@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.2

package/dist/billing/definitions/tiers/team.js

@@ -0,0 +1,152 @@
+export const TEAM_TIER_DEFINITIONS = {
+    'team-standard': {
+        slug: 'team-standard',
+        name: 'Team Standard',
+        description: 'Collaboration for small teams',
+        accountType: 'team',
+        sortOrder: 10,
+        creditGrant: { monthly: 1500, yearlyMultiplier: 12 },
+        features: {
+            workbench: true,
+            benchmarks: true,
+            'model-70b-access': true,
+            'ai-agents': true,
+            'ai-audio-generations': 1000,
+            'ai-image-generations': 1000,
+            'ai-ocr-pages': 2500,
+            'ai-text-tokens': 5000000,
+            'ai-agent-runs': 500,
+            'ai-agent-callback': 2500,
+            'knowledge-queries': 10000,
+            'ai-knowledge-extract': 5000,
+            'ai-benchmark-execute': 250,
+            'knowledge-bases': true,
+            'knowledge-extraction': true,
+            'knowledge-cloud-delivery': true,
+            'manual-ingest': true,
+            'web-crawl-pages-monthly': 10000,
+            'build-mode-access': true,
+            'sandbox-uptime-minutes': true,
+            'custom-hostnames': 10,
+            'custom-hostname-ssl': true,
+            'custom-hostname-rate-limit': 5000,
+            // Forge/Registry — generous private allowance for teams.
+            'private-repos': 100,
+            'private-packages': 100,
+            // storage-capacity-gb values are CHAIR-PROVISIONAL defaults pending product
+            // confirmation (typed three-way + fail-closed makes retuning a data change).
+            'storage-capacity-gb': 100,
+            'registry-storage-gb': 100,
+            'repo-storage-mb': 25000,
+            'collaborator-seats': 25
+        },
+        metadata: {
+            minSeats: 5,
+            benefits: [
+                '5 seat minimum (expand anytime)',
+                'Increased storage and knowledge limits',
+                'Optional self-hosted runners'
+            ]
+        }
+    },
+    'team-plus': {
+        slug: 'team-plus',
+        name: 'Team Plus',
+        description: 'Advanced features for growing teams',
+        accountType: 'team',
+        sortOrder: 11,
+        creditGrant: { monthly: 2500, yearlyMultiplier: 12 },
+        features: {
+            workbench: true,
+            benchmarks: true,
+            'model-70b-access': true,
+            'ai-agents': true,
+            'ai-audio-generations': 2500,
+            'ai-image-generations': 2500,
+            'ai-ocr-pages': 7500,
+            'ai-text-tokens': 15000000,
+            'ai-agent-runs': 1500,
+            'ai-agent-callback': 7500,
+            'knowledge-queries': 30000,
+            'ai-knowledge-extract': 15000,
+            'ai-benchmark-execute': 750,
+            'knowledge-bases': true,
+            'knowledge-extraction': true,
+            'knowledge-cloud-delivery': true,
+            'manual-ingest': true,
+            'web-crawl-pages-monthly': 30000,
+            'build-mode-access': true,
+            'sandbox-uptime-minutes': true,
+            'custom-hostnames': 25,
+            'custom-hostname-ssl': true,
+            'custom-hostname-rate-limit': 10000,
+            // Forge/Registry — Team Plus.
+            'private-repos': 500,
+            'private-packages': 500,
+            'storage-capacity-gb': 500,
+            'registry-storage-gb': 500,
+            'repo-storage-mb': 100000,
+            'collaborator-seats': 100
+        },
+        metadata: {
+            minSeats: 5,
+            backgroundJobsSkipCredits: true,
+            benefits: [
+                '5 seat minimum with advanced automation',
+                'Dedicated background job queue with zero credit burn',
+                'Self-hosted runners available'
+            ]
+        }
+    },
+    'team-ultra': {
+        slug: 'team-ultra',
+        name: 'Team Ultra',
+        description: 'Enterprise-grade team collaboration',
+        accountType: 'team',
+        sortOrder: 12,
+        creditGrant: { monthly: 5500, yearlyMultiplier: 12 },
+        features: {
+            workbench: true,
+            benchmarks: true,
+            'model-70b-access': true,
+            'ai-agents': true,
+            'ai-audio-generations': 10000,
+            'ai-image-generations': 10000,
+            'ai-ocr-pages': 25000,
+            'ai-text-tokens': 50000000,
+            'ai-agent-runs': 5000,
+            'ai-agent-callback': 25000,
+            'knowledge-queries': 100000,
+            'ai-knowledge-extract': 50000,
+            'ai-benchmark-execute': 2500,
+            'knowledge-bases': true,
+            'knowledge-extraction': true,
+            'knowledge-cloud-delivery': true,
+            'manual-ingest': true,
+            'web-crawl-pages-monthly': 100000,
+            'build-mode-access': true,
+            'sandbox-uptime-minutes': true,
+            'custom-hostnames': 100,
+            'custom-hostname-ssl': true,
+            'custom-hostname-rate-limit': 50000,
+            // Forge/Registry — Team Ultra.
+            'private-repos': 2500,
+            'private-packages': 2500,
+            'storage-capacity-gb': 2000,
+            'registry-storage-gb': 2000,
+            'repo-storage-mb': 500000,
+            'collaborator-seats': 500
+        },
+        metadata: {
+            minSeats: 10,
+            backgroundJobsSkipCredits: true,
+            selfHostedRunners: true,
+            benefits: [
+                '10 seat minimum with SSO & SCIM',
+                'Unlimited scheduled/background jobs without credit usage',
+                'Named success manager + priority support'
+            ]
+        }
+    }
+};
+//# sourceMappingURL=team.js.map

