@owlmeans/server-payment 0.1.18-rc.30 → 0.1.18-rc.32

package/README.md

@@ -40,17 +40,16 @@ declarePaymentPlan(cfg, {
 })
 ```
 
-`declarePaymentPlan` validates each declaration before recording it; `assertPlanDeclarations` checks
-the catalogue as a whole (one free plan per rank, no two paid plans of a product at one rank) and runs
-when the gateway initializes. A limit key may use a different kind on different plans — each kind keeps
-its own counter window, so a lifetime count still sticks to the entity when it moves to a monthly plan.
+`declarePaymentPlan` validates each declaration before recording it;
+`makePlanDeclarationsModel(cfg).assertPlans()` checks the catalogue as a whole (one free plan per
+rank, no two paid plans of a product at one rank) and runs when the gateway initializes. A limit key
+may use a different kind on different plans — each kind keeps its own counter window, so a lifetime
+count still sticks to the entity when it moves to a monthly plan.
 
 ## Wire the services
 
 ```typescript
-import {
-  appendPaymentGatewayService, entitlements, gateway, observer, paymentGateEntrypoints,
-} from '@owlmeans/server-payment'
+import { appendPaymentGatewayService, paymentAccessOf, paymentGateEntrypoints } from '@owlmeans/server-payment'
 
 appendPaymentGatewayService(context)                    // the process that owns Stripe
 appendPaymentGatewayService(context, { manage: false }) // a process that only reads entitlements
@@ -59,11 +58,12 @@ appendPaymentGatewayService(context, { owner: 'app-api', webhookService: 'app-ho
 appendPaymentGatewayService(context, { owner: 'app-api', webhookService: 'app-hooks', bootstrap: false }) // checkout and portal
 export const serverBindings = [...paymentGateEntrypoints]
 
-observer(context).onTopUp(async completion => { /* credit, idempotent by completion.externalId */ })
-observer(context).onSubscription(async event => { /* idempotent by event.eventKey */ })
-observer(context).onRefund(async event => { /* claw back, idempotent by event.eventKey */ })
-observer(context).onDispute(async event => { /* … */ })
-observer(context).onPaymentFailed(async event => { /* notify */ })
+const paid = paymentAccessOf(context).observer()
+paid.onTopUp(async completion => { /* credit, idempotent by completion.externalId */ })
+paid.onSubscription(async event => { /* idempotent by event.eventKey */ })
+paid.onRefund(async event => { /* claw back, idempotent by event.eventKey */ })
+paid.onDispute(async event => { /* … */ })
+paid.onPaymentFailed(async event => { /* notify */ })
 ```
 
 A managed gateway brings Stripe to the declared state at boot — products and prices, one
@@ -77,7 +77,7 @@ Three gateway options place that state when a deployment runs several processes:
 |---|---|---|
 | `webhookService` | `cfg.service` | the `cfg.services` alias whose host and base form the webhook URL — also the portal's deployment key |
 | `owner` | `cfg.service` | the key of the `payment-webhook` rows, the signing-secret lookup, the `portal:<owner>` fingerprint and the Stripe labels |
-| `bootstrap` | `manage` | whether this process runs the bootstrap at boot; a forced one (`resync`, `bootstrapStripe(ctx, stripe, { force: true })`) runs in any managed process |
+| `bootstrap` | `manage` | whether this process runs the bootstrap at boot; a forced one (`resync`, `stripeBootstrapOf(ctx).bootstrapStripe(stripe, { force: true })`) runs in any managed process |
 
 Give every process of the database the same `owner` and `webhookService` (the process that receives
 the webhook), and keep `bootstrap` on that receiver only. Changing `webhookService` moves the
@@ -103,29 +103,40 @@ even an undeliverable local one.
 ## Use it
 
 ```typescript
+const payments = paymentAccessOf(ctx)   // the services, resources and settings of one context
+
 // Checkout and the portal (in-process; resolve the stable entityId at your authenticated boundary)
-const url = await gateway(ctx).createLink(ctx, { productSku: 'app-plans', planSku: 'pro-monthly', entityId, service: 'app', successUrl })
-const portal = await gateway(ctx).portalLink(ctx, entityId, { flow: PortalFlow.Change, planSku: 'pro-monthly', returnUrl })
-await gateway(ctx).grantInternalPlan(ctx, entityId, 'free')   // when the organization is created
+const url = await payments.gateway().createLink(ctx, { productSku: 'app-plans', planSku: 'pro-monthly', entityId, service: 'app', successUrl })
+const portal = await payments.gateway().portalLink(ctx, entityId, { flow: PortalFlow.Change, planSku: 'pro-monthly', returnUrl })
+await payments.gateway().grantInternalPlan(ctx, entityId, 'free')   // when the organization is created
 
 // What the entity may do
-const view = await entitlements(ctx).entitlements(entityId)   // the EntitlementView a UI renders
-await entitlements(ctx).hasCapability(entityId, 'feature:whitelabel')
+const view = await payments.entitlements().entitlements(entityId)   // the EntitlementView a UI renders
+await payments.entitlements().hasCapability(entityId, 'feature:whitelabel')
 
 // Spend a counted allowance — key it by the record it pays for
-await entitlements(ctx).consume({ entityId, limitKey: 'exports', eventKey: `export:${reportId}`, ref: reportId })
-await entitlements(ctx).release({ entityId, limitKey: 'exports', eventKey: `export:${reportId}` })
+await payments.entitlements().consume({ entityId, limitKey: 'exports', eventKey: `export:${reportId}`, ref: reportId })
+await payments.entitlements().release({ entityId, limitKey: 'exports', eventKey: `export:${reportId}` })
 
 // Periodic repair
-await reconcileAll(ctx, { freePlanSku: 'free' })
-await entitlements(ctx).reconcileOccupancy(entityId, 'seats', liveSeatCount)
+await reconcileOf(ctx).reconcileAll({ freePlanSku: 'free' })
+await payments.entitlements().reconcileOccupancy(entityId, 'seats', liveSeatCount)
 ```
 
+The package's functionality comes as objects: pure helpers with a ready instance (`planHelper`,
+`subscriptionHelper`, `checkoutPolicyHelper`, `stripeSessionHelper`, `consumerFormatHelper`,
+`originHelper`) and helpers bound to one context, reached through their accessor — `paymentAccessOf(ctx)`,
+`catalogueOf(ctx)`, `usageOf(ctx)`, `subscriptionCommitOf(ctx)`, `productSyncOf(ctx)`,
+`stripeBootstrapOf(ctx)`, `reconcileOf(ctx)`, `checkoutPluginsOf(ctx)`, `stripeCheckoutOf(ctx)`,
+`stripeSubscriptionsOf(ctx)`, `portalOf(ctx)`, `webhookOf(ctx)`, `estimateOf(ctx)`, `consumerMailOf(ctx)`.
+The former free functions (`gateway`, `reconcileAll`, `webhookUrlOf`, …) remain as
+deprecated delegates.
+
 Routes declare what they need; the gates refuse before the handler:
 
