diff --git a/apps/studio/src/worker/auth.ts b/apps/studio/src/worker/auth.ts
index 2dfefa0..c2f4c78 100644
--- a/apps/studio/src/worker/auth.ts
+++ b/apps/studio/src/worker/auth.ts
@@ -23,6 +23,24 @@ export interface Env extends AnalyticsEnv {
EMAIL_FROM?: string;
GOOGLE_CLIENT_ID?: string;
GOOGLE_CLIENT_SECRET?: string;
+ /**
+ * "on" only on the hosted Studio: plans, limits, fetch metering and Stripe (src/worker/plans.ts,
+ * billing.ts). Unset, as on every self-hosted Studio, there are no limits and no billing.
+ */
+ BILLING?: string;
+ STRIPE_SECRET_KEY?: string;
+ STRIPE_WEBHOOK_SECRET?: string;
+ STRIPE_PRICE_PRO_MONTH?: string;
+ STRIPE_PRICE_PRO_YEAR?: string;
+ STRIPE_PRICE_TEAM_MONTH?: string;
+ STRIPE_PRICE_TEAM_YEAR?: string;
+ /** The founding offer: a coupon at 50% off, forever, for at most 100 redemptions. */
+ STRIPE_COUPON_FOUNDING?: string;
+ /** Workers Analytics Engine: one data point per fetch by key, rolled up by the cron. */
+ FETCHES?: AnalyticsEngineDataset;
+ /** For the rollup to read Analytics Engine back: the account, and a token with Account Analytics Read. */
+ CF_ACCOUNT_ID?: string;
+ CF_ANALYTICS_TOKEN?: string;
}
export interface User {
@@ -109,9 +127,10 @@ export async function userFromRequest(c: Ctx, auth: Auth): Promise<{ user: User
const bearer = c.req.header("authorization")?.match(/^Bearer (pxs_[a-f0-9]+)$/)?.[1];
if (bearer) {
const hash = await sha256(bearer);
- const key = await c.env.DB.prepare("SELECT id, workspace_id, created_by FROM api_keys WHERE key_hash = ?").bind(hash).first<{ id: string; workspace_id: string; created_by: string }>();
+ const key = await c.env.DB.prepare("SELECT id, workspace_id, created_by, last_used_at FROM api_keys WHERE key_hash = ?").bind(hash).first<{ id: string; workspace_id: string; created_by: string; last_used_at: string | null }>();
if (!key) return { user: null, apiWorkspace: null };
- await c.env.DB.prepare("UPDATE api_keys SET last_used_at = ? WHERE id = ?").bind(now(), key.id).run();
+ // A product fetches by key on every request; "last used" to the hour is enough, and saves a write each time.
+ if (!key.last_used_at || Date.parse(key.last_used_at) < Date.now() - 3600e3) await c.env.DB.prepare("UPDATE api_keys SET last_used_at = ? WHERE id = ?").bind(now(), key.id).run();
const user = await c.env.DB.prepare("SELECT id, email, name FROM user WHERE id = ?").bind(key.created_by).first
();
return { user, apiWorkspace: key.workspace_id };
}
diff --git a/apps/studio/src/worker/billing.ts b/apps/studio/src/worker/billing.ts
new file mode 100644
index 0000000..5605de6
--- /dev/null
+++ b/apps/studio/src/worker/billing.ts
@@ -0,0 +1,186 @@
+/**
+ * Stripe, through its REST API with fetch (no SDK: a form-encoded POST is all Checkout, the
+ * Customer Portal and a seat change need). Checkout makes the subscription; the webhook is the
+ * only thing that changes a workspace's plan. Prices and the founding coupon come from env, so
+ * test mode and live mode differ only in configuration.
+ */
+import type { Env } from "./auth.ts";
+import { billingOn, editorCount, overQuotaSince, periodOf, type Plan } from "./plans.ts";
+
+export type Interval = "month" | "year";
+export const stripeOn = (env: Env) => billingOn(env) && !!env.STRIPE_SECRET_KEY;
+
+export class StripeError extends Error {
+ status: number;
+ code?: string;
+ param?: string;
+ constructor(status: number, message: string, code?: string, param?: string) {
+ super(message);
+ this.status = status;
+ this.code = code;
+ this.param = param;
+ }
+}
+
+/** Stripe's form encoding: nested objects and lists as metadata[workspace_id], line_items[0][price]. */
+export function form(params: Record, into = new URLSearchParams(), prefix = ""): URLSearchParams {
+ for (const [k, v] of Object.entries(params)) {
+ if (v === undefined || v === null) continue;
+ const key = prefix ? `${prefix}[${k}]` : k;
+ if (Array.isArray(v)) v.forEach((item, i) => (typeof item === "object" && item !== null ? form(item as Record, into, `${key}[${i}]`) : into.append(`${key}[${i}]`, String(item))));
+ else if (typeof v === "object") form(v as Record, into, key);
+ else into.append(key, String(v));
+ }
+ return into;
+}
+
+export async function stripe>(env: Env, method: "GET" | "POST", path: string, params?: Record): Promise {
+ const encoded = params ? form(params).toString() : "";
+ const url = `https://api.stripe.com/v1${path}${method === "GET" && encoded ? `?${encoded}` : ""}`;
+ const r = await fetch(url, {
+ method,
+ headers: { authorization: `Bearer ${env.STRIPE_SECRET_KEY}`, ...(method === "POST" ? { "content-type": "application/x-www-form-urlencoded" } : {}) },
+ body: method === "POST" ? encoded : undefined,
+ });
+ const data = (await r.json().catch(() => ({}))) as { error?: { message?: string; code?: string; param?: string } };
+ if (!r.ok) throw new StripeError(r.status, data.error?.message ?? `Stripe answered ${r.status}`, data.error?.code, data.error?.param);
+ return data as T;
+}
+
+export function priceFor(env: Env, plan: "pro" | "team", interval: Interval): string | undefined {
+ return { pro: { month: env.STRIPE_PRICE_PRO_MONTH, year: env.STRIPE_PRICE_PRO_YEAR }, team: { month: env.STRIPE_PRICE_TEAM_MONTH, year: env.STRIPE_PRICE_TEAM_YEAR } }[plan][interval];
+}
+
+export function planOfPrice(env: Env, price: string): { plan: Plan; interval: Interval } | null {
+ const table: [string | undefined, Plan, Interval][] = [
+ [env.STRIPE_PRICE_PRO_MONTH, "pro", "month"],
+ [env.STRIPE_PRICE_PRO_YEAR, "pro", "year"],
+ [env.STRIPE_PRICE_TEAM_MONTH, "team", "month"],
+ [env.STRIPE_PRICE_TEAM_YEAR, "team", "year"],
+ ];
+ const hit = table.find(([id]) => id && id === price);
+ return hit ? { plan: hit[1], interval: hit[2] } : null;
+}
+
+const hex = (buf: ArrayBuffer) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+
+/**
+ * Stripe-Signature: t=,v1=[,v1=…]. Checked with Web
+ * Crypto against the endpoint's secret, compared in constant time, and refused when older than
+ * the tolerance so a captured request can't be replayed later.
+ */
+export async function verifySignature(payload: string, header: string | undefined, secret: string, tolerance = 300, nowSec = Math.floor(Date.now() / 1000)): Promise {
+ if (!header) return false;
+ const parts = header.split(",").map((p) => p.trim().split("="));
+ const t = Number(parts.find(([k]) => k === "t")?.[1]);
+ const sigs = parts.filter(([k]) => k === "v1").map(([, v]) => v);
+ if (!Number.isFinite(t) || !sigs.length || Math.abs(nowSec - t) > tolerance) return false;
+ const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+ const expected = hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${payload}`)));
+ return sigs.some((s) => {
+ if (s.length !== expected.length) return false;
+ let diff = 0;
+ for (let i = 0; i < s.length; i++) diff |= s.charCodeAt(i) ^ expected.charCodeAt(i);
+ return diff === 0;
+ });
+}
+
+/** Signs a payload as Stripe would, for tests and for trying the webhook locally. */
+export async function signPayload(payload: string, secret: string, t = Math.floor(Date.now() / 1000)): Promise {
+ const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+ return `t=${t},v1=${hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${payload}`)))}`;
+}
+
+export interface Subscription {
+ id: string;
+ customer: string;
+ status: string;
+ metadata?: Record;
+ current_period_end?: number;
+ items: { data: { id: string; quantity?: number; current_period_end?: number; price: { id: string } }[] };
+}
+
+/** Statuses in which the workspace has what it pays for. past_due keeps it while Stripe retries. */
+const PAYING = new Set(["active", "trialing", "past_due"]);
+
+/**
+ * A subscription as Stripe describes it, onto its workspace: the plan from its price, the status,
+ * the interval, the seats and the end of the period. A subscription that has ended puts the
+ * workspace back on Free, unless the workspace has since moved to another one.
+ */
+export async function applySubscription(env: Env, sub: Subscription, workspaceId?: string, ended = false): Promise {
+ const id =
+ workspaceId ??
+ sub.metadata?.workspace_id ??
+ (await env.DB.prepare("SELECT id FROM workspaces WHERE stripe_subscription_id = ?").bind(sub.id).first<{ id: string }>())?.id ??
+ (await env.DB.prepare("SELECT id FROM workspaces WHERE stripe_customer_id = ?").bind(sub.customer).first<{ id: string }>())?.id;
+ if (!id) {
+ console.error(`Stripe subscription ${sub.id} matches no workspace`);
+ return null;
+ }
+ const w = await env.DB.prepare("SELECT id, plan, stripe_subscription_id, over_quota_since FROM workspaces WHERE id = ?").bind(id).first<{ id: string; plan: string; stripe_subscription_id: string | null; over_quota_since: string | null }>();
+ if (!w) return null;
+ if (w.stripe_subscription_id && w.stripe_subscription_id !== sub.id && (ended || !PAYING.has(sub.status))) return id;
+ const item = sub.items?.data?.[0];
+ const priced = item ? planOfPrice(env, item.price.id) : null;
+ if (!ended && PAYING.has(sub.status) && !priced) {
+ console.error(`Stripe subscription ${sub.id} has price ${item?.price.id}, which no STRIPE_PRICE_* names`);
+ return null;
+ }
+ const paying = !ended && PAYING.has(sub.status) && priced;
+ // An enterprise workspace is set by hand and stays so whatever Stripe says.
+ const plan = w.plan === "enterprise" ? "enterprise" : paying ? priced.plan : "free";
+ const end = sub.current_period_end ?? item?.current_period_end;
+ const fetches = (await env.DB.prepare("SELECT count FROM usage WHERE workspace_id = ? AND metric = 'fetches' AND period = ?").bind(id, periodOf(new Date())).first<{ count: number }>())?.count ?? 0;
+ await env.DB.prepare(
+ "UPDATE workspaces SET plan = ?, plan_status = ?, billing_interval = ?, seats = ?, stripe_customer_id = ?, stripe_subscription_id = ?, period_end = ?, over_quota_since = ? WHERE id = ?",
+ ).bind(
+ plan,
+ ended ? "canceled" : sub.status,
+ paying ? priced.interval : null,
+ paying ? (item?.quantity ?? 1) : null,
+ sub.customer,
+ ended ? null : sub.id,
+ paying && end ? new Date(end * 1000).toISOString() : null,
+ overQuotaSince(plan, fetches, w.over_quota_since, new Date()),
+ id,
+ ).run();
+ return id;
+}
+
+/**
+ * Team is billed per editor: after someone joins or leaves in an editor role, the subscription's
+ * quantity follows, prorated. Never throws; a failed sync is logged and the next change retries.
