create-ailk 0.27.0 → 0.28.0

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/__tests__/route.test.ts

@@ -11,8 +11,13 @@
  * #7874 D5). The rest of the ladder is pinned in `../../__tests__/route.test.ts`.
  *
  * Each case loads the route in its own module registry, so no case reads
- * another's shared shown-set answer; a spoke case swaps in the spoke render
- * of both generated seams, as `lib/__tests__/relay.test.ts` does.
+ * another's shared shown-set answer or spends another's start budget; a spoke
+ * case swaps in the spoke render of both generated seams, as
+ * `lib/__tests__/relay.test.ts` does.
+ *
+ * The per-visitor start budget (#9965: #9059, #9063) is pinned at the end:
+ * keyed only on the address Vercel's edge writes, never skipped for a visitor
+ * with none, and spent only by a start the API made.
  */
 import { workspaceShownSetSchema } from "@working-theory/validation";
 
@@ -71,6 +76,7 @@ const ENV_NAMES = [
   "NODE_ENV",
   "OSS_API_INTERNAL_SECRET",
   "AILK_SPOKE_KEY",
+  "VERCEL",
 ] as const;
 const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
 
@@ -83,16 +89,21 @@ function json(status: number, body: unknown): Promise<Response> {
   );
 }
 
-/** The shown-set read answers `shownStatus`; the session POST starts one. */
+function started(): Promise<Response> {
+  return json(201, {
+    sessionId: "cs_test_a1",
+    url: "https://checkout.stripe.com/c/pay/cs_test_a1",
+  });
+}
+
+/** The shown-set read answers `shownStatus`; the session POST `sessionAnswer`. */
 let shownStatus: "unconnected" | "shown";
+let sessionAnswer: () => Promise<Response>;
 const realFetch = global.fetch;
 const fetchMock = jest.fn(
   (input: string | URL | Request, _init?: RequestInit) => {
     if (new URL(String(input)).pathname === "/v1/checkout/sessions") {
-      return json(201, {
-        sessionId: "cs_test_a1",
-        url: "https://checkout.stripe.com/c/pay/cs_test_a1",
-      });
+      return sessionAnswer();
     }
     return json(200, {
       ok: true,
@@ -119,6 +130,7 @@ beforeEach(() => {
   env.NODE_ENV = "production";
   env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
   shownStatus = "unconnected";
+  sessionAnswer = started;
   fetchMock.mockClear();
   warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
 });
@@ -163,6 +175,53 @@ async function buy(topology: "hub" | "spoke"): Promise<Response> {
   return res;
 }
 
