@birtalanrobert/commerce 2.0.0 → 3.1.0

package/README.md

@@ -27,7 +27,7 @@ canTakeMoney('pending'); // false — the provider has not verified them yet
 ## Using it in a NestJS application
 
 ```ts
-import { StripeConnect } from '@birtalanrobert/commerce';
+import { StripeConnect } from '@birtalanrobert/commerce/stripe';
 import {
   COMMERCE_PROVIDER,
   CommerceService,
@@ -55,6 +55,20 @@ export class PaymentsModule {}
 Register `commerceEntities` and `commerceMigrations` with the data source, as
 with every other package here.
 
+Where a deployment takes no card payments — which is most of them in some
+categories — provide `NoPayments` instead of `StripeConnect`. It reports `none`
+and refuses every operation, so every gate that already asks whether a business
+can be paid out answers no. **Do not construct the vendor client with an empty
+key**: it throws inside its own constructor and the application does not start.
+
+**Three entry points, and the split is deliberate.** The root is pure — what a
+deposit comes to, whether a business may sell yet, whether a payment can still
+be refunded — because a console decides all three while somebody drags a
+slider. `/nestjs` holds the service, the entities and the migrations.
+`/stripe` holds the vendor's client on its own, because importing it pulls in
+the whole SDK, and a barrel that re-exported it once put a payments SDK into a
+booking console's first load.
+
 ## The parts worth knowing before using it
 
 - **A business cannot be charged for until the provider says it may be paid

package/dist/index.d.ts

@@ -12,13 +12,15 @@
  * the mistake that makes both hard to reason about — they differ in who pays
  * whom, in which Stripe account, and in what happens when one fails.
  *
- * **This entry point is pure.** What a deposit comes to and whether a business
- * may sell yet are decided without a database or a provider, because a console
- * shows both while somebody drags a slider. Everything needing storage or
- * somebody else's money-moving licence is behind `/nestjs`.
+ * **This entry point is pure**, and stays that way by leaving things out. What
+ * a deposit comes to and whether a business may sell yet are decided without a
+ * database or a provider, because a console shows both while somebody drags a
+ * slider. Storage and the container are behind `/nestjs`; the Stripe client is
+ * behind `/stripe`, because a barrel that re-exports it puts the vendor's whole
+ * SDK into every bundle that wanted to divide a price by three.
  */
 export { balanceAfter, canTakeMoney, depositFor, payoutBlockReason, type DepositKind, type DepositPolicy, type PayoutStatus, } from './deposits';
 export { isRefundable, refundableAmount, type PaymentKind, type PaymentMethod, type PaymentState, } from './payments';
+export { NoPayments } from './providers/none';
 export type { ChargeRequest, ChargeResult, OnboardingLink, PaymentProvider, ProviderAccount, ProviderEvent, RefundRequest, SaveCardRequest, SaveCardResult, StoredCard, } from './providers/port';
-export { StripeConnect, type StripeConnectOptions } from './providers/stripe';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,YAAY,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.StripeConnect = exports.refundableAmount = exports.isRefundable = exports.payoutBlockReason = exports.depositFor = exports.canTakeMoney = exports.balanceAfter = void 0;
+exports.NoPayments = exports.refundableAmount = exports.isRefundable = exports.payoutBlockReason = exports.depositFor = exports.canTakeMoney = exports.balanceAfter = void 0;
 /**
  * Taking money on a business's behalf.
  *
@@ -15,10 +15,12 @@ exports.StripeConnect = exports.refundableAmount = exports.isRefundable = export
  * the mistake that makes both hard to reason about — they differ in who pays
  * whom, in which Stripe account, and in what happens when one fails.
  *
- * **This entry point is pure.** What a deposit comes to and whether a business
- * may sell yet are decided without a database or a provider, because a console
- * shows both while somebody drags a slider. Everything needing storage or
- * somebody else's money-moving licence is behind `/nestjs`.
+ * **This entry point is pure**, and stays that way by leaving things out. What
+ * a deposit comes to and whether a business may sell yet are decided without a
+ * database or a provider, because a console shows both while somebody drags a
+ * slider. Storage and the container are behind `/nestjs`; the Stripe client is
+ * behind `/stripe`, because a barrel that re-exports it puts the vendor's whole
+ * SDK into every bundle that wanted to divide a price by three.
