@volter/twin-stripe 2.0.38 → 3.0.1

package/dist/src/semantics/connect.js

@@ -1,493 +0,0 @@
-import { ACCOUNT_TYPES, accountCapabilities, accountRequirements, accountSettings, asBool, PLATFORM_ACCOUNT_ID } from "../stripe-twin.js";
-import { currentlyDue, kindOf } from "../screens/onboarding.js";
-import { at, created, externalList, fail, list, newest, path, syncExternals } from "./shared.js";
-import { OAUTH_CONNECTIONS } from "../stripe-shared.js";
-const accountMissing = (ctx, id, status = 404) => fail(ctx, `No such account: '${id}'`, status, 'resource_missing');
-/** The account, tombstones included where the hand-written routes looked past a deletion. */
-const accountRow = (ctx, id) => ctx.row('account', id, { withDeleted: true });
-// the platform's own account: stored once it is written, otherwise Stripe's default. It "controls itself" (controller
-// type `account`, docs.stripe.com/api/accounts/object), is fully onboarded with nothing due, and takes card payments
-// and transfers. Where the documentation stops and the twin decides: it was created as the World began (2026-01-01),
-// and its bank account, which its automatic payouts reach, is not modelled, so it lists none.
-const PLATFORM_CREATED = 1_767_225_600;
-/** The platform's own account as Stripe's default has it, before anything is written to it. */
-export const platformAccountDefault = () => ({
-    object: 'account', id: PLATFORM_ACCOUNT_ID, type: 'standard', country: 'US', default_currency: 'usd', created: PLATFORM_CREATED,
-    charges_enabled: true, payouts_enabled: true, details_submitted: true, email: null, metadata: {},
-    capabilities: { card_payments: 'active', transfers: 'active' }, controller: { type: 'account' },
-    requirements: { alternatives: [], current_deadline: null, currently_due: [], disabled_reason: null, errors: [], eventually_due: [], past_due: [], pending_verification: [] },
-    future_requirements: { alternatives: [], current_deadline: null, currently_due: [], disabled_reason: null, errors: [], eventually_due: [], past_due: [], pending_verification: [] },
-    external_accounts: externalList(PLATFORM_ACCOUNT_ID, []), tos_acceptance: { date: null, ip: null, user_agent: null }, business_profile: {},
-    settings: accountSettings(undefined), livemode: false,
-});
-// GET /v1/account answers the account the request acts as: with the Stripe-Account header (or a connected account's OAuth
-// key, which acts as it: stripe-server.ts) that connected account, "Retrieves the details of an account"
-// (docs.stripe.com/api/accounts/retrieve; docs.stripe.com/connect/authentication), else the platform's own
-const platform = async (ctx) => {
-    const acting = ctx.call.request.headers.get('stripe-account');
-    const connected = acting && acting !== PLATFORM_ACCOUNT_ID ? ctx.get('account', acting) : undefined;
-    // a Stripe-Account naming no account is refused as Stripe refuses a Stripe-Account the key cannot use (account_invalid,
-    // docs.stripe.com/error-codes; stripe-server.ts revokedAccountRefused words it the same)
-    if (acting && acting !== PLATFORM_ACCOUNT_ID && !connected)
-        return fail(ctx, `The provided key does not have access to account '${acting}' (or that account does not exist). Application access may have been revoked.`, 403, 'account_invalid');
-    return ctx.reply(connected ?? ctx.get('account', PLATFORM_ACCOUNT_ID) ?? platformAccountDefault());
-};
-/** A new Express account owes what its hosted onboarding will ask for (screens/onboarding.tsx; the US sets
- *  docs.stripe.com/connect/required-verification-information lists), or, where the twin does not model the set, the
- *  generic list. */
-function expressRequirements(params) {
-    const kind = kindOf({ country: params.country ?? 'US', business_type: params.business_type ?? 'individual' });
-    const base = accountRequirements();
-    return kind ? { ...base, currently_due: currentlyDue(kind), eventually_due: currentlyDue(kind) } : base;
-}
-// the requested capabilities become Stripe's status map, and settings its canonical shape
-const create = async (ctx) => {
-    const params = ctx.params;
-    const type = typeof params.type === 'string' ? params.type : 'standard';
-    if (!ACCOUNT_TYPES.has(type))
-        return fail(ctx, 'Invalid account type: must be one of express, standard, or custom.', 400, 'parameter_invalid_string_enum');
