@join-pantheon/cli 0.20.0 → 0.21.1

package/dist/relay.js

@@ -13,6 +13,7 @@ import { emailSenderFromEnv } from "./email.js";
 import { Allowlist } from "./roster-file.js";
 import { StateStore } from "./store.js";
 import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
+import { fmtLimit, parseLimits, PLAN_NAME } from "./plans.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -144,6 +145,12 @@ export class Relay {
         this.adminAllow = (process.env.PANTHEON_ADMIN_ALLOW_IPS ?? "").split(",").map((x) => x.trim()).filter(Boolean);
         const wantStore = this.requireAccounts || this.adminToken !== null;
         this.accounts = opts.accounts ?? (wantStore ? new Accounts(join(this.dataDir, "accounts.db")) : null);
+        if (this.accounts) {
+            this.backfillSpaceOwners();
+            const closed = this.accounts.endAllOpenSessions();
+            if (closed)
+                this.log(`ended ${closed} session${closed === 1 ? "" : "s"} left open by the previous relay process`);
+        }
         this.email = opts.emailSender ?? emailSenderFromEnv(this.log);
         const envNum = (k) => {
             const v = process.env[k];
@@ -810,16 +817,109 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
                 return done(`unblocked ${id}`);
             }
             case "delete_space": {
-                if (body.confirm !== id)
-                    return this.json(res, 400, { error: "type the space name to confirm" });
+                if ((body.confirm ?? "").trim() !== id)
+                    return done(`not deleted: type the space name exactly ("${id}") to confirm`);
                 const existed = this.deleteSpace(id);
+                A.markSpaceDeleted(id);
                 A.audit({ event: "admin_space_deleted", space: id, ip });
                 this.log(`[admin] deleted space "${id}" from ${ip}`);
                 return done(existed ? `space "${id}" deleted — its members were disconnected` : `no space "${id}"`);
             }
+            case "set_plan": {
+                const target = A.accountById(id);
+                if (!target)
+                    return this.json(res, 404, { error: "no such account" });
+                const plan = (body.plan ?? "").trim();
+                if (!A.plans()[plan])
+                    return this.json(res, 400, { error: `no plan "${plan}"` });
+                A.setPlan(target.id, plan);
+                A.audit({ event: "admin_set_plan", target: target.username, detail: `${target.plan} → ${plan}`, ip });
+                this.log(`[admin] ${target.username}: plan ${target.plan} → ${plan} (${ip})`);
+                return done(`${target.username} is now on the ${plan} plan — in effect for their next space, invite or admit`);
+            }
+            case "set_limits": {
+                const target = A.accountById(id);
+                if (!target)
+                    return this.json(res, 404, { error: "no such account" });
+                const raw = (body.json ?? "").trim();
+                if (!A.setLimits(target.id, raw || null))
+                    return this.json(res, 400, { error: 'custom limits must look like {"spaces":3,"members":5,"wake":true}' });
+                A.audit({ event: "admin_set_limits", target: target.username, detail: raw || "(cleared)", ip });
+                return done(raw ? `${target.username} now has custom limits ${raw}` : `${target.username} is back on plain ${target.plan} limits`);
+            }
+            case "set_plan_limits": {
+                if (!PLAN_NAME.test(id))
+                    return this.json(res, 400, { error: "plan names are lowercase letters, digits, - and _" });
+                const lim = parseLimits({ spaces: body.spaces, members: body.members, wake: body.wake ?? "off" });
+                if (!lim)
+                    return this.json(res, 400, { error: "spaces must be 0 or more and members 1 or more" });
+                const plans = A.plans();
+                const prev = plans[id];
+                plans[id] = lim;
+                A.setPlans(plans);
+                A.audit({ event: "admin_set_plan_limits", target: id, detail: `${prev ? JSON.stringify(prev) : "(new plan)"} → ${JSON.stringify(lim)}`, ip });
+                return done(`${id} plan: ${fmtLimit(lim.spaces)} spaces · ${fmtLimit(lim.members)} people · unattended workers ${lim.wake ? "on" : "off"} — applies to the next create, invite or admit`);
+            }
+            case "delete_plan": {
+                if (id === "free")
+                    return this.json(res, 400, { error: "the free plan is every account's default and cannot be removed" });
+                const plans = A.plans();
+                if (!plans[id])
+                    return this.json(res, 404, { error: `no plan "${id}"` });
+                const onIt = A.planCounts()[id] ?? 0;
+                if (onIt)
+                    return this.json(res, 400, { error: `${onIt} account${onIt === 1 ? " is" : "s are"} on "${id}" — move them to another plan first` });
