@kernhq/module-billing 0.2.0

package/dist/server/services/stripe.js

@@ -0,0 +1,267 @@
+import { KernError } from '@kernhq/kernel';
+import { eq } from 'drizzle-orm';
+import Stripe from 'stripe';
+import { invoices, plans, subscriptions, webhookEvents } from '../schema.js';
+import * as subs from './subscriptions.js';
+/**
+ * Stripe, or nothing at all.
+ *
+ * The module ships in every Kern image, including every self-hosted one, so the absence of a key is
+ * the normal case rather than a misconfiguration. `client()` returning null is how the rest of the
+ * module finds out, and every caller has to handle it — there is no "assume it is configured" path.
+ */
+export function client() {
+    const key = process.env.STRIPE_SECRET_KEY;
+    if (!key)
+        return null;
+    return new Stripe(key, {
+        // Pinned deliberately: an account-level API version change must not reach a running instance
+        // before its image has been built against it.
+        apiVersion: '2026-07-29.dahlia',
+        appInfo: { name: 'Kern', url: 'https://kernaio.com' },
+        maxNetworkRetries: 2,
+    });
+}
+export const paymentsEnabled = () => Boolean(process.env.STRIPE_SECRET_KEY);
+function required() {
+    const s = client();
+    if (!s)
+        throw KernError.conflict('This instance is not configured to take payments', 'billing.stripe.not_configured');
+    return s;
+}
+/** Stripe's subscription statuses, mapped onto the five this module recognises. */
+function mapStatus(s) {
+    switch (s) {
+        case 'trialing':
+            return 'trialing';
+        case 'active':
+            return 'active';
+        case 'past_due':
+        case 'unpaid':
+            return 'past_due';
+        case 'canceled':
+        case 'incomplete_expired':
+            return 'canceled';
+        // `incomplete` means the first payment has not succeeded yet: not entitled, not yet a customer
+        case 'incomplete':
+        case 'paused':
+            return 'suspended';
+        default:
+            return 'suspended';
+    }
+}
+/** The Stripe customer for a workspace, created on first use and remembered. */
+async function customerFor(kernel, workspaceId, email) {
+    const existing = await subs.get(kernel, workspaceId);
+    if (existing?.stripeCustomerId)
+        return existing.stripeCustomerId;
+    const stripe = required();
+    const customer = await stripe.customers.create({
+        email,
+        // the workspace id travels with the customer so a webhook can find its way home even if our
+        // own row is missing — which is exactly the case during a first checkout
+        metadata: { kern_workspace_id: workspaceId },
+    });
+    await subs.upsert(kernel, workspaceId, { stripeCustomerId: customer.id });
+    return customer.id;
+}
+export async function checkout(kernel, input) {
+    const stripe = required();
+    const [plan] = await kernel.database.db.select().from(plans).where(eq(plans.slug, input.planSlug)).limit(1);
+    if (!plan)
+        throw KernError.notFound('Plan');
+    if (!plan.stripePriceId)
+        throw KernError.conflict('That plan has no Stripe price attached', 'billing.plan.no_price');
+    const customer = await customerFor(kernel, input.workspaceId, input.email);
+    const session = await stripe.checkout.sessions.create({
+        mode: 'subscription',
+        customer,
+        line_items: [{ price: plan.stripePriceId, quantity: plan.perSeat ? (input.seats ?? 1) : 1 }],
+        subscription_data: {
+            ...(plan.trialDays > 0 ? { trial_period_days: plan.trialDays } : {}),
+            metadata: { kern_workspace_id: input.workspaceId, kern_plan_id: plan.id },
+        },
+        // The card is taken up front, trial or not, so the subscription converts without asking again.
