openprofit 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Raphael Morency
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,95 @@
-# Temporary Holding Version
+# openprofit
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `openprofit` package is the command-line tool and local MCP server for [OpenProfit](https://openprofit.dev). Use it to sign in, connect revenue and cost providers with keys from your env files, and let coding agents work with your OpenProfit workspace without pasting keys into a chat. It needs Node.js 20 or later.
+
+## Sign in
+
+Run `login` once per server:
+
+```sh
+npx openprofit login
+```
+
+The command prints a code and opens your browser. After you approve the code, the CLI saves a token to `~/.config/openprofit/config.json` (or `$XDG_CONFIG_HOME/openprofit/config.json`) with file mode `0600`.
+
+To sign in to a self-hosted instance, pass its URL:
+
+```sh
+npx openprofit login --url https://profit.example.com
+```
+
+The config keeps one token per server URL, so hosted and self-hosted logins sit side by side. Commands pick the server from `--url`, then `OPENPROFIT_URL`, then the last server you signed in to, then `https://openprofit.dev`. Set `OPENPROFIT_TOKEN` to use a token without signing in, for example in CI.
+
+`openprofit whoami` shows the workspace and server in use. `openprofit logout` deletes the saved token for that server.
+
+## Connect a provider from an env file
+
+The `connect` command reads the key from an env file and sends it to OpenProfit. It never prints the key, error messages included:
+
+```sh
+npx openprofit connect stripe --env-file .env --key STRIPE_RESTRICTED_KEY
+```
+
+On success it prints `Connected Stripe (<label>), first sync started`. The options:
+
+- `--env-file path`: file to read variables from. Without it, the CLI reads the environment only
+- `--key NAME`: env var that holds the provider's secret key, for providers with one secret field
+- `--field field=NAME`: read any field from an env var. Repeat it for each field
+- `--value field=text`: set a non-secret field, such as a team id. The CLI refuses secret fields here so keys stay out of your shell history
+- `--product id`: assign the connection to a product
+
+Providers with several fields take one `--field` per field:
+
+```sh
+npx openprofit connect twilio --env-file .env \
+  --field accountSid=TWILIO_ACCOUNT_SID \
+  --field keySid=TWILIO_API_KEY_SID \
+  --field keySecret=TWILIO_API_KEY_SECRET
+```
+
+Use a restricted, read-only key when the provider offers one. The [integration pages](https://openprofit.dev/integrations) list the scopes each provider needs.
+
+## Use OpenProfit from a coding agent
+
+`openprofit mcp` runs a Model Context Protocol (MCP) server over stdio. It forwards the tools of your OpenProfit workspace and replaces `connect_provider` with a local version. The agent passes env var names, and the server reads the values on your machine. No tool takes a key value.
+
+When the agent calls `connect_provider` with only a provider, the server looks for known variable names such as `STRIPE_SECRET_KEY`, `OPENAI_ADMIN_KEY` and `VERCEL_TOKEN` in `.env` and `.env.local`. It reports the names it finds so the agent can confirm with you. If it finds none, it returns a one-time link where you enter the key in the browser.
+
+Run `npx openprofit login` before you add the server. Without a token, every tool replies with that instruction.
+
+### Claude Code
+
+Add the server from your project directory:
+
+```sh
+claude mcp add openprofit -- npx -y openprofit mcp
+```
+
+### Cursor
+
+Add the server to `.cursor/mcp.json` in your project, or to `~/.cursor/mcp.json` for every project:
+
+```json
+{
+  "mcpServers": {
+    "openprofit": {
+      "command": "npx",
+      "args": ["-y", "openprofit", "mcp"]
+    }
+  }
+}
+```
+
+### Claude Desktop
+
+Open **Settings > Developer > Edit Config** and add the same `mcpServers` entry to `claude_desktop_config.json`.
+
+### Env files outside the working directory
+
+The server resolves `.env` and `.env.local` against the directory the client starts it in. If the agent finds no keys although your project has them, ask it to pass the absolute path of your env file as `env_file`.
+
+For a self-hosted instance, add `"--url", "https://profit.example.com"` to `args`, or sign in to that instance last.
