@checkbox-site/node 0.0.0-stage → 0.1.0

package/dist/generated/types.js

@@ -0,0 +1,57 @@
+// GENERATED by scripts/generate-sdk-types from openapi/checkbox.v1.json (Checkbox API 2026-10-30). DO NOT EDIT.
+// Regenerate with `pnpm generate:sdk` after `pnpm generate:openapi`; packages/sdk-node/src/generated.test.ts fails when stale.
+/* eslint-disable */
+/** The API version these types describe (sent as Checkbox-Version by default). */
+export const API_VERSION = "2026-10-30";
+/** Every API version the server knows, oldest first. */
+export const API_VERSIONS = ["2026-10-30"];
+/** Every webhook event type. */
+export const WEBHOOK_EVENT_TYPES = ["plan.updated", "task.verified", "notice.due", "notice.overdue", "receipt.created", "test_run.completed", "test_run.failed", "site.score_changed", "site.insurable_changed", "finding.created", "finding.resolved", "scan.completed", "scan.failed", "law.changed", "certificate.issued", "certificate.lapsed", "certificate.revoked", "notice.sent", "consent.created", "site.compliant"];
+// ---- Errors ----------------------------------------------------------------------------------------------------
+/** Stable error codes (`error.code`), with HTTP status, type and meaning. Codes are never renamed. */
+export const ERROR_CODES = {
+    parameter_invalid: { status: 400, type: "invalid_request_error", description: "A parameter has an invalid value; `param` names it." },
+    parameter_missing: { status: 400, type: "invalid_request_error", description: "A required parameter is missing; `param` names it." },
+    parameter_unknown: { status: 400, type: "invalid_request_error", description: "The request has a parameter this endpoint does not accept." },
+    body_invalid_json: { status: 400, type: "invalid_request_error", description: "The request body is not valid JSON." },
+    url_not_allowed: { status: 400, type: "invalid_request_error", description: "A URL points to a private, local or otherwise unreachable address." },
+    api_version_invalid: { status: 400, type: "invalid_request_error", description: "The Checkbox-Version header names an unknown API version." },
+    idempotency_key_invalid: { status: 400, type: "idempotency_error", description: "The Idempotency-Key header is empty or longer than 255 characters." },
+    idempotency_key_reused: { status: 400, type: "idempotency_error", description: "The Idempotency-Key was already used with different parameters within 24 hours." },
+    test_key_missing: { status: 400, type: "invalid_request_error", description: "A Stripe test run needs a Stripe TEST-mode key stored for the site (createTestCredential)." },
+    test_key_not_test_mode: { status: 400, type: "invalid_request_error", description: "The billing key is a live-mode (or malformed) key; test runs only accept test-mode keys (rk_test_… / sk_test_…)." },
+    test_key_rejected: { status: 400, type: "invalid_request_error", description: "Stripe rejected the test-mode key or it lacks a permission test runs need; `message` names it." },
+    authorization_pending: { status: 400, type: "invalid_request_error", description: "Device login: the human has not approved yet. Keep polling createDeviceToken every `interval` seconds." },
+    slow_down: { status: 400, type: "rate_limit_error", description: "Device login: polling too fast. Add 5 seconds to the interval and keep polling." },
+    expired_token: { status: 400, type: "invalid_request_error", description: "Device login: the device code expired (15 minutes) or was already used. Start again with createDeviceAuthorization." },
+    device_code_invalid: { status: 400, type: "invalid_request_error", description: "Device login: the device code is unknown." },
+    access_denied: { status: 403, type: "permission_error", description: "Device login: the human clicked Deny. Do not retry without asking them." },
+    api_key_missing: { status: 401, type: "authentication_error", description: "No API key was provided (Authorization: Bearer ck_…)." },
+    api_key_invalid: { status: 401, type: "authentication_error", description: "The API key is unknown, revoked or expired." },
+    publishable_key_not_allowed: { status: 403, type: "permission_error", description: "A publishable key (pk_…) cannot call this endpoint; use a secret key on your server." },
+    origin_not_allowed: { status: 403, type: "permission_error", description: "A publishable-key request came from a page (Origin) that is not on one of the site's domains (base URL or checkout URL)." },
+    insufficient_scope: { status: 403, type: "permission_error", description: "The restricted key lacks the scope this endpoint needs." },
+    insufficient_role: { status: 403, type: "permission_error", description: "The key (or the person who created it) does not have a role that allows this action." },
+    account_not_activated: { status: 403, type: "permission_error", description: "Live mode needs an activated account: verify the domain of one of your sites (or use a test key)." },
+    test_mode_domain_unverified: { status: 403, type: "permission_error", description: "Test mode only scans, monitors, fetches and test-runs localhost or domains the account has verified; verify the domain (createDomainVerification) or send the HTML instead." },
+    test_mode_scan_budget_exhausted: { status: 429, type: "rate_limit_error", description: "No longer returned (round 6): test mode has no scan budget for unverified domains any more, they are refused with test_mode_domain_unverified. Kept so older clients still recognise the code." },
+    domain_not_verified: { status: 403, type: "permission_error", description: "Checkbox only scans, monitors, fetches and test-runs websites the account has verified (DNS TXT record or /.well-known file): every target host (site, checkout, account and policy URLs) must be on a verified domain. `next_action` says which domain to verify." },
+    account_suspended: { status: 403, type: "permission_error", description: "The account was suspended by Checkbox staff; contact support." },
+    resource_missing: { status: 404, type: "invalid_request_error", description: "No object with this id exists in this mode of the account." },
+    route_not_found: { status: 404, type: "invalid_request_error", description: "No such endpoint. See /v1/openapi.json for the list." },
+    resource_conflict: { status: 409, type: "invalid_request_error", description: "The object is in a state that does not allow this action." },
+    scan_already_queued: { status: 409, type: "invalid_request_error", description: "A scan of this site is already queued or running." },
+    consent_reference_locked: { status: 409, type: "invalid_request_error", description: "The consent already carries a different customer_reference; references are set once and never changed." },
+    test_run_in_progress: { status: 409, type: "invalid_request_error", description: "The site already has a queued or running test run; wait for it (retrieveTestRun) or cancel it (cancelTestRun)." },
+    idempotency_key_in_use: { status: 409, type: "idempotency_error", description: "A request with this Idempotency-Key is still being processed; retry shortly." },
+    resource_archived: { status: 410, type: "invalid_request_error", description: "The object is archived; restore it before changing it." },
+    body_too_large: { status: 413, type: "invalid_request_error", description: "The request body is too large." },
+    content_type_unsupported: { status: 415, type: "invalid_request_error", description: "Send JSON bodies with Content-Type: application/json." },
+    site_limit_reached: { status: 403, type: "invalid_request_error", description: "The account reached its fair-use site limit (default 25); contact support to raise it." },
+    webhook_endpoint_limit_reached: { status: 403, type: "invalid_request_error", description: "The account reached the maximum number of webhook endpoints (16 per mode)." },
+    plan_required: { status: 402, type: "invalid_request_error", description: "Only when billing is enabled on this deployment: the feature needs a paid plan." },
+    rate_limit_exceeded: { status: 429, type: "rate_limit_error", description: "Too many requests; slow down and retry after the Retry-After header." },
+    receipts_disabled: { status: 403, type: "permission_error", description: "Consent receipts are turned off for this account (updateReceiptSettings enabled=true turns them on)." },
+    feature_unavailable: { status: 503, type: "api_error", description: "The feature is not configured on this deployment (for example the database migration is missing)." },
+    internal_error: { status: 500, type: "api_error", description: "Something went wrong on Checkbox's side. Retrying with the same Idempotency-Key is safe." },
+};

