create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/app/api/auth/hub/authorize/route.ts

@@ -12,6 +12,7 @@
  *       ?response_type=code&client_id=…&redirect_uri=…&state=…
  *       &code_challenge=…&code_challenge_method=S256
  *       [&login_hint=<email>]   (optional, #8757 D9 — see below)
+ *       [&prompt=create]        (optional, #9912 D3 — see below)
  *
  *   - a malformed query is a 400 and NEVER a redirect;
  *   - no Better Auth session: the six validated keys are sealed into a short
@@ -27,6 +28,11 @@
  *     the REGISTERED redirect URI the API echoes back, with `code` and the
  *     same `state` — never to the query's own `redirect_uri` until the API has
  *     confirmed it is the client's;
+ *   - a person who has not said yes to this spoke (403 `consent_required`,
+ *     #9966 D2) goes to the hub's own consent page, `/account/connect?ref=…`,
+ *     with the six keys sealed as the no-session branch seals them. The GET
+ *     never sends `consent`: a spoke can send a visitor here on page load, so
+ *     a GET must never be the yes;
  *   - a person whose email is not verified (403 `email_unverified`) goes to the
  *     hub's own `/account/settings`, whose For-you item says how to verify —
  *     never to the spoke;
@@ -41,6 +47,24 @@
  * route rebuilds the query from the ref, so the hint is gone after sign-in —
  * and with a session it is ignored.
  *
+ * `prompt=create` (#9912 D3) is the spoke's "Sign up": read beside
+ * `login_hint` by the same once-only rule (repeated → 400, before the session
+ * read). On the no-session branch exactly `create` sends the visitor to
+ * `/sign-up?next=<the same continue path>` instead of `/sign-in`, with no
+ * `email`; any other value does nothing. It never enters the ref — so a
+ * password sign-up, which ends with no session, comes back through the
+ * continuation to `/sign-in` — nor a code or a cookie, and with a session it
+ * is ignored: the person has an account, and the spoke signs them in.
+ *
+ *   POST /api/auth/hub/authorize   (form field `ref`, #9966 D2)
+ *
+ *   - the consent page's Continue. Accepted only with `Sec-Fetch-Site:
+ *     same-origin` and an `Origin` equal to the pinned origin (a missing or
+ *     `null` Origin is refused), before any session read; the ref is opened
+ *     and its query re-validated, and the session branch runs as GET's does,
+ *     with `consent: true` — and `x-internal-auth` where the API requires it —
+ *     on the code request. This is the one call site that sends consent.
+ *
  * `BETTER_AUTH_URL` pins the `Origin` sent with the cookie-authenticated write
  * (Node's `fetch` sets none). Unset, the step answers 503: it needs a pinned
  * origin, exactly as the emailed link does.
@@ -54,13 +78,17 @@ import { hubSignIn } from "@working-theory/api-client";
 import {
   accountEmailHintSchema,
   hubAuthorizeQuerySchema,
+  type HubAuthorizeQuery,
 } from "@working-theory/validation";
 
 import { auth, resolveSecret } from "../../../../../auth";
+import { browserApiOrigin } from "../../../../../lib/api-origin.generated";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import {
   CONTINUATION_REF_MAX,
   CONTINUE_PATH,
   mintContinuation,
+  openContinuation,
 } from "../continuation";
 
 /** The six query keys, each read exactly once. */
@@ -76,6 +104,11 @@ const QUERY_KEYS = [
 /** Where an unverified person is sent to verify: the hub's own account page. */
 const VERIFY_EMAIL_PATH = "/account/settings";
 
+/** The hub's consent page, where a person says yes to one spoke (#9966 D2). */
+const CONSENT_PATH = "/account/connect";
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+
 function json(status: number, error: string): Response {
   return new Response(JSON.stringify({ error }), {
     status,
@@ -110,38 +143,50 @@ function pinnedOrigin(): string | null {
   }
 }
 
-// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
-export async function GET(request: Request): Promise<Response> {
-  const url = new URL(request.url);
-
-  // Each declared key exactly once: a repeated key is ambiguous, so 400.
-  const raw: Record<string, string | undefined> = {};
-  for (const key of QUERY_KEYS) {
-    const values = url.searchParams.getAll(key);
-    if (values.length > 1) return json(400, "invalid_request");
-    raw[key] = values[0];
-  }
-  // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
-  const hints = url.searchParams.getAll("login_hint");
-  if (hints.length > 1) return json(400, "invalid_request");
-  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
-  if (!parsed.success) return json(400, "invalid_request");
-  const query = parsed.data;
-  const hint = accountEmailHintSchema.safeParse(hints[0]);
+/** The six validated keys as a sealed continuation ref, or `null` past the cap. */
+function sealQuery(query: HubAuthorizeQuery): string | null {
+  // Only the six validated keys, in QUERY_KEYS order: a ref carries nothing
+  // that did not pass the schema, and extra or reordered keys are dropped.
+  const canonical = new URLSearchParams();
+  for (const key of QUERY_KEYS) canonical.set(key, query[key]);
+  const ref = mintContinuation(canonical.toString(), resolveSecret());
+  return ref.length > CONTINUATION_REF_MAX ? null : ref;
+}
 
-  const session = await auth.api.getSession({ headers: request.headers });
-  if (!session) {
-    // Only the six validated keys, in QUERY_KEYS order: a ref carries nothing
-    // that did not pass the schema, and extra or reordered keys are dropped.
-    const canonical = new URLSearchParams();
-    for (const key of QUERY_KEYS) canonical.set(key, query[key]);
-    const ref = mintContinuation(canonical.toString(), resolveSecret());
-    if (ref.length > CONTINUATION_REF_MAX) return json(400, "invalid_request");
-    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
-    if (hint.success) signIn.set("email", hint.data);
-    return see(`/sign-in?${signIn.toString()}`);
+/**
+ * `x-internal-auth` for the consent-bearing code request, under the Offerings
+ * buy route's `startHeaders` rule: only from a site that is not a spoke, and
+ * only to an `https:` or loopback API, so the secret never crosses a plain
+ * network hop. The API honours `consent: true` only beside it where it is set.
+ */
+function internalAuthHeader(): Record<string, string> {
+  const secret = process.env.OSS_API_INTERNAL_SECRET;
+  const spoke = TOPOLOGY === "spoke" || !!process.env.AILK_SPOKE_KEY?.trim();
+  if (!secret || spoke) return {};
+  try {
+    const api = new URL(
+      process.env.AILK_API_URL ||
+        browserApiOrigin() ||
+        process.env.NEXT_PUBLIC_API_URL ||
+        "http://localhost:3001",
+    );
+    const safe = api.protocol === "https:" || LOOPBACK_HOSTS.has(api.hostname);
+    return safe ? { "x-internal-auth": secret } : {};
+  } catch {
+    return {};
   }
+}
 
+/**
+ * The session branch, shared by GET and the consent POST: ask the API for a
+ * code and answer with where the visitor goes next. Only the POST passes
+ * `consent` (#9966 D2).
+ */
+async function codeRedirect(
+  request: Request,
+  query: HubAuthorizeQuery,
+  consent: boolean,
+): Promise<Response> {
   const origin = pinnedOrigin();
   if (origin === null) return json(503, "temporarily_unavailable");
 
