@volter/twin-stripe 2.0.37 → 3.0.0

package/dist/src/screens/connect-oauth.js

@@ -1,94 +1,19 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// STRIPE CONNECT OAUTH (Standard accounts) — a hosted flow (docs/contributing/architecture.md, "Screens") and the two
-// connect.stripe.com endpoints behind it, as docs.stripe.com/connect/oauth-reference and
-// docs.stripe.com/connect/oauth-standard-accounts describe them. A platform sends a person to
-// GET connect.stripe.com/oauth/authorize with its client_id; the person connects (in test mode Stripe lets them "Force-skip
-// the account form", docs.stripe.com/connect/testing#using-oauth) or denies; Stripe sends them back to the redirect_uri
-// with a `code`, the `scope` granted and the `state` (or `error=access_denied`); the platform's server turns the code into
-// the connection with POST connect.stripe.com/oauth/token, authenticated by its secret key, and learns the account id
-// (`stripe_user_id`) it then acts as with the Stripe-Account header. POST connect.stripe.com/oauth/deauthorize revokes the
-// connection. The page is @volter/world-ui's consent piece under Stripe's skin; nothing of Stripe's page is copied.
-//
-// What the documentation says and the twin keeps:
-// - authorize: `client_id` is the platform's (its Connect OAuth settings, ./connect-settings.tsx, where OAuth is enabled
-//   and the redirect URIs are registered); `response_type` "The only option at the moment is code"; `redirect_uri`, "If
-//   provided, this must exactly match one of the ... redirect_uri values in your application settings" and "Defaults to
-//   the redirect_uri in your application settings" ("the first URI configured"); `scope` read_write or read_only,
-//   "Defaults to read_only"; `state` passed back. `stripe_user[...]` prefills the new account, and "Any parameters with
-//   invalid values are silently ignored". Errors: "the user's browser won't be redirected except in the case of
-//   access_denied. Instead, errors will be returned in a JSON dictionary" of error, error_description and state, with
-//   the codes invalid_scope, invalid_redirect_uri, invalid_request (Missing response_type) and unsupported_response_type.
-//   Denied: `error=access_denied&error_description=The%20user%20denied%20your%20request`. Success: code, scope, state.
-// - token: the code "can only be used once and expires in 5 minutes"; "Consuming an authorization code more than once
-//   revokes the account connection"; grant_type authorization_code or refresh_token; a refresh `scope` of "equal or lesser
-//   scope" and "Any existing access token with the same scope and mode ... is revoked"; the response's scope,
-//   stripe_user_id, livemode, token_type "bearer", access_token, stripe_publishable_key and refresh_token; errors
-//   invalid_request, invalid_grant ("Authorization code does not exist: {AUTHORIZATION_CODE}", verbatim from the guide),
-//   unsupported_grant_type and invalid_scope as `{ error, error_description }`.
-// - deauthorize: client_id and stripe_user_id, answered `{ stripe_user_id }`; errors invalid_request and invalid_client
-//   ("stripe_user_id doesn't exist or isn't connected to your application"); afterwards "the account can't be accessed by
-//   your platform ... through the API" (stripe-server.ts refuses the Stripe-Account header for it, account_invalid).
-// - events: account.application.authorized when the person connects and account.application.deauthorized when the
-//   connection is revoked, each the connected account's (top-level `account`, Connect endpoints), carrying the
-//   `application` object ({ id: the client_id, object: 'application', name }).
-//
-// Where the documentation stops and the twin decides:
-// - the twin is a test-mode Stripe: its client_id is a test one (./connect-settings.tsx PLATFORM_CLIENT_ID), redirect
-//   URIs may be http and localhost ("Your test client_id allows you to ... Set your redirect_uri to a non-HTTPS URL /
-//   to localhost"), a code, token and connection are livemode false, and a live secret key (sk_live_) is refused as the
-//   documented mode mismatch (invalid_grant at token, invalid_client at deauthorize).
-// - the only way through the page is the test-mode skip: it creates a NEW Standard account from the prefill and connects
-//   it; logging in to connect an existing Stripe account is not modelled. A skipped test account can take payments at
-//   once (charges and payouts enabled, card_payments and transfers active, nothing due), and controls itself (controller
-//   type `account`), since the platform did not create it.
-// - an unknown client_id answers invalid_client "No application matches the supplied client identifier", and a
-//   platform that has not enabled OAuth invalid_client naming its settings page; a missing client_id is invalid_request.
-//   The JSON errors are HTTP 400; the order of the checks is client_id, OAuth enabled, redirect_uri, response_type,
-//   scope. With no redirect URI registered and none given, invalid_redirect_uri. read_only is accepted from any platform
-//   (the docs limit it to extensions; the twin does not tell a platform from an extension).
-// - the secret key may come as Bearer, as Basic's user, or as the `client_secret` parameter (the reference's curl uses
-//   `-u`, stripe-node a Bearer header); without one the answer is 401 invalid_request, and a key that is not a secret
-//   key (sk_…/rk_…) 401 invalid_request too. The token and deauthorize wording other than the one quoted above is the
-//   twin's. An expired code is invalid_grant "Authorization code expired: {code}"; a reused one invalid_grant "This
-//   authorization code has already been used. All tokens issued with this code have been revoked." and revokes.
-// - tokens are deterministic, not secret: access_token `sk_test_oauth_{account}_{n}`, refresh_token `rt_twin_{n}`,
-//   stripe_publishable_key `pk_test_oauth_{account}`; a refresh answers the same refresh_token (`rt_twin_{n}` of the code
-//   `ac_twin_{n}` that made the connection). The access_token and publishable key are deprecated by Stripe (use the
-//   Stripe-Account header) and act as the account (stripe-server.ts actingAsOAuthKey); a read_only one is not held to
-//   reads (manifest todo `stripe.connect.oauth_scope_enforcement`).
