@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/feature-flags/feature-flags.test.ts

@@ -0,0 +1,270 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { PLANS, type PlanFeatures } from "../../billing/plan-catalog.js";
+import { freePlan, type WorkspacePlan } from "../billing/entitlements.js";
+import { blockedBy, evaluateFeatures, featureState, requiredPlanFor, type FeatureOverride } from "../feature-access.js";
+import { FEATURES, FEATURE_DEFS, OPERATIONAL_FEATURES, type Feature } from "../flags.js";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+
+const ADMIN_TOKEN = "platform-test-token";
+const ALL_ON = Object.fromEntries(FEATURES.map((feature) => [`FEATURE_${feature.toUpperCase()}`, "on"]));
+
+function planOf(plan: WorkspacePlan["plan"], overrides: WorkspacePlan["overrides"] = {}): WorkspacePlan {
+  return { ...freePlan("acme"), plan, overrides };
+}
+
+function override(feature: Feature, enabled: boolean, expiresAt: string | null = null): FeatureOverride {
+  return { feature, enabled, expiresAt, reason: null, setBy: "ops", updatedAt: "2026-09-30T00:00:00Z" };
+}
+
+const NOW = new Date("2026-09-30T12:00:00Z");
+
+test("every catalog feature has exactly one flag, and every flag is a catalog feature or listed as operational", () => {
+  const catalogKeys = Object.keys(PLANS.free.features) as Array<keyof PlanFeatures>;
+  const mapped = FEATURES.map((feature) => FEATURE_DEFS[feature].planFeature).filter(Boolean);
+  for (const key of catalogKeys) {
+    assert.equal(mapped.filter((value) => value === key).length, 1, `catalog feature ${key} needs exactly one FEATURE_DEFS entry`);
+  }
+  for (const feature of FEATURES) {
+    const key = FEATURE_DEFS[feature].planFeature;
+    if (key) assert.ok(catalogKeys.includes(key), `${feature} maps to ${key}, which isn't in the catalog`);
+    else assert.ok((OPERATIONAL_FEATURES as readonly string[]).includes(feature), `${feature} has no catalog key and isn't listed as operational`);
+  }
+  for (const feature of OPERATIONAL_FEATURES) assert.equal(FEATURE_DEFS[feature].planFeature, undefined);
+});
+
+test("the required plan is the cheapest plan that includes a feature", () => {
+  assert.equal(requiredPlanFor("pr_checks"), "team");
+  assert.equal(requiredPlanFor("device_clouds"), "business");
+  assert.equal(requiredPlanFor("scim"), "enterprise");
+  assert.equal(requiredPlanFor("self_hosted_workers"), "enterprise");
+  assert.equal(requiredPlanFor("feedback"), undefined);
+  assert.equal(requiredPlanFor("ai_failure_analysis"), "free", "all-plans features are on for Free");
+});
+
+test("precedence: kill switch, then beta opt-in, then workspace override, then plan", () => {
+  const evaluate = (env: Record<string, string>, options: { plan?: WorkspacePlan; beta?: Feature[]; overrides?: FeatureOverride[] } = {}) =>
+    evaluateFeatures({
+      env,
+      plan: options.plan ?? planOf("free"),
+      betaOptIns: new Set(options.beta ?? []),
+      overrides: options.overrides ?? [],
+      now: NOW,
+    });
+
+  // Plan only.
+  let result = evaluate(ALL_ON, { plan: planOf("team") });
+  assert.deepEqual([result.pr_checks.enabled, result.pr_checks.reason], [true, "plan"]);
+  assert.deepEqual([result.sso.enabled, result.sso.reason, result.sso.requiredPlan], [false, "plan", "business"]);
+  assert.deepEqual([result.feedback.enabled, result.feedback.reason, result.feedback.requiredPlan], [true, "plan", undefined]);
+
+  // A workspace override beats the plan both ways.
+  result = evaluate(ALL_ON, { plan: planOf("team"), overrides: [override("sso", true), override("pr_checks", false)] });
+  assert.deepEqual([result.sso.enabled, result.sso.reason], [true, "workspace_override"]);
+  assert.deepEqual([result.pr_checks.enabled, result.pr_checks.reason], [false, "workspace_override"]);
+
+  // The kill switch beats an override and the plan; shadow counts as off for access.
