create-ailk 0.27.0 → 0.28.0

package/templates/apps/web/app/[locale]/contact/__tests__/contact.actions.test.ts

@@ -18,10 +18,21 @@ import { captureLeadAction } from "../contact.actions.js";
 
 // Mock @working-theory/api-client. `visitorForwardHeaders` stays real (#7394)
 // so AC-9 compares the action's `init` with the helper's own output.
+// #9255 — the write bot check's verdict. `checkBotId` reads Vercel's
+// request context, which jest has none of, so every case decides it here.
+const checkBotIdMock = jest.fn();
+jest.mock("botid/server", () => ({
+  checkBotId: (...args: unknown[]) => checkBotIdMock(...args),
+}));
+
 jest.mock("@working-theory/api-client", () => ({
   leads: {
     submit: jest.fn(),
   },
+  // #9171 — a `checkout` magnet's lookup key comes from the shown set.
+  offerings: {
+    shown: jest.fn(),
+  },
   visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
     .visitorForwardHeaders,
 }));
@@ -53,9 +64,9 @@ jest.mock("next-intl/server", () => {
   };
 });
 
-// #8757 D11 — a `checkout` magnet redirects after the write. Next's
-// `redirect()` throws NEXT_REDIRECT; the mock throws the same way so a case
-// can read the target and prove nothing ran after it.
+// #9171 — a `checkout` magnet never calls Next's `redirect()`: a Server
+// Action redirect is fetched as RSC, which the buy route refuses. The mock
+// throws NEXT_REDIRECT as Next does, so a stray call fails its case.
 const mockRedirect = jest.fn((url: string): never => {
   throw new Error(`NEXT_REDIRECT:${url}`);
 });
@@ -65,21 +76,19 @@ jest.mock("next/navigation", () => ({
 }));
 
 let mockSignInProvider: "site" | "hub" | "none" = "site";
-let mockTopology: "hub" | "spoke" = "spoke";
-// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER and TOPOLOGY are generated per-build constants (#8757 D8, D11), not runtime inputs; no env or HTTP surface selects them.
+// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER is a generated per-build constant (#8757 D8), not a runtime input; no env or HTTP surface selects it.
 jest.mock("../../../../lib/topology.generated", () => ({
   __esModule: true,
   get SIGN_IN_PROVIDER() {
     return mockSignInProvider;
   },
-  get TOPOLOGY() {
-    return mockTopology;
-  },
 }));
 
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { leads, offerings, visitorForwardHeaders } from "@working-theory/api-client";
+import { workspaceShownSetSchema } from "@working-theory/validation";
 import { headers } from "next/headers";
 const mockSubmit = leads.submit as jest.Mock;
+const mockShown = offerings.shown as jest.Mock;
 const mockHeaders = headers as jest.Mock;
 
 afterEach(() => {
@@ -612,7 +621,22 @@ describe("captureLeadAction — the built-in form's source (#8747)", () => {
 
 describe("captureLeadAction — the per-visitor limit (#8747)", () => {
   const visitor = (ip: string) => ({
-    get: (name: string) => (name === "x-forwarded-for" ? ip : null),
+    get: (name: string) => (name === "x-vercel-forwarded-for" ? ip : null),
+  });
+  // On Vercel, where the edge-set address is read; the bot check has its own suite.
+  const ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK"] as const;
+  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  beforeEach(() => {
+    process.env.VERCEL = "1";
+    process.env.AILK_BOT_CHECK = "off";
+  });
+
+  afterEach(() => {
+    for (const [name, value] of priorEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
   });
 
   it("admits 30 posts from one visitor in ten minutes, and refuses the 31st without calling the API", async () => {
@@ -633,17 +657,27 @@ describe("captureLeadAction — the per-visitor limit (#8747)", () => {
     expect(mockSubmit).toHaveBeenCalledTimes(30);
   });
 
