create-ailk 0.22.0 → 0.23.0

package/templates/apps/api/src/server.ts

@@ -11,18 +11,18 @@
  */
 import cors from "@fastify/cors";
 import rateLimit from "@fastify/rate-limit";
-import { idRegex } from "@working-theory/ids";
 import { logger } from "@working-theory/observability";
 import Fastify from "fastify";
 import type {
   FastifyPluginAsync,
   FastifyPluginCallback,
+  FastifyReply,
   FastifyRequest,
 } from "fastify";
 
 import { config } from "./config/index.js";
 import { isModuleEnabled, servedModules } from "./config/modules.js";
-import { registerErrorSerializer } from "./lib/error-serializer.js";
+import { redactLogPath, registerErrorSerializer } from "./lib/error-serializer.js";
 import { validateLeadCaptureDir } from "./lib/lead-capture-store.js";
 import { registerLicenseKeyStore } from "./lib/license-key-store.js";
 import { requireCommerceClaim } from "./lib/require-commerce-claim.js";
@@ -35,7 +35,10 @@ import {
   buildTrustedKeyDigests,
   DEFAULT_SCHEDULE_PER_KEY_PER_MINUTE,
   DEFAULT_PER_IP_PER_MINUTE_STRICT,
+  DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
   resolveRateLimitIdentity,
+  SITE_KEY_IDENTITY_PREFIX,
+  siteKeyReader,
 } from "./middleware/rate-limit.js";
 import { openapiRoutes } from "./openapi/index.js";
 import {
@@ -65,12 +68,18 @@ import {
 import { getPageRoute } from "./routes/content/get-page.js";
 import { listPagesRoute } from "./routes/content/list-pages.js";
 import { listTypesRoute } from "./routes/content/list-types.js";
+import { offeringsRoute } from "./routes/content/offerings.js";
+import { pricingRoute } from "./routes/content/pricing.js";
 import {
   CONTENT_RATE_LIMIT_AUTH,
   CONTENT_RATE_LIMIT_UNAUTH,
   CONTENT_RATE_LIMIT_WINDOW,
 } from "./routes/content/rate-limit.js";
 import { searchContentRoute } from "./routes/content/search.js";
+import {
+  shownOfferingsRoute,
+  type ShownOfferingsRouteOptions,
+} from "./routes/content/shown-offerings.js";
 import {
   leadCallbackRoute,
   leadCaptureStatusRoute,
@@ -84,6 +93,8 @@ import {
   shouldMountTestAuth,
 } from "./routes/test/auth/session.js";
 import { consentLinkSecretConfigured } from "./services/consent.js";
+import { stripeCatalogSourceFor } from "./services/offerings/source.js";
+import { resolveCallerSite } from "./services/public-site-resolver.js";
 
 /**
  * What a request looks like in a log line — Fastify's own default shape, minus
@@ -99,56 +110,43 @@ import { consentLinkSecretConfigured } from "./services/consent.js";
  * Nothing that identifies a request is lost: a route parameter such as `:id`
  * lives in the PATH and survives. Only the secret after `?` is dropped.
  *
- * #6084 D14 — `GET /v1/checkout/sessions/:id` puts its credential in the
- * PATH, not the query string, so the strip above does not cover it: every
- * request would otherwise write a live `cs_…` Checkout Session id into the
- * log — contradicting D3 and `sessions.ts`'s own stated invariant that only
- * the first 8 characters of a session id ever reach a log line. A path
- * SEGMENT rule (never a substring replace) truncates any `cs_…`-shaped
- * segment to its first 8 characters plus `…`, so it cannot corrupt an
- * unrelated URL.
- *
- * #6216 D11/§ 9 A-3 — the SAME rule now carries a second arm for
- * `lead_…`-shaped segments. Fastify's automatic "incoming request" line is
- * emitted by its internal hook BEFORE any route hook can intervene, so
- * every `GET`/`PATCH .../workspaces/:workspaceId/messages/:leadId` would
- * otherwise write the lead id into the log beside `remoteAddress` —
- * completing exactly the `leadId` ↔ `siteId`/`ip`/`user-agent` correlation
- * `routes/leads/index.ts` and this file's own PII posture refuse. No
- * route-level discipline can fix it; this is the only place that can.