+  result = evaluate({ ...ALL_ON, FEATURE_SSO: "off", FEATURE_PR_CHECKS: "shadow" }, { plan: planOf("business"), overrides: [override("sso", true)] });
+  assert.deepEqual([result.sso.enabled, result.sso.reason], [false, "flag_off"]);
+  assert.deepEqual([result.pr_checks.enabled, result.pr_checks.reason], [false, "flag_off"]);
+
+  // Beta needs an opt-in before an override or the plan is consulted.
+  result = evaluate({ ...ALL_ON, FEATURE_SLACK: "beta" }, { plan: planOf("business"), overrides: [override("slack", true)] });
+  assert.deepEqual([result.slack.enabled, result.slack.reason], [false, "beta_not_enabled"]);
+  result = evaluate({ ...ALL_ON, FEATURE_SLACK: "beta" }, { plan: planOf("business"), beta: ["slack"], overrides: [override("slack", false)] });
+  assert.deepEqual([result.slack.enabled, result.slack.reason], [false, "workspace_override"]);
+  result = evaluate({ ...ALL_ON, FEATURE_SLACK: "beta" }, { plan: planOf("free"), beta: ["slack"] });
+  assert.deepEqual([result.slack.enabled, result.slack.reason, result.slack.requiredPlan], [false, "plan", "team"]);
+
+  // Blocked-by classifies what a gate should answer.
+  assert.equal(blockedBy(result.slack), "plan");
+  assert.equal(blockedBy(evaluate({ FEATURE_SLACK: "off" }).slack), "rollout");
+  assert.equal(blockedBy(evaluate(ALL_ON, { plan: planOf("team"), overrides: [override("pr_checks", false)] }).pr_checks), "rollout");
+});
+
+test("unset vars: launch flags default to beta, plan features default to on", () => {
+  const result = evaluateFeatures({ env: {}, plan: planOf("enterprise"), betaOptIns: new Set(["mcp"]), overrides: [], now: NOW });
+  assert.equal(result.sso.reason, "beta_not_enabled");
+  assert.equal(result.mcp.enabled, true);
+  assert.deepEqual([result.scim.enabled, result.scim.mode], [true, "on"]);
+  assert.deepEqual([result.ai_fixes.enabled, result.audit_export.enabled], [true, true]);
+});
+
+test("an expired override stops counting", () => {
+  const overrides = [override("device_clouds", true, "2026-09-30T11:59:59Z"), override("sso", true, "2026-10-01T00:00:00Z")];
+  const result = evaluateFeatures({ env: ALL_ON, plan: planOf("free"), betaOptIns: new Set(), overrides, now: NOW });
+  assert.deepEqual([result.device_clouds.enabled, result.device_clouds.reason], [false, "plan"]);
+  assert.deepEqual([result.sso.enabled, result.sso.reason, result.sso.overrideExpiresAt], [true, "workspace_override", "2026-10-01T00:00:00Z"]);
+});
+
+test("contract overrides on an Enterprise plan report enterprise_override", () => {
+  const plan = planOf("enterprise", { projects: 200, features: { scim: false, selfHostedWorkers: true } });
+  const result = evaluateFeatures({ env: ALL_ON, plan, betaOptIns: new Set(), overrides: [], now: NOW });
+  assert.deepEqual([result.scim.enabled, result.scim.reason], [false, "enterprise_override"]);
+  assert.deepEqual([result.self_hosted_workers.enabled, result.self_hosted_workers.reason], [true, "enterprise_override"]);
+  assert.deepEqual([result.sso.enabled, result.sso.reason], [true, "plan"]);
+  assert.equal(blockedBy(result.scim), "plan");
+});
+
+test("beta opt-ins come from workspace_flags", async () => {
+  const { env, db } = createTestEnv({ ...ALL_ON, FEATURE_CLOUD_RUNNERS: "beta" });
+  const { workspaceId } = await seedProject(env);
+  assert.equal((await featureState(env, workspaceId, "cloud_runners")).reason, "beta_not_enabled");
+  db.db.prepare("INSERT INTO workspace_flags (workspace_id, flag, enabled) VALUES (?, 'cloud_runners', 0)").run(workspaceId);
+  assert.equal((await featureState(env, workspaceId, "cloud_runners")).enabled, false, "a disabled row isn't an opt-in");
+  db.db.prepare("UPDATE workspace_flags SET enabled = 1 WHERE workspace_id = ?").run(workspaceId);
+  assert.equal((await featureState(env, workspaceId, "cloud_runners")).enabled, true);
+});
+
