@volter/twin-stripe 3.0.0 → 3.0.1

package/src/semantics/shared.ts

@@ -1,42 +1,27 @@
-// What Stripe's manifest takes from its handlers' side: the events its writes send, as data the kernel renders, stores,
-// signs and delivers (world-core events.ts; ./events.ts renders each event's `data` and its further values).
 import type { EventsDecl, Handler, HandlerContext, TwinResource } from '@volter/world-core';
 import { NAMED_EVENTS, readDecision, STRIPE_EVENT_TYPES, STRIPE_REALTIME_AUTH_TIMEOUT_MS, type StripeAuthRequestOutcome, stripeSignature } from '../engine/webhooks.ts';
 import { redactKey, requestKey } from '../engine/oauth.ts';
-import { HOUR, INV, itemQuantity, itemsOf, keptAfter, oneTimeLines, RENEWING, SUB, unspentDiscounts } from '../engine/renewals.ts';
+import { HOUR, INV, itemQuantity, itemsOf, keptAfter, oneTimeLines, RENEWING, SUB } from '../engine/renewals.ts';
 import { DAY, payoutDay } from '../engine/balance.ts';
 import { AFTER_SUCCESS_CARDS, BY_NUMBER, type Outcome } from '../engine/after-payment.ts';
-import { accountSettings, addBillingInterval, applyCouponDiscount, asBool, buildDiscount, buildSubscriptionItemsList, cardError, chargeDefaults, type CheckoutItem, declineFor, disputeEvidence, lineItemEntries, microdepositsNextAction, mintClientSecret, nowUnix, OBJECT_NAME, paginate, paymentMethodSubObject, PLATFORM_ACCOUNT_ID, priceAmount, requiresAuthentication, requiresMicrodeposits, resolveLineItem, resolveSubscriptionBillingInterval, resolveTrial, searchOver, type StripeResponse, subscriptionItemEntries, subscriptionItemPrice, TEST_TOKEN_DECLINES, threeDsNextAction, validateMoney, view } from '../engine/stripe.ts';
-import { AUTO_VALIDATED, euVatCountry } from '../engine/customers.ts';
-import { SI } from '../engine/setup-intents.ts';
-import { BY_CLIENT_SECRET, PUBLISHABLE_CREATES } from '../engine/front.ts';
-import { WE } from '../engine/webhook-endpoints.ts';
-import { ENTRY, ENTRY_TYPES, FA, TX } from '../engine/treasury.ts';
+import { accountSettings, addBillingInterval, applyCouponDiscount, asBool, buildDiscount, buildSubscriptionItemsList, cardError, chargeDefaults, declineFor, disputeEvidence, microdepositsNextAction, mintClientSecret, nowUnix, OBJECT_NAME, paginate, paymentMethodSubObject, PLATFORM_ACCOUNT_ID, priceAmount, requiresAuthentication, requiresMicrodeposits, resolveSubscriptionBillingInterval, resolveTrial, searchOver, type StripeResponse, subscriptionItemEntries, subscriptionItemPrice, TEST_TOKEN_DECLINES, threeDsNextAction, view } from '../engine/stripe.ts';
 import { SECRET } from '../engine/apps-secrets.ts';
-import { draft, invoicePrefix, linesOf, sumLines, transitions, unlinkedLine } from '../engine/invoices.ts';
-import { CN } from '../engine/credit-notes.ts';
+import { collectsThroughIntent, invoicePrefix, transitions } from '../engine/invoices.ts';
 import { CS, type EnteredCard, isOneTime, nestedMetadata } from '../engine/checkout.ts';
-import { externalList, type Find, refundDestination, type Row, SPEC_FIELDS } from '../engine/common.ts';
+import { externalList, type Find, type Row, SPEC_FIELDS } from '../engine/common.ts';
 import { noBilling, PM, TEST_PM_CARDS, testCardOf } from '../engine/payment-methods.ts';
-import { type Interval, SS } from '../engine/subscription-schedules.ts';
-import { OAUTH_CONNECTIONS } from '../engine/display.ts';
 import { intentCarries, PI, TYPES_GIVEN } from '../engine/payment-intents.ts';
 import { BT, BYPASS_NUMBERS, feeOf, onAccount, UNSENT } from '../engine/ledger.ts';
-import { withoutCard } from '../engine/charges.ts';
 import { MAX_TRIAL, movedTrial } from '../engine/subscriptions.ts';
 import { VL, VLI } from '../engine/radar.ts';
-import { AUTH, CARD, historyEntry, merchantData, PD, REALTIME_WINDOW_SECONDS, TXN } from '../engine/issuing.ts';
-import { has } from '../engine/onboarding.ts';
-import { REFUND_REASONS } from '../engine/refunds.ts';
-import { ADVANCE_SECONDS, CLOCK } from '../engine/test-clocks.ts';
+import { AUTH, historyEntry, merchantData, REALTIME_WINDOW_SECONDS, TXN } from '../engine/issuing.ts';
 import { BYPASS_PENDING_CARDS } from '../engine/test-cards.ts';
-import { type ConnectOAuthSettings, PLATFORM_CLIENT_ID, SETTINGS } from '../engine/connect-settings.ts';
-import { controllerOf, customRequirements } from '../engine/connect.ts';
-import { READER } from '../engine/terminal.ts';
+import { customRequirements } from '../engine/connect.ts';
 import { expandOf, render, SERVED_VERSION, servesCurrent, withoutEndpointSecret } from '../engine/version.ts';
-import { ALERT, GRANT, METER } from '../engine/billing.ts';
 import { CHECKOUT_METHOD_TYPES, DOCUMENTED, methodTypesRemoved, oneOf, OPS, PAYMENT_METHOD_TYPES, REMOVED_TYPES, TYPED, TYPES_DOC } from '../engine/params.ts';
-
+import { linesOf, sumLines } from '../engine/invoices.ts';
+import { refundDestination } from '../engine/common.ts';
+import { REFUND_REASONS } from '../engine/refunds.ts';
 /** Stripe's events: `Stripe-Signature: t=…,v1=…` over `${t}.${body}` keyed by the endpoint's secret
  *  (docs.stripe.com/webhooks#verify-manually); the Event object (docs.stripe.com/api/events/object) kept as the account's
  *  own (`GET /v1/events`), whether or not an endpoint takes it; an endpoint live while `enabled`, taking the types its
@@ -54,24 +39,6 @@ export const STRIPE_EVENTS: EventsDecl = {
   endpoints: { storedAs: 'webhook_endpoint', url: 'url', secret: 'secret', filter: 'enabled_events', status: { field: 'status', live: 'enabled' }, scope: { field: 'connect', value: '$account' } },
 };
 
-// ── what the handlers share: Stripe's behaviour over the context ──
-
-export type Reads = Pick<HandlerContext, 'rowsRaw'>;
-
-/** Whether a connected account's OAuth connection to the platform was revoked (deauthorized, or its code reused). */
-export function connectionRevoked(ctx: Reads, account: string): boolean {
-  return ctx.rowsRaw(OAUTH_CONNECTIONS).some((c) => c.id === account && c.revoked === true);
-}
-
-/** The connected account an OAuth key acts as — the connection's current access_token (sk_test_oauth_…) or its
- *  stripe_publishable_key (pk_test_oauth_…) — with the scope it was issued; undefined for any other key, and null for an
- *  OAuth-shaped key no live connection holds (revoked, replaced by a refresh, or never issued). */
-export function oauthKeyAccount(ctx: Reads, key: string): { account: string; scope: string } | null | undefined {
-  if (!/^(sk|pk)_test_oauth_/.test(key)) return undefined;
-  const held = ctx.rowsRaw(OAUTH_CONNECTIONS).find((c) => c.revoked !== true && (c.access_token === key || c.publishable_key === key));
-  return held ? { account: String(held.id), scope: String(key.startsWith('pk_') ? held.scope : held.access_scope ?? held.scope) } : null;
-}
-
 /** A customer's now: its test clock's frozen time when it is on one (docs.stripe.com/billing/testing/test-clocks), the
  *  World's otherwise. */
 export function clockNow(ctx: HandlerContext, customer: unknown): number {
@@ -96,7 +63,7 @@ export function customerDefault(ctx: HandlerContext, sub: Row): string | undefin
  *  it did not take (added after it was drafted) stays for the next (unspentDiscounts). */
 export async function spendOnceCoupon(ctx: HandlerContext, invoice: Row): Promise<void> {
   const subId = typeof invoice.subscription === 'string' ? invoice.subscription : undefined;
-  const sub = subId ? ctx.get(SUB, subId) : undefined;
+  const sub = subId ? resourceView(ctx, SUB, subId) : undefined;
   if (!sub || !subId) return;
   const all = (sub.discounts as Row[] | undefined) ?? [];
   const kept = keptAfter(all, invoice);
@@ -150,7 +117,7 @@ export async function draftSubscriptionInvoice(ctx: HandlerContext, sub: Row, o:
  *  whether it was paid. */
 export async function collectSubscriptionInvoice(ctx: HandlerContext, invoiceId: string, at: number, actor: 'time' | 'external' | 'api', opts: { payer?: string; attempt?: boolean } = {}): Promise<boolean> {
   const inv = ctx.get(INV, invoiceId);
-  const sub = inv && typeof inv.subscription === 'string' ? ctx.get(SUB, inv.subscription) : undefined;
+  const sub = inv && typeof inv.subscription === 'string' ? resourceView(ctx, SUB, inv.subscription) : undefined;
   if (!inv || !sub || inv.status !== 'draft') return false;
   const total = Number(inv.total) || 0;
   const numbered = { ...finalizedFields(ctx, inv, at), status_transitions: { ...(inv.status_transitions as Row), finalized_at: at } };
@@ -172,7 +139,7 @@ export async function collectSubscriptionInvoice(ctx: HandlerContext, invoiceId:
   const piId = ctx.mint('payment_intent');
   const currency = String(inv.currency ?? 'usd');
   const chargeId = pays ? await mintCharge(ctx, piId, { currency, customer: inv.customer, payment_method: payer, invoice: invoiceId }, total) : null;
-  await created(ctx, 'payment_intent', { id: piId, amount: total, currency, customer: inv.customer, invoice: invoiceId, payment_method: pays ? payer : null }, {
+  const intent = await created(ctx, 'payment_intent', { id: piId, amount: total, currency, customer: inv.customer, invoice: invoiceId, payment_method: pays ? payer : null }, {
     status: pays ? 'succeeded' : 'requires_payment_method', client_secret: mintClientSecret(piId, await ctx.secret(`client-secret:${piId}`)), livemode: false,
     capture_method: 'automatic', amount_capturable: 0, amount_received: pays ? total : 0, next_action: null, latest_charge: chargeId,
     last_payment_error: decline ? { type: 'card_error', code: decline.code, decline_code: decline.decline_code ?? null, message: decline.message, payment_method: { id: payer } } : null,
@@ -180,6 +147,8 @@ export async function collectSubscriptionInvoice(ctx: HandlerContext, invoiceId:
   });
   await ctx.write(INV, invoiceId, {
     ...numbered, status: pays ? 'paid' : 'open', paid: pays, attempt_count: attempt ? 1 : 0, attempted: attempt, payment_intent: piId, charge: chargeId,
+    // source: spec:/components/schemas/invoice/properties/confirmation_secret/description "client_secret of the PaymentIntent"
+    confirmation_secret: { type: 'payment_intent', client_secret: intent.client_secret },
     amount_paid: pays ? total : 0, amount_remaining: pays ? 0 : total, auto_advance: attempt && !pays, next_payment_attempt: null,
     status_transitions: { ...numbered.status_transitions, paid_at: pays ? at : null },
   }, pays ? 'invoice.paid' : attempt ? 'invoice.payment_failed' : 'invoice.finalized');
@@ -213,7 +182,7 @@ export async function payOpenInvoice(ctx: HandlerContext, invoiceId: string, pay
     attempt_count: (Number(inv.attempt_count) || 0) + 1, attempted: true,
     status_transitions: { ...(inv.status_transitions as Row), paid_at: now },
   }, 'invoice.paid');
-  const sub = typeof inv.subscription === 'string' ? ctx.get(SUB, inv.subscription) : undefined;
+  const sub = typeof inv.subscription === 'string' ? resourceView(ctx, SUB, inv.subscription) : undefined;
   if (sub && sub.status === 'past_due' && !ctx.legal(SUB, 'status', op, 'past_due', 'active', String(sub.id), 'external')) {
     await ctx.write(SUB, String(sub.id), { status: 'active' }, 'customer.subscription.updated');
   }
@@ -235,14 +204,14 @@ export async function advanceBilling(ctx: HandlerContext, only?: (sub: Row) => b
 export async function billingStep(ctx: HandlerContext, at: (t: number) => Promise<HandlerContext>, only?: (sub: Row) => boolean): Promise<boolean> {
     // the earliest move that has come due, of any subscription
     let next: { t: number; kind: 'period' | 'collect'; id: string } | undefined;
-    for (const sub of ctx.rows(SUB)) {
+    for (const sub of ctx.rows(SUB).map((s) => ctx.expand(SUB, s))) {
       if (only && !only(sub)) continue;
       if (!RENEWING.includes(String(sub.status)) || typeof sub.current_period_end !== 'number' || sub.pause_collection) continue;
       if (sub.current_period_end <= clockNow(ctx, sub.customer) && (!next || sub.current_period_end < next.t)) next = { t: sub.current_period_end, kind: 'period', id: String(sub.id) };
     }
     for (const inv of ctx.rows(INV)) {
       if (inv.status !== 'draft' || inv.billing_reason !== 'subscription_cycle' || inv.auto_advance !== true) continue;
-      const sub = typeof inv.subscription === 'string' ? ctx.get(SUB, inv.subscription) : undefined;
+      const sub = typeof inv.subscription === 'string' ? resourceView(ctx, SUB, inv.subscription) : undefined;
       if (!sub || (only && !only(sub))) continue;
       const t = Number(inv.created) + HOUR;
       if (t <= clockNow(ctx, sub.customer) && (!next || t < next.t)) next = { t, kind: 'collect', id: String(inv.id) };
@@ -254,7 +223,7 @@ export async function billingStep(ctx: HandlerContext, at: (t: number) => Promis
       return true;
     }
     const id = next.id;
-    const sub = c.get(SUB, id)!;
+    const sub = resourceView(c, SUB, id)!;
     const op = c.call.operation.id;
     // one set to cancel at its period's end is canceled then, with no renewal
     // (docs.stripe.com/billing/subscriptions/cancel#cancel-at-end-of-cycle)
@@ -275,8 +244,6 @@ export async function billingStep(ctx: HandlerContext, at: (t: number) => Promis
 
 export const account = (ctx: HandlerContext): string | undefined => actingAccount(ctx);
 
-export const payoutMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such payout: '${id}'`, 404, 'resource_missing');
-
 /** The acting account's Balance object (docs.stripe.com/api/balance/balance_object). */
 export function balanceBody(ctx: HandlerContext, acct: string | undefined = account(ctx)): Row {
   const { available, pending, issuing } = balanceOf(ctx, acct);
@@ -446,120 +413,8 @@ export async function openReview(ctx: HandlerContext, chargeId: string, pi: { pa
   }, 'review.opened');
 }
 
-/** The mandate a verified bank account carries for a payment (single use) or a setup (multi use). */
-export async function mintMandate(ctx: HandlerContext, paymentMethod: unknown, use: 'single_use' | 'multi_use', amount?: number, currency?: string): Promise<string> {
-  const now = Number(nowUnix(ctx.occurredAt));
-  const mandate = await created(ctx, 'mandate', { payment_method: typeof paymentMethod === 'string' ? paymentMethod : null }, {
-    status: 'active', type: use, livemode: false,
-    customer_acceptance: { type: 'online', accepted_at: now, online: { ip_address: '127.0.0.1', user_agent: 'twin' } },
-    payment_method_details: { type: 'us_bank_account', us_bank_account: { collection_method: 'paper' } },
-    ...(use === 'single_use' ? { single_use: { amount: amount ?? 0, currency: currency ?? 'usd' } } : { multi_use: {} }),
-  }, { timeField: '_created' });
-  return String(mandate.id);
-}
-
 export const customerMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such customer: '${id}'`, 404, 'resource_missing');
 
