aegis-desktop 1.0.13 → 1.0.15

package/lib/local/entitlement.js

@@ -1,656 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * entitlement.js — the Pro boundary for the autonomous queue.
- *
- * Phase 4 of docs/upgrade-conversion-plan.md. The queue is the feature people
- * actually pay for, and until this file existed it was 100% free and ungated:
- * `registerQueueIpc` in main.js checked no key, no plan and no quota, so the
- * single most expensive thing this app can do (an unattended task, optionally
- * fanned out across pooled workers) ran forever on the free tier.
- *
- * WHAT IS GATED, AND WHY IT IS THE FAN-OUT. Free keeps everything local: the
- * drain runs on the user's own key, in this process, while the window is open.
- * The *fan-out* is the multiplier — aegis1's pool_brain spawns up to `workers`
- * reasoning workers plus a synthesis pass and re-sends the task context to each
- * (see autonomous.js resolveFanout) — so that is the worker ceiling this module
- * enforces: free = 1 worker (a plain single-pass turn), Pro = the fan-out plus
- * the cloud drain it belongs to. Nothing here changes price, the memory cap or
- * the free-tier definition; it only stops the free tier from spending the Pro
- * tier's multiplier.
- *
- * WHERE THE GATE LIVES. This module is the DECISION; main.js is the DOOR.
- * `registerQueueIpc` consults it, so a renderer that never renders the fan-out
- * control cannot get a fan-out anyway — renderer-side gating is cosmetic and
- * trivially bypassed (any devtools console can call `window.queue.enqueue`).
- * Nothing in the renderer decides entitlement; it displays what main tells it.
- *
- * THE SIGNAL (see the report / the module's `probe`): main injects a probe that
- * calls `aegis.verifyApiKey()` — aegis1 `/api/verify-api-key`, which its own
- * docstring describes as "Verify a shared api_key and return plan/email/
- * memory_token". The plan field is the account's plan, and aegis1 owns the
- * vocabulary for it (`services/billing_service.py`: `TIERS = ("free", "pro",
- * "unlimited")`, `PAID_PLANS = ("pro", "unlimited")`, plus the legacy aliases
- * that normalize onto one of them). This module MIRRORS that vocabulary rather
- * than inventing one; there is no new billing anything here, no new endpoint,
- * and no write to the server. The probe prefers the server's `plan_effective`
- * (its own `is_pro()` verdict, trial included) over the stored `plan` string
- * when it is present, because a welcome-trial account is a real Unlimited
- * entitlement that `users.plan` does not record — see `classifyProbe`.
- *
- * THE BUG THIS VOCABULARY COST (fixed here). `PAID_PLANS` read `("pro",)`,
- * mirroring the retired €2 line and MISSING `unlimited` — the €9/mo tier that
- * is the only one sold. So `normalizePlan('unlimited')` fell through to `free`,
- * and a paying Unlimited subscriber with a spent-out bank was handed the
- * free-tier boundary: the fan-out refused, the cloud drain clamped to one local
- * worker, and a "top up your balance" prompt — for an account whose plan is
- * precisely what pays for the drain. aegis1's own `LEGACY_PLAN_ALIASES` carries
- * the matching warning from the other side ("Deliberately NOT an alias:
- * `unlimited` is a live tier you can subscribe to, so it must resolve through
- * TIERS"), and its `test_tier_vocabulary` pins `PAID_PLANS` at two entries.
- * Two implementations of "is this account paid" had already drifted once; this
- * was the drift.
- *
- * PHASE 6 — THE SECOND SIGNAL, THE BALANCE. The plan is only half of how this
- * product charges. aegis1's actual paywall is the Token Bank running dry: the
- * balance is prepaid EUR the OPERATOR credits by hand, and `app.py` states the
- * consequence plainly — "Pool-key users with token bank balance skip legacy
- * credit checks." So entitlement here is `paid_plan || balance > 0` — and the
- * `paid_plan` half is what carries an Unlimited subscriber whose bank is empty;
- * the bank is an OVERAGE lever, never the thing that decides whether a paying
- * account may use the feature it pays for. When the
- * bank reads zero the wall names the fix that exists (a top-up, campaign
- * `topup_bank`) instead of a plan checkout the user may already own. Nothing in
- * this module grants a balance, expires one, or auto-charges: the operator
- * decides when an account pays, and this file only reads the number they set.
- * An unreadable balance is UNKNOWN, not zero — a network blip must never
- * manufacture a paywall, and only a balance we actually read can be "empty".
- *
- * FAIL CLOSED, AND SAY SO. Every way of not knowing — no key on the machine, an
- * offline/500 probe, a plan string outside the vocabulary — resolves to the
- * free boundary, and the snapshot carries `degraded: true` plus the reason so
- * the UI and the report can be honest about it. The fan-out is real money; an
- * unknown entitlement must not hand it out. The cost is the opposite error (a
- * paying customer offline at that instant is held to one worker for the length
- * of one TTL), which is bounded, visible in the note, and recoverable by
- * re-probing — the next `refresh()` after the TTL flips it back.
- *
- * Pure Node on purpose: no Electron, no network of its own (the probe is
- * injected), and `now` is a seam, so the whole thing is unit-testable —
- * including the bypass path (a renderer asking for workers > 1 while free must
- * be refused HERE, not merely hidden in the UI).