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+import { Checkbox } from './client.ts';
+export { Checkbox, modeOfKey, getLastResponse, backoff, DEFAULT_BASE_URL, DEFAULT_MAX_NETWORK_RETRIES, DEFAULT_TIMEOUT_MS, type CheckboxConfig, type Mode } from './client.ts';
+export { CheckboxError, CheckboxInvalidRequestError, CheckboxAuthenticationError, CheckboxPermissionError, CheckboxRateLimitError, CheckboxIdempotencyError, CheckboxAPIError, CheckboxConnectionError, CheckboxSignatureVerificationError, type CheckboxErrorType, type CheckboxErrorRaw, type NextAction, } from './errors.ts';
+export { Webhooks, webhooks, SIGNATURE_HEADER, DEFAULT_TOLERANCE, parseSignatureHeader, computeSignature, type WebhookPayload, type WebhookHeader, type VerifyOptions } from './webhooks.ts';
+export { Resource, MAX_AUTO_PAGING, type ApiListPromise, type ListObject, type RequestOptions, type ResponseMeta } from './resource.ts';
+export { OPERATIONS, RESOURCES, type OperationId, type OperationSpec, type OperationTypes } from './generated/operations.ts';
+export { SDK_VERSION } from './version.ts';
+export * from './generated/types.ts';
+export type * as Types from './generated/types.ts';
+export default Checkbox;

