fraim 2.0.351 → 2.0.353

package/dist/src/local-mcp-server/stdio-server.js

@@ -61,6 +61,9 @@ const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const local_runtime_1 = require("../../registry/scripts/learning-usage/local-runtime");
 const axios_1 = __importDefault(require("axios"));
+const http_1 = require("http");
+const https_1 = require("https");
+const tool_schemas_1 = require("../mcp/tool-schemas");
 const provider_utils_1 = require("../core/utils/provider-utils");
 const object_utils_1 = require("../core/utils/object-utils");
 const redact_secrets_1 = require("../core/utils/redact-secrets");
@@ -525,6 +528,14 @@ function buildExecutionModeForwardUrl(hubBase, hubRunId, requestSessionId) {
 }
 class FraimLocalMCPServer {
     constructor(writer) {
+        this.launchedAt = performance.now();
+        this.launcherStartedAt = Number(process.env.FRAIM_MCP_LAUNCH_STARTED_AT);
+        this.discoveryLogged = false;
+        this.firstToolLogged = false;
+        this.firstToolCompletedLogged = false;
+        this.sessionChecks = new Map();
+        this.httpAgent = new http_1.Agent({ keepAlive: true });
+        this.httpsAgent = new https_1.Agent({ keepAlive: true });
         this.config = null;
         this.clientSupportsRoots = false;
         this.workspaceRoot = null;
@@ -575,6 +586,8 @@ class FraimLocalMCPServer {
         this.usageUploadRequested = false;
         // Telemetry is best effort: process exit does not wait for or replay uploads.
         this.usageCollector.shutdown();
+        this.httpAgent.destroy();
+        this.httpsAgent.destroy();
         if (this.otlpServer?.server) {
             (0, otlp_metrics_receiver_js_1.stopOtlpReceiver)(this.otlpServer.server);
             this.otlpServer = null;
@@ -847,6 +860,7 @@ class FraimLocalMCPServer {
             await runSync({
                 projectRoot,
                 skipUpdates: true,
+                automatic: true,
                 local: this.shouldUseLocalSyncTarget(),
                 failHard: 'throw'
             });
@@ -866,6 +880,8 @@ class FraimLocalMCPServer {
         }
     }
     async ensureFreshLocalCatalogOnConnect(requestId) {
+        if (this.isShutdown)
+            return;
         if (process.env.FRAIM_DISABLE_SYNC_ON_CONNECT === '1') {
             this.latestConnectSyncWarning = null;
             return;
@@ -890,9 +906,10 @@ class FraimLocalMCPServer {
         }
         this.log(`[req:${requestId}] Refreshing local FRAIM catalog in background because ${reason}`);
         this.connectSyncInFlight = (async () => {
+            const refreshStartedAt = performance.now();
             try {
                 await this.performLocalCatalogSync(projectRoot);
-                this.log(`[req:${requestId}] Local FRAIM catalog refresh complete`);
+                this.log(`[req:${requestId}] Local FRAIM catalog refresh complete in ${(performance.now() - refreshStartedAt).toFixed(0)} ms`);
             }
             catch (error) {
                 const message = error?.message || String(error);
@@ -2345,12 +2362,15 @@ class FraimLocalMCPServer {
             }
             const resolvedRequestStr = requestSubstitution.content;
             const finalRequest = JSON.parse(resolvedRequestStr);
-            const canRetryTransientRemoteReset = request.method === 'initialize' ||
-                request.method === 'tools/list' ||
-                request.method === 'resources/list' ||
-                request.method === 'prompts/list' ||
-                (request.method === 'tools/call' && request.params?.name === 'fraim_connect');
+            // Only pure reads may be replayed after a socket reset. Session creation and
+            // workflow calls can have committed remotely even when the response is lost.
