@kernhq/module-billing 0.2.0

package/dist/server/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/server/schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,MAAM,uDAA0B,CAAA;AAO7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBjB,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBzB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOzB,CAAA;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOpB,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBpB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,uBAAwB,CAAA"}

package/dist/server/schema.js

@@ -0,0 +1,137 @@
+import { sql } from 'drizzle-orm';
+import { bigint, boolean, index, integer, jsonb, pgSchema, text, timestamp, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
+// `pgSchema` directly (not `moduleSchema` from @kernhq/kernel) so drizzle-kit can load this file standalone
+export const schema = pgSchema('mod_billing');
+const ts = (name) => timestamp(name, { withTimezone: true });
+const id = () => uuid('id').primaryKey().default(sql `uuidv7()`);
+const jsonObject = (name) => jsonb(name).notNull().default(sql `'{}'::jsonb`);
+const jsonArray = (name) => jsonb(name).notNull().default(sql `'[]'::jsonb`);
+/**
+ * # Why most of this module is not row-level secured
+ *
+ * Kern's rule is that a module's tenant tables carry `workspace_id` and RLS. Billing is the one place
+ * that rule does not fit, and it is worth saying exactly why rather than leaving the next person to
+ * assume it was forgotten.
+ *
+ * A subscription row is not the workspace's data. It is the **instance operator's** record *about*
+ * that workspace: what they charge it, whether it has paid, whether it is suspended. Two things
+ * follow, and neither is possible under RLS, which returns nothing at all when `app.workspace_id` is
+ * unset:
+ *
+ * - the instance console lists every workspace on the instance in one query — that screen is the
+ *   whole reason an operator can run Kern as a service;
+ * - the dunning and reconcile jobs enumerate workspaces before they can pick one.
+ *
+ * So `plans`, `subscriptions`, `workspace_usage`, `overrides` and `webhook_events` are operator
+ * tables, and their isolation is enforced in the procedure layer: every workspace-facing procedure
+ * filters by the caller's own workspace and checks `billing.subscription.view|manage` first.
+ *
+ * `invoices` is the exception that proves it. An invoice **is** the customer's own record, read on
+ * their own billing screen, so it is a proper tenant table with RLS — see `TENANT_TABLES` below.
+ */
+/** The catalogue. Instance-scoped: a plan belongs to the instance, not to any workspace. */
+export const plans = schema.table('plans', {
+    id: id(),
+    slug: text('slug').notNull(),
+    name: text('name').notNull(),
+    description: text('description').notNull().default(''),
+    /** smallest currency unit, so 800 is $8.00 — money is never a float */
+    priceMinor: integer('price_minor').notNull().default(0),
+    currency: text('currency').notNull().default('usd'),
+    interval: text('interval').notNull().default('month'),
+    perSeat: boolean('per_seat').notNull().default(true),
+    trialDays: integer('trial_days').notNull().default(0),
+    limits: jsonObject('limits'),
+    stripePriceId: text('stripe_price_id'),
+    highlights: jsonArray('highlights'),
+    published: boolean('published').notNull().default(false),
+    order: integer('order').notNull().default(100),
+    /** archived plans keep working for whoever is on them, and stop being offered */
+    archivedAt: ts('archived_at'),
+    createdAt: ts('created_at').notNull().defaultNow(),
+    updatedAt: ts('updated_at').notNull().defaultNow(),
+}, (t) => [uniqueIndex('plans_slug_idx').on(t.slug), index('plans_published_idx').on(t.published, t.order)]);
+/** One per workspace. Operator table — see the note at the top of this file. */
+export const subscriptions = schema.table('subscriptions', {
