create-ailk 0.27.0 → 0.28.1

package/templates/apps/web/app/[locale]/(authed)/account/connect/__tests__/page.test.tsx

@@ -0,0 +1,197 @@
+/**
+ * Tests for /[locale]/account/connect — the hub's consent page (#9966 D2;
+ * AC-4).
+ *
+ * Covers:
+ *   1. A ref that opens and a client the registry answers for renders the
+ *      spoke's registry name, its origin and the signed-in email, and one
+ *      form posting `ref` alone to `/api/auth/hub/authorize`.
+ *   2. A forged ref, a missing ref, a client the registry does not answer for
+ *      and a ref whose `redirect_uri` is on another origin each render
+ *      `hubConnect.unavailable` and no form.
+ *   3. `generateMetadata` answers `referrer: "same-origin"` and `noindex`.
+ *   4. A spoke build is a 404.
+ */
+import { render, screen } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string, values?: Record<string, unknown>): string => {
+        const value = dig(messages, key);
+        if (typeof value !== "string") return `${ns}.${key}`;
+        return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+          values && name in values ? String(values[name]) : m,
+        );
+      };
+    },
+  };
+});
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockSecret = "k".repeat(43);
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session fields can mock without standing up Prisma.
+jest.mock("../../../../../../auth", () => ({
+  __esModule: true,
+  auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
+  resolveSecret: () => mockSecret,
+}));
+
+const mockClientInfo = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  hubSignIn: { clientInfo: (...args: unknown[]) => mockClientInfo(...args) },
+  subscription: { me: jest.fn(), portalSession: jest.fn() },
+  visitorForwardHeaders: () => undefined,
+}));
+
+class NotFound extends Error {}
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: () => {
+    throw new NotFound();
+  },
+  redirect: jest.fn(),
+}));
+
+const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
+jest.mock("../../../../../../lib/topology.generated", () => {
+  const real = jest.requireActual("../../../../../../lib/topology.generated") as Record<string, unknown>;
+  return {
+    ...real,
+    __esModule: true,
+    get TOPOLOGY() {
+      return mockTopology.value;
+    },
+  };
+});
+
+import { mintContinuation } from "../../../../../api/auth/hub/continuation";
+import Page, { generateMetadata } from "../page";
+
+const SPOKE_ORIGIN = "https://spoke.example.com";
+const SPOKE_CALLBACK = `${SPOKE_ORIGIN}/api/hub-session/callback`;
+
+function query(overrides: Record<string, string> = {}): string {
+  return new URLSearchParams({
+    response_type: "code",
+    client_id: "spoke_abc",
+    redirect_uri: SPOKE_CALLBACK,
+    state: "s".repeat(43),
+    code_challenge: "c".repeat(43),
+    code_challenge_method: "S256",
+    ...overrides,
+  }).toString();
+}
+
+const SESSION = {
+  user: { id: "user_1", name: "Ada", email: "ada@example.com", emailVerified: true },
+};
+
+beforeEach(() => {
+  mockTopology.value = "hub";
+  mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockClientInfo.mockReset().mockResolvedValue({
+    ok: true,
+    body: { clientId: "spoke_abc", name: "Acme Studio", origin: SPOKE_ORIGIN },
+  });
+});
+
+async function renderPage(ref?: string | string[]): Promise<void> {
+  const element = await Page({
+    params: Promise.resolve({ locale: "en" }),