+ */
+export async function syncSeats(env: Env, workspaceId: string): Promise {
+ if (!stripeOn(env)) return;
+ try {
+ const w = await env.DB.prepare("SELECT plan, stripe_subscription_id FROM workspaces WHERE id = ?").bind(workspaceId).first<{ plan: string; stripe_subscription_id: string | null }>();
+ if (!w?.stripe_subscription_id || w.plan !== "team") return;
+ const seats = Math.max(1, await editorCount(env, workspaceId));
+ const sub = await stripe(env, "GET", `/subscriptions/${w.stripe_subscription_id}`);
+ const item = sub.items.data[0];
+ if (!item || item.quantity === seats) return;
+ await stripe(env, "POST", `/subscription_items/${item.id}`, { quantity: seats, proration_behavior: "create_prorations" });
+ await env.DB.prepare("UPDATE workspaces SET seats = ? WHERE id = ?").bind(seats, workspaceId).run();
+ } catch (e) {
+ console.error(`seat sync for ${workspaceId}`, e);
+ }
+}
+
+/** The Checkout parameters for a plan: Team's quantity is the editor count, Pro's is one. */
+export function checkoutParams(env: Env, o: { workspaceId: string; slug: string; plan: "pro" | "team"; interval: Interval; seats: number; customer: string | null; email: string; coupon: boolean }) {
+ return {
+ mode: "subscription",
+ line_items: [{ price: priceFor(env, o.plan, o.interval), quantity: o.plan === "team" ? Math.max(1, o.seats) : 1 }],
+ client_reference_id: o.workspaceId,
+ metadata: { workspace_id: o.workspaceId },
+ subscription_data: { metadata: { workspace_id: o.workspaceId } },
+ ...(o.customer ? { customer: o.customer } : { customer_email: o.email }),
+ ...(o.coupon && env.STRIPE_COUPON_FOUNDING ? { discounts: [{ coupon: env.STRIPE_COUPON_FOUNDING }] } : { allow_promotion_codes: true }),
+ success_url: `${env.APP_URL}/w/${o.slug}/billing?upgraded=1`,
+ cancel_url: `${env.APP_URL}/w/${o.slug}/billing`,
+ };
+}
+
+export const isPaidPlan = (p: unknown): p is "pro" | "team" => p === "pro" || p === "team";
diff --git a/apps/studio/src/worker/index.ts b/apps/studio/src/worker/index.ts
index c082d70..bcef5f4 100644
--- a/apps/studio/src/worker/index.ts
+++ b/apps/studio/src/worker/index.ts
@@ -23,6 +23,8 @@ import { checkDirection } from "../direction/schema.ts";
import { capture, ingest, posthogConfig, type Properties } from "./analytics.ts";
import { CORS, ingestEvents, newIngestKey, preflight } from "./insights.ts";
import { RANGES, RETENTION_DAYS, detail, range, summarise, type StoredRow } from "../insights/report.ts";
+import { PlanLimit, assertCanCreate, assertCanEdit, billingOn, countFetch, isEditor, planSummary, pruneHistory, rollUp } from "./plans.ts";
+import { StripeError, applySubscription, checkoutParams, isPaidPlan, priceFor, stripe, stripeOn, syncSeats, verifySignature, type Subscription } from "./billing.ts";
type Vars = { user: User | null; apiWorkspace: string | null };
const app = new Hono<{ Bindings: Env; Variables: Vars }>();
@@ -42,6 +44,7 @@ class Fail extends Error {
}
app.onError((e, c) => {
if (e instanceof Fail) return c.json({ error: e.message }, e.status as 500);
+ if (e instanceof PlanLimit) return c.json({ error: e.message, ...e.data }, 402);
console.error(e);
return c.json({ error: "Something went wrong on our side" }, 500);
});
@@ -61,12 +64,13 @@ const text = (v: unknown, max: number, what: string): string => {
const MAX_UPLOAD = 25 * 1024 * 1024;
-/** Work that may finish after the answer: the Worker waits for it, a test just lets it run. */
-function later(c: Ctx, work: Promise) {
+/** Work that may finish after the answer (analytics, a seat sync): handed to the runtime when
+ * there is one, and awaited when there isn't, so a test sees it finish. */
+async function later(c: Ctx, work: Promise) {
try {
c.executionCtx.waitUntil(work);
} catch {
- void work;
+ await work;
}
}
/** An analytics event from the Worker (src/worker/analytics.ts), when POSTHOG_KEY is set; otherwise nothing. */
@@ -132,6 +136,8 @@ interface Workspace {
slug: string;
name: string;
role: string;
+ plan: string;
+ over_quota_since: string | null;
}
/** The workspace in the URL, and the caller's role in it. */
@@ -139,7 +145,7 @@ async function ws(c: Ctx, allowed?: ReadonlySet): Promise {
const user = need(c);
const slug = c.req.param("slug");
const row = await c.env.DB.prepare(
- "SELECT w.id, w.slug, w.name, m.role FROM workspaces w JOIN memberships m ON m.workspace_id = w.id WHERE w.slug = ? AND m.user_id = ?",
+ "SELECT w.id, w.slug, w.name, m.role, w.plan, w.over_quota_since FROM workspaces w JOIN memberships m ON m.workspace_id = w.id WHERE w.slug = ? AND m.user_id = ?",
).bind(slug, user.id).first();
if (!row) throw new Fail(404, "No such workspace, or you're not in it");
// An API key is scoped to one workspace, and to what a machine does: whatever its creator can
@@ -154,20 +160,31 @@ async function ws(c: Ctx, allowed?: ReadonlySet): Promise {
if (!importing && !reading) throw new Fail(403, "An API key can import and read design systems, and read screens and Directions, only");
}
if (allowed && !allowed.has(row.role)) throw new Fail(403, `Your role (${row.role}) can't do that`);
+ // Over the fetch quota for longer than the grace period: reading and paying still work, changes don't.
+ if (c.req.method !== "GET" && !new URL(c.req.url).pathname.includes("/billing/")) assertCanEdit(c.env, row);
return row;
}
+/** A pruned design-system version's files, after its rows. */
+async function dropVersionFiles(env: Env, ids: string[]) {
+ for (const id of ids) {
+ const list = await env.FILES.list({ prefix: `versions/${id}/` });
+ for (const o of list.objects) await env.FILES.delete(o.key);
+ }
+}
+
// ---------------------------------------------------------------- sign in and out
app.get("/api/me", async (c) => {
const user = c.get("user");
const signIn = { google: !!(c.env.GOOGLE_CLIENT_ID && c.env.GOOGLE_CLIENT_SECRET), emailVerification: !isLocal(c.env) };
- if (!user) return c.json({ user: null, workspaces: [], signIn });
- const workspaces = await c.env.DB.prepare("SELECT w.id, w.slug, w.name, m.role FROM workspaces w JOIN memberships m ON m.workspace_id = w.id WHERE m.user_id = ? ORDER BY w.name")
+ // billing: whether this Studio has plans at all (the hosted one); a self-hosted one shows none.
+ if (!user) return c.json({ user: null, workspaces: [], signIn, billing: billingOn(c.env) });
+ const workspaces = await c.env.DB.prepare("SELECT w.id, w.slug, w.name, m.role, w.plan FROM workspaces w JOIN memberships m ON m.workspace_id = w.id WHERE m.user_id = ? ORDER BY w.name")
.bind(user.id).all();
// The app's analytics are on only for signed-in people, and only when the Worker has a key (the public one).
const config = posthogConfig(c.env);
- return c.json({ user, workspaces: workspaces.results, signIn, ...(config ? { analytics: { key: config.key, ui: config.ui } } : {}) });
+ return c.json({ user, workspaces: workspaces.results, signIn, billing: billingOn(c.env), ...(config ? { analytics: { key: config.key, ui: config.ui } } : {}) });
});
// ---------------------------------------------------------------- workspaces, members, invites
@@ -180,6 +197,7 @@ app.post("/api/workspaces", async (c) => {
if (!name?.trim() || !/^[a-z0-9][a-z0-9-]{1,39}$/.test(s)) throw new Fail(400, "A name, and an address of letters, digits and dashes");
const taken = await c.env.DB.prepare("SELECT 1 FROM workspaces WHERE slug = ?").bind(s).first();
if (taken) throw new Fail(409, `studio.polyxd.com/${s} is taken`);
+ await assertCanCreate(c.env, null, { kind: "workspace", userId: user.id });
const id = crypto.randomUUID();
await c.env.DB.batch([
c.env.DB.prepare("INSERT INTO workspaces (id, slug, name, created_at) VALUES (?, ?, ?, ?)").bind(id, s, name.trim(), now()),
@@ -208,6 +226,8 @@ app.post("/api/w/:slug/invites", async (c) => {
const members = await c.env.DB.prepare("SELECT u.email FROM memberships m JOIN user u ON u.id = m.user_id WHERE m.workspace_id = ?").bind(w.id).all<{ email: string }>();
const already = list.filter((e) => members.results.some((m) => m.email === e));
if (already.length) throw new Fail(409, `${already.join(", ")} ${already.length === 1 ? "is" : "are"} already in this workspace`);
+ // An editor invite holds a seat until it is used or expires; viewers are always free.
+ if (isEditor(role)) await assertCanCreate(c.env, w, { kind: "editors", adding: list.length, pending: true });
const made = [];
for (const email of list) {
const id = crypto.randomUUID();
@@ -239,14 +259,38 @@ app.post("/api/invites/:id/accept", async (c) => {
if (inv.email !== user.email) throw new Fail(403, "This invite is for a different email address");
const member = await c.env.DB.prepare("SELECT role FROM memberships WHERE workspace_id = ? AND user_id = ?").bind(inv.workspace_id, user.id).first();
if (member) throw new Fail(409, "You're already in this workspace; an invite can't change your role");
+ const w = await c.env.DB.prepare("SELECT id, slug, plan, over_quota_since FROM workspaces WHERE id = ?").bind(inv.workspace_id).first<{ id: string; slug: string; plan: string; over_quota_since: string | null }>();
+ // Checked again on accepting: the plan may have changed, or other invites been used, since.
+ if (w && isEditor(inv.role)) await assertCanCreate(c.env, w, { kind: "editors", adding: 1, pending: false });
await c.env.DB.batch([
c.env.DB.prepare("INSERT INTO memberships (workspace_id, user_id, role, created_at) VALUES (?, ?, ?, ?)").bind(inv.workspace_id, user.id, inv.role, now()),
c.env.DB.prepare("UPDATE invites SET accepted_at = ? WHERE id = ?").bind(now(), inv.id),
]);
- const w = await c.env.DB.prepare("SELECT slug FROM workspaces WHERE id = ?").bind(inv.workspace_id).first<{ slug: string }>();
+ if (isEditor(inv.role)) await later(c as Ctx, syncSeats(c.env, inv.workspace_id));
return c.json({ slug: w?.slug });
});
+/** An open invite withdrawn, which frees the seat it held. */
+app.delete("/api/w/:slug/invites/:id", async (c) => {
+ const w = await ws(c as Ctx, new Set(["owner", "design-system"]));
+ await c.env.DB.prepare("DELETE FROM invites WHERE id = ? AND workspace_id = ? AND accepted_at IS NULL").bind(c.req.param("id"), w.id).run();
+ return c.json({ ok: true });
+});
+
+/** Someone taken out of the workspace by an owner. The last owner stays. */
+app.delete("/api/w/:slug/members/:user", async (c) => {
+ const w = await ws(c as Ctx, new Set(["owner"]));
+ const m = await c.env.DB.prepare("SELECT role FROM memberships WHERE workspace_id = ? AND user_id = ?").bind(w.id, c.req.param("user")).first<{ role: string }>();
+ if (!m) throw new Fail(404, "They're not in this workspace");
+ if (m.role === "owner") {
+ const owners = await c.env.DB.prepare("SELECT COUNT(*) AS n FROM memberships WHERE workspace_id = ? AND role = 'owner'").bind(w.id).first<{ n: number }>();
+ if ((owners?.n ?? 0) <= 1) throw new Fail(409, "A workspace needs an owner; make someone else owner first");
+ }
+ await c.env.DB.prepare("DELETE FROM memberships WHERE workspace_id = ? AND user_id = ?").bind(w.id, c.req.param("user")).run();
+ if (isEditor(m.role)) await later(c as Ctx, syncSeats(c.env, w.id));
+ return c.json({ ok: true });
+});
+
// ---------------------------------------------------------------- registries and API keys
app.get("/api/w/:slug/registries", async (c) => {
@@ -436,6 +480,7 @@ app.post("/api/w/:slug/design-systems/import", async (c) => {
const last = await c.env.DB.prepare("SELECT MAX(number) AS n FROM ds_versions WHERE design_system_id = ?").bind(into).first<{ n: number | null }>();
number = (last?.n ?? 0) + 1;
} else {
+ await assertCanCreate(c.env, w, { kind: "designSystem" });
const first = await c.env.DB.prepare("SELECT COUNT(*) AS n FROM design_systems WHERE workspace_id = ?").bind(w.id).first<{ n: number }>();
statements.push(
c.env.DB.prepare("INSERT INTO design_systems (id, workspace_id, name, source, is_default, created_at) VALUES (?, ?, ?, ?, ?, ?)")