package/dist/billing/definitions/tiers/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../../../src/billing/definitions/tiers/team.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACzD,eAAe,EAAE;QAChB,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACpD,QAAQ,EAAE;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,WAAW,EAAE,IAAI;YACjB,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,IAAI;YAC5B,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,OAAO;YACzB,eAAe,EAAE,GAAG;YACpB,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,GAAG;YAC3B,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,0BAA0B,EAAE,IAAI;YAChC,eAAe,EAAE,IAAI;YACrB,yBAAyB,EAAE,KAAK;YAChC,mBAAmB,EAAE,IAAI;YACzB,wBAAwB,EAAE,IAAI;YAC9B,kBAAkB,EAAE,EAAE;YACtB,qBAAqB,EAAE,IAAI;YAC3B,4BAA4B,EAAE,IAAI;YAClC,yDAAyD;YACzD,eAAe,EAAE,GAAG;YACpB,kBAAkB,EAAE,GAAG;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,qBAAqB,EAAE,GAAG;YAC1B,qBAAqB,EAAE,GAAG;YAC1B,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,EAAE;SACxB;QACD,QAAQ,EAAE;YACT,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE;gBACT,iCAAiC;gBACjC,wCAAwC;gBACxC,8BAA8B;aAC9B;SACD;KACD;IACD,WAAW,EAAE;QACZ,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,qCAAqC;QAClD,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACpD,QAAQ,EAAE;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,WAAW,EAAE,IAAI;YACjB,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,IAAI;YAC5B,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,eAAe,EAAE,IAAI;YACrB,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;YAC7B,sBAAsB,EAAE,GAAG;YAC3B,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,0BAA0B,EAAE,IAAI;YAChC,eAAe,EAAE,IAAI;YACrB,yBAAyB,EAAE,KAAK;YAChC,mBAAmB,EAAE,IAAI;YACzB,wBAAwB,EAAE,IAAI;YAC9B,kBAAkB,EAAE,EAAE;YACtB,qBAAqB,EAAE,IAAI;YAC3B,4BAA4B,EAAE,KAAK;YACnC,8BAA8B;YAC9B,eAAe,EAAE,GAAG;YACpB,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,GAAG;YAC1B,qBAAqB,EAAE,GAAG;YAC1B,iBAAiB,EAAE,MAAM;YACzB,oBAAoB,EAAE,GAAG;SACzB;QACD,QAAQ,EAAE;YACT,QAAQ,EAAE,CAAC;YACX,yBAAyB,EAAE,IAAI;YAC/B,QAAQ,EAAE;gBACT,yCAAyC;gBACzC,sDAAsD;gBACtD,+BAA+B;aAC/B;SACD;KACD;IACD,YAAY,EAAE;QACb,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qCAAqC;QAClD,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;QACpD,QAAQ,EAAE;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,IAAI;YACxB,WAAW,EAAE,IAAI;YACjB,sBAAsB,EAAE,KAAK;YAC7B,sBAAsB,EAAE,KAAK;YAC7B,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,QAAQ;YAC1B,eAAe,EAAE,IAAI;YACrB,mBAAmB,EAAE,KAAK;YAC1B,mBAAmB,EAAE,MAAM;YAC3B,sBAAsB,EAAE,KAAK;YAC7B,sBAAsB,EAAE,IAAI;YAC5B,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,0BAA0B,EAAE,IAAI;YAChC,eAAe,EAAE,IAAI;YACrB,yBAAyB,EAAE,MAAM;YACjC,mBAAmB,EAAE,IAAI;YACzB,wBAAwB,EAAE,IAAI;YAC9B,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,IAAI;YAC3B,4BAA4B,EAAE,KAAK;YACnC,+BAA+B;YAC/B,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,IAAI;YACxB,qBAAqB,EAAE,IAAI;YAC3B,qBAAqB,EAAE,IAAI;YAC3B,iBAAiB,EAAE,MAAM;YACzB,oBAAoB,EAAE,GAAG;SACzB;QACD,QAAQ,EAAE;YACT,QAAQ,EAAE,EAAE;YACZ,yBAAyB,EAAE,IAAI;YAC/B,iBAAiB,EAAE,IAAI;YACvB,QAAQ,EAAE;gBACT,iCAAiC;gBACjC,0DAA0D;gBAC1D,0CAA0C;aAC1C;SACD;KACD;CACD,CAAC"}