package/dist/index.js

@@ -0,0 +1,15 @@
+// Checkbox Node SDK. Public surface:
+//   import Checkbox from '@checkbox-site/node';                      // or: import { Checkbox } from '@checkbox-site/node';
+//   const checkbox = new Checkbox(process.env.CHECKBOX_API_KEY);
+//   await checkbox.checks.stripeCheckoutSession({ params });
+//   const event = checkbox.webhooks.constructEvent(rawBody, req.headers['checkbox-signature'], secret);
+// Published to npm as @checkbox-site/node.
+import { Checkbox } from "./client.js";
+export { Checkbox, modeOfKey, getLastResponse, backoff, DEFAULT_BASE_URL, DEFAULT_MAX_NETWORK_RETRIES, DEFAULT_TIMEOUT_MS } from "./client.js";
+export { CheckboxError, CheckboxInvalidRequestError, CheckboxAuthenticationError, CheckboxPermissionError, CheckboxRateLimitError, CheckboxIdempotencyError, CheckboxAPIError, CheckboxConnectionError, CheckboxSignatureVerificationError, } from "./errors.js";
+export { Webhooks, webhooks, SIGNATURE_HEADER, DEFAULT_TOLERANCE, parseSignatureHeader, computeSignature } from "./webhooks.js";
+export { Resource, MAX_AUTO_PAGING } from "./resource.js";
+export { OPERATIONS, RESOURCES } from "./generated/operations.js";
+export { SDK_VERSION } from "./version.js";
+export * from "./generated/types.js";
+export default Checkbox;

package/dist/resource.d.ts

@@ -0,0 +1,59 @@
+import type { OperationSpec } from './generated/operations.ts';
+/** Per-request options (last argument of every method). */
+export interface RequestOptions {
+    /** Idempotency-Key for this POST. Generated automatically (and reused across retries) when omitted. */
+    idempotencyKey?: string;
+    /** Checkbox-Version for this request (defaults to the client's). */
+    apiVersion?: string;
+    /** Use another API key for this request (e.g. a live key next to a test-mode client). */
+    apiKey?: string;
+    /** Timeout in milliseconds for each attempt (defaults to the client's, 80 s). */
+    timeout?: number;
+    /** Retries on network errors, 409 idempotency_key_in_use, 429 and 5xx (defaults to the client's, 2). */
+    maxNetworkRetries?: number;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
+    /** Abort the request (and its retries). */
+    signal?: AbortSignal;
+}
+/** A page of a list (`{ object: 'list', data, has_more, url }`). */
+export interface ListObject<T> {
+    object: 'list';
+    data: T[];
+    has_more: boolean;
+    url: string;
+}
+/**
+ * Result of a paginated `list()`: await it for one page, or iterate it with `for await` to walk every object across
+ * pages (cursor pagination with `starting_after`, or `ending_before` when you started with it).
+ */
+export interface ApiListPromise<T> extends Promise<ListObject<T>>, AsyncIterable<T> {
+    /** Calls `fn` for every object across pages; return `false` from `fn` to stop early. */
+    autoPagingEach(fn: (item: T) => void | boolean | Promise<void | boolean>): Promise<void>;
+    /** Collects objects across pages, at most `limit` (required; max 10 000). */
+    autoPagingToArray(opts: {
+        limit: number;
+    }): Promise<T[]>;
+}
+/** Response metadata, attached (non-enumerable) to every returned object as `lastResponse`. */
+export interface ResponseMeta {
+    statusCode: number;
+    requestId: string | undefined;
+    apiVersion: string | undefined;
+    idempotencyKey: string | undefined;
+    /** True when the response replayed an earlier request with the same Idempotency-Key. */
+    idempotentReplayed: boolean;
+    headers: Record<string, string>;
+}
+/** What a resource needs from the client. */
+export interface RequestSender {
+    _send(op: OperationSpec, pathArgs: readonly unknown[], params: Record<string, unknown> | undefined, options: RequestOptions | undefined): Promise<unknown>;
+}
+export declare abstract class Resource {
+    protected readonly _client: RequestSender;
+    constructor(_client: RequestSender);
+    protected _request(op: OperationSpec, pathArgs: readonly unknown[], params: object | undefined, options: RequestOptions | undefined): Promise<unknown>;
+    protected _list<T>(op: OperationSpec, pathArgs: readonly unknown[], params: object | undefined, options: RequestOptions | undefined): ApiListPromise<T>;
+}
+export declare const MAX_AUTO_PAGING = 10000;
+export declare function listPromise<T>(client: RequestSender, op: OperationSpec, pathArgs: readonly unknown[], params: Record<string, unknown>, options: RequestOptions | undefined): ApiListPromise<T>;

