fraim 2.0.352 → 2.0.354

package/dist/src/services/subscription-payment.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSubscriptionPayment = readSubscriptionPayment;
+const stripe_1 = require("../config/stripe");
+const idOf = (value) => typeof value === 'string' ? value : value?.id || null;
+const MAX_PAGES = 10;
+const PAGE_SIZE = 100;
+function belongsTo(invoice, subscriptionId, customerId) {
+    const legacy = idOf(invoice.subscription);
+    const modern = idOf(invoice.parent?.subscription_details?.subscription);
+    return idOf(invoice.customer) === customerId && (legacy || modern) === subscriptionId
+        && (!legacy || legacy === subscriptionId) && (!modern || modern === subscriptionId)
+        && (!invoice.parent || invoice.parent.type === 'subscription_details');
+}
+async function allPages(first, next) {
+    const result = [];
+    const seen = new Set();
+    let page = first;
+    for (let index = 0; index < MAX_PAGES; index++) {
+        for (const entry of page.data) {
+            if (!entry.id || seen.has(entry.id))
+                throw new Error('Stripe payment proof pagination repeated an item');
+            seen.add(entry.id);
+            result.push(entry);
+        }
+        if (!page.has_more)
+            return result;
+        if (!page.data.length || index === MAX_PAGES - 1)
+            throw new Error('Stripe payment proof pagination is incomplete');
+        page = await next(page.data[page.data.length - 1].id);
+    }
+    throw new Error('Stripe payment proof pagination is incomplete');
+}
+/**
+ * Stripe owns billing amounts and discounts. A fully discounted or credit-funded
+ * invoice carries no balance, so Stripe finalizes it as paid with no cash to collect
+ * and no ledger entry at all. That is a settled service period, not an unpaid one.
+ */
+function hasNoBalanceDue(invoice) {
+    // Only an absent balance field is treated as unreported; any present value must be
+    // an explicit zero, so a null or non-numeric balance denies rather than settles.
+    return invoice.amount_due === 0
+        && (invoice.amount_remaining === undefined || invoice.amount_remaining === 0);
+}
+async function isSettledInvoice(invoice, deps) {
+    if (invoice.status !== 'paid' || !Number.isSafeInteger(invoice.amount_paid)
+        || invoice.amount_paid < 0 || invoice.paid_out_of_band)
+        return false;
+    if (hasNoBalanceDue(invoice) && invoice.amount_paid === 0)
+        return true;
+    if (invoice.amount_paid <= 0)
+        return false;
+    // Older invoice versions explicitly distinguish collected from out-of-band
+    // payment. Clover instead represents externally recorded payments in its ledger.
+    if (!invoice.parent && invoice.subscription && invoice.paid_out_of_band === false)
+        return true;
+    const listPayments = deps.invoicePaymentLister || (params => stripe_1.stripe.invoicePayments.list(params));
+    const params = { invoice: invoice.id, status: 'paid', limit: PAGE_SIZE };
+    const payments = await allPages(invoice.payments || await listPayments(params), cursor => listPayments({ ...params, starting_after: cursor }));
+    const collected = payments.reduce((total, payment) => {
+        const source = payment.payment;
+        const collectedSource = source?.type === 'payment_intent' ? idOf(source.payment_intent)
+            : source?.type === 'charge' ? idOf(source.charge) : null;
+        return idOf(payment.invoice) === invoice.id && payment.status === 'paid' && collectedSource
+            && !!invoice.currency && payment.currency === invoice.currency
+            && Number.isSafeInteger(payment.amount_paid) && (payment.amount_paid || 0) > 0
+            ? total + payment.amount_paid : total;
+    }, 0);
+    return Number.isSafeInteger(collected) && collected >= invoice.amount_paid;
+}
+/**
+ * Payment proof comes only from settled invoices and their recurring service lines.
+ * Settlement is Stripe reporting the invoice paid with no balance outstanding, not a
+ * positive amount of cash: a 100% discount settles a period exactly as a charge does.
+ * An active subscription and its next billing date are deliberately insufficient.
+ * Each current recurring item must be covered; mixed-item coverage ends at the
+ * earliest item deadline. The returned invoice is the one constraining that date.
+ * Future intervals cannot bridge an unsettled gap. Prorations, credit lines, manually
+ * marked paid invoices, and incomplete/ambiguous item data grant nothing.
+ * Read failures throw so webhook/periodic callers can retry without replacing proof.