-// - concurrency: a code's number is taken with its write in one move; a code redeemed twice at once lets one exchange
-//   win, and whichever of the two finishes last revokes the connection, so a double exchange always ends revoked.
-import { semanticsContext } from '@volter/world-core';
 import { Consent, CONSENT_CSS, flowPage } from '@volter/world-ui';
-import surface from '../generated/surface.gen.json' with { type: 'json' };
-import { manifest } from "../manifest.js";
-import { created } from "../semantics/shared.js";
-import { OAUTH_CONNECTIONS, publicBusinessName } from "../stripe-shared.js";
-import { accountSettings, afterStripeWrite, PLATFORM_ACCOUNT_ID } from "../stripe-twin.js";
-import { formOf, seeOther, STRIPE_CONSENT_SKIN } from "./consent-skin.js";
-import { connectOAuthSettings, PLATFORM_CLIENT_ID, SETTINGS_URL } from "./connect-settings.js";
-const OPERATION = surface.operations.find((o) => o.id === 'PostAccountsAccount');
+import { PLATFORM_CLIENT_ID, SETTINGS_URL } from "../engine/connect-settings.js";
+import { OAUTH_CONNECTIONS, publicBusinessName } from "../engine/display.js";
+import { redactKey } from "../engine/oauth.js";
+import { accountSettings, nowUnix, PLATFORM_ACCOUNT_ID } from "../engine/stripe.js";
+import { formOf, notFound, seeOther, STRIPE_CONSENT_SKIN } from "./shared.js";
+import { connectOAuthSettings, created, decide } from "../semantics/shared.js";
 /** A code "expires in 5 minutes". */
-export const CODE_TTL_SECONDS = 300;
+const CODE_TTL_SECONDS = 300;
 const CODES = '_oauth_code';
 /** One connection per connected account (the twin's one platform): its scope, tokens, and whether it was revoked. */
-export const CONNECTIONS = OAUTH_CONNECTIONS;
+const CONNECTIONS = OAUTH_CONNECTIONS;
 const SCOPES = ['read_write', 'read_only'];
 const json = (body, status = 200) => Response.json(body, { status, headers: { 'request-id': 'req_twin', 'cache-control': 'no-store' } });
 const oauthError = (error, description, status = 400, extra = {}) => json({ error, error_description: description, ...extra }, status);
-/** Whether a connected account's OAuth connection to the platform was revoked (deauthorized, or its code reused). */
-export function connectionRevoked(ctx, account) {
-    return ctx.rowsRaw(CONNECTIONS).some((c) => c.id === account && c.revoked === true);
-}
-/** The connected account an OAuth key acts as — the connection's current access_token (sk_test_oauth_…) or its
- *  stripe_publishable_key (pk_test_oauth_…) — with the scope it was issued; undefined for any other key, and null for an
- *  OAuth-shaped key no live connection holds (revoked, replaced by a refresh, or never issued). */
-export function oauthKeyAccount(ctx, key) {
-    if (!/^(sk|pk)_test_oauth_/.test(key))
-        return undefined;
-    const held = ctx.rowsRaw(CONNECTIONS).find((c) => c.revoked !== true && (c.access_token === key || c.publishable_key === key));
-    return held ? { account: String(held.id), scope: String(key.startsWith('pk_') ? held.scope : held.access_scope ?? held.scope) } : null;
-}
 // ── authorize ──
 /** A query parameter, or undefined when absent (an empty value is absent too, as a browser form sends one). */
 const param = (q, k) => { const v = q.get(k); return v === null || v === '' ? undefined : v; };
@@ -135,7 +60,7 @@ function withParams(uri, params) {
 /** The prefill the request carries, invalid values silently dropped (docs.stripe.com/connect/oauth-reference). Only
  *  what the new account's object shows the platform, or the page shows the person, is read: the person's birth date and
  *  the business address are the account application's, which the twin does not model (the test-mode skip). */
-export function prefill(q) {
+function prefill(q) {
     const v = (k) => param(q, `stripe_user[${k}]`)?.trim() || undefined;
     const out = {};
     const keep = (k, ok = () => true) => { const s = v(k); if (s !== undefined && ok(s))
@@ -179,13 +104,11 @@ async function createAccount(ctx, p) {
 function application(ctx) {
     return { id: PLATFORM_CLIENT_ID, object: 'application', name: publicBusinessName(ctx.get('account', PLATFORM_ACCOUNT_ID)) };
 }
-/** Send one of the account.application.* events as the connected account's. */
+/** Send one of the account.application.* events as the connected account's: the notice it is sent for (the kernel
+ *  sends it, ../semantics/events.ts renders it). */
 async function applicationEvent(ctx, type, account) {
-    await afterStripeWrite('application', type, application(ctx), ctx.root, ctx.occurredAt, undefined, account);
+    await ctx.write('_application_notice', `${account}:${type}:${ctx.occurredAt}`, { account, application: application(ctx) }, type);
 }
-/** A code's number: `ac_twin_{n}`, the refresh token its exchange mints being `rt_twin_{n}`, so the one follows the
- *  other and neither is counted separately. */
-const codeNumber = (code) => code.replace(/^ac_twin_/, '');
 function page(ctx, action, a, p) {
     const name = publicBusinessName(ctx.get('account', PLATFORM_ACCOUNT_ID));
     const who = [p.email, [p.first_name, p.last_name].filter(Boolean).join(' '), p.business_name].filter((s) => s).join(' · ');
@@ -203,19 +126,17 @@ function page(ctx, action, a, p) {
 /** The person connects: a new Standard account, its connection's code, the authorized event, and the redirect. */
 async function connect(ctx, a, p) {
     const account = await createAccount(ctx, p);
-    // the code's number is taken and its row written in one move, so two people connecting at once get two codes
-    const fields = { client_id: PLATFORM_CLIENT_ID, account, scope: a.scope, redirect_uri: a.redirect, expires_at: Number(ctx.now()) + CODE_TTL_SECONDS, used: false, livemode: false };
-    const code = await ctx.atomically((rows) => {
-        const id = `ac_twin_${rows(CODES).length + 1}`;
-        return { value: id, write: { resource: CODES, id, fields, operation: 'oauth_code.issue' } };