+test("members read the evaluated features and limits; strangers can't", async () => {
+  const { env } = createTestEnv(ALL_ON);
+  const { workspaceId, owner } = await seedProject(env);
+  const read = await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: owner });
+  assert.equal(read.status, 200);
+  assert.deepEqual(read.json.plan, { id: "free", name: "Free", status: "active" });
+  assert.equal(read.json.source, "default");
+  assert.equal(read.json.features.pr_checks.enabled, false);
+  assert.equal(read.json.features.pr_checks.requiredPlan, "team");
+  assert.equal(read.json.features.pr_checks.planFeature, "prChecks");
+  assert.deepEqual(
+    { enabled: read.json.planFeatures.deviceClouds.enabled, requiredPlan: read.json.planFeatures.deviceClouds.requiredPlan },
+    { enabled: false, requiredPlan: "business" },
+  );
+  assert.equal(read.json.features.feedback.requiredPlan, null);
+  assert.deepEqual(read.json.limits.projects, { limit: 1, unlimited: false, used: 1 });
+  assert.deepEqual(read.json.limits.cloudMinutes, { limit: 300, unlimited: false, used: 0 });
+  assert.deepEqual(read.json.limits.parallel, { limit: 2, unlimited: false });
+  assert.equal(read.json.limitsEnforced, "enforce");
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: "user_stranger" })).status, 403);
+});
+
+test("platform routes: 503 without the secret, 401 without or with a wrong token", async () => {
+  const unset = createTestEnv(ALL_ON);
+  await seedProject(unset.env);
+  assert.equal((await call(unset.env, "GET", "/api/platform/workspaces/acme/features", { token: "anything" })).status, 503);
+
+  const { env } = createTestEnv({ ...ALL_ON, PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { owner } = await seedProject(env);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/acme/features")).status, 401);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/acme/features", { token: "wrong" })).status, 401);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/acme/features", { token: `${ADMIN_TOKEN}x` })).status, 401);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/acme/features", { as: owner })).status, 401, "a dashboard session isn't a platform token");
+  assert.equal((await call(env, "PUT", "/api/platform/workspaces/acme/plan", { as: owner, body: { plan: "enterprise" } })).status, 401);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/acme/features", { token: ADMIN_TOKEN })).status, 200);
+  assert.equal((await call(env, "GET", "/api/platform/workspaces/nope/features", { token: ADMIN_TOKEN })).status, 404);
+  assert.equal((await call(env, "PUT", "/api/platform/workspaces/acme/features/bogus", { token: ADMIN_TOKEN, body: { enabled: true } })).status, 404);
+});
+
+test("an operator override turns a plan feature on for a trial, is audited, and lapses", async () => {
+  const { env, db } = createTestEnv({ ...ALL_ON, PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { workspaceId, owner } = await seedProject(env);
+  const admin = { token: ADMIN_TOKEN, headers: { "x-bugmole-operator": "ops@bugmole.test" } };
+
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/features/sso`, { ...admin, body: { enabled: true, expiresAt: "2020-01-01" } })).status, 422);
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/features/sso`, { ...admin, body: { enabled: "yes" } })).status, 422);
+
+  const set = await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/features/device_clouds`, {
+    ...admin, body: { enabled: true, expiresAt: "2099-01-31", reason: "Trial for Acme" },
+  });
+  assert.equal(set.status, 200);
+  assert.equal(set.json.features.device_clouds.enabled, true);
+  assert.equal(set.json.features.device_clouds.reason, "workspace_override");
+  assert.equal(set.json.features.device_clouds.expiresAt, "2099-01-31T23:59:59.999Z");
+  assert.equal(set.json.overrides[0].setBy, "ops@bugmole.test");
+
+  // The member endpoint and the server gate agree.
