@absolutejs/billing 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.8.0 — 2026-09-11
+
+### Added
+
+- **Add single-use purchase-only checkout handoffs with hashed capabilities, account binding and CSRF verification**
+
 ## 0.7.0 — 2026-09-11
 
 ### Added

package/README.md

@@ -98,3 +98,7 @@ BSL-1.1 with named carveout against hosted SaaS billing platforms
 ## Prepaid service credits
 
 [Durable balances, reservations, capped work, and migration rules](docs/prepaid-credits.md) are available through the `prepaid`, `prepaid-postgres`, and `credit-work` subpaths.
+
+## Secure credit checkout
+
+[Purchase-only handoffs](docs/checkout-handoffs.md) provide expiring, single-use browser capabilities without a full login session.

package/changelog.json

@@ -1,16 +1,26 @@
 {
-	"contract": 1,
-	"name": "@absolutejs/billing",
-	"releases": [
-		{
-			"changes": [
-				{
-					"kind": "added",
-					"summary": "Add durable prepaid credit accounts, reservations, and capped idempotent work settlement"
-				}
-			],
-			"date": "2026-09-11",
-			"version": "0.7.0"
-		}
-	]
+  "contract": 1,
+  "name": "@absolutejs/billing",
+  "releases": [
+    {
+      "version": "0.8.0",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add single-use purchase-only checkout handoffs with hashed capabilities, account binding and CSRF verification"
+        }
+      ]
+    },
+    {
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add durable prepaid credit accounts, reservations, and capped idempotent work settlement"
+        }
+      ],
+      "date": "2026-09-11",
+      "version": "0.7.0"
+    }
+  ]
 }

package/dist/checkoutHandoff.d.ts

@@ -0,0 +1,39 @@
+import type { CreditSqlClient } from "./prepaidPostgres";
+export type CheckoutQuote = {
+    productId: string;
+    amountCents: number;
+    currency: string;
+    credits: number;
+};
+export type CheckoutHandoff = {
+    id: string;
+    accountId: string;
+    quote: CheckoutQuote;
+    expiresAt: number;
+};
+/** Apply explicitly during deployment. Secrets are stored only as SHA-256 hashes. */
+export declare const checkoutHandoffPostgresSchemaSql: () => string;
+/** This is a purchase-only capability, never a login or a saved-card authorization.
+ * The application binds the authenticated account and prices the quote. */
+export declare const createPostgresCheckoutHandoffs: (db: CreditSqlClient, now?: () => number) => {
+    issue(accountId: string, quote: CheckoutQuote): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        code: string;
+        expiresAt: number;
+    }>;
+    /** Invoke only on a deliberate same-origin POST, never a preview GET.
+     * Atomic exchange makes concurrent redemption and link replay fail closed. */
+    exchange(code: string, browserAccountId?: string | null): Promise<{
+        handoff: CheckoutHandoff;
+        session: string;
+        csrf: string;
+        expiresAt: number;
+    } | null>;
+    authorize(session: string, csrf: string, browserAccountId?: string | null): Promise<CheckoutHandoff | null>;
+    /** Public IDs are not capabilities: status always requires account binding. */
+    get(accountId: string, id: string): Promise<CheckoutHandoff | null>;
+};
+/** Put the code in a fragment so previews, servers and referrers don't receive it.
+ * The landing page must remove it before loading any third-party code. */
+export declare const checkoutHandoffUrl: (landingUrl: string, code: string) => string;
+export declare const checkoutSameOrigin: (request: Request, origin: string) => boolean;