+ */
+async function readSubscriptionPayment(subscription, deps = {}, now = new Date()) {
+    const items = subscription.items?.data || [];
+    const cadence = items.map(item => item.price?.recurring);
+    const firstCadence = cadence[0];
+    const sameCadence = !!firstCadence && Number.isSafeInteger(firstCadence.interval_count)
+        && firstCadence.interval_count > 0 && cadence.every(value => value?.interval === firstCadence.interval
+        && value?.interval_count === firstCadence.interval_count);
+    const result = {
+        paidThrough: null, paidPeriodStart: null, paidInvoiceId: null, paymentStatus: 'unverified',
+        billingInterval: sameCadence ? firstCadence.interval : null,
+        billingIntervalCount: sameCadence ? firstCadence.interval_count : null
+    };
+    const customerId = idOf(subscription.customer);
+    if (!customerId || !subscription.id || !Number.isFinite(now.getTime()) || !items.length
+        || subscription.items.has_more || items.some(item => !item.id || !item.price?.id || !item.price.recurring)
+        || new Set(items.map(item => item.id)).size !== items.length)
+        return result;
+    const listInvoices = deps.invoiceLister || (params => stripe_1.stripe.invoices.list(params));
+    const listLines = deps.invoiceLineLister || ((invoiceId, params) => stripe_1.stripe.invoices.listLineItems(invoiceId, params));
+    const retrieveInvoice = deps.invoiceRetriever || (invoiceId => stripe_1.stripe.invoices.retrieve(invoiceId));
+    const params = { customer: customerId, subscription: subscription.id, status: 'paid', limit: PAGE_SIZE };
+    const invoices = await allPages(await listInvoices(params), cursor => listInvoices({ ...params, starting_after: cursor }));
+    const latestId = idOf(subscription.latest_invoice);
+    const latest = latestId ? await retrieveInvoice(latestId) : null;
+    if (latest && (!belongsTo(latest, subscription.id, customerId) || latest.id !== latestId)) {
+        throw new Error('Latest Stripe invoice does not match subscription/customer');
+    }
+    // The freshly retrieved latest invoice supersedes its list snapshot. This also
+    // handles a just-paid invoice arriving before the paid-invoice list catches up.
+    if (latest) {
+        const index = invoices.findIndex(invoice => invoice.id === latest.id);
+        if (index >= 0)
+            invoices[index] = latest;
+        else
+            invoices.push(latest);
+    }
+    const latestUnpaid = latest && ['draft', 'open', 'uncollectible', 'void'].includes(latest.status || '');
+    if (latestUnpaid)
+        result.paymentStatus = 'unpaid';
+    const coverage = new Map();
+    const settledInvoices = new Set();
+    for (const invoice of invoices) {
+        if (!belongsTo(invoice, subscription.id, customerId) || !await isSettledInvoice(invoice, deps))
+            continue;
+        settledInvoices.add(invoice.id);
+        const lines = await allPages(invoice.lines, cursor => listLines(invoice.id, { limit: PAGE_SIZE, starting_after: cursor }));
+        for (const line of lines) {
+            const details = line.parent?.subscription_item_details;
+            const itemId = idOf(details?.subscription_item || line.subscription_item);
+            const item = items.find(candidate => candidate.id === itemId);
+            const priceId = idOf(line.pricing?.price_details?.price || line.price);
+            const lineSubscription = idOf(line.subscription);
+            const parentSubscription = idOf(details?.subscription);
+            // A settled invoice leaves nothing owed, so every recurring period it billed is
+            // covered whatever that line cost. Stripe folds an item discount into the line
+            // amount and an invoice discount into the total, and neither is unpaid service.