+  const member = await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: owner });
+  assert.equal(member.json.features.device_clouds.enabled, true);
+  assert.equal(member.json.features.device_clouds.expiresAt, "2099-01-31T23:59:59.999Z");
+  const clouds = await call(env, "GET", `/api/workspaces/${workspaceId}/device-clouds`, { as: owner });
+  assert.equal(clouds.json.available, true);
+
+  const audit = db.db.prepare("SELECT actor_type AS actorType, actor_id AS actorId, action, target_id AS target, data_json AS data FROM audit_log WHERE action LIKE 'platform.%'").all() as Array<Record<string, string>>;
+  assert.equal(audit.length, 1);
+  assert.deepEqual([audit[0].actorType, audit[0].actorId, audit[0].action, audit[0].target], ["system", "platform_admin", "platform.feature_override_set", "device_clouds"]);
+  assert.equal(JSON.parse(audit[0].data).operator, "ops@bugmole.test");
+  assert.equal(JSON.parse(audit[0].data).reason, "Trial for Acme");
+
+  // Past its expiry, the plan decides again.
+  db.db.prepare("UPDATE workspace_feature_overrides SET expires_at = ? WHERE workspace_id = ?").run("2026-01-01T00:00:00.000Z", workspaceId);
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/device-clouds`, { as: owner })).json.available, false);
+
+  // Clearing it is audited too; clearing twice is a 404.
+  assert.equal((await call(env, "DELETE", `/api/platform/workspaces/${workspaceId}/features/device_clouds`, admin)).status, 200);
+  assert.equal((await call(env, "DELETE", `/api/platform/workspaces/${workspaceId}/features/device_clouds`, admin)).status, 404);
+  const list = await call(env, "GET", "/api/platform/feature-overrides", admin);
+  assert.deepEqual(list.json.overrides, []);
+});
+
+test("an incident override turns a feature off even on a plan that includes it", async () => {
+  const { env, db } = createTestEnv({ ...ALL_ON, PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { workspaceId, owner } = await seedProject(env);
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, 'team')").run(workspaceId);
+  await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/features/ai_fixes`, { token: ADMIN_TOKEN, body: { enabled: false } });
+  const state = await featureState(env, workspaceId, "ai_fixes");
+  assert.deepEqual([state.enabled, state.reason], [false, "workspace_override"]);
+  const read = await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: owner });
+  assert.equal(read.json.planFeatures.aiFixes.enabled, false);
+});
+
+test("beta opt-ins are set through the platform routes", async () => {
+  const { env } = createTestEnv({ ...ALL_ON, FEATURE_CLOUD_RUNNERS: "beta", PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { workspaceId } = await seedProject(env);
+  const on = await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/beta/cloud_runners`, { token: ADMIN_TOKEN, body: { enabled: true } });
+  assert.equal(on.status, 200);
+  assert.equal(on.json.features.cloud_runners.enabled, true);
+  assert.deepEqual(on.json.betaOptIns.map((row: { feature: string; enabled: boolean }) => [row.feature, row.enabled]), [["cloud_runners", true]]);
+  const off = await call(env, "DELETE", `/api/platform/workspaces/${workspaceId}/beta/cloud_runners`, { token: ADMIN_TOKEN });
+  assert.equal(off.json.features.cloud_runners.reason, "beta_not_enabled");
+});
+
+test("an operator puts a workspace on an Enterprise contract and back to Free", async () => {
+  const { env, db } = createTestEnv({ ...ALL_ON, PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { workspaceId, owner } = await seedProject(env);
+  const admin = { token: ADMIN_TOKEN, headers: { "x-bugmole-operator": "ops" } };
+
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "team" } })).status, 422);
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "enterprise", limits: { projects: -1 } } })).status, 422);
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "enterprise", limits: { seats: 3 } } })).status, 422);
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "enterprise", features: { teleport: true } } })).status, 422);
+  assert.equal((await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "enterprise", features: { feedback: true } } })).status, 422, "operational flags aren't contract features");
+
+  const set = await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, {
+    ...admin,
+    body: {
+      plan: "enterprise",
+      limits: { projects: 40, cloudMinutes: 50_000, aiCredits: 20_000, parallel: 60, retentionDays: 400 },
+      features: { scim: false, self_hosted_workers: true },
+      note: "Contract C-17",
+    },
+  });
+  assert.equal(set.status, 200);
+  assert.equal(set.json.plan.id, "enterprise");
+  assert.equal(set.json.source, "contract");
+  assert.deepEqual(set.json.limits.projects, { limit: 40, unlimited: false, used: 1 });
+  assert.equal(set.json.limits.historyDays.limit, 400);
