fraim 2.0.195 → 2.0.197

package/dist/src/services/persona-entitlement-service.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSubscriptionActive = computeSubscriptionActive;
+exports.resolvePersonaAccessStatuses = resolvePersonaAccessStatuses;
+exports.buildUngatedPersonaWorkspaceState = buildUngatedPersonaWorkspaceState;
 exports.buildPersonaHireUrl = buildPersonaHireUrl;
 exports.syncPersonaEntitlementPurchase = syncPersonaEntitlementPurchase;
 exports.syncPersonaEntitlementFromCheckoutSession = syncPersonaEntitlementFromCheckoutSession;
@@ -9,6 +12,66 @@ const persona_hiring_1 = require("../config/persona-hiring");
 const persona_capability_bundles_1 = require("../config/persona-capability-bundles");
 const workspace_identity_1 = require("./workspace-identity");
 const DEFAULT_JOB_CREDITS = 1;
+// The one place the "is the persona system gating this workspace?" question is
+// answered. A workspace is subscribed if it explicitly opted in (personaSystemActive)
+// or has ever held an active entitlement. Shared by getWorkspacePersonaState and
+// evaluatePersonaAccess so display and enforcement can never diverge.
+function computeSubscriptionActive(apiKeyData, entitlements) {
+    return apiKeyData?.personaSystemActive === true || entitlements.some((e) => e.status === 'active');
+}
+// Single source of truth for per-persona access, mirroring evaluatePersonaAccess's
+// gating rules exactly:
+//   - `ungated` (feature flag OFF, or legacy/never-subscribed workspace) => every
+//     persona is accessible ('hired').
+//   - otherwise => 'hired' iff the workspace holds an active entitlement for it.
+// Pure and DB-free so it is trivially testable and callable from either code path.
+function resolvePersonaAccessStatuses(ungated, entitlements) {
+    const activeByKey = new Map();
+    for (const entitlement of entitlements) {
+        if (entitlement.status !== 'active')
+            continue;
+        const list = activeByKey.get(entitlement.personaKey) || [];
+        list.push(entitlement);
+        activeByKey.set(entitlement.personaKey, list);
+    }
+    return (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => {
+        const active = activeByKey.get(bundle.personaKey) || [];
+        const seatCount = active.reduce((sum, e) => sum + (e.jobCreditsRemaining ?? 1), 0);
+        return {
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            status: (ungated || active.length > 0) ? 'hired' : 'locked',
+            seatCount,
+        };
+    });
+}
+// The persona-entitlements feature is OFF: there is no gating, so every persona is
+// accessible. Returned by /api/personas/me instead of a 404 so downstream consumers
+// (the Hub especially) inherit "flag off => all employees available" rather than
+// inventing their own fallback. Matches maybeBuildPersonaLockResponse, which also
+// short-circuits to "allowed" when the flag is off. No DB lookup is required.
+function buildUngatedPersonaWorkspaceState(userId, apiKey) {
+    return {
+        featureFlagEnabled: false,
+        featureFlags: { personaEntitlementsEnabled: false },
+        subscriptionActive: false,
+        workspaceId: normalizeEmail(userId),
+        userId: normalizeEmail(userId),
+        apiKey: apiKey || null,
+        entitlements: [],
+        catalog: (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => ({
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            protectedJobs: bundle.protectedJobs,
+        })),
+        lockedPersonas: [],
+        personas: resolvePersonaAccessStatuses(true, []),
+    };
+}
 function normalizeEmail(email) {
     return email.trim().toLowerCase();
 }
@@ -154,9 +217,7 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
         protectedJobs: bundle.protectedJobs
     }));
     const knownPersonaKeys = new Set(entitlements.map((entitlement) => entitlement.personaKey));
-    // Subscribed = explicitly opted in via flag, OR has ever had an active entitlement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        entitlements.some((e) => e.status === 'active');
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, entitlements);
     return {
         featureFlagEnabled: true,
         featureFlags: {
@@ -185,7 +246,10 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
             .map((persona) => ({
             ...persona,
             status: 'locked'
-        }))
+        })),
+        // Authoritative per-persona verdict: a non-subscribed (legacy) workspace is
+        // ungated, so all personas are accessible; a subscribed one gates to owned.
+        personas: resolvePersonaAccessStatuses(!subscriptionActive, entitlements),
     };
 }
 async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnTo) {
@@ -205,9 +269,9 @@ async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnT
     });
     const workspaceEntitlements = await dbService.getPersonaEntitlementsByWorkspaceId(workspace.workspaceId, false);
     // Legacy bypass: if the workspace has never subscribed to the persona system,
-    // all jobs are freely accessible — no lock enforcement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        workspaceEntitlements.some((e) => e.status === 'active');
+    // all jobs are freely accessible — no lock enforcement. Same rule the Hub
+    // display inherits via resolvePersonaAccessStatuses(!subscriptionActive, ...).
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, workspaceEntitlements);
     if (!subscriptionActive) {
         return {
             allowed: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.195",
+  "version": "2.0.197",
   "description": "FRAIM CLI - Framework for Rigor-based AI Management (alias for fraim-framework)",
   "main": "index.js",
   "bin": {

