@superblocksteam/shared 0.9601.2 → 0.9602.0

package/dist-esm/types/billing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/billing/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/billing/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist-esm/types/billing/index.js

@@ -1,4 +1,5 @@
 export * from './freeCreditsTier.js';
+export * from './pricingModel.js';
 export * from './billing.js';
 export * from './spendAlert.js';
 //# sourceMappingURL=index.js.map

package/dist-esm/types/billing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/billing/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/billing/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist-esm/types/billing/pricingModel.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Which pricing model an organization is on, persisted on `billing.pricing_model`.
+ *
+ * `seats` (default) is the legacy seat-based model: the Stripe subscription is
+ * anchored on a `builder_seat` line item and AI usage is gated per assigned seat.
+ * `credits` is the PLG model where the org buys credit packs (surfaced as "GAUs")
+ * and deployed apps, and AI usage is metered against the org-level pool with no seats.
+ *
+ * Values match the PostgreSQL `pricing_model_enum`. Existing orgs default to `seats`
+ * so they are grandfathered onto seat-based pricing until explicitly migrated.
+ */
+export declare enum PricingModelEnum {
+    CREDITS = "credits",
+    SEATS = "seats"
+}
+export type PricingModel = `${PricingModelEnum}`;
+/**
+ * True only when the org is on the seatless credits (GAU) pricing model. Anything
+ * absent or unrecognized is treated as seat-based — the grandfather-safe default.
+ */
+export declare function isCreditsPricing(pricingModel: PricingModel | undefined | null): boolean;
+/**
+ * True when the org is on seat-based pricing — the inverse of {@link isCreditsPricing}.
+ * Anything absent or unrecognized reads as seat-based, so use this rather than a raw
+ * `=== 'seats'` comparison, which would miss the grandfathered (unset) case.
+ */
+export declare function isSeatsPricing(pricingModel: PricingModel | undefined | null): boolean;
+/**
+ * Coerce the raw value of the `superblocks.billing.default-pricing-model` LaunchDarkly
+ * flag into a valid {@link PricingModel} for stamping onto a new org at creation. (Conversion
+ * does not re-resolve the flag; it carries the existing stamp forward — see
+ * `createBillingHistoryRowForOrg`.)
+ *
+ * Fails **closed to `seats`** for anything unrecognized — an LD typo, a variation the
+ * running code doesn't know yet, or a wrong-typed value — so a misconfigured flag can
+ * never strand a new org on a half-built pricing model.
+ */
+export declare function resolvePricingModel(rawFlagValue: unknown): PricingModel;
+//# sourceMappingURL=pricingModel.d.ts.map

package/dist-esm/types/billing/pricingModel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricingModel.d.ts","sourceRoot":"","sources":["../../../src/types/billing/pricingModel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,GAAG,gBAAgB,EAAE,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAErF;AAID;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,OAAO,GAAG,YAAY,CAIvE"}