+            if (!item || priceId !== item.price.id || !(line.amount >= 0)
+                || details?.proration || line.proration
+                || (line.subscription_item && idOf(line.subscription_item) !== itemId)
+                || (line.price && idOf(line.price) !== priceId)
+                || (line.parent ? line.parent.type !== 'subscription_item_details' : line.type !== 'subscription')
+                || (!lineSubscription && !parentSubscription)
+                || (lineSubscription && lineSubscription !== subscription.id)
+                || (parentSubscription && parentSubscription !== subscription.id)
+                || (line.invoice && line.invoice !== invoice.id))
+                continue;
+            const { start, end } = line.period || {};
+            if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end <= start
+                || start * 1000 > now.getTime() || !Number.isFinite(new Date(end * 1000).getTime()))
+                continue;
+            const previous = coverage.get(item.id);
+            if (!previous || end > previous.end || (end === previous.end && start < previous.start)) {
+                coverage.set(item.id, { start, end, invoiceId: invoice.id });
+            }
+        }
+    }
+    if (coverage.size !== items.length)
+        return result;
+    const periods = [...coverage.values()];
+    const limiting = periods.reduce((left, right) => left.end <= right.end ? left : right);
+    const start = Math.max(...periods.map(period => period.start));
+    if (start >= limiting.end)
+        return result;
+    result.paidPeriodStart = new Date(start * 1000);
+    result.paidThrough = new Date(limiting.end * 1000);
+    result.paidInvoiceId = limiting.invoiceId;
+    result.paymentStatus = latestUnpaid ? 'unpaid'
+        : latest && !settledInvoices.has(latest.id) ? 'unverified' : 'paid';
+    return result;
+}

package/dist/src/services/subscription-provisioning.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.subscriptionCustomerId = subscriptionCustomerId;
+exports.subscriptionPeriodEnd = subscriptionPeriodEnd;
+exports.provisionSubscriptionApiKey = provisionSubscriptionApiKey;
+const feature_flags_1 = require("../config/feature-flags");
+const persona_hiring_1 = require("../config/persona-hiring");
+const subscription_payment_1 = require("./subscription-payment");
+const current_license_1 = require("../fraim/current-license");
+const persona_entitlement_service_1 = require("./persona-entitlement-service");
+function subscriptionCustomerId(subscription) {
+    return typeof subscription.customer === 'string' ? subscription.customer : subscription.customer.id;
+}
+/** Billing schedule only; never evidence that a service period was paid. */
+function subscriptionPeriodEnd(subscription) {
+    const root = subscription.current_period_end;
+    const valid = (value) => typeof value === 'number' && Number.isFinite(value) && value > 0;
+    const ends = valid(root) ? [root] : (subscription.items?.data || [])
+        .map(item => item.current_period_end).filter(valid);
+    return ends.length ? new Date(Math.min(...ends) * 1000) : null;
+}
+/** Reconcile verified payment, account transport and purchased scope together. */
+async function provisionSubscriptionApiKey(dbService, email, subscription, currentPeriodEnd, paymentDeps = {}) {
+    const billingReconciledAt = new Date();
+    const persona = subscription.metadata?.plan === 'persona-hire';
+    if (persona && (!(0, persona_hiring_1.isPersonaHireKey)(subscription.metadata.personaKey) || subscription.metadata.hireMode !== 'fulltime')) {
+        throw new Error('Invalid recurring persona purchase scope');
+    }
+    const terminal = ['canceled', 'incomplete_expired'].includes(subscription.status);
+    const prior = await dbService.getApiKeyByStripeSubscriptionId(subscription.id);
+    const terminalSeconds = subscription.ended_at || subscription.canceled_at;
+    const endedAt = prior?.stripeSubscriptionEndedAt
+        || (terminalSeconds ? new Date(terminalSeconds * 1000) : billingReconciledAt);
+    // Cancellation must still terminate access if invoice retrieval is unavailable.
+    const payment = terminal ? {} : await (0, subscription_payment_1.readSubscriptionPayment)(subscription, paymentDeps, billingReconciledAt);
+    const billing = {
+        stripeCustomerId: subscriptionCustomerId(subscription),
+        stripeSubscriptionId: subscription.id,
+        ...(Number.isSafeInteger(subscription.created) && subscription.created > 0
+            ? { stripeSubscriptionCreatedAt: new Date(subscription.created * 1000) } : {}),
+        subscriptionStatus: subscription.status,
+        billingReconciledAt,
+        currentPeriodEnd,
+        cancelAt: subscription.cancel_at ? new Date(subscription.cancel_at * 1000)
+            : subscription.cancel_at_period_end ? currentPeriodEnd : null,
+        accessScope: persona ? 'persona' : 'general',
+        ...(terminal ? { stripeSubscriptionEndedAt: endedAt } : {}),
+        ...payment,
+        ...(persona || (0, feature_flags_1.isPersonaEntitlementsEnabled)() ? { personaSystemActive: true } : {})
+    };
+    const key = await dbService.provisionSubscriptionApiKey(email.trim().toLowerCase(), {
+        ...billing, ...(0, current_license_1.subscriptionAccessPatch)({ ...prior, ...billing })
+    });
+    if (persona) {
+        // The entitlement store compares canonical subscription purchase dates and
+        // conditionally writes the observed owner, so concurrent deliveries converge.