+ * Path segments that are themselves credentials or identifiers — a `cs_…`
+ * Checkout Session id (#6084 D14), a `lead_…` id (#6216 D11), a `person_…` id
+ * (#8438 SEC-8438-10) and a webhook connection token (#8932 D10) — are
+ * redacted by `redactLogPath` (`lib/error-serializer.ts`), the ONE path
+ * redactor this serializer and the global error handler share, so a request
+ * line and an error line can never disagree about what a path may carry.
+ * Fastify's automatic "incoming request" line is emitted by its internal hook
+ * BEFORE any route hook can intervene, so no route-level discipline can fix
+ * it; this is the only place that can.
  */
-const SESSION_ID_LOG_SEGMENT = /^cs_[A-Za-z0-9_]+$/;
-const LEAD_ID_LOG_SEGMENT = idRegex("lead");
-// #8438 SEC-8438-10 — a third arm for `person_…` segments. The consents route
-// (and every other `…/people/:personId…` route) would otherwise write a full
-// Person id into the request log line, beside `remoteAddress`.
-const PERSON_ID_LOG_SEGMENT = idRegex("person");
-
-function redactSensitiveIdSegments(url: string): string {
-  return url
-    .split("/")
-    .map((segment) =>
-      SESSION_ID_LOG_SEGMENT.test(segment) ||
-      LEAD_ID_LOG_SEGMENT.test(segment) ||
-      PERSON_ID_LOG_SEGMENT.test(segment)
-        ? `${segment.slice(0, 8)}…`
-        : segment,
-    )
-    .join("/");
-}
-
 export function requestLogSerializer(request: FastifyRequest) {
-  const raw = request.url;
-  const queryAt = raw.indexOf("?");
-  const path = queryAt === -1 ? raw : raw.slice(0, queryAt);
   return {
     method: request.method,
-    url: redactSensitiveIdSegments(path),
+    url: redactLogPath(request.url),
     host: request.hostname,
     remoteAddress: request.ip,
   };
 }
 
+/**
+ * Fastify's default 404, with the logged path redacted (#8932 SEC-8932-10).
+ * The default handler logs `Route METHOD:URL not found` with the raw URL in
+ * the message, where `requestLogSerializer` never reaches, so a mis-pasted
+ * webhook URL — a trailing slash, a double slash, an extra segment — would
+ * log its connection token on every Stripe retry. The answer is the default
+ * one, byte for byte; only the log line changes.
+ */
+export function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {
+  const { method, url = "" } = request.raw;
+  request.log.info(`Route ${method}:${redactLogPath(url)} not found`);
+  return reply.code(404).send({
+    message: `Route ${method}:${url} not found`,
+    error: "Not Found",
+    statusCode: 404,
+  });
+}
+
 /**
  * Paid-module SLICE entry points, keyed by the export each branch needs
  * (#5182).
@@ -234,6 +232,8 @@ const WORKSPACES_MESSAGES = "./routes/workspaces/messages.js";
 // #7535 — the Inbox submissions and subscribers reads, siblings of
 // WORKSPACES_MESSAGES in the same workspace/multi-tenant scope.
 const WORKSPACES_SUBMISSIONS = "./routes/workspaces/submissions.js";
+// #9170 — the Inbox orders read, the SAME scope.
+const WORKSPACES_ORDERS = "./routes/workspaces/orders.js";
 const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
 // #852 D8 — the People reads (the workspace's clients), the SAME scope.
 const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
@@ -289,6 +289,7 @@ const ASSETS_UPLOAD = "./routes/assets/upload.js";
 const ASSETS_READ = "./routes/assets/read.js";
 const ASSETS_MANAGE = "./routes/assets/manage.js";
 const BILLING_INDEX = "./routes/billing/index.js";
+const WORKSPACES_OFFERINGS = "./routes/workspaces/offerings.js";
 const WAITLIST_EXPERIMENTS_INDEX = "./routes/waitlist-experiments/index.js";
 const SCHEDULE_INDEX = "./routes/schedule/index.js";
 const FLOWS_INDEX = "./routes/flows/index.js";
@@ -346,6 +347,11 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_SUBMISSIONS,
     load: () => import(WORKSPACES_SUBMISSIONS),
   },
+  // #9170 — the Inbox orders read, the SAME scope.
