@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/billing/enforcement.ts

@@ -1,8 +1,10 @@
 // Plan limits at the points where they apply. The "entitlements" flag lets
 // limits run in shadow mode first: violations are logged, nothing is blocked.
+import { PLANS, type PlanId } from "../../billing/plan-catalog.js";
 import type { Env } from "../core.js";
 import { response } from "../core.js";
-import { flagMode, flagOn } from "../flags.js";
+import { featureEnabled, featureState } from "../feature-access.js";
+import { flagMode } from "../flags.js";
 import { getEntitlements } from "./entitlements.js";
 import { canSpend } from "./ledger.js";
 
@@ -10,14 +12,38 @@ export type EnforcementMode = "enforce" | "shadow" | "off";
 
 export async function entitlementMode(env: Env, workspaceId: string | null): Promise<EnforcementMode> {
   const mode = flagMode(env, "entitlements");
-  if (mode === "on") return "enforce";
   if (mode === "shadow") return "shadow";
-  if (mode === "off" || !workspaceId) return "off";
-  return (await flagOn(env, workspaceId, "entitlements")) ? "enforce" : "off";
+  if (!workspaceId) return mode === "on" ? "enforce" : "off";
+  // Kill switch, beta opt-in and a workspace override (e.g. limits lifted
+  // during an incident) all come from the shared evaluator.
+  return (await featureState(env, workspaceId, "entitlements")).enabled ? "enforce" : "off";
 }
 
-function planLimit(message: string, limit: string, extra: Record<string, unknown> = {}): Response {
-  return response({ error: message, code: "plan_limit", limit, upgradeUrl: "/billing", ...extra }, 402);
+/** Where Billing lives, relative (for the dashboard) and absolute (for the CLI, email and anything outside it). */
+export function billingLinks(env: Env, workspaceId: string | null, plan?: PlanId | null): { upgradeUrl: string; billingUrl: string } {
+  const query = new URLSearchParams();
+  if (workspaceId) query.set("workspace", workspaceId);
+  if (plan) query.set("plan", plan);
+  const search = query.toString();
+  const upgradeUrl = `/billing${search ? `?${search}` : ""}`;
+  return { upgradeUrl, billingUrl: `${(env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "")}${upgradeUrl}` };
+}
+
+/** The smallest paid plan with room for more projects than `current`; Enterprise when none has. */
+export function planForProjects(current: number): PlanId {
+  for (const plan of ["team", "business"] as const) {
+    const limit = PLANS[plan].projects;
+    if (limit === null || limit > current) return plan;
+  }
+  return "enterprise";
+}
+
+export function planLimitBody(env: Env, workspaceId: string | null, message: string, limit: string, extra: Record<string, unknown> & { suggestedPlan?: PlanId } = {}) {
+  return { error: message, code: "plan_limit", limit, ...billingLinks(env, workspaceId, extra.suggestedPlan), ...extra };
+}
+
+function planLimit(env: Env, workspaceId: string, message: string, limit: string, extra: Record<string, unknown> & { suggestedPlan?: PlanId } = {}): Response {
+  return response(planLimitBody(env, workspaceId, message, limit, extra), 402);
 }
 