+        payment_method_collection: 'always',
+        success_url: `${input.baseUrl}/settings/billing?checkout=done`,
+        cancel_url: `${input.baseUrl}/settings/billing?checkout=cancelled`,
+    });
+    if (!session.url)
+        throw KernError.conflict('Stripe did not return a checkout URL', 'billing.stripe.no_url');
+    return { url: session.url };
+}
+export async function portal(kernel, input) {
+    const stripe = required();
+    const sub = await subs.get(kernel, input.workspaceId);
+    if (!sub?.stripeCustomerId)
+        throw KernError.conflict('This workspace has no billing account yet', 'billing.stripe.no_customer');
+    const session = await stripe.billingPortal.sessions.create({
+        customer: sub.stripeCustomerId,
+        return_url: input.returnUrl,
+    });
+    return { url: session.url };
+}
+/** Keep the seat quantity on Stripe in step with the workspace's actual membership. */
+export async function syncSeats(kernel, workspaceId, seats) {
+    const stripe = client();
+    if (!stripe)
+        return;
+    const sub = await subs.get(kernel, workspaceId);
+    if (!sub?.stripeSubscriptionId)
+        return;
+    const remote = await stripe.subscriptions.retrieve(sub.stripeSubscriptionId);
+    const item = remote.items.data[0];
+    if (!item || item.quantity === seats)
+        return;
+    await stripe.subscriptions.update(sub.stripeSubscriptionId, {
+        items: [{ id: item.id, quantity: seats }],
+        // the customer is billed for the seat from the moment it is used, not from the next period
+        proration_behavior: 'create_prorations',
+    });
+    await subs.upsert(kernel, workspaceId, { seatsPurchased: seats });
+}
+/**
+ * Record that an event id has been handled, and say whether it is new.
+ *
+ * The insert *is* the check. Reading first and then inserting is a race that two concurrent
+ * deliveries of the same event will lose, and losing it means charging or crediting twice.
+ */
+async function claim(kernel, id, type) {
+    const rows = await kernel.database.db
+        .insert(webhookEvents)
+        .values({ id, type })
+        .onConflictDoNothing()
+        .returning({ id: webhookEvents.id });
+    return rows.length > 0;
+}
+/** The workspace a Stripe object belongs to, from the metadata we set when creating it. */
+function workspaceOf(o) {
+    return o.metadata?.kern_workspace_id ?? null;
+}
+async function applySubscription(kernel, s) {
+    const workspaceId = workspaceOf(s);
+    if (!workspaceId) {
+        kernel.log.warn({ subscription: s.id }, 'billing: Stripe subscription without a workspace id');
+        return;
+    }
+    const planId = s.metadata?.kern_plan_id ?? null;
+    const item = s.items.data[0];
+    const periodEnd = item?.current_period_end ?? null;
+    await subs.upsert(kernel, workspaceId, {
+        ...(planId ? { planId } : {}),
+        status: mapStatus(s.status),
+        seatsPurchased: item?.quantity ?? 0,
+        stripeSubscriptionId: s.id,
+        stripeCustomerId: typeof s.customer === 'string' ? s.customer : s.customer.id,
+        cancelAtPeriodEnd: s.cancel_at_period_end,
+        trialEndsAt: s.trial_end ? new Date(s.trial_end * 1000) : null,
+        currentPeriodEnd: periodEnd ? new Date(periodEnd * 1000) : null,
+        graceEndsAt: null,
+    });
+}
+async function applyInvoice(kernel, inv) {
+    const customer = typeof inv.customer === 'string' ? inv.customer : inv.customer?.id;
+    if (!customer)
+        return;
+    const [row] = await kernel.database.db
+        .select({ workspaceId: subscriptions.workspaceId })
+        .from(subscriptions)
+        .where(eq(subscriptions.stripeCustomerId, customer))
+        .limit(1);
+    if (!row)
+        return;
+    const workspaceId = row.workspaceId;
+    const line = inv.lines?.data?.[0];
+    await kernel.database.withWorkspace(workspaceId, async (tx) => {
+        await tx
+            .insert(invoices)
+            .values({
+            workspaceId,
+            stripeInvoiceId: inv.id ?? null,
+            number: inv.number ?? null,
+            status: inv.status ?? 'draft',
+            totalMinor: inv.total ?? 0,
+            currency: inv.currency ?? 'usd',
+            periodStart: line?.period?.start ? new Date(line.period.start * 1000) : null,
+            periodEnd: line?.period?.end ? new Date(line.period.end * 1000) : null,
+            hostedUrl: inv.hosted_invoice_url ?? null,
+            pdfUrl: inv.invoice_pdf ?? null,
+        })
+            .onConflictDoUpdate({
+            target: invoices.stripeInvoiceId,
+            set: {
+                status: inv.status ?? 'draft',
+                totalMinor: inv.total ?? 0,
+                hostedUrl: inv.hosted_invoice_url ?? null,
+                pdfUrl: inv.invoice_pdf ?? null,
+            },
+        });
+    });
+}
+/**
+ * Apply one webhook.