+  workspaceOrderRoutes: {
+    specifier: WORKSPACES_ORDERS,
+    load: () => import(WORKSPACES_ORDERS),
+  },
   workspaceSubscriberRoutes: {
     specifier: WORKSPACES_SUBSCRIBERS,
     load: () => import(WORKSPACES_SUBSCRIBERS),
@@ -481,6 +487,11 @@ const SLICE_PLUGINS = {
     specifier: BILLING_INDEX,
     load: () => import(BILLING_INDEX),
   },
+  // #8926 D1 — the workspace Offerings routes, multi-tenant only.
+  workspaceOfferingsRoutes: {
+    specifier: WORKSPACES_OFFERINGS,
+    load: () => import(WORKSPACES_OFFERINGS),
+  },
   waitlistExperimentRoutes: {
     specifier: WAITLIST_EXPERIMENTS_INDEX,
     load: () => import(WAITLIST_EXPERIMENTS_INDEX),
@@ -504,6 +515,11 @@ const SLICE_PLUGINS = {
     specifier: SCHEDULE_INDEX,
     load: () => import(SCHEDULE_INDEX),
   },
+  // #8843 D1 — the meetings read; same specifier as its schedule siblings.
+  listMeetingsRoute: {
+    specifier: SCHEDULE_INDEX,
+    load: () => import(SCHEDULE_INDEX),
+  },
   // #6085 — the tenant-guarded appointments read; same specifier as the
   // three anonymous schedule routes above (§ D6, no new SLICE_PLUGINS
   // specifier constant needed).
@@ -539,6 +555,11 @@ const SLICE_PLUGINS = {
     specifier: DELIVERABLES_INDEX,
     load: () => import(DELIVERABLES_INDEX),
   },
+  // #8848 D5 — an ungated file's bytes, in its own `deliverableopen` scope.
+  deliverableOpenRoute: {
+    specifier: DELIVERABLES_INDEX,
+    load: () => import(DELIVERABLES_INDEX),
+  },
   projectListingStartRoute: {
     specifier: PROJECT_LISTINGS_INDEX,
     load: () => import(PROJECT_LISTINGS_INDEX),
@@ -840,6 +861,17 @@ export async function build() {
     (msg) => server.log.warn(msg),
   );
 
+  // #8805 — the sign-up evidence read's site key, verified once per request
+  // and shared by the global ceiling and the `signupevidence` scope below. A
+  // registered, unrevoked spoke key (`resolveCallerSite`, the registry lookup
+  // every spoke-aware route uses) is counted per key; a malformed, unknown or
+  // revoked one, or none, keeps `req.ip`. It decides the bucket only — the
+  // route still serves `resolveSiteWorkspaceId()`.
+  const signUpEvidenceSiteKey = siteKeyReader(async (req) => {
+    const caller = await resolveCallerSite(req);
+    return caller.kind === "spoke" ? caller.spokeId : null;
+  });
+
   // Collect the route table this server registers (#5314).
   //
   // Installed here — after `Fastify()` and before the first `register()` — so
@@ -870,6 +902,7 @@ export async function build() {
   // so connection strings, hostnames, stack traces, and SDK error details
   // never reach the client. Full detail still goes to pino at error level.
   registerErrorSerializer(server);
+  server.setNotFoundHandler(notFoundHandler);
 
   // Register CORS — public read API + the trusted browser origins (#7395).
   // `origin` is ALWAYS a copy of `config.TRUSTED_ORIGINS`, the frozen list
@@ -918,11 +951,23 @@ export async function build() {
   // visitor's own ceiling here too, or a spoke whose visitors share one
   // egress IP would still be capped at this limit in total. For every other
   // request it returns `req.ip`, the plugin's own default key.
+  //
+  // #8805: a sign-up evidence read with a verified site key is keyed
+  // `site,<spokeId>` and let through here — its scope's per-key ceiling is
+  // its one limit, so an anonymous caller spoofing the web's egress address
+  // cannot spend it, and many web instances behind that address share no
+  // IP bucket.
   await server.register(rateLimit, {
     max: CONTENT_RATE_LIMIT_UNAUTH,
     timeWindow: CONTENT_RATE_LIMIT_WINDOW,
-    keyGenerator: (req) =>
-      resolveRateLimitIdentity(req, visitorForwardKeyDigests).identity,
+    keyGenerator: async (req) => {
+      const siteId = await signUpEvidenceSiteKey(req);
+      return siteId === null
+        ? resolveRateLimitIdentity(req, visitorForwardKeyDigests).identity
+        : `${SITE_KEY_IDENTITY_PREFIX}${siteId}`;
+    },
+    allowList: (_req, key) =>
+      typeof key === "string" && key.startsWith(SITE_KEY_IDENTITY_PREFIX),
   });
 
   // Health check
@@ -1122,6 +1167,10 @@ export async function build() {
         await tenantScope.register(await sliceRoutePlugin("sessionRoutes"));
         // Org-billing routes (#3701) — org-scoped read + Stripe customer-portal.