package/dist/billing/definitions/tiers.d.ts

@@ -0,0 +1,3 @@
+export { TIER_DEFINITIONS, getAllTiers, getTiersHash } from './tiers/index.ts';
+export type { AccountType, TierDefinition, TierFeatures } from './tiers/index.ts';
+//# sourceMappingURL=tiers.d.ts.map

package/dist/billing/definitions/tiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiers.d.ts","sourceRoot":"","sources":["../../../src/billing/definitions/tiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/billing/definitions/tiers.js

@@ -0,0 +1,2 @@
+export { TIER_DEFINITIONS, getAllTiers, getTiersHash } from "./tiers/index.js";
+//# sourceMappingURL=tiers.js.map

package/dist/billing/definitions/tiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiers.js","sourceRoot":"","sources":["../../../src/billing/definitions/tiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/billing/failure-status.d.ts

@@ -0,0 +1,3 @@
+/** The HTTP status a caught transport failure carries, or undefined when it names none. */
+export declare function failureStatus<Failure>(failure: Failure): number | undefined;
+//# sourceMappingURL=failure-status.d.ts.map

package/dist/billing/failure-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-status.d.ts","sourceRoot":"","sources":["../../src/billing/failure-status.ts"],"names":[],"mappings":"AAKA,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG3E"}

package/dist/billing/failure-status.js

@@ -0,0 +1,9 @@
+import * as z from 'zod/v4';
+/** A transport failure that names its HTTP status (the canonical client's `ClientError.status`). */
+const statusFailureSchema = z.object({ status: z.number() }).loose();
+/** The HTTP status a caught transport failure carries, or undefined when it names none. */
+export function failureStatus(failure) {
+    const read = statusFailureSchema.safeParse(failure);
+    return read.success ? read.data.status : undefined;
+}
+//# sourceMappingURL=failure-status.js.map

package/dist/billing/failure-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-status.js","sourceRoot":"","sources":["../../src/billing/failure-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAErE,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAU,OAAgB;IACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}