package/dist/resource.js

@@ -0,0 +1,63 @@
+export class Resource {
+    _client;
+    constructor(_client) {
+        this._client = _client;
+    }
+    _request(op, pathArgs, params, options) {
+        return this._client._send(op, pathArgs, params, options);
+    }
+    _list(op, pathArgs, params, options) {
+        return listPromise(this._client, op, pathArgs, (params ?? {}), options);
+    }
+}
+export const MAX_AUTO_PAGING = 10_000;
+export function listPromise(client, op, pathArgs, params, options) {
+    const fetchPage = (p) => client._send(op, pathArgs, p, options);
+    const first = fetchPage(params);
+    const backwards = params.ending_before !== undefined && params.starting_after === undefined;
+    async function* iterate() {
+        let page = await first;
+        for (;;) {
+            const items = backwards ? [...page.data].reverse() : page.data;
+            for (const item of items)
+                yield item;
+            if (!page.has_more || !page.data.length)
+                return;
+            const cursor = (backwards ? page.data[0] : page.data[page.data.length - 1]);
+            if (typeof cursor?.id !== 'string')
+                return;
+            const { starting_after: _s, ending_before: _e, ...rest } = params;
+            page = await fetchPage(backwards ? { ...rest, ending_before: cursor.id } : { ...rest, starting_after: cursor.id });
+        }
+    }
+    const promise = first;
+    // Keep `then` on the original promise; add the iteration helpers.
+    Object.defineProperties(promise, {
+        [Symbol.asyncIterator]: { value: () => iterate(), enumerable: false },
+        autoPagingEach: {
+            enumerable: false,
+            value: async (fn) => {
+                for await (const item of iterate())
+                    if ((await fn(item)) === false)
+                        return;
+            },
+        },
+        autoPagingToArray: {
+            enumerable: false,
+            value: async (opts) => {
+                const limit = opts?.limit;
+                if (!Number.isInteger(limit) || limit < 1 || limit > MAX_AUTO_PAGING) {
+                    throw new RangeError(`autoPagingToArray needs { limit } between 1 and ${MAX_AUTO_PAGING}.`);
+                }
+                const out = [];
+                for await (const item of iterate()) {
+                    out.push(item);
+                    if (out.length >= limit)
+                        break;
+                }
+                return out;
+            },
+        },
+    });
+    return promise;
+}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+/** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
+export declare const SDK_VERSION = "0.1.0";

package/dist/version.js

@@ -0,0 +1,2 @@
+/** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
+export const SDK_VERSION = '0.1.0';

