@arnaudjnn/billing-tools 0.14.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arnaud Jeannin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,243 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/arnaudjnn/billing-tools/main/assets/hero.svg" alt="Billing Tools, the get-paid engine for Stripe + WorkOS apps, for humans and AI agents" width="100%">
+</p>
+
+<p align="center">
+  <b>Drop-in auth + billing for any Stripe&nbsp;+&nbsp;WorkOS app, usable by humans <i>and</i> AI agents,</b><br/>
+  exposed as <b>MCP tools</b>, a <b>REST API</b>, and a <b>CLI</b>, over one storage-agnostic engine.
+</p>
+
+<p align="center">
+  <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-635BFF.svg">
+  <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-strict-3178C6.svg">
+  <img alt="Stripe" src="https://img.shields.io/badge/Stripe-635BFF.svg">
+  <img alt="WorkOS" src="https://img.shields.io/badge/WorkOS-000000.svg">
+  <img alt="MCP compatible" src="https://img.shields.io/badge/MCP-compatible-16a34a.svg">
+  <img alt="Framework agnostic" src="https://img.shields.io/badge/framework-agnostic-8A8A9A.svg">
+  <img alt="PRs welcome" src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg">
+</p>
+
+---
+
+**Billing Tools** packages the "get money in" plumbing you'd otherwise rebuild in every SaaS: API-key auth on top of **WorkOS**, token/credit + subscription billing on top of **Stripe**, and (because the next wave of customers is autonomous) first-class **agent** rails: [`auth.md`](https://workos.com/auth-md) self-registration and [`MPP`](https://mpp.dev/) machine payments. Wire it once; serve humans through a browser and agents through headless HTTP with the same engine. Storage is pluggable behind one small adapter (use the built-in WorkOS store, or mirror into your own Postgres).
+
+## Table of contents
+
+- [Ship tools, not billing plumbing](#ship-tools-not-billing-plumbing)
+- [Key Features](#key-features)
+- [Getting Started](#getting-started)
+- [How it works](#how-it-works)
+- [Agent auth (auth.md)](#agent-auth-authmd)
+- [Machine payments (MPP)](#machine-payments-mpp)
+- [CLI](#cli)
+- [Configuration](#configuration)
+- [Roadmap](#roadmap)
+- [Contributing](#contributing)
+- [License](#license)
+
+## Ship tools, not billing plumbing
+
+The next generation of software is **agents**, and an agent is only as useful as the **tools** it can call. Tools *are* the product now.
+
+But you don't go to war naked. Ship a tool into the wild with no auth and no way to get paid, and you're just donating GPU time to strangers. Someone still has to meter every call, hold a balance, bill the workspace, enforce seats, and cut off the freeloaders: the boring, identical, get-it-wrong-once-and-bleed-money layer that *every* AI product rebuilds from scratch.
+
+**Billing Tools is the armor.** Bring a Stripe + WorkOS stack and you inherit, out of the box, the exact monetization model the frontier labs run on. The same shape as **Anthropic, OpenAI, and xAI (Grok)**:
+
+- 💰 **A price per token:** every tool call costs tokens, metered and deducted automatically.
+- 🏢 **Workspaces:** the billable account, with one Stripe customer + balance each.
+- 👥 **Users per workspace:** seats, invitations, and roles.
+- 🪙 **Tokens per user:** per-seat grants, seat limits, and auto-reload.
+
+So you do the one thing only you can do (**build great tools**) and monetize them the same afternoon. The get-paid layer is already handled, battle-tested, and agent-ready. 🛡️
+
+## Key Features
+
+### 🔐 Auth & identity
+- 🔑 **API-key auth:** WorkOS organization API keys (`Authorization: Bearer sk_…`), validated on every request.
+- ✉️ **Passwordless magic-auth:** email a 6-digit code, get back a workspace/org + API key. No passwords.
+- 🤖 **auth.md agent self-registration:** the [WorkOS auth.md](https://workos.com/auth-md) protocol (RFC 9728 Protected-Resource-Metadata + RFC 8414 Authorization-Server-Metadata + `/agent/identity` anonymous or verified-email + the claim ceremony), so agents onboard with **no human signup**.
+- ♻️ **RFC 7009 revocation:** revoke a key by value; always-200, no token-existence leak.