-    const { capabilities: _caps, settings: _settings, ...accountParams } = keptKyc(params);
-    const id = ctx.mint('account');
-    const made = await created(ctx, 'account', { ...accountParams, id, type }, {
-        business_type: null, charges_enabled: false, payouts_enabled: false, details_submitted: false,
-        capabilities: accountCapabilities(params), requirements: type === 'express' ? expressRequirements(params) : accountRequirements(),
-        country: typeof params.country === 'string' ? params.country : 'US',
-        default_currency: 'usd', email: params.email ?? null, metadata: {}, livemode: false,
-        settings: accountSettings(params.settings), business_profile: {},
-        controller: controllerOf(type), external_accounts: externalList(id, []),
-        future_requirements: { alternatives: [], current_deadline: null, currently_due: [], disabled_reason: null, errors: [], eventually_due: [], past_due: [], pending_verification: [] },
-        tos_acceptance: { date: null, ip: null, user_agent: null },
-    });
-    await review(ctx, String(made.id));
-    return ctx.reply(ctx.get('account', String(made.id)));
-};
-/** The controller an account made with a `type` has: "Each of the three account types maps to values in the
- *  `controller` hash", Standard to losses.payments `stripe`, fees.payer `account`, requirement_collection `stripe` and
- *  a `full` dashboard, Express to `application`, `application_express`, `stripe` and `express`, Custom to
- *  `application`, `application_custom`, `application` and `none`; each "type": "application", "is_controller": true
- *  (docs.stripe.com/connect/migrate-to-controller-properties). */
-function controllerOf(type) {
-    const [losses, payer, collection, dashboard] = type === 'express' ? ['application', 'application_express', 'stripe', 'express']
-        : type === 'custom' ? ['application', 'application_custom', 'application', 'none'] : ['stripe', 'account', 'stripe', 'full'];
-    return { type: 'application', is_controller: true, losses: { payments: losses }, fees: { payer }, requirement_collection: collection, stripe_dashboard: { type: dashboard } };
-}
-// connected accounts only: the platform's own is not one, and neither is an account whose OAuth connection was revoked,
-// which "can't be accessed by your platform in the Dashboard or through the API" (docs.stripe.com/connect/oauth-reference;
-// its connection row is OAUTH_CONNECTIONS, screens/connect-oauth.tsx)
-const listAccounts = async (ctx) => {
-    const revoked = new Set(ctx.rowsRaw(OAUTH_CONNECTIONS).filter((c) => c.revoked === true).map((c) => c.id));
-    return list(ctx, 'account', newest(ctx, 'account').filter((a) => a.id !== PLATFORM_ACCOUNT_ID && !revoked.has(a.id)));
-};
-/** What a Custom account still owes, from what the platform has given for it, as Stripe's requirements endpoint lists it
- *  for a US account with no Stripe Dashboard and the full service agreement
- *  (docs.stripe.com/_endpoint/get-requirements-for-setups, the data behind
- *  docs.stripe.com/connect/required-verification-information). With transfers alone, a company owes business_profile.url,
- *  company.name, an external account and tos_acceptance.date and .ip at once (capability_limit_amount -1: paused until
- *  given) and company.tax_id before $3,000 of payouts (payout_limit_amount 300000); an individual owes the url, its
- *  first and last name, the bank account and the terms at once, and its date of birth and ssn_last_4 before $3,000 of
- *  payouts. Requesting card_payments adds business_profile.mcc and the entity's address at once (and an individual's
- *  email and ssn_last_4). A company with card_payments owes, at once, business_profile.mcc, its address, that its owners
- *  are provided, each owner's name and email, and its representative's name, email, address, title and ssn_last_4; and
- *  in time its phone, its statement descriptor and its representative's date of birth and phone (the endpoint's answer
- *  for US / dashboard none / full terms / company / card_payments and transfers, saved in scratch as
- *  req-custom-company-cards-transfers.json: capability_limit_amount -1 for the first, none for the second). The
- *  representative and the owners are the account's persons (relationship.representative, relationship.owner).