-  it("with no readable address, the limit is skipped rather than shared", async () => {
-    mockHeaders.mockResolvedValue({ get: () => null });
+  it("with no readable address, every post shares one bucket at ten times the limit, never skipped (#9967)", async () => {
+    // A client-sent x-forwarded-for is no address: it changes on every post.
+    let n = 0;
+    mockHeaders.mockImplementation(async () => {
+      n += 1;
+      return { get: (name: string) => (name === "x-forwarded-for" ? `10.0.${n >> 8}.${n & 255}` : null) };
+    });
     mockSubmit.mockResolvedValue({ ok: true, body: { id: "lead_1", persisted: "db" } });
 
-    for (let i = 0; i < 31; i += 1) {
+    for (let i = 0; i < 300; i += 1) {
       expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toEqual({
         kind: "success",
         name: expect.any(String),
       });
     }
-    expect(mockSubmit).toHaveBeenCalledTimes(31);
+    expect(mockSubmit).toHaveBeenCalledTimes(300);
+
+    const refused = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(refused).toMatchObject({ kind: "error", message: expect.any(String) });
+    expect(mockSubmit).toHaveBeenCalledTimes(300);
   });
 
   it("another visitor keeps its own budget", async () => {
@@ -786,7 +820,16 @@ describe("captureLeadAction — the account link (#8757 D8)", () => {
   });
 });
 
-describe("captureLeadAction — a checkout magnet redirects after the write (#8757 D11, AC-8)", () => {
+describe("captureLeadAction — a checkout magnet answers the Offerings buy route after the write (#8757 D11, #9171)", () => {
+  // The shown-set read is shared for 15 seconds per instance, so each case
+  // starts a minute past the last one's window.
+  let clock = Date.now();
+  let now: jest.SpyInstance<number, []>;
+  beforeEach(() => {
+    clock += 60_000;
+    now = jest.spyOn(Date, "now").mockReturnValue(clock);
+  });
+
   function answers(next: unknown): void {
     mockSubmit.mockResolvedValueOnce({
       ok: true,
@@ -794,18 +837,135 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
     });
   }
 
-  it("next: checkout, retainer → Next's redirect to /api/checkout/retainer, after exactly one write", async () => {
+  /** A shown set in `state`: one `plan` carrying a Price per `period`. */
+  function shownSet(
+    periods: readonly ("monthly" | "yearly" | "once")[],
+    plan = "retainer",
+    state = "current",
+  ): unknown {
+    return workspaceShownSetSchema.partial({ workspaceId: true, organizationId: true }).parse({
+      productIds: [`prod_${plan}`],
+      recommended: { plan: null, addon: null },
+      offerings: [
+        {
+          productId: `prod_${plan}`,
+          plan,
+          name: plan,
+          description: null,
+          marketingFeatures: [],
+          unitLabel: null,
+          note: null,
+          termsNote: null,
+          ailkGroup: "plan",
+          ailkOrder: null,
+          prices: periods.map((period) => ({
+            priceId: `price_${plan}_${period}`,
+            lookupKey: `${plan}_${period}`,
+            plan,
+            period,
+            interval: { monthly: "month", yearly: "year", once: null }[period],
+            amount: 4900,
+            currency: "usd",
+          })),
+          recommended: false,
+        },
+      ],
+      state,
+      snapshotAt: "2026-10-26T00:00:00.000Z",
+    });
+  }
+
+  afterEach(() => {
+    mockShown.mockReset();
+    now.mockRestore();
+  });
+
+  /** The shown-set read answers `body` (the api-client's unwrapped 2xx). */
+  function shows(body: unknown): void {
+    mockShown.mockResolvedValueOnce({ ok: true, status: 200, body });
+  }
+
+  it("next: checkout, retainer → the success state carries /api/offerings/checkout/retainer_monthly, after exactly one write", async () => {
     answers({ completion: "checkout", checkoutOffering: "retainer" });
+    shows({ status: "shown", shownSet: shownSet(["monthly", "yearly"]) });
 