-    });
+    // the code's row id is minted and its value drawn from the World's secret; the row keeps the value's SHA-256 alone
+    const id = ctx.mint(CODES);
+    const code = `ac_${(await ctx.secret(`stripe-oauth-code:${id}`)).replace(/[^A-Za-z0-9]/g, '').slice(0, 24)}`;
+    await ctx.record(CODES, { client_id: PLATFORM_CLIENT_ID, account, scope: a.scope, redirect_uri: a.redirect, expires_at: nowUnix(ctx.occurredAt) + CODE_TTL_SECONDS, used: false, livemode: false, sha256: ctx.crypto.sha256(code) }, id);
     await applicationEvent(ctx, 'account.application.authorized', account);
     return seeOther(withParams(a.redirect, [['scope', a.scope], ['code', code], ['state', a.state]]));
 }
-async function authorize(request, scope) {
+async function authorize(ctx) {
+    const request = ctx.call.request;
     const url = new URL(request.url);
     const form = request.method === 'POST' ? await formOf(request.clone()) : {};
-    const ctx = await semanticsContext(manifest, request, OPERATION, scope);
     const a = checked(ctx, url.searchParams);
     if (a instanceof Response)
         return a;
@@ -259,12 +180,6 @@ function secretKey(request, params) {
     }
     return params.client_secret || undefined;
 }
-/** A key shown the way Stripe's errors show one: its prefix and its last four. */
-export const redactKey = (key) => {
-    const prefix = /^(sk|rk|pk)_(test|live)_/.exec(key)?.[0] ?? '';
-    const rest = key.slice(prefix.length);
-    return rest.length > 4 ? `${prefix}${'*'.repeat(rest.length - 4)}${rest.slice(-4)}` : `${prefix}${'*'.repeat(rest.length)}`;
-};
 /** The refusal of a request without a usable secret key, or undefined when it has one (answered with whether it is live). */
 function keyRefused(key) {
     if (!key)
@@ -279,27 +194,30 @@ function keyRefused(key) {
 }
 const live = (key) => /^(sk|rk)_live_/.test(key);
 /** A new access token for a connection: its generation counted from the ones it had. */
-const accessToken = (account, n) => `sk_test_oauth_${account}_${n}`;
+/** A connection's access token of one generation: its account, then a digest of the connection's secret and the
+ *  generation (the secret read before the atomic move that numbers the generation). */
+// p3: keyed by the connection's secret, drawn from ctx.secret
+const accessToken = (ctx, secret, account, n) => `sk_test_oauth_${account}_${ctx.crypto.digest('sha256', `${secret}:${n}`, 'base64url').replace(/[-_]/g, '').slice(0, 24)}`;
 /** Revoke an account's connection, once: the check and the write are one move, and only the move that revoked it sends
  *  account.application.deauthorized. Answers whether this call revoked it. */
 async function revoke(ctx, account) {
-    const revoked = await ctx.atomically((rows) => {
+    const revoked = await decide(ctx, (rows) => {
         const held = rows(CONNECTIONS).find((c) => c.id === account);
         if (!held || held.revoked === true)
             return { value: false };
-        return { value: true, write: { resource: CONNECTIONS, id: account, fields: { revoked: true, access_token: null, revoked_at: Number(ctx.now()) }, operation: 'oauth_connection.revoke' } };
+        return { value: true, write: { resource: CONNECTIONS, id: account, fields: { revoked: true, access_token: null, revoked_at: nowUnix(ctx.occurredAt) }, operation: 'oauth_connection.revoke' } };
     });
     if (revoked)
         await applicationEvent(ctx, 'account.application.deauthorized', account);
     return revoked;
 }
-async function token(request, scope) {
+async function token(ctx) {
+    const request = ctx.call.request;
     const params = await bodyOf(request);
     const key = secretKey(request, params);
     const refused = keyRefused(key);
     if (refused)
         return refused;
-    const ctx = await semanticsContext(manifest, request, OPERATION, scope);
     const grant = params.grant_type;
     if (!grant)
         return oauthError('invalid_request', 'No grant type specified');
@@ -311,16 +229,16 @@ async function token(request, scope) {
             return oauthError('invalid_request', 'No authorization code provided');
         if (live(key))
             return oauthError('invalid_grant', `Authorization code provided does not belong to the livemode of the API key: ${code} is a test mode code, but a live mode key was used.`);
-        const found = await ctx.atomically((rows) => {
-            const row = rows(CODES).find((r) => r.id === code);
+        const found = await decide(ctx, (rows) => {
+            const row = rows(CODES).find((r) => r.sha256 === ctx.crypto.sha256(code));
             if (!row)
                 return { value: { outcome: 'missing' } };
             // a second use is marked in the same move, so the exchange that spent it sees it after writing its connection
             if (row.used === true)
-                return { value: { outcome: 'used', row }, write: { resource: CODES, id: code, fields: { reused: true }, operation: 'oauth_code.reuse' } };
-            if (Number(ctx.now()) >= Number(row.expires_at))
+                return { value: { outcome: 'used', row }, write: { resource: CODES, id: String(row.id), fields: { reused: true }, operation: 'oauth_code.reuse' } };
+            if (nowUnix(ctx.occurredAt) >= Number(row.expires_at))
                 return { value: { outcome: 'expired', row } };
-            return { value: { outcome: 'ok', row }, write: { resource: CODES, id: code, fields: { used: true, used_at: Number(ctx.now()) }, operation: 'oauth_code.redeem' } };
+            return { value: { outcome: 'ok', row }, write: { resource: CODES, id: String(row.id), fields: { used: true, used_at: nowUnix(ctx.occurredAt) }, operation: 'oauth_code.redeem' } };
         });
         if (found.outcome === 'missing')
             return oauthError('invalid_grant', `Authorization code does not exist: ${code}`);
