@fayz-ai/plugin-shop 0.16.16 → 0.17.0

package/dist/index.js

@@ -5792,6 +5792,15 @@ var STRIPE_CONNECT_SETTINGS = [
     defaultValue: ["card"]
   }
 ];
+var STRIPE_CONNECT_FIELDS = [
+  {
+    key: "secretKey",
+    label: "Chave secreta (sk_\u2026)",
+    type: "password",
+    secret: true,
+    placeholder: "Stripe \u2192 Developers \u2192 API keys \u2192 Secret key"
+  }
+];
 var store4 = createConnectionStore(STRIPE_CONNECT_CONNECTOR_ID, {
   settings: STRIPE_CONNECT_SETTINGS
 });
@@ -5833,8 +5842,8 @@ var stripeConnectConnectorDef = {
   description: "Cart\xE3o, Pix e boleto pela Stripe. A loja recebe na conta dela e a Fayz ret\xE9m a taxa na pr\xF3pria cobran\xE7a.",
   icon: "CreditCard",
   category: "payments",
-  // Hosted onboarding rather than a pasted key: the merchant authorizes at
-  // Stripe and nothing secret ever reaches this file.
+  // The OAuth grant on an account the merchant already owns (Connect's OAuth
+  // flow, served by the vault); nothing secret ever reaches this file.
   authKind: "oauth",
   planes: ["request", "sync"],
   direction: "outbound",
@@ -5859,8 +5868,10 @@ var stripeConnectConnectorDef = {
   // Same verdict as the other two gateways: an order that reads as confirmed
   // without a payment is worse than a refused checkout.
   onFailure: "block",
-  // OAuth-shaped: consent is the whole form, and no value is collected here.
-  fields: [],
+  // OAuth-shaped, with a key as the second door: consent is the usual form,
+  // and a merchant who already holds the account may paste its secret key
+  // instead. Either one lands in the vault under this connector.
+  fields: STRIPE_CONNECT_FIELDS,
   settings: STRIPE_CONNECT_SETTINGS,
   invokedAt: [
     {
@@ -5888,10 +5899,10 @@ var stripeConnectConnectorDef = {
   ),
   ...connectionSettings(store4),
   startOAuth: fayzConnectorOAuth(STRIPE_CONNECT_CONNECTOR_ID),
-  // Reached with no values when the browser returns marked `connected`. It is
-  // required even though nothing is collected here: the platform callback stores
-  // the credential but deliberately never touches the pool, so this is the only
-  // thing that writes the tenant's `connections` row.
+  // Reached with no values when the browser returns marked `connected`, and
+  // with none again after a pasted key (the secret goes to the vault, not
+  // here). Required either way: the vault never touches the pool, so this is
+  // the only thing that writes the tenant's `connections` row.
   saveConnection: async () => {
     await store4.save({ active: true });
   },