---
checkouts: "0.1"
provider: railbed
# test until Live is wired and checked (playbook §8, Go Live), then live.
mode: test
# The ISO 4217 code most products are priced in: USD, EUR, GBP, CAD or AUD.
currency: USD
# The names of the environment variables the checkout reads. Names only: never a value.
secrets: [RAILBED_SECRET_KEY, RAILBED_WEBHOOK_SECRET]
# The webhook receiver's path (not a full URL).
webhook: /api/webhooks/railbed
updated: YYYY-MM-DD
---

# Project name

How this project takes payments. Written by an agent following https://checkouts.md; read it before changing anything that touches payments. Format: https://checkouts.md/spec.md.

<!--
Rules for every agent that edits this file or the code it describes:
R1 Secrets never enter chat, logs or git. Only their names go in CHECKOUTS.md.
R2 Paid means a verified signed webhook, then a re-read of the payment by id. Never the redirect back.
R3 Amounts are decimal strings in the currency's units, like "49.00".
R4 Test before Live, and record the evidence.
R5 Ask the person only for the account and the approval. Everything else is the agent's job.
Never put a secret, a URL with a token, or a buyer's personal details in this file: it is as public as the repository.
-->

## Products

<!-- One row per product. Amounts must match the prices in the code. Leave Currency blank when it's the frontmatter's. -->

| Id | Name | Amount | Currency | What the buyer gets |
|---|---|---|---|---|
| pro | Example product | 49.00 | | One line |

## After payment

<!--
What the project does once an order is paid: what it grants or sends, where that code is, and how it stays
exactly-once (for example: a unique payment_id on orders, and the order marked paid only if it isn't already, in
the same transaction as the grant). Then what happens to held, failed and expired payments.
-->

## Wiring

<!--
Every file that takes part in the checkout, one line each, with what it does. Then the webhook endpoints by id and
path, per mode (we_… ids aren't secret), and where each mode's secrets are kept.
-->

- `path/to/products`: the products and their prices.
- `path/to/checkout-route`: saves the order, creates the checkout session (Idempotency-Key = order id), redirects to it.
- `path/to/pay-button`: the Pay button.
- `path/to/success-page`: shows the order's status from the database; never marks it paid.
- `path/to/webhook-route`: verifies Railbed-Signature, re-reads the payment, fulfils once.
- `path/to/migration`: the `orders` and `railbed_events` tables.
- Webhook endpoints: Test `we_…` at `/api/webhooks/railbed`. Live: not yet.
- Secrets: `RAILBED_SECRET_KEY`, `RAILBED_WEBHOOK_SECRET`. Test values in `.env` (gitignored); Live values in the production host's secret store.

## Evidence

<!--
Newest first. State only what you observed: "builds", "session created", "Test payment simulated", "webhook delivered
and verified", "fulfilled once" and "Live payment received" are different claims. Add rows; don't delete them.
-->

| Date | Mode | Check | Result | Ids |
|---|---|---|---|---|