package/dist/checkoutHandoff.js

@@ -0,0 +1,108 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/checkoutHandoff.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+var lifetimeMs = 15 * 60 * 1000;
+var hash = (secret) => createHash("sha256").update(secret).digest("hex");
+var secret = () => randomBytes(32).toString("base64url");
+var validSecret = (value) => /^[A-Za-z0-9_-]{43}$/.test(value);
+var validQuote = (value) => typeof value.productId === "string" && value.productId.length > 0 && value.productId.length <= 128 && Number.isSafeInteger(value.amountCents) && value.amountCents > 0 && /^[A-Z]{3}$/.test(value.currency) && Number.isSafeInteger(value.credits) && value.credits > 0;
+var checkoutHandoffPostgresSchemaSql = () => `
+CREATE SCHEMA IF NOT EXISTS billing_checkout;
+CREATE TABLE IF NOT EXISTS billing_checkout.handoffs (
+ id text PRIMARY KEY, account_id text NOT NULL, quote jsonb NOT NULL,
+ code_hash text NOT NULL UNIQUE, expires_at bigint NOT NULL,
+ session_hash text UNIQUE, csrf_hash text, session_expires_at bigint
+);
+CREATE INDEX IF NOT EXISTS handoffs_account ON billing_checkout.handoffs(account_id, id);
+`;
+var decode = (row) => {
+  if (!row)
+    return null;
+  const quote = row.quote;
+  if (!quote || typeof quote !== "object" || !("productId" in quote) || !("amountCents" in quote) || !("currency" in quote) || !("credits" in quote) || typeof quote.productId !== "string" || typeof quote.amountCents !== "number" || typeof quote.currency !== "string" || typeof quote.credits !== "number" || typeof row.id !== "string" || typeof row.account_id !== "string")
+    throw new Error("Invalid checkout record");
+  const parsed = {
+    productId: quote.productId,
+    amountCents: quote.amountCents,
+    currency: quote.currency,
+    credits: quote.credits
+  };
+  if (!validQuote(parsed))
+    throw new Error("Invalid checkout quote");
+  return {
+    id: row.id,
+    accountId: row.account_id,
+    quote: parsed,
+    expiresAt: Number(row.expires_at)
+  };
+};
+var createPostgresCheckoutHandoffs = (db, now = Date.now) => ({
+  async issue(accountId, quote) {
+    if (!accountId || !validQuote(quote))
+      throw new Error("Invalid checkout request");
+    const code = secret();
+    const id = randomUUID();
+    const expiresAt = now() + lifetimeMs;
+    await db.query(`INSERT INTO billing_checkout.handoffs(id,account_id,quote,code_hash,expires_at) VALUES ($1,$2,$3::jsonb,$4,$5)`, [id, accountId, JSON.stringify(quote), hash(code), expiresAt]);
+    return { id, code, expiresAt };
+  },
+  async exchange(code, browserAccountId = null) {
+    if (!validSecret(code))
+      return null;
+    const session = secret();
+    const csrf = secret();
+    const expiresAt = now() + lifetimeMs;
+    const { rows } = await db.query(`UPDATE billing_checkout.handoffs SET session_hash=$2,csrf_hash=$3,session_expires_at=$4 WHERE code_hash=$1 AND session_hash IS NULL AND expires_at>$5 AND ($6::text IS NULL OR account_id=$6) RETURNING *`, [
+      hash(code),
+      hash(session),
+      hash(csrf),
+      expiresAt,
+      now(),
+      browserAccountId
+    ]);
+    const handoff = decode(rows[0]);
+    return handoff ? { handoff, session, csrf, expiresAt } : null;
+  },
+  async authorize(session, csrf, browserAccountId = null) {
+    if (!validSecret(session) || !validSecret(csrf))
+      return null;
+    const { rows } = await db.query(`SELECT * FROM billing_checkout.handoffs WHERE session_hash=$1 AND csrf_hash=$2 AND session_expires_at>$3 AND ($4::text IS NULL OR account_id=$4)`, [hash(session), hash(csrf), now(), browserAccountId]);
+    return decode(rows[0]);
+  },
+  async get(accountId, id) {
+    const { rows } = await db.query(`SELECT * FROM billing_checkout.handoffs WHERE id=$1 AND account_id=$2`, [id, accountId]);
+    return decode(rows[0]);
+  }
+});
+var checkoutHandoffUrl = (landingUrl, code) => {
+  const url = new URL(landingUrl);
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || !validSecret(code))
+    throw new Error("Invalid checkout landing URL");
+  url.hash = code;
+  return url.href;
+};
+var checkoutSameOrigin = (request, origin) => request.method === "POST" && request.headers.get("origin") === new URL(origin).origin && [null, "same-origin"].includes(request.headers.get("sec-fetch-site"));
+export {
+  checkoutHandoffPostgresSchemaSql,
+  checkoutHandoffUrl,
+  checkoutSameOrigin,
+  createPostgresCheckoutHandoffs
+};
+
+//# debugId=F96D1D9F1E1CA67A64756E2164756E21
+//# sourceMappingURL=checkoutHandoff.js.map