+- 🎫 **Optional OAuth-JWT hook:** bring your own MCP OAuth proxy via a single adapter method.
+
+### 💳 Billing & payments
+- 🪙 **Usage-metered token wallet:** held in the native Stripe customer credit balance (1 token = 1¢), with idempotent credit/debit.
+- 🛒 **Checkout top-ups:** Stripe Checkout that auto-offers cards **+ Apple&nbsp;Pay / Google&nbsp;Pay / Link**.
+- 📦 **Declarative subscription plans:** describe plans in code; products/prices are **auto-provisioned in Stripe** via `lookup_key` (immutable-price safe, orphan-cleaning). Zero dashboard clicks.
+- 🎟️ **Per-seat / per-cycle token grants + seat limits:** included tokens scale with active members.
+- 🔁 **Auto-reload:** off-session saved-card recharge when the balance drops below a threshold.
+- 🧾 **Invoices + 🏛️ Customer Portal:** list invoices, and a one-call Stripe Billing Portal URL for self-serve upgrade/downgrade/cancel + card updates.
+- 🔒 **Idempotency on every money move:** welcome bonus, checkout credit, and per-cycle grants each carry a stable key, so retries/replays never double-charge.
+
+### 🤖 Built for AI agents
+- 📄 **auth.md:** the [agent onboarding standard](https://workos.com/auth-md), served for you (`/auth.md` narrative + discovery metadata).
+- 🏧 **MPP machine payments:** Stripe's [Machine Payments Protocol](https://mpp.dev/): a HTTP **402 + `WWW-Authenticate: Payment`** challenge for pay-per-request (SPT card or crypto/USDC), the payment sibling of auth.md's 401.
+- 🧰 **MCP server tools:** `get_api_key`, `get_token_balance`, `buy_tokens`, `list_plans`, `get_billing_portal`, and more, drop straight into Claude, Cursor, or any MCP client.
+- 🧭 **Discovery hints:** every 401/402 advertises `resource_metadata`, so an agent can bootstrap unattended.
+
+### 🧩 Three surfaces, one engine
+- 🛠️ **MCP:** `createMcpTransport({ register, adapter })`.
+- 🌐 **REST:** `createToolListHandler` + `createToolDispatchHandler` (429/401/400/404 mapping built in).
+- ⌨️ **CLI:** `registerBillingCommands(program, …)` gives you `auth`, `keys`, `balance`, `buy`, `invoices`.
+- 🪝 **Stripe webhook:** `createStripeWebhookHandler()` for instant checkout crediting.
+
+### 🔄 Zero-webhook sync
+- 📡 **Event polling:** reconcile Stripe **and** WorkOS via their Events APIs. No webhook endpoints, no signing secrets.
+- ⏱️ **Any scheduler:** run it in-process with `sync.start()` (persistent hosts) or as a serverless cron via `createSyncRoute()`.
+- 🪞 **Generic DB mirror:** shadow WorkOS orgs/users into your own tables (`createMirror`), driver-agnostic.
+- 📉 **Dunning hook:** `invoice.payment_failed` flips the org to `past_due` and fires an `onPaymentFailed` hook (Stripe Smart Retries do the retries).
+
+### 🌍 Framework and platform agnostic
+- ⚡ **Web-standard handlers:** everything returns `Request` to `Response`; mount in Next.js, Hono, Bun, Deno, or Cloudflare Workers.
+- 🧱 **No framework imports:** runtime deps are just `stripe` + `@workos-inc/node`.
+- 🗄️ **Bring your own DB:** no `pg` dependency; you pass a `query` executor (any Postgres-compatible driver).
+- 🔌 **Pluggable storage adapter:** WorkOS-only, or WorkOS + your DB mirror, behind one interface.
+- ☁️ **No lock-in:** runs on any Node host (Railway / Render / Fly / Vercel / self-host).
+
+### 🏛️ Design doctrine
+- 📐 **SDK-first:** thin-wraps the Stripe & WorkOS SDKs (SDK types, pagination, typed errors, idempotency) so the lib evolves *with* the platforms instead of drifting.
+- 🎯 **One memoized client per SDK:** lazy, never constructed at import.
+- 🔒 **Secure by default:** AES-256-GCM session encryption at rest, SHA-256-hashed claim tokens, verified-domain-only internal-org checks.