+  assert.equal(set.json.features.scim.reason, "enterprise_override");
+  assert.equal(set.json.features.scim.enabled, false);
+  assert.equal(set.json.features.sso.enabled, true);
+
+  const usage = await call(env, "GET", `/api/workspaces/${workspaceId}/usage`, { as: owner });
+  assert.equal(usage.json.usage.lines.browser_minute.included, 50_000, "enforcement reads the same contract");
+  assert.equal(usage.json.limits.parallel, 60);
+
+  const [audit] = db.db.prepare("SELECT data_json AS data FROM audit_log WHERE action = 'platform.plan_set'").all() as Array<{ data: string }>;
+  const data = JSON.parse(audit.data);
+  assert.deepEqual([data.from, data.to, data.note, data.overrides.historyDays], ["free", "enterprise", "Contract C-17", 400]);
+
+  const back = await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { ...admin, body: { plan: "free" } });
+  assert.equal(back.json.plan.id, "free");
+  assert.equal(back.json.limits.projects.limit, 1);
+});
+
+test("a workspace paying through PayPal can't be put on a contract", async () => {
+  const { env, db } = createTestEnv({ ...ALL_ON, PLATFORM_ADMIN_TOKEN: ADMIN_TOKEN });
+  const { workspaceId } = await seedProject(env);
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan, provider, provider_subscription_id) VALUES (?, 'business', 'paypal', 'I-1')").run(workspaceId);
+  const refused = await call(env, "PUT", `/api/platform/workspaces/${workspaceId}/plan`, { token: ADMIN_TOKEN, body: { plan: "enterprise" } });
+  assert.equal(refused.status, 409);
+  assert.equal(refused.json.code, "subscription_active");
+});

package/src/registry-worker/feature-flags/routes.ts

@@ -0,0 +1,102 @@
+// GET /api/workspaces/:id/features — what the dashboard may show a member:
+// every feature, whether it is on for this workspace, why, and the plan that
+// would unlock it. Read-only; changes go through the platform routes in admin.ts.
+import { PLANS } from "../../billing/plan-catalog.js";
+import { memberOfWorkspace, response } from "../core.js";
+import type { Env } from "../core.js";
+import { entitlementMode } from "../billing/enforcement.js";
+import { usageSummary } from "../billing/ledger.js";
+import {
+  type EffectiveFeatures,
+  type FeatureState,
+  type LimitKey,
+  type LimitState,
+  effectiveFeatures,
+  limitsFor,
+  planSource,
+} from "../feature-access.js";
+import { FEATURES, FEATURE_DEFS, type Feature } from "../flags.js";
+import { type AuthedRouteContext, matchPath, registerRoutes } from "../routes/index.js";
+
+export type FeatureView = {
+  feature: Feature;
+  label: string;
+  enabled: boolean;
+  reason: FeatureState["reason"];
+  /** Cheapest plan that includes it; null when it isn't plan-gated. */
+  requiredPlan: string | null;
+  /** The plan-catalog key (as in GET /usage limits.features), when plan-gated. */
+  planFeature: string | null;
+  /** Set when a workspace override decided and it lapses. */
+  expiresAt: string | null;
+};
+
+export function featureView(state: FeatureState): FeatureView {
+  const def = FEATURE_DEFS[state.feature];
+  return {
+    feature: state.feature,
+    label: def.label,
+    enabled: state.enabled,
+    reason: state.reason,
+    requiredPlan: state.requiredPlan ?? null,
+    planFeature: def.planFeature ?? null,
+    expiresAt: state.reason === "workspace_override" ? state.overrideExpiresAt ?? null : null,
+  };
+}
+
+export type LimitUsage = Partial<Record<LimitKey, number>>;
+
+export function featuresBody(workspaceId: string, evaluated: EffectiveFeatures, used: LimitUsage = {}, limitsEnforced: "enforce" | "shadow" | "off" = "enforce") {
+  const features = Object.fromEntries(FEATURES.map((feature) => [feature, featureView(evaluated.features[feature])])) as Record<Feature, FeatureView>;
+  const planFeatures = Object.fromEntries(
+    Object.values(features).filter((view) => view.planFeature).map((view) => [view.planFeature, view]),
+  ) as Record<string, FeatureView>;
+  return {
+    workspaceId,
+    plan: { id: evaluated.plan.plan, name: PLANS[evaluated.plan.plan].name, status: evaluated.plan.status },
+    source: planSource(evaluated.plan),
+    features,
+    planFeatures,
+    limits: Object.fromEntries(Object.entries(limitsFor(evaluated.plan)).map(([key, state]) => {
+      const usedValue = used[key as LimitKey];
+      return [key, usedValue === undefined ? state : { ...state, used: usedValue }];
+    })) as Record<LimitKey, LimitState>,
+    /** "enforce" unless FEATURE_ENTITLEMENTS (or an override) has limits in shadow mode or off. */
+    limitsEnforced,
+  };
+}
+
+/** Current usage against the limits that have a meter: projects, cloud minutes and AI credits this period. */
+export async function limitUsage(env: Env, workspaceId: string): Promise<LimitUsage> {
+  const [{ summary }, projects] = await Promise.all([
+    usageSummary(env, workspaceId),
+    // Paused (inactive) projects don't count toward the limit.