 /** Null when allowed; otherwise the response to return. */
@@ -32,10 +58,18 @@ async function decide(env: Env, workspaceId: string, violation: Response | null,
 export async function checkProjectLimit(env: Env, workspaceId: string): Promise<Response | null> {
   const { projects } = await getEntitlements(env, workspaceId);
   if (projects === null) return null;
-  const row = await env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL")
+  // Paused (inactive) projects don't count until someone activates them.
+  const row = await env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL AND inactive_at IS NULL")
     .bind(workspaceId).first<{ count: number }>();
-  const violation = (row?.count ?? 0) >= projects
-    ? planLimit(`Your plan includes ${projects} project${projects === 1 ? "" : "s"}. Upgrade to add more.`, "projects", { included: projects })
+  const count = row?.count ?? 0;
+  const suggestedPlan = planForProjects(count);
+  const violation = count >= projects
+    ? planLimit(
+      env, workspaceId,
+      `Your plan includes ${projects} project${projects === 1 ? "" : "s"} and this workspace has ${count}. ${suggestedPlan === "enterprise" ? "Contact us about Enterprise" : `Upgrade to ${PLANS[suggestedPlan].name}`} to add more.`,
+      "projects",
+      { included: projects, suggestedPlan },
+    )
     : null;
   return decide(env, workspaceId, violation, "project creation");
 }
@@ -52,18 +86,39 @@ export function executionModeOf(value: unknown): ExecutionMode | null {
  * A cloud run needs the cloud-runner rollout and minutes (or budget) left.
  */
 export async function checkCloudRun(env: Env, workspaceId: string): Promise<Response | null> {
-  if (!(await flagOn(env, workspaceId, "cloud_runners"))) {
+  if (!(await featureEnabled(env, workspaceId, "cloud_runners"))) {
     return response({ error: "Bugmole Cloud runs aren't available for this workspace yet. Run on your own machine or CI.", code: "cloud_unavailable" }, 422);
   }
   const decision = await canSpend(env, workspaceId, "browser_minute", 1);
   const violation = decision.allowed
     ? null
-    : planLimit(decision.message, decision.reason === "spending_limit" ? "spending_limit" : decision.reason === "suspended" ? "payment" : "cloud_minutes");
+    : planLimit(env, workspaceId, decision.message, decision.reason === "spending_limit" ? "spending_limit" : decision.reason === "suspended" ? "payment" : "cloud_minutes");
   return decide(env, workspaceId, violation, "cloud run");
 }
 
+/** Runs that finished before this are past the plan's history. Null keeps everything. */
+export function historyCutoff(historyDays: number | null, now: Date): string | null {
+  return historyDays === null ? null : new Date(now.getTime() - historyDays * 86_400_000).toISOString();
+}
+
+/**
+ * The history cutoff reads apply: the same one the retention job deletes at,
+ * and only once plan limits are enforced (shadow and off keep everything).
+ */
 export async function historyCutoffFor(env: Env, workspaceId: string | null, now = new Date()): Promise<string | null> {
   if (!workspaceId || (await entitlementMode(env, workspaceId)) !== "enforce") return null;
   const { historyDays } = await getEntitlements(env, workspaceId);
-  return historyDays === null ? null : new Date(now.getTime() - historyDays * 86_400_000).toISOString();
+  return historyCutoff(historyDays, now);
+}
+
+const TERMINAL_RUN = new Set(["success", "partial", "error", "cancelled"]);
+
+/** Whether a run is past the history cutoff: finished, and finished before it. Unfinished runs are never hidden. */
+export function runExpired(run: { status: string; completedAt?: string | null; requestedAt?: string | null }, cutoff: string | null): boolean {
+  if (!cutoff || !TERMINAL_RUN.has(run.status)) return false;
+  const at = run.completedAt ?? run.requestedAt;
+  if (!at) return false;
+  // D1's CURRENT_TIMESTAMP is "YYYY-MM-DD HH:MM:SS" in UTC.
+  const time = Date.parse(/[zZ]|[+-]\d\d:\d\d$/.test(at) ? at : `${at.replace(" ", "T")}Z`);
+  return Number.isFinite(time) && time < Date.parse(cutoff);
 }

package/src/registry-worker/billing/paypal/api.ts

@@ -126,6 +126,20 @@ export async function cancelPayPalSubscription(env: PayPalEnv, id: string, reaso
   return fail(res, "cancel subscription");
 }
 
+/**
+ * Restarts a SUSPENDED subscription. PayPal only activates suspended ones: a
+ * CANCELLED or EXPIRED subscription is final and needs a new checkout.
+ */
+export async function activatePayPalSubscription(env: PayPalEnv, id: string, reason: string): Promise<void> {
+  const res = await payPalApiFetch(env, subscriptionPath(id, "/activate"), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ reason: reason.slice(0, 128) }),
+  });
+  if (res.ok) return;
+  return fail(res, "activate subscription");
+}
+
 /**
  * Refunds part of a subscription payment. Subscription payments are sales,
  * refunded through /v1/payments/sale/{id}/refund (v2 only refunds captures).

package/src/registry-worker/billing/paypal/client.ts

@@ -45,6 +45,15 @@ export function payPalCredentials(env: PayPalEnv): Credentials | null {
   return { clientId, clientSecret, apiBase: sandbox ? SANDBOX_BASE : LIVE_BASE };
 }
 