-/** The discount a customer's `coupon` makes, a parameter of API versions before the served one. */
-export function customerDiscount(ctx: HandlerContext, couponId: string): Row | Response {
-  const coupon = ctx.get('coupon', couponId);
-  return coupon ? buildDiscount(coupon, '', Number(nowUnix(ctx.occurredAt))) : fail(ctx, `No such coupon: '${couponId}'`, 400, 'resource_missing');
-}
-
-/** A tax ID for its owner: the account itself, or one of its customers. */
-export async function makeTaxId(ctx: HandlerContext, customer: string | undefined): Promise<Response> {
-  const given = ctx.params;
-  const { owner: _owner, ...params } = given;
-  if (params.type === undefined || params.type === '') return fail(ctx, 'Missing required param: type.', 400, 'parameter_missing');
-  if (params.value === undefined || params.value === '') return fail(ctx, 'Missing required param: value.', 400, 'parameter_missing');
-  const vatCountry = params.type === 'eu_vat' ? euVatCountry(String(params.value)) : undefined;
-  if (params.type === 'eu_vat' && !vatCountry) return ctx.refuse({ status: 400, code: 'tax_id_invalid', param: 'value', message: `Invalid value for eu_vat.` });
-  return ctx.reply(
-    await created(ctx, 'tax_id', { ...params, ...(customer ? { customer } : {}) }, {
-      livemode: false,
-      country: vatCountry ?? (typeof params.country === 'string' ? params.country : null),
-      owner: customer ? { type: 'customer', customer } : { type: 'self' },
-      verification: { status: AUTO_VALIDATED.has(String(params.type)) ? 'pending' : 'unavailable', verified_address: null, verified_name: null },
-    }),
-  );
-}
-
-/** The owner a top-level tax-ID call names: the account itself unless `owner[type]=customer` names a customer
- *  (docs.stripe.com/api/tax_ids/list: owner defaults to self). */
-export function ownerOf(ctx: HandlerContext): { customer?: string } | Response {
-  const owner = (ctx.params.owner ?? {}) as Row;
-  const type = String(owner.type ?? 'self');
-  if (type === 'self') return {};
-  if (type !== 'customer') return fail(ctx, `Invalid owner[type]: must be one of self or customer.`, 400, 'parameter_invalid_string_enum');
-  const customer = typeof owner.customer === 'string' ? owner.customer : '';
-  if (!customer) return fail(ctx, 'Missing required param: owner[customer].', 400, 'parameter_missing');
-  if (!ctx.get('customer', customer)) return customerMissing(ctx, customer);
-  return { customer };
-}
-
-// ── the cash balance: per-currency sums of the funding ledger, and the reconciliation setting ──
-
-export function cashBalance(ctx: HandlerContext, customer: string): Row {
-  const byCurrency: Record<string, number> = {};
-  for (const t of ctx.rows('customer_cash_balance_transaction')) {
-    if (t.customer !== customer) continue;
-    const cur = String(t.currency ?? 'usd');
-    byCurrency[cur] = (byCurrency[cur] ?? 0) + (Number(t.net_amount) || 0);
-  }
-  const cust = ctx.row('customer', customer);
-  const mode = typeof cust?._cash_balance_mode === 'string' ? cust._cash_balance_mode : 'automatic';
-  return {
-    object: 'cash_balance', customer,
-    available: Object.keys(byCurrency).length ? byCurrency : null,
-    settings: { reconciliation_mode: mode, using_merchant_default: mode === 'merchant_default' },
-    livemode: false,
-  };
-}
-
-/** Automatic reconciliation (docs.stripe.com/payments/customer-balance/reconciliation): funds that arrive pay the
- *  customer's open invoices that take bank transfers (payment_method_types customer_balance), the one whose number
- *  the transfer's reference names first, then the oldest. Where the documentation stops and the twin decides: an
- *  invoice is paid only when the balance covers all of what remains; a smaller balance waits for more funds. */
-export async function reconcile(ctx: HandlerContext, customer: string, currency: string, reference: string | null): Promise<void> {
-  const takesTransfers = (inv: Row): boolean => ((inv.payment_settings as Row | undefined)?.payment_method_types as unknown[] | undefined)?.includes('customer_balance') === true;
-  const open = ctx.rows('invoice').filter((inv) => inv.customer === customer && inv.status === 'open' && String(inv.currency ?? 'usd') === currency && takesTransfers(inv))
-    .sort((a, b) => (reference && a.number === reference ? -1 : reference && b.number === reference ? 1 : Number(a.created) - Number(b.created)));
-  for (const inv of open) {
-    const available = Number(((cashBalance(ctx, customer).available as Row | null) ?? {})[currency] ?? 0);
-    const amount = Number(inv.amount_remaining ?? inv.amount_due) || 0;
-    if (amount <= 0 || available < amount) continue;
-    const id = String(inv.id);
-    if (ctx.legal('invoice', 'status', 'PostTestHelpersCustomersCustomerFundCashBalance', inv.status, 'paid', id)) continue;
-    // the payment the balance makes: the invoice's own PaymentIntent (every invoice finalized with an amount due has one,
-    // semantics/invoices.ts), paid from the cash balance, its charge, and the ledger's entry
-    const piId = String(inv.payment_intent);
-    await created(ctx, 'customer_cash_balance_transaction', { customer }, { currency, type: 'applied_to_payment', net_amount: -amount, ending_balance: available - amount, applied_to_payment: { payment_intent: piId }, livemode: false });
-    const charge = await mintCharge(ctx, piId, { currency, customer, invoice: id }, amount);
-    await ctx.write('payment_intent', piId, { status: 'succeeded', amount_received: amount, latest_charge: charge }, 'payment_intent.succeeded');
-    await ctx.write('invoice', id, {
-      status: 'paid', paid: true, amount_paid: amount, amount_remaining: 0, payment_intent: piId, charge,
-      status_transitions: { ...((inv.status_transitions as Row | undefined) ?? {}), paid_at: nowUnix(ctx.occurredAt) },
-    }, 'invoice.paid');
-  }
-}
-
-/** The customer's source the path names, or undefined. */
-export const customerSource = (ctx: HandlerContext): Row | undefined => {
-  const s = ctx.get('source', at(ctx, 'id'));
-  return s && s.customer === at(ctx, 'customer') ? s : undefined;
-};
-
-export const sourceMissing = (ctx: HandlerContext): Response => fail(ctx, `No such source: '${at(ctx, 'id')}'`, 404, 'resource_missing');
-
-/** The intent the path names, and the machine's refusal when this operation may not move it. */
-export function load(ctx: HandlerContext, operationId: string): { si: Row } | { answer: Response } {
-  const id = at(ctx, 'intent');
-  const si = ctx.get(SI, id);
-  if (!si) return { answer: fail(ctx, `No such setup_intent: '${id}'`, 404, 'resource_missing') };
-  const refused = ctx.legal(SI, 'status', operationId, si.status, undefined, id);
-  return refused ? { answer: ctx.refuse(refused) } : { si };
-}
-
 /** The request event asked of the endpoint, signed with its secret and rendered in the event's API version, and its
  *  answer read as the decision. */
 export async function askForAuthorization(ctx: HandlerContext, url: string, event: Record<string, unknown>, secret: string): Promise<StripeAuthRequestOutcome> {
@@ -576,65 +431,20 @@ export function publishableKeyRefused(ctx: HandlerContext): Response | undefined
   // the key however it is sent, Bearer or Basic's user (requestKey): a publishable key is public, and sent as Basic it
   // is still one
   if (!requestKey(ctx.call.request).startsWith('pk_')) return undefined;
-  const op = ctx.call.operation.id;
-  if (PUBLISHABLE_CREATES.has(op)) return undefined;
-  const scoped = BY_CLIENT_SECRET[op];
-  if (!scoped) return ctx.refuse({ status: 403, code: 'secret_key_required', message: 'The API key provided is a publishable key, but a secret key is required.' });
-  const secret = typeof ctx.params.client_secret === 'string' ? ctx.params.client_secret : '';
-  if (!secret) return ctx.refuse({ status: 400, code: 'parameter_missing', param: 'client_secret', message: 'Missing required param: client_secret.' });
-  const id = ctx.call.params[scoped.param] ?? '';
-  return ctx.get(scoped.type, id)?.client_secret === secret ? undefined : ctx.refuse({ status: 404, code: 'resource_missing', param: scoped.param, message: `No such ${scoped.type}: '${id}'` });
-}
-
-// ── an account whose OAuth connection was revoked ──
-// "After revocation, the account can't be accessed by your platform in the Dashboard or through the API"
-// (docs.stripe.com/connect/oauth-reference, deauthorize; so too a connection revoked by a reused code). A call made as it
-// (the Stripe-Account header) or naming it (/v1/accounts/{account}…) is refused with the error Stripe documents for a
-// Stripe-Account the key cannot use: "account_invalid | The account ID provided as a value for the Stripe-Account header
-// is invalid" (docs.stripe.com/error-codes), as 403. Where the documentation stops and the twin decides: the message's
-// wording; an account the platform created itself, or never connected by OAuth, is not affected.
-export function revokedAccountRefused(ctx: HandlerContext): Response | undefined {
-  const request = ctx.call.request;
-  const named = [request.headers.get('stripe-account') ?? undefined, ctx.call.operation.path.startsWith('/v1/accounts/{account}') ? ctx.call.params.account : undefined].filter((a): a is string => !!a);
-  const revoked = named.find((a) => connectionRevoked(ctx, a));
-  if (!revoked) return undefined;
-  return ctx.refuse({ status: 403, code: 'account_invalid', message: `The provided key '${redactKey(requestKey(request))}' does not have access to account '${revoked}' (or that account does not exist). Application access may have been revoked.` });
-}
-
-// A connected account's OAuth keys (../screens/connect-oauth.tsx): the token endpoint's access_token is "Use the
-// Stripe-Account header with your platform's secret key (that can make requests on behalf of this Stripe account)" and
-// its stripe_publishable_key the same with the publishable key (docs.stripe.com/connect/oauth-reference): a request made
-// with one acts as that account, as a request with the Stripe-Account header does. A key no live connection holds (its
-// connection revoked, or replaced by a refresh: "Any existing access token with the same scope and mode ... is
-// revoked") is Stripe's unknown key, 401 "Invalid API Key provided" (docs.stripe.com/api/authentication); one sent with
-// a Stripe-Account header naming another account cannot act as it (account_invalid). Where the documentation stops and
-// the twin decides: the messages' wording; a read_only key is not held to reads (manifest todo
-// stripe.connect.oauth_scope_enforcement).
+  return ctx.refuse({ status: 403, code: 'secret_key_required', message: 'The API key provided is a publishable key, but a secret key is required.' });
+}
+
 /** The platform's own keys, as the dashboard's API keys page makes them (the `appCredentials` door): a secret key and a
  *  publishable key, held by their SHA-256. A request with no key is refused, as is a platform key Stripe never issued
- *  ("Invalid API Key provided"); a connected account's OAuth key is checked where it is read (actingAsOAuthKey). */
+ *  ("Invalid API Key provided"). */
 // source: https://docs.stripe.com/api/authentication "API requests without authentication also fail."
 export function platformKeyRefused(ctx: HandlerContext, request: Request): Response | undefined {
   const key = requestKey(request);
   if (!key) return ctx.refuse({ status: 401, message: "You did not provide an API key. You need to provide your API key in the Authorization header, using Bearer auth (e.g. 'Authorization: Bearer YOUR_SECRET_KEY'). See https://stripe.com/docs/api#authentication for details, or we can help at https://support.stripe.com/." });
-  if (/^(sk|pk)_test_oauth_/.test(key)) return undefined;
   const held = ctx.rowsRaw('_platform_key').some((k) => k._sha256 === ctx.crypto.sha256(key) && k.deleted !== true);
   return held ? undefined : ctx.refuse({ status: 401, message: `Invalid API Key provided: ${redactKey(key)}` });
 }
 
-export async function actingAsOAuthKey(ctx: HandlerContext, request: Request): Promise<Request | Response> {
-  const key = requestKey(request);
-  if (!/^(sk|pk)_test_oauth_/.test(key)) return request;
-  const held = oauthKeyAccount(ctx, key);
-  if (!held) return ctx.refuse({ status: 401, message: `Invalid API Key provided: ${redactKey(key)}` });
-  const named = request.headers.get('stripe-account');
-  if (named && named !== held.account) return ctx.refuse({ status: 403, code: 'account_invalid', message: `The provided key '${redactKey(key)}' does not have access to account '${named}' (or that account does not exist). Application access may have been revoked.` });
-  const headers = new Headers(request.headers);
-  headers.set('stripe-account', held.account);
-  const bodied = request.method !== 'GET' && request.method !== 'HEAD';
-  return new Request(request.url, { method: request.method, headers, ...(bodied ? { body: await request.arrayBuffer() } : {}) });
-}
-
 // ── metadata ──
 // "This parameter uses a merge mechanism, which allows you to add new key-value pairs to an object in an update call
 // without affecting any existing metadata"; "Pass in the key with an empty string as the value to remove the key from the
@@ -655,8 +465,7 @@ export function withMetadata(ctx: HandlerContext, request: Request): Request {
     else if (given && typeof given === 'object' && !Array.isArray(given) && Object.values(given).includes('')) metadata = Object.fromEntries(Object.entries(given as Row).filter(([, v]) => v !== ''));
     else return request;
   } else if (op.class === 'update' && op.resource) {
-    // a plan is kept as the recurring price it is (../semantics/plans.ts)
-    const resource = op.resource === 'plan' ? 'price' : op.resource;
+    const resource = op.resource;
     const id = Object.values(ctx.call.params).at(-1) ?? '';
     const held = ctx.get(resource, id)?.metadata;
     const prior = held && typeof held === 'object' ? (held as Row) : {};
@@ -671,191 +480,6 @@ export function withMetadata(ctx: HandlerContext, request: Request): Request {
   return new Request(request.url, { method: request.method, headers, body: JSON.stringify({ ...ctx.params, metadata }) });
 }
 
-/** `disabled` switches delivery off or back on (docs.stripe.com/api/webhook_endpoints/update#update_webhook_endpoint-disabled). */
-export async function switchDelivery(ctx: HandlerContext, id: string, we: Row, fields: Row, off: boolean): Promise<Response> {
-  const status = off ? 'disabled' : 'enabled';
-  const refused = ctx.legal(WE, 'status', 'PostWebhookEndpointsWebhookEndpoint', we.status, status, id);
-  if (refused) return ctx.refuse(refused);
-  return ctx.reply(await ctx.write(WE, id, { ...fields, status }, 'webhook_endpoint.update'));
-}
-
-/** Whether a stored event is the acting account's (no `account`: the platform's). */
-export const ownEvent = (ctx: HandlerContext, e: Row): boolean => (typeof e.account === 'string' ? e.account : undefined) === actingAccount(ctx);
-
-export const faMissing = (ctx: HandlerContext, id: string, status = 404): Response => fail(ctx, `No such financial account: '${id}'`, status, 'resource_missing');
-
-export const metadataOf = (ctx: HandlerContext): unknown => (ctx.params.metadata && typeof ctx.params.metadata === 'object' ? ctx.params.metadata : {});
-
-/** The account's bank address once financial_addresses.aba is active: "The FinancialAccount gains a FinancialAddress
- *  when the `financial_addresses.aba` feature is active", and "A FinancialAddress is not added until the
- *  financial_addresses.aba feature has been activated" (docs.stripe.com/treasury/account-management/financial-accounts),
- *  whose test example answers "bank_name": "Stripe Test Bank", "routing_number": "000000001" and the networks "ach",
- *  "us_domestic_wire", "rtp"; "The full account_number is only returned if the request expands it" (the same page).
- *  Where the documentation stops and the twin decides: the account number is ten digits drawn from the account's id,
- *  answered by its last four (the full number is null: expanding it is not modelled), and the holder's name is the
- *  platform account's business name, its dashboard name or, with neither, its id. */
-export function abaAddress(ctx: HandlerContext, faId: string): Row {
-  let n = 0;
-  for (const ch of faId) n = (n * 31 + ch.charCodeAt(0)) % 10_000_000_000;
-  const number = String(n).padStart(10, '0');
-  const platform = ctx.get('account', PLATFORM_ACCOUNT_ID) as Row | undefined;
-  const name = ((platform?.business_profile as Row | undefined)?.name ?? ((platform?.settings as Row | undefined)?.dashboard as Row | undefined)?.display_name ?? PLATFORM_ACCOUNT_ID) as string;
-  return { type: 'aba', supported_networks: ['ach', 'us_domestic_wire', 'rtp'], aba: { account_holder_name: name, account_number: null, account_number_last4: number.slice(-4), bank_name: 'Stripe Test Bank', routing_number: '000000001' } };
-}
-
-export const addressesOf = (ctx: HandlerContext, faId: string, active: string[]): Row[] => (active.includes('financial_addresses.aba') ? [abaAddress(ctx, faId)] : []);
-
-/** Post a flow's double entry: a ledger transaction with its net balance impact, and its one entry. */
-export async function post(ctx: HandlerContext, o: {
-  financial_account: string; amount: number; currency: string; flow: string; flow_type: string;
-  status: 'open' | 'posted'; balance_impact: Row; description: string; flowDetailKey?: string;
-}): Promise<string> {
-  const now = nowUnix(ctx.occurredAt);
-  const txnId = ctx.mint(TX);
-  await ctx.write(TX, txnId, {
-    object: 'treasury.transaction', created: now, livemode: false,
-    amount: o.amount, currency: o.currency, financial_account: o.financial_account,
-    flow: o.flow, flow_type: o.flow_type, flow_details: null,
-    status: o.status, balance_impact: o.balance_impact, description: o.description,
-    entries: { object: 'list', has_more: false, url: `/v1/treasury/transaction_entries?transaction=${txnId}`, data: [] },
-    status_transitions: { posted_at: o.status === 'posted' ? now : null, void_at: null },
-  }, 'treasury_transaction.created');
-  await ctx.write(ENTRY, ctx.mint(ENTRY), {
-    object: 'treasury.transaction_entry', created: now, livemode: false,
-    amount: o.amount, currency: o.currency, financial_account: o.financial_account,
-    flow: o.flow, flow_type: o.flow_type,
-    flow_details: o.flowDetailKey ? { type: o.flowDetailKey, [o.flowDetailKey]: o.flow } : null,
-    transaction: txnId, effective_at: now,
-    balance_impact: o.balance_impact,
-    // what the entry records: its flow's kind where Stripe names one (docs.stripe.com/api/treasury/transaction_entries/object);
-    // a vendor `type`, kept apart from the kernel's row type
-    type: ENTRY_TYPES.has(String(o.flow_type)) ? o.flow_type : 'other',
-  }, 'treasury_transaction_entry.created');
-  // the account's balance moves by the entry's impact: cash "Funds the user can spend right now", inbound_pending
-  // "Funds not spendable yet", outbound_pending "held for pending outbound flows" (the served spec's balance)
-  const account = ctx.get(FA, o.financial_account);
-  if (account) {
-    const bal = (account.balance as Record<string, Record<string, number>> | undefined) ?? { cash: {}, inbound_pending: {}, outbound_pending: {} };
-    const moved = Object.fromEntries((['cash', 'inbound_pending', 'outbound_pending'] as const).map((k) => [k, { ...(bal[k] ?? {}), [o.currency]: ((bal[k] ?? {})[o.currency] ?? 0) + (Number(o.balance_impact[k]) || 0) }]));
-    await ctx.write(FA, o.financial_account, { balance: moved }, 'financial_account.balance_updated');
-  }
-  return txnId;
-}
-
-/** The request's funding account, or the refusal. */
-export function fundingAccount(ctx: HandlerContext): string | Response {
-  const bad = validateMoney(ctx.params);
-  if (bad) return send(ctx, bad);
-  const fa = typeof ctx.params.financial_account === 'string' ? ctx.params.financial_account : '';
-  if (!fa) return fail(ctx, 'Missing required param: financial_account.', 400, 'parameter_missing');
-  return ctx.get(FA, fa) ? fa : faMissing(ctx, fa, 400);
-}
-
-/** Where an outbound flow sends its money, as the served spec's payment method details give it: the bank account's
- *  holder type, last four digits and routing number from what the request sent (a saved method's, or the test bank's
- *  when none is given), and its billing details (required): the name and email sent, the address lines null where not
- *  given. Where the documentation stops and the twin decides: a saved method's details are the test bank's. */
-export function destinationDetails(ctx: HandlerContext, dest: string | null): Row {
-  const data = ctx.params.destination_payment_method_data && typeof ctx.params.destination_payment_method_data === 'object' ? (ctx.params.destination_payment_method_data as Row) : {};
-  const bank = data.us_bank_account && typeof data.us_bank_account === 'object' ? (data.us_bank_account as Row) : {};
-  const billing = data.billing_details && typeof data.billing_details === 'object' ? (data.billing_details as Row) : {};
-  const address = billing.address && typeof billing.address === 'object' ? (billing.address as Row) : {};
-  const number = typeof bank.account_number === 'string' ? bank.account_number.replace(/\D/g, '') : '';
-  const billing_details = { name: billing.name ?? null, email: billing.email ?? null, address: Object.fromEntries(['city', 'country', 'line1', 'line2', 'postal_code', 'state'].map((k) => [k, address[k] ?? null])) };
-  if (dest && data.type === undefined && dest.startsWith('fa_')) return { type: 'financial_account', financial_account: { id: dest, network: 'stripe' }, billing_details };
-  return {
-    type: 'us_bank_account', billing_details,
-    us_bank_account: { last4: number ? number.slice(-4) : '6789', network: 'ach', routing_number: typeof bank.routing_number === 'string' ? bank.routing_number : '110000000', account_holder_type: typeof bank.account_holder_type === 'string' ? bank.account_holder_type : 'individual', account_type: typeof bank.account_type === 'string' ? bank.account_type : 'checking', bank_name: 'STRIPE TEST BANK', mandate: null },
-  };
-}
-
-/** An outbound payment that names no destination: "You must provide either destination_payment_method or
- *  destination_payment_method_data" (the served spec's outbound payment create). */
-export function noDestination(ctx: HandlerContext): Response {
-  return fail(ctx, 'You must provide either `destination_payment_method` or `destination_payment_method_data`.', 400, 'parameter_missing');
-}
-
-/** The bank account an inbound transfer may pull from: "You must first set up the account-attached payment method for
- *  inbound flows and verify the bank account using a SetupIntent", and invalid ones ("of unsupported types, containing
- *  an unverified bank account, or not set up for inbound flows") "throw the same errors as in live mode"
- *  (docs.stripe.com/treasury/moving-money/financial-accounts/into/inbound-transfers). A payment method is set up for
- *  inbound flows by a SetupIntent whose flow_directions holds `inbound`, and verified when that SetupIntent succeeded
- *  ("The bank account has been instantly verified or verification isn't necessary", its `succeeded` status,
- *  docs.stripe.com/treasury/connect/legacy/v1/moving-money/working-with-bankaccount-objects).
- *  Where the documentation stops and the twin decides: the page quotes no error, so the twin answers the documented code
- *  for the class, payment_method_unexpected_state ("The provided payment method's state was incompatible with the
- *  operation you were trying to perform", docs.stripe.com/error-codes), in its own words; an existing verified
- *  BankAccount (`ba_`), which the page also allows, is not checked. Answers the payment method, or the refusal. */
-export function inboundOrigin(ctx: HandlerContext, origin: string): Row | Response | undefined {
-  if (origin.startsWith('ba_')) return undefined;
-  const pm = ctx.get('payment_method', origin);
-  if (!pm) return fail(ctx, `No such PaymentMethod: '${origin}'`, 400, 'resource_missing');
-  if (pm.type !== 'us_bank_account') return fail(ctx, `The PaymentMethod '${origin}' is of type ${String(pm.type)}; an InboundTransfer pulls from a us_bank_account.`, 400, 'payment_method_unexpected_state');
-  const setUp = ctx.rows('setup_intent').some((si) => si.payment_method === origin && si.status === 'succeeded' && Array.isArray(si.flow_directions) && si.flow_directions.map(String).includes('inbound'));
-  if (!setUp) return fail(ctx, `The PaymentMethod '${origin}' has not been set up for inbound flows and verified with a SetupIntent.`, 400, 'payment_method_unexpected_state');
-  return pm;
-}
-
-// test mode's stand-ins for money another party sends to the account or pulls from it
-// (docs.stripe.com/treasury/moving-money/receiving-funds, docs.stripe.com/api/treasury/received_credits/test_mode_create)
-export function received(kind: 'received_credit' | 'received_debit'): Handler {
-  return async (ctx) => {
-    const fa = fundingAccount(ctx);
-    if (fa instanceof Response) return fa;
-    const network = typeof ctx.params.network === 'string' ? ctx.params.network : '';
-    if (!['ach', 'us_domestic_wire', 'stripe'].includes(network)) return fail(ctx, 'Missing required param: network.', 400, 'parameter_missing');
-    const amount = ctx.params.amount as number;
-    const currency = String(ctx.params.currency);
-    const id = ctx.mint(`treasury.${kind}`);
-    const signed = kind === 'received_credit' ? amount : -amount;
-    const txn = await post(ctx, { financial_account: fa, amount: signed, currency, flow: id, flow_type: kind, status: 'posted', balance_impact: { cash: signed, inbound_pending: 0, outbound_pending: 0 }, description: kind === 'received_credit' ? 'ReceivedCredit' : 'ReceivedDebit', flowDetailKey: kind });
-    return ctx.reply(
-      await created(ctx, `treasury.${kind}`, { id }, {
-        amount, currency, financial_account: fa, network, livemode: false, status: 'succeeded', failure_code: null,
-        description: typeof ctx.params.description === 'string' ? ctx.params.description : kind === 'received_credit' ? 'Received credit' : 'Received debit',
-        hosted_regulatory_receipt_url: null, transaction: txn, reversal_details: null,
-        initiating_payment_method_details: { type: 'us_bank_account', billing_details: { address: {}, email: null, name: null }, us_bank_account: { bank_name: 'STRIPE TEST BANK', last4: '6789', routing_number: '110000000' } },
-        linked_flows: kind === 'received_credit' ? { credit_reversal: null, issuing_authorization: null, issuing_transaction: null, source_flow: null, source_flow_type: null } : { debit_reversal: null, inbound_transfer: null, issuing_authorization: null, issuing_transaction: null, payout: null },
-      }),
-    );
-  };
-}
-
-/** Cancel a flow still processing; an outbound one must also still be cancelable. */
-export function cancel(resource: string, param: string, name: string, operationId: string, op: string, checkCancelable: boolean): Handler {
-  return async (ctx) => {
-    const id = at(ctx, param);
-    const flow = ctx.get(resource, id);
-    if (!flow) return fail(ctx, `No such ${name}: '${id}'`, 404, 'resource_missing');
-    // a processing flow that is no longer cancelable is refused as one no longer processing
-    const refused = ctx.legal(resource, 'status', operationId, checkCancelable && flow.cancelable !== true ? 'not_cancelable' : flow.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    // a canceled flow's open transaction is voided and what it held returns to the account (the reverse of its
-    // balance impact). Where the documentation stops and the twin decides: a flow already posted is only marked canceled
-    const txn = typeof flow.transaction === 'string' ? ctx.get(TX, flow.transaction) : undefined;
-    if (txn && txn.status === 'open') {
-      await ctx.write(TX, String(txn.id), { status: 'void', status_transitions: { ...(txn.status_transitions as object), void_at: nowUnix(ctx.occurredAt) } }, 'treasury_transaction.voided');
-      const account = ctx.get(FA, String(txn.financial_account));
-      const impact = (txn.balance_impact as Record<string, number> | undefined) ?? {};
-      const cur = String(txn.currency ?? 'usd');
-      if (account) {
-        const bal = (account.balance as Record<string, Record<string, number>> | undefined) ?? { cash: {}, inbound_pending: {}, outbound_pending: {} };
-        const back = Object.fromEntries((['cash', 'inbound_pending', 'outbound_pending'] as const).map((k) => [k, { ...(bal[k] ?? {}), [cur]: ((bal[k] ?? {})[cur] ?? 0) - (Number(impact[k]) || 0) }]));
-        await ctx.write(FA, String(account.id), { balance: back }, 'financial_account.balance_updated');
-      }
-    }
-    return ctx.reply(await ctx.write(resource, id, { status: 'canceled', cancelable: false, status_transitions: { ...(flow.status_transitions as object), canceled_at: nowUnix(ctx.occurredAt) } }, op));
-  };
-}
-
-// the ledger is always read for one account
-export function ledger(resource: string, spec: Record<string, (r: Row, v: unknown) => boolean>): Handler {
-  return async (ctx) => {
-    if (typeof ctx.params.financial_account !== 'string' || !ctx.params.financial_account) return fail(ctx, 'Missing required param: financial_account.', 400, 'parameter_missing');
-    return list(ctx, resource, where(ctx, newest(ctx, resource), spec));
-  };
-}
-
 export function scopeKeyOf(ctx: HandlerContext): string {
   const scope = ctx.params.scope && typeof ctx.params.scope === 'object' ? (ctx.params.scope as Row) : undefined;
   const scopeType = scope && typeof scope.type === 'string' ? scope.type : 'account';
@@ -866,13 +490,6 @@ export const named = (ctx: HandlerContext, name: string): Row | undefined => ctx
 