package/dist/webhooks.d.ts

@@ -0,0 +1,40 @@
+import type { WebhookEvent } from './generated/types.ts';
+export declare const SIGNATURE_HEADER = "Checkbox-Signature";
+/** Default maximum age of a signature, in seconds (replay protection). */
+export declare const DEFAULT_TOLERANCE = 300;
+export type WebhookPayload = string | Uint8Array;
+export type WebhookHeader = string | string[] | undefined | null;
+export interface ParsedSignatureHeader {
+    timestamp: number;
+    signatures: string[];
+}
+export declare function parseSignatureHeader(header: string | undefined): ParsedSignatureHeader | null;
+export declare function computeSignature(payload: string, secret: string, timestamp: number): string;
+export interface VerifyOptions {
+    /** Maximum signature age in seconds (default 300). 0 disables the check (not recommended). */
+    tolerance?: number;
+    /** Current time in unix seconds (tests). */
+    now?: number;
+}
+export declare class Webhooks {
+    /**
+     * Verifies `Checkbox-Signature` and returns the parsed event. Throws CheckboxSignatureVerificationError when the
+     * signature does not match or is older than `tolerance` seconds.
+     *
+     * @param payload the RAW request body (string or Buffer)
+     * @param header the Checkbox-Signature header
+     * @param secret the endpoint secret (whsec_…)
+     */
+    constructEvent(payload: WebhookPayload, header: WebhookHeader, secret: string, tolerance?: number | VerifyOptions): WebhookEvent;
+    /** Same as constructEvent, using WebCrypto (edge runtimes: Vercel Edge, Cloudflare Workers, Deno). */
+    constructEventAsync(payload: WebhookPayload, header: WebhookHeader, secret: string, tolerance?: number | VerifyOptions): Promise<WebhookEvent>;
+    /** True when the signature is valid (no exception). */
+    verifySignature(payload: WebhookPayload, header: WebhookHeader, secret: string, opts?: VerifyOptions): boolean;
+    /** Builds a valid Checkbox-Signature header for a payload (for your tests). */
+    generateTestHeaderString(opts: {
+        payload: string;
+        secret: string;
+        timestamp?: number;
+    }): string;
+}
+export declare const webhooks: Webhooks;