+ *
+ * Verification happens against the **raw body**, before anything parses it — a signature over
+ * re-encoded JSON proves nothing, because re-encoding is not guaranteed to reproduce the bytes that
+ * were signed.
+ */
+export async function handleWebhook(kernel, raw, signature) {
+    const stripe = required();
+    const secret = process.env.STRIPE_WEBHOOK_SECRET;
+    if (!secret)
+        throw KernError.conflict('No Stripe webhook secret is configured', 'billing.stripe.no_webhook_secret');
+    let event;
+    try {
+        event = stripe.webhooks.constructEvent(raw, signature, secret);
+    }
+    catch (err) {
+        throw KernError.badRequest('Stripe signature did not verify', { err: String(err) });
+    }
+    if (!(await claim(kernel, event.id, event.type))) {
+        kernel.log.info({ event: event.id, type: event.type }, 'billing: webhook already applied');
+        return { handled: false, type: event.type };
+    }
+    switch (event.type) {
+        case 'customer.subscription.created':
+        case 'customer.subscription.updated':
+        case 'customer.subscription.deleted':
+            await applySubscription(kernel, event.data.object);
+            break;
+        case 'checkout.session.completed': {
+            const session = event.data.object;
+            const subId = typeof session.subscription === 'string' ? session.subscription : session.subscription?.id;
+            if (subId)
+                await applySubscription(kernel, await stripe.subscriptions.retrieve(subId));
+            break;
+        }
+        case 'invoice.paid':
+            await applyInvoice(kernel, event.data.object);
+            break;
+        case 'invoice.payment_failed': {
+            const inv = event.data.object;
+            await applyInvoice(kernel, inv);
+            const customer = typeof inv.customer === 'string' ? inv.customer : inv.customer?.id;
+            if (customer) {
+                const [row] = await kernel.database.db
+                    .select({ workspaceId: subscriptions.workspaceId })
+                    .from(subscriptions)
+                    .where(eq(subscriptions.stripeCustomerId, customer))
+                    .limit(1);
+                if (row) {
+                    // A failed payment starts a clock, it does not close the workspace. Stripe keeps retrying
+                    // for its own dunning window; the grace period is what decides when we stop waiting.
+                    const grace = new Date();
+                    grace.setUTCDate(grace.getUTCDate() + GRACE_DAYS);
+                    await subs.upsert(kernel, row.workspaceId, { status: 'past_due', graceEndsAt: grace });
+                }
+            }
+            break;
+        }
+        default:
+            kernel.log.debug({ type: event.type }, 'billing: unhandled Stripe event');
+    }
+    return { handled: true, type: event.type };
+}
+/** How long a workspace keeps working after a payment fails. */
+export const GRACE_DAYS = 14;
+//# sourceMappingURL=stripe.js.map

package/dist/server/services/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../../src/server/services/stripe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5E,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,MAAM;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE;QACrB,6FAA6F;QAC7F,8CAA8C;QAC9C,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE;QACrD,iBAAiB,EAAE,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;AAE3E,SAAS,QAAQ;IACf,MAAM,CAAC,GAAG,MAAM,EAAE,CAAA;IAClB,IAAI,CAAC,CAAC;QACJ,MAAM,SAAS,CAAC,QAAQ,CACtB,kDAAkD,EAClD,+BAA+B,CAChC,CAAA;IACH,OAAO,CAAC,CAAA;AACV,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,CAA6B;IAC9C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,UAAU;YACb,OAAO,UAAU,CAAA;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAA;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,UAAU,CAAA;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,oBAAoB;YACvB,OAAO,UAAU,CAAA;QACnB,+FAA+F;QAC/F,KAAK,YAAY,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAA;QACpB;YACE,OAAO,WAAW,CAAA;IACtB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAmB,EAAE,KAAc;IAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,QAAQ,EAAE,gBAAgB;QAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAA;IAChE,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,KAAK;QACL,4FAA4F;QAC5F,yEAAyE;QACzE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IACzE,OAAO,QAAQ,CAAC,EAAE,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,KAAiG;IAEjG,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3G,IAAI,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,aAAa;QACrB,MAAM,SAAS,CAAC,QAAQ,CAAC,wCAAwC,EAAE,uBAAuB,CAAC,CAAA;IAE7F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpD,IAAI,EAAE,cAAc;QACpB,QAAQ;QACR,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,iBAAiB,EAAE;YACjB,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;SAC1E;QACD,+FAA+F;QAC/F,yBAAyB,EAAE,QAAQ;QACnC,WAAW,EAAE,GAAG,KAAK,CAAC,OAAO,iCAAiC;QAC9D,UAAU,EAAE,GAAG,KAAK,CAAC,OAAO,sCAAsC;KACnE,