@@ -152,11 +197,13 @@ export async function GET(request: Request): Promise<Response> {
         clientId: query.client_id,
         redirectUri: query.redirect_uri,
         codeChallenge: query.code_challenge,
+        ...(consent ? { consent: true as const } : {}),
       },
       {
         headers: {
           cookie: request.headers.get("cookie") ?? "",
           origin,
+          ...(consent ? internalAuthHeader() : {}),
         },
       },
     );
@@ -184,5 +231,90 @@ export async function GET(request: Request): Promise<Response> {
   if (result.status === 403 && code === "email_unverified") {
     return see(VERIFY_EMAIL_PATH);
   }
+  // Not yet said yes to this spoke: ask, on the hub's own page. The POST that
+  // page sends already carries consent, so it never comes back here.
+  if (!consent && result.status === 403 && code === "consent_required") {
+    const ref = sealQuery(query);
+    if (ref === null) return json(400, "invalid_request");
+    return see(`${CONSENT_PATH}?${new URLSearchParams({ ref }).toString()}`);
+  }
   return json(400, "invalid_request");
 }
+
+// platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
+export async function GET(request: Request): Promise<Response> {
+  const url = new URL(request.url);
+
+  // Each declared key exactly once: a repeated key is ambiguous, so 400.
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) {
+    const values = url.searchParams.getAll(key);
+    if (values.length > 1) return json(400, "invalid_request");
+    raw[key] = values[0];
+  }
+  // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
+  const hints = url.searchParams.getAll("login_hint");
+  if (hints.length > 1) return json(400, "invalid_request");
+  // #9912 D3 — the sign-up hint, by the same rule; only `create` acts.
+  const prompts = url.searchParams.getAll("prompt");
+  if (prompts.length > 1) return json(400, "invalid_request");
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  if (!parsed.success) return json(400, "invalid_request");
+  const query = parsed.data;
+  const hint = accountEmailHintSchema.safeParse(hints[0]);
+
+  const session = await auth.api.getSession({ headers: request.headers });
+  if (!session) {
+    const ref = sealQuery(query);
+    if (ref === null) return json(400, "invalid_request");
+    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    if (prompts[0] === "create") return see(`/sign-up?${signIn.toString()}`);
+    if (hint.success) signIn.set("email", hint.data);
+    return see(`/sign-in?${signIn.toString()}`);
+  }
+
+  return codeRedirect(request, query, false);
+}
+
+/**
+ * The consent page's Continue (#9966 D2): the one request that says yes to a
+ * spoke. Same-origin only, decided before any session read, so neither a
+ * cross-site form nor a sandboxed frame (`Origin: null`) can post it.
+ */
+export async function POST(request: Request): Promise<Response> {
+  const origin = pinnedOrigin();
+  if (origin === null) return json(503, "temporarily_unavailable");
+  const sent = request.headers.get("origin");
+  if (
+    request.headers.get("sec-fetch-site") !== "same-origin" ||
+    sent === null ||
+    sent !== origin
+  ) {
+    return json(403, "invalid_request");
+  }
+
+  let refs: FormDataEntryValue[];
+  try {
+    refs = (await request.formData()).getAll("ref");
+  } catch {
+    return json(400, "invalid_request");
+  }
+  const [ref] = refs;
+  if (refs.length !== 1 || typeof ref !== "string") {
+    return json(400, "invalid_request");
+  }
+  const search = openContinuation(ref, resolveSecret());
+  if (search === null) return json(400, "invalid_request");
+  const params = new URLSearchParams(search);
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) raw[key] = params.get(key) ?? undefined;
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  if (!parsed.success) return json(400, "invalid_request");
+
+  const session = await auth.api.getSession({ headers: request.headers });
+  if (!session) {
+    const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    return see(`/sign-in?${signIn.toString()}`);
+  }
+  return codeRedirect(request, parsed.data, true);
+}

package/templates/apps/web/app/api/hub-session/__tests__/routes.test.ts

@@ -16,6 +16,10 @@
  *
  * #8757 D9 (AC-6): a valid single `?email=` on the sign-in route becomes the
  * authorize URL's `login_hint`; the sealed flow cookie never carries it.
+ *
+ * #9912 D2 (AC-1): exactly one `?prompt=create` rides to the hub as
+ * `prompt=create`, so the hub sends a visitor with no session to /sign-up;
+ * any other value adds nothing, and the flow cookie's keys are unchanged.
  */
 
 import { createHash } from "node:crypto";
@@ -204,6 +208,53 @@ describe("GET /api/hub-session/sign-in — the hinted email (#8757 D9)", () => {
   });
 });
 