@@ -333,11 +251,12 @@ async function token(request, scope) {
         if (found.outcome === 'expired')
             return oauthError('invalid_grant', `Authorization code expired: ${code}`);
         const granted = String(found.row.scope);
-        const refresh = `rt_twin_${codeNumber(code)}`;
-        const connection = { client_id: PLATFORM_CLIENT_ID, account, scope: granted, code, refresh_token: refresh, access_token: accessToken(account, 1), access_scope: granted, generation: 1, publishable_key: `pk_test_oauth_${account}`, revoked: false, livemode: false };
+        const refresh = `rt_${(await ctx.secret(`stripe-oauth-refresh:${String(found.row.id)}`)).replace(/[-_]/g, '').slice(0, 32)}`;
+        const secret = await ctx.secret(`stripe-oauth-access:${account}`);
+        const connection = { client_id: PLATFORM_CLIENT_ID, account, scope: granted, code: found.row.id, refresh_token: refresh, access_token: accessToken(ctx, secret, account, 1), access_scope: granted, generation: 1, publishable_key: `pk_test_oauth_${account}`, revoked: false, livemode: false };
         await ctx.record(CONNECTIONS, connection, account);
         // the code used again while this exchange was writing: that use found no connection to revoke, so this one does
-        if (ctx.rowsRaw(CODES).some((r) => r.id === code && r.reused === true)) {
+        if (ctx.rowsRaw(CODES).some((r) => r.id === found.row.id && r.reused === true)) {
             await revoke(ctx, account);
             return oauthError('invalid_grant', 'This authorization code has already been used. All tokens issued with this code have been revoked.');
         }
@@ -360,12 +279,13 @@ async function token(request, scope) {
     // "Any existing access token with the same scope and mode ... is revoked": the connection holds the one now issued; the
     // generation is read and written in one move, so two refreshes at once issue two tokens, and a refresh never lands
     // on a connection revoked meanwhile
-    const renewed = await ctx.atomically((rows) => {
+    const secret = await ctx.secret(`stripe-oauth-access:${account}`);
+    const renewed = await decide(ctx, (rows) => {
         const now = rows(CONNECTIONS).find((c) => c.id === account && c.revoked !== true);
         if (!now)
             return { value: undefined };
         const generation = Number(now.generation ?? 1) + 1;
-        const fields = { access_token: accessToken(account, generation), access_scope: asked, generation };
+        const fields = { access_token: accessToken(ctx, secret, account, generation), access_scope: asked, generation };
         return { value: { ...now, ...fields }, write: { resource: CONNECTIONS, id: account, fields, operation: 'oauth_connection.refresh' } };
     });
     if (!renewed)
@@ -376,13 +296,13 @@ async function token(request, scope) {
 function tokenBody(c, scope) {
     return { access_token: c.access_token, livemode: false, refresh_token: c.refresh_token, scope, stripe_publishable_key: c.publishable_key, stripe_user_id: c.account ?? c.id, token_type: 'bearer' };
 }
-async function deauthorize(request, scope) {
+async function deauthorize(ctx) {
+    const request = ctx.call.request;
     const params = await bodyOf(request);
     const key = secretKey(request, params);
     const refused = keyRefused(key);
     if (refused)
         return refused;
-    const ctx = await semanticsContext(manifest, request, OPERATION, scope);
     const client = params.client_id;
     const account = params.stripe_user_id;
     if (!client)
@@ -399,16 +319,15 @@ async function deauthorize(request, scope) {
         return oauthError('invalid_client', `This application is not connected to stripe account ${account}, or that account does not exist.`);
     return json({ stripe_user_id: account });
 }
-/** connect.stripe.com's OAuth endpoints, or undefined for any other request. */
-export function stripeConnectOAuthFlow(scope) {
-    return async (request) => {
-        const path = new URL(request.url).pathname.replace(/\/+$/, '');
-        if (path === '/oauth/authorize' && (request.method === 'GET' || request.method === 'POST'))
-            return authorize(request, scope);
-        if (path === '/oauth/token' && request.method === 'POST')
-            return token(request, scope);
-        if (path === '/oauth/deauthorize' && request.method === 'POST')
-            return deauthorize(request, scope);
-        return undefined;
-    };
+/** connect.stripe.com's OAuth endpoints; Stripe's 404 for anything else there. */
+export async function screen(ctx) {
+    const request = ctx.call.request;
+    const path = new URL(request.url).pathname.replace(/\/+$/, '');
+    if (path === '/oauth/authorize' && (request.method === 'GET' || request.method === 'POST'))
+        return authorize(ctx);
+    if (path === '/oauth/token' && request.method === 'POST')
+        return token(ctx);
+    if (path === '/oauth/deauthorize' && request.method === 'POST')
+        return deauthorize(ctx);
+    return notFound();
 }

package/dist/src/screens/connect-onboarding.d.ts

@@ -0,0 +1,3 @@
+import type { HandlerContext } from '@volter/world-core';
+/** connect.stripe.com's onboarding pages, or undefined for any other request. */
+export declare function screen(ctx: HandlerContext): Promise<Response>;

package/dist/src/screens/{onboarding.js → connect-onboarding.js}

@@ -1,44 +1,17 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// STRIPE CONNECT HOSTED ONBOARDING — a hosted flow (docs/contributing/architecture.md, "Screens"): a platform
-// creates an Account Link for a connected account and sends the account's owner to its `url`. The link is a
-// single-use entry point: visiting it takes the owner to their onboarding session, and visiting it again, or after it
-// expires, sends them to refresh_url, where the platform makes a new one (docs.stripe.com/connect/hosted-onboarding).