- */
-
-/** The free-tier fan-out ceiling: one worker per task, i.e. a plain turn. */
-const FREE_MAX_WORKERS = 1;
-
-/**
- * Aegis1's paid tiers. MIRROR of services/billing_service.py
- * `PAID_PLANS = ("pro", "unlimited")` — pinned literal on purpose, because this
- * is the line that has to move whenever the server sells another tier.
- *
- * `unlimited` (€9/mo) is the tier ON SALE and the one a paying customer almost
- * certainly owns; `pro` is the grandfathered €2 line, kept because its
- * subscribers keep their entitlements. Reading only `pro` was not a narrower
- * version of this gate, it was a gate pointing at the wrong tier: every
- * Unlimited account fell to the free boundary. `starter` stays out — aegis1
- * itself calls that one free.
- */
-const PAID_PLANS = Object.freeze(['pro', 'unlimited']);
-
-/**
- * What each paid tier is CALLED, so a surface that names the account's plan
- * names the one the server granted. The CLI has read the tier off the server's
- * plan string since 6443a60 (`cli/src/entitlement.js::paymentView`) after it
- * told a €9 subscriber they owned the retired €2 plan; this is the same value,
- * resolved once in the shared module both hosts read.
- */
-const TIER_NAMES = Object.freeze({ pro: 'Pro', unlimited: 'Unlimited' });
-
-/** The display name for a plan string, or null when it is not a paid tier. */
-function tierName(plan) {
-  return TIER_NAMES[normalizePlan(plan)] || null;
-}
-
-/**
- * MIRROR of services/billing_service.py `LEGACY_PLAN_ALIASES`: every stored
- * plan string that normalizes onto a tier. `starter` is free-equivalent by
- * aegis1's own definition — reading it as paid here would hand the fan-out to
- * the one account the server itself treats as free.
- */
-const LEGACY_PLAN_ALIASES = Object.freeze({
-  cloud: 'pro',
-  memory: 'pro',
-  s: 'pro',
-  heavy: 'pro',
-  team: 'pro',
-  starter: 'free',
-});
-
-/**
- * The Pro value, in the words every surface repeats (Phase 3's PAID_PROMISE is
- * the same claim). A refusal that only stated the limit ("max 1 worker") reads
- * as a bug; naming what Pro buys is the whole point of the wall.
- */
-const PRO_VALUE =
-  'Pro puts the drain in the cloud, so the job keeps running after you close the laptop';
-
-/**
- * The honesty line — Phase 3's rule, and the second half of the same claim:
- * everything that runs on the user's own machine stays free forever, and the
- * cloud drain is the thing being sold. Both hosts that print a paid prompt
- * print this beside it (the desktop keeps its own literal in
- * `desktop/renderer/app.js`; the terminal reads it from here), because the
- * promise without the honesty line is the four-bullet feature list again.
- *
- * Kept byte-identical to the renderer's `FREE_HONESTY`, and asserted verbatim
- * by both hosts' tests, so the terminal and the GUI cannot come to disagree
- * about what is free — a disagreement that would either overcharge a promise
- * or undercut the offer, depending on which copy a user believed.
- */
-const FREE_HONESTY =
-  'Everything on your machine is free, permanently. The cloud drain is what you pay for.';
-
-/**
- * The BYOK lane's price, in words — built from the SERVER's published rate.
- *
- * The desktop README says the byok lane is "billed a flat handling fee" and
- * aegis1 charges exactly that (services/pricing.price_byok_call), but no client
- * surface said so: a user who pasted their own Anthropic key into AEGIS read
- * "your provider's cost" and never learned AEGIS adds a fee. That is the one
- * place in this product where the bill and the pitch disagreed, and it is the
- * copy the desktop session flagged as an unresolved honesty conflict.
- *
- * `fee` is aegis1's own `/api/v1/byok/providers` payload — a live payload, never
- * a hardcoded number, for the reason the engine already states: a client that
- * hardcodes a fee is a client that can disagree with the ledger. No published
- * fee (old server, offline, unauthenticated read that returned nothing) returns
- * '' and every host then says NOTHING about the price, which is the only honest
- * alternative to inventing one.
- *
- * `require_account` / `anonymous_daily_calls` come from the same payload and
- * describe enforcement, not price: with the relay requiring an AEGIS account the
- * sentence has to say so, or the user meets a 402 the client never warned about
- * — the exact failure tests/test_byok_fee.py::test_the_published_gate_warning_is
- * _true_whenever_the_gate_can_402 exists to prevent.
- */
-const BYOK_FEE_NOTE =
-  'Bring your own key is relayed through AEGIS, not dialled from here — the routing, prompt assembly and caching are billed as a flat handling fee, on top of your provider\'s own bill.';
-
-/** Per-million-token rendering of a published per-1k rate. */
-function ratePerMillion(usdPer1k) {
-  return `$${(Number(usdPer1k) * 1000).toFixed(2)}/M`;
-}
-
-function byokFeeLine(fee) {
-  const f = fee && typeof fee === 'object' ? fee : null;
-  if (!f) return '';
-  const inRate = Number(f.in_usd_per_1k);
-  const outRate = Number(f.out_usd_per_1k);
-  if (!Number.isFinite(inRate) || !Number.isFinite(outRate)) return '';
-  if (f.disabled === true) {
-    // The deployment switched the fee off; saying "free" is then the truth
-    // rather than a promise this client cannot keep.
