@agentsean/hosted 1.0.0

package/dist/billing.d.ts

@@ -0,0 +1,40 @@
+import { type SqliteDatabase } from "@agentsean/db";
+import { type PlanId } from "./plans.js";
+export type StripeEvent = {
+    id: string;
+    type: string;
+    data: {
+        object: Record<string, unknown>;
+    };
+};
+export type StripeLike = {
+    createCheckoutSession: (opts: {
+        tenantId: string;
+        plan: PlanId;
+        email: string;
+        interval: "month" | "year";
+    }) => Promise<{
+        id: string;
+        url: string;
+    }>;
+    reportMeteredUsage?: ((opts: {
+        tenantId: string;
+        quantity: number;
+        period: string;
+    }) => Promise<void>) | undefined;
+};
+export declare function fakeStripe(baseUrl?: string): StripeLike;
+export declare function applyStripeEvent(db: SqliteDatabase, event: StripeEvent, now?: Date): {
+    duplicate: boolean;
+    tenantId: string | null;
+};
+export declare function activateSubscription(db: SqliteDatabase, opts: {
+    tenantId: string;
+    plan: PlanId;
+    customerId: string | null;
+    subscriptionId: string | null;
+    now?: Date | undefined;
+}): void;
+export declare function reportArticleUsage(db: SqliteDatabase, tenantId: string, quantity?: number, now?: Date, stripe?: StripeLike | undefined): void;
+export declare function articlesThisMonth(db: SqliteDatabase, tenantId: string, now?: Date): number;
+//# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EACf,CAAC,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GACjF,SAAS,CAAC;CACf,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,SAAiC,GAAG,UAAU,CAY/E;AAOD,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,WAAW,EAClB,GAAG,OAAa,GACf;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAmEjD;AAWD,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB,GACA,IAAI,CA0BN;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAI,EACZ,GAAG,OAAa,EAChB,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,GAC9B,IAAI,CAaN;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,OAAa,GACf,MAAM,CASR"}

package/dist/billing.js

@@ -0,0 +1,142 @@
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { meteredUsage, stripeEvents, subscriptions, tenants, } from "@agentsean/db";
+import { isPlanId } from "./plans.js";
+export function fakeStripe(baseUrl = "https://checkout.stripe.test") {
+    return {
+        async createCheckoutSession(opts) {
+            return {
+                id: `cs_test_${opts.tenantId}`,
+                url: `${baseUrl}/c/pay/${opts.plan}?tenant=${opts.tenantId}`,
+            };
+        },
+        async reportMeteredUsage() {
+            return;
+        },
+    };
+}
+function str(obj, key) {
+    const v = obj[key];
+    return typeof v === "string" ? v : undefined;
+}
+export function applyStripeEvent(db, event, now = new Date()) {
+    const existing = db
+        .select()
+        .from(stripeEvents)
+        .where(eq(stripeEvents.id, event.id))
+        .get();
+    if (existing)
+        return { duplicate: true, tenantId: null };
+    db.insert(stripeEvents)
+        .values({
+        id: event.id,
+        type: event.type,
+        payload: JSON.stringify(event.data.object),
+        processedAt: now.toISOString(),
+    })
+        .run();
+    const obj = event.data.object;
+    const tenantId = str(obj, "client_reference_id") ?? str(obj, "tenantId") ?? null;
+    const planRaw = str(obj, "plan") ?? metadataPlan(obj);
+    const customer = str(obj, "customer");
+    const subscription = str(obj, "subscription") ?? str(obj, "id");
+    if (event.type === "checkout.session.completed" &&
+        tenantId &&
+        planRaw &&
+        isPlanId(planRaw)) {
+        activateSubscription(db, {
+            tenantId,
+            plan: planRaw,
+            customerId: customer ?? null,
+            subscriptionId: subscription ?? null,
+            now,
+        });
+        return { duplicate: false, tenantId };
+    }
+    if (event.type === "customer.subscription.updated" &&
+        tenantId &&
+        planRaw &&
+        isPlanId(planRaw)) {
+        activateSubscription(db, {
+            tenantId,
+            plan: planRaw,
+            customerId: customer ?? null,
+            subscriptionId: subscription ?? null,
+            now,
+        });
+        return { duplicate: false, tenantId };
+    }
+    if (event.type === "customer.subscription.deleted" && tenantId) {
+        db.update(tenants)
+            .set({ status: "canceled", updatedAt: now.toISOString() })
+            .where(eq(tenants.id, tenantId))
+            .run();
+        return { duplicate: false, tenantId };
+    }
+    if (event.type === "invoice.payment_failed" && tenantId) {
+        db.update(tenants)
+            .set({ status: "past_due", updatedAt: now.toISOString() })
+            .where(eq(tenants.id, tenantId))
+            .run();
+        return { duplicate: false, tenantId };
+    }
+    return { duplicate: false, tenantId };
+}
+function metadataPlan(obj) {
+    const meta = obj["metadata"];
+    if (meta && typeof meta === "object" && !Array.isArray(meta) && "plan" in meta) {
+        const p = meta.plan;
+        return typeof p === "string" ? p : undefined;
+    }
+    return undefined;
+}
+export function activateSubscription(db, opts) {
+    const now = (opts.now ?? new Date()).toISOString();
+    db.update(tenants)
+        .set({
+        plan: opts.plan,
+        status: "active",
+        stripeCustomerId: opts.customerId,
+        stripeSubscriptionId: opts.subscriptionId,
+        updatedAt: now,
+    })
+        .where(eq(tenants.id, opts.tenantId))
+        .run();
+    db.insert(subscriptions)
+        .values({
+        id: randomUUID(),
+        tenantId: opts.tenantId,
+        plan: opts.plan,
+        interval: "month",
+        status: "active",
+        currentPeriodEnd: new Date((opts.now ?? new Date()).getTime() + 30 * 86400000).toISOString(),
+        createdAt: now,
+        updatedAt: now,
+    })
+        .run();
+}
+export function reportArticleUsage(db, tenantId, quantity = 1, now = new Date(), stripe) {
+    const period = now.toISOString().slice(0, 7);
+    db.insert(meteredUsage)
+        .values({
+        id: randomUUID(),
+        tenantId,
+        kind: "article",
+        quantity,
+        period,
+        createdAt: now.toISOString(),
+    })
+        .run();
+    void stripe?.reportMeteredUsage?.({ tenantId, quantity, period });
+}
+export function articlesThisMonth(db, tenantId, now = new Date()) {
+    const period = now.toISOString().slice(0, 7);
+    return db
+        .select()
+        .from(meteredUsage)
+        .where(eq(meteredUsage.tenantId, tenantId))
+        .all()
+        .filter((r) => r.period === period && r.kind === "article")
+        .reduce((s, r) => s + r.quantity, 0);
+}
+//# sourceMappingURL=billing.js.map