+    env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL AND inactive_at IS NULL")
+      .bind(workspaceId).first<{ count: number }>(),
+  ]);
+  return {
+    projects: projects?.count ?? 0,
+    cloudMinutes: summary.lines.browser_minute.used,
+    aiCredits: summary.lines.ai_credit.used,
+  };
+}
+
+export async function workspaceFeatures(env: Env, workspaceId: string) {
+  const [evaluated, used, mode] = await Promise.all([
+    effectiveFeatures(env, workspaceId),
+    limitUsage(env, workspaceId),
+    entitlementMode(env, workspaceId),
+  ]);
+  return featuresBody(workspaceId, evaluated, used, mode);
+}
+
+async function getFeatures({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
+  return response(await workspaceFeatures(env, workspaceId));
+}
+
+registerRoutes(async (context) => {
+  const params = matchPath(context.url.pathname, "/api/workspaces/:workspaceId/features");
+  if (params && context.request.method === "GET") return getFeatures(context, params.workspaceId);
+  return null;
+});

package/src/registry-worker/features.ts

@@ -5,7 +5,9 @@ import "./billing/routes.js";
 import "./jobs/retention.js";
 import "./ai/routes.js";
 import "./runner/routes.js";
+import "./proposals/routes.js";
 import "./signup/routes.js";
+import "./signup/attribution.js";
 import "./billing/checkout-routes.js";
 import "./notifications/outbox.js";
 import "./notifications/alerts.js";
@@ -13,8 +15,17 @@ import "./notifications/routes.js";
 import "./github/checks.js";
 import "./gitlab/checks.js";
 import "./personas/routes.js";
+import "./roles/routes.js";
+import "./secrets/routes.js";
+import "./identity/oidc.js";
 import "./feedback/routes.js";
+import "./feedback/website.js";
 import "./devices/routes.js";
 import "./domains/routes.js";
 import "./sso/routes.js";
 import "./mcp/routes.js";
+import "./jira/routes.js";
+import "./feature-flags/routes.js";
+import "./feature-flags/admin.js";
+import "./projects/identity.js";
+import "./projects/inactivity.js";

package/src/registry-worker/feedback/feedback.test.ts

@@ -228,3 +228,50 @@ test("a missing GitHub setup keeps the report and stops retrying", async () => {
   assert.equal((db.db.prepare("SELECT status FROM outbox").get() as any).status, "dead");
   assert.equal((db.db.prepare("SELECT status FROM feedback_reports WHERE id = ?").get(sent.json.id) as any).status, "new");
 });
+
+// ── The public website's "Questions?" panel ──
+
+const SITE = { origin: "https://bugmole.com", "cf-connecting-ip": "203.0.113.9" };
+
+test("website feedback is stored for triage, never filed on GitHub", async () => {
+  const gh = fakeGithub();
+  const { env, db } = feedbackEnv(gh);
+  const preflight = await call(env, "OPTIONS", "/api/public/feedback", { headers: { origin: "https://bugmole.com" } });
+  assert.equal(preflight.status, 204);
+  assert.equal(preflight.headers.get("access-control-allow-origin"), "https://bugmole.com");
+  const sent = await call(env, "POST", "/api/public/feedback", {
+    headers: SITE,
+    body: { topic: "question", message: "Does Bugmole test Flutter apps?", email: "ann@example.com", page: "https://bugmole.com/pricing/?token=abc" },
+  });
+  assert.equal(sent.status, 201);
+  assert.equal(sent.headers.get("access-control-allow-origin"), "https://bugmole.com");
+  const row = db.db.prepare("SELECT aegis_id, kind, category, contact, page, ip, github_issue_number FROM feedback_reports WHERE id = ?").get(sent.json.id) as any;
