@arnaudjnn/billing-tools 0.14.0

package/dist/tools/register.js

@@ -0,0 +1,87 @@
+import { resolveConfig } from "../types.js";
+import { registerKeyTools } from "./keys.js";
+import { registerBillingOnlyTools } from "./billing.js";
+import { ensurePlans } from "../plans.js";
+// Keys whose values must never hit the logs (magic-auth codes, API keys, etc.).
+const SENSITIVE_KEY_RE = /cookie|token|secret|password|passwd|authorization|api[_-]?key|session|credential|code/i;
+function redactForLog(value, depth = 0) {
+    if (value === null || typeof value !== "object") {
+        if (typeof value === "string" && value.length > 300) {
+            return `${value.slice(0, 300)}…(${value.length} chars)`;
+        }
+        return value;
+    }
+    if (depth > 4)
+        return "[…]";
+    if (Array.isArray(value))
+        return value.map((v) => redactForLog(v, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = SENSITIVE_KEY_RE.test(k) ? "[redacted]" : redactForLog(v, depth + 1);
+    }
+    return out;
+}
+// Wrap server.tool so every handler logs its (redacted) input. Call before
+// registering tools so both the live MCP server and the REST dispatch shadow
+// server emit uniform [tool-input] lines.
+export function installInputLogging(server) {
+    const orig = server.tool.bind(server);
+    server.tool = function (...args) {
+        const name = args[0];
+        const cbIdx = args.length - 1;
+        const cb = args[cbIdx];
+        if (typeof cb === "function" && typeof name === "string") {
+            args[cbIdx] = async (toolArgs, extra) => {
+                try {
+                    console.log(`[tool-input] ${name} ${JSON.stringify(redactForLog(toolArgs))}`);
+                }
+                catch {
+                    console.log(`[tool-input] ${name} (unserializable args)`);
+                }
+                return cb(toolArgs, extra);
+            };
+        }
+        return orig(...args);
+    };
+}
+// Register the billing-tools surface (auth/key management + token billing) on
+// an MCP server. Host apps call this, then register their own product tools.
+export function registerBillingTools(server, opts) {
+    const config = resolveConfig(opts.config);
+    if (opts.installLogging !== false)
+        installInputLogging(server);
+    registerKeyTools(server, opts.adapter, config);
+    registerBillingOnlyTools(server, opts.adapter, config, opts.toolCosts ?? {});
+    if (opts.plans)
+        registerPlanTools(server, opts.plans, opts.defaultPlan, config.currency);
+}
+// list_plans: returns the configured plans + live Stripe prices, provisioning
+// the Stripe products/prices on first call (idempotent). Zero dashboard setup.
+function registerPlanTools(server, plans, defaultPlan, currency) {
+    server.tool("list_plans", "List the available subscription plans (seats, included tokens, and monthly/yearly prices). Prices are provisioned in Stripe automatically.", {}, async () => {
+        const ensured = await ensurePlans(plans, { currency });
+        const priceOf = (plan, interval) => ensured.find((e) => e.plan === plan && e.interval === interval) ?? null;
+        const out = Object.entries(plans).map(([key, def]) => ({
+            plan: key,
+            default: key === defaultPlan,
+            seats: def.seats,
+            tokens_per_seat: def.tokensPerSeat,
+            prices: {
+                monthly: { amount: def.price.monthly, currency, price_id: priceOf(key, "monthly")?.priceId ?? null },
+                yearly: { amount: def.price.yearly, currency, price_id: priceOf(key, "yearly")?.priceId ?? null },
+            },
+        }));
+        return { content: [{ type: "text", text: JSON.stringify({ plans: out }, null, 2) }] };
+    });
+}
+export const BILLING_TOOL_NAMES = [
+    "get_api_key",
+    "list_api_keys",
+    "revoke_api_key",
+    "get_token_balance",
+    "buy_tokens",
+    "set_auto_reload",
+    "get_billing_portal",
+    "list_invoices",
+];
+//# sourceMappingURL=register.js.map