+- 🧪 **Offline-testable:** the auth.md + MPP protocol surfaces are pure `Request` to `Response`, unit-testable without a live account.
+
+## Getting Started
+
+### Prerequisites
+- **Node 18+**
+- A **Stripe** secret key (`STRIPE_SECRET_KEY`)
+- A **WorkOS** API key + client id (`WORKOS_API_KEY`, `WORKOS_CLIENT_ID`)
+
+### Install
+
+```bash
+npm install @arnaudjnn/billing-tools
+# peers (provide the ones you use): @modelcontextprotocol/sdk mcp-handler zod
+```
+
+Ships compiled `dist/`, so there's no build step or `transpilePackages` needed in the consumer.
+
+### Environment
+
+```bash
+STRIPE_SECRET_KEY=sk_test_…
+STRIPE_WEBHOOK_SECRET=whsec_…        # only if you mount the webhook
+WORKOS_API_KEY=sk_…
+WORKOS_CLIENT_ID=client_…
+INTERNAL_ORG_DOMAINS=acme.com        # optional: orgs with these verified domains are unmetered
+```
+
+### Wire it up (one call)
+
+`createBilling()` composes every surface from a single config (one module instance = one shared auth context). You supply the adapter + config; it returns the mounted handlers.
+
+```ts
+// billing.ts
+import { createBilling } from "@arnaudjnn/billing-tools";
+import { WorkOSOrgAdapter } from "@arnaudjnn/billing-tools/adapters/workos-org";
+
+export const { mcp, restList, restDispatch, webhook, agentAuth } = createBilling({
+  adapter: new WorkOSOrgAdapter(),                       // WorkOS is the source of truth
+  config: { currency: "usd", baseUrl: process.env.APP_URL! },
+  agentAuth: { branding: { productName: "Acme" } },     // enables auth.md (optional)
+});
+```
+
+```ts
+// app/[transport]/route.ts       →  export const { GET, POST } = mcp
+// app/api/v0/route.ts            →  export const GET = restList
+// app/api/v0/[tool]/route.ts     →  export const POST = restDispatch
+// app/api/stripe/webhook/route.ts→  export const POST = webhook
+```
+
+Prefer fine-grained control? Every factory is exported individually (`registerBillingTools`, `createMcpTransport`, `createToolListHandler`, `createToolDispatchHandler`, `createStripeWebhookHandler`, `createAgentAuth`, …) so you can build your own composition root.
+
+### First call
+
+```bash
+# List available tools + costs
+curl https://your-app.com/api/v0
+
+# Use a key (Bearer sk_…)
+curl -X POST https://your-app.com/api/v0/get_token_balance \
+  -H "Authorization: Bearer sk_…"
+```
+
+Add agent onboarding with [`createAgentAuth`](#agent-auth-authmd) and pay-per-call with [`createMachinePaymentHandler`](#machine-payments-mpp). See below.
+
+## How it works
+
+**WorkOS is always the source of truth.** Your app's `orgId` is opaque: implement the adapter and everything (auth, metering, Stripe math, all surfaces) works unchanged. Two shipped patterns:
+
+| Pattern | What `orgId` maps to | Storage | Use when |
+|---|---|---|---|
+| **A: WorkOS-only** | the WorkOS org id | none beyond WorkOS | you don't have (or need) your own DB rows |
+| **B: WorkOS + DB mirror** | your own id (e.g. `ws_…`) | a `workos_org_id` column + `org.externalId`, 1:1 | you keep local rows and mirror WorkOS into them |
+
+In both, API keys are WorkOS org keys and the Stripe pointer lives on the org. The `WorkOSOrgAdapter` (`@arnaudjnn/billing-tools/adapters/workos-org`) implements both; pass a `map` for Pattern B.
+
+## Agent auth (auth.md)
+
+Implements the [WorkOS auth.md](https://workos.com/auth-md) spec.
+
+```ts
+import { createAgentAuth } from "@arnaudjnn/billing-tools";
+
+export const agentAuth = createAgentAuth({
+  adapter, config,
+  branding: { productName: "Acme", logoUri: "https://acme.com/logo.svg" },
+  identityTypes: ["anonymous", "verified_email"],
+});
+// mount: /auth.md, /.well-known/oauth-{protected-resource,authorization-server},
+//        /agent/identity, /agent/identity/claim, /oauth/token, /oauth/revoke
+```
+
+An agent hits a 401, follows the `resource_metadata` hint to your metadata, reads `/auth.md`, then registers (either **anonymously** for an instant key, or via a **verified-email** claim ceremony where the user reads back a code) and starts calling tools. All handlers are `Request` to `Response`.
