@carrierllc/mcp 0.2.1 → 0.2.2

package/dist/clerk.d.ts

@@ -1,125 +0,0 @@
-/**
- * Clerk integration for the Carrier MCP Worker.
- *
- * Human identity is delegated to Clerk (sign-in, sign-up, MFA, social).
- * MCP-client tokens are still minted by @cloudflare/workers-oauth-provider —
- * the Clerk session only gates the OAuth `/authorize` consent step.
- *
- * v1.1a: org_id / org_role / org_name from the "carrier-mcp" JWT template
- *        are read from sessionClaims. Email + publicMetadata still come from
- *        users.getUser() until the template carries email.
- * v1.1c: reads Clerk Billing plan + features from session claims via auth.has()
- *        so tier checks don't require a round-trip when Clerk Billing is enabled.
- * v1.1f: surfaces twoFactorVerified + factorVerificationAge for the MFA gate
- *        on admin-scope OAuth grants (see mfa.ts).
- * v1.2:  M2M JWT acceptance — Authorization: Bearer <clerk_m2m_jwt> issued via
- *        Clerk client_credentials flow. Subject is a machine ID (mch_ prefix).
- *        Custom claims (reseller_id, reseller_name, tier, scopes) are read from
- *        the M2M client's privateMetadata-backed JWT claims.
- */
-import { type ClerkClient } from "@clerk/backend";
-import type { ClerkPublicMetadata, OcsPortalCredentials, Env } from "./types.js";
-export declare function getClerkClient(env: Env): ClerkClient;
-export type ClerkPlan = "free" | "pro" | "enterprise";
-export interface ClerkAuthResult {
-    /** Clerk user ID (e.g. "user_2pXkL9aB..."). Prefix with "clerk_" for our `sub`. */
-    userId: string;
-    email: string;
-    publicMetadata: ClerkPublicMetadata;
-    /** v1.1a — Active Clerk organisation ID from sessionClaims (carrier-mcp JWT template). */
-    orgId?: string;
-    /** v1.1a — Active Clerk organisation role, e.g. "org:admin". */
-    orgRole?: string;
-    /** v1.1a — Active Clerk organisation display name (org_name claim). */
-    orgName?: string;
-    /**
-     * v1.1c Clerk Billing — active subscription plan resolved via auth.has({ plan }).
-     * `undefined` when Clerk Billing is not enabled or the user has no plan claim.
-     */
-    plan?: ClerkPlan;
-    /**
-     * v1.1c Clerk Billing — feature entitlements resolved via auth.has({ feature }).
-     * Populated when CLERK_BILLING_FEATURES env lists features to probe.
-     */
-    features: Record<string, boolean>;
-    /**
-     * v1.1f MFA gate — true if the session JWT carries two-factor verification.
-     * Computed from auth.sessionClaims.two_factor || factor_verification_age.
-     */
-    twoFactorVerified: boolean;
-    /**
-     * v1.1f MFA gate — seconds since the user last completed a 2FA challenge,
-     * or `undefined` when the session predates the JWT template's second_factor_age claim.
-     */
-    factorVerificationAge?: number;
-    /**
-     * v1.2 — How this auth result was produced.
-     * "session"  → Clerk session cookie / session token (existing path).
-     * "m2m"      → Clerk M2M JWT (Authorization: Bearer <mch_ subject JWT>).
-     * Downstream code (audit log, tools-call) uses this to tag machine vs human traffic.
-     */
-    auth_method: "session" | "m2m";
-}
-/**
- * v1.2 — Validate a Clerk M2M JWT from `Authorization: Bearer <jwt>`.
- *
- * Uses `acceptsToken: 'm2m_token'` so the Clerk SDK handles JWKS fetch,
- * signature verification, and `iss` / expiry checks natively.
- *
- * Custom claims (reseller_id, reseller_name, tier, scopes) must be
- * configured in the Clerk Dashboard → M2M client → JWT template or
- * privateMetadata-backed claims.
- *
- * Returns null when:
- *   - No Authorization: Bearer header present
- *   - The JWT is not a valid M2M token (wrong iss, bad sig, expired)
- *   - The subject does not start with the M2M prefix (mch_)
- */
-export declare function authenticateM2MRequest(request: Request, env: Env): Promise<ClerkAuthResult | null>;
-/**
- * Validate the incoming request against Clerk.