package/dist-esm/types/billing/pricingModel.js

@@ -0,0 +1,48 @@
+/**
+ * Which pricing model an organization is on, persisted on `billing.pricing_model`.
+ *
+ * `seats` (default) is the legacy seat-based model: the Stripe subscription is
+ * anchored on a `builder_seat` line item and AI usage is gated per assigned seat.
+ * `credits` is the PLG model where the org buys credit packs (surfaced as "GAUs")
+ * and deployed apps, and AI usage is metered against the org-level pool with no seats.
+ *
+ * Values match the PostgreSQL `pricing_model_enum`. Existing orgs default to `seats`
+ * so they are grandfathered onto seat-based pricing until explicitly migrated.
+ */
+export var PricingModelEnum;
+(function (PricingModelEnum) {
+    PricingModelEnum["CREDITS"] = "credits";
+    PricingModelEnum["SEATS"] = "seats";
+})(PricingModelEnum || (PricingModelEnum = {}));
+/**
+ * True only when the org is on the seatless credits (GAU) pricing model. Anything
+ * absent or unrecognized is treated as seat-based — the grandfather-safe default.
+ */
+export function isCreditsPricing(pricingModel) {
+    return pricingModel === PricingModelEnum.CREDITS;
+}
+/**
+ * True when the org is on seat-based pricing — the inverse of {@link isCreditsPricing}.
+ * Anything absent or unrecognized reads as seat-based, so use this rather than a raw
+ * `=== 'seats'` comparison, which would miss the grandfathered (unset) case.
+ */
+export function isSeatsPricing(pricingModel) {
+    return !isCreditsPricing(pricingModel);
+}
+const KNOWN_PRICING_MODELS = new Set(Object.values(PricingModelEnum));
+/**
+ * Coerce the raw value of the `superblocks.billing.default-pricing-model` LaunchDarkly
+ * flag into a valid {@link PricingModel} for stamping onto a new org at creation. (Conversion
+ * does not re-resolve the flag; it carries the existing stamp forward — see
+ * `createBillingHistoryRowForOrg`.)
+ *
+ * Fails **closed to `seats`** for anything unrecognized — an LD typo, a variation the
+ * running code doesn't know yet, or a wrong-typed value — so a misconfigured flag can
+ * never strand a new org on a half-built pricing model.
+ */
+export function resolvePricingModel(rawFlagValue) {
+    return typeof rawFlagValue === 'string' && KNOWN_PRICING_MODELS.has(rawFlagValue)
+        ? rawFlagValue
+        : PricingModelEnum.SEATS;
+}
+//# sourceMappingURL=pricingModel.js.map

package/dist-esm/types/billing/pricingModel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricingModel.js","sourceRoot":"","sources":["../../../src/types/billing/pricingModel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,mCAAe,CAAA;AACjB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAID;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAA6C;IAC5E,OAAO,YAAY,KAAK,gBAAgB,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAA6C;IAC1E,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAqB;IACvD,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/E,CAAC,CAAE,YAA6B;QAChC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAC7B,CAAC"}

package/dist-esm/types/billing/pricingModel.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pricingModel.test.d.ts.map

package/dist-esm/types/billing/pricingModel.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricingModel.test.d.ts","sourceRoot":"","sources":["../../../src/types/billing/pricingModel.test.ts"],"names":[],"mappings":""}

package/dist-esm/types/billing/pricingModel.test.js

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import { isCreditsPricing, isSeatsPricing, PricingModelEnum, resolvePricingModel } from './pricingModel.js';
+describe('PricingModelEnum', () => {
+    it('uses stable string values for the billing.pricing_model column', () => {
+        expect(PricingModelEnum.SEATS).toBe('seats');
+        expect(PricingModelEnum.CREDITS).toBe('credits');
+    });
+});
+describe('isCreditsPricing', () => {
+    it('is true only for credits-based orgs', () => {
+        expect(isCreditsPricing(PricingModelEnum.CREDITS)).toBe(true);
+    });
+    it('is false for seat-based orgs', () => {
+        expect(isCreditsPricing(PricingModelEnum.SEATS)).toBe(false);
+    });
+    it('defaults to false (seat-based) when the model is absent, so existing orgs are grandfathered', () => {
+        expect(isCreditsPricing(undefined)).toBe(false);
+        expect(isCreditsPricing(null)).toBe(false);
+    });
+});
+describe('isSeatsPricing', () => {
+    it('is true for seat-based orgs', () => {
+        expect(isSeatsPricing(PricingModelEnum.SEATS)).toBe(true);
+    });
+    it('is false for credits-based orgs', () => {
+        expect(isSeatsPricing(PricingModelEnum.CREDITS)).toBe(false);
+    });
+    it('treats an absent model as seat-based, so existing orgs are grandfathered', () => {
+        expect(isSeatsPricing(undefined)).toBe(true);
+        expect(isSeatsPricing(null)).toBe(true);
+    });
+});
+describe('resolvePricingModel', () => {
+    it('passes through recognized model values from the LD flag', () => {
+        expect(resolvePricingModel('credits')).toBe(PricingModelEnum.CREDITS);
+        expect(resolvePricingModel('seats')).toBe(PricingModelEnum.SEATS);
+    });
+    it('fails closed to seats for an unrecognized flag value (LD typo / unknown variation)', () => {
+        expect(resolvePricingModel('gau')).toBe(PricingModelEnum.SEATS);
+        expect(resolvePricingModel('Credits')).toBe(PricingModelEnum.SEATS);
+        expect(resolvePricingModel('')).toBe(PricingModelEnum.SEATS);
+    });
+    it('fails closed to seats when the flag is missing or the wrong type', () => {
+        expect(resolvePricingModel(undefined)).toBe(PricingModelEnum.SEATS);
+        expect(resolvePricingModel(null)).toBe(PricingModelEnum.SEATS);
+        expect(resolvePricingModel(true)).toBe(PricingModelEnum.SEATS);
+        expect(resolvePricingModel(42)).toBe(PricingModelEnum.SEATS);
+    });
+});
+//# sourceMappingURL=pricingModel.test.js.map