+
+## Machine payments (MPP)
+
+Implements Stripe's [Machine Payments Protocol](https://mpp.dev/).
+
+```ts
+import { createMachinePaymentHandler } from "@arnaudjnn/billing-tools";
+
+const pay = createMachinePaymentHandler({ methods: ["stripe"], amount: 50, currency: "usd" });
+const gate = await pay.requirePayment(request);
+if (gate instanceof Response) return gate;   // 402 + WWW-Authenticate: Payment challenge
+// else settlement succeeded, serve the paid resource
+```
+
+The 402 challenge + credential parsing ship ready and are offline-testable. Actual settlement (card via shared payment tokens, or crypto/USDC) is injected via a `settle` function once your Stripe account is enabled for machine payments; until then the gate returns a clean "settlement not enabled" 402 (never a crash). `createPaymentMd()` serves an agent-facing `/payment.md`.
+
+## CLI
+
+```ts
+import { registerBillingCommands } from "@arnaudjnn/billing-tools";
+import { Command } from "commander";
+
+const program = new Command();
+registerBillingCommands(program, { configDir: "~/.acme", envPrefix: "ACME", defaultUrl: "https://acme.com" });
+// acme auth | keys list|revoke | balance | buy | invoices
+```
+
+## Configuration
+
+`BillingConfig` (pass to `resolveConfig`):
+
+| Field | Default | Purpose |
+|---|---|---|
+| `baseUrl` | required | Checkout success/cancel + portal return URLs |
+| `currency` | `"usd"` | Stripe currency |
+| `freeTokens` | `100` | Welcome credit on first customer creation |
+| `internalDomains` | `[]` | Orgs with these **verified** WorkOS domains are unmetered (see `internalDomainsFromEnv`) |
+
+## Roadmap
+
+- 🧾 Stripe Tax (`automatic_tax`) opt-in
+- 🪙 x402 machine-payment protocol alongside [MPP](https://mpp.dev/)
+
+## Contributing
+
+Issues and PRs welcome. The engine is plain TypeScript compiled with `tsc`; `dist/` is committed (consumers install via Git). See `AGENTS.md` for the architecture, the adapter interface, the SDK-first doctrine, and the release flow.
+
+## License
+
+[MIT](LICENSE) © Arnaud Jeannin

package/dist/adapters/workos-org.d.ts

@@ -0,0 +1,80 @@
+import type { BillingAdapter, BillingUser, ApiKeyInfo } from "../types.js";
+/** Bidirectional id map between the app's `orgId` and the WorkOS org id. */
+export interface WorkOSOrgMap {
+    /** app orgId → WorkOS org id (create/reconcile-on-read as needed). */
+    toWorkosOrgId(orgId: string): Promise<string>;
+    /** WorkOS org id → app orgId, or null if it maps to nothing. */
+    toOrgId(workosOrgId: string): Promise<string | null>;
+}
+export interface WorkOSOrgAdapterOptions {
+    apiKey?: string;
+    clientId?: string;
+    /** Key name for new keys. Default "API Key". */
+    keyName?: string;
+    /** DB-mirror id map. Omit for a WorkOS-only app (identity mapping). */
+    map?: WorkOSOrgMap;
+    /** Override org creation (e.g. also insert the mirror workspace row +
+     *  membership). Omit to use the default (company-domain org + verified
+     *  domain + membership). */
+    ensureOrg?: (user: BillingUser) => Promise<{
+        orgId: string;
+    }>;
+}
+export declare class WorkOSOrgAdapter implements BillingAdapter {
+    private apiKey?;
+    private clientId?;
+    private map?;
+    private ensureOrg?;
+    constructor(opts?: WorkOSOrgAdapterOptions);
+    private get workos();
+    /** app orgId → WorkOS org id (identity when no map is configured). */
+    private wid;
+    validateApiKey(token: string): Promise<{
+        orgId: string;
+    } | null>;
+    getOrgDomains(orgId: string): Promise<string[]>;
+    getBillingCustomerId(orgId: string): Promise<string | null>;
+    setBillingCustomerId(orgId: string, customerId: string): Promise<void>;
+    ensureOrgForUser(user: BillingUser): Promise<{
+        orgId: string;
+    }>;
+    mintApiKey(orgId: string, name: string, _createdBy?: string): Promise<{
+        id: string;
+        value: string;
+    }>;
+    listApiKeys(orgId: string): Promise<ApiKeyInfo[]>;
+    /** Revoke by raw token value (RFC 7009): validate → key id → hard delete. */
+    revokeApiKeyByToken(token: string): Promise<boolean>;
+    /** Create an org with no user (auth.md anonymous). No verified domain, so it
+     *  never satisfies the internal-org unmetered check. Returns the WorkOS org id
