@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/signup/attribution.test.ts

@@ -0,0 +1,147 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+import { normalizeAttribution } from "./attribution.js";
+
+const now = Date.parse("2026-09-25T12:00:00Z");
+
+test("attribution keeps only values that match the contract", () => {
+  const cleaned = normalizeAttribution({
+    ref: "  Partner_42 ",
+    utm_source: " newsletter ",
+    utm_medium: "email",
+    utm_campaign: "x".repeat(150),
+    utm_content: "line\nbreak",
+    utm_term: 7,
+    landing_path: "/pricing/?utm_source=newsletter#plans",
+    referrer_host: "News.Example.com",
+    first_seen_at: "2026-09-20T08:30:00.000Z",
+  }, now);
+  assert.deepEqual(cleaned, {
+    ref: "partner_42",
+    utm_source: "newsletter",
+    utm_medium: "email",
+    utm_campaign: "x".repeat(100),
+    utm_content: null,
+    utm_term: null,
+    landing_path: "/pricing/",
+    referrer_host: "news.example.com",
+    first_seen_at: "2026-09-20T08:30:00.000Z",
+  });
+
+  const invalid = normalizeAttribution({
+    ref: "bad code!",
+    utm_source: "ok",
+    landing_path: "//evil.test/path",
+    referrer_host: "www.bugmole.com",
+    first_seen_at: "2027-01-01T00:00:00Z",
+  }, now);
+  assert.equal(invalid?.ref, null);
+  assert.equal(invalid?.landing_path, null);
+  assert.equal(invalid?.referrer_host, null);
+  assert.equal(invalid?.first_seen_at, null);
+  assert.equal(invalid?.utm_source, "ok");
+
+  assert.equal(normalizeAttribution({ ref: "a".repeat(41) }, now), null);
+  assert.equal(normalizeAttribution({ referrer_host: "https://news.example.com/x" }, now), null);
+  assert.equal(normalizeAttribution({ first_seen_at: "2026-09-20T08:30:00Z" }, now), null, "a date alone says nothing");
+  assert.equal(normalizeAttribution({ landing_path: "/docs/", first_seen_at: "2025-01-01T00:00:00Z" }, now)?.first_seen_at, null);
+  assert.equal(normalizeAttribution([], now), null);
+  assert.equal(normalizeAttribution("ref=x", now), null);
+});
+
+test("the first touch is recorded once and never overwritten", async () => {
+  const { env, db } = createTestEnv();
+  const first = await call(env, "POST", "/api/attribution", {
+    as: "user_new",
+    body: { ref: "Partner", utm_campaign: "launch", landing_path: "/", referrer_host: "news.example.com", bogus: "ignored" },
+  });
+  assert.equal(first.status, 201, JSON.stringify(first.json));
+  assert.equal(first.json.recorded, true);
+
+  const second = await call(env, "POST", "/api/attribution", { as: "user_new", body: { ref: "other", utm_campaign: "later" } });
+  assert.equal(second.status, 200);
+  assert.deepEqual(second.json, { recorded: false, reason: "already_recorded" });
+
+  const row = db.db.prepare("SELECT ref, utm_campaign, utm_source, landing_path, referrer_host FROM signup_attribution WHERE aegis_id = ?").get("user_new");
+  assert.deepEqual({ ...row }, { ref: "partner", utm_campaign: "launch", utm_source: null, landing_path: "/", referrer_host: "news.example.com" });
+});
+
+test("an account older than a day can't be attributed", async () => {
+  const { env, db } = createTestEnv();
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_old', datetime('now', '-3 days'))").run();
+  const result = await call(env, "POST", "/api/attribution", { as: "user_old", body: { ref: "partner" } });
+  assert.deepEqual(result.json, { recorded: false, reason: "account_too_old" });
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM signup_attribution").get()?.n, 0);
+});
+
+test("nothing usable, API keys and the dashboard service record nothing", async () => {
+  const { env, db } = createTestEnv();
+  const empty = await call(env, "POST", "/api/attribution", { as: "user_new", body: { ref: "no spaces allowed", utm_source: "   " } });