+  assert.deepEqual({ ...row }, { aegis_id: "website", kind: "feedback", category: "website:question", contact: "ann@example.com", page: redactUrl("https://bugmole.com/pricing/?token=abc"), ip: "203.0.113.9", github_issue_number: null });
+  await drainOutbox(env);
+  assert.equal(gh.state.issues.length, 0);
+});
+
+test("website feedback only from bugmole.com, and not from bots", async () => {
+  const { env, db } = feedbackEnv(fakeGithub());
+  const other = await call(env, "POST", "/api/public/feedback", { headers: { origin: "https://evil.example" }, body: { topic: "bug", message: "hello there" } });
+  assert.equal(other.status, 403);
+  const noOrigin = await call(env, "POST", "/api/public/feedback", { body: { topic: "bug", message: "hello there" } });
+  assert.equal(noOrigin.status, 403);
+  const bot = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "bug", message: "cheap pills", website: "http://spam" } });
+  assert.equal(bot.status, 201);
+  const bad = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "bug", message: "x" } });
+  assert.equal(bad.status, 422);
+  assert.equal((db.db.prepare("SELECT count(*) AS n FROM feedback_reports").get() as any).n, 0);
+});
+
+test("website feedback is rate limited per visitor", async () => {
+  const { env } = feedbackEnv(fakeGithub());
+  for (let i = 0; i < 5; i++) {
+    const ok = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "idea", message: `idea number ${i}` } });
+    assert.equal(ok.status, 201);
+  }
+  const limited = await call(env, "POST", "/api/public/feedback", { headers: SITE, body: { topic: "idea", message: "one more idea" } });
+  assert.equal(limited.status, 429);
+  const someoneElse = await call(env, "POST", "/api/public/feedback", { headers: { ...SITE, "cf-connecting-ip": "198.51.100.4" }, body: { topic: "idea", message: "a different person" } });
+  assert.equal(someoneElse.status, 201);
+});

package/src/registry-worker/feedback/routes.ts

@@ -6,7 +6,7 @@ import { githubAppConfigured, githubRequest, GithubAppError, type GithubAppEnv }
 import type { Env, Principal } from "../core.js";
 import { constantTimeEqual, newId, requestJson, response, sha256 } from "../core.js";
 import { getWorkspacePlan } from "../billing/entitlements.js";
-import { flagOn } from "../flags.js";
+import { featureEnabled } from "../feature-access.js";
 import { recordAudit } from "../org/audit.js";
 import { drainSoon, enqueue, PermanentDeliveryError, registerOutboxHandler } from "../notifications/outbox.js";
 import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
@@ -174,7 +174,7 @@ async function submit({ env, principal, request, ctx }: AuthedRouteContext): Pro
     await recordAudit(env, { type: "user", id: principal.aegisId }, { workspaceId: workspace.id, projectId: project?.id ?? null, action: "feedback.submitted", targetType: "feedback", targetId: id, data: { kind } }, request);
   }
 
-  if (await flagOn(env, workspace?.id ?? null, "feedback")) {
+  if (await featureEnabled(env, workspace?.id ?? null, "feedback")) {
     const since = new Date(Date.now() - DUPLICATE_WINDOW_MS).toISOString().replace("T", " ").slice(0, 19);
     const original = await env.DB.prepare(`
       SELECT id, github_issue_number AS issue FROM feedback_reports

package/src/registry-worker/feedback/website.ts

@@ -0,0 +1,77 @@
+// Questions and feedback from the public website (bugmole.com's "Questions?"
+// panel), from people who aren't signed in. They land in the same triage list
+// as dashboard reports (aegis_id "website"), but are never filed as GitHub
+// issues automatically: anyone on the internet can send one.