-    return 'Bring your own key is relayed free on this deployment right now.';
-  }
-  // The price clause stands alone when the server published no enforcement
-  // detail — which is every server deployed before this change, and the
-  // default-off gate after it. Joined with ' — ' only when there IS a second
-  // clause: a sentence-ending dash with nothing after it ("…provider's bill —.")
-  // is what the first live run of this line actually printed.
-  const price = `Bring your own key: relayed through AEGIS, handled at `
-    + `${ratePerMillion(inRate)} in / ${ratePerMillion(outRate)} out, `
-    + `on top of your provider's bill`;
-  let clause = '';
-  if (f.require_account === true) {
-    clause = 'and needs an AEGIS account key (X-AEGIS-Key) for the fee to be billed';
-  } else {
-    const cap = Number(f.anonymous_daily_calls);
-    if (Number.isFinite(cap) && cap > 0) {
-      clause = `with ${cap} relayed turns/24h before an AEGIS account is required`;
-    }
-  }
-  return clause ? `${price} — ${clause}.` : `${price}.`;
-}
-
-/** Campaign id for this prompt (Phase 1's fixed ids; aegis1 keeps the slug). */
-const CAMPAIGN = 'queue_cap';
-
-/**
- * Where a refusal sends someone. A single-quoted literal so
- * desktop/test/renderer-attribution.test.mjs can see it, and on aegis1's
- * `/go/` route rather than the raw /subscribe path: `/go/` owns utm_source and
- * utm_medium and maps `s`/`c` onto them, and `c=queue_cap` is what makes this
- * click attributable to the refusal that produced it. Appending utm_* here
- * would be a silent zero (aegis1 go_short_link() documents it) — the route
- * finds no `s`, files the click as 'direct', and the link still works.
- */
-const UPGRADE_URL = 'https://aegiscloud.org/go/upgrade?s=desktop&c=queue_cap';
-
-/**
- * The BALANCE wall (Phase 6). Aegis1's paywall is not a feature tier — it is
- * the Token Bank running dry. `balance_micros` is a prepaid EUR balance
- * (db.py), the operator credits it by hand, and aegis1 says the consequence
- * out loud in app.py: "Pool-key users with token bank balance skip legacy
- * credit checks." So the truthful trigger is balance == 0, and the money path
- * that fixes it is a TOP-UP, not a plan checkout.
- *
- * Campaign is `topup_bank` — the id Phase 1 already reserved for
- * "top-up / bank / balance surfaces" (desktop/renderer/app.js). Reusing it
- * rather than minting a sixth id keeps the documented list in the plan and the
- * code-level list in the renderer from drifting; a new id in one place and not
- * the other is exactly the silent-zero failure this project keeps hitting.
- */
-const BALANCE_CAMPAIGN = 'topup_bank';
-
-/** Where the balance wall sends someone: `/go/topup` (aegis1's `/go/<page>`
- *  route handles both pages), same `s=desktop` requirement as UPGRADE_URL. */
-const BALANCE_URL = 'https://aegiscloud.org/go/topup?s=desktop&c=topup_bank';
-
-/**
- * HOST SEAM — the one thing that had to change for the terminal to reuse this
- * module (Phase 7).
- *
- * This file is no longer desktop-only: `cli/src/autonomous.js` gates the SAME
- * fan-out through the SAME decision, because the paid multiplier must not cost
- * money in one host and be free in another. But the two hosts are not the same
- * channel: a click from the terminal is a `cli` conversion and a click from the
- * GUI is a `desktop` one, and aegis1 files whatever `s` it is given.
- *
- * The URLs above are literals (`s=desktop`), so a CLI refusal printing one
- * would file every terminal click as a desktop one — silently, in the worst
- * available way, since the link still works and the only thing it destroys is
- * the number. That is the same failure `/go/` exists to prevent, so it gets the
- * same treatment: the channel is a parameter, and `host` (NOT `source`, which
- * already means "where this verdict came from" in the snapshot) is what
- * selects it.
- *
- * `SIGNUP_SOURCES` mirrors aegis1's accepted set. An unknown host is not sent:
- * it falls back to the desktop default rather than minting a source the server
- * will file as 'direct' — a wrong datapoint is worse than a missing one.
- */
-const SIGNUP_SOURCES = Object.freeze(['desktop', 'cli', 'mcp']);
-const DEFAULT_HOST = 'desktop';
-
-/** aegis1's `/go/<page>` short form, for a DIFFERENT channel than the literals
- *  above. `page` is `upgrade` or `topup`; the wire names (utm_*) are never sent
- *  here — `/go/` reads `s`/`c` and re-emits them itself (signup.js documents the
- *  measured difference). */
-function goUrl(page, campaign, host) {
-  const slug = String(host == null ? '' : host).trim().toLowerCase();
-  const s = SIGNUP_SOURCES.includes(slug) ? slug : DEFAULT_HOST;
-  return `https://aegiscloud.org/go/${String(page).trim().toLowerCase()}?s=${s}&c=${campaign}`;
-}
-
-/** The campaign-tagged prompt URL for one host: the same page and campaign as
- *  the literals, filed under `host`'s channel. */
-function promptUrlFor(host) {
-  return {
-    upgrade: goUrl('upgrade', CAMPAIGN, host),
-    balance: goUrl('topup', BALANCE_CAMPAIGN, host),
-  };
-}
-
-/** How long a resolved snapshot is trusted before the next probe. The probe is
- *  one small POST; a minute is short enough that a fresh purchase unlocks the
- *  card on the next refresh and long enough that a drain never probes per task. */
-const DEFAULT_TTL_MS = 60 * 1000;
-
-/** Collapse any stored/alias plan string onto a tier, exactly as aegis1 does.