package/dist/billing/gates/build-mode.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Build-mode entitlement gate.
+ *
+ * A chat-web Build session (WS4) is gated two ways before it may start:
+ *   1. PLAN entitlement — the `build-mode-access` feature is a paid-tier
+ *      capability. Gated with `isPlanAtLeast(currentTier, minimumTier)`, the
+ *      same tier-priority comparison every other billing gate uses
+ *      (`gates/constants.ts`). The default minimum is `plus`.
+ *   2. QUOTA preflight — the account must have `build-mode-access` quota
+ *      remaining AND, for a cloud session, enough `sandbox-uptime-minutes`
+ *      budget. Both go through the canonical `preflightQuota` client.
+ *
+ * Consumer / local-host sessions are FREE to RUN (the metering helpers zero
+ * them), but the user must still hold the `build-mode-access` entitlement to
+ * USE Build mode at all — the gate is about feature access, not per-minute
+ * compute, so the plan + access-quota check applies regardless of host.
+ * `preflightSandboxQuota` is only relevant for cloud sessions that consume
+ * vibes-managed compute.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type QuotaStatus } from '../client/quota-guard.ts';
+import { type TierSlug } from './constants.ts';
+/** Lowest tier that may use Build mode. Plus and above. */
+export declare const BUILD_MODE_MINIMUM_TIER: TierSlug;
+export interface CanUseBuildModeInput {
+    /** Caller user id — analytics / logging only; entitlement is tier + quota. */
+    userId?: string | null;
+    /**
+     * The user's active tier slug (e.g. `free`, `plus`, `pro`). Caller
+     * resolves it from `locals.user.planSlug` via the plan normalizer, the
+     * same way every other gate does. Unknown slugs fail the plan check:
+     * quota availability alone is not proof of an entitlement.
+     */
+    currentTier: string;
+    /**
+     * Minimum tier override. Defaults to `BUILD_MODE_MINIMUM_TIER` (`plus`).
+     */
+    minimumTier?: TierSlug;
+}
+export interface BuildModeEntitlement {
+    /** True only when BOTH the plan check and the access-quota preflight pass. */
+    allowed: boolean;
+    /** Did the tier meet the minimum? */
+    planAllowed: boolean;
+    /** Normalized `build-mode-access` quota status. */
+    quota: QuotaStatus;
+    /** The minimum tier that was enforced. */
+    minimumTier: TierSlug;
+}
+/**
+ * Resolve whether the caller may use Build mode: plan-tier entitlement AND
+ * `build-mode-access` quota remaining. Runs the quota preflight client-side
+ * (browser) or against the current origin server-side; on any failure the
+ * quota preflight returns a conservative not-allowed status.
+ */
+export declare function canUseBuildMode(runtime: RuntimeRef, input: CanUseBuildModeInput): Promise<BuildModeEntitlement>;
+/**
+ * Preflight `sandbox-uptime-minutes` quota for a cloud Build session before
+ * it starts (or before extending it). Consumer / local-host sessions don't
+ * consume vibes-managed compute and SHOULD skip this check (they're free).
+ *
+ * @param minutes Expected uptime budget to reserve. Defaults to 1.
+ */
+export declare function preflightSandboxQuota(runtime: RuntimeRef, minutes?: number): Promise<QuotaStatus>;
+//# sourceMappingURL=build-mode.d.ts.map

package/dist/billing/gates/build-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-mode.d.ts","sourceRoot":"","sources":["../../../src/billing/gates/build-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAU9D,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,EAAE,QAAiB,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,KAAK,EAAE,WAAW,CAAC;IACnB,0CAA0C;IAC1C,WAAW,EAAE,QAAQ,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,SAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAGlG"}

