Merge branch 'master' into dependabot/github_actions/actions-c303e18619

Author: mastermanas805

plans/plans.go

@@ -886,6 +886,7 @@ plans:
       alerts: true
       custom_domains: true
       sla: true
+      dedicated: true # Team gets dedicated infra like Growth (bug bash #12)
   # team_yearly mirrors team exactly. $1990/yr = $199 x 10 ("2 months free" vs $199 x 12).
   team_yearly:
     display_name: "Team (yearly)"
@@ -920,6 +921,7 @@ plans:
       alerts: true
       custom_domains: true
       sla: true
+      dedicated: true # mirrors team (bug bash #12)
   growth:
     display_name: "Growth"
     price_monthly_cents: 9900

plans/plans_test.go

@@ -412,6 +412,8 @@ func TestRegistry_TierHelpers(t *testing.T) {
 	assert.Equal(t, "Pro", r.DisplayName("pro"))
 	assert.False(t, r.IsDedicatedTier("pro"))
 	assert.True(t, r.IsDedicatedTier("growth"))
+	// bug bash #12: Team ($199, above Growth) also gets dedicated infra.
+	assert.True(t, r.IsDedicatedTier("team"))
 	// W11: hobby_plus is the mid-tier — $19/mo, custom domains, 2 apps.
 	assert.Equal(t, 1900, r.PriceMonthly("hobby_plus"),
 		"hobby_plus monthly price must be $19/mo (1900 cents)")

queueprovider/nats/nats.go

@@ -389,8 +389,12 @@ func (p *Provider) RevokeTenantCredentials(ctx context.Context, keyID string) er
 	accClaims.Name = val.accountJWT // placeholder — re-encoding deletes effectively
 	// Set the account "Deleted" flag by zeroing limits and pushing.
 	accClaims.Limits.JetStreamLimits = jwt.JetStreamLimits{}
+	// Conn: 0 means "zero connections allowed" — i.e. fully revoked. A NEGATIVE
+	// value (-1) means UNLIMITED in NATS account limits, which would do the
+	// exact opposite of revocation and let a deleted/revoked tenant keep
+	// connecting. Must be 0 to disable the account.
 	accClaims.Limits.AccountLimits = jwt.AccountLimits{
-		Conn: -1,
+		Conn: 0,
 	}
 	accClaims.Exports = jwt.Exports{}
 	accClaims.Imports = jwt.Imports{}