Sync public snapshot from freebuff-private

Source: CodebuffAI/freebuff-private@b9d3f8c3096ef95a002a013b3b3a8d8777279802

Author: github-actions[bot]

bun.lock

@@ -437,9 +437,9 @@ describe('freebuff model availability', () => {
   test('GLM 5.3 Flash is UNMETERED, and the two flags that say so agree', () => {
     // Unmetered on 2026-08-28, matching DeepSeek V4 Flash and MiMo. It was
     // premium-pooled while its cost was unknown; measured prod spend settled
-    // that at $[redacted]/msg — the cheapest row we serve, 8.9x under the
-    // already-unmetered V4 Flash. Capping the cheapest model while the dearer
-    // ones run uncapped inverts the reason caps exist.
+    // that as the cheapest row we serve, 8.9x under the already-unmetered
+    // V4 Flash. Capping the cheapest model while the dearer ones run uncapped
+    // inverts the reason caps exist.
     expect(
       getFreebuffPerModelSessionCap(FREEBUFF_GLM_V53_FLASH_MODEL_ID),
     ).toBeUndefined()
@@ -791,7 +791,7 @@ describe('freebuff model availability', () => {
   test('Kimi K2.7 Code is fully removed from Freebuff', () => {
     // Removed 2026-07-31 (client pickers went first, on 2026-07-30). The server
     // half is gone too, so a stale client selection is no longer admitted —
-    // that tail was still spending ~$[redacted]/day. Paid/BYOK Kimi is unaffected;
+    // that tail was still a material daily spend. Paid/BYOK Kimi is unaffected;
     // it never resolves through these helpers.
     expect(SUPPORTED_FREEBUFF_MODELS.map((model) => model.id)).not.toContain(
       FREEBUFF_KIMI_MODEL_ID,
@@ -1235,8 +1235,8 @@ describe('freebuff model availability', () => {
   })
 
   test('MiniMax M3 is withdrawn: recognised, refused, served to nobody', () => {
-    // Withdrawn from free mode entirely on 2026-08-20 after reaching $[redacted]/hr.
-    // Out of every picker and pool...
+    // Withdrawn from free mode entirely on 2026-08-20 after its hourly burn
+    // became the largest single line on the bill. Out of every picker and pool...
     expect(FREEBUFF_MODELS.map((model) => model.id)).not.toContain(
       MINIMAX_M3_MODEL_ID,
     )

common/src/__tests__/freebuff-models.test.ts

@@ -62,7 +62,7 @@ describe('Ox Alpha is withdrawn from every surface', () => {
    * This test used to assert the exact opposite ("is on every surface, and
    * carries its CLI root with it"). It flipped because the host ended the free
    * promotion, not because the measurements that justified widening it were
-   * wrong — the four days of $[redacted] traffic recorded in
+   * wrong — the four days of $0.0000 traffic recorded in
    * docs/freebuff-ox-alpha.md all happened.
    *
    * What the flip costs is the thing the doc warned about in advance: on CLI

common/src/__tests__/ox-alpha.test.ts

@@ -500,7 +500,7 @@ export const FREE_MODE_AGENT_MODELS: Record<string, Set<string>> = {
   // been hidden from every client picker in 75fb0ade6 (2026-07-30) while
   // deliberately staying valid here and in session admission, so released
   // clients weren't broken mid-session. That tail kept costing real spend
-  // (~$[redacted]/day, [redacted]% of free-mode cost) because CLI builds older than 75fb0ade6
+  // (a double-digit share of free-mode cost) because CLI builds older than 75fb0ade6
   // never drop a saved Kimi preference, and nothing forces those users to
   // upgrade. Every remaining free-mode Kimi request now 403s with
   // 'free_mode_invalid_agent_model'. Paid/BYOK Kimi is unaffected: the