-    await expect(captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).rejects.toThrow(
-      "NEXT_REDIRECT:/api/checkout/retainer",
-    );
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: "Jane Smith",
+      redirect: "/api/offerings/checkout/retainer_monthly",
+    });
     expect(mockSubmit).toHaveBeenCalledTimes(1);
-    expect(mockRedirect).toHaveBeenCalledTimes(1);
-    expect(mockRedirect).toHaveBeenCalledWith("/api/checkout/retainer");
     expect(mockSubmit.mock.invocationCallOrder[0]!).toBeLessThan(
-      mockRedirect.mock.invocationCallOrder[0]!,
+      mockShown.mock.invocationCallOrder[0]!,
     );
+    // The form navigates; never a Server Action redirect, and never the retired route.
+    expect(mockRedirect).not.toHaveBeenCalled();
+  });
+
+  it("one shown-set read serves every submit within 15 seconds", async () => {
+    const checkout = { completion: "checkout", checkoutOffering: "retainer" };
+    answers(checkout);
+    answers(checkout);
+    answers(checkout);
+    shows({ status: "shown", shownSet: shownSet(["monthly"]) });
+    shows({ status: "shown", shownSet: shownSet(["yearly"]) });
+    const submit = () => captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_monthly" });
+    now.mockReturnValue(clock + 14_999);
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_monthly" });
+    expect(mockShown).toHaveBeenCalledTimes(1);
+    now.mockReturnValue(clock + 15_000);
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_yearly" });
+    expect(mockShown).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([
+    [["yearly", "once"], "retainer_yearly"],
+    [["once"], "retainer_once"],
+  ] as const)(
+    "the key /pricing's card links first: shown %j → %s",
+    async (periods, lookupKey) => {
+      answers({ completion: "checkout", checkoutOffering: "retainer" });
+      shows({ status: "shown", shownSet: shownSet(periods) });
+
+      expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toMatchObject({
+        redirect: `/api/offerings/checkout/${lookupKey}`,
+      });
+    },
+  );
+
+  it.each([
+    ["a plan the shown set does not show", () => shows({ status: "shown", shownSet: shownSet(["monthly"], "growth") })],
+    ["an unconnected site", () => shows({ status: "unconnected" })],
+    ["a shown set that is not current", () => shows({ status: "shown", shownSet: shownSet(["monthly"], "retainer", "expired") })],
+    ["a non-2xx read", () => mockShown.mockResolvedValueOnce({ ok: false, status: 503, body: null })],
+    ["a thrown read", () => mockShown.mockRejectedValueOnce(new Error("network"))],
+  ] as const)("%s → exactly { kind: success } and no buy route", async (_label, read) => {
+    answers({ completion: "checkout", checkoutOffering: "retainer" });
+    read();
+
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: expect.any(String),
+    });
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    expect(mockRedirect).not.toHaveBeenCalled();
+  });
+
+  it("a read with no answer within 5 seconds → exactly { kind: success } and no buy route", async () => {
+    jest.useFakeTimers({ doNotFake: ["nextTick", "setImmediate", "queueMicrotask", "Date"] });
+    try {
+      answers({ completion: "checkout", checkoutOffering: "retainer" });
+      mockShown.mockReturnValueOnce(new Promise(() => {}));
+
+      const result = captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+      await jest.advanceTimersByTimeAsync(5_000);
+      expect(await result).toStrictEqual({ kind: "success", name: expect.any(String) });
+      expect(mockRedirect).not.toHaveBeenCalled();
+    } finally {
+      jest.useRealTimers();
+    }
   });
 
   it.each([
@@ -816,24 +976,26 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
       { ok: false, status: 503, body: { error: "lead_capture_not_configured" } },
       "unavailable",
     ],
-  ] as const)("a failed write (%s) → { kind: %s } and no redirect", async (_label, response, kind) => {
+  ] as const)("a failed write (%s) → { kind: %s } and no buy route", async (_label, response, kind) => {
     mockSubmit.mockResolvedValueOnce(response);
 