  */
 var deposits_1 = require("./deposits");
 Object.defineProperty(exports, "balanceAfter", { enumerable: true, get: function () { return deposits_1.balanceAfter; } });
@@ -28,6 +30,16 @@ Object.defineProperty(exports, "payoutBlockReason", { enumerable: true, get: fun
 var payments_1 = require("./payments");
 Object.defineProperty(exports, "isRefundable", { enumerable: true, get: function () { return payments_1.isRefundable; } });
 Object.defineProperty(exports, "refundableAmount", { enumerable: true, get: function () { return payments_1.refundableAmount; } });
-var stripe_1 = require("./providers/stripe");
-Object.defineProperty(exports, "StripeConnect", { enumerable: true, get: function () { return stripe_1.StripeConnect; } });
+var none_1 = require("./providers/none");
+Object.defineProperty(exports, "NoPayments", { enumerable: true, get: function () { return none_1.NoPayments; } });
+/*
+ * `StripeConnect` is deliberately NOT re-exported here.
+ *
+ * It lives at `@birtalanrobert/commerce/stripe`, because importing it pulls in
+ * the vendor's whole SDK — and this entry point is imported by browser code
+ * that only wants to know what a deposit comes to. Re-exporting it put 30 KB of
+ * a payments SDK into a console's first load for a screen that never calls it:
+ * a barrel is a bundling decision, and the only way to keep this one pure is to
+ * leave the heavy thing out of it.
+ */
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,uCAQoB;AAPlB,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AAMnB,uCAMoB;AALlB,wGAAA,YAAY,OAAA;AACZ,4GAAA,gBAAgB,OAAA;AAmBlB,6CAA8E;AAArE,uGAAA,aAAa,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uCAQoB;AAPlB,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AAMnB,uCAMoB;AALlB,wGAAA,YAAY,OAAA;AACZ,4GAAA,gBAAgB,OAAA;AAMlB,yCAA8C;AAArC,kGAAA,UAAU,OAAA;AAenB;;;;;;;;;GASG"}

package/dist/nestjs/index.d.ts

@@ -16,6 +16,6 @@ import { Payment, PaymentRefund } from './payment.entity';
 import { SavedCard } from './saved-card.entity';
 import { CreateCommerce1789800000000 } from '../migrations/1789800000000-CreateCommerce';
 /** Register with the data source, the way every other mortar package is. */
-export declare const commerceEntities: (typeof PayoutAccount | typeof Payment | typeof PaymentRefund | typeof SavedCard)[];
+export declare const commerceEntities: (typeof PayoutAccount | typeof Payment | typeof SavedCard | typeof PaymentRefund)[];
 export declare const commerceMigrations: (typeof CreateCommerce1789800000000)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/none.d.ts

@@ -0,0 +1,50 @@
+import type { ChargeRequest, ChargeResult, OnboardingLink, PaymentProvider, ProviderAccount, RefundRequest, SaveCardRequest, SaveCardResult, StoredCard } from './port';
+/**
+ * No payment provider at all, said out loud rather than by failing.
+ *
+ * **Online payment is optional and never mandatory**, and this is what makes
+ * that true in the code rather than only in a document. A salon that takes cash
+ * at the counter and has never heard of Stripe runs its whole diary, writes
+ * down what it took, and reports on it — and nothing about that deployment
+ * should require a payment account to exist, least of all the application
+ * starting up.
+ *
+ * The alternative that looks simpler is constructing the vendor's client with
+ * an empty key. It throws inside its own constructor, and the whole API fails
+ * to boot — which is how this was found.
+ *
+ * **Not a permissive no-op.** Every operation refuses, and the account reports
+ * `none`, so every gate that already asks "can this business be paid out?"
+ * answers no without a special case. A provider that quietly returned success
+ * would write a trail of payments that never happened, which is worse than the
+ * crash it replaced.
+ */
+export declare class NoPayments implements PaymentProvider {
+    readonly name = "none";
+    onboard(): Promise<OnboardingLink>;
+    /**
+     * `none` rather than `pending`.