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,sCAAsC,EAAE,uBAAuB,CAAC,CAAA;IAC3G,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAc,EACd,KAAiD;IAEjD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,EAAE,gBAAgB;QACxB,MAAM,SAAS,CAAC,QAAQ,CAAC,2CAA2C,EAAE,4BAA4B,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzD,QAAQ,EAAE,GAAG,CAAC,gBAAgB;QAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,WAAmB,EAAE,KAAa;IAChF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,GAAG,EAAE,oBAAoB;QAAE,OAAM;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAM;IAC5C,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAC1D,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACzC,2FAA2F;QAC3F,kBAAkB,EAAE,mBAAmB;KACxC,CAAC,CAAA;IACF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,EAAU,EAAE,IAAY;IAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SAClC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACpB,mBAAmB,EAAE;SACrB,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAA;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,CAAwC;IAC3D,OAAO,CAAC,CAAC,QAAQ,EAAE,iBAAiB,IAAI,IAAI,CAAA;AAC9C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,CAAsB;IACrE,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,qDAAqD,CAAC,CAAA;QAC9F,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAA;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,SAAS,GAAG,IAAI,EAAE,kBAAkB,IAAI,IAAI,CAAA;IAClD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE;QACrC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,cAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC;QACnC,oBAAoB,EAAE,CAAC,CAAC,EAAE;QAC1B,gBAAgB,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QAC7E,iBAAiB,EAAE,CAAC,CAAC,oBAAoB;QACzC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,WAAW,EAAE,IAAI;KAClB,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,GAAmB;IAC7D,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACnC,MAAM,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC;SAClD,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,CAAC,GAAG;QAAE,OAAM;IAChB,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5D,MAAM,EAAE;aACL,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,WAAW;YACX,eAAe,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;YAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO;YAC7B,UAAU,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;YAC/B,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5E,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,SAAS,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;YACzC,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;SAChC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,QAAQ,CAAC,eAAe;YAChC,GAAG,EAAE;gBACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO;gBAC7B,UAAU,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;gBAC1B,SAAS,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;gBACzC,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;aAChC;SACF,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,GAAoB,EACpB,SAAiB;IAEjB,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAChD,IAAI,CAAC,MAAM;QACT,MAAM,SAAS,CAAC,QAAQ,CAAC,wCAAwC,EAAE,kCAAkC,CAAC,CAAA;IAExG,IAAI,KAAmB,CAAA;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,UAAU,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,+BAA+B,CAAC;QACrC,KAAK,+BAA+B,CAAC;QACrC,KAAK,+BAA+B;YAClC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClD,MAAK;QACP,KAAK,4BAA4B,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;YACjC,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAA;YACxG,IAAI,KAAK;gBAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YACtF,MAAK;QACP,CAAC;QACD,KAAK,cAAc;YACjB,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAK;QACP,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;YAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC/B,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAA;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;qBACnC,MAAM,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC;qBAClD,IAAI,CAAC,aAAa,CAAC;qBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;qBACnD,KAAK,CAAC,CAAC,CAAC,CAAA;gBACX,IAAI,GAAG,EAAE,CAAC;oBACR,0FAA0F;oBAC1F,qFAAqF;oBACrF,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAA;oBACxB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,CAAA;oBACjD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;gBACxF,CAAC;YACH,CAAC;YACD,MAAK;QACP,CAAC;QACD;YACE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAA"}

package/dist/server/services/subscriptions.d.ts

@@ -0,0 +1,35 @@
+import { type Kernel } from '@kernhq/kernel';
+import { type AdminWorkspaceRow, type Invoice, PlanLimitsPatch, type Subscription, type SubscriptionStatus } from '../../contract.js';
+import { subscriptions } from '../schema.js';
+declare const ser: (r: typeof subscriptions.$inferSelect, plan: {
+    name: string;
+    slug: string;
+} | null) => Subscription;
+export declare function get(kernel: Kernel, workspaceId: string): Promise<Subscription | null>;
+/**
+ * Write a subscription and tell the rest of the instance.