+import type { Env } from "../core.js";
+import { newId, response } from "../core.js";
+import { registerPublicRoutes } from "../routes/index.js";
+import { fingerprintOf, redactSecrets, redactUrl } from "./format.js";
+
+export const WEBSITE_AEGIS_ID = "website";
+/** Per visitor (IP) and for the whole site, per hour. */
+export const WEBSITE_IP_LIMIT_PER_HOUR = 5;
+export const WEBSITE_LIMIT_PER_HOUR = 100;
+const ALLOWED_ORIGINS = new Set(["https://bugmole.com"]);
+const KINDS = { question: "feedback", idea: "feedback", bug: "bug" } as const;
+
+function cors(origin: string | null): Record<string, string> {
+  return origin && ALLOWED_ORIGINS.has(origin)
+    ? { "access-control-allow-origin": origin, "access-control-allow-methods": "POST", "access-control-allow-headers": "content-type", "access-control-max-age": "86400", vary: "Origin" }
+    : {};
+}
+
+function withCors(res: Response, origin: string | null): Response {
+  const headers = new Headers(res.headers);
+  for (const [k, v] of Object.entries(cors(origin))) headers.set(k, v);
+  return new Response(res.body, { status: res.status, headers });
+}
+
+const text = (value: unknown, max: number) => (typeof value === "string" ? value.trim().slice(0, max) : "");
+const validEmail = (s: string) => /^[^\s@<>,;]+@[^\s@<>,;]+\.[^\s@<>,;]+$/.test(s);
+
+export async function submitWebsiteFeedback(request: Request, env: Env): Promise<Response> {
+  const origin = request.headers.get("origin");
+  if (!origin || !ALLOWED_ORIGINS.has(origin)) return response({ error: "Not allowed" }, 403);
+  const body = await request.json().catch(() => null) as Record<string, unknown> | null;
+  if (!body) return withCors(response({ error: "Send JSON" }, 400), origin);
+  // A field people never see: bots fill it in. Pretend it worked.
+  if (text(body.website, 200)) return withCors(response({ ok: true }, 201), origin);
+  const topic = text(body.topic, 20) as keyof typeof KINDS;
+  if (!(topic in KINDS)) return withCors(response({ error: "topic is question, idea or bug" }, 422), origin);
+  const message = text(body.message, 2_000);
+  if (message.length < 3) return withCors(response({ error: "Write a few words first" }, 422), origin);
+  const email = text(body.email, 200);
+  if (email && !validEmail(email)) return withCors(response({ error: "That email address doesn't look right" }, 422), origin);
+
+  const ip = request.headers.get("cf-connecting-ip");
+  const hourAgo = new Date(Date.now() - 3_600_000).toISOString().replace("T", " ").slice(0, 19);
+  const recent = await env.DB.prepare(`
+    SELECT count(*) AS total, SUM(CASE WHEN ip IS NOT NULL AND ip = ? THEN 1 ELSE 0 END) AS fromIp
+    FROM feedback_reports WHERE aegis_id = ? AND created_at > ?
+  `).bind(ip, WEBSITE_AEGIS_ID, hourAgo).first<{ total: number | null; fromIp: number | null }>();
+  if ((recent?.total ?? 0) >= WEBSITE_LIMIT_PER_HOUR || (ip && (recent?.fromIp ?? 0) >= WEBSITE_IP_LIMIT_PER_HOUR)) {
+    return withCors(response({ error: "Thanks, we've had a lot of messages just now. Please try again later, or ask on Discord." }, 429), origin);
+  }
+
+  const kind = KINDS[topic];
+  const page = text(body.page, 500) ? redactUrl(text(body.page, 500)) : null;
+  const clean = redactSecrets(message);
+  const id = newId("fb");
+  await env.DB.prepare(`
+    INSERT INTO feedback_reports (id, aegis_id, kind, category, message, page, contact, data_json, fingerprint, ip)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).bind(
+    id, WEBSITE_AEGIS_ID, kind, `website:${topic}`, clean, page, email || null,
+    JSON.stringify({ source: "website", userAgent: text(request.headers.get("user-agent"), 300) || undefined }),
+    await fingerprintOf(kind, clean, page, []), ip,
+  ).run();
+  return withCors(response({ ok: true, id }, 201), origin);
+}
+
+registerPublicRoutes(async ({ request, env, url }) => {
+  if (url.pathname !== "/api/public/feedback") return null;
+  const origin = request.headers.get("origin");
+  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: cors(origin) });
+  if (request.method !== "POST") return withCors(response({ error: "Not found" }, 404), origin);
+  return submitWebsiteFeedback(request, env);
+});