@absolutejs/billing 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -0,0 +1,87 @@
+# Changelog
+
+All notable changes to `@absolutejs/billing`.
+
+This file is generated by `absolute-changelog` from the entries in
+`changelog/`. Edit an entry, not this file — and add new ones under
+`changelog/unreleased/`.
+
+## 0.8.0 — 2026-09-11
+
+### Added
+
+- **Add single-use purchase-only checkout handoffs with hashed capabilities, account binding and CSRF verification**
+
+## 0.7.0 — 2026-09-11
+
+### Added
+
+- **Add durable prepaid credit accounts, reservations, and capped idempotent work settlement**
+
+---
+
+## Earlier releases
+
+# @absolutejs/billing changelog
+
+## 0.1.0 — 2026-05-31
+
+Initial release. Closes G13 from the second-pass PaaS audit — the
+substrate now has a pure cost-model layer between
+`@absolutejs/metering` and any invoicing backend.
+
+### Added
+
+- **`createPlan({ name, basePriceMicros?, pricedDimensions,
+currency?, rounding?, minimumChargeMicros?, metadata? })`** —
+  declarative pricing config. Validates tiered dimensions at
+  construction: non-empty, final tier must be `upTo: Infinity`,
+  bounds must be monotonically non-decreasing.
+- **`computeInvoice({ plan, period, tenant, usage, currency? })`**
+  — pure function. Returns `{ tenant, plan, currency, period,
+lineItems, totalMicros, totalUnits, metadata? }`.
+- **Three pricing shapes** per dimension: flat `perUnitMicros`,
+  graduated `tiers`, or custom `price(quantity) => micros`.
+- **`freeTier`** per dimension subtracted before pricing.
+- **`unit`** divisor so `bytesEgress` priced as MB ↔ `unit:
+1024*1024`.
+- **Rounding modes**: `'truncate'` (default — sub-cent → $0.00 to
+  match operator intuition) and `'round-half-up'`.
+- **`minimumChargeMicros`** floor with an explicit
+  `'minimum-charge-adjustment'` line item that captures the gap
+  (transparent, not magical).
+- **`formatMicros(amount, currency, { minorUnits? })`** — pure
+  string formatter, honors zero-minor-unit currencies (JPY etc.).
+- **All money in integer micros** (1/1,000,000 of a unit) — same
+  denomination Stripe uses internally. Float drift structurally
+  impossible.
+
+### Design notes
+
+- Pure functions throughout — no IO, no SDK peers, no side effects.
+  The control plane can preview invoices, re-price past periods
+  under a proposed plan, and dry-run plan changes without touching
+  any external system.
+- Invoice push (Stripe, QuickBooks, mailed PDF) lives OUTSIDE this
+  package in `@absolutejs/billing-adapters/*`.
+- Substrate is intentionally policy-free: it doesn't pick the plan
+  for a tenant, doesn't fetch usage, doesn't store invoices. Those
+  are control-plane concerns.
+
+### Tests
+
+34 covering: tier validation; flat per-unit; zero / missing /
+negative / NaN usage; free tier (below / above / at boundary);
+unit divisor + truncation + round-half-up; tiered (single band /
+multi-band / unbounded final); tiered + free tier composition;
+custom price fn; chargedQuantity passed to custom fn; base fee
+emission + suppression-when-zero; minimum-charge top-up + no-op
+when above floor; currency defaults + override; metadata
+flow-through; realistic full-Usage shape; label override;
+formatMicros (whole / sub-cent / negative / zero-minor-unit).
+
+### License
+
+BSL-1.1 with named carveout against hosted SaaS-billing platforms
+(Metronome, Orb, Lago, Stripe Billing, m3ter, Chargebee). Change
+date: 2030-05-31 (Apache 2.0).

package/README.md

@@ -1,6 +1,6 @@
 # `@absolutejs/billing`
 
-> Cost-model substrate for the AbsoluteJS PaaS.
+> Provider-neutral pricing and invoice computation used by the hosted AbsoluteJS.ai platform.
 
