Sync public snapshot from freebuff-private

Source: CodebuffAI/freebuff-private@27cb5242be46f06b4c8e079490afb309aebb3307

Author: github-actions[bot]

bun.lock

@@ -1,6 +1,8 @@
 import { describe, expect, test } from 'bun:test'
 
 import {
+  FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+  FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS,
   FREEBUFF_WEB_LIMITED_MODEL_IDS,
   LIMITED_FREEBUFF_MODEL_ID,
   LIMITED_FREEBUFF_MODEL_IDS,
@@ -103,6 +105,34 @@ describe('paid plans at limited access', () => {
     }
   })
 
+  test('Luna is free at full access and plan-locked only at limited access', () => {
+    expect(FREEBUFF_SUBSCRIPTION_PRO_MODEL_IDS).not.toContain(
+      FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+    )
+    expect(FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS).toContain(
+      FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+    )
+    expect(
+      isFreebuffSessionModelAllowedForAccessTier(
+        FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+        'full',
+      ),
+    ).toBe(true)
+    expect(
+      isFreebuffSessionModelAllowedForAccessTier(
+        FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+        'limited',
+      ),
+    ).toBe(false)
+    expect(
+      isFreebuffSessionModelAllowedForAccessTier(
+        FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+        'limited',
+        true,
+      ),
+    ).toBe(true)
+  })
+
   test('every plan model is admissible at limited access with a plan', () => {
     // The two lists CANNOT drift any more: both the plan set and the predicate
     // read FREEBUFF_PLAN_METERED_CATALOG_MODEL_IDS, since 2026-09-04. This
@@ -121,14 +151,11 @@ describe('paid plans at limited access', () => {
     expect(FREEBUFF_SUBSCRIPTION_MODEL_IDS).toHaveLength(5)
   })
 
-  test('a Pro row is never free at limited access', () => {
-    // The limited catalog excluded Luna BY NAME until 2026-09-04, which was
-    // indistinguishable from "excludes the Pro rows" while Luna was the only
-    // one. Gemini 3.8 Flash separated the two readings, and the by-name
-    // version would have put the dearest row in the catalog into the FREE
-    // limited catalog. Asserted over the whole Pro set so the next row added
-    // to it cannot repeat that.
-    for (const model of FREEBUFF_SUBSCRIPTION_PRO_MODEL_IDS) {
+  test('a limited-tier plan-only row is never free at limited access', () => {
+    // This set is intentionally broader than the global Pro set: Luna is free
+    // at full access and still plan-locked here. Assert over the actual tier
+    // boundary so changing either policy cannot silently widen this catalog.
+    for (const model of FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS) {
       expect(freeAtLimitedTier(model)).toBe(false)
       expect(isFreebuffSessionModelAllowedForAccessTier(model, 'limited')).toBe(
         false,
@@ -138,7 +165,7 @@ describe('paid plans at limited access', () => {
         isFreebuffSessionModelAllowedForAccessTier(model, 'limited', true),
       ).toBe(true)
     }
-    expect(FREEBUFF_SUBSCRIPTION_PRO_MODEL_IDS.length).toBeGreaterThan(0)
+    expect(FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS.length).toBeGreaterThan(0)
   })
 