+                delete plans[id];
+                A.setPlans(plans);
+                A.audit({ event: "admin_delete_plan", target: id, ip });
+                return done(`plan "${id}" removed`);
+            }
             default: return this.json(res, 400, { error: `unknown action "${act}"` });
         }
     }
+    spaceOnDisk(name) {
+        return existsSync(join(this.dataDir, `${name.replace(/[^a-z0-9._-]/gi, "_")}.members.json`));
+    }
+    spacePlan(name) {
+        if (!this.accounts)
+            return null;
+        const owner = this.accounts.spaceOwner(name);
+        if (!owner)
+            return null;
+        return { name: owner.plan, limits: this.accounts.limitsFor(owner), owner };
+    }
+    planView(acct, sp) {
+        const fresh = this.accounts?.accountById(acct.id) ?? acct;
+        return { name: fresh.plan, limits: this.accounts.limitsFor(fresh), usage: { spaces: this.accounts.spacesOwned(fresh.id).length, members: sp.allow.admittedCount() } };
+    }
+    planRefusal(space, plan, target, msg, cid, fail, actor, ip) {
+        this.accounts?.audit({ event: "plan_limit", actor_account: actor ?? plan.owner.id, space: space.name, target, detail: `${plan.name}: ${msg.slice(0, 160)}`, ip });
+        this.log(`[${space.name}] ! PLAN_LIMIT (${target}, ${plan.name} plan)`);
+        fail("PLAN_LIMIT", msg, cid);
+    }
+    backfillSpaceOwners() {
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch {
+            return;
+        }
+        for (const f of files) {
+            if (!f.endsWith(".members.json"))
+                continue;
+            const name = f.slice(0, -".members.json".length);
+            if (this.accounts.hasSpaceRecord(name))
+                continue;
+            try {
+                const founder = new Allowlist(this.dataDir, name).founder();
+                const owner = founder ? this.accounts.accountByUsername(founder) : null;
+                this.accounts.recordSpace(name, owner?.id ?? null);
+                this.log(`[${name}] owner recorded: ${owner ? owner.username : "unknown (no plan limits apply)"}`);
+            }
+            catch { }
+        }
+    }
     adminDashboard(res, A, url) {
         const c = A.counts();
         const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (m) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[m]));
@@ -829,7 +929,8 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
         const kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(1)} KB` : `${(n / 1048576).toFixed(1)} MB`;
         const accounts = A.allAccounts();
         const devices = A.allDevices();
-        const sessions = A.allSessions(200);
+        const sessions = A.liveSessions(200);
+        const endedToday = A.endedSessionsSince(Date.now() - DAY);
         const audit = A.auditLog({ limit: 300 });
         const blocks = A.allBlocks();
         const verifs = A.recentVerifications(50);
@@ -838,6 +939,13 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
         const dayAgo = Date.now() - DAY;
         const refused24 = spaces.reduce((n, x) => n + refusalsSince(x.refusals, dayAgo), 0);
         const refusedAll = spaces.reduce((n, x) => n + (x.refusals?.total ?? 0), 0);
+        const plans = A.plans();
+        const planCounts = A.planCounts();
+        const owners = A.spaceOwners();
+        const ownedCounts = A.ownedCounts();
+        const limitHits = A.planLimitHits();
+        const acctById = new Map(accounts.map((a) => [a.id, a]));
+        const planOptions = (sel) => Object.keys(plans).map((n) => `<option value="${esc(n)}"${n === sel ? " selected" : ""}>${esc(n)}</option>`).join("");
         const devByAcct = new Map();
         for (const d of devices)
             devByAcct.set(d.account_id, (devByAcct.get(d.account_id) ?? 0) + 1);
@@ -866,7 +974,8 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
 <div class=stats>
   <div class=stat><b>${c.accounts}</b><span>accounts</span></div>
   <div class=stat><b>${c.devices}</b><span>devices</span></div>
-  <div class=stat><b>${sessions.filter((s) => !s.revoked_at && Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>sessions active / open</span></div>
+  <div class=stat><b>${Object.entries(planCounts).filter(([n]) => n !== "free").reduce((s, [, v]) => s + v, 0)}<span class=dim style="font-size:14px"> / ${c.accounts}</span></b><span>paid plans / accounts</span></div>
+  <div class=stat><b>${sessions.filter((s) => Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>connections heartbeating / open</span></div>
   <div class=stat><b>${spaces.filter((s) => s.live).length}<span class=dim style="font-size:14px"> / ${spaces.length}</span></b><span>spaces live / total · cap ${this.limits.maxSpaces}</span></div>
   <div class="stat ${emailsHour > emailCap * 0.8 ? "warn" : ""}"><b>${emailsHour}<span class=dim style="font-size:14px"> / ${emailCap}</span></b><span>emails this hour</span></div>
   <div class=stat><b>${snapshots.length}</b><span>snapshots · latest ${snapshots.length ? esc(snapshots[snapshots.length - 1].replace(/^accounts-|\\.db$/g, "").replace(/T/, " ").slice(0, 16)) : "—"}</span></div>