+            const canRetryTransientRemoteReset = request.method === 'fraim/session/validate'
+                || (request.method === 'tools/call' && request.params?.name === 'get_fraim_file');
+            const remoteStartedAt = performance.now();
             const response = await this.postRemoteMcpRequest(finalRequest, headers, requestId, canRetryTransientRemoteReset);
+            if (request.method === 'tools/call' && request.params?.name === 'fraim_connect') {
+                this.log(`Remote session creation completed in ${(performance.now() - remoteStartedAt).toFixed(0)} ms`);
+            }
             return response.data;
         }
         catch (error) {
@@ -2407,10 +2427,9 @@ class FraimLocalMCPServer {
         for (let attempt = 1; attempt <= attempts; attempt++) {
             try {
                 return await axios_1.default.post(`${this.remoteUrl}/mcp`, requestBody, {
-                    headers: {
-                        ...headers,
-                        Connection: 'close'
-                    },
+                    headers,
+                    httpAgent: this.httpAgent,
+                    httpsAgent: this.httpsAgent,
                     timeout: 30000
                 });
             }
@@ -2452,6 +2471,34 @@ class FraimLocalMCPServer {
             this.loadConfig();
         }
     }
+    async checkLocalWorkflowSession(sessionId, id) {
+        if (!sessionId) {
+            return { jsonrpc: '2.0', id, error: {
+                    code: -32001, message: 'FRAIM session is missing. Call fraim_connect first.'
+                } };
+        }
+        let check = this.sessionChecks.get(sessionId);
+        if (!check) {
+            check = this._doProxyToRemote({
+                jsonrpc: '2.0', id: (0, crypto_1.randomUUID)(), method: 'fraim/session/validate', params: { sessionId }
+            });
+            this.sessionChecks.set(sessionId, check);
+            void check.finally(() => {
+                if (this.sessionChecks.get(sessionId) === check)
+                    this.sessionChecks.delete(sessionId);
+            });
+        }
+        const response = await check;
+        if (response.error || response.result?.valid !== true) {
+            return { jsonrpc: '2.0', id, error: {
+                    code: -32001,
+                    message: response.error
+                        ? `FRAIM session validation failed: ${response.error.message} Check connectivity and retry, or call fraim_connect again.`
+                        : 'FRAIM session could not be validated. Call fraim_connect again.'
+                } };
+        }
+        return null;
+    }
     /**
      * Handle incoming MCP request
      */
@@ -2459,6 +2506,32 @@ class FraimLocalMCPServer {
         this.log(`📥 ${request.method}`);
         const requestSessionId = this.extractSessionIdFromRequest(request);
         const requestId = (0, crypto_1.randomUUID)();
+        if (request.method === 'notifications/initialized')
+            return null;
+        if (request.method === 'tools/list') {
+            if (!this.discoveryLogged) {
+                this.discoveryLogged = true;
+                this.log(`Local MCP discovery ready in ${(performance.now() - this.launchedAt).toFixed(0)} ms`);
+                if (Number.isFinite(this.launcherStartedAt) && this.launcherStartedAt > 0 && this.launcherStartedAt <= Date.now()) {
+                    this.log(`MCP launcher to discovery completed in ${Date.now() - this.launcherStartedAt} ms`);
+                }
+            }
+            return { jsonrpc: '2.0', id: request.id, result: {
+                    tools: (0, tool_schemas_1.getToolDefinitions)({ surface: 'local-proxy' })
+                } };
+        }
+        if (request.method === 'ping')
+            return { jsonrpc: '2.0', id: request.id, result: {} };
+        if (request.method === 'resources/list') {
+            return { jsonrpc: '2.0', id: request.id, result: { resources: [] } };
+        }
+        if (request.method === 'prompts/list') {
+            return { jsonrpc: '2.0', id: request.id, result: { prompts: [] } };
+        }
+        if (request.method === 'tools/call' && !this.firstToolLogged) {
+            this.firstToolLogged = true;
+            this.log(`First MCP tool call began in ${(performance.now() - this.launchedAt).toFixed(0)} ms`);
+        }
         // Special handling for initialize request
         if (request.method === 'initialize') {
             // Check if client supports roots
@@ -2471,20 +2544,19 @@ class FraimLocalMCPServer {
                 this.clientSupportsRoots = false;
                 this.log(`❌ Client does NOT support roots capability`);
             }
-            // Proxy initialize to remote server first using the raw proxy method
-            const response = await this._doProxyToRemote(request, requestId);
-            const processedResponse = await this.finalizeToolResponse(request, response, requestSessionId, requestId);
-            // After successful initialization, load config
-            if (!processedResponse.error) {
-                // Load config immediately for compatibility, then request roots so
-                // workspace-aware clients (Codex, Cursor, etc.) can provide exact roots.