   test('every plan model resolves in the Web catalog', () => {

common/src/constants/__tests__/freebuff-limited-subscriber.test.ts

@@ -2893,7 +2893,8 @@ export const FREEBUFF_CLOUD_PLANNER_TURN_LIMIT = 12
 /**
  * Models available to limited-region Freebuff Web users.
  *
- * **Widened 2026-09-04 to the whole Web free catalog except GPT-5.6 Luna.**
+ * **Widened 2026-09-04 to the whole Web free catalog except the rows a plan
+ * unlocks at limited access.**
  * It used to alias `LIMITED_FREEBUFF_MODEL_IDS` (Flash, MiMo, Solar), which
  * left limited regions without the CHEAPEST row we serve — GLM 5.3 Flash at 5
  * Freebucks an hour, a third of the Flash price — so the tier that can least
@@ -2906,10 +2907,12 @@ export const FREEBUFF_CLOUD_PLANNER_TURN_LIMIT = 12
  * on a row that goes further. Before the meter, catalog WAS the control, which
  * is why this list was narrow.
  *
- * Luna is the deliberate exception: it stays plan-gated at this tier
+ * Luna is the deliberate full-access exception: it stays plan-gated only at
+ * the limited tier
  * (`isFreebuffSubscriptionModelIdForAccessTier` admits it only with a live
- * paid plan), and the Web picker lists it locked rather than hiding it, so the
- * row is an offer instead of an absence.
+ * paid plan there), while a full-access account may spend its ordinary premium
+ * allowance on it. The Web picker lists it locked at limited access rather
+ * than hiding it, so the row is an offer instead of an absence.
  *
  * Its own name, and NOT `LIMITED_FREEBUFF_MODEL_IDS`, because this is a
  * broader browser catalog: CLI/Desktop also offer GLM 5.3 Flash, while
@@ -2931,17 +2934,13 @@ export const FREEBUFF_CLOUD_PLANNER_TURN_LIMIT = 12
  * cannot import that one — freebuff-subscriptions.ts already imports this
  * module, so the dependency only runs one way.
  *
- * That it is needed here at all is the point. The limited tier's catalog used
- * to exclude Luna by NAME, which was correct only while Luna was the sole row
- * a plan stood in front of; the moment a second one existed, the free limited
- * catalog silently handed it out. One definition, consumed by both, is what
- * stops the next Pro row repeating it.
+ * The limited-tier plan-only set below extends this one. Defining the global
+ * paid boundary once keeps a future Pro row out of the free limited catalog
+ * without making Luna globally Pro-only just because it has the narrower
+ * limited-tier restriction.
  */
 export const FREEBUFF_PRO_ONLY_CATALOG_MODEL_IDS: readonly string[] =
-  Object.freeze([
-    FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
-    FREEBUFF_GEMINI_38_FLASH_MODEL_ID,
-  ])
+  Object.freeze([FREEBUFF_GEMINI_38_FLASH_MODEL_ID])
 
 /** Whether the catalog marks `id` openable only on a paid session. Exact match:
  *  the suffix-tolerant public predicate is
@@ -2950,20 +2949,36 @@ export function isFreebuffProOnlyCatalogModelId(id: string): boolean {
   return FREEBUFF_PRO_ONLY_CATALOG_MODEL_IDS.includes(id)
 }
 
+/**
+ * Rows an unpaid LIMITED-tier account cannot open.
+ *
+ * Every globally Pro-only row belongs here, plus Luna: Luna is part of the
+ * ordinary full-access premium pool, but a paid plan is still what unlocks it
+ * at limited access. Keeping this distinction explicit prevents the global Pro
+ * gate from accidentally paywalling full-access users just to preserve the
+ * limited-tier catalog boundary.
+ */
+export const FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS: readonly string[] =
+  Object.freeze([
+    FREEBUFF_GPT_5_6_LUNA_MODEL_ID,
+    ...FREEBUFF_PRO_ONLY_CATALOG_MODEL_IDS,
+  ])
+
+export function isFreebuffLimitedTierPlanOnlyModelId(id: string): boolean {
+  return FREEBUFF_LIMITED_TIER_PLAN_ONLY_MODEL_IDS.includes(id)
+}
+
 export const FREEBUFF_WEB_GEO_EXEMPT_MODEL_IDS: readonly string[] = [
   ...new Set<string>([
     ...LIMITED_FREEBUFF_MODEL_IDS,
     ...FREEBUFF_WEB_MODELS.filter(
       (model) =>
         isFreebuffWebSelectableModelId(model.id) &&
         !isFreebuffWebGodOnlyModelId(model.id) &&
-        // Every Pro row, not just Luna. This read `!== LUNA` while Luna was
-        // the only model a plan stood in front of, so "the row a plan gates"
-        // and "Luna" were the same set and the narrower reading was the one
-        // written down. Gemini 3.8 Flash joining the Pro rows on 2026-09-04
-        // separated them: the old test would have put the dearest row in the
-        // catalog into the FREE limited catalog.
-        !isFreebuffProOnlyCatalogModelId(model.id),
+        // This is deliberately broader than the global Pro set. Luna is free
+        // from the premium pool at full access but still plan-locked here;
+        // Gemini 3.8 Flash is plan-only at every tier.
+        !isFreebuffLimitedTierPlanOnlyModelId(model.id),
     ).map((model) => model.id),
   ]),
 ]