+     *  as `orgId` (Pattern A). With a `map` configured there's no mirror row, so
+     *  prefer disabling anonymous for mirror apps (identityTypes without it). */
+    createAnonymousOrg(opts: {
+        name: string;
+        metadata?: Record<string, string>;
+    }): Promise<{
+        orgId: string;
+    }>;
+    revokeApiKey(orgId: string, id: string): Promise<{
+        id: string;
+        name: string;
+    } | null>;
+    /** Active-member count for the org (per-seat token grants + seat limits).
+     *  Auto-paginates so orgs with >100 members aren't undercounted. */
+    memberCount(orgId: string): Promise<number>;
+    getSubscription(orgId: string): Promise<{
+        plan: string | null;
+        status: string | null;
+        subscriptionId: string | null;
+        periodEnd: string | null;
+    }>;
+    /** Write subscription state onto the org metadata. `plan: undefined` leaves
+     *  the plan as-is; `null` clears it (back to the default plan). */
+    setSubscription(orgId: string, sub: {
+        plan?: string | null;
+        status: string | null;
+        subscriptionId: string | null;
+        periodEnd: string | null;
+    }): Promise<void>;
+}
+//# sourceMappingURL=workos-org.d.ts.map

package/dist/adapters/workos-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-org.d.ts","sourceRoot":"","sources":["../../src/adapters/workos-org.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB3E,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,gEAAgE;IAChE,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;gCAE4B;IAC5B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,qBAAa,gBAAiB,YAAW,cAAc;IACrD,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAoD;gBAE1D,IAAI,GAAE,uBAA4B;IAS9C,OAAO,KAAK,MAAM,GAEjB;IAED,sEAAsE;IACtE,OAAO,CAAC,GAAG;IAIL,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAYhE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS/C,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAW3D,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtE,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB/D,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQpG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAYvD,6EAA6E;IACvE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW1D;;;iFAG6E;IACvE,kBAAkB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IASzG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAe3F;wEACoE;IAC9D,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAS3C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IAWF;uEACmE;IAC7D,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GACA,OAAO,CAAC,IAAI,CAAC;CAejB"}

package/dist/adapters/workos-org.js

@@ -0,0 +1,176 @@
+import { DomainDataState, OrganizationDomainState } from "@workos-inc/node";
+import { getWorkOS } from "../workos.js";
+import { lookupCompany } from "../util/clearout.js";
+export class WorkOSOrgAdapter {
+    apiKey;
+    clientId;
+    map;
+    ensureOrg;
+    constructor(opts = {}) {
+        this.apiKey = opts.apiKey;
+        this.clientId = opts.clientId;
+        this.map = opts.map;
+        this.ensureOrg = opts.ensureOrg;
+    }
+    // The shared, lazily-memoized client (see workos.ts). With no explicit creds
+    // this is the process-wide singleton; explicit creds get their own client.
+    get workos() {
+        return getWorkOS({ apiKey: this.apiKey, clientId: this.clientId });
+    }
+    /** app orgId → WorkOS org id (identity when no map is configured). */
+    wid(orgId) {
+        return this.map ? this.map.toWorkosOrgId(orgId) : Promise.resolve(orgId);
+    }
+    async validateApiKey(token) {
+        try {
+            const { apiKey } = await this.workos.apiKeys.createValidation({ value: token });
+            if (!apiKey)
+                return null;
+            const workosOrgId = apiKey.owner.id;
+            const orgId = this.map ? await this.map.toOrgId(workosOrgId) : workosOrgId;
+            return orgId ? { orgId } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async getOrgDomains(orgId) {
+        const org = await this.workos.organizations.getOrganization(await this.wid(orgId));
+        // Only VERIFIED domains count — a pending/failed domain must not unlock the
+        // internal-org unmetered path (see auth.ts isInternalOrg).