-                this.loadConfig();
-                if (this.clientSupportsRoots) {
-                    setImmediate(() => this.requestRootsFromClient());
-                }
+            // Load config and request roots without waiting for remote authentication.
+            this.loadConfig();
+            if (this.clientSupportsRoots) {
+                setImmediate(() => this.requestRootsFromClient());
+            }
+            else {
+                setImmediate(() => { void this.ensureFreshLocalCatalogOnConnect('startup'); });
             }
-            this.log(`📤 ${request.method} → ${processedResponse.error ? 'ERROR' : 'OK'}`);
-            return processedResponse;
+            return { jsonrpc: '2.0', id: request.id, result: {
+                    protocolVersion: '2024-11-05',
+                    serverInfo: { name: 'fraim-mcp-server', version: this.localVersion },
+                    capabilities: { tools: {}, resources: {}, prompts: {} }
+                } };
         }
         // Force ALL tools/call requests to return raw definitions so the proxy
         // can resolve templates and replace includes locally
@@ -2492,6 +2564,11 @@ class FraimLocalMCPServer {
         const args = request.params?.arguments || {};
         let injectedRequest = request;
         if (request.method === 'tools/call' && typeof toolName === 'string') {
+            if (toolName === 'seekMentoring' || toolName === 'get_fraim_job') {
+                const sessionError = await this.checkLocalWorkflowSession(requestSessionId, request.id);
+                if (sessionError)
+                    return sessionError;
+            }
             // 🔍 SMART DISPATCHER: Intercept mentoring and job/workflow tools for local overrides
             if (toolName === 'seekMentoring') {
                 this.recordRecoveryState(args, requestSessionId);
@@ -2860,9 +2937,19 @@ class FraimLocalMCPServer {
                     if (firstRoot.uri && firstRoot.uri.startsWith('file://')) {
                         const rootPath = this.fileUriToLocalPath(firstRoot.uri);
                         if (rootPath) {
+                            const userEmail = this.engine?.getUserEmail();
+                            if (this.workspaceRoot !== rootPath) {
+                                // Both values retain project-specific identity and templates.
+                                // Rebuild them for the next queued request in the new root.
+                                this.repoInfo = null;
+                                this.engine = null;
+                            }
                             this.workspaceRoot = rootPath;
                             this.log(`✅ Got workspace root from client: ${this.workspaceRoot} (${firstRoot.name || 'unknown'})`);
                             this.loadConfig(); // Reload config with the correct workspace root
+                            // Workspace caches change; the authenticated session identity does not.
+                            if (userEmail && !this.engine)
+                                this.ensureEngine().setUserEmail(userEmail);
                         }
                         else {
                             this.log(`⚠️  Could not parse root URI: ${firstRoot.uri}`);
@@ -2879,6 +2966,7 @@ class FraimLocalMCPServer {
                     this.loadConfig();
                 }
             }
+            void this.ensureFreshLocalCatalogOnConnect('workspace-roots');
         }
     }
     /**
@@ -2938,62 +3026,88 @@ class FraimLocalMCPServer {
             clearInterval(uploadInterval);
             this.shutdown();
         };
-        process.stdin.on('data', async (chunk) => {
+        // Stateful operations share one queue across input chunks. Discovery only
+        // waits for initialization, so a remote tool call cannot delay local schema
+        // negotiation. Root responses use the stateful queue to avoid changing a
+        // request's workspace while that request is awaiting remote work.
+        let statefulQueue = Promise.resolve();
+        let initialized = Promise.resolve();
+        const pending = new Set();
+        const localMethods = new Set([
+            'tools/list', 'resources/list', 'prompts/list', 'ping', 'notifications/initialized'
+        ]);
+        const reportError = (error) => {
+            this.logError(`Message processing failed: ${error.message}`);
+            process.stdout.write(JSON.stringify({
+                jsonrpc: '2.0', error: { code: -32700, message: `Parse error: ${error.message}` }, id: null
+            }) + '\n');
+        };
+        const dispatch = async (message) => {
+            // Distinguish between requests and responses
+            // Requests have 'method', responses have 'result' or 'error' (but no 'method')
+            if ('method' in message && message.method) {
+                // This is a request from the client
+                const response = await this.handleRequest(message);
+                if (message.method === 'tools/call' && !this.firstToolCompletedLogged) {
+                    this.firstToolCompletedLogged = true;
+                    this.log(`First MCP tool call completed in ${(performance.now() - this.launchedAt).toFixed(0)} ms`);
+                }
+                // Only send response if we got one (null means we handled it internally)
+                if (response) {
+                    process.stdout.write(JSON.stringify(response) + '\n');
+                    // Usage is optional; token capture and upload must not hold the
+                    // client response open after the tool result is ready.