- *  Where the documentation stops and the twin decides: what has no limit, or is owed before $3,000 of payouts, is
- *  eventually_due and blocks nothing (the twin keeps no payout total against it); an owner field is met when every
- *  person marked owner has it (none marked: met). */
-const at_path = (a, path) => path.split('.').reduce((v, k) => (v && typeof v === 'object' ? v[k] : undefined), a);
-const CARD_COMPANY_NOW = ['business_profile.mcc', 'company.address.line1', 'company.address.city', 'company.address.state', 'company.address.postal_code', 'company.owners_provided', 'owners.first_name', 'owners.last_name', 'owners.email', 'representative.first_name', 'representative.last_name', 'representative.email', 'representative.address.line1', 'representative.address.city', 'representative.address.state', 'representative.address.postal_code', 'representative.relationship.title', 'representative.ssn_last_4'];
-const CARD_COMPANY_LATER = ['company.phone', 'settings.payments.statement_descriptor', 'representative.dob.day', 'representative.dob.month', 'representative.dob.year', 'representative.phone'];
-const CARD_INDIVIDUAL_NOW = ['business_profile.mcc', 'individual.address.line1', 'individual.address.city', 'individual.address.state', 'individual.address.postal_code', 'individual.email', 'individual.ssn_last_4'];
-/** A field only card_payments asks for (the transfers capability's requirements leave it out). */
-const cardOnly = (field) => [...CARD_COMPANY_NOW, ...CARD_COMPANY_LATER, ...CARD_INDIVIDUAL_NOW].includes(field);
-const personHas = (p, field) => {
-    if (field === 'ssn_last_4')
-        return p.ssn_last_4_provided === true;
-    const v = at_path(p, field);
-    return v !== undefined && v !== null && v !== '';
-};
-const met = (a, bank, field, persons = []) => {
-    if (field === 'external_account')
-        return bank;
-    if (field.startsWith('representative.')) {
-        const rep = persons.find((p) => p.relationship?.representative === true);
-        return !!rep && personHas(rep, field.slice('representative.'.length));
-    }
-    if (field.startsWith('owners.'))
-        return persons.filter((p) => p.relationship?.owner === true).every((p) => personHas(p, field.slice('owners.'.length)));
-    if (field === 'company.tax_id')
-        return at_path(a, 'company.tax_id_provided') === true;
-    if (field === 'individual.ssn_last_4')
-        return at_path(a, 'individual.ssn_last_4_provided') === true;
-    const v = at_path(a, field);
-    return v !== undefined && v !== null && v !== '';
-};
-function customRequirements(a, bank, persons = []) {
-    const company = a.business_type === 'company';
-    const cards = Object.keys(a.capabilities ?? {}).includes('card_payments');
-    const now = ['business_profile.url', ...(company ? ['company.name'] : ['individual.first_name', 'individual.last_name']), 'external_account', 'tos_acceptance.date', 'tos_acceptance.ip'];
-    if (cards)
-        now.push(...(company ? CARD_COMPANY_NOW : CARD_INDIVIDUAL_NOW));
-    const later = [...(company ? ['company.tax_id'] : ['individual.dob.day', 'individual.dob.month', 'individual.dob.year', 'individual.ssn_last_4']), ...(cards && company ? CARD_COMPANY_LATER : [])].filter((f) => !now.includes(f));
-    return { now: now.filter((f) => !met(a, bank, f, persons)), later: later.filter((f) => !met(a, bank, f, persons)) };
-}
-/** A request's company or individual as Stripe keeps it: a tax id or SSN given is kept only as provided (the Account
- *  object answers company.tax_id_provided and individual.ssn_last_4_provided, never the numbers;
- *  docs.stripe.com/api/accounts/object). */
-function keptKyc(params) {
-    const out = { ...params };
-    if (params.company && typeof params.company === 'object') {
-        const { tax_id, ...company } = params.company;
-        out.company = { ...company, ...(tax_id !== undefined && tax_id !== '' ? { tax_id_provided: true } : {}) };
-    }
-    if (params.individual && typeof params.individual === 'object') {
-        const { ssn_last_4, id_number, ...individual } = params.individual;
-        out.individual = { ...individual, ...(ssn_last_4 !== undefined && ssn_last_4 !== '' ? { ssn_last_4_provided: true } : {}), ...(id_number !== undefined && id_number !== '' ? { id_number_provided: true } : {}) };
-    }
-    return out;
-}
-/** Stripe's review of a Custom account once the platform gives it something: with nothing left due, its requested