package/dist/billing/gates/build-mode.js

@@ -0,0 +1,62 @@
+/**
+ * Build-mode entitlement gate.
+ *
+ * A chat-web Build session (WS4) is gated two ways before it may start:
+ *   1. PLAN entitlement — the `build-mode-access` feature is a paid-tier
+ *      capability. Gated with `isPlanAtLeast(currentTier, minimumTier)`, the
+ *      same tier-priority comparison every other billing gate uses
+ *      (`gates/constants.ts`). The default minimum is `plus`.
+ *   2. QUOTA preflight — the account must have `build-mode-access` quota
+ *      remaining AND, for a cloud session, enough `sandbox-uptime-minutes`
+ *      budget. Both go through the canonical `preflightQuota` client.
+ *
+ * Consumer / local-host sessions are FREE to RUN (the metering helpers zero
+ * them), but the user must still hold the `build-mode-access` entitlement to
+ * USE Build mode at all — the gate is about feature access, not per-minute
+ * compute, so the plan + access-quota check applies regardless of host.
+ * `preflightSandboxQuota` is only relevant for cloud sessions that consume
+ * vibes-managed compute.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { preflightQuota } from "../client/quota-guard.js";
+import { isPlanAtLeast } from "./constants.js";
+import { BUILD_MODE_ACCESS_SLUG, SANDBOX_UPTIME_MINUTES_SLUG } from "../schemas/core/build-feature-slugs.js";
+function log(runtime) {
+    return getLogger('account', runtime).child({ context: 'gates.build-mode' });
+}
+/** Lowest tier that may use Build mode. Plus and above. */
+export const BUILD_MODE_MINIMUM_TIER = 'plus';
+/**
+ * Resolve whether the caller may use Build mode: plan-tier entitlement AND
+ * `build-mode-access` quota remaining. Runs the quota preflight client-side
+ * (browser) or against the current origin server-side; on any failure the
+ * quota preflight returns a conservative not-allowed status.
+ */
+export async function canUseBuildMode(runtime, input) {
+    const minimumTier = input.minimumTier ?? BUILD_MODE_MINIMUM_TIER;
+    const planAllowed = isPlanAtLeast(input.currentTier, minimumTier);
+    const quota = await preflightQuota(runtime, BUILD_MODE_ACCESS_SLUG, 1);
+    const allowed = planAllowed && quota.allowed;
+    if (!allowed) {
+        log(runtime).debug('canUseBuildMode: denied', {
+            userId: input.userId ?? null,
+            currentTier: input.currentTier,
+            minimumTier,
+            planAllowed,
+            quotaAllowed: quota.allowed
+        });
+    }
+    return { allowed, planAllowed, quota, minimumTier };
+}
+/**
+ * Preflight `sandbox-uptime-minutes` quota for a cloud Build session before
+ * it starts (or before extending it). Consumer / local-host sessions don't
+ * consume vibes-managed compute and SHOULD skip this check (they're free).
+ *
+ * @param minutes Expected uptime budget to reserve. Defaults to 1.
+ */
+export async function preflightSandboxQuota(runtime, minutes = 1) {
+    const requested = Number.isFinite(minutes) && minutes > 0 ? minutes : 1;
+    return preflightQuota(runtime, SANDBOX_UPTIME_MINUTES_SLUG, requested);
+}
+//# sourceMappingURL=build-mode.js.map

package/dist/billing/gates/build-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-mode.js","sourceRoot":"","sources":["../../../src/billing/gates/build-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAoB,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EACN,sBAAsB,EACtB,2BAA2B,EAC3B,MAAM,wCAAwC,CAAC;AAEhD,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAa,MAAM,CAAC;AA6BxD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAmB,EACnB,KAA2B;IAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,uBAAuB,CAAC;IACjE,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAElE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW;YACX,WAAW;YACX,YAAY,EAAE,KAAK,CAAC,OAAO;SAC3B,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB,EAAE,OAAO,GAAG,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,cAAc,CAAC,OAAO,EAAE,2BAA2B,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC"}