+
+## License
+
+MIT

package/dist/cli.js

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+import { parseArgs } from "node:util";
+import { connect, LOGIN_HINT, loadEnv, removeLogin, request, resolveServer, saveLogin, VERSION, } from "./lib.js";
+const HELP = {
+    main: `Usage: openprofit <command> [--url <url>]
+
+Commands:
+  login               Sign in through the browser and save a token
+  logout              Delete the saved token for this server
+  whoami              Show the workspace and server in use
+  connect <provider>  Connect a provider with a key from an env file
+  mcp                 Run the local MCP server over stdio
+
+Options:
+  --url <url>   Server to use. Default: OPENPROFIT_URL, then the last login,
+                then https://openprofit.dev
+  -h, --help    Show help for a command
+  -v, --version Show the version
+
+OPENPROFIT_TOKEN overrides the saved token.`,
+    login: `Usage: openprofit login [--url <url>]
+
+Opens the browser to approve a code, then saves a token in
+~/.config/openprofit/config.json.`,
+    logout: `Usage: openprofit logout [--url <url>]
+
+Deletes the saved token for the server.`,
+    whoami: `Usage: openprofit whoami [--url <url>]
+
+Shows the workspace and server the token belongs to.`,
+    connect: `Usage: openprofit connect <provider> [options]
+
+Reads the provider's key from an env file or the environment and sends it to
+OpenProfit. The CLI never prints the key.
+
+Options:
+  --env-file <path>     Read variables from this file. Default: the environment
+  --key <NAME>          Env var that holds the provider's secret key
+  --field <field=NAME>  Read a field from an env var (repeatable)
+  --value <field=text>  Set a non-secret field, such as a team id (repeatable)
+  --product <id>        Assign the connection to a product
+
+Example:
+  openprofit connect stripe --env-file .env --key STRIPE_RESTRICTED_KEY`,
+    mcp: `Usage: openprofit mcp [--url <url>]
+
+Runs an MCP server over stdio. It forwards OpenProfit's tools and replaces
+connect_provider with a version that reads keys from local env files.
+
+Claude Code:
+  claude mcp add openprofit -- npx -y openprofit mcp`,
+};
+function pairs(list, flag) {
+    const out = {};
+    for (const item of list ?? []) {
+        const i = item.indexOf("=");
+        if (i < 1)
+            throw new Error(`${flag} takes name=value, got "${item}".`);
+        out[item.slice(0, i)] = item.slice(i + 1);
+    }
+    return out;
+}
+function openBrowser(url) {
+    const cmd = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "explorer"
+            : "xdg-open";
+    spawn(cmd, [url], { stdio: "ignore", detached: true })
+        .on("error", () => { })
+        .unref();
+}
+async function login(url) {
+    const server = { ...resolveServer(url), token: undefined };
+    const start = await request(server, "POST", "/api/cli/login");
+    if (start.status !== 200 || !start.data.device_code) {
+        throw new Error(`${server.url} didn't start a login (HTTP ${start.status}).`);
+    }
+    const { device_code, user_code, verification_url } = start.data;
+    if (!/^https?:\/\//.test(verification_url)) {
+        throw new Error(`${server.url} sent an invalid verification URL.`);
+    }
+    console.log(`Code: ${user_code}`);
+    console.log(`Confirm it at ${verification_url}`);
+    if (process.stdout.isTTY)
+        openBrowser(verification_url);
+    const deadline = Date.now() + (start.data.expires_in ?? 600) * 1000;
+    while (Date.now() < deadline) {
+        await sleep((start.data.interval ?? 5) * 1000);
+        const poll = await request(server, "POST", "/api/cli/login/poll", { device_code });
+        if (poll.status === 202)
+            continue;
+        if (poll.status === 410)
+            break;
+        if (poll.status !== 200 || !poll.data.token || !poll.data.workspace) {
+            throw new Error(`Login failed (HTTP ${poll.status}).`);
+        }
+        saveLogin(server.url, poll.data.token, poll.data.workspace);
+        console.log(`Logged in to ${poll.data.workspace.name} (${poll.data.workspace.slug}) on ${server.url}`);
+        return;
+    }
+    throw new Error("The code expired. Run `openprofit login` again.");
+}
+async function whoami(url) {
+    const server = resolveServer(url);
+    if (!server.token)
+        throw new Error(`Not logged in to ${server.url}. ${LOGIN_HINT}`);
+    // Any authenticated call works; this one fails fast on a revoked token.