+    workspaceId: uuid('workspace_id').primaryKey(),
+    planId: uuid('plan_id'),
+    status: text('status').notNull().default('trialing'),
+    seatsPurchased: integer('seats_purchased').notNull().default(0),
+    trialEndsAt: ts('trial_ends_at'),
+    currentPeriodEnd: ts('current_period_end'),
+    cancelAtPeriodEnd: boolean('cancel_at_period_end').notNull().default(false),
+    stripeCustomerId: text('stripe_customer_id'),
+    stripeSubscriptionId: text('stripe_subscription_id'),
+    /** when the grace period after a failed payment runs out and the workspace is suspended */
+    graceEndsAt: ts('grace_ends_at'),
+    createdAt: ts('created_at').notNull().defaultNow(),
+    updatedAt: ts('updated_at').notNull().defaultNow(),
+}, (t) => [
+    index('subscriptions_status_idx').on(t.status),
+    uniqueIndex('subscriptions_stripe_sub_idx').on(t.stripeSubscriptionId),
+]);
+/**
+ * What a workspace is actually using.
+ *
+ * Kept as a counter rather than recomputed, because `sum(files.size)` on every upload is a scan of
+ * the workspace's whole file table. Event subscriptions move it; a nightly job recomputes the truth
+ * and logs the drift rather than silently papering over it, because silent correction hides the bug
+ * that caused the drift.
+ */
+export const workspaceUsage = schema.table('workspace_usage', {
+    workspaceId: uuid('workspace_id').primaryKey(),
+    seats: integer('seats').notNull().default(0),
+    /** bigint, not integer: a 2 GiB workspace would overflow int4 counted in bytes */
+    storageBytes: bigint('storage_bytes', { mode: 'number' }).notNull().default(0),
+    reconciledAt: ts('reconciled_at'),
+    updatedAt: ts('updated_at').notNull().defaultNow(),
+});
+/** Per-workspace limit overrides, so an account can be comped without inventing a plan for it. */
+export const overrides = schema.table('overrides', {
+    workspaceId: uuid('workspace_id').primaryKey(),
+    limits: jsonObject('limits'),
+    note: text('note').notNull().default(''),
+    createdBy: uuid('created_by'),
+    createdAt: ts('created_at').notNull().defaultNow(),
+    updatedAt: ts('updated_at').notNull().defaultNow(),
+});
+/**
+ * The customer's own invoice history — a **tenant table**, read on their billing screen in their own
+ * workspace context. The operator reads invoices in Stripe, which is authoritative; this is a mirror
+ * kept so the screen does not have to call Stripe to render.
+ */
+export const invoices = schema.table('invoices', {
+    id: id(),
+    workspaceId: uuid('workspace_id').notNull(),
+    stripeInvoiceId: text('stripe_invoice_id'),
+    number: text('number'),
+    status: text('status').notNull(),
+    totalMinor: integer('total_minor').notNull().default(0),
+    currency: text('currency').notNull().default('usd'),
+    periodStart: ts('period_start'),
+    periodEnd: ts('period_end'),
+    hostedUrl: text('hosted_url'),
+    pdfUrl: text('pdf_url'),
+    createdAt: ts('created_at').notNull().defaultNow(),
+}, (t) => [
+    index('invoices_ws_idx').on(t.workspaceId, t.createdAt),
+    uniqueIndex('invoices_stripe_idx').on(t.stripeInvoiceId),
+]);
+/**
+ * Stripe event ids already applied.
+ *
+ * Stripe retries a webhook until it gets a 2xx, and it does not promise to deliver only once, so a
+ * handler that is not idempotent will double-count. The unique index is what makes the second
+ * delivery a no-op — checking then inserting is a race, so the insert *is* the check.
+ */
+export const webhookEvents = schema.table('webhook_events', {
+    id: text('id').primaryKey(),
+    type: text('type').notNull(),
+    receivedAt: ts('received_at').notNull().defaultNow(),
+}, (t) => [index('webhook_events_received_idx').on(t.receivedAt)]);
+/**
+ * Tables that carry another workspace's rows and therefore must be row-level secured.
+ * Deliberately short — see the note at the top of this file for why the rest are operator tables.
+ */
+export const TENANT_TABLES = ['invoices'];
+//# sourceMappingURL=schema.js.map