         await tenantScope.register(await sliceRoutePlugin("billingRoutes"));
+        // The workspace Offerings routes (#8926 D1) — the Library → Offerings
+        // tab's read and its selection write, beside the billing routes that
+        // write the Stripe connection they need.
+        await tenantScope.register(await sliceRoutePlugin("workspaceOfferingsRoutes"));
       });
     }
 
@@ -1268,6 +1317,11 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspaceSubscriberRoutes"),
         );
+        // The Inbox orders read (#9170) — the SAME scope and guard: the
+        // workspace's purchases (list, item read), behind `inbox-read`.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceOrderRoutes"),
+        );
         // The People reads (#852 D8) — the SAME scope and guard: the
         // workspace's clients and one Person with its derived timeline,
         // behind `people-read` (owner, admin, a granted agent).
@@ -1385,8 +1439,20 @@ export async function build() {
     await server.register(await sliceRoutePlugin("publicAssetReadRoute"));
   }
   await server.register(listTypesRoute);
-  // Before `listPagesRoute`: `search` must never be read as a `:type`.
+  // Before `listPagesRoute`: `search`, `offerings`, `pricing` and
+  // `shown-offerings` must never be read as a `:type`.
   await server.register(searchContentRoute);
+  // The Organization's Stripe catalog source (#8922), so a stale snapshot
+  // refreshes on the service's bounded, never-forced path (#8924 D7, #9124;
+  // the bounds are `refreshWorkspaceSnapshot`'s). The two agent twins read
+  // the shown set through the same read with these same options, so all
+  // three refresh together (#8933 D5).
+  const shownSetRouteOptions: ShownOfferingsRouteOptions = {
+    sourceFor: stripeCatalogSourceFor,
+  };
+  await server.register(offeringsRoute, shownSetRouteOptions);
+  await server.register(pricingRoute, shownSetRouteOptions);
+  await server.register(shownOfferingsRoute, shownSetRouteOptions);
   await server.register(listPagesRoute);
   await server.register(getPageRoute);
   // The hub's sign-in page names the spoke that sent a visitor (#8790 D2):
@@ -1471,6 +1537,20 @@ export async function build() {
   // (signal-collectors, D-48): gated PDFs and reports.
   if (isModuleEnabled("signal-collectors")) {
     await server.register(await sliceRoutePlugin("deliverableDownloadRoute"));
+    // #8848 D5 — the ungated file read, anonymous and keyed by slug, so it
+    // gets its OWN encapsulated scope: `rateLimitMiddleware` breaks
+    // encapsulation, so it is never installed on the grant route's
+    // registration above, whose budget stays as it is. With the hub's
+    // forward-key digests (the route is on FORWARDED_VISITOR_ROUTES), a
+    // site's proxied reads are counted per visitor (SEC-8848-C).
+    await server.register(async (deliverableOpenScope) => {
+      deliverableOpenScope.register(rateLimitMiddleware, {
+        perIpPerMinute: 60,
+        scope: "deliverableopen",
+        trustedKeyDigests: visitorForwardKeyDigests,
+      });
+      await deliverableOpenScope.register(await sliceRoutePlugin("deliverableOpenRoute"));
+    });
   }
 
   // Webhooks routes — raw-body parser scoped to this sub-router only so the
@@ -1586,15 +1666,20 @@ export async function build() {
     await unsubscribeScope.register(consentUnsubscribeRoute);
   });
   // #8765 D2 — the sign-up agreements' evidence, beside the consent floor:
-  // anonymous, keyless, outside every module gate (sign-up and consent are
-  // never-gate surfaces). Its own scope, `signupevidence`, so an anonymous
-  // burst never shares a bucket with the cookie banner's log (SEC-8765-D).
-  // Its main caller is the web's own server, whose cache keeps it to one call
-  // a minute per enabled locale per instance.