-// At the session's own address they give Stripe what it requires, and Stripe sends them to return_url. Submitting is
-// the owner's move, not an API call. Authored from @volter/world-ui's payment piece; nothing of Stripe's page is copied.
-//
-// The page asks for exactly what Stripe requires before a US Express account with card_payments and transfers can
-// take card payments (docs.stripe.com/connect/required-verification-information; the set is the one Stripe's
-// requirements endpoint answers, docs.stripe.com/_endpoint/get-requirements-for-setups with apiVersion=v1,
-// platformCountry=US, accountCountry=US, dashboardType=express, tosType=full, capabilities card_payments and transfers):
-// thirty requirements for a company (the business profile, the statement descriptor, the company with its tax id,
-// phone and address, its owners, its representative with their title and address, the agreement and the payout bank
-// account) and eighteen for an individual. A submit that leaves any out is refused with what is missing. The account's
-// requirements.currently_due lists what is still missing, and charges and payouts are enabled, and its requested
-// capabilities become active (Stripe's move on the capability machine), only once none is. The agreement is the
-// page's own checkbox, recorded as tos_acceptance with the request's address and the time.
-//
-// Where the documentation stops and the twin decides: only these two US sets are modelled; an account elsewhere, or
-// of another business type, is told its requirements are not modelled. Test mode verifies at once whatever is
-// submitted (docs.stripe.com/connect/testing lists the values that pass: date of birth 1901-01-01, SSN last four
-// 0000, tax id 000000000, routing 110000000, account 000123456789); the industries offered are Stripe's supported
-// merchant category codes as its list gives them (./industries.ts), and an industry the page does not offer leaves
-// business_profile.mcc due; the states are the fifty and the District of Columbia; a request with no forwarded address
-// records 127.0.0.1. An update link (account_update) shows the same page.
-import { semanticsContext } from '@volter/world-core';
 import { CONSENT_CSS, flowPage, Payment, PAYMENT_CSS } from '@volter/world-ui';
-import surface from '../generated/surface.gen.json' with { type: 'json' };
-import { manifest } from "../manifest.js";
+import { nowUnix } from "../engine/stripe.js";
+import { formOf, notFound, seeOther, STRIPE_CONSENT_SKIN } from "./shared.js";
+import { INDUSTRIES as MCCS } from "../engine/industries.js";
+import { currentlyDue, kindOf, OFFERED } from "../engine/onboarding.js";
 import { created, syncExternals } from "../semantics/shared.js";
-import { formOf, seeOther, STRIPE_CONSENT_SKIN } from "./consent-skin.js";
-import { INDUSTRIES as MCCS } from "./industries.js";
 const LINK = 'account_link';
-const OPERATION = surface.operations.find((o) => o.id === 'PostAccountsAccount');
+const OPERATION = { id: 'PostAccountsAccount' };
 const gone = () => flowPage({ title: 'Stripe', status: 404, css: [CONSENT_CSS, STRIPE_CONSENT_SKIN], body: _jsx("main", { className: "consent", children: _jsx("h1", { className: "consent-heading", children: "This link is invalid." }) }) });
 /** A link that can still be used: not used and not past its expiry. */
-const usable = (ctx, link) => link.used !== true && Number(link.expires_at) > Number(ctx.now());
+const usable = (ctx, link) => link.used !== true && Number(link.expires_at) > nowUnix(ctx.occurredAt);
 // the field asks, with no industry chosen until the person chooses one (an unanswered field leaves the MCC due)
 const INDUSTRIES = [{ value: '', label: 'Select your industry' }, ...MCCS.map(([value, label]) => ({ value, label }))];
-const OFFERED = new Set(MCCS.map(([mcc]) => mcc));
 // the fifty states and the District of Columbia, by their USPS codes (the address's `state`, ISO 3166-2 without its
 // country, docs.stripe.com/api/accounts/object)
 const STATES = [
@@ -51,43 +24,6 @@ const STATES = [
     ['SC', 'South Carolina'], ['SD', 'South Dakota'], ['TN', 'Tennessee'], ['TX', 'Texas'], ['UT', 'Utah'], ['VT', 'Vermont'], ['VA', 'Virginia'],
     ['WA', 'Washington'], ['WV', 'West Virginia'], ['WI', 'Wisconsin'], ['WY', 'Wyoming'],
 ].map(([value, label]) => ({ value, label }));
-const has = (v, k) => (v[k] ?? '').trim() !== '';
-const dobPart = (v, i) => /^\d{4}-\d{2}-\d{2}$/.test(v.dob ?? '') && Number((v.dob ?? '').split('-')[i]) > 0;
-/** Each requirement Stripe names, the form's answer that meets it, and which of the two sets it belongs to. */
-const REQUIREMENTS = [
-    ['business_profile.mcc', (v) => OFFERED.has((v.mcc ?? '').trim()), ['company', 'individual']],
-    ['business_profile.url', (v) => has(v, 'url'), ['company', 'individual']],
-    ['settings.payments.statement_descriptor', (v) => has(v, 'statement_descriptor'), ['company', 'individual']],
-    ['company.name', (v) => has(v, 'company_name'), ['company']],
-    ['company.tax_id', (v) => has(v, 'company_tax_id'), ['company']],
-    ['company.phone', (v) => has(v, 'company_phone'), ['company']],
-    ['company.address.line1', (v) => has(v, 'company_line1'), ['company']],
-    ['company.address.city', (v) => has(v, 'company_city'), ['company']],
-    ['company.address.state', (v) => has(v, 'company_state'), ['company']],
-    ['company.address.postal_code', (v) => has(v, 'company_postal_code'), ['company']],
-    ['company.owners_provided', (v) => v.owners_provided === 'provided', ['company']],