+  assert.deepEqual(empty.json, { recorded: false, reason: "nothing_to_record" });
+
+  const { owner, projectId } = await seedProject(env);
+  const key = await call(env, "POST", "/api/api-keys", { as: owner, body: { name: "ci", projectIds: [projectId] } });
+  const byKey = await call(env, "POST", "/api/attribution", { token: key.json.token, body: { ref: "partner" } });
+  assert.equal(byKey.status, 403);
+  const byService = await call(env, "POST", "/api/attribution", { as: "bugmole-dashboard-service", body: { ref: "partner" } });
+  assert.equal(byService.status, 403);
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS n FROM signup_attribution").get()?.n, 0);
+});
+
+function withScents(env: Record<string, unknown>, codes: string[]) {
+  env.SCENTS = {
+    fetch: async (url: string) => {
+      const code = decodeURIComponent(String(url).split("/public/ref/")[1] ?? "");
+      return new Response(JSON.stringify({ valid: codes.includes(code) }), { headers: { "content-type": "application/json" } });
+    },
+  };
+  return env;
+}
+
+test("a typed referral code credits a recent account once, and only real codes", async () => {
+  const { env, db } = createTestEnv();
+  withScents(env as unknown as Record<string, unknown>, ["jane"]);
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_new', datetime('now', '-5 days'))").run();
+
+  const before = await call(env, "GET", "/api/attribution/me", { as: "user_new" });
+  assert.equal(before.json.ref, null);
+  assert.equal(before.json.canEnterCode, true);
+
+  const typo = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jan" } });
+  assert.equal(typo.status, 404);
+  const bad = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "not a code!" } });
+  assert.equal(bad.status, 400);
+
+  const ok = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: " JANE " } });
+  assert.equal(ok.status, 201, JSON.stringify(ok.json));
+  assert.equal(db.db.prepare("SELECT ref FROM signup_attribution WHERE aegis_id = 'user_new'").get()?.ref, "jane");
+
+  const again = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jane" } });
+  assert.equal(again.status, 409);
+  const after = await call(env, "GET", "/api/attribution/me", { as: "user_new" });
+  assert.deepEqual([after.json.ref, after.json.canEnterCode], ["jane", false]);
+});
+
+test("a code fills in a campaign-only attribution but never replaces a code", async () => {
+  const { env, db } = createTestEnv();
+  withScents(env as unknown as Record<string, unknown>, ["jane", "bob"]);
+  await call(env, "POST", "/api/attribution", { as: "user_new", body: { utm_campaign: "launch" } });
+  const ok = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "jane" } });
+  assert.equal(ok.status, 201);
+  const row = db.db.prepare("SELECT ref, utm_campaign FROM signup_attribution WHERE aegis_id = 'user_new'").get();
+  assert.deepEqual({ ...row }, { ref: "jane", utm_campaign: "launch" });
+  const swap = await call(env, "POST", "/api/attribution/code", { as: "user_new", body: { code: "bob" } });
+  assert.equal(swap.status, 409);
+});
+
+test("codes can't be added after 30 days, or when Scents can't be asked", async () => {
+  const { env, db } = createTestEnv();
+  db.db.prepare("INSERT INTO aegis_users (id, created_at) VALUES ('user_old', datetime('now', '-40 days'))").run();
+  const unreachable = await call(env, "POST", "/api/attribution/code", { as: "user_old", body: { code: "jane" } });
+  assert.equal(unreachable.status, 503);
+  withScents(env as unknown as Record<string, unknown>, ["jane"]);
+  const late = await call(env, "POST", "/api/attribution/code", { as: "user_old", body: { code: "jane" } });
+  assert.equal(late.status, 409);
+  assert.equal((await call(env, "GET", "/api/attribution/me", { as: "user_old" })).json.canEnterCode, false);
+});

