[helpcodeai]

Summary

Before a Cloud workspace picks a plan, it should know what that plan keeps and what it pauses. This PR adds the data. The dashboard warning before checkout (next PR) and the automatic downgrade (the PR after) both use it. One ranking serves both, so the warning and the downgrade always name the same connectors.

Changes

• license/plan-fit.ts (pure functions):
  • CLOUD_PLAN_LIMITS: Starter 5/3/1, Team 15/10/3, mirroring the licence site.
  • rankForCap: most tool calls in the last 30 days first, then the most recently changed, then by id.
  • evaluatePlanFit: per axis { current, max, over } for connectors, MCP servers, users, File Search folders, files and storage, saved code tools and code runs this month; inline code in use against included; keep and pause lists for connectors, MCP servers and File Search folders.
  • anonymizePlanFit: drops names for the page without a sign-in.
• license/plan-fit.service.ts: reads one workspace snapshot. It counts active connectors and servers, keeps File Search folders apart and leaves the File Share connector out. File counts go through FileSearchRepository.withTenant. Every query filters on organizationId.
• GET /api/license/plan-fit[?plan=starter|team]: JWT or management key, so the CLI can call it. 404 on self-hosted and without a workspace, 400 for any other plan.
• /api/license/reactivate/:token returns planFit for both plans without connector or server names. That page opens without a sign-in. If the read fails, the page still answers with planFit: null.
• GET /api/license/usage and the trial creation caps count only active connectors and MCP servers, and leave File Search folders out (File Search has its own limits). A paused connector can be swapped back in. On Cloud today, 5 of about 9,700 connectors are inactive.
• paywall_action accepts plan_fit_shown and plan_fit_details_opened, so the next PR can track the block.
• CLI: regenerated operations.ts (license planFitForUser); README recipe "Check what a plan change would pause (Cloud)". No new command is needed: amcp api calls any path.

Cloud vs self-hosted: Cloud only. On self-hosted the endpoint answers 404 and the usage counts keep their meaning there (no caps).

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

In packages/backend, after npx prisma generate:

• npx jest --maxWorkers=4 src/license src/auth src/file-search src/audit src/mcp-servers: all pass except src/auth/jwt-or-management-key.guard*.spec.ts. Those 13 tests need a local Postgres and fail the same way on main in this environment (baseline, not touched here).
• New tests:
  • plan-fit.spec.ts: ranking, evaluation for Starter and Team, inline code, anonymizing, and snapshot queries scoped to the org;
  • controller tests for plan-fit (both plans, one plan, 400, 404 on self-hosted or without a workspace);
  • reactivation tests (no names leak, a failed read gives planFit: null);
  • the getUsage counting filters.
• npm run lint: 0 errors. The 11 warnings already exist on main.
• npx tsc --noEmit -p tsconfig.json: clean.

In packages/cli, npm test: 0 failed, 2 skipped.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title

Related Issues

Second step of the Team-trial plan, after #1599 (trial limits = Team). Next: the warning UI, then the automatic downgrade.