 ```typescript
 protocol(route(...), contract(...), { gate: { alias: ENTITLEMENT_GATE, params: ['feature:whitelabel'] } })
-protocol(route(...), contract(...), { gate: { alias: LIMIT_GATE, params: [formatLimitParam('seats')] } })
+protocol(route(...), contract(...), { gate: { alias: LIMIT_GATE, params: [planLimitHelper.formatLimitParam('seats')] } })
 ```
 
 `CapabilityRequired` and `LimitExhausted` extend `AuthForbidden`, so an HTTP boundary answers 403.
@@ -167,7 +178,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-payment",
-  "version": "0.1.18-rc.30",
-  "generatedAt": "2026-10-05T08:32:19.125Z",
+  "version": "0.1.18-rc.32",
+  "generatedAt": "2026-10-06T11:45:57.672Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-payment/SKILL.md

@@ -7,7 +7,7 @@ user-invocable: false
 
 # @owlmeans/server-payment
 
-**Install:** `bun add @owlmeans/server-payment@^0.1.18-rc.30`
+**Install:** `bun add @owlmeans/server-payment@^0.1.18-rc.32`
 
 Public MIT package. It embeds Stripe into an application backend and owns everything between
 Stripe and an entity's entitlements: the subscription store, one-time fulfillments, the usage
@@ -53,8 +53,8 @@ appendPaymentGatewayService(context, { manage: false })  // a worker that only r
 appendPaymentGatewayService(context, { owner: 'app-api', webhookService: 'app-hooks' })                   // receives the webhook, bootstraps at boot
 appendPaymentGatewayService(context, { owner: 'app-api', webhookService: 'app-hooks', bootstrap: false }) // checkout and portal only
 appendConsumerRights(context, { manage, usage: myUsageMeter })   // before or after the gateway; idempotent
-consumerRights(context).useMailRenderer(myRenderer)      // lazy service: works while wiring
-gateway(context).use(myCheckoutPlugin)                   // a tier / cap / hold plugin — once the context is initialized
+paymentAccessOf(context).consumerRights().useMailRenderer(myRenderer)   // lazy service: works while wiring
+paymentAccessOf(context).gateway().use(myCheckoutPlugin)  // a tier / cap / hold plugin — once the context is initialized
 export const serverBindings = [
   ...paymentGateEntrypoints,                            // the library's own, unpinned `paymentGate`
   ...consumerRightsEntrypoints(consumerProtocols, { guardMoney, throttle, subjectOf, planNameOf }),
@@ -67,7 +67,7 @@ export const hookBindings = [
   bind(own.resync, paymentGateHandlers.resync),
   bind(own.resyncSubscriptions, paymentGateHandlers.resyncSubscriptions),
 ]
-observer(context).onSubscription(async event => { /* keyed by event.eventKey */ })
+paymentAccessOf(context).observer().onSubscription(async event => { /* keyed by event.eventKey */ })
 ```
 