package/dist/server/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/server/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,WAAW,EACX,IAAI,GACL,MAAM,qBAAqB,CAAA;AAE5B,4GAA4G;AAC5G,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;AAE7C,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,UAAU,CAAC,CAAA;AAC/D,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC,CAAA;AACpF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC,CAAA;AAEnF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAC/B,OAAO,EACP;IACE,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACrD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;IAC5B,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACtC,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9C,iFAAiF;IACjF,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC;IAC7B,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CACzG,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CACvC,eAAe,EACf;IACE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE;IAC9C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IACpD,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC;IAChC,gBAAgB,EAAE,EAAE,CAAC,oBAAoB,CAAC;IAC1C,iBAAiB,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3E,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAAC;IACpD,2FAA2F;IAC3F,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC;IAChC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;CACvE,CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE;IAC9C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC;IACjC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACnD,CAAC,CAAA;AAEF,kGAAkG;AAClG,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;IACjD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IAClD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACnD,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAClC,UAAU,EACV;IACE,EAAE,EAAE,EAAE,EAAE;IACR,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC;IAC/B,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;IACvD,WAAW,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;CACzD,CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CACvC,gBAAgB,EAChB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACrD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,CAAU,CAAA"}

package/dist/server/services/entitlements.d.ts

@@ -0,0 +1,3 @@
+import type { Entitlement, Kernel } from '@kernhq/kernel';
+export declare function resolve(kernel: Kernel, workspaceId: string): Promise<Partial<Entitlement>>;
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/server/services/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../../src/server/services/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AA8BzD,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAgDhG"}

package/dist/server/services/entitlements.js

@@ -0,0 +1,68 @@
+import { eq } from 'drizzle-orm';
+import { PlanLimits, PlanLimitsPatch } from '../../contract.js';
+import { overrides, plans, subscriptions } from '../schema.js';
+/**
+ * Statuses that still entitle a workspace to its plan.
+ *
+ * `past_due` is deliberately in the list: a card that failed this morning must not lock a team out
+ * of their work the same afternoon. The grace period is what ends, and ending it moves the row to
+ * `suspended` — which is not here, and which makes writes fail while reads keep working.
+ */
+const ENTITLED = new Set(['trialing', 'active', 'past_due']);
+/** Statuses where the workspace may read but not write. */
+const INACTIVE = new Set(['suspended', 'canceled']);
+/**
+ * What a workspace is allowed to do, resolved from its plan and any override an admin has set.
+ *
+ * The result is exactly the shape `kernel.entitlements` expects, because this is the procedure the
+ * kernel calls. Anything this function cannot answer — no subscription row, no plan, an unparseable
+ * limits blob — resolves to *unlimited* rather than to nothing. A billing bug must not be able to
+ * lock a paying customer out of their own workspace; the failure has to fall open.
+ */
+/** Drop the keys a patch does not mention, so a spread cannot overwrite with `undefined`. */
+function definedOnly(patch) {
+    return Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined));
+}
+export async function resolve(kernel, workspaceId) {
+    const db = kernel.database.db;
+    const [row] = await db
+        .select({
+        status: subscriptions.status,
+        planName: plans.name,
+        limits: plans.limits,
+    })
+        .from(subscriptions)
+        .leftJoin(plans, eq(plans.id, subscriptions.planId))
+        .where(eq(subscriptions.workspaceId, workspaceId))
+        .limit(1);
+    // Nothing bills this workspace — a self-hosted instance, or one where the admin has not assigned
+    // a plan. Unlimited, and silent about it.
+    if (!row)
+        return { planName: null, active: true };
+    const parsed = PlanLimits.safeParse(row.limits ?? {});
+    if (!parsed.success)
+        kernel.log.warn({ workspaceId, issues: parsed.error.issues.length }, 'billing: plan limits did not parse; treating the workspace as unlimited');
+    const base = parsed.success ? parsed.data : PlanLimits.parse({});
+    const [ovr] = await db
+        .select({ limits: overrides.limits })
+        .from(overrides)
+        .where(eq(overrides.workspaceId, workspaceId))
+        .limit(1);
+    // An override is a patch over the plan, so comping one limit does not silently reset the others to
+    // a default the admin never chose — which means dropping the keys the patch does not mention
+    // rather than spreading them as `undefined`.
+    const patch = ovr?.limits ? definedOnly(PlanLimitsPatch.parse(ovr.limits)) : null;
+    const merged = patch
+        ? { ...base, ...patch }
+        : ENTITLED.has(row.status)
+            ? base
+            : // Not entitled: the plan's allowances do not apply, but nothing is taken away that would
+                // stop the customer reading and exporting what is theirs.
+                PlanLimits.parse({});
+    return {
+        ...merged,
+        planName: row.planName ?? null,
+        active: !INACTIVE.has(row.status),
+    };
+}
+//# sourceMappingURL=entitlements.js.map