 export const invoiceMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such invoice: '${id}'`, 404, 'resource_missing');
 
-/** Write a draft's line list and the totals derived from it. */
-export async function writeLines(ctx: HandlerContext, invoiceId: string, next: Row[]): Promise<Row> {
-  const subtotal = sumLines(next);
-  const lines = { object: 'list', data: next, has_more: false, total_count: next.length, url: `/v1/invoices/${invoiceId}/lines` };
-  return ctx.write(INV, invoiceId, { lines, subtotal, total: subtotal, amount_due: subtotal, amount_remaining: subtotal }, 'invoice.update');
-}
-
 /** Paying an invoice with nothing to pay it: "If not set, defaults to the subscription's default payment method, if any,
  *  or to the default payment method in the customer's invoice settings" (docs.stripe.com/api/invoices/object,
  *  default_payment_method), and none of them is set. */
@@ -886,59 +503,6 @@ export async function activatedByPayment(ctx: HandlerContext, subId: string): Pr
   await ctx.write('subscription', subId, { status: 'active' }, 'subscription.update');
 }
 
-/** Re-derive a draft's lines from the items still on it: an item that changed or was deleted moves the invoice with it. */
-export async function resyncDraftLines(ctx: HandlerContext, invoiceId: string): Promise<void> {
-  const inv = ctx.get(INV, invoiceId);
-  if (!inv || inv.status !== 'draft') return;
-  const next: Row[] = [];
-  for (const line of linesOf(inv)) {
-    const itemId = typeof line.invoice_item === 'string' ? line.invoice_item : '';
-    if (!itemId) next.push(unlinkedLine(line));
-    const item = itemId ? ctx.get('invoiceitem', itemId) : undefined;
-    if (item) next.push({ ...line, amount: Number(item.amount) || 0, description: (item.description as string) ?? null });
-  }
-  await writeLines(ctx, invoiceId, next);
-}
-
-// ── invoice items: a price-based item takes its amount from the price; one naming a draft invoice
-// lands on its lines at once ──
-
-/** An item priced by a Price: its unit amount times the quantity, in its currency (docs.stripe.com/api/invoiceitems/create#create_invoiceitem-pricing). */
-export function pricedItem(ctx: HandlerContext, priceRef: string, qty: number): { amount: number; currency: string | undefined } | Response {
-  const price = ctx.get('price', priceRef);
-  if (!price) return fail(ctx, `No such price: '${priceRef}'`, 400, 'resource_missing');
-  return { amount: priceAmount(price, qty), currency: typeof price.currency === 'string' ? price.currency : undefined };
-}
-
-export const itemMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such invoiceitem: '${id}'`, 404, 'resource_missing');
-
-/** A draft invoice another object makes (an accepted quote): its customer's, with an invoice item per line the
- *  object gives, and the object named as its parent. Answers the invoice's id. */
-export async function draftInvoiceFor(ctx: HandlerContext, customer: string, currency: string, parent: Row, lines: Array<{ price: unknown; quantity: number; amount: number; description: unknown }>): Promise<string> {
-  const now = Number(nowUnix(ctx.occurredAt));
-  const id = ctx.mint(INV);
-  const holder = ctx.get('customer', customer);
-  const inv = await created(ctx, INV, { id, customer, currency, parent }, { ...draft(now), currency, customer_email: holder?.email ?? null, customer_name: holder?.name ?? null, lines: { object: 'list', data: [], has_more: false, total_count: 0, url: `/v1/invoices/${id}/lines` } });
-  for (const l of lines) {
-    const price = typeof l.price === 'string' ? l.price : l.price && typeof l.price === 'object' ? String((l.price as Row).id) : null;
-    const item = await created(ctx, 'invoiceitem', { customer, currency, amount: l.amount, quantity: l.quantity, ...(price ? { price } : {}), description: l.description ?? null }, { date: now, livemode: false, metadata: {}, discountable: true, proration: false, period: { start: now, end: now } });
-    await pullPendingItem(ctx, id, inv, item, now);
-  }
-  return id;
-}
-
-/** A customer's pending invoice item, made before the invoice, pulled onto it (docs.stripe.com/api/invoices/create#create_invoice-pending_invoice_items_behavior). */
-export async function pullPendingItem(ctx: HandlerContext, invoiceId: string, inv: Row, item: Row, now: number): Promise<void> {
-  const current = ctx.get(INV, invoiceId) ?? inv;
-  await writeLines(ctx, invoiceId, [...linesOf(current), {
-    id: `il_${String(item.id)}`, object: 'line_item', type: 'invoiceitem', amount: Number(item.amount) || 0, currency: String(current.currency ?? item.currency ?? 'usd'),
-    quantity: Number(item.quantity) || 1, proration: false, invoice_item: item.id, price: item.price ?? null,
-    period: item.period ?? { start: now, end: now }, description: (item.description as string) ?? null,
-    discountable: item.discountable ?? true, discounts: [], livemode: false, metadata: item.metadata ?? {}, tax_amounts: [], tax_rates: [],
-  }]);
-  await ctx.write('invoiceitem', String(item.id), { invoice: invoiceId }, 'invoiceitem.update');
-}
-
 /** The invoice the path names, and the machine's refusal when this operation may not move it. */
 export function invoicesLoad(ctx: HandlerContext, operationId: string): { inv: Row } | { answer: Response } {
   const id = at(ctx, 'invoice');
@@ -948,11 +512,22 @@ export function invoicesLoad(ctx: HandlerContext, operationId: string): { inv: R
   return refused ? { answer: ctx.refuse(refused) } : { inv };
 }
 
+/** A draft finalized on its way to being paid: numbered, open, its PaymentIntent opened (PostInvoicesInvoiceFinalize). */
+export async function finalizeForPayment(ctx: HandlerContext, inv: Row, id: string): Promise<Row> {
+  const piId = collectsThroughIntent(inv) ? ctx.mint('payment_intent') : null;
+  const now = nowUnix(ctx.occurredAt);
+  ctx.legal(INV, 'status', 'PostInvoicesInvoicePay', 'draft', 'open', id);
+  const body = await ctx.write(INV, id, { ...finalizedFields(ctx, inv, Number(now)), status: 'open', status_transitions: { ...transitions(inv), finalized_at: now }, payment_intent: piId }, 'invoice.finalize');
+  if (piId) await openPaymentIntent(ctx, piId, inv, id);
+  await spendOnceCoupon(ctx, inv);
+  return ctx.get(INV, id) ?? body;
+}
+
 /** The PaymentIntent a charge_automatically invoice with a balance gets when it is finalized; it
  *  waits for confirmation when the invoice already names a default payment method. */
 export async function openPaymentIntent(ctx: HandlerContext, piId: string, inv: Row, invoiceId: string): Promise<void> {
   const defaultPaymentMethod = typeof inv.default_payment_method === 'string' ? inv.default_payment_method : undefined;
-  await created(ctx, 'payment_intent', {
+  const intent = await created(ctx, 'payment_intent', {
     id: piId, amount: Number(inv.amount_due) || 0, currency: String(inv.currency ?? 'usd'), customer: inv.customer, invoice: invoiceId,
     ...(defaultPaymentMethod ? { payment_method: defaultPaymentMethod } : {}),
   }, {
@@ -961,6 +536,8 @@ export async function openPaymentIntent(ctx: HandlerContext, piId: string, inv:
     capture_method: 'automatic', amount_capturable: 0, amount_received: 0, next_action: null,
     automatic_payment_methods: null, payment_method_types: ['card', 'link'], payment_method_options: {},
   });
+  // source: spec:/components/schemas/invoice/properties/confirmation_secret/description "client_secret of the PaymentIntent"
+  await ctx.write(INV, invoiceId, { confirmation_secret: { type: 'payment_intent', client_secret: intent.client_secret } }, 'invoice.updated');
 }
 
 export function finalizedFields(ctx: HandlerContext, inv: Row, now: number): Row {
@@ -976,140 +553,6 @@ export function finalizedFields(ctx: HandlerContext, inv: Row, now: number): Row
   return fields;
 }
 
-// add_lines, update_lines and remove_lines edit a draft's lines in bulk and re-derive its totals
-export function editLines(kind: 'add' | 'update' | 'remove'): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'invoice');
-    const inv = ctx.get(INV, id);
-    if (!inv) return invoiceMissing(ctx, id);
-    if (inv.status !== 'draft') return fail(ctx, `You can only add/update/remove lines on a draft invoice (this one is ${String(inv.status)}).`, 400, 'invoice_not_editable');
-    const cur = linesOf(inv);
-    let next = [...cur];
-    const raw = ctx.params.lines;
-    const entries = Array.isArray(raw) ? (raw as Row[]) : raw && typeof raw === 'object' ? [raw as Row] : [];
-    if (entries.length === 0) return fail(ctx, 'Missing required param: lines.', 400, 'parameter_missing');
-    const currency = String(inv.currency ?? 'usd');
-    if (kind === 'add') {
-      for (let i = 0; i < entries.length; i++) {
-        const e = entries[i]!;
-        const priceRef = typeof e.price === 'string' ? e.price : '';
-        const price = priceRef ? ctx.get('price', priceRef) : undefined;
-        if (priceRef && !price) return fail(ctx, `No such price: '${priceRef}'`, 400, 'resource_missing');
-        const quantity = e.quantity !== undefined ? Math.max(1, Math.trunc(Number(e.quantity) || 1)) : 1;
-        const unit = Math.trunc(Number(e.amount) || 0);
-        next.push({ id: `il_twin_${id}_${cur.length + i + 1}`, object: 'line_item', amount: price ? priceAmount(price, quantity) : unit, currency, quantity, price: price ?? (priceRef || null), description: typeof e.description === 'string' ? e.description : null, proration: false });
-      }
-    } else if (kind === 'update') {
-      for (const e of entries) {
-        const lid = typeof e.id === 'string' ? e.id : '';
-        next = next.map((l) => (l.id === lid ? { ...l, ...(e.amount !== undefined ? { amount: Math.trunc(Number(e.amount) || 0) } : {}), ...(e.quantity !== undefined ? { quantity: Math.max(1, Math.trunc(Number(e.quantity) || 1)) } : {}), ...(e.description !== undefined ? { description: e.description } : {}) } : l));
-      }
-    } else {
-      const remove = new Set(entries.map((e) => (typeof e.id === 'string' ? e.id : '')).filter(Boolean));
-      next = next.filter((l) => !remove.has(String(l.id)));
-    }
-    return ctx.reply(await writeLines(ctx, id, next));
-  };
-}
-
-export const noteMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such credit note: '${id}'`, 404, 'resource_missing');
-
-/** The credit note the request describes (the `amount` form: one custom line), or Stripe's refusal. */
-export function build(ctx: HandlerContext, id: string): Row | Response {
-  const params = ctx.params;
-  const invoiceId = typeof params.invoice === 'string' ? params.invoice : '';
-  if (!invoiceId) return fail(ctx, 'Missing required param: invoice.', 400, 'parameter_missing');
-  const invoice = ctx.get('invoice', invoiceId);
-  if (!invoice) return fail(ctx, `No such invoice: '${invoiceId}'`, 404, 'resource_missing');
-  if (params.amount === undefined) return fail(ctx, 'Missing required param: amount.', 400, 'parameter_missing');
-  const amount = Number(params.amount);
-  if (!Number.isInteger(amount) || amount <= 0) return fail(ctx, 'Invalid integer: amount must be a positive integer.', 400, 'parameter_invalid_integer');
-  const vendorType = invoice.status === 'paid' ? 'post_payment' : 'pre_payment';
-  const outOfBand = Number(params.out_of_band_amount) || 0;
-  // a paid invoice's credit is paid back: "The sum of refunds, customer balance credits, and outside of Stripe credits
-  // must equal the post_payment_amount" (docs.stripe.com/api/credit_notes/create); the message's wording is the twin's
-  if (vendorType === 'post_payment') {
-    const split = (Number(params.refund_amount) || 0) + (Number(params.credit_amount) || 0) + outOfBand;
-    if (split !== amount) return fail(ctx, `The sum of refund_amount, credit_amount and out_of_band_amount (${split}) must equal the credit note's post_payment_amount (${amount}).`, 400, 'parameter_invalid_integer');
-  }
-  const line = {
-    object: 'credit_note_line_item', id: `cnli_${id}_1`, type: 'custom_line_item',
-    amount, description: typeof params.memo === 'string' ? params.memo : null,
-    // a custom line credits no invoice line: invoice_line_item ("ID of the invoice line item being credited") is left
-    // out, the served spec not letting it be null
-    discount_amount: 0, discount_amounts: [], livemode: false,
-    pretax_credit_amounts: [], quantity: null, tax_rates: [], taxes: [],
-    unit_amount: null, unit_amount_decimal: null,
-  };
-  return {
-    amount, amount_shipping: 0, created: nowUnix(ctx.occurredAt), currency: typeof invoice.currency === 'string' ? invoice.currency : 'usd', customer: typeof invoice.customer === 'string' ? invoice.customer : null,
-    customer_balance_transaction: null,
-    // "The date when this credit note is in effect. Same as `created` unless overwritten" (the served spec)
-    discount_amount: 0, discount_amounts: [], effective_at: params.effective_at !== undefined ? Number(params.effective_at) : nowUnix(ctx.occurredAt), invoice: invoiceId,
-    lines: { object: 'list', data: [line], has_more: false, total_count: 1, url: `/v1/credit_notes/${id}/lines` },
-    livemode: false, memo: params.memo ?? null, metadata: params.metadata && typeof params.metadata === 'object' ? params.metadata : {},
-    number: `${invoiceId}-CN-01`, out_of_band_amount: outOfBand || null,
-    pdf: `https://files.twin.local/credit_notes/${id}.pdf`,
-    post_payment_amount: vendorType === 'post_payment' ? amount : 0,
-    pre_payment_amount: vendorType === 'pre_payment' ? amount : 0,
-    pretax_credit_amounts: [],
-    reason: typeof params.reason === 'string' ? params.reason : null,
-    refunds: [], shipping_cost: null, status: 'issued',
-    subtotal: amount, subtotal_excluding_tax: amount,
-    type: vendorType, total: amount, total_excluding_tax: amount, total_taxes: [],
-    voided_at: null,
-  };
-}
-
-/** The invoice's credit-note sums, from its issued credit notes; a pre-payment credit lowers what is owed. */
-export async function syncInvoice(ctx: HandlerContext, invoiceId: string): Promise<void> {
-  const inv = ctx.get('invoice', invoiceId);
-  if (!inv) return;
-  let pre = 0;
-  let post = 0;
-  for (const cn of ctx.rows(CN)) {
-    if (cn.invoice !== invoiceId || cn.status === 'void') continue;
-    if (cn.type === 'post_payment') post += Number(cn.amount) || 0;
-    else pre += Number(cn.amount) || 0;
-  }
-  const total = Number(inv.total ?? inv.amount_due) || 0;
-  const paid = Number(inv.amount_paid) || 0;
-  await ctx.write('invoice', invoiceId, { pre_payment_credit_notes_amount: pre, post_payment_credit_notes_amount: post, amount_remaining: Math.max(0, total - paid - pre) }, 'invoice.update');
-}
-
-/** What a post-payment credit pays back: "Refunds: create a new refund (using refund_amount)"; "Customer balance credit:
- *  credit the customer's balance (using credit_amount) which will be automatically applied to their next invoice when
- *  it's finalized" (docs.stripe.com/api/credit_notes/create). The refund is made on the invoice's charge as a refund
- *  call makes it (refunds.ts); the credit is a customer balance transaction of type credit_note. Where the documentation
- *  stops and the twin decides: the refund carries no reason of its own. */
-export async function payBack(ctx: HandlerContext, id: string, cn: Row): Promise<Row | Response> {
-  const params = ctx.params;
-  const out: Row = {};
-  const refundAmount = Number(params.refund_amount) || 0;
-  if (refundAmount > 0) {
-    const invoice = ctx.get('invoice', String(cn.invoice));
-    const pi = typeof invoice?.payment_intent === 'string' ? ctx.get('payment_intent', invoice.payment_intent) : undefined;
-    const chargeId = typeof invoice?.charge === 'string' ? invoice.charge : typeof pi?.latest_charge === 'string' ? pi.latest_charge : undefined;
-    const charge = chargeId ? ctx.get('charge', chargeId) : undefined;
-    if (!charge) return fail(ctx, 'This invoice was not paid with a charge that can be refunded.', 400, 'invoice_no_charge_to_refund');
-    const answer = await refundCharge(ctx, charge, { amount: refundAmount });
-    if (answer.status >= 400) return answer;
-    const refund = (await answer.json()) as Row;
-    out.refunds = [{ amount_refunded: refundAmount, refund: refund.id, type: 'refund', payment_record_refund: null }];
-  }
-  const creditAmount = Number(params.credit_amount) || 0;
-  const customer = typeof cn.customer === 'string' ? cn.customer : undefined;
-  if (creditAmount > 0 && customer) {
-    const ending = (Number(ctx.get('customer', customer)?.balance) || 0) - creditAmount;
-    const txn = await created(ctx, 'customer_balance_transaction', { customer, amount: -creditAmount, currency: cn.currency, credit_note: id, invoice: cn.invoice }, {
-      ending_balance: ending, type: 'credit_note', livemode: false, metadata: {}, description: null, checkout_session: null,
-    });
-    await ctx.write('customer', customer, { balance: ending }, `customer.balance_adjusted:${String(txn.id)}`);
-    out.customer_balance_transaction = txn.id;
-  }
-  return out;
-}
-
 /** A coupon for a fixed amount off, in its currency (docs.stripe.com/api/coupons/create#create_coupon-amount_off). */
 export function amountOffOf(ctx: HandlerContext, params: Record<string, unknown>): number | Response {
   const amountOff = Number(params.amount_off);
@@ -1131,69 +574,6 @@ export async function lapseCoupons(ctx: HandlerContext): Promise<void> {
   }
 }
 