@@ -449,6 +494,7 @@ app.post("/api/w/:slug/design-systems/import", async (c) => {
await c.env.FILES.put(graphKey(versionId), JSON.stringify(graph), { httpMetadata: { contentType: "application/json" } });
if (original) await c.env.FILES.put(`versions/${versionId}/original`, original.bytes, { customMetadata: { name: original.name } });
await c.env.DB.batch(statements);
+ if (into) await dropVersionFiles(c.env, await pruneHistory(c.env, w, "ds_versions", dsId));
return c.json({ designSystemId: dsId, versionId, number, scan: { ...summary, picked }, url: `${c.env.APP_URL}/w/${w.slug}/design-systems/${dsId}/versions/${versionId}/scan` }, 201);
});
@@ -573,6 +619,7 @@ app.post("/api/w/:slug/design-systems/from-template", async (c) => {
const { template, name } = await body<{ template?: string; name?: string }>(c as Ctx);
if (!isStartName(template)) throw new Fail(400, `Which template? One of ${[BLANK, ...TEMPLATE_NAMES].join(", ")}`);
if (name !== undefined) text(name, 80, "Name");
+ await assertCanCreate(c.env, w, { kind: "designSystem" });
const graph = templateGraph(template);
const summary = scan(graph);
const display = template === BLANK ? "Blank" : (TEMPLATE_PACKS[template].manifest.displayName ?? template);
@@ -635,6 +682,7 @@ app.post("/api/w/:slug/design-systems/:id/versions/:v/edit", async (c) => {
.bind(versionId, ds.id, number, `edited in Studio from v${v.number}`, JSON.stringify({ ...summary, picked: [], edited: changes.length, from: v.number }), v.package_name, v.package_version, b.notes?.trim() || `${changes.length} token${changes.length === 1 ? "" : "s"} changed`, v.template, user.id, now()),
...carried.map((o) => c.env.DB.prepare("INSERT INTO role_overrides (version_id, role, token_path, decided_by, decided_at) VALUES (?, ?, ?, ?, ?)").bind(versionId, o.role, o.token, user.id, now())),
]);
+ await dropVersionFiles(c.env, await pruneHistory(c.env, w, "ds_versions", ds.id));
const rows = mapRoles(next, CONTRACT, carried);
return c.json({ versionId, number, changes: changes.length, fails: rows.filter((r) => r.status === "fails").length, scan: summary, url: `${c.env.APP_URL}/w/${w.slug}/design-systems/${ds.id}/versions/${versionId}/edit` }, 201);
});
@@ -653,6 +701,7 @@ app.get("/api/w/:slug/design-systems/:id/versions/:v/export", async (c) => {
const mapping = Object.fromEntries(rows.map((r) => [r.role, r.status === "off" ? null : r.token]));
const extras = await c.env.FILES.get(extrasKey(v.id));
const file = exportDesignSystem(format, { name: ds.name, version: v.number, status: v.status, graph, mapping, contract: CONTRACT, extras: extras ? await extras.text() : undefined });
+ if (c.get("apiWorkspace")) countFetch(c.env, w.id, "tokens");
c.header("Content-Type", file.contentType);
c.header("Content-Disposition", `${c.req.query("download") === "1" ? "attachment" : "inline"}; filename="${file.fileName}"`);
c.header("X-Polyxd-Design-System-Version", String(v.number));
@@ -936,6 +985,7 @@ app.get("/api/w/:slug/screens/:key", async (c) => {
const doc = JSON.parse(v.document_json) as Doc;
// A screen a person made says so, so the mark a product shows can too.
doc.surface.origin ??= "authored";
+ if (c.get("apiWorkspace")) countFetch(c.env, w.id, "screen");
c.header("X-Polyxd-Screen-Version", String(v.number));
return c.json(doc);
});
@@ -995,6 +1045,7 @@ app.post("/api/w/:slug/screens/:key/versions", async (c) => {
c.env.DB.prepare("INSERT INTO screen_versions (id, screen_id, number, document_json, notes, status, issues_json, created_by, created_at) VALUES (?, ?, ?, ?, ?, 'draft', ?, ?, ?)").bind(crypto.randomUUID(), s.id, number, JSON.stringify(document), b.notes ?? "", JSON.stringify(result), user.id, now()),
c.env.DB.prepare("UPDATE screens SET intent = ?, updated_at = ? WHERE id = ?").bind(intent, now(), s.id),
]);
+ await pruneHistory(c.env, w, "screen_versions", s.id);
return c.json({ number, ...result }, 201);
});
@@ -1007,6 +1058,7 @@ app.post("/api/w/:slug/screens/:key/versions/:n/publish", async (c) => {
const result = checkDocument(JSON.parse(v.document_json), { rules: await workspaceRules(c.env, w.id) });
const errors = result.issues.filter((i) => i.severity === "error");
if (errors.length) throw new Fail(409, `v${v.number} has ${errors.length} error${errors.length === 1 ? "" : "s"}: ${errors.slice(0, 3).map((e) => e.message).join("; ")}${errors.length > 3 ? "; …" : ""}. Fix them before publishing.`);
+ await assertCanCreate(c.env, w, { kind: "publishedScreen", screenId: s.id });
await c.env.DB.batch([
c.env.DB.prepare("UPDATE screen_versions SET status = 'draft', issues_json = ? WHERE screen_id = ? AND status = 'published'").bind(JSON.stringify(result), s.id),
c.env.DB.prepare("UPDATE screen_versions SET status = 'published', issues_json = ? WHERE id = ?").bind(JSON.stringify(result), v.id),
@@ -1102,6 +1154,7 @@ app.post("/api/w/:slug/directions", async (c) => {
if (b.notes !== undefined) text(b.notes, 500, "Notes");
const taken = await c.env.DB.prepare("SELECT 1 FROM directions WHERE workspace_id = ? AND key = ?").bind(w.id, key).first();
if (taken) throw new Fail(409, `A Direction with the key ${key} already exists`);
+ await assertCanCreate(c.env, w, { kind: "direction" });
const snapshot = b.direction === undefined ? { direction: blankDirection(key), patterns: [] } : parseSnapshot(b);
const { stored, issues } = checkSnapshot(snapshot, key, await directionRulesOf(c.env, w.id));
if (issues.length) return refuse(issues);
@@ -1123,6 +1176,7 @@ app.get("/api/w/:slug/directions/:key", async (c) => {
const d = await directionByKey(c as Ctx, w);
const v = await c.env.DB.prepare("SELECT direction_json, patterns_json, number FROM direction_versions WHERE direction_id = ? AND status = 'published'").bind(d.id).first<{ direction_json: string; patterns_json: string; number: number }>();
if (!v) throw new Fail(404, `${d.name} has no published version yet`);
+ if (c.get("apiWorkspace")) countFetch(c.env, w.id, "direction");
c.header("X-Polyxd-Direction-Version", String(v.number));
return c.json(toExport(snapshotOf(v), d.key));
});
@@ -1193,6 +1247,7 @@ app.post("/api/w/:slug/directions/:key/versions", async (c) => {
c.env.DB.prepare("INSERT INTO direction_versions (id, direction_id, number, direction_json, patterns_json, notes, status, created_by, created_at) VALUES (?, ?, ?, ?, ?, ?, 'draft', ?, ?)").bind(crypto.randomUUID(), d.id, number, JSON.stringify(stored.direction), JSON.stringify(stored.patterns), b.notes ?? "", user.id, now()),
c.env.DB.prepare("UPDATE directions SET updated_at = ? WHERE id = ?").bind(now(), d.id),
]);
+ await pruneHistory(c.env, w, "direction_versions", d.id);
return c.json({ number, snapshot: stored }, 201);
});
@@ -1269,7 +1324,95 @@ app.delete("/api/w/:slug/insights", async (c) => {
return c.json({ ok: true, deleted: r.meta.changes });
});
+// ---------------------------------------------------------------- plans and billing (hosted Studio only)
+
+const OWNERS = new Set(["owner"]);
+
+/** The workspace's plan and what it uses, for the Billing page; { enabled: false } on a self-hosted Studio. */
+app.get("/api/w/:slug/billing", async (c) => {
+ const w = await ws(c as Ctx);
+ if (!billingOn(c.env)) return c.json({ enabled: false });
+ return c.json({ ...(await planSummary(c.env, w.id)), canManage: w.role === "owner" });
+});
+
+const needStripe = (env: Env) => {
+ if (!billingOn(env)) throw new Fail(404, "This Studio has no billing: it runs without plans or limits");
+ if (!stripeOn(env)) throw new Fail(503, "Billing isn't set up on this Studio yet");
+};
+
+app.post("/api/w/:slug/billing/checkout", async (c) => {
+ const w = await ws(c as Ctx, OWNERS);
+ const user = need(c as Ctx);
+ needStripe(c.env);
+ const { plan, interval } = await body<{ plan?: string; interval?: string }>(c as Ctx);
+ if (!isPaidPlan(plan)) throw new Fail(400, "plan: pro or team");
+ if (interval !== "month" && interval !== "year") throw new Fail(400, "interval: month or year");
+ const price = priceFor(c.env, plan, interval);
+ if (!price) throw new Fail(503, `No ${plan} price is set up for paying by the ${interval}`);
+ const row = await c.env.DB.prepare("SELECT stripe_customer_id, stripe_subscription_id, plan_status FROM workspaces WHERE id = ?").bind(w.id).first<{ stripe_customer_id: string | null; stripe_subscription_id: string | null; plan_status: string | null }>();
+ if (row?.stripe_subscription_id) throw new Fail(409, "This workspace already has a plan. Change it from Manage billing.");
+ const editors = (await c.env.DB.prepare("SELECT COUNT(*) AS n FROM memberships WHERE workspace_id = ? AND role != 'viewer'").bind(w.id).first<{ n: number }>())?.n ?? 1;
+ if (plan === "pro" && editors > 1) throw new Fail(409, `Pro is for one editor, and this workspace has ${editors}. Team fits, or make the others viewers first.`);
+ const params = (coupon: boolean) => checkoutParams(c.env, { workspaceId: w.id, slug: w.slug, plan, interval, seats: editors, customer: row?.stripe_customer_id ?? null, email: user.email, coupon });
+ let session: { url: string };
+ try {
+ session = await stripe<{ url: string }>(c.env, "POST", "/checkout/sessions", params(true));
+ } catch (e) {
+ // The founding coupon runs out after 100 workspaces; then it's the full price.
+ if (!(e instanceof StripeError) || !c.env.STRIPE_COUPON_FOUNDING || e.status >= 500) throw e;
+ session = await stripe<{ url: string }>(c.env, "POST", "/checkout/sessions", params(false));
+ }
+ return c.json({ url: session.url });
+});
+
+app.post("/api/w/:slug/billing/portal", async (c) => {
+ const w = await ws(c as Ctx, OWNERS);
+ needStripe(c.env);
+ const row = await c.env.DB.prepare("SELECT stripe_customer_id FROM workspaces WHERE id = ?").bind(w.id).first<{ stripe_customer_id: string | null }>();
+ if (!row?.stripe_customer_id) throw new Fail(409, "This workspace hasn't paid for a plan yet; pick one first");
+ const session = await stripe<{ url: string }>(c.env, "POST", "/billing_portal/sessions", { customer: row.stripe_customer_id, return_url: `${c.env.APP_URL}/w/${w.slug}/billing` });
+ return c.json({ url: session.url });
+});
+
+/** Stripe tells Studio what changed. The only way a workspace's plan changes, besides by hand for Enterprise. */
+app.post("/api/billing/webhook", async (c) => {
+ if (!billingOn(c.env) || !c.env.STRIPE_WEBHOOK_SECRET) throw new Fail(404, "No such endpoint");
+ const payload = await c.req.text();
+ if (!(await verifySignature(payload, c.req.header("stripe-signature"), c.env.STRIPE_WEBHOOK_SECRET))) throw new Fail(400, "Bad signature");
+ const event = JSON.parse(payload) as { type: string; data: { object: Record } };
+ const o = event.data.object;
+ switch (event.type) {
+ case "checkout.session.completed": {
+ if (o.mode !== "subscription" || typeof o.subscription !== "string") break;
+ const id = (o.client_reference_id as string | null) ?? (o.metadata as Record | undefined)?.workspace_id;
+ if (!id) break;
+ await c.env.DB.prepare("UPDATE workspaces SET stripe_customer_id = ?, stripe_subscription_id = ? WHERE id = ?").bind(o.customer, o.subscription, id).run();
+ await applySubscription(c.env, await stripe(c.env, "GET", `/subscriptions/${o.subscription}`), id);
+ break;
+ }
+ case "customer.subscription.created":
+ case "customer.subscription.updated":
+ await applySubscription(c.env, o as unknown as Subscription);
+ break;
+ case "customer.subscription.deleted":
+ await applySubscription(c.env, o as unknown as Subscription, undefined, true);
+ break;
+ case "invoice.payment_failed":
+ // Stripe retries and says so again with customer.subscription.updated; this shows it at once.