package/dist-esm/types/billing/pricingModel.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricingModel.test.js","sourceRoot":"","sources":["../../../src/types/billing/pricingModel.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE5G,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/shared",
-  "version": "0.9601.2",
+  "version": "0.9602.0",
   "description": "Superblocks Shared Resources",
   "license": "Superblocks Community Software License",
   "repository": "https://github.com/superblocksteam/shared.git",

package/src/database-lifecycle/index.test.ts

@@ -4,6 +4,7 @@ import {
   computeBindingKey,
   computeDesiredSpecHash,
   computeNativeDbApplicationToken,
+  computeNativeDbBindingToken,
   computeNativeDbDatabaseName,
   computeRequirementKey,
   containsCredentialMaterial,
@@ -179,6 +180,57 @@ describe('database lifecycle contracts', () => {
     );
   });
 
+  test('reads binding-scoped v2 managed Postgres IAM descriptors', () => {
+    expect(
+      parseNativeDbIamDescriptor({
+        application_id: 'application-id',
+        auth_descriptor_version: 2,
+        auth_mode: 'aws_iam_role',
+        aws_account_id: '123456789012',
+        binding_id: 'binding-id',
+        cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
+        connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
+        port: 5432,
+        region: 'us-west-2',
+        username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
+      })
+    ).toEqual({
+      application_id: 'application-id',
+      auth_descriptor_version: 2,
+      auth_mode: 'aws_iam_role',
+      aws_account_id: '123456789012',
+      binding_id: 'binding-id',
+      cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
+      connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
+      port: 5432,
+      region: 'us-west-2',
+      username: 'sbndb_abcdef123456_0123456789abcdef01234567_runtime'
+    });
+  });
+
+  test('rejects v2 descriptors when database and runtime username use different binding tokens', () => {
+    expect(
+      parseNativeDbIamDescriptor({
+        application_id: 'application-id',
+        auth_descriptor_version: 2,
+        auth_mode: 'aws_iam_role',
+        aws_account_id: '123456789012',
+        binding_id: 'binding-id',
+        cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
+        connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
+        port: 5432,
+        region: 'us-west-2',
+        username: 'sbndb_abcdef123456_fedcba9876543210fedcba98_runtime'
+      })
+    ).toBeUndefined();
+  });
+
   test('rejects malformed or non-commercial managed Postgres IAM descriptors', () => {
     const descriptor = {
       application_id: 'application-id',
@@ -195,7 +247,7 @@ describe('database lifecycle contracts', () => {
       username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
     };
 
