Billing and tenancy, exact by construction
Meter usage, price it to a fraction of a cent, keep a double-entry ledger, and hold every tenant’s boundary at the database — a family of Apache-2.0 libraries you embed in the app you already run. No revenue cut, no second service to operate.
keystoneA cent that can’t drift into a rounding error.
Amounts are integer minor units in a bigint — never a JavaScript number. Once a value passes through a float, an exact 19.99 and a drifted 19.99 are indistinguishable. billing-kit refuses the ambiguity at the type level.
- ✓Exact decimals, no float
- ✓ISO-4217 aware (JPY, KWD)
- ✓Rounds once, auditably
import { Money, Quantity, Rate, price } from '@quxkit/billing-kit'; const q = Quantity.fromDecimalString('1234567'); // tokens const r = Rate.fromDecimalString('0.00012'); // cents / token const { amount } = price(q, r, 'USD'); amount.toDecimalString(); // '1.48' — exactly
Built to meter billions of events.
One set-based pass in Postgres — FOR UPDATE SKIP LOCKED, batched, idempotent — so concurrent workers can never double-bill and a run is a bounded transaction no matter how much is due.
Every cent, traceable — and it still balances.
Append-only and double-entry. Positive is a debit, negative a credit, and a transaction’s legs sum to zero — enforced by a deferred trigger, not by hope. Cash reaches the ledger only from a verified payment, never a stray credit().
- ✓Append-only, trigger-enforced
- ✓Balanced per currency
- ✓Idempotent postings
“Whose rows” is a property of the connection.
tenant-kit holds isolation at the database: tenancy.protect() forces row-level security per table, and the scoped executor sets the tenant per transaction. The forgotten WHERE tenant_id — the classic multi-tenant leak — degrades from a breach into an empty result.
- ✓Forced RLS — owners included
- ✓Scope dies with its transaction
- ✓The tenantId billing-kit consumes
Drop billing into your app with one command.
Pricing tables, usage meters, a ledger explorer, checkout and a superadmin — installed with npx shadcn add, styled with your tokens, yours to own. Every amount renders through one Money formatter, never number math.
One stack, each kit owning one narrow thing.
Composed over shared shapes — one executor interface, one opaque tenant id, one Money type. What’s planned is labeled, not pre-announced as shipped.
billing-kitThe headless core: metering, exact pricing, double-entry ledger, providers.
Apache-2.0
tenant-kitTenant directory, request→tenant resolution, and row-level-security isolation — the tenantId billing-kit assumes, made true.
Communitybilling-kit-adaptersPayment-provider adapters beyond Stripe & Paddle, and the contract they conform to.
Communitytenant-kit-adaptersEnterprise SSO, SCIM provisioning, and RBAC-engine bridges over tenant-kit’s seams.
Per seatbilling-kit-componentsshadcn-compatible billing UI — pricing, usage, ledger, checkout — installed with npx shadcn add.
MCPbilling-kit-mcpExact money math for AI assistants over the Model Context Protocol.
Hostedbilling-kit cloudThe core, run for you: managed metering and settlement behind this portal.
AGPL-3.0
ai-memberA member that remembers: persona memory and a code graph, grounded in one prompt — the family’s AI teammate.
Commercialai-member-cloudThe hosted member’s control plane: authentication, tenancy and entitlements over the AGPL core.
Apache-2.0
identity-kitThe UserId the family consumes, produced honestly: accounts, argon2id credentials, revocable sessions — with MFA, API keys and social sign-in as opt-in entry points. This portal runs on it.
Open at the core. Priced where it’s hosted.
The libraries are Apache-2.0 and free forever. Pay only for the hosted service, or for the commercial UI — by the seat.
Self-host the Apache-2.0 core. Unlimited events, forever.
Hosted metering and ledger, managed for you.
The commercial UI library, per developer seat.
Start billing in minutes.
Precise money, a metering engine for scale, tenant boundaries the database holds, and the UI to show it — open source at the core.