     const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
     expect(result).toMatchObject({ kind });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 
-  it("a thrown write → { kind: unavailable } and no redirect", async () => {
+  it("a thrown write → { kind: unavailable } and no buy route", async () => {
     mockSubmit.mockRejectedValueOnce(new Error("network"));
 
     const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
     expect(result).toMatchObject({ kind: "unavailable" });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 
   it.each(["../x", "/evil", "Retainer", "has_underscore", "a".repeat(41), ""])(
-    "checkoutOffering %j → exactly { kind: success } and no redirect",
+    "checkoutOffering %j → exactly { kind: success }, no shown-set read and no buy route",
     async (checkoutOffering) => {
       answers({ completion: "checkout", checkoutOffering });
 
@@ -841,27 +1003,12 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
         kind: "success",
         name: expect.any(String),
       });
+      expect(mockShown).not.toHaveBeenCalled();
       expect(mockRedirect).not.toHaveBeenCalled();
     },
   );
 
-  it("a build that is not a spoke (no standard checkout) → exactly { kind: success } and no redirect", async () => {
-    mockTopology = "hub";
-    try {
-      answers({ completion: "checkout", checkoutOffering: "retainer" });
-
-      expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
-        kind: "success",
-        name: expect.any(String),
-      });
-      expect(mockSubmit).toHaveBeenCalledTimes(1);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    } finally {
-      mockTopology = "spoke";
-    }
-  });
-
-  it("an invite still answers the account link and never redirects", async () => {
+  it("an invite still answers the account link and no buy route", async () => {
     answers({ completion: "invite" });
 
