@absolutejs/mcp 0.14.0 → 0.15.1

package/CHANGELOG.md

@@ -6,6 +6,18 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.15.1 — 2026-09-11
+
+### Fixed
+
+- **Build and test before publishing so checkout exports are present in the distributed artifact**
+
+## 0.15.0 — 2026-09-11
+
+### Added
+
+- **Add commerce-classified account-bound checkout handoff and purchase status tools**
+
 ## 0.14.0 — 2026-09-11
 
 ### Added

package/README.md

@@ -427,3 +427,7 @@ on the Change Date.
 ### Budgeted prepaid work
 
 `budgetedMcpTool({ tool, execute })` adds a stable work ID, an explicit maximum-credit budget, and a `paid_access` commerce requirement. The executor must bind the account and use durable claims and settlement (for example `@absolutejs/billing/credit-work`). Only wrap tools whose effects and metering finish inside the execution scope. Deferred jobs need a durable budget handoff. Task-required, authorization-mapped, and already commerce-tagged tools are rejected rather than silently changing their enforcement contracts.
+
+## Secure credit checkout
+
+`createCheckoutHandoffTool` and `createPurchaseStatusTool` provide account-bound credit checkout and recovery contracts. The issuer must bind server pricing and identity; route these tools through the commerce guard. Checkout is classified as `external_checkout`, so restricted and unverified channels cannot discover or execute it. Status works at zero credits. Never pass card data in tool input. See [host rules](docs/commerce-host-rules.md).

package/changelog.json

@@ -1,32 +1,52 @@
 {
-	"contract": 1,
-	"name": "@absolutejs/mcp",
-	"releases": [
-		{
-			"changes": [
-				{
-					"kind": "added",
-					"summary": "Add explicit credit-budget envelopes for durable prepaid MCP work"
-				}
-			],
-			"date": "2026-09-11",
-			"version": "0.14.0"
-		},
-		{
-			"changes": [
-				{
-					"kind": "added",
-					"summary": "Add reviewed host commerce eligibility, execution guards, and reusable credit status tools",
-					"symbols": [
-						"McpServerConfig",
-						"McpTool",
-						"evaluateCommerce",
-						"createCreditBalanceTool"
-					]
-				}
-			],
-			"date": "2026-09-11",
-			"version": "0.13.0"
-		}
-	]
+  "contract": 1,
+  "name": "@absolutejs/mcp",
+  "releases": [
+    {
+      "version": "0.15.1",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "fixed",
+          "summary": "Build and test before publishing so checkout exports are present in the distributed artifact"
+        }
+      ]
+    },
+    {
+      "version": "0.15.0",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add commerce-classified account-bound checkout handoff and purchase status tools"
+        }
+      ]
+    },
+    {
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add explicit credit-budget envelopes for durable prepaid MCP work"
+        }
+      ],
+      "date": "2026-09-11",
+      "version": "0.14.0"
+    },
+    {
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Add reviewed host commerce eligibility, execution guards, and reusable credit status tools",
+          "symbols": [
+            "McpServerConfig",
+            "McpTool",
+            "evaluateCommerce",
+            "createCreditBalanceTool"
+          ]
+        }
+      ],
+      "date": "2026-09-11",
+      "version": "0.13.0"
+    }
+  ]
 }