@@ -888,24 +997,32 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   <p class=note>Messages are acts delegates sent; JOIN/LEAVE presence is not counted. Retained is what each space's ledger still holds — the most recent ${LIMITS.ledgerKeepRecent.toLocaleString()} acts plus everything in an open goal. Refused is what the relay handed back: wrong turn, missing reference, foreign repo, rate limit. Click a space for its conversation.</p>
 
   <h2>Spaces <input placeholder="filter" data-filter="t-spaces"></h2><div class=wrap><table id=t-spaces>
-    <tr><th>space</th><th>state</th><th>members</th><th>online</th><th>acts</th><th>msgs today</th><th>delegates today</th><th>objections</th><th>refused</th><th>goals</th><th>owed</th><th>last activity</th><th>on disk</th><th></th></tr>
-    ${rows(spaces.map((s) => `<tr><td><a href="/admin/space?name=${encodeURIComponent(s.name)}" title="members, refusals and the conversation"><code>${esc(s.name)}</code></a></td><td><span class="pill ${s.live ? "ok" : ""}">${s.live ? "live" : "sleeping"}</span></td><td>${s.members}</td><td>${s.online}</td><td>${s.acts}</td><td>${s.activity.messages_24h}</td><td>${s.activity.senders_24h.length}</td><td>${s.activity.by_act_24h.OBJECT ?? 0}<span class=dim> / ${s.activity.by_act.OBJECT ?? 0}</span></td><td>${refusalsSince(s.refusals, dayAgo)}<span class=dim> / ${s.refusals?.total ?? 0}</span></td><td>${s.open_goals} open / ${s.goals}</td><td>${s.live ? s.obligations : "<span class=dim>—</span>"}</td><td class=dim title="${when(s.last)}">${ago(s.last)}</td><td class=dim>${kb(s.bytes)}</td><td>${form("delete_space", s.name, "delete", `<input type=hidden name=confirm value="">`, "danger")}</td></tr>`))}
-    ${spaces.length ? "" : "<tr><td colspan=14 class=dim>no spaces yet</td></tr>"}
+    <tr><th>space</th><th>state</th><th>owner</th><th>members</th><th>online</th><th>acts</th><th>msgs today</th><th>delegates today</th><th>objections</th><th>refused</th><th>goals</th><th>owed</th><th>last activity</th><th>on disk</th><th></th></tr>
+    ${rows(spaces.map((s) => `<tr><td><a href="/admin/space?name=${encodeURIComponent(s.name)}" title="members, refusals and the conversation"><code>${esc(s.name)}</code></a></td><td><span class="pill ${s.live ? "ok" : ""}">${s.live ? "live" : "sleeping"}</span></td><td>${(() => { const o = owners.get(s.name) ? acctById.get(owners.get(s.name)) : undefined; return o ? `<code>${esc(o.username)}</code> <span class=pill data-plan="${esc(o.plan)}">${esc(o.plan)}</span>` : "<span class=dim title=\"no owner on record — no plan limits apply\">—</span>"; })()}</td><td>${s.members}</td><td>${s.online}</td><td>${s.acts}</td><td>${s.activity.messages_24h}</td><td>${s.activity.senders_24h.length}</td><td>${s.activity.by_act_24h.OBJECT ?? 0}<span class=dim> / ${s.activity.by_act.OBJECT ?? 0}</span></td><td>${refusalsSince(s.refusals, dayAgo)}<span class=dim> / ${s.refusals?.total ?? 0}</span></td><td>${s.open_goals} open / ${s.goals}</td><td>${s.live ? s.obligations : "<span class=dim>—</span>"}</td><td class=dim title="${when(s.last)}">${ago(s.last)}</td><td class=dim>${kb(s.bytes)}</td><td>${form("delete_space", s.name, "delete", `<input type=hidden name=confirm value="">`, "danger")}</td></tr>`))}
+    ${spaces.length ? "" : "<tr><td colspan=15 class=dim>no spaces yet</td></tr>"}
   </table></div>
   <p class=note>Sleeping spaces are on disk but idle; they reload on the next connect. Delete is irreversible and disconnects every member of that space.</p>
 
   <h2>Accounts <input placeholder="filter" data-filter="t-accounts"></h2><div class=wrap><table id=t-accounts>
-    <tr><th>username</th><th>email</th><th>status</th><th>devices</th><th>created</th><th></th></tr>
-    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class="pill ${a.status === "suspended" ? "bad" : ""}">${esc(a.status)}</span></td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td><td>${a.status === "suspended" ? form("reinstate", a.id, "reinstate") : form("suspend", a.id, "suspend", "", "danger")} ${form("block", a.email, "block email", "", "danger")}</td></tr>`))}
-    ${accounts.length ? "" : "<tr><td colspan=6 class=dim>no accounts yet</td></tr>"}
+    <tr><th>username</th><th>email</th><th>status</th><th>plan</th><th>spaces</th><th>limit hits</th><th>devices</th><th>created</th><th></th></tr>