+    searchParams: Promise.resolve(ref === undefined ? {} : { ref }),
+  });
+  render(element);
+}
+
+function expectUnavailable(): void {
+  expect(screen.getByTestId("hub-connect-unavailable")).toBeTruthy();
+  expect(screen.getByText("This sign-in can't continue")).toBeTruthy();
+  expect(screen.queryByTestId("hub-connect-form")).toBeNull();
+  expect(document.querySelector("form")).toBeNull();
+}
+
+describe("the consent page (#9966 D2, AC-4)", () => {
+  it("names the spoke from the registry and posts the ref alone to the authorize route", async () => {
+    const ref = mintContinuation(query(), mockSecret);
+
+    await renderPage(ref);
+
+    expect(screen.getByRole("heading", { level: 1 }).textContent).toBe("Sign in to Acme Studio?");
+    expect(screen.getByText(/https:\/\/spoke\.example\.com will see your name/).textContent).toContain(
+      "ada@example.com",
+    );
+    expect(mockClientInfo).toHaveBeenCalledWith("spoke_abc");
+    const form = screen.getByTestId("hub-connect-form") as HTMLFormElement;
+    expect(form.getAttribute("method")).toBe("post");
+    expect(form.getAttribute("action")).toBe("/api/auth/hub/authorize");
+    const fields = Array.from(form.querySelectorAll("input"));
+    expect(fields.map((f) => [f.type, f.name, f.value])).toEqual([["hidden", "ref", ref]]);
+    expect(screen.getByTestId("hub-connect-continue").textContent).toBe("Continue");
+    expect(screen.getByTestId("hub-connect-cancel").getAttribute("href")).toBe("/account");
+  });
+
+  it.each([
+    ["a forged ref", () => "x".repeat(80)],
+    ["no ref", () => undefined],
+    ["two refs", () => [mintContinuation(query(), mockSecret), mintContinuation(query(), mockSecret)]],
+    ["a ref sealing a query that fails the schema", () => mintContinuation(query({ code_challenge_method: "plain" }), mockSecret)],
+  ])("%s renders unavailable and no form", async (_name, ref) => {
+    await renderPage(ref());
+    expectUnavailable();
+  });
+
+  it("a client the registry does not answer for renders unavailable and no form", async () => {
+    mockClientInfo.mockResolvedValue({ ok: false, status: 404, body: null });
+    await renderPage(mintContinuation(query(), mockSecret));
+    expectUnavailable();
+  });
+
+  it("a registry read that throws renders unavailable and no form", async () => {
+    mockClientInfo.mockRejectedValue(new Error("network"));
+    await renderPage(mintContinuation(query(), mockSecret));
+    expectUnavailable();
+  });
+
+  it("a ref whose redirect_uri is on another origin than the registry names renders unavailable (SEC-9966-10)", async () => {
+    await renderPage(
+      mintContinuation(query({ redirect_uri: "https://other.example.com/api/hub-session/callback" }), mockSecret),
+    );
+    expectUnavailable();
+  });
+
+  it("generateMetadata keeps the ref out of a cross-site Referer and the page out of the index", async () => {
+    const metadata = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({}),
+    });
+    expect(metadata).toEqual({
+      title: "Sign in to a site",
+      robots: { index: false, follow: false },
+      referrer: "same-origin",
+    });
+  });
+
+  it("a spoke build is a 404", async () => {
+    mockTopology.value = "spoke";
+    await expect(renderPage(mintContinuation(query(), mockSecret))).rejects.toBeInstanceOf(NotFound);
+    expect(mockClientInfo).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/connect/page.tsx

