Gate Routing, Secrets, Host Console, and Mesh dashboard/settings surfaces on the existing useExperimental readiness flag so immature operator surfaces stay out of the default UI while paid and admin backend gates remain unchanged.
* feat(pricing): collapse to two tiers (Community + Admiral)
Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral)
to two: a generous free Community tier and a single paid Admiral tier. The
Skipper tier is removed.
Now free in Community: auto-heal, auto-update, scheduled operations,
webhooks, notification routing, Fleet Actions and bulk operations, SSO
preset providers (Google / GitHub / Okta), unlimited users with admin and
viewer roles, and deploy safety (atomic deploys, auto-rollback, and
one-click rollback).
Admiral (paid) is focused on running and governing a fleet: blueprints,
Fleet Secrets, deploy enforcement, vulnerability report export, audit log,
host console, private registries, mesh networking, node cordon, managed
cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles
(deployer, node-admin, auditor) with per-resource scoped assignments.
Internally the license variant distinction is removed so tier is binary
(community / paid). License validation still verifies the Lemon Squeezy
store and product before granting paid status.
Docs and the contributor guide are updated to the two-tier model.
* docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording
The licensing docs page kept the old Admiral pricing plus a Founder
Lifetime column and an Enterprise paragraph after the two-tier collapse.
Update it to $12/month or $99/year, drop the lifetime and Enterprise
content, and link to the pricing page for current pricing.
Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title,
and three test comments. Historical CHANGELOG entries and the
retired-Skipper license-guard test are intentionally left as-is.
* docs: align licensing and SSO pages with the two-tier model
Correct the SSO overview so the Google, GitHub, and Okta presets read as
available on every tier, matching the provider table; only LDAP and Active
Directory require Sencho Admiral. Remove the lifetime-plan references from the
licensing, settings, and troubleshooting pages so they reflect subscription-only
Admiral pricing.
* fix(rbac): omit scoped permissions from /me on the Community tier
Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case.
* docs: use custom-pricing wording on the contact page
The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.
* test(dashboard): cover dashboard routes, ConfigurationStatus tier parity, and useMeshDataPlane
The dashboard router had no dedicated Vitest coverage; tier parity in the
ConfigurationStatus component was only proved by manual inspection; and the
Admiral short-circuit in useMeshDataPlane had no automated regression net.
Add three spec files:
- backend/src/__tests__/dashboard-routes.test.ts: 11 cases against the live
Express app. Both routes reject unauthenticated requests; the
configuration response matches its documented shape; the tier x variant
`locked` matrix is asserted end-to-end for Community, Skipper, and
Admiral via LicenseService spies; a seeded Discord agent URL is shown
never to appear in the serialized response; /stack-restarts clamps days
values of 0, 999, and NaN without bailing.
- frontend/src/components/dashboard/__tests__/ConfigurationStatus.test.tsx:
five render cases prove the parity contract. Community hides the entire
Automation section plus the four gated rows (Notification routing,
Webhooks, Scheduled tasks, Vulnerability scanning); Skipper shows
everything except Scheduled tasks (Admiral-only); Admiral shows every
gated row plus the SSO provider name mapping (oidc_google -> "Google").
Skeleton and load-error paths are also covered.
- frontend/src/components/dashboard/__tests__/useMeshDataPlane.test.tsx:
four hook cases prove the Admiral short-circuit. Non-Admiral sessions
never fire /mesh/status; Admiral sessions fetch once and populate the
localDataPlane payload; a 403 response leaves status null without
raising; a response that omits localDataPlane also leaves status null.
Backend route suite + dashboard-only frontend suite green in isolation.
The full backend suite shows one pre-existing Windows-only EBUSY flake in
filesystem-backup.test.ts (SQLite file lock on unlink) that reproduces on
the unmodified branch tip and is unrelated to these changes.
* test(dashboard): drop backup.requiredTier from ConfigurationStatus fixture
The fixture's `backup.requiredTier: 'admiral'` field was authored to match
the type on this branch's original base. Main has since removed that field
from the ConfigurationStatus payload, so the fixture now over-specifies a
property the type forbids and fails tsc.
Drop the field to realign with the current type.
Anso