+    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class="pill ${a.status === "suspended" ? "bad" : ""}">${esc(a.status)}</span></td><td><span class="pill ${a.plan === "free" ? "" : "ok"}" data-plan="${esc(a.plan)}">${esc(a.plan)}</span>${a.limits_json ? ' <span class="pill warn" title="custom limits">custom</span>' : ""} <form method=POST action="/admin/action" class=inl onsubmit="return confirmAct(this)"><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan><input type=hidden name=id value="${esc(a.id)}"><select name=plan class=act style="margin-left:4px">${planOptions(a.plan)}</select><button class=act>set</button></form><details class=inl style="margin-left:6px"><summary class="act dim" style="display:inline;list-style:none;cursor:pointer">custom…</summary><form method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_limits><input type=hidden name=id value="${esc(a.id)}"><input name=json placeholder='{"spaces":3,"members":5,"wake":true}' value="${esc(a.limits_json ?? "")}" size=34 style="font:12px ui-monospace,monospace;padding:3px 6px;border:1px solid var(--line);border-radius:6px;background:var(--card);color:var(--fg)"><button class=act>save</button></form></details></td><td>${ownedCounts.get(a.id) ?? 0}<span class=dim> / ${fmtLimit(A.limitsFor(a).spaces)}</span></td><td>${limitHits.get(a.id) ? `<span class="pill warn">${limitHits.get(a.id)}</span>` : "<span class=dim>0</span>"}</td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td><td>${a.status === "suspended" ? form("reinstate", a.id, "reinstate") : form("suspend", a.id, "suspend", "", "danger")} ${form("block", a.email, "block email", "", "danger")}</td></tr>`))}
+    ${accounts.length ? "" : "<tr><td colspan=9 class=dim>no accounts yet</td></tr>"}
   </table></div>
-  <p class=note>Suspending signs the account out everywhere and refuses its handshakes until reinstated. Its messages stay in the ledgers.</p>
+  <p class=note>Suspending signs the account out everywhere and refuses its handshakes until reinstated. Its messages stay in the ledgers. A plan change takes effect at the account's next space, invite or admit; nothing they already have is removed. "Limit hits" counts the times the relay refused them for a plan limit — the people to talk to about upgrading.</p>
+
+  <h2>Plans <span class=dim>(limits the relay enforces; the owner's plan governs a space)</span></h2><div class=wrap><table id=t-plans>
+    <tr><th>plan</th><th>accounts</th><th>spaces created</th><th>people per space</th><th>unattended workers</th><th></th></tr>
+    ${rows(Object.entries(plans).map(([n, l]) => { const fid = `plan-${esc(n)}`; return `<tr><td><form id="${fid}" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits><input type=hidden name=id value="${esc(n)}"></form><code>${esc(n)}</code></td><td>${planCounts[n] ?? 0}</td><td><input form="${fid}" name=spaces type=number min=0 value="${l.spaces}" class=act style="width:90px"></td><td><input form="${fid}" name=members type=number min=1 value="${l.members}" class=act style="width:90px"></td><td><label><input form="${fid}" type=checkbox name=wake value=on${l.wake ? " checked" : ""}> allowed</label></td><td><button form="${fid}" class=act>save</button> ${n === "free" ? "" : form("delete_plan", n, "remove", "", "danger")}</td></tr>`; }))}
+    <tr><td><form id="plan-new" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits></form><input form="plan-new" name=id placeholder="new plan name" pattern="[a-z][a-z0-9_-]{0,23}" required class=act style="width:130px"></td><td class=dim>—</td><td><input form="plan-new" name=spaces type=number min=0 value=3 class=act style="width:90px"></td><td><input form="plan-new" name=members type=number min=1 value=5 class=act style="width:90px"></td><td><label><input form="plan-new" type=checkbox name=wake value=on checked> allowed</label></td><td><button form="plan-new" class=act>add plan</button></td></tr>
+  </table></div>
+  <p class=note>Edits apply immediately to the next create, invite or admit of every account on that plan. Unused invites count toward "people per space" so nobody mints five at once. Personas are files on the user's machine and cannot be limited here. Every change is audited.</p>
 
   <h2>Live sessions <input placeholder="filter" data-filter="t-sessions"></h2><div class=wrap><table id=t-sessions>
-    <tr><th>session</th><th>account</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
-    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
-    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=7 class=dim>no live sessions</td></tr>"}
+    <tr><th>session</th><th>account</th><th>device</th><th>role</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
+    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td class=dim>${esc(devices.find((d) => d.id === s.device_id)?.label ?? s.device_id.slice(0, 10))}</td><td>${s.role ? `<span class=pill>${esc(s.role)}</span>` : "<span class=dim>—</span>"}</td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
+    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=9 class=dim>no open connections right now</td></tr>"}
   </table></div>
+  <p class=note>One row per open connection — an agent window, a worker, or a CLI command while it runs. Rows leave when the socket closes; ${endedToday} connection${endedToday === 1 ? "" : "s"} came and went in the last 24 hours. "Stale" means no heartbeat for 15 minutes on a socket that has not closed, usually a machine that went to sleep.</p>
 
   <h2>Blocked emails and domains</h2><div class=wrap><table id=t-blocks>
     <tr><th>pattern</th><th>kind</th><th>since</th><th></th></tr>
@@ -936,6 +1053,8 @@ ${done ? `<div class=done>${esc(done)}</div>` : ""}
