@bugmole/cli 0.5.0 → 0.6.0

package/src/registry-worker/notifications/alerts.ts

@@ -2,7 +2,7 @@
 // the outbox handlers that deliver them.
 import type { Env } from "../core.js";
 import { emailSender, escapeHtml, type EmailMessage } from "../email/sender.js";
-import { getEntitlements } from "../billing/entitlements.js";
+import { effectiveFeatures } from "../feature-access.js";
 import { onUsageAlert } from "../billing/thresholds.js";
 import { runChangedHooks } from "../hooks.js";
 import { enqueue, registerOutboxHandler } from "./outbox.js";
@@ -48,10 +48,10 @@ async function matchingRules(env: Env, workspaceId: string, event: AlertEvent, p
       )
   `).bind(workspaceId, event, projectId).all<Rule>();
   if (!rows.results.some((rule) => PAID_CHANNELS.has(rule.channel))) return rows.results;
-  const { features } = await getEntitlements(env, workspaceId);
+  const { features } = await effectiveFeatures(env, workspaceId);
   return rows.results.filter((rule) => {
-    if (rule.channel === "slack") return features.slack;
-    if (rule.channel === "teams") return features.teams;
+    if (rule.channel === "slack") return features.slack.enabled;
+    if (rule.channel === "teams") return features.teams.enabled;
     return true;
   });
 }

package/src/registry-worker/notifications/notifications.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { validTeamsWebhookUrl } from "./teams.js";
 import type { Env } from "../core.js";
 import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
 import { recordUsage } from "../billing/ledger.js";
@@ -296,3 +297,13 @@ test("a failed run reaches both Slack and Teams; a revoked Teams webhook disconn
   // Already revoked by the failed delivery above, so there's nothing left to disconnect.
   assert.equal((await call(setup.env, "DELETE", `/api/workspaces/${project.workspaceId}/integrations/teams/${teamsInstallationId}`, { as: project.owner })).status, 404);
 });
+
+test("Teams accepts the Power Automate webhook URLs Microsoft issues now, and still nothing else", () => {
+  // Microsoft moved workflow triggers from logic.azure.com to api.powerplatform.com in 2025.
+  assert.equal(validTeamsWebhookUrl("https://default1234.56.environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/abc/triggers/manual/paths/invoke?api-version=1"), true);
+  assert.equal(validTeamsWebhookUrl("https://acme.logic.azure.com/workflows/abc123/triggers/manual/paths/invoke"), true);
+  assert.equal(validTeamsWebhookUrl("http://api.powerplatform.com/x"), false, "https only");
+  assert.equal(validTeamsWebhookUrl("https://api.powerplatform.com.evil.example/x"), false);
+  assert.equal(validTeamsWebhookUrl("https://evilapi.powerplatform.com.attacker.net/x"), false);
+  assert.equal(validTeamsWebhookUrl("https://notpowerplatform.com/x"), false);
+});

package/src/registry-worker/notifications/routes.ts

@@ -1,8 +1,7 @@
 // Routes for connecting Slack and choosing which alerts go where.
 import type { Env, Principal } from "../core.js";
 import { memberOfWorkspace, newId, requestJson, response } from "../core.js";
-import { getEntitlements } from "../billing/entitlements.js";
-import { flagOn } from "../flags.js";
+import { blockedBy, featureState } from "../feature-access.js";
 import { actorOf, recordAudit } from "../org/audit.js";
 import { matchPath, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
 import { ALERT_EVENTS, isAlertEvent, slackBlocks } from "./alerts.js";
@@ -15,20 +14,20 @@ async function canManage(env: Env, principal: Principal, workspaceId: string): P
   return memberOfWorkspace(env, principal, workspaceId, "workspace.manage");
 }
 
-async function slackAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string }> {
-  if (!(await flagOn(env, workspaceId, "slack")) || !slackConfigured(env) || !canStoreSecrets(env)) {
+async function slackAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string; planIncludes?: boolean }> {
+  const blocked = blockedBy(await featureState(env, workspaceId, "slack"));
+  if (blocked === "rollout" || !slackConfigured(env) || !canStoreSecrets(env)) {
     return { available: false, reason: "Slack isn't available yet." };
   }
-  const { features } = await getEntitlements(env, workspaceId);
-  return features.slack ? { available: true } : { available: false, reason: "Slack alerts are included in Team and Business." };
+  return blocked ? { available: false, reason: "Slack alerts are included in Team and Business.", planIncludes: false } : { available: true, planIncludes: true };
 }
 