-    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 2 })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 3 })).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, cluster_resource_id: 'not-an-rds-resource' })).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, connector_role_arn: 'arn:aws:iam::210987654321:role/other' })).toBeUndefined();
     expect(parseNativeDbIamDescriptor({ ...descriptor, database: 'orders' })).toBeUndefined();
@@ -230,4 +282,8 @@ describe('database lifecycle contracts', () => {
     await expect(computeNativeDbApplicationToken('application-id')).resolves.toBe('7bfeae1170db923274f1943f');
     await expect(computeNativeDbDatabaseName('abcdef123456', 'database-id')).resolves.toBe('sbndb_abcdef123456_dad72612f7a80580b028178f');
   });
+
+  test('derives a stable binding identity token for v2 database and runtime-user names', async () => {
+    await expect(computeNativeDbBindingToken('binding-id')).resolves.toBe('927968fc37b7b41be7e14cf9');
+  });
 });

package/src/database-lifecycle/index.ts

@@ -16,7 +16,8 @@ export const LIFECYCLE_OPERATIONS = ['ensure_database', 'migrate_schema', 'retir
 export const LIFECYCLE_ENVIRONMENTS = ['edit', 'preview', 'deployed'] as const;
 export const DATABASE_ENGINES = ['postgres', 'snowflake', 'snowflake_postgres', 'lakebase'] as const;
 export const DATABASE_LIFECYCLE_MANAGED_BY = 'database_lifecycle';
-export const NATIVE_DB_AUTH_DESCRIPTOR_VERSION = 1 as const;
+export const NATIVE_DB_AUTH_DESCRIPTOR_VERSION = 2 as const;
+export const NATIVE_DB_AUTH_DESCRIPTOR_VERSIONS = [1, NATIVE_DB_AUTH_DESCRIPTOR_VERSION] as const;
 export const NATIVE_DB_CONNECTOR_ROLE_NAME_PREFIX = 'superblocks-native-db-connector';
 export const NATIVE_DB_IAM_AUTH_MODE = 'aws_iam_role' as const;
 export const NATIVE_DB_IDENTIFIER_HASH_DOMAIN = 'superblocks-native-db:v1';
@@ -68,7 +69,7 @@ export type CredentialRef = {
 
 export type NativeDbIamDescriptor = {
   application_id: string;
-  auth_descriptor_version: typeof NATIVE_DB_AUTH_DESCRIPTOR_VERSION;
+  auth_descriptor_version: (typeof NATIVE_DB_AUTH_DESCRIPTOR_VERSIONS)[number];
   auth_mode: typeof NATIVE_DB_IAM_AUTH_MODE;
   aws_account_id: string;
   binding_id: string;
@@ -287,7 +288,7 @@ export function parseNativeDbIamDescriptor(value: unknown): NativeDbIamDescripto
       : null;
   if (
     !isNonEmptyString(value.application_id) ||
-    value.auth_descriptor_version !== NATIVE_DB_AUTH_DESCRIPTOR_VERSION ||
+    !isNativeDbAuthDescriptorVersion(value.auth_descriptor_version) ||
     value.auth_mode !== NATIVE_DB_IAM_AUTH_MODE ||
     !isNonEmptyString(value.aws_account_id) ||
     !/^\d{12}$/.test(value.aws_account_id) ||
@@ -299,6 +300,7 @@ export function parseNativeDbIamDescriptor(value: unknown): NativeDbIamDescripto
     !databaseIdentifier ||
     !usernameIdentifier ||
     databaseIdentifier[1] !== usernameIdentifier[1] ||
+    (value.auth_descriptor_version === NATIVE_DB_AUTH_DESCRIPTOR_VERSION && databaseIdentifier[2] !== usernameIdentifier[2]) ||
     !isValidNativeDbRdsHostname(value.host, value.region) ||
     typeof value.port !== 'number' ||
     !Number.isInteger(value.port) ||
@@ -311,7 +313,7 @@ export function parseNativeDbIamDescriptor(value: unknown): NativeDbIamDescripto
 