   });
   function confirmAct(f) {
     var a = f.querySelector("[name=action]").value, id = f.querySelector("[name=id]").value;
+    if (a === "set_plan") return confirm("Move " + f.closest("tr").querySelector("code").textContent + " to the " + f.querySelector("[name=plan]").value + " plan? Takes effect on their next space, invite or admit.");
+    if (a === "delete_plan") return confirm('Remove the plan "' + id + '"?');
     if (a === "delete_space") { var typed = prompt("Delete space \\"" + id + "\\" and disconnect its members? Type the name to confirm."); if (typed !== id) return false; f.querySelector("[name=confirm]").value = typed; return true; }
     if (a === "suspend" || a === "revoke_session" || a === "revoke_device" || a === "block") return confirm(a.replace("_", " ") + " " + id + "?");
     return true;
@@ -1136,12 +1255,21 @@ pantheon signup --email you@work.com --username you</code></pre>
     onSocket(ws, ip = "unknown") {
         let space = null;
         let me = null;
+        let acct = null;
+        let dbSession = null;
+        let lastTouch = 0;
+        const touch = () => {
+            if (dbSession && Date.now() - lastTouch > 60_000) {
+                lastTouch = Date.now();
+                this.accounts?.touchSession(dbSession);
+            }
+        };
         let sessionId = "";
         let role = "interactive";
         let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
-        ws.on("pong", () => { alive = true; });
+        ws.on("pong", () => { alive = true; touch(); });
         const probe = ws;
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
@@ -1189,6 +1317,7 @@ pantheon signup --email you@work.com --username you</code></pre>
             }
             const m = parsed.data;
             lastMsg = m.t === "act" ? m.act : m.t;
+            touch();
             if (m.t === "ping")
                 return this.send(ws, { t: "pong" });
             if (m.t === "hello") {
@@ -1201,6 +1330,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
                     return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
                 }
+                const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
+                const pre = gated ? this.accounts.authorize(m.pubkey, m.member) : null;
                 let sp;
                 if (m.enroll) {
                     sp = this.spaces.get(m.space) ?? null;
@@ -1212,16 +1343,33 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (tomb && Date.now() - tomb < 3_600_000) {
                         return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
                     }
+                    const isNew = !this.spaces.has(m.space) && !this.spaceOnDisk(m.space);
                     if (!this.spaces.has(m.space)) {
                         const denied = this.mayCreateSpace(ip);
                         if (denied)
                             return reject(denied.code, denied.message);
                     }
+                    if (isNew && gated && !pre?.ok) {
+                        this.log(`! REFUSED ${m.member}: cannot create "${m.space}" without a signed-in account (${pre?.ok === false ? pre.reason : "no account"})`);
+                        return reject("NOT_SIGNED_IN", "sign in first: run `pantheon signup` (new) or `pantheon login` (existing account) on this machine, then try again.");
+                    }
+                    if (isNew && pre?.ok) {
+                        const lim = this.accounts.limitsFor(pre.account);
+                        const owned = this.accounts.spacesOwned(pre.account.id);
+                        if (owned.length >= lim.spaces) {
+                            const msg = `your ${pre.account.plan} plan allows ${fmtLimit(lim.spaces)} space${lim.spaces === 1 ? "" : "s"} you create${owned.length ? ` (you own ${owned.map((n) => `"${n}"`).join(", ")})` : ""}. Upgrade at https://www.joinpantheon.network, or free a slot: pantheon space delete <team> --yes`;
+                            this.accounts.audit({ event: "plan_limit", actor_account: pre.account.id, space: m.space, target: "create_space", detail: `${pre.account.plan}: ${owned.length}/${lim.spaces} spaces`, ip });
+                            this.log(`! PLAN_LIMIT ${m.member}: cannot create "${m.space}" (${owned.length}/${fmtLimit(lim.spaces)} spaces on ${pre.account.plan})`);
+                            return reject("PLAN_LIMIT", msg);
+                        }
+                    }
                     sp = this.getOrCreateSpace(m.space, m.token);
                     if (!sp)
                         return reject("BAD_TOKEN", "wrong token for this space");
-                    if (sp.createdAt >= Date.now() - 1_000)
+                    if (isNew) {
                         this.noteSpaceCreate(ip);
+                        this.accounts?.recordSpace(sp.name, pre?.ok ? pre.account.id : null);
+                    }
                 }
                 let acctSession = null;
                 if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