common/src/constants/free-agents.ts

@@ -0,0 +1,123 @@
+/**
+ * Freebuff account standing ("Access Level") — the PRESENTATIONAL half.
+ *
+ * This file carries everything a client may see: the level names, their
+ * user-facing labels and blurbs, and the wire shapes for standing info. The
+ * actual limit matrix, thresholds and scorer live in
+ * `./freebuff-trust.ts`, which is deliberately EXCLUDED from the public-repo
+ * export (see scripts/public-export-manifest.txt) — a published limit is a
+ * published target, so the numbers must never ship in a public file. Keep
+ * that split when adding here: names, labels and shapes only, never numbers.
+ */
+
+import type { FreebuffAccessTier } from './freebuff-models'
+
+/**
+ * Ordered least- to most-established. The order is load-bearing:
+ * `FREEBUFF_TRUST_LEVELS.indexOf` is how "at least X" comparisons are done, so
+ * inserting a level in the middle re-ranks every comparison in one edit rather
+ * than requiring each call site to be found.
+ */
+export const FREEBUFF_TRUST_LEVELS = [
+  'new',
+  'verified',
+  'established',
+  'core',
+] as const
+
+export type FreebuffTrustLevel = (typeof FREEBUFF_TRUST_LEVELS)[number]
+
+/** The level an account holds before anything is known about it. Every failure
+ *  path in the resolver must land somewhere DEFINITE, and this is not it — see
+ *  `FREEBUFF_TRUST_FALLBACK_LEVEL`. */
+export const FREEBUFF_TRUST_MIN_LEVEL: FreebuffTrustLevel = 'new'
+
+/**
+ * The level used when signals cannot be loaded (database error, timeout).
+ *
+ * `established` and NOT `new`, and this is the single most consequential
+ * constant in the file. This resolver runs on the free-mode hot path; if a
+ * Postgres hiccup dropped every caller to `new`, one degraded dependency would
+ * throttle the entire product to a fifth of its capacity, and it would look
+ * exactly like an outage nobody could attribute. Failing to the level that
+ * reproduces roughly today's flat limits means a broken resolver costs us the
+ * enforcement, never the users. Same reasoning as the signup gate's fail-open.
+ */
+export const FREEBUFF_TRUST_FALLBACK_LEVEL: FreebuffTrustLevel = 'established'
+
+export function isAtLeastTrustLevel(
+  level: FreebuffTrustLevel,
+  minimum: FreebuffTrustLevel,
+): boolean {
+  return (
+    FREEBUFF_TRUST_LEVELS.indexOf(level) >=
+    FREEBUFF_TRUST_LEVELS.indexOf(minimum)
+  )
+}
+
+/** User-facing name. Never says "trust", "risk" or "score" — a user reading
+ *  their own level is reading an explanation of their limits, not a verdict on
+ *  their character. */
+export const FREEBUFF_TRUST_LEVEL_LABELS: Record<FreebuffTrustLevel, string> = {
+  new: 'Getting started',
+  verified: 'Verified',
+  established: 'Established',
+  core: 'Core member',
+}
+
+/** One line of user-facing copy per level, shown under the label. */
+export const FREEBUFF_TRUST_LEVEL_BLURBS: Record<FreebuffTrustLevel, string> = {
+  new: 'Welcome! Your account is brand new, so limits start small. They open up quickly — the steps below take a few minutes.',
+  verified:
+    'Your account is verified. You have solid daily limits, and a bit of history unlocks the next level.',
+  established:
+    'You are an established Freebuff user with generous limits on messages, spend and premium sessions.',
+  core: 'You are a core member. You get the highest free limits we offer, in every region.',
+}
+
+/** A signal that moved the score, in user-facing language. */
+export interface FreebuffTrustFactor {
+  id: string
+  label: string
+  points: number
+}
+
+/** Something the user can do to move up, with what it is worth. */
+export interface FreebuffTrustNextStep {
+  id: string
+  label: string
+  detail: string
+  points: number
+  /** Where the UI should send them. Relative to the freebuff web app. */
+  href?: string
+}
+
+export interface FreebuffStandingHighlight {
+  label: string
+  value: string
+}
+
+/**
+ * NOTE FOR CALLERS: `highlights` is what the level WOULD grant, which is only
+ * what the account actually gets once `FREEBUFF_TRUST_LEVELS=enforce`. Both
+ * producers gate on that (the Earn route and the session `standing` field), so
+ * a client that receives this can render it as fact. A third producer must do
+ * the same — see the comment in freebuff/web/src/app/api/web/standing/route.ts
+ * for what happens otherwise.
+ */
+export interface FreebuffStandingInfo {
+  level: FreebuffTrustLevel
+  label: string
+  blurb: string
+  score: number
+  /** Score at which the next level starts, or null at `core`. */
+  nextLevelAt: number | null
+  nextLevel: FreebuffTrustLevel | null
+  cappedBy: string | null
+  cappedReason: string | null
+  factors: FreebuffTrustFactor[]
+  nextSteps: FreebuffTrustNextStep[]
+  accessTier: FreebuffAccessTier
+  /** Semantic, never numeric — see FreebuffStandingHighlight. */
+  highlights: FreebuffStandingHighlight[]
+}