- *  capabilities become active and it can take charges and receive payouts; with something due again (its bank account
- *  removed), they stop. Where the documentation stops and the twin decides: test-mode verification is immediate, and
- *  it owes what customRequirements lists. An Express or Standard account is onboarded on Stripe's own pages. */
-async function review(ctx, id) {
-    const account = ctx.get('account', id);
-    if (account && account.type === 'custom')
-        await reviewCustom(ctx, id, account);
-}
-/** The review of a Custom account (see review). */
-async function reviewCustom(ctx, id, account) {
-    const bank = ctx.rows('external_account').some((e) => e.account === id);
-    const persons = ctx.rows('person').filter((p) => p.account === id);
-    const { now: due, later } = customRequirements(account, bank, persons);
-    // one account, one review: "If a connected account has both card_payments and transfers, and the status of either one
-    // is inactive, then both capabilities are disabled" (docs.stripe.com/connect/account-capabilities)
-    const ready = due.length === 0;
-    const capabilities = {};
-    for (const [key, was] of Object.entries(account.capabilities ?? {})) {
-        const to = ready ? 'active' : 'inactive';
-        // Stripe's review moves each capability, as the machine declares it may
-        if (was !== to)
-            ctx.legal('capability', 'status', ctx.call.operation.id, String(was), to, key, 'vendor');
-        capabilities[key] = to;
-    }
-    const requirements = { ...(account.requirements ?? {}), currently_due: due, eventually_due: [...due, ...later], past_due: [], disabled_reason: ready ? null : 'requirements.past_due', current_deadline: null };
-    await ctx.write('account', id, { capabilities, requirements, charges_enabled: ready, payouts_enabled: ready, details_submitted: ready }, ready ? 'account.updated' : 'account.update');
-}
-// `type` cannot change; settings merge onto the existing ones
-const update = async (ctx) => {
-    const id = at(ctx, 'account');
-    const ex = ctx.get('account', id);
-    if (!ex)
-        return accountMissing(ctx, id);
-    const { type: _drop, settings: rawSettings, ...rest } = keptKyc(ctx.params);
-    if (rawSettings !== undefined)
-        rest.settings = accountSettings(rawSettings, ex.settings);
-    // a company or an individual given in part is laid over what the account holds
-    for (const k of ['company', 'individual', 'business_profile', 'tos_acceptance'])
-        if (rest[k] && typeof rest[k] === 'object' && ex[k] && typeof ex[k] === 'object')
-            rest[k] = { ...ex[k], ...rest[k] };
-    await ctx.write('account', id, rest, 'account.update');
-    await review(ctx, id);
-    return ctx.reply(ctx.get('account', id));
-};
-// a single-use Express dashboard link, not stored
-const loginLink = async (ctx) => {
-    const id = at(ctx, 'account');
-    if (!ctx.get('account', id))
-        return accountMissing(ctx, id);
-    return ctx.reply({ object: 'login_link', created: ctx.now(), url: `https://connect.twin.local/express/${id}` });
-};
-// ── persons on an account ──
-const personMissing = (ctx) => fail(ctx, `No such person: '${at(ctx, 'person')}'`, 404, 'resource_missing');
-const accountPerson = (ctx) => {
-    const p = ctx.get('person', at(ctx, 'person'));
-    return p && p.account === at(ctx, 'account') ? p : undefined;
-};
-/** A person's details as Stripe keeps them: an SSN or ID number given is kept only as provided (the Person object
- *  answers ssn_last_4_provided and id_number_provided, never the numbers; docs.stripe.com/api/persons/object). */
-function keptPerson(params, was = {}) {
-    const { ssn_last_4, id_number, ...rest } = params;
-    const out = { ...rest, ...(ssn_last_4 !== undefined && ssn_last_4 !== '' ? { ssn_last_4_provided: true } : {}), ...(id_number !== undefined && id_number !== '' ? { id_number_provided: true } : {}) };
-    // a relationship, address or date of birth given in part is laid over what the person holds
-    for (const k of ['relationship', 'address', 'dob'])
-        if (out[k] && typeof out[k] === 'object' && was[k] && typeof was[k] === 'object')
-            out[k] = { ...was[k], ...out[k] };
-    return out;
-}
-const RELATIONSHIP = { director: false, executive: false, owner: false, representative: false, percent_ownership: null, title: null };
-// a person given or changed is part of the account's review: its representative and owners are what card_payments asks for
-const createPerson = async (ctx) => {
-    const account = at(ctx, 'account');
-    if (!accountRow(ctx, account))
-        return accountMissing(ctx, account);
-    const kept = keptPerson(ctx.params, { relationship: RELATIONSHIP });
-    const body = await created(ctx, 'person', { ...kept, account }, {
-        relationship: RELATIONSHIP,
-        requirements: { currently_due: [], eventually_due: [], past_due: [], pending_verification: [], errors: [], alternatives: [] },
-        verification: { status: 'unverified', document: { back: null, details: null, details_code: null, front: null } },
-        metadata: {}, ssn_last_4_provided: false, id_number_provided: false,
-    });
-    await review(ctx, account);
-    return ctx.reply(body);
-};
-const person = async (ctx) => {
-    const p = accountPerson(ctx);
-    return p ? ctx.reply(p) : personMissing(ctx);
-};
-const updatePerson = async (ctx) => {
-    const was = accountPerson(ctx);
-    if (!was)
-        return personMissing(ctx);
-    const body = await ctx.write('person', at(ctx, 'person'), keptPerson(ctx.params, was), 'person.update');
-    await review(ctx, at(ctx, 'account'));
-    return ctx.reply(body);
-};
-const deletePerson = async (ctx) => {
-    if (!accountPerson(ctx))
-        return personMissing(ctx);
-    const id = at(ctx, 'person');
-    await ctx.write('person', id, { deleted: true }, 'person.delete');
-    await review(ctx, at(ctx, 'account'));
-    return ctx.reply({ id, object: 'person', deleted: true });
-};
-// ── capabilities: the account's capability map is the truth; requesting one leaves it pending ──
-/** A capability as its account stands: its status, and the account's requirements that capability asks for (transfers
- *  leaves out what only card_payments asks for). Where the documentation stops and the twin decides: the account-wide
- *  fields (the bank account, the terms) belong to every capability. */
-const capabilityBody = (acct, id, status, requested = true, requestedAt = null) => {
-    const req = acct.requirements ?? {};
-    const mine = (list) => (Array.isArray(list) ? list : []).filter((f) => id === 'card_payments' || !cardOnly(f));
-    const due = mine(req.currently_due);
-    return {
-        id, object: 'capability', account: acct.id, status, requested, requested_at: requestedAt,
-        requirements: { currently_due: due, eventually_due: mine(req.eventually_due), past_due: [], pending_verification: [], errors: [], alternatives: [], current_deadline: null, disabled_reason: due.length ? 'requirements.past_due' : null },
-    };
-};
-const capabilities = async (ctx) => {
-    const account = at(ctx, 'account');
-    const acct = ctx.get('account', account);
-    if (!acct)
-        return accountMissing(ctx, account);
-    const caps = acct.capabilities ?? {};
-    return ctx.reply({ object: 'list', url: path(ctx), has_more: false, data: Object.entries(caps).map(([id, status]) => capabilityBody(acct, id, status)) });
-};
-const capability = async (ctx) => {
-    const account = at(ctx, 'account');
-    const acct = ctx.get('account', account);
-    if (!acct)
-        return accountMissing(ctx, account);
-    const caps = acct.capabilities ?? {};
-    const cap = at(ctx, 'capability');
-    return cap in caps ? ctx.reply(capabilityBody(acct, cap, caps[cap])) : fail(ctx, `No such capability: '${cap}'`, 404, 'resource_missing');
-};
-const requestCapability = async (ctx) => {
-    const account = at(ctx, 'account');
-    const acct = ctx.get('account', account);
-    if (!acct)
-        return accountMissing(ctx, account);
-    const caps = { ...(acct.capabilities ?? {}) };
-    const cap = at(ctx, 'capability');
-    const requested = ctx.params.requested === undefined ? true : asBool(ctx.params.requested);
-    const to = requested ? 'pending' : 'inactive';
-    const refused = ctx.legal('capability', 'status', 'PostAccountsAccountCapabilitiesCapability', String(caps[cap] ?? 'unrequested'), to, cap);
-    if (refused)
-        return ctx.refuse(refused);
-    caps[cap] = to;
-    await ctx.write('account', account, { capabilities: caps }, 'account.updated');
-    // Stripe reviews the account against what the capability asks for (review)
-    await review(ctx, account);
-    const now = ctx.get('account', account);
-    return ctx.reply(capabilityBody(now, cap, now.capabilities[cap], requested, requested ? ctx.now() : null));
-};