+describe("GET /api/hub-session/sign-in — the sign-up hint (#9912 D2)", () => {
+  function startWith(query: string): { authorize: URL; payload: Record<string, unknown> } {
+    const res = signIn(new Request(`${SITE}/api/hub-session/sign-in?${query}`));
+    expect(res.status).toBe(303);
+    const flow = cookieValue(res, "ailk-hub-flow");
+    if (flow === undefined) throw new Error("no flow cookie");
+    const payload = unseal(flow, SESSION_SECRET, "flow", "ailk-hub-flow");
+    if (payload === null || typeof payload !== "object") throw new Error("flow did not open");
+    return {
+      authorize: new URL(res.headers.get("location") ?? ""),
+      payload: payload as Record<string, unknown>,
+    };
+  }
+
+  it("?next=/account&prompt=create → the authorize URL carries prompt=create; the flow cookie keeps exactly its five keys", () => {
+    const { authorize, payload } = startWith("next=/account&prompt=create");
+    expect(authorize.pathname).toBe("/api/auth/hub/authorize");
+    expect(authorize.searchParams.getAll("prompt")).toEqual(["create"]);
+    // The six keys are untouched beside it.
+    expect(authorize.searchParams.get("response_type")).toBe("code");
+    expect(authorize.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(Object.keys(payload).sort()).toEqual(
+      ["expiresAt", "next", "state", "v", "verifier"],
+    );
+    expect(payload.next).toBe("/account");
+    expect(JSON.stringify(payload)).not.toContain("create");
+  });
+
+  it("forwards the hint beside a valid login_hint", () => {
+    const { authorize } = startWith("next=/account&prompt=create&email=a%40b.example");
+    expect(authorize.searchParams.get("prompt")).toBe("create");
+    expect(authorize.searchParams.get("login_hint")).toBe("a@b.example");
+  });
+
+  it.each([
+    ["another OIDC value", "next=/account&prompt=login"],
+    ["an empty value", "next=/account&prompt="],
+    ["a repeated value", "next=/account&prompt=create&prompt=create"],
+    ["a cased value", "next=/account&prompt=Create"],
+    ["no value", "next=/account"],
+  ])("%s → no prompt", (_label, query) => {
+    const { authorize, payload } = startWith(query);
+    expect(authorize.searchParams.has("prompt")).toBe(false);
+    expect(payload).not.toHaveProperty("prompt");
+  });
+});
+
 describe("GET /api/hub-session/callback", () => {
   function exchangeOk(): void {
     mockExchange.mockResolvedValue({

package/templates/apps/web/app/api/hub-session/sign-in/route.ts

@@ -15,6 +15,12 @@
  * the address typed. A refused or repeated value is dropped. The hint goes on
  * the authorize URL only — never into the sealed flow cookie.
  *
+ * Sign-up hint (#9912 D2): exactly one `?prompt=create` (the gate's "Sign up")
+ * rides to the hub as `prompt=create`, so a visitor with no hub session lands
+ * on its sign-up screen instead of sign-in; the round trip is otherwise the
+ * same. Any other value, an empty or a repeated one adds nothing, and the hint
+ * never enters the flow cookie.
+ *
  * Nothing here logs the state, the verifier or the challenge.
  */
 import { createHash, randomBytes } from "node:crypto";
@@ -55,6 +61,12 @@ function emailHint(params: URLSearchParams): string | undefined {
   return parsed.success ? parsed.data : undefined;
 }
 
+/** #9912 D2 — `"create"` when the one `prompt` is exactly that, else none. */
+function signUpHint(params: URLSearchParams): "create" | undefined {
+  const values = params.getAll("prompt");
+  return values.length === 1 && values[0] === "create" ? "create" : undefined;
+}
+
 // platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
 export function GET(request: Request): Response {
   if (SIGN_IN_PROVIDER !== "hub") return new Response(null, { status: 404 });
@@ -84,6 +96,7 @@ export function GET(request: Request): Response {
     code_challenge: challenge,
     code_challenge_method: "S256",
   });
+  if (signUpHint(params) !== undefined) query.set("prompt", "create");
   const loginHint = emailHint(params);
   if (loginHint !== undefined) query.set("login_hint", loginHint);
   authorize.search = query.toString();

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/__tests__/route.test.ts

@@ -11,8 +11,13 @@
  * #7874 D5). The rest of the ladder is pinned in `../../__tests__/route.test.ts`.
  *
  * Each case loads the route in its own module registry, so no case reads
- * another's shared shown-set answer; a spoke case swaps in the spoke render
- * of both generated seams, as `lib/__tests__/relay.test.ts` does.
+ * another's shared shown-set answer or spends another's start budget; a spoke
+ * case swaps in the spoke render of both generated seams, as
+ * `lib/__tests__/relay.test.ts` does.
+ *
+ * The per-visitor start budget (#9965: #9059, #9063) is pinned at the end:
+ * keyed only on the address Vercel's edge writes, never skipped for a visitor
+ * with none, and spent only by a start the API made.
  */
 import { workspaceShownSetSchema } from "@working-theory/validation";
 