+/**
+ * PayPal's "Automatic payments" page, where a subscriber changes the card or
+ * bank a subscription charges. There's no API for it: the subscriber does it
+ * signed in to PayPal, in the same environment the subscription lives in.
+ */
+export function payPalAutopayUrl(env: PayPalEnv): string {
+  return env.PAYPAL_ENV === "sandbox" ? "https://www.sandbox.paypal.com/myaccount/autopay/" : "https://www.paypal.com/myaccount/autopay/";
+}
+
 export function isPayPalConfigured(env: PayPalEnv): boolean {
   return payPalCredentials(env) !== null;
 }

package/src/registry-worker/billing/paypal/provider.ts

@@ -3,8 +3,9 @@
 import type { BillingInterval } from "../../../billing/plan-catalog.js";
 import type { Env } from "../../core.js";
 import { registerBillingProvider, toCents, fromCents, type BillingProvider, type PaidPlan, type ProviderSubscription } from "../provider.js";
-import { isPayPalConfigured, type PayPalEnv } from "./client.js";
+import { isPayPalConfigured, payPalAutopayUrl, type PayPalEnv } from "./client.js";
 import {
+  activatePayPalSubscription,
   cancelPayPalSubscription,
   createPayPalSubscription,
   getPayPalInvoiceStatus,
@@ -105,6 +106,14 @@ export const payPalProvider: BillingProvider = {
     return cancelPayPalSubscription(payPal(env), id, reason);
   },
 
+  reactivateSubscription(env, id, reason) {
+    return activatePayPalSubscription(payPal(env), id, reason);
+  },
+
+  manageUrl(env) {
+    return payPalAutopayUrl(payPal(env));
+  },
+
   async refund(env, payment, amountCents, requestId, description) {
     const result = await refundPayPalSale(payPal(env), payment.reference, { total: fromCents(amountCents), currency: payment.currency }, requestId, description);
     return { reference: result.id };