-export const planMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such plan: '${id}'`, 404, 'resource_missing');
-
-/** A recurring price the Plans API still answers: one whose plan was deleted is not a plan any more. */
-export const recurring = (ctx: HandlerContext, p: Row | undefined): p is Row => !!p && !!p.recurring && kept(ctx, 'price', p, '_plan_deleted') !== true;
-
-/** The request's line items resolved against their prices, or the refusal for a missing price. */
-export function resolved(ctx: HandlerContext): CheckoutItem[] | Response {
-  const entries = lineItemEntries(ctx.params);
-  const items: CheckoutItem[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const { item, priceMissing } = resolveLineItem(entries[i]!, i, 'usd', finder(ctx));
-    if (priceMissing) return fail(ctx, `No such price: '${priceMissing}'`, 400, 'resource_missing');
-    items.push(item);
-  }
-  return items;
-}
-
-/** A page of the line items a stored object carries. */
-export function linePage(ctx: HandlerContext, holder: Row): Response {
-  const li = holder.line_items as { data?: Row[] } | undefined;
-  const { page, hasMore } = paginate(Array.isArray(li?.data) ? li!.data! : [], ctx.params);
-  return ctx.reply({ object: 'list', url: path(ctx), has_more: hasMore, data: page });
-}
-
-export const linkMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such payment link: '${id}'`, 404, 'resource_missing');
-
-// ── quotes ──
-
-export const quoteMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such quote: '${id}'`, 404, 'resource_missing');
-
-export function move(action: 'finalize' | 'accept' | 'cancel', operationId: string): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'quote');
-    const q = ctx.get('quote', id);
-    if (!q) return quoteMissing(ctx, id);
-    const refused = ctx.legal('quote', 'status', operationId, q.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    const now = nowUnix(ctx.occurredAt);
-    const stamp = action === 'finalize' ? { finalized_at: now } : action === 'accept' ? { accepted_at: now } : { canceled_at: now };
-    // "Accepted quotes automatically generate an invoice, subscription, or subscription schedule"; "Quotes without
-    // recurring prices: A draft invoice is created with auto_advance set to false" (docs.stripe.com/quotes/overview),
-    // the quote its parent ("Details about the quote that generated this invoice", the served spec). Where the
-    // documentation stops and the twin decides: a quote with recurring prices makes no subscription yet.
-    let made: Row = {};
-    if (action === 'accept') {
-      const lines = ((q.line_items as Row | undefined)?.data as Row[] | undefined) ?? [];
-      const recurring = lines.some((l) => l.price && typeof l.price === 'object' && (l.price as Row).recurring);
-      if (!recurring && typeof q.customer === 'string') {
-        const invoice = await draftInvoiceFor(ctx, q.customer, String(q.currency ?? 'usd'), { type: 'quote_details', quote_details: { quote: id }, subscription_details: null }, lines.map((l) => ({ price: l.price, quantity: Number(l.quantity) || 1, amount: Number(l.amount_subtotal ?? l.amount_total) || 0, description: l.description })));
-        made = { invoice };
-      }
-    }
-    return ctx.reply(
-      await ctx.write('quote', id, {
-        status: action === 'finalize' ? 'open' : action === 'accept' ? 'accepted' : 'canceled',
-        status_transitions: { ...((q.status_transitions as Row) ?? {}), ...stamp },
-        ...(action === 'finalize' ? { number: `QT-${id.toUpperCase()}` } : {}),
-        ...made,
-      }, `quote.${action}`),
-    );
-  };
-}
-
 export const sessionMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such checkout.session: '${id}'`, 404, 'resource_missing');
 
 // Stripe normalizes the create input into the Session: line_items become the list envelope, and
@@ -1382,6 +762,7 @@ export async function completeSession(ctx: HandlerContext, id: string, existing:
   const d = ctx.row(CS, id)?._discount as Row | undefined;
   if (d) await redeemCoupon(ctx, d.coupon, d.promotion_code);
   // the session's url "is only present when the session is active" (docs.stripe.com/api/checkout/sessions/object)
+  if (link.payment_status !== undefined) ctx.legal(CS, 'payment_status', 'PostCheckoutSessionsSession', existing.payment_status, String(link.payment_status), id, 'external');
   return ctx.write(CS, id, { ...details, ...link, url: null }, 'checkout.session.completed');
 }
 
@@ -1390,42 +771,12 @@ export const send = (ctx: HandlerContext, r: StripeResponse): Response => ctx.re
 /** Stripe's error body: an invalid_request_error with the message, and the code when there is one. */
 export const fail = (ctx: HandlerContext, message: string, status = 404, code?: string): Response => ctx.refuse({ status, message, ...(code ? { code } : {}) });
 
-/** A file parameter whose description requires a purpose refuses a file of another one. The served spec requires it
- *  on every such parameter ("Must have a `purpose` value of `issuing_logo`", personalization designs' card_logo;
- *  "The file's `purpose` must be one of the following: …", file links' file). Where the documentation stops and the
- *  twin decides: Stripe documents no error for it (docs.stripe.com/error-codes names none), so the twin answers the
- *  400 invalid_request_error it answers for an unknown file, naming the parameter and the purposes allowed. */
-export function filePurposeRefused(ctx: HandlerContext, param: string, allowed: readonly string[]): Response | undefined {
-  const given = ctx.params[param];
-  if (given === undefined || given === '') return undefined;
-  const file = ctx.get('file', String(given));
-  if (!file) return fail(ctx, `No such file upload: '${String(given)}'`, 400, 'resource_missing');
-  if (allowed.includes(String(file.purpose))) return undefined;
-  const need = allowed.length === 1 ? `a \`purpose\` value of \`${allowed[0]}\`` : `a \`purpose\` of one of: ${allowed.map((a) => `\`${a}\``).join(', ')}`;
-  return fail(ctx, `Invalid ${param}: the file '${String(given)}' has a \`purpose\` of \`${String(file.purpose)}\`, but it must have ${need}.`, 400);
-}
-
 /** The request's path, as the list envelope's `url` carries it. */
 export const path = (ctx: HandlerContext): string => new URL(ctx.call.request.url).pathname.replace(/\/+$/, '') || '/';
 
 /** A path parameter, by the name the spec gives it. */
 export const at = (ctx: HandlerContext, name: string): string => ctx.call.params[name] ?? '';
 
-/** An update's fields laid over what is stored, as the derived core does: a nested hash is merged into the stored one,
- *  not put in its place (Stripe updates only the keys a request names; docs.stripe.com/api/metadata and each update
- *  reference), and an empty string unsets a key. */
-export function mergeUpdate(ctx: HandlerContext, resource: string, id: string, fields: Row): Row {
-  const current = ctx.get(resource, id) ?? {};
-  const out: Row = {};
-  for (const [k, v] of Object.entries(fields)) {
-    const prior = (current as Row)[k];
-    out[k] = v && typeof v === 'object' && !Array.isArray(v) && prior && typeof prior === 'object' && !Array.isArray(prior)
-      ? Object.fromEntries(Object.entries({ ...(prior as object), ...(v as object) }).filter(([, x]) => x !== ''))
-      : v;
-  }
-  return out;
-}
-
 /** A resource's rows in Stripe's list order: newest first by `timeField`, ties by mint order (as the derived core breaks them). */
 /** A subject's bookkeeping field (`_…`): kept on the stored row, never in the wire view ctx.get and ctx.rows answer. */
 export const kept = (ctx: HandlerContext, resource: string, row: Row, key: string): unknown => ctx.row(resource, String(row.id), { withDeleted: true })?.[key];
@@ -1460,7 +811,7 @@ export function newest(ctx: HandlerContext, resource: string, timeField = 'creat
     const ta = when(a), tb = when(b);
     if (tb !== ta) return tb - ta;
     return made.get(b)! - made.get(a)!;
-  });
+  }).map((r) => ctx.expand(resource, r));
 }
 
 /** A context at the moment Stripe would have made a move time makes (a renewal, a payout on its schedule), so what
@@ -1497,7 +848,6 @@ export function commonAsOf(ctx: HandlerContext, t: Row): Row {
  *  it holds, one segment at a time; an id the tree lacks stays an id. An embedded balance transaction reads as the clock
  *  has it (asOf), as its own retrieve does. */
 export function expandRow(ctx: HandlerContext, resource: string, body: Row, paths: string[][]): Row {
-  if (paths.length === 0) return body;
   const asOf = (v: unknown): unknown => {
     if (Array.isArray(v)) return v.map(asOf);
     if (!v || typeof v !== 'object') return v;
@@ -1511,11 +861,16 @@ export function expandRow(ctx: HandlerContext, resource: string, body: Row, path
 /** One resource with the request's `expand[]` applied. */
 export const expanded = (ctx: HandlerContext, resource: string, body: Row): Row => expandRow(ctx, resource, body, expandPaths(ctx));
 
+export const resourceView = (ctx: HandlerContext, resource: string, id: string): Row | undefined => {
+  const row = ctx.get(resource, id);
+  return row ? ctx.expand(resource, row) : undefined;
+};
+
 /** Stripe's list envelope over rows already in list order: a page, `has_more`, and `expand[]=data.*`. */
 export function list(ctx: HandlerContext, resource: string, items: Row[]): Response {
   const { page, hasMore } = paginate(items, ctx.params);
   const paths = expandPaths(ctx).filter((p) => p[0] === 'data').map((p) => p.slice(1)).filter((p) => p.length > 0);
-  return ctx.reply({ object: 'list', url: path(ctx), has_more: hasMore, data: paths.length ? page.map((r) => expandRow(ctx, resource, r, paths)) : page });
+  return ctx.reply({ object: 'list', url: path(ctx), has_more: hasMore, data: page.map((r) => expandRow(ctx, resource, r, paths)) });
 }
 
 /** Stripe's search over a resource's rows (`query` in its search language). */
@@ -1534,12 +889,30 @@ export async function created(ctx: HandlerContext, resource: string, params: Row
   const timeField = opts.timeField ?? 'created';
   const stamped = !known || known.has(timeField) || timeField in defaults || timeField in rest ? timeField : '_created';
   const fields = { object: OBJECT_NAME[type] ?? type, [stamped]: nowUnix(ctx.occurredAt), ...defaults, ...rest };
-  return ctx.write(resource, id, fields, opts.operation ?? `${type}.create`);
+  // source: spec:/components/schemas/subscription/properties/items/description "List of subscription items, each with an attached price."
+  const children = resource === SUB ? ((fields.items as { data?: Row[] } | undefined)?.data ?? []) : [];
+  if (resource === SUB) delete (fields as Row).items;
+  // source: spec:/components/schemas/subscription_item/properties/price "price"
+  if (resource === 'subscription_item') {
+    const item = fields as Row;
+    if (item.price && typeof item.price === 'object') item.price = (item.price as Row).id;
+    delete item.plan; // the served subscription_item schema has no plan field
+  }
+  // source: spec:/components/schemas/account/properties/individual "person"
+  if (resource === 'account' && (fields as Row).individual && typeof (fields as Row).individual === 'object') {
+    const person = await created(ctx, 'person', { ...((fields as Row).individual as Row), account: id }, { metadata: {}, relationship: { representative: true } });
+    (fields as Row).individual = person.id;
+  }
+  const row = await ctx.write(resource, id, fields, opts.operation ?? `${type}.create`);
+  if (children.length) await storeItems(ctx, id, children);
+  return ctx.expand(resource, row);
 }
 
 export const finder = (ctx: Pick<HandlerContext, 'rowsRaw'>): Find => (storedType, id) => {
   const r = ctx.rowsRaw(storedType, { withDeleted: true }).find((x) => x.id === id);
-  return r ? view(storedType, r as TwinResource) : undefined;
+  // source: https://docs.stripe.com/testing "Generic decline 4000 0000 0000 0002"
+  // Private test-card behavior is used for subsequent charges, never sent as a vendor field.
+  return r ? { ...view(storedType, r as TwinResource), ...(r._declineOutcome !== undefined ? { _declineOutcome: r._declineOutcome } : {}) } : undefined;
 };
 
 /** The account's external_accounts list, rewritten from its external accounts after one is added or removed. */
@@ -1548,47 +921,6 @@ export async function syncExternals(ctx: HandlerContext, account: string): Promi
   await ctx.write('account', account, { external_accounts: externalList(account, newest(ctx, 'external_account').filter((e) => e.account === account)) }, 'account.external_accounts');
 }
 
-/** A decision over the rows and the write it makes, taken together: the read and the write follow one another with
- *  nothing between them (a code spent once, a connection revoked once). */
-export async function decide<T>(ctx: HandlerContext, decision: (rows: (resource: string) => Row[]) => { value: T; write?: { resource: string; id: string; fields: Row; operation: string } }): Promise<T> {
-  const d = decision((resource) => ctx.rowsRaw(resource));
-  if (d.write) await ctx.write(d.write.resource, d.write.id, d.write.fields, d.write.operation);
-  return d.value;
-}
-
-export const catalog = (ctx: HandlerContext, data: Row[]): Response => ctx.reply({ object: 'list', url: path(ctx), has_more: false, data });
-
-export const orderMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such order: '${id}'`, 404, 'resource_missing');
-
-/** Each pending report run completes, caught up before anything is answered: "When the run completes, Stripe updates
- *  the object, and it has a status of succeeded. It also has a nested result object, containing a URL that you can use
- *  to access the file", the guide's example a File of purpose report_run and type csv (docs.stripe.com/reports/api).
- *  "Most runs complete within a few minutes" (the same page). Where the documentation stops and the twin decides: a run
- *  completes one minute after it was created (the guide's example: created 1580832900, succeeded_at 1580832960), and
- *  its CSV holds the report type's header row alone (its size that row's bytes). */
-export async function finishReportRuns(ctx: HandlerContext): Promise<void> {
-  for (const run of ctx.rowsRaw('reporting.report_run')) {
-    if (run.status !== 'pending') continue;
-    const done = Number(run.created) + 60;
-    if (Number(nowUnix(ctx.occurredAt)) < done) continue;
-    const id = String(run.id);
-    const header = 'category,currency,description,net_amount\n';
-    const file = await created(ctx, 'file', { purpose: 'report_run' }, {
-      filename: `${String(run.report_type)}_${id}.csv`, size: header.length, type: 'csv', title: null, expires_at: null, url: null,
-      links: { object: 'list', data: [], has_more: false, url: '' },
-    });
-    await ctx.write('file', String(file.id), { url: `https://files.twin.local/v1/files/${String(file.id)}/contents` }, 'file.updated');
-    ctx.legal('reporting.report_run', 'status', ctx.call.operation.id, 'pending', 'succeeded', id, 'vendor');
-    await ctx.write('reporting.report_run', id, { status: 'succeeded', succeeded_at: done, result: ctx.get('file', String(file.id)) }, 'reporting.report_run.succeeded');
-  }
-}
-
-/** A feature whose lookup_key an unarchived feature already has: "A unique key you provide as your own system identifier"
- *  (docs.stripe.com/api/entitlements/feature/create). */
-export function lookupKeyTaken(ctx: HandlerContext, lookupKey: string): Response {
-  return fail(ctx, `A feature with lookup_key '${lookupKey}' already exists.`, 400, 'resource_already_exists');
-}
-
 export const pmMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such payment_method: '${id}'`, 404, 'resource_missing');
 
 /** The card a charge was paid with, as its payment_method_details reports it
@@ -1649,11 +981,18 @@ export async function methodFromData(ctx: HandlerContext, data: unknown): Promis
   const d = data as Row;
   const type = typeof d.type === 'string' ? d.type : 'card';
   const made = await created(ctx, PM, {}, {
-    type, customer: null, livemode: false, metadata: {},
+    type, customer: null, livemode: false,
+    // source: spec:/paths/~1v1~1setup_intents~1{intent}~1confirm/post/requestBody/content/application~1x-www-form-urlencoded/schema/properties/payment_method_data/description "this hash creates a PaymentMethod"
+    metadata: d.metadata && typeof d.metadata === 'object' ? d.metadata : {},
     billing_details: { ...noBilling, ...((d.billing_details as Row | undefined) ?? {}) },
     ...paymentMethodSubObject(type, d),
     // what follows its card's success (a dispute, funds straight to available), as a PaymentMethod created directly carries
     ...(type === 'card' && afterSuccessOf(ctx, d.card) ? { _afterSuccess: afterSuccessOf(ctx, d.card) } : {}),
+    // and what a payment with its card answers: a test card the issuer declines, or one that asks the cardholder to
+    // authenticate, entered as its number (Stripe.js sends it so), as the same card made a PaymentMethod directly does
+    // source: https://docs.stripe.com/testing "Generic decline 4000 0000 0000 0002"
+    // source: https://docs.stripe.com/testing "This card requires authentication on all transactions, regardless of how the card is set up."
+    ...(type === 'card' ? { _declineOutcome: declineFor(() => undefined, { card: d.card }) ?? null, ...(requiresAuthentication({ card: d.card }) ? { _requiresAuthentication: true } : {}) } : {}),
   });
   return String(made.id);
 }
@@ -1666,103 +1005,8 @@ export function microdepositsAsked(ctx: HandlerContext, params: Row, intent: Row
   return options?.verification_method === 'microdeposits' && !!pm && ctx.get(PM, pm)?.type === 'us_bank_account';
 }
 
-export const scheduleMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such subscription_schedule: '${id}'`, 404, 'resource_missing');
-
-/** A schedule's phases as Stripe answers them (the served spec's subscription_schedule_phase_configuration): each
- *  starts where the last ended (the first at the schedule's start_date, "now" or a timestamp), and ends at its
- *  end_date or after its duration ("duration: interval, interval_count", the served spec's phases[] parameter) on the
- *  calendar; its currency is its first price's, each item carries its price, quantity and (empty) discounts. Where the
- *  documentation stops and the twin decides: a phase with neither lasts one interval of its first price. */
-export function phasesOf(ctx: HandlerContext, given: Row[], start: number): Row[] {
-  let cursor = start;
-  return given.map((p) => {
-    const items = (Array.isArray(p.items) ? (p.items as Row[]) : []).map((it) => ({ price: it.price ?? null, quantity: Math.max(1, Math.trunc(Number(it.quantity) || 1)), discounts: [], metadata: {}, tax_rates: [], billing_thresholds: null }));
-    const price = typeof items[0]?.price === 'string' ? ctx.get('price', items[0]!.price as string) : undefined;
-    const recurring = (price?.recurring as Row | undefined) ?? {};
-    const d = p.duration && typeof p.duration === 'object' ? (p.duration as Row) : undefined;
-    const startDate = cursor;
-    const end = p.end_date !== undefined && p.end_date !== 'now' ? Number(p.end_date)
-      : d ? addBillingInterval(startDate, String(d.interval) as Interval, Math.max(1, Number(d.interval_count) || 1))
-      : addBillingInterval(startDate, String(recurring.interval ?? 'month') as Interval, Math.max(1, Number(recurring.interval_count) || 1));
-    cursor = end;
-    return {
-      add_invoice_items: [], application_fee_percent: null, automatic_tax: { enabled: false, liability: null, disabled_reason: null }, billing_cycle_anchor: null,
-      billing_thresholds: null, collection_method: null, currency: String(price?.currency ?? 'usd'), default_payment_method: null, default_tax_rates: [],
-      description: null, discounts: [], end_date: end, invoice_settings: null, items, metadata: p.metadata && typeof p.metadata === 'object' ? p.metadata : {},
-      on_behalf_of: null, proration_behavior: typeof p.proration_behavior === 'string' ? p.proration_behavior : 'create_prorations', start_date: startDate,
-      transfer_data: null, trial_end: null,
-    };
-  });
-}
-
-export function end(kind: 'cancel' | 'release'): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'schedule');
-    const sched = ctx.get(SS, id);
-    if (!sched) return scheduleMissing(ctx, id);
-    const refused = ctx.legal(SS, 'status', kind === 'cancel' ? 'PostSubscriptionSchedulesScheduleCancel' : 'PostSubscriptionSchedulesScheduleRelease', sched.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    const now = nowUnix(ctx.occurredAt);
-    const subId = typeof sched.subscription === 'string' ? sched.subscription : undefined;
-    const sub = subId ? ctx.get('subscription', subId) : undefined;
-    // "Cancels a subscription schedule and its associated subscription immediately (if the subscription schedule has an
-    // active subscription)" (docs.stripe.com/api/subscription_schedules/cancel); releasing "will remove its subscription
-    // property and set the subscription's ID to the released_subscription property", leaving the subscription in place
-    // (docs.stripe.com/api/subscription_schedules/release)
-    if (kind === 'cancel' && subId && sub && sub.status !== 'canceled') {
-      ctx.legal('subscription', 'status', 'PostSubscriptionSchedulesScheduleCancel', String(sub.status), 'canceled', subId);
-      await ctx.write('subscription', subId, { status: 'canceled', canceled_at: now, ended_at: now }, 'subscription.cancel');
-    }
-    if (kind === 'release' && subId && sub) await ctx.write('subscription', subId, { schedule: null }, 'subscription.update');
-    const fields = kind === 'cancel'
-      ? { status: 'canceled', canceled_at: now, current_phase: null }
-      : { status: 'released', released_at: now, released_subscription: subId ?? null, subscription: null, current_phase: null };
-    return ctx.reply(await ctx.write(SS, id, fields, `subscription_schedule.${kind}`));
-  };
-}
-
-/** A token asked for none of what a token holds. */
-export function noTokenSource(ctx: HandlerContext): Response {
-  return fail(ctx, 'You must provide one of the following parameters: card, bank_account, pii.', 400, 'parameter_missing');
-}
-
-/** A bank account token's account, as the legacy BankAccount object holds it. */
-export function bankAccountOf(ctx: HandlerContext, ba: Row): Row {
-  const acct = typeof ba.account_number === 'string' ? ba.account_number.replace(/\D/g, '') : '';
-  return {
-    id: ctx.mint('external_account'), object: 'bank_account', account_holder_name: ba.account_holder_name ?? null,
-    account_holder_type: ba.account_holder_type ?? null, bank_name: 'STRIPE TEST BANK',
-    country: ba.country ?? 'US', currency: ba.currency ?? 'usd', fingerprint: 'twin_ba_fp',
-    last4: acct ? acct.slice(-4) : '6789', routing_number: ba.routing_number ?? '110000000', status: 'new',
-  };
-}
-
-export const productMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such product: '${id}'`, 404, 'resource_missing');
-
-// a product with prices cannot be deleted; Stripe says to deactivate it instead
-/** A product deleted while it has prices: "Deleting a product is only possible if it has no prices associated with it"
- *  (docs.stripe.com/api/products/delete). */
-export function pricedProductRefused(ctx: HandlerContext): Response {
-  return fail(ctx, 'You cannot delete the product because it has one or more prices. Deactivate the product instead.', 400, 'resource_already_exists');
-}
-
 // ── features: an entitlements feature granted to a product, at most once ──
 