- * Returns null when the request is unauthenticated.
- *
- * v1.2: When `Authorization: Bearer <jwt>` is present, tries M2M acceptance
- * first. If the JWT is a valid Clerk M2M token (subject starts with mch_),
- * returns immediately without a users.getUser() round-trip.
- * Falls through to session-cookie path only when M2M validation yields null.
- *
- * Calls users.getUser() once for email and publicMetadata (reseller_id, tier,
- * scopes, role). org_id / org_role / org_name are read from sessionClaims when
- * the JWT template includes them.
- */
-export declare function authenticateClerkRequest(request: Request, env: Env): Promise<ClerkAuthResult | null>;
-/**
- * Build the Clerk-hosted sign-in URL with a redirect back to the current request.
- */
-export declare function buildSignInRedirect(env: Env, requestUrl: string): string;
-export declare function buildSignUpRedirect(env: Env, requestUrl: string): string;
-/**
- * Fetch OCS portal credentials from Clerk privateMetadata.
- * Uses the Clerk REST API directly (no SDK method for privateMetadata on CF Workers).
- */
-export declare function getOcsPortalCredentials(env: Env, orgId?: string, userId?: string): Promise<OcsPortalCredentials | null>;
-export interface CreateOrgOptions {
-    name: string;
-    slug: string;
-    email: string;
-}
-/**
- * Provision a Clerk organisation for a Stripe Projects operator install.
- * If an org with the given slug already exists, returns the existing org ID.
- * Creates a membership for the provided email address (creates the user if absent).
- */
-export declare function createClerkOrgForOperator(env: Env, opts: CreateOrgOptions): Promise<string>;
-/**
- * Mint a Carrier OAuth bearer token for a Stripe Projects operator.
- * Token is bound to the org, has read+write scope, and 30-day TTL.
- * Stored in OAUTH_KV so it's validated by OAuthProvider on subsequent requests.
- */
-export declare function mintProjectsToken(env: Env, orgId: string): Promise<string>;
-/**
- * Store OCS portal credentials in Clerk org (or user) privateMetadata.
- * Called from the /setup endpoint or the console settings page.
- */
-export declare function setOcsPortalCredentials(env: Env, credentials: OcsPortalCredentials, orgId?: string, userId?: string): Promise<boolean>;
-//# sourceMappingURL=clerk.d.ts.map

package/dist/clerk.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../src/clerk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAkB,mBAAmB,EAA0B,oBAAoB,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAOzH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAWpD;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,mBAAmB,CAAC;IACpC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,SAAS,GAAG,KAAK,CAAC;CAChC;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA0EjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAyEjC;AAqCD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAMxE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAMxE;AAeD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAsCtC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAMD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,oBAAoB,EACjC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CA0BlB"}

package/dist/clerk.js

@@ -1,389 +0,0 @@
-/**
- * Clerk integration for the Carrier MCP Worker.
- *
- * Human identity is delegated to Clerk (sign-in, sign-up, MFA, social).
- * MCP-client tokens are still minted by @cloudflare/workers-oauth-provider —
- * the Clerk session only gates the OAuth `/authorize` consent step.
- *
- * v1.1a: org_id / org_role / org_name from the "carrier-mcp" JWT template
- *        are read from sessionClaims. Email + publicMetadata still come from
- *        users.getUser() until the template carries email.
- * v1.1c: reads Clerk Billing plan + features from session claims via auth.has()
- *        so tier checks don't require a round-trip when Clerk Billing is enabled.
- * v1.1f: surfaces twoFactorVerified + factorVerificationAge for the MFA gate
- *        on admin-scope OAuth grants (see mfa.ts).
- * v1.2:  M2M JWT acceptance — Authorization: Bearer <clerk_m2m_jwt> issued via
- *        Clerk client_credentials flow. Subject is a machine ID (mch_ prefix).
- *        Custom claims (reseller_id, reseller_name, tier, scopes) are read from
- *        the M2M client's privateMetadata-backed JWT claims.