package/src/registry-worker/billing/paypal.test.ts

@@ -3,7 +3,7 @@ import test from "node:test";
 import type { Env } from "../core.js";
 import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
 import { recordUsage } from "./ledger.js";
-import { changeKind, closeUsagePeriods, chaseOverdueInvoices, syncWorkspaceBilling, CANCEL_REASON, SCHEDULED_REASON, UPGRADE_REASON } from "./subscriptions.js";
+import { changeKind, closeUsagePeriods, chaseOverdueInvoices, syncWorkspaceBilling, CANCEL_REASON, RESUME_REASON, SCHEDULED_REASON, UPGRADE_REASON } from "./subscriptions.js";
 import { freePlan } from "./entitlements.js";
 import { proRataCents, toCents } from "./provider.js";
 import { canSpend } from "./ledger.js";
@@ -46,6 +46,16 @@ function fakePayPal() {
     }
     let match = path.match(/^\/v1\/billing\/subscriptions\/([^/]+)\/transactions$/);
     if (match) return Response.json({ transactions: (state.sales.get(match[1]) ?? []).map((sale) => ({ ...sale, amount_with_breakdown: { gross_amount: { value: sale.amount, currency_code: "USD" } } })) });
+    match = path.match(/^\/v1\/billing\/subscriptions\/([^/]+)\/activate$/);
+    if (match) {
+      // Like PayPal: only a SUSPENDED subscription can be activated again.
+      const sub = state.subscriptions.get(match[1]);
+      if (!sub || sub.status !== "SUSPENDED") {
+        return Response.json({ name: "UNPROCESSABLE_ENTITY", details: [{ issue: "SUBSCRIPTION_STATUS_INVALID" }] }, { status: 422 });
+      }
+      Object.assign(sub, { status: "ACTIVE", status_change_note: body.reason });
+      return new Response(null, { status: 204 });
+    }
     match = path.match(/^\/v1\/billing\/subscriptions\/([^/]+)\/cancel$/);
     if (match) {
       const sub = state.subscriptions.get(match[1]);
@@ -464,3 +474,100 @@ test("the billing contact is saved for receipts and validated", async () => {
   assert.equal(receipt.json.invoice.billingName, "Acme Ltd");
   assert.equal(receipt.json.invoice.kind, "subscription");
 });
+
+// --- Keeping a plan, and changing how it's paid -------------------------------------------------
+
+test("keeping a cancelled plan: PayPal can't restart it, so a new subscription starts when the period ends", async () => {
+  const paypal = fakePayPal();
+  const { env, db, workspaceId, owner, subscriptionId } = await activeTeam(paypal);
+  const resume = () => call(env, "POST", `/api/workspaces/${workspaceId}/billing/resume`, { as: owner });
+  assert.equal((await resume()).json.code, "not_cancelled", "a renewing plan has nothing to undo");
+
+  assert.equal((await call(env, "POST", `/api/workspaces/${workspaceId}/billing/cancel`, { as: owner })).status, 200);
+  assert.equal(paypal.state.subscriptions.get(subscriptionId)!.status, "CANCELLED", "cancelling ends the PayPal subscription right away");
+  const periodEnd = (db.db.prepare("SELECT current_period_end AS end FROM workspace_plans WHERE workspace_id = ?").get(workspaceId) as any).end;
+
+  const kept = await resume();
+  assert.equal(kept.status, 200, JSON.stringify(kept.json));
+  assert.equal(kept.json.status, "checkout_required");
+  assert.match(kept.json.message, /can't be restarted/);
+  assert.equal(kept.json.effective, "period_end");
+  assert.equal(paypal.state.calls.filter((c) => c.path.endsWith("/activate")).length, 0, "a cancelled subscription isn't activated");
+  const newSub = kept.json.approveUrl.split("/").pop();
+  assert.notEqual(newSub, subscriptionId);
+  assert.equal(paypal.state.subscriptions.get(newSub)!.plan_id, "P-TEAM-M", "the same plan and interval");
+  assert.equal(paypal.state.subscriptions.get(newSub)!.start_time, new Date(Date.parse(periodEnd)).toISOString(), "starts when the paid period ends: no double charge");
+
+  paypal.approve(newSub);
+  const done = await call(env, "POST", `/api/workspaces/${workspaceId}/billing/checkout/${kept.json.checkoutId}/complete`, { as: owner });
+  assert.equal(done.json.status, "scheduled");
+  const billing = await call(env, "GET", `/api/workspaces/${workspaceId}/billing`, { as: owner });
+  assert.deepEqual(billing.json.subscription.changesTo, { plan: "team", interval: "month" });
+  const audit = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.ok(audit.json.entries.some((entry: { action: string }) => entry.action === "billing.resume_needs_checkout"));
+
+  // The period ends and the new subscription takes its first payment: still Team, never Free.
+  const after = new Date(Date.parse(periodEnd) + 60_000);
