@luckydraw/cumulus 0.31.66 → 1.0.0

package/dist/gateway/namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../../src/gateway/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,eAAe,EAAE,GAC5B,MAAM,GAAG,SAAS,CAWpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,GAAG,SAAS,CAM9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,UAAU,EAAE,eAAe,EAAE,GAC5B,OAAO,CAGT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,UAAU,EAAE,eAAe,EAAE,GAC5B,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAExE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,eAAe,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,SAAS,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,eAAe,EAAE,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAchC"}
+{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../../src/gateway/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,eAAe,EAAE,GAC5B,MAAM,GAAG,SAAS,CAWpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,GAAG,SAAS,CAM9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,UAAU,EAAE,eAAe,EAAE,GAC5B,OAAO,CAGT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,UAAU,EAAE,eAAe,EAAE,GAC5B,OAAO,CAGT;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,MAAM,EACV,mBAAmB,EAAE,MAAM,EAAE,EAC7B,UAAU,EAAE,eAAe,EAAE,GAC5B,MAAM,CAER;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,eAAe,EAAE,EAC7B,mBAAmB,EAAE,MAAM,EAAE,EAC7B,MAAM,EAAE,aAAa,EACrB,GAAG,GAAE,MAAgC,GACpC,aAAa,GAAG,SAAS,CAS3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,eAAe,EAAE,EAC7B,mBAAmB,EAAE,MAAM,EAAE,EAC7B,GAAG,GAAE,MAAgC,GACpC,MAAM,EAAE,CAkBV;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAExE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,eAAe,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,SAAS,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,eAAe,EAAE,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAchC"}

package/dist/gateway/namespaces.js

@@ -22,6 +22,7 @@
  * everything but lists only non-namespaced threads (P2 keeps the owner's list
  * clean).
  */
+import { DEMO_VISITOR_THREAD_CAP, LICENSE_CONTACT, describeLicenseFailure, namespaceLicensed, } from '../lib/license.js';
 /**
  * Does `threadName` belong to namespace `ns`? True only for `${ns}-` prefixed
  * children — so `pursuit` covers `pursuit-abc` but NOT bare `pursuit`, and not
@@ -101,6 +102,63 @@ export function threadAccessibleToScope(threadName, scopeNs, namespaces) {
         return true;
     return namespaceForThread(threadName, namespaces) === scopeNs;
 }
+/** Existing threads belonging to `ns` (longest-match, so `x-v-1` counts under `x-v`). */
+export function countNamespaceThreads(ns, existingThreadNames, namespaces) {
+    return existingThreadNames.filter(t => namespaceForThread(t, namespaces) === ns).length;
+}
+/**
+ * Demo-mode capacity check (task 127). Returns a denial when a request would
+ * MINT a new thread in an unlicensed namespace that is already at the cap, or
+ * undefined when the request may proceed.
+ *
+ * Three deliberate exemptions, in the order they are checked:
+ *  1. **Non-namespaced threads are never gated.** Personal threads, the CLI, the
+ *     TUI — the gate exists only where the sold capability lives.
+ *  2. **Threads that already exist always keep working.** The cap gates minting,
+ *     never reads or replies, so an evaluator who reaches it loses no data.
+ *  3. **Licensed namespaces are uncapped.**
+ *
+ * Pure: the caller supplies the thread inventory, so this is testable without a
+ * filesystem and callable from both the REST and WS gates.
+ */
+export function demoMintDenial(threadName, namespaces, existingThreadNames, status, cap = DEMO_VISITOR_THREAD_CAP) {
+    const ns = namespaceForThread(threadName, namespaces);
+    if (!ns)
+        return undefined;
+    if (existingThreadNames.includes(threadName))
+        return undefined;
+    if (namespaceLicensed(status, ns))
+        return undefined;
+    const count = countNamespaceThreads(ns, existingThreadNames, namespaces);
+    if (count < cap)
+        return undefined;
+    return { namespace: ns, count, cap };
+}
+/**
+ * The startup / periodic licence banner (task 127), as lines. Pure so the
+ * wording is asserted in tests rather than eyeballed in a log.
