The family, mapped
Every kit is a library you embed — Apache-2.0 at the core, on the database and provider you already run. Each section links to the canonical README; this page is the map, not a mirror.
billing-kit
Apache-2.0$ npm i @quxkit/billing-kitThe headless core: metering, exact pricing, double-entry ledger, providers.
- Meter usage events idempotently — retries and replays converge, concurrent workers never double-bill.
- Price quantities exactly: integer minor units in a bigint, correct for every ISO-4217 currency.
- Post every movement to an append-only double-entry ledger, balanced by a deferred constraint at COMMIT.
- Settle closed periods through Stripe, Paddle, or any adapter — the core branches on capabilities, never a provider name.
tenant-kit
Apache-2.0$ npm i @quxkit/tenant-kitTenant directory, request→tenant resolution, and row-level-security isolation — the tenantId billing-kit assumes, made true.
- A tenant directory: DNS-label slugs, memberships with three roles, archive-never-delete.
- Resolution split into untrusted extraction and membership-checked authorization — "trust the subdomain" is not expressible by accident.
- Row-level-security isolation: tenancy.protect() forces RLS per table; the scoped executor sets the tenant per transaction.
- The tenantId billing-kit consumes, produced honestly: same SqlExecutor, same opaque id, one pool for both.
billing-kit-adapters
CommunityPayment-provider adapters beyond Stripe & Paddle, and the contract they conform to.
- Payment providers beyond Stripe & Paddle, each conforming to the BillingProvider contract.
- A conformance testkit: every ensure* and settle proves idempotency before an adapter lands.
tenant-kit-adapters
CommunityEnterprise SSO, SCIM provisioning, and RBAC-engine bridges over tenant-kit’s seams.
- Enterprise SSO over any OIDC IdP: per-tenant connections, group→role mapping, JIT provisioning.
- SCIM 2.0 provisioning: the directory offboards someone, they are out of your product the same hour.
- RBAC bridges: memberships mirrored into OpenFGA/SpiceDB-style engines as convergent desired-state sync.
- The one rule: adapters never verify credentials — input is your verifier’s output.
billing-kit-components
Per seat$ npx shadcn add …shadcn-compatible billing UI — pricing, usage, ledger, checkout — installed with npx shadcn add.
- Pricing tables, usage meters, ledger views, checkout — shadcn-compatible, themeable, yours after install.
billing-kit-mcp
MCPExact money math for AI assistants over the Model Context Protocol.
- Exact Money math for AI assistants over the Model Context Protocol — the same types the core bills with.
billing-kit cloud
HostedThe core, run for you: managed metering and settlement behind this portal.
- The core, run for you: managed metering and settlement behind this portal, from $49/mo.
ai-member
AGPL-3.0A member that remembers: persona memory and a code graph, grounded in one prompt — the family’s AI teammate.
- A member that remembers: what it knows about you (a distilled persona), what it knows about your code (a hybrid vector + lexical graph), and a conversation grounded in both.
- AGPL-3.0 open core; binds to localhost and holds one person’s memory of their own machine.
ai-member-cloud
CommercialThe hosted member’s control plane: authentication, tenancy and entitlements over the AGPL core.
- The commercial control plane for the hosted member: authentication, tenancy and entitlements — everything the localhost core deliberately does not have.
- Proprietary; documented in its own repository rather than on this site.
identity-kit
Apache-2.0$ npm i @quxkit/identity-kitThe UserId the family consumes, produced honestly: accounts, argon2id credentials, revocable sessions — with MFA, API keys and social sign-in as opt-in entry points. This portal runs on it.
- Accounts, credentials and sessions as a library: signup, login, email verification, password reset — argon2id with an app-held pepper, server-side revocable sessions.
- Produces the opaque UserId the rest of the family consumes, over the same SqlExecutor seam; an identity schema in its own namespace.
- MFA, API keys and Sign in with Google/Apple ship as opt-in entry points, not defaults.
- This portal dogfoods it: the login, signup and verify-email flows run on identity-kit.