-/** A feature attached to a product that already has it. */
-export function alreadyAttached(ctx: HandlerContext): Response {
-  return fail(ctx, 'This feature is already attached to the product.', 400, 'resource_already_exists');
-}
-
-export const productFeature = (ctx: HandlerContext): Row | undefined => {
-  const pf = ctx.get('product_feature', at(ctx, 'id'));
-  // the product a feature is attached to is its address, not a field Stripe answers
-  return pf && kept(ctx, 'product_feature', pf, '_product') === at(ctx, 'product') ? pf : undefined;
-};
-
-export const featureMissing = (ctx: HandlerContext): Response => fail(ctx, `No such product feature: '${at(ctx, 'id')}'`, 404, 'resource_missing');
-
-// ── prices ──
-
 /** A tiered price: tiers_mode and tiers, each tier with up_to and a unit or flat amount; no single unit_amount, and
  *  the last tier's up_to null (∞) (docs.stripe.com/products-prices/pricing-models#tiered-pricing). */
 export async function tieredPrice(ctx: HandlerContext, params: Row): Promise<Response> {
@@ -1840,6 +1084,11 @@ export async function payInvoiceOf(ctx: HandlerContext, pi: Row, operationId: st
   const invoiceId = typeof pi.invoice === 'string' ? pi.invoice : undefined;
   const invoice = invoiceId ? ctx.get('invoice', invoiceId) : undefined;
   if (!invoiceId || !invoice || invoice.status === 'paid' || invoice.status === 'void') return;
+  await finishInvoiceIntent(ctx, invoice, invoiceId, operationId, actor);
+}
+
+/** An invoice-linked intent read back from a live account; the served create API cannot set invoice. */
+export async function finishInvoiceIntent(ctx: HandlerContext, invoice: Row, invoiceId: string, operationId: string, actor?: 'vendor'): Promise<void> {
   if (ctx.legal('invoice', 'status', operationId, invoice.status, 'paid', invoiceId, actor)) return;
   const amount = Number(invoice.total ?? invoice.amount_due) || 0;
   // `invoice.pay` is the event the standalone pay action sends: invoice.paid
@@ -1848,20 +1097,12 @@ export async function payInvoiceOf(ctx: HandlerContext, pi: Row, operationId: st
     status_transitions: { ...((invoice.status_transitions as object) ?? {}), paid_at: nowUnix(ctx.occurredAt) },
   }, 'invoice.pay');
   const subId = typeof invoice.subscription === 'string' ? invoice.subscription : undefined;
-  const sub = subId ? ctx.get('subscription', subId) : undefined;
+  const sub = subId ? resourceView(ctx, 'subscription', subId) : undefined;
   if (subId && sub && sub.status === 'incomplete' && !ctx.legal('subscription', 'status', operationId, sub.status, 'active', subId, actor)) {
     await ctx.write('subscription', subId, { status: 'active' }, 'subscription.update');
   }
 }
 
-/** The intent the path names, and the machine's refusal when this operation may not move it. */
-export function paymentIntentsLoad(ctx: HandlerContext, operationId: string): { pi: Record<string, unknown> } | { answer: Response } {
-  const pi = ctx.id ? ctx.get(PI, ctx.id) : undefined;
-  if (!pi) return { answer: ctx.notFound(PI, String(ctx.id)) };
-  const refusal = ctx.legal(PI, 'status', operationId, pi.status);
-  return refusal ? { answer: ctx.refuse(refusal) } : { pi };
-}
-
 /** The type of the payment method an intent is paid with: its PaymentMethod's, or a documented test name's (pm_card_*,
  *  tok_* a card; pm_usBankAccount_* a US bank account), else unknown. */
 export function methodType(ctx: HandlerContext, method: unknown): string | undefined {
@@ -1891,6 +1132,15 @@ export function methodNotAllowed(ctx: HandlerContext, existing: Row, params: Row
   return ctx.refuse({ status: 400, code: 'payment_intent_invalid_parameter', param: 'payment_method', message: `The PaymentMethod provided (${type}) is not allowed for this PaymentIntent. Please attach a PaymentMethod of one of the following types: ${types.join(', ')}. Alternatively, update the allowed payment_method_types for this PaymentIntent to include "${type}"` });
 }
 
+// Confirmation controls are request instructions, absent from the pinned PaymentIntent object.
+// source: spec:/paths/~1v1~1payment_intents~1{intent}~1confirm/post/requestBody/content/application~1x-www-form-urlencoded/schema/properties/return_url/description "The URL to redirect your customer back to after they authenticate or cancel their payment"
+export function intentFields(params: Record<string, unknown>): Record<string, unknown> {
+  const { confirm: _confirm, amount_to_confirm: _amount, confirmation_token: _token, error_on_requires_action: _error,
+    expand: _expand, mandate: _mandate, mandate_data: _mandateData, off_session: _offSession,
+    payment_method_data: _methodData, radar_options: _radar, return_url: _returnUrl, use_stripe_sdk: _sdk, ...fields } = params;
+  return fields;
+}
+
 /** Confirm an intent the confirm machine allows to move: the confirm action, and a create with `confirm=true`. */
 export async function confirmIntent(ctx: HandlerContext, existing: Record<string, unknown>, params: Record<string, unknown>): Promise<Response> {
   const id = String(existing.id);
@@ -1918,7 +1168,7 @@ export async function confirmIntent(ctx: HandlerContext, existing: Record<string
       id: chargeId, amount, currency: existing.currency ?? 'usd', payment_intent: id,
       ...(typeof existing.customer === 'string' ? { customer: existing.customer } : {}),
       ...(pmId ? { payment_method: pmId } : {}),
-      ...intentCarries({ ...existing, ...params }),
+      ...intentCarries({ ...existing, ...intentFields(params) }),
     }, {
       ...chargeDefaults(chargeId, amount, false, ctx.occurredAt), status: 'failed', paid: false, captured: false, capture_before: null,
       failure_code: decline.code, failure_message: decline.message, balance_transaction: null,
@@ -1927,57 +1177,37 @@ export async function confirmIntent(ctx: HandlerContext, existing: Record<string
     }, { operation: 'charge.failed' }); // "Occurs whenever a failed charge attempt occurs." (docs.stripe.com/api/events/types)
     const { payment_method: _pm, ...rest } = params;
     const last_payment_error = { type: 'card_error', code: decline.code, ...(decline.decline_code ? { decline_code: decline.decline_code } : {}), message: decline.message, param: 'card', charge: chargeId, payment_method: pm ?? null };
-    const failed = await ctx.write(PI, id, { ...rest, payment_method: null, latest_charge: chargeId, status: 'requires_payment_method', last_payment_error }, 'payment_intent.payment_failed');
+    const failed = await ctx.write(PI, id, { ...intentFields(rest), payment_method: null, latest_charge: chargeId, status: 'requires_payment_method', last_payment_error }, 'payment_intent.payment_failed');
     return paymentIntentsSend(ctx, cardError(decline, { payment_intent: failed, charge: chargeId }));
   }
   // a bank debit that needs micro-deposit verification waits in requires_action
   const method = typeof params.payment_method === 'string' ? params.payment_method : typeof existing.payment_method === 'string' ? existing.payment_method : undefined;
   // a bank transfer is paid from the customer's cash balance, or waits for the transfer (fundFromCashBalance)
-  if (method && ctx.get('payment_method', method)?.type === 'customer_balance') return ctx.reply(ctx.expand(PI, await fundFromCashBalance(ctx, { ...existing, ...params }, params)));
+  if (method && ctx.get('payment_method', method)?.type === 'customer_balance') return ctx.reply(ctx.expand(PI, await fundFromCashBalance(ctx, { ...existing, ...intentFields(params) }, intentFields(params))));
   if (requiresMicrodeposits(params, existing) || microdepositsAsked(ctx, params, existing, method)) {
-    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...params, status: 'requires_action', next_action: microdepositsNextAction(), last_payment_error: null }, 'payment_intent.requires_action')));
+    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...intentFields(params), status: 'requires_action', next_action: microdepositsNextAction(), last_payment_error: null }, 'payment_intent.requires_action')));
   }
   // 3DS: the first confirm asks for authentication; a second one completes it
-  if (existing.status !== 'requires_action' && requiresAuthentication(params, existing)) {
-    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...params, status: 'requires_action', next_action: threeDsNextAction(), last_payment_error: null }, 'payment_intent.requires_action')));
+  if (existing.status !== 'requires_action' && (requiresAuthentication(params, existing) || (!!method && ctx.row(PM, method)?._requiresAuthentication === true))) {
+    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...intentFields(params), status: 'requires_action', next_action: threeDsNextAction(), last_payment_error: null }, 'payment_intent.requires_action')));
   }
   // manual capture authorizes and waits for /capture: the authorization is a charge, succeeded and not captured, the
   // intent's latest_charge
   if ((params.capture_method ?? existing.capture_method) === 'manual') {
     const amount = Number(existing.amount ?? params.amount ?? 0);
-    const charge = await authorizeCharge(ctx, id, { ...existing, ...params }, amount);
-    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...params, status: 'requires_capture', amount_capturable: amount, amount_received: 0, next_action: null, last_payment_error: null, latest_charge: charge }, 'payment_intent.amount_capturable_updated')));
+    const charge = await authorizeCharge(ctx, id, { ...existing, ...intentFields(params) }, amount);
+    return ctx.reply(ctx.expand(PI, await ctx.write(PI, id, { ...intentFields(params), status: 'requires_capture', amount_capturable: amount, amount_received: 0, next_action: null, last_payment_error: null, latest_charge: charge }, 'payment_intent.amount_capturable_updated')));
   }
   // a bank debit is submitted and settles later (beginBankDebit)
-  if (isBankDebit(ctx, method)) return ctx.reply(ctx.expand(PI, await beginBankDebit(ctx, id, params)));
+  if (isBankDebit(ctx, method)) return ctx.reply(ctx.expand(PI, await beginBankDebit(ctx, id, intentFields(params))));
   const amount = Number(existing.amount ?? params.amount ?? 0);
   // a succeeded intent has a Charge, and latest_charge names it: what a refund of it lands on
-  const charge = await mintCharge(ctx, id, { ...existing, ...params }, amount);
-  const body = await ctx.write(PI, id, { ...params, status: 'succeeded', amount_received: amount, next_action: null, last_payment_error: null, latest_charge: charge }, 'payment_intent.confirm');
+  const charge = await mintCharge(ctx, id, { ...existing, ...intentFields(params) }, amount);
+  const body = await ctx.write(PI, id, { ...intentFields(params), status: 'succeeded', amount_received: amount, next_action: null, last_payment_error: null, latest_charge: charge }, 'payment_intent.confirm');
   await payInvoiceOf(ctx, body, 'PostPaymentIntentsIntentConfirm');
   return ctx.reply(ctx.expand(PI, body));
 }
 
-/** An increment that does not raise the authorization. */
-export function incrementTooSmall(ctx: HandlerContext): Response {
-  return ctx.refuse({ status: 400, code: 'parameter_invalid_integer', message: 'The new amount must be greater than the current amount of the PaymentIntent.' });
-}
-
-// ── a bank debit is submitted, and settles ──
-//
-// ACH Direct Debit "is a delayed notification payment method ... The PaymentIntent you create initially has a status
-// of `processing`. After the payment has succeeded, the PaymentIntent status is updated from `processing` to
-// `succeeded`"; verification by micro-deposits returns "a status of `processing`, and sends a payment_intent.processing
-// webhook event"; and, the twin being a test-mode account: "Test transactions settle instantly and are added to your
-// available test balance. This behavior differs from live mode, where transactions can take multiple days to settle"
-// (docs.stripe.com/payments/ach-direct-debit/accept-a-payment?payment-ui=direct-api). A confirm answers processing; the
-// debit succeeds at that same instant of the World's clock, caught up before the next request is answered (as
-// renewals and payouts are). The page's test accounts give each debit its outcome: pm_usBankAccount_success
-// (000123456789) "The payment succeeds"; pm_usBankAccount_processing (000000000009) "The payment stays in processing
-// indefinitely". Where the documentation stops and the twin decides: its Charge is made when it succeeds (the page
-// names none while it processes); the failing test accounts (closed, no account, insufficient funds, debit not
-// authorized, invalid currency, dispute, weekly limit, Radar block) are not modelled and succeed.
-
 /** Whether the method an intent is confirmed with is a bank debit: a us_bank_account PaymentMethod, or one of Stripe's
  *  test bank accounts named as one (pm_usBankAccount_*, pm_us_bank_account). */
 export function isBankDebit(ctx: HandlerContext, method: unknown): boolean {
@@ -2000,7 +1230,7 @@ export async function beginBankDebit(ctx: HandlerContext, id: string, fields: Ro
 }
 
 /** Time's settling of bank debits, caught up to the World's clock: each processing debit whose moment has come succeeds
- *  then, its Charge made (naming the mandate it ran under) and the invoice it collects for paid. */
+ *  then, its Charge made and the invoice it collects for paid. */
 export async function settleBankDebits(ctx: HandlerContext): Promise<void> {
   const now = Number(nowUnix(ctx.occurredAt));
   const due = ctx.rowsRaw(PI).filter((p) => p.status === 'processing' && typeof p._settles_at === 'number' && p._settles_at <= now).sort((a, b) => Number(a._settles_at) - Number(b._settles_at));
@@ -2010,17 +1240,9 @@ export async function settleBankDebits(ctx: HandlerContext): Promise<void> {
     c.legal(PI, 'status', ctx.call.operation.id, 'processing', 'succeeded', id, 'vendor');
     const amount = Number(pi.amount) || 0;
     const charge = await mintCharge(c, id, pi, amount);
-    // the charge names the mandate its bank debit ran under (payment_method_details.us_bank_account.mandate)
-    const details = (c.get('charge', charge)?.payment_method_details ?? null) as Row | null;
-    const kind = typeof details?.type === 'string' ? details.type : undefined;
-    if (details && kind && typeof pi.mandate === 'string') await c.write('charge', charge, { payment_method_details: { ...details, [kind]: { ...((details[kind] as Row | undefined) ?? {}), mandate: pi.mandate } } }, 'charge.mandate');
     const body = await c.write(PI, id, { status: 'succeeded', amount_received: amount, latest_charge: charge, _settles_at: null }, 'payment_intent.succeeded');
-    // a single-use mandate is spent by its payment: "previously used, and may not be used to initiate future payments"
-    const used = typeof pi.mandate === 'string' ? c.get('mandate', pi.mandate) : undefined;
-    if (used && used.type === 'single_use' && used.status === 'active') {
-      c.legal('mandate', 'status', ctx.call.operation.id, 'active', 'inactive', String(used.id), 'vendor');
-      await c.write('mandate', String(used.id), { status: 'inactive' }, 'mandate.updated');
-    }
+    // (a debit run under a mandate names it on its charge, and a single-use mandate is spent by it, at Stripe; the twin
+    // makes no mandate: micro-deposit verification, which accepts one, is the gap here, ../manifest.ts unmodeled)
     await payInvoiceOf(c, body, ctx.call.operation.id, 'vendor');
   }
 }
@@ -2036,17 +1258,20 @@ export async function fundFromCashBalance(ctx: HandlerContext, pi: Row, fields:
   // what the customer's funded cash balance holds in this currency, from its ledger
   const available = customer ? ctx.rows('customer_cash_balance_transaction').filter((t) => t.customer === customer && String(t.currency) === currency).reduce((n, t) => n + (Number(t.net_amount) || 0), 0) : 0;
   const amount = Number(pi.amount) || 0;
-  if (available >= amount) {
-    // the balance pays the intent: its ledger records what was applied
-    await created(ctx, 'customer_cash_balance_transaction', { customer }, { currency, type: 'applied_to_payment', net_amount: -amount, ending_balance: available - amount, applied_to_payment: { payment_intent: String(pi.id) }, livemode: false });
-    const charge = await mintCharge(ctx, String(pi.id), { ...pi, ...fields }, amount);
-    return ctx.write(PI, String(pi.id), { ...fields, status: 'succeeded', next_action: null, amount_received: amount, last_payment_error: null, latest_charge: charge }, 'payment_intent.succeeded');
-  }
+  if (available >= amount) return payFromCashBalance(ctx, pi, fields, { customer, currency, available, amount });
   // not enough yet: the intent waits for the rest, with the instructions to send it
   const next_action = { type: 'display_bank_transfer_instructions', display_bank_transfer_instructions: { amount_remaining: amount - available, currency, type: 'us_bank_transfer' } };
   return ctx.write(PI, String(pi.id), { ...fields, status: 'requires_action', next_action }, 'payment_intent.requires_action');
 }
 
+/** A customer_balance intent the customer's funded cash balance pays: its ledger records what was applied, and the intent
+ *  succeeds with its charge. */
+export async function payFromCashBalance(ctx: HandlerContext, pi: Row, fields: Row, o: { customer: string; currency: string; available: number; amount: number }): Promise<Row> {
+  await created(ctx, 'customer_cash_balance_transaction', { customer: o.customer }, { currency: o.currency, type: 'applied_to_payment', net_amount: -o.amount, ending_balance: o.available - o.amount, applied_to_payment: { payment_intent: String(pi.id) }, livemode: false });
+  const charge = await mintCharge(ctx, String(pi.id), { ...pi, ...fields }, o.amount);
+  return ctx.write(PI, String(pi.id), { ...fields, status: 'succeeded', next_action: null, amount_received: o.amount, last_payment_error: null, latest_charge: charge }, 'payment_intent.succeeded');
+}
+
 /** Whether a charge's funds go straight to the available balance: a bypass card as a raw number, a test name (pm_card_*
  *  or tok_*), or a stored PaymentMethod made from one (which records it as what follows its success, after-payment.ts);
  *  or a US bank account, stored or one of Stripe's test bank accounts named as one (pm_usBankAccount_*). */
@@ -2060,7 +1285,8 @@ export function bypassesPending(ctx: HandlerContext, card: string | undefined):
 }
 
 /** The connected account a request acts for, or undefined for the platform. */
-export const actingAccount = (ctx: HandlerContext): string | undefined => ctx.call.request.headers.get('stripe-account') ?? undefined;
+// The platform's own account ID denotes the same balance as an omitted Stripe-Account header.
+export const actingAccount = (ctx: HandlerContext): string | undefined => { const id = ctx.call.request.headers.get('stripe-account'); return id && id !== PLATFORM_ACCOUNT_ID ? id : undefined; };
 