package/public/ai-hub/index.html

@@ -12,6 +12,9 @@
     // #700: set the theme pre-paint (no flash). Explicit choice in
     // localStorage wins; otherwise follow the OS preference.
     try{var t=localStorage.getItem('fraim-theme');if(t!=='light'&&t!=='dark'){t=(window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches)?'dark':'light';}h.setAttribute('data-theme',t);}catch(e){h.setAttribute('data-theme','light');}
+    // #744: apply the cached org brand pre-paint (no flash of FRAIM identity
+    // before company branding). script.js refines the per-theme accent on load.
+    try{var b=JSON.parse(localStorage.getItem('fraim-org-brand')||'null');if(b){if(typeof b.color==='string'&&/^#[0-9a-f]{6}$/i.test(b.color)){h.style.setProperty('--accent',b.color);h.style.setProperty('--accent-strong',b.color);}if(typeof b.name==='string'&&b.name){document.title=b.name+' Hub';}}}catch(e){}
   })();</script>
   <link rel="stylesheet" href="./styles.css?v=conv-panels-20260611b">
   <link rel="stylesheet" href="./review.css">
@@ -20,10 +23,15 @@
 
   <!-- Issue #512: three-area top nav + account menu (surface=hub only). -->
   <nav class="hub-tabs" id="hub-tabs" hidden>
+    <!-- #744: company brand lockup (logo + name), populated from bootstrap.orgBrand. -->
+    <span class="hub-brand" id="hub-brand" hidden></span>
+    <span class="hub-brand-divider" id="hub-brand-divider" hidden></span>
     <button class="hub-tab" type="button" data-area="company">Company</button>
     <button class="hub-tab" type="button" data-area="manager">Manager</button>
     <button class="hub-tab on" type="button" data-area="projects">Projects</button>
     <div class="nav-right">
+      <!-- #744: FRAIM co-mark (co-branding, not white-label) shown when a brand is set. -->
+      <span class="hub-cobrand" id="hub-cobrand" hidden></span>
       <button class="avatar-btn" id="avatar-btn" type="button" title="Account &amp; settings">SM</button>
       <div id="account-menu" class="account-menu">
         <div class="am-header">
@@ -68,6 +76,12 @@
             <div class="area-h1">Company</div>
             <p class="area-lede">Your organization's identity — what you do, how you operate, and the guardrails every employee follows on every job.</p>
             <div id="company-push-banner"></div>
+            <!-- #744: Brand editor — company identity across the Hub. -->
+            <details class="ctx-acc" id="company-brand-acc">
+              <summary><span class="ca-chev">▸</span> <span>🎨 Brand</span>
+                <span class="ca-note">— your company's identity across the Hub, applied for every teammate</span></summary>
+              <div class="ctx-acc-body"><div class="card area-profile" id="company-brand-editor"></div></div>
+            </details>
             <details class="ctx-acc" id="company-ctx-acc">
               <summary><span class="ca-chev">▸</span> <span>🏢 Context &amp; rules</span></summary>
               <div class="ctx-acc-body"><div class="card area-profile" id="company-profile"></div></div>
@@ -199,6 +213,7 @@
           <!-- Onboarding state banner lives ABOVE the accordions so it shows even
                when the Brief is collapsed (so the conversation keeps its height). -->
           <div id="proj-onboarding-banner"></div>
+          <div id="hub-agent-setup-panel" class="hub-agent-setup-panel" data-testid="hub-cli-setup-panel" hidden></div>
           <details class="ctx-acc" id="proj-brief-acc">
             <summary><span class="ca-chev">▸</span> <span>📋 Brief</span>
               <span class="ca-note">— this project's context and rules, captured by Project Onboarding</span></summary>
@@ -839,6 +854,7 @@
         <span class="cp-agent-label">Run with:</span>
         <span id="cp-agent-picker" class="cp-agent-pills"></span>
       </div>
+      <div id="cp-agent-install-panel" class="cp-agent-install-panel" data-testid="cp-cli-setup-panel" hidden></div>
     </div>
   </div>
 
@@ -868,6 +884,6 @@
     </div>
   </div>
 
-  <script src="./script.js?v=conv-persist-20260705"></script>
+  <script src="./script.js?v=persona-mgr-del-20260707"></script>
 </body>
 </html>