+                    void this.collectUsageForResponse(message, response)
+                        .catch((error) => this.logError(`Usage collection failed: ${error instanceof Error ? error.message : String(error)}`));
+                }
+            }
+            else if ('result' in message || 'error' in message) {
+                // This is a response from the client (to our roots/list request)
+                this.handleResponse(message);
+                // Don't send anything back - this was a response to our request
+            }
+            else {
+                this.logError(`Unknown message type: ${JSON.stringify(message)}`);
+                process.stdout.write(JSON.stringify({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32600,
+                        message: 'Invalid Request: Unknown message type'
+                    },
+                    id: message.id || null
+                }) + '\n');
+            }
+        };
+        process.stdin.on('data', (chunk) => {
             buffer += chunk;
-            // Process complete JSON-RPC messages (newline-delimited)
             let newlineIndex;
             while ((newlineIndex = buffer.indexOf('\n')) !== -1) {
                 const line = buffer.slice(0, newlineIndex).trim();
                 buffer = buffer.slice(newlineIndex + 1);
-                if (line) {
-                    try {
-                        const message = JSON.parse(line);
-                        // Distinguish between requests and responses
-                        // Requests have 'method', responses have 'result' or 'error' (but no 'method')
-                        if ('method' in message && message.method) {
-                            // This is a request from the client
-                            const response = await this.handleRequest(message);
-                            // Only send response if we got one (null means we handled it internally)
-                            if (response) {
-                                // Collect usage for all tools/call requests before sending response
-                                await this.collectUsageForResponse(message, response);
-                                process.stdout.write(JSON.stringify(response) + '\n');
-                            }
-                        }
-                        else if ('result' in message || 'error' in message) {
-                            // This is a response from the client (to our roots/list request)
-                            this.handleResponse(message);
-                            // Don't send anything back - this was a response to our request
-                        }
-                        else {
-                            this.logError(`Unknown message type: ${JSON.stringify(message)}`);
-                            process.stdout.write(JSON.stringify({
-                                jsonrpc: '2.0',
-                                error: {
-                                    code: -32600,
-                                    message: 'Invalid Request: Unknown message type'
-                                },
-                                id: message.id || null
-                            }) + '\n');
-                        }
-                    }
-                    catch (error) {
-                        this.logError(`Message processing failed: ${error.message}`);
-                        // Send error response
-                        const errorResponse = {
-                            jsonrpc: '2.0',
-                            error: {
-                                code: -32700,
-                                message: `Parse error: ${error.message}`
-                            },
-                            id: null
-                        };
-                        process.stdout.write(JSON.stringify(errorResponse) + '\n');
-                    }
+                if (!line)
+                    continue;
+                try {
+                    const message = JSON.parse(line);
+                    const local = localMethods.has(message?.method);
+                    const operation = (local ? initialized : statefulQueue)
+                        .then(() => dispatch(message)).catch(reportError);
+                    if (!local)
+                        statefulQueue = operation;
+                    if (message?.method === 'initialize')
+                        initialized = operation;
+                    pending.add(operation);
+                    void operation.finally(() => pending.delete(operation));
+                }
+                catch (error) {
+                    reportError(error);
                 }
             }
         });
-        process.stdin.on('end', () => {
+        process.stdin.on('end', async () => {
+            await Promise.all(pending);
+            // stdout can be asynchronous when piped. Flush accepted responses before
+            // process.exit so a large final result cannot be truncated on shutdown.
+            await new Promise(resolve => process.stdout.write('', () => resolve()));
             this.log('🛑 Stdin closed, shutting down...');
             cleanup();
             process.exit(0);
@@ -3055,13 +3169,14 @@ class FraimLocalMCPServer {
             }
             // Keep enrichment request-local until it settles. Neither another call
             // nor the uploader may observe an event that is still being constructed.