     const result = await captureLeadAction(
@@ -869,6 +1016,86 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
       makeFormData({ ...VALID_FIELDS, email: "a@b.example" }),
     );
     expect(result).toMatchObject({ kind: "success", next: { label: "Track this in your account" } });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 });
+
+// #9255 D4 — the write bot check runs after the honeypot, the consent and
+// the schema, immediately before the write (spec
+// docs/specs/9255-an-edge-bot-challenge-in-spec.md §5.1 AC-2).
+describe("captureLeadAction — the write bot check (#9255)", () => {
+  const BOT = { isHuman: false, isBot: true, isVerifiedBot: false, bypassed: false };
+  const HUMAN = { ...BOT, isHuman: true, isBot: false };
+  const BOT_ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK", "AILK_BOOKING_BOT_CHECK"] as const;
+  const priorBotEnv = new Map(BOT_ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  let botLogSpies: jest.SpyInstance[] = [];
+
+  beforeEach(() => {
+    checkBotIdMock.mockReset();
+    for (const name of BOT_ENV_KEYS) delete process.env[name];
+    process.env.VERCEL = "1";
+    botLogSpies = [
+      jest.spyOn(console, "warn").mockImplementation(() => undefined),
+      jest.spyOn(console, "error").mockImplementation(() => undefined),
+    ];
+  });
+
+  afterEach(() => {
+    for (const [name, value] of priorBotEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+    for (const spy of botLogSpies) spy.mockRestore();
+  });
+
+  const OK = { ok: true, body: { id: "lead_abc123", persisted: "db" } };
+
+  it("a bot gets the generic error, and nothing is sent", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    expect(result).toStrictEqual({ kind: "error", message: "Something went wrong, please try again." });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("a check that fails is unavailable, and nothing is sent", async () => {
+    checkBotIdMock.mockRejectedValue(new Error("boom"));
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    expect(result).toStrictEqual({ kind: "unavailable" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("a human sends exactly what the check off sends", async () => {
+    checkBotIdMock.mockResolvedValue(HUMAN);
+    mockSubmit.mockResolvedValue(OK);
+    delete process.env.VERCEL;
+    await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    process.env.VERCEL = "1";
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toMatchObject({
+      kind: "success",
+    });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmit).toHaveBeenCalledTimes(2);
+    expect(mockSubmit.mock.calls[1]).toEqual(mockSubmit.mock.calls[0]);
+  });
+
+  it("a filled honeypot answers success with no check", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const result = await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, ailk_hp: "spam" }),
+    );
+    expect(result).toEqual({ kind: "success" });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+
+  it("a post without consent answers the consent error with no check", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const { consent: _consent, ...unticked } = VALID_FIELDS;
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(unticked));
+    expect(result).toEqual({ kind: "error", fieldErrors: { consent: expect.any(String) } });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -16,8 +16,9 @@
  * calls per 10 minutes per visitor address, before the write. From a server
  * action the hub sees this site's egress address, so one visitor could
  * otherwise drain the hub's per-IP budget for every visitor of the site. With
- * no readable address the limit is skipped, never shared. The hub keeps its
- * own per-IP limit on the route.
+ * no readable address the post is counted in one shared bucket at ten times
+ * the limit, never skipped (#9967). The hub keeps its own per-IP limit on the
+ * route.
  *
  * The write (#8747): every lead goes through `writeLead`, the site's lead
  * writer (`src/lib/lead-write.ts`), which marks it `payload.site =
@@ -68,6 +69,11 @@
  * requires of a contact lead and records on it); an API `400
  * consent_required` is shown as the same field error.
  *
+ * The bot check (#9255 D4): after the honeypot, consent, schema and
+ * per-visitor refusals and immediately before the write, `runBotCheck`
+ * (lib/bot-check.ts) asks Vercel BotID for a verdict. A bot gets the generic
+ * error and a check that cannot decide `unavailable`; neither is sent.
+ *
  * Visitor forwarding (#7394): on a spoke whose API is a hub, the call
  * carries the visitor's IP and the spoke's `AILK_VISITOR_FORWARD_KEY`
  * (server-only, never `NEXT_PUBLIC_`) via `visitorForwardHeaders`, so the
@@ -86,35 +92,43 @@
  * be read — answers exactly `{ kind: "success" }`: a written lead is never
  * reported as a failure.
  *
- * Continue to checkout (#8757 D11): `{ completion: "checkout",
+ * Continue to checkout (#8757 D11, #9171): `{ completion: "checkout",
  * checkoutOffering }` — the magnet sends the submitter on to the offering's
- * standard checkout — calls `redirect("/api/checkout/<checkoutOffering>")`
- * (a Server Action redirect, a 303). It runs only after the write resolved
- * `ok`, and outside any `try`, since `redirect()` throws NEXT_REDIRECT by
- * design (`checkout.actions.ts`'s rule). The key is re-checked with
- * `flowCheckoutOfferingSchema` first; one that fails answers `{ kind:
- * "success" }`, as `lead` does. The standard checkout is served on a spoke
- * only (`TOPOLOGY`), so any other build answers `{ kind: "success" }` too,
- * never a redirect to a 404. A failed write never redirects.
+ * checkout — answers `{ kind: "success", redirect:
+ * "/api/offerings/checkout/<lookupKey>" }`, the Offerings buy route every
+ * `/pricing` card links; the legacy `/api/checkout/<offering>` is retired
+ * (#9142). The form hard-navigates there (`LeadCaptureForm`'s `redirect`),
+ * because the route starts a session only for a top-level navigation and a
+ * Server Action `redirect()` is fetched as RSC, which it sends to `/pricing`.
+ * The stored value is a `{plan}`, so the key is the one that plan's
+ * `/pricing` card links first: the first of `<plan>_monthly`,
+ * `<plan>_yearly` and `<plan>_once` the shown set shows, read through
+ * `offerings.shown()` within 5 seconds and shared per instance for 15, as
+ * the buy route reads it. It runs only after the write resolved `ok`. The
+ * value is re-checked with `flowCheckoutOfferingSchema` first; one that
+ * fails, a plan the shown set does not show, or a read that fails or times
+ * out answers `{ kind: "success" }`, as `lead` does.
+ * A failed write never answers the buy route.
  */
 