+    await request(server, "GET", "/api/providers");
+    const who = server.workspace
+        ? `${server.workspace.name} (${server.workspace.slug})`
+        : "OPENPROFIT_TOKEN";
+    console.log(`${who} on ${server.url}`);
+}
+async function main() {
+    const { values: flags, positionals } = parseArgs({
+        allowPositionals: true,
+        options: {
+            url: { type: "string" },
+            help: { type: "boolean", short: "h" },
+            version: { type: "boolean", short: "v" },
+            "env-file": { type: "string" },
+            key: { type: "string" },
+            field: { type: "string", multiple: true },
+            value: { type: "string", multiple: true },
+            product: { type: "string" },
+        },
+    });
+    const [command, ...args] = positionals;
+    if (flags.version)
+        return console.log(VERSION);
+    if (!command || flags.help) {
+        return console.log(HELP[command ?? "main"] ?? HELP.main);
+    }
+    switch (command) {
+        case "login":
+            return login(flags.url);
+        case "logout": {
+            const { url } = resolveServer(flags.url);
+            return console.log(removeLogin(url) ? `Logged out of ${url}` : `Not logged in to ${url}`);
+        }
+        case "whoami":
+            return whoami(flags.url);
+        case "connect": {
+            if (!args[0])
+                return console.log(HELP.connect);
+            const server = resolveServer(flags.url);
+            if (!server.token)
+                throw new Error(LOGIN_HINT);
+            const file = flags["env-file"];
+            const message = await connect(server, {
+                provider: args[0],
+                env: loadEnv(file ? [file] : []),
+                envLabel: file ? `${file} or the environment` : "the environment",
+                key: flags.key,
+                fields: pairs(flags.field, "--field"),
+                values: pairs(flags.value, "--value"),
+                productId: flags.product,
+            });
+            return console.log(message);
+        }
+        case "mcp": {
+            const { serveMcp } = await import("./mcp.js");
+            return serveMcp(resolveServer(flags.url));
+        }
+        default:
+            throw new Error(`Unknown command "${command}". Run \`openprofit --help\`.`);
+    }
+}
+main().catch((e) => {
+    console.error(`openprofit: ${e.message}`);
+    process.exit(1);
+});

package/dist/lib.js

@@ -0,0 +1,198 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+export const LOGIN_HINT = "Run `npx openprofit login` first.";
+const CONFIG_PATH = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "openprofit", "config.json");
+function readConfig() {
+    try {
+        return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+    }
+    catch {
+        return { servers: {} };
+    }
+}
+function writeConfig(config) {
+    mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+    writeFileSync(CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    // `mode` only applies when the file is created.
+    chmodSync(CONFIG_PATH, 0o600);
+}
+// --url, then OPENPROFIT_URL, then the last login, then the hosted app.
+export function resolveServer(flagUrl) {
+    const config = readConfig();
+    const url = (flagUrl ||
+        process.env.OPENPROFIT_URL ||
+        config.current ||
+        "https://openprofit.dev").replace(/\/+$/, "");
+    const entry = config.servers[url];
+    return {
+        url,
+        token: process.env.OPENPROFIT_TOKEN || entry?.token,
+        workspace: entry?.workspace,
+    };
+}
+export function saveLogin(url, token, workspace) {
+    const config = readConfig();
+    config.servers[url] = { url, token, workspace };
+    config.current = url;
+    writeConfig(config);
+}
+export function removeLogin(url) {
+    const config = readConfig();
+    if (!config.servers[url])
+        return false;
+    delete config.servers[url];
+    if (config.current === url)
+        delete config.current;
+    writeConfig(config);
+    return true;
+}
+// ---- HTTP
+export async function request(server, method, path, body) {
+    const res = await fetch(server.url + path, {
+        method,
+        headers: {
+            "content-type": "application/json",
+            ...(server.token && { authorization: `Bearer ${server.token}` }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    }).catch(() => {
+        throw new Error(`Can't reach ${server.url}.`);
+    });
+    if (res.status === 401) {
+        throw new Error(`${server.url} rejected the token. ${LOGIN_HINT}`);
+    }
+    const data = (await res.json().catch(() => ({})));
+    return { status: res.status, data };
+}
+// ---- Env files
+// Parses dotenv syntax: `export` prefix, comments, single, double and
+// backtick quotes (quoted values may span lines; double quotes expand \n,
+// \r, \t, \" and \\). An unquoted value ends at a ` #` comment.