+  paypal.paySale(newSub, after.toISOString());
+  await syncWorkspaceBilling(env, workspaceId, after);
+  const plan = db.db.prepare("SELECT plan, status, provider_subscription_id AS sub, cancel_at_period_end AS cancelling FROM workspace_plans WHERE workspace_id = ?").get(workspaceId) as any;
+  assert.deepEqual({ ...plan }, { plan: "team", status: "active", sub: newSub, cancelling: 0 });
+});
+
+test("keeping a plan whose PayPal subscription is only paused activates it again", async () => {
+  const paypal = fakePayPal();
+  const { env, db, workspaceId, owner, subscriptionId, email } = await activeTeam(paypal);
+  // Cancelled on Bugmole while PayPal had only suspended it (a failed renewal).
+  db.db.prepare("UPDATE workspace_plans SET cancel_at_period_end = 1, pending_plan = 'free' WHERE workspace_id = ?").run(workspaceId);
+  paypal.state.subscriptions.get(subscriptionId)!.status = "SUSPENDED";
+
+  await inviteMember(env, owner, workspaceId);
+  assert.equal((await call(env, "POST", `/api/workspaces/${workspaceId}/billing/resume`, { as: "user_dev" })).status, 403, "members can't change billing");
+
+  const kept = await call(env, "POST", `/api/workspaces/${workspaceId}/billing/resume`, { as: owner });
+  assert.equal(kept.status, 200, JSON.stringify(kept.json));
+  assert.equal(kept.json.status, "resumed");
+  assert.equal(paypal.state.subscriptions.get(subscriptionId)!.status, "ACTIVE");
+  assert.equal(paypal.state.subscriptions.get(subscriptionId)!.status_change_note, RESUME_REASON);
+  const row = db.db.prepare("SELECT cancel_at_period_end AS cancelling, pending_plan AS pending FROM workspace_plans WHERE workspace_id = ?").get(workspaceId) as any;
+  assert.deepEqual({ ...row }, { cancelling: 0, pending: null });
+  const billing = await call(env, "GET", `/api/workspaces/${workspaceId}/billing`, { as: owner });
+  assert.equal(billing.json.subscription.renews, true);
+  assert.ok(email.sent.some((message) => /will renew/.test(message.subject)));
+  const audit = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.ok(audit.json.entries.some((entry: { action: string }) => entry.action === "billing.resumed"));
+});
+
+test("a plan can't be kept once its paid period has ended", async () => {
+  const paypal = fakePayPal();
+  const { env, db, workspaceId, owner } = await activeTeam(paypal);
+  await call(env, "POST", `/api/workspaces/${workspaceId}/billing/cancel`, { as: owner });
+  db.db.prepare("UPDATE workspace_plans SET current_period_end = ? WHERE workspace_id = ?").run(new Date(Date.now() - 1000).toISOString(), workspaceId);
+  const late = await call(env, "POST", `/api/workspaces/${workspaceId}/billing/resume`, { as: owner });
+  assert.equal(late.status, 409);
+  assert.equal(late.json.code, "period_ended");
+});
+
+test("billing links to PayPal's automatic payments page for the environment in use, and the failed-payment email does too", async () => {
+  const paypal = fakePayPal();
+  const { env, workspaceId, owner, subscriptionId, email } = await activeTeam(paypal);
+  const billing = await call(env, "GET", `/api/workspaces/${workspaceId}/billing`, { as: owner });
+  assert.deepEqual(billing.json.paymentProvider, { id: "paypal", manageUrl: "https://www.paypal.com/myaccount/autopay/" });
+
+  paypal.state.subscriptions.get(subscriptionId)!.status = "SUSPENDED";
+  await syncWorkspaceBilling(env, workspaceId);
+  const failed = email.sent.find((message) => /didn't go through/.test(message.subject))!;
+  assert.match(failed.text, /https:\/\/www\.paypal\.com\/myaccount\/autopay\//);
+  assert.match(failed.text, new RegExp(`dash\\.test/billing\\?workspace=${workspaceId}`));
+
+  const sandbox = billingEnv(fakePayPal(), { PAYPAL_ENV: "sandbox", PAYPAL_SANDBOX_CLIENT_ID: "c", PAYPAL_SANDBOX_CLIENT_SECRET: "s" });
+  const other = await seedProject(sandbox.env);
+  const view = await call(sandbox.env, "GET", `/api/workspaces/${other.workspaceId}/billing`, { as: other.owner });
+  assert.equal(view.json.paymentProvider.manageUrl, "https://www.sandbox.paypal.com/myaccount/autopay/");
+});
+
+async function inviteMember(env: Env, owner: string, workspaceId: string) {
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: owner, body: { email: "dev@acme.test", role: "member" } });
+  const token = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  await call(env, "POST", `/api/invitations/${token}/accept`, { as: "user_dev", headers: { "x-aegis-email": "dev@acme.test", "x-aegis-email-verified": "true" } });
+}