+ *
+ * A licensed gateway gets exactly one confirmation line and nothing further. An
+ * unlicensed one gets one line per configured namespace naming its occupancy,
+ * plus the reason and the contact address — so an operator who is about to hit
+ * the cap sees it coming rather than discovering it as a 402.
+ */
+export function licenseBannerLines(status, namespaces, existingThreadNames, cap = DEMO_VISITOR_THREAD_CAP) {
+    if (status.licensed) {
+        const scope = status.namespaces === null ? 'all namespaces' : status.namespaces.join(', ');
+        return [`[License] Licensed to ${status.licensee} (major ${status.major}, ${scope}).`];
+    }
+    const lines = [
+        `[License] UNLICENSED (${describeLicenseFailure(status.reason)}) — running in demo mode.`,
+    ];
+    for (const ns of namespaces) {
+        const count = countNamespaceThreads(ns.name, existingThreadNames, namespaces);
+        lines.push(`[License]   namespace "${ns.name}": ${count}/${cap} visitor threads` +
+            (count >= cap ? ' — AT CAP, new threads are refused (402).' : '.'));
+    }
+    lines.push(`[License]   Commercial and production use requires a licence: ${LICENSE_CONTACT}`);
+    return lines;
+}
 /**
  * Every API key scoped to any namespace, for folding into the gateway's set of
  * valid authentication keys (a scoped key must still authenticate).

package/dist/gateway/namespaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../../src/gateway/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,EAAU;IAC9D,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,UAA6B;IAE7B,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IACE,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC;YACtC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EACpD,CAAC;YACD,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,UAA6B;IACxE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,OAA2B,EAC3B,UAA6B;IAE7B,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkB,EAClB,OAA2B,EAC3B,UAA6B;IAE7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,OAAO,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA6B;IAC5D,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,UAA6B;IAE7B,MAAM,EAAE,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,eAAe,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,IAAiD,CAAC;IACtD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,aAAa,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACtC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}
+{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../../src/gateway/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,EAAU;IAC9D,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,UAA6B;IAE7B,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IACE,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC;YACtC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EACpD,CAAC;YACD,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,UAA6B;IACxE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,OAA2B,EAC3B,UAA6B;IAE7B,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkB,EAClB,OAA2B,EAC3B,UAA6B;IAE7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,OAAO,CAAC;AAChE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,EAAU,EACV,mBAA6B,EAC7B,UAA6B;IAE7B,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;AAC1F,CAAC;AAQD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,UAA6B,EAC7B,mBAA6B,EAC7B,MAAqB,EACrB,MAAc,uBAAuB;IAErC,MAAM,EAAE,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,IAAI,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAqB,EACrB,UAA6B,EAC7B,mBAA6B,EAC7B,MAAc,uBAAuB;IAErC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,yBAAyB,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,yBAAyB,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B;KAC1F,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,CACR,0BAA0B,EAAE,CAAC,IAAI,MAAM,KAAK,IAAI,GAAG,kBAAkB;YACnE,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,GAAG,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iEAAiE,eAAe,EAAE,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA6B;IAC5D,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,UAA6B;IAE7B,MAAM,EAAE,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,eAAe,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,IAAiD,CAAC;IACtD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,aAAa,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACtC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}

package/dist/gateway/server.d.ts

@@ -16,6 +16,7 @@
  */
 import { type GatewayAgentsConfig } from '../lib/gateway.js';
 import type { HooksConfig, NamespaceConfig, AppliedConfig } from './config.js';
+import { type DemoCapDenial } from './namespaces.js';
 import { type VapidConfig } from './push.js';
 export interface GatewayServerOptions {
     basePath?: string;
@@ -56,6 +57,9 @@ export interface GatewayServerOptions {
     bridge?: import('./config.js').BridgeConfig;
     /** Thread namespaces — prefix-scoped list visibility for app/test threads (task 097 P2). */
     namespaces?: NamespaceConfig[];
+    /** Lucky Draw licence key (task 127). Absent = demo mode: namespaces capped at
+     * DEMO_VISITOR_THREAD_CAP visitor threads. Verified offline at startup. */
+    licenseKey?: string;
 }
 export interface GatewayServerHandle {
     port: number;
@@ -99,6 +103,10 @@ export declare function isThreadBusy(threadName: string): boolean;
  * net to swallow these without crashing while still surfacing real faults.