- */
-import { createClerkClient } from "@clerk/backend";
-/** Prefix Clerk uses for M2M machine subject IDs. */
-const M2M_SUBJECT_PREFIX = "mch_";
-let cached = null;
-export function getClerkClient(env) {
-    if (!cached) {
-        cached = createClerkClient({
-            secretKey: env.CLERK_SECRET_KEY,
-            publishableKey: env.CLERK_PUBLISHABLE_KEY,
-            ...(env.CLERK_MACHINE_SECRET_KEY
-                ? { machineSecretKey: env.CLERK_MACHINE_SECRET_KEY }
-                : {}),
-        });
-    }
-    return cached;
-}
-/** Clerk Billing plans we probe via auth.has({ plan }). Order matches tier hierarchy. */
-const CLERK_PLANS = ["enterprise", "pro", "free"];
-/**
- * v1.2 — Validate a Clerk M2M JWT from `Authorization: Bearer <jwt>`.
- *
- * Uses `acceptsToken: 'm2m_token'` so the Clerk SDK handles JWKS fetch,
- * signature verification, and `iss` / expiry checks natively.
- *
- * Custom claims (reseller_id, reseller_name, tier, scopes) must be
- * configured in the Clerk Dashboard → M2M client → JWT template or
- * privateMetadata-backed claims.
- *
- * Returns null when:
- *   - No Authorization: Bearer header present
- *   - The JWT is not a valid M2M token (wrong iss, bad sig, expired)
- *   - The subject does not start with the M2M prefix (mch_)
- */
-export async function authenticateM2MRequest(request, env) {
-    const authHeader = request.headers.get("Authorization");
-    if (!authHeader || !/^Bearer\s+/i.test(authHeader))
-        return null;
-    const token = authHeader.replace(/^Bearer\s+/i, "").trim();
-    if (!token)
-        return null;
-    const client = getClerkClient(env);
-    const origin = new URL(request.url).origin;
-    let requestState;
-    try {
-        requestState = await client.authenticateRequest(request, {
-            acceptsToken: "m2m_token",
-            authorizedParties: [origin, "https://accounts.carrier.llc"],
-        });
-    }
-    catch {
-        return null;
-    }
-    if (requestState.status !== "signed-in")
-        return null;
-    const auth = requestState.toAuth();
-    // M2M auth object carries `subject` (the machine ID) and `claims`.
-    if (!auth ||
-        typeof auth.subject !== "string" ||
-        !auth.subject.startsWith(M2M_SUBJECT_PREFIX)) {
-        return null;
-    }
-    // Claims are set in the Clerk M2M client's JWT template / privateMetadata.
-    const claims = (auth.claims ?? {});
-    const resellerId = typeof claims.reseller_id === "number" ? claims.reseller_id : undefined;
-    const resellerName = typeof claims.reseller_name === "string" ? claims.reseller_name : "";
-    const tier = claims.tier === "free" ||
-        claims.tier === "pro" ||
-        claims.tier === "enterprise"
-        ? claims.tier
-        : undefined;
-    const scopes = Array.isArray(claims.scopes)
-        ? claims.scopes
-        : undefined;
-    return {
-        // Use the machine subject as the userId so downstream code (sub = `clerk_${userId}`)
-        // produces a stable, unique identity for audit logging.
-        userId: auth.subject,
-        email: "",
-        publicMetadata: {
-            reseller_id: resellerId,
-            reseller_name: resellerName || undefined,
-            tier,
-            scopes,
-            role: "user",
-        },
-        orgId: typeof claims.org_id === "string" ? claims.org_id : undefined,
-        orgRole: typeof claims.org_role === "string" ? claims.org_role : undefined,
-        orgName: typeof claims.org_name === "string" ? claims.org_name : undefined,
-        plan: tier,
-        features: {},
-        twoFactorVerified: false,
-        factorVerificationAge: undefined,
-        auth_method: "m2m",
-    };
-}
-/**
- * Validate the incoming request against Clerk.
- * Returns null when the request is unauthenticated.
- *
- * v1.2: When `Authorization: Bearer <jwt>` is present, tries M2M acceptance
- * first. If the JWT is a valid Clerk M2M token (subject starts with mch_),
- * returns immediately without a users.getUser() round-trip.