   return {
     application_id: value.application_id,
-    auth_descriptor_version: NATIVE_DB_AUTH_DESCRIPTOR_VERSION,
+    auth_descriptor_version: value.auth_descriptor_version,
     auth_mode: NATIVE_DB_IAM_AUTH_MODE,
     aws_account_id: value.aws_account_id,
     binding_id: value.binding_id,
@@ -329,11 +331,15 @@ export async function computeNativeDbApplicationToken(trustedApplicationId: stri
   return (await computeNativeDbIdentifierToken('application', trustedApplicationId)).slice(0, 24);
 }
 
+export async function computeNativeDbBindingToken(trustedBindingId: string): Promise<string> {
+  return (await computeNativeDbIdentifierToken('database', trustedBindingId)).slice(0, 24);
+}
+
 export async function computeNativeDbDatabaseName(deploymentToken: string, trustedDatabaseId: string): Promise<string> {
   if (!/^[0-9a-f]{12}$/.test(deploymentToken)) {
     throw new Error('Native database deployment token must be 12 lowercase hexadecimal characters');
   }
-  return `sbndb_${deploymentToken}_${(await computeNativeDbIdentifierToken('database', trustedDatabaseId)).slice(0, 24)}`;
+  return `sbndb_${deploymentToken}_${await computeNativeDbBindingToken(trustedDatabaseId)}`;
 }
 
 async function computeNativeDbIdentifierToken(kind: 'application' | 'database', trustedId: string): Promise<string> {
@@ -417,6 +423,10 @@ function isCommercialAwsRegion(value: unknown): value is string {
   return typeof value === 'string' && /^[a-z]{2}-[a-z]+-[0-9]+$/.test(value) && !value.startsWith('cn-') && !value.startsWith('us-gov-');
 }
 
+function isNativeDbAuthDescriptorVersion(value: unknown): value is NativeDbIamDescriptor['auth_descriptor_version'] {
+  return value === 1 || value === NATIVE_DB_AUTH_DESCRIPTOR_VERSION;
+}
+
 function isNonEmptyString(value: unknown): value is string {
   return typeof value === 'string' && value.trim().length > 0;
 }

package/src/plugins/templates/postgres.test.ts

@@ -85,11 +85,28 @@ describe('Postgres datasource template', () => {
           }
         },
         rules: [{ required: false }],
-        startVersion: '0.0.13'
+        startVersion: '0.0.13',
+        style: {
+          height: '100px'
+        }
       })
     ]);
   });
 
+  it('places session policy after the required IAM username field', () => {
+    const iamFieldOrder =
+      datasourceItems
+        ?.filter((item) => item.startVersion === '0.0.13')
+        .filter((item) => item.display?.show?.['authentication.authType']?.includes('aws_iam_role'))
+        .map((item) => item.name) ?? [];
+
+    const usernameIndex = iamFieldOrder.indexOf('authentication.username');
+    const sessionPolicyIndex = iamFieldOrder.indexOf('authentication.custom.sessionPolicy.value');
+
+    expect(usernameIndex).toBeGreaterThanOrEqual(0);
+    expect(sessionPolicyIndex).toBeGreaterThan(usernameIndex);
+  });
+
   it('keeps username visible and password compatible with legacy configurations', () => {
     expect(findDatasourceItems('authentication.username')).toEqual([
       expect.objectContaining({