-    ['owners.first_name', (v) => has(v, 'owner_first_name'), ['company']],
-    ['owners.last_name', (v) => has(v, 'owner_last_name'), ['company']],
-    ['owners.email', (v) => has(v, 'owner_email'), ['company']],
-    ...['first_name', 'last_name', 'email', 'phone'].flatMap((f) => [[`representative.${f}`, (v) => has(v, f), ['company']], [`individual.${f}`, (v) => has(v, f), ['individual']]]),
-    ...['day', 'month', 'year'].flatMap((f, i) => [[`representative.dob.${f}`, (v) => dobPart(v, 2 - i), ['company']], [`individual.dob.${f}`, (v) => dobPart(v, 2 - i), ['individual']]]),
-    ...['line1', 'city', 'state', 'postal_code'].flatMap((f) => [[`representative.address.${f}`, (v) => has(v, f), ['company']], [`individual.address.${f}`, (v) => has(v, f), ['individual']]]),
-    ['representative.relationship.title', (v) => has(v, 'title'), ['company']],
-    ['representative.ssn_last_4', (v) => /^\d{4}$/.test(v.ssn_last_4 ?? ''), ['company']],
-    ['individual.ssn_last_4', (v) => /^\d{4}$/.test(v.ssn_last_4 ?? ''), ['individual']],
-    ['tos_acceptance.date', (v) => v.tos === 'accepted', ['company', 'individual']],
-    ['tos_acceptance.ip', (v) => v.tos === 'accepted', ['company', 'individual']],
-    ['external_account', (v) => has(v, 'routing_number') && has(v, 'account_number'), ['company', 'individual']],
-];
-/** The set an account onboards against: the two US sets the twin models, or none. */
-export function kindOf(account) {
-    const type = account.business_type ?? 'individual';
-    return (account.country ?? 'US') === 'US' && (type === 'company' || type === 'individual') ? type : undefined;
-}
-/** What an account of this kind still owes, given the form's answers (none: all of it). */
-export function currentlyDue(kind, v = {}) {
-    return REQUIREMENTS.filter(([, met, kinds]) => kinds.includes(kind) && !met(v)).map(([req]) => req);
-}
 const field = (id, label, v, extra = {}) => ({ id, label, value: v[id] ?? '', ...extra });
 const addressFields = (prefix, v) => [
     field(`${prefix}line1`, 'Address', v, { autoComplete: 'address-line1' }), field(`${prefix}city`, 'City', v),
@@ -163,7 +99,7 @@ async function submit(ctx, link, kind, v, ip) {
         ...(company
             ? { company: { name: v.company_name, phone: v.company_phone, address: addressOf('company_'), tax_id_provided: true, owners_provided: true, directors_provided: false, executives_provided: false } }
             : { individual: { ...person, id: `person_${id}` } }),
-        tos_acceptance: { date: Number(ctx.now()), ip, user_agent: null },
+        tos_acceptance: { date: nowUnix(ctx.occurredAt), ip, user_agent: null },
     }, 'account.updated');
     if (company) {
         await created(ctx, 'person', { account: id }, { ...person, relationship: { representative: true, executive: true, director: false, owner: false, percent_ownership: null, title: v.title }, metadata: {} });
@@ -191,35 +127,33 @@ async function visit(ctx, id) {
     return seeOther(`${SESSIONS}${session}`);
 }
 /** connect.stripe.com's onboarding pages, or undefined for any other request. */
-export function stripeOnboardingFlow(scope) {
-    return async (request) => {
-        const path = new URL(request.url).pathname;
-        const entry = /^\/setup\/(acctlink_[A-Za-z0-9_]+)\/?$/.exec(path);
-        const at = /^\/setup\/s\/(onbs_[A-Za-z0-9_]+)\/?$/.exec(path);
-        if (entry && request.method === 'GET')
-            return visit(await semanticsContext(manifest, request, OPERATION, scope), entry[1]);
-        if (!at || (request.method !== 'GET' && request.method !== 'POST'))
-            return undefined;
-        const sid = at[1];
-        const form = request.method === 'POST' ? await formOf(request.clone()) : {};
-        const ctx = await semanticsContext(manifest, request, OPERATION, scope);
-        // the session the visited link opened, until it is submitted
-        const stored = ctx.rowsRaw(LINK).find((l) => l._session === sid && l._submitted !== true);
-        const link = stored ? ctx.get(LINK, String(stored.id)) : undefined;
-        if (!stored || !link)
-            return gone();
-        const sessionUrl = `${SESSIONS}${sid}`;
-        const account = ctx.get('account', String(link.account)) ?? {};
-        const kind = kindOf(account);
-        if (!kind)
-            return unmodelled(account);
-        if (request.method === 'GET')
-            return page(ctx, sessionUrl, link, kind);
-        const missing = currentlyDue(kind, form);
-        if (missing.length)
-            return incomplete(ctx, sessionUrl, link, kind, form, missing);
-        await ctx.write(LINK, String(stored.id), { _submitted: true }, 'account_link.submitted');
-        await submit(ctx, link, kind, form, request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || '127.0.0.1');
-        return seeOther(String(link.return_url));
-    };
+export async function screen(ctx) {
+    const request = ctx.call.request;
+    const path = new URL(request.url).pathname;
+    const entry = /^\/setup\/(acctlink_[A-Za-z0-9_]+)\/?$/.exec(path);
+    const at = /^\/setup\/s\/(onbs_[A-Za-z0-9_]+)\/?$/.exec(path);
+    if (entry && request.method === 'GET')
+        return visit(ctx, entry[1]);
+    if (!at || (request.method !== 'GET' && request.method !== 'POST'))
+        return notFound();
+    const sid = at[1];
+    const form = request.method === 'POST' ? await formOf(request.clone()) : {};
+    // the session the visited link opened, until it is submitted
+    const stored = ctx.rowsRaw(LINK).find((l) => l._session === sid && l._submitted !== true);