- *
- *  Aegis1 checks its live `TIERS` BEFORE the alias table (`normalize_plan`), so
- *  an alias can never shadow a tier it also names — and `unlimited` is a live
- *  tier. It is therefore returned as itself and never collapsed onto `pro`: the
- *  two grant different entitlements server-side (the monthly Unlimited
- *  allowance and the BYOK fee waiver are `is_unlimited()`-gated), and telling a
- *  €9 customer they own the retired €2 plan is the mistake commit 6443a60
- *  exists to record.
- */
-function normalizePlan(plan) {
-  const raw = String(plan == null ? '' : plan).trim().toLowerCase();
-  if (!raw) return 'free';
-  if (PAID_PLANS.includes(raw)) return raw;
-  const aliased = LEGACY_PLAN_ALIASES[raw];
-  return aliased || 'free';
-}
-
-/** The sentence a user types to route a task to the drain — quoted verbatim in
- *  every refusal and in the CLI's promotion block, so the two hosts cannot
- *  drift into two different instructions. */
-const ASK_EXAMPLE = 'Do X autonomously';
-
-/** True only for a tier aegis1 itself would call paid (`pro` or `unlimited`). */
-function isPaidPlan(plan) {
-  return normalizePlan(plan) !== 'free';
-}
-
-/**
- * The refusal, as the sentence a user reads. Names the Pro value (the cloud
- * drain surviving app close), not just the ceiling, and carries the campaign
- * id in the link it is paired with (see `gateFanout`'s `upgradeUrl`).
- */
-function fanoutRefusal() {
-  return (
-    `Fan-out needs Pro: ${PRO_VALUE}. ` +
-    // The ask, in the message, as the sentence to write — the CLI prints the
-    // same two lines (`cli/src/autonomous.js`), so a user who meets this wall
-    // in either host reads one instruction, not two vocabularies. `autonomously`
-    // is the word the queue actually routes on (queue.js stores the inverse as
-    // `singlePass`), which is why the example quotes it verbatim instead of
-    // naming the feature.
-    `Write it in the message: "${ASK_EXAMPLE}". ` +
-    'Unlock: Pro, or any Token Bank balance. ' +
-    'Free keeps the local drain on your own key — one worker per task, while this window is open.'
-  );
-}
-
-/**
- * The refusal when the account's BANK is empty rather than its plan being
- * free. Still exactly one reason to pay (PRO_VALUE — Phase 3's rule: a refusal
- * that pitches something else is a second, competing offer at the moment the
- * first is declined), and it names the fix that actually exists: top the bank
- * up. "Your AEGIS balance is empty." is already aegis1's own string for this
- * state (translations.py), so the two surfaces say the same sentence.
- */
-function balanceRefusal() {
-  return (
-    'Your AEGIS balance is empty — ' +
-    `${PRO_VALUE}. ` +
-    // Same ask as the plan wall, but the unlock line follows THIS wall: the
-    // bank is empty, so topping it up is the action that clears it. Naming only
-    // "upgrade to Pro" would send a user who already owns Pro (and simply spent
-    // the bank) to a checkout for a plan they have — the exact confusion this
-    // module exists to remove. Kept symmetric with `fanoutRefusal` otherwise.
-    `Write it in the message: "${ASK_EXAMPLE}". ` +
-    'Unlock: top up the Token Bank, or upgrade to Pro. ' +
-    'Local drains stay free: one worker per task, on your own key, while this window is open.'
-  );
-}
-
-/**
- * The account's bank, from whatever shape the probe answered.
- *
- * aegis1's `/api/token-bank/balance` returns `balance_eur` (micros stay
- * internal — its own docstring says so), and that value is ROUNDED to cents
- * before it is sent. 0.004 EUR therefore arrives as 0 and reads as empty;
- * that is the server's rounding, not this module's, and it is the safe
- * direction for a wall (it charges nothing, it only withholds the multiplier).
- *
- * `balanceKnown: false` is the important state: a probe that did not report a
- * balance has NOT proven the bank is funded, so it must not unlock anything.
- * Fail closed, same as the plan signal.
- *
- * The returned keys are `balanceKnown` / `balanceMicros` — deliberately the
- * SAME names `fromProbe` destructures, because these are spread straight into
- * `classifyProbe`'s result (`...bal`). They were once `known` / `micros`, and
- * the mismatch made every funded bank read as `undefined` → not banked, so the
- * operator's lever silently did nothing. Keep these names in lockstep with the
- * `...bal` spreads below; the test asserts the exact shape.