 - `appendPaymentGatewayService` registers twelve resources, the catalogue service
@@ -79,9 +79,9 @@ observer(context).onSubscription(async event => { /* keyed by event.eventKey */
   `usage` and `stripe` are installed on the one service, and `manage` resolves as the application's
   explicit value, else the gateway's, else managed. The consumer-rights resources keep the aliases
   of the first registration.
-- **The consumer-rights service is lazy** (like the completion observer): `consumerRights(ctx)`,
+- **The consumer-rights service is lazy** (like the completion observer): `paymentAccessOf(ctx).consumerRights()`,
   `useMeter` and `useMailRenderer` work while the application is wired; the gateway's initialization
-  initializes it, so its boot checks still run at boot. The gateway is NOT lazy: `gateway(ctx)` (and
+  initializes it, so its boot checks still run at boot. The gateway is NOT lazy: `paymentAccessOf(ctx).gateway()` (and
   `.use(plugin)`) needs the initialized context.
 - **`manage: false`** registers the same surface with no Stripe client: no bootstrap at init, and
   `createLink`, `portalLink`, `resyncSubscription`, `resyncAll`, the webhook route, `withdraw` and
@@ -89,24 +89,24 @@ observer(context).onSubscription(async event => { /* keyed by event.eventKey */
   `amountPolicy`, `planPrices` and the consumer-rights reads, `recordConsent`,
   `recordStartRequest` and `assertConsent` work, because they are Mongo only.
 - **Three keys of a deployment's Stripe state**, each a `PaymentGatewayOptions` field, each read
-  back on the gateway (`gateway(ctx).webhookService / owner / bootstrap`):
+  back on the gateway (`paymentAccessOf(ctx).gateway().webhookService / owner / bootstrap`):
   - `webhookService` (default `cfg.service`) — the `cfg.services` alias whose host and base form
-    `webhookUrlOf`, the portal's deployment key too. Name the process that RECEIVES the webhook
+    `webhookOf(ctx).webhookUrlOf`, the portal's deployment key too. Name the process that RECEIVES the webhook
     (the one serving `paymentGate`) in every process, so every bootstrap computes one URL.
   - `owner` (default `cfg.service`) — the `payment-webhook` rows' `service`, the signing-secret
     lookup, the endpoint's `owlmeans:<owner>` description and `service` metadata, the
     `portal:<owner>` fingerprint and the portal's `service` metadata. One value in every process of
     the database, so each finds and replaces the others' rows.
-  - `bootstrap` (default: `manage`) — run `bootstrapStripe` at boot. Exactly one kind of process
+  - `bootstrap` (default: `manage`) — run `stripeBootstrapOf(ctx).bootstrapStripe` at boot. Exactly one kind of process
     keeps it (the receiver). A managed process with `bootstrap: false` still serves checkout, the
     portal, estimates, the resyncs and the webhook route, and a FORCED bootstrap (`resync`, an
-    application's maintenance `bootstrapStripe(ctx, stripe, { force: true })`) still runs there —
+    application's maintenance `stripeBootstrapOf(ctx).bootstrapStripe(stripe, { force: true })`) still runs there —
     same URL, same rows, fingerprinted, so idempotent from any process.
   - Refused at construction: `bootstrap: true` with `manage: false`, an empty `owner` or
     `webhookService` (`PaygateError`). A managed, bootstrapping gateway fails its initialization when
     `webhookService` is not declared in `cfg.services` (`WebhookSetupError('service:<alias>')`).
-- `stripe` (a `StripeFactory`, default `stripeClient`) is the gateway's own Stripe client —
-  `gateway(ctx).stripe(ctx)`, used by its methods, its boot bootstrap and the `paymentGate` handlers.
+- `stripe` (a `StripeFactory`, default `paymentAccessOf(ctx).stripeClient`) is the gateway's own Stripe client —
+  `paymentAccessOf(ctx).gateway().stripe(ctx)`, used by its methods, its boot bootstrap and the `paymentGate` handlers.
   The consumer-rights service takes its own (`appendConsumerRights({ stripe })`).
 - Every process that registers the gateway runs the collection validators (`collMod`) of all
   twelve records at init: a process of an older version narrows the validators again, so roll
@@ -130,12 +130,12 @@ observer(context).onSubscription(async event => { /* keyed by event.eventKey */
   (CJEU C-641/19): `{ key, basis: 'time' | 'units', shareMinor }`, the shares summing to
   `round(price × 100)`. Absent: the whole price is one `time` component. They also pick the start
   statement: a `units` part → the `_units` variant, otherwise the base (time-only) texts
-  (`startContextOf`, `@owlmeans/payment`).
+  (`consumerCopyHelper.startContextOf`, `@owlmeans/payment`).
 - `declarePaymentPlan` refuses before recording: a bad rank or a priced/gatewayed free plan
   (`PlanRankConflict`), a capability set under the reserved `limit` scope, a malformed limit
   (`LimitMisdeclared('<key>:<reason>')`), a malformed or amount-mode `currencyPrices` or components
   that do not add up (`ProductError('currency-prices:…' | 'withdrawal:<sku>:…')`).
-- `assertPlanDeclarations` runs when the gateway initializes and fails the boot on two free plans
+- `makePlanDeclarationsModel(cfg).assertPlans()` runs when the gateway initializes and fails the boot on two free plans
   at one rank, or two paid non-consumable plans of one product at one rank.
 - A limit key may use a different kind on different plans; each kind counts separately and a
   lifetime count stays with the entity through upgrades, downgrades and cancellations.
@@ -167,7 +167,7 @@ None declares an ObjectId reference: `entityId` is an organization key and every
 - A compound sparse index still indexes a row that lacks only some of its keys — a unique index
   that must skip absent values is single-field (`{sessionId}`).
 - Conditional writes (`consentedAt`, `withdrawnAt`) are raw `$set`s guarded by the old value
-  (`conditionalSet`), so a concurrent declaration of the same purchase loses; declarations,
+  (`paymentUtils.conditionalSet`), so a concurrent declaration of the same purchase loses; declarations,
   consents and events are only ever created.
 
 ## Checkout
@@ -198,7 +198,7 @@ None declares an ObjectId reference: `entityId` is an organization key and every
   (an operator relocks). An organization that already paid before its country was locked is
   locked lazily from its Stripe customer's address (`source: 'customer'`). Before any lock, the
   declared country is prefilled on a customer without an address.
-- **The currency.** Charge currency = the profile's currency, else `chargeCurrencyOf(region)`
+- **The currency.** Charge currency = the profile's currency, else `consumerRegionHelper.chargeCurrencyOf(region)`
   (`policy.currencies`). An amount checkout whose policy currency IS the charge currency is
   charged exactly — no FX call; any other goes through the FX reference rate (rounded up). A
   subscription or quantity session is forced to the charge currency (`currency`) only when its
@@ -209,7 +209,7 @@ None declares an ObjectId reference: `entityId` is an organization key and every
 - **The lock at Stripe.** A locked profile whose customer carries the address:
   `customer_update.address: 'never'` and `billing_address_collection: 'auto'` (tax follows the
   saved address, Checkout cannot move it); `name: 'auto'` stays. A locked customer without a
-  tax-locatable address (`isTaxLocatable`) keeps `'auto'`/`'required'`, or Stripe refuses the
+  tax-locatable address (`stripeSessionHelper.isTaxLocatable`) keeps `'auto'`/`'required'`, or Stripe refuses the
   session ("Automatic tax calculation in Checkout requires a valid address on the Customer").
 - **Terms.** `mechanisms.checkoutTerms` puts `consent_collection.terms_of_service: 'required'` and
   `custom_text.terms_of_service_acceptance` (the `checkout.terms-acceptance.in-scope | other` copy
@@ -217,7 +217,7 @@ None declares an ObjectId reference: `entityId` is an organization key and every
 - **A missing Dashboard terms URL never breaks a payment.** Stripe refuses the checkbox then
   (`invalid_request_error`, param `consent_collection[terms_of_service]`, "You cannot collect consent
   to your terms of service unless a URL is set in the Stripe Dashboard", matched by
-  `isMissingTermsUrl`): the session is created ONCE more without `consent_collection` and without the
+  `stripeSessionHelper.isMissingTermsUrl`): the session is created ONCE more without `consent_collection` and without the
   terms text, under the same plugin admissions, metadata `termsCollected: 'false'`; a
   `checkout-terms-fallback` event (`recordKind: 'checkout'`, `recordId` = the entity, `externalId`
   = the session, `ok: false`, the Stripe message in `detail`) is appended per fallback and one
@@ -259,7 +259,7 @@ or without a consumer-rights policy.
   region" picker (a payment-method detail no parameter hides), which then moves neither tax nor the
   saved address. Metadata `countryPinned: 'true'` makes the first completed purchase lock THAT
   country (`lockFromSession`: `metadata.country` before `customer_details.address.country`).
-- **Tax-locatable** (`isTaxLocatable`, from Stripe's customer-locations table): a country alone
+- **Tax-locatable** (`stripeSessionHelper.isTaxLocatable`, from Stripe's customer-locations table): a country alone
   everywhere except US (needs `postal_code`) and CA / IN (`postal_code` or `state`). A pinned US,
   CA or IN customer without one is not kept: Checkout collects the address — country editable —
   and the purchase locks what was typed, as without the option.
@@ -268,7 +268,7 @@ or without a consumer-rights policy.
 