- * Falls through to session-cookie path only when M2M validation yields null.
- *
- * Calls users.getUser() once for email and publicMetadata (reseller_id, tier,
- * scopes, role). org_id / org_role / org_name are read from sessionClaims when
- * the JWT template includes them.
- */
-export async function authenticateClerkRequest(request, env) {
-    // v1.2 — M2M fast-path: try before session cookie so machine clients that
-    // send a valid Bearer JWT never hit the session-token branch.
-    const authHeader = request.headers.get("Authorization");
-    const hasBearer = authHeader !== null && /^Bearer\s+/i.test(authHeader);
-    if (hasBearer) {
-        const m2mResult = await authenticateM2MRequest(request, env);
-        if (m2mResult !== null)
-            return m2mResult;
-        // Bearer present but NOT a Clerk M2M JWT — fall through so the
-        // OAuthProvider's regular bearer handler (OAUTH_KV tokens) stays intact.
-        // The session-cookie branch below will also return null for a Bearer-only
-        // request, which is the correct behaviour.
-    }
-    const client = getClerkClient(env);
-    const origin = new URL(request.url).origin;
-    const requestState = await client.authenticateRequest(request, {
-        acceptsToken: "session_token",
-        authorizedParties: [origin, "https://accounts.carrier.llc"],
-    });
-    if (requestState.status !== "signed-in")
-        return null;
-    const auth = requestState.toAuth();
-    if (!auth || !("userId" in auth) || !auth.userId)
-        return null;
-    const claims = (auth.sessionClaims ?? {});
-    const user = await client.users.getUser(auth.userId);
-    const email = user.emailAddresses.find((e) => e.id === user.primaryEmailAddressId)
-        ?.emailAddress ??
-        user.emailAddresses[0]?.emailAddress ??
-        "";
-    const publicMetadata = (user.publicMetadata ?? {});
-    // v1.1c Clerk Billing — probe plan + features via the session's has() helper.
-    const plan = resolvePlan(auth);
-    const features = resolveFeatures(auth, env);
-    // v1.1f MFA — extract second-factor verification state from session claims.
-    const twoFactorVerified = Boolean(claims.two_factor_verified ??
-        claims.second_factor_verified ??
-        (typeof claims.fva === "object" &&
-            claims.fva !== null &&
-            Array.isArray(claims.fva) &&
-            claims.fva[1] !== -1));
-    const factorVerificationAge = typeof claims.second_factor_age === "number"
-        ? claims.second_factor_age
-        : Array.isArray(claims.fva) &&
-            typeof claims.fva[1] === "number" &&
-            (claims.fva[1] ?? -1) >= 0
-            ? // Clerk's `fva` tuple is ages in minutes; MFA compares seconds (mfa.ts).
-                claims.fva[1] * 60
-            : undefined;
-    return {
-        userId: auth.userId,
-        email,
-        publicMetadata,
-        orgId: claims.org_id ?? auth.orgId ?? undefined,
-        orgRole: claims.org_role ?? auth.orgRole ?? undefined,
-        orgName: claims.org_name,
-        plan,
-        features,
-        twoFactorVerified,
-        factorVerificationAge,
-        auth_method: "session",
-    };
-}
-function resolvePlan(auth) {
-    if (typeof auth.has !== "function")
-        return undefined;
-    for (const plan of CLERK_PLANS) {
-        try {
-            if (auth.has({ plan }))
-                return plan;
-        }
-        catch {
-            // has() may throw for an unconfigured plan — try the next tier
-            continue;
-        }
-    }
-    return undefined;
-}
-function resolveFeatures(auth, env) {
-    const list = (env.CLERK_BILLING_FEATURES ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter(Boolean);
-    const out = {};
-    if (typeof auth.has !== "function")
-        return out;
-    for (const feature of list) {
-        try {
-            out[feature] = auth.has({ feature });
-        }
-        catch {
-            out[feature] = false;
-        }
-    }
-    return out;
-}
-/**
- * Build the Clerk-hosted sign-in URL with a redirect back to the current request.