+     *
+     * They are different facts: `pending` means the provider is still checking,
+     * and a business told that will wait for an email that is never coming.
+     */
+    account(externalId: string | null): Promise<ProviderAccount>;
+    charge(_request: ChargeRequest): Promise<ChargeResult>;
+    capture(): Promise<ChargeResult>;
+    release(): Promise<void>;
+    refund(_request: RefundRequest): Promise<{
+        externalId: string;
+    }>;
+    saveCard(_request: SaveCardRequest): Promise<SaveCardResult>;
+    storedCard(): Promise<StoredCard | undefined>;
+    forgetCard(): Promise<void>;
+    /**
+     * Never genuine.
+     *
+     * A deployment with no provider has no webhook to receive, so anything
+     * arriving at that address came from somebody else — and `undefined` is how
+     * the port says "not from the provider".
+     */
+    verify(): undefined;
+}
+//# sourceMappingURL=none.d.ts.map

package/dist/providers/none.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"none.d.ts","sourceRoot":"","sources":["../../src/providers/none.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,UAAU,EACX,MAAM,QAAQ,CAAC;AAEhB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,UAAW,YAAW,eAAe;IAChD,QAAQ,CAAC,IAAI,UAAU;IAEjB,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IAIxC;;;;;OAKG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAI5D,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAQtD,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IAIhC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAIhE,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5D,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;;OAMG;IACH,MAAM,IAAI,SAAS;CAGpB"}

package/dist/providers/none.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoPayments = void 0;
+/**
+ * No payment provider at all, said out loud rather than by failing.
+ *
+ * **Online payment is optional and never mandatory**, and this is what makes
+ * that true in the code rather than only in a document. A salon that takes cash
+ * at the counter and has never heard of Stripe runs its whole diary, writes
+ * down what it took, and reports on it — and nothing about that deployment
+ * should require a payment account to exist, least of all the application
+ * starting up.
+ *
+ * The alternative that looks simpler is constructing the vendor's client with
+ * an empty key. It throws inside its own constructor, and the whole API fails
+ * to boot — which is how this was found.
+ *
+ * **Not a permissive no-op.** Every operation refuses, and the account reports
+ * `none`, so every gate that already asks "can this business be paid out?"
+ * answers no without a special case. A provider that quietly returned success
+ * would write a trail of payments that never happened, which is worse than the
+ * crash it replaced.
+ */
+class NoPayments {
+    name = 'none';
+    async onboard() {
+        throw new Error('This deployment has no payment provider configured.');
+    }
+    /**
+     * `none` rather than `pending`.
+     *
+     * They are different facts: `pending` means the provider is still checking,
+     * and a business told that will wait for an email that is never coming.
+     */
+    async account(externalId) {
+        return { externalId: externalId ?? '', status: 'none', requirements: [] };
+    }
+    async charge(_request) {
+        return {
+            externalId: '',
+            state: 'failed',
+            detail: 'This business cannot take card payments.',
+        };
+    }
+    async capture() {
+        return { externalId: '', state: 'failed', detail: 'There is nothing to capture.' };
+    }
+    async release() {
+        // Nothing was ever held.
+    }
+    async refund(_request) {
+        throw new Error('Nothing was taken through a provider, so nothing can be given back.');
+    }
+    async saveCard(_request) {
+        throw new Error('This deployment has no payment provider configured.');
+    }
+    async storedCard() {
+        return undefined;
+    }
+    async forgetCard() {
+        // There is nothing stored anywhere to forget.
+    }
+    /**
+     * Never genuine.
+     *
+     * A deployment with no provider has no webhook to receive, so anything
+     * arriving at that address came from somebody else — and `undefined` is how
+     * the port says "not from the provider".