-async function teamsAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string }> {
-  if (!(await flagOn(env, workspaceId, "teams")) || !canStoreSecrets(env)) {
+async function teamsAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string; planIncludes?: boolean }> {
+  const blocked = blockedBy(await featureState(env, workspaceId, "teams"));
+  if (blocked === "rollout" || !canStoreSecrets(env)) {
     return { available: false, reason: "Microsoft Teams isn't available yet." };
   }
-  const { features } = await getEntitlements(env, workspaceId);
-  return features.teams ? { available: true } : { available: false, reason: "Microsoft Teams alerts are included in Team and Business." };
+  return blocked ? { available: false, reason: "Microsoft Teams alerts are included in Team and Business.", planIncludes: false } : { available: true, planIncludes: true };
 }
 
 async function overview({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {

package/src/registry-worker/notifications/teams.ts

@@ -15,11 +15,15 @@ export function teamsFetchEnv(env: object): TeamsFetchEnv {
   return env as TeamsFetchEnv;
 }
 
-/** A Workflows webhook is a plain HTTPS URL on Microsoft's Logic Apps or Power Automate domains. */
+/**
+ * A Workflows webhook is a plain HTTPS URL on Microsoft's Power Automate
+ * domains: api.powerplatform.com (and its per-environment subdomains) since
+ * Microsoft moved the triggers there in 2025, and the older Logic Apps hosts.
+ */
 export function validTeamsWebhookUrl(value: string): boolean {
   try {
     const url = new URL(value);
-    return url.protocol === "https:" && /(^|\.)(logic\.azure\.com|azure-automation\.net|flow\.microsoft\.com)$/i.test(url.hostname);
+    return url.protocol === "https:" && /(^|\.)(api\.powerplatform\.com|logic\.azure\.com|azure-automation\.net|flow\.microsoft\.com)$/i.test(url.hostname);
   } catch {
     return false;
   }

package/src/registry-worker/org/routes.ts

@@ -12,7 +12,7 @@ import {
   workspaceRole,
 } from "../core.js";
 import { emailSender, escapeHtml } from "../email/sender.js";
-import { getEntitlements } from "../billing/entitlements.js";
+import { featureEnabled } from "../feature-access.js";
 import { type AuthedRouteContext, matchPath, registerRoutes } from "../routes/index.js";
 import { actorOf, auditCsv, listAudit, recordAudit } from "./audit.js";
 
@@ -253,12 +253,12 @@ async function auditLog(context: AuthedRouteContext, workspaceId: string): Promi
   if (!(await memberOfWorkspace(env, principal, workspaceId, "audit.read"))) {
     return response({ error: "Only owners and admins can view the audit log" }, 403);
   }
-  const entitlements = await getEntitlements(env, workspaceId);
+  const auditExport = await featureEnabled(env, workspaceId, "audit_export");
   const csv = url.searchParams.get("format") === "csv";
-  if (csv && !entitlements.features.auditLogExport) {
+  if (csv && !auditExport) {
     return response({ error: "Audit log export is available on the Business plan", code: "plan_feature", feature: "auditLogExport" }, 402);
   }
-  const fullHistory = entitlements.features.auditLogExport;
+  const fullHistory = auditExport;
   const basicSince = new Date(Date.now() - BASIC_AUDIT_DAYS * 86_400_000).toISOString();
   const requestedSince = url.searchParams.get("since") ?? undefined;
   const since = fullHistory ? requestedSince : requestedSince && requestedSince > basicSince ? requestedSince : basicSince;