package/src/plugins/templates/postgres.ts

@@ -277,20 +277,6 @@ export const PostgresPlugin: Plugin = {
               }
             }
           },
-          {
-            label: 'Session policy JSON (optional)',
-            name: 'authentication.custom.sessionPolicy.value',
-            startVersion: PostgresPluginVersions.V13,
-            componentType: FormComponentType.CODE_EDITOR,
-            language: EditorLanguage.JSON,
-            rules: [{ required: false }],
-            display: {
-              show: {
-                'authentication.authType': [PostgresAuthType.AWS_IAM_ROLE],
-                connectionType: ['fields']
-              }
-            }
-          },
           // DATABASE USERNAME
           { ...BASE_DATABASE_USERNAME, startVersion: PostgresPluginVersions.V1, endVersion: PostgresPluginVersions.V10 } as FormItem,
           {
@@ -328,6 +314,23 @@ export const PostgresPlugin: Plugin = {
               }
             }
           },
+          {
+            label: 'Session policy JSON (optional)',
+            name: 'authentication.custom.sessionPolicy.value',
+            startVersion: PostgresPluginVersions.V13,
+            componentType: FormComponentType.CODE_EDITOR,
+            language: EditorLanguage.JSON,
+            rules: [{ required: false }],
+            style: {
+              height: '100px'
+            },
+            display: {
+              show: {
+                'authentication.authType': [PostgresAuthType.AWS_IAM_ROLE],
+                connectionType: ['fields']
+              }
+            }
+          },
           // DATABASE PASSWORD
           { ...BASE_DATABASE_PASSWORD, startVersion: PostgresPluginVersions.V1, endVersion: PostgresPluginVersions.V10 } as FormItem,
           {

package/src/tracing/errorSanitizer.test.ts

@@ -58,13 +58,13 @@ describe('Error Sanitization', () => {
     const error = new Error('Test error');
     error.stack = `Error: Invalid token eyJhbGciOiJIUzI1NiI...
     at AuthService.validateToken (/app/src/auth.js:42:15)
-    at api_key=sk_live_abc123 (/app/src/api.js:20:10)`;
+    at api_key=sk_live_abc123def456ghi789 (/app/src/api.js:20:10)`;
 
     const sanitized = sanitizeError(error);
 
     expect(sanitized.stack).toContain('[REDACTED]');
     expect(sanitized.stack).not.toContain('eyJhbGciOiJIUzI1NiI');
-    expect(sanitized.stack).not.toContain('sk_live_abc123');
+    expect(sanitized.stack).not.toContain('sk_live_abc123def456ghi789');
   });
 
   it('should preserve error type and non-sensitive properties', () => {
@@ -85,7 +85,7 @@ describe('Error Sanitization', () => {
 
   it('should handle non-Error objects', () => {
     const errorObj = {
-      message: 'Auth failed with token abc123',
+      message: 'Auth failed with token abc123def456ghi789jkl012',
       token: 'secret-token',
       data: {
         user: 'john',
@@ -101,6 +101,23 @@ describe('Error Sanitization', () => {
     expect((sanitized.data as Record<string, unknown>).password).toBe('[REDACTED]');
   });
 
+  it('should preserve short values after token/api_key (false positive prevention)', () => {
+    const testCases = [
+      { input: 'Token does not have apps:update scope', expected: 'Token does not have apps:update scope' },
+      { input: 'token usage exceeded limit', expected: 'token usage exceeded limit' },
+      { input: 'API key not found', expected: 'API key not found' },
+      { input: 'access token expired', expected: 'access token expired' },
+      { input: 'refresh token is missing', expected: 'refresh token is missing' },
+      { input: 'token: abcdef012345678', expected: 'token: abcdef012345678' },
+      { input: 'token: abcdef0123456789', expected: 'token: [REDACTED]' }
+    ];
+    for (const { input, expected } of testCases) {
+      const error = new Error(input);
+      const sanitized = sanitizeError(error);
+      expect(sanitized.message).toBe(expected);
+    }
+  });
+
   it('should not double-sanitize already sanitized errors', () => {
     const error = new Error('Invalid token: eyJhbGciOiJIUzI1NiI...');
 

package/src/tracing/errorSanitizer.ts

@@ -11,10 +11,10 @@ const SENSITIVE_PATTERNS = [
   /(\bbearer\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
   /(\bbasic\s+)\S+/gi, // Basic auth can contain any non-whitespace characters
   /(\bjwt\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
-  /(\btoken[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
-  /(\bapi[_\s]?key[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
-  /(\baccess[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
-  /(\brefresh[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]+=*/gi,
+  /(\btoken[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+  /(\bapi[_\s]?key[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+  /(\baccess[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+  /(\brefresh[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
 