+export function parseEnv(src) {
+    const out = {};
+    const line = /^[ \t]*(?:export[ \t]+)?([A-Za-z_][\w.-]*)[ \t]*=[ \t]*("(?:\\[\s\S]|[^"\\])*"|'[^']*'|`[^`]*`|[^\r\n]*)/gm;
+    const escapes = { n: "\n", r: "\r", t: "\t" };
+    for (const [, key, raw] of src.matchAll(line)) {
+        const quote = raw[0];
+        if (quote === '"') {
+            out[key] = raw
+                .slice(1, -1)
+                .replace(/\\(.)/g, (_, c) => escapes[c] ?? c);
+        }
+        else if (quote === "'" || quote === "`") {
+            out[key] = raw.slice(1, -1);
+        }
+        else {
+            out[key] = raw.replace(/(^|[ \t]+)#.*$/, "").trim();
+        }
+    }
+    return out;
+}
+// Variables from the files (later files win) over the process environment.
+// `optional` skips files that don't exist.
+export function loadEnv(files, optional = false) {
+    const env = { ...process.env };
+    for (const file of files) {
+        try {
+            Object.assign(env, parseEnv(readFileSync(file, "utf8")));
+        }
+        catch (e) {
+            if (!(optional && e.code === "ENOENT")) {
+                throw new Error(`Can't read ${file}`);
+            }
+        }
+    }
+    return env;
+}
+// Env var names that usually hold each provider's secret key.
+export const KNOWN_ENV = {
+    stripe: ["STRIPE_RESTRICTED_KEY", "STRIPE_SECRET_KEY", "STRIPE_API_KEY"],
+    polar: ["POLAR_ACCESS_TOKEN"],
+    openai: ["OPENAI_ADMIN_KEY", "OPENAI_API_KEY"],
+    anthropic: ["ANTHROPIC_ADMIN_KEY"],
+    vercel: ["VERCEL_TOKEN"],
+    cloudflare: ["CLOUDFLARE_API_TOKEN"],
+    railway: ["RAILWAY_TOKEN", "RAILWAY_API_TOKEN"],
+};
+export async function getProvider(server, id) {
+    const { status, data } = await request(server, "GET", "/api/providers");
+    if (status !== 200 || !Array.isArray(data)) {
+        throw new Error(`Couldn't list providers (HTTP ${status}).`);
+    }
+    const provider = data.find((p) => p.id === id.toLowerCase());
+    if (!provider) {
+        const ids = data.map((p) => p.id).join(", ");
+        throw new Error(`Unknown provider "${id}". Available: ${ids}.`);
+    }
+    return provider;
+}
+export function describeFields(provider) {
+    return provider.fields
+        .map((f) => `${f.name}${f.secret ? " (secret)" : ""}${f.optional ? " (optional)" : ""}`)
+        .join(", ");
+}
+// Builds the credentials from env vars and POSTs them. Error messages name
+// fields and env vars but never include a value.
+export async function connect(server, input) {
+    const provider = await getProvider(server, input.provider);
+    const field = (name) => {
+        const f = provider.fields.find((f) => f.name === name);
+        if (!f) {
+            throw new Error(`${provider.name} has no field "${name}". Fields: ${describeFields(provider)}.`);
+        }
+        return f;
+    };
+    const fields = { ...input.fields };
+    if (input.key) {
+        const secret = provider.fields.filter((f) => f.secret);
+        if (secret.length !== 1) {
+            throw new Error(`${provider.name} has ${secret.length} secret fields, so --key is ambiguous. Map each one with --field. Fields: ${describeFields(provider)}.`);
+        }
+        fields[secret[0].name] ??= input.key;
+    }
+    const credentials = {};
+    for (const [name, envName] of Object.entries(fields)) {
+        field(name);
+        const value = input.env[envName];
+        if (!value)
+            throw new Error(`${envName} is not set in ${input.envLabel}.`);
+        credentials[name] = value;
+    }
+    for (const [name, value] of Object.entries(input.values)) {
+        if (field(name).secret) {
+            throw new Error(`${name} is a secret field. Pass the name of an env var that holds it instead of the value.`);
+        }
+        credentials[name] = value;
+    }
+    const missing = provider.fields.filter((f) => !f.optional && !credentials[f.name]);
+    if (missing.length) {
+        throw new Error(`Missing ${missing.map((f) => f.name).join(", ")}. ${provider.name} fields: ${describeFields(provider)}.`);
+    }
+    const { status, data } = await request(server, "POST", "/api/connections", {
+        provider: provider.id,
+        credentials,
+        ...(input.productId && { product_id: input.productId }),
+    });
+    if (status !== 201 || !data.connection) {
+        const secrets = provider.fields
+            .filter((f) => f.secret && credentials[f.name])
+            .map((f) => credentials[f.name]);
+        throw new Error(scrub(data.error ?? `Connecting failed (HTTP ${status}).`, secrets));
+    }
+    return `Connected ${provider.name} (${data.connection.label}), first sync started`;
+}
+// Drops a server message that quotes 8 or more characters of a secret.