package/dist/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,OAAO,GAER,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAe,MAAM,YAAY,CAAC;AAoBnD,MAAM,UAAU,UAAU,CAAC,OAAO,GAAG,8BAA8B;IACjE,OAAO;QACL,KAAK,CAAC,qBAAqB,CAAC,IAAI;YAC9B,OAAO;gBACL,EAAE,EAAE,WAAW,IAAI,CAAC,QAAQ,EAAE;gBAC9B,GAAG,EAAE,GAAG,OAAO,UAAU,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,QAAQ,EAAE;aAC7D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,kBAAkB;YACtB,OAAO;QACT,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,GAAW;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,EAAkB,EAClB,KAAkB,EAClB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,EAAE;SAChB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SACpC,GAAG,EAAE,CAAC;IACT,IAAI,QAAQ;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;KAC/B,CAAC;SACD,GAAG,EAAE,CAAC;IAET,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;IACjF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEhE,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B;QAC3C,QAAQ;QACR,OAAO;QACP,QAAQ,CAAC,OAAO,CAAC,EACjB,CAAC;QACD,oBAAoB,CAAC,EAAE,EAAE;YACvB,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,QAAQ,IAAI,IAAI;YAC5B,cAAc,EAAE,YAAY,IAAI,IAAI;YACpC,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,+BAA+B;QAC9C,QAAQ;QACR,OAAO;QACP,QAAQ,CAAC,OAAO,CAAC,EACjB,CAAC;QACD,oBAAoB,CAAC,EAAE,EAAE;YACvB,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,QAAQ,IAAI,IAAI;YAC5B,cAAc,EAAE,YAAY,IAAI,IAAI;YACpC,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,IAAI,QAAQ,EAAE,CAAC;QAC/D,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;aACzD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;aAC/B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,IAAI,QAAQ,EAAE,CAAC;QACxD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;aACzD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;aAC/B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAkB,EAClB,IAMC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC;QACH,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,QAAQ;QAChB,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,oBAAoB,EAAE,IAAI,CAAC,cAAc;QACzC,SAAS,EAAE,GAAG;KACf,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SACpC,GAAG,EAAE,CAAC;IACT,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,gBAAgB,EAAE,IAAI,IAAI,CACxB,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CACnD,CAAC,WAAW,EAAE;QACf,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAkB,EAClB,QAAgB,EAChB,QAAQ,GAAG,CAAC,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,MAA+B;IAE/B,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;SACD,GAAG,EAAE,CAAC;IACT,KAAK,MAAM,EAAE,kBAAkB,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAkB,EAClB,QAAgB,EAChB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;SAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/connector.d.ts