package/src/registry-worker/projects/identity.ts

@@ -0,0 +1,194 @@
+// One app is one project. A project's identity (src/registry/project-identity.ts)
+// is its app's domain, or its repository plus the app's folder. In a workspace
+// the same identity always resolves to the existing project, and on Free an
+// identity that already belongs to someone else's Free workspace can't be
+// claimed by another (the owner invites you, or you upgrade).
+import {
+  describeIdentity,
+  domainIdentityFromUrl,
+  identityHash,
+  parseProjectIdentity,
+  type ProjectIdentity,
+} from "../../registry/project-identity.js";
+import type { Env, Principal } from "../core.js";
+import { can, memberOfProject, requestJson, response } from "../core.js";
+import { billingLinks, entitlementMode } from "../billing/enforcement.js";
+import { getWorkspacePlan } from "../billing/entitlements.js";
+import { auditProject } from "../org/audit.js";
+import { matchPath, registerRoutes } from "../routes/index.js";
+import { activateUrl } from "./inactivity.js";
+
+export type StoredIdentity = ProjectIdentity & { hash: string };
+
+export type IdentityProject = { id: string; name: string; workspaceId: string; inactiveAt: string | null };
+
+/** The registry's normalized, hashed reading of a client's identity; null when none was sent. */
+export async function readIdentity(input: unknown): Promise<StoredIdentity | null | "invalid"> {
+  const parsed = parseProjectIdentity(input);
+  if (parsed === null || parsed === "invalid") return parsed;
+  return { ...parsed, hash: await identityHash(parsed.key) };
+}
+
+/** A cloud project's identity from a site URL; null for a private host or no URL. */
+export async function domainIdentity(appUrl: unknown): Promise<StoredIdentity | null> {
+  const parsed = domainIdentityFromUrl(appUrl);
+  return parsed ? { ...parsed, hash: await identityHash(parsed.key) } : null;
+}
+
+export const invalidIdentity = () => response({
+  error: "identity must name a git remote (with the app's folder) or a public domain",
+  code: "invalid_identity",
+}, 422);
+
+/** The columns an identity is stored in, in INSERT order: kind, key, hash, origin. */
+export function identityValues(identity: StoredIdentity | null): [string | null, string | null, string | null, string | null] {
+  return identity ? [identity.kind, identity.key, identity.hash, identity.origin ?? null] : [null, null, null, null];
+}
+
+/** The existing project in a workspace with this identity. */
+export async function workspaceProjectWithIdentity(env: Env, workspaceId: string, hash: string): Promise<IdentityProject | null> {
+  return env.DB.prepare(`
+    SELECT id, name, workspace_id AS workspaceId, inactive_at AS inactiveAt FROM projects
+    WHERE workspace_id = ? AND identity_hash = ? AND deleted_at IS NULL
+  `).bind(workspaceId, hash).first<IdentityProject>();
+}
+
+/**
+ * A project with this identity in a workspace the person can work in (owner,
+ * admin or member). Pairing a teammate's clone of the same repository lands
+ * here instead of creating a second project.
+ */
+export async function memberProjectWithIdentity(env: Env, principal: Principal, hash: string): Promise<IdentityProject | null> {
+  const row = await env.DB.prepare(`
+    SELECT p.id, p.name, p.workspace_id AS workspaceId, p.inactive_at AS inactiveAt FROM projects p
+    JOIN workspace_memberships wm ON wm.workspace_id = p.workspace_id AND wm.aegis_id = ? AND wm.status = 'active'
+      AND wm.role IN ('owner', 'admin', 'member')
+    WHERE p.identity_hash = ? AND p.deleted_at IS NULL
+    ORDER BY p.created_at ASC, p.rowid ASC LIMIT 1
+  `).bind(principal.aegisId, hash).first<IdentityProject>();