package/dist/billing/gates/constants.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Billing Gate Constants
+ *
+ * Plan priority ordering and comparison utilities for billing gates.
+ * Priority is derived from the tier sortOrder in the canonical tier definitions.
+ *
+ * These normalize tier slugs (e.g. "plus") and plan slugs
+ * (e.g. "plus-monthly") to tier priority so billing period doesn't affect
+ * feature gating.
+ *
+ * Canonical source: account — apps and libraries import from here.
+ */
+/**
+ * Tier slugs ordered from lowest to highest priority.
+ * Derived from canonical tier definitions by ascending sortOrder.
+ */
+export declare const planPriorityOrderValues: readonly string[];
+/** Tier slug. Kept as string because definitions are code-first and extensible. */
+export type TierSlug = string;
+/**
+ * Tier slugs ordered from lowest to highest priority.
+ * Alias for `planPriorityOrderValues` — matches the export name
+ * consumers expect from the old `account-web/billing/gates/constants`.
+ */
+export declare const planPriorityOrder: readonly string[];
+/**
+ * Resolve a billing gate slug to a tier slug.
+ *
+ * Accepts either canonical tier slugs (`pro`) or plan slugs
+ * (`pro-monthly`). Unknown slugs return null so entitlement gates can fail
+ * closed instead of granting capabilities from unrecognized billing state.
+ */
+export declare function normalizeTierSlug(slug: string | null | undefined): string | null;
+/**
+ * Compare two tier slugs by priority.
+ *
+ * @returns negative if `a` is lower priority than `b`, zero if equal, positive if higher.
+ *          Returns 0 if either slug is unknown.
+ */
+export declare function comparePlanPriority(a: string, b: string): number;
+/**
+ * Check whether the current tier meets or exceeds the minimum tier.
+ *
+ * @param current  - The user's active tier slug
+ * @param minimum  - The minimum tier slug required
+ * @returns true if `current` is at least `minimum` in the priority ordering
+ */
+export declare function isPlanAtLeast(current: string, minimum: string): boolean;
+/**
+ * Check whether the current tier slug is one of the allowed slugs.
+ *
+ * @param current - The user's active tier slug
+ * @param plans   - Array of tier slugs to match against
+ * @returns true if `current` is in `plans`
+ */
+export declare function isPlanOneOf(current: string, plans: string[]): boolean;
+export interface BillingGateQuotaState {
+    allowed: boolean;
+    usage: number;
+    limit: number | null;
+    remaining: number | null;
+}
+export interface BillingGateEvaluationInput {
+    currentPlanSlug: string | null | undefined;
+    hasActiveSubscription?: boolean | null;
+    requiredTier?: string | null;
+    anyPaid?: boolean;
+    featureSlug?: string | null;
+    featureName?: string | null;
+    quota?: BillingGateQuotaState | null;
+    redirect?: string | null;
+}
+export type BillingGateDenialReason = 'subscription' | 'plan' | 'quota';
+export type BillingGateEvaluation = {
+    allowed: true;
+    currentTier: string | null;
+    requiredTier: string | null;
+    featureSlug: string | null;
+    featureLabel: string | null;
+    quota: BillingGateQuotaState | null;
+} | {
+    allowed: false;
+    reason: BillingGateDenialReason;
+    currentTier: string | null;
+    requiredTier: string | null;
+    featureSlug: string | null;
+    featureLabel: string | null;
+    title: string;
+    message: string;
+    upgradeUrl: string;
+    quota: BillingGateQuotaState | null;
+};
+export declare function getManagedBillingFeatureLabel(featureSlug: string | null | undefined): string | null;
+export declare function evaluateBillingGate(input: BillingGateEvaluationInput): BillingGateEvaluation;
+//# sourceMappingURL=constants.d.ts.map

package/dist/billing/gates/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/billing/gates/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,mBAAwD,CAAC;AAE7F,mFAAmF;AACnF,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,mBAA0B,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAehF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAevE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IAC1C,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,qBAAqB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC9B;IACA,OAAO,EAAE,IAAI,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnC,GACD;IACA,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnC,CAAC;AAEL,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGnG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,GAAG,qBAAqB,CAoG5F"}