package/src/registry-worker/billing/plan-gaps.test.ts

@@ -0,0 +1,216 @@
+// Plan limits on every way in (dashboard, API key, CLI device pairing),
+// read-only projects an owner can choose between, and run history that
+// follows the plan everywhere the dashboard reads it.
+import assert from "node:assert/strict";
+import test from "node:test";
+import { entitlementsFor } from "../../billing/plan-catalog.js";
+import type { Env } from "../core.js";
+import { enforceRetention } from "../jobs/retention.js";
+import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
+import { planForProjects } from "./enforcement.js";
+import { applyProjectLimit } from "./subscriptions.js";
+
+const DAY = 86_400_000;
+
+async function startDevice(env: Env, projectId: string, projectName = projectId) {
+  const start = await call(env, "POST", "/api/device-authorizations", {
+    body: { projectId, projectName, environment: "staging", storageProvider: "r2" },
+  });
+  assert.equal(start.status, 201, JSON.stringify(start.json));
+  return start.json as { attemptId: string; code: string; pollSecret: string };
+}
+
+async function claimDevice(env: Env, who: string, projectId: string) {
+  const attempt = await startDevice(env, projectId);
+  const claimed = await call(env, "POST", "/api/device-authorizations/claim", {
+    as: who,
+    headers: { "x-aegis-email": `${who}@acme.test`, "x-aegis-email-verified": "true" },
+    body: { attemptId: attempt.attemptId, code: attempt.code, deviceId: projectId },
+  });
+  const poll = () => call(env, "POST", "/api/device-authorizations/poll", { body: { attemptId: attempt.attemptId, pollSecret: attempt.pollSecret } });
+  return { claimed, poll };
+}
+
+test("the smallest plan with room for more projects", () => {
+  assert.equal(planForProjects(1), "team");
+  assert.equal(planForProjects(10), "business");
+  assert.equal(planForProjects(50), "enterprise");
+});
+
+test("creating a project over the limit names the plan that allows more, with a billing link", async () => {
+  const { env } = createTestEnv({ FEATURE_ENTITLEMENTS: "on", DASHBOARD_URL: "https://dash.test" });
+  const { workspaceId, owner } = await seedProject(env);
+  const second = await call(env, "POST", "/api/projects/register", {
+    as: owner, body: { id: "second", name: "Second", workspaceId, environment: "staging", storageProvider: "r2" },
+  });
+  assert.equal(second.status, 402);
+  assert.equal(second.json.code, "plan_limit");
+  assert.equal(second.json.suggestedPlan, "team");
+  assert.equal(second.json.upgradeUrl, `/billing?workspace=${workspaceId}&plan=team`);
+  assert.equal(second.json.billingUrl, `https://dash.test/billing?workspace=${workspaceId}&plan=team`);
+  assert.match(second.json.error, /includes 1 project and this workspace has 1\. Upgrade to Team/);
+});
+
+test("CLI pairing can't create a second Free workspace or a project past the plan's limit", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on", DASHBOARD_URL: "https://dash.test" });
+  const { workspaceId, owner } = await seedProject(env);
+
+  const { claimed, poll } = await claimDevice(env, owner, "cli-app");
+  assert.equal(claimed.status, 402, JSON.stringify(claimed.json));
+  assert.equal(claimed.json.code, "plan_limit");
+  assert.equal(claimed.json.billingUrl, `https://dash.test/billing?workspace=${workspaceId}&plan=team`);
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM projects WHERE id = 'cli-app'").get()?.c, 0, "no project was created");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM workspaces WHERE id = ?").get(`workspace_${owner}`)?.c, 0, "no second Free workspace");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM api_keys").get()?.c, 0, "no machine key");
+
+  // The waiting CLI hears why, instead of polling until the attempt expires.
+  const polled = await poll();
+  assert.equal(polled.status, 402);
+  assert.equal(polled.json.status, "refused");
+  assert.equal(polled.json.code, "plan_limit");
+  assert.equal(polled.json.billingUrl, claimed.json.billingUrl);
+});
+
+test("CLI pairing puts the project in the person's Free workspace when there's room, and re-pairing isn't a new project", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  assert.equal((await call(env, "POST", "/api/workspaces", { as: "user_new", body: { id: "solo", name: "Solo" } })).status, 201);
+  const first = await claimDevice(env, "user_new", "cli-app");
+  assert.equal(first.claimed.status, 200, JSON.stringify(first.claimed.json));
+  assert.equal((db.db.prepare("SELECT workspace_id AS w FROM projects WHERE id = 'cli-app'").get() as any).w, "solo");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM workspaces WHERE id = 'workspace_user_new'").get()?.c, 0);
+  assert.equal((await first.poll()).json.status, "completed");
+
+  const again = await claimDevice(env, "user_new", "cli-app");
+  assert.equal(again.claimed.status, 200, "the project already exists, so the limit doesn't apply");
+
+  // Someone who doesn't manage a project can't pair a machine to it.
+  const stranger = await claimDevice(env, "user_stranger", "cli-app");
+  assert.equal(stranger.claimed.status, 409);
+  assert.equal(stranger.claimed.json.code, "project_exists");
+  assert.equal((db.db.prepare("SELECT workspace_id AS w FROM projects WHERE id = 'cli-app'").get() as any).w, "solo", "not moved");
+});
+
+test("CLI pairing for someone new still creates their workspace and project", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  const { claimed } = await claimDevice(env, "user_fresh", "first-app");
+  assert.equal(claimed.status, 200, JSON.stringify(claimed.json));
+  assert.equal((db.db.prepare("SELECT workspace_id AS w FROM projects WHERE id = 'first-app'").get() as any).w, "workspace_user_fresh");
+});
+
+async function overLimitWorkspace() {
+  const setup = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  const { env, db } = setup;
+  const project = await seedProject(env);
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, 'team')").run(project.workspaceId);
+  for (const id of ["second", "third"]) {
+    const created = await call(env, "POST", "/api/projects/register", { as: project.owner, body: { id, name: id, workspaceId: project.workspaceId, environment: "staging", storageProvider: "r2" } });
+    assert.equal(created.status, 201);
+  }
+  // Back on Free (as moveToFree does): the newest two become read-only.