+ *
+ * The event matters as much as the row: the kernel drops its entitlement cache on
+ * `billing.subscription.*`, so a customer who has just paid gets the seat now rather than when a TTL
+ * happens to expire.
+ */
+export declare function upsert(kernel: Kernel, workspaceId: string, patch: Partial<typeof subscriptions.$inferInsert>): Promise<Subscription>;
+export declare function setPlan(kernel: Kernel, workspaceId: string, planId: string | null, seatsPurchased?: number): Promise<Subscription>;
+export declare function extendTrial(kernel: Kernel, workspaceId: string, days: number): Promise<Subscription>;
+export declare function setStatus(kernel: Kernel, workspaceId: string, status: 'active' | 'suspended'): Promise<Subscription>;
+export declare function setOverride(kernel: Kernel, workspaceId: string, limits: PlanLimitsPatch | null, actorId: string | null): Promise<Subscription>;
+/**
+ * Every workspace on the instance, with what it pays.
+ *
+ * Workspace names live in core, so this reads billing's own rows first and then asks core to name
+ * them — a module never reaches into another module's tables, and this is the one screen where that
+ * rule costs an extra round trip.
+ */
+export declare function adminList(kernel: Kernel, input: {
+    q?: string;
+    status?: SubscriptionStatus;
+    limit: number;
+}): Promise<AdminWorkspaceRow[]>;
+export declare function listInvoices(kernel: Kernel, workspaceId: string, limit: number): Promise<Invoice[]>;
+export { ser as serialiseSubscription };
+//# sourceMappingURL=subscriptions.d.ts.map

package/dist/server/services/subscriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../src/server/services/subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAA8B,aAAa,EAAE,MAAM,cAAc,CAAA;AAUxE,QAAA,MAAM,GAAG,GACP,GAAG,OAAO,aAAa,CAAC,YAAY,EACpC,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,KAC1C,YAYD,CAAA;AAEF,wBAAsB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS3F;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,CAAC,OAAO,aAAa,CAAC,YAAY,CAAC,GAChD,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAED,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQ1G;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,GAAG,WAAW,GAC7B,OAAO,CAAC,YAAY,CAAC,CAYvB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,YAAY,CAAC,CAyBvB;AAQD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA6C9B;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAuBzG;AAED,OAAO,EAAE,GAAG,IAAI,qBAAqB,EAAE,CAAA"}

package/dist/server/services/subscriptions.js

@@ -0,0 +1,193 @@
+import { KernError } from '@kernhq/kernel';
+import { desc, eq, inArray } from 'drizzle-orm';
+import { billingEvents, PlanLimitsPatch, } from '../../contract.js';
+import { invoices, overrides, plans, subscriptions } from '../schema.js';
+import * as usage from './usage.js';
+const ser = (r, plan) => ({
+    workspaceId: r.workspaceId,
+    planId: r.planId,
+    planName: plan?.name ?? null,
+    planSlug: plan?.slug ?? null,
+    status: r.status,
+    seatsPurchased: r.seatsPurchased,
+    trialEndsAt: r.trialEndsAt?.toISOString() ?? null,
+    currentPeriodEnd: r.currentPeriodEnd?.toISOString() ?? null,
+    cancelAtPeriodEnd: r.cancelAtPeriodEnd,
+    stripeCustomerId: r.stripeCustomerId,
+    stripeSubscriptionId: r.stripeSubscriptionId,
+});
+export async function get(kernel, workspaceId) {
+    const [row] = await kernel.database.db
+        .select({ sub: subscriptions, planName: plans.name, planSlug: plans.slug })
+        .from(subscriptions)
+        .leftJoin(plans, eq(plans.id, subscriptions.planId))
+        .where(eq(subscriptions.workspaceId, workspaceId))
+        .limit(1);
+    if (!row)
+        return null;
+    return ser(row.sub, row.planName && row.planSlug ? { name: row.planName, slug: row.planSlug } : null);
+}
+/**
+ * Write a subscription and tell the rest of the instance.
+ *
+ * The event matters as much as the row: the kernel drops its entitlement cache on
+ * `billing.subscription.*`, so a customer who has just paid gets the seat now rather than when a TTL
+ * happens to expire.