  */
 export declare function isBenignSocketError(err: unknown): boolean;
+/** Thread names that currently exist on disk (one `.jsonl` per thread). */
+export declare function listExistingThreadNames(): string[];
+/** The 402 body for a demo-cap refusal. Exported so tests assert one string. */
+export declare function demoCapMessage(d: DemoCapDenial): string;
 export interface AgentQueuedMessage {
     text: string;
     sender: string;

package/dist/gateway/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAsB,aAAa,EAAE,MAAM,aAAa,CAAC;AAiBnG,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAKnB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qCAAqC;IACrC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5C,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,aAAa,EAAE,gBAAgB,EAAE,CAAC;IACxD,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;uCAGmC;IACnC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACnD,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,MAAM,CAAC,EAAE,OAAO,aAAa,EAAE,YAAY,CAAC;IAC5C,4FAA4F;IAC5F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,MAAM,EAAE,OAAO,MAAM,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,wDAAwD;IACxD,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC5C,sFAAsF;IACtF,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,IAAI,CAAC;IACjG,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,EAAE;QAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAChF,oEAAoE;IACpE,mBAAmB,EAAE,CAAC,MAAM,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnF;AAyFD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAetE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAUvF;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AA8CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAscD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GACA,MAAM,CAwER;AAsJD,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI/C;AAymCD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA8oB9B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAuB3B,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAsB,aAAa,EAAE,MAAM,aAAa,CAAC;AAQnG,OAAO,EAUL,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAKnB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,8CAA8C;IAC9C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qCAAqC;IACrC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5C,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,aAAa,EAAE,gBAAgB,EAAE,CAAC;IACxD,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;uCAGmC;IACnC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACnD,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,MAAM,CAAC,EAAE,OAAO,aAAa,EAAE,YAAY,CAAC;IAC5C,4FAA4F;IAC5F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;+EAC2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,MAAM,EAAE,OAAO,MAAM,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,wDAAwD;IACxD,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC5C,sFAAsF;IACtF,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,IAAI,CAAC;IACjG,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,EAAE;QAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAChF,oEAAoE;IACpE,mBAAmB,EAAE,CAAC,MAAM,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnF;AAyFD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAetE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAUvF;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AA8CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGzD;AAqQD,2EAA2E;AAC3E,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAMlD;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAMvD;AAkPD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GACA,MAAM,CAwER;AAsJD,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI/C;AA4mCD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAosB9B"}

package/dist/gateway/server.js

@@ -23,16 +23,17 @@ import * as path from 'path';
 import { loadThreadConfig, saveThreadConfig, setConfigThreadsDir } from '../lib/config.js';
 import { loadEmbeddings, generateMissingEmbeddings } from '../lib/embeddings.js';
 import { sendMessage, getOrCreateThread, clearThreadCache, getActiveSubprocessCount, setGatewayThreadsDir, } from '../lib/gateway.js';
+import { verifyLicense, majorOf, LICENSE_CONTACT } from '../lib/license.js';