- */
-function balanceOf(body) {
-  if (!body || typeof body !== 'object') return { balanceKnown: false, balanceMicros: null };
-  let raw = null;
-  if (body.balance_micros != null) raw = Number(body.balance_micros);
-  else if (body.balance_eur != null) raw = Number(body.balance_eur) * 1_000_000;
-  if (raw == null || !Number.isFinite(raw)) return { balanceKnown: false, balanceMicros: null };
-  return { balanceKnown: true, balanceMicros: Math.trunc(raw) };
-}
-
-/**
- * Coerce a probe's answer into the three states this module cares about.
- *
- * The probe resolves aegis1's `{ valid, plan }` for a good key. A missing key
- * comes back as HTTP 400 `api_key required` (or resolves `valid: false`), which
- * is not a failure — it is the definitive "this install is free". Everything
- * else that did not produce a plan is `unreachable`, which also lands on the
- * free boundary but is a different FACT and must stay distinguishable in the
- * snapshot (a report that cannot tell "free" from "could not ask" is guessing).
- */
-function classifyProbe(result, error) {
-  if (error) {
-    const bal = balanceOf(error && error.data);
-    const status = error.status;
-    const data = (error && error.data) || {};
-    const code = String(data.error || data.code || '');
-    const message = String((error && error.message) || '');
-    if (status === 400 || status === 401 || /api_key required|invalid api key|unauthor/i.test(`${code} ${message}`)) {
-      return { source: 'no-key', plan: 'free', degraded: false, ...bal };
-    }
-    return { source: 'unreachable', plan: 'free', degraded: true, ...bal };
-  }
-  const body = result && typeof result === 'object' ? result : {};
-  const bal = balanceOf(body);
-  if (body.valid === false) return { source: 'no-key', plan: 'free', degraded: false, ...bal };
-  // WHICH plan field. `plan_effective` is aegis1's own entitlement verdict —
-  // the same predicate its `is_pro()` gates pooled calls on, so it counts the
-  // 30-day welcome trial that never writes `users.plan` (see app.py's
-  // register_device: the trial lives in `subscriptions`). The stored `plan`
-  // column cannot express that account, so an installing user read as `free`
-  // here and only the €12 signup credit kept the gate open — spend it, or fail
-  // to receive it, and a real Unlimited account was refused the feature. The
-  // stored string is still the fallback: an older server that predates the
-  // field must keep working, and it is the same value when nothing is on trial.
-  const rawPlan = body.plan_effective != null && String(body.plan_effective).trim()
-    ? body.plan_effective
-    : body.plan;
-  const stated = String(rawPlan == null ? '' : rawPlan).trim();
-  if (!stated) {
-    // A key that verified but carried no plan: aegis1's own default for such an
-    // account is `free` (the column default), and a missing field is not proof
-    // of payment — so this is the free boundary, marked as not proven.
-    return { source: 'no-plan-field', plan: 'free', degraded: true, ...bal };
-  }
-  // The server STATED a plan, so the verdict is proven — free or paid.
-  // `degraded` means "no real answer" (timeout, no plan field, no key); a stated
-  // `free` IS an answer. This was once `degraded: !known`, where `known` meant
-  // "is this a PAID plan" — so every honestly-free account was marked degraded,
-  // and every promotion path that requires `degraded === false` (the CLI's
-  // per-drain upsell, the desktop's refusal link) went silent. The gate then
-  // withheld the fan-out and never said how to pay for it: it charged nothing
-  // and converted nobody. Unknown plan strings still normalize to `free`, so the
-  // money direction stays fail-closed.
-  return { source: 'server-plan', plan: normalizePlan(stated), degraded: false, ...bal };
-}
-
-/**
- * The gate. `probe` is injected (main.js passes the shared client's
- * verifyApiKey; tests pass a stub), so this module never touches the network
- * itself and every branch below is reachable in a unit test.
- */
-function createEntitlement({
-  probe,
-  now = Date.now,
-  ttlMs = DEFAULT_TTL_MS,
-  // The CHANNEL the prompts in this instance link to. 'desktop' by default so
-  // every existing caller is unchanged; `cli/src/entitlement.js` passes 'cli'.
-  host = DEFAULT_HOST,
-} = {}) {
-  const urls = promptUrlFor(host);
-  // Start at the free boundary, not at Pro. Until a probe has answered, nothing
-  // has been paid for — and `current()` (the sync read the drain clamp uses) is
-  // never allowed to be optimistic.
-  let snapshot = Object.freeze({
-    pro: false,
-    entitled: false,
-    balanceKnown: false,
-    balanceMicros: null,
-    balanceZero: false,
-    wall: 'plan',
-    plan: 'free',
-    tier: null,
-    tierName: null,
-    planRaw: null,
-    maxWorkers: FREE_MAX_WORKERS,
-    source: 'unresolved',
-    degraded: true,
-    checkedAt: null,
-    campaign: CAMPAIGN,
-    host: SIGNUP_SOURCES.includes(String(host).toLowerCase()) ? String(host).toLowerCase() : DEFAULT_HOST,
-    upgradeUrl: urls.upgrade,
-    refusal: null,
-  });
-  let inflight = null;
-
-  function fromProbe({ source, plan, degraded, planRaw, balanceKnown = false, balanceMicros = null }) {
-    // The tier itself, not a paid/not-paid bit: `unlimited` and `pro` are both
-    // paid and must stay distinguishable, because the surfaces that name the
-    // account's plan (the desktop's queue boundary, the CLI's `/billing`) name
-    // the one the server granted. `pro` below keeps its original meaning — "the
-    // PLAN is paid for", as opposed to a free plan carried by a funded bank.