- */
-export function buildSignInRedirect(env, requestUrl) {
-    const signInBase = env.CLERK_SIGN_IN_URL ?? "https://accounts.carrier.llc/sign-in";
-    const url = new URL(signInBase);
-    url.searchParams.set("redirect_url", requestUrl);
-    return url.toString();
-}
-export function buildSignUpRedirect(env, requestUrl) {
-    const signUpBase = env.CLERK_SIGN_UP_URL ?? "https://accounts.carrier.llc/sign-up";
-    const url = new URL(signUpBase);
-    url.searchParams.set("redirect_url", requestUrl);
-    return url.toString();
-}
-// ---------------------------------------------------------------------------
-// v1.1.1 — OCS portal credentials from Clerk privateMetadata.
-// Used by tools-ui-agent.ts to authenticate the Manus browser agent against
-// the OCS web dashboard for UI-only operations.
-//
-// Resolution order:
-//   1. Organization privateMetadata (org_id present)
-//   2. User privateMetadata (solo user, no org)
-//
-// Returns null when no credentials are stored — the UI agent tool surfaces
-// a clear "link your OCS portal" message to the user.
-// ---------------------------------------------------------------------------
-/**
- * Fetch OCS portal credentials from Clerk privateMetadata.
- * Uses the Clerk REST API directly (no SDK method for privateMetadata on CF Workers).
- */
-export async function getOcsPortalCredentials(env, orgId, userId) {
-    const baseUrl = "https://api.clerk.com/v1";
-    const headers = {
-        Authorization: `Bearer ${env.CLERK_SECRET_KEY}`,
-        "Content-Type": "application/json",
-    };
-    // Try org-level first
-    if (orgId) {
-        try {
-            const res = await fetch(`${baseUrl}/organizations/${orgId}`, { headers });
-            if (res.ok) {
-                const org = (await res.json());
-                if (org.private_metadata?.ocs_portal?.username && org.private_metadata.ocs_portal.password) {
-                    return org.private_metadata.ocs_portal;
-                }
-            }
-        }
-        catch {
-            // Fall through to user-level
-        }
-    }
-    // Fallback: user-level privateMetadata
-    if (userId) {
-        try {
-            const res = await fetch(`${baseUrl}/users/${userId}`, { headers });
-            if (res.ok) {
-                const user = (await res.json());
-                if (user.private_metadata?.ocs_portal?.username && user.private_metadata.ocs_portal.password) {
-                    return user.private_metadata.ocs_portal;
-                }
-            }
-        }
-        catch {
-            // No credentials available
-        }
-    }
-    return null;
-}
-/**
- * Provision a Clerk organisation for a Stripe Projects operator install.
- * If an org with the given slug already exists, returns the existing org ID.
- * Creates a membership for the provided email address (creates the user if absent).
- */
-export async function createClerkOrgForOperator(env, opts) {
-    const baseUrl = "https://api.clerk.com/v1";
-    const headers = {
-        Authorization: `Bearer ${env.CLERK_SECRET_KEY}`,
-        "Content-Type": "application/json",
-    };
-    // Check if org slug already exists
-    const listRes = await fetch(`${baseUrl}/organizations?query=${encodeURIComponent(opts.slug)}&limit=1`, { headers });
-    if (listRes.ok) {
-        const list = (await listRes.json());
-        const existing = list.data?.find((o) => o.slug === opts.slug);
-        if (existing)
-            return existing.id;
-    }
-    // Create new org
-    const createRes = await fetch(`${baseUrl}/organizations`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-            name: opts.name,
-            slug: opts.slug,
-            public_metadata: { source: "stripe_projects", email: opts.email },
-        }),
-    });
-    if (!createRes.ok) {
-        const errText = await createRes.text();
-        throw new Error(`Failed to create Clerk org: ${errText}`);
-    }
-    const org = (await createRes.json());
-    return org.id;
-}
-// ---------------------------------------------------------------------------
-// OAuth token minting for Stripe Projects
-// ---------------------------------------------------------------------------
-/**
- * Mint a Carrier OAuth bearer token for a Stripe Projects operator.
- * Token is bound to the org, has read+write scope, and 30-day TTL.
- * Stored in OAUTH_KV so it's validated by OAuthProvider on subsequent requests.