package/dist/commerce.js

@@ -59,6 +59,92 @@ var createCreditBalanceTool = (options) => ({
     };
   }
 });
+// src/checkoutTools.ts
+var record = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
+var createCheckoutHandoffTool = (options) => ({
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    openWorldHint: true,
+    title: "Open credit checkout"
+  },
+  commerce: { action: "external_checkout", categories: ["usage_credits"] },
+  description: "Prepare a short-lived credit-purchase link on the service website. The user reviews and explicitly pays there. Never send card data in chat. Does not charge a card or create a subscription.",
+  inputSchema: {
+    type: "object",
+    properties: { productId: { type: "string", minLength: 1, maxLength: 128 } },
+    required: ["productId"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    if (!record(input) || Object.keys(input).length !== 1 || typeof input.productId !== "string" || !input.productId || input.productId.length > 128)
+      throw new Error("A productId is required");
+    const result = await options.issue(input.productId);
+    const url = new URL(result.url);
+    if (url.protocol !== "https:" || url.origin !== new URL(options.origin).origin || url.username || url.password || !Number.isFinite(Date.parse(result.expiresAt)))
+      throw new Error("Invalid checkout handoff");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Review and pay on ${url.hostname}: ${url.href}. Expires ${result.expiresAt}. No payment has been made.`
+        }
+      ],
+      structuredContent: {
+        purchaseId: result.purchaseId,
+        url: url.href,
+        expiresAt: result.expiresAt
+      }
+    };
+  }
+});
+var createPurchaseStatusTool = (options) => ({
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    openWorldHint: false
+  },
+  commerce: { action: "entitlement_status", categories: ["usage_credits"] },
+  description: "Read this account's credit-purchase status. Available at zero balance. Does not initiate or retry payment.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      purchaseId: { type: "string", minLength: 1, maxLength: 128 }
+    },
+    required: ["purchaseId"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    if (!record(input) || Object.keys(input).length !== 1 || typeof input.purchaseId !== "string" || !input.purchaseId || input.purchaseId.length > 128)
+      throw new Error("A purchaseId is required");
+    const value = await options.read(input.purchaseId);
+    if (!value)
+      return "No purchase with that ID exists for this account.";
+    if (value.purchaseId !== input.purchaseId || ![
+      "not_started",
+      "pending",
+      "approved",
+      "declined",
+      "refunded",
+      "reconciliation"
+    ].includes(value.status) || !Number.isSafeInteger(value.creditsGranted) || value.creditsGranted < 0)
+      throw new Error("Purchase status is unavailable");
+    const summary = {
+      purchaseId: value.purchaseId,
+      status: value.status,
+      creditsGranted: value.creditsGranted
+    };
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Purchase ${summary.status}; ${summary.creditsGranted} credits granted.`
+        }
+      ],
+      structuredContent: summary
+    };
+  }
+});
 
 // src/commerce.ts
 var COMMERCE_POLICY_VERSION = "2026-09-10.1";
@@ -168,6 +254,8 @@ var evaluateCommerce = (req, context, now = new Date) => {
 export {
   COMMERCE_POLICY_SOURCES,
   COMMERCE_POLICY_VERSION,
+  createCheckoutHandoffTool,
   createCreditBalanceTool,
+  createPurchaseStatusTool,
   evaluateCommerce
 };

package/dist/index.js

@@ -59,6 +59,92 @@ var createCreditBalanceTool = (options) => ({
     };
   }
 });
+// src/checkoutTools.ts
+var record = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
+var createCheckoutHandoffTool = (options) => ({
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    openWorldHint: true,
+    title: "Open credit checkout"
+  },
+  commerce: { action: "external_checkout", categories: ["usage_credits"] },
+  description: "Prepare a short-lived credit-purchase link on the service website. The user reviews and explicitly pays there. Never send card data in chat. Does not charge a card or create a subscription.",
+  inputSchema: {
+    type: "object",
+    properties: { productId: { type: "string", minLength: 1, maxLength: 128 } },
+    required: ["productId"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    if (!record(input) || Object.keys(input).length !== 1 || typeof input.productId !== "string" || !input.productId || input.productId.length > 128)
+      throw new Error("A productId is required");
+    const result = await options.issue(input.productId);
+    const url = new URL(result.url);
+    if (url.protocol !== "https:" || url.origin !== new URL(options.origin).origin || url.username || url.password || !Number.isFinite(Date.parse(result.expiresAt)))
+      throw new Error("Invalid checkout handoff");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Review and pay on ${url.hostname}: ${url.href}. Expires ${result.expiresAt}. No payment has been made.`
+        }
+      ],
+      structuredContent: {
+        purchaseId: result.purchaseId,
+        url: url.href,
+        expiresAt: result.expiresAt
+      }
+    };
+  }
+});
+var createPurchaseStatusTool = (options) => ({
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    openWorldHint: false
+  },
+  commerce: { action: "entitlement_status", categories: ["usage_credits"] },
+  description: "Read this account's credit-purchase status. Available at zero balance. Does not initiate or retry payment.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      purchaseId: { type: "string", minLength: 1, maxLength: 128 }
+    },
+    required: ["purchaseId"],
+    additionalProperties: false
+  },
+  handler: async (input) => {
+    if (!record(input) || Object.keys(input).length !== 1 || typeof input.purchaseId !== "string" || !input.purchaseId || input.purchaseId.length > 128)
+      throw new Error("A purchaseId is required");
+    const value = await options.read(input.purchaseId);
+    if (!value)
+      return "No purchase with that ID exists for this account.";
+    if (value.purchaseId !== input.purchaseId || ![
+      "not_started",
+      "pending",
+      "approved",
+      "declined",
+      "refunded",
+      "reconciliation"
+    ].includes(value.status) || !Number.isSafeInteger(value.creditsGranted) || value.creditsGranted < 0)
+      throw new Error("Purchase status is unavailable");
+    const summary = {
+      purchaseId: value.purchaseId,
+      status: value.status,
+      creditsGranted: value.creditsGranted
+    };
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Purchase ${summary.status}; ${summary.creditsGranted} credits granted.`
+        }
+      ],
+      structuredContent: summary
+    };
+  }
+});
 