   // JWT pattern (base64.base64.base64) - standalone tokens
   /\b[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\b/g

package/src/types/ai/quota-paywall.test.ts

@@ -46,6 +46,14 @@ describe('getAiQuotaPaywallReasonFromMessage', () => {
     expect(getAiQuotaPaywallReasonFromMessage('YOUR FREE TRIAL HAS ENDED')).toBe('trial_expired');
   });
 
+  it('returns provisioning_error for the provisioning phrasings, including the server 402/429 copy', () => {
+    expect(getAiQuotaPaywallReasonFromMessage('provisioning_error')).toBe('provisioning_error');
+    expect(getAiQuotaPaywallReasonFromMessage("Your organization's plan hasn't finished provisioning. Try again in a few minutes.")).toBe(
+      'provisioning_error'
+    );
+    expect(getAiQuotaPaywallReasonFromMessage('The plan has not finished provisioning')).toBe('provisioning_error');
+  });
+
   it('returns undefined when the message does not match any known phrasing', () => {
     expect(getAiQuotaPaywallReasonFromMessage('Connection refused')).toBeUndefined();
     expect(getAiQuotaPaywallReasonFromMessage('')).toBeUndefined();
@@ -62,6 +70,7 @@ describe('AI_QUOTA_PAYWALL_REASON_CONFIG', () => {
       'deploy_quota_exceeded',
       'no_seat_assigned',
       'payment_past_due',
+      'provisioning_error',
       'token_limit_exceeded',
       'trial_expired'
     ] as const;

package/src/types/ai/quota-paywall.ts

@@ -4,6 +4,7 @@ export type AiQuotaPaywallReason =
   | 'dollar_commit_exhausted'
   | 'no_seat_assigned'
   | 'payment_past_due'
+  | 'provisioning_error'
   | 'token_limit_exceeded'
   | 'trial_expired'
   | 'user_credit_limit_exceeded';
@@ -20,6 +21,7 @@ export const AI_QUOTA_PAYWALL_REASONS: ReadonlySet<AiQuotaPaywallReason> = new S
   'dollar_commit_exhausted',
   'no_seat_assigned',
   'payment_past_due',
+  'provisioning_error',
   'token_limit_exceeded',
   'trial_expired',
   'user_credit_limit_exceeded'
@@ -60,6 +62,18 @@ export const getAiQuotaPaywallReasonFromMessage = (message: string): AiQuotaPayw
     return 'trial_expired';
   }
 
+  // A paid org whose entitlement row hasn't been written yet (webhook delayed or
+  // failed). Must be matched before the generic 'ai usage limit' fallback below —
+  // this state is a provisioning problem, not exhaustion, and its paywall must not
+  // suggest buying more credits.
+  if (
+    normalizedMessage.includes('provisioning_error') ||
+    normalizedMessage.includes("hasn't finished provisioning") ||
+    normalizedMessage.includes('has not finished provisioning')
+  ) {
+    return 'provisioning_error';
+  }
+
   if (normalizedMessage.includes('token_limit_exceeded')) {
     return 'token_limit_exceeded';
   }
@@ -126,6 +140,11 @@ export const AI_QUOTA_PAYWALL_REASON_CONFIG: Record<AiQuotaPaywallReason, { titl
   user_credit_limit_exceeded: {
     title: "You've reached your assigned usage limit",
     subtitle: 'Contact an admin to request an increase.'
+  },
+  provisioning_error: {
+    title: "Your organization's plan isn't fully set up yet",
+    subtitle:
+      "Your subscription is active, but its usage allowance hasn't finished provisioning. Try again in a few minutes — if this persists, contact support@superblocks.com."
   }
 };
 