 import { getPromptsDirForThreadPath, isValidCaptureId, readPromptCapture, } from '../lib/prompt-capture.js';
 import { catchUpSegmentation, loadSegmentBoundaries, saveSegmentBoundaries, } from '../lib/segments.js';
 import { listTemplates, scaffoldFromTemplate } from '../lib/templates.js';
-import { checkForUpdate, performUpdate, readChangelog } from '../lib/version-check.js';
+import { checkForUpdate, getCurrentVersion, performUpdate, readChangelog, } from '../lib/version-check.js';
 import { serveStaticFile, getMediaDir } from './adapters/webchat.js';
 import { authenticate, getPresentedKey } from './auth.js';
 import { BridgeGateway } from './bridge/gateway.js';
 import { applyConfigPatch, maskedConfigView } from './config.js';
 import { handleEmailHook, handleFormHook, handleGenericWebhook, } from './hooks.js';
-import { allNamespaceKeys, extraMcpServersForThread, namespaceForKey, namespaceForThread, resolveExecutorProxy, threadAccessibleToScope, threadVisibleToScope, } from './namespaces.js';
+import { allNamespaceKeys, demoMintDenial, extraMcpServersForThread, licenseBannerLines, namespaceForKey, namespaceForThread, resolveExecutorProxy, threadAccessibleToScope, threadVisibleToScope, } from './namespaces.js';
 import { configureVapid, sendNotification, subscribe as pushSubscribe, unsubscribe as pushUnsubscribe, } from './push.js';
 import { validateTranscriptFlush, ingestTranscriptFlush } from './transcript-ingest.js';
 const threadQueues = new Map();
@@ -379,6 +380,39 @@ function denyOutOfNamespace(res, threadName, scope) {
     jsonResponse(res, 403, { error: 'Thread not in your namespace' });
     return true;
 }
+/** Thread names that currently exist on disk (one `.jsonl` per thread). */
+export function listExistingThreadNames() {
+    if (!fs.existsSync(THREADS_DIR))
+        return [];
+    return fs
+        .readdirSync(THREADS_DIR)
+        .filter(f => f.endsWith('.jsonl'))
+        .map(f => f.replace(/\.jsonl$/, ''));
+}
+/** The 402 body for a demo-cap refusal. Exported so tests assert one string. */
+export function demoCapMessage(d) {
+    return (`Demo mode: namespace "${d.namespace}" has reached its limit of ${d.cap} visitor threads ` +
+        `(${d.count} in use). Existing threads keep working. ` +
+        `Commercial and production use requires a licence — contact ${LICENSE_CONTACT}.`);
+}
+/**
+ * 402s and returns true when the request would MINT a new thread in an
+ * unlicensed namespace that is already at the demo cap (task 127). Non-namespaced
+ * threads, already-existing threads and licensed namespaces all pass through.
+ */
+function denyOverDemoCap(res, threadName, scope) {
+    const denial = demoMintDenial(threadName, scope.namespaces, listExistingThreadNames(), scope.license);
+    if (!denial)
+        return false;
+    jsonResponse(res, 402, {
+        error: demoCapMessage(denial),
+        demoMode: true,
+        namespace: denial.namespace,
+        cap: denial.cap,
+        contact: LICENSE_CONTACT,
+    });
+    return true;
+}
 async function handleAgentInject(req, res, pipelineOpts, scope) {
     let body;
     try {
@@ -420,6 +454,23 @@ async function handleAgentInject(req, res, pipelineOpts, scope) {
         jsonResponse(res, 403, { error: `Thread not in your namespace: ${denied.join(', ')}` });
         return;
     }
+    // Task 127: injecting into a thread that doesn't exist yet mints it. Checked
+    // once against a single inventory read so a multi-target inject can't slip
+    // extra threads past the cap.
+    const existing = listExistingThreadNames();
+    for (const t of targetNames) {
+        const capDenial = demoMintDenial(t, scope.namespaces, existing, scope.license);
+        if (capDenial) {
+            jsonResponse(res, 402, {
+                error: demoCapMessage(capDenial),
+                demoMode: true,
+                namespace: capDenial.namespace,
+                cap: capDenial.cap,
+                contact: LICENSE_CONTACT,
+            });
+            return;
+        }
+    }
     const results = [];
     for (const targetName of targetNames) {
         const type = messageType || 'direct';
@@ -1084,9 +1135,12 @@ async function handleIngestTranscript(req, res, scope) {
         jsonResponse(res, 400, { error: parsed.error });
         return;
     }
-    // P7: the target thread arrives in the body, so gate it here.