 /** A ledger entry on an account's balance: the acting account's unless one is named (null names the platform). */
 export async function write(ctx: HandlerContext, fields: Row, account: string | null | undefined = actingAccount(ctx)): Promise<string> {
@@ -2118,12 +1344,6 @@ export async function settleDispute(ctx: HandlerContext, disputeId: string, amou
   });
 }
 
-/** A won dispute's credit, at once: the disputed amount returned (docs.stripe.com/disputes/how-disputes-work). Where the
- *  documentation stops and the twin decides: the dispute fee is not returned. */
-export async function settleDisputeWon(ctx: HandlerContext, disputeId: string, amount: number, currency: string): Promise<string> {
-  return write(ctx, { amount, currency, fee: 0, net: amount, type: 'adjustment', reporting_category: 'dispute_reversal', source: disputeId, available_on: Number(nowUnix(ctx.occurredAt)) });
-}
-
 /** An account's ledger entries an automatic payout has not yet paid out: every entry on its payments balance that no
  *  automatic payout took (the automatic payouts' own debits excluded), as stored. */
 export function unpaidEntries(ctx: HandlerContext, account: string | undefined): Row[] {
@@ -2156,27 +1376,12 @@ export async function settleTransfer(ctx: HandlerContext, transferId: string, am
   return platform;
 }
 
-/** A transfer reversal's two entries: back into the platform's balance, out of the destination's. */
-export async function settleTransferReversal(ctx: HandlerContext, reversalId: string, amount: number, currency: string, destination: string): Promise<string> {
-  const platform = await write(ctx, { amount, currency, fee: 0, net: amount, type: 'transfer_refund', reporting_category: 'transfer_reversal', source: reversalId, available_on: Number(nowUnix(ctx.occurredAt)) }, null);
-  await write(ctx, { amount: -amount, currency, fee: 0, net: -amount, type: 'payment_refund', reporting_category: 'refund', source: reversalId, available_on: Number(nowUnix(ctx.occurredAt)) }, destination);
-  return platform;
-}
-
 /** A direct charge's application fee: out of the connected account's balance, into the platform's. */
 export async function settleApplicationFee(ctx: HandlerContext, feeId: string, amount: number, currency: string, account: string): Promise<string> {
   await write(ctx, { amount: -amount, currency, fee: 0, net: -amount, type: 'application_fee', reporting_category: 'platform_earning', source: feeId, available_on: Number(nowUnix(ctx.occurredAt)) }, account);
   return write(ctx, { amount, currency, fee: 0, net: amount, type: 'application_fee', reporting_category: 'platform_earning', source: feeId, available_on: Number(nowUnix(ctx.occurredAt)) }, null);
 }
 
-/** A top-up's credit, to the payments balance or, with `destination_balance=issuing`, to Issuing's
- *  (docs.stripe.com/issuing/funding/balance). Where the documentation stops and the twin decides: a test-mode top-up
- *  is available at once. */
-export async function settleTopup(ctx: HandlerContext, topupId: string, amount: number, currency: string, destination: string): Promise<string> {
-  const issuing = destination === 'issuing';
-  return write(ctx, { amount, currency, fee: 0, net: amount, type: 'topup', reporting_category: 'topup', source: topupId, available_on: Number(nowUnix(ctx.occurredAt)), balance_type: issuing ? 'issuing' : 'payments' });
-}
-
 /** Time's settlements, written: each entry on the acting account's balance whose funds came due by the World's clock
  *  moves pending → available (the clock's move the machine allows), so a settlement is recorded once. A read already
  *  sees it (asOf); the record is what lets Stripe's balance.available be sent once (./front.ts, the drain).
@@ -2233,96 +1438,23 @@ export function chargeBody(ctx: HandlerContext, c: Row): Row {
   return { ...c, refunds: { object: 'list', data, has_more: false, total_count: data.length, url: `/v1/charges/${String(c.id)}/refunds` } };
 }
 
-/** A Charges-API charge a declining test card refuses: a 402 card_error naming the failed charge Stripe records for the
- *  attempt (docs.stripe.com/declines). */
-export async function declinedCharge(ctx: HandlerContext, decline: { code: string; decline_code?: string; message: string }): Promise<Response> {
-  const params = ctx.params;
-  const failedId = ctx.mint('charge');
-  const amount = Number(params.amount) || 0;
-  await created(ctx, 'charge', { ...withoutCard(params), id: failedId }, {
-    ...chargeDefaults(failedId, amount, false, ctx.occurredAt), status: 'failed', paid: false, captured: false, capture_before: null,
-    failure_code: decline.code, failure_message: decline.message, balance_transaction: null,
-    outcome: { type: 'issuer_declined', network_status: 'declined_by_network', reason: decline.decline_code ?? decline.code, risk_level: 'normal', seller_message: 'The bank did not return any further details with this decline.' },
-    payment_method_details: paymentMethodDetails(ctx, params.payment_method ?? params.source ?? params.card) ?? null,
-  }, { operation: 'charge.failed' });
-  return send(ctx, cardError(decline, { charge: failedId }));
-}
-
-/** A charge's fraud report: "user_report … Assessments reported by you. If set, possible values of are `safe` and
- *  `fraudulent`" (docs.stripe.com/api/charges/object, fraud_details). */
-export function fraudReport(ctx: HandlerContext, existing: Row, fd: Row): Row | Response {
-  const report = String(fd.user_report);
-  if (report !== 'safe' && report !== 'fraudulent') return fail(ctx, "Invalid fraud_details[user_report]: must be 'safe' or 'fraudulent'.", 400, 'parameter_invalid_string_enum');
-  const prior = existing.fraud_details && typeof existing.fraud_details === 'object' ? (existing.fraud_details as Row) : {};
-  return { user_report: report, stripe_report: prior.stripe_report ?? null };
+export const subMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such subscription: '${id}'`, 404, 'resource_missing');
+
+/** A coupon that replaces the subscription's discount, or an empty one that clears it (docs.stripe.com/api/subscriptions/update#update_subscription-discounts). */
+export function replacedDiscounts(ctx: HandlerContext, couponId: string, sub: Row): Row[] | Response {
+  if (couponId === '') return [];
+  const coupon = ctx.get('coupon', couponId);
+  return coupon ? [buildDiscount(coupon, String(sub.customer ?? ''), Number(nowUnix(ctx.occurredAt)), { subscription: String(sub.id) })] : fail(ctx, `No such coupon: '${couponId}'`, 400, 'resource_missing');
 }
 
-/** A capture=false charge refunded while uncaptured: its authorization is released by the refund, as it would be
- *  "automatically refunded if uncaptured" (spec/openapi.json.gz, `capture_before`). The charge stays uncaptured and
- *  becomes refunded in full, a Refund records the release, and no money moves: none was ever received. Written as
- *  charge.refunded. Where the documentation stops and the twin decides: Stripe's basil change ("Partially capturing or
- *  canceling payments no longer creates a Refund", docs.stripe.com/changelog/basil/2025-03-31/remove-refund-from-partial-
- *  capture-and-payment-cancellation-flow) names partial capture and cancellation, not a refund asked for, so a refund
- *  still makes one; its reason is null and it has no balance transaction. Answers the Refund. */
-export async function releaseAuthorization(ctx: HandlerContext, ch: Row, operationId: string, given: Row = {}): Promise<Row> {
-  const id = String(ch.id);
-  const full = Number(ch.amount) || 0;
-  if (ch.refunded !== true) ctx.legal('charge', 'refunded', operationId, 'false', 'true', id);
-  const refund = await created(ctx, 'refund', { ...given, charge: id, amount: full - (Number(ch.amount_refunded) || 0), currency: String(ch.currency ?? 'usd') }, {
-    status: 'succeeded', metadata: {}, reason: null, receipt_number: null,
-    balance_transaction: null, source_transfer_reversal: null, transfer_reversal: null, ...refundDestination(ch, 'reversal'),
-    ...(typeof ch.payment_intent === 'string' ? { payment_intent: ch.payment_intent } : {}),
-  });
-  await ctx.write('charge', id, { amount_refunded: full, refunded: true }, 'charge.refunded');
-  return refund;
-}
-
-/** A PaymentIntent's authorization released by its cancel: "For PaymentIntents with a `status` of `requires_capture`, the
- *  remaining `amount_capturable` is automatically refunded" (docs.stripe.com/api/payment_intents/cancel), and since basil
- *  a cancellation makes no Refund: "`amount_captured` will be 0 instead of `nil` in payment cancellation flows",
- *  "`amount_refunded` will no longer be updated by these actions", "`refunded` will no longer be `true` for payment
- *  cancellation flows", and no charge.refunded is sent (docs.stripe.com/changelog/basil/2025-03-31/remove-refund-from-
- *  partial-capture-and-payment-cancellation-flow). The charge stays uncaptured; nothing is written as an event. */
-export async function cancelAuthorization(ctx: HandlerContext, ch: Row): Promise<Row> {
-  return ctx.write('charge', String(ch.id), { amount_captured: 0 }, 'charge.authorization_released');
-}
-
-/** An authorized charge captured, by the charge's capture or its PaymentIntent's: what is captured credits the balance.
- *  Written as charge.captured, "Occurs whenever a previously uncaptured charge is captured" (docs.stripe.com/api/events/types).
- *  A partial capture releases the rest with no Refund and leaves amount_refunded and refunded as they were: "The following
- *  flows no longer result in a `Refund` object created and linked to the payment: Partial capture", "`amount_refunded`
- *  will no longer be updated by these actions", and "There will only be a single balance transaction for partial captures"
- *  (docs.stripe.com/changelog/basil/2025-03-31/remove-refund-from-partial-capture-and-payment-cancellation-flow).
- *  The caller has asked the machine whether it may capture. */
-export async function captureAuthorization(ctx: HandlerContext, ch: Row, toCapture: number, _operationId: string): Promise<Row> {
-  const id = String(ch.id);
-  const bt = toCapture > 0 ? await settleCharge(ctx, id, toCapture, String(ch.currency ?? 'usd'), String(ch.source ?? ch.payment_method ?? '')) : null;
-  return ctx.write('charge', id, { captured: true, amount_captured: toCapture, balance_transaction: bt }, 'charge.captured');
-}
-
-export const chargeRefund = (ctx: HandlerContext): Row | Response => {
-  if (!ctx.get('charge', at(ctx, 'charge'))) return chargeMissing(ctx, at(ctx, 'charge'));
-  const r = ctx.get('refund', at(ctx, 'refund'));
-  return r && r.charge === at(ctx, 'charge') ? r : fail(ctx, `No such refund: '${at(ctx, 'refund')}'`, 404, 'resource_missing');
-};
-
-export const subMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such subscription: '${id}'`, 404, 'resource_missing');
-
-/** A coupon that replaces the subscription's discount, or an empty one that clears it (docs.stripe.com/api/subscriptions/update#update_subscription-discounts). */
-export function replacedDiscounts(ctx: HandlerContext, couponId: string, sub: Row): Row[] | Response {
-  if (couponId === '') return [];
-  const coupon = ctx.get('coupon', couponId);
-  return coupon ? [buildDiscount(coupon, String(sub.customer ?? ''), Number(nowUnix(ctx.occurredAt)), { subscription: String(sub.id) })] : fail(ctx, `No such coupon: '${couponId}'`, 400, 'resource_missing');
-}
-
-/** A `trial_end` Stripe refuses: the parameter is `"now" | timestamp` (docs.stripe.com/api/subscriptions/update), and a
- *  timestamp that is not in the future answers "Invalid timestamp: must be an integer Unix timestamp in the future."
- *  (Stripe's own message, as its SDKs' users report it: github.com/stripe/stripe-dotnet/issues/805,
- *  github.com/stripe/stripe-ruby/issues/682). Where the documentation stops and the twin decides: a value that is no
- *  number at all, and one more than two years on, answer that same message. */
-export function trialEndRefused(ctx: HandlerContext, value: unknown, now: number): Response | undefined {
-  const t = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/.test(value.trim()) ? Number(value) : NaN;
-  return value === undefined || value === 'now' || (Number.isInteger(t) && t > now && t <= now + MAX_TRIAL) ? undefined : invalidTrialEnd(ctx);
+/** A `trial_end` Stripe refuses: the parameter is `"now" | timestamp` (docs.stripe.com/api/subscriptions/update), and a
+ *  timestamp that is not in the future answers "Invalid timestamp: must be an integer Unix timestamp in the future."
+ *  (Stripe's own message, as its SDKs' users report it: github.com/stripe/stripe-dotnet/issues/805,
+ *  github.com/stripe/stripe-ruby/issues/682). Where the documentation stops and the twin decides: a value that is no
+ *  number at all, and one more than two years on, answer that same message. */
+export function trialEndRefused(ctx: HandlerContext, value: unknown, now: number): Response | undefined {
+  const t = typeof value === 'number' ? value : typeof value === 'string' && /^\d+$/.test(value.trim()) ? Number(value) : NaN;
+  return value === undefined || value === 'now' || (Number.isInteger(t) && t > now && t <= now + MAX_TRIAL) ? undefined : invalidTrialEnd(ctx);
 }
 
 export function invalidTrialEnd(ctx: HandlerContext): Response {
@@ -2362,7 +1494,7 @@ export async function applyTrialEnd(ctx: HandlerContext, sub: Row, fields: Row,
   const id = String(sub.id);
   if (value !== 'now' || sub.status !== 'trialing') return value === 'now' ? undefined : movedTrial(sub, fields, Number(value), now);
   // the period's invoice bills the items as this update leaves them, under its discount
-  const next: Row = { ...sub, ...fields, items: ctx.get(SUB, id)?.items ?? sub.items };
+  const next: Row = { ...sub, ...fields, items: resourceView(ctx, SUB, id)?.items ?? sub.items };
   const { interval, interval_count } = resolveSubscriptionBillingInterval(((next.items as { data?: Row[] } | undefined)?.data) ?? [], finder(ctx));
   const period = { start: now, end: addBillingInterval(now, interval, interval_count) };
   const invoice = await draftSubscriptionInvoice(ctx, next, { ...period, reason: 'subscription_update' });
@@ -2500,7 +1632,7 @@ export async function writeItemChanges(ctx: HandlerContext, subId: string, entri
     const metadata = entry.metadata && typeof entry.metadata === 'object' ? { metadata: entry.metadata } : {};
     if (typeof entry.id === 'string' && entry.id) {
       if (asBool(entry.deleted)) { await ctx.write('subscription_item', entry.id, { deleted: true }, 'subscription_item.delete'); continue; }
-      await ctx.write('subscription_item', entry.id, { ...(priceRef ? subscriptionItemPrice(priceRef, finder(ctx)) : {}), ...quantity, ...metadata }, 'subscription_item.update');
+      await ctx.write('subscription_item', entry.id, { ...(priceRef ? { price: priceRef } : {}), ...quantity, ...metadata }, 'subscription_item.update');
     } else {
       await created(ctx, 'subscription_item', { subscription: subId, ...subscriptionItemPrice(priceRef, finder(ctx)), quantity: 1, ...quantity, ...metadata }, { livemode: false, metadata: {}, discounts: [], tax_rates: [], billing_thresholds: null });
     }
@@ -2540,24 +1672,16 @@ export async function inlinePrice(ctx: HandlerContext, d: Row): Promise<string>
 export async function storeItems(ctx: HandlerContext, subId: string, items: Row[]): Promise<void> {
   for (const item of items) {
     if (typeof item.id !== 'string' || ctx.get('subscription_item', item.id)) continue;
-    await ctx.write('subscription_item', item.id, { ...item, subscription: subId }, 'subscription_item.create');
+    const { plan: _plan, price, ...fields } = item;
+    await ctx.write('subscription_item', item.id, { ...fields, price: typeof price === 'object' && price ? (price as Row).id : price, subscription: subId }, 'subscription_item.create');
   }
 }
 
 export async function syncItems(ctx: HandlerContext, subId: string): Promise<void> {
   if (!subId) return;
-  const items = ctx.rows('subscription_item').filter((r) => r.subscription === subId);
-  await ctx.write(SUB, subId, { items: { object: 'list', data: items, has_more: false, total_count: items.length, url: `/v1/subscription_items?subscription=${subId}` } }, 'subscription.items_synced');
+  await ctx.write(SUB, subId, {}, 'subscription.items_synced');
 }
 
-/** A subscription item with its billing period: its subscription's (basil moved the period onto the items). */
-export const withPeriod = (ctx: HandlerContext, si: Row): Row => {
-  const sub = ctx.get(SUB, String(si.subscription));
-  return { ...si, current_period_start: si.current_period_start ?? sub?.current_period_start ?? null, current_period_end: si.current_period_end ?? sub?.current_period_end ?? null };
-};
-
-export const subscriptionsItemMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such subscription_item: '${id}'`, 404, 'resource_missing');
-
 export const listMissing = (ctx: HandlerContext, id: string, status = 404): Response => fail(ctx, `No such radar value list: '${id}'`, status, 'resource_missing');
 
 /** A value list's list_items, "List of items contained within this value list" (the served spec), kept in step with
@@ -2567,25 +1691,9 @@ export async function radarSyncItems(ctx: HandlerContext, listId: string): Promi
   await ctx.write(VL, listId, { list_items: { object: 'list', data, has_more: false, url: `/v1/radar/value_list_items?value_list=${listId}` } }, 'radar.value_list.items_synced');
 }
 
-/** A requested move of a state field the machine declares, legal or refused; a value the machine
- *  does not name is written as given, as the hand-written route did. */
-export function requestedMove(ctx: HandlerContext, resource: string, operationId: string, current: unknown, values: string[]): Response | undefined {
-  const to = ctx.params.status;
-  if (typeof to !== 'string' || !values.includes(to)) return undefined;
-  const refused = ctx.legal(resource, 'status', operationId, current, to);
-  return refused ? ctx.refuse(refused) : undefined;
-}
-
-// ── authorizations ──
-
 /** An authorization as every egress carries it: its card embedded in full. */
 export function withCard(ctx: HandlerContext, a: Row): Row {
-  const out = { ...a };
-  if (typeof out.card === 'string') {
-    const card = ctx.get(CARD, out.card);
-    if (card) out.card = card;
-  }
-  return out;
+  return ctx.expand(AUTH, a);
 }
 
 export const authMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such authorization: '${id}'`, 404, 'resource_missing');
@@ -2637,7 +1745,7 @@ export function issuingDecide(approved: boolean): Handler {
     if (!auth) return authMissing(ctx, id);
     const finalized = { status: 400, code: 'authorization_already_finalized', message: `This authorization has already been finalized (status ${String(auth.status)}).` };
     // a webhook-approved authorization is decided, though still pending
-    if (auth.approved === true) return ctx.refuse(finalized);
+    if (auth.approved === true && auth.status === 'pending') return ctx.refuse(finalized);
     const refused = ctx.legal(AUTH, 'status', approved ? 'PostIssuingAuthorizationsAuthorizationApprove' : 'PostIssuingAuthorizationsAuthorizationDecline', auth.status, undefined, id);
     if (refused) return ctx.refuse(refused);
     // a partial approval only for an amount-controllable presentment, and never a credit
@@ -2650,7 +1758,7 @@ export function issuingDecide(approved: boolean): Handler {
     // (docs.stripe.com/issuing/purchases/authorizations, docs.stripe.com/issuing/funding/balance)
     const hold = approved ? await holdFor(ctx, id, decidedAmount, currency) : null;
     return ctx.reply(withCard(ctx, await ctx.write(AUTH, id, {
-        ...(approved ? {} : { status: 'closed' }), approved, pending_request: null,
+        status: approved ? 'pending' : 'closed', approved, pending_request: null,
         ...(approved && ctx.params.amount !== undefined ? { amount: decidedAmount } : {}),
         request_history: [...history, historyEntry({
           amount: decidedAmount, currency, approved, reason: approved ? 'webhook_approved' : 'webhook_declined', reasonMessage: null,
@@ -2721,31 +1829,209 @@ export async function answeredByEndpoint(ctx: HandlerContext, outcome: { kind: '
   return outcome.kind === 'declined' ? o.decline('webhook_declined', null) : o.decline('webhook_error', outcome.message);
 }
 