 `@absolutejs/billing` is the pure-function layer between
 `@absolutejs/metering` (which collects usage events) and an
@@ -94,3 +94,11 @@ mailed-PDF generator) lives outside this package, in
 BSL-1.1 with named carveout against hosted SaaS billing platforms
 (Metronome, Orb, Lago, Stripe Billing, m3ter, Chargebee). See
 `LICENSE`. Change date: **2030-05-31** → Apache 2.0.
+
+## Prepaid service credits
+
+[Durable balances, reservations, capped work, and migration rules](docs/prepaid-credits.md) are available through the `prepaid`, `prepaid-postgres`, and `credit-work` subpaths.
+
+## Secure credit checkout
+
+[Purchase-only handoffs](docs/checkout-handoffs.md) provide expiring, single-use browser capabilities without a full login session.

package/changelog.json

@@ -0,0 +1,26 @@
+{
+  "contract": 1,
+  "name": "@absolutejs/billing",
+  "releases": [
+    {
+      "version": "0.8.0",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add single-use purchase-only checkout handoffs with hashed capabilities, account binding and CSRF verification"
+        }
+      ]
+    },
+    {
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add durable prepaid credit accounts, reservations, and capped idempotent work settlement"
+        }
+      ],
+      "date": "2026-09-11",
+      "version": "0.7.0"
+    }
+  ]
+}

package/dist/checkoutHandoff.d.ts

@@ -0,0 +1,39 @@
+import type { CreditSqlClient } from "./prepaidPostgres";
+export type CheckoutQuote = {
+    productId: string;
+    amountCents: number;
+    currency: string;
+    credits: number;
+};
+export type CheckoutHandoff = {
+    id: string;
+    accountId: string;
+    quote: CheckoutQuote;
+    expiresAt: number;
+};
+/** Apply explicitly during deployment. Secrets are stored only as SHA-256 hashes. */
+export declare const checkoutHandoffPostgresSchemaSql: () => string;
+/** This is a purchase-only capability, never a login or a saved-card authorization.
+ * The application binds the authenticated account and prices the quote. */
+export declare const createPostgresCheckoutHandoffs: (db: CreditSqlClient, now?: () => number) => {
+    issue(accountId: string, quote: CheckoutQuote): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        code: string;
+        expiresAt: number;
+    }>;
+    /** Invoke only on a deliberate same-origin POST, never a preview GET.
+     * Atomic exchange makes concurrent redemption and link replay fail closed. */
+    exchange(code: string, browserAccountId?: string | null): Promise<{
+        handoff: CheckoutHandoff;
+        session: string;
+        csrf: string;
+        expiresAt: number;
+    } | null>;
+    authorize(session: string, csrf: string, browserAccountId?: string | null): Promise<CheckoutHandoff | null>;
+    /** Public IDs are not capabilities: status always requires account binding. */
+    get(accountId: string, id: string): Promise<CheckoutHandoff | null>;
+};
+/** Put the code in a fragment so previews, servers and referrers don't receive it.
+ * The landing page must remove it before loading any third-party code. */
+export declare const checkoutHandoffUrl: (landingUrl: string, code: string) => string;
+export declare const checkoutSameOrigin: (request: Request, origin: string) => boolean;