common/src/constants/freebuff-models.ts

@@ -44,8 +44,9 @@ export const FREEBUFF_SUBSCRIPTION_MODEL_IDS: readonly string[] = Object.freeze(
 /**
  * The expensive half of the pool, sub-capped within each day.
  *
- * Measured 2026-08-21: Luna $[redacted] and DeepSeek V4 Pro $[redacted] per hour-session,
- * against Flash at $[redacted] — roughly 4-5x. Without a sub-cap a subscriber
+ * Measured 2026-08-21: Luna and DeepSeek V4 Pro each cost roughly 4-5x Flash
+ * per hour-session (dollar figures live in the internal cost notes, not in
+ * this exported file). Without a sub-cap a subscriber
  * spending every daily session on Luna costs 5x one spending them on Flash, at
  * the same price, so the daily allowance would have to be priced for the worst
  * case and would be small for everyone.
@@ -183,8 +184,9 @@ export const FREEBUFF_SUBSCRIPTION_TIERS: readonly FreebuffSubscriptionTier[] =
       introPriceUsd: 5,
       // Resized 2026-08-27, before the public rollout. The pre-rollout
       // figures were sized against god-only testing and priced most of a
-      // month of premium use into $8 — at Luna's measured $[redacted]/session,
-      // 4/day was ~$[redacted] of compute. The 5-DAY window is what actually bounds a
+      // month of premium use into $8 — at Luna's measured per-session cost,
+      // 4/day was an order of magnitude more compute than the price
+      // (figures in the internal cost notes). The 5-DAY window is what actually bounds a
       // heavy week (3/day would allow 15 in five days; 10 is the real cap),
       // which is why the two numbers are not simply proportional.
       dailySessions: 3,

common/src/constants/freebuff-standing.ts

@@ -1,5 +1,5 @@
 import type { FreebuffAccessTier } from '../constants/freebuff-models'
-import type { FreebuffStandingInfo } from '../constants/freebuff-trust'
+import type { FreebuffStandingInfo } from '../constants/freebuff-standing'
 
 /**
  * Wire-level shapes returned by `/api/v1/freebuff/session`. Source of truth

common/src/constants/freebuff-subscriptions.ts

@@ -54,8 +54,8 @@ export const FREEBUFF_PAUSED_MODEL_NOTICE =
  *
  * 2026-08-28: GLM 5.3 Flash is now UNMETERED, joining MiMo and DeepSeek V4
  * Flash. The 2-a-day cap came off on 08-27 when its measurement window closed;
- * a day of production spend then settled the cost question outright — it bills
- * $[redacted]/msg, the cheapest row we serve, 4.6x under MiMo and 8.9x under V4
+ * a day of production spend then settled the cost question outright — it is
+ * the cheapest row we serve per message, 4.6x under MiMo and 8.9x under V4
  * Flash, both of which already ran uncapped. Keeping a ceiling on the cheapest
  * model while the dearer ones had none inverted the reason ceilings exist.
  *