-// ── disputes: opened against a transaction, unsubmitted until submitted ──
+/** Time's settling of held refunds, caught up to the World's clock: each refund held for want of balance, oldest first,
+ *  is made at the first moment the account's available balance covers it (the funds that come due then), its debit
+ *  written then, as `refund.updated`. Where the documentation stops and the twin decides: a held refund is made the
+ *  moment the balance covers it. */
+export async function settleHeldRefunds(ctx: HandlerContext): Promise<void> {
+  const now = Number(nowUnix(ctx.occurredAt));
+  const heldRefunds = ctx.rowsRaw('refund').filter((r) => r.status === 'pending' && r.pending_reason === 'insufficient_funds').sort((a, b) => Number(a.created) - Number(b.created));
+  for (const r of heldRefunds) await settleOneHeldRefund(ctx, r, now);
+}
+
+/** A pending refund can enter this surface only through the vendor-backed refund refresh. */
+export async function settleOneHeldRefund(ctx: HandlerContext, r: Row, now: number): Promise<void> {
+    const account = typeof r._account === 'string' ? r._account : undefined;
+    const currency = String(r.currency ?? 'usd');
+    const amount = Number(r.amount) || 0;
+    const when = [Number(r.created), ...fundsDueBetween(ctx, account, currency, Number(r.created), now)].find((t) => availableAt(ctx, account, currency, t) >= amount);
+    if (when === undefined) return;
+    const c = await at_(ctx)(when);
+    c.legal('refund', 'status', ctx.call.operation.id, 'pending', 'succeeded', String(r.id), 'vendor');
+    const bt = await settleRefund(c, String(r.id), amount, currency, account ?? null);
+    await c.write('refund', String(r.id), { status: 'succeeded', pending_reason: null, balance_transaction: bt }, 'refund.updated');
+}
+
+export const accountMissing = (ctx: HandlerContext, id: string, status = 404): Response => fail(ctx, `No such account: '${id}'`, status, 'resource_missing');
+
+/** The account, tombstones included where the hand-written routes looked past a deletion. */
+export const accountRow = (ctx: HandlerContext, id: string): Row | undefined => ctx.row('account', id, { withDeleted: true });
 
-export const disputeMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such dispute: '${id}'`, 404, 'resource_missing');
+/** Stripe's review of a Custom account once the platform gives it something: with nothing left due, its requested
+ *  capabilities become active and it can take charges and receive payouts; with something due again (its bank account
+ *  removed), they stop. Where the documentation stops and the twin decides: test-mode verification is immediate, and
+ *  it owes what customRequirements lists. An Express or Standard account is onboarded on Stripe's own pages. */
+export async function connectReview(ctx: HandlerContext, id: string): Promise<void> {
+  const account = resourceView(ctx, 'account', id);
+  if (account && account.type === 'custom') await reviewCustom(ctx, id, account);
+}
 
-// ── personalization designs: in review until Stripe's review (the test helpers in test mode) decides ──
+/** The review of a Custom account (see review). */
+export async function reviewCustom(ctx: HandlerContext, id: string, account: Row): Promise<void> {
+  const bank = ctx.rows('external_account').some((e) => e.account === id);
+  const persons = ctx.rows('person').filter((p) => p.account === id);
+  const { now: due, later } = customRequirements(account, bank, persons);
+  // one account, one review: "If a connected account has both card_payments and transfers, and the status of either one
+  // is inactive, then both capabilities are disabled" (docs.stripe.com/connect/account-capabilities)
+  const ready = due.length === 0;
+  const capabilities: Row = {};
+  for (const [key, was] of Object.entries((account.capabilities as Row | undefined) ?? {})) {
+    const to = ready ? 'active' : 'inactive';
+    // Capabilities are entries of the account's map, not standalone stored subjects.
+    capabilities[key] = to;
+  }
+  const requirements = { ...((account.requirements as Row | undefined) ?? {}), currently_due: due, eventually_due: [...due, ...later], past_due: [], disabled_reason: ready ? null : 'requirements.past_due', current_deadline: null };
+  await ctx.write('account', id, { capabilities, requirements, charges_enabled: ready, payouts_enabled: ready, details_submitted: ready }, ready ? 'account.updated' : 'account.update');
+}
 
-export const designMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such personalization design: '${id}'`, 404, 'resource_missing');
+/** A transfer to an account whose transfers capability is not active. */
+export function transfersInactive(ctx: HandlerContext): Response {
+  return ctx.refuse({ status: 400, code: 'insufficient_capabilities_for_transfer', param: 'destination', message: 'Your destination account needs to have at least one of the following capabilities enabled: transfers, crypto_transfers, legacy_payments' });
+}
 
-export function review(action: 'activate' | 'deactivate' | 'reject', operationId: string): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'personalization_design');
-    const d = ctx.get(PD, id);
-    if (!d) return designMissing(ctx, id);
-    const refused = ctx.legal(PD, 'status', operationId, d.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    const status = action === 'activate' ? 'active' : action === 'deactivate' ? 'inactive' : 'rejected';
-    // a rejection records its reasons: the reject helper's required rejection_reasons, "The reason(s) the
-    // personalization design was rejected" (the served spec), per card_logo and carrier_text
-    const given = ctx.params.rejection_reasons && typeof ctx.params.rejection_reasons === 'object' ? (ctx.params.rejection_reasons as Row) : undefined;
-    if (action === 'reject' && !given) return fail(ctx, 'Missing required param: rejection_reasons.', 400, 'parameter_missing');
-    const reasons = action === 'reject' ? { rejection_reasons: { card_logo: Array.isArray(given!.card_logo) ? given!.card_logo : [], carrier_text: Array.isArray(given!.carrier_text) ? given!.carrier_text : [] } } : {};
-    return ctx.reply(await ctx.write(PD, id, { status, ...reasons }, `personalization_design.${action}`));
-  };
+/** A transfer from a charge whose funds have settled: "With a source_transaction, the transfer request returns success
+ *  regardless of your available balance if the related charge hasn't settled yet" (docs.stripe.com/connect/separate-
+ *  charges-and-transfers), so a settled one comes out of the available balance. */
+export function settledSourceRefused(ctx: HandlerContext, amount: number, currency: string): Response | undefined {
+  return refusePayout(ctx, amount, currency, undefined);
 }
 
+/** An earlier version's payment_method_types refused: the first value that names no payment method type the
+ *  operation takes, in the intent's words or (a Checkout Session) the enum's. */
+export function unknownMethodType(ctx: HandlerContext, opId: string, given: unknown): Response | undefined {
+  const values = Array.isArray(given) ? given : given && typeof given === 'object' ? Object.values(given) : [given];
+  const checkout = opId === 'PostCheckoutSessions';
+  const known = checkout ? CHECKOUT_METHOD_TYPES : PAYMENT_METHOD_TYPES;
+  const i = values.findIndex((v) => !known.includes(String(v)));
+  if (i < 0) return undefined;
+  if (checkout) {
+    const param = `payment_method_types[${i}]`;
+    return ctx.refuse({ status: 400, param, message: `Invalid ${param}: must be one of ${oneOf(known)}` });
+  }
+  const doc = TYPES_DOC[opId.startsWith('PostSetupIntents') ? 'setup_intents' : 'payment_intents'];
+  return ctx.refuse({ status: 400, param: 'payment_method_types', message: `The payment method type "${String(values[i])}" is invalid. See ${doc} for the full list of supported payment method types.` });
+}
+
+/** payment_method_types refused where the caller's version removed it. */
+export const noLongerSupported = (ctx: HandlerContext, version: string): Response =>
+  ctx.refuse({ status: 400, code: 'payment_method_types_no_longer_supported', param: 'payment_method_types', message: `payment_method_types is no longer supported in API version ${version}. Use allowed_payment_method_types, or dynamic payment methods, instead.` });
+
+/** Stripe's refusal of a request whose top-level parameters the operation does not take, or undefined. */
+export function refuseParameters(ctx: HandlerContext): Response | undefined {
+  const op = OPS.get(ctx.call.operation.id);
+  if (!op) return undefined;
+  const pinned = ctx.call.request.headers.get('stripe-version');
+  const params = ctx.params;
+  if (pinned && pinned < SERVED_VERSION) {
+    if (!TYPED.has(op.id)) return undefined;
+    if (params.payment_method_types === undefined) return undefined;
+    if (REMOVED_TYPES.has(op.id) && methodTypesRemoved(pinned)) return noLongerSupported(ctx, pinned);
+    return unknownMethodType(ctx, op.id, params.payment_method_types);
+  }
+  const method = ctx.call.request.method.toUpperCase();
+  const known = new Set([...(op.query ?? []), ...(op.body ?? [])].map((p) => p.name).concat(DOCUMENTED[op.id] ?? []));
+  if (REMOVED_TYPES.has(op.id) && params.payment_method_types !== undefined) return noLongerSupported(ctx, pinned ?? SERVED_VERSION);
+  for (const name of Object.keys(params)) {
+    if (!known.has(name)) return ctx.refuse({ status: 400, code: 'parameter_unknown', param: name, message: `Received unknown parameter: ${name}` });
+  }
+  const required = method === 'GET' || method === 'DELETE' ? (op.query ?? []) : (op.body ?? []);
+  for (const p of required) {
+    if (p.required && params[p.name] === undefined) return ctx.refuse({ status: 400, code: 'parameter_missing', param: p.name, message: `Missing required param: ${p.name}.` });
+  }
+  return undefined;
+}
+
+/** An answer in the shape of the API version the caller is served (./version.ts), a webhook endpoint's `secret` shown
+ *  only at its creation ("Only returned at creation", docs.stripe.com/api/webhook_endpoints/object). */
+export async function rendered(request: Request, res: Response): Promise<Response> {
+  const creates = request.method === 'POST' && new URL(request.url).pathname.replace(/\/+$/, '') === '/v1/webhook_endpoints';
+  const pinned = request.headers.get('stripe-version');
+  if (!(res.headers.get('content-type') ?? '').includes('json')) return res;
+  if (!servesCurrent(pinned) && creates) return res;
+  const expand = await expandOf(request.clone());
+  const body = await res.json();
+  const answered = creates ? body : withoutEndpointSecret(body);
+  return new Response(JSON.stringify(servesCurrent(pinned) ? render(answered, pinned, expand) : answered), { status: res.status, statusText: res.statusText, headers: res.headers });
+}
+
+
+
+/** Write a draft's line list and the totals derived from it. */
+export async function writeLines(ctx: HandlerContext, invoiceId: string, next: Row[]): Promise<Row> {
+  const subtotal = sumLines(next);
+  const lines = { object: 'list', data: next, has_more: false, total_count: next.length, url: `/v1/invoices/${invoiceId}/lines` };
+  return ctx.write(INV, invoiceId, { lines, subtotal, total: subtotal, amount_due: subtotal, amount_remaining: subtotal }, 'invoice.update');
+}
+
+
+
+/** A customer's pending invoice item, made before the invoice, pulled onto it (docs.stripe.com/api/invoices/create#create_invoice-pending_invoice_items_behavior). */
+export async function pullPendingItem(ctx: HandlerContext, invoiceId: string, inv: Row, item: Row, now: number): Promise<void> {
+  const current = ctx.get(INV, invoiceId) ?? inv;
+  await writeLines(ctx, invoiceId, [...linesOf(current), {
+    id: `il_${String(item.id)}`, object: 'line_item', type: 'invoiceitem', amount: Number(item.amount) || 0, currency: String(current.currency ?? item.currency ?? 'usd'),
+    quantity: Number(item.quantity) || 1, proration: false, invoice_item: item.id, price: item.price ?? null,
+    period: item.period ?? { start: now, end: now }, description: (item.description as string) ?? null,
+    discountable: item.discountable ?? true, discounts: [], livemode: false, metadata: item.metadata ?? {}, tax_amounts: [], tax_rates: [],
+  }]);
+  await ctx.write('invoiceitem', String(item.id), { invoice: invoiceId }, 'invoiceitem.update');
+}
+
+
+
+/** The intent the path names, and the machine's refusal when this operation may not move it. */
+export function paymentIntentsLoad(ctx: HandlerContext, operationId: string): { pi: Record<string, unknown> } | { answer: Response } {
+  const pi = ctx.id ? ctx.get(PI, ctx.id) : undefined;
+  if (!pi) return { answer: ctx.notFound(PI, String(ctx.id)) };
+  const refusal = ctx.legal(PI, 'status', operationId, pi.status);
+  return refusal ? { answer: ctx.refuse(refusal) } : { pi };
+}
+
+
+
+/** A transfer reversal's two entries: back into the platform's balance, out of the destination's. */
+export async function settleTransferReversal(ctx: HandlerContext, reversalId: string, amount: number, currency: string, destination: string): Promise<string> {
+  const platform = await write(ctx, { amount, currency, fee: 0, net: amount, type: 'transfer_refund', reporting_category: 'transfer_reversal', source: reversalId, available_on: Number(nowUnix(ctx.occurredAt)) }, null);
+  await write(ctx, { amount: -amount, currency, fee: 0, net: -amount, type: 'payment_refund', reporting_category: 'refund', source: reversalId, available_on: Number(nowUnix(ctx.occurredAt)) }, destination);
+  return platform;
+}
+
+
+
+/** A capture=false charge refunded while uncaptured: its authorization is released by the refund, as it would be
+ *  "automatically refunded if uncaptured" (spec/openapi.json.gz, `capture_before`). The charge stays uncaptured and
+ *  becomes refunded in full, a Refund records the release, and no money moves: none was ever received. Written as
+ *  charge.refunded. Where the documentation stops and the twin decides: Stripe's basil change ("Partially capturing or
+ *  canceling payments no longer creates a Refund", docs.stripe.com/changelog/basil/2025-03-31/remove-refund-from-partial-
+ *  capture-and-payment-cancellation-flow) names partial capture and cancellation, not a refund asked for, so a refund
+ *  still makes one; its reason is null and it has no balance transaction. Answers the Refund. */
+export async function releaseAuthorization(ctx: HandlerContext, ch: Row, operationId: string, given: Row = {}): Promise<Row> {
+  const id = String(ch.id);
+  const full = Number(ch.amount) || 0;
+  if (ch.refunded !== true) ctx.legal('charge', 'refunded', operationId, 'false', 'true', id);
+  const refund = await created(ctx, 'refund', { ...given, charge: id, amount: full - (Number(ch.amount_refunded) || 0), currency: String(ch.currency ?? 'usd') }, {
+    status: 'succeeded', metadata: {}, reason: null, receipt_number: null,
+    balance_transaction: null, source_transfer_reversal: null, transfer_reversal: null, ...refundDestination(ch, 'reversal'),
+    ...(typeof ch.payment_intent === 'string' ? { payment_intent: ch.payment_intent } : {}),
+  });
+  await ctx.write('charge', id, { amount_refunded: full, refunded: true }, 'charge.refunded');
+  return refund;
+}
+
+
+
+/** A PaymentIntent's authorization released by its cancel: "For PaymentIntents with a `status` of `requires_capture`, the
+ *  remaining `amount_capturable` is automatically refunded" (docs.stripe.com/api/payment_intents/cancel), and since basil
+ *  a cancellation makes no Refund: "`amount_captured` will be 0 instead of `nil` in payment cancellation flows",
+ *  "`amount_refunded` will no longer be updated by these actions", "`refunded` will no longer be `true` for payment
+ *  cancellation flows", and no charge.refunded is sent (docs.stripe.com/changelog/basil/2025-03-31/remove-refund-from-
+ *  partial-capture-and-payment-cancellation-flow). The charge stays uncaptured; nothing is written as an event. */
+export async function cancelAuthorization(ctx: HandlerContext, ch: Row): Promise<Row> {
+  return ctx.write('charge', String(ch.id), { amount_captured: 0 }, 'charge.authorization_released');
+}
+
+
+
 /**
  * Create a refund and land it on its charge. An omitted amount is the whole remaining balance. The
  * charge's write records `charge.refunded`, the event Stripe sends carrying the charge's new totals;
@@ -2756,6 +2042,8 @@ export function badReason(ctx: HandlerContext): Response {
   return fail(ctx, `Invalid refund reason: must be one of ${[...REFUND_REASONS].join(', ')}.`, 400, 'parameter_invalid_string_enum');
 }
 
+
+
 /** A bank-transfer payment refunded with origin=customer_balance goes back to the cash balance
  *  (docs.stripe.com/payments/customer-balance/refunding). */
 export async function backToCashBalance(ctx: HandlerContext, customer: string, currency: string, amount: number, refundId: string): Promise<void> {
@@ -2763,6 +2051,8 @@ export async function backToCashBalance(ctx: HandlerContext, customer: string, c
   await created(ctx, 'customer_cash_balance_transaction', { customer }, { currency, type: 'refunded_from_payment', net_amount: amount, ending_balance: before + amount, refunded_from_payment: { refund: refundId }, livemode: false });
 }
 
+
+
 /** A capture=false charge's refund, which releases its whole authorization (see the header). */
 export async function refundUncaptured(ctx: HandlerContext, charge: Row, amount: number, remaining: number, params: Row): Promise<Response> {
   if (amount < remaining) return fail(ctx, `Charge ${String(charge.id)} is uncaptured: refunding it releases the whole authorization (${remaining}).`, 400, 'amount_too_small');
@@ -2770,6 +2060,8 @@ export async function refundUncaptured(ctx: HandlerContext, charge: Row, amount:
   return ctx.reply(await releaseAuthorization(ctx, charge, ctx.call.operation.id, { ...(reason !== undefined ? { reason } : {}), ...(metadata !== undefined ? { metadata } : {}) }));
 }
 
+
+
 export async function refundCharge(ctx: HandlerContext, charge: Row, params: Row): Promise<Response> {
   const chargeId = String(charge.id);
   const total = Number(charge.amount) || 0;
@@ -2856,25 +2148,7 @@ export async function refundCharge(ctx: HandlerContext, charge: Row, params: Row
   return ctx.reply(body);
 }
 
-/** Time's settling of held refunds, caught up to the World's clock: each refund held for want of balance, oldest first,
- *  is made at the first moment the account's available balance covers it (the funds that come due then), its debit
- *  written then, as `refund.updated`. Where the documentation stops and the twin decides: a held refund is made the
- *  moment the balance covers it. */
-export async function settleHeldRefunds(ctx: HandlerContext): Promise<void> {
-  const now = Number(nowUnix(ctx.occurredAt));
-  const heldRefunds = ctx.rowsRaw('refund').filter((r) => r.status === 'pending' && r.pending_reason === 'insufficient_funds').sort((a, b) => Number(a.created) - Number(b.created));
-  for (const r of heldRefunds) {
-    const account = typeof r._account === 'string' ? r._account : undefined;
-    const currency = String(r.currency ?? 'usd');
-    const amount = Number(r.amount) || 0;
-    const when = [Number(r.created), ...fundsDueBetween(ctx, account, currency, Number(r.created), now)].find((t) => availableAt(ctx, account, currency, t) >= amount);
-    if (when === undefined) continue;
-    const c = await at_(ctx)(when);
-    c.legal('refund', 'status', ctx.call.operation.id, 'pending', 'succeeded', String(r.id), 'vendor');
-    const bt = await settleRefund(c, String(r.id), amount, currency, account ?? null);
-    await c.write('refund', String(r.id), { status: 'succeeded', pending_reason: null, balance_transaction: bt }, 'refund.updated');
-  }
-}
+
 
 /** The charge a refund aims at: named directly, or reached through its PaymentIntent. */
 export function target(ctx: HandlerContext): Row | Response {
@@ -2889,324 +2163,18 @@ export function target(ctx: HandlerContext): Row | Response {
   return ch ?? fail(ctx, `This PaymentIntent does not have a successful charge to refund. Its status is ${String(pi.status)}.`, 400, 'payment_intent_unexpected_state');
 }
 