-    const tier = normalizePlan(plan);
-    const pro = tier !== 'free';
-    const banked = balanceKnown && Number.isFinite(balanceMicros) && balanceMicros > 0;
-    // TWO independent ways to be paid for: a paid plan, or a funded bank. The
-    // operator controls the second by hand (aegis1 admin `add_funds`), which is
-    // the lever this wall is built around — nothing here grants, times out or
-    // auto-charges; it only reads the number the operator set. The FIRST way is
-    // the one a paying subscriber holds, and it does not weaken when their bank
-    // runs dry: the balance is overage, the subscription is the entitlement.
-    const entitled = pro || banked;
-    // The bank was READABLE and EMPTY — the operator's own signal that this
-    // account is now paying, not the absence of a plan.
-    const balanceZero = balanceKnown && !banked;
-    // Which wall to print. Entitled accounts get none. An account whose bank we
-    // read and found empty gets the TOP-UP wall, because topping up is the
-    // action that actually clears it. Everything else — unknown balance, no
-    // key, unreachable probe — gets the PLAN wall: we have not proven the bank
-    // is the problem, and a top-up prompt we cannot justify is a dark pattern.
-    const wall = entitled ? null : (balanceZero ? 'balance' : 'plan');
-    return Object.freeze({
-      pro,
-      entitled,
-      balanceKnown: Boolean(balanceKnown),
-      balanceMicros: balanceKnown ? balanceMicros : null,
-      balanceZero,
-      wall,
-      // The tier a paid PLAN grants, else `free`. A funded bank on a free plan
-      // is still `free` here — the bank is not a tier, and naming one would put
-      // a plan on the account the server never granted.
-      plan: pro ? tier : 'free',
-      tier: pro ? tier : null,
-      tierName: pro ? (TIER_NAMES[tier] || null) : null,
-      planRaw: planRaw == null ? null : String(planRaw),
-      // A paid session has no ceiling of its own here: main.js still clamps the
-      // renderer's number to QUEUE_MAX_WORKERS, which stays the only upper bound.
-      maxWorkers: entitled ? null : FREE_MAX_WORKERS,
-      source,
-      // `degraded` means "this verdict was not proven by the server" — for a
-      // paid verdict that is impossible (a plan string or a funded bank is what
-      // proves it), so it only ever marks a free boundary we could not confirm.
-      degraded: Boolean(degraded),
-      checkedAt: now(),
-      campaign: wall === 'balance' ? BALANCE_CAMPAIGN : CAMPAIGN,
-      upgradeUrl: wall === 'balance' ? urls.balance : urls.upgrade,
-      refusal: entitled ? null : (wall === 'balance' ? balanceRefusal() : fanoutRefusal()),
-    });
-  }
-
-  /**
-   * Re-probe (or return the cached verdict while it is fresh). Never throws:
-   * a probe that fails IS an answer here (`unreachable` → free boundary).
-   */
-  async function refresh({ force = false } = {}) {
-    const fresh = snapshot.checkedAt != null && now() - snapshot.checkedAt < ttlMs;
-    if (fresh && !force) return snapshot;
-    if (inflight) return inflight;
-    inflight = (async () => {
-      if (typeof probe !== 'function') {
-        snapshot = fromProbe({ source: 'no-probe', plan: 'free', degraded: true });
-        return snapshot;
-      }
-      try {
-        const answer = await probe();
-        const c = classifyProbe(answer, null);
-        snapshot = fromProbe({ ...c, planRaw: answer && answer.plan });
-      } catch (err) {
-        const c = classifyProbe(null, err);
-        snapshot = fromProbe(c);
-      }
-      return snapshot;
-    })();
-    try {
-      return await inflight;
-    } finally {
-      inflight = null;
-    }
-  }
-
-  /** The cached verdict, synchronously. Never probes — this is the read the
-   *  drain clamp makes on the hot path, and an optimistic answer would be a
-   *  free fan-out. */
-  function current() {
-    return snapshot;
-  }
-
-  /**
-   * THE GATE. Decide what a renderer's enqueue payload may do.
-   *
-   * `workers` is the number the renderer asked for (`null` = "no pick"), and
-   * `fanout` is its explicit fan-me-out flag. Either one naming more than one
-   * worker is a fan-out request, and a fan-out request from a non-Pro session
-   * is REFUSED — not silently clamped, because the request came from a control
-   * that is supposed to mean something, and a silent downgrade reads as a bug
-   * while teaching the user nothing. (A fan-out already sitting in the queue
-   * file — the CLI, a hand-edited queue.jsonl — is the other case: that one is
-   * clamped to a single pass at drain time, see main.js's `canFanOut`.)
-   */
-  function gateFanout({ workers, fanout } = {}) {
-    const requested = Number.isInteger(workers) ? workers : null;
-    const wantsFanout = fanout === true || (requested != null && requested > FREE_MAX_WORKERS);
-    if (!wantsFanout) return { ok: true, workers: requested, fanout: Boolean(fanout) };
-    if (snapshot.entitled) return { ok: true, workers: requested, fanout: true };
-    return {
-      ok: false,
-      // The code names WHICH wall, because the two have different fixes: an
-      // empty bank is topped up, a free plan is upgraded. A caller that showed
-      // the same message for both would be sending half its users to the wrong
-      // checkout, which is the exact confusion this phase exists to remove.