+function scrub(message, secrets) {
+    const leaks = secrets.some((s) => {
+        for (let i = 0; i + 8 <= s.length; i++) {
+            if (message.includes(s.slice(i, i + 8)))
+                return true;
+        }
+        return message.includes(s);
+    });
+    return leaks ? "OpenProfit rejected the credentials." : message;
+}

package/dist/mcp.js

@@ -0,0 +1,151 @@
+// Local stdio MCP server. It forwards the remote OpenProfit tools and
+// replaces connect_provider with a version that reads keys from env files
+// on this machine, so key values never pass through the agent.
+import { Client, UrlElicitationRequiredError as RemoteUrlElicitationRequired, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
+import { fromJsonSchema, McpServer, UrlElicitationRequiredError, } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { z } from "zod";
+import { connect, describeFields, getProvider, KNOWN_ENV, LOGIN_HINT, loadEnv, VERSION, } from "./lib.js";
+const INSTRUCTIONS = `OpenProfit shows revenue, costs and profit per product.
+
+To add a provider such as Stripe or OpenAI, call connect_provider. Never ask the user to paste an API key into the chat: pass env var names and this server reads the values from env files on this machine. Suggest a restricted or read-only key when the provider offers one. If connect_provider finds no key, it returns a one-time link. Show the link to the user, then call connection_status with its link_id until the connection appears.`;
+const CONNECT_DESCRIPTION = `Connect a provider (stripe, openai, vercel...) to the OpenProfit workspace. Pass env var names, never key values: this server reads the values from local env files.
+
+Call it with only \`provider\` first. It lists the known env vars it found in .env and .env.local, plus the provider's fields. After the user picks one, call it again with \`fields\`, such as {"key": "STRIPE_RESTRICTED_KEY"}. If it finds no key, it returns a one-time link where the user enters the key in the browser.`;
+const text = (message, isError = false) => ({
+    content: [{ type: "text", text: message }],
+    isError,
+});
+// https://ts.sdk.modelcontextprotocol.io/v2/clients/connect.html
+async function connectRemote(server) {
+    const client = new Client({ name: "openprofit-cli", version: VERSION });
+    await client.connect(new StreamableHTTPClientTransport(new URL(`${server.url}/mcp`), {
+        authProvider: { token: async () => server.token },
+    }));
+    const tools = [];
+    let cursor;
+    do {
+        const page = await client.listTools({ cursor });
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+    } while (cursor);
+    return { client, tools };
+}
+async function forward(remote, name, args) {
+    try {
+        return await remote.client.callTool({ name, arguments: args });
+    }
+    catch (e) {
+        // Pass a URL elicitation (-32042) on to the host unchanged; McpServer
+        // rethrows this error instead of turning it into a tool error.
+        // https://ts.sdk.modelcontextprotocol.io/v2/servers/elicitation.html
+        if (e instanceof RemoteUrlElicitationRequired) {
+            throw new UrlElicitationRequiredError(e.elicitations, e.message);
+        }
+        throw e;
+    }
+}
+export function serveMcp(server) {
+    // One remote connection per process, shared by every factory call.
+    const remote = server.token
+        ? connectRemote(server).catch((e) => {
+            // stdout carries JSON-RPC, so log to stderr.
+            console.error(`openprofit: ${server.url}/mcp: ${e.message}`);
+            return undefined;
+        })
+        : undefined;
+    // https://ts.sdk.modelcontextprotocol.io/v2/serving/stdio.html
+    const handle = serveStdio(async () => {
+        const mcp = new McpServer({ name: "openprofit", version: VERSION }, { instructions: INSTRUCTIONS });
+        const r = await remote;
+        // ponytail: tools are listed once at startup; restart the server to
+        // pick up new remote tools, or handle tools/list_changed if that matters.