package/dist/tools/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/tools/register.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAoB,MAAM,aAAa,CAAC;AAE5D,gFAAgF;AAChF,MAAM,gBAAgB,GACpB,wFAAwF,CAAC;AAE3F,SAAS,YAAY,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC;QAC1D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,0CAA0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAiC,CAAC;IACrE,MAA4D,CAAC,IAAI,GAAG,UAAU,GAAG,IAAe;QAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,QAAiB,EAAE,KAAc,EAAE,EAAE;gBACxD,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,wBAAwB,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAQ,EAA0C,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtE,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAgBD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,IAAiC;IACvF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/D,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,KAAK;QAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3F,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,MAAiB,EACjB,KAAkB,EAClB,WAA+B,EAC/B,QAAgB;IAEhB,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,4IAA4I,EAC5I,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAA8B,EAAE,EAAE,CAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,GAAG,KAAK,WAAW;YAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,eAAe,EAAE,GAAG,CAAC,aAAa;YAClC,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE;gBACpG,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE;aAClG;SACF,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjG,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;CACP,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,90 @@
+export interface BillingUser {
+    id: string;
+    email: string;
+    firstName?: string | null;
+    lastName?: string | null;
+    profilePictureUrl?: string | null;
+}
+export interface ApiKeyInfo {
+    id: string;
+    name: string;
+    obfuscatedValue: string;
+}
+export interface BillingAdapter {
+    /** Resolve a raw Bearer API key → org, or null if invalid/revoked. */
+    validateApiKey(token: string): Promise<{
+        orgId: string;
+    } | null>;
+    /** Optional: resolve an OAuth bearer (JWT) → org id. Omit if no OAuth. */
+    resolveOauthOrg?(token: string): Promise<string | null>;
+    /** Verified domains for the org (used for the internal-org unmetered check). */
+    getOrgDomains(orgId: string): Promise<string[]>;
+    /** Read the Stripe customer id pointer for the org (null if none yet). */
+    getBillingCustomerId(orgId: string): Promise<string | null>;
+    /** Persist the Stripe customer id pointer for the org. */
+    setBillingCustomerId(orgId: string, customerId: string): Promise<void>;
+    /** After magic-auth: find or create the org/workspace for this user. */
+    ensureOrgForUser(user: BillingUser): Promise<{
+        orgId: string;
+    }>;
+    /** Mint a new API key for the org. `createdBy` (the acting user id) is
+     *  passed when available; adapters that don't track it may ignore it.
+     *  Returns the raw value (shown once). */
+    mintApiKey(orgId: string, name: string, createdBy?: string): Promise<{
+        id: string;
+        value: string;
+    }>;
+    /** List the org's (non-revoked) keys, obfuscated. */
+    listApiKeys(orgId: string): Promise<ApiKeyInfo[]>;
+    /** Revoke a key by id, scoped to the org (belongs-to check inside). */
+    revokeApiKey(orgId: string, id: string): Promise<{
+        id: string;
+        name: string;
+    } | null>;
+    /** Revoke an API key by its raw value — for the RFC 7009 /oauth/revoke
+     *  endpoint, where only the token (not the org/id) is known. Optional. */
+    revokeApiKeyByToken?(token: string): Promise<boolean>;
+    /** Create an org with NO associated user (auth.md `anonymous` registration).
+     *  Optional — if absent, anonymous registration reports `anonymous_not_enabled`. */
+    createAnonymousOrg?(opts: {
+        name: string;
+        metadata?: Record<string, string>;
+    }): Promise<{
+        orgId: string;
+    }>;
+}
+export interface BillingConfig {
+    /** Welcome credit granted on first Stripe customer creation. Default 100. */
+    freeTokens?: number;
+    /** Stripe currency, e.g. "usd" | "eur". Default "usd". */
+    currency?: string;
+    /** Base URL for Checkout success/cancel + billing-portal return. */
+    baseUrl: string;
+    /** Domains whose orgs are unmetered (internal). Default []. */
+    internalDomains?: string[];
+}
+export type ResolvedConfig = Required<BillingConfig>;
+export declare function resolveConfig(c: BillingConfig): ResolvedConfig;
+/** Build the `internalDomains` allowlist from the environment: an optional
+ *  deployment root domain (whatever your host exposes — pass it if you want the
+ *  deployment's own domain treated as internal) plus a comma-separated env var
+ *  (default `INTERNAL_ORG_DOMAINS`). Orgs with a verified WorkOS domain matching
+ *  any entry get unmetered access (see enforceTokens → isInternalOrg). Result is
+ *  lowercased + de-duplicated. Host-agnostic: the caller supplies the root
+ *  domain (or nothing); the env var is generic. */
+export declare function internalDomainsFromEnv(rootDomain?: string | null, envVar?: string): string[];
+export type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+export type ToolErrorResult = {
+    isError: true;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjE,0EAA0E;IAC1E,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,gFAAgF;IAChF,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,0EAA0E;IAC1E,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,0DAA0D;IAC1D,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,wEAAwE;IACxE,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE;;8CAE0C;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpG,qDAAqD;IACrD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,uEAAuE;IACvE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtF;8EAC0E;IAC1E,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;wFACoF;IACpF,kBAAkB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;AAErD,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,GAAG,cAAc,CAO9D;AAED;;;;;;mDAMmD;AACnD,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,SAAyB,GAC9B,MAAM,EAAE,CAOV;AAGD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC"}

