@stacksjs/defaults 0.75.267 → 0.75.269

package/ai/skills/stacks-native/CATALOG.md

@@ -68,7 +68,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/orm` | [`stacks-orm`](../stacks-orm/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/index.ts) | 72 |
 | `@stacksjs/pagination` | [`stacks-pagination`](../stacks-pagination/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/src/index.ts) | 0 |
 | `@stacksjs/path` | [`stacks-path`](../stacks-path/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts) | 13 |
-| `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 28 |
+| `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 29 |
 | `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 6 |
 | `@stacksjs/query-builder` | [`stacks-query-builder`](../stacks-query-builder/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/query-builder/src/index.ts) | 6 |
 | `@stacksjs/queue` | [`stacks-queue`](../stacks-queue/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/queue/src/index.ts) | 49 |
@@ -659,7 +659,7 @@ Declared runtime exports: `Payment`, `freshIdempotencyKey`, `stacksIdempotencyKe
 
 Local source modules: [src/billable/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/billable/index.ts), [src/checkout-outcome.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/checkout-outcome.ts), [src/connect/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/connect/index.ts), [src/direct-debit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/direct-debit.ts), [src/driver/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/driver/index.ts), [src/drivers/stripe.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/drivers/stripe.ts), [src/idempotency.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/idempotency.ts), [src/payment.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/payment.ts), [src/subscription-state.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/subscription-state.ts), [src/terminal.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/terminal.ts).
 
-Evidence directory: [28 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [29 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/push
 

package/ai/skills/stacks-payments/SKILL.md

@@ -133,6 +133,38 @@ const changed = await Payment.changeSubscription(user, 'enterprise-monthly')
 
 `Payment.connect` (source `src/connect/`) onboards merchants as Express connected accounts and settles sales to them, while the customer, the charge and its refunds and disputes stay on the platform.
 