+    // P7: the target thread arrives in the body, so gate it here. Task 127's demo
+    // cap rides the same spot for the same reason.
     if (denyOutOfNamespace(res, parsed.flush.targetThread, scope))
         return;
+    if (denyOverDemoCap(res, parsed.flush.targetThread, scope))
+        return;
     try {
         const result = await ingestTranscriptFlush(parsed.flush);
         jsonResponse(res, 200, result);
@@ -1364,6 +1418,8 @@ async function handleMigrate(req, res, opts, scope) {
     // P7: the thread arrives in the body — gate before creating/cloning anything.
     if (denyOutOfNamespace(res, threadName, scope))
         return;
+    if (denyOverDemoCap(res, threadName, scope))
+        return;
     const result = {
         threadName,
         synced: 0,
@@ -1674,6 +1730,34 @@ export async function startGatewayServer(options) {
     // them into the valid-key set. The namespace→key mapping stays in
     // `namespaces` for scope resolution.
     const namespaces = options.namespaces ?? [];
+    // Licence verification (task 127). Offline, once at startup — SIGHUP config
+    // reload is a full process restart, so this re-runs there too. Pasting a key
+    // therefore requires a reload, which is the right cadence for a rare act.
+    const licenseStatus = verifyLicense(options.licenseKey, majorOf(getCurrentVersion()));
+    // Task 129: the licence key is editable in Settings but NEVER live-applied —
+    // enforcement stays `licenseStatus` above, verified once at startup (127's
+    // reload cadence). This tracks the on-disk value only, so GET /api/config can
+    // render masked state and a truthful pendingReload flag after a PUT.
+    let storedLicenseKey = options.licenseKey;
+    const licenseView = () => ({
+        licensed: licenseStatus.licensed,
+        ...(licenseStatus.licensed
+            ? { licensee: licenseStatus.licensee }
+            : { reason: licenseStatus.reason }),
+        pendingReload: (storedLicenseKey ?? '') !== (options.licenseKey ?? ''),
+    });
+    const emitLicenseBanner = () => {
+        for (const line of licenseBannerLines(licenseStatus, namespaces, listExistingThreadNames())) {
+            console.log(line);
+        }
+    };
+    emitLicenseBanner();
+    // Periodic repeat while unlicensed, so a long-running demo deployment keeps
+    // saying so. `unref` keeps it from holding the process open.
+    const licenseBannerTimer = licenseStatus.licensed
+        ? undefined
+        : setInterval(emitLicenseBanner, 60 * 60 * 1000);
+    licenseBannerTimer?.unref?.();
     const nsKeys = allNamespaceKeys(namespaces);
     let currentApiKeys = Array.from(new Set([...options.apiKeys, ...nsKeys]));
     let scheduler;
@@ -1783,6 +1867,13 @@ export async function startGatewayServer(options) {
             jsonResponse(res, 403, { error: 'Thread not in your namespace' });
             return;
         }
+        // Demo capacity gate (task 127) — rides the same choke point, one notch
+        // later: access says WHO may touch a thread, this says whether a NEW one may
+        // be minted. Ordered after the 403 so an out-of-namespace caller never learns
+        // a namespace's occupancy from the status code.