- */
-export async function mintProjectsToken(env, orgId) {
-    // Generate a cryptographically random bearer token
-    const tokenBytes = crypto.getRandomValues(new Uint8Array(32));
-    const token = Array.from(tokenBytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-    const ttl = 30 * 24 * 60 * 60; // 30 days in seconds
-    const expiresAt = Date.now() + ttl * 1000;
-    const record = {
-        sub: `clerk_org_${orgId}`,
-        org_id: orgId,
-        scopes: ["read", "write"],
-        issued_at: new Date().toISOString(),
-        expires_at: new Date(expiresAt).toISOString(),
-        source: "stripe_projects",
-    };
-    // Store under OAUTH_KV so the OAuthProvider validates it as a bearer token.
-    // Key matches the pattern used by @cloudflare/workers-oauth-provider for bearer lookup.
-    await env.OAUTH_KV.put(`token:${token}`, JSON.stringify(record), { expirationTtl: ttl });
-    return token;
-}
-/**
- * Store OCS portal credentials in Clerk org (or user) privateMetadata.
- * Called from the /setup endpoint or the console settings page.
- */
-export async function setOcsPortalCredentials(env, credentials, orgId, userId) {
-    const baseUrl = "https://api.clerk.com/v1";
-    const headers = {
-        Authorization: `Bearer ${env.CLERK_SECRET_KEY}`,
-        "Content-Type": "application/json",
-    };
-    const body = JSON.stringify({
-        private_metadata: { ocs_portal: credentials },
-    });
-    // Prefer org-level storage
-    const entityType = orgId ? "organizations" : "users";
-    const entityId = orgId ?? userId;
-    if (!entityId)
-        return false;
-    try {
-        const res = await fetch(`${baseUrl}/${entityType}/${entityId}/metadata`, {
-            method: "PATCH",
-            headers,
-            body,
-        });
-        return res.ok;
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=clerk.js.map

package/dist/clerk.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../src/clerk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,iBAAiB,EAAoB,MAAM,gBAAgB,CAAC;AAGrE,qDAAqD;AACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,IAAI,MAAM,GAAuB,IAAI,CAAC;AAEtC,MAAM,UAAU,cAAc,CAAC,GAAQ;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,iBAAiB,CAAC;YACzB,SAAS,EAAE,GAAG,CAAC,gBAAgB;YAC/B,cAAc,EAAE,GAAG,CAAC,qBAAqB;YACzC,GAAG,CAAC,GAAG,CAAC,wBAAwB;gBAC9B,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA4CD,yFAAyF;AACzF,MAAM,WAAW,GAAgB,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,GAAQ;IAER,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAE3C,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE;YACvD,YAAY,EAAE,WAA8B;YAC5C,iBAAiB,EAAE,CAAC,MAAM,EAAE,8BAA8B,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAK,YAAmC,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAM7E,MAAM,IAAI,GAAI,YAAiD,CAAC,MAAM,EAAE,CAAC;IACzE,mEAAmE;IACnE,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA6C,CAAC;IAE/E,MAAM,UAAU,GACd,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,MAAM;QACtB,MAAM,CAAC,IAAI,KAAK,KAAK;QACrB,MAAM,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QACzC,CAAC,CAAE,MAAM,CAAC,MAA4C;QACtD,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,KAAK,EAAE,EAAE;QACT,cAAc,EAAE;YACd,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY,IAAI,SAAS;YACxC,IAAI;YACJ,MAAM;YACN,IAAI,EAAE,MAAM;SACb;QACD,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACpE,OAAO,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC1E,OAAO,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC1E,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,EAAE;QACZ,iBAAiB,EAAE,KAAK;QACxB,qBAAqB,EAAE,SAAS;QAChC,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAQ;IAER,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACzC,+DAA+D;QAC/D,yEAAyE;QACzE,0EAA0E;QAC1E,2CAA2C;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAE3C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE;QAC7D,YAAY,EAAE,eAAe;QAC7B,iBAAiB,EAAE,CAAC,MAAM,EAAE,8BAA8B,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CACf,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CAAC;QAClE,EAAE,YAAY;QAChB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY;QACpC,EAAE,CAAC;IACL,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAwB,CAAC;IAE1E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE5C,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,OAAO,CAC/B,MAAM,CAAC,mBAAmB;QACxB,MAAM,CAAC,sBAAsB;QAC7B,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC7B,MAAM,CAAC,GAAG,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM,CAAC,GAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