package/dist/checkoutHandoff.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/checkoutHandoff.ts"],
+  "sourcesContent": [
+    "import { createHash, randomBytes, randomUUID } from \"node:crypto\";\nimport type { CreditSqlClient } from \"./prepaidPostgres\";\n\nexport type CheckoutQuote = {\n  productId: string;\n  amountCents: number;\n  currency: string;\n  credits: number;\n};\nexport type CheckoutHandoff = {\n  id: string;\n  accountId: string;\n  quote: CheckoutQuote;\n  expiresAt: number;\n};\nconst lifetimeMs = 15 * 60 * 1000;\nconst hash = (secret: string) =>\n  createHash(\"sha256\").update(secret).digest(\"hex\");\nconst secret = () => randomBytes(32).toString(\"base64url\");\nconst validSecret = (value: string) => /^[A-Za-z0-9_-]{43}$/.test(value);\nconst validQuote = (value: CheckoutQuote) =>\n  typeof value.productId === \"string\" &&\n  value.productId.length > 0 &&\n  value.productId.length <= 128 &&\n  Number.isSafeInteger(value.amountCents) &&\n  value.amountCents > 0 &&\n  /^[A-Z]{3}$/.test(value.currency) &&\n  Number.isSafeInteger(value.credits) &&\n  value.credits > 0;\n\n/** Apply explicitly during deployment. Secrets are stored only as SHA-256 hashes. */\nexport const checkoutHandoffPostgresSchemaSql = () => `\nCREATE SCHEMA IF NOT EXISTS billing_checkout;\nCREATE TABLE IF NOT EXISTS billing_checkout.handoffs (\n id text PRIMARY KEY, account_id text NOT NULL, quote jsonb NOT NULL,\n code_hash text NOT NULL UNIQUE, expires_at bigint NOT NULL,\n session_hash text UNIQUE, csrf_hash text, session_expires_at bigint\n);\nCREATE INDEX IF NOT EXISTS handoffs_account ON billing_checkout.handoffs(account_id, id);\n`;\nconst decode = (\n  row: Record<string, unknown> | undefined,\n): CheckoutHandoff | null => {\n  if (!row) return null;\n  const quote = row.quote;\n  if (\n    !quote ||\n    typeof quote !== \"object\" ||\n    !(\"productId\" in quote) ||\n    !(\"amountCents\" in quote) ||\n    !(\"currency\" in quote) ||\n    !(\"credits\" in quote) ||\n    typeof quote.productId !== \"string\" ||\n    typeof quote.amountCents !== \"number\" ||\n    typeof quote.currency !== \"string\" ||\n    typeof quote.credits !== \"number\" ||\n    typeof row.id !== \"string\" ||\n    typeof row.account_id !== \"string\"\n  )\n    throw new Error(\"Invalid checkout record\");\n  const parsed = {\n    productId: quote.productId,\n    amountCents: quote.amountCents,\n    currency: quote.currency,\n    credits: quote.credits,\n  };\n  if (!validQuote(parsed)) throw new Error(\"Invalid checkout quote\");\n  return {\n    id: row.id,\n    accountId: row.account_id,\n    quote: parsed,\n    expiresAt: Number(row.expires_at),\n  };\n};\n/** This is a purchase-only capability, never a login or a saved-card authorization.