package/dist/billing/gates/constants.js

@@ -0,0 +1,210 @@
+/**
+ * Billing Gate Constants
+ *
+ * Plan priority ordering and comparison utilities for billing gates.
+ * Priority is derived from the tier sortOrder in the canonical tier definitions.
+ *
+ * These normalize tier slugs (e.g. "plus") and plan slugs
+ * (e.g. "plus-monthly") to tier priority so billing period doesn't affect
+ * feature gating.
+ *
+ * Canonical source: account — apps and libraries import from here.
+ */
+import { PLAN_DEFINITIONS } from "../definitions/plans/index.js";
+import { MANAGED_BILLING_FEATURES } from "../definitions/features.js";
+import { TIER_DEFINITIONS } from "../definitions/tiers/data.js";
+import { getAllTiers } from "../definitions/tiers/hash.js";
+import { buildUpgradeUrl, buildUpgradeUrlForFeature } from "../upgrade-links.js";
+/**
+ * Tier slugs ordered from lowest to highest priority.
+ * Derived from canonical tier definitions by ascending sortOrder.
+ */
+export const planPriorityOrderValues = Object.freeze(getAllTiers().map((tier) => tier.slug));
+/**
+ * Tier slugs ordered from lowest to highest priority.
+ * Alias for `planPriorityOrderValues` — matches the export name
+ * consumers expect from the old `account-web/billing/gates/constants`.
+ */
+export const planPriorityOrder = planPriorityOrderValues;
+/**
+ * Resolve a billing gate slug to a tier slug.
+ *
+ * Accepts either canonical tier slugs (`pro`) or plan slugs
+ * (`pro-monthly`). Unknown slugs return null so entitlement gates can fail
+ * closed instead of granting capabilities from unrecognized billing state.
+ */
+export function normalizeTierSlug(slug) {
+    if (!slug)
+        return null;
+    const normalized = slug.toLowerCase().replace(/_/g, '-');
+    if (Object.prototype.hasOwnProperty.call(TIER_DEFINITIONS, normalized))
+        return normalized;
+    const plan = PLAN_DEFINITIONS[normalized];
+    if (plan)
+        return plan.tierSlug;
+    const withoutCreditPrefix = normalized.replace(/^credits-/, '');
+    const withoutPeriod = withoutCreditPrefix.replace(/-(?:monthly|yearly|trial)$/, '');
+    if (Object.prototype.hasOwnProperty.call(TIER_DEFINITIONS, withoutPeriod)) {
+        return withoutPeriod;
+    }
+    return null;
+}
+/**
+ * Compare two tier slugs by priority.
+ *
+ * @returns negative if `a` is lower priority than `b`, zero if equal, positive if higher.
+ *          Returns 0 if either slug is unknown.
+ */
+export function comparePlanPriority(a, b) {
+    const tierA = normalizeTierSlug(a);
+    const tierB = normalizeTierSlug(b);
+    const indexA = tierA ? planPriorityOrder.indexOf(tierA) : -1;
+    const indexB = tierB ? planPriorityOrder.indexOf(tierB) : -1;
+    // Unknown slugs compare as equal to avoid accidental lockouts
+    if (indexA === -1 || indexB === -1)
+        return 0;
+    return indexA - indexB;
+}
+/**
+ * Check whether the current tier meets or exceeds the minimum tier.
+ *
+ * @param current  - The user's active tier slug
+ * @param minimum  - The minimum tier slug required
+ * @returns true if `current` is at least `minimum` in the priority ordering
+ */
+export function isPlanAtLeast(current, minimum) {
+    const currentTier = normalizeTierSlug(current);
+    const minimumTier = normalizeTierSlug(minimum);
+    const indexCurrent = currentTier ? planPriorityOrder.indexOf(currentTier) : -1;
+    const indexMinimum = minimumTier ? planPriorityOrder.indexOf(minimumTier) : -1;
+    // An unrecognized current or policy tier is not proof of entitlement.
+    if (!currentTier || !minimumTier || indexCurrent === -1 || indexMinimum === -1)
+        return false;
+    // Catalog ordering must not authorize a different product's entitlements.
+    const currentFamily = TIER_DEFINITIONS[currentTier]?.metadata?.family ?? 'vibes';
+    const minimumFamily = TIER_DEFINITIONS[minimumTier]?.metadata?.family ?? 'vibes';
+    if (currentFamily !== minimumFamily)
+        return false;
+    return indexCurrent >= indexMinimum;
+}
+/**
+ * Check whether the current tier slug is one of the allowed slugs.
+ *
+ * @param current - The user's active tier slug
+ * @param plans   - Array of tier slugs to match against
+ * @returns true if `current` is in `plans`
+ */
+export function isPlanOneOf(current, plans) {
+    const currentTier = normalizeTierSlug(current);
+    if (!currentTier)
+        return plans.includes(current);
+    return plans.some((plan) => plan === current || normalizeTierSlug(plan) === currentTier);