+ if (typeof o.customer === "string") await c.env.DB.prepare("UPDATE workspaces SET plan_status = 'past_due' WHERE stripe_customer_id = ? AND stripe_subscription_id IS NOT NULL").bind(o.customer).run();
+ break;
+ }
+ return c.json({ received: true });
+});
+
app.get("/api/contract", (c) => c.json({ roles: Object.keys(CONTRACT.tokens).length, contrastPairs: CONTRACT.contrast.length }));
app.all("/api/*", (c) => c.json({ error: "No such endpoint" }, 404));
-export default app;
+export { app };
+export default {
+ fetch: app.fetch,
+ /** The cron (wrangler.jsonc triggers): fetches rolled up into usage, and quotas checked. Does nothing without BILLING. */
+ async scheduled(_event: ScheduledController, env: Env, ctx: ExecutionContext) {
+ ctx.waitUntil(rollUp(env).then((r) => console.log(`usage rollup: ${r.workspaces} workspaces counted, ${r.over} over quota`)));
+ },
+} satisfies ExportedHandler;
diff --git a/apps/studio/src/worker/plans.ts b/apps/studio/src/worker/plans.ts
new file mode 100644
index 0000000..4bd4840
--- /dev/null
+++ b/apps/studio/src/worker/plans.ts
@@ -0,0 +1,279 @@
+/**
+ * Plans and their limits (docs/decisions/0004-pricing-and-licensing.md), in one table, and the
+ * checks the routes make against it. None of it applies unless BILLING is "on", which only the
+ * hosted Studio sets: a self-hosted Studio, free under its licence, has no limits at all.
+ *
+ * Hard limits (editors, design systems, Directions, published screens, workspaces owned) only
+ * stop something new being made. Fetches are soft: going over never breaks a product; after
+ * seven days over, editing is locked until the workspace upgrades, and fetches carry on.
+ */
+import type { Env } from "./auth.ts";
+
+export const PLANS = ["free", "pro", "team", "enterprise"] as const;
+export type Plan = (typeof PLANS)[number];
+
+/** null is unlimited. */
+export interface Limits {
+ workspaces: number | null;
+ editors: number | null;
+ designSystems: number | null;
+ directions: number | null;
+ publishedScreens: number | null;
+ fetches: number | null;
+ /** Versions kept per screen, Direction or design system; the published one is always kept. */
+ history: number | null;
+ privateMcp: boolean;
+ approvals: boolean;
+ sharedLibraries: boolean;
+}
+
+export const LIMITS: Record = {
+ free: { workspaces: 1, editors: 2, designSystems: 1, directions: 1, publishedScreens: 10, fetches: 10_000, history: 10, privateMcp: false, approvals: false, sharedLibraries: false },
+ pro: { workspaces: 3, editors: 1, designSystems: null, directions: null, publishedScreens: null, fetches: 250_000, history: null, privateMcp: true, approvals: false, sharedLibraries: false },
+ team: { workspaces: null, editors: null, designSystems: null, directions: null, publishedScreens: null, fetches: 1_000_000, history: null, privateMcp: true, approvals: true, sharedLibraries: true },
+ enterprise: { workspaces: null, editors: null, designSystems: null, directions: null, publishedScreens: null, fetches: 10_000_000, history: null, privateMcp: true, approvals: true, sharedLibraries: true },
+};
+
+/** Dollars, for the app to show; Stripe's prices are the ones charged. Team is per editor. */
+export const PRICES = { pro: { month: 8, year: 80 }, team: { month: 12, year: 120 } } as const;
+export const PLAN_NAMES: Record = { free: "Free", pro: "Pro", team: "Team", enterprise: "Enterprise" };
+
+/** Days a workspace may stay over its fetch quota before editing locks. */
+export const GRACE_DAYS = 7;
+
+export const billingOn = (env: Env) => env.BILLING === "on";
+export const isPlan = (p: unknown): p is Plan => typeof p === "string" && (PLANS as readonly string[]).includes(p);
+export const limitsFor = (plan: string): Limits => LIMITS[isPlan(plan) ? plan : "free"];
+/** Viewers are free; every other role takes a seat. */
+export const isEditor = (role: string) => role !== "viewer";
+/** 'YYYY-MM' in UTC: the period usage is counted in. */
+export const periodOf = (d: Date) => d.toISOString().slice(0, 7);
+
+/** A 402 the app turns into an upgrade prompt. */
+export class PlanLimit extends Error {
+ status = 402;
+ data: { code: "plan_limit" | "over_quota"; limit: string; plan: string; current?: number; max?: number | null };
+ constructor(message: string, data: PlanLimit["data"]) {
+ super(message);
+ this.data = data;
+ }
+}
+
+export interface PlanWorkspace {
+ id: string;
+ plan: string;
+ over_quota_since: string | null;
+}
+
+/** People in editor roles, and (with invites) the editor invites still open, which hold a seat too. */
+export async function editorCount(env: Env, workspaceId: string, withInvites = false): Promise {
+ const r = await env.DB.prepare(
+ `SELECT (SELECT COUNT(*) FROM memberships WHERE workspace_id = ? AND role != 'viewer') AS members,
+ (SELECT COUNT(*) FROM invites WHERE workspace_id = ? AND role != 'viewer' AND accepted_at IS NULL AND expires_at > ?) AS invited`,
+ ).bind(workspaceId, workspaceId, new Date().toISOString()).first<{ members: number; invited: number }>();
+ return (r?.members ?? 0) + (withInvites ? (r?.invited ?? 0) : 0);
+}
+
+const plural = (n: number, word: string) => `${n} ${word}${n === 1 ? "" : "s"}`;
+const upgrade = (plan: string) => (plan === "free" ? "Upgrade to Pro or Team for more." : plan === "pro" ? "Team has no limit." : "");
+
+export type Creatable =
+ | { kind: "workspace"; userId: string }
+ | { kind: "editors"; adding: number; pending: boolean }
+ | { kind: "designSystem" }
+ | { kind: "direction" }
+ | { kind: "publishedScreen"; screenId: string };
+
+/**
+ * Throws a 402 when the workspace's plan has no room for one more of something. Workspaces are
+ * counted per owner: the most generous plan among the workspaces a person owns sets how many
+ * they may own (a Free person owns one).
+ */
+export async function assertCanCreate(env: Env, w: PlanWorkspace | null, what: Creatable): Promise {
+ if (!billingOn(env)) return;
+ const fail = (limit: keyof Limits, plan: string, current: number, max: number, words: string) => {
+ throw new PlanLimit(`${PLAN_NAMES[isPlan(plan) ? plan : "free"]} has room for ${words}. ${upgrade(plan)}`.trim(), { code: "plan_limit", limit, plan, current, max });
+ };
+ if (what.kind === "workspace") {
+ const owned = await env.DB.prepare("SELECT w.plan FROM workspaces w JOIN memberships m ON m.workspace_id = w.id WHERE m.user_id = ? AND m.role = 'owner'").bind(what.userId).all<{ plan: string }>();
+ const allowances = owned.results.map((r) => limitsFor(r.plan).workspaces);
+ const max = allowances.includes(null) ? null : Math.max(LIMITS.free.workspaces!, ...(allowances as number[]));
+ const best = owned.results.reduce((b, r) => (PLANS.indexOf(r.plan as Plan) > PLANS.indexOf(b as Plan) ? r.plan : b), "free");
+ if (max !== null && owned.results.length >= max) fail("workspaces", best, owned.results.length, max, `${plural(max, "workspace")} of your own`);
+ return;
+ }
+ if (!w) return;
+ const limits = limitsFor(w.plan);
+ if (what.kind === "editors") {
+ if (limits.editors === null) return;
+ const current = await editorCount(env, w.id, what.pending);
+ if (current + what.adding > limits.editors) fail("editors", w.plan, current, limits.editors, `${plural(limits.editors, "editor")} (viewers are free)`);
+ return;
+ }
+ const count = async (sql: string, ...args: string[]) => (await env.DB.prepare(sql).bind(...args).first<{ n: number }>())?.n ?? 0;
+ if (what.kind === "designSystem" && limits.designSystems !== null) {
+ const n = await count("SELECT COUNT(*) AS n FROM design_systems WHERE workspace_id = ?", w.id);
+ if (n >= limits.designSystems) fail("designSystems", w.plan, n, limits.designSystems, plural(limits.designSystems, "design system"));
+ }
+ if (what.kind === "direction" && limits.directions !== null) {
+ const n = await count("SELECT COUNT(*) AS n FROM directions WHERE workspace_id = ?", w.id);
+ if (n >= limits.directions) fail("directions", w.plan, n, limits.directions, plural(limits.directions, "Direction"));
+ }
+ if (what.kind === "publishedScreen" && limits.publishedScreens !== null) {
+ // Publishing a new version of a screen that is already published adds nothing.
+ const n = await count("SELECT COUNT(*) AS n FROM screens WHERE workspace_id = ? AND status = 'published' AND id != ?", w.id, what.screenId);
+ if (n >= limits.publishedScreens) fail("publishedScreens", w.plan, n, limits.publishedScreens, plural(limits.publishedScreens, "published screen"));
+ }
+}
+
+/** When the grace period ends for a workspace over its fetch quota, or null. */
+export const lockedFrom = (w: PlanWorkspace): Date | null => (w.over_quota_since ? new Date(Date.parse(w.over_quota_since) + GRACE_DAYS * 86400e3) : null);
+
+/** Throws a 402 once a workspace has been over its fetch quota for longer than the grace period. */
+export function assertCanEdit(env: Env, w: PlanWorkspace, at = new Date()): void {
+ if (!billingOn(env)) return;
+ const from = lockedFrom(w);
+ if (from && from <= at) {
+ throw new PlanLimit(`This workspace has been over its monthly fetches for more than ${GRACE_DAYS} days, so editing is paused. Products still get their screens. Upgrade to edit again.`, { code: "over_quota", limit: "fetches", plan: w.plan });
+ }
+}
+
+/**
+ * Keeps a Free workspace's history to its last versions, the published or live one always among
+ * those kept. Returns the ids removed, so a design system's files can go too.
+ */
+export async function pruneHistory(env: Env, w: PlanWorkspace, table: "screen_versions" | "direction_versions" | "ds_versions", parentId: string): Promise {
+ const keep = limitsFor(w.plan).history;
+ if (!billingOn(env) || keep === null) return [];
+ const parent = table === "screen_versions" ? "screen_id" : table === "direction_versions" ? "direction_id" : "design_system_id";
+ const old = await env.DB.prepare(
+ `SELECT id FROM ${table} WHERE ${parent} = ? AND status NOT IN ('published', 'live')
+ AND number NOT IN (SELECT number FROM ${table} WHERE ${parent} = ? ORDER BY number DESC LIMIT ?)`,
+ ).bind(parentId, parentId, keep).all<{ id: string }>();
+ const ids = old.results.map((r) => r.id);
+ if (ids.length) await env.DB.batch(ids.map((id) => env.DB.prepare(`DELETE FROM ${table} WHERE id = ?`).bind(id)));
+ return ids;
+}
+
+// ---------------------------------------------------------------- fetch metering
+
+export const FETCH_DATASET = "polyxd_studio_fetches";
+
+/**
+ * Counts one fetch by key (a screen, a Direction, a design system's tokens). One Analytics Engine
+ * data point, written without waiting and never to D1; the rollup below adds them up.
+ */
+export function countFetch(env: Env, workspaceId: string, kind: "screen" | "direction" | "tokens"): void {
+ if (!billingOn(env) || !env.FETCHES) return;
+ try {
+ env.FETCHES.writeDataPoint({ indexes: [workspaceId], blobs: [kind], doubles: [1] });
+ } catch (e) {
+ console.error("fetch metering", e);
+ }
+}
+
+const sqlTime = (d: Date) => `toDateTime('${d.toISOString().slice(0, 19).replace("T", " ")}')`;
+
+/** A month's fetches per workspace, read back from Analytics Engine's SQL API. */
+export async function readFetches(env: Env, period: string): Promise> {
+ const [y, m] = period.split("-").map(Number);
+ const from = new Date(Date.UTC(y, m - 1, 1));
+ const to = new Date(Date.UTC(y, m, 1));
+ const r = await fetch(`https://api.cloudflare.com/client/v4/accounts/${env.CF_ACCOUNT_ID}/analytics_engine/sql`, {
+ method: "POST",
+ headers: { authorization: `Bearer ${env.CF_ANALYTICS_TOKEN}` },
+ // _sample_interval: Analytics Engine may sample at volume; each point stands for that many.