+  // anonymous, outside every module gate (sign-up and consent are never-gate
+  // surfaces). Its own scope, `signupevidence`, so an anonymous burst never
+  // shares a bucket with the cookie banner's log (SEC-8765-D). Its main
+  // caller is the web's own server, whose cache keeps it to one call a minute
+  // per enabled locale per instance. #8805: a call with a verified site key
+  // is counted per key (DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
+  // AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE), never per IP; any
+  // other call keeps 10 a minute per IP.
   await server.register(async (signUpEvidenceScope) => {
     signUpEvidenceScope.register(rateLimitMiddleware, {
       perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
+      perKeyPerMinute: DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
       scope: "signupevidence",
+      siteKeyOf: signUpEvidenceSiteKey,
     });
     await signUpEvidenceScope.register(consentSignUpRoute);
   });
@@ -1772,6 +1857,10 @@ export async function build() {
       await scheduleScope.register(
         await sliceRoutePlugin("meetingTypesRoute"),
       );
+      // #8843 D1 — the meetings read: the same gate and per-IP limit.
+      await scheduleScope.register(
+        await sliceRoutePlugin("listMeetingsRoute"),
+      );
     });
   }
 

package/templates/apps/api/src/services/__tests__/checkout-plan.test.ts

@@ -0,0 +1,313 @@
+/**
+ * @file checkout-plan.test.ts
+ * @description The hub's checkout plan rule end to end (#8793, spec
+ * docs/specs/8793-the-hub-s-checkout-plan-spec.md D1–D3; AC-3, AC-4, AC-5):
+ * a spoke's marked checkout lead never writes a Person's plan — it holds it —
+ * and the held plan is released only when `resolveMemberPersonId` first links
+ * the Person to the signed-in user whose VERIFIED email is the Person's own.
+ * A checkout that types another Person's email cannot change that Person's
+ * plan, and the lead, the purchase message, the purchase email and the
+ * consent grant are written exactly as before.
+ *
+ * Runs `routeLead` and `resolveMemberPersonId` with the real `person.ts`
+ * over `createInMemoryPrisma()`, which enforces the Person's
+ * `(workspaceId, email)` and `(workspaceId, userId)` keys.
+ *
+ * External dependency boundaries mocked:
+ *   - apps/api/src/lib/prisma — the in-memory, where-clause-honouring double.
+ *     Its `lead.count` is arranged per test: the purchase email's cap reads
+ *     with `mode: "insensitive"`, a filter the double does not model.
+ *   - @working-theory/email — the operator notification and purchase email.
+ *   - ../plan-offerings.js — the workspace's content-adapter read.
+ *   - consent.recordCheckoutConsent — spied; the ledger's own transaction is
+ *     `consent.test.ts`'s, and here only its call is the claim.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
+jest.mock("../../lib/prisma.js", () =>
+  jest
+    .requireActual<typeof import("../../__tests__/factories/in-memory-prisma")>(
+      "../../__tests__/factories/in-memory-prisma",
+    )
+    .createInMemoryPrisma(),
+);
+
+const mockSendLeadNotification = jest.fn();
+const mockSendPurchaseConfirmationEmail = jest.fn();
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: (...args: unknown[]) =>
+    mockSendLeadNotification(...args),
+  sendPurchaseConfirmationEmail: (...args: unknown[]) =>
+    mockSendPurchaseConfirmationEmail(...args),
+}));
+
+const mockListPlanOfferings = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- plan-offerings.ts is the workspace's content-adapter read (the database adapter, an external boundary), the same seam lead-routing.test.ts mocks.
+jest.mock("../plan-offerings.js", () => ({
+  listPlanOfferings: (...args: unknown[]) => mockListPlanOfferings(...args),
+}));
+
+import { logger } from "@working-theory/observability";
+
+import { prisma } from "../../lib/prisma.js";
+import * as consent from "../consent";
+import { routeLead } from "../lead-routing";
+import { resolveMemberPersonId } from "../person";
+
+type Row = Record<string, unknown>;
+// The in-memory double's own surface (`__db`, `__calls`) is not on the
+// PrismaClient type the import carries, so it is named here once.