-import { visitorForwardHeaders } from "@working-theory/api-client";
+import { offerings, visitorForwardHeaders } from "@working-theory/api-client";
 import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
 import {
   CONTACT_LEAD_SOURCES,
   flowCheckoutOfferingSchema,
   leadSubmitNextSchema,
+  LOOKUP_KEY_PERIODS,
 } from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
-import { redirect } from "next/navigation";
 import { getLocale, getTranslations } from "next-intl/server";
 import { z } from "zod";
 
 import { accountInviteHref } from "../../../lib/account-invite";
+import { runBotCheck } from "../../../lib/bot-check";
 import { consentVisitorHeader, readConsentVisitor } from "../../../lib/consent-visitor";
-import { TOPOLOGY } from "../../../lib/topology.generated";
+import { isShownLookupKey, offeringsCheckoutHref } from "../../../lib/offerings-pricing";
 import { writeLead } from "../../../src/lib/lead-write";
-import { checkRateLimit, clientIpFromHeaders } from "../../../src/lib/rate-limit";
+import { takeVisitorLimit } from "../../../src/lib/rate-limit";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
 const RATE_LIMITED = "Too many messages from here. Please try again in a few minutes.";
@@ -122,6 +136,8 @@ const RATE_LIMITED = "Too many messages from here. Please try again in a few min
 /** The per-visitor budget (#8747): the consumer sites' own values. */
 const RATE_LIMIT_MAX_CALLS = 30;
 const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+/** Outside a request scope there is no address: the shared bucket. */
+const NO_HEADERS = { get: () => null };
 
 /** Field names the action reads itself — never copied into `payload`. */
 const RESERVED_FIELDS = new Set([
@@ -196,16 +212,54 @@ function isApiUnreachable(res: { status: number }): boolean {
   return res.status === 0 || res.status === 502 || res.status === 504;
 }
 
+/** The buy route's own bounds on its shown-set read. */
+const SHOWN_READ_TIMEOUT_MS = 5_000;
+const SHOWN_READ_TTL_MS = 15_000;
+
+/** The shown set `/pricing` renders from, or `null`: any other answer, a throw, or none in time. */
+async function readShownSet(): Promise<unknown> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const late = new Promise<null>((resolve) => {
+    timer = setTimeout(() => resolve(null), SHOWN_READ_TIMEOUT_MS);
+  });
+  try {
+    const res = await Promise.race([offerings.shown(), late]);
+    return res?.ok && res.body.status === "shown" ? res.body.shownSet : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+let shownRead: { at: number; read: Promise<unknown> } | undefined;
+
 /**
- * #8757 D11 — the offering a `checkout` answer names, when its key passes the
- * schema and this build serves the standard checkout (a spoke); else `null`.
+ * One read per instance per SHOWN_READ_TTL_MS: `offerings.shown()` forwards
+ * no visitor header, so a read per submit would count every visitor against
+ * this server's one per-IP limit at the API. Failed reads are shared too.
  */
-function checkoutOfferingOf(next: unknown): string | null {
-  if (TOPOLOGY !== "spoke") return null;
+function sharedShownSet(): Promise<unknown> {
+  const now = Date.now();
+  if (shownRead && now - shownRead.at < SHOWN_READ_TTL_MS) return shownRead.read;
+  shownRead = { at: now, read: readShownSet() };
+  return shownRead.read;
+}
+
+/**
+ * #8757 D11, #9171 — the Offerings buy route for the plan a `checkout` answer
+ * names: its first shown key in `/pricing`'s card order; else `null`.
+ */
+async function checkoutHrefOf(next: unknown): Promise<string | null> {
   const parsed = leadSubmitNextSchema.safeParse(next);
   if (!parsed.success || parsed.data.completion !== "checkout") return null;
-  const key = flowCheckoutOfferingSchema.safeParse(parsed.data.checkoutOffering);
-  return key.success ? key.data : null;
+  const plan = flowCheckoutOfferingSchema.safeParse(parsed.data.checkoutOffering);
+  if (!plan.success) return null;
+  const shownSet = await sharedShownSet();
+  const key = LOOKUP_KEY_PERIODS.map((period) => `${plan.data}_${period}`).find((k) =>
+    isShownLookupKey(shownSet, k),
+  );
+  return key === undefined ? null : offeringsCheckoutHref(key);
 }
 