package/src/types/billing/billing.ts

@@ -1,4 +1,5 @@
 import type { FreeCreditsTier } from './freeCreditsTier.js';
+import type { PricingModel } from './pricingModel.js';
 
 export enum BillingPlan {
   TRIAL = 'TRIAL',
@@ -53,4 +54,6 @@ export type Billing = {
   showCcGateIfTrial?: boolean;
   /** Set at signup; used for LD targeting (`freeCreditsTier`). */
   freeCreditsTier?: FreeCreditsTier;
+  /** Set at signup; `seats` (legacy, default) or `credits` (seatless PLG/GAU pricing). Absent = seat-based. */
+  pricingModel?: PricingModel;
 };

package/src/types/billing/index.ts

@@ -1,3 +1,4 @@
 export * from './freeCreditsTier.js';
+export * from './pricingModel.js';
 export * from './billing.js';
 export * from './spendAlert.js';

package/src/types/billing/pricingModel.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest';
+
+import { isCreditsPricing, isSeatsPricing, PricingModelEnum, resolvePricingModel } from './pricingModel.js';
+
+describe('PricingModelEnum', () => {
+  it('uses stable string values for the billing.pricing_model column', () => {
+    expect(PricingModelEnum.SEATS).toBe('seats');
+    expect(PricingModelEnum.CREDITS).toBe('credits');
+  });
+});
+
+describe('isCreditsPricing', () => {
+  it('is true only for credits-based orgs', () => {
+    expect(isCreditsPricing(PricingModelEnum.CREDITS)).toBe(true);
+  });
+
+  it('is false for seat-based orgs', () => {
+    expect(isCreditsPricing(PricingModelEnum.SEATS)).toBe(false);
+  });
+
+  it('defaults to false (seat-based) when the model is absent, so existing orgs are grandfathered', () => {
+    expect(isCreditsPricing(undefined)).toBe(false);
+    expect(isCreditsPricing(null)).toBe(false);
+  });
+});
+
+describe('isSeatsPricing', () => {
+  it('is true for seat-based orgs', () => {
+    expect(isSeatsPricing(PricingModelEnum.SEATS)).toBe(true);
+  });
+
+  it('is false for credits-based orgs', () => {
+    expect(isSeatsPricing(PricingModelEnum.CREDITS)).toBe(false);
+  });
+
+  it('treats an absent model as seat-based, so existing orgs are grandfathered', () => {
+    expect(isSeatsPricing(undefined)).toBe(true);
+    expect(isSeatsPricing(null)).toBe(true);
+  });
+});
+
+describe('resolvePricingModel', () => {
+  it('passes through recognized model values from the LD flag', () => {
+    expect(resolvePricingModel('credits')).toBe(PricingModelEnum.CREDITS);
+    expect(resolvePricingModel('seats')).toBe(PricingModelEnum.SEATS);
+  });
+
+  it('fails closed to seats for an unrecognized flag value (LD typo / unknown variation)', () => {
+    expect(resolvePricingModel('gau')).toBe(PricingModelEnum.SEATS);
+    expect(resolvePricingModel('Credits')).toBe(PricingModelEnum.SEATS);
+    expect(resolvePricingModel('')).toBe(PricingModelEnum.SEATS);
+  });
+
+  it('fails closed to seats when the flag is missing or the wrong type', () => {
+    expect(resolvePricingModel(undefined)).toBe(PricingModelEnum.SEATS);
+    expect(resolvePricingModel(null)).toBe(PricingModelEnum.SEATS);
+    expect(resolvePricingModel(true)).toBe(PricingModelEnum.SEATS);
+    expect(resolvePricingModel(42)).toBe(PricingModelEnum.SEATS);
+  });
+});