+        if (!key.revokedAt && key.isActive !== false) {
+            await (0, persona_entitlement_service_1.syncPersonaEntitlementPurchase)(dbService, {
+                userId: key.userId, orgId: key.orgId,
+                stripeCustomerId: subscriptionCustomerId(subscription), stripeSubscriptionId: subscription.id,
+                stripeCheckoutSessionId: null, personaKey: subscription.metadata.personaKey,
+                hireMode: 'fulltime', purchaseSource: 'stripe-webhook',
+                status: key.status, expiresAt: key.expiresAt, metadata: subscription.metadata
+            });
+        }
+    }
+    return key;
+}

package/dist/src/services/subscription-reconciliation.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubscriptionReconciliationService = void 0;
+exports.subscriptionReconciliationEnabled = subscriptionReconciliationEnabled;
+const stripe_1 = require("../config/stripe");
+const subscription_provisioning_1 = require("./subscription-provisioning");
+/** Development and test servers never contact Stripe unless explicitly enabled. */
+function subscriptionReconciliationEnabled(env = process.env) {
+    return Boolean(env.STRIPE_SECRET_KEY) && env.FRAIM_SUBSCRIPTION_RECONCILIATION !== 'false'
+        && (env.NODE_ENV === 'production' || env.FRAIM_SUBSCRIPTION_RECONCILIATION === 'true');
+}
+/**
+ * Repair missed events using the same verified-invoice path as checkout/webhooks.
+ * Mongo streams subscription IDs in batches; duplicate and historical
+ * credentials are updated by their subscription without changing identity.
+ */
+class SubscriptionReconciliationService {
+    constructor(dbService, dependencies = {}) {
+        this.dbService = dbService;
+        this.dependencies = dependencies;
+        this.stopped = false;
+    }
+    start(intervalMs = 60 * 60 * 1000) {
+        if (this.timer)
+            return;
+        if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+            throw new Error('Reconciliation interval must be positive');
+        this.stopped = false;
+        const sweep = () => {
+            // Sharing a pending promise prevents overlapping manual/scheduled sweeps.
+            if (this.pending)
+                return;
+            void this.runOnce().then(result => (this.dependencies.report || (summary => console.log('[subscription-reconciliation]', summary)))(result), error => (this.dependencies.reportError || (() => console.error('[subscription-reconciliation] Sweep failed; retrying next interval')))(error));
+        };
+        this.timer = setInterval(sweep, intervalMs);
+        this.timer.unref();
+        sweep();
+    }
+    async stop() {
+        this.stopped = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+        await this.pending;
+    }
+    runOnce() {
+        if (this.pending)
+            return this.pending;
+        if (this.stopped)
+            return Promise.resolve({ scanned: 0, reconciled: 0, failed: 0 });
+        this.pending = this.reconcile().finally(() => { this.pending = undefined; });
+        return this.pending;
+    }
+    async *subscriptionIds(db) {
+        const seen = new Set();
+        // Separate projected finds work with both MongoDB and Cosmos Mongo API.
+        // Keep only IDs in memory and close each cursor before opening the next.
+        for (const collection of ['fraim_api_keys', 'fraim_persona_entitlements']) {
+            if (this.stopped)
+                return;
+            const cursor = db.collection(collection).find({ stripeSubscriptionId: { $type: 'string', $ne: '' } }, { projection: { _id: 0, stripeSubscriptionId: 1 }, batchSize: 100 });
+            try {
+                for await (const row of cursor) {
+                    if (this.stopped)
+                        return;
+                    if (seen.has(row.stripeSubscriptionId))
+                        continue;
+                    seen.add(row.stripeSubscriptionId);
+                    yield row.stripeSubscriptionId;
+                }
+            }
+            finally {
+                await cursor.close();
+            }
+        }
+    }
+    async reconcile() {
+        const result = { scanned: 0, reconciled: 0, failed: 0 };
+        const db = await this.dbService.getDb();
+        const keys = db.collection('fraim_api_keys');
+        const entitlements = db.collection('fraim_persona_entitlements');
+        const subscriptions = this.subscriptionIds(db);
+        try {
+            for await (const subscriptionId of subscriptions) {
+                if (this.stopped)
+                    break;
+                result.scanned++;
+                try {
+                    // The database enforces account/workspace agreement across duplicates.