+  db.db.prepare("UPDATE workspace_plans SET status = 'canceled' WHERE workspace_id = ?").run(project.workspaceId);
+  await applyProjectLimit(env, project.workspaceId, entitlementsFor("free"));
+  return { ...setup, ...project };
+}
+
+const lockedIds = (db: ReturnType<typeof createTestEnv>["db"], workspaceId: string) =>
+  (db.db.prepare("SELECT id FROM projects WHERE workspace_id = ? AND locked_at IS NOT NULL ORDER BY id").all(workspaceId) as Array<{ id: string }>).map((row) => row.id);
+
+test("an owner chooses which projects stay active within the plan's limit, and the choice survives plan changes", async () => {
+  const { env, db, workspaceId, owner } = await overLimitWorkspace();
+  assert.deepEqual(lockedIds(db, workspaceId), ["second", "third"]);
+  const listed = await call(env, "GET", "/api/workspaces", { as: owner });
+  const projects = listed.json.workspaces.find((w: { id: string }) => w.id === workspaceId).projects;
+  assert.ok(projects.find((p: { id: string; lockedAt: string | null }) => p.id === "third").lockedAt, "the workspace list shows read-only projects");
+
+  const choose = (projectIds: unknown, as = owner) => call(env, "PUT", `/api/workspaces/${workspaceId}/projects/active`, { as, body: { projectIds } });
+  assert.equal((await choose(["shop", "third"])).json.code, "over_limit");
+  assert.equal((await choose(["elsewhere"])).json.code, "unknown_project");
+  assert.equal((await choose([])).status, 422);
+  assert.equal((await choose("third")).status, 422);
+  assert.equal((await choose(["third"], "user_stranger")).status, 403);
+
+  const kept = await choose(["third"]);
+  assert.equal(kept.status, 200, JSON.stringify(kept.json));
+  assert.deepEqual(kept.json, { active: ["third"], locked: ["shop", "second"] });
+  assert.deepEqual(lockedIds(db, workspaceId), ["second", "shop"]);
+  const audit = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.ok(audit.json.entries.some((entry: { action: string }) => entry.action === "billing.projects_chosen"));
+
+  // Upgrading unlocks everything; the next downgrade keeps the owner's pick.
+  await applyProjectLimit(env, workspaceId, entitlementsFor("team"));
+  assert.deepEqual(lockedIds(db, workspaceId), []);
+  await applyProjectLimit(env, workspaceId, entitlementsFor("free"));
+  assert.deepEqual(lockedIds(db, workspaceId), ["second", "shop"]);
+});
+
+test("re-pairing a read-only project explains the limit instead of claiming it exists", async () => {
+  const { env, owner } = await overLimitWorkspace();
+  const { claimed } = await claimDevice(env, owner, "third");
+  assert.equal(claimed.status, 402);
+  assert.equal(claimed.json.code, "plan_limit");
+  assert.match(claimed.json.error, /read-only/);
+});
+
+async function historySetup(mode: string) {
+  const setup = createTestEnv({ FEATURE_ENTITLEMENTS: mode });
+  const { env, db, artifacts } = setup;
+  const project = await seedProject(env);
+  await seedPlan(env, project.projectId, project.owner);
+  const make = async (key: string) =>
+    (await call(env, "POST", `/api/projects/${project.projectId}/runs`, { as: project.owner, body: { planId: "checkout", idempotencyKey: key } })).json.run.id as string;
+  const oldRun = await make("old");
+  const newRun = await make("new");
+  const oldDate = new Date(Date.now() - 10 * DAY).toISOString();
+  db.db.prepare("UPDATE runs SET status = 'success', completed_at = ?, requested_at = ? WHERE id = ?").run(oldDate, oldDate, oldRun);
+  db.db.prepare("UPDATE runs SET status = 'success', completed_at = ? WHERE id = ?").run(new Date().toISOString(), newRun);
+  await artifacts.put(`projects/${project.projectId}/runs/${oldRun}/manifest.json`, "{}");
+  await artifacts.put(`projects/${project.projectId}/runs/${newRun}/manifest.json`, "{}");
+  await artifacts.put(`projects/${project.projectId}/journeys/graph.json`, "{}");
+  return { ...setup, ...project, oldRun, newRun };
+}
+
+test("the plan's history cutoff applies to a run, its events and its evidence, not only the runs list", async () => {
+  const { env, projectId, owner, oldRun, newRun } = await historySetup("on");
+  const old = await call(env, "GET", `/api/runs/${oldRun}`, { as: owner });
+  assert.equal(old.status, 404);
+  assert.equal(old.json.code, "history_expired");
+  assert.equal((await call(env, "GET", `/api/runs/${newRun}`, { as: owner })).status, 200);
+
+  const listed = await call(env, "GET", `/api/projects/${projectId}/artifacts`, { as: owner });
+  const keys = listed.json.objects.map((object: { key: string }) => object.key).sort();
+  assert.deepEqual(keys, [`projects/${projectId}/journeys/graph.json`, `projects/${projectId}/runs/${newRun}/manifest.json`], "run evidence past the cutoff is hidden; other project files aren't run history");
+  const object = (runId: string) => call(env, "GET", `/api/projects/${projectId}/artifacts/object?key=${encodeURIComponent(`projects/${projectId}/runs/${runId}/manifest.json`)}`, { as: owner });
+  assert.equal((await object(oldRun)).status, 404);
+  assert.equal((await object(newRun)).status, 200);
+});
+
+test("in shadow mode the cutoff hides nothing and retention only logs what it would delete", async () => {
+  const { env, db, artifacts, projectId, owner, oldRun } = await historySetup("shadow");
+  assert.equal((await call(env, "GET", `/api/runs/${oldRun}`, { as: owner })).status, 200);
+  const listed = await call(env, "GET", `/api/projects/${projectId}/runs`, { as: owner });
+  assert.equal(listed.json.runs.length, 2);
+
+  const warnings: string[] = [];
+  const warn = console.warn;
+  console.warn = (message: string) => void warnings.push(String(message));
+  try {
+    assert.deepEqual(await enforceRetention(env), { runs: 0, objects: 0, wouldDelete: 1 });
+  } finally {
+    console.warn = warn;
+  }
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM runs WHERE id = ?").get(oldRun)?.c, 1, "nothing deleted");
+  assert.ok(artifacts.objects.has(`projects/${projectId}/runs/${oldRun}/manifest.json`));
+  assert.ok(warnings.some((line) => /shadow: retention would delete 1 run/.test(line)));
+});
+
+test("with limits off, retention deletes nothing", async () => {
+  const { env, db, oldRun } = await historySetup("off");
+  const warn = console.warn;
+  console.warn = () => undefined;
+  try {
+    assert.equal((await enforceRetention(env)).runs, 0);
+  } finally {
+    console.warn = warn;
+  }
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM runs WHERE id = ?").get(oldRun)?.c, 1);
+});