+            const usageContext = this.usageCollector.captureContext();
             const enrichment = toolName === 'seekMentoring' ? await this.captureTokenUsage() : {};
             if (this.isShutdown)
                 return;
             // Capture the current queue size before synchronous publication.
             const beforeCount = this.usageCollector.getEventCount();
             try {
-                this.usageCollector.collectMCPCall(toolName, args, requestSessionId, success, enrichment);
+                this.usageCollector.collectMCPCall(toolName, args, requestSessionId, success, enrichment, usageContext);
                 // Check if the event was actually added to the queue
                 const afterCount = this.usageCollector.getEventCount();
                 if (afterCount > beforeCount) {
@@ -3077,7 +3192,7 @@ class FraimLocalMCPServer {
                 // Emit job-complete event when seekMentoring reaches the final phase
                 if (toolName === 'seekMentoring' && acceptedPhaseResponse && args.status === 'complete' && args.nextPhase === null && args.jobName && args.jobId) {
                     try {
-                        this.usageCollector.collectJobComplete(args.jobName, args.jobId, requestSessionId);
+                        this.usageCollector.collectJobComplete(args.jobName, args.jobId, requestSessionId, usageContext);
                         this.log(`📊 ✅ Job complete event emitted: ${args.jobName} (jobId: ${args.jobId})`);
                     }
                     catch (err) {

package/dist/src/local-mcp-server/usage-collector.js

@@ -54,10 +54,19 @@ class UsageCollector {
     }
     getAgentName() { return this.agentName; }
     getAgentModel() { return this.agentModel; }
+    /** Freeze attribution before asynchronous enrichment can overlap another connection. */
+    captureContext() {
+        return {
+            userId: this.userId || 'unknown',
+            repoIdentifier: this.repoIdentifier || undefined,
+            agentName: this.agentName || undefined,
+            agentModel: this.agentModel || undefined,
+        };
+    }
     /**
      * Collect MCP tool call event
      */
-    collectMCPCall(toolName, args, sessionId, success = true, enrichment = {}) {
+    collectMCPCall(toolName, args, sessionId, success = true, enrichment = {}, context = this.captureContext()) {
         const parsed = this.parseMCPCall(toolName, args);
         if (!parsed) {
             const errorMsg = `[UsageCollector] 🚫 Tool not tracked: ${toolName}`;
@@ -75,14 +84,14 @@ class UsageCollector {
         const event = {
             type: parsed.type,
             name: parsed.name,
-            // Use set userId if available; the server will override with the authenticated userId.
-            userId: this.userId || 'unknown',
+            // The server overrides this with the authenticated userId.
+            userId: context.userId,
             sessionId,
             success,
             category: parsed.category,
-            repoIdentifier: this.repoIdentifier || undefined,
-            agentName: this.agentName || undefined,
-            agentModel: this.agentModel || undefined,
+            repoIdentifier: context.repoIdentifier,
+            agentName: context.agentName,
+            agentModel: context.agentModel,
             tokenSnapshot: enrichment.tokenSnapshot,
             tokenCaptureUnavailableReason: enrichment.tokenCaptureUnavailableReason,
             jobId: args.jobId || undefined, // Bug fix: capture jobId from enriched args
@@ -190,17 +199,17 @@ class UsageCollector {
      * Emit a job-completion event when seekMentoring returns nextPhase === null.
      * Called by the local proxy after the final mentoring event is queued.
      */
-    collectJobComplete(jobName, jobId, sessionId) {
+    collectJobComplete(jobName, jobId, sessionId, context = this.captureContext()) {
         const event = {
             type: 'job',
             name: jobName,
-            userId: this.userId || 'unknown',
+            userId: context.userId,
             sessionId,
             success: true,
             jobId,
-            repoIdentifier: this.repoIdentifier || undefined,
-            agentName: this.agentName || undefined,
-            agentModel: this.agentModel || undefined,
+            repoIdentifier: context.repoIdentifier,
+            agentName: context.agentName,
+            agentModel: context.agentModel,
             args: { action: 'complete', jobId },
         };
         this.events.push(event);

package/dist/src/middleware/auth.js

@@ -4,6 +4,7 @@ exports.AuthMiddleware = void 0;
 const redact_secrets_1 = require("../core/utils/redact-secrets");
 const fs_1 = require("fs");
 const path_1 = require("path");
+const current_license_1 = require("../fraim/current-license");
 const cookie_service_1 = require("../services/cookie-service");
 const audit_log_1 = require("../services/audit-log");
 function resolveFraimProFilePath(fileName) {
@@ -58,6 +59,41 @@ class AuthMiddleware {
         if (isPublic) {
             return next();
         }
+        // Identity remains available to explain and recover an expired subscription.