-// ── external accounts: a payout destination from a token or a bank_account hash ──
-const externalMissing = (ctx) => fail(ctx, `No such external account: '${at(ctx, 'id')}'`, 404, 'resource_missing');
-const accountExternal = (ctx) => {
-    const e = ctx.get('external_account', at(ctx, 'id'));
-    return e && e.account === at(ctx, 'account') ? e : undefined;
-};
-/** Whether the platform may create, update or delete an account's external accounts: "A platform can create, update, or
- *  delete external accounts only for connected accounts without access to either the full Stripe or Express Dashboard
- *  and where the platform is responsible for negative balances" (docs.stripe.com/connect/payouts-bank-accounts); it can
- *  still view an Express account's ("A platform can view the external accounts of connected accounts that don’t have
- *  access to the full Stripe Dashboard"). Where the documentation stops and the twin decides: the refusal. Stripe's
- *  pages give no error code for it; the twin answers 403, which the errors page gives as "The API key doesn’t have
- *  permissions to perform the request" (docs.stripe.com/api/errors), with the twin's own wording. The create page says
- *  it too: "You can only specify connected accounts where account.controller.requirement_collection is `application`"
- *  (docs.stripe.com/api/external_account_bank_accounts/create). */
-function refuseExternalWrite(ctx, account) {
-    const row = accountRow(ctx, account);
-    const controller = row?.controller ?? controllerOf(String(row?.type ?? 'standard'));
-    const dashboard = String((controller.stripe_dashboard?.type) ?? '');
-    const losses = String((controller.losses?.payments) ?? '');
-    if (dashboard === 'none' && losses === 'application')
-        return undefined;
-    return ctx.refuse({ status: 403, message: `This application does not have the required permissions to manage the external accounts of account '${account}': they can only be managed through the account's ${dashboard === 'express' ? 'Express' : 'Stripe'} Dashboard.` });
-}
-const createExternal = async (ctx) => {
-    const account = at(ctx, 'account');
-    if (!accountRow(ctx, account))
-        return accountMissing(ctx, account);
-    const forbidden = refuseExternalWrite(ctx, account);
-    if (forbidden)
-        return forbidden;
-    const ext = ctx.params.external_account ?? ctx.params.bank_account;
-    if (ext === undefined)
-        return fail(ctx, 'Missing required param: external_account.', 400, 'parameter_missing');
-    const ba = typeof ext === 'object' ? ext : {};
-    const acctNum = typeof ba.account_number === 'string' ? ba.account_number.replace(/\D/g, '') : '';
-    const currency = String(ba.currency ?? 'usd');
-    const sameCurrency = ctx.rows('external_account').filter((e) => e.account === account && String(e.currency ?? 'usd') === currency);
-    const isDefault = sameCurrency.length === 0 || ctx.params.default_for_currency === true || ctx.params.default_for_currency === 'true';
-    const made = await created(ctx, 'external_account', { account }, {
-        account_holder_name: ba.account_holder_name ?? null,
-        account_holder_type: ba.account_holder_type ?? null, bank_name: 'STRIPE TEST BANK',
-        country: ba.country ?? 'US', currency,
-        fingerprint: 'twin_ext_fp', last4: acctNum ? acctNum.slice(-4) : '6789',
-        routing_number: ba.routing_number ?? '110000000', status: 'new', metadata: {},
-        // "When set to true, or if this is the first external account added in this currency, this account becomes the
-        // default external account for its currency" (docs.stripe.com/api/external_account_bank_accounts/create)
-        default_for_currency: isDefault,
-        ...(ctx.params.metadata && typeof ctx.params.metadata === 'object' ? { metadata: ctx.params.metadata } : {}),
-    });
-    if (isDefault)
-        for (const other of sameCurrency)
-            if (other.default_for_currency === true)
-                await ctx.write('external_account', String(other.id), { default_for_currency: false }, 'external_account.update');
-    await syncExternals(ctx, account);
-    await review(ctx, account);
-    return ctx.reply(made);
-};
-const externals = async (ctx) => {
-    const account = at(ctx, 'account');
-    if (!accountRow(ctx, account))
-        return accountMissing(ctx, account);
-    return list(ctx, 'external_account', newest(ctx, 'external_account').filter((e) => e.account === account));
-};
-const external = async (ctx) => {
-    const e = accountExternal(ctx);
-    return e ? ctx.reply(e) : externalMissing(ctx);
-};
-const deleteExternal = async (ctx) => {
-    if (!accountExternal(ctx))
-        return externalMissing(ctx);
-    const forbidden = refuseExternalWrite(ctx, at(ctx, 'account'));
-    if (forbidden)
-        return forbidden;
-    const id = at(ctx, 'id');
-    await ctx.write('external_account', id, { deleted: true }, 'external_account.delete');
-    await syncExternals(ctx, at(ctx, 'account'));
-    await review(ctx, at(ctx, 'account'));
-    return ctx.reply({ id, object: 'bank_account', deleted: true });
-};
-// ── hosted onboarding links and embedded-component sessions ──
-const accountLink = async (ctx) => {
-    const account = typeof ctx.params.account === 'string' ? ctx.params.account : '';
-    if (!account)
-        return fail(ctx, 'Missing required param: account.', 400, 'parameter_missing');
-    if (!ctx.get('account', account))
-        return accountMissing(ctx, account, 400);
-    const linkType = typeof ctx.params.type === 'string' ? ctx.params.type : '';
-    if (linkType !== 'account_onboarding' && linkType !== 'account_update')
-        return fail(ctx, 'Invalid account link type: must be account_onboarding or account_update.', 400, 'parameter_invalid_string_enum');
-    // the owner is sent back to return_url when done, and to refresh_url for a new link once this one is used or expired
-    for (const k of ['refresh_url', 'return_url'])
-        if (typeof ctx.params[k] !== 'string' || !ctx.params[k])
-            return fail(ctx, `Missing required param: ${k}.`, 400, 'parameter_missing');
-    const now = Number(ctx.now());
-    const id = ctx.mint('account_link');
-    const link = { object: 'account_link', created: now, expires_at: now + 300, url: `https://connect.stripe.com/setup/${id}` };
-    await ctx.write('account_link', id, { ...link, account, type: linkType, refresh_url: ctx.params.refresh_url, return_url: ctx.params.return_url, used: false }, 'account_link.create');
-    return ctx.reply(link);
-};
-// a session is identified by its client_secret: the row is kept for traceability, the answer has no id
-/** Every embedded component an account session answers (the served spec requires all of them), each enabled only when
- *  the request enables it, with its features: what the request gives, else the spec's stated default, "The default
- *  value for this feature is `true`" (external_account_collection); disable_stripe_user_authentication "the opposite of
- *  the `external_account_collection` value"; edit_payout_schedule and standard_payouts "Defaults to `true` when
- *  `controller.losses.payments` is set to `stripe` for the account, otherwise `false`"; capture_payments, dispute_management
- *  and refund_management "true by default"; destination_on_behalf_of_charge_management "false by default";
- *  smart_disputes_management "Defaults to the value of `dispute_management`". Where the documentation stops and the twin
- *  decides: instant_payouts (described as `enabled` "when Stripe is responsible for negative account balances", typed
- *  boolean) is true exactly then, and the Issuing and financial-account features, which state no default, are false. */
-const SESSION_COMPONENTS = {
-    account_management: ['external_account_collection', 'disable_stripe_user_authentication'],
-    account_onboarding: ['external_account_collection', 'disable_stripe_user_authentication'],
-    balance_report: [], documents: [], payout_details: [], payout_reconciliation_report: [], payouts_list: [], tax_registrations: [], tax_settings: [],
-    balances: ['external_account_collection', 'disable_stripe_user_authentication', 'edit_payout_schedule', 'instant_payouts', 'standard_payouts'],
-    payouts: ['external_account_collection', 'disable_stripe_user_authentication', 'edit_payout_schedule', 'instant_payouts', 'standard_payouts'],
-    disputes_list: ['capture_payments', 'destination_on_behalf_of_charge_management', 'dispute_management', 'refund_management', 'smart_disputes_management'],
-    payment_details: ['capture_payments', 'destination_on_behalf_of_charge_management', 'dispute_management', 'refund_management', 'smart_disputes_management'],
-    payments: ['capture_payments', 'destination_on_behalf_of_charge_management', 'dispute_management', 'refund_management', 'smart_disputes_management'],