+type Get = (typeof import("../route"))["GET"];
+
+/** The hub route in one module registry, so its calls share one budget. */
+async function loadHubRoute(): Promise<Get> {
+  let get: Get | undefined;
+  await jest.isolateModulesAsync(async () => {
+    jest.dontMock(ORIGIN_SEAM);
+    jest.dontMock(TOPOLOGY_SEAM);
+    ({ GET: get } = await import("../route"));
+  });
+  if (get === undefined) throw new Error("the route did not load");
+  return get;
+}
+
+/** A buyer's click on `growth_monthly` carrying `headers`. */
+function click(
+  get: Get,
+  headers: Record<string, string> = {},
+): Promise<Response> {
+  const request = new Request(
+    "https://shop.example.com/api/offerings/checkout/growth_monthly",
+    {
+      headers: {
+        "sec-fetch-mode": "navigate",
+        "sec-fetch-dest": "document",
+        "sec-fetch-site": "same-origin",
+        ...headers,
+      },
+    },
+  );
+  return get(request, {
+    params: Promise.resolve({ lookupKey: "growth_monthly" }),
+  });
+}
+
+function postCount(): number {
+  return fetchMock.mock.calls.filter(
+    ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+  ).length;
+}
+
+function refusedFor(reason: string): number {
+  return warnSpy.mock.calls.filter(
+    ([line]) => line === `[offerings-checkout] refused reason=${reason}`,
+  ).length;
+}
+
 function postHeaders(): Record<string, string> {
   const post = fetchMock.mock.calls.find(
     ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
@@ -220,3 +279,170 @@ describe("the route's API origin comes from the topology seam", () => {
     expect(postHeaders()["x-internal-auth"]).toBeUndefined();
   });
 });
+
+describe("the per-visitor start budget (#9059, #9063)", () => {
+  beforeEach(() => {
+    env.AILK_API_URL = HUB_API;
+    shownStatus = "shown";
+  });
+
+  it("on Vercel, keys on x-vercel-forwarded-for, never a client-chosen x-forwarded-for", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 6; i += 1) {
+      await click(get, {
+        "x-vercel-forwarded-for": "198.51.100.1",
+        "x-forwarded-for": `203.0.113.${i}`,
+        "x-real-ip": `192.0.2.${i}`,
+      });
+    }
+
+    expect(postCount()).toBe(5);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    await click(get, { "x-vercel-forwarded-for": "198.51.100.2" });
+    expect(postCount()).toBe(6);
+  });
+
+  it("off Vercel, reads no address header, so every visitor shares the one wide bucket", async () => {
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 51; i += 1) {
+      await click(get, {
+        "x-vercel-forwarded-for": `198.51.100.${i}`,
+        "x-forwarded-for": `203.0.113.${i}`,
+      });
+    }
+
+    expect(postCount()).toBe(50);
+    expect(refusedFor("rate_limited")).toBe(1);
+  });
+
+  it("charges a visitor with no readable address to the shared bucket, never skips one", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+
+    for (let i = 0; i < 51; i += 1) await click(get);
+
+    expect(postCount()).toBe(50);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    // An addressed visitor keeps a budget of its own.
+    await click(get, { "x-vercel-forwarded-for": "198.51.100.1" });
+    expect(postCount()).toBe(51);
+  });
+
+  it("spends a start only when the API starts a Checkout", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    // The same address in both headers, so the unfixed keying counts it too.
+    const visitor = {
+      "x-vercel-forwarded-for": "198.51.100.1",
+      "x-forwarded-for": "198.51.100.1",
+    };
+
+    const failures = [
+      () => json(502, { error: "upstream" }),
+      () => json(503, { error: "unavailable" }),
+      () => json(500, { error: "internal" }),
+      () => Promise.reject(new TypeError("fetch failed")),
+      () => Promise.reject(new TypeError("fetch failed")),
+    ];
+    for (const failure of failures) {
+      sessionAnswer = failure;
+      await click(get, visitor);
+    }
+    expect(postCount()).toBe(5);
+    expect(refusedFor("rate_limited")).toBe(0);
+
+    sessionAnswer = started;
+    for (let i = 0; i < 5; i += 1) {
+      const res = await click(get, visitor);
+      expect(res.headers.get("location")).toBe(
+        "https://checkout.stripe.com/c/pay/cs_test_a1",
+      );
+    }
+    expect(postCount()).toBe(10);
+
+    const sixth = await click(get, visitor);
+    expect(sixth.headers.get("location")).toBe("/pricing");
+    expect(postCount()).toBe(10);
+    expect(refusedFor("rate_limited")).toBe(1);
+  });
+
+  it("holds a start in flight against the budget, so concurrent clicks cannot overrun it", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    // The same address in both headers, so the unfixed keying counts it too.
+    const visitor = {
+      "x-vercel-forwarded-for": "198.51.100.1",
+      "x-forwarded-for": "198.51.100.1",
+    };
+    const answers: Array<(res: Response) => void> = [];
+    sessionAnswer = () =>
+      new Promise<Response>((resolve) => {
+        answers.push(resolve);
+      });
+
+    const clicks = Array.from({ length: 6 }, () => click(get, visitor));
+    // The sixth is refused while the other five still wait on the API.
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(answers).toHaveLength(5);
+    expect(refusedFor("rate_limited")).toBe(1);
+
+    for (const answer of answers) {
+      answer(
+        new Response(JSON.stringify({ error: "upstream" }), {
+          status: 502,
+          headers: { "content-type": "application/json" },
+        }),
+      );
+    }
+    await Promise.all(clicks);
+
+    // Five failed starts spent nothing, so the visitor can start again.
+    sessionAnswer = started;
+    await click(get, visitor);
+    expect(postCount()).toBe(6);
+  });
+
+  it("a start in flight across the window's end settles on the window it holds", async () => {
+    env.VERCEL = "1";
+    const get = await loadHubRoute();
+    const visitor = { "x-vercel-forwarded-for": "198.51.100.1" };
+    const answers: Array<(res: Response) => void> = [];
+    sessionAnswer = () =>
+      new Promise<Response>((resolve) => {
+        answers.push(resolve);
+      });
+    const now = jest.spyOn(Date, "now");
+    try {
+      now.mockReturnValue(1_000_000);
+      const first = click(get, visitor);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      now.mockReturnValue(1_000_000 + 10 * 60_000);
+      const second = click(get, visitor);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      expect(answers).toHaveLength(2);
+
+      for (const answer of answers) {
+        answer(
+          new Response(JSON.stringify({ error: "upstream" }), {
+            status: 502,
+            headers: { "content-type": "application/json" },
+          }),
+        );
+      }
+      await Promise.all([first, second]);
+
+      // Both failed, so nothing is held: the window admits its full five.
+      sessionAnswer = started;
+      for (let i = 0; i < 6; i += 1) await click(get, visitor);
+      expect(postCount()).toBe(7);
+      expect(refusedFor("rate_limited")).toBe(1);
+    } finally {
+      now.mockRestore();
+    }
+  });
+});