+ body: `SELECT index1 AS workspace, SUM(_sample_interval) AS fetches FROM ${FETCH_DATASET} WHERE timestamp >= ${sqlTime(from)} AND timestamp < ${sqlTime(to)} GROUP BY index1`,
+ });
+ if (!r.ok) throw new Error(`Analytics Engine answered ${r.status}: ${(await r.text()).slice(0, 300)}`);
+ const body = (await r.json()) as { data?: { workspace: string; fetches: number | string }[] };
+ return new Map((body.data ?? []).map((row) => [row.workspace, Math.round(Number(row.fetches))]));
+}
+
+/** Whether a count is over a plan's fetches, and so what over_quota_since should become. */
+export const overQuotaSince = (plan: string, count: number, since: string | null, at: Date): string | null => {
+ const limit = limitsFor(plan).fetches;
+ return limit !== null && count > limit ? (since ?? at.toISOString()) : null;
+};
+
+/**
+ * The scheduled rollup: this month's (and last month's, which may still be settling) fetches into
+ * `usage`, as totals so a run can repeat safely, and over_quota_since set or cleared from this
+ * month's. A new month starts from zero, so a lock lifts on the first of the month too.
+ * TODO: email owners at 80% and 100% (the Billing page shows both already).
+ */
+export async function rollUp(env: Env, at = new Date()): Promise<{ workspaces: number; over: number }> {
+ if (!billingOn(env) || !env.CF_ACCOUNT_ID || !env.CF_ANALYTICS_TOKEN) return { workspaces: 0, over: 0 };
+ const period = periodOf(at);
+ const previous = periodOf(new Date(Date.UTC(at.getUTCFullYear(), at.getUTCMonth() - 1, 1)));
+ const stamp = at.toISOString();
+ const statements: D1PreparedStatement[] = [];
+ const known = new Set((await env.DB.prepare("SELECT id FROM workspaces").all<{ id: string }>()).results.map((r) => r.id));
+ let current = new Map();
+ for (const p of [previous, period]) {
+ const counts = await readFetches(env, p);
+ if (p === period) current = counts;
+ for (const [id, n] of counts) {
+ if (!known.has(id)) continue;
+ statements.push(env.DB.prepare("INSERT INTO usage (workspace_id, metric, period, count, updated_at) VALUES (?, 'fetches', ?, ?, ?) ON CONFLICT (workspace_id, metric, period) DO UPDATE SET count = excluded.count, updated_at = excluded.updated_at").bind(id, p, n, stamp));
+ }
+ }
+ const rows = await env.DB.prepare("SELECT id, plan, over_quota_since FROM workspaces").all();
+ let over = 0;
+ for (const w of rows.results) {
+ const next = overQuotaSince(w.plan, current.get(w.id) ?? 0, w.over_quota_since, at);
+ if (next) over++;
+ if (next !== w.over_quota_since) statements.push(env.DB.prepare("UPDATE workspaces SET over_quota_since = ? WHERE id = ?").bind(next, w.id));
+ }
+ for (let i = 0; i < statements.length; i += 100) await env.DB.batch(statements.slice(i, i + 100));
+ return { workspaces: current.size, over };
+}
+
+// ---------------------------------------------------------------- what the app shows
+
+export interface BillingRow extends PlanWorkspace {
+ plan_status: string | null;
+ billing_interval: string | null;
+ seats: number | null;
+ stripe_customer_id: string | null;
+ stripe_subscription_id: string | null;
+ period_end: string | null;
+}
+
+/** A workspace's plan, its limits and how much of each it uses, for the Billing page. */
+export async function planSummary(env: Env, workspaceId: string, at = new Date()) {
+ const w = await env.DB.prepare("SELECT id, plan, plan_status, billing_interval, seats, stripe_customer_id, stripe_subscription_id, period_end, over_quota_since FROM workspaces WHERE id = ?").bind(workspaceId).first();
+ if (!w) throw new Error("no such workspace");
+ const n = async (sql: string) => (await env.DB.prepare(sql).bind(workspaceId).first<{ n: number }>())?.n ?? 0;
+ const usage = {
+ editors: await editorCount(env, workspaceId),
+ pendingEditors: (await editorCount(env, workspaceId, true)) - (await editorCount(env, workspaceId)),
+ viewers: await n("SELECT COUNT(*) AS n FROM memberships WHERE workspace_id = ? AND role = 'viewer'"),
+ designSystems: await n("SELECT COUNT(*) AS n FROM design_systems WHERE workspace_id = ?"),
+ directions: await n("SELECT COUNT(*) AS n FROM directions WHERE workspace_id = ?"),
+ publishedScreens: await n("SELECT COUNT(*) AS n FROM screens WHERE workspace_id = ? AND status = 'published'"),
+ fetches: (await env.DB.prepare("SELECT count FROM usage WHERE workspace_id = ? AND metric = 'fetches' AND period = ?").bind(workspaceId, periodOf(at)).first<{ count: number }>())?.count ?? 0,
+ };
+ const limits = limitsFor(w.plan);
+ const locked = lockedFrom(w);
+ return {
+ enabled: true as const,
+ plan: isPlan(w.plan) ? w.plan : "free",
+ status: w.plan_status,
+ interval: w.billing_interval,
+ seats: w.seats,
+ periodEnd: w.period_end,
+ subscribed: !!w.stripe_subscription_id,
+ customer: !!w.stripe_customer_id,
+ limits,
+ usage,
+ period: periodOf(at),
+ fetchesPercent: limits.fetches ? Math.round((usage.fetches / limits.fetches) * 100) : null,
+ overQuotaSince: w.over_quota_since,
+ lockedFrom: locked?.toISOString() ?? null,
+ locked: !!locked && locked <= at,
+ prices: PRICES,
+ founding: !!env.STRIPE_COUPON_FOUNDING,
+ checkout: !!env.STRIPE_SECRET_KEY,
+ };
+}
diff --git a/apps/studio/test/billing.worker.test.ts b/apps/studio/test/billing.worker.test.ts
new file mode 100644
index 0000000..0d97eb7
--- /dev/null
+++ b/apps/studio/test/billing.worker.test.ts
@@ -0,0 +1,381 @@
+/**
+ * Plans, limits, fetch metering and Stripe, through the Worker itself (test/support/worker.ts).
+ * Two Studios: a self-hosted one (no BILLING), which has no limits and no billing at all, and
+ * the hosted one (BILLING=on), where the plan table applies. Stripe and the Analytics Engine
+ * SQL API are never called: global fetch is replaced for the requests that would go to them.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { startWorker } from "./support/worker.ts";
+import { form, signPayload, verifySignature } from "../src/worker/billing.ts";
+import { LIMITS } from "../src/worker/plans.ts";
+
+type Worker = Awaited>;
+
+const STRIPE = {
+ BILLING: "on",
+ STRIPE_SECRET_KEY: "sk_test_fake",
+ STRIPE_WEBHOOK_SECRET: "whsec_test_fake",
+ STRIPE_PRICE_PRO_MONTH: "price_pro_month",
+ STRIPE_PRICE_PRO_YEAR: "price_pro_year",
+ STRIPE_PRICE_TEAM_MONTH: "price_team_month",
+ STRIPE_PRICE_TEAM_YEAR: "price_team_year",
+ STRIPE_COUPON_FOUNDING: "FOUNDING",
+};
+
+/** Someone signed up, without a workspace of their own. */
+async function person(worker: Worker, email: string) {
+ const p = worker.client();
+ const r = await p.call("POST", "/api/auth/sign-up/email", { name: email.split("@")[0], email, password: `test-${crypto.randomUUID()}` });
+ assert.equal(r.status, 200);
+ return p;
+}
+
+/** An invite made and accepted; the accept's answer, and the person who joined. */
+async function join(worker: Worker, owner: Awaited>, slug: string, email: string, role: string) {
+ const inv = await owner.call("POST", `/api/w/${slug}/invites`, { emails: [email], role });
+ assert.equal(inv.status, 201, JSON.stringify(inv.body));
+ const them = await person(worker, email);
+ return { ...(await them.call("POST", `/api/invites/${inv.body.invites[0].id}/accept`)), as: them };
+}
+
+const setPlan = (worker: Worker, slug: string, plan: string) => worker.env.DB.prepare("UPDATE workspaces SET plan = ? WHERE slug = ?").bind(plan, slug).run();
+const row = (worker: Worker, slug: string) => worker.env.DB.prepare("SELECT * FROM workspaces WHERE slug = ?").bind(slug).first>();
+
+/** Replaces fetch for the duration of fn; `answer` sees each outbound request. */
+async function withFetch(answer: (url: string, init: RequestInit) => Response | Promise, fn: () => Promise) {
+ const real = globalThis.fetch;
+ globalThis.fetch = (async (input: RequestInfo | URL, init: RequestInit = {}) => answer(String(input), init)) as typeof fetch;
+ try {
+ await fn();
+ } finally {
+ globalThis.fetch = real;
+ }
+}
+const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+
+test("a self-hosted Studio has no limits and no billing", async () => {
+ const worker = await startWorker();
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ const w = "/api/w/harbourline";
+ assert.equal((await mira.call("GET", "/api/me")).body.billing, false);
+ assert.deepEqual((await mira.call("GET", `${w}/billing`)).body, { enabled: false });
+ // More of everything than Free allows.
+ for (const name of ["Second", "Third"]) assert.equal((await mira.call("POST", "/api/workspaces", { name })).status, 201);
+ assert.equal((await mira.call("POST", `${w}/invites`, { emails: ["a@x.test", "b@x.test", "c@x.test"], role: "designer" })).status, 201);
+ for (const t of ["mono", "civic"]) assert.equal((await mira.call("POST", `${w}/design-systems/from-template`, { template: t })).status, 201);
+ for (const name of ["One", "Two"]) assert.equal((await mira.call("POST", `${w}/directions`, { name })).status, 201);
+ // No billing routes: checkout and the webhook aren't there.
+ assert.equal((await mira.call("POST", `${w}/billing/checkout`, { plan: "pro", interval: "month" })).status, 404);
+ assert.equal((await worker.client().call("POST", "/api/billing/webhook", {})).status, 404);
+ // History is kept whole.
+ assert.equal((await mira.call("POST", `${w}/screens`, { name: "Send" })).status, 201);
+ for (let i = 0; i < 11; i++) assert.equal((await mira.call("POST", `${w}/screens/send/versions`, { document: (await mira.call("GET", `${w}/screens/send/versions/1`)).body.document })).status, 201);
+ assert.equal((await mira.call("GET", `${w}/screens/send/versions`)).body.versions.length, 12);
+});
+
+test("Free: one workspace owned, two editors, one design system, one Direction, ten published screens", async () => {
+ const worker = await startWorker({ BILLING: "on" });
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ const w = "/api/w/harbourline";
+ assert.equal((await mira.call("GET", "/api/me")).body.billing, true);
+
+ // Workspaces: a Free owner owns one.
+ const second = await mira.call("POST", "/api/workspaces", { name: "Second" });
+ assert.equal(second.status, 402);
+ assert.equal(second.body.code, "plan_limit");
+ assert.equal(second.body.limit, "workspaces");
+ assert.equal(second.body.plan, "free");
+ assert.match(second.body.error, /Free has room for 1 workspace of your own/);
+ // Owning a Pro workspace allows three.
+ await setPlan(worker, "harbourline", "pro");
+ assert.equal((await mira.call("POST", "/api/workspaces", { name: "Second" })).status, 201);
+ assert.equal((await mira.call("POST", "/api/workspaces", { name: "Third" })).status, 201);
+ assert.equal((await mira.call("POST", "/api/workspaces", { name: "Fourth" })).status, 402);
+ await setPlan(worker, "harbourline", "free");
+
+ // Editors: the owner is one; an open invite holds a seat; viewers are free.
+ const two = await mira.call("POST", `${w}/invites`, { emails: ["a@x.test", "b@x.test"], role: "designer" });
+ assert.equal(two.status, 402);
+ assert.deepEqual([two.body.limit, two.body.current, two.body.max], ["editors", 1, 2]);
+ assert.equal((await mira.call("POST", `${w}/invites`, { emails: ["a@x.test"], role: "designer" })).status, 201);
+ assert.equal((await mira.call("POST", `${w}/invites`, { emails: ["b@x.test"], role: "engineer" })).status, 402);
+ assert.equal((await mira.call("POST", `${w}/invites`, { emails: ["v1@x.test", "v2@x.test", "v3@x.test"], role: "viewer" })).status, 201);
+ // Withdrawing the open invite frees its seat.