@@ -0,0 +1,22 @@
+import { type SqliteDatabase } from "@agentsean/db";
+/** CMS write kinds the hosted control plane must never store. */
+export declare const CMS_WRITE_KINDS: readonly ["wordpress", "shopify", "webflow", "ghost", "wix", "bigcommerce", "contentful", "sanity", "strapi", "payload", "cloudflare", "git"];
+export declare class HostedCredentialError extends Error {
+    readonly name = "HostedCredentialError";
+}
+export declare function isCmsWriteKind(kind: string): boolean;
+export declare function refuseHostedCmsCredential(kind: string): never;
+export declare function createConnectorPairing(db: SqliteDatabase, tenantId: string, siteId: string | null, now?: Date): {
+    id: string;
+    token: string;
+};
+export declare function activateConnector(db: SqliteDatabase, token: string): boolean;
+export declare function listConnectors(db: SqliteDatabase, tenantId: string): {
+    id: string;
+    tenantId: string;
+    siteId: string | null;
+    tokenHash: string;
+    status: string;
+    createdAt: string;
+}[];
+//# sourceMappingURL=connector.d.ts.map

package/dist/connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../src/connector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEvE,iEAAiE;AACjE,eAAO,MAAM,eAAe,+IAalB,CAAC;AAEX,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,2BAA2B;CAClD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAI7D;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,GAAG,OAAa,GACf;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAc/B;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAa5E;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM;;;;;;;IAMlE"}

package/dist/connector.js

@@ -0,0 +1,65 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { connectorPairings } from "@agentsean/db";
+/** CMS write kinds the hosted control plane must never store. */
+export const CMS_WRITE_KINDS = [
+    "wordpress",
+    "shopify",
+    "webflow",
+    "ghost",
+    "wix",
+    "bigcommerce",
+    "contentful",
+    "sanity",
+    "strapi",
+    "payload",
+    "cloudflare",
+    "git",
+];
+export class HostedCredentialError extends Error {
+    name = "HostedCredentialError";
+}
+export function isCmsWriteKind(kind) {
+    return CMS_WRITE_KINDS.includes(kind);
+}
+export function refuseHostedCmsCredential(kind) {
+    throw new HostedCredentialError(`Hosted Sean will not store ${kind} write credentials. Pair a customer-side connector; the customer's own daemon holds the key.`);
+}
+export function createConnectorPairing(db, tenantId, siteId, now = new Date()) {
+    const token = randomBytes(24).toString("base64url");
+    const id = randomUUID();
+    db.insert(connectorPairings)
+        .values({
+        id,
+        tenantId,
+        siteId,
+        tokenHash: createHash("sha256").update(token).digest("hex"),
+        status: "pending",
+        createdAt: now.toISOString(),
+    })
+        .run();
+    return { id, token };
+}
+export function activateConnector(db, token) {
+    const hash = createHash("sha256").update(token).digest("hex");
+    const row = db
+        .select()
+        .from(connectorPairings)
+        .all()
+        .find((r) => r.tokenHash === hash);
+    if (!row)
+        return false;
+    db.update(connectorPairings)
+        .set({ status: "active" })
+        .where(eq(connectorPairings.id, row.id))
+        .run();
+    return true;
+}
+export function listConnectors(db, tenantId) {
+    return db
+        .select()
+        .from(connectorPairings)
+        .where(eq(connectorPairings.tenantId, tenantId))
+        .all();
+}
+//# sourceMappingURL=connector.js.map

package/dist/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../src/connector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAuB,MAAM,eAAe,CAAC;AAEvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,KAAK;IACL,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,KAAK;CACG,CAAC;AAEX,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,uBAAuB,CAAC;CAClD;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,IAAI,8FAA8F,CACjI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAkB,EAClB,QAAgB,EAChB,MAAqB,EACrB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CAAC;QACN,EAAE;QACF,QAAQ;QACR,MAAM;QACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3D,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;SACD,GAAG,EAAE,CAAC;IACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAkB,EAAE,KAAa;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,GAAG,EAAE;SACL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACvC,GAAG,EAAE,CAAC;IACT,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAkB,EAAE,QAAgB;IACjE,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC/C,GAAG,EAAE,CAAC;AACX,CAAC"}