package/dist/types.js

@@ -0,0 +1,28 @@
+// The storage seam. `orgId` is an opaque string — a WorkOS org id, a Postgres
+// workspace id ("ws_…"), whatever the host uses. Implement this and the rest of
+// billing-tools (auth flow, metering, all Stripe math, tool/route/CLI surfaces)
+// works unchanged.
+export function resolveConfig(c) {
+    return {
+        freeTokens: c.freeTokens ?? 100,
+        currency: c.currency ?? "usd",
+        baseUrl: c.baseUrl,
+        internalDomains: c.internalDomains ?? [],
+    };
+}
+/** Build the `internalDomains` allowlist from the environment: an optional
+ *  deployment root domain (whatever your host exposes — pass it if you want the
+ *  deployment's own domain treated as internal) plus a comma-separated env var
+ *  (default `INTERNAL_ORG_DOMAINS`). Orgs with a verified WorkOS domain matching
+ *  any entry get unmetered access (see enforceTokens → isInternalOrg). Result is
+ *  lowercased + de-duplicated. Host-agnostic: the caller supplies the root
+ *  domain (or nothing); the env var is generic. */
+export function internalDomainsFromEnv(rootDomain, envVar = "INTERNAL_ORG_DOMAINS") {
+    const extras = (process.env[envVar] ?? "")
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    const root = rootDomain?.trim().toLowerCase();
+    return Array.from(new Set([...(root ? [root] : []), ...extras]));
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,mBAAmB;AA0DnB,MAAM,UAAU,aAAa,CAAC,CAAgB;IAC5C,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,GAAG;QAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;QAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;mDAMmD;AACnD,MAAM,UAAU,sBAAsB,CACpC,UAA0B,EAC1B,MAAM,GAAG,sBAAsB;IAE/B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SACvC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/util/clearout.d.ts

@@ -0,0 +1,5 @@
+export declare function lookupCompany(domain: string): Promise<{
+    name: string;
+    logoUrl: string;
+} | null>;
+//# sourceMappingURL=clearout.d.ts.map

package/dist/util/clearout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearout.d.ts","sourceRoot":"","sources":["../../src/util/clearout.ts"],"names":[],"mappings":"AAEA,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAenD"}

package/dist/util/clearout.js

@@ -0,0 +1,18 @@
+// Best-effort company enrichment from a domain (name + logo), used by the
+// WorkOS-org adapter when creating an org. Never throws.
+export async function lookupCompany(domain) {
+    try {
+        const res = await fetch(`https://api.clearout.io/public/companies/autocomplete?query=${encodeURIComponent(domain)}`);
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const match = data.data?.find((c) => c.domain.toLowerCase() === domain.toLowerCase());
+        if (!match)
+            return null;
+        return { name: match.name, logoUrl: match.logo_url };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=clearout.js.map

package/dist/util/clearout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearout.js","sourceRoot":"","sources":["../../src/util/clearout.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+DAA+D,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC5F,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/workos.d.ts