+  if (!row) return null;
+  return principal.projectIds.length === 0 || principal.projectIds.includes(row.id) ? row : null;
+}
+
+/**
+ * Refuses a Free workspace an app that already belongs to an active project
+ * in someone else's Free workspace. Paid workspaces are never refused. Follows
+ * the "entitlements" rollout: enforced it refuses, in shadow it only logs.
+ */
+export async function identityInUse(env: Env, principal: Principal, workspaceId: string, identity: StoredIdentity): Promise<Response | null> {
+  if ((await getWorkspacePlan(env, workspaceId)).plan !== "free") return null;
+  const other = await env.DB.prepare(`
+    SELECT p.id, p.workspace_id AS workspaceId FROM projects p
+    LEFT JOIN workspace_plans wp ON wp.workspace_id = p.workspace_id
+    WHERE p.identity_hash = ? AND p.workspace_id <> ? AND p.deleted_at IS NULL AND p.inactive_at IS NULL
+      AND (wp.workspace_id IS NULL OR wp.plan = 'free' OR wp.status = 'canceled')
+      AND NOT EXISTS (
+        SELECT 1 FROM workspace_memberships wm
+        WHERE wm.workspace_id = p.workspace_id AND wm.aegis_id = ? AND wm.role = 'owner' AND wm.status = 'active'
+      )
+    LIMIT 1
+  `).bind(identity.hash, workspaceId, principal.aegisId).first<{ id: string; workspaceId: string }>();
+  if (!other) return null;
+  const mode = await entitlementMode(env, workspaceId);
+  if (mode === "off") return null;
+  if (mode === "shadow") {
+    console.warn(`[entitlements] shadow: would refuse ${identity.kind} identity already used by a Free workspace (${other.workspaceId}) for ${workspaceId}`);
+    return null;
+  }
+  const name = describeIdentity(identity);
+  return response({
+    error: `${name} is already a project in another Free workspace. Ask that project's owner to invite you to their workspace, or upgrade this workspace to add it here.`,
+    code: "identity_in_use",
+    identity: name,
+    ...billingLinks(env, workspaceId, "team"),
+  }, 409);
+}
+
+/**
+ * Gives a project that has none an identity. False when the workspace already
+ * has another project with it (the unique index), so the caller can say so.
+ */
+export async function assignIdentity(env: Env, projectId: string, identity: StoredIdentity): Promise<boolean> {
+  try {
+    const result = await env.DB.prepare(`
+      UPDATE projects SET identity_kind = ?, identity_key = ?, identity_hash = ?, identity_origin = ?
+      WHERE id = ? AND identity_hash IS NULL
+    `).bind(...identityValues(identity), projectId).run() as { meta?: { changes?: number } };
+    return result.meta?.changes === 1;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * When a project without an identity gets a public site URL (an environment),
+ * that domain becomes its identity. Refused on Free if the domain is someone
+ * else's Free project; left unset if the workspace already has a project for it.
+ */
+export async function claimDomainIdentity(env: Env, principal: Principal, projectId: string, baseUrl: unknown): Promise<Response | null> {
+  const identity = await domainIdentity(baseUrl);
+  if (!identity) return null;
+  const project = await env.DB.prepare("SELECT workspace_id AS workspaceId, identity_hash AS identityHash FROM projects WHERE id = ?")
+    .bind(projectId).first<{ workspaceId: string | null; identityHash: string | null }>();
+  if (!project?.workspaceId || project.identityHash) return null;
+  if (await workspaceProjectWithIdentity(env, project.workspaceId, identity.hash)) return null;
+  const refusal = await identityInUse(env, principal, project.workspaceId, identity);
+  if (refusal) return refusal;
+  await assignIdentity(env, projectId, identity);