package/dist/server/services/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../../src/server/services/entitlements.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,eAAe,EAA2B,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;AAErG,2DAA2D;AAC3D,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;AAE5F;;;;;;;GAOG;AACH,6FAA6F;AAC7F,SAAS,WAAW,CAAmB,KAAQ;IAC7C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAe,CAAA;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,WAAmB;IAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;SACD,IAAI,CAAC,aAAa,CAAC;SACnB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SACnD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,iGAAiG;IACjG,0CAA0C;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAEjD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,CAAC,GAAG,CAAC,IAAI,CACb,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EACnD,yEAAyE,CAC1E,CAAA;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAEhE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;SACpC,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;SAC7C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,mGAAmG;IACnG,6FAA6F;IAC7F,6CAA6C;IAC7C,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE;QACvB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,yFAAyF;gBACzF,0DAA0D;gBAC1D,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAE1B,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/server/services/plans.d.ts

@@ -0,0 +1,20 @@
+import { type Kernel } from '@kernhq/kernel';
+import { type Plan, type PublicPlan, type UpsertPlan } from '../../contract.js';
+import { plans } from '../schema.js';
+type Row = typeof plans.$inferSelect;
+declare const ser: (r: Row) => Plan;
+/** What a stranger sees: published, unarchived, and nothing internal. */
+declare const serPublic: (r: Row) => PublicPlan;
+export declare function list(kernel: Kernel, includeUnpublished: boolean): Promise<Plan[]>;
+export declare function publicList(kernel: Kernel): Promise<PublicPlan[]>;
+export declare function bySlug(kernel: Kernel, slug: string): Promise<Plan | null>;
+export declare function upsert(kernel: Kernel, input: UpsertPlan): Promise<Plan>;
+export declare function setPublished(kernel: Kernel, id: string, published: boolean): Promise<Plan>;
+/**
+ * Archiving withdraws a plan from the catalogue without deleting it: whoever is already on it stays
+ * on it, and their subscription row keeps pointing at something that still resolves. Deleting the
+ * row would leave those workspaces with a dangling `plan_id` and no limits at all.
+ */
+export declare function archive(kernel: Kernel, id: string): Promise<void>;
+export { ser as serialisePlan, serPublic as serialisePublicPlan };
+//# sourceMappingURL=plans.d.ts.map

package/dist/server/services/plans.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plans.d.ts","sourceRoot":"","sources":["../../../src/server/services/plans.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAU,MAAM,gBAAgB,CAAA;AAE/D,OAAO,EAAE,KAAK,IAAI,EAAc,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAEpC,KAAK,GAAG,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAEpC,QAAA,MAAM,GAAG,GAAI,GAAG,GAAG,KAAG,IAiBpB,CAAA;AAEF,yEAAyE;AACzE,QAAA,MAAM,SAAS,GAAI,GAAG,GAAG,KAAG,UAY1B,CAAA;AAEF,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAUvF;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOtE;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAG/E;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC7E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE;AAED,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,SAAS,IAAI,mBAAmB,EAAE,CAAA"}