package/dist/checkoutHandoff.js

@@ -0,0 +1,108 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/checkoutHandoff.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+var lifetimeMs = 15 * 60 * 1000;
+var hash = (secret) => createHash("sha256").update(secret).digest("hex");
+var secret = () => randomBytes(32).toString("base64url");
+var validSecret = (value) => /^[A-Za-z0-9_-]{43}$/.test(value);
+var validQuote = (value) => typeof value.productId === "string" && value.productId.length > 0 && value.productId.length <= 128 && Number.isSafeInteger(value.amountCents) && value.amountCents > 0 && /^[A-Z]{3}$/.test(value.currency) && Number.isSafeInteger(value.credits) && value.credits > 0;
+var checkoutHandoffPostgresSchemaSql = () => `
+CREATE SCHEMA IF NOT EXISTS billing_checkout;
+CREATE TABLE IF NOT EXISTS billing_checkout.handoffs (
+ id text PRIMARY KEY, account_id text NOT NULL, quote jsonb NOT NULL,
+ code_hash text NOT NULL UNIQUE, expires_at bigint NOT NULL,
+ session_hash text UNIQUE, csrf_hash text, session_expires_at bigint
+);
+CREATE INDEX IF NOT EXISTS handoffs_account ON billing_checkout.handoffs(account_id, id);
+`;
+var decode = (row) => {
+  if (!row)
+    return null;
+  const quote = row.quote;
+  if (!quote || typeof quote !== "object" || !("productId" in quote) || !("amountCents" in quote) || !("currency" in quote) || !("credits" in quote) || typeof quote.productId !== "string" || typeof quote.amountCents !== "number" || typeof quote.currency !== "string" || typeof quote.credits !== "number" || typeof row.id !== "string" || typeof row.account_id !== "string")
+    throw new Error("Invalid checkout record");
+  const parsed = {
+    productId: quote.productId,
+    amountCents: quote.amountCents,
+    currency: quote.currency,
+    credits: quote.credits
+  };
+  if (!validQuote(parsed))
+    throw new Error("Invalid checkout quote");
+  return {
+    id: row.id,
+    accountId: row.account_id,
+    quote: parsed,
+    expiresAt: Number(row.expires_at)
+  };
+};
+var createPostgresCheckoutHandoffs = (db, now = Date.now) => ({
+  async issue(accountId, quote) {
+    if (!accountId || !validQuote(quote))
+      throw new Error("Invalid checkout request");
+    const code = secret();
+    const id = randomUUID();
+    const expiresAt = now() + lifetimeMs;
+    await db.query(`INSERT INTO billing_checkout.handoffs(id,account_id,quote,code_hash,expires_at) VALUES ($1,$2,$3::jsonb,$4,$5)`, [id, accountId, JSON.stringify(quote), hash(code), expiresAt]);
+    return { id, code, expiresAt };
+  },
+  async exchange(code, browserAccountId = null) {
+    if (!validSecret(code))
+      return null;
+    const session = secret();
+    const csrf = secret();
+    const expiresAt = now() + lifetimeMs;
+    const { rows } = await db.query(`UPDATE billing_checkout.handoffs SET session_hash=$2,csrf_hash=$3,session_expires_at=$4 WHERE code_hash=$1 AND session_hash IS NULL AND expires_at>$5 AND ($6::text IS NULL OR account_id=$6) RETURNING *`, [
+      hash(code),
+      hash(session),
+      hash(csrf),
+      expiresAt,
+      now(),
+      browserAccountId
+    ]);
+    const handoff = decode(rows[0]);
+    return handoff ? { handoff, session, csrf, expiresAt } : null;
+  },
+  async authorize(session, csrf, browserAccountId = null) {
+    if (!validSecret(session) || !validSecret(csrf))
+      return null;
+    const { rows } = await db.query(`SELECT * FROM billing_checkout.handoffs WHERE session_hash=$1 AND csrf_hash=$2 AND session_expires_at>$3 AND ($4::text IS NULL OR account_id=$4)`, [hash(session), hash(csrf), now(), browserAccountId]);
+    return decode(rows[0]);
+  },
+  async get(accountId, id) {
+    const { rows } = await db.query(`SELECT * FROM billing_checkout.handoffs WHERE id=$1 AND account_id=$2`, [id, accountId]);
+    return decode(rows[0]);
+  }
+});
+var checkoutHandoffUrl = (landingUrl, code) => {
+  const url = new URL(landingUrl);
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || !validSecret(code))
+    throw new Error("Invalid checkout landing URL");
+  url.hash = code;
+  return url.href;
+};
+var checkoutSameOrigin = (request, origin) => request.method === "POST" && request.headers.get("origin") === new URL(origin).origin && [null, "same-origin"].includes(request.headers.get("sec-fetch-site"));
+export {
+  checkoutHandoffPostgresSchemaSql,
+  checkoutHandoffUrl,
+  checkoutSameOrigin,
+  createPostgresCheckoutHandoffs
+};
+
+//# debugId=F96D1D9F1E1CA67A64756E2164756E21
+//# sourceMappingURL=checkoutHandoff.js.map