@@ -0,0 +1,152 @@
+/**
+ * /[locale]/account/connect — the hub asks a person once per spoke before it
+ * tells that spoke who they are (#9966 D2, #7978).
+ *
+ * The authorize step (`app/api/auth/hub/authorize/route.ts`) sends a signed-in
+ * person here when the API answers `consent_required`, with the six validated
+ * authorize keys sealed as `ref`. This page opens the ref, names the spoke
+ * from the registry (`hubSignIn.clientInfo`) — never from the query — and
+ * offers one Continue: a same-origin form POST of `ref` back to the authorize
+ * route, which alone sends `consent: true`. Cancel goes to `/account`.
+ *
+ * The form renders only when the ref's `redirect_uri` is on the origin the
+ * registry names, so the page never names one site while the code goes to
+ * another. Anything that does not hold — a ref that does not open, a client
+ * the registry does not answer for — renders `hubConnect.unavailable` and no
+ * form. A spoke carries no hub routes, so a spoke build is a 404. `noindex`,
+ * and `referrer: same-origin`, which keeps the ref out of any cross-site
+ * Referer while the browser still sends the real `Origin` on Continue.
+ */
+
+import { hubSignIn } from "@working-theory/api-client";
+import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Input, Link, Text } from "@working-theory/ui/primitives";
+import { hubAuthorizeQuerySchema, type HubAuthorizeQuery } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { resolveSecret } from "../../../../../auth";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
+import { openContinuation } from "../../../../api/auth/hub/continuation";
+import { accountSession } from "../account-data";
+
+/** The authorize route's POST — the one request that says yes. */
+const AUTHORIZE_PATH = "/api/auth/hub/authorize";
+
+const QUERY_KEYS = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "code_challenge",
+  "code_challenge_method",
+] as const;
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ ref?: string | string[] }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "hubConnect" });
+  return {
+    title: t("metaTitle"),
+    robots: { index: false, follow: false },
+    referrer: "same-origin",
+  };
+}
+
+/** The sealed authorize query, or `null` when the ref does not open or parse. */
+function openQuery(ref: string | string[] | undefined): HubAuthorizeQuery | null {
+  if (typeof ref !== "string") return null;
+  const search = openContinuation(ref, resolveSecret());
+  if (search === null) return null;
+  const params = new URLSearchParams(search);
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) raw[key] = params.get(key) ?? undefined;
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  return parsed.success ? parsed.data : null;
+}
+
+function originOf(url: string): string | null {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+
+/** The spoke's registry name and origin, or `null` when it cannot be read. */
+async function readClient(clientId: string): Promise<{ name: string; origin: string } | null> {
+  try {
+    const res = await hubSignIn.clientInfo(clientId);
+    return res.ok ? { name: res.body.name, origin: res.body.origin } : null;
+  } catch {
+    return null;
+  }
+}
+
+export default async function HubConnectPage({ params, searchParams }: Props): Promise<ReactElement> {
+  if (TOPOLOGY === "spoke") notFound();
+  const { locale } = await params;
+  const { ref } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "hubConnect" });
+
+  const query = openQuery(ref);
+  const client = query ? await readClient(query.client_id) : null;
+  const session = await accountSession(locale);
+  const ready =
+    typeof ref === "string" &&
+    query !== null &&
+    client !== null &&
+    session !== null &&
+    originOf(query.redirect_uri) === client.origin;
+
+  if (!ready) {
+    return (
+      <div className="flex max-w-3xl flex-col gap-6 py-8" data-testid="hub-connect-unavailable">
+        <div>
+          <Heading level={1} visual={2}>
+            {t("unavailable.title")}
+          </Heading>
+          <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight">
+            {t("unavailable.body")}
+          </Text>
+        </div>
+        <Link href={localeHref(locale, "/account")} data-testid="hub-connect-back">
+          {t("unavailable.back")}
+        </Link>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex max-w-3xl flex-col gap-8 py-8" data-testid="hub-connect">
+      <div>
+        <Heading level={1} visual={2}>
+          {t("title", { name: client.name })}
+        </Heading>
+        <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight">
+          {t("lead", { origin: client.origin, email: session.ctx.user.email })}
+        </Text>
+      </div>
+      <form
+        method="post"
+        action={AUTHORIZE_PATH}
+        className="flex flex-wrap items-center gap-4"
+        data-testid="hub-connect-form"
+      >
+        <Input type="hidden" name="ref" value={ref} />
+        <Button type="submit" size="big" data-testid="hub-connect-continue">
+          {t("continue")}
+        </Button>
+        <Link href={localeHref(locale, "/account")} data-testid="hub-connect-cancel">
+          {t("cancel")}
+        </Link>
+      </form>
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/about/__tests__/about-routes.test.tsx