+                    const existing = await this.dbService.getApiKeyByStripeSubscriptionId(subscriptionId);
+                    const personaRecords = await entitlements.find({ stripeSubscriptionId: subscriptionId }).toArray();
+                    const identity = existing || personaRecords[0];
+                    if (!identity?.userId || !identity.stripeCustomerId)
+                        throw new Error('Subscription has no stored customer identity');
+                    if (personaRecords.some(record => record.userId !== identity.userId || record.orgId !== identity.orgId
+                        || record.workspaceId !== identity.workspaceId || record.stripeCustomerId !== identity.stripeCustomerId)) {
+                        throw new Error('Subscription persona scope mismatch');
+                    }
+                    if (!existing) {
+                        // Older persona purchases recorded only an entitlement, leaving the
+                        // account's trial credential expired. Repair within that saved scope.
+                        const accountKey = await this.dbService.getApiKeyByUserId(identity.userId, false);
+                        if (!accountKey || accountKey.revokedAt || accountKey.isActive === false
+                            || accountKey.userId !== identity.userId || accountKey.orgId !== identity.orgId
+                            || accountKey.workspaceId !== identity.workspaceId) {
+                            throw new Error('Persona purchase has no unambiguous account scope');
+                        }
+                    }
+                    const subscription = await (this.dependencies.subscriptionRetriever || (id => stripe_1.stripe.subscriptions.retrieve(id, {}, { timeout: 15000, maxNetworkRetries: 1 })))(subscriptionId);
+                    if (subscription.id !== subscriptionId || (0, subscription_provisioning_1.subscriptionCustomerId)(subscription) !== identity.stripeCustomerId) {
+                        throw new Error('Stripe subscription identity mismatch');
+                    }
+                    if (personaRecords.some(record => subscription.metadata.plan !== 'persona-hire'
+                        || record.hireMode !== 'fulltime' || record.personaKey !== subscription.metadata.personaKey
+                        || subscription.metadata.hireMode !== 'fulltime'))
+                        throw new Error('Stripe persona purchase scope mismatch');
+                    const customer = await (this.dependencies.customerRetriever || (id => stripe_1.stripe.customers.retrieve(id, {}, { timeout: 15000, maxNetworkRetries: 1 })))(identity.stripeCustomerId);
+                    if (customer.deleted || customer.id !== identity.stripeCustomerId || !customer.email
+                        || customer.email.trim().toLowerCase() !== identity.userId.trim().toLowerCase()) {
+                        throw new Error('Stripe customer identity mismatch');
+                    }
+                    const conflictingKey = await keys.findOne({
+                        stripeSubscriptionId: subscriptionId,
+                        stripeCustomerId: { $ne: identity.stripeCustomerId }
+                    }, { projection: { _id: 1 } });
+                    if (conflictingKey)
+                        throw new Error('Duplicate subscription customer identity mismatch');
+                    if (this.stopped)
+                        break;
+                    await (this.dependencies.provision || subscription_provisioning_1.provisionSubscriptionApiKey)(this.dbService, customer.email, subscription, (0, subscription_provisioning_1.subscriptionPeriodEnd)(subscription));
+                    result.reconciled++;
+                }
+                catch (error) {
+                    // Preserve prior proof on retrieval failure. Other subscriptions still
+                    // reconcile, and this exact subscription is retried on the next sweep.
+                    result.failed++;
+                    this.dependencies.reportError?.(error);
+                }
+            }
+        }
+        finally {
+            await subscriptions.return(undefined);
+        }
+        return result;
+    }
+}
+exports.SubscriptionReconciliationService = SubscriptionReconciliationService;

package/dist/src/services/usage-analytics-service.js

@@ -306,19 +306,21 @@ class UsageAnalyticsService {
         await this.logUsage(mentoringEvent);
     }
     /**
-     * Validate that a jobId exists for the user (check recent usage events)
+     * Validate that this user started this jobId, regardless of how long ago.
      */
     async validateJobId(jobId, userId) {
         try {
-            // Check if there's a recent job start event for this jobId and user
-            const recentEvents = await this.dbService.getDb();
-            const collection = recentEvents.collection('fraim_usage_events');
+            // Issue #2093 — a run resumed days or months later is still the same job, so
+            // this match is on job identity and ownership only. Adding an age condition
+            // here would silently drop analytics for exactly the long-gap resumes that
+            // the session fix is meant to support.
+            const events = await this.dbService.getDb();
+            const collection = events.collection('fraim_usage_events');
             const jobStartEvent = await collection.findOne({
                 jobId,
                 userId,
                 type: 'job',
-                'args.action': 'start',
-                createdAt: { $gte: new Date(Date.now() - 24 * 60 * 60 * 1000) } // Within last 24 hours
+                'args.action': 'start'
             });
             return jobStartEvent !== null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.352",
+  "version": "2.0.354",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {