@omega.js/manager 0.1.0

package/dist/services/payment/lib/paypal-api.js

@@ -0,0 +1,354 @@
+/**
+ * PayPal REST API wrapper — OAuth2 client credentials with live/sandbox
+ * auto-detection (first auth probes both endpoints in parallel). Ported from
+ * omega-manager minus the subscription-inspection methods (they belong to
+ * the migrations port) and the unused plan/webhook helpers.
+ */
+const LIVE_URL = 'https://api-m.paypal.com';
+const SANDBOX_URL = 'https://api-m.sandbox.paypal.com';
+
+class PayPalAPI {
+  constructor(clientId, clientSecret) {
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.baseUrl = null; // Resolved on first auth
+    this.accessToken = null;
+    this.tokenExpiry = 0;
+    this.appId = null; // From token response
+  }
+
+  /**
+   * Try to authenticate against a specific PayPal endpoint.
+   * Returns the token response data on success, null on auth failure.
+   */
+  static async tryAuth(clientId, clientSecret, baseUrl) {
+    const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
+
+    const response = await fetch(`${baseUrl}/v1/oauth2/token`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Basic ${credentials}`,
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: 'grant_type=client_credentials',
+    });
+
+    if (!response.ok) {
+      return null;
+    }
+
+    return response.json();
+  }
+
+  /**
+   * Get OAuth2 access token (cached until expiry).
+   * On first call, tries both live and sandbox simultaneously to detect the right endpoint.
+   */
+  async getAccessToken() {
+    if (this.accessToken && Date.now() < this.tokenExpiry) {
+      return this.accessToken;
+    }
+
+    // First auth — try both endpoints in parallel
+    if (!this.baseUrl) {
+      const [liveResult, sandboxResult] = await Promise.all([
+        PayPalAPI.tryAuth(this.clientId, this.clientSecret, LIVE_URL),
+        PayPalAPI.tryAuth(this.clientId, this.clientSecret, SANDBOX_URL),
+      ]);
+
+      if (liveResult) {
+        this._applyToken(liveResult, LIVE_URL);
+        return this.accessToken;
+      }
+
+      if (sandboxResult) {
+        this._applyToken(sandboxResult, SANDBOX_URL);
+        return this.accessToken;
+      }
+
+      throw new Error('PayPal auth failed on both live and sandbox — check paypal.clientId and PAYPAL_CLIENT_SECRET');
+    }
+
+    // Subsequent auths — use the resolved endpoint
+    const result = await PayPalAPI.tryAuth(this.clientId, this.clientSecret, this.baseUrl);
+    if (!result) {
+      throw new Error(`PayPal auth failed (${this.baseUrl})`);
+    }
+
+    this._applyToken(result);
+    return this.accessToken;
+  }
+
+  /**
+   * Store token data from an auth response
+   */
+  _applyToken(data, baseUrl) {
+    if (baseUrl) {
+      this.baseUrl = baseUrl;
+    }
+    this.accessToken = data.access_token;
+    this.tokenExpiry = Date.now() + (data.expires_in - 60) * 1000;
+    this.appId = data.app_id || this.appId;
+  }
+
+  /**
+   * Get account info derived from the token response.
+   * Must call getAccessToken() first.
+   */
+  getAccountInfo() {
+    return {
+      appId: this.appId,
+      environment: this.baseUrl === SANDBOX_URL ? 'sandbox' : 'live',
+      clientId: this.clientId,
+    };
+  }
+
+  /**
+   * Make an authenticated request to PayPal API
+   */
+  async makeRequest(method, path, body, extraHeaders) {
+    const token = await this.getAccessToken();
+
+    const options = {
+      method,
+      headers: {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        ...extraHeaders,
+      },
+    };
+
+    if (body) {
+      options.body = JSON.stringify(body);
+    }
+
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      ...options,
+      signal: AbortSignal.timeout(30000),
+    });
+
+    // PATCH returns 204 No Content on success
+    if (response.status === 204) {
+      return null;
+    }
+
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`PayPal API error (${response.status} ${method} ${path}): ${text}`);
+    }
+
+    return response.json();
+  }
+
+  /**
+   * Paginate through a PayPal list endpoint, collecting all items.
+   *
+   * @param {string} basePath - Base API path (e.g. '/v1/catalogs/products')
+   * @param {string} itemsKey - Key in response containing items (e.g. 'products')
+   * @param {Object} [extraParams] - Additional query params
+   * @param {Object} [extraHeaders] - Additional request headers
+   * @returns {Array} All items across all pages
+   */
+  async paginate(basePath, itemsKey, extraParams = {}, extraHeaders) {
+    const allItems = [];
+    let page = 1;
+    const pageSize = 20;
+
+    while (true) {
+      const params = new URLSearchParams({
+        page_size: pageSize,
+        page: page,
+        total_required: true,
+        ...extraParams,
+      });
+
+      const response = await this.makeRequest('GET', `${basePath}?${params}`, null, extraHeaders);
+      const items = response?.[itemsKey] || [];
+      allItems.push(...items);
+
+      const total = response?.total_items || 0;
+      if (allItems.length >= total || items.length < pageSize) {
+        break;
+      }
+
+      page++;
+    }
+
+    return allItems;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Catalog Products
+  // ---------------------------------------------------------------------------
+
+  /**
+   * List all catalog products (paginated)
+   */
+  async listProducts() {
+    return this.paginate('/v1/catalogs/products', 'products');
+  }
+
+  /**
+   * Retrieve a catalog product by ID
+   */
+  async getProduct(productId) {
+    return this.makeRequest('GET', `/v1/catalogs/products/${productId}`);
+  }
+
+  /**
+   * Create a catalog product
+   */
+  async createProduct({ name, description, type = 'SERVICE', imageUrl, homeUrl }) {
+    const body = {
+      name,
+      type,
+    };
+
+    if (description) {
+      body.description = description.slice(0, 256); // PayPal limit
+    }
+    if (imageUrl) {
+      body.image_url = imageUrl;
+    }
+    if (homeUrl) {
+      body.home_url = homeUrl;
+    }
+
+    return this.makeRequest('POST', '/v1/catalogs/products', body);
+  }
+
+  /**
+   * Update a catalog product using JSON Patch format
+   *
+   * @param {string} productId - PayPal product ID
+   * @param {Array} patches - Array of JSON Patch operations
+   *   e.g. [{ op: 'replace', path: '/description', value: 'new desc' }]
+   */
+  async updateProduct(productId, patches) {
+    return this.makeRequest('PATCH', `/v1/catalogs/products/${productId}`, patches);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Billing Plans (subscriptions)
+  // ---------------------------------------------------------------------------
+
+  /**
+   * List billing plans filtered by product ID (with full details including billing_cycles).
+   * Paginated — returns ALL plans for the product.
+   */
+  async listPlansForProduct(productId) {
+    return this.paginate(
+      '/v1/billing/plans',
+      'plans',
+      { product_id: productId },
+      { 'Prefer': 'return=representation' },
+    );
+  }
+
+  /**
+   * Deactivate a billing plan (stops new subscriptions, existing ones continue)
+   */
+  async deactivatePlan(planId) {
+    return this.makeRequest('POST', `/v1/billing/plans/${planId}/deactivate`);
+  }
+
+  /**
+   * Create a billing plan for a product
+   *
+   * @param {Object} options
+   * @param {string} options.productId - PayPal catalog product ID
+   * @param {string} options.name - Plan name (e.g. "Chatsy - Plus (Monthly)")
+   * @param {string} options.interval - 'monthly' or 'annually'
+   * @param {number} options.amount - Price amount (e.g. 28)
+   * @param {string} [options.currency='USD'] - Currency code
+   * @param {number} [options.trialDays=0] - Trial period in days
+   */
+  async createPlan({ productId, name, interval, amount, currency = 'USD', trialDays = 0 }) {
+    const billingCycles = [];
+
+    // Add trial cycle if specified
+    if (trialDays > 0) {
+      billingCycles.push({
+        frequency: {
+          interval_unit: 'DAY',
+          interval_count: 1,
+        },
+        tenure_type: 'TRIAL',
+        sequence: 1,
+        total_cycles: trialDays,
+        pricing_scheme: {
+          fixed_price: {
+            value: '0',
+            currency_code: currency,
+          },
+        },
+      });
+    }
+
+    // Regular billing cycle
+    billingCycles.push({
+      frequency: {
+        interval_unit: { annually: 'YEAR', monthly: 'MONTH', weekly: 'WEEK', daily: 'DAY' }[interval] || 'MONTH',
+        interval_count: 1,
+      },
+      tenure_type: 'REGULAR',
+      sequence: trialDays > 0 ? 2 : 1,
+      total_cycles: 0, // 0 = infinite
+      pricing_scheme: {
+        fixed_price: {
+          value: amount.toFixed(2),
+          currency_code: currency,
+        },
+      },
+    });
+
+    const body = {
+      product_id: productId,
+      name,
+      billing_cycles: billingCycles,
+      payment_preferences: {
+        auto_bill_outstanding: true,
+        payment_failure_threshold: 3,
+      },
+    };
+
+    return this.makeRequest('POST', '/v1/billing/plans', body);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Webhooks
+  // ---------------------------------------------------------------------------
+
+  /**
+   * List all webhook endpoints
+   */
+  async listWebhooks() {
+    return this.makeRequest('GET', '/v1/notifications/webhooks');
+  }
+
+  /**
+   * Create a webhook endpoint
+   */
+  async createWebhook(url, eventTypes) {
+    return this.makeRequest('POST', '/v1/notifications/webhooks', {
+      url,
+      event_types: eventTypes.map((name) => ({ name })),
+    });
+  }
+
+  /**
+   * Update a webhook endpoint using JSON Patch format
+   */
+  async updateWebhook(webhookId, patches) {
+    return this.makeRequest('PATCH', `/v1/notifications/webhooks/${webhookId}`, patches);
+  }
+
+  /**
+   * Delete a webhook endpoint (204 No Content on success)
+   */
+  async deleteWebhook(webhookId) {
+    return this.makeRequest('DELETE', `/v1/notifications/webhooks/${webhookId}`);
+  }
+}
+
+module.exports = { PayPalAPI };

package/dist/services/payment/lib/provider-setup.js

@@ -0,0 +1,134 @@
+/**
+ * Interactive payment-provider credential entry — one provider's instance of
+ * the shared setup contract (#608): the same Provide / Skip / Disable gate
+ * every service opens with (lib/config-flow.js confirmSetup, the ONE home of
+ * that wording), then the provider dashboard and its keys. Public halves
+ * (publishable key, client id, site) land in omega.json5 via the
+ * comment-preserving writeback — a provider with no public half declares none
+ * (coinbase, whose API key is the whole credential) — and the SECRET half rides
+ * the shared helper
+ * (lib/service-input.js), which persists it to the brand .env and exports it
+ * so the current run proceeds immediately. Disable writes
+ * `payment.providers.<name>: false` so the run stops asking — permanently.
+ *
+ * Non-interactive or dry-run sessions return false without prompting — the
+ * provider stays unconfigured and its operations print their dim note.
+ */
+const chalk = require('chalk').default;
+const { input } = require('../../../vendor/devkit/prompt.js');
+const { serviceInputSpec } = require('../../../config.js');
+const { writeBrandConfig } = require('../../../lib/config-write.js');
+const { confirmSetup, setAtPath } = require('../../../lib/config-flow.js');
+const { requestServiceInput } = require('../../../lib/service-input.js');
+const { canPrompt } = require('../../../lib/run-gates.js');
+
+// Per provider: the dashboard to open, and the PUBLIC halves that land in
+// omega.json5. The secret half's descriptor (name, mint URL, hint) lives once,
+// in the REQUIRES registry — never re-spelled here.
+const PROVIDERS = {
+  stripe: {
+    label: 'Stripe',
+    url: 'https://dashboard.stripe.com/apikeys',
+    instructions: 'Create or switch to the brand\'s Stripe account, then go to Developers → API keys.',
+    secret: 'STRIPE_SECRET_KEY',
+    fields: [
+      {
+        message: 'Stripe publishable key (pk_live_... or pk_test_...):',
+        validate: (val) => (val?.trim().startsWith('pk_') ? true : 'Must start with pk_live_ or pk_test_'),
+        configPath: 'payment.providers.stripe.publishableKey',
+      },
+    ],
+  },
+  paypal: {
+    label: 'PayPal',
+    url: 'https://developer.paypal.com/dashboard/applications',
+    instructions: 'Create or open the brand\'s REST API app (live), then copy its credentials.',
+    secret: 'PAYPAL_CLIENT_SECRET',
+    fields: [
+      {
+        message: 'PayPal client ID:',
+        validate: (val) => (val?.trim() ? true : 'Required'),
+        configPath: 'payment.providers.paypal.clientId',
+      },
+    ],
+  },
+  chargebee: {
+    label: 'Chargebee',
+    url: 'https://app.chargebee.com/',
+    instructions: 'Open the brand\'s Chargebee site, then go to Settings → API keys.',
+    secret: 'CHARGEBEE_API_KEY',
+    fields: [
+      {
+        message: 'Chargebee site (the {site}.chargebee.com subdomain):',
+        validate: (val) => (val?.trim() ? true : 'Required'),
+        configPath: 'payment.providers.chargebee.site',
+      },
+    ],
+  },
+  // The one provider with NO public half ([#642](https://github.com/Omega-JS-Stack/omega/issues/642)):
+  // the Coinbase Commerce API key is the entire credential, so `fields` is empty
+  // and nothing is written to omega.json5 — the gate and the secret ask are the
+  // whole flow. Its Disable therefore lands on `enabled`, the switch the schema
+  // declares and the checkout reads, rather than on the provider block the
+  // siblings turn off.
+  coinbase: {
+    label: 'Coinbase Commerce',
+    url: 'https://commerce.coinbase.com/settings/security',
+    instructions: 'Open the brand\'s Coinbase Commerce account, then go to Settings → Security → API keys.',
+    secret: 'COINBASE_COMMERCE_API_KEY',
+    disablePath: 'payment.providers.coinbase.enabled',
+    fields: [],
+  },
+};
+
+/**
+ * Run the credential-entry flow for one provider. Returns true when
+ * credentials were landed (config + .env + process.env), false otherwise.
+ *
+ * @param {Object} context - Service context (brandConfig, brandRoot, options)
+ * @param {string} name - 'stripe' | 'paypal' | 'chargebee' | 'coinbase'
+ */
+async function providerSetupFlow(context, name) {
+  if (!canPrompt(context.options)) {
+    return false;
+  }
+
+  const provider = PROVIDERS[name];
+  // Where Disable lands `false`. The provider BLOCK is the switch for the ones
+  // whose public data enables them; a provider carrying its own switch names it
+  // (coinbase's `enabled`, #642), so the off state is the one shape the schema
+  // declares and every reader already gates on.
+  const disablePath = provider.disablePath || `payment.providers.${name}`;
+
+  // The uniform gate — Disable lands `payment.providers.<name>: false`
+  const action = await confirmSetup(context, {
+    label: provider.label,
+    instructions: [provider.instructions, `URL: ${chalk.cyan(provider.url)}`],
+    disablePath,
+  });
+  if (action !== 'yes') {
+    return false;
+  }
+
+  // The public halves land in omega.json5; the dashboard is opened by the
+  // secret ask below (Enter-gated, the house rule) — one page, both keys.