+        const scope = { ns: scopeNs, namespaces, license: licenseStatus };
+        if (pathThread && denyOverDemoCap(res, pathThread, scope))
+            return;
         try {
             // POST /bridge/call — route a tool call to the connected app tab (task
             // 097). Body: { thread, command, params?, confirm?, summary? }. Commands
@@ -1812,6 +1903,8 @@ export async function startGatewayServer(options) {
                     jsonResponse(res, 403, { error: 'Thread not in your namespace' });
                     return;
                 }
+                if (denyOverDemoCap(res, thread, scope))
+                    return;
                 const callParams = body.params ?? {};
                 const manifestEntry = bridgeGateway.manifest(thread)?.find(c => c.name === command);
                 const needsConfirm = Boolean(body.confirm) || manifestEntry?.risk === 'export';
@@ -1929,7 +2022,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/ingest-transcript — store-only transcript ingestion (task 096)
             if (routePath === '/api/ingest-transcript' && req.method === 'POST') {
-                await handleIngestTranscript(req, res, { ns: scopeNs, namespaces });
+                await handleIngestTranscript(req, res, scope);
                 return;
             }
             // GET /api/thread/:name/history
@@ -2022,15 +2115,12 @@ export async function startGatewayServer(options) {
             // PUT /api/config reassigns pipelineOpts.* in place, so this is the single
             // authoritative in-memory source (task 104).
             if (routePath === '/api/models' && req.method === 'GET') {
-                // Build models list with global default marked
-                let models = (pipelineOpts.models || []).map(m => ({ ...m }));
-                if (models.length === 0) {
-                    // Fallback: just Claude
-                    models = [
-                        { id: 'claude', label: 'Claude (CLI)', provider: 'claude-cli', default: true },
-                    ];
-                }
-                else {
+                // Serve the configured catalog truthfully — task 129 deleted the
+                // hardcoded fallbacks (a lone Claude entry / the Opus-Sonnet pair).
+                // An unconfigured gateway gets empty arrays; setup seeds a catalog,
+                // and the Settings gear (topbar, task 128) is the recovery path.
+                const models = (pipelineOpts.models || []).map(m => ({ ...m }));
+                if (models.length > 0) {
                     // Clear all defaults, then set the global default (or first if none specified)
                     const globalDefault = pipelineOpts.model || models[0].id;
                     for (const m of models) {
@@ -2038,31 +2128,39 @@ export async function startGatewayServer(options) {
                     }
                 }
                 // Claude CLI model variants (Opus/Sonnet/...) for the sub-model picker.
-                // Config-driven; fall back to the historical Opus/Sonnet pair when unset.
-                let claudeModels = (pipelineOpts.claudeModels || []).map(m => ({ ...m }));
-                if (claudeModels.length === 0) {
-                    claudeModels = [
-                        { id: 'claude-opus-5[1m]', label: 'Opus 5', default: true },
-                        { id: 'claude-sonnet-5[1m]', label: 'Sonnet 5' },
-                    ];
-                }
-                else if (!claudeModels.some(m => m.default)) {
+                // First-is-default is a normalization rule for a configured list, not
+                // model knowledge — it stays.
+                const claudeModels = (pipelineOpts.claudeModels || []).map(m => ({ ...m }));
+                if (claudeModels.length > 0 && !claudeModels.some(m => m.default)) {
                     claudeModels[0].default = true;
                 }
                 jsonResponse(res, 200, { models, claudeModels });
                 return;
             }
+            // GET/PUT /api/config — gateway-level settings are ADMIN-ONLY (task 128).
+            // Task 104 opened these to "any valid key", which predated scoped app keys
+            // becoming a public surface (097 P4 ships one to every app visitor's
+            // browser); a scoped key must not read or rewrite the gateway's model
+            // catalog, default model, or provider credentials.
+            if (routePath === '/api/config' && scopeNs) {
+                jsonResponse(res, 403, { error: 'Gateway settings require an admin key' });
+                return;
+            }
             // GET /api/config — live-mutable config subset (task 104), credentials
-            // MASKED. Any valid gateway key (Karl's poll). Lets the in-app editor
-            // render current state without ever exposing a full provider key.