+ const open = (await mira.call("GET", w)).body.invites.find((i: { email: string }) => i.email === "a@x.test");
+ assert.equal((await mira.call("DELETE", `${w}/invites/${open.id}`)).status, 200);
+ assert.equal((await join(worker, mira, "harbourline", "b@x.test", "engineer")).status, 200);
+
+ // Design systems: import or template, one in all.
+ assert.equal((await mira.call("POST", `${w}/design-systems/from-template`, { template: "mono" })).status, 201);
+ const ds = await mira.call("POST", `${w}/design-systems/from-template`, { template: "civic" });
+ assert.equal(ds.status, 402);
+ assert.equal(ds.body.limit, "designSystems");
+
+ // Directions.
+ assert.equal((await mira.call("POST", `${w}/directions`, { name: "One" })).status, 201);
+ const dir = await mira.call("POST", `${w}/directions`, { name: "Two" });
+ assert.equal(dir.status, 402);
+ assert.equal(dir.body.limit, "directions");
+
+ // Published screens: ten; a new version of a published one isn't another.
+ for (let i = 1; i <= 11; i++) assert.equal((await mira.call("POST", `${w}/screens`, { name: `Screen ${i}` })).status, 201);
+ for (let i = 1; i <= 10; i++) assert.equal((await mira.call("POST", `${w}/screens/screen-${i}/versions/1/publish`)).status, 200);
+ const eleventh = await mira.call("POST", `${w}/screens/screen-11/versions/1/publish`);
+ assert.equal(eleventh.status, 402);
+ assert.equal(eleventh.body.limit, "publishedScreens");
+ const doc = (await mira.call("GET", `${w}/screens/screen-1/versions/1`)).body.document;
+ assert.equal((await mira.call("POST", `${w}/screens/screen-1/versions`, { document: doc })).status, 201);
+ assert.equal((await mira.call("POST", `${w}/screens/screen-1/versions/2/publish`)).status, 200);
+
+ // History: the last ten versions, and the published one wherever it is.
+ for (let i = 0; i < 12; i++) await mira.call("POST", `${w}/screens/screen-1/versions`, { document: doc });
+ const kept = (await mira.call("GET", `${w}/screens/screen-1/versions`)).body.versions.map((v: { number: number }) => v.number);
+ assert.deepEqual(kept, [14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 2]);
+
+ // The Billing page's numbers.
+ const b = (await mira.call("GET", `${w}/billing`)).body;
+ assert.equal(b.enabled, true);
+ assert.equal(b.plan, "free");
+ assert.equal(b.canManage, true);
+ assert.deepEqual([b.usage.editors, b.usage.viewers, b.usage.designSystems, b.usage.directions, b.usage.publishedScreens], [2, 0, 1, 1, 10]);
+ assert.equal(b.limits.fetches, LIMITS.free.fetches);
+
+ // Team: no editor limit.
+ await setPlan(worker, "harbourline", "team");
+ assert.equal((await mira.call("POST", `${w}/invites`, { emails: ["c@x.test", "d@x.test"], role: "designer" })).status, 201);
+ assert.equal((await mira.call("POST", `${w}/directions`, { name: "Two" })).status, 201);
+});
+
+test("accepting an editor invite is checked again, in case the plan changed", async () => {
+ const worker = await startWorker({ BILLING: "on" });
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ await setPlan(worker, "harbourline", "team");
+ const inv = await mira.call("POST", "/api/w/harbourline/invites", { emails: ["a@x.test", "b@x.test"], role: "designer" });
+ const viewerInv = await mira.call("POST", "/api/w/harbourline/invites", { emails: ["v@x.test"], role: "viewer" });
+ await setPlan(worker, "harbourline", "free");
+ const a = await person(worker, "a@x.test");
+ assert.equal((await a.call("POST", `/api/invites/${inv.body.invites[0].id}/accept`)).status, 200);
+ const b = await person(worker, "b@x.test");
+ const refused = await b.call("POST", `/api/invites/${inv.body.invites[1].id}/accept`);
+ assert.equal(refused.status, 402);
+ assert.equal(refused.body.limit, "editors");
+ const v = await person(worker, "v@x.test");
+ assert.equal((await v.call("POST", `/api/invites/${viewerInv.body.invites[0].id}/accept`)).status, 200);
+ // An owner can take someone out, which frees the seat; the last owner stays.
+ const members = (await mira.call("GET", "/api/w/harbourline")).body.members as { id: string; email: string }[];
+ assert.equal((await mira.call("DELETE", `/api/w/harbourline/members/${members.find((m) => m.email === "a@x.test")!.id}`)).status, 200);
+ assert.equal((await b.call("POST", `/api/invites/${inv.body.invites[1].id}/accept`)).status, 200);
+ assert.equal((await mira.call("DELETE", `/api/w/harbourline/members/${members.find((m) => m.email === "mira@harbourline.test")!.id}`)).status, 409);
+});
+
+test("fetches by key are counted without D1, rolled up by the cron, and a week over quota locks editing but never fetching", async () => {
+ const points: { indexes?: unknown[]; blobs?: unknown[] }[] = [];
+ const worker = await startWorker({ BILLING: "on", FETCHES: { writeDataPoint: (p: { indexes?: unknown[]; blobs?: unknown[] }) => points.push(p) }, CF_ACCOUNT_ID: "acc", CF_ANALYTICS_TOKEN: "tok" });
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ const w = "/api/w/harbourline";
+ const id = (await row(worker, "harbourline"))!.id as string;
+ assert.equal((await mira.call("POST", `${w}/screens`, { name: "Send" })).status, 201);
+ assert.equal((await mira.call("POST", `${w}/screens/send/versions/1/publish`)).status, 200);
+ const key = (await mira.call("POST", `${w}/api-keys`, { name: "web" })).body.key;
+ const product = worker.client({ key });
+
+ // A product's fetch is one data point; a person looking in Studio isn't a fetch.
+ assert.equal((await product.call("GET", `${w}/screens/send`)).status, 200);
+ assert.equal((await mira.call("GET", `${w}/screens/send`)).status, 200);
+ assert.deepEqual(points, [{ indexes: [id], blobs: ["screen"], doubles: [1] }]);
+
+ // The rollup asks Analytics Engine for this month and last, and writes totals.
+ const asked: string[] = [];
+ let count = 12_000;
+ const ae = (url: string, init: RequestInit) => {
+ assert.equal(url, "https://api.cloudflare.com/client/v4/accounts/acc/analytics_engine/sql");
+ assert.equal((init.headers as Record).authorization, "Bearer tok");
+ asked.push(String(init.body));
+ return json({ data: [{ workspace: id, fetches: String(count) }, { workspace: "gone", fetches: 5 }] });
+ };
+ await withFetch(ae, () => worker.scheduled());
+ assert.equal(asked.length, 2);
+ assert.match(asked[1], /SUM\(_sample_interval\).*FROM polyxd_studio_fetches.*GROUP BY index1/);
+ const since = (await row(worker, "harbourline"))!.over_quota_since as string;
+ assert.ok(since, "over quota from this run");
+ const billing = (await mira.call("GET", `${w}/billing`)).body;
+ assert.equal(billing.usage.fetches, 12_000);
+ assert.equal(billing.fetchesPercent, 120);
+ assert.equal(billing.locked, false);
+
+ // Within the grace period, editing works; a second run keeps the first date.
+ assert.equal((await mira.call("POST", `${w}/screens`, { name: "Grace" })).status, 201);
+ await withFetch(ae, () => worker.scheduled());
+ assert.equal((await row(worker, "harbourline"))!.over_quota_since, since);
+
+ // Eight days over: changes are refused with a 402; fetches and reads carry on; billing still opens.
+ await worker.env.DB.prepare("UPDATE workspaces SET over_quota_since = ? WHERE id = ?").bind(new Date(Date.now() - 8 * 86400e3).toISOString(), id).run();
+ const locked = await mira.call("POST", `${w}/screens`, { name: "Locked" });
+ assert.equal(locked.status, 402);
+ assert.equal(locked.body.code, "over_quota");
+ assert.equal((await product.call("GET", `${w}/screens/send`)).status, 200);
+ assert.equal((await mira.call("GET", `${w}/screens`)).status, 200);
+ assert.equal((await mira.call("POST", `${w}/billing/checkout`, { plan: "pro", interval: "month" })).status, 503, "not locked, just not set up");
+ assert.equal((await mira.call("GET", `${w}/billing`)).body.locked, true);
+
+ // Under quota again (a new month, or an upgrade): the lock lifts.
+ count = 900;
+ await withFetch(ae, () => worker.scheduled());
+ assert.equal((await row(worker, "harbourline"))!.over_quota_since, null);
+ assert.equal((await mira.call("POST", `${w}/screens`, { name: "Unlocked" })).status, 201);
+});
+
+test("checkout: owners only, the plan's price, Team's seats, the founding coupon until it runs out", async () => {
+ const worker = await startWorker(STRIPE);
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ const w = "/api/w/harbourline";
+ const sent: URLSearchParams[] = [];
+ let couponLeft = true;
+ const stripe = (url: string, init: RequestInit) => {
+ assert.equal(url, "https://api.stripe.com/v1/checkout/sessions");
+ assert.equal((init.headers as Record).authorization, "Bearer sk_test_fake");
+ const p = new URLSearchParams(String(init.body));
+ sent.push(p);
+ if (p.get("discounts[0][coupon]") && !couponLeft) return json({ error: { message: "Coupon expired", code: "coupon_expired" } }, 400);
+ return json({ id: "cs_1", url: "https://checkout.stripe.com/c/pay/cs_1" });
+ };
+ await withFetch(stripe, async () => {
+ const r = await mira.call("POST", `${w}/billing/checkout`, { plan: "pro", interval: "year" });
+ assert.equal(r.status, 200, JSON.stringify(r.body));
+ assert.equal(r.body.url, "https://checkout.stripe.com/c/pay/cs_1");
+ const p = sent[0];
+ assert.equal(p.get("mode"), "subscription");
+ assert.equal(p.get("line_items[0][price]"), "price_pro_year");
+ assert.equal(p.get("line_items[0][quantity]"), "1");
+ assert.equal(p.get("discounts[0][coupon]"), "FOUNDING");
+ assert.equal(p.get("customer_email"), "mira@harbourline.test");
+ const id = (await row(worker, "harbourline"))!.id;
+ assert.equal(p.get("client_reference_id"), id);
+ assert.equal(p.get("subscription_data[metadata][workspace_id]"), id);
+ assert.equal(p.get("success_url"), "http://localhost:8789/w/harbourline/billing?upgraded=1");
+
+ // Two editors: Pro is for one, Team bills both.
+ const leo = await join(worker, mira, "harbourline", "leo@harbourline.test", "designer");
+ assert.equal(leo.status, 200);
+ assert.equal((await mira.call("POST", `${w}/billing/checkout`, { plan: "pro", interval: "month" })).status, 409);
+ couponLeft = false;
+ const team = await mira.call("POST", `${w}/billing/checkout`, { plan: "team", interval: "month" });
+ assert.equal(team.status, 200);
+ const [withCoupon, without] = sent.slice(-2);
+ assert.equal(withCoupon.get("discounts[0][coupon]"), "FOUNDING");
+ assert.equal(without.get("discounts[0][coupon]"), null, "retried at full price");
+ assert.equal(without.get("allow_promotion_codes"), "true");
+ assert.equal(without.get("line_items[0][price]"), "price_team_month");
+ assert.equal(without.get("line_items[0][quantity]"), "2");
+
+ // Only an owner pays; nonsense is refused before Stripe is asked.