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -6,7 +6,9 @@
 // Only a buyer's page load starts anything: a prefetch, a crawler, a
 // cross-site load or an ungrammatical key is refused before any call. The
 // route then confirms, from a shown-set read shared for 15 seconds, that the
-// site is connected and shows the key — an unconnected site's POST would take
+// site is connected and shows the key — and, for a bundle link, the required
+// product's key it carries as `?with=` (#10028 D10), sent as the body's
+// `requires` — an unconnected site's POST would take
 // the API's env path (#8931 A9) — and POSTs `/v1/checkout/sessions` with
 // success and cancel URLs on the site's configured origin, never the
 // request's. Every refusal is a 303 to `/pricing` with no body and one fixed
@@ -19,6 +21,10 @@ import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
 import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
 import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
+import {
+  clientIpFromHeaders,
+  UNKNOWN_VISITOR_FACTOR,
+} from "../../../../../src/lib/rate-limit";
 import { resolveBaseUrl } from "../../../../../src/lib/routes";
 
 export const runtime = "nodejs";
@@ -166,37 +172,75 @@ function siteOrigin(): string | null {
 const BUDGET_STARTS = 5;
 const BUDGET_WINDOW_MS = 10 * 60_000;
 const BUDGET_MAX_ADDRESSES = 10_000;
-/** An address key is cut to this length, so the Map cannot grow by key size. */
-const BUDGET_ADDRESS_LENGTH = 64;
 
-const starts = new Map<string, { windowStart: number; count: number }>();
+/** One visitor's window: the starts it made, and the ones still in flight. */
+interface StartWindow {
+  windowStart: number;
+  count: number;
+  pending: number;
+}
+
+const starts = new Map<string, StartWindow>();
+/** The address-less visitors' one window, which no address key can evict. */
+const unknownStarts: StartWindow = { windowStart: 0, count: 0, pending: 0 };
 
-function visitorAddress(headers: Headers): string | null {
-  const address =
-    headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
-    headers.get("x-real-ip")?.trim();
-  return address ? address.slice(0, BUDGET_ADDRESS_LENGTH) : null;
+/** Starts `window` afresh once its time is up, in place, so a start in flight settles on it. */
+function rollOver(window: StartWindow, now: number): void {
+  if (now - window.windowStart < BUDGET_WINDOW_MS) return;
+  window.windowStart = now;
+  window.count = 0;
 }
 