+        // These exact read endpoints do not execute product work.
+        const recoveryRead = req.method === 'GET' && [
+            '/account', '/billing', '/api/auth/session', '/api/account/me',
+            '/api/account/api-key', '/api/account/sessions', '/api/account/activity',
+            '/api/account/referral-code', '/api/analytics/me', '/api/personas/me'
+        ].includes(p);
+        const enforceLicense = (key) => {
+            if ((recoveryRead && !key.revokedAt) || (0, current_license_1.hasUsableLicense)(key))
+                return true;
+            const suspended = key.status === 'suspended';
+            const reason = key.suspensionReason || 'payment failure';
+            console.error(`[FRAIM AUTH] ${suspended ? 'Suspended' : 'Expired'} API key: ${(0, redact_secrets_1.redactApiKey)(key.key)} (${key.tier})${suspended ? ` due to ${reason}` : ''}`);
+            res.status(402).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: suspended ? -32002 : -32003,
+                    message: suspended
+                        ? `API key suspended due to ${reason}. Please update your payment method.`
+                        : key.tier === 'trial'
+                            ? 'Your 14-day free trial has expired. Please upgrade to continue using FRAIM.'
+                            : 'Your subscription has expired. Please renew to continue using FRAIM.',
+                    data: {
+                        status: suspended ? 'suspended' : 'expired', tier: key.tier,
+                        ...(suspended ? { reason } : {}),
+                        expiresAt: key.expiresAt?.toISOString(),
+                        paymentUrl: key.tier === 'trial'
+                            ? (process.env.STRIPE_CHECKOUT_URL || 'https://fraimworks.ai/pricing')
+                            : (process.env.STRIPE_BILLING_PORTAL_URL || 'https://fraimworks.ai/billing')
+                    }
+                },
+                id: req.body?.id || null
+            });
+            return false;
+        };
         // Header-only API key transport. Query-string transport was removed because credentials
         // in URLs leak through access logs, browser history, and HTTP Referer headers.
         // Reject any request that attempts to use ?api-key= so silent fallback to header doesn't mask the misuse.
@@ -90,17 +126,16 @@ class AuthMiddleware {
         if (!apiKey && sessionToken) {
             try {
                 const session = await this.dbService.getAuthSession(sessionToken);
-                if (!session || session.revoked || session.expiresAt < new Date()) {
+                if (!session || session.revoked || session.expiresAt.getTime() <= Date.now()) {
                     // MCP clients (claude.ai Connectors, Office add-ins, Claude Design) send the
                     // FRAIM API key as Authorization: Bearer <key>. The bearer value arrives here
                     // as sessionToken but is not a session UUID — it's the raw key. Try it as a
                     // direct API key before returning 401.
                     if (sessionFromBearer) {
                         const directKeyData = await this.dbService.verifyApiKey(sessionFromBearer).catch(() => null);
-                        const isDirectKeyValid = directKeyData
-                            && directKeyData.status !== 'suspended'
-                            && !(directKeyData.status === 'expired' || (directKeyData.expiresAt && new Date() > directKeyData.expiresAt));
-                        if (isDirectKeyValid) {
+                        if (directKeyData) {
+                            if (!enforceLicense(directKeyData))
+                                return;
                             this.dbService.updateApiKeyLastUsed(directKeyData.key).catch(() => undefined);
                             req.apiKeyData = directKeyData;
                             req.authSource = 'bearer-api-key';
@@ -133,6 +168,8 @@ class AuthMiddleware {
                         id: req.body?.id || null
                     });
                 }
+                if (!enforceLicense(apiKeyData))
+                    return;
                 this.dbService.touchAuthSession(session.sessionId).catch(err => {
                     console.warn('[FRAIM AUTH] Failed to update auth session lastSeenAt:', err);
                 });
@@ -228,52 +265,8 @@ class AuthMiddleware {
                     id: req.body?.id || null
                 });
             }
-            // Check if key is suspended
-            if (apiKeyData.status === 'suspended') {
-                const reason = apiKeyData.suspensionReason || 'payment failure';
-                console.error(`❌ FRAIM AUTH: Suspended API key: ${(0, redact_secrets_1.redactApiKey)(apiKey)} (reason: ${reason})`);
-                return res.status(402).json({
-                    jsonrpc: '2.0',
-                    error: {
-                        code: -32002,
-                        message: `API key suspended due to ${reason}. Please update your payment method.`,
-                        data: {
-                            status: 'suspended',
-                            reason,
-                            paymentUrl: process.env.STRIPE_BILLING_PORTAL_URL || 'https://fraimworks.ai/billing'
-                        }
-                    },
-                    id: req.body?.id || null
-                });
-            }
-            // Check if key is expired
-            if (apiKeyData.status === 'expired' || (apiKeyData.expiresAt && new Date() > apiKeyData.expiresAt)) {
-                // Update status to expired if not already
-                if (apiKeyData.status !== 'expired') {
-                    await this.dbService.updateApiKey(apiKey, { status: 'expired' });
-                }
-                const tier = apiKeyData.tier;
-                const message = tier === 'trial'
-                    ? 'Your 14-day free trial has expired. Please upgrade to continue using FRAIM.'