\n * The application binds the authenticated account and prices the quote. */\nexport const createPostgresCheckoutHandoffs = (\n  db: CreditSqlClient,\n  now = Date.now,\n) => ({\n  async issue(accountId: string, quote: CheckoutQuote) {\n    if (!accountId || !validQuote(quote))\n      throw new Error(\"Invalid checkout request\");\n    const code = secret();\n    const id = randomUUID();\n    const expiresAt = now() + lifetimeMs;\n    await db.query(\n      `INSERT INTO billing_checkout.handoffs(id,account_id,quote,code_hash,expires_at) VALUES ($1,$2,$3::jsonb,$4,$5)`,\n      [id, accountId, JSON.stringify(quote), hash(code), expiresAt],\n    );\n    return { id, code, expiresAt };\n  },\n  /** Invoke only on a deliberate same-origin POST, never a preview GET.\n   * Atomic exchange makes concurrent redemption and link replay fail closed. */\n  async exchange(code: string, browserAccountId: string | null = null) {\n    if (!validSecret(code)) return null;\n    const session = secret();\n    const csrf = secret();\n    const expiresAt = now() + lifetimeMs;\n    const { rows } = await db.query(\n      `UPDATE billing_checkout.handoffs SET session_hash=$2,csrf_hash=$3,session_expires_at=$4 WHERE code_hash=$1 AND session_hash IS NULL AND expires_at>$5 AND ($6::text IS NULL OR account_id=$6) RETURNING *`,\n      [\n        hash(code),\n        hash(session),\n        hash(csrf),\n        expiresAt,\n        now(),\n        browserAccountId,\n      ],\n    );\n    const handoff = decode(rows[0]);\n    return handoff ? { handoff, session, csrf, expiresAt } : null;\n  },\n  async authorize(\n    session: string,\n    csrf: string,\n    browserAccountId: string | null = null,\n  ) {\n    if (!validSecret(session) || !validSecret(csrf)) return null;\n    const { rows } = await db.query(\n      `SELECT * FROM billing_checkout.handoffs WHERE session_hash=$1 AND csrf_hash=$2 AND session_expires_at>$3 AND ($4::text IS NULL OR account_id=$4)`,\n      [hash(session), hash(csrf), now(), browserAccountId],\n    );\n    return decode(rows[0]);\n  },\n  /** Public IDs are not capabilities: status always requires account binding. */\n  async get(accountId: string, id: string) {\n    const { rows } = await db.query(\n      `SELECT * FROM billing_checkout.handoffs WHERE id=$1 AND account_id=$2`,\n      [id, accountId],\n    );\n    return decode(rows[0]);\n  },\n});\n\n/** Put the code in a fragment so previews, servers and referrers don't receive it.\n * The landing page must remove it before loading any third-party code. */\nexport const checkoutHandoffUrl = (landingUrl: string, code: string) => {\n  const url = new URL(landingUrl);\n  if (\n    url.protocol !== \"https:\" ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    !validSecret(code)\n  )\n    throw new Error(\"Invalid checkout landing URL\");\n  url.hash = code;\n  return url.href;\n};\nexport const checkoutSameOrigin = (request: Request, origin: string) =>\n  request.method === \"POST\" &&\n  request.headers.get(\"origin\") === new URL(origin).origin &&\n  [null, \"same-origin\"].includes(request.headers.get(\"sec-fetch-site\"));\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAeA,IAAM,aAAa,KAAK,KAAK;AAC7B,IAAM,OAAO,CAAC,WACZ,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AAClD,IAAM,SAAS,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,IAAM,cAAc,CAAC,UAAkB,sBAAsB,KAAK,KAAK;AACvE,IAAM,aAAa,CAAC,UAClB,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,SAAS,KACzB,MAAM,UAAU,UAAU,OAC1B,OAAO,cAAc,MAAM,WAAW,KACtC,MAAM,cAAc,KACpB,aAAa,KAAK,MAAM,QAAQ,KAChC,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,UAAU;AAGX,IAAM,mCAAmC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAStD,IAAM,SAAS,CACb,QAC2B;AAAA,EAC3B,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EACjB,MAAM,QAAQ,IAAI;AAAA,EAClB,IACE,CAAC,SACD,OAAO,UAAU,YACjB,EAAE,eAAe,UACjB,EAAE,iBAAiB,UACnB,EAAE,cAAc,UAChB,EAAE,aAAa,UACf,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,YAAY,YACzB,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,eAAe;AAAA,IAE1B,MAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C,MAAM,SAAS;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,EACjB;AAAA,EACA,IAAI,CAAC,WAAW,MAAM;AAAA,IAAG,MAAM,IAAI,MAAM,wBAAwB;AAAA,EACjE,OAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,OAAO;AAAA,IACP,WAAW,OAAO,IAAI,UAAU;AAAA,EAClC;AAAA;AAIK,IAAM,iCAAiC,CAC5C,IACA,MAAM,KAAK,SACP;AAAA,OACE,MAAK,CAAC,WAAmB,OAAsB;AAAA,IACnD,IAAI,CAAC,aAAa,CAAC,WAAW,KAAK;AAAA,MACjC,MAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C,MAAM,OAAO,OAAO;AAAA,IACpB,MAAM,KAAK,WAAW;AAAA,IACtB,MAAM,YAAY,IAAI,IAAI;AAAA,IAC1B,MAAM,GAAG,MACP,kHACA,CAAC,IAAI,WAAW,KAAK,UAAU,KAAK,GAAG,KAAK,IAAI,GAAG,SAAS,CAC9D;AAAA,IACA,OAAO,EAAE,IAAI,MAAM,UAAU;AAAA;AAAA,OAIzB,SAAQ,CAAC,MAAc,mBAAkC,MAAM;AAAA,IACnE,IAAI,CAAC,YAAY,IAAI;AAAA,MAAG,OAAO;AAAA,IAC/B,MAAM,UAAU,OAAO;AAAA,IACvB,MAAM,OAAO,OAAO;AAAA,IACpB,MAAM,YAAY,IAAI,IAAI;AAAA,IAC1B,QAAQ,SAAS,MAAM,GAAG,MACxB,6MACA;AAAA,MACE,KAAK,IAAI;AAAA,MACT,KAAK,OAAO;AAAA,MACZ,KAAK,IAAI;AAAA,MACT;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF,CACF;AAAA,IACA,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,IAC9B,OAAO,UAAU,EAAE,SAAS,SAAS,MAAM,UAAU,IAAI;AAAA;AAAA,OAErD,UAAS,CACb,SACA,MACA,mBAAkC,MAClC;AAAA,IACA,IAAI,CAAC,YAAY,OAAO,KAAK,CAAC,YAAY,IAAI;AAAA,MAAG,OAAO;AAAA,IACxD,QAAQ,SAAS,MAAM,GAAG,MACxB,oJACA,CAAC,KAAK,OAAO,GAAG,KAAK,IAAI,GAAG,IAAI,GAAG,gBAAgB,CACrD;AAAA,IACA,OAAO,OAAO,KAAK,EAAE;AAAA;AAAA,OAGjB,IAAG,CAAC,WAAmB,IAAY;AAAA,IACvC,QAAQ,SAAS,MAAM,GAAG,MACxB,yEACA,CAAC,IAAI,SAAS,CAChB;AAAA,IACA,OAAO,OAAO,KAAK,EAAE;AAAA;AAEzB;AAIO,IAAM,qBAAqB,CAAC,YAAoB,SAAiB;AAAA,EACtE,MAAM,MAAM,IAAI,IAAI,UAAU;AAAA,EAC9B,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,CAAC,YAAY,IAAI;AAAA,IAEjB,MAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD,IAAI,OAAO;AAAA,EACX,OAAO,IAAI;AAAA;AAEN,IAAM,qBAAqB,CAAC,SAAkB,WACnD,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,QAAQ,MAAM,IAAI,IAAI,MAAM,EAAE,UAClD,CAAC,MAAM,aAAa,EAAE,SAAS,QAAQ,QAAQ,IAAI,gBAAgB,CAAC;",
+  "debugId": "F96D1D9F1E1CA67A64756E2164756E21",
+  "names": []
+}