package/dist/server/services/plans.js

@@ -0,0 +1,122 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, asc, eq, isNull, ne } from 'drizzle-orm';
+import { PlanLimits } from '../../contract.js';
+import { plans } from '../schema.js';
+const ser = (r) => ({
+    id: r.id,
+    slug: r.slug,
+    name: r.name,
+    description: r.description,
+    priceMinor: r.priceMinor,
+    currency: r.currency,
+    interval: r.interval,
+    perSeat: r.perSeat,
+    trialDays: r.trialDays,
+    limits: PlanLimits.parse(r.limits ?? {}),
+    stripePriceId: r.stripePriceId,
+    highlights: r.highlights ?? [],
+    published: r.published,
+    order: r.order,
+    createdAt: r.createdAt.toISOString(),
+    updatedAt: r.updatedAt.toISOString(),
+});
+/** What a stranger sees: published, unarchived, and nothing internal. */
+const serPublic = (r) => ({
+    slug: r.slug,
+    name: r.name,
+    description: r.description,
+    priceMinor: r.priceMinor,
+    currency: r.currency,
+    interval: r.interval,
+    perSeat: r.perSeat,
+    trialDays: r.trialDays,
+    highlights: r.highlights ?? [],
+    order: r.order,
+    limits: PlanLimits.parse(r.limits ?? {}),
+});
+export async function list(kernel, includeUnpublished) {
+    const where = includeUnpublished
+        ? isNull(plans.archivedAt)
+        : and(isNull(plans.archivedAt), eq(plans.published, true));
+    const rows = await kernel.database.db
+        .select()
+        .from(plans)
+        .where(where)
+        .orderBy(asc(plans.order), asc(plans.priceMinor));
+    return rows.map(ser);
+}
+export async function publicList(kernel) {
+    const rows = await kernel.database.db
+        .select()
+        .from(plans)
+        .where(and(isNull(plans.archivedAt), eq(plans.published, true)))
+        .orderBy(asc(plans.order), asc(plans.priceMinor));
+    return rows.map(serPublic);
+}
+export async function bySlug(kernel, slug) {
+    const [row] = await kernel.database.db.select().from(plans).where(eq(plans.slug, slug)).limit(1);
+    return row ? ser(row) : null;
+}
+export async function upsert(kernel, input) {
+    const db = kernel.database.db;
+    // A slug appears in URLs and in whatever the marketing site has cached, so two plans may never
+    // share one — checked explicitly so the admin gets a sentence rather than a unique-violation.
+    const [clash] = await db
+        .select({ id: plans.id })
+        .from(plans)
+        .where(input.id ? and(eq(plans.slug, input.slug), ne(plans.id, input.id)) : eq(plans.slug, input.slug))
+        .limit(1);
+    if (clash)
+        throw KernError.conflict('Another plan already uses that slug', 'billing.plan.slug_taken');
+    const values = {
+        slug: input.slug,
+        name: input.name,
+        description: input.description,
+        priceMinor: input.priceMinor,
+        currency: input.currency,
+        interval: input.interval,
+        perSeat: input.perSeat,
+        trialDays: input.trialDays,
+        limits: PlanLimits.parse(input.limits),
+        stripePriceId: input.stripePriceId,
+        highlights: input.highlights,
+        published: input.published,
+        order: input.order,
+        updatedAt: new Date(),
+    };
+    const [row] = input.id
+        ? await db.update(plans).set(values).where(eq(plans.id, input.id)).returning()
+        : await db
+            .insert(plans)
+            .values({ id: uuidv7(), ...values })
+            .returning();
+    if (!row)
+        throw KernError.notFound('Plan');
+    return ser(row);
+}
+export async function setPublished(kernel, id, published) {
+    const [row] = await kernel.database.db
+        .update(plans)
+        .set({ published, updatedAt: new Date() })
+        .where(eq(plans.id, id))
+        .returning();
+    if (!row)
+        throw KernError.notFound('Plan');
+    return ser(row);
+}
+/**
+ * Archiving withdraws a plan from the catalogue without deleting it: whoever is already on it stays
+ * on it, and their subscription row keeps pointing at something that still resolves. Deleting the
+ * row would leave those workspaces with a dangling `plan_id` and no limits at all.
+ */
+export async function archive(kernel, id) {
+    const [row] = await kernel.database.db
+        .update(plans)
+        .set({ archivedAt: new Date(), published: false, updatedAt: new Date() })
+        .where(eq(plans.id, id))
+        .returning({ id: plans.id });
+    if (!row)
+        throw KernError.notFound('Plan');
+}
+export { ser as serialisePlan, serPublic as serialisePublicPlan };
+//# sourceMappingURL=plans.js.map