@@ -1236,10 +1384,18 @@ pantheon signup --email you@work.com --username you</code></pre>
                         return reject("NOT_SIGNED_IN", msg);
                     }
                     m.member = auth.account.username;
-                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip).id;
+                    acct = auth.account;
+                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip, m.role ?? "interactive").id;
+                    dbSession = acctSession;
+                    lastTouch = Date.now();
                 }
                 let enrolled = null;
                 if (m.enroll) {
+                    const plan = this.spacePlan(sp.name);
+                    if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
+                        this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
+                        return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network`);
+                    }
                     const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
                     if (!r.ok) {
                         this.log(`[${sp.name}] ! invite refused for ${m.member}: ${r.why}`);
@@ -1294,6 +1450,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     roster: this.roster(sp), goals: [...sp.goals.values()],
                     obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
                     space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
+                    ...(acct ? { plan: this.planView(acct, sp) } : {}),
                     ...(enrolled ? { token: enrolled } : {}),
                 });
                 for (const r of sp.ledger.since(m.from_seq ?? sp.ledger.head)) {
@@ -1337,6 +1494,13 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const target = space.allow.get(m.member);
                 if (!target)
                     return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
+                if (!m.revoke && !m.forget) {
+                    const plan = this.spacePlan(space.name);
+                    if (plan && m.may_wake && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "admit", `the ${plan.name} plan does not include unattended workers — admit without --may-wake`, m.cid, fail, acct?.id ?? null, ip);
+                    if (plan && !target.admitted && space.allow.admittedCount() >= plan.limits.members)
+                        return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade at https://www.joinpantheon.network to admit more.`, m.cid, fail, acct?.id ?? null, ip);
+                }
                 if (m.revoke || m.forget) {
                     if (m.forget)
                         space.allow.forget(m.member);
@@ -1360,10 +1524,40 @@ pantheon signup --email you@work.com --username you</code></pre>
                 this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.member, seq: space.ledger.head });
                 return;
             }
+            if (m.t === "worker_state") {
+                if (role !== "worker")
+                    return;
+                me.worker = { state: m.state, ...(m.detail ? { detail: m.detail } : {}), ...(m.until ? { until: m.until } : {}), at: Date.now() };
+                this.broadcast(space, { t: "roster", roster: this.roster(space) });
+                return;
+            }
+            if (m.t === "delete_space") {
+                if (m.confirm !== space.name)
+                    return fail("CONFIRM_MISMATCH", `type the space name ("${space.name}") to confirm`, m.cid);
+                const owner = this.accounts?.spaceOwner(space.name) ?? null;
+                const isOwner = owner ? owner.id === acct?.id : space.allow.founder() === me.id;
+                if (!isOwner)
+                    return fail("NOT_OWNER", `only the founder of "${space.name}" can delete it${owner ? ` (that is ${owner.username})` : ""}`, m.cid);
+                const name = space.name;
+                this.accounts?.audit({ event: "space_deleted", actor_account: acct?.id ?? null, space: name, detail: `by its founder ${me.id}`, ip });
+                this.log(`[${name}] * DELETED by its founder ${me.id}`);
+                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: name, seq: space.ledger.head });
+                setTimeout(() => { this.deleteSpace(name); this.accounts?.markSpaceDeleted(name); }, 50).unref?.();
+                return;
+            }
             if (m.t === "invite") {
                 const self = space.allow.get(me.id);
                 if (!self?.admitted)
                     return fail("NOT_ADMITTED", "only an admitted member can invite", m.cid);
+                const plan = this.spacePlan(space.name);
+                if (plan) {
+                    if (m.may_wake && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "invite", `the ${plan.name} plan does not include unattended workers — invite without wake: pantheon invite --no-wake`, m.cid, fail, acct?.id ?? null, ip);
+                    const open = space.allow.openInvites().length;