+            // MASKED. Lets the in-app editor render current state without ever
+            // exposing a full provider key.
             if (routePath === '/api/config' && req.method === 'GET') {
-                jsonResponse(res, 200, maskedConfigView({
-                    models: pipelineOpts.models,
-                    claudeModels: pipelineOpts.claudeModels,
-                    model: pipelineOpts.model,
-                    hfApiKey: pipelineOpts.hfApiKey,
-                    openaiApiKey: pipelineOpts.openaiApiKey,
-                }));
+                jsonResponse(res, 200, {
+                    ...maskedConfigView({
+                        models: pipelineOpts.models,
+                        claudeModels: pipelineOpts.claudeModels,
+                        model: pipelineOpts.model,
+                        hfApiKey: pipelineOpts.hfApiKey,
+                        openaiApiKey: pipelineOpts.openaiApiKey,
+                        licenseKey: storedLicenseKey,
+                    }),
+                    license: licenseView(),
+                });
                 return;
             }
             // PUT /api/config — live-apply the model catalog / default / provider
@@ -2070,7 +2168,7 @@ export async function startGatewayServer(options) {
             // in-memory options in place so /api/models and the per-turn spawn reflect
             // it with NO restart; onConfigApplied propagates to the other spawn-path
             // holders (webchat). PUT (not PATCH) so it rides the existing CORS
-            // allow-methods. Any valid gateway key.
+            // allow-methods. Admin (non-namespaced) keys only — gated above.
             if (routePath === '/api/config' && req.method === 'PUT') {
                 let patch;
                 try {
@@ -2094,15 +2192,24 @@ export async function startGatewayServer(options) {
                         pipelineOpts.hfApiKey = applied.hfApiKey;
                     if (patch.openaiApiKey !== undefined)
                         pipelineOpts.openaiApiKey = applied.openaiApiKey;
+                    // Task 129: licence key is persist-ONLY — track the stored value for
+                    // display, but never rewire enforcement (licenseStatus stays as
+                    // verified at startup; a reload is what applies it — task 127).
+                    if (patch.licenseKey !== undefined)
+                        storedLicenseKey = applied.licenseKey;
                     // Propagate to the daemon's OTHER holders (webchat pipelineOpts, etc.).
                     options.onConfigApplied?.(applied);
-                    jsonResponse(res, 200, maskedConfigView({
-                        models: pipelineOpts.models,
-                        claudeModels: pipelineOpts.claudeModels,
-                        model: pipelineOpts.model,
-                        hfApiKey: pipelineOpts.hfApiKey,
-                        openaiApiKey: pipelineOpts.openaiApiKey,
-                    }));
+                    jsonResponse(res, 200, {
+                        ...maskedConfigView({
+                            models: pipelineOpts.models,
+                            claudeModels: pipelineOpts.claudeModels,
+                            model: pipelineOpts.model,
+                            hfApiKey: pipelineOpts.hfApiKey,
+                            openaiApiKey: pipelineOpts.openaiApiKey,
+                            licenseKey: storedLicenseKey,
+                        }),
+                        license: licenseView(),
+                    });
                 }
                 catch (err) {
                     jsonResponse(res, 500, { error: String(err) });
@@ -2125,7 +2232,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/agents/inject — agent-to-agent messaging
             if (routePath === '/api/agents/inject' && req.method === 'POST') {
-                await handleAgentInject(req, res, pipelineOpts, { ns: scopeNs, namespaces });
+                await handleAgentInject(req, res, pipelineOpts, scope);
                 return;
             }
             // GET /api/federation/status — connected spokes and their threads (hub only)
@@ -2140,7 +2247,7 @@ export async function startGatewayServer(options) {
             }
             // POST /api/migrate — sync thread + clone repo + set projectDir
             if (routePath === '/api/migrate' && req.method === 'POST') {
-                await handleMigrate(req, res, pipelineOpts, { ns: scopeNs, namespaces });
+                await handleMigrate(req, res, pipelineOpts, scope);
                 return;
             }
             // POST /api/push/subscribe — register push subscription
@@ -2241,6 +2348,8 @@ export async function startGatewayServer(options) {
                     // Abort any in-flight message processing
                     threadQueues.clear();
                     threadBusy.clear();
+                    if (licenseBannerTimer)
+                        clearInterval(licenseBannerTimer);
                     return new Promise(resolveClose => {
                         server.close(() => {
                             clearThreadCache();