-      code: snapshot.wall === 'balance' ? 'fanout_requires_balance' : 'fanout_requires_pro',
-      reason: snapshot.refusal || fanoutRefusal(),
-      campaign: snapshot.campaign,
-      upgradeUrl: snapshot.upgradeUrl,
-      wall: snapshot.wall,
-      pro: false,
-      entitled: false,
-      maxWorkers: FREE_MAX_WORKERS,
-      entitlement: snapshot,
-    };
-  }
-
-  return { refresh, current, gateFanout };
-}
-
-module.exports = {
-  createEntitlement,
-  normalizePlan,
-  isPaidPlan,
-  tierName,
-  TIER_NAMES,
-  classifyProbe,
-  fanoutRefusal,
-  balanceRefusal,
-  ASK_EXAMPLE,
-  balanceOf,
-  FREE_MAX_WORKERS,
-  PAID_PLANS,
-  LEGACY_PLAN_ALIASES,
-  CAMPAIGN,
-  UPGRADE_URL,
-  BALANCE_CAMPAIGN,
-  BALANCE_URL,
-  PRO_VALUE,
-  FREE_HONESTY,
-  BYOK_FEE_NOTE,
-  byokFeeLine,
-  DEFAULT_TTL_MS,
-  // Phase 7: the host seam + the builder the CLI binds itself to.
-  SIGNUP_SOURCES,
-  DEFAULT_HOST,
-  goUrl,
-  promptUrlFor,
-};
+"use strict";const FREE_MAX_WORKERS=1,PAID_PLANS=Object.freeze(["pro","unlimited"]),TIER_NAMES=Object.freeze({pro:"Pro",unlimited:"Unlimited"});function tierName(e){return TIER_NAMES[normalizePlan(e)]||null}const LEGACY_PLAN_ALIASES=Object.freeze({cloud:"pro",memory:"pro",s:"pro",heavy:"pro",team:"pro",starter:"free"}),PRO_VALUE="Pro puts the drain in the cloud, so the job keeps running after you close the laptop",FREE_HONESTY="Everything on your machine is free, permanently. The cloud drain is what you pay for.",BYOK_FEE_NOTE="Bring your own key is relayed through AEGIS, not dialled from here — the routing, prompt assembly and caching are billed as a flat handling fee, on top of your provider's own bill.";function ratePerMillion(e){return`$${(1e3*Number(e)).toFixed(2)}/M`}function byokFeeLine(e){const n=e&&"object"==typeof e?e:null;if(!n)return"";const r=Number(n.in_usd_per_1k),a=Number(n.out_usd_per_1k);if(!Number.isFinite(r)||!Number.isFinite(a))return"";if(!0===n.disabled)return"Bring your own key is relayed free on this deployment right now.";const o=`Bring your own key: relayed through AEGIS, handled at ${ratePerMillion(r)} in / ${ratePerMillion(a)} out, on top of your provider's bill — no fee at all on Unlimited, and no fee at all during the free 1-month Unlimited trial`;let l="";if(!0===n.require_account)l="and needs an AEGIS account key (X-AEGIS-Key) for the fee to be billed";else{const e=Number(n.anonymous_daily_calls);Number.isFinite(e)&&e>0&&(l=`with ${e} relayed turns/24h before an AEGIS account is required`)}return l?`${o} — ${l}.`:`${o}.`}const CAMPAIGN="queue_cap",UPGRADE_URL="https://aegiscloud.org/go/upgrade?s=desktop&c=queue_cap",BALANCE_CAMPAIGN="topup_bank",BALANCE_URL="https://aegiscloud.org/go/topup?s=desktop&c=topup_bank",SIGNUP_SOURCES=Object.freeze(["desktop","cli","mcp"]),DEFAULT_HOST="desktop";function goUrl(e,n,r){const a=String(null==r?"":r).trim().toLowerCase(),o=SIGNUP_SOURCES.includes(a)?a:DEFAULT_HOST;return`https://aegiscloud.org/go/${String(e).trim().toLowerCase()}?s=${o}&c=${n}`}function promptUrlFor(e){return{upgrade:goUrl("upgrade",CAMPAIGN,e),balance:goUrl("topup",BALANCE_CAMPAIGN,e)}}const DEFAULT_TTL_MS=6e4;function normalizePlan(e){const n=String(null==e?"":e).trim().toLowerCase();return n?PAID_PLANS.includes(n)?n:LEGACY_PLAN_ALIASES[n]||"free":"free"}const ASK_EXAMPLE="Do X autonomously";function isPaidPlan(e){return"free"!==normalizePlan(e)}function fanoutRefusal(){return`Fan-out needs Pro: ${PRO_VALUE}. Write it in the message: "${ASK_EXAMPLE}". Unlock: Pro, or any Token Bank balance. Free keeps the local drain on your own key — one worker per task, while this window is open.