package/dist/checkoutHandoff.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/checkoutHandoff.ts"],
+  "sourcesContent": [
+    "import { createHash, randomBytes, randomUUID } from \"node:crypto\";\nimport type { CreditSqlClient } from \"./prepaidPostgres\";\n\nexport type CheckoutQuote = {\n  productId: string;\n  amountCents: number;\n  currency: string;\n  credits: number;\n};\nexport type CheckoutHandoff = {\n  id: string;\n  accountId: string;\n  quote: CheckoutQuote;\n  expiresAt: number;\n};\nconst lifetimeMs = 15 * 60 * 1000;\nconst hash = (secret: string) =>\n  createHash(\"sha256\").update(secret).digest(\"hex\");\nconst secret = () => randomBytes(32).toString(\"base64url\");\nconst validSecret = (value: string) => /^[A-Za-z0-9_-]{43}$/.test(value);\nconst validQuote = (value: CheckoutQuote) =>\n  typeof value.productId === \"string\" &&\n  value.productId.length > 0 &&\n  value.productId.length <= 128 &&\n  Number.isSafeInteger(value.amountCents) &&\n  value.amountCents > 0 &&\n  /^[A-Z]{3}$/.test(value.currency) &&\n  Number.isSafeInteger(value.credits) &&\n  value.credits > 0;\n\n/** Apply explicitly during deployment. Secrets are stored only as SHA-256 hashes. */\nexport const checkoutHandoffPostgresSchemaSql = () => `\nCREATE SCHEMA IF NOT EXISTS billing_checkout;\nCREATE TABLE IF NOT EXISTS billing_checkout.handoffs (\n id text PRIMARY KEY, account_id text NOT NULL, quote jsonb NOT NULL,\n code_hash text NOT NULL UNIQUE, expires_at bigint NOT NULL,\n session_hash text UNIQUE, csrf_hash text, session_expires_at bigint\n);\nCREATE INDEX IF NOT EXISTS handoffs_account ON billing_checkout.handoffs(account_id, id);\n`;\nconst decode = (\n  row: Record<string, unknown> | undefined,\n): CheckoutHandoff | null => {\n  if (!row) return null;\n  const quote = row.quote;\n  if (\n    !quote ||\n    typeof quote !== \"object\" ||\n    !(\"productId\" in quote) ||\n    !(\"amountCents\" in quote) ||\n    !(\"currency\" in quote) ||\n    !(\"credits\" in quote) ||\n    typeof quote.productId !== \"string\" ||\n    typeof quote.amountCents !== \"number\" ||\n    typeof quote.currency !== \"string\" ||\n    typeof quote.credits !== \"number\" ||\n    typeof row.id !== \"string\" ||\n    typeof row.account_id !== \"string\"\n  )\n    throw new Error(\"Invalid checkout record\");\n  const parsed = {\n    productId: quote.productId,\n    amountCents: quote.amountCents,\n    currency: quote.currency,\n    credits: quote.credits,\n  };\n  if (!validQuote(parsed)) throw new Error(\"Invalid checkout quote\");\n  return {\n    id: row.id,\n    accountId: row.account_id,\n    quote: parsed,\n    expiresAt: Number(row.expires_at),\n  };\n};\n/** This is a purchase-only capability, never a login or a saved-card authorization.\n * The application binds the authenticated account and prices the quote. */\nexport const createPostgresCheckoutHandoffs = (\n  db: CreditSqlClient,\n  now = Date.now,\n) => ({\n  async issue(accountId: string, quote: CheckoutQuote) {\n    if (!accountId || !validQuote(quote))\n      throw new Error(\"Invalid checkout request\");\n    const code = secret();\n    const id = randomUUID();\n    const expiresAt = now() + lifetimeMs;\n    await db.query(\n      `INSERT INTO billing_checkout.handoffs(id,account_id,quote,code_hash,expires_at) VALUES ($1,$2,$3::jsonb,$4,$5)`,\n      [id, accountId, JSON.stringify(quote), hash(code), expiresAt],\n    );\n    return { id, code, expiresAt };\n  },\n  /** Invoke only on a deliberate same-origin POST, never a preview GET.