@@ -329,7 +329,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("sitemap.xml: one <loc> ending in /about/sam-henry, none ending in a bare /sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter });
+    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
     const response = await GET();
     const text = await response.text();
     const locs = Array.from(text.matchAll(/<loc>([^<]*)<\/loc>/g)).map(
@@ -341,7 +341,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("llms.txt: names a URL ending in /about/sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter });
+    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
     const response = await GET();
     const text = await response.text();
     expect(text).toContain("URL: https://site.example/about/sam-henry");

package/templates/apps/web/app/[locale]/careers/[slug]/[action]/page.tsx

@@ -21,6 +21,16 @@
  * are shared across requests for 15 seconds per server instance, as
  * /contact's are (#8731). Full-screen (`isMagnetWalkPath` matches the path),
  * so it draws its own back arrow, and `noindex, follow` like the walk.
+ *
+ * #10054 D4 — a posting may name its magnet (`applicationFlow`). The page
+ * reads it through the same shared read, keyed per flow (the keys are only
+ * slugs content names: the posting must exist before any read), and renders
+ * its step 1 when it maps; the submission then records the flow beside the
+ * posting (`apply.actions.ts` D6). A flow the hub answers absent — any non-ok
+ * answer below 500, as the walk's `readMagnet` reads it — or whose step 1
+ * does not map falls back to the Job application and is logged with the two
+ * slugs. A failed read (5xx, a throw) falls back silently, as a down hub
+ * always has.
  */
 import { flows, leads } from "@working-theory/api-client";
 import { flowRouteMetadata } from "@working-theory/metadata";
@@ -33,6 +43,7 @@ import {
 } from "@working-theory/ui";
 import { NavBackLink } from "@working-theory/ui/chrome";
 import {
+  flowSlugSchema,
   JOB_APPLICATION_FLOW_SLUG,
   type FlowConfig,
 } from "@working-theory/validation";
@@ -41,7 +52,7 @@ import { notFound } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
-import { postingTitle } from "../../../../../lib/posting-title";
+import { postingForApply, type ApplyPosting } from "../../../../../lib/posting-title";
 import { contactFormText } from "../../../contact/contact-form-text";
 import { readSiteContactEmail } from "../../../contact/site-contact-email";
 import { captureLeadAction } from "../apply.actions";
@@ -94,51 +105,91 @@ function readAccepting(): Promise<boolean> {
   });
 }
 
-/** The served Job application magnet's config, or `null` for any failed read. */
-function readJobApplicationMagnet(): Promise<FlowConfig | null> {
-  return sharedHubRead("job-application-magnet", async () => {
+type MagnetConfigRead =
+  | { kind: "ok"; config: FlowConfig }
+  | { kind: "absent" }
+  | { kind: "failed" };
+
+/**
+ * A served magnet's config: `absent` for a non-ok answer below 500, `failed`
+ * for a 5xx or a throw. Never called with a slug content did not name.
+ */
+function readMagnetConfig(flowSlug: string): Promise<MagnetConfigRead> {
+  return sharedHubRead(`magnet:${flowSlug}`, async () => {
     try {
-      const res = await flows.get(JOB_APPLICATION_FLOW_SLUG);
-      return res.ok ? res.body : null;
+      const res = await flows.get(flowSlug);
+      if (res.ok) return { kind: "ok", config: res.body };
+      return res.status >= 500 ? { kind: "failed" } : { kind: "absent" };
     } catch {
-      return null;
+      return { kind: "failed" };
     }
   });
 }
 
-/** The posting's title, or `null` for a segment pair this page does not serve. */
-async function titleFor(
+type ApplicationForm = ReturnType<typeof jobApplicationFormFallback>;
+
+/**
+ * The form a posting's page draws (D4), and the flow it records when that is
+ * the posting's own; with none named, exactly the Job application path.
+ */
+async function applicationForm(
+  slug: string,
+  { applicationFlow: named }: ApplyPosting,
+  locale: string,
+): Promise<{ view: ApplicationForm; applicationFlow?: string }> {
+  if (named !== undefined && named !== JOB_APPLICATION_FLOW_SLUG) {
+    const read: MagnetConfigRead = flowSlugSchema.safeParse(named).success
+      ? await readMagnetConfig(named)
+      : { kind: "absent" };
+    const view = read.kind === "ok" ? jobApplicationFormFromConfig(read.config, locale) : null;
+    if (view) return { view, applicationFlow: named };
+    if (read.kind !== "failed") {
+      console.warn("[careers] application flow unavailable — falling back to job-application", {
+        posting: slug,
+        flow: named,
+        reason: read.kind === "ok" ? "unmappable" : "absent",
+      });
+    }
+  }
+  const read = await readMagnetConfig(JOB_APPLICATION_FLOW_SLUG);
+  return {
+    view:
+      (read.kind === "ok" ? jobApplicationFormFromConfig(read.config, locale) : null) ??
+      jobApplicationFormFallback(locale),
+  };
+}
+
+/** The posting, or `null` for a segment pair this page does not serve. */
+async function postingFor(
   slug: string,
   action: string,
   locale: string,
-): Promise<string | null> {
+): Promise<ApplyPosting | null> {
   if (action !== "apply" || !POSTING_SLUG_RE.test(slug)) return null;
-  return postingTitle(slug, locale);
+  return postingForApply(slug, locale);
 }
 