package/dist/webhooks.js

@@ -0,0 +1,129 @@
+// Webhook signature verification. Checkbox signs every delivery with
+//   Checkbox-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(endpoint secret, "<t>.<raw body>")>
+// (several v1 entries during a secret roll). Verify against the RAW request body: re-serialised JSON will not match.
+import { createHmac } from 'node:crypto';
+import { CheckboxSignatureVerificationError } from "./errors.js";
+export const SIGNATURE_HEADER = 'Checkbox-Signature';
+/** Default maximum age of a signature, in seconds (replay protection). */
+export const DEFAULT_TOLERANCE = 300;
+const decoder = new TextDecoder();
+function payloadText(payload) {
+    if (typeof payload === 'string')
+        return payload;
+    if (payload instanceof Uint8Array)
+        return decoder.decode(payload);
+    throw new CheckboxSignatureVerificationError('Webhook payload must be the raw request body as a string or Buffer (not parsed JSON). In Express use express.raw({ type: "application/json" }); in Next.js use await request.text().', undefined, String(payload));
+}
+function headerText(header) {
+    if (Array.isArray(header))
+        return header[0];
+    return header ?? undefined;
+}
+export function parseSignatureHeader(header) {
+    if (!header || header.length > 2000)
+        return null;
+    let timestamp = null;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const i = part.indexOf('=');
+        if (i < 0)
+            continue;
+        const k = part.slice(0, i).trim();
+        const v = part.slice(i + 1).trim();
+        if (k === 't' && /^\d{1,12}$/.test(v))
+            timestamp = Number(v);
+        else if (k === 'v1' && /^[0-9a-f]{64}$/i.test(v))
+            signatures.push(v.toLowerCase());
+    }
+    return timestamp === null || !signatures.length ? null : { timestamp, signatures };
+}
+export function computeSignature(payload, secret, timestamp) {
+    return createHmac('sha256', secret).update(`${timestamp}.${payload}`, 'utf8').digest('hex');
+}
+/** Constant-time comparison of two hex strings (no Buffer, so it also runs on edge runtimes). */
+function safeEqual(a, b) {
+    if (a.length !== b.length || !a.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+function check(payload, header, secret, opts, hmac) {
+    if (!secret)
+        throw new CheckboxSignatureVerificationError('No webhook secret given. Use the endpoint secret (whsec_…) from createWebhookEndpoint.', header, payload);
+    const parsed = parseSignatureHeader(header);
+    if (!parsed) {
+        throw new CheckboxSignatureVerificationError(`Missing or malformed ${SIGNATURE_HEADER} header (expected "t=<timestamp>,v1=<signature>").`, header, payload);
+    }
+    const expected = hmac(parsed.timestamp);
+    const match = parsed.signatures.some((s) => safeEqual(s, expected));
+    if (!match) {
+        throw new CheckboxSignatureVerificationError('No signature matches the payload. Check that you pass the raw request body (not parsed JSON) and the secret of this endpoint.', header, payload);
+    }
+    const tolerance = opts.tolerance ?? DEFAULT_TOLERANCE;
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (tolerance > 0 && Math.abs(now - parsed.timestamp) > tolerance) {
+        throw new CheckboxSignatureVerificationError(`Signature timestamp is outside the tolerance of ${tolerance} seconds (possible replay).`, header, payload);
+    }
+}
+function parseEvent(text, header) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new CheckboxSignatureVerificationError('The payload is not valid JSON.', header, text);
+    }
+}
+export class Webhooks {
+    /**
+     * Verifies `Checkbox-Signature` and returns the parsed event. Throws CheckboxSignatureVerificationError when the
+     * signature does not match or is older than `tolerance` seconds.
+     *
+     * @param payload the RAW request body (string or Buffer)
+     * @param header the Checkbox-Signature header
+     * @param secret the endpoint secret (whsec_…)
+     */
+    constructEvent(payload, header, secret, tolerance) {
+        const text = payloadText(payload);
+        const h = headerText(header);
+        const opts = typeof tolerance === 'number' ? { tolerance } : (tolerance ?? {});
+        check(text, h, secret, opts, (t) => computeSignature(text, secret, t));
+        return parseEvent(text, h);
+    }
+    /** Same as constructEvent, using WebCrypto (edge runtimes: Vercel Edge, Cloudflare Workers, Deno). */
+    async constructEventAsync(payload, header, secret, tolerance) {
+        const text = payloadText(payload);
+        const h = headerText(header);
+        const opts = typeof tolerance === 'number' ? { tolerance } : (tolerance ?? {});
+        const parsed = parseSignatureHeader(h);
+        let hex = '';
+        if (parsed && secret) {
+            const enc = new TextEncoder();
+            const key = await globalThis.crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+            const sig = new Uint8Array(await globalThis.crypto.subtle.sign('HMAC', key, enc.encode(`${parsed.timestamp}.${text}`)));
+            hex = [...sig].map((b) => b.toString(16).padStart(2, '0')).join('');
+        }
+        check(text, h, secret, opts, () => hex);
+        return parseEvent(text, h);
+    }
+    /** True when the signature is valid (no exception). */
+    verifySignature(payload, header, secret, opts = {}) {
+        try {
+            const text = payloadText(payload);
+            check(text, headerText(header), secret, opts, (t) => computeSignature(text, secret, t));
+            return true;
+        }
+        catch (err) {
+            if (err instanceof CheckboxSignatureVerificationError)
+                return false;
+            throw err;
+        }
+    }
+    /** Builds a valid Checkbox-Signature header for a payload (for your tests). */
+    generateTestHeaderString(opts) {
+        const t = opts.timestamp ?? Math.floor(Date.now() / 1000);
+        return `t=${t},v1=${computeSignature(opts.payload, opts.secret, t)}`;
+    }
+}
+export const webhooks = new Webhooks();

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "@checkbox-site/node",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Checkbox Node.js SDK: automatic-renewal-law compliance (ROSCA, California ARL, New York and other state laws) for subscription businesses. Zero dependencies. Published to npm as @checkbox-site/node.",
+  "keywords": [
+    "subscription",
+    "auto-renewal",
+    "automatic-renewal",
+    "compliance",
+    "rosca",
+    "click-to-cancel",
+    "california-arl",
+    "stripe",
+    "stripe-checkout",
+    "checkout",
+    "cancellation"
+  ],
+  "license": "MIT",
+  "author": "Checkbox <support@checkbox.site>",
+  "homepage": "https://checkbox.site/docs",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/checkbox-site/checkbox.git",
+    "directory": "node"
+  },
+  "bugs": {
+    "url": "https://github.com/checkbox-site/checkbox/issues",
+    "email": "support@checkbox.site"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "sideEffects": false,
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "prepack": "npm run build"
+  }
+}