package/dist/cost.d.ts

@@ -0,0 +1,15 @@
+import { type SqliteDatabase } from "@agentsean/db";
+export type TenantCost = {
+    tenantId: string;
+    plan: string;
+    sites: number;
+    siteCap: number;
+    ledgerUsd: number;
+    cogsUsd: number;
+    revenueUsd: number;
+    margin: number;
+    articles: number;
+    byok: boolean;
+};
+export declare function tenantCostVisibility(db: SqliteDatabase, tenantId: string, now?: Date): TenantCost;
+//# sourceMappingURL=cost.d.ts.map

package/dist/cost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK7E,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,OAAa,GACf,UAAU,CA6BZ"}

package/dist/cost.js

@@ -0,0 +1,38 @@
+import { eq } from "drizzle-orm";
+import { costLedger, tenantSites } from "@agentsean/db";
+import { NON_LLM_COGS_USD, planOf } from "./plans.js";
+import { getTenant, tenantSiteCount } from "./tenants.js";
+import { articlesThisMonth } from "./billing.js";
+export function tenantCostVisibility(db, tenantId, now = new Date()) {
+    const tenant = getTenant(db, tenantId);
+    if (!tenant)
+        throw new Error("unknown_tenant");
+    const plan = planOf(tenant.plan);
+    const links = db
+        .select()
+        .from(tenantSites)
+        .where(eq(tenantSites.tenantId, tenantId))
+        .all();
+    const siteIds = new Set(links.map((l) => l.siteId));
+    let ledgerUsd = 0;
+    for (const row of db.select().from(costLedger).all()) {
+        if (row.siteId && siteIds.has(row.siteId))
+            ledgerUsd += row.costUsd;
+    }
+    const sites = tenantSiteCount(db, tenantId);
+    const revenueUsd = plan.priceUsdMonth;
+    const cogsUsd = NON_LLM_COGS_USD + ledgerUsd;
+    return {
+        tenantId,
+        plan: plan.id,
+        sites,
+        siteCap: plan.sites,
+        ledgerUsd,
+        cogsUsd,
+        revenueUsd,
+        margin: revenueUsd <= 0 ? 1 : (revenueUsd - cogsUsd) / revenueUsd,
+        articles: articlesThisMonth(db, tenantId, now),
+        byok: Boolean(tenant.byok),
+    };
+}
+//# sourceMappingURL=cost.js.map

package/dist/cost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.js","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAuB,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAejD,MAAM,UAAU,oBAAoB,CAClC,EAAkB,EAClB,QAAgB,EAChB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,EAAE;SACR,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACzC,GAAG,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAC7C,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,SAAS;QACT,OAAO;QACP,UAAU;QACV,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,UAAU;QACjE,QAAQ,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC;QAC9C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/engine.d.ts

@@ -0,0 +1,47 @@
+import { type PlanId } from "./plans.js";
+import { addTenantSite } from "./tenants.js";
+import { type StripeLike } from "./billing.js";
+import type { SqliteDatabase } from "@agentsean/db";
+export type SignupResult = {
+    tenantId: string;
+    plan: PlanId;
+    checkoutUrl: string;
+};
+export declare function signupTenant(db: SqliteDatabase, opts: {
+    name: string;
+    email: string;
+    plan: PlanId;
+    stripe?: StripeLike | undefined;
+    now?: Date | undefined;
+}): Promise<SignupResult>;
+/** Simulate (or apply) the paid webhook so the tenant can add sites. */
+export declare function completeCheckout(db: SqliteDatabase, opts: {
+    tenantId: string;
+    plan: PlanId;
+    eventId?: string | undefined;
+    now?: Date | undefined;
+}): void;
+export declare function hostedStatus(db: SqliteDatabase, tenantId: string): {
+    tenant: {
+        id: string;
+        name: string;
+        email: string;
+        plan: string;
+        status: string;
+        stripeCustomerId: string | null;
+        stripeSubscriptionId: string | null;
+        byok: number;
+        createdAt: string;
+        updatedAt: string;
+    };
+    plan: import("./plans.js").Plan;
+    sites: {
+        id: string;
+        origin: string;
+        name: string | null;
+    }[];
+    cost: import("./cost.js").TenantCost;
+    googleRedirect: string | null;
+} | null;
+export { addTenantSite };
+//# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA4C,MAAM,cAAc,CAAC;AACvF,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,YAAY,CAChC,EAAE,EAAE,cAAc,EAClB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB,GACA,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,cAAc,EAClB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB,GACA,IAAI,CAeN;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;SAWhE;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/engine.js