 ## Checkout plugins
 
-`gateway(ctx).use(plugin)` seats a `CheckoutPlugin` per gateway instance (the `ExecutionService.use`
+`paymentAccessOf(ctx).gateway().use(plugin)` seats a `CheckoutPlugin` per gateway instance (the `ExecutionService.use`
 registry: a plugin whose `alias` is registered already replaces it). All hooks are optional:
 
 | Hook | Called | Contract |
@@ -280,7 +280,7 @@ registry: a plugin whose `alias` is registered already replaces it). All hooks a
 | `sessionTtlSeconds` | — | the smallest declared, clamped to 30 min – 24 h, becomes `expires_at`; none declared: Stripe's default |
 
 - **One narrowing path.** `createLink` and `gateway.amountPolicy(ctx, entityId, productSku,
-  planSku?)` both call `narrowAmountFor` → `narrowAmountPolicy` (`@owlmeans/payment`); an amount
+  planSku?)` both call `checkoutPluginsOf(ctx).narrowAmountFor` → `amountNarrowingHelper.narrowAmountPolicy` (`@owlmeans/payment`); an amount
   above the narrowed maximum, or any amount while `blocked`, is `CheckoutLimitExceeded` (409). A
   control and a refusal cannot disagree. An amount above the plan's own maximum stays the base
   policy's error.
@@ -291,7 +291,7 @@ registry: a plugin whose `alias` is registered already replaces it). All hooks a
 
 ## Price sync and the tax estimate
 
-- `syncStripeProducts` gives a matching, still-`unspecified` price the declared `tax.behavior` IN
+- `productSyncOf(ctx).syncStripeProducts` gives a matching, still-`unspecified` price the declared `tax.behavior` IN
   PLACE and a fresh one on creation; a price carrying the OPPOSITE behavior is replaced. Before an
   in-place update it checks the account's tax-settings default and skips — logging why — when that
   would change existing renewals, unless `stripe.migrateUnspecifiedPrices` opts in.
@@ -324,7 +324,7 @@ registry: a plugin whose `alias` is registered already replaces it). All hooks a
 - **The effective plan** is the highest-ranked row in `ENTITLING_STATUSES` (catalogue rank; the
   newest on a tie), else the declared free plan, else `PlanRequired`.
 - **A subscription row may override its plan.** `PaymentSubscriptionRecord.overrides`
-  (`SubscriptionOverrides`: `limits: { <key>: { limit } }`) is applied by `overriddenPlan(plan, row)`
+  (`SubscriptionOverrides`: `limits: { <key>: { limit } }`) is applied by `planHelper.overriddenPlan(plan, row)`
   inside `resolveEffectivePlan` and `snapshotOf`, so ceilings, the entitlement view, both gates and
   observers read one answer and nothing else needs to know. An override sets the ceiling of a key
   the plan declares and drops that key's promo; kind and window stay the plan's (counters are keyed
@@ -332,7 +332,7 @@ registry: a plugin whose `alias` is registered already replaces it). All hooks a
   writes it, no paygate does: every sync and re-grant spreads the previous row, so it survives. It
   belongs to the row — it follows the subscription through a plan change, ends with it, and the
   free-plan fallback (no row) has none. A new overridable parameter is a new optional key of
-  `SubscriptionOverrides`, declared in `PaymentSubscriptionSchema` and merged in `overriddenPlan`.
+  `SubscriptionOverrides`, declared in `PaymentSubscriptionSchema` and merged in `planHelper.overriddenPlan`.
 - `mapStatus`: `active`→Active, `trialing`→Trial, `past_due`→PastDue, `unpaid`/`paused`→Suspended,
   `incomplete`→Created, `incomplete_expired`→Ended, `canceled`→Canceled; paused collection is
   Suspended with `pausedAt`.
@@ -354,12 +354,12 @@ registry: a plugin whose `alias` is registered already replaces it). All hooks a
 admission reads. `consume` increments the counter FIRST by one conditional upsert (`used <= limit
 - amount`), then appends the event — **the counter may over-count, never over-admit**. An event
 key is idempotent; `release` appends `release:<eventKey>` first. `reconcileCounters`,
-`reconcileOccupancy`, `reconcileEntity` and `reconcileAll` repair it (details: the `entitlements`
+`reconcileOccupancy`, `reconcileOf(ctx).reconcileEntity` and `.reconcileAll` repair it (details: the `entitlements`
 skill).
 
 ## Entitlements and gates
 
-- `entitlements(ctx)` → `effectivePlan`, `entitlements` (the `EntitlementView`), `hasCapability`,
+- `paymentAccessOf(ctx).entitlements()` → `effectivePlan`, `entitlements` (the `EntitlementView`), `hasCapability`,
   `limitState`, the ledger operations. Never calls Stripe.
 - **Capability gate** (`ENTITLEMENT_GATE`) passes when the view grants ANY parameter; **limit gate**
   (`LIMIT_GATE`) when any `limit:<key>[>=n]` has room — it never consumes. Both refuse with
@@ -370,7 +370,7 @@ skill).
 
 The EU right of withdrawal (with the Art. 11a withdrawal function), spend consent for prepaid
 credits, subscription start requests, the cancellation function and a billing country fixed at the
-first purchase. The service is `consumerRights(ctx)` (`consumerRightsOf(ctx)` is null-safe); its
+first purchase. The service is `paymentAccessOf(ctx).consumerRights()` (`.consumerRightsOf()` is null-safe); its
 full contract is in `reference.md`.
 