package/dist/server/services/plans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plans.js","sourceRoot":"","sources":["../../../src/server/services/plans.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAa,UAAU,EAAoC,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAIpC,MAAM,GAAG,GAAG,CAAC,CAAM,EAAQ,EAAE,CAAC,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,QAAQ,EAAE,CAAC,CAAC,QAA4B;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,aAAa,EAAE,CAAC,CAAC,aAAa;IAC9B,UAAU,EAAG,CAAC,CAAC,UAAuB,IAAI,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;CACrC,CAAC,CAAA;AAEF,yEAAyE;AACzE,MAAM,SAAS,GAAG,CAAC,CAAM,EAAc,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,QAAQ,EAAE,CAAC,CAAC,QAA4B;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,UAAU,EAAG,CAAC,CAAC,UAAuB,IAAI,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;CACzC,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,kBAA2B;IACpE,MAAM,KAAK,GAAG,kBAAkB;QAC9B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,KAAK,CAAC;SACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;SAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChG,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,KAAiB;IAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7B,+FAA+F;IAC/F,8FAA8F;IAC9F,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;SACxB,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SACtG,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,KAAK;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,qCAAqC,EAAE,yBAAyB,CAAC,CAAA;IAErG,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE;QACpB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE;QAC9E,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;aACnC,SAAS,EAAE,CAAA;IAClB,IAAI,CAAC,GAAG;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,EAAU,EAAE,SAAkB;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACnC,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SACzC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACvB,SAAS,EAAE,CAAA;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACnC,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SACxE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACvB,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,SAAS,IAAI,mBAAmB,EAAE,CAAA"}

package/dist/server/services/stripe.d.ts

@@ -0,0 +1,42 @@
+import { type Kernel } from '@kernhq/kernel';
+import Stripe from 'stripe';
+/**
+ * Stripe, or nothing at all.
+ *
+ * The module ships in every Kern image, including every self-hosted one, so the absence of a key is
+ * the normal case rather than a misconfiguration. `client()` returning null is how the rest of the
+ * module finds out, and every caller has to handle it — there is no "assume it is configured" path.
+ */
+export declare function client(): Stripe | null;
+export declare const paymentsEnabled: () => boolean;
+export declare function checkout(kernel: Kernel, input: {
+    workspaceId: string;
+    planSlug: string;
+    seats?: number;
+    email?: string;
+    baseUrl: string;
+}): Promise<{
+    url: string;
+}>;
+export declare function portal(kernel: Kernel, input: {
+    workspaceId: string;
+    returnUrl: string;
+}): Promise<{
+    url: string;
+}>;
+/** Keep the seat quantity on Stripe in step with the workspace's actual membership. */
+export declare function syncSeats(kernel: Kernel, workspaceId: string, seats: number): Promise<void>;
+/**
+ * Apply one webhook.
+ *
+ * Verification happens against the **raw body**, before anything parses it — a signature over
+ * re-encoded JSON proves nothing, because re-encoding is not guaranteed to reproduce the bytes that
+ * were signed.
+ */
+export declare function handleWebhook(kernel: Kernel, raw: Buffer | string, signature: string): Promise<{
+    handled: boolean;
+    type: string;
+}>;
+/** How long a workspace keeps working after a payment fails. */
+export declare const GRACE_DAYS = 14;
+//# sourceMappingURL=stripe.d.ts.map

package/dist/server/services/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","sourceRoot":"","sources":["../../../src/server/services/stripe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAK3B;;;;;;GAMG;AACH,wBAAgB,MAAM,IAAI,MAAM,GAAG,IAAI,CAUtC;AAED,eAAO,MAAM,eAAe,eAA+C,CAAA;AAiD3E,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB1B;AAED,wBAAsB,MAAM,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1B;AAED,uFAAuF;AACvF,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjG;AAkFD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GAAG,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD7C;AAED,gEAAgE;AAChE,eAAO,MAAM,UAAU,KAAK,CAAA"}