+  return null;
+}
+
+/** What a project's identity looks like to the dashboard, the MCP and the CLI. */
+export function identityView(row: { identityKind?: string | null; identityKey?: string | null }) {
+  if (!row.identityKind || !row.identityKey) return null;
+  const kind = row.identityKind === "domain" ? "domain" : "repo";
+  return { kind, key: row.identityKey, label: describeIdentity({ kind, key: row.identityKey }) } as const;
+}
+
+/**
+ * POST /api/projects/:id/identity — the CLI (`bugmole serve`, `bugmole init`)
+ * reports which app a project is. Sets it once; afterwards it must match, so
+ * two apps of a monorepo never share one project.
+ */
+async function setProjectIdentity(env: Env, principal: Principal, projectId: string, request: Request): Promise<Response> {
+  if (!can(principal, "projects:write") && !can(principal, "*")) return response({ error: "Project editing is not allowed" }, 403);
+  if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
+  const body = await requestJson(request);
+  const identity = await readIdentity(body?.identity);
+  if (identity === "invalid" || identity === null) return invalidIdentity();
+  const project = await env.DB.prepare(`
+    SELECT workspace_id AS workspaceId, identity_hash AS identityHash, identity_kind AS identityKind, identity_key AS identityKey,
+           inactive_at AS inactiveAt
+    FROM projects WHERE id = ? AND deleted_at IS NULL
+  `).bind(projectId).first<{ workspaceId: string | null; identityHash: string | null; identityKind: string | null; identityKey: string | null; inactiveAt: string | null }>();
+  if (!project?.workspaceId) return response({ error: "Project not found" }, 404);
+  const status = { inactiveAt: project.inactiveAt, ...(project.inactiveAt ? { activateUrl: activateUrl(env, projectId) } : {}) };
+  if (project.identityHash) {
+    if (project.identityHash === identity.hash) return response({ identity: identityView(project), ...status });
+    return response({
+      error: `This project is ${describeIdentity({ kind: project.identityKind === "domain" ? "domain" : "repo", key: project.identityKey ?? "" })}, not ${describeIdentity(identity)}. Each app is its own project: run \`bugmole init\` in this app's folder to create or join its project.`,
+      code: "identity_mismatch",
+      identity: identityView(project),
+    }, 409);
+  }
+  const existing = await workspaceProjectWithIdentity(env, project.workspaceId, identity.hash);
+  if (existing && existing.id !== projectId) {
+    return response({
+      error: `${describeIdentity(identity)} is already project ${existing.id} in this workspace. Use that project instead.`,
+      code: "identity_exists",
+      projectId: existing.id,
+    }, 409);
+  }
+  const refusal = await identityInUse(env, principal, project.workspaceId, identity);
+  if (refusal) return refusal;
+  if (!(await assignIdentity(env, projectId, identity))) return response({ error: "The project's identity changed; try again", code: "identity_conflict" }, 409);
+  await auditProject(env, principal, projectId, { action: "project.identity_set", targetType: "project", targetId: projectId, data: { kind: identity.kind, identity: describeIdentity(identity) } }, request);
+  return response({ identity: identityView({ identityKind: identity.kind, identityKey: identity.key }), ...status });
+}
+
+registerRoutes(async ({ request, env, principal, url }) => {
+  if (request.method !== "POST") return null;
+  const params = matchPath(url.pathname, "/api/projects/:projectId/identity");
+  if (!params) return null;
+  return setProjectIdentity(env, principal, params.projectId, request);
+});