,qBAAqB,GACzB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC1C,CAAC,CAAE,MAAM,CAAC,iBAA4B;QACtC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;YACvB,OAAQ,MAAM,CAAC,GAAiB,CAAC,CAAC,CAAC,KAAK,QAAQ;YAChD,CAAE,MAAM,CAAC,GAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,yEAAyE;gBACvE,MAAM,CAAC,GAAgB,CAAC,CAAC,CAAY,GAAG,EAAE;YAC9C,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK;QACL,cAAc;QACd,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,SAAS;QAC/C,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS;QACrD,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,IAAI;QACJ,QAAQ;QACR,iBAAiB;QACjB,qBAAqB;QACrB,WAAW,EAAE,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAEpB;IACC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,IAAsD,EACtD,GAAQ;IAER,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAQ,EAAE,UAAkB;IAC9D,MAAM,UAAU,GACd,GAAG,CAAC,iBAAiB,IAAI,sCAAsC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ,EAAE,UAAkB;IAC9D,MAAM,UAAU,GACd,GAAG,CAAC,iBAAiB,IAAI,sCAAsC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,8DAA8D;AAC9D,4EAA4E;AAC5E,gDAAgD;AAChD,EAAE;AACF,oBAAoB;AACpB,qDAAqD;AACrD,gDAAgD;AAChD,EAAE;AACF,2EAA2E;AAC3E,sDAAsD;AACtD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,KAAc,EACd,MAAe;IAEf,MAAM,OAAO,GAAG,0BAA0B,CAAC;IAC3C,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,GAAG,CAAC,gBAAgB,EAAE;QAC/C,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,sBAAsB;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kBAAkB,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;gBAChF,IAAI,GAAG,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,IAAI,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC3F,OAAO,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;gBACjF,IAAI,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC7F,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAQ,EACR,IAAsB;IAEtB,MAAM,OAAO,GAAG,0BAA0B,CAAC;IAC3C,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,GAAG,CAAC,gBAAgB,EAAE;QAC/C,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,mCAAmC;IACnC,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,GAAG,OAAO,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EACzE,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEjC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,iBAAiB;IACjB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,gBAAgB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,eAAe,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAClE,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,KAAa;IAEb,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,qBAAqB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,aAAa,KAAK,EAAE;QACzB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC7C,MAAM,EAAE,iBAAiB;KAC1B,CAAC;IAEF,4EAA4E;IAC5E,wFAAwF;IACxF,MAAO,GAAuC,CAAC,QAAQ,CAAC,GAAG,CACzD,SAAS,KAAK,EAAE,EAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,WAAiC,EACjC,KAAc,EACd,MAAe;IAEf,MAAM,OAAO,GAAG,0BAA0B,CAAC;IAC3C,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,GAAG,CAAC,gBAAgB,EAAE;QAC/C,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;KAC9C,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,IAAI,MAAM,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,IAAI,UAAU,IAAI,QAAQ,WAAW,EAAE;YACvE,MAAM,EAAE,OAAO;YACf,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/client.d.ts

@@ -1,35 +0,0 @@
-/**
- * eSIMVault OCS API client.
- * All requests are POST to /v1?token=<api_key> with JSON body { methodName: <params> }.
- * Responses: { status: { code, msg }, methodName: { ...data } }.
- *
- * params may be a plain object OR a bare scalar (number/string) for OCS methods that
- * expect a primitive as the request value rather than a nested object (e.g. listSponsor,
- * listSteeringList, getCustomerTariff, listDetailedLocationZone, getSimProviderStatus).
- */
-export interface OcsStatus {
-    code: number;
-    msg: string;
-}
-export interface OcsResponse<T = Record<string, unknown>> {
-    status: OcsStatus;
-    [method: string]: T | OcsStatus;
-}
-export declare class OcsApiError extends Error {
-    readonly code: number;
-    readonly method: string;
-    constructor(code: number, message: string, method: string);
-}
-export declare class OcsClient {
-    private readonly baseUrl;
-    private readonly token;
-    constructor(baseUrl: string, token: string);
-    call<T = Record<string, unknown>>(method: string, params?: Record<string, unknown> | number | string): Promise<T>;
-}
-export declare function getClient(): OcsClient;
-/**
- * Fetch the token owner's reseller ID via getResellerInfo.