@@ -71,6 +76,7 @@ const ENV_NAMES = [
   "NODE_ENV",
   "OSS_API_INTERNAL_SECRET",
   "AILK_SPOKE_KEY",
+  "VERCEL",
 ] as const;
 const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
 
@@ -83,16 +89,21 @@ function json(status: number, body: unknown): Promise<Response> {
   );
 }
 
-/** The shown-set read answers `shownStatus`; the session POST starts one. */
+function started(): Promise<Response> {
+  return json(201, {
+    sessionId: "cs_test_a1",
+    url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+  });
+}
+
+/** The shown-set read answers `shownStatus`; the session POST `sessionAnswer`. */
 let shownStatus: "unconnected" | "shown";
+let sessionAnswer: () => Promise<Response>;
 const realFetch = global.fetch;
 const fetchMock = jest.fn(
   (input: string | URL | Request, _init?: RequestInit) => {
     if (new URL(String(input)).pathname === "/v1/checkout/sessions") {
-      return json(201, {
-        sessionId: "cs_test_a1",
-        url: "https://checkout.stripe.com/c/pay/cs_test_a1",
-      });
+      return sessionAnswer();
     }
     return json(200, {
       ok: true,
@@ -119,6 +130,7 @@ beforeEach(() => {
   env.NODE_ENV = "production";
   env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
   shownStatus = "unconnected";
+  sessionAnswer = started;
   fetchMock.mockClear();
   warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
 });
@@ -163,6 +175,53 @@ async function buy(topology: "hub" | "spoke"): Promise<Response> {
   return res;
 }
 