 /**
@@ -294,13 +348,11 @@ export async function captureLeadAction(
     // No request scope to read — no forwarding, and the visitor is "unknown".
   }
 
-  // No readable address: skip the per-visitor limit rather than put every
-  // visitor in one shared bucket a single caller could fill. The hub's own
-  // per-IP limit still applies.
-  const visitor = requestHeaders ? clientIpFromHeaders(requestHeaders) : "unknown";
+  // No readable address: the shared, wider bucket, never a skip (#9967 D1).
+  // The hub's own per-IP limit still applies.
   if (
-    visitor !== "unknown" &&
-    !checkRateLimit(`contact:${visitor}`, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+    !takeVisitorLimit("contact", requestHeaders ?? NO_HEADERS, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+      .allowed
   ) {
     return { kind: "error", message: RATE_LIMITED };
   }
@@ -321,6 +373,12 @@ export async function captureLeadAction(
     // No request scope to read — submit with no visitor-link header.
   }
 
+  // #9255 D4 — the spoke edge's bot check, after every local refusal and
+  // immediately before the write.
+  const botCheck = await runBotCheck({ source: "bot-check", target: "captureLeadAction", scope: "write" });
+  if (botCheck === "bot") return { kind: "error", message: GENERIC_ERROR };
+  if (botCheck === "unavailable") return { kind: "unavailable" };
+
   // writeLead never throws: a thrown submit is logged there by error name
   // only, with no field values (#4042), and resolves as `status: 0`.
   const res = await writeLead({ source, email, page: "contact", consent: true, payload }, init);
@@ -331,9 +389,9 @@ export async function captureLeadAction(
     if (isNotConfigured(res) || isApiUnreachable(res)) return { kind: "unavailable" };
     return { kind: "error", message: GENERIC_ERROR };
   }
-  // #8757 D11 — after the write, outside any try: redirect() throws by design.
-  const checkoutOffering = checkoutOfferingOf(res.body.next);
-  if (checkoutOffering !== null) redirect(`/api/checkout/${checkoutOffering}`);
+  // #9171 — the form navigates: the buy route refuses a Server Action redirect.
+  const checkoutHref = await checkoutHrefOf(res.body.next);
+  if (checkoutHref !== null) return { kind: "success", name, redirect: checkoutHref };
   // #8847 D7 — the parsed name, which the magnet's ending fills `{name}` with.
   return { ...(await successState(res.body.next, email)), name };
 }

package/templates/apps/web/app/[locale]/courses/[slug]/page.tsx

@@ -1,7 +1,11 @@
 // Course detail page. Reads the Course MDX for the given slug, renders via
 // @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs trigger 404.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import {
+  getMdxSource as loadMdxSource,
+  renderPage,
+  renderPageMetadata,
+} from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
@@ -22,12 +26,25 @@ export default async function Page({
   getMdxSource,
 }: Props): Promise<ReactElement> {
   const { locale, slug } = await params;
+  // A page that composes `sections[]` renders them (JSON-LD is built from
+  // the same sections); a prose page renders its MDX body — the rule
+  // /vs/[slug] applies (#10122).
+  const source = await (getMdxSource ?? loadMdxSource)("Course", slug, locale);
+  const composed =
+    source !== null &&
+    Array.isArray((source.frontmatter as { sections?: unknown[] }).sections) &&
+    ((source.frontmatter as { sections?: unknown[] }).sections?.length ?? 0) >
+      0;
   return renderPage({
     type: "Course",
     slug,
     locale,
-    bodyMode: "mdx-body",
-    populatedDescriptionTestId: "course-description",
+    ...(composed
+      ? {}
+      : {
+          bodyMode: "mdx-body" as const,
+          populatedDescriptionTestId: "course-description",
+        }),
     ...(getMdxSource !== undefined && { getMdxSource }),
   });
 }