-                    : 'Your subscription has expired. Please renew to continue using FRAIM.';
-                console.error(`❌ FRAIM AUTH: Expired API key: ${(0, redact_secrets_1.redactApiKey)(apiKey)} (tier: ${tier})`);
-                return res.status(402).json({
-                    jsonrpc: '2.0',
-                    error: {
-                        code: -32003,
-                        message,
-                        data: {
-                            status: 'expired',
-                            tier,
-                            expiresAt: apiKeyData.expiresAt?.toISOString(),
-                            paymentUrl: tier === 'trial'
-                                ? (process.env.STRIPE_CHECKOUT_URL || 'https://fraimworks.ai/pricing')
-                                : (process.env.STRIPE_BILLING_PORTAL_URL || 'https://fraimworks.ai/billing')
-                        }
-                    },
-                    id: req.body?.id || null
-                });
-            }
+            if (!enforceLicense(apiKeyData))
+                return;
             // Update last used timestamp (async, don't await)
             this.dbService.updateApiKeyLastUsed(apiKey).catch(err => {
                 console.warn('[FRAIM AUTH] Failed to update lastUsedAt:', err);

package/dist/src/routes/analytics.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const license_presentation_1 = require("../fraim/license-presentation");
 const express_1 = __importDefault(require("express"));
 const path_1 = __importDefault(require("path"));
 const usage_analytics_service_js_1 = require("../services/usage-analytics-service.js");
@@ -884,7 +885,7 @@ router.get('/me', async (req, res) => {
         res.json({
             userId: apiKeyData.userId,
             isAdmin: apiKeyData.userId === 'sid.mathur@gmail.com',
-            ...serializeKeyLifecycle(apiKeyData),
+            ...(0, license_presentation_1.serializeLicenseLifecycle)(apiKeyData),
         });
     }
     catch (error) {
@@ -927,15 +928,6 @@ function resolveAnalyticsTimeframe(query) {
     }
     return startDate && endDate ? { period: 'custom', startDate, endDate } : { period };
 }
-function serializeKeyLifecycle(keyData) {
-    if (!keyData) {
-        return { status: null, expiresAt: null };
-    }
-    return {
-        status: keyData.status ?? 'active',
-        expiresAt: keyData.expiresAt instanceof Date ? keyData.expiresAt.toISOString() : null,
-    };
-}
 async function resolveManagerMember(dbService, managerId, memberId) {
     const members = await dbService.getTeamMembers(managerId);
     if (!members.find(m => m.memberId === memberId)) {
@@ -1029,7 +1021,7 @@ router.get('/team/members/:memberId/summary', async (req, res) => {
         const lastEventAt = stats.status === 'fulfilled' ? stats.value.lastEventAt ?? null : null;
         const historicalLastEventAt = allTimeLastEventAt.status === 'fulfilled' ? allTimeLastEventAt.value ?? null : null;
         const lifecycle = keyLifecycle.status === 'fulfilled'
-            ? serializeKeyLifecycle(keyLifecycle.value)
+            ? (0, license_presentation_1.serializeLicenseLifecycle)(keyLifecycle.value)
             : { status: null, expiresAt: null };
         res.json({
             memberId,