+  const configEdits = {};
+  for (const field of provider.fields) {
+    const value = (await input({ message: field.message, validate: field.validate })).trim();
+    configEdits[field.configPath] = value;
+    setAtPath(context.brandConfig, field.configPath, value);
+  }
+  writeBrandConfig(context, configEdits);
+
+  // The secret half through the shared helper — the gate already ran, so it
+  // goes straight to the guided paste, the brand .env, and process.env
+  const gate = await requestServiceInput(context, serviceInputSpec('payment', {
+    names: [provider.secret],
+    label: provider.label,
+    gate: false,
+  }));
+
+  return gate === null;
+}
+
+module.exports = { providerSetupFlow };

package/dist/services/payment/lib/stripe-api.js

@@ -0,0 +1,152 @@
+/**
+ * Stripe API wrapper — the official SDK behind the method surface the
+ * payment operations actually use (accounts, products, prices, webhook
+ * endpoints). omega-manager's wrapper also carried test clocks, customers,
+ * subscriptions, and Radar-rule methods; the first three ride the
+ * testing-live port and the Radar methods were dead code (Stripe has no
+ * Radar rules API — the stripe-radar operation is manual guidance).
+ */
+const Stripe = require('stripe');
+
+class StripeAPI {
+  constructor(secretKey) {
+    this.stripe = new Stripe(secretKey);
+  }
+
+  /**
+   * Retrieve the current Stripe account
+   */
+  async getAccount() {
+    return this.stripe.accounts.retrieve();
+  }
+
+  /**
+   * Update a Stripe account's settings
+   */
+  async updateAccount(accountId, updates) {
+    return this.stripe.accounts.update(accountId, updates);
+  }
+
+  /**
+   * Retrieve a product by ID
+   */
+  async getProduct(productId) {
+    return this.stripe.products.retrieve(productId);
+  }
+
+  /**
+   * Create a Stripe product with full brand/product details
+   */
+  async createProduct({ name, brandId, productId, description, images, url }) {
+    const params = {
+      name,
+      metadata: { brandId, productId },
+    };
+
+    if (description) {
+      params.description = description;
+    }
+    if (images?.length) {
+      params.images = images;
+    }
+    if (url) {
+      params.url = url;
+    }
+
+    return this.stripe.products.create(params);
+  }
+
+  /**
+   * Update an existing Stripe product
+   */
+  async updateProduct(stripeProductId, updates) {
+    return this.stripe.products.update(stripeProductId, updates);
+  }
+
+  /**
+   * List all products (auto-paginates)
+   */
+  async listAllProducts() {
+    const products = [];
+    for await (const product of this.stripe.products.list({ limit: 100 })) {
+      products.push(product);
+    }
+    return products;
+  }
+
+  /**
+   * List all prices for a product (auto-paginates)
+   */
+  async listPricesForProduct(productId) {
+    const prices = [];
+    for await (const price of this.stripe.prices.list({ product: productId, limit: 100 })) {
+      prices.push(price);
+    }
+    return prices;
+  }
+
+  /**
+   * Create a recurring price (monthly or annually)
+   */
+  async createRecurringPrice(productId, amount, interval, currency = 'usd') {
+    return this.stripe.prices.create({
+      product: productId,
+      unit_amount: Math.round(amount * 100), // Stripe uses cents
+      currency,
+      recurring: {
+        interval: { annually: 'year', monthly: 'month', weekly: 'week', daily: 'day' }[interval] || 'month',
+      },
+    });
+  }
+
+  /**
+   * Create a one-time price
+   */
+  async createOneTimePrice(productId, amount, currency = 'usd') {
+    return this.stripe.prices.create({
+      product: productId,
+      unit_amount: Math.round(amount * 100),
+      currency,
+    });
+  }
+
+  /**
+   * Archive a price (set active: false). Stripe does not support deleting prices.