+ const count = sent.length;
+ assert.equal((await leo.as.call("POST", `${w}/billing/checkout`, { plan: "team", interval: "month" })).status, 403);
+ assert.equal((await leo.as.call("POST", `${w}/billing/portal`)).status, 403);
+ assert.equal((await leo.as.call("GET", `${w}/billing`)).body.canManage, false);
+ assert.equal(sent.length, count);
+ assert.equal((await mira.call("POST", `${w}/billing/checkout`, { plan: "enterprise", interval: "month" })).status, 400);
+ assert.equal((await mira.call("POST", `${w}/billing/portal`)).status, 409, "no customer yet");
+ });
+});
+
+test("the webhook: signature checked, plan set from the subscription, seats synced, back to Free when it ends", async () => {
+ const worker = await startWorker(STRIPE);
+ const mira = await worker.signUp("mira@harbourline.test", "Harbourline");
+ const id = (await row(worker, "harbourline"))!.id as string;
+ const hook = worker.client();
+ const send = async (event: unknown, secret = STRIPE.STRIPE_WEBHOOK_SECRET) => {
+ const payload = JSON.stringify(event);
+ const res = await worker.app.request("http://localhost:8789/api/billing/webhook", { method: "POST", headers: { "content-type": "application/json", "stripe-signature": await signPayload(payload, secret) }, body: payload }, worker.env);
+ return res.status;
+ };
+ const end = Math.floor(Date.now() / 1000) + 30 * 86400;
+ const sub = (price: string, quantity: number, status = "active") => ({ id: "sub_1", customer: "cus_1", status, metadata: { workspace_id: id }, items: { data: [{ id: "si_1", quantity, current_period_end: end, price: { id: price } }] } });
+
+ // A request Stripe didn't sign is refused.
+ assert.equal(await send({ type: "customer.subscription.updated", data: { object: sub("price_team_month", 9) } }, "whsec_wrong"), 400);
+ assert.equal((await hook.call("POST", "/api/billing/webhook", { type: "x" })).status, 400);
+ assert.equal((await row(worker, "harbourline"))!.plan, "free");
+
+ // Checkout finished: Studio reads the subscription and sets the plan.
+ const stripeCalls: { url: string; body: string }[] = [];
+ let quantity = 1;
+ await withFetch((url, init) => {
+ stripeCalls.push({ url, body: String(init.body ?? "") });
+ if (url === "https://api.stripe.com/v1/subscriptions/sub_1") return json(sub("price_team_month", quantity));
+ if (url === "https://api.stripe.com/v1/subscription_items/si_1") return json({ id: "si_1" });
+ return json({ error: { message: "unexpected" } }, 500);
+ }, async () => {
+ assert.equal(await send({ type: "checkout.session.completed", data: { object: { mode: "subscription", client_reference_id: id, customer: "cus_1", subscription: "sub_1" } } }), 200);
+ let w = (await row(worker, "harbourline"))!;
+ assert.deepEqual([w.plan, w.plan_status, w.billing_interval, w.seats, w.stripe_customer_id, w.stripe_subscription_id], ["team", "active", "month", 1, "cus_1", "sub_1"]);
+ assert.equal(w.period_end, new Date(end * 1000).toISOString());
+ const billing = (await mira.call("GET", "/api/w/harbourline/billing")).body;
+ assert.equal(billing.plan, "team");
+ assert.equal(billing.subscribed, true);
+
+ // A new editor joins: the subscription's quantity follows, prorated. A viewer doesn't count.
+ assert.equal((await join(worker, mira, "harbourline", "leo@harbourline.test", "designer")).status, 200);
+ const change = stripeCalls.find((c) => c.url.endsWith("/subscription_items/si_1"))!;
+ assert.deepEqual(Object.fromEntries(new URLSearchParams(change.body)), { quantity: "2", proration_behavior: "create_prorations" });
+ assert.equal((await row(worker, "harbourline"))!.seats, 2);
+ quantity = 2;
+ const before = stripeCalls.length;
+ assert.equal((await join(worker, mira, "harbourline", "ana@harbourline.test", "viewer")).status, 200);
+ assert.equal(stripeCalls.length, before, "no Stripe call for a viewer");
+
+ // Checkout again while subscribed is refused; the portal opens.
+ assert.equal((await mira.call("POST", "/api/w/harbourline/billing/checkout", { plan: "team", interval: "year" })).status, 409);
+ w = (await row(worker, "harbourline"))!;
+ assert.equal(w.plan, "team");
+ });
+
+ // Changed in the portal to Pro yearly.
+ assert.equal(await send({ type: "customer.subscription.updated", data: { object: sub("price_pro_year", 1) } }), 200);
+ let w = (await row(worker, "harbourline"))!;
+ assert.deepEqual([w.plan, w.billing_interval], ["pro", "year"]);
+
+ // A failed payment shows at once; Stripe keeps retrying, so the plan stays.
+ assert.equal(await send({ type: "invoice.payment_failed", data: { object: { customer: "cus_1" } } }), 200);
+ w = (await row(worker, "harbourline"))!;
+ assert.deepEqual([w.plan, w.plan_status], ["pro", "past_due"]);
+
+ // A price no STRIPE_PRICE_* names changes nothing.
+ assert.equal(await send({ type: "customer.subscription.updated", data: { object: sub("price_other", 1) } }), 200);
+ assert.equal((await row(worker, "harbourline"))!.plan, "pro");
+
+ // Cancelled: back to Free, the customer kept for next time.
+ assert.equal(await send({ type: "customer.subscription.deleted", data: { object: sub("price_pro_year", 1, "canceled") } }), 200);
+ w = (await row(worker, "harbourline"))!;
+ assert.deepEqual([w.plan, w.plan_status, w.stripe_subscription_id, w.stripe_customer_id, w.period_end], ["free", "canceled", null, "cus_1", null]);
+
+ // The portal, for a workspace with a customer.
+ await withFetch((url, init) => {
+ assert.equal(url, "https://api.stripe.com/v1/billing_portal/sessions");
+ const p = new URLSearchParams(String(init.body));
+ assert.equal(p.get("customer"), "cus_1");
+ assert.equal(p.get("return_url"), "http://localhost:8789/w/harbourline/billing");
+ return json({ url: "https://billing.stripe.com/p/session/1" });
+ }, async () => {
+ const r = await mira.call("POST", "/api/w/harbourline/billing/portal");
+ assert.equal(r.status, 200);
+ assert.equal(r.body.url, "https://billing.stripe.com/p/session/1");
+ });
+});
+
+test("Stripe's signature and form encoding", async () => {
+ const payload = '{"id":"evt_1"}';
+ const t = 1_800_000_000;
+ const header = await signPayload(payload, "whsec_x", t);
+ assert.equal(await verifySignature(payload, header, "whsec_x", 300, t + 10), true);
+ assert.equal(await verifySignature(payload, header, "whsec_x", 300, t + 301), false, "too old");
+ assert.equal(await verifySignature(payload + " ", header, "whsec_x", 300, t), false, "body changed");
+ assert.equal(await verifySignature(payload, header, "whsec_y", 300, t), false, "another secret");
+ assert.equal(await verifySignature(payload, `t=${t},v1=00,${header.split(",")[1]}`, "whsec_x", 300, t), true, "any v1 may match");
+ assert.equal(await verifySignature(payload, undefined, "whsec_x"), false);
+ assert.equal(
+ decodeURIComponent(form({ mode: "subscription", line_items: [{ price: "p", quantity: 2 }], metadata: { workspace_id: "w" }, skip: undefined }).toString()),
+ "mode=subscription&line_items[0][price]=p&line_items[0][quantity]=2&metadata[workspace_id]=w",
+ );
+});
diff --git a/apps/studio/test/support/worker.ts b/apps/studio/test/support/worker.ts
index 30e7541..bbf2bbc 100644
--- a/apps/studio/test/support/worker.ts
+++ b/apps/studio/test/support/worker.ts
@@ -107,14 +107,14 @@ class R2 {
export const APP_URL = "http://localhost:8789";
-/** A fresh Worker with its own empty database, and a caller that keeps a session's cookie. */
-export async function startWorker() {
- const { default: app } = await import("../../src/worker/index.ts");
+/** A fresh Worker with its own empty database, and a caller that keeps a session's cookie. `vars` are extra env (BILLING, Stripe's). */
+export async function startWorker(vars: Record = {}) {
+ const { app, default: worker } = await import("../../src/worker/index.ts");
const DB = new D1();
const migrations = new URL("../../migrations/", import.meta.url);
for (const f of readdirSync(migrations).filter((f) => f.endsWith(".sql")).sort()) DB.db.exec(readFileSync(new URL(f, migrations), "utf8"));
// A secret made for this run only, so sessions sign as they would anywhere.
- const env = { DB, FILES: new R2(), ASSETS: { fetch: async () => new Response("", { status: 404 }) }, APP_URL, AUTH_SECRET: randomBytes(32).toString("hex") };
+ const env = { DB, FILES: new R2(), ASSETS: { fetch: async () => new Response("", { status: 404 }) }, APP_URL, AUTH_SECRET: randomBytes(32).toString("hex"), ...vars };
const silence = console.log;
/** One caller: a browser session (cookies kept) or an API key (a bearer header). */
@@ -149,5 +149,16 @@ export async function startWorker() {
if (w.status !== 201) throw new Error(`workspace: ${w.status} ${JSON.stringify(w.body)}`);
return person;
};
- return { app, env, client, signUp };
+ /** Runs the cron handler once, as the scheduler would. */
+ const scheduled = async () => {
+ const waits: Promise[] = [];
+ console.log = () => undefined;
+ try {
+ await worker.scheduled({} as ScheduledController, env as never, { waitUntil: (p: Promise) => waits.push(p), passThroughOnException: () => undefined } as unknown as ExecutionContext);
+ await Promise.all(waits);
+ } finally {
+ console.log = silence;
+ }
+ };
+ return { app, env, client, signUp, scheduled };
}
diff --git a/apps/studio/wrangler.jsonc b/apps/studio/wrangler.jsonc
index 788082d..a6e6bd5 100644
--- a/apps/studio/wrangler.jsonc
+++ b/apps/studio/wrangler.jsonc
@@ -23,11 +23,17 @@
// The top level is local development: `wrangler dev` uses a local database and bucket, no
// email goes out, and an account works as soon as it's created. Production is `production`.
"vars": { "APP_URL": "http://localhost:8789", "EMAIL_FROM": "Polyxd Studio " },
+ // Plans and billing run only where BILLING is "on" (the hosted Studio sets it as a secret, with
+ // Stripe's). Without it the fetch counter and the hourly rollup do nothing, and there are no limits.
+ "analytics_engine_datasets": [{ "binding": "FETCHES", "dataset": "polyxd_studio_fetches" }],
+ "triggers": { "crons": ["17 * * * *"] },
"env": {
"production": {
"routes": [{ "pattern": "studio.polyxd.com", "custom_domain": true }],
"d1_databases": [{ "binding": "DB", "database_name": "studio", "database_id": "0d0c8972-4d26-4897-8115-471304e74ead", "migrations_dir": "migrations" }],
"r2_buckets": [{ "binding": "FILES", "bucket_name": "polyxd-studio-files" }],
+ "analytics_engine_datasets": [{ "binding": "FETCHES", "dataset": "polyxd_studio_fetches" }],
+ "triggers": { "crons": ["17 * * * *"] },
"vars": { "APP_URL": "https://studio.polyxd.com", "EMAIL_FROM": "Polyxd Studio " },
"workers_dev": false,
"preview_urls": false,
diff --git a/docs/decisions/0004-pricing-and-licensing.md b/docs/decisions/0004-pricing-and-licensing.md
new file mode 100644
index 0000000..5a90bbc
--- /dev/null
+++ b/docs/decisions/0004-pricing-and-licensing.md
@@ -0,0 +1,144 @@
+# 0004 — Pricing and licensing
+
+Status: **being built** (29 Sep 2026): Studio plans, limits and billing (2 and 3) are built on `feat/studio-billing`; the rest in the order under [Build plan](#build-plan).
+
+## Decision
+
+**Everything that runs on your machine or in your app is free and open. We charge for what we host and for what a team needs to work on its own design system together.**
+
+- No "commercial use" licence and no per-render or runtime fees. Apache code can't enforce them, and they'd stop adoption of the spec.
+- The product we sell is **Studio**, priced per editor. Viewers are free.
+- Hosted services (publishing screens by key, private packs through the hosted MCP) are part of Studio plans, not metered separately.
+- Screens, packs and Directions can always be exported as JSON on every plan, so there's no lock-in.
+
+## Licensing
+
+Neelank is the sole copyright holder (every commit is his; AI co-authors hold no copyright). 0.3.0 and earlier stay Apache-2.0 for good. Every later version can be licensed however we choose.