package/src/registry-worker/signup/attribution.ts

@@ -0,0 +1,194 @@
+// Sign-up attribution: which affiliate code (?ref=) and campaign (utm_* tags)
+// brought a new user. bugmole.com keeps the first visit's tags in the bm_attr
+// cookie on .bugmole.com; the dashboard reads it after sign-in and posts it
+// here once. First touch wins, and only accounts created in the last day can
+// be attributed, so visiting an affiliate link later can't claim an old user.
+// Nothing here is sent anywhere else; Scents reads the table.
+import type { Env, Principal } from "../core.js";
+import { requestJson, response } from "../core.js";
+import { registerRoutes } from "../routes/index.js";
+
+/** How long after an account first appears it may still be attributed. */
+export const ATTRIBUTION_WINDOW_HOURS = 24;
+/** How long after signing up someone may still type an affiliate's referral code. */
+export const REFERRAL_CODE_WINDOW_DAYS = 30;
+
+// The dashboard's own identity for calls made without a person (webhooks).
+const DASHBOARD_SERVICE_ID = "bugmole-dashboard-service";
+const UTM_FIELDS = ["utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term"] as const;
+// The cookie lives 90 days; allow a little over that, and a little clock skew.
+const MAX_AGE_MS = 100 * 86_400_000;
+const CLOCK_SKEW_MS = 5 * 60_000;
+
+export type SignupAttribution = {
+  ref: string | null;
+  utm_source: string | null;
+  utm_medium: string | null;
+  utm_campaign: string | null;
+  utm_content: string | null;
+  utm_term: string | null;
+  landing_path: string | null;
+  referrer_host: string | null;
+  first_seen_at: string | null;
+};
+
+function text(value: unknown, max: number): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  // Control characters mean the value was tampered with, not typed into a link.
+  if (!trimmed || /[\u0000-\u001f\u007f]/u.test(trimmed)) return null;
+  return trimmed.slice(0, max);
+}
+
+function ref(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const code = value.trim().toLowerCase();
+  return /^[a-z0-9_-]{1,40}$/u.test(code) ? code : null;
+}
+
+function landingPath(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const pathOnly = value.trim().split(/[?#]/u)[0];
+  // A path on bugmole.com: starts with one slash, no spaces.
+  if (!/^\/(?!\/)[^\s\u0000-\u001f\u007f]*$/u.test(pathOnly)) return null;
+  return pathOnly.slice(0, 200);
+}
+
+function referrerHost(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const host = value.trim().toLowerCase().replace(/\.$/u, "");
+  if (host.length > 100 || !/^[a-z0-9-]+(\.[a-z0-9-]+)*$/u.test(host)) return null;
+  // Only outside sites count as referrers.
+  if (host === "bugmole.com" || host.endsWith(".bugmole.com")) return null;
+  return host;
+}
+
+function firstSeenAt(value: unknown, now: number): string | null {
+  if (typeof value !== "string" || value.length > 40) return null;
+  const at = Date.parse(value);
+  if (!Number.isFinite(at) || at > now + CLOCK_SKEW_MS || at < now - MAX_AGE_MS) return null;
+  return new Date(at).toISOString();
+}
+
+/**
+ * Keeps only values that match the contract; anything else becomes null.
+ * Returns null when nothing usable is left.
+ */
+export function normalizeAttribution(input: unknown, now = Date.now()): SignupAttribution | null {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const source = input as Record<string, unknown>;
+  const result: SignupAttribution = {
+    ref: ref(source.ref),
+    utm_source: null,
+    utm_medium: null,
+    utm_campaign: null,
+    utm_content: null,
+    utm_term: null,
+    landing_path: landingPath(source.landing_path),
+    referrer_host: referrerHost(source.referrer_host),
+    first_seen_at: firstSeenAt(source.first_seen_at, now),
+  };
+  for (const field of UTM_FIELDS) result[field] = text(source[field], 100);
+  const { first_seen_at: _when, ...facts } = result;
+  return Object.values(facts).some((value) => value !== null) ? result : null;
+}
+
+async function recordAttribution(request: Request, env: Env, principal: Principal): Promise<Response> {
+  // Only a person signed in on the dashboard, never an API key or runner.
+  if (principal.apiKeyId || principal.runner || !principal.scopes.includes("*") || principal.aegisId === DASHBOARD_SERVICE_ID) {
+    return response({ error: "Only the dashboard records sign-up attribution" }, 403);
+  }
+  const attribution = normalizeAttribution(await requestJson(request));
+  if (!attribution) return response({ recorded: false, reason: "nothing_to_record" });
+  const values = [
+    attribution.ref,
+    ...UTM_FIELDS.map((field) => attribution[field]),
+    attribution.landing_path,
+    attribution.referrer_host,
+    attribution.first_seen_at,
+  ];
+  const [, inserted] = await env.DB.batch([
+    // The dashboard can call this before anything else has created the row.
+    env.DB.prepare("INSERT INTO aegis_users (id) VALUES (?) ON CONFLICT(id) DO NOTHING").bind(principal.aegisId),