`}function balanceRefusal(){return`Your AEGIS balance is empty — ${PRO_VALUE}. Write it in the message: "${ASK_EXAMPLE}". Unlock: top up the Token Bank, or upgrade to Pro. Local drains stay free: one worker per task, on your own key, while this window is open.`}function balanceOf(e){if(!e||"object"!=typeof e)return{balanceKnown:!1,balanceMicros:null};let n=null;return null!=e.balance_micros?n=Number(e.balance_micros):null!=e.balance_eur&&(n=1e6*Number(e.balance_eur)),null!=n&&Number.isFinite(n)?{balanceKnown:!0,balanceMicros:Math.trunc(n)}:{balanceKnown:!1,balanceMicros:null}}function classifyProbe(e,n){if(n){const e=balanceOf(n&&n.data),r=n.status,a=n&&n.data||{},o=String(a.error||a.code||""),l=String(n&&n.message||"");return 400===r||401===r||/api_key required|invalid api key|unauthor/i.test(`${o} ${l}`)?{source:"no-key",plan:"free",degraded:!1,...e}:{source:"unreachable",plan:"free",degraded:!0,...e}}const r=e&&"object"==typeof e?e:{},a=balanceOf(r);if(!1===r.valid)return{source:"no-key",plan:"free",degraded:!1,...a};const o=null!=r.plan_effective&&String(r.plan_effective).trim()?r.plan_effective:r.plan,l=String(null==o?"":o).trim();return l?{source:"server-plan",plan:normalizePlan(l),degraded:!1,...a}:{source:"no-plan-field",plan:"free",degraded:!0,...a}}function createEntitlement({probe:e,now:n=Date.now,ttlMs:r=6e4,host:a=DEFAULT_HOST}={}){const o=promptUrlFor(a);let l=Object.freeze({pro:!1,entitled:!1,balanceKnown:!1,balanceMicros:null,balanceZero:!1,wall:"plan",plan:"free",tier:null,tierName:null,planRaw:null,maxWorkers:1,source:"unresolved",degraded:!0,checkedAt:null,campaign:CAMPAIGN,host:SIGNUP_SOURCES.includes(String(a).toLowerCase())?String(a).toLowerCase():DEFAULT_HOST,upgradeUrl:o.upgrade,refusal:null}),t=null;function i({source:e,plan:r,degraded:a,planRaw:l,balanceKnown:t=!1,balanceMicros:i=null}){const u=normalizePlan(r),c="free"!==u,s=t&&Number.isFinite(i)&&i>0,d=c||s,f=t&&!s,p=d?null:f?"balance":"plan";return Object.freeze({pro:c,entitled:d,balanceKnown:Boolean(t),balanceMicros:t?i:null,balanceZero:f,wall:p,plan:c?u:"free",tier:c?u:null,tierName:c&&TIER_NAMES[u]||null,planRaw:null==l?null:String(l),maxWorkers:d?null:1,source:e,degraded:Boolean(a),checkedAt:n(),campaign:"balance"===p?BALANCE_CAMPAIGN:CAMPAIGN,upgradeUrl:"balance"===p?o.balance:o.upgrade,refusal:d?null:"balance"===p?balanceRefusal():fanoutRefusal()})}return{refresh:async function({force:a=!1}={}){if(null!=l.checkedAt&&n()-l.checkedAt<r&&!a)return l;if(t)return t;t=(async()=>{if("function"!=typeof e)return l=i({source:"no-probe",plan:"free",degraded:!0}),l;try{const n=await e(),r=classifyProbe(n,null);l=i({...r,planRaw:n&&n.plan})}catch(e){const n=classifyProbe(null,e);l=i(n)}return l})();try{return await t}finally{t=null}},current:function(){return l},gateFanout:function({workers:e,fanout:n}={}){const r=Number.isInteger(e)?e:null;return!0===n||null!=r&&r>1?l.entitled?{ok:!0,workers:r,fanout:!0}:{ok:!1,code:"balance"===l.wall?"fanout_requires_balance":"fanout_requires_pro",reason:l.refusal||fanoutRefusal(),campaign:l.campaign,upgradeUrl:l.upgradeUrl,wall:l.wall,pro:!1,entitled:!1,maxWorkers:1,entitlement:l}:{ok:!0,workers:r,fanout:Boolean(n)}}}}module.exports={createEntitlement:createEntitlement,normalizePlan:normalizePlan,isPaidPlan:isPaidPlan,tierName:tierName,TIER_NAMES:TIER_NAMES,classifyProbe:classifyProbe,fanoutRefusal:fanoutRefusal,balanceRefusal:balanceRefusal,ASK_EXAMPLE:ASK_EXAMPLE,balanceOf:balanceOf,FREE_MAX_WORKERS:1,PAID_PLANS:PAID_PLANS,LEGACY_PLAN_ALIASES:LEGACY_PLAN_ALIASES,CAMPAIGN:CAMPAIGN,UPGRADE_URL:UPGRADE_URL,BALANCE_CAMPAIGN:BALANCE_CAMPAIGN,BALANCE_URL:BALANCE_URL,PRO_VALUE:PRO_VALUE,FREE_HONESTY:FREE_HONESTY,BYOK_FEE_NOTE:BYOK_FEE_NOTE,byokFeeLine:byokFeeLine,DEFAULT_TTL_MS:6e4,SIGNUP_SOURCES:SIGNUP_SOURCES,DEFAULT_HOST:DEFAULT_HOST,goUrl:goUrl,promptUrlFor:promptUrlFor};