+        return org.domains
+            .filter((d) => d.state === OrganizationDomainState.Verified)
+            .map((d) => d.domain);
+    }
+    async getBillingCustomerId(orgId) {
+        const org = await this.workos.organizations.getOrganization(await this.wid(orgId));
+        // Native field first (v10); fall back to the legacy metadata pointer so
+        // apps that stored it in metadata under v8 don't orphan their customer.
+        return (org.stripeCustomerId ||
+            org.metadata?.stripeCustomerId ||
+            null);
+    }
+    async setBillingCustomerId(orgId, customerId) {
+        await this.workos.organizations.updateOrganization({
+            organization: await this.wid(orgId),
+            stripeCustomerId: customerId,
+        });
+    }
+    async ensureOrgForUser(user) {
+        if (this.ensureOrg)
+            return this.ensureOrg(user);
+        const memberships = await this.workos.userManagement.listOrganizationMemberships({ userId: user.id });
+        if (memberships.data.length > 0)
+            return { orgId: memberships.data[0].organizationId };
+        const domain = user.email.split("@")[1];
+        const company = await lookupCompany(domain);
+        const org = await this.workos.organizations.createOrganization({
+            name: company?.name || domain,
+            domainData: [{ domain, state: DomainDataState.Verified }],
+            metadata: company?.logoUrl ? { logoUrl: company.logoUrl } : undefined,
+        });
+        await this.workos.userManagement.createOrganizationMembership({
+            organizationId: org.id,
+            userId: user.id,
+        });
+        return { orgId: org.id };
+    }
+    async mintApiKey(orgId, name, _createdBy) {
+        const key = await this.workos.apiKeys.createOrganizationApiKey({
+            organizationId: await this.wid(orgId),
+            name,
+        });
+        return { id: key.id, value: key.value };
+    }
+    async listApiKeys(orgId) {
+        const paginatable = await this.workos.apiKeys.listOrganizationApiKeys({
+            organizationId: await this.wid(orgId),
+        });
+        const keys = await paginatable.autoPagination();
+        return keys.map((k) => ({
+            id: k.id,
+            name: k.name,
+            obfuscatedValue: k.obfuscatedValue,
+        }));
+    }
+    /** Revoke by raw token value (RFC 7009): validate → key id → hard delete. */
+    async revokeApiKeyByToken(token) {
+        try {
+            const { apiKey } = await this.workos.apiKeys.createValidation({ value: token });
+            if (!apiKey)
+                return false;
+            await this.workos.apiKeys.deleteApiKey(apiKey.id);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Create an org with no user (auth.md anonymous). No verified domain, so it
+     *  never satisfies the internal-org unmetered check. Returns the WorkOS org id
+     *  as `orgId` (Pattern A). With a `map` configured there's no mirror row, so
+     *  prefer disabling anonymous for mirror apps (identityTypes without it). */
+    async createAnonymousOrg(opts) {
+        const org = await this.workos.organizations.createOrganization({
+            name: opts.name,
+            metadata: opts.metadata,
+        });
+        const orgId = this.map ? (await this.map.toOrgId(org.id)) ?? org.id : org.id;
+        return { orgId };
+    }
+    async revokeApiKey(orgId, id) {
+        // Full-list scope check (all pages) so a key on a later page isn't mistaken
+        // for "not found"; the SDK delete needs only the id.
+        const paginatable = await this.workos.apiKeys.listOrganizationApiKeys({
+            organizationId: await this.wid(orgId),
+        });
+        const keys = await paginatable.autoPagination();
+        const target = keys.find((k) => k.id === id);
+        if (!target)
+            return null;
+        await this.workos.apiKeys.deleteApiKey(id);
+        return { id: target.id, name: target.name };
+    }
+    // ── Subscription state + seats (org metadata; used by the billing-sync) ────
+    /** Active-member count for the org (per-seat token grants + seat limits).