 export async function generateMetadata({ params }: Props): Promise<Metadata> {
   const { locale, slug, action } = await params;
-  const title = await titleFor(slug, action, locale);
-  return title === null ? flowRouteMetadata() : flowRouteMetadata({ title });
+  const posting = await postingFor(slug, action, locale);
+  return posting === null ? flowRouteMetadata() : flowRouteMetadata({ title: posting.title });
 }
 
 export default async function Page({ params }: Props): Promise<ReactElement> {
   const { locale, slug, action } = await params;
-  const title = await titleFor(slug, action, locale);
-  if (title === null) notFound();
+  const posting = await postingFor(slug, action, locale);
+  if (posting === null) notFound();
+  const { title } = posting;
 
-  const [accepting, t, tCareers, tFlow, magnet] = await Promise.all([
+  const [accepting, t, tCareers, tFlow, { view, applicationFlow }] = await Promise.all([
     readAccepting(),
     getTranslations({ locale, namespace: "contact" }),
     getTranslations({ locale, namespace: "careers" }),
     getTranslations({ locale, namespace: "flow" }),
-    readJobApplicationMagnet(),
+    applicationForm(slug, posting, locale),
   ]);
   const text = contactFormText(t);
   const contactEmail = readSiteContactEmail();
-  const view =
-    (magnet ? jobApplicationFormFromConfig(magnet, locale) : null) ??
-    jobApplicationFormFallback(locale);
 
   return (
     <main id="main" data-testid="job-apply">
@@ -155,7 +206,11 @@ export default async function Page({ params }: Props): Promise<ReactElement> {
           </Heading>
           {accepting ? (
             <LeadCaptureForm
-              action={captureLeadAction.bind(null, slug)}
+              action={
+                applicationFlow === undefined
+                  ? captureLeadAction.bind(null, slug)
+                  : captureLeadAction.bind(null, { job: slug, flow: applicationFlow })
+              }
               text={
                 view.consentStatement
                   ? { ...text, consentStatement: view.consentStatement }

package/templates/apps/web/app/[locale]/careers/[slug]/apply.actions.ts

@@ -25,13 +25,19 @@
  * the API so (`consent: true`, #9130): the hub requires it of a
  * `flow:job-application` lead and records `payload.consent` itself.
  *
+ * #10054 D6 — a posting that names its own magnet binds `{ job, flow }`
+ * instead: the flow, slug-checked, is written as `payload.applicationFlow`
+ * beside `job`, and no form field overrides it. The source stays
+ * `flow:job-application`, so the hub still records consent.
+ *
  * Checks, before any write: the honeypot (a filled one answers success and
  * sends nothing); first name, last name and email required; a LinkedIn URL,
  * when given, an http(s) URL — a bare domain gains `https://`, the flow
  * engine's `url` idiom; the terms box ticked, as the form block requires; and
  * the per-visitor limit /contact runs, in /contact's own bucket so a visitor's
- * lead posts stay at 30 per 10 minutes however they are split (skipped when
- * no client address is readable). Outcomes map as /contact's do: the API's
+ * lead posts stay at 30 per 10 minutes however they are split (with no
+ * readable client address, /contact's shared, wider bucket — never skipped,
+ * #9967). Outcomes map as /contact's do: the API's
  * `lead_capture_not_configured` or an unreachable API is `unavailable`, any
  * other refusal the generic error.
  */
@@ -44,6 +50,7 @@ import {
 import {
   accountEmailHintSchema,
   flowLeadSource,
+  flowSlugSchema,
   JOB_APPLICATION_FLOW_SLUG,
   leadSubmitNextSchema,
 } from "@working-theory/validation";
@@ -52,15 +59,13 @@ import { getLocale, getTranslations } from "next-intl/server";
 import { z } from "zod";
 