package/src/registry-worker/projects/inactivity.ts

@@ -0,0 +1,162 @@
+// Projects nobody uses are paused after the plan's inactiveProjectDays (Free:
+// 30; paid plans: never). A paused project keeps everything and stays
+// readable, but takes no runs, tasks or claims (409 project_inactive) and
+// doesn't count toward the project limit until a member activates it again.
+//
+// Activity is the latest of: the project's creation or last activation, a
+// run requested or finished, an agent task requested, worked on or finished,
+// a published plan, a saved journey, a machine (`bugmole serve` or the MCP
+// with an API key) checking for tasks, or any audited dashboard change.
+//
+// Everything follows the "entitlements" rollout: enforced, projects are
+// paused and refused; in shadow, the job and the gates only log.
+import type { Env, Principal } from "../core.js";
+import { can, memberOfProject, response } from "../core.js";
+import { checkProjectLimit, entitlementMode } from "../billing/enforcement.js";
+import { getEntitlements } from "../billing/entitlements.js";
+import { auditProject, recordAudit } from "../org/audit.js";
+import { matchPath, registerRoutes } from "../routes/index.js";
+import { registerJob } from "../jobs/index.js";
+
+const DAY_MS = 86_400_000;
+/** No plan pauses sooner than this, so younger projects are never examined. */
+const MIN_INACTIVE_DAYS = 30;
+const MAX_PAUSED_PER_TICK = 500;
+
+/** Where a member activates a paused project (the project's dashboard page). */
+export function activateUrl(env: Env, projectId: string): string {
+  return `${(env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "")}/?project=${encodeURIComponent(projectId)}`;
+}
+
+/** D1's CURRENT_TIMESTAMP is "YYYY-MM-DD HH:MM:SS" (UTC); everything else is ISO. */
+export function parseRegistryTime(value: string | null | undefined): number {
+  if (!value) return Number.NaN;
+  return Date.parse(/[zZ]|[+-]\d\d:\d\d$/.test(value) ? value : `${value.replace(" ", "T")}Z`);
+}
+
+const LAST_ACTIVITY = `
+  SELECT p.id, p.workspace_id AS workspaceId, p.name,
+    p.created_at AS createdAt, p.local_worker_seen_at AS workerSeenAt, p.activated_at AS activatedAt,
+    (SELECT MAX(COALESCE(r.completed_at, r.requested_at)) FROM runs r WHERE r.project_id = p.id) AS runAt,
+    (SELECT MAX(COALESCE(t.completed_at, t.heartbeat_at, t.requested_at)) FROM agent_tasks t WHERE t.project_id = p.id) AS taskAt,
+    (SELECT MAX(d.updated_at) FROM plan_drafts d WHERE d.project_id = p.id) AS planAt,
+    (SELECT MAX(j.created_at) FROM journey_revisions j WHERE j.project_id = p.id) AS journeyAt,
+    (SELECT MAX(a.created_at) FROM audit_log a WHERE a.project_id = p.id AND a.actor_type <> 'system') AS auditAt
+  FROM projects p
+`;
+
+type ActivityRow = {
+  id: string; workspaceId: string; name: string;
+  createdAt: string | null; workerSeenAt: string | null; activatedAt: string | null;
+  runAt: string | null; taskAt: string | null; planAt: string | null; journeyAt: string | null; auditAt: string | null;
+};
+
+/** The latest activity on a project, in epoch ms (NaN when it has none on record). */
+export function lastActivityOf(row: Omit<ActivityRow, "id" | "workspaceId" | "name">): number {
+  const times = [row.createdAt, row.workerSeenAt, row.activatedAt, row.runAt, row.taskAt, row.planAt, row.journeyAt, row.auditAt]
+    .map(parseRegistryTime)
+    .filter(Number.isFinite);
+  return times.length ? Math.max(...times) : Number.NaN;
+}
+
+export async function projectLastActivity(env: Env, projectId: string): Promise<number> {
+  const row = await env.DB.prepare(`${LAST_ACTIVITY} WHERE p.id = ?`).bind(projectId).first<ActivityRow>();
+  return row ? lastActivityOf(row) : Number.NaN;
+}
+
+/** Pauses projects idle for longer than their workspace's plan allows. */
+export async function pauseInactiveProjects(env: Env, now = new Date()): Promise<{ paused: number; wouldPause: number }> {
+  const oldest = new Date(now.getTime() - MIN_INACTIVE_DAYS * DAY_MS).toISOString();
+  const workspaces = await env.DB.prepare(`
+    SELECT DISTINCT workspace_id AS workspaceId FROM projects
+    WHERE workspace_id IS NOT NULL AND deleted_at IS NULL AND inactive_at IS NULL
+      AND COALESCE(activated_at, created_at) < ?
+  `).bind(oldest).all<{ workspaceId: string }>();
+  let paused = 0;
+  let wouldPause = 0;
+  for (const { workspaceId } of workspaces.results) {
+    if (paused >= MAX_PAUSED_PER_TICK) break;
+    const { inactiveProjectDays } = await getEntitlements(env, workspaceId);
+    if (inactiveProjectDays === null) continue;
+    const mode = await entitlementMode(env, workspaceId);