- * Used as a fallback when bare-integer methods are called without an explicit resellerId.
- */
-export declare function getDefaultResellerId(): Promise<number>;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,EAAE,SAAS,CAAC;IAClB,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CACjC;AAED,qBAAa,WAAY,SAAQ,KAAK;aAElB,IAAI,EAAE,MAAM;aAEZ,MAAM,EAAE,MAAM;gBAFd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAKjC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAKpC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,MAAW,GACrD,OAAO,CAAC,CAAC,CAAC;CAuCd;AAID,wBAAgB,SAAS,IAAI,SAAS,CAarC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO5D"}

package/dist/client.js

@@ -1,85 +0,0 @@
-/**
- * eSIMVault OCS API client.
- * All requests are POST to /v1?token=<api_key> with JSON body { methodName: <params> }.
- * Responses: { status: { code, msg }, methodName: { ...data } }.
- *
- * params may be a plain object OR a bare scalar (number/string) for OCS methods that
- * expect a primitive as the request value rather than a nested object (e.g. listSponsor,
- * listSteeringList, getCustomerTariff, listDetailedLocationZone, getSimProviderStatus).
- */
-export class OcsApiError extends Error {
-    code;
-    method;
-    constructor(code, message, method) {
-        super(`[${method}] OCS error ${code}: ${message}`);
-        this.code = code;
-        this.method = method;
-        this.name = "OcsApiError";
-    }
-}
-export class OcsClient {
-    baseUrl;
-    token;
-    constructor(baseUrl, token) {
-        this.baseUrl = baseUrl.replace(/\/+$/, "");
-        this.token = token;
-    }
-    async call(method, params = {}) {
-        const url = `${this.baseUrl}/v1?token=${this.token}`;
-        const body = JSON.stringify({ [method]: params });
-        const res = await fetch(url, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body,
-        });
-        if (!res.ok) {
-            throw new OcsApiError(res.status, `HTTP ${res.status} ${res.statusText}`, method);
-        }
-        const json = (await res.json());
-        if (json.status?.code !== 0) {
-            throw new OcsApiError(json.status?.code ?? -1, json.status?.msg ?? "Unknown error", method);
-        }
-        // getCustomerTariff response is keyed as "listTariffRule" not "getCustomerTariff"
-        if (method === "getCustomerTariff" && json["listTariffRule"] !== undefined) {
-            return json["listTariffRule"];
-        }
-        // GeoSense: live OCS returns coordinates under "subscriberLocation", not the method name
-        if (method === "getSubscriberLocationByCellId") {
-            const byMethod = json[method];
-            if (byMethod !== undefined) {
-                return byMethod;
-            }
-            if (json["subscriberLocation"] !== undefined) {
-                return json["subscriberLocation"];
-            }
-        }
-        // Return the method-specific payload
-        return json[method] ?? json;
-    }
-}
-let _client = null;
-export function getClient() {
-    if (!_client) {
-        const baseUrl = process.env.ESIMVAULT_BASE_URL;
-        const token = process.env.ESIMVAULT_API_TOKEN;
-        if (!baseUrl || !token) {
-            throw new Error("Missing ESIMVAULT_BASE_URL or ESIMVAULT_API_TOKEN environment variables. " +
-                "Set them before starting the MCP server.");
-        }
-        _client = new OcsClient(baseUrl, token);
-    }
-    return _client;
-}
-/**
- * Fetch the token owner's reseller ID via getResellerInfo.
- * Used as a fallback when bare-integer methods are called without an explicit resellerId.
- */
-export async function getDefaultResellerId() {
-    const info = await getClient().call("getResellerInfo", {});
-    const id = info?.id;
-    if (typeof id !== "number") {
-        throw new Error("Could not determine resellerId from getResellerInfo");
-    }
-    return id;
-}
-//# sourceMappingURL=client.js.map