\n   * Atomic exchange makes concurrent redemption and link replay fail closed. */\n  async exchange(code: string, browserAccountId: string | null = null) {\n    if (!validSecret(code)) return null;\n    const session = secret();\n    const csrf = secret();\n    const expiresAt = now() + lifetimeMs;\n    const { rows } = await db.query(\n      `UPDATE billing_checkout.handoffs SET session_hash=$2,csrf_hash=$3,session_expires_at=$4 WHERE code_hash=$1 AND session_hash IS NULL AND expires_at>$5 AND ($6::text IS NULL OR account_id=$6) RETURNING *`,\n      [\n        hash(code),\n        hash(session),\n        hash(csrf),\n        expiresAt,\n        now(),\n        browserAccountId,\n      ],\n    );\n    const handoff = decode(rows[0]);\n    return handoff ? { handoff, session, csrf, expiresAt } : null;\n  },\n  async authorize(\n    session: string,\n    csrf: string,\n    browserAccountId: string | null = null,\n  ) {\n    if (!validSecret(session) || !validSecret(csrf)) return null;\n    const { rows } = await db.query(\n      `SELECT * FROM billing_checkout.handoffs WHERE session_hash=$1 AND csrf_hash=$2 AND session_expires_at>$3 AND ($4::text IS NULL OR account_id=$4)`,\n      [hash(session), hash(csrf), now(), browserAccountId],\n    );\n    return decode(rows[0]);\n  },\n  /** Public IDs are not capabilities: status always requires account binding. */\n  async get(accountId: string, id: string) {\n    const { rows } = await db.query(\n      `SELECT * FROM billing_checkout.handoffs WHERE id=$1 AND account_id=$2`,\n      [id, accountId],\n    );\n    return decode(rows[0]);\n  },\n});\n\n/** Put the code in a fragment so previews, servers and referrers don't receive it.\n * The landing page must remove it before loading any third-party code. */\nexport const checkoutHandoffUrl = (landingUrl: string, code: string) => {\n  const url = new URL(landingUrl);\n  if (\n    url.protocol !== \"https:\" ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    !validSecret(code)\n  )\n    throw new Error(\"Invalid checkout landing URL\");\n  url.hash = code;\n  return url.href;\n};\nexport const checkoutSameOrigin = (request: Request, origin: string) =>\n  request.method === \"POST\" &&\n  request.headers.get(\"origin\") === new URL(origin).origin &&\n  [null, \"same-origin\"].includes(request.headers.get(\"sec-fetch-site\"));\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAeA,IAAM,aAAa,KAAK,KAAK;AAC7B,IAAM,OAAO,CAAC,WACZ,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AAClD,IAAM,SAAS,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,IAAM,cAAc,CAAC,UAAkB,sBAAsB,KAAK,KAAK;AACvE,IAAM,aAAa,CAAC,UAClB,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,UAAU,OAC1B,OAAO,cAAc,MAAM,WAAW,KACtC,MAAM,cAAc,KACpB,aAAa,KAAK,MAAM,QAAQ,KAChC,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,UAAU;AAGX,IAAM,mCAAmC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAStD,IAAM,SAAS,CACb,QAC2B;AAAA,EAC3B,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EACjB,MAAM,QAAQ,IAAI;AAAA,EAClB,IACE,CAAC,SACD,OAAO,UAAU,YACjB,EAAE,eAAe,UACjB,EAAE,iBAAiB,UACnB,EAAE,cAAc,UAChB,EAAE,aAAa,UACf,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,YAAY,YACzB,