 - **A purchase** is a paid one-time checkout, or a subscription's FIRST invoice — renewals,
@@ -379,7 +379,7 @@ full contract is in `reference.md`.
   collision) is written **before anything is granted**: in `checkout.session.completed` before
   `onTopUp`, in the first subscription commit before the `created` observers. A completed
   subscription checkout then refines it with the buyer's own country, e-mail, totals and terms
-  acceptance. Window = in scope, before `deadline` (`withdrawalDeadlineOf`, policy margin),
+  acceptance. Window = in scope, before `deadline` (`withdrawalDeadlineHelper.withdrawalDeadlineOf`, policy margin),
   neither withdrawn nor refunded; a full refund closes it (`refundedAt`).
 - **In scope** when the buyer's own country or the organization's locked country is in the policy's
   territories; an unknown country is protected by default. A business tax id does not exempt.
@@ -399,16 +399,16 @@ full contract is in `reference.md`.
   required while an open in-scope top-up window has none. `assertConsent` is one indexed query and
   throws `PerformanceConsentRequired` (428, `pending`, latest `deadline`); an application calls it
   only where credits will actually be spent. `consentView` carries the policy's `consentContext`
-  as `context`. `recordConsent` renders the statement itself (`consentStatementOf` with the
+  as `context`. `recordConsent` renders the statement itself (`consumerCopyHelper.consentStatementOf` with the
   trader's `name` and the policy's `consentContext`, so the stored verbatim text and the consent
   mail are the `_<context>` variant the dialog showed; without a context the base statement),
   stores that `context` on the record, refuses a stale `textVersion` with a fresh 428, covers only
   the open windows the body lists, stamps `consentedAt` conditionally, mails the confirmation, then
   tells `onConsent`.
 - **Start requests follow the plan's withdrawal arithmetic.** `startView(entityId, planSku)` names
-  `context = startContextOf(plan)` (`'units'` for a plan with a `units` component, absent for a
+  `context = consumerCopyHelper.startContextOf(plan)` (`'units'` for a plan with a `units` component, absent for a
   time-only one); `recordStartRequest(subject, body, origin, { plan })` renders the statement with
-  the SAME `startContextOf(plan)` and the plan's short name the application passes (default: its
+  the SAME `consumerCopyHelper.startContextOf(plan)` and the plan's short name the application passes (default: its
   localized title), stores it verbatim with its `context`, and the start mail repeats it with
   `email.start.rule` of that variant (the record's `context`). Usable `startRequestTtlSeconds`
   (3600); the purchase takes it as `servicesStartedAt`/`consentedAt`.
@@ -444,7 +444,7 @@ address and the model form), consent confirmation, start confirmation, withdrawa
 cancellation receipt. User values are HTML-escaped; a deadline is shown as its last included day.
 The mails and the withdrawal information name the trader's `legalName, address, email`; the
 statements its `name`. Every send, skip or failure is a `mail` event (step = kind); addresses on
-`.test`/`.example`/`.invalid`/`.localhost` and every subdomain of them (`isReservedAddress`; case, a
+`.test`/`.example`/`.invalid`/`.localhost` and every subdomain of them (`consumerFormatHelper.isReservedAddress`; case, a
 display-name form and a trailing dot read through) are never sent (recorded as skipped); each `bcc`
 address gets its own copy. **The purchase confirmation goes out once per purchase**: a delivery
 sends it only after winning the conditional `confirmationMailAt` claim on the purchase row (a mail
@@ -457,7 +457,7 @@ mailer is registered.
 
 ## Reconcile
 
-`consumerRights(ctx).reconcile({ since?, limit? })` — the application's nightly job: retries the
+`paymentAccessOf(ctx).consumerRights().reconcile({ since?, limit? })` — the application's nightly job: retries the
 paygate steps of withdrawals (refund, credit note, subscription cancel) and scheduled
 cancellations, failed mails and failed observers; backfills purchases (records only, no mail) from
 completed sessions of the last 16 days without a row; locks organizations that paid before the
@@ -477,7 +477,7 @@ made (found by `metadata.withdrawalId`). Five failures of a step leave it to an
   `@owlmeans/server-entrypoint` / `@owlmeans/server-app`, and never registers `paymentGate` or
   `paymentGateEntrypoints`. A handler reads its context from the entrypoint it is bound to, so the
   application's declaration is the one mounted and run. Its declarations keep the library's paths
-  (`webhookUrlOf` forms the Stripe URL from `paymentGate`'s), contracts (`PaygateParams`,
+  (`webhookOf(ctx).webhookUrlOf` forms the Stripe URL from `paymentGate`'s), contracts (`PaygateParams`,
   `ResyncResult`, `ResyncSubscriptionsResult` — `bind` refuses another shape at compile time) and
   guards. Two ways to get it wrong: `bindAll(declarations, [paymentGateHandlers.webhook])` pairs by
   object identity and leaves the application's declaration without a handler, and
@@ -496,16 +496,16 @@ made (found by `metadata.withdrawalId`). Five failures of a step leave it to an
   least `publicMinMs` (1000 ms) so a match is not visible in the timing either.
 - `checkoutReadEntrypoints(protocols, { resolveEntity?, gatewayAlias? })` binds
   `makeCheckoutReadProtocols`: `amountPolicy` and `planPrices`; its `resolveEntity(req, ctx)` too.
-- **`requestOriginOf(req)`** is the evidence of every consumer act (the default `metaOf`): `ip` =
+- **`originHelper.requestOriginOf(req)`** is the evidence of every consumer act (the default `metaOf`): `ip` =
   `cf-connecting-ip` → the LAST `x-forwarded-for` entry → `x-real-ip` → the socket; the raw
   `x-forwarded-for`, `user-agent` (≤ 512), `cf-ipcountry`, `accept-language`.
 
 ## Stripe self-management
 
 Runs in `initialize()` of a managed gateway with `bootstrap` (default), after the context is
-ready, and on a forced `bootstrapStripe` from any managed process; each step independent: products
+ready, and on a forced `stripeBootstrapOf(ctx).bootstrapStripe` from any managed process; each step independent: products
 and prices (above), the portal configuration, the webhook endpoint. A deployment's identity is its
-webhook URL (`webhookUrlOf`: the `webhookService` alias's host and base); its rows carry the
+webhook URL (`webhookOf(ctx).webhookUrlOf()`: the `webhookService` alias's host and base); its rows carry the
 `owner`.
 
 - **The portal configuration**: customer update (tax id; email unless `stripe.lockCustomerEmail`;
@@ -513,11 +513,11 @@ webhook URL (`webhookUrlOf`: the `webhookService` alias's host and base); its ro
   payment method update, cancellation at period end without proration, price switching between the
   active recurring prices. Its fingerprint covers the catalogue (incl. `currencyPrices`), the lock
   flags, the region currencies, the branding and the deployment key. Each deployment owns its own configuration, tagged `{ owlmeans: 'payment',
-  service: <owner>, deployment: webhookUrlOf(ctx) }`; one tagged for another deployment (a former
+  service: <owner>, deployment: webhookOf(ctx).webhookUrlOf() }`; one tagged for another deployment (a former
   webhook URL included) is never touched — a moved URL creates a new configuration.
 - `portalLink(ctx, entityId, { flow, planSku?, returnUrl })`: a customer is required
   (`PortalUnavailable`, 409); `Cancel`/`Update`/`Change` need an entitling Stripe subscription.
-- **The webhook endpoint** at `webhookUrlOf(ctx)`, subscribed to `WEBHOOK_EVENTS`, on the API version
+- **The webhook endpoint** at `webhookOf(ctx).webhookUrlOf()`, subscribed to `WEBHOOK_EVENTS`, on the API version
   read back from the client; only an https public host. A deployment deletes only the endpoints its
   own rows name. A new URL (a moved host, a new `webhookService`) creates the endpoint there, then
   deletes the endpoints of the owner's rows at other URLs and those rows — no migration step. The