+type Get = (typeof import("../route"))["GET"];
+
+/** The hub route in one module registry, so its calls share one budget. */
+async function loadHubRoute(): Promise<Get> {
+  let get: Get | undefined;
+  await jest.isolateModulesAsync(async () => {
+    jest.dontMock(ORIGIN_SEAM);
+    jest.dontMock(TOPOLOGY_SEAM);
+    ({ GET: get } = await import("../route"));
+  });
+  if (get === undefined) throw new Error("the route did not load");
+  return get;
+}
+
+/** A buyer's click on `growth_monthly` carrying `headers`. */
+function click(
+  get: Get,
+  headers: Record<string, string> = {},
+): Promise<Response> {
+  const request = new Request(
+    "https://shop.example.com/api/offerings/checkout/growth_monthly",
+    {
+      headers: {
+        "sec-fetch-mode": "navigate",
+        "sec-fetch-dest": "document",
+        "sec-fetch-site": "same-origin",
+        ...headers,
+      },
+    },
+  );
+  return get(request, {
+    params: Promise.resolve({ lookupKey: "growth_monthly" }),
+  });
+}
+
+function postCount(): number {
+  return fetchMock.mock.calls.filter(
+    ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+  ).length;
+}
+
+function refusedFor(reason: string): number {
+  return warnSpy.mock.calls.filter(
+    ([line]) => line === `[offerings-checkout] refused reason=${reason}`,
+  ).length;
+}
+
 function postHeaders(): Record<string, string> {
   const post = fetchMock.mock.calls.find(
     ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
@@ -220,3 +279,170 @@ describe("the route's API origin comes from the topology seam", () => {
     expect(postHeaders()["x-internal-auth"]).toBeUndefined();
   });
 });
+
+describe("the per-visitor start budget (#9059, #9063)", () => {
+  beforeEach(() => {
+    env.AILK_API_URL = HUB_API;
+    shownStatus = "shown";
+  });
+
+  it("on Vercel, keys on x-vercel-forwarded-for, never a client-chosen x-forwarded-for", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 6; i += 1) {
+      await click(get, {
+        "x-vercel-forwarded-for": "198.51.100.1",
+        "x-forwarded-for": `203.0.113.${i}`,
+        "x-real-ip": `192.0.2.${i}`,
+      });
+    }
+
+    expect(postCount()).toBe(5);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    await click(get, { "x-vercel-forwarded-for": "198.51.100.2" });
+    expect(postCount()).toBe(6);
+  });
+
+  it("off Vercel, reads no address header, so every visitor shares the one wide bucket", async () => {
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 51; i += 1) {
+      await click(get, {
+        "x-vercel-forwarded-for": `198.51.100.${i}`,
+        "x-forwarded-for": `203.0.113.${i}`,
+      });
+    }
+
+    expect(postCount()).toBe(50);
+    expect(refusedFor("rate_limited")).toBe(1);
+  });
+
+  it("charges a visitor with no readable address to the shared bucket, never skips one", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 51; i += 1) await click(get);
+
+    expect(postCount()).toBe(50);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    // An addressed visitor keeps a budget of its own.
+    await click(get, { "x-vercel-forwarded-for": "198.51.100.1" });
+    expect(postCount()).toBe(51);
+  });
+
+  it("spends a start only when the API starts a Checkout", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    // The same address in both headers, so the unfixed keying counts it too.
+    const visitor = {
+      "x-vercel-forwarded-for": "198.51.100.1",
+      "x-forwarded-for": "198.51.100.1",
+    };
+
+    const failures = [
+      () => json(502, { error: "upstream" }),
+      () => json(503, { error: "unavailable" }),
+      () => json(500, { error: "internal" }),
+      () => Promise.reject(new TypeError("fetch failed")),
+      () => Promise.reject(new TypeError("fetch failed")),
+    ];
+    for (const failure of failures) {
+      sessionAnswer = failure;
+      await click(get, visitor);
+    }
+    expect(postCount()).toBe(5);
+    expect(refusedFor("rate_limited")).toBe(0);
+
+    sessionAnswer = started;
+    for (let i = 0; i < 5; i += 1) {
+      const res = await click(get, visitor);
+      expect(res.headers.get("location")).toBe(
+        "https://checkout.stripe.com/c/pay/cs_test_a1",
+      );
+    }
+    expect(postCount()).toBe(10);
+
+    const sixth = await click(get, visitor);
+    expect(sixth.headers.get("location")).toBe("/pricing");
+    expect(postCount()).toBe(10);
+    expect(refusedFor("rate_limited")).toBe(1);
+  });
+
+  it("holds a start in flight against the budget, so concurrent clicks cannot overrun it", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    // The same address in both headers, so the unfixed keying counts it too.
+    const visitor = {
+      "x-vercel-forwarded-for": "198.51.100.1",
+      "x-forwarded-for": "198.51.100.1",
+    };
+    const answers: Array<(res: Response) => void> = [];
+    sessionAnswer = () =>
+      new Promise<Response>((resolve) => {
+        answers.push(resolve);
+      });
+
+    const clicks = Array.from({ length: 6 }, () => click(get, visitor));
+    // The sixth is refused while the other five still wait on the API.
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(answers).toHaveLength(5);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    for (const answer of answers) {
+      answer(
+        new Response(JSON.stringify({ error: "upstream" }), {
+          status: 502,
+          headers: { "content-type": "application/json" },
+        }),
+      );
+    }
+    await Promise.all(clicks);
+
+    // Five failed starts spent nothing, so the visitor can start again.
+    sessionAnswer = started;
+    await click(get, visitor);
+    expect(postCount()).toBe(6);
+  });
+
+  it("a start in flight across the window's end settles on the window it holds", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    const visitor = { "x-vercel-forwarded-for": "198.51.100.1" };
+    const answers: Array<(res: Response) => void> = [];
+    sessionAnswer = () =>
+      new Promise<Response>((resolve) => {
+        answers.push(resolve);
+      });
+    const now = jest.spyOn(Date, "now");
+    try {
+      now.mockReturnValue(1_000_000);
+      const first = click(get, visitor);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      now.mockReturnValue(1_000_000 + 10 * 60_000);
+      const second = click(get, visitor);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      expect(answers).toHaveLength(2);
+
+      for (const answer of answers) {
+        answer(
+          new Response(JSON.stringify({ error: "upstream" }), {
+            status: 502,
+            headers: { "content-type": "application/json" },
+          }),
+        );
+      }
+      await Promise.all([first, second]);
+
+      // Both failed, so nothing is held: the window admits its full five.
+      sessionAnswer = started;
+      for (let i = 0; i < 6; i += 1) await click(get, visitor);
+      expect(postCount()).toBe(7);
+      expect(refusedFor("rate_limited")).toBe(1);
+    } finally {
+      now.mockRestore();
+    }
+  });
+});