+### Direct charges (Managed Risk, the default for new accounts)
+
+`createConnectedAccount` makes a Managed Risk account unless you pass `type` or
+`controller` (`MANAGED_RISK_CONTROLLER`: Stripe carries losses, full Stripe
+Dashboard, Stripe-hosted onboarding). Stripe refuses `type: 'express'`/`'custom'`
+on a platform that has not taken on loss liability, and such a platform sells
+with **direct charges**: the sale is made on the merchant's account and the
+platform's cut is an application fee. Everything of the sale lives there (the
+customer, session, PaymentIntent, subscription and invoices, payment methods,
+refund), so every call acts as the account with `asAccount(id)` (the
+`Stripe-Account` header). Stripe's fees are the merchant's; webhooks for it
+arrive on the **Connect** endpoint with `event.account` set.
+
+```typescript
+import { asAccount, checkoutLineItemsTotal, connectedCustomer, connectRefund, directCheckout, directCheckoutPaymentData, directSubscriptionParams, manageDirectSubscription } from '@stacksjs/payments'
+
+// One-off: Checkout on the account, the user's customer there found or created
+await directCheckout(user, gym.stripe_account_id, {
+  line_items,
+  payment_intent_data: directCheckoutPaymentData(checkoutLineItemsTotal(line_items), { feeCents: 140 }, { metadata }),
+  success_url, cancel_url,
+})
+// Recurring: a subscription on the account paying the platform a percent of each invoice
+await manageDirectSubscription.checkout(user, { account, price: { amount: 4900, currency: 'eur', interval: 'month', productName: 'Unlimited' }, platformFeePercent: 5, successUrl, cancelUrl })
+await stripe.subscriptions.create({ customer: (await connectedCustomer(user, account)).id, items: [{ price }], ...directSubscriptionParams({ feePercent: 5 }) }, asAccount(account))
+// Read, expire and refund as the account; a direct refund gives the fee back by default
+await stripe.checkout.sessions.retrieve(sessionId, asAccount(account))
+await connectRefund(paymentIntentId, { account, amount: 500 })
+```
+
+### Destination charges (a platform that took on loss liability)
+
 ```typescript
 import { manageConnectedAccount, manageDestinationCharge, manageDestinationSubscription } from '@stacksjs/payments'
 

package/app/Models/PersonalAccessToken.ts

@@ -162,9 +162,17 @@ export default defineModel({
      */
 
     /** Legacy owner column, written as a copy of `tokenable_id`. */
+    /**
+     * The legacy owner column, a copy of `tokenableId` kept for installs that
+     * predate the pair. `ensureAuthTables()` gives it no constraint, since a
+     * token can belong to an author as well as a user, so it is not a foreign
+     * key. Without saying so, convention inferred `users.id` from the name and
+     * a fresh app's first `buddy doctor` failed on it.
+     */
     userId: {
       order: 10,
       guarded: true,
+      foreignKey: false,
       validation: {
         rule: schema.number(),
       },

package/functions/dashboard-dates.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'bun:test'
+
+/**
+ * Run `parseDashboardDate` in a process pinned to `zone`, since a calendar
+ * date only goes wrong west of UTC and a test process's zone is fixed at
+ * start-up.
+ */
+async function inZone(zone: string, expression: string): Promise<string> {
+  const child = Bun.spawn([process.execPath, '--no-env-file', '-e', `
+    const { parseDashboardDate } = await import(${JSON.stringify(`${import.meta.dir}/dashboard-dates.ts`)})
+    console.log(${expression})
+  `], { env: { ...process.env, TZ: zone }, stdout: 'pipe', stderr: 'pipe' })
+  const [code, out, err] = await Promise.all([child.exited, new Response(child.stdout).text(), new Response(child.stderr).text()])
+  expect(code, err).toBe(0)
+  return out.trim()
+}
+
+const calendarDay = `[parseDashboardDate('2026-10-01')].map(d => [d.getFullYear(), d.getMonth() + 1, d.getDate()].join('-'))[0]`
+
+describe('parseDashboardDate', () => {
+  for (const zone of ['America/Los_Angeles', 'UTC', 'Asia/Manila', 'Pacific/Kiritimati']) {
+    it(`reads a calendar date as that day in ${zone}`, async () => {
+      expect(await inZone(zone, calendarDay)).toBe('2026-10-1')
+    })
+  }
+
+  it('reads an offsetless database timestamp as UTC, wherever it runs', async () => {
+    for (const zone of ['America/Los_Angeles', 'Asia/Manila'])
+      expect(await inZone(zone, `parseDashboardDate('2026-10-01 14:30:00').toISOString()`)).toBe('2026-10-01T14:30:00.000Z')
+  })
+
+  it('leaves an ISO string with an offset, and a Date, as they are', async () => {
+    expect(await inZone('America/Los_Angeles', `parseDashboardDate('2026-10-01T14:30:00+08:00').toISOString()`)).toBe('2026-10-01T06:30:00.000Z')
+    const at = new Date('2026-10-01T00:00:00Z')
+    const { parseDashboardDate } = await import('./dashboard-dates')
+    expect(parseDashboardDate(at)).toBe(at)
+  })
+
+  it('the reading it replaces is the bug: a calendar date lands on the day before west of UTC', async () => {
+    // The control. Without it, every assertion above would pass in a zone
+    // where the two readings agree.
+    expect(await inZone('America/Los_Angeles', `[new Date('2026-10-01')].map(d => d.getDate())[0]`)).toBe('30')
+  })
+})

package/functions/dashboard-dates.ts

@@ -0,0 +1,22 @@
+/**
+ * Read a date value from a dashboard row.
+ *
+ * A calendar date (`2026-10-01`) is a day, not an instant, so it is read as
+ * local midnight. `new Date('2026-10-01')` reads it as UTC midnight instead,
+ * which every zone west of UTC renders as the day before: a coupon starting
+ * on October 1st showed September 30th in Los Angeles.
+ *
+ * A database timestamp written without an offset (`2026-10-01 14:30:00`) is
+ * UTC, which is how the framework writes it, so it gains the `Z` it lacks.
+ * Anything else, ISO strings with an offset among them, is left to `Date`.
+ */
+export function parseDashboardDate(value: unknown): Date {
+  if (value instanceof Date)
+    return value
+  const text = String(value)
+  if (/^\d{4}-\d{2}-\d{2}$/.test(text))
+    return new Date(`${text}T00:00:00`)
+  if (/^\d{4}-\d{2}-\d{2} \d/.test(text))
+    return new Date(`${text.replace(' ', 'T')}Z`)
+  return new Date(text)
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.267",
+  "version": "0.75.269",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.267",
+  "version": "0.75.269",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.267",
-    "@stacksjs/sanitizer": "0.2.664",
-    "@stacksjs/stx": "0.2.664",
+    "@stacksjs/mobile": "0.75.269",
+    "@stacksjs/sanitizer": "0.2.667",
+    "@stacksjs/stx": "0.2.667",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"

package/resources/components/Dashboard/UI/Table.stx

@@ -1,5 +1,6 @@
 <script client>
 import { formatCurrency } from '@stacksjs/commerce/money'
+import { parseDashboardDate } from '../../../../functions/dashboard-dates'
 /**
  * The data table.
  *
@@ -276,14 +277,14 @@ function displayValue(row: DashboardTableRow, column: DashboardTableColumn): str
     return Number.isFinite(amount) ? amount.toLocaleString() : String(value)
   }
   if (column.type === 'date') {
-    const at = toDate(value)
+    const at = parseDashboardDate(value)
     return Number.isNaN(at.getTime()) ? String(value) : at.toLocaleDateString()
   }
   // An event or log row is ordered by when it happened, and to the minute, so
   // the date alone is not enough to read it. Separate from `date` rather than
   // a flag on it because the two render differently everywhere they appear.
   if (column.type === 'datetime') {
-    const at = toDate(value)
+    const at = parseDashboardDate(value)
     return Number.isNaN(at.getTime())
       ? String(value)
       : at.toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' })
@@ -346,20 +347,6 @@ function hasBadge(row: DashboardTableRow, column: DashboardTableColumn): boolean
   return badgeLabel(row, column) !== ''
 }
 
-/**
- * Parse a stored timestamp.
- *
- * SQLite hands back `2026-01-01 12:00:00`, with a space and no zone. `new
- * Date()` reads that as local time where it reads it at all, so every row
- * shifted by the viewer's offset - a date near midnight landing on the wrong
- * day. The hand-rolled tables each normalised it themselves; this is the same
- * knowledge in the one place that needs it.
- */
-function toDate(value: unknown): Date {
-  const text = String(value)
-  return new Date(/^\d{4}-\d{2}-\d{2} \d/.test(text) ? `${text.replace(' ', 'T')}Z` : text)
-}
-
 /** The pill's text: the mapped label, else the value with its underscores read as spaces. */
 function badgeLabel(row: DashboardTableRow, column: DashboardTableColumn): string {
   const value = rawValue(row, column.key)
@@ -397,7 +384,7 @@ function compare(a: any, b: any, type: DashboardTableColumn['type']): number {
   // comparison below, which is only accidentally right for ISO timestamps and
   // wrong for every other format.
   if (type === 'date' || type === 'datetime')
-    return toDate(a).getTime() - toDate(b).getTime()
+    return parseDashboardDate(a).getTime() - parseDashboardDate(b).getTime()
   if (type === 'boolean')
     return (a ? 1 : 0) - (b ? 1 : 0)