package/build/access/types.d.ts

@@ -0,0 +1,46 @@
+import type Stripe from 'stripe';
+import type { PaymentService } from '@owlmeans/payment';
+import type { BillingProfileResource, CompletionObserver, ConsumerConsentResource, ConsumerDeclarationResource, ConsumerEventResource, ConsumerMailPluginConfig, ConsumerRightsService, EntitlementService, FingerprintResource, GatewayService, PaygateCustomerResource, PaymentFulfillmentResource, PaymentSubscriptionRecord, PaymentSubscriptionResource, PaymentUsageCounterResource, PaymentUsageResource, PaymentWebhookResource, PortalBrandingConfig, PurchaseResource, StripePluginConfig, StripePricingPluginConfig } from '../types.js';
+/** What one context holds for payments: its services, its resources, its plugin configs and its Stripe client. */
+export interface PaymentAccess {
+    payment: () => PaymentService;
+    gateway: () => GatewayService;
+    /** The gateway, or `null` in a context that registered none. */
+    gatewayOf: () => GatewayService | null;
+    observer: () => CompletionObserver;
+    entitlements: () => EntitlementService;
+    paygateCustomers: () => PaygateCustomerResource;
+    subscriptions: () => PaymentSubscriptionResource;
+    fulfillments: () => PaymentFulfillmentResource;
+    paymentWebhooks: () => PaymentWebhookResource;
+    usageEvents: () => PaymentUsageResource;
+    usageCounters: () => PaymentUsageCounterResource;
+    fingerprints: () => FingerprintResource;
+    billingProfiles: () => BillingProfileResource;
+    purchases: () => PurchaseResource;
+    consumerConsents: () => ConsumerConsentResource;
+    consumerDeclarations: () => ConsumerDeclarationResource;
+    consumerEvents: () => ConsumerEventResource;
+    /** The consumer-rights service. @throws when it is not registered */
+    consumerRights: (alias?: string) => ConsumerRightsService;
+    /** The consumer-rights service, or `null` in a process that registered none. */
+    consumerRightsOf: (alias?: string) => ConsumerRightsService | null;
+    stripeConfig: () => Promise<StripePluginConfig>;
+    /** The portal branding declared with `portalBranding`, or `null`. */
+    portalBrandingConfig: () => Promise<PortalBrandingConfig | null>;
+    /** The consumer-rights mail options declared with `declareConsumerRights`, or `null`. */
+    consumerMailConfig: () => Promise<ConsumerMailPluginConfig | null>;
+    /** The Stripe-only pricing settings declared with `declarePaymentPricing`, or `null`. */
+    stripePricingConfig: () => Promise<StripePricingPluginConfig | null>;
+    /**
+     * A Stripe client pinned to {@link STRIPE_PINNED_API_VERSION}: the API version this package's payload
+     * readers, the stored webhook endpoints and the test doubles are written for. The installed SDK is typed
+     * for a newer one, so a read of a field the newer version moved (a subscription's period, an invoice's
+     * subscription) is cast at the seam until the readers are migrated — the pin is what keeps the shapes
+     * the code parses and the shapes Stripe sends the same.
+     */
+    stripeClient: () => Promise<Stripe>;
+    /** The entity's highest-ranked entitling subscription of one product. */
+    activeSubscription: (entityId: string, productSku: string) => Promise<PaymentSubscriptionRecord | null>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/access/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EACV,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,2BAA2B,EAChG,qBAAqB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAC/G,cAAc,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,yBAAyB,EAC9F,2BAA2B,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,sBAAsB,EACtG,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,EACtF,MAAM,aAAa,CAAA;AAEpB,kHAAkH;AAClH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,cAAc,CAAA;IAC7B,OAAO,EAAE,MAAM,cAAc,CAAA;IAC7B,gEAAgE;IAChE,SAAS,EAAE,MAAM,cAAc,GAAG,IAAI,CAAA;IACtC,QAAQ,EAAE,MAAM,kBAAkB,CAAA;IAClC,YAAY,EAAE,MAAM,kBAAkB,CAAA;IACtC,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;IAC/C,aAAa,EAAE,MAAM,2BAA2B,CAAA;IAChD,YAAY,EAAE,MAAM,0BAA0B,CAAA;IAC9C,eAAe,EAAE,MAAM,sBAAsB,CAAA;IAC7C,WAAW,EAAE,MAAM,oBAAoB,CAAA;IACvC,aAAa,EAAE,MAAM,2BAA2B,CAAA;IAChD,YAAY,EAAE,MAAM,mBAAmB,CAAA;IACvC,eAAe,EAAE,MAAM,sBAAsB,CAAA;IAC7C,SAAS,EAAE,MAAM,gBAAgB,CAAA;IACjC,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;IAC/C,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;IACvD,cAAc,EAAE,MAAM,qBAAqB,CAAA;IAC3C,qEAAqE;IACrE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,qBAAqB,CAAA;IACzD,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,qBAAqB,GAAG,IAAI,CAAA;IAClE,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC/C,qEAAqE;IACrE,oBAAoB,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;IAChE,yFAAyF;IACzF,kBAAkB,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAA;IAClE,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAA;CACxG"}

package/build/access/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/access/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":""}

package/build/access.d.ts

@@ -0,0 +1,6 @@
+import type { Context as ApiContext } from '@owlmeans/server-api';
+import type { PaymentAccess } from './access/types.js';
+export declare const makePaymentAccess: (ctx: ApiContext) => PaymentAccess;
+/** The payment access of a context — one per context. */
+export declare const paymentAccessOf: (target: ApiContext<import("@owlmeans/server-api").Config>) => PaymentAccess;
+//# sourceMappingURL=access.d.ts.map

package/build/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAgBjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,eAAO,MAAM,iBAAiB,QAAS,UAAU,KAAG,aA4DnD,CAAA;AAED,yDAAyD;AACzD,eAAO,MAAM,eAAe,8EAAwC,CAAA"}