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,eAAe;AAAA,IAE1B,MAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C,MAAM,SAAS;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,EACjB;AAAA,EACA,IAAI,CAAC,WAAW,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,wBAAwB;AAAA,EACjE,OAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,OAAO;AAAA,IACP,WAAW,OAAO,IAAI,UAAU;AAAA,EAClC;AAAA;AAIK,IAAM,iCAAiC,CAC5C,IACA,MAAM,KAAK,SACP;AAAA,OACE,MAAK,CAAC,WAAmB,OAAsB;AAAA,IACnD,IAAI,CAAC,aAAa,CAAC,WAAW,KAAK;AAAA,MACjC,MAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C,MAAM,OAAO,OAAO;AAAA,IACpB,MAAM,KAAK,WAAW;AAAA,IACtB,MAAM,YAAY,IAAI,IAAI;AAAA,IAC1B,MAAM,GAAG,MACP,kHACA,CAAC,IAAI,WAAW,KAAK,UAAU,KAAK,GAAG,KAAK,IAAI,GAAG,SAAS,CAC9D;AAAA,IACA,OAAO,EAAE,IAAI,MAAM,UAAU;AAAA;AAAA,OAIzB,SAAQ,CAAC,MAAc,mBAAkC,MAAM;AAAA,IACnE,IAAI,CAAC,YAAY,IAAI;AAAA,MAAG,OAAO;AAAA,IAC/B,MAAM,UAAU,OAAO;AAAA,IACvB,MAAM,OAAO,OAAO;AAAA,IACpB,MAAM,YAAY,IAAI,IAAI;AAAA,IAC1B,QAAQ,SAAS,MAAM,GAAG,MACxB,6MACA;AAAA,MACE,KAAK,IAAI;AAAA,MACT,KAAK,OAAO;AAAA,MACZ,KAAK,IAAI;AAAA,MACT;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,CACF;AAAA,IACA,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,IAC9B,OAAO,UAAU,EAAE,SAAS,SAAS,MAAM,UAAU,IAAI;AAAA;AAAA,OAErD,UAAS,CACb,SACA,MACA,mBAAkC,MAClC;AAAA,IACA,IAAI,CAAC,YAAY,OAAO,KAAK,CAAC,YAAY,IAAI;AAAA,MAAG,OAAO;AAAA,IACxD,QAAQ,SAAS,MAAM,GAAG,MACxB,oJACA,CAAC,KAAK,OAAO,GAAG,KAAK,IAAI,GAAG,IAAI,GAAG,gBAAgB,CACrD;AAAA,IACA,OAAO,OAAO,KAAK,EAAE;AAAA;AAAA,OAGjB,IAAG,CAAC,WAAmB,IAAY;AAAA,IACvC,QAAQ,SAAS,MAAM,GAAG,MACxB,yEACA,CAAC,IAAI,SAAS,CAChB;AAAA,IACA,OAAO,OAAO,KAAK,EAAE;AAAA;AAEzB;AAIO,IAAM,qBAAqB,CAAC,YAAoB,SAAiB;AAAA,EACtE,MAAM,MAAM,IAAI,IAAI,UAAU;AAAA,EAC9B,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,CAAC,YAAY,IAAI;AAAA,IAEjB,MAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD,IAAI,OAAO;AAAA,EACX,OAAO,IAAI;AAAA;AAEN,IAAM,qBAAqB,CAAC,SAAkB,WACnD,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,QAAQ,MAAM,IAAI,IAAI,MAAM,EAAE,UAClD,CAAC,MAAM,aAAa,EAAE,SAAS,QAAQ,QAAQ,IAAI,gBAAgB,CAAC;",
+  "debugId": "F96D1D9F1E1CA67A64756E2164756E21",
+  "names": []
+}

package/dist/creditWork.d.ts

@@ -0,0 +1,25 @@
+import { type CreditSqlClient } from "./prepaidPostgres";
+export type CreditWork = {
+    request: string;
+    budget: number;
+    charged: number;
+    absorbed: number;
+    status: "running" | "completed" | "failed";
+    result: string | null;
+};
+export declare const creditWorkPostgresSchemaSql: (schema?: string) => string;
+/** Durable execution claim + capped customer charge. A crash leaves work running
+ * and its credits held: never automatically rerun an uncertain external effect.
+ * Provider cost over the agreed budget is recorded as absorbed, not customer debt. */
+export declare const createPostgresCreditWork: (client: CreditSqlClient, schema?: string) => {
+    get: (accountId: string, workId: string) => Promise<CreditWork | null>;
+    begin: (accountId: string, workId: string, request: string, budget: number) => Promise<{
+        fresh: boolean;
+        work: CreditWork;
+    }>;
+    record: (accountId: string, workId: string, eventId: string, credits: number, reference: string) => Promise<{
+        charged: number;
+        fresh: boolean;
+    }>;
+    finish: (accountId: string, workId: string, result: string, failed?: boolean) => Promise<CreditWork>;
+};