+    if (mode === "off") continue;
+    const cutoff = now.getTime() - inactiveProjectDays * DAY_MS;
+    const rows = await env.DB.prepare(`${LAST_ACTIVITY} WHERE p.workspace_id = ? AND p.deleted_at IS NULL AND p.inactive_at IS NULL`)
+      .bind(workspaceId).all<ActivityRow>();
+    const idle = rows.results.filter((row) => {
+      const last = lastActivityOf(row);
+      return Number.isFinite(last) && last < cutoff;
+    });
+    if (!idle.length) continue;
+    if (mode === "shadow") {
+      wouldPause += idle.length;
+      console.warn(`[entitlements] shadow: would pause ${idle.length} project(s) idle for over ${inactiveProjectDays} days in ${workspaceId}`);
+      continue;
+    }
+    const stamp = now.toISOString();
+    for (const project of idle.slice(0, MAX_PAUSED_PER_TICK - paused)) {
+      await env.DB.prepare("UPDATE projects SET inactive_at = ? WHERE id = ? AND inactive_at IS NULL").bind(stamp, project.id).run();
+      await recordAudit(env, { type: "system", id: "inactivity" }, {
+        workspaceId, projectId: project.id, action: "project.paused", targetType: "project", targetId: project.id,
+        data: { inactiveProjectDays, lastActivity: new Date(lastActivityOf(project)).toISOString() },
+      });
+      paused += 1;
+    }
+  }
+  return { paused, wouldPause };
+}
+
+/**
+ * The refusal for work on a paused project: runs, tasks and claims. Null when
+ * the project is active, or when plan limits aren't enforced (shadow logs).
+ */
+export async function projectInactiveRefusal(env: Env, projectId: string): Promise<Response | null> {
+  const project = await env.DB.prepare("SELECT inactive_at AS inactiveAt, workspace_id AS workspaceId FROM projects WHERE id = ?")
+    .bind(projectId).first<{ inactiveAt: string | null; workspaceId: string | null }>();
+  if (!project?.inactiveAt) return null;
+  const mode = await entitlementMode(env, project.workspaceId);
+  if (mode === "off") return null;
+  if (mode === "shadow") {
+    console.warn(`[entitlements] shadow: would refuse work on paused project ${projectId}`);
+    return null;
+  }
+  const days = project.workspaceId ? (await getEntitlements(env, project.workspaceId)).inactiveProjectDays : null;
+  const url = activateUrl(env, projectId);
+  return response({
+    error: `This project is paused${days ? ` after ${days} days without activity` : ""}, so it can't run tests or tasks. A project member can activate it: ${url}`,
+    code: "project_inactive",
+    inactiveAt: project.inactiveAt,
+    activateUrl: url,
+  }, 409);
+}
+
+/** POST /api/projects/:id/activate — a member with write access un-pauses a project, within the plan's project limit. */
+async function activateProject(env: Env, principal: Principal, projectId: string, request: Request): Promise<Response> {
+  if (!can(principal, "projects:write") && !can(principal, "*")) return response({ error: "Project editing is not allowed" }, 403);
+  if (!(await memberOfProject(env, principal, projectId, "project.write"))) return response({ error: "Project scope is not allowed" }, 403);
+  const project = await env.DB.prepare("SELECT workspace_id AS workspaceId, inactive_at AS inactiveAt FROM projects WHERE id = ? AND deleted_at IS NULL")
+    .bind(projectId).first<{ workspaceId: string | null; inactiveAt: string | null }>();
+  if (!project) return response({ error: "Project not found" }, 404);
+  if (!project.inactiveAt) return response({ project: { id: projectId, inactiveAt: null }, alreadyActive: true });
+  // A paused project doesn't count toward the limit, so activating needs room for it.
+  if (project.workspaceId) {
+    const limit = await checkProjectLimit(env, project.workspaceId);
+    if (limit) return limit;
+  }
+  const now = new Date().toISOString();
+  await env.DB.prepare("UPDATE projects SET inactive_at = NULL, activated_at = ? WHERE id = ?").bind(now, projectId).run();
+  await auditProject(env, principal, projectId, { action: "project.activated", targetType: "project", targetId: projectId, data: { pausedAt: project.inactiveAt } }, request);
+  return response({ project: { id: projectId, inactiveAt: null, activatedAt: now }, activated: true });
+}
+
+registerRoutes(async ({ request, env, principal, url }) => {
+  if (request.method !== "POST") return null;
+  const params = matchPath(url.pathname, "/api/projects/:projectId/activate");
+  if (!params) return null;
+  return activateProject(env, principal, params.projectId, request);
+});
+
+registerJob("daily", "inactive-projects", async (env, _ctx, now) => {
+  await pauseInactiveProjects(env, now);
+});
+