package/build/access.js

@@ -0,0 +1,45 @@
+import Stripe from 'stripe';
+import { PLUGINS } from '@owlmeans/config';
+import { memoHelper } from '@owlmeans/context';
+import { DEFAULT_ALIAS as PAYMENT_SERVICE, ENTITLING_STATUSES } from '@owlmeans/payment';
+import { CONSUMER_RIGHTS_MAIL_PLUGIN_CONFIG, CONSUMER_RIGHTS_SERVICE, ENTITLEMENT_SERVICE, GATEWAY_SERVICE, PAYMENT_OBSERVER, RES_BILLING_PROFILE, RES_CONSUMER_CONSENT, RES_CONSUMER_DECLARATION, RES_CONSUMER_EVENT, RES_PAYGATE_CUSTOMER, RES_PAYMENT_FINGERPRINT, RES_PAYMENT_FULFILLMENT, RES_PAYMENT_PURCHASE, RES_PAYMENT_SUBSCRIPTION, RES_PAYMENT_USAGE, RES_PAYMENT_USAGE_COUNTER, RES_PAYMENT_WEBHOOK, STRIPE_PINNED_API_VERSION, STRIPE_PLUGIN_CONFIG, STRIPE_PORTAL_PLUGIN_CONFIG, STRIPE_PRICING_PLUGIN_CONFIG, } from './consts.js';
+export const makePaymentAccess = (ctx) => {
+    const hasService = (alias) => ctx.hasService?.(alias) === true;
+    const plugins = () => ctx.getConfigResource(PLUGINS);
+    const payment = () => ctx.service(PAYMENT_SERVICE);
+    const gateway = () => ctx.service(GATEWAY_SERVICE);
+    const gatewayOf = () => hasService(GATEWAY_SERVICE) ? gateway() : null;
+    const observer = () => ctx.service(PAYMENT_OBSERVER);
+    const entitlements = () => ctx.service(ENTITLEMENT_SERVICE);
+    const paygateCustomers = () => ctx.resource(RES_PAYGATE_CUSTOMER);
+    const subscriptions = () => ctx.resource(RES_PAYMENT_SUBSCRIPTION);
+    const fulfillments = () => ctx.resource(RES_PAYMENT_FULFILLMENT);
+    const paymentWebhooks = () => ctx.resource(RES_PAYMENT_WEBHOOK);
+    const usageEvents = () => ctx.resource(RES_PAYMENT_USAGE);
+    const usageCounters = () => ctx.resource(RES_PAYMENT_USAGE_COUNTER);
+    const fingerprints = () => ctx.resource(RES_PAYMENT_FINGERPRINT);
+    const billingProfiles = () => ctx.resource(RES_BILLING_PROFILE);
+    const purchases = () => ctx.resource(RES_PAYMENT_PURCHASE);
+    const consumerConsents = () => ctx.resource(RES_CONSUMER_CONSENT);
+    const consumerDeclarations = () => ctx.resource(RES_CONSUMER_DECLARATION);
+    const consumerEvents = () => ctx.resource(RES_CONSUMER_EVENT);
+    const consumerRights = (alias = CONSUMER_RIGHTS_SERVICE) => ctx.service(alias);
+    const consumerRightsOf = (alias = CONSUMER_RIGHTS_SERVICE) => hasService(alias) ? ctx.service(alias) : null;
+    const stripeConfig = async () => await plugins().get(STRIPE_PLUGIN_CONFIG);
+    const portalBrandingConfig = async () => await plugins().load(STRIPE_PORTAL_PLUGIN_CONFIG);
+    const consumerMailConfig = async () => await plugins().load(CONSUMER_RIGHTS_MAIL_PLUGIN_CONFIG);
+    const stripePricingConfig = async () => await plugins().load(STRIPE_PRICING_PLUGIN_CONFIG);
+    const stripeClient = async () => new Stripe((await stripeConfig()).api, { apiVersion: STRIPE_PINNED_API_VERSION });
+    const activeSubscription = async (entityId, productSku) => await subscriptions().load({
+        entityId, productSku, status: [...ENTITLING_STATUSES],
+    }, { sort: [{ field: 'rank', order: 'desc' }, { field: 'createdAt', order: 'desc' }] });
+    return {
+        payment, gateway, gatewayOf, observer, entitlements, paygateCustomers, subscriptions, fulfillments,
+        paymentWebhooks, usageEvents, usageCounters, fingerprints, billingProfiles, purchases, consumerConsents,
+        consumerDeclarations, consumerEvents, consumerRights, consumerRightsOf, stripeConfig, portalBrandingConfig,
+        consumerMailConfig, stripePricingConfig, stripeClient, activeSubscription,
+    };
+};
+/** The payment access of a context — one per context. */
+export const paymentAccessOf = memoHelper.oncePer(makePaymentAccess);
+//# sourceMappingURL=access.js.map