+// eslint-disable-next-line no-restricted-syntax -- justified above
+const store = prisma as unknown as {
+  __db: Record<string, Row[]>;
+  lead: Record<string, jest.Mock>;
+};
+
+const WS = "wksp_00000000-0000-7000-8000-000000008793";
+const KEY = "cs_live_h8793Hold"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8793 AC-3), not a credential
+const KEY_2 = "cs_live_h8793Hold2"; // gitleaks:allow -- a second synthetic Checkout Session id shape (#8793 AC-4), not a credential
+const VICTIM = "victim@x.io";
+const U = "user_00000000-0000-7000-8000-000000008793";
+const ENV_KEYS = [
+  "DATABASE_URL",
+  "NODE_ENV",
+  "AILK_LEAD_NOTIFICATION_TO",
+  "AILK_LEAD_NOTIFICATION_FROM",
+  "AILK_DELIVERABLE_EMAIL_FROM",
+] as const;
+
+const sourceMeta = {
+  ip: "127.0.0.1",
+  userAgent: "jest",
+  receivedAt: new Date().toISOString(),
+  viaSpoke: true,
+};
+
+const people = () => (store.__db["person"] ??= []);
+const users = () => (store.__db["user"] ??= []);
+const leads = () => (store.__db["lead"] ??= []);
+const interactions = () => (store.__db["interaction"] ??= []);
+const victim = () => people().find((p) => p["email"] === VICTIM);
+
+function checkout(email: string, offering: string, extra: Row = {}) {
+  return {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email,
+    payload: {
+      site: "wendi",
+      page: "checkout",
+      offering,
+      amountTotal: 900,
+      currency: "usd",
+      ...extra,
+    } as Record<string, unknown>,
+  };
+}
+
+/** A Person of `WS`, optionally linked to a verified user. */
+function seedVictim(row: { userId?: string; planOffering?: string | null }): void {
+  people().push({
+    id: "person_00000000-0000-7000-8000-000000008793",
+    workspaceId: WS,
+    email: VICTIM,
+    name: null,
+    userId: null,
+    billingProvider: null,
+    billingCustomerId: null,
+    planOffering: null,
+    contactConfirmedAt: null,
+    contactConfirmedBy: null,
+    createdAt: new Date(Date.UTC(2026, 0, 1)),
+    ...row,
+  });
+}
+
+const verifiedUser = (id: string, email: string) =>
+  users().push({ id, email, emailVerified: true });
+
+let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+let info: jest.SpyInstance;
+let recordGrant: jest.SpyInstance;
+
+const planLines = () =>
+  info.mock.calls
+    .map(([fields]) => fields as Row)
+    .filter((fields) => fields?.["event"] === "checkout-plan");
+
+/** Let the fired (void) purchase email run to its end. */
+const settle = async () => {
+  for (let i = 0; i < 5; i += 1)
+    await new Promise((resolve) => setImmediate(resolve));
+};
+
+beforeEach(() => {
+  for (const key of Object.keys(store.__db)) delete store.__db[key];
+  saved = {};
+  for (const k of ENV_KEYS) saved[k] = process.env[k];
+  process.env.DATABASE_URL = "postgres://stub";
+  delete process.env.NODE_ENV;
+  process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+  process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+  process.env.AILK_DELIVERABLE_EMAIL_FROM = "orders@example.com";
+  mockSendLeadNotification.mockReset().mockResolvedValue({ ok: true, messageId: "m" });
+  mockSendPurchaseConfirmationEmail
+    .mockReset()
+    .mockResolvedValue({ ok: true, messageId: "m2" });
+  mockListPlanOfferings.mockReset().mockResolvedValue([]);
+  store.lead["count"]!.mockReset().mockResolvedValue(1);
+  info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
+  recordGrant = jest
+    .spyOn(consent, "recordCheckoutConsent")
+    .mockResolvedValue("recorded");
+});
+
+afterEach(() => {
+  for (const k of ENV_KEYS) {
+    if (saved[k] === undefined) delete process.env[k];
+    else process.env[k] = saved[k];
+  }
+  info.mockRestore();
+  recordGrant.mockRestore();
+});
+
+describe("a checkout that types another Person's email cannot change that Person's plan (#8793 AC-3)", () => {
+  it("a linked victim's set plan stays, and the checkout's line is held", async () => {
+    verifiedUser(U, VICTIM);
+    seedVictim({ userId: U, planOffering: "premium" });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(victim()!["planOffering"]).toBe("premium");
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
+  });
+
+  it("a linked victim's blank plan stays blank, through the victim's next member read", async () => {
+    verifiedUser(U, VICTIM);
+    seedVictim({ userId: U });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(victim()!["planOffering"]).toBeNull();
+    expect(await resolveMemberPersonId(WS, U, VICTIM)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBeNull();
+  });
+
+  it("a stranger's later purchase cannot decide an unlinked victim's held plan", async () => {
+    seedVictim({});
+    leads().push({
+      id: "lead_00000000-0000-7000-8000-000000000001",
+      workspaceId: WS,
+      siteId: WS,
+      personId: victim()!["id"],
+      email: VICTIM,
+      source: "web",
+      spokeCheckout: true,
+      payload: { site: "wendi", page: "checkout", offering: "wendi_premium" },
+      createdAt: new Date(Date.UTC(2026, 0, 2)),
+    });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    verifiedUser(U, VICTIM);
+    const log = { warn: jest.fn() };
+    expect(await resolveMemberPersonId(WS, U, VICTIM, log)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBeNull();
+    // The release ran and refused: the purchases disagree.
