🛡 Operator only

Premium Operator Desk

Check licenses, payment refs, seat limits, and unlock signals. Not for members.

Set Discord webhook in premium/premium.js (NOTIFY_WEBHOOK_URL) so unlocks ping you.

Operator desklicenses · payments · sharing

Seat ledger

How you know someone paid: BMC receipt → you add/update a row in premium.js with paymentRef + licenseId → they unlock → webhook/local log shows License ID.

Webhook

Create a Discord channel webhook, paste the URL into NOTIFY_WEBHOOK_URL in premium/premium.js, commit, redeploy. Every unlock then posts member, License ID, payment ref, IP, TZ, UA.

Lookup

Enter an access name (BLOCK) or License ID (OK-PREM-BLOCK-001).

All licenses

Access	License ID	Status	Seats	Tier	Issued	Payment ref	Notes

Unlock log (this browser)

Local signal only, the Discord webhook is the durable feed. This log helps when testing on your machine.

No local unlock events yet.

Sharing response protocol

Detect: Webhook shows same License ID from distant IPs/timezones in a short window, or member reports a leak.
Confirm: Message the original payer on Discord with License ID + times. Ask if they authorized the other unlocks.
Contain: In premium.js set status: 'suspended' or 'revoked', rotate password/PIN hashes, redeploy. Suspended seats fail unlock with a clear message.
Resolve: If payer was compromised, re-issue new credentials, keep License ID or bump suffix. If intentional sharing, revoke; they can buy a new seat.
Record: Update paymentRef / notes with the incident date so the ledger stays honest.

Issuing a new paid seat

Confirm BMC payment (amount, name/note, date).
Pick access name (A-Z0-9). Generate password + 4-digit PIN.
Add hashes to USERS and a row to LICENSES with licenseId, paymentRef (e.g. BMC #1234 · $20 · 2026-09-17), seats: 1, status: 'active'.
Commit, deploy, DM credentials + License ID. Never post secrets in public Discord.