-    payment_disputes: ['destination_on_behalf_of_charge_management', 'dispute_management', 'refund_management', 'smart_disputes_management'],
-    financial_account: ['external_account_collection', 'disable_stripe_user_authentication', 'send_money', 'transfer_balance'],
-    financial_account_transactions: ['card_spend_dispute_management'],
-    instant_payouts_promotion: ['external_account_collection', 'disable_stripe_user_authentication', 'instant_payouts'],
-    issuing_card: ['card_management', 'card_spend_dispute_management', 'cardholder_management', 'spend_control_management'],
-    issuing_cards_list: ['card_management', 'card_spend_dispute_management', 'cardholder_management', 'disable_stripe_user_authentication', 'spend_control_management'],
-    notification_banner: ['external_account_collection', 'disable_stripe_user_authentication'],
-    payment_method_settings: ['disable_stripe_user_authentication'],
-};
-function sessionComponents(account, given) {
-    const stripeLosses = (account.controller?.losses?.payments) === 'stripe';
-    const out = {};
-    for (const [name, featureNames] of Object.entries(SESSION_COMPONENTS)) {
-        const c = given[name] && typeof given[name] === 'object' ? given[name] : {};
-        const asked = c.features && typeof c.features === 'object' ? c.features : {};
-        const f = {};
-        const val = (k, fallback) => (asked[k] !== undefined ? asBool(asked[k]) : fallback);
-        for (const k of featureNames) {
-            if (k === 'external_account_collection')
-                f[k] = val(k, true);
-            else if (k === 'disable_stripe_user_authentication')
-                f[k] = val(k, !val('external_account_collection', true));
-            else if (k === 'edit_payout_schedule' || k === 'standard_payouts' || k === 'instant_payouts')
-                f[k] = val(k, stripeLosses);
-            else if (k === 'capture_payments' || k === 'dispute_management' || k === 'refund_management')
-                f[k] = val(k, true);
-            else if (k === 'smart_disputes_management')
-                f[k] = val(k, val('dispute_management', true));
-            else
-                f[k] = val(k, false);
-        }
-        out[name] = { enabled: c.enabled !== undefined ? asBool(c.enabled) : false, features: f };
-    }
-    return out;
-}
-const accountSession = async (ctx) => {
-    const account = typeof ctx.params.account === 'string' ? ctx.params.account : '';
-    if (!account)
-        return fail(ctx, 'Missing required param: account.', 400, 'parameter_missing');
-    if (!ctx.get('account', account))
-        return accountMissing(ctx, account, 400);
-    const comps = ctx.params.components && typeof ctx.params.components === 'object' ? ctx.params.components : undefined;
-    if (!comps || Object.keys(comps).length === 0)
-        return fail(ctx, 'Missing required param: components.', 400, 'parameter_missing');
-    const components = sessionComponents(ctx.get('account', account), comps);
-    const now = Number(ctx.now());
-    const seq = ctx.rowsRaw('account_session', { withDeleted: true }).length + 1;
-    const secret = `_twin_acct_sess_${seq}_secret`;
-    await created(ctx, 'account_session', { id: `accts_twin_${seq}`, account }, { livemode: false, client_secret: secret, expires_at: now + 3600, components });
-    return ctx.reply({ object: 'account_session', account, client_secret: secret, expires_at: now + 3600, components, livemode: false });
-};
-export const connect = {
-    GetAccount: platform,
-    PostAccounts: create,
-    GetAccounts: listAccounts,
-    PostAccountsAccount: update,
-    PostAccountsAccountLoginLinks: loginLink,
-    PostAccountsAccountPersons: createPerson,
-    GetAccountsAccountPersonsPerson: person,
-    PostAccountsAccountPersonsPerson: updatePerson,
-    DeleteAccountsAccountPersonsPerson: deletePerson,
-    GetAccountsAccountCapabilities: capabilities,
-    GetAccountsAccountCapabilitiesCapability: capability,
-    PostAccountsAccountCapabilitiesCapability: requestCapability,
-    PostAccountsAccountExternalAccounts: createExternal,
-    GetAccountsAccountExternalAccounts: externals,
-    GetAccountsAccountExternalAccountsId: external,
-    DeleteAccountsAccountExternalAccountsId: deleteExternal,
-    PostAccountLinks: accountLink,
-    PostAccountSessions: accountSession,
-};

package/dist/src/semantics/credit-notes.d.ts

@@ -1,2 +0,0 @@
-import type { Semantics } from '@volter/world-core';
-export declare const creditNotes: Record<string, Semantics>;