package/src/registry-worker/billing/provider.ts

@@ -54,6 +54,14 @@ export interface BillingProvider {
   /** The payment for the current period (made on or after `since`), once the provider has posted it. */
   latestPayment(env: Env, subscriptionId: string, since: Date, until: Date): Promise<ProviderPayment | null>;
   cancelSubscription(env: Env, id: string, reason: string): Promise<void>;
+  /**
+   * Restarts a subscription that was paused (a failed renewal), when the
+   * provider allows it. A cancelled subscription can't be restarted at PayPal;
+   * callers check the status first and send the customer to a new checkout.
+   */
+  reactivateSubscription(env: Env, id: string, reason: string): Promise<void>;
+  /** Where the customer changes the card or bank behind their subscription, on the provider's site. */
+  manageUrl(env: Env): string | null;
   refund(env: Env, payment: ProviderPayment, amountCents: number, requestId: string, description: string): Promise<{ reference: string }>;
   /** Bills usage after the month; the payer receives the provider's pay link. */
   chargeUsage(env: Env, params: {

package/src/registry-worker/billing/routes.ts

@@ -12,7 +12,8 @@ async function getUsage({ env, principal }: AuthedRouteContext, workspaceId: str
   if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
   const { entitlements, summary } = await usageSummary(env, workspaceId);
   const { plan, ...limits } = entitlements;
-  const projects = await env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL")
+  // Paused (inactive) projects don't count toward the limit.
+  const projects = await env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL AND inactive_at IS NULL")
     .bind(workspaceId).first<{ count: number }>();
   return response({
     plan: {