@@ -0,0 +1,62 @@
+import { isPlanId, PLANS } from "./plans.js";
+import { addTenantSite, createTenant, getTenant, listTenantSites } from "./tenants.js";
+import { applyStripeEvent, fakeStripe, } from "./billing.js";
+import { tenantCostVisibility } from "./cost.js";
+import { hostedOauthRedirectUri } from "./oauth.js";
+export async function signupTenant(db, opts) {
+    if (opts.plan === "self_host") {
+        const tenant = createTenant(db, {
+            name: opts.name,
+            email: opts.email,
+            plan: "self_host",
+            now: opts.now,
+        });
+        return { tenantId: tenant.id, plan: "self_host", checkoutUrl: "" };
+    }
+    const tenant = createTenant(db, {
+        name: opts.name,
+        email: opts.email,
+        plan: opts.plan,
+        now: opts.now,
+    });
+    const stripe = opts.stripe ?? fakeStripe();
+    const session = await stripe.createCheckoutSession({
+        tenantId: tenant.id,
+        plan: opts.plan,
+        email: opts.email,
+        interval: "month",
+    });
+    return { tenantId: tenant.id, plan: opts.plan, checkoutUrl: session.url };
+}
+/** Simulate (or apply) the paid webhook so the tenant can add sites. */
+export function completeCheckout(db, opts) {
+    const event = {
+        id: opts.eventId ?? `evt_${opts.tenantId}`,
+        type: "checkout.session.completed",
+        data: {
+            object: {
+                client_reference_id: opts.tenantId,
+                tenantId: opts.tenantId,
+                plan: opts.plan,
+                customer: `cus_${opts.tenantId}`,
+                subscription: `sub_${opts.tenantId}`,
+            },
+        },
+    };
+    applyStripeEvent(db, event, opts.now ?? new Date());
+}
+export function hostedStatus(db, tenantId) {
+    const tenant = getTenant(db, tenantId);
+    if (!tenant)
+        return null;
+    const plan = PLANS[isPlanId(tenant.plan) ? tenant.plan : "cloud_starter"];
+    return {
+        tenant,
+        plan,
+        sites: listTenantSites(db, tenantId),
+        cost: tenantCostVisibility(db, tenantId),
+        googleRedirect: hostedOauthRedirectUri(),
+    };
+}
+export { addTenantSite };
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAe,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AASpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAkB,EAClB,IAMC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAC5E,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAC9B,EAAkB,EAClB,IAKC;IAED,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE;QAC1C,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,mBAAmB,EAAE,IAAI,CAAC,QAAQ;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE;gBAChC,YAAY,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE;aACrC;SACF;KACF,CAAC;IACF,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAkB,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC1E,OAAO;QACL,MAAM;QACN,IAAI;QACJ,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC;QACpC,IAAI,EAAE,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC;QACxC,cAAc,EAAE,sBAAsB,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/entitlements.d.ts

@@ -0,0 +1,8 @@
+import { type Plan, type PlanId } from "./plans.js";
+export type EntitlementFeature = "aiVisibility" | "hostedOauth" | "whiteLabel" | "apiAccess" | "priorityQueue" | "clientSeats" | "bulkOps" | "dailyRanks";
+export declare class EntitlementError extends Error {
+    readonly name = "EntitlementError";
+}
+export declare function hasFeature(plan: Plan, feature: EntitlementFeature): boolean;
+export declare function assertEntitlement(planId: PlanId | string, feature: EntitlementFeature): void;
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../src/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,IAAI,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,aAAa,GACb,YAAY,GACZ,WAAW,GACX,eAAe,GACf,aAAa,GACb,SAAS,GACT,YAAY,CAAC;AAEjB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;CAC7C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAmB3E;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAKN"}

