fraim-hub 2.0.204

package/dist/src/services/persona-entitlement-service.js

@@ -0,0 +1,352 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSubscriptionActive = computeSubscriptionActive;
+exports.resolvePersonaAccessStatuses = resolvePersonaAccessStatuses;
+exports.buildUngatedPersonaWorkspaceState = buildUngatedPersonaWorkspaceState;
+exports.buildPersonaHireUrl = buildPersonaHireUrl;
+exports.syncPersonaEntitlementPurchase = syncPersonaEntitlementPurchase;
+exports.syncPersonaEntitlementFromCheckoutSession = syncPersonaEntitlementFromCheckoutSession;
+exports.getWorkspacePersonaState = getWorkspacePersonaState;
+exports.evaluatePersonaAccess = evaluatePersonaAccess;
+const persona_hiring_1 = require("../config/persona-hiring");
+const persona_capability_bundles_1 = require("../config/persona-capability-bundles");
+const workspace_identity_1 = require("./workspace-identity");
+const DEFAULT_JOB_CREDITS = 1;
+// The one place the "is the persona system gating this workspace?" question is
+// answered. A workspace is subscribed if it explicitly opted in (personaSystemActive)
+// or has ever held an active entitlement. Shared by getWorkspacePersonaState and
+// evaluatePersonaAccess so display and enforcement can never diverge.
+function computeSubscriptionActive(apiKeyData, entitlements) {
+    return apiKeyData?.personaSystemActive === true || entitlements.some((e) => e.status === 'active');
+}
+// Single source of truth for per-persona access, mirroring evaluatePersonaAccess's
+// gating rules exactly:
+//   - `ungated` (feature flag OFF, or legacy/never-subscribed workspace) => every
+//     persona is accessible ('hired').
+//   - otherwise => 'hired' iff the workspace holds an active entitlement for it.
+// Pure and DB-free so it is trivially testable and callable from either code path.
+function resolvePersonaAccessStatuses(ungated, entitlements) {
+    const activeByKey = new Map();
+    for (const entitlement of entitlements) {
+        if (entitlement.status !== 'active')
+            continue;
+        const list = activeByKey.get(entitlement.personaKey) || [];
+        list.push(entitlement);
+        activeByKey.set(entitlement.personaKey, list);
+    }
+    return (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => {
+        const active = activeByKey.get(bundle.personaKey) || [];
+        const seatCount = active.reduce((sum, e) => sum + (e.jobCreditsRemaining ?? 1), 0);
+        return {
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            status: (ungated || active.length > 0) ? 'hired' : 'locked',
+            seatCount,
+        };
+    });
+}
+// The persona-entitlements feature is OFF: there is no gating, so every persona is
+// accessible. Returned by /api/personas/me instead of a 404 so downstream consumers
+// (the Hub especially) inherit "flag off => all employees available" rather than
+// inventing their own fallback. Matches maybeBuildPersonaLockResponse, which also
+// short-circuits to "allowed" when the flag is off. No DB lookup is required.
+function buildUngatedPersonaWorkspaceState(userId, apiKey) {
+    return {
+        featureFlagEnabled: false,
+        featureFlags: { personaEntitlementsEnabled: false },
+        subscriptionActive: false,
+        workspaceId: normalizeEmail(userId),
+        userId: normalizeEmail(userId),
+        apiKey: apiKey || null,
+        entitlements: [],
+        catalog: (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => ({
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            protectedJobs: bundle.protectedJobs,
+        })),
+        lockedPersonas: [],
+        personas: resolvePersonaAccessStatuses(true, []),
+    };
+}
+function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+function mergeMetadata(existingMetadata, nextMetadata) {
+    if (!existingMetadata && !nextMetadata) {
+        return undefined;
+    }
+    return {
+        ...(existingMetadata || {}),
+        ...(nextMetadata || {})
+    };
+}
+function buildPersonaHireUrl(personaKey, hireMode = 'job', returnTo) {
+    const params = new URLSearchParams({
+        persona: personaKey,
+        mode: hireMode
+    });
+    if (returnTo) {
+        params.set('returnTo', returnTo);
+    }
+    return `/pricing?${params.toString()}`;
+}
+async function resolveWorkspaceContext(dbService, input) {
+    const normalizedUserId = normalizeEmail(input.userId);
+    let apiKey = input.workspaceId ? await dbService.getApiKeyByWorkspaceId(input.workspaceId, false) : null;
+    if (!apiKey && input.stripeCustomerId) {
+        apiKey = await dbService.getApiKeyByStripeCustomerId(input.stripeCustomerId);
+    }
+    if (!apiKey) {
+        apiKey = await dbService.getApiKeyByUserId(normalizedUserId, false);
+    }
+    const workspaceId = (0, workspace_identity_1.resolveWorkspaceId)({
+        workspaceId: apiKey?.workspaceId || input.workspaceId || undefined,
+        stripeCustomerId: input.stripeCustomerId || apiKey?.stripeCustomerId || undefined,
+        email: normalizedUserId
+    }) || `user:${normalizedUserId}`;
+    if (apiKey && apiKey.workspaceId !== workspaceId) {
+        await dbService.updateApiKey(apiKey.key, { workspaceId });
+        apiKey.workspaceId = workspaceId;
+    }
+    return {
+        workspaceId,
+        orgId: apiKey?.orgId || input.orgId || 'default',
+        apiKey
+    };
+}
+async function syncPersonaEntitlementPurchase(dbService, input) {
+    const persona = persona_hiring_1.PERSONA_HIRE_CATALOG[input.personaKey];
+    const normalizedUserId = normalizeEmail(input.userId);
+    const workspace = await resolveWorkspaceContext(dbService, {
+        userId: normalizedUserId,
+        orgId: input.orgId,
+        stripeCustomerId: input.stripeCustomerId
+    });
+    const existing = await dbService.getPersonaEntitlement(workspace.workspaceId, input.personaKey, input.hireMode);
+    const currentPurchaseCount = existing?.purchasedCount || 0;
+    const isNewPurchase = !existing || (input.stripeCheckoutSessionId &&
+        existing.stripeCheckoutSessionId !== input.stripeCheckoutSessionId) || (input.stripeSubscriptionId &&
+        existing.stripeSubscriptionId !== input.stripeSubscriptionId);
+    const jobCreditsIncluded = input.hireMode === 'job'
+        ? (existing?.jobCreditsIncluded || 0) + (isNewPurchase ? DEFAULT_JOB_CREDITS : 0)
+        : 0;
+    const jobCreditsRemaining = input.hireMode === 'job'
+        ? (existing?.jobCreditsRemaining || 0) + (isNewPurchase ? DEFAULT_JOB_CREDITS : 0)
+        : null;
+    const entitlement = await dbService.upsertPersonaEntitlement({
+        workspaceId: workspace.workspaceId,
+        userId: normalizedUserId,
+        orgId: workspace.orgId,
+        personaKey: input.personaKey,
+        personaName: persona.displayName,
+        personaRole: persona.role,
+        hireMode: input.hireMode,
+        status: input.status || 'active',
+        stripeCustomerId: input.stripeCustomerId || existing?.stripeCustomerId || null,
+        stripeSubscriptionId: input.stripeSubscriptionId || existing?.stripeSubscriptionId || null,
+        stripeCheckoutSessionId: input.stripeCheckoutSessionId || existing?.stripeCheckoutSessionId || null,
+        purchaseSource: input.purchaseSource,
+        purchasedCount: currentPurchaseCount + (isNewPurchase ? 1 : 0),
+        jobCreditsIncluded,
+        jobCreditsRemaining,
+        activatedAt: existing?.activatedAt || new Date(),
+        expiresAt: input.expiresAt ?? existing?.expiresAt ?? null,
+        canceledAt: input.status === 'expired' ? new Date() : null,
+        metadata: mergeMetadata(existing?.metadata, input.metadata)
+    });
+    // Transition a legacy workspace into the persona system on first purchase.
+    if (workspace.apiKey?.key && !workspace.apiKey.personaSystemActive) {
+        await dbService.updateApiKey(workspace.apiKey.key, { personaSystemActive: true }).catch(() => { });
+    }
+    return entitlement;
+}
+async function syncPersonaEntitlementFromCheckoutSession(dbService, session, purchaseSource) {
+    const personaKey = session.metadata?.personaKey;
+    const rawHireMode = session.metadata?.hireMode;
+    const email = session.customer_details?.email || session.customer_email;
+    if (!personaKey || !(0, persona_hiring_1.isPersonaHireKey)(personaKey) || !email || !rawHireMode || (rawHireMode !== 'job' && rawHireMode !== 'fulltime')) {
+        return null;
+    }
+    const customerId = !session.customer
+        ? null
+        : (typeof session.customer === 'string' ? session.customer : session.customer.id);
+    const subscriptionId = !session.subscription
+        ? null
+        : (typeof session.subscription === 'string' ? session.subscription : session.subscription.id);
+    return await syncPersonaEntitlementPurchase(dbService, {
+        userId: email,
+        stripeCustomerId: customerId,
+        stripeSubscriptionId: subscriptionId,
+        stripeCheckoutSessionId: session.id,
+        personaKey,
+        hireMode: rawHireMode,
+        purchaseSource,
+        metadata: session.metadata || {}
+    });
+}
+async function getWorkspacePersonaState(dbService, userId, apiKey) {
+    const normalizedUserId = normalizeEmail(userId);
+    let apiKeyData = null;
+    if (apiKey) {
+        apiKeyData = await dbService.getApiKeyByKey(apiKey);
+    }
+    if (!apiKeyData) {
+        apiKeyData = await dbService.getApiKeyByUserId(normalizedUserId, false);
+    }
+    const workspace = await resolveWorkspaceContext(dbService, {
+        userId: normalizedUserId,
+        orgId: apiKeyData?.orgId,
+        stripeCustomerId: apiKeyData?.stripeCustomerId,
+        workspaceId: apiKeyData?.workspaceId
+    });
+    let entitlements = await dbService.getPersonaEntitlementsByWorkspaceId(workspace.workspaceId, false);
+    // Fallback: when the local dev workspace has no API key the workspaceId may not
+    // match the cust: prefix written by the Stripe checkout sync. Look up by userId.
+    if (entitlements.length === 0) {
+        entitlements = await dbService.getPersonaEntitlementsByUserId(normalizedUserId, false);
+    }
+    const catalog = (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => ({
+        personaKey: bundle.personaKey,
+        personaName: bundle.catalogMetadata.displayName,
+        personaRole: bundle.catalogMetadata.role,
+        hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+        protectedJobs: bundle.protectedJobs
+    }));
+    const knownPersonaKeys = new Set(entitlements.map((entitlement) => entitlement.personaKey));
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, entitlements);
+    return {
+        featureFlagEnabled: true,
+        featureFlags: {
+            personaEntitlementsEnabled: true
+        },
+        subscriptionActive,
+        workspaceId: workspace.workspaceId,
+        userId: normalizedUserId,
+        apiKey: apiKeyData?.key || apiKey || null,
+        entitlements: entitlements.map((entitlement) => ({
+            personaKey: entitlement.personaKey,
+            personaName: entitlement.personaName,
+            personaRole: entitlement.personaRole,
+            hireMode: entitlement.hireMode,
+            status: entitlement.status,
+            jobCreditsRemaining: entitlement.jobCreditsRemaining,
+            expiresAt: entitlement.expiresAt ? entitlement.expiresAt.toISOString() : null,
+            hireUrl: buildPersonaHireUrl(entitlement.personaKey, entitlement.hireMode),
+            jobs: (0, persona_hiring_1.isPersonaHireKey)(entitlement.personaKey)
+                ? (0, persona_capability_bundles_1.getPersonaCapabilityBundle)(entitlement.personaKey).protectedJobs
+                : []
+        })),
+        catalog,
+        lockedPersonas: catalog
+            .filter((persona) => !knownPersonaKeys.has(persona.personaKey))
+            .map((persona) => ({
+            ...persona,
+            status: 'locked'
+        })),
+        // Authoritative per-persona verdict: a non-subscribed (legacy) workspace is
+        // ungated, so all personas are accessible; a subscribed one gates to owned.
+        personas: resolvePersonaAccessStatuses(!subscriptionActive, entitlements),
+    };
+}
+async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnTo) {
+    const normalizedUserId = normalizeEmail(userId);
+    let apiKeyData = null;
+    if (apiKey) {
+        apiKeyData = await dbService.getApiKeyByKey(apiKey);
+    }
+    if (!apiKeyData) {
+        apiKeyData = await dbService.getApiKeyByUserId(normalizedUserId, false);
+    }
+    const workspace = await resolveWorkspaceContext(dbService, {
+        userId: normalizedUserId,
+        orgId: apiKeyData?.orgId,
+        stripeCustomerId: apiKeyData?.stripeCustomerId,
+        workspaceId: apiKeyData?.workspaceId
+    });
+    const workspaceEntitlements = await dbService.getPersonaEntitlementsByWorkspaceId(workspace.workspaceId, false);
+    // Legacy bypass: if the workspace has never subscribed to the persona system,
+    // all jobs are freely accessible — no lock enforcement. Same rule the Hub
+    // display inherits via resolvePersonaAccessStatuses(!subscriptionActive, ...).
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, workspaceEntitlements);
+    if (!subscriptionActive) {
+        return {
+            allowed: true,
+            personaKey: null,
+            workspaceId: workspace.workspaceId,
+            ownedPersonaKeys: []
+        };
+    }
+    const ownedPersonaKeys = Array.from(new Set(workspaceEntitlements
+        .filter((entitlement) => entitlement.status === 'active')
+        .map((entitlement) => entitlement.personaKey)
+        .filter((personaKey) => (0, persona_hiring_1.isPersonaHireKey)(personaKey))));
+    const protectedPersonaKey = (0, persona_capability_bundles_1.getProtectedPersonaForJob)(jobName);
+    if (!protectedPersonaKey) {
+        return {
+            allowed: true,
+            personaKey: null,
+            workspaceId: workspace.workspaceId,
+            ownedPersonaKeys
+        };
+    }
+    const fulltimeEntitlement = await dbService.getPersonaEntitlement(workspace.workspaceId, protectedPersonaKey, 'fulltime');
+    if (fulltimeEntitlement && fulltimeEntitlement.status === 'active') {
+        return {
+            allowed: true,
+            personaKey: protectedPersonaKey,
+            workspaceId: workspace.workspaceId,
+            ownedPersonaKeys,
+            entitlement: fulltimeEntitlement
+        };
+    }
+    const jobEntitlement = await dbService.getPersonaEntitlement(workspace.workspaceId, protectedPersonaKey, 'job');
+    if (jobEntitlement && jobEntitlement.status === 'active' && (jobEntitlement.jobCreditsRemaining || 0) > 0) {
+        return {
+            allowed: true,
+            personaKey: protectedPersonaKey,
+            workspaceId: workspace.workspaceId,
+            ownedPersonaKeys,
+            entitlement: jobEntitlement
+        };
+    }
+    const bundle = (0, persona_capability_bundles_1.getPersonaCapabilityBundle)(protectedPersonaKey);
+    const persona = persona_hiring_1.PERSONA_HIRE_CATALOG[protectedPersonaKey];
+    const priorEntitlement = fulltimeEntitlement || jobEntitlement || null;
+    const ownedOtherPersonas = ownedPersonaKeys
+        .filter((personaKey) => personaKey !== protectedPersonaKey)
+        .map((personaKey) => persona_hiring_1.PERSONA_HIRE_CATALOG[personaKey].displayName);
+    let message = bundle?.lockCopy || `This job requires ${persona.displayName}. Hire them to unlock it.`;
+    let hireUrl = buildPersonaHireUrl(protectedPersonaKey, bundle?.defaultHireMode || 'job', returnTo);
+    let ctaLabel = `Hire ${persona.displayName}`;
+    if (priorEntitlement?.status === 'suspended') {
+        message = `${persona.displayName} is currently suspended for this workspace because billing needs attention. Update billing to restore ${persona.displayName} for this request.`;
+        hireUrl = process.env.STRIPE_BILLING_PORTAL_URL || '/billing';
+        ctaLabel = `Restore ${persona.displayName}`;
+    }
+    else if (priorEntitlement?.status === 'expired') {
+        message = `${persona.displayName} was previously active in this workspace but is no longer active. Reactivate ${persona.displayName} to resume this request.`;
+        ctaLabel = `Reactivate ${persona.displayName}`;
+    }
+    else if (ownedOtherPersonas.length > 0) {
+        message = `${persona.displayName} owns this job, and your workspace has not hired ${persona.displayName} yet. You currently have ${ownedOtherPersonas.join(' and ')} active. ${ctaLabel} to unlock this request.`;
+    }
+    return {
+        allowed: false,
+        personaKey: protectedPersonaKey,
+        workspaceId: workspace.workspaceId,
+        ownedPersonaKeys,
+        entitlement: priorEntitlement,
+        lock: {
+            personaKey: protectedPersonaKey,
+            personaName: persona.displayName,
+            personaRole: persona.role,
+            message,
+            hireUrl,
+            ctaLabel
+        }
+    };
+}

package/dist/src/services/workspace-identity.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeWorkspaceEmail = normalizeWorkspaceEmail;
+exports.resolveWorkspaceId = resolveWorkspaceId;