common/src/constants/freebuff-models.ts

@@ -340,22 +340,19 @@ export const FREEBUFF_SUBSCRIPTION_FIVE_DAY_WINDOW_DAYS = 7
  * reads as the way in, and sends the user to spend a balance that will not
  * open it.
  *
- * ## Why these two, as of 2026-09-04
+ * ## Why Gemini 3.8 Flash
  *
- * GPT-5.6 Luna and Gemini 3.8 Flash are the two dearest rows we serve, and
- * both were already half-fenced. Luna has been plan-locked for the limited
- * tier since 2026-09-04 (`LIMITED_TIER_PLAN_LOCKED_MODELS`) and is in the
- * sub-capped premium half above; Gemini 3.8 Flash was withdrawn outright the
- * day it shipped. Putting both behind the plan is the same decision applied to
- * the whole audience rather than to one tier.
+ * Gemini 3.8 Flash was withdrawn outright the day it shipped and restored as
+ * a Web-only paid row. GPT-5.6 Luna is deliberately NOT in this set: it stays
+ * plan-locked at limited access, but full-access users may spend their shared
+ * premium allowance on it just as CLI and Desktop users can.
  *
  * ## Scope
  *
- * Enforced on FREEBUFF WEB ONLY — see FREEBUFF_PRO_ENFORCED_SURFACES. Desktop
- * and the CLI keep serving Luna free, because a released binary holding the id
- * must not have the model taken away by a server deploy it did not ask for.
- * Widening is one edit to that constant, and should be made with a client
- * release rather than ahead of one.
+ * Enforced on FREEBUFF WEB ONLY — see FREEBUFF_PRO_ENFORCED_SURFACES. Gemini is
+ * absent from the CLI/Desktop catalog, so the Web-only listing and Web-only
+ * gate stay paired. Widening is one edit to that constant, and should be made
+ * with a client release rather than ahead of one.
  *
  * Withdrawn history: V4 Pro was the one entry for a few hours (#2254) and left
  * on 2026-08-26 with its withdrawal from free mode — a row nothing may admit
@@ -368,11 +365,13 @@ export const FREEBUFF_SUBSCRIPTION_PRO_MODEL_IDS: readonly string[] =
 /**
  * The Pro rows are enforced on **Freebuff Web only**, for now.
  *
- * Desktop and the CLI keep serving V4 Pro exactly as they do today — free, at
- * every hour, on the Cheaper Inference lane with its existing fallbacks —
- * while Web moves to the paid, direct, off-peak arrangement. Legacy clients
- * are mid-transition and must not have a model taken away by a server deploy
- * they did not ask for.
+ * The current Pro row, Gemini 3.8 Flash, is Web-only too. A future native
+ * rollout must add the surface here before adding the row to the shared
+ * CLI/Desktop catalog, and must ship clients that understand the refusal
+ * before the server can take a model away from them.
+ *
+ * Luna is deliberately outside this policy: it is available from the shared
+ * premium pool on every full-access surface.
  *
  * Web is identified server-side by the Freebuff Web SERVICE ACCOUNT key, never
  * by a client-supplied header, so a CLI cannot claim to be Web to dodge the