+   */
+  async archivePrice(priceId) {
+    return this.stripe.prices.update(priceId, { active: false });
+  }
+
+  /**
+   * List all webhook endpoints on this account
+   */
+  async listWebhookEndpoints() {
+    return this.stripe.webhookEndpoints.list({ limit: 100 });
+  }
+
+  /**
+   * Create a webhook endpoint
+   */
+  async createWebhookEndpoint(url, enabledEvents) {
+    return this.stripe.webhookEndpoints.create({
+      url,
+      enabled_events: enabledEvents,
+    });
+  }
+
+  /**
+   * Update a webhook endpoint ({ enabled_events }, { disabled }, etc.)
+   */
+  async updateWebhookEndpoint(webhookId, params) {
+    return this.stripe.webhookEndpoints.update(webhookId, params);
+  }
+
+  /**
+   * Delete a webhook endpoint
+   */
+  async deleteWebhookEndpoint(webhookId) {
+    return this.stripe.webhookEndpoints.del(webhookId);
+  }
+}
+
+module.exports = { StripeAPI };

package/dist/services/repo/ensure/org.js

@@ -0,0 +1,70 @@
+/**
+ * Ensure the GitHub org profile matches the brand — display name, support
+ * email, billing email, description (160-char org limit), blog URL, and
+ * location (only when github.location is configured; omega-manager hardcoded
+ * a country — company/brand config owns that choice now).
+ *
+ * Skipped entirely for shared orgs (filtered in the service setup).
+ */
+const chalk = require('chalk').default;
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+module.exports = async function ensureOrg(context) {
+  const { brandConfig, options = {}, githubApi: api } = context;
+
+  const github = brandConfig.repo?.providers?.github;
+  const org = api.getOrg(github.org);
+
+  if (!org) {
+    console.log(`      ${chalk.dim(`⊘ ${github.org} is not an organization — org-level settings don't apply`)}`);
+    return { status: 'success', output: { org: { skipped: 'owner is not an organization' } } };
+  }
+
+  const name = brandConfig.brand?.name;
+  const domain = (brandConfig.brand?.url || '').replace(/^https?:\/\//, '');
+  // GitHub org description has a 160 character limit
+  const fullDescription = brandConfig.brand?.description || '';
+  const description = fullDescription.length > 160
+    ? fullDescription.slice(0, 157) + '...'
+    : fullDescription;
+
+  const supportEmail = `support@${domain}`;
+  const desired = {
+    name: name || org.name,
+    email: supportEmail,
+    billing_email: supportEmail,
+    description: description || org.description || '',
+    blog: `https://${domain}`,
+  };
+
+  if (github.location) {
+    desired.location = github.location;
+  }
+
+  // Diff current vs desired — only drifted fields get patched
+  const updates = {};
+  for (const [key, value] of Object.entries(desired)) {
+    if (org[key] !== value) {
+      updates[key] = value;
+      console.log(`      ${key}: "${org[key] || '(none)'}" ${chalk.dim('→')} "${chalk.cyan(value)}"`);
+    }
+  }
+
+  if (Object.keys(updates).length === 0) {
+    console.log(`      ${chalk.green('✓')} Org settings already configured`);
+    return { status: 'success' };
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan('update org settings', { status: 'success', output: { org: { planned: Object.keys(updates) } } });
+  }
+
+  try {
+    api.updateOrg(github.org, updates);
+    console.log(`      ${chalk.green('✓')} Org settings updated`);
+    return { status: 'success', output: { org: { updated: Object.keys(updates) } } };
+  } catch (error) {
+    console.log(`      ${chalk.red('✗')} Failed to update org${chalk.dim(`: ${error.message}`)}`);
+    return { status: 'error', error: error.message };
+  }
+};