 /**
- * Charges one start to `address`, or answers false when its window is spent.
- * The oldest-inserted address is evicted at BUDGET_MAX_ADDRESSES.
+ * The window for `address`, re-inserted when it rolls over so the
+ * oldest-inserted window evicted at BUDGET_MAX_ADDRESSES is the stalest.
  */
-function spendStart(address: string, now: number): boolean {
-  const entry = starts.get(address);
-  if (entry && now - entry.windowStart < BUDGET_WINDOW_MS) {
-    if (entry.count >= BUDGET_STARTS) return false;
-    entry.count += 1;
-    return true;
+function addressWindow(address: string, now: number): StartWindow {
+  const window = starts.get(address);
+  if (window) {
+    if (now - window.windowStart >= BUDGET_WINDOW_MS) {
+      rollOver(window, now);
+      starts.delete(address);
+      starts.set(address, window);
+    }
+    return window;
   }
-  if (entry) {
-    starts.delete(address);
-  } else if (starts.size >= BUDGET_MAX_ADDRESSES) {
+  if (starts.size >= BUDGET_MAX_ADDRESSES) {
     const oldest = starts.keys().next().value;
     if (oldest !== undefined) starts.delete(oldest);
   }
-  starts.set(address, { windowStart: now, count: 1 });
-  return true;
+  const fresh = { windowStart: now, count: 0, pending: 0 };
+  starts.set(address, fresh);
+  return fresh;
+}
+
+/**
+ * Reserves one start for the visitor, or answers null when its window is
+ * spent (#9059). The key is `clientIpFromHeaders`'s (#9967 D1): Vercel's own
+ * `x-vercel-forwarded-for`, read only on Vercel, never a header the client
+ * chooses. A visitor with no readable address shares one window
+ * UNKNOWN_VISITOR_FACTOR times as wide, never skipped. Starts in flight hold
+ * their place, so concurrent clicks cannot overrun the window.
+ */
+function reserveStart(headers: Headers, now: number): StartWindow | null {
+  const address = clientIpFromHeaders(headers);
+  let window = unknownStarts;
+  let limit = UNKNOWN_VISITOR_FACTOR * BUDGET_STARTS;
+  if (address === "unknown") {
+    rollOver(window, now);
+  } else {
+    window = addressWindow(address, now);
+    limit = BUDGET_STARTS;
+  }
+  if (window.count + window.pending >= limit) return null;
+  window.pending += 1;
+  return window;
+}
+
+/** Only a Checkout the API started spends the start (#9063). */
+function settleStart(window: StartWindow, started: boolean): void {
+  window.pending -= 1;
+  if (started) window.count += 1;
 }
 
 // ─── D2 steps 8 and 9 — the start and its answer ────────────────────────────
@@ -263,9 +307,12 @@ async function startCheckout(
   ctx: BuyContext,
 ): Promise<Response> {
   const { lookupKey } = await ctx.params;
+  // #10028 D10 — a bundle link names the required product's key as `?with=`.
+  const withKey = new URL(request.url).searchParams.get("with");
 
   if (!isBuyerNavigation(request)) return refuse("unintended");
   if (!parseLookupKey(lookupKey)) return refuse("ungrammatical");
+  if (withKey !== null && !parseLookupKey(withKey)) return refuse("ungrammatical");
   if (!(await resolveCommerceClaim())) return refuse("no_claim");
   if (process.env.NODE_ENV === "production" && !configuredApiBase()) {
     return refuse("unconnected");
@@ -276,29 +323,33 @@ async function startCheckout(
   if (shown.kind !== "shown" || !isShownLookupKey(shown.shownSet, lookupKey)) {
     return refuse("not_shown");
   }
+  if (withKey !== null && !isShownLookupKey(shown.shownSet, withKey)) {
+    return refuse("not_shown");
+  }
 
   const origin = siteOrigin();
   if (!origin) return refuse("no_origin");
 