+                    if (space.allow.admittedCount() + open >= plan.limits.members) {
+                        return this.planRefusal(space, plan, "invite", `"${space.name}" is full for the ${plan.name} plan: ${fmtLimit(plan.limits.members)} people${open ? `, counting ${open} unused invite${open === 1 ? "" : "s"}` : ""}. Upgrade at https://www.joinpantheon.network to invite more.`, m.cid, fail, acct?.id ?? null, ip);
+                    }
+                }
                 const token = randomBytes(18).toString("base64url");
                 const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token);
                 this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
@@ -1374,9 +1568,13 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const self = space.allow.get(me.id);
                 if (!self?.admitted)
                     return fail("NOT_ADMITTED", "only an admitted member can register a repo", m.cid);
-                const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id);
+                const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
+                if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
+                    this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
+                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                }
                 if (added) {
-                    this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}`);
+                    this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
                     this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
                     this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
                 }
@@ -1384,6 +1582,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return;
             }
             if (m.t === "claim") {
+                if (role === "worker") {
+                    const plan = this.spacePlan(space.name);
+                    if (plan && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "wake", `unattended workers are not included in this space's ${plan.name} plan`, m.cid, fail, acct?.id ?? null, ip);
+                }
                 if (m.obligation.startsWith("cont:")) {
                     const act = space.ledger.find(m.obligation.slice(5));
                     if (!act)
@@ -1484,7 +1687,11 @@ pantheon signup --email you@work.com --username you</code></pre>
             if (m.after_seq !== undefined) {
                 const mine = me.id;
                 const missed = space.ledger.since(m.after_seq)
-                    .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE");
+                    .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE")
+                    .filter((r) => (m.goal ? r.goal === m.goal : !r.goal)
+                    || (r.to?.includes(mine) ?? false)
+                    || (m.to?.includes(r.from) ?? false)
+                    || (!!m.ref && r.ref === m.ref));
                 if (missed.length) {
                     return fail("STALE_VIEW", `${missed.length} act(s) arrived while you were composing — read them before you answer:\n` +
                         missed.slice(0, 8).map((r) => `  [${r.seq}] ${r.act} from ${r.from}: ${first(r.body)}`).join("\n") +
@@ -1512,6 +1719,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
         });
         ws.on("close", () => {
+            if (dbSession) {
+                this.accounts?.endSession(dbSession);
+                dbSession = null;
+            }
             if (!space || !me)
                 return;
             me.sessions.delete(sessionId);
@@ -1592,19 +1803,22 @@ pantheon signup --email you@work.com --username you</code></pre>
                     message: "HUMAN_REQUIRED must name decision_domains so the relay can verify the human owner. Call pantheon_route_decision first." };
             }
             const target = sp.profiles.get(to[0]);
-            if (!target) {
-                return { code: "NO_AUTHORITY_PROFILE",
-                    message: `${to[0]} has not published an organization profile, so their decision authority cannot be verified.` };
-            }
             const route = routeDecision(sp.profiles.values(), { domains });
             if (route.conflicts.length) {
                 return { code: "AMBIGUOUS_DECISION_AUTHORITY",
                     message: `authority conflicts for ${route.conflicts.map((c) => `${c.domain} (${c.reason}: ${c.members.join(", ")})`).join("; ")}. Fix the profiles or ESCALATE instead of guessing.` };
             }
-            const owner = route.required_humans.find((x) => x.member === to[0]);
-            if (!owner || domains.some((d) => !owner.domains.includes(d)) || route.unmatched_domains.length) {
+            const others = route.required_humans.filter((h) => h.member !== to[0] && h.domains.some((d) => domains.includes(d)));
+            if (others.length) {
+                const theirs = [...new Set(others.flatMap((h) => h.domains.filter((d) => domains.includes(d))))];
                 return { code: "WRONG_DECISION_OWNER",