+ */
+export async function upsert(kernel, workspaceId, patch) {
+    const db = kernel.database.db;
+    await db
+        .insert(subscriptions)
+        .values({ workspaceId, status: 'trialing', ...patch })
+        .onConflictDoUpdate({
+        target: subscriptions.workspaceId,
+        set: { ...patch, updatedAt: new Date() },
+    });
+    const next = await get(kernel, workspaceId);
+    if (!next)
+        throw KernError.notFound('Subscription');
+    await kernel.emit(billingEvents.subscriptionChanged, { workspaceId: workspaceId, status: next.status, planSlug: next.planSlug }, { workspaceId });
+    return next;
+}
+export async function setPlan(kernel, workspaceId, planId, seatsPurchased) {
+    if (planId) {
+        const [plan] = await kernel.database.db
+            .select({ id: plans.id, trialDays: plans.trialDays })
+            .from(plans)
+            .where(eq(plans.id, planId))
+            .limit(1);
+        if (!plan)
+            throw KernError.notFound('Plan');
+    }
+    return upsert(kernel, workspaceId, {
+        planId,
+        ...(seatsPurchased !== undefined ? { seatsPurchased } : {}),
+        // An admin assigning a plan by hand is a decision, not a trial: it takes effect now.
+        status: 'active',
+        graceEndsAt: null,
+    });
+}
+export async function extendTrial(kernel, workspaceId, days) {
+    const current = await get(kernel, workspaceId);
+    const from = current?.trialEndsAt && new Date(current.trialEndsAt) > new Date()
+        ? new Date(current.trialEndsAt)
+        : new Date();
+    from.setUTCDate(from.getUTCDate() + days);
+    return upsert(kernel, workspaceId, { status: 'trialing', trialEndsAt: from, graceEndsAt: null });
+}
+export async function setStatus(kernel, workspaceId, status) {
+    const next = await upsert(kernel, workspaceId, { status, graceEndsAt: null });
+    if (status === 'suspended')
+        await kernel.emit(billingEvents.subscriptionSuspended, {
+            workspaceId: workspaceId,
+            reason: 'an instance admin suspended this workspace',
+        }, { workspaceId });
+    return next;
+}
+export async function setOverride(kernel, workspaceId, limits, actorId) {
+    const db = kernel.database.db;
+    if (limits === null)
+        await db.delete(overrides).where(eq(overrides.workspaceId, workspaceId));
+    else
+        await db
+            .insert(overrides)
+            .values({ workspaceId, limits: PlanLimitsPatch.parse(limits), createdBy: actorId })
+            .onConflictDoUpdate({
+            target: overrides.workspaceId,
+            set: { limits: PlanLimitsPatch.parse(limits), updatedAt: new Date() },
+        });
+    const next = await get(kernel, workspaceId);
+    // an override changes what the workspace may do, so the cache has to be told even though the
+    // subscription row itself did not move
+    await kernel.emit(billingEvents.subscriptionChanged, {
+        workspaceId: workspaceId,
+        status: next?.status ?? 'trialing',
+        planSlug: next?.planSlug ?? null,
+    }, { workspaceId });
+    if (!next)
+        throw KernError.notFound('Subscription');
+    return next;
+}
+/** What a plan bills per month, so annual and monthly plans can be added up in one column. */
+function monthlyMinor(priceMinor, interval, perSeat, seats) {
+    const perMonth = interval === 'year' ? Math.round(priceMinor / 12) : priceMinor;
+    return perSeat ? perMonth * seats : perMonth;
+}
+/**
+ * Every workspace on the instance, with what it pays.
+ *
+ * Workspace names live in core, so this reads billing's own rows first and then asks core to name
+ * them — a module never reaches into another module's tables, and this is the one screen where that
+ * rule costs an extra round trip.