 // src/commerce.ts
 var COMMERCE_POLICY_VERSION = "2026-09-10.1";
@@ -2008,6 +2094,7 @@ export {
   MCP_LATEST_PROTOCOL_VERSION,
   McpClientError,
   budgetedMcpTool,
+  createCheckoutHandoffTool,
   createCreditBalanceTool,
   createMcpAuthorizationRequest,
   createMcpClient,
@@ -2017,6 +2104,7 @@ export {
   createMemoryMcpTaskStore,
   createPostgresMcpSessionStore,
   createPostgresMcpTaskStore,
+  createPurchaseStatusTool,
   createSessionRegistry,
   discoverMcpAuthorization,
   dispatchMcp,

package/dist/manifest.js

@@ -2861,7 +2861,9 @@ var manifest = defineManifest()({
     tagline: "Let AI assistants connect to your site and use its tools."
   },
   requires: {
-    peers: [{ name: "elysia", range: "^2.0.0-beta.6", reason: "plugin host" }]
+    peers: [
+      { name: "elysia", range: "^2.0.0-beta.6", reason: "plugin host" }
+    ]
   },
   settings: Type.Object({
     instructions: Type.Optional(Type.String({

package/dist/src/checkoutTools.d.ts

@@ -0,0 +1,19 @@
+import type { McpTool } from "./types";
+export type McpPurchaseStatus = {
+    purchaseId: string;
+    status: "not_started" | "pending" | "approved" | "declined" | "refunded" | "reconciliation";
+    creditsGranted: number;
+};
+/** The issuer is bound to the authenticated account and canonical server pricing.
+ * Register only through the commerce guard. This tool never takes payment data. */
+export declare const createCheckoutHandoffTool: (options: {
+    origin: string;
+    issue: (productId: string) => Promise<{
+        purchaseId: string;
+        url: string;
+        expiresAt: string;
+    }>;
+}) => McpTool;
+export declare const createPurchaseStatusTool: (options: {
+    read: (purchaseId: string) => Promise<McpPurchaseStatus | null>;
+}) => McpTool;

package/dist/src/commerce.d.ts

@@ -48,3 +48,4 @@ export type CommerceDecision = {
  * Unverified paths need explicit, fresh server-side review evidence. */
 export declare const evaluateCommerce: (req: CommerceRequirement, context: CommerceContext, now?: Date) => CommerceDecision;
 export { createCreditBalanceTool, type McpCreditBalance } from "./creditStatus";
+export { createCheckoutHandoffTool, createPurchaseStatusTool, type McpPurchaseStatus, } from "./checkoutTools";

package/dist/src/index.d.ts

@@ -45,3 +45,4 @@ export type { McpAgencyOptions, McpAudioContent, McpElicitAnswer, McpElicitation
 export * from "./commerce";
 export { createCreditBalanceTool, type McpCreditBalance } from "./creditStatus";
 export { budgetedMcpTool, type McpCreditWorkRequest } from "./budgetedTool";
+export { createCheckoutHandoffTool, createPurchaseStatusTool, type McpPurchaseStatus, } from "./checkoutTools";

package/package.json

@@ -68,9 +68,9 @@
     "release": "bun run format && bun run test && bun run build && bun publish",
     "test": "bun test",
     "typecheck": "tsc --noEmit --project tsconfig.json",
-    "check:package": "absolute-changelog check",
+    "check:package": "bun run typecheck && bun run test && bun run build && absolute-changelog check",
     "prepublishOnly": "bun run check:package"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.14.0"
+  "version": "0.15.1"
 }