package/build/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,IAAI,eAAe,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAA;AAE7G,OAAO,EACL,kCAAkC,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,eAAe,EACjG,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,kBAAkB,EACzG,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,oBAAoB,EAC5F,wBAAwB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,EAC3F,yBAAyB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,4BAA4B,GAC3G,MAAM,aAAa,CAAA;AAWpB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAe,EAAiB,EAAE;IAClE,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC3C,GAA8D,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAA;IAC9F,MAAM,OAAO,GAAG,GAAG,EAAE,CAAE,GAA6B,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAE/E,MAAM,OAAO,GAAG,GAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAiB,eAAe,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,GAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAiB,eAAe,CAAC,CAAA;IAClF,MAAM,SAAS,GAAG,GAA0B,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,MAAM,QAAQ,GAAG,GAAuB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAqB,gBAAgB,CAAC,CAAA;IAC5F,MAAM,YAAY,GAAG,GAAuB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAqB,mBAAmB,CAAC,CAAA;IAEnG,MAAM,gBAAgB,GAAG,GAA4B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAA0B,oBAAoB,CAAC,CAAA;IACnH,MAAM,aAAa,GAAG,GAAgC,EAAE,CACtD,GAAG,CAAC,QAAQ,CAA8B,wBAAwB,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,GAA+B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAA6B,uBAAuB,CAAC,CAAA;IACxH,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAyB,mBAAmB,CAAC,CAAA;IAC/G,MAAM,WAAW,GAAG,GAAyB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAuB,iBAAiB,CAAC,CAAA;IACrG,MAAM,aAAa,GAAG,GAAgC,EAAE,CACtD,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;IACtE,MAAM,YAAY,GAAG,GAAwB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAsB,uBAAuB,CAAC,CAAA;IAC1G,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAyB,mBAAmB,CAAC,CAAA;IAC/G,MAAM,SAAS,GAAG,GAAqB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAmB,oBAAoB,CAAC,CAAA;IAC9F,MAAM,gBAAgB,GAAG,GAA4B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAA0B,oBAAoB,CAAC,CAAA;IACnH,MAAM,oBAAoB,GAAG,GAAgC,EAAE,CAC7D,GAAG,CAAC,QAAQ,CAA8B,wBAAwB,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,GAA0B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAwB,kBAAkB,CAAC,CAAA;IAE3G,MAAM,cAAc,GAAG,CAAC,KAAK,GAAW,uBAAuB,EAAyB,EAAE,CACxF,GAAG,CAAC,OAAO,CAAwB,KAAK,CAAC,CAAA;IAE3C,MAAM,gBAAgB,GAAG,CAAC,KAAK,GAAW,uBAAuB,EAAgC,EAAE,CACjG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAwB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEtE,MAAM,YAAY,GAAG,KAAK,IAAiC,EAAE,CAC3D,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAuB,CAAA;IAEjE,MAAM,oBAAoB,GAAG,KAAK,IAA0C,EAAE,CAC5E,MAAM,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAgC,CAAA;IAElF,MAAM,kBAAkB,GAAG,KAAK,IAA8C,EAAE,CAC9E,MAAM,OAAO,EAAE,CAAC,IAAI,CAAC,kCAAkC,CAAoC,CAAA;IAE7F,MAAM,mBAAmB,GAAG,KAAK,IAA+C,EAAE,CAChF,MAAM,OAAO,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAqC,CAAA;IAExF,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE,CAC/C,IAAI,MAAM,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,yBAAkC,EAAE,CAAC,CAAA;IAE5F,MAAM,kBAAkB,GAAG,KAAK,EAC9B,QAAgB,EAAE,UAAkB,EACO,EAAE,CAAC,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC;QACzE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,kBAAkB,CAAC;KACtD,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAEvF,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY;QAClG,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB;QACvG,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB;QAC1G,kBAAkB,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB;KAC1E,CAAA;AACH,CAAC,CAAA;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA"}

package/build/actions/resync-subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resync-subscriptions.d.ts","sourceRoot":"","sources":["../../src/actions/resync-subscriptions.ts"],"names":[],"mappings":"AAMA,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,sKACY,CAAA"}
+{"version":3,"file":"resync-subscriptions.d.ts","sourceRoot":"","sources":["../../src/actions/resync-subscriptions.ts"],"names":[],"mappings":"AAOA,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,sKAC8B,CAAA"}

package/build/actions/resync-subscriptions.js

@@ -1,6 +1,7 @@
 import { handlers } from '@owlmeans/server-api';
-import { paymentGate, gateway } from '../utils.js';
+import { paymentAccessOf } from '../access.js';
+import { paymentGate } from '../protocol.js';
 const bind = handlers();
 /** Re-read every live paygate subscription — the manually or periodically triggered repair. */
-export const resyncSubscriptions = bind.request(paymentGate.resyncSubscriptions, async (_request, context) => await gateway(context).resyncAll(context));
+export const resyncSubscriptions = bind.request(paymentGate.resyncSubscriptions, async (_request, context) => await paymentAccessOf(context).gateway().resyncAll(context));
 //# sourceMappingURL=resync-subscriptions.js.map

package/build/actions/resync-subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"resync-subscriptions.js","sourceRoot":"","sources":["../../src/actions/resync-subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,IAAI,GAAG,QAAQ,EAAW,CAAA;AAEhC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC3G,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"resync-subscriptions.js","sourceRoot":"","sources":["../../src/actions/resync-subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,IAAI,GAAG,QAAQ,EAAW,CAAA;AAEhC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC3G,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/build/actions/resync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resync.d.ts","sourceRoot":"","sources":["../../src/actions/resync.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,eAAO,MAAM,MAAM,yJAMjB,CAAA"}
+{"version":3,"file":"resync.d.ts","sourceRoot":"","sources":["../../src/actions/resync.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,MAAM,yJAOjB,CAAA"}

package/build/actions/resync.js

@@ -1,7 +1,8 @@
 import { PaygateError } from '@owlmeans/payment';
 import { handlers } from '@owlmeans/server-api';
-import { paymentGate, fingerprints, gateway } from '../utils.js';
-import { bootstrapStripe } from '../service.js';
+import { paymentAccessOf } from '../access.js';
+import { paymentGate } from '../protocol.js';
+import { stripeBootstrapOf } from '../bootstrap.js';
 const bind = handlers();
 /**
  * Forget every sync fingerprint and bring Stripe back to the declared catalogue, portal and webhook —
@@ -9,11 +10,12 @@ const bind = handlers();
  * gateway's `webhookService` and `owner`, so every process of the owner converges on one state.
  */
 export const resync = bind.request(paymentGate.resync, async (_request, context) => {
-    const service = gateway(context);
+    const paymentAccess = paymentAccessOf(context);
+    const service = paymentAccess.gateway();
     if (!service.managed)
         throw new PaygateError('unmanaged');
-    await fingerprints(context).clear();
-    await bootstrapStripe(context, await service.stripe(context), { force: true });
+    await paymentAccess.fingerprints().clear();
+    await stripeBootstrapOf(context).bootstrapStripe(await service.stripe(context), { force: true });
     return { ok: true };
 });
 //# sourceMappingURL=resync.js.map

package/build/actions/resync.js.map

@@ -1 +1 @@
-{"version":3,"file":"resync.js","sourceRoot":"","sources":["../../src/actions/resync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAG/C,MAAM,IAAI,GAAG,QAAQ,EAAW,CAAA;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;IACzD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAA;IACnC,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"resync.js","sourceRoot":"","sources":["../../src/actions/resync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,IAAI,GAAG,QAAQ,EAAW,CAAA;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjF,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,CAAA;IACvC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;IACzD,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAA;IAC1C,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC,CAAC,CAAA"}

package/build/actions/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/actions/webhook.ts"],"names":[],"mappings":"AASA,uGAAuG;AACvG,eAAO,MAAM,OAAO;;cAKlB,CAAA"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/actions/webhook.ts"],"names":[],"mappings":"AAUA,uGAAuG;AACvG,eAAO,MAAM,OAAO;;cAKlB,CAAA"}