+     *  Auto-paginates so orgs with >100 members aren't undercounted. */
+    async memberCount(orgId) {
+        const paginatable = await this.workos.userManagement.listOrganizationMemberships({
+            organizationId: await this.wid(orgId),
+            statuses: ["active"],
+        });
+        const members = await paginatable.autoPagination();
+        return members.length;
+    }
+    async getSubscription(orgId) {
+        const org = await this.workos.organizations.getOrganization(await this.wid(orgId));
+        const m = (org.metadata ?? {});
+        return {
+            plan: m.plan ?? null,
+            status: m.subscriptionStatus ?? null,
+            subscriptionId: m.stripeSubscriptionId ?? null,
+            periodEnd: m.subscriptionPeriodEnd ?? null,
+        };
+    }
+    /** Write subscription state onto the org metadata. `plan: undefined` leaves
+     *  the plan as-is; `null` clears it (back to the default plan). */
+    async setSubscription(orgId, sub) {
+        const wid = await this.wid(orgId);
+        const org = await this.workos.organizations.getOrganization(wid);
+        const metadata = { ...(org.metadata ?? {}) };
+        const set = (k, v) => {
+            if (v === undefined)
+                return;
+            if (v === null || v === "")
+                delete metadata[k];
+            else
+                metadata[k] = v;
+        };
+        set("subscriptionStatus", sub.status);
+        set("stripeSubscriptionId", sub.subscriptionId);
+        set("subscriptionPeriodEnd", sub.periodEnd);
+        set("plan", sub.plan);
+        await this.workos.organizations.updateOrganization({ organization: wid, metadata });
+    }
+}
+//# sourceMappingURL=workos-org.js.map

package/dist/adapters/workos-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos-org.js","sourceRoot":"","sources":["../../src/adapters/workos-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAe,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsCpD,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAU;IAChB,QAAQ,CAAU;IAClB,GAAG,CAAgB;IACnB,SAAS,CAAqD;IAEtE,YAAY,OAAgC,EAAE;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAY,MAAM;QAChB,OAAO,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,sEAAsE;IAC9D,GAAG,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,2DAA2D;QAC3D,OAAO,GAAG,CAAC,OAAO;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,CAAC,QAAQ,CAAC;aAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,wEAAwE;QACxE,wEAAwE;QACxE,OAAO,CACL,GAAG,CAAC,gBAAgB;YACnB,GAAG,CAAC,QAA+C,EAAE,gBAAgB;YACtE,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,UAAkB;QAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC;YACjD,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACnC,gBAAgB,EAAE,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAiB;QACtC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAEtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAC7D,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM;YAC7B,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC;YACzD,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;SACtE,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,4BAA4B,CAAC;YAC5D,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,UAAmB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC;YAC7D,cAAc,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACrC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC;YACpE,cAAc,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,eAAe;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;iFAG6E;IAC7E,KAAK,CAAC,kBAAkB,CAAC,IAAyD;QAChF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,EAAU;QAC1C,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC;YACpE,cAAc,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,8EAA8E;IAE9E;wEACoE;IACpE,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,2BAA2B,CAAC;YAC/E,cAAc,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACrC,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QAMjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA2B,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,MAAM,EAAE,CAAC,CAAC,kBAAkB,IAAI,IAAI;YACpC,cAAc,EAAE,CAAC,CAAC,oBAAoB,IAAI,IAAI;YAC9C,SAAS,EAAE,CAAC,CAAC,qBAAqB,IAAI,IAAI;SAC3C,CAAC;IACJ,CAAC;IAED;uEACmE;IACnE,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,GAKC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,QAAQ,GAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,QAAkC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAA4B,EAAE,EAAE;YACtD,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO;YAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;;gBAC1C,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAChD,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/agent-auth/claim-store.d.ts

@@ -0,0 +1,37 @@
+export type ClaimStatus = "pending" | "ready" | "error";
+export type ClaimReadResult = {
+    status: "not_found";
+} | {
+    status: "pending";
+    email: string;
+} | {
+    status: "ready";
+    email: string;
+    apiKey: string;
+    organizationId: string;