+    env.DB.prepare(`
+      INSERT INTO signup_attribution
+        (aegis_id, ref, utm_source, utm_medium, utm_campaign, utm_content, utm_term, landing_path, referrer_host, first_seen_at)
+      SELECT id, ?, ?, ?, ?, ?, ?, ?, ?, ?
+      FROM aegis_users
+      WHERE id = ? AND created_at > datetime('now', ?)
+      ON CONFLICT(aegis_id) DO NOTHING
+    `).bind(...values, principal.aegisId, `-${ATTRIBUTION_WINDOW_HOURS} hours`),
+  ]);
+  if (inserted?.meta?.changes === 1) return response({ recorded: true }, 201);
+  const existing = await env.DB.prepare("SELECT 1 AS found FROM signup_attribution WHERE aegis_id = ?")
+    .bind(principal.aegisId).first<{ found: number }>();
+  return response({ recorded: false, reason: existing ? "already_recorded" : "account_too_old" });
+}
+
+function signedInPerson(principal: Principal): boolean {
+  return !principal.apiKeyId && !principal.runner && principal.scopes.includes("*") && principal.aegisId !== DASHBOARD_SERVICE_ID;
+}
+
+/** Whether `code` is a real affiliate's code, asked of Scents (which owns the affiliate list). */
+export async function isAffiliateCode(env: Env, code: string): Promise<boolean | null> {
+  if (!env.SCENTS) return null;
+  try {
+    const res = await env.SCENTS.fetch(`https://scents.bugmole.com/public/ref/${encodeURIComponent(code)}`);
+    if (!res.ok) return null;
+    return ((await res.json()) as { valid?: boolean }).valid === true;
+  } catch {
+    return null;
+  }
+}
+
+/** The signed-in person's referral: the code that brought them, and whether they may still type one. */
+async function myReferral(env: Env, principal: Principal): Promise<Response> {
+  const row = await env.DB.prepare(
+    `SELECT u.created_at, a.ref FROM aegis_users u LEFT JOIN signup_attribution a ON a.aegis_id = u.id WHERE u.id = ?`,
+  ).bind(principal.aegisId).first<{ created_at: string | null; ref: string | null }>();
+  const created = row?.created_at ? Date.parse(`${row.created_at.replace(" ", "T")}Z`) : Date.now();
+  const deadline = new Date(created + REFERRAL_CODE_WINDOW_DAYS * 86_400_000);
+  return response({ ref: row?.ref ?? null, canEnterCode: !row?.ref && Date.now() < deadline.getTime(), deadline: deadline.toISOString() });
+}
+
+/**
+ * Someone types an affiliate's referral code (they may have heard it, or
+ * declined the cookie that would have carried the link's ?ref=). Once per
+ * person, within 30 days of signing up, only if nothing credited them yet,
+ * and only a code that belongs to an affiliate, so a typo can't lock in.
+ */
+async function enterReferralCode(request: Request, env: Env, principal: Principal): Promise<Response> {
+  const code = ref(((await requestJson(request)) as { code?: unknown } | null)?.code);
+  if (!code) return response({ error: "Enter the referral code: letters, numbers, - or _" }, 400);
+  const valid = await isAffiliateCode(env, code);
+  if (valid === null) return response({ error: "Couldn't check that code right now. Try again in a minute." }, 503);
+  if (!valid) return response({ error: "That referral code doesn't exist. Check the spelling." }, 404);
+  const [, written] = await env.DB.batch([
+    env.DB.prepare("INSERT INTO aegis_users (id) VALUES (?) ON CONFLICT(id) DO NOTHING").bind(principal.aegisId),
+    env.DB.prepare(`
+      INSERT INTO signup_attribution (aegis_id, ref)
+      SELECT id, ? FROM aegis_users WHERE id = ? AND created_at > datetime('now', ?)
+      ON CONFLICT(aegis_id) DO UPDATE SET ref = excluded.ref WHERE signup_attribution.ref IS NULL
+    `).bind(code, principal.aegisId, `-${REFERRAL_CODE_WINDOW_DAYS} days`),
+  ]);
+  if (written?.meta?.changes === 1) return response({ recorded: true, ref: code }, 201);
+  const existing = await env.DB.prepare("SELECT ref FROM signup_attribution WHERE aegis_id = ?").bind(principal.aegisId).first<{ ref: string | null }>();
+  return response(
+    existing?.ref
+      ? { error: `Your account is already credited to code ${existing.ref}.`, ref: existing.ref }
+      : { error: `Referral codes can only be added in the first ${REFERRAL_CODE_WINDOW_DAYS} days after signing up.` },
+    409,
+  );
+}
+
+registerRoutes(async ({ request, env, principal, url }) => {
+  if (url.pathname === "/api/attribution/me" || url.pathname === "/api/attribution/code") {
+    if (!signedInPerson(principal)) return response({ error: "Only the dashboard can do this" }, 403);
+    if (url.pathname === "/api/attribution/me" && request.method === "GET") return myReferral(env, principal);
+    if (url.pathname === "/api/attribution/code" && request.method === "POST") return enterReferralCode(request, env, principal);
+    return response({ error: "Method not allowed" }, 405);
+  }
+  if (url.pathname !== "/api/attribution") return null;
+  if (request.method !== "POST") return response({ error: "Method not allowed" }, 405);
+  return recordAttribution(request, env, principal);
+});