-                    message: `${to[0]} is not the human-required owner for: ${domains.join(", ")}. Call pantheon_route_decision and route each domain to its published owner.` };
+                    message: `${to[0]} is not the human-required owner for: ${theirs.join(", ")} — ${others.map((h) => h.member).join(", ")} ${others.length === 1 ? "is" : "are"}. Call pantheon_route_decision and route each domain to its published owner.` };
+            }
+            const owner = route.required_humans.find((x) => x.member === to[0]);
+            const uncovered = domains.filter((d) => !owner?.domains.includes(d));
+            if (uncovered.length && meta) {
+                meta["authority"] = target ? "partly_unverified" : "unverified";
+                meta["unverified_domains"] = uncovered;
             }
             const openDup = [...sp.obligations.values()].find((o) => {
                 if (o.kind !== "HUMAN" || o.owner !== `human:${to[0]}` || (o.goal ?? null) !== (goalId ?? null))
@@ -1735,8 +1949,11 @@ pantheon signup --email you@work.com --username you</code></pre>
         const rec = sp.ledger.append({ ...partial, id: newId("a"), ts: Date.now(), space: sp.name });
         sp.lastTouch = rec.ts;
         const m = sp.members.get(rec.from);
-        if (m)
+        if (m) {
             m.stamps.push(rec.ts);
+            if (rec.act !== "JOIN" && rec.act !== "LEAVE" && (m.seen_seq ?? 0) < rec.seq - 1)
+                m.seen_seq = rec.seq - 1;
+        }
         if (rec.goal) {
             const goal = sp.goals.get(rec.goal);
             if (goal) {
@@ -1744,6 +1961,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const run = sp.lastActor.get(rec.goal);
                 sp.lastActor.set(rec.goal, run && run.member === rec.from ? { member: rec.from, run: run.run + 1 } : { member: rec.from, run: 1 });
                 this.applyObligations(sp, rec, goal);
+                this.broadcast(sp, { t: "goal", goal });
                 if (goal.acts >= goal.budget && goal.state === "OPEN") {
                     goal.state = "STALLED";
                     this.oblige(sp, { kind: "HUMAN", owner: `human:${goal.opened_by}`, ref: rec.id, goal: goal.id,
@@ -2033,6 +2251,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 id: s.id, role: s.role, agent: s.agent, ...(s.pkg ? { pkg: s.pkg } : {}),
             })),
             ...(this.work(m) ? { work: this.work(m) } : {}),
+            ...(m.worker && Date.now() - m.worker.at < 15 * 60_000 ? { worker: m.worker } : {}),
             delivered_seq: m.delivered_seq,
             ...(m.seen_seq !== undefined ? { seen_seq: m.seen_seq } : {}),
         }));

package/dist/roster-file.js

@@ -51,10 +51,18 @@ export class Allowlist {
     repoList() { return [...this.repos.values()]; }
     repoCount() { return this.repos.size; }
     hasRepo(fingerprint) { return this.repos.has(fingerprint); }
-    addRepo(fingerprint, origin, by) {
+    addRepo(fingerprint, origin, by, base = null) {
         if (this.repos.has(fingerprint))
             return false;
-        this.repos.set(fingerprint, { fingerprint, origin, added_by: by, at: Date.now() });
+        this.repos.set(fingerprint, { fingerprint, origin, added_by: by, at: Date.now(), ...(base ? { base } : {}) });
+        this.flush();
+        return true;
+    }
+    setRepoBase(fingerprint, base) {
+        const r = this.repos.get(fingerprint);
+        if (!r || r.base === base)
+            return false;
+        this.repos.set(fingerprint, { ...r, base });
         this.flush();
         return true;
     }
@@ -119,6 +127,11 @@ export class Allowlist {
     openInvites() {
         return [...this.invites.values()].filter((i) => !i.used_by && Date.now() < i.expires_at);
     }
+    admittedCount() { return [...this.entries.values()].filter((e) => e.admitted).length; }
+    founder() {
+        const f = [...this.entries.values()].filter((e) => e.admitted && (e.admitted_by === e.member || e.admitted_by === undefined)).sort((a, b) => a.first_seen - b.first_seen)[0];
+        return f?.member ?? null;
+    }
     get(member) {
         return this.entries.get(member);
     }

package/dist/service.js

@@ -138,6 +138,20 @@ export function uninstallService(kind) {
     }
     return out;
 }
+export function restartService(kind, exec = (c, a) => execFileSync(c, a, { stdio: "ignore" })) {
+    if (!serviceInstalled(kind))
+        return [`  ${kind}: not installed here`];
+    try {
+        if (platform() === "darwin")
+            exec("launchctl", ["kickstart", "-k", `gui/${process.getuid?.() ?? 501}/${LABEL(kind)}`]);
+        else
+            exec("systemctl", ["--user", "restart", `pantheon-${kind}`]);
+        return [`  ${kind}: restarted on the new code`];
+    }
+    catch (e) {
+        return [`  ${kind}: could not restart (${e.message.split("\n")[0]}) — pantheon service restart ${kind}`];
+    }
+}
 export function serviceInstalled(kind) {
     try {
         return existsSync(platform() === "darwin" ? plistPath(kind) : unitPath(kind));