+} | {
+    status: "error";
+    email: string;
+    error: string;
+};
+/** Persistence for the claim ceremony. claim_token is hashed at rest by the
+ *  default store (SHA-256) per the auth.md spec; a custom store should do the
+ *  same and never persist the plaintext token. */
+export interface ClaimStore {
+    create(email: string): Promise<{
+        claimToken: string;
+        expiresIn: number;
+    }>;
+    get(claimToken: string): Promise<ClaimReadResult>;
+    markReady(claimToken: string, data: {
+        apiKey: string;
+        organizationId: string;
+    }): Promise<boolean>;
+    markError(claimToken: string, error: string): Promise<boolean>;
+    /** One-shot: return the entry and delete it once ready/error. */
+    consume(claimToken: string): Promise<ClaimReadResult>;
+}
+/** Default single-process claim store. sha256(claim_token) is the map key;
+ *  10-minute TTL; pruned every minute + lazily on read. */
+export declare function inMemoryClaimStore(ttlMs?: number): ClaimStore;
+//# sourceMappingURL=claim-store.d.ts.map

package/dist/agent-auth/claim-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-store.d.ts","sourceRoot":"","sources":["../../src/agent-auth/claim-store.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD;;kDAEkD;AAClD,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,iEAAiE;IACjE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACvD;AAWD;2DAC2D;AAC3D,wBAAgB,kBAAkB,CAAC,KAAK,SAAiB,GAAG,UAAU,CAqDrE"}

package/dist/agent-auth/claim-store.js

@@ -0,0 +1,64 @@
+import { createHash, randomBytes } from "node:crypto";
+/** Default single-process claim store. sha256(claim_token) is the map key;
+ *  10-minute TTL; pruned every minute + lazily on read. */
+export function inMemoryClaimStore(ttlMs = 10 * 60 * 1000) {
+    const claims = new Map();
+    const hash = (t) => createHash("sha256").update(t).digest("hex");
+    const prune = () => {
+        const now = Date.now();
+        for (const [k, v] of claims)
+            if (now > v.expiresAt)
+                claims.delete(k);
+    };
+    const g = globalThis;
+    if (typeof globalThis !== "undefined" && !g.__billing_claim_cleanup) {
+        g.__billing_claim_cleanup = setInterval(prune, 60 * 1000);
+        g.__billing_claim_cleanup.unref?.();
+    }
+    const read = (claimToken) => {
+        prune();
+        const e = claims.get(hash(claimToken));
+        if (!e)
+            return { status: "not_found" };
+        if (e.status === "pending")
+            return { status: "pending", email: e.email };
+        if (e.status === "error")
+            return { status: "error", email: e.email, error: e.error ?? "unknown" };
+        return { status: "ready", email: e.email, apiKey: e.apiKey, organizationId: e.organizationId };
+    };
+    return {
+        async create(email) {
+            prune();
+            const claimToken = `clm_${randomBytes(32).toString("base64url")}`;
+            claims.set(hash(claimToken), { email, status: "pending", expiresAt: Date.now() + ttlMs });
+            return { claimToken, expiresIn: Math.floor(ttlMs / 1000) };
+        },
+        async get(claimToken) {
+            return read(claimToken);
+        },
+        async markReady(claimToken, data) {
+            const e = claims.get(hash(claimToken));
+            if (!e)
+                return false;
+            e.status = "ready";
+            e.apiKey = data.apiKey;
+            e.organizationId = data.organizationId;
+            return true;
+        },
+        async markError(claimToken, error) {
+            const e = claims.get(hash(claimToken));
+            if (!e)
+                return false;
+            e.status = "error";
+            e.error = error;
+            return true;
+        },
+        async consume(claimToken) {
+            const result = read(claimToken);
+            if (result.status === "ready" || result.status === "error")
+                claims.delete(hash(claimToken));
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=claim-store.js.map

package/dist/agent-auth/claim-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-store.js","sourceRoot":"","sources":["../../src/agent-auth/claim-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA2CtD;2DAC2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;YAAE,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,UAAqC,CAAC;IAChD,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;QACpE,CAAC,CAAC,uBAAuB,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,uBAAkD,CAAC,KAAK,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAmB,EAAE;QACnD,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,cAAc,EAAE,CAAC,CAAC,cAAe,EAAE,CAAC;IACnG,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,KAAK,EAAE,CAAC;YACR,MAAM,UAAU,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,UAAU;YAClB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI;YAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK;YAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,UAAU;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}