+    const link = stored ? ctx.get(LINK, String(stored.id)) : undefined;
+    if (!stored || !link)
+        return gone();
+    const sessionUrl = `${SESSIONS}${sid}`;
+    const account = ctx.get('account', String(link.account)) ?? {};
+    const kind = kindOf(account);
+    if (!kind)
+        return unmodelled(account);
+    if (request.method === 'GET')
+        return page(ctx, sessionUrl, link, kind);
+    const missing = currentlyDue(kind, form);
+    if (missing.length)
+        return incomplete(ctx, sessionUrl, link, kind, form, missing);
+    await ctx.write(LINK, String(stored.id), { _submitted: true }, 'account_link.submitted');
+    await submit(ctx, link, kind, form, request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || '127.0.0.1');
+    return seeOther(String(link.return_url));
 }

package/dist/src/screens/dashboard.d.ts

@@ -0,0 +1,3 @@
+import type { HandlerContext } from '@volter/world-core';
+/** dashboard.stripe.com's pages: Public details and the Connect OAuth settings; Stripe's 404 for any other. */
+export declare function screen(ctx: HandlerContext): Promise<Response>;

package/dist/src/screens/dashboard.js

@@ -0,0 +1,117 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { flowPage } from '@volter/world-ui';
+import { platformAccountDefault } from "../engine/connect.js";
+import { CONNECT_SETTINGS_PATH, PLATFORM_CLIENT_ID, redirectUris, SETTINGS } from "../engine/connect-settings.js";
+import { publicBusinessName } from "../engine/display.js";
+import { PLATFORM_ACCOUNT_ID } from "../engine/stripe.js";
+import { formOf, notFound } from "./shared.js";
+import { connectOAuthSettings, created } from "../semantics/shared.js";
+const PUBLIC_DETAILS_PATH = '/settings/public';
+const MAX_NAME = 5000;
+const SETTINGS_CSS = `
+* { box-sizing: border-box; }
+body { margin: 0; background: #f6f8fa; color: #1a1f36; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Ubuntu, sans-serif; font-size: 14px; }
+.co { max-width: 680px; margin: 48px auto; padding: 0 16px; }
+.co h1 { font-size: 28px; margin: 16px 0 4px; }
+.co-lead { color: #697386; margin: 0 0 24px; }
+.co-card { background: #ffffff; border: 1px solid #e3e8ee; border-radius: 8px; padding: 24px; margin-bottom: 16px; }
+.co-card h2 { font-size: 16px; margin: 0 0 12px; }
+.co-card label { display: block; font-weight: 600; margin-bottom: 6px; }
+.co-card small { display: block; color: #697386; margin-bottom: 8px; }
+.co-card textarea { width: 100%; min-height: 96px; padding: 8px 10px; border: 1px solid #c1c9d2; border-radius: 6px; font: 13px ui-monospace, Menlo, monospace; }
+.co-id { font: 14px ui-monospace, Menlo, monospace; background: #f6f8fa; border: 1px solid #e3e8ee; border-radius: 6px; padding: 6px 10px; display: inline-block; }
+.co-toggle { display: flex; gap: 8px; align-items: center; font-weight: 600; }
+.co-actions { display: flex; justify-content: flex-end; }
+.co-actions button { background: #635bff; color: #ffffff; border: 0; border-radius: 6px; padding: 8px 16px; font: inherit; font-weight: 600; cursor: pointer; }
+.co-notice { padding: 10px 12px; border-radius: 6px; margin-bottom: 16px; }
+.co-error { background: #fff0f3; color: #df1b41; }
+.co-saved { background: #e7f8ef; color: #0e6245; }
+.co-uris { margin: 0; padding-left: 18px; }
+`;
+function settingsPage(s, opts = {}) {
+    const enabled = opts.enabled ?? s.oauth_enabled;
+    return flowPage({
+        title: 'OAuth – Connect settings – Stripe',
+        css: [SETTINGS_CSS],
+        ...(opts.error ? { status: 400 } : {}),
+        body: (_jsxs("main", { className: "co", children: [_jsx("h1", { children: "OAuth" }), _jsx("p", { className: "co-lead", children: "Onboard Standard accounts by sending them to Stripe's OAuth flow. Test mode." }), opts.error ? _jsx("p", { className: "co-notice co-error", role: "alert", children: opts.error }) : null, opts.saved ? _jsx("p", { className: "co-notice co-saved", role: "status", children: "Your OAuth settings were saved." }) : null, _jsxs("section", { className: "co-card", children: [_jsx("h2", { children: "Test mode client ID" }), _jsx("small", { children: "The client_id your platform sends to connect.stripe.com/oauth/authorize." }), _jsx("code", { className: "co-id", "data-testid": "connect-client-id", children: PLATFORM_CLIENT_ID }), _jsx("p", { "data-testid": "connect-oauth-status", children: s.oauth_enabled ? 'OAuth is enabled.' : 'OAuth is disabled.' }), s.redirect_uris.length ? _jsx("ul", { className: "co-uris", children: s.redirect_uris.map((u) => _jsx("li", { "data-testid": "connect-redirect-uri", children: u }, u)) }) : _jsx("p", { children: "No redirect URIs." })] }), _jsxs("form", { className: "co-card", method: "post", children: [_jsxs("label", { className: "co-toggle", htmlFor: "oauth_enabled", children: [_jsx("input", { type: "checkbox", id: "oauth_enabled", name: "oauth_enabled", value: "on", defaultChecked: enabled }), " Enable OAuth for Standard accounts"] }), _jsx("label", { htmlFor: "redirect_uris", children: "Redirect URIs" }), _jsx("small", { children: "One per line. The first is used when a request names none. http and localhost are allowed in test mode." }), _jsx("textarea", { id: "redirect_uris", name: "redirect_uris", defaultValue: opts.value ?? s.redirect_uris.join('\n') }), _jsx("div", { className: "co-actions", children: _jsx("button", { type: "submit", children: "Save" }) })] })] })),
+    });
+}
+const DETAILS_CSS = `
+* { box-sizing: border-box; }