-  const address = visitorAddress(request.headers);
-  if (address && !spendStart(address, Date.now())) {
-    return refuse("rate_limited");
-  }
-
-  const started = await settleWithin(
-    checkout
-      .createSession(
-        {
-          productCode: lookupKey,
-          successUrl: `${origin}/purchase/success?session_id={CHECKOUT_SESSION_ID}`,
-          cancelUrl: `${origin}/pricing`,
-        },
-        { headers: startHeaders(request.headers) },
-      )
-      .catch(() => null),
-    START_TIMEOUT_MS,
-    null,
-  );
+  const headers = startHeaders(request.headers);
+  const reserved = reserveStart(request.headers, Date.now());
+  if (!reserved) return refuse("rate_limited");
+
+  // Settled on the API's own answer, not the timeout: a start that answers
+  // late still spends, and one in flight still holds its place.
+  const start = checkout
+    .createSession(
+      {
+        productCode: lookupKey,
+        ...(withKey !== null && { requires: withKey }),
+        successUrl: `${origin}/purchase/success?session_id={CHECKOUT_SESSION_ID}`,
+        cancelUrl: `${origin}/pricing`,
+      },
+      { headers },
+    )
+    .catch(() => null);
+  void start.then((answer) => settleStart(reserved, answer?.ok === true));
+
+  const started = await settleWithin(start, START_TIMEOUT_MS, null);
   if (!started) return refuse("unreachable");
   if (!started.ok) return refuse(`api_${started.status}`);
 

package/templates/apps/web/app/api/offerings/checkout/__tests__/route.test.ts

@@ -29,6 +29,7 @@ jest.mock("@working-theory/license", () => ({
   checkLicense: jest.fn(),
 }));
 
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { GET } from "../[lookupKey]/route";
 
 const mockCheckLicense = checkLicense as jest.MockedFunction<
@@ -209,6 +210,7 @@ const ENV_NAMES = [
   "NODE_ENV",
   "OSS_API_INTERNAL_SECRET",
   "AILK_SPOKE_KEY",
+  "VERCEL",
 ] as const;
 const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
 
@@ -248,6 +250,7 @@ beforeEach(() => {
   env.AILK_API_URL = API;
   env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
   env.NODE_ENV = "test";
+  env.VERCEL = "1";
   shownAnswer = SHOWN;
   postAnswer = STARTED;
   fetchMock.mockClear();
@@ -267,8 +270,9 @@ afterEach(() => {
 
 /**
  * A buyer's card click on `key`: a top-level same-origin navigation to the
- * wrong host, with a session cookie and a fresh forwarded address. A header
- * set to `null` is left out.
+ * wrong host, with a session cookie and fresh forwarded addresses, Vercel's
+ * included, so no two cases share a visitor budget. A header set to `null` is
+ * left out.
  */
 function buyRequest(
   key: string,
@@ -281,6 +285,7 @@ function buyRequest(
     "sec-fetch-dest": "document",
     "sec-fetch-site": "same-origin",
     "x-forwarded-for": freshAddress(),
+    "x-vercel-forwarded-for": freshAddress(),
     ...options.headers,
   };
   const sent = new Headers();
@@ -411,11 +416,18 @@ describe("AC-1 — a shown key on a connected site starts its Checkout", () => {
     );
   });
 
-  it("sends x-internal-auth from OSS_API_INTERNAL_SECRET to an https API", async () => {
-    env.OSS_API_INTERNAL_SECRET = "s3cret";
-    await expectStarted(await buy("growth_monthly"));
-    expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBe("s3cret");
-  });
+  // #9601 — hub-only: a spoke render of the seam withholds the secret even
+  // with no spoke key, so a spoke scaffold skips this case. The sibling
+  // suite's "a spoke with no spoke key never sends the internal secret"
+  // pins the spoke side.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "sends x-internal-auth from OSS_API_INTERNAL_SECRET to an https API",
+    async () => {
+      env.OSS_API_INTERNAL_SECRET = "s3cret";
+      await expectStarted(await buy("growth_monthly"));
+      expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBe("s3cret");
+    },
+  );
 
   it("sends no x-internal-auth when OSS_API_INTERNAL_SECRET is unset", async () => {
     await expectStarted(await buy("growth_monthly"));
@@ -649,6 +661,46 @@ describe("AC-4 — every other outcome returns to /pricing, without throwing and
 