+function normalizeWorkspaceEmail(email) {
+    if (!email)
+        return null;
+    const trimmed = email.trim().toLowerCase();
+    return trimmed || null;
+}
+function resolveWorkspaceId(input) {
+    if (input.workspaceId)
+        return input.workspaceId;
+    if (input.stripeCustomerId)
+        return `cust:${input.stripeCustomerId}`;
+    const normalizedEmail = normalizeWorkspaceEmail(input.email);
+    if (normalizedEmail) {
+        return `user:${normalizedEmail}`;
+    }
+    return null;
+}

package/dist/src/types/analytics.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/utils/payment-calculator.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculatePaymentAmount = calculatePaymentAmount;
+exports.calculateDiscount = calculateDiscount;
+exports.validateFounderEmail = validateFounderEmail;
+exports.isConsumerEmailDomain = isConsumerEmailDomain;
+const pricing_1 = require("../config/pricing");
+function calculatePaymentAmount(plan, numberOfUsers, billingCycle, founderDiscount) {
+    let baseAmount;
+    if (plan === 'managed') {
+        // Managed plan: $200/user/month (license) + $10K per group of 10 (training/support)
+        const licenseCost = pricing_1.PRICING[plan][billingCycle] * numberOfUsers;
+        const numberOfGroups = Math.ceil(numberOfUsers / pricing_1.MANAGED_PRICING.licensesPerGroup);
+        const trainingCost = numberOfGroups * pricing_1.MANAGED_PRICING[billingCycle];
+        baseAmount = licenseCost + trainingCost;
+    }
+    else {
+        // Self-served plan: per-user pricing
+        const userCost = pricing_1.PRICING[plan][billingCycle] * numberOfUsers;
+        const fixedFee = pricing_1.FIXED_FEES[plan];
+        baseAmount = userCost + fixedFee;
+    }
+    if (founderDiscount) {
+        const discountAmount = Math.round(baseAmount * pricing_1.FOUNDER_DISCOUNT_RATE);
+        const amount = baseAmount - discountAmount;
+        return { amount, discountAmount };
+    }
+    return { amount: baseAmount, discountAmount: 0 };
+}
+function calculateDiscount(amount) {
+    return Math.round(amount * pricing_1.FOUNDER_DISCOUNT_RATE);
+}
+function validateFounderEmail(email) {
+    if (!email || !email.includes('@')) {
+        return { valid: false, reason: 'Invalid email format' };
+    }
+    const parts = email.split('@');
+    if (parts.length !== 2 || !parts[1] || parts[1].trim() === '') {
+        return { valid: false, reason: 'Invalid email format' };
+    }
+    const domain = parts[1].toLowerCase();
+    if (isConsumerEmailDomain(domain)) {
+        return {
+            valid: false,
+            reason: 'Founder/Academia discount requires a company or university email address (not gmail, yahoo, etc.)'
+        };
+    }
+    return { valid: true };
+}
+function isConsumerEmailDomain(domain) {
+    return pricing_1.CONSUMER_EMAIL_DOMAINS.includes(domain.toLowerCase());
+}

package/extensions/office-word/manifest.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1"
+           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+           xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0"
+           xsi:type="TaskPaneApp">
+  <Id>d1090951-50cf-4cf2-9d12-b0f8541d265c</Id>
+  <Version>1.0.0.0</Version>
+  <ProviderName>FRAIM</ProviderName>
+  <DefaultLocale>en-US</DefaultLocale>
+  <DisplayName DefaultValue="FRAIM"/>
+  <Description DefaultValue="AI Hub for your document - legal, product, engineering, and more in one task pane."/>
+  <IconUrl DefaultValue="http://localhost:43091/word-taskpane/icon-64.png"/>
+  <HighResolutionIconUrl DefaultValue="http://localhost:43091/word-taskpane/icon-64.png"/>
+  <AppDomains>
+    <AppDomain>https://appsforoffice.microsoft.com</AppDomain>
+  </AppDomains>
+
+  <Hosts>
+    <Host Name="Document"/>
+  </Hosts>
+
+  <Requirements>
+    <Sets>
+      <Set Name="WordApi" MinVersion="1.1"/>
+    </Sets>
+  </Requirements>
+
+  <DefaultSettings>
+    <SourceLocation DefaultValue="http://localhost:43091/word-taskpane/"/>
+  </DefaultSettings>
+
+  <Permissions>ReadWriteDocument</Permissions>
+</OfficeApp>