+     */
+    verify() {
+        return undefined;
+    }
+}
+exports.NoPayments = NoPayments;
+//# sourceMappingURL=none.js.map

package/dist/providers/none.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"none.js","sourceRoot":"","sources":["../../src/providers/none.ts"],"names":[],"mappings":";;;AAYA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,UAAU;IACZ,IAAI,GAAG,MAAM,CAAC;IAEvB,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAyB;QACrC,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAuB;QAClC,OAAO;YACL,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,OAAO;QACX,yBAAyB;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAuB;QAClC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAyB;QACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,8CAA8C;IAChD,CAAC;IAED;;;;;;OAMG;IACH,MAAM;QACJ,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA3DD,gCA2DC"}

package/dist/providers/port.d.ts

@@ -14,7 +14,14 @@
 /** Where a business's money goes, as the provider knows it. */
 export interface ProviderAccount {
     readonly externalId: string;
-    readonly status: 'pending' | 'restricted' | 'ready';
+    /**
+     * `none` is a real answer, not an absence.
+     *
+     * It is what a deployment with no payment provider configured says, and it is
+     * different from `pending`: `pending` means somebody is checking, and a
+     * business told that will wait for an email nobody is going to send.
+     */
+    readonly status: 'none' | 'pending' | 'restricted' | 'ready';
     /** What the provider still wants, in its own words. */
     readonly requirements: readonly string[];
 }

package/dist/providers/port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/providers/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;IACpD,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE1F,yEAAyE;IACzE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9F,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEtD,wEAAwE;IACxE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEpE,+CAA+C;IAC/C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5D;;;;;;OAMG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhE;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;CAC5F"}
+{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/providers/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;IAC7D,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE1F,yEAAyE;IACzE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9F,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEtD,wEAAwE;IACxE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEpE,+CAA+C;IAC/C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5D;;;;;;OAMG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhE;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;CAC5F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@birtalanrobert/commerce",
-  "version": "2.0.0",
+  "version": "3.1.0",
   "description": "Taking money on a business's behalf: payout onboarding, payments, refunds and the record of both",
   "license": "AGPL-3.0-only",
   "author": "Robert Birtalan",
@@ -20,6 +20,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./stripe": {
+      "types": "./dist/providers/stripe.d.ts",
+      "default": "./dist/providers/stripe.js"
+    },
     "./nestjs": {
       "types": "./dist/nestjs/index.d.ts",
       "default": "./dist/nestjs/index.js"
@@ -34,16 +38,17 @@
     "README.md",
     "LICENSE",
     "NOTICE",
+    "stripe",
     "nestjs",
     "CHANGELOG.md"
   ],
   "dependencies": {
     "stripe": "^22.6.0",
-    "@birtalanrobert/database": "^1.0.0",
     "@birtalanrobert/context": "^1.1.0",
     "@birtalanrobert/http": "^2.0.0",
+    "@birtalanrobert/money": "^1.0.0",
     "@birtalanrobert/tenancy": "^1.1.0",
-    "@birtalanrobert/money": "^1.0.0"
+    "@birtalanrobert/database": "^1.0.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",

package/src/index.ts

@@ -12,10 +12,12 @@
  * the mistake that makes both hard to reason about — they differ in who pays
  * whom, in which Stripe account, and in what happens when one fails.
  *
- * **This entry point is pure.** What a deposit comes to and whether a business
- * may sell yet are decided without a database or a provider, because a console
- * shows both while somebody drags a slider. Everything needing storage or
- * somebody else's money-moving licence is behind `/nestjs`.
+ * **This entry point is pure**, and stays that way by leaving things out. What
+ * a deposit comes to and whether a business may sell yet are decided without a
+ * database or a provider, because a console shows both while somebody drags a
+ * slider. Storage and the container are behind `/nestjs`; the Stripe client is
+ * behind `/stripe`, because a barrel that re-exports it puts the vendor's whole
+ * SDK into every bundle that wanted to divide a price by three.
  */
 export {
   balanceAfter,
@@ -35,6 +37,8 @@ export {
   type PaymentState,
 } from './payments';
 
+export { NoPayments } from './providers/none';
+
 export type {
   ChargeRequest,
   ChargeResult,
@@ -48,4 +52,13 @@ export type {
   StoredCard,
 } from './providers/port';
 
-export { StripeConnect, type StripeConnectOptions } from './providers/stripe';
+/*
+ * `StripeConnect` is deliberately NOT re-exported here.