+body { margin: 0; background: #f6f8fa; color: #1a1f36; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Ubuntu, sans-serif; font-size: 14px; }
+.pd { max-width: 640px; margin: 48px auto; padding: 0 16px; }
+.pd h1 { font-size: 28px; margin: 16px 0 4px; }
+.pd-lead { color: #697386; margin: 0 0 24px; }
+.pd-card { background: #ffffff; border: 1px solid #e3e8ee; border-radius: 8px; padding: 24px; }
+.pd-card label { display: block; font-weight: 600; margin-bottom: 6px; }
+.pd-card small { display: block; color: #697386; margin-bottom: 8px; }
+.pd-card input { width: 100%; padding: 8px 10px; border: 1px solid #c1c9d2; border-radius: 6px; font: inherit; }
+.pd-actions { margin-top: 20px; display: flex; justify-content: flex-end; }
+.pd-actions button { background: #635bff; color: #ffffff; border: 0; border-radius: 6px; padding: 8px 16px; font: inherit; font-weight: 600; cursor: pointer; }
+.pd-notice { padding: 10px 12px; border-radius: 6px; margin-bottom: 16px; }
+.pd-error { background: #fff0f3; color: #df1b41; }
+.pd-saved { background: #e7f8ef; color: #0e6245; }
+`;
+function detailsPage(account, opts = {}) {
+    const named = account?.business_profile?.name;
+    const value = opts.value ?? (typeof named === 'string' ? named : '');
+    return flowPage({
+        title: 'Public details – Stripe',
+        css: [DETAILS_CSS],
+        ...(opts.error ? { status: 400 } : {}),
+        body: (_jsxs("main", { className: "pd", children: [_jsx("h1", { children: "Public details" }), _jsxs("p", { className: "pd-lead", children: ["What your customers see on Checkout, the customer portal, receipts and invoices. Currently shown: ", _jsx("strong", { "data-testid": "public-business-name", children: publicBusinessName(account) })] }), opts.error ? _jsx("p", { className: "pd-notice pd-error", role: "alert", children: opts.error }) : null, opts.saved ? _jsx("p", { className: "pd-notice pd-saved", role: "status", children: "Your public details were saved." }) : null, _jsxs("form", { className: "pd-card", method: "post", children: [_jsx("label", { htmlFor: "business_name", children: "Business name" }), _jsx("small", { children: "The name customers see when they pay you." }), _jsx("input", { id: "business_name", name: "business_name", autoComplete: "organization", defaultValue: value, required: true, maxLength: MAX_NAME }), _jsx("div", { className: "pd-actions", children: _jsx("button", { type: "submit", children: "Save" }) })] })] })),
+    });
+}
+/** Save the business name on the platform's own account: the stored record, made from Stripe's default the first
+ *  time anything is saved, and otherwise changed in place (its other public details kept). */
+async function save(ctx, name) {
+    const held = ctx.get('account', PLATFORM_ACCOUNT_ID);
+    const profile = { business_profile: { ...((held ?? platformAccountDefault()).business_profile ?? {}), name } };
+    await (held ? ctx.write('account', PLATFORM_ACCOUNT_ID, profile, 'account.update') : created(ctx, 'account', { ...platformAccountDefault(), ...profile }, {}, { operation: 'account.update' }));
+}
+/** What the page says of a name no browser sends (the field is required and bounded), for a client that sends it. */
+function nameRefused(name) {
+    return !name ? 'Enter your business name.' : name.length > MAX_NAME ? `Your business name must be at most ${MAX_NAME} characters.` : undefined;
+}
+async function settings(ctx) {
+    const request = ctx.call.request;
+    const url = new URL(request.url);
+    if (request.method !== 'GET' && request.method !== 'POST')
+        return notFound();
+    const form = request.method === 'POST' ? await formOf(request.clone()) : {};
+    const held = connectOAuthSettings(ctx);
+    if (request.method === 'GET')
+        return settingsPage(held, { saved: url.searchParams.has('saved') });
+    const enabled = form.oauth_enabled === 'on' || form.oauth_enabled === 'true';
+    const parsed = redirectUris(form.redirect_uris ?? '');
+    if ('refused' in parsed)
+        return settingsPage(held, { value: form.redirect_uris ?? '', enabled, error: parsed.refused });
+    await ctx.record(SETTINGS, { oauth_enabled: enabled, redirect_uris: parsed.uris }, PLATFORM_CLIENT_ID);
+    return new Response(null, { status: 303, headers: { location: '?saved=1' } });
+}
+async function publicDetails(ctx) {
+    const request = ctx.call.request;
+    const url = new URL(request.url);
+    if (request.method !== 'GET' && request.method !== 'POST')
+        return notFound();
+    const form = request.method === 'POST' ? await formOf(request.clone()) : {};
+    if (request.method === 'GET')
+        return detailsPage(ctx.get('account', PLATFORM_ACCOUNT_ID), { saved: url.searchParams.has('saved') });
+    const name = (form.business_name ?? '').trim();
+    const refused = nameRefused(name);
+    if (refused)
+        return detailsPage(ctx.get('account', PLATFORM_ACCOUNT_ID), { value: form.business_name ?? '', error: refused });
+    await save(ctx, name);
+    // a query-only reference: the page's own path, wherever it is mounted and with or without its trailing slash
+    return new Response(null, { status: 303, headers: { location: '?saved=1' } });
+}
+/** dashboard.stripe.com's pages: Public details and the Connect OAuth settings; Stripe's 404 for any other. */
+export async function screen(ctx) {
+    const path = new URL(ctx.call.request.url).pathname.replace(/\/+$/, '');
+    if (path === PUBLIC_DETAILS_PATH)
+        return publicDetails(ctx);
+    if (CONNECT_SETTINGS_PATH.test(path))
+        return settings(ctx);
+    return notFound();
+}