+}
+export function getManagedBillingFeatureLabel(featureSlug) {
+    if (!featureSlug)
+        return null;
+    return MANAGED_BILLING_FEATURES.find((feature) => feature.slug === featureSlug)?.name ?? null;
+}
+export function evaluateBillingGate(input) {
+    const currentPlanSlug = input.currentPlanSlug ?? 'free';
+    const currentTier = normalizeTierSlug(currentPlanSlug);
+    const requiredTier = input.requiredTier ?? null;
+    const normalizedRequiredTier = requiredTier ? normalizeTierSlug(requiredTier) : null;
+    const featureSlug = input.featureSlug ?? null;
+    const featureLabel = input.featureName ?? getManagedBillingFeatureLabel(featureSlug);
+    const quota = input.quota ?? null;
+    // A policy slug is authority, not optional decoration. If it does not map to
+    // a canonical tier, we cannot prove entitlement and must deny the gate.
+    if (requiredTier && !normalizedRequiredTier) {
+        return {
+            allowed: false,
+            reason: 'plan',
+            currentTier,
+            requiredTier,
+            featureSlug,
+            featureLabel,
+            title: 'Access unavailable',
+            message: featureLabel
+                ? `${featureLabel} has an invalid plan requirement. Contact support.`
+                : 'This feature has an invalid plan requirement. Contact support.',
+            upgradeUrl: buildUpgradeUrl({
+                feature: featureSlug,
+                redirect: input.redirect ?? null
+            }),
+            quota
+        };
+    }
+    if (input.anyPaid && !input.hasActiveSubscription) {
+        return {
+            allowed: false,
+            reason: 'subscription',
+            currentTier,
+            requiredTier: normalizedRequiredTier,
+            featureSlug,
+            featureLabel,
+            title: 'Paid plan required',
+            message: featureLabel
+                ? `${featureLabel} requires an active paid plan.`
+                : 'This feature requires an active paid plan.',
+            upgradeUrl: buildUpgradeUrl({
+                plan: normalizedRequiredTier,
+                feature: featureSlug,
+                redirect: input.redirect ?? null
+            }),
+            quota
+        };
+    }
+    if (!input.anyPaid &&
+        normalizedRequiredTier &&
+        !isPlanAtLeast(currentPlanSlug, normalizedRequiredTier)) {
+        return {
+            allowed: false,
+            reason: 'plan',
+            currentTier,
+            requiredTier: normalizedRequiredTier,
+            featureSlug,
+            featureLabel,
+            title: 'Upgrade required',
+            message: featureLabel
+                ? `${featureLabel} requires the ${normalizedRequiredTier} plan or higher.`
+                : `This feature requires the ${normalizedRequiredTier} plan or higher.`,
+            upgradeUrl: featureSlug
+                ? buildUpgradeUrlForFeature(featureSlug, normalizedRequiredTier, input.redirect ?? null)
+                : buildUpgradeUrl({ plan: normalizedRequiredTier, redirect: input.redirect ?? null }),
+            quota
+        };
+    }
+    if (quota && !quota.allowed) {
+        return {
+            allowed: false,
+            reason: 'quota',
+            currentTier,
+            requiredTier: normalizedRequiredTier,
+            featureSlug,
+            featureLabel,
+            title: quota.limit === 0 ? 'Plan limit reached' : 'Usage limit reached',
+            message: buildQuotaDenialMessage(featureLabel, quota),
+            upgradeUrl: featureSlug
+                ? buildUpgradeUrlForFeature(featureSlug, normalizedRequiredTier, input.redirect ?? null)
+                : buildUpgradeUrl({ plan: normalizedRequiredTier, redirect: input.redirect ?? null }),
+            quota
+        };
+    }
+    return {
+        allowed: true,
+        currentTier,
+        requiredTier: normalizedRequiredTier,
+        featureSlug,
+        featureLabel,
+        quota
+    };
+}
+function buildQuotaDenialMessage(featureLabel, quota) {
+    const subject = featureLabel ?? 'This feature';
+    if (quota.limit === 0)
+        return `${subject} is not included in your current plan.`;
+    if (quota.limit === null)
+        return `${subject} is temporarily unavailable for your account.`;
+    return `${subject} has reached the current plan limit of ${quota.limit.toLocaleString('en-US')}.`;
+}
+//# sourceMappingURL=constants.js.map