-export const refundMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such refund: '${id}'`, 404, 'resource_missing');
-
-/** Each advancing clock whose advance has taken its time reaches its target, caught up before anything is answered:
- *  its frozen_time moves, it is ready, and its customers' trials and periods that ended by then end
- *  (./renewals.ts advanceBilling). The advance's own write is when it began (the kernel's updatedAt). */
-export async function finishClockAdvances(ctx: HandlerContext): Promise<void> {
-  const now = Number(nowUnix(ctx.occurredAt));
-  for (const clock of ctx.rowsRaw(CLOCK)) {
-    if (clock.status !== 'advancing') continue;
-    if (Date.parse(String(clock.updatedAt)) / 1000 + ADVANCE_SECONDS > now) continue;
-    const id = String(clock.id);
-    const target = Number((clock.status_details as { advancing?: { target_frozen_time?: number } } | undefined)?.advancing?.target_frozen_time);
-    ctx.legal(CLOCK, 'status', ctx.call.operation.id, 'advancing', 'ready', id, 'vendor');
-    await ctx.write(CLOCK, id, { frozen_time: target, status: 'ready', status_details: {} }, 'test_clock.ready');
-    await advanceBilling(ctx, (sub) => typeof sub.customer === 'string' && ctx.get('customer', sub.customer)?.test_clock === id);
-  }
-}
-
-/** What the platform saved, or the settings a new platform starts with (OAuth off, no redirect URI). */
-export function connectOAuthSettings(ctx: Pick<HandlerContext, 'rowsRaw'>): ConnectOAuthSettings {
-  const row = ctx.rowsRaw(SETTINGS).find((r) => r.id === PLATFORM_CLIENT_ID);
-  return { oauth_enabled: row?.oauth_enabled === true, redirect_uris: Array.isArray(row?.redirect_uris) ? (row!.redirect_uris as string[]) : [] };
-}
-
-export const accountMissing = (ctx: HandlerContext, id: string, status = 404): Response => fail(ctx, `No such account: '${id}'`, status, 'resource_missing');
-
-/** The account, tombstones included where the hand-written routes looked past a deletion. */
-export const accountRow = (ctx: HandlerContext, id: string): Row | undefined => ctx.row('account', id, { withDeleted: true });
-
-/** Stripe's review of a Custom account once the platform gives it something: with nothing left due, its requested
- *  capabilities become active and it can take charges and receive payouts; with something due again (its bank account
- *  removed), they stop. Where the documentation stops and the twin decides: test-mode verification is immediate, and
- *  it owes what customRequirements lists. An Express or Standard account is onboarded on Stripe's own pages. */
-export async function connectReview(ctx: HandlerContext, id: string): Promise<void> {
-  const account = ctx.get('account', id);
-  if (account && account.type === 'custom') await reviewCustom(ctx, id, account);
-}
-
-/** The review of a Custom account (see review). */
-export async function reviewCustom(ctx: HandlerContext, id: string, account: Row): Promise<void> {
-  const bank = ctx.rows('external_account').some((e) => e.account === id);
-  const persons = ctx.rows('person').filter((p) => p.account === id);
-  const { now: due, later } = customRequirements(account, bank, persons);
-  // one account, one review: "If a connected account has both card_payments and transfers, and the status of either one
-  // is inactive, then both capabilities are disabled" (docs.stripe.com/connect/account-capabilities)
-  const ready = due.length === 0;
-  const capabilities: Row = {};
-  for (const [key, was] of Object.entries((account.capabilities as Row | undefined) ?? {})) {
-    const to = ready ? 'active' : 'inactive';
-    // Stripe's review moves each capability, as the machine declares it may
-    if (was !== to) ctx.legal('capability', 'status', ctx.call.operation.id, String(was), to, key, 'vendor');
-    capabilities[key] = to;
-  }
-  const requirements = { ...((account.requirements as Row | undefined) ?? {}), currently_due: due, eventually_due: [...due, ...later], past_due: [], disabled_reason: ready ? null : 'requirements.past_due', current_deadline: null };
-  await ctx.write('account', id, { capabilities, requirements, charges_enabled: ready, payouts_enabled: ready, details_submitted: ready }, ready ? 'account.updated' : 'account.update');
-}
-
-// ── persons on an account ──
-
-export const personMissing = (ctx: HandlerContext): Response => fail(ctx, `No such person: '${at(ctx, 'person')}'`, 404, 'resource_missing');
-
-export const accountPerson = (ctx: HandlerContext): Row | undefined => {
-  const p = ctx.get('person', at(ctx, 'person'));
-  return p && p.account === at(ctx, 'account') ? p : undefined;
-};
-
-// ── external accounts: a payout destination from a token or a bank_account hash ──
-
-export const externalMissing = (ctx: HandlerContext): Response => fail(ctx, `No such external account: '${at(ctx, 'id')}'`, 404, 'resource_missing');
-
-export const accountExternal = (ctx: HandlerContext): Row | undefined => {
-  const e = ctx.get('external_account', at(ctx, 'id'));
-  return e && e.account === at(ctx, 'account') ? e : undefined;
-};
-
-/** Whether the platform may create, update or delete an account's external accounts: "A platform can create, update, or
- *  delete external accounts only for connected accounts without access to either the full Stripe or Express Dashboard
- *  and where the platform is responsible for negative balances" (docs.stripe.com/connect/payouts-bank-accounts); it can
- *  still view an Express account's ("A platform can view the external accounts of connected accounts that don’t have
- *  access to the full Stripe Dashboard"). Where the documentation stops and the twin decides: the refusal. Stripe's
- *  pages give no error code for it; the twin answers 403, which the errors page gives as "The API key doesn’t have
- *  permissions to perform the request" (docs.stripe.com/api/errors), with the twin's own wording. The create page says
- *  it too: "You can only specify connected accounts where account.controller.requirement_collection is `application`"
- *  (docs.stripe.com/api/external_account_bank_accounts/create). */
-export function refuseExternalWrite(ctx: HandlerContext, account: string): Response | undefined {
-  const row = accountRow(ctx, account);
-  const controller = (row?.controller as Row | undefined) ?? controllerOf(String(row?.type ?? 'standard'));
-  const dashboard = String(((controller.stripe_dashboard as Row | undefined)?.type) ?? '');
-  const losses = String(((controller.losses as Row | undefined)?.payments) ?? '');
-  if (dashboard === 'none' && losses === 'application') return undefined;
-  return ctx.refuse({ status: 403, message: `This application does not have the required permissions to manage the external accounts of account '${account}': they can only be managed through the account's ${dashboard === 'express' ? 'Express' : 'Stripe'} Dashboard.` });
-}
-
-/** Update and delete by id, finding tombstones as the hand-written routes did, with Stripe's own operation names. */
-export function patch(resource: string, param: string, missing: string, op: string): Handler {
-  return (ctx) => patchRow(ctx, resource, param, missing, op);
-}
-
-export async function patchRow(ctx: HandlerContext, resource: string, param: string, missing: string, op: string): Promise<Response> {
-  const id = at(ctx, param);
-  if (!ctx.row(resource, id, { withDeleted: true })) return fail(ctx, `No such ${missing}: '${id}'`, 404, 'resource_missing');
-  return ctx.reply(await ctx.write(resource, id, ctx.params, op));
-}
-
-// A reader's update takes its label and metadata only; it moves to another location by registering it
-// there again (https://docs.stripe.com/api/terminal/readers/update, docs.stripe.com/terminal/fleet/locations-and-zones)
-// (the parameter check refuses anything else, as Stripe does: ./params.ts)
-export const updateReader: Handler = patch(READER, 'reader', 'reader', 'terminal_reader.updated');
-
-export function remove(resource: string, param: string, missing: string, op: string, object: string): Handler {
-  return async (ctx) => {
-    const id = at(ctx, param);
-    if (!ctx.row(resource, id, { withDeleted: true })) return fail(ctx, `No such ${missing}: '${id}'`, 404, 'resource_missing');
-    const row = ctx.get(resource, id);
-    await ctx.write(resource, id, { deleted: true }, op);
-    // a deleted reader still says what device it was
-    return ctx.reply({ id, object, deleted: true, ...(object === 'terminal.reader' && row ? { device_type: row.device_type, serial_number: row.serial_number } : {}) });
-  };
-}
-
-export const readerMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such reader: '${id}'`, 404, 'resource_missing');
-
-/** A card presented to a reader with no payment in progress. */
-export function nothingToPresent(ctx: HandlerContext): Response {
-  return fail(ctx, 'This reader has no in-progress payment to present a payment method to.', 400, 'terminal_reader_invalid_state');
-}
-
-/** Under manual capture the presented card only holds the amount (docs.stripe.com/terminal/payments/collect-card-payment#capture-payment):
- *  the hold is an uncaptured charge, as an online authorization's is (authorizeCharge), which the intent's capture takes. */
-export async function holdForCapture(ctx: HandlerContext, piId: string, pi: Record<string, unknown>, pm: string, amount: number): Promise<void> {
-  const charge = await authorizeCharge(ctx, piId, { ...pi, payment_method: pm }, amount);
-  await ctx.write('payment_intent', piId, { status: 'requires_capture', payment_method: pm, amount_capturable: amount, latest_charge: charge }, 'payment_intent.amount_capturable_updated');
-}
-
-/** Time's settling of top-ups, caught up to the World's clock: a pending top-up succeeds on its expected_availability_date,
- *  its funds entered then in the balance it names. */
-export async function settleTopups(ctx: HandlerContext): Promise<void> {
-  const now = Number(nowUnix(ctx.occurredAt));
-  for (const t of ctx.rowsRaw('topup')) {
-    if (t.status !== 'pending' || Number(t.expected_availability_date) > now) continue;
-    const c = await at_(ctx)(Number(t.expected_availability_date));
-    c.legal('topup', 'status', ctx.call.operation.id, 'pending', 'succeeded', String(t.id), 'vendor');
-    const bt = await settleTopup(c, String(t.id), Number(t.amount), String(t.currency), t.destination_balance === 'issuing' ? 'issuing' : 'payments');
-    await c.write('topup', String(t.id), { status: 'succeeded', balance_transaction: bt }, 'topup.succeeded');
-  }
-}
-
-export const disputesDisputeMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such dispute: '${id}'`, 404, 'resource_missing');
-
-/** Evidence staged without submitting it (submit=false), or on a dispute already under review or decided. */
-export async function keepEvidence(ctx: HandlerContext, id: string, fields: Row): Promise<Response> {
-  return ctx.reply(await ctx.write('dispute', id, fields, 'dispute.update'));
-}
-
-export const meterMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such meter: '${id}'`, 404, 'resource_missing');
-
-export function activation(kind: 'deactivate' | 'reactivate'): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'id');
-    const m = ctx.get(METER, id);
-    if (!m) return meterMissing(ctx, id);
-    const refused = ctx.legal(METER, 'status', kind === 'deactivate' ? 'PostBillingMetersIdDeactivate' : 'PostBillingMetersIdReactivate', m.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    const fields = { ...(kind === 'deactivate' ? { status: 'inactive', status_transitions: { deactivated_at: nowUnix(ctx.occurredAt) } } : { status: 'active', status_transitions: { deactivated_at: null } }), updated: nowUnix(ctx.occurredAt) };
-    return ctx.reply(await ctx.write(METER, id, fields, `billing_meter.${kind}`));
-  };
-}
-
-export const grantMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such credit grant: '${id}'`, 404, 'resource_missing');
 
-// expiring or voiding a grant stamps the instant; it no longer counts toward the balance
-export function endGrant(kind: 'expire' | 'void'): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'id');
-    if (!ctx.get(GRANT, id)) return grantMissing(ctx, id);
-    return ctx.reply(await ctx.write(GRANT, id, { ...(kind === 'void' ? { voided_at: nowUnix(ctx.occurredAt) } : { expires_at: nowUnix(ctx.occurredAt) }), updated: nowUnix(ctx.occurredAt) }, `credit_grant.${kind}`));
-  };
-}
-
-export function alertMove(kind: 'activate' | 'deactivate' | 'archive', operationId: string): Handler {
-  return async (ctx) => {
-    const id = at(ctx, 'id');
-    const a = ctx.get(ALERT, id);
-    if (!a) return fail(ctx, `No such alert: '${id}'`, 404, 'resource_missing');
-    const refused = ctx.legal(ALERT, 'status', operationId, a.status, undefined, id);
-    if (refused) return ctx.refuse(refused);
-    const status = kind === 'activate' ? 'active' : kind === 'deactivate' ? 'inactive' : 'archived';
-    return ctx.reply(await ctx.write(ALERT, id, { status }, `billing_alert.${kind}`));
+/** A pending invoice item contributes to a preview only on its customer's next invoice. */
+// source: spec:PostInvoicesCreatePreview "including subscription renewal charges, invoice item charges, etc."
+export function pendingPreviewItem(ii: Row, customer: string, currency: string, now: number): Row | undefined {
+  if (ii.customer !== customer || ii.invoice) return undefined;
+  return {
+    id: `il_${String(ii.id)}`, object: 'line_item', type: 'invoiceitem', amount: Number(ii.amount) || 0, currency,
+    quantity: Number(ii.quantity) || 1, proration: false, invoice_item: ii.id,
+    period: ii.period ?? { start: now, end: now }, description: (ii.description as string) ?? null,
   };
 }
 
-export const transferMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such transfer: '${id}'`, 404, 'resource_missing');
-
-/** A transfer to an account whose transfers capability is not active. */
-export function transfersInactive(ctx: HandlerContext): Response {
-  return ctx.refuse({ status: 400, code: 'insufficient_capabilities_for_transfer', param: 'destination', message: 'Your destination account needs to have at least one of the following capabilities enabled: transfers, crypto_transfers, legacy_payments' });
-}
-
-/** A transfer from a charge whose funds have settled: "With a source_transaction, the transfer request returns success
- *  regardless of your available balance if the related charge hasn't settled yet" (docs.stripe.com/connect/separate-
- *  charges-and-transfers), so a settled one comes out of the available balance. */
-export function settledSourceRefused(ctx: HandlerContext, amount: number, currency: string): Response | undefined {
-  return refusePayout(ctx, amount, currency, undefined);
-}
-
-/** An application fee refunded to its whole through its own refunds endpoint: the fee machine's move, or its refusal. */
-export function feeFullyRefunded(ctx: HandlerContext, resource: string, flag: string, id: string): Response | undefined {
-  const refused = ctx.legal(resource, flag, ctx.call.operation.id, 'false', 'true', id);
-  return refused ? ctx.refuse(refused) : undefined;
-}
-
-/** Take `amount` (the remainder by default) back out of a parent's total, as a child row appended to its list. */
-export async function giveBack(ctx: HandlerContext, o: {
-  parent: Row; parentResource: string; child: string; childFields: (amount: number) => Row; childDefaults: Row;
-  doneField: string; flag: string; listUrl: string; op: string; tooLarge: (remaining: number) => string;
-  /** what the money movement itself writes, once the child exists */
-  settle?: (child: Row, amount: number) => Promise<void>;
-}): Promise<Response> {
-  const id = String(o.parent.id);
-  const total = Number(o.parent.amount ?? 0);
-  const already = Number(o.parent[o.doneField] ?? 0);
-  const remaining = total - already;
-  const amount = ctx.params.amount !== undefined ? Math.trunc(Number(ctx.params.amount) || 0) : remaining;
-  if (amount <= 0 || amount > remaining) return fail(ctx, o.tooLarge(remaining), 400, 'amount_too_large');
-  const done = already + amount;
-  // a fee refunded in full is `refunded`: the application fee machine's move (a transfer's `reversed` is no state)
-  const feeRefusal = o.parentResource === 'application_fee' && done >= total && o.parent[o.flag] !== true ? feeFullyRefunded(ctx, o.parentResource, o.flag, id) : undefined;
-  if (feeRefusal) return feeRefusal;
-  // the `metadata` a reversal or a fee refund is created with is its own ("Set of key-value pairs that you can attach to
-  // an object", docs.stripe.com/api/transfer_reversals/create, docs.stripe.com/api/fee_refunds/create)
-  const metadata = ctx.params.metadata && typeof ctx.params.metadata === 'object' ? { metadata: ctx.params.metadata } : {};
-  const child = await created(ctx, o.child, { ...o.childFields(amount), ...metadata }, o.childDefaults);
-  if (o.settle) await o.settle(child, amount);
-  const existing = (o.parent[o.flag === 'reversed' ? 'reversals' : 'refunds'] as Row) ?? { object: 'list', data: [], has_more: false, total_count: 0 };
-  const data = [...((existing.data as unknown[]) ?? []), child];
-  await ctx.write(o.parentResource, id, {
-    [o.doneField]: done, [o.flag]: done >= total,
-    [o.flag === 'reversed' ? 'reversals' : 'refunds']: { ...existing, data, total_count: data.length, url: o.listUrl },
-  }, o.op);
-  return ctx.reply(child);
-}
-
-export const feeMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such application fee: '${id}'`, 404, 'resource_missing');
-
-/** An earlier version's payment_method_types refused: the first value that names no payment method type the
- *  operation takes, in the intent's words or (a Checkout Session) the enum's. */
-export function unknownMethodType(ctx: HandlerContext, opId: string, given: unknown): Response | undefined {
-  const values = Array.isArray(given) ? given : given && typeof given === 'object' ? Object.values(given) : [given];
-  const checkout = opId === 'PostCheckoutSessions';
-  const known = checkout ? CHECKOUT_METHOD_TYPES : PAYMENT_METHOD_TYPES;
-  const i = values.findIndex((v) => !known.includes(String(v)));
-  if (i < 0) return undefined;
-  if (checkout) {
-    const param = `payment_method_types[${i}]`;
-    return ctx.refuse({ status: 400, param, message: `Invalid ${param}: must be one of ${oneOf(known)}` });
-  }
-  const doc = TYPES_DOC[opId.startsWith('PostSetupIntents') ? 'setup_intents' : 'payment_intents'];
-  return ctx.refuse({ status: 400, param: 'payment_method_types', message: `The payment method type "${String(values[i])}" is invalid. See ${doc} for the full list of supported payment method types.` });
-}
-
-/** payment_method_types refused where the caller's version removed it. */
-export const noLongerSupported = (ctx: HandlerContext, version: string): Response =>
-  ctx.refuse({ status: 400, code: 'payment_method_types_no_longer_supported', param: 'payment_method_types', message: `payment_method_types is no longer supported in API version ${version}. Use allowed_payment_method_types, or dynamic payment methods, instead.` });
-
-/** Stripe's refusal of a request whose top-level parameters the operation does not take, or undefined. */
-export function refuseParameters(ctx: HandlerContext): Response | undefined {
-  const op = OPS.get(ctx.call.operation.id);
-  if (!op) return undefined;
-  const pinned = ctx.call.request.headers.get('stripe-version');
-  const params = ctx.params;
-  if (pinned && pinned < SERVED_VERSION) {
-    if (!TYPED.has(op.id)) return undefined;
-    if (params.payment_method_types === undefined) return undefined;
-    if (REMOVED_TYPES.has(op.id) && methodTypesRemoved(pinned)) return noLongerSupported(ctx, pinned);
-    return unknownMethodType(ctx, op.id, params.payment_method_types);
-  }
-  const method = ctx.call.request.method.toUpperCase();
-  const known = new Set([...(op.query ?? []), ...(op.body ?? [])].map((p) => p.name).concat(DOCUMENTED[op.id] ?? []));
-  if (REMOVED_TYPES.has(op.id) && params.payment_method_types !== undefined) return noLongerSupported(ctx, pinned ?? SERVED_VERSION);
-  for (const name of Object.keys(params)) {
-    if (!known.has(name)) return ctx.refuse({ status: 400, code: 'parameter_unknown', param: name, message: `Received unknown parameter: ${name}` });
-  }
-  const required = method === 'GET' || method === 'DELETE' ? (op.query ?? []) : (op.body ?? []);
-  for (const p of required) {
-    if (p.required && params[p.name] === undefined) return ctx.refuse({ status: 400, code: 'parameter_missing', param: p.name, message: `Missing required param: ${p.name}.` });
-  }
-  return undefined;
-}
-
-/** A file's links, kept in step with the links made to it, at the address Stripe lists them
- *  (/v1/file_links?file=…, the File object's example). */
-export async function syncLinks(ctx: HandlerContext, fileId: string): Promise<void> {
-  const data = newest(ctx, 'file_link').filter((l) => l.file === fileId);
-  await ctx.write('file', fileId, { links: { object: 'list', data, has_more: false, url: `/v1/file_links?file=${fileId}` } }, 'file.links_synced');
-}
-
-// ── calculations: each line's tax on top of its amount; no `created`, a tax_date instead ──
-
-export const calcMissing = (ctx: HandlerContext, id: string): Response => fail(ctx, `No such tax calculation: '${id}'`, 404, 'resource_missing');
-
-/** A page of the line items a stored object carries. */
-export function taxLinePage(ctx: HandlerContext, holder: Row): Response {
-  const li = holder.line_items as { data?: Row[] } | undefined;
-  const { page, hasMore } = paginate(Array.isArray(li?.data) ? li!.data! : [], ctx.params);
-  return ctx.reply({ object: 'list', url: path(ctx), has_more: hasMore, data: page });
-}
-
-export const txMissing = (ctx: HandlerContext, id: string, status = 404): Response => fail(ctx, `No such tax transaction: '${id}'`, status, 'resource_missing');
-
-/** An answer in the shape of the API version the caller is served (./version.ts), a webhook endpoint's `secret` shown
- *  only at its creation ("Only returned at creation", docs.stripe.com/api/webhook_endpoints/object). */
-export async function rendered(request: Request, res: Response): Promise<Response> {
-  const creates = request.method === 'POST' && new URL(request.url).pathname.replace(/\/+$/, '') === '/v1/webhook_endpoints';
-  const pinned = request.headers.get('stripe-version');
-  if (!(res.headers.get('content-type') ?? '').includes('json')) return res;
-  if (!servesCurrent(pinned) && creates) return res;
-  const expand = await expandOf(request.clone());
-  const body = await res.json();
-  const answered = creates ? body : withoutEndpointSecret(body);
-  return new Response(JSON.stringify(servesCurrent(pinned) ? render(answered, pinned, expand) : answered), { status: res.status, statusText: res.statusText, headers: res.headers });
+export function pendingPreviewLines(ctx: HandlerContext, customer: string, currency: string, now: number): Row[] {
+  return newest(ctx, 'invoiceitem', 'date').flatMap(ii => { const line = pendingPreviewItem(ii, customer, currency, now); return line ? [line] : []; });
 }