package/dist/entitlements.js

@@ -0,0 +1,33 @@
+import { isHostedMode, planOf } from "./plans.js";
+export class EntitlementError extends Error {
+    name = "EntitlementError";
+}
+export function hasFeature(plan, feature) {
+    switch (feature) {
+        case "aiVisibility":
+            return plan.aiVisibility;
+        case "hostedOauth":
+            return plan.hostedOauth;
+        case "whiteLabel":
+            return plan.whiteLabel;
+        case "apiAccess":
+            return plan.apiAccess;
+        case "priorityQueue":
+            return plan.priorityQueue;
+        case "clientSeats":
+            return plan.clientSeats;
+        case "bulkOps":
+            return plan.bulkOps;
+        case "dailyRanks":
+            return plan.ranks === "daily";
+    }
+}
+export function assertEntitlement(planId, feature) {
+    if (!isHostedMode())
+        return;
+    const plan = planOf(planId);
+    if (hasFeature(plan, feature))
+        return;
+    throw new EntitlementError(`${plan.name} does not include ${feature}.`);
+}
+//# sourceMappingURL=entitlements.js.map

package/dist/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../src/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAA0B,MAAM,YAAY,CAAC;AAY1E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;CAC7C;AAED,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,OAA2B;IAChE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,KAAK,YAAY;YACf,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,OAA2B;IAE3B,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;QAAE,OAAO;IACtC,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,IAAI,qBAAqB,OAAO,GAAG,CAAC,CAAC;AAC1E,CAAC"}

package/dist/envelope.d.ts

@@ -0,0 +1,9 @@
+import { type SqliteDatabase } from "@agentsean/db";
+export declare class EnvelopeError extends Error {
+    readonly name = "EnvelopeError";
+}
+export declare function masterKeyFromEnv(env?: NodeJS.ProcessEnv): Buffer;
+export declare function encryptSecret(dek: Buffer, plaintext: string): string;
+export declare function decryptSecret(dek: Buffer, blob: string): string;
+export declare function loadOrCreateDek(db: SqliteDatabase, tenantId: string, master: Buffer, now?: Date): Buffer;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAIlE,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAmB;CAC1C;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAS7E;AAoBD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED,wBAAgB,eAAe,CAC7B,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,OAAa,GACf,MAAM,CAiBR"}

package/dist/envelope.js

@@ -0,0 +1,72 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { envelopeKeys } from "@agentsean/db";
+const ALGO = "aes-256-gcm";
+export class EnvelopeError extends Error {
+    name = "EnvelopeError";
+}
+export function masterKeyFromEnv(env = process.env) {
+    const raw = env["SEAN_KMS_KEY"]?.trim();
+    if (!raw) {
+        throw new EnvelopeError("SEAN_KMS_KEY is required to wrap per-tenant data keys.");
+    }
+    if (/^[0-9a-f]+$/i.test(raw) && raw.length === 64)
+        return Buffer.from(raw, "hex");
+    const buf = Buffer.from(raw, "base64");
+    if (buf.length === 32)
+        return buf;
+    return createHash("sha256").update(raw).digest();
+}
+function wrapDek(master, dek) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGO, master, iv);
+    const enc = Buffer.concat([cipher.update(dek), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString("base64url");
+}
+function unwrapDek(master, wrapped) {
+    const buf = Buffer.from(wrapped, "base64url");
+    const iv = buf.subarray(0, 12);
+    const tag = buf.subarray(12, 28);
+    const enc = buf.subarray(28);
+    const decipher = createDecipheriv(ALGO, master, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(enc), decipher.final()]);
+}
+export function encryptSecret(dek, plaintext) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGO, dek, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString("base64url");
+}
+export function decryptSecret(dek, blob) {
+    const buf = Buffer.from(blob, "base64url");
+    const iv = buf.subarray(0, 12);
+    const tag = buf.subarray(12, 28);
+    const enc = buf.subarray(28);
+    const decipher = createDecipheriv(ALGO, dek, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(enc), decipher.final()]).toString("utf8");
+}
+export function loadOrCreateDek(db, tenantId, master, now = new Date()) {
+    const existing = db
+        .select()
+        .from(envelopeKeys)
+        .where(eq(envelopeKeys.tenantId, tenantId))
+        .get();
+    if (existing)
+        return unwrapDek(master, existing.wrappedDek);
+    const dek = randomBytes(32);
+    db.insert(envelopeKeys)
+        .values({
+        id: randomUUID(),
+        tenantId,
+        wrappedDek: wrapDek(master, dek),
+        createdAt: now.toISOString(),
+    })
+        .run();
+    return dek;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAElE,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,GAAW;IAC1C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiB;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,EAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,QAAQ,GAAG,EAAE;SAChB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,GAAG,EAAE,CAAC;IACT,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QAChC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;SACD,GAAG,EAAE,CAAC;IACT,OAAO,GAAG,CAAC;AACb,CAAC"}