package/src/registry-worker/signup/policy.ts

@@ -3,7 +3,7 @@
 // whose email Aegis confirmed.
 import type { Env, Principal } from "../core.js";
 import { response } from "../core.js";
-import { entitlementMode } from "../billing/enforcement.js";
+import { billingLinks, entitlementMode } from "../billing/enforcement.js";
 import { getWorkspacePlan } from "../billing/entitlements.js";
 import { flagMode } from "../flags.js";
 
@@ -30,7 +30,7 @@ export async function freeWorkspaceLimit(env: Env, principal: Principal): Promis
     error: "You already have a Free workspace. Upgrade it, or ask a teammate to invite you to theirs.",
     code: "free_workspace_exists",
     workspaceId: owned[0],
-    upgradeUrl: "/billing",
+    ...billingLinks(env, owned[0], "team"),
   }, 402);
 }
 

package/src/registry-worker/signup/routes.ts

@@ -6,6 +6,7 @@ import { newId, response, requestJson } from "../core.js";
 import { recordAudit, actorOf } from "../org/audit.js";
 import { matchPath, registerRoutes } from "../routes/index.js";
 import { ownedFreeWorkspaces } from "./policy.js";
+import { domainIdentity, identityInUse, identityValues } from "../projects/identity.js";
 
 const MAX_NAME = 80;
 
@@ -54,6 +55,13 @@ async function onboard(env: Env, principal: Principal, request: Request): Promis
   const workspaceId = `${slugify(workspaceName, "workspace")}-${suffix()}`;
   const projectId = `${slugify(projectName, "project")}-${suffix()}`;
   const environment = siteUrl ? { id: "production", name: "Production", baseUrl: siteUrl } : null;
+  // The site's domain is the project's identity: one that's already someone
+  // else's Free project can't start a second Free workspace.
+  const identity = await domainIdentity(siteUrl);
+  if (identity) {
+    const inUse = await identityInUse(env, principal, workspaceId, identity);
+    if (inUse) return inUse;
+  }
   const statements = [
     env.DB.prepare(`
       INSERT INTO aegis_users (id, email, email_verified) VALUES (?, ?, 1)
@@ -63,9 +71,10 @@ async function onboard(env: Env, principal: Principal, request: Request): Promis
     env.DB.prepare("INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status) VALUES (?, ?, 'owner', 'active')")
       .bind(workspaceId, principal.aegisId),
     env.DB.prepare(`
-      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode, default_execution_mode, created_at)
-      VALUES (?, ?, ?, ?, ?, 'bugmole', 'managed', 'cloud', CURRENT_TIMESTAMP)
-    `).bind(projectId, workspaceId, workspaceId, projectName, environment?.id ?? "production"),
+      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode, default_execution_mode,
+        identity_kind, identity_key, identity_hash, identity_origin, created_at)
+      VALUES (?, ?, ?, ?, ?, 'bugmole', 'managed', 'cloud', ?, ?, ?, ?, CURRENT_TIMESTAMP)
+    `).bind(projectId, workspaceId, workspaceId, projectName, environment?.id ?? "production", ...identityValues(identity)),
     env.DB.prepare("INSERT INTO project_apps (id, project_id, name, type, is_default) VALUES ('default', ?, ?, 'web', 1)")
       .bind(projectId, projectName),
   ];

package/src/registry-worker/sso/membership.ts

@@ -1,7 +1,7 @@
 // Workspace membership for people who sign in through a workspace's identity
 // provider: roles follow their IdP groups, and the IdP can remove them.
 import { type Env, type WorkspaceRole, isWorkspaceRole } from "../core.js";
-import { flagOn } from "../flags.js";
+import { blockedBy, featureState } from "../feature-access.js";
 import { type AuditActor, recordAudit } from "../org/audit.js";
 
 /** Roles an IdP group may grant. Ownership is only ever given by a person. */
@@ -65,7 +65,9 @@ export async function applyOrgMembership(
   actor: AuditActor = { type: "user", id: identity.aegisId },
 ): Promise<void> {
   const workspace = await workspaceForOrg(env, org.id);
-  if (!workspace || !(await flagOn(env, workspace.id, "sso"))) return;
+  // Only the rollout gates this: a workspace that lost SSO on its plan keeps
+  // membership sync through the grace period syncSsoEntitlements manages.
+  if (!workspace || blockedBy(await featureState(env, workspace.id, "sso")) === "rollout") return;
   const role = pickRole(await groupRoleMappings(env, workspace.id), org.groups, workspace.defaultRole);
   const existing = await env.DB.prepare(
     "SELECT role, status, source FROM workspace_memberships WHERE workspace_id = ? AND aegis_id = ?",

package/src/registry-worker/sso/routes.ts

@@ -3,8 +3,8 @@
 // roles here, and act on Aegis's deprovisioning events.
 import { type Env, memberOfWorkspace, requestJson, response } from "../core.js";
 import { escapeHtml } from "../email/sender.js";
-import { getEntitlements } from "../billing/entitlements.js";
-import { flagOn } from "../flags.js";
+import { entitlementsFor } from "../../billing/plan-catalog.js";
+import { blockedBy, effectiveFeatures, type FeatureState } from "../feature-access.js";
 import { planChangedHooks } from "../hooks.js";
 import { registerJob } from "../jobs/index.js";
 import { enqueue, registerOutboxHandler } from "../notifications/outbox.js";
@@ -76,12 +76,28 @@ export function losesAccess(previous: Allowed, next: Allowed): boolean {
   return (previous.sso && !next.sso) || (previous.scim && !next.scim);
 }
 
+/**
+ * What the workspace is granted: the shared evaluator's answer, except that a
+ * rollout block (kill switch, beta, an incident override) falls back to the
+ * plan — it hides the feature without telling Aegis to revoke it.
+ */
+async function grantedFeatures(env: SsoEnv, workspaceId: string) {
+  const { plan, features: evaluated } = await effectiveFeatures(env, workspaceId);
+  const byPlan = entitlementsFor(plan.plan, plan.overrides).features;
+  const granted = (state: FeatureState, planValue: boolean) => blockedBy(state) === "rollout" ? planValue : state.enabled;
+  return {
+    evaluated,
+    features: { sso: granted(evaluated.sso, byPlan.sso), scim: granted(evaluated.scim, byPlan.scim) },
+  };
+}
+
 async function availability(env: SsoEnv, workspaceId: string) {
-  const { features } = await getEntitlements(env, workspaceId);
-  if (!(await flagOn(env, workspaceId, "sso")) || !aegisOrgConfigured(env) || !registryUrl(env)) {
+  const { evaluated, features } = await grantedFeatures(env, workspaceId);
+  const ssoBlocked = blockedBy(evaluated.sso);
+  if (ssoBlocked === "rollout" || !aegisOrgConfigured(env) || !registryUrl(env)) {
     return { available: false, reason: "Single sign-on isn't available yet.", features };
   }
-  if (!features.sso) return { available: false, reason: "Single sign-on is included in Business and Enterprise.", features };
+  if (ssoBlocked === "plan") return { available: false, reason: "Single sign-on is included in Business and Enterprise.", features };
   return { available: true, features };
 }
 
@@ -251,8 +267,8 @@ async function passthrough(context: AuthedRouteContext, workspace: WorkspaceSsoR
     if (!params) continue;
     if (Object.values(params).some((value) => !SAFE_ID.test(value))) return response({ error: "Not found" }, 404);
     if (entry.needs === "scim") {
-      const { features } = await getEntitlements(env, workspace.id);
-      if (!features.scim) return response({ error: "SCIM provisioning is included in Enterprise." }, 402);
+      const { features } = await effectiveFeatures(env, workspace.id);
+      if (!features.scim.enabled) return response({ error: "SCIM provisioning is included in Enterprise." }, 402);
     }
     let body: Record<string, unknown> | undefined;
     if (entry.fields) {
@@ -395,7 +411,7 @@ async function ownerEmails(env: Env, workspaceId: string): Promise<string[]> {
 export async function syncSsoEntitlements(env: SsoEnv, workspaceId: string, now = new Date()): Promise<void> {
   const workspace = await workspaceSso(env, workspaceId);
   if (!workspace?.aegisOrgId) return;
-  const { features } = await getEntitlements(env, workspaceId);
+  const { features } = await grantedFeatures(env, workspaceId);
   const previous = decodeAllowed(workspace.entitlement);
   const allowed = planAllows(features);
   let graceUntil = workspace.graceUntil;

package/src/registry-worker/sso/sso.test.ts

@@ -255,14 +255,15 @@ test("losing SSO starts a 14-day notice before Aegis turns it off", async () =>
   assert.equal(row().ent, "sso");
   assert.equal(row().grace, new Date(now.getTime() + SSO_GRACE_DAYS * 86_400_000).toISOString());
   assert.deepEqual(aegis.org.entitlements, { sso: true, scim: false }, "still on during the notice");
-  await drainOutbox(env, now);
+  // The outbox queues on the real clock, so drain on it too; the synced dates stay fixed.
+  await drainOutbox(env, new Date());
   assert.equal(email.sent.length, 1);
   assert.match(email.sent[0].subject, /Single sign-on for Acme ends on 2026-10-15/);
 
   // A daily re-sync during the notice changes nothing and sends no second email.
   await syncSsoEntitlements(env, workspaceId, new Date("2026-10-05T00:00:00Z"));
   assert.equal(aegis.org.entitlements.sso, true);
-  await drainOutbox(env, new Date("2026-10-05T00:00:00Z"));
+  await drainOutbox(env, new Date());
   assert.equal(email.sent.length, 1);
 
   await syncSsoEntitlements(env, workspaceId, new Date("2026-10-16T00:00:00Z"));

package/src/registry-worker/task-approval.test.ts

@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "./testing/harness.js";
+
+async function inviteAndJoin(env: Parameters<typeof call>[0], inviter: string, workspaceId: string, who: string, role: string) {
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: inviter, body: { email: `${who}@example.com`, role } });
+  assert.equal(invited.status, 201, JSON.stringify(invited.json));
+  const token = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  assert.equal((await call(env, "POST", `/api/invitations/${token}/accept`, { as: who })).status, 200);
+}
+
+function taskApi(env: Parameters<typeof call>[0], projectId: string, owner: string) {
+  let key = 0;
+  return {
+    create: (taskType: string, as = owner) => call(env, "POST", `/api/projects/${projectId}/tasks`, {
+      as,
+      body: { title: `A ${taskType} task`, description: "Do the thing on https://shop.test", taskType, idempotencyKey: `k${key += 1}` },
+    }),
+    claim: (taskId: string) => call(env, "POST", `/api/tasks/${taskId}/claim`, { as: owner, body: { workerId: "worker-1" } }),
+    approve: (taskId: string, as = owner) => call(env, "POST", `/api/tasks/${taskId}/approve`, { as }),
+    setMode: (taskApprovalMode: string, as = owner) => call(env, "PATCH", `/api/projects/${projectId}/settings`, { as, body: { taskApprovalMode } }),
+  };
+}
+
+test("in auto mode, investigations start by themselves and code changes wait for a manager's approval", async () => {
+  const { env } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  const tasks = taskApi(env, projectId, owner);
+
+  const investigation = (await tasks.create("investigation")).json.task;
+  assert.equal(investigation.approvedBy, "auto:auto");
+  assert.ok(investigation.approvedAt);
+  assert.equal((await tasks.claim(investigation.id)).status, 200);
+
+  const code = (await tasks.create("code")).json.task;
+  assert.equal(code.approvedAt, null, "a code change waits");
+  const early = await tasks.claim(code.id);
+  assert.equal(early.status, 409);
+  assert.match(early.json.error, /waiting for approval/);
+
+  assert.equal((await tasks.approve(code.id, "user_member")).status, 403, "members can queue tasks but not approve them");
+  const approved = await tasks.approve(code.id);
+  assert.equal(approved.status, 200, JSON.stringify(approved.json));
+  assert.equal(approved.json.task.approvedBy, owner);
+  assert.equal((await tasks.approve(code.id)).status, 409, "approving twice");
+  assert.equal((await tasks.claim(code.id)).status, 200);
+});
+
+test("manual holds every task, extreme holds none, and only managers change the mode", async () => {
+  const { env } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  const tasks = taskApi(env, projectId, owner);
+
+  assert.equal((await tasks.setMode("manual", "user_member")).status, 403);
+  assert.equal((await tasks.setMode("reckless")).status, 422);
+  assert.equal((await tasks.setMode("manual")).status, 200);
+  const listed = await call(env, "GET", "/api/projects", { as: owner });
+  assert.equal(listed.json.projects.find((project: { id: string }) => project.id === projectId).taskApprovalMode, "manual");
+  assert.equal((await tasks.create("investigation")).json.task.approvedAt, null, "manual holds even an investigation");
+
+  assert.equal((await tasks.setMode("extreme")).status, 200);
+  const code = (await tasks.create("code")).json.task;
+  assert.equal(code.approvedBy, "auto:extreme");
+  assert.equal((await tasks.claim(code.id)).status, 200);
+});