@@ -0,0 +1,6 @@
+import { WorkOS } from "@workos-inc/node";
+export declare function getWorkOS(opts?: {
+    apiKey?: string;
+    clientId?: string;
+}): WorkOS;
+//# sourceMappingURL=workos.d.ts.map

package/dist/workos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../src/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAgB1C,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAS/E"}

package/dist/workos.js

@@ -0,0 +1,24 @@
+import { WorkOS } from "@workos-inc/node";
+// The ONE WorkOS client bootstrap for the whole lib. Every module (adapter,
+// invitations, magic-auth, events) goes through here so there's a single
+// lifecycle + one place that reads the env.
+//
+// Lazy + memoized: constructing WorkOS eagerly throws when WORKOS_API_KEY is
+// unset, which must never break app boot (adapters/services are built at module
+// load) — so the client is created on first actual use (the v0.4.1 rule).
+//
+// The env-based client is a shared singleton. Explicit per-instance credentials
+// (rare — an app running >1 WorkOS env in one process) get their own client so
+// they never collide with the shared one.
+let _default = null;
+export function getWorkOS(opts) {
+    if (opts?.apiKey || opts?.clientId) {
+        return new WorkOS(opts.apiKey ?? process.env.WORKOS_API_KEY, {
+            clientId: opts.clientId ?? process.env.WORKOS_CLIENT_ID ?? "",
+        });
+    }
+    return (_default ??= new WorkOS(process.env.WORKOS_API_KEY, {
+        clientId: process.env.WORKOS_CLIENT_ID ?? "",
+    }));
+}
+//# sourceMappingURL=workos.js.map

package/dist/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../src/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,4EAA4E;AAC5E,yEAAyE;AACzE,4CAA4C;AAC5C,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,0CAA0C;AAE1C,IAAI,QAAQ,GAAkB,IAAI,CAAC;AAEnC,MAAM,UAAU,SAAS,CAAC,IAA6C;IACrE,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;YAC3D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,QAAQ,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;KAC7C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "@arnaudjnn/billing-tools",
+  "version": "0.14.0",
+  "description": "The get-paid engine for Stripe + WorkOS apps, for humans and AI agents. Drop-in API-key auth, token/credit + subscription billing, auth.md agent registration, and MPP machine payments, as MCP tools, a REST API, and a CLI. Framework-agnostic, storage-pluggable.",
+  "license": "MIT",
+  "author": "Arnaud Jeannin",
+  "homepage": "https://github.com/arnaudjnn/billing-tools#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/arnaudjnn/billing-tools.git"
+  },
+  "bugs": {
+    "url": "https://github.com/arnaudjnn/billing-tools/issues"
+  },
+  "keywords": [
+    "stripe",
+    "workos",
+    "billing",
+    "payments",
+    "auth",
+    "api-keys",
+    "mcp",
+    "auth.md",
+    "mpp",
+    "ai-agents",
+    "agentic-commerce",
+    "subscriptions",
+    "saas",
+    "usage-based-billing"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./adapters/workos-org": {
+      "types": "./dist/adapters/workos-org.d.ts",
+      "import": "./dist/adapters/workos-org.js",
+      "default": "./dist/adapters/workos-org.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@workos-inc/node": "^10.7.0",
+    "commander": "^13.1.0",
+    "stripe": "^20.3.1"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": ">=1.25.0",
+    "mcp-handler": ">=1.1.0",
+    "zod": "^3.25.0"
+  },
+  "peerDependenciesMeta": {
+    "mcp-handler": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "1.25.2",
+    "@types/node": "^20",
+    "mcp-handler": "^1.1.0",
+    "typescript": "^5",
+    "zod": "^3.25.76"
+  },
+  "main": "./dist/index.js"
+}