+    expect(log.warn).toHaveBeenCalledWith(
+      { event: "checkout-plan-release", outcome: "ambiguous" },
+      expect.any(String),
+    );
+  });
+
+  it("an unlinked victim's operator-set plan stays through the first link", async () => {
+    seedVictim({ planOffering: "premium" });
+    await routeLead(checkout("VICTIM@x.io", "wendi_basic"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    verifiedUser(U, VICTIM);
+    expect(await resolveMemberPersonId(WS, U, VICTIM)).toBe(victim()!["id"]);
+    expect(victim()!["planOffering"]).toBe("premium");
+  });
+});
+
+describe("a real buyer still gets the plan at their verified first link (#8793 AC-4)", () => {
+  const BUYER = "new@x.io";
+  const buyer = () => people().find((p) => p["email"] === BUYER)!;
+  // A Person the capture created carries no `planOffering` key in the double
+  // (Postgres reads the unwritten column back as `null`).
+  const buyerPlan = () => buyer()["planOffering"] ?? null;
+
+  it("the checkout holds, and the buyer's first member read releases it", async () => {
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(buyerPlan()).toBeNull();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
+    verifiedUser(U, BUYER);
+    expect(await resolveMemberPersonId(WS, U, BUYER)).toBe(buyer()["id"]);
+    expect(buyerPlan()).toBe("retainer");
+  });
+
+  it("a second purchase of the same offering under a new key still releases it", async () => {
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY,
+    });
+    await routeLead(checkout(BUYER, "wendi_retainer"), sourceMeta, {
+      idempotencyKey: KEY_2,
+    });
+    expect(leads()).toHaveLength(2);
+    verifiedUser(U, BUYER);
+    expect(await resolveMemberPersonId(WS, U, BUYER)).toBe(buyer()["id"]);
+    expect(buyerPlan()).toBe("retainer");
+  });
+});
+
+describe("the lead, the purchase message, the purchase email and the consent grant are unchanged (#8793 AC-5)", () => {
+  it.each([
+    ["linked with a plan", { userId: U, planOffering: "premium" }],
+    ["linked with no plan", { userId: U }],
+    ["unlinked", {}],
+  ] as const)("victim %s", async (_label, victimRow) => {
+    verifiedUser(U, VICTIM);
+    seedVictim(victimRow);
+    const terms = consent.currentAccountTermsStamp()!;
+    const result = await routeLead(
+      checkout("VICTIM@x.io", "wendi_basic", { termsAccepted: terms.stamp }),
+      sourceMeta,
+      { idempotencyKey: KEY },
+    );
+    await settle();
+    const personId = victim()!["id"];
+    expect(result).toEqual({
+      ok: true,
+      id: leads()[0]!["id"],
+      personId,
+      persisted: "db",
+      email: expect.anything(),
+    });
+    expect(leads()).toHaveLength(1);
+    expect(leads()[0]).toMatchObject({ spokeCheckout: true, personId });
+    expect(interactions()).toHaveLength(1);
+    expect(interactions()[0]).toMatchObject({
+      personId,
+      channel: "member",
+      direction: "outbound",
+      subject: "Your purchase",
+      createdBy: "system:checkout",
+    });
+    expect(mockSendPurchaseConfirmationEmail).toHaveBeenCalledTimes(1);
+    expect(recordGrant).toHaveBeenCalledTimes(1);
+    expect(recordGrant).toHaveBeenCalledWith({
+      workspaceId: WS,
+      personId,
+      sessionId: KEY,
+      policyVersion: terms.policyVersion,
+    });
+  });
+});