+ */
+export async function adminList(kernel, input) {
+    const refs = await kernel.call('core.workspaces.list', { q: input.q, limit: input.limit });
+    if (!refs.length)
+        return [];
+    const ids = refs.map((w) => w.id);
+    const subs = await kernel.database.db
+        .select({ sub: subscriptions, plan: plans })
+        .from(subscriptions)
+        .leftJoin(plans, eq(plans.id, subscriptions.planId))
+        .where(inArray(subscriptions.workspaceId, ids));
+    const byWs = new Map(subs.map((s) => [s.sub.workspaceId, s]));
+    const ovr = await kernel.database.db
+        .select({ workspaceId: overrides.workspaceId })
+        .from(overrides)
+        .where(inArray(overrides.workspaceId, ids));
+    const overridden = new Set(ovr.map((o) => o.workspaceId));
+    const rows = [];
+    for (const w of refs) {
+        const hit = byWs.get(w.id);
+        if (input.status && hit?.sub.status !== input.status)
+            continue;
+        const used = await usage.read(kernel, w.id);
+        const plan = hit?.plan ?? null;
+        rows.push({
+            workspaceId: w.id,
+            workspaceName: w.name,
+            workspaceSlug: w.slug,
+            planName: plan?.name ?? null,
+            planSlug: plan?.slug ?? null,
+            status: hit?.sub.status ?? null,
+            seatsUsed: used.seats,
+            seatsPurchased: hit?.sub.seatsPurchased ?? 0,
+            storageBytes: used.storageBytes,
+            trialEndsAt: hit?.sub.trialEndsAt?.toISOString() ?? null,
+            currentPeriodEnd: hit?.sub.currentPeriodEnd?.toISOString() ?? null,
+            monthlyMinor: plan
+                ? monthlyMinor(plan.priceMinor, plan.interval, plan.perSeat, hit?.sub.seatsPurchased ?? used.seats)
+                : 0,
+            currency: plan?.currency ?? 'usd',
+            overridden: overridden.has(w.id),
+            stripeCustomerId: hit?.sub.stripeCustomerId ?? null,
+        });
+    }
+    return rows;
+}
+export async function listInvoices(kernel, workspaceId, limit) {
+    // a tenant table, so it is read inside the workspace's own RLS context
+    return kernel.database.withWorkspace(workspaceId, async (tx) => {
+        const rows = await tx
+            .select()
+            .from(invoices)
+            .where(eq(invoices.workspaceId, workspaceId))
+            .orderBy(desc(invoices.createdAt))
+            .limit(limit);
+        return rows.map((r) => ({
+            id: r.id,
+            workspaceId: r.workspaceId,
+            number: r.number,
+            status: r.status,
+            totalMinor: r.totalMinor,
+            currency: r.currency,
+            periodStart: r.periodStart?.toISOString() ?? null,
+            periodEnd: r.periodEnd?.toISOString() ?? null,
+            hostedUrl: r.hostedUrl,
+            pdfUrl: r.pdfUrl,
+            createdAt: r.createdAt.toISOString(),
+        }));
+    });
+}
+export { ser as serialiseSubscription };
+//# sourceMappingURL=subscriptions.js.map

package/dist/server/services/subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/server/services/subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAEL,aAAa,EAEb,eAAe,GAGhB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AASnC,MAAM,GAAG,GAAG,CACV,CAAoC,EACpC,IAA2C,EAC7B,EAAE,CAAC,CAAC;IAClB,WAAW,EAAE,CAAC,CAAC,WAA0C;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;IAC5B,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;IAC5B,MAAM,EAAE,CAAC,CAAC,MAA4B;IACtC,cAAc,EAAE,CAAC,CAAC,cAAc;IAChC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;IACjD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,IAAI;IAC3D,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;IACpC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;CAC7C,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,WAAmB;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACnC,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1E,IAAI,CAAC,aAAa,CAAC;SACnB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SACnD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACvG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAc,EACd,WAAmB,EACnB,KAAiD;IAEjD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7B,MAAM,EAAE;SACL,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC;SACrD,kBAAkB,CAAC;QAClB,MAAM,EAAE,aAAa,CAAC,WAAW;QACjC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;KACzC,CAAC,CAAA;IACJ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACnD,MAAM,MAAM,CAAC,IAAI,CACf,aAAa,CAAC,mBAAmB,EACjC,EAAE,WAAW,EAAE,WAA0C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EACzG,EAAE,WAAW,EAAE,CAChB,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,WAAmB,EACnB,MAAqB,EACrB,cAAuB;IAEvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;aACpC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACpD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE;QACjC,MAAM;QACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,qFAAqF;QACrF,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IACjF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC9C,MAAM,IAAI,GACR,OAAO,EAAE,WAAW,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,EAAE;QAChE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,WAAmB,EACnB,MAA8B;IAE9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,KAAK,WAAW;QACxB,MAAM,MAAM,CAAC,IAAI,CACf,aAAa,CAAC,qBAAqB,EACnC;YACE,WAAW,EAAE,WAA0C;YACvD,MAAM,EAAE,4CAA4C;SACrD,EACD