 // ─── AC-5 ───────────────────────────────────────────────────────────────────
 
+// ── #10028 AC-10 — the bundle link's `?with=` ───────────────────────────────
+
+describe("#10028 AC-10 — a shown ?with= key is forwarded as requires; an ungrammatical or unshown one is refused", () => {
+  /** A buyer's click on a bundle link: the plan key with `?with=<required>` in the URL. */
+  function bundleRequest(key: string, withKey: string): Request {
+    const base = buyRequest(key);
+    return new Request(`${base.url}?with=${withKey}`, { method: "GET", headers: base.headers });
+  }
+
+  it("sends the shown ?with= key as the body's requires, beside the plan key", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "growth_yearly"));
+    await expectStarted(res);
+    const [call] = postCalls();
+    expect(JSON.parse(String(call!.init.body))).toEqual({
+      productCode: "growth_monthly",
+      requires: "growth_yearly",
+      successUrl: "https://shop.example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "https://shop.example.com/pricing",
+    });
+  });
+
+  it("builds exactly today's body with no ?with=", async () => {
+    await expectStarted(await buy("growth_monthly"));
+    const [call] = postCalls();
+    expect(JSON.parse(String(call!.init.body))).not.toHaveProperty("requires");
+  });
+
+  it("refuses an ungrammatical ?with= before any call", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "Growth%20Yearly"));
+    await expectRefused(res, "Growth Yearly", "ungrammatical");
+    expect(postCalls()).toHaveLength(0);
+  });
+
+  it("refuses a grammatical ?with= the shown set does not hold, with no POST", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "managed_monthly"));
+    await expectRefused(res, "managed_monthly", "not_shown");
+    expect(postCalls()).toHaveLength(0);
+  });
+});
+
 describe("AC-5 — only a buyer's page load starts anything", () => {
   it.each<
     [string, { method?: string; headers?: Record<string, string | null> }]
@@ -735,7 +787,9 @@ describe("AC-6 — one shared read, a switched-off product stops within it, a pe
 
   it("starts at most 5 Checkouts per visitor per 10 minutes", async () => {
     const from = (address: string) =>
-      buyRequest("growth_monthly", { headers: { "x-forwarded-for": address } });
+      buyRequest("growth_monthly", {
+        headers: { "x-vercel-forwarded-for": address },
+      });
 
     for (let i = 0; i < 5; i += 1) {
       await expectStarted(await buy("growth_monthly", from("192.0.2.50")));
@@ -757,43 +811,27 @@ describe("AC-6 — one shared read, a switched-off product stops within it, a pe
     expect(postCalls()).toHaveLength(7);
   });
 
-  it("keys the budget on the first 64 characters of an address", async () => {
-    const prefix = "f".repeat(64);
-    for (let i = 0; i < 5; i += 1) {
-      await expectStarted(
-        await buy(
-          "growth_monthly",
-          buyRequest("growth_monthly", {
-            headers: { "x-forwarded-for": `${prefix}${i}` },
-          }),
-        ),
-      );
+  it("charges a request with no visitor address to one shared budget, ten times as wide", async () => {
+    jest.setSystemTime(Date.now() + 10 * 60_000);
+    const addressless = () =>
+      buyRequest("growth_monthly", {
+        headers: { "x-forwarded-for": null, "x-vercel-forwarded-for": null },
+      });
+
+    for (let i = 0; i < 50; i += 1) {
+      await expectStarted(await buy("growth_monthly", addressless()));
     }
+    expect(postCalls()).toHaveLength(50);
+
     await expectRefused(
-      await buy(
-        "growth_monthly",
-        buyRequest("growth_monthly", {
-          headers: { "x-forwarded-for": `${prefix}x` },
-        }),
-      ),
+      await buy("growth_monthly", addressless()),
       "growth_monthly",
       "rate_limited",
     );
-    expect(postCalls()).toHaveLength(5);
-  });
+    expect(postCalls()).toHaveLength(50);
 
-  it("does not count a request with no visitor address", async () => {
-    for (let i = 0; i < 7; i += 1) {
-      await expectStarted(
-        await buy(
-          "growth_monthly",
-          buyRequest("growth_monthly", {
-            headers: { "x-forwarded-for": null },
-          }),
-        ),
-      );
-    }
-    expect(postCalls()).toHaveLength(7);
+    await expectStarted(await buy("growth_monthly"));
+    expect(postCalls()).toHaveLength(51);
   });
 
   it("reaches neither Stripe nor the session cookie itself", () => {