package/docs/checkout-handoffs.md

@@ -0,0 +1,9 @@
+# Purchase-only checkout handoffs
+
+`@absolutejs/billing/checkout-handoff` issues opaque 256-bit codes from a server-priced quote and authenticated account. Apply `checkoutHandoffPostgresSchemaSql()` explicitly; use `createPostgresCheckoutHandoffs` with the same parameterized SQL adapter as the prepaid ledger. This API is not login, consent to charge, or saved-payment-method access.
+
+Deliver `checkoutHandoffUrl(httpsLandingUrl, code)` only on permitted host channels. The fragment prevents ordinary HTTP previews/referrers from receiving the code, but it is still a limited bearer capability visible in the assistant transcript. Never log it. Remove it synchronously before analytics or third-party scripts run. GET renders a neutral page; an explicit same-origin POST atomically exchanges the code. Reject a different signed-in browser account. Set the returned session in a Secure, HttpOnly, host-only SameSite=Strict cookie; retain CSRF only in the browser. Require `checkoutSameOrigin` AND `authorize(session, csrf, browserAccountId)` on every review/payment POST. Codes and sessions expire after 15 minutes; concurrent redemption succeeds once.
+
+The limited session reveals only its fixed quote and purchase status. It cannot read profile, balance history, receipts, saved cards, or subscribe. Payment requires a new provider-hosted token and explicit user confirmation of the exact quote. Bind the gateway operation ID to the handoff ID; reuse the existing durable reserve/charge/recover/grant service. Never retry uncertain charges with new IDs. A status read is not a gateway operation. Account deletion/revocation remains the consumer's responsibility on issue and use. Retain financial records; expired unused handoffs may be removed by an operator's retention policy.
+
+Host approval and supported UI are independent. MCP form elicitation must not collect payment credentials; use an approved external browser interaction. The handoff alone does not approve a commerce channel. Sources: https://modelcontextprotocol.io/specification/2025-11-25/client/elicitation and the MCP package `docs/commerce-host-rules.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/billing",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Provider-neutral pricing and invoice computation used by the hosted AbsoluteJS.ai platform. Converts metered usage into exact integer-micro line items with tiers and allowances.",
   "repository": {
     "type": "git",
@@ -47,6 +47,11 @@
       "types": "./dist/creditWork.d.ts",
       "import": "./dist/creditWork.js",
       "default": "./dist/creditWork.js"
+    },
+    "./checkout-handoff": {
+      "types": "./dist/checkoutHandoff.d.ts",
+      "import": "./dist/checkoutHandoff.js",
+      "default": "./dist/checkoutHandoff.js"
     }
   },
   "publishConfig": {
@@ -57,10 +62,11 @@
     "README.md",
     "changelog.json",
     "dist",
-    "docs/prepaid-credits.md"
+    "docs/prepaid-credits.md",
+    "docs/checkout-handoffs.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/ledger.ts src/prepaid.ts src/prepaidPostgres.ts src/creditWork.ts src/manifest.ts --root ./src --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json && absolute-manifest emit",
+    "build": "rm -rf dist && bun build src/index.ts src/ledger.ts src/prepaid.ts src/prepaidPostgres.ts src/creditWork.ts src/checkoutHandoff.ts src/manifest.ts --root ./src --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json && absolute-manifest emit",
     "test": "bun test tests/",
     "typecheck": "tsc --noEmit",
     "format": "prettier --write \"./**/*.{ts,json,md}\"",