,EAAE,WAAW,EAAE,CAChB,CAAA;IACH,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,WAAmB,EACnB,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7B,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;;QAE3F,MAAM,EAAE;aACL,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClF,kBAAkB,CAAC;YAClB,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SACtE,CAAC,CAAA;IACN,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC3C,6FAA6F;IAC7F,uCAAuC;IACvC,MAAM,MAAM,CAAC,IAAI,CACf,aAAa,CAAC,mBAAmB,EACjC;QACE,WAAW,EAAE,WAA0C;QACvD,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,UAAU;QAClC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;KACjC,EACD,EAAE,WAAW,EAAE,CAChB,CAAA;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,UAAkB,EAAE,QAAgB,EAAE,OAAgB,EAAE,KAAa;IACzF,MAAM,QAAQ,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAC/E,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,KAAiE;IAEjE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,sBAAsB,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1G,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAEjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SAClC,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC3C,IAAI,CAAC,aAAa,CAAC;SACnB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SACnD,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE7D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACjC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;SAC9C,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IAEzD,MAAM,IAAI,GAAwB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,SAAQ;QAC9D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,IAAI,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC;YACR,WAAW,EAAE,CAAC,CAAC,EAAsC;YACrD,aAAa,EAAE,CAAC,CAAC,IAAI;YACrB,aAAa,EAAE,CAAC,CAAC,IAAI;YACrB,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;YAC5B,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;YAC5B,MAAM,EAAG,GAAG,EAAE,GAAG,CAAC,MAA6B,IAAI,IAAI;YACvD,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,cAAc,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,IAAI,CAAC;YAC5C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;YACxD,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,IAAI;YAClE,YAAY,EAAE,IAAI;gBAChB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC;gBACnG,CAAC,CAAC,CAAC;YACL,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,KAAK;YACjC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;SACpD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,KAAa;IACnF,uEAAuE;IACvE,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;aACjC,KAAK,CAAC,KAAK,CAAC,CAAA;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAqC;YACpD,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;YACjD,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;YAC7C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,OAAO,EAAE,GAAG,IAAI,qBAAqB,EAAE,CAAA"}

package/dist/server/services/usage.d.ts

@@ -0,0 +1,40 @@
+import type { Kernel } from '@kernhq/kernel';
+/** What core reports when asked to recount a workspace from its own tables. */
+export interface CountedUsage {
+    seats: number;
+    storageBytes: number;
+}
+/**
+ * Move a counter by a delta.
+ *
+ * Arithmetic in SQL rather than read-modify-write in JavaScript: two members joining at once is the
+ * normal case, not a rare one, and the read-modify-write version loses one of them.
+ * `greatest(0, …)` because a counter that has drifted negative is a bug that must not also start
+ * refusing uploads — the nightly reconcile is what corrects it.
+ */
+export declare function bump(kernel: Kernel, workspaceId: string, delta: Partial<CountedUsage>): Promise<void>;
+/**
+ * Recount seats for one workspace and write the answer down.
+ *
+ * Seats are recounted rather than moved by a delta, because the events do not carry enough to do the
+ * arithmetic safely: `core.member.removed` does not say what role the person had, and
+ * `core.member.updated` does not say what role they had *before* — so a guest being promoted, or a
+ * member leaving, would each be counted wrongly. A count over one workspace's memberships is cheap;
+ * being wrong about what a customer is charged is not.
+ */
+export declare function recountSeats(kernel: Kernel, workspaceId: string): Promise<number>;
+export declare function read(kernel: Kernel, workspaceId: string): Promise<CountedUsage & {
+    updatedAt: Date;
+}>;
+/**
+ * Recount one workspace from core's own tables and write the answer down.
+ *
+ * Returns the drift it found. The caller logs it rather than swallowing it: a counter that keeps
+ * needing correction means an event is being missed somewhere, and silently fixing the number every
+ * night is how that goes unnoticed for a year.
+ */
+export declare function reconcile(kernel: Kernel, workspaceId: string): Promise<{
+    drift: CountedUsage;
+    counted: CountedUsage;
+}>;
+//# sourceMappingURL=usage.d.ts.map

package/dist/server/services/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../../src/server/services/usage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAI5C,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB;AAUD;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3G;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvF;AAED,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAW3G;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,CA2BzD"}