+ *
+ * It lives at `@birtalanrobert/commerce/stripe`, because importing it pulls in
+ * the vendor's whole SDK — and this entry point is imported by browser code
+ * that only wants to know what a deposit comes to. Re-exporting it put 30 KB of
+ * a payments SDK into a console's first load for a screen that never calls it:
+ * a barrel is a bundling decision, and the only way to keep this one pure is to
+ * leave the heavy thing out of it.
+ */

package/src/providers/none.ts

@@ -0,0 +1,92 @@
+import type {
+  ChargeRequest,
+  ChargeResult,
+  OnboardingLink,
+  PaymentProvider,
+  ProviderAccount,
+  RefundRequest,
+  SaveCardRequest,
+  SaveCardResult,
+  StoredCard,
+} from './port';
+
+/**
+ * No payment provider at all, said out loud rather than by failing.
+ *
+ * **Online payment is optional and never mandatory**, and this is what makes
+ * that true in the code rather than only in a document. A salon that takes cash
+ * at the counter and has never heard of Stripe runs its whole diary, writes
+ * down what it took, and reports on it — and nothing about that deployment
+ * should require a payment account to exist, least of all the application
+ * starting up.
+ *
+ * The alternative that looks simpler is constructing the vendor's client with
+ * an empty key. It throws inside its own constructor, and the whole API fails
+ * to boot — which is how this was found.
+ *
+ * **Not a permissive no-op.** Every operation refuses, and the account reports
+ * `none`, so every gate that already asks "can this business be paid out?"
+ * answers no without a special case. A provider that quietly returned success
+ * would write a trail of payments that never happened, which is worse than the
+ * crash it replaced.
+ */
+export class NoPayments implements PaymentProvider {
+  readonly name = 'none';
+
+  async onboard(): Promise<OnboardingLink> {
+    throw new Error('This deployment has no payment provider configured.');
+  }
+
+  /**
+   * `none` rather than `pending`.
+   *
+   * They are different facts: `pending` means the provider is still checking,
+   * and a business told that will wait for an email that is never coming.
+   */
+  async account(externalId: string | null): Promise<ProviderAccount> {
+    return { externalId: externalId ?? '', status: 'none', requirements: [] };
+  }
+
+  async charge(_request: ChargeRequest): Promise<ChargeResult> {
+    return {
+      externalId: '',
+      state: 'failed',
+      detail: 'This business cannot take card payments.',
+    };
+  }
+
+  async capture(): Promise<ChargeResult> {
+    return { externalId: '', state: 'failed', detail: 'There is nothing to capture.' };
+  }
+
+  async release(): Promise<void> {
+    // Nothing was ever held.
+  }
+
+  async refund(_request: RefundRequest): Promise<{ externalId: string }> {
+    throw new Error('Nothing was taken through a provider, so nothing can be given back.');
+  }
+
+  async saveCard(_request: SaveCardRequest): Promise<SaveCardResult> {
+    throw new Error('This deployment has no payment provider configured.');
+  }
+
+  async storedCard(): Promise<StoredCard | undefined> {
+    return undefined;
+  }
+
+  async forgetCard(): Promise<void> {
+    // There is nothing stored anywhere to forget.
+  }
+
+  /**
+   * Never genuine.
+   *
+   * A deployment with no provider has no webhook to receive, so anything
+   * arriving at that address came from somebody else — and `undefined` is how
+   * the port says "not from the provider".
+   */
+  verify(): undefined {
+    return undefined;
+  }
+}

package/src/providers/port.ts

@@ -15,7 +15,14 @@
 /** Where a business's money goes, as the provider knows it. */
 export interface ProviderAccount {
   readonly externalId: string;
-  readonly status: 'pending' | 'restricted' | 'ready';
+  /**
+   * `none` is a real answer, not an absence.
+   *
+   * It is what a deployment with no payment provider configured says, and it is
+   * different from `pending`: `pending` means somebody is checking, and a
+   * business told that will wait for an email nobody is going to send.
+   */
+  readonly status: 'none' | 'pending' | 'restricted' | 'ready';
   /** What the provider still wants, in its own words. */
   readonly requirements: readonly string[];
 }

package/stripe/package.json

@@ -0,0 +1,5 @@
+{
+  "main": "../dist/providers/stripe.js",
+  "types": "../dist/providers/stripe.d.ts",
+  "sideEffects": false
+}