+
+| Part | From 0.4.0 | Why |
+|---|---|---|
+| `spec`, `core`, `react`, `web`, `polyxd` CLI, `a2ui`, `python-spec`, all `ds-*` packs | Apache-2.0 (unchanged) | Adoption. Anyone must be able to implement the spec and render it. |
+| `verifier`, `runtime`, `server`, `mcp` | Apache-2.0 for now | We can move them to FSL-1.1-Apache-2.0 in a later version if a hosted competitor appears. |
+| `apps/studio` | FSL-1.1-ALv2 (done 28 Sep 2026) | Source stays public. Free to self-host for your own team or company; no competing hosted service. Each version becomes Apache-2.0 two years after release. Commits before the change remain Apache-2.0. |
+| `apps/vscode` | Apache-2.0 (unchanged) | Funnel into Studio. |
+
+**CLA (Contributor License Agreement).** Before any outside contribution is merged, require a CLA. It keeps our right to relicense future versions. Use CLA Assistant (a GitHub app, which the user installs) with a CLA text in the repo.
+
+**Trademark policy.** "Polyxd", the mark, and "Polyxd Conformant" belong to us:
+- Anyone may say their renderer is *Polyxd Conformant* if it passes the conformance suite. This is free.
+- Nobody may name a product or hosted service "Polyxd …" without permission.
+
+**Never charge for the packs modelled on named design systems** (Material 3, Carbon, Polaris, …). Their token licences allow it (all MIT or Apache, see NOTICE), but selling them invites trademark trouble.
+
+## Plans
+
+Prices and limits are proposals. **The user sets the final numbers.** Lowered on 29 Sep 2026 from $20 and $45 per editor, which the user judged too much for individuals and small teams.
+
+| | Free | Pro | Team | Enterprise |
+|---|---|---|---|---|
+| For | trying it, side projects | one designer | small and growing teams | companies with security and procurement needs |
+| Price, monthly | $0 | $8 / month | $12 / editor / month | custom, from about $10k / year |
+| Price, yearly (2 months free) | $0 | $80 / year | $120 / editor / year | custom |
+| Workspaces | 1 | 3 | unlimited | unlimited |
+| Editors (owner, design-system, designer, product, engineer) | 2 | 1 | unlimited | unlimited |
+| Viewers | unlimited | unlimited | unlimited | unlimited |
+| Custom design systems (import or from template) | 1 | unlimited | unlimited | unlimited |
+| Directions | 1 | unlimited | unlimited | unlimited |
+| Published screens | 10 | unlimited | unlimited | unlimited |
+| Fetches by key (screens, Directions, tokens) per month | 10k | 250k | 1M | 10M or more, with an SLA |
+| Private packs, screens and Directions through hosted MCP | — | ✓ | ✓ | ✓ |
+| Version history | last 10 | full | full | full |
+| Approval before publish | — | — | ✓ | ✓ |
+| Google sign-in, shared libraries across workspaces | — | — | ✓ | ✓ |
+| SAML/SCIM, audit log, support for self-hosted Studio, SLA, indemnity | — | — | — | ✓ |
+| Export everything as JSON | ✓ | ✓ | ✓ | ✓ |
+
+**Why these numbers.** Studio sits beside a team's design tool, not in place of it, so it must cost well under a design tool's paid seat. $8 is an easy personal expense. A five-person team pays $60 a month, which a team lead can approve without procurement. Free keeps 2 editors so a pair can try Studio together; Pro is for one person who needs more than Free's limits.
+
+**Founding offer.** The first 100 paying workspaces keep half price for as long as they stay subscribed ($4 for Pro, $6 per editor for Team). It rewards early users while there are none yet, and the cap makes it end on its own.
+
+**Always free, no plan needed:** every open package, the CLI, the local verifier, the VS Code extension, self-hosting `@polyxd/server` and `@polyxd/mcp`, and the hosted MCP for public packs (no sign-in; per-IP rate limit only to stop abuse).
+
+**Limits are soft where production depends on them.** Going over the fetch quota never breaks a live app. We warn in Studio and by email at 80% and 100%, and after a 7-day grace period fetches stay up but editing is locked until the workspace upgrades. Hard limits (editors, design systems, Directions, published screens) only block creating new ones.
+
+**Services:** "We build your design-system pack", a fixed fee (proposal: $3–5k). It leads into Team or Enterprise.
+
+## Build plan
+
+Each workstream is its own branch **from `origin/main`**, not local main, because other sessions commit to main. The rule that docs stay current applies: `apps/site/scripts/check-docs.ts` must pass, and every agent brief names the docs it must update.
+
+### 1. Licensing files (small, do first)
+
+- `CONTRIBUTING.md`: how to contribute, the CLA requirement, DCO sign-off for small fixes.
+- `CLA.md`: individual CLA text (based on the Apache ICLA).
+- `TRADEMARKS.md`: the policy above.
+- ~~`apps/studio/LICENSE`~~: done. FSL-1.1-ALv2, `"license": "FSL-1.1-ALv2"`, README, NOTICE and site docs updated.
+- README: a "Licence" section that says what's open, what Studio is, and links to the trademark policy.
+- `PLAN.md`: replace "A paid hosted API" under *Not in scope for v1* with a link to this decision.
+- **User:** install CLA Assistant on the repo.
+
+### 2. Studio plans and limits
+
+Built on `feat/studio-billing` (29 Sep 2026). Everything here applies only when the Worker's `BILLING` is `on`, which only the hosted Studio sets: a self-hosted Studio has no limits and no Billing page (tested both ways).
+
+- ~~Migration `apps/studio/migrations/0007_plans.sql`~~: done.
+ - `workspaces` gains `plan` (default `free`), `plan_status`, `billing_interval`, `seats`, `stripe_customer_id`, `stripe_subscription_id`, `period_end`, `over_quota_since`
+ - `usage (workspace_id, metric, period, count, updated_at)`: monthly totals, `period` as `YYYY-MM`
+- ~~`apps/studio/src/worker/plans.ts`~~: done. `LIMITS` (the one table), `limitsFor`, `editorCount`, `assertCanCreate`, `assertCanEdit`, `pruneHistory`, `planSummary` (what the Billing page shows). `viewer` is free; every other role is an editor.
+- ~~Enforcement points~~: done.
+ - `POST /api/workspaces`: a person may own as many workspaces as the most generous plan among the ones they own allows (Free 1, Pro 3)
+ - invites and invite accept: editor seats, with open editor invites holding a seat; viewers always allowed. New: `DELETE /api/w/:slug/invites/:id` and `DELETE /api/w/:slug/members/:user` (owners), so a seat can be freed
+ - design-system import (a new design system, not a new version of one) and from-template
+ - `POST …/directions`
+ - screen publish (republishing a published screen doesn't count)
+ - Free keeps the last 10 versions of each screen, Direction and design system on save; the published or live one is always kept
+- ~~Fetch metering~~: done. A `GET` by API key of a published screen, a Direction or a design-system export writes one Workers Analytics Engine data point (`FETCHES`, dataset `polyxd_studio_fetches`). The cron runs **hourly** (fresher warnings than daily, and the query is cheap), reads this month and last month back through the Analytics Engine SQL API into `usage`, and sets or clears `over_quota_since`. Seven days over: every change answers 402 `over_quota` until the workspace upgrades or the month turns; fetches, reads and billing keep working. The API key's `last_used_at` is now written at most hourly too.
+- ~~Errors~~: done. 402 `{ error, code: "plan_limit", limit, plan, current, max }`.
+- ~~Tests~~: done, `apps/studio/test/billing.worker.test.ts`.
+- Still to do: warning emails at 80% and 100% (the Billing page shows both); approval before publish and shared libraries (Team) are flags in the table, not features yet.
+
+### 3. Billing (Stripe)
+
+Built on `feat/studio-billing` (29 Sep 2026), with Stripe's REST API through fetch (no SDK), tested with Stripe stood in for; not yet run against Stripe test mode.
+
+- ~~Worker routes~~: done.
+ - `POST /api/w/:slug/billing/checkout` (owners): `{ plan: "pro" | "team", interval: "month" | "year" }`. Team's quantity is the editor count; Pro is refused for a workspace with more than one editor. The founding coupon (`STRIPE_COUPON_FOUNDING`) is applied while Stripe accepts it, then Checkout opens at full price with promotion codes allowed.
+ - `POST /api/w/:slug/billing/portal` (owners)
+ - `POST /api/billing/webhook`: `Stripe-Signature` checked with Web Crypto (HMAC-SHA256, constant-time, 5-minute tolerance); `checkout.session.completed`, `customer.subscription.created|updated|deleted`, `invoice.payment_failed`. Sets `plan`, `plan_status`, `billing_interval`, `seats` and `period_end` from the subscription's price; a deleted subscription puts the workspace back on Free. Enterprise is set by hand and left alone.
+ - `GET /api/w/:slug/billing`: the plan, limits and usage for the app
+- ~~Seat sync~~: done. An editor joining or leaving a Team workspace sets the subscription item's quantity, `proration_behavior: create_prorations`.
+- ~~App~~: done. Workspace → Billing (plan, seats, usage bars, notices for 80%, over quota, paused and past due, monthly or yearly, upgrade and manage for owners) and an upgrade dialog on any 402. Team has Remove and Withdraw.
+- **User:** create the Stripe account, the business details and tax settings; in test mode first, the products and prices (Pro $8/month and $80/year; Team per unit $12/month and $120/year), the founding coupon (50% off, `duration: forever`, max redemptions 100), the Customer Portal settings (switch between those prices, change quantity, cancel), and a webhook endpoint at `https://studio.polyxd.com/api/billing/webhook` for the five events above. A Cloudflare API token with Account Analytics Read. Then `wrangler secret put … --env production` for `BILLING` (`on`), `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `STRIPE_PRICE_PRO_MONTH`, `STRIPE_PRICE_PRO_YEAR`, `STRIPE_PRICE_TEAM_MONTH`, `STRIPE_PRICE_TEAM_YEAR`, `STRIPE_COUPON_FOUNDING`, `CF_ACCOUNT_ID`, `CF_ANALYTICS_TOKEN`, and apply migration 0007 remotely. We never enter keys.
+
+### 4. Site
+
+- `/pricing`: picture-first, following the site design rules (one headline, one line, CTA right under it). Four plan cards, the "always free" list, a short FAQ ("Can I use Polyxd commercially? Yes, free." · "What's open?" · "What happens if I go over?" · "Can I leave?"). Enterprise and the pack-building service get a contact button that emails through Resend.
+- `/trademarks`: the trademark policy.
+- `/terms` (on `feat/legal-listing`, not yet approved): add plans, billing, renewals, refunds, over-quota handling, and the enterprise contract precedence.
+- Nav and footer links; a Studio sign-up CTA from pricing; `check-docs.ts` coverage for the new pages; a social card for `/pricing`.
+- **User:** approve the terms; OK the deploy.
+
+### 5. Hosted MCP: sign-in for private resources
+
+Depends on `feat/mcp-remote` merging.
+
+- Public packs stay authless. Add a per-IP limit with the Workers Rate Limiting binding.
+- Studio as the OAuth provider, using better-auth's MCP/OIDC plugin (Studio already uses better-auth). A signed-in MCP client can list and fetch its workspace's design systems, screens and Directions. Only Pro and above; Free gets a clear message saying which plan unlocks it.
+- Update `packages/mcp/listing` and the directory submission notes: sign-in is optional.
+
+### 6. Enterprise (later; tonight only the contact path)
+
+- Self-hosting Studio is free under FSL. Enterprise sells what self-hosters need on top: SAML/SCIM through better-auth plugins, an audit log table, a support SLA and indemnity. A packaged self-host build (Docker, D1 swapped for SQLite or Postgres) when the first enterprise lead asks.
+
+## Later, only when people ask
+
+- Hosted verification in CI (a GitHub check running the full pack × width × light/dark grid), priced by render-minutes.
+- Hosted generation with Polyxd paying the model, sold as credits. It conflicts with "no bundled model", so only on demand.
+- A pack marketplace with a revenue share for pack authors.
+
+## Open decisions for the user
+
+1. Final prices and Free limits (the table above is a proposal).
+2. The legal entity for Stripe and the terms.
+3. ~~Self-hosted Studio~~: decided 28 Sep. Free under FSL; Enterprise sells SAML, audit, SLA and indemnity.
+4. CLA Assistant, or DCO only (DCO is lighter but doesn't give relicensing rights as clearly).
diff --git a/package-lock.json b/package-lock.json
index f5f9509..69b1c74 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -111,6 +111,7 @@
"apps/studio": {
"name": "@polyxd/studio",
"version": "0.0.1",
+ "license": "FSL-1.1-ALv2",
"dependencies": {
"@polyxd/analytics": "^0.4.1",
"@polyxd/ds-kit": "^0.4.1",