 import { accountInviteHref } from "../../../../lib/account-invite";
+import { runBotCheck } from "../../../../lib/bot-check";
 import {
   consentVisitorHeader,
   readConsentVisitor,
 } from "../../../../lib/consent-visitor";
 import { writeLead } from "../../../../src/lib/lead-write";
-import {
-  checkRateLimit,
-  clientIpFromHeaders,
-} from "../../../../src/lib/rate-limit";
+import { takeVisitorLimit } from "../../../../src/lib/rate-limit";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
 const RATE_LIMITED =
@@ -69,6 +74,8 @@ const CONSENT_REQUIRED = "Please accept the terms to send your application.";
 
 const RATE_LIMIT_MAX_CALLS = 30;
 const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+/** Outside a request scope there is no address: the shared bucket. */
+const NO_HEADERS = { get: () => null };
 
 const SOURCE = flowLeadSource(JOB_APPLICATION_FLOW_SLUG);
 const JOB_SLUG_RE = /^[a-z0-9][a-z0-9-]{0,127}$/;
@@ -84,6 +91,7 @@ const RESERVED_FIELDS = new Set([
   "consent",
   "name",
   "job",
+  "applicationFlow",
   "source",
   LEAD_CAPTURE_HONEYPOT,
 ]);
@@ -191,8 +199,22 @@ async function successState(
   }
 }
 
+/**
+ * The bound posting: today's string `job`, or `{ job, flow }` (D6). `null`
+ * for anything else — a bound argument comes back from the browser, so its
+ * type is checked, not only its text.
+ */
+function readPosting(posting: unknown): { job: string; applicationFlow?: string } | null {
+  if (typeof posting === "string") return JOB_SLUG_RE.test(posting) ? { job: posting } : null;
+  if (typeof posting !== "object" || posting === null) return null;
+  const { job, flow } = posting as { job?: unknown; flow?: unknown };
+  if (typeof job !== "string" || !JOB_SLUG_RE.test(job)) return null;
+  if (!flowSlugSchema.safeParse(flow).success) return null;
+  return { job, applicationFlow: flow as string };
+}
+
 export async function captureLeadAction(
-  job: string,
+  posting: string | { job: string; flow: string },
   _prevState: LeadCaptureFormState,
   formData: FormData,
 ): Promise<LeadCaptureFormState> {
@@ -200,10 +222,11 @@ export async function captureLeadAction(
   if (typeof honeypot === "string" && honeypot !== "")
     return { kind: "success" };
 
-  // A bound argument comes back from the browser: check its type, not only its text.
-  if (typeof job !== "string" || !JOB_SLUG_RE.test(job)) {
+  const attribution = readPosting(posting);
+  if (attribution === null) {
     return { kind: "error", message: GENERIC_ERROR };
   }
+  const { job, applicationFlow } = attribution;
 
   const fieldErrors: Record<string, string> = {};
   if (formData.get("consent") !== "true")
@@ -238,6 +261,7 @@ export async function captureLeadAction(
     ...(phone !== undefined && { phone }),
     ...(linkedin_url !== undefined && { linkedin_url }),
     job,
+    ...(applicationFlow !== undefined && { applicationFlow }),
   };
 
   let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
@@ -247,16 +271,13 @@ export async function captureLeadAction(
     // No request scope — no forwarding, and the visitor is "unknown".
   }
 
-  const visitor = requestHeaders
-    ? clientIpFromHeaders(requestHeaders)
-    : "unknown";
   if (
-    visitor !== "unknown" &&
-    !checkRateLimit(
-      `contact:${visitor}`,
+    !takeVisitorLimit(
+      "contact",
+      requestHeaders ?? NO_HEADERS,
       RATE_LIMIT_MAX_CALLS,
       RATE_LIMIT_WINDOW_MS,
-    )
+    ).allowed
   ) {
     return { kind: "error", message: RATE_LIMITED };
   }
@@ -282,6 +303,15 @@ export async function captureLeadAction(
     // No request scope — submit with no visitor-link header.
   }
 
+  // #9255 D4 — the spoke edge's bot check, immediately before the write.
+  const botCheck = await runBotCheck({
+    source: "bot-check",
+    target: "captureLeadAction",
+    scope: "write",
+  });
+  if (botCheck === "bot") return { kind: "error", message: GENERIC_ERROR };
+  if (botCheck === "unavailable") return { kind: "unavailable" };
+
   const res = await writeLead(
     { source: SOURCE, email, page: "careers", consent: true, payload },
     init,