+        for (const tool of r?.tools ?? []) {
+            if (tool.name === "connect_provider")
+                continue;
+            mcp.registerTool(tool.name, {
+                title: tool.title,
+                description: tool.description,
+                inputSchema: fromJsonSchema(tool.inputSchema),
+                outputSchema: tool.outputSchema &&
+                    fromJsonSchema(tool.outputSchema),
+                annotations: tool.annotations,
+            }, (args) => forward(r, tool.name, args));
+        }
+        // Tool annotations: https://ts.sdk.modelcontextprotocol.io/v2/servers/tools.html
+        mcp.registerTool("connect_provider", {
+            title: "Connect a provider",
+            description: CONNECT_DESCRIPTION,
+            inputSchema: z.object({
+                provider: z
+                    .string()
+                    .describe("Provider id, such as stripe or openai"),
+                env_file: z
+                    .string()
+                    .optional()
+                    .describe("Env file to read, relative to the working directory. Default: .env and .env.local"),
+                fields: z
+                    .record(z.string(), z.string())
+                    .optional()
+                    .describe('Provider field name to env var name, such as {"key": "STRIPE_RESTRICTED_KEY"}'),
+                values: z
+                    .record(z.string(), z.string())
+                    .optional()
+                    .describe("Values for non-secret fields, such as a team id. Secret fields are rejected here."),
+                product_id: z
+                    .string()
+                    .optional()
+                    .describe("Product to assign the connection to"),
+            }),
+            annotations: {
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: true,
+            },
+        }, async ({ provider, env_file, fields, values, product_id }) => {
+            if (!server.token)
+                return text(LOGIN_HINT, true);
+            const files = env_file ? [env_file] : [".env", ".env.local"];
+            const env = loadEnv(files, !env_file);
+            const where = `${files.join(", ")} or the environment`;
+            if (fields || values) {
+                const message = await connect(server, {
+                    provider,
+                    env,
+                    envLabel: where,
+                    fields: fields ?? {},
+                    values: values ?? {},
+                    productId: product_id,
+                });
+                return text(`${message}.`);
+            }
+            const p = await getProvider(server, provider);
+            const found = (KNOWN_ENV[p.id] ?? []).filter((name) => env[name]);
+            if (found.length) {
+                const secret = p.fields.find((f) => f.secret)?.name ?? "key";
+                return text(`Found ${found.join(", ")} in ${where}. ${p.name} fields: ${describeFields(p)}. Ask the user which variable to use, then call connect_provider again with fields {"${secret}": "<ENV_VAR>"}.`);
+            }
+            if (!r)
+                throw new Error(`Can't reach ${server.url}/mcp to create a link.`);
+            const result = await forward(r, "connect_provider", {
+                provider: p.id,
+                ...(product_id && { product_id }),
+            });
+            if (result.isError)
+                return result;
+            return {
+                ...result,
+                content: [
+                    {
+                        type: "text",
+                        text: `No ${p.name} key in ${where}. Show the user this link to enter the key in the browser, then call connection_status with the link_id.`,
+                    },
+                    ...result.content,
+                ],
+            };
+        });
+        return mcp;
+    });
+    process.on("SIGINT", () => void handle.close());
+}

package/package.json

@@ -1,6 +1,34 @@
 {
-  "name": "openprofit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "openprofit",
+	"version": "0.1.0",
+	"description": "OpenProfit CLI and local MCP server",
+	"license": "MIT",
+	"homepage": "https://openprofit.dev",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/lobbystack/openprofit.git",
+		"directory": "packages/cli"
+	},
+	"type": "module",
+	"bin": {
+		"openprofit": "dist/cli.js"
+	},
+	"files": ["dist"],
+	"engines": {
+		"node": ">=20"
+	},
+	"scripts": {
+		"build": "tsc -p .",
+		"test": "node --test test/",
+		"prepack": "tsc -p ."
+	},
+	"dependencies": {
+		"@modelcontextprotocol/client": "^2.3.1",
+		"@modelcontextprotocol/server": "^2.3.1",
+		"zod": "^4.6.5"
+	},
+	"devDependencies": {
+		"@types/node": "^22.20.5",
+		"typescript": "^6.0.3"
+	}
+}