@weft-js/pay 0.1.1 → 0.1.4

package/src/square.ts

@@ -0,0 +1,231 @@
+// Square's signature is base64 HMAC-SHA256 of `<notification URL><raw body>` with the subscription's signature key, in
+// `x-square-hmacsha256-signature`. It carries no time, so a replay is stopped by the ledger's event ids. A payment's event
+// doesn't carry the order's metadata, so after the signature checks out the rail reads the order once to learn who and what.
+// Square sells one-time payments here: subscriptions and a customer portal are Stripe's (PAY022).
+
+import {
+  PayError,
+  type CheckoutLine,
+  type CheckoutRequest,
+  type PayRail,
+  type PurchaseState,
+  type RailEvent,
+} from './index'
+
+/** Options of `squareRail()`. Secrets default to the environment, which is where they belong. */
+export interface SquareOptions {
+  /** `sandbox` talks to squareupsandbox.com. Default `process.env.SQUARE_ENV`, else production. */
+  environment?: 'sandbox' | 'production'
+  /** The API's origin: point it at a local mock. Default from `environment`. */
+  api?: string
+  /** Pinned, so an account's default version can't reshape these calls. */
+  apiVersion?: string
+  /** Default `process.env.SQUARE_ACCESS_TOKEN`. */
+  accessToken?: string
+  /** Default `process.env.SQUARE_LOCATION_ID`: the shop the payments land in. */
+  locationId?: string
+  /** Default `process.env.SQUARE_WEBHOOK_SIGNATURE_KEY`. */
+  signatureKey?: string
+  /** The exact URL given to Square for the webhook; it's part of what's signed. Default `process.env.SQUARE_WEBHOOK_URL`. */
+  notificationUrl?: string
+  /** Default the global one. */
+  fetch?: typeof fetch
+}
+
+interface Money {
+  amount?: number
+  currency?: string
+}
+interface SquarePayment {
+  id: string
+  order_id?: string
+  status?: string
+  updated_at?: string
+  created_at?: string
+  customer_id?: string
+  total_money?: Money
+  amount_money?: Money
+  refunded_money?: Money
+}
+interface SquareEvent {
+  event_id?: string
+  type?: string
+  created_at?: string
+  data?: { object?: { payment?: SquarePayment } }
+}
+
+const PAYMENT: Record<string, PurchaseState> = {
+  APPROVED: 'pending',
+  PENDING: 'pending',
+  COMPLETED: 'active',
+  CANCELED: 'expired',
+  FAILED: 'expired',
+}
+
+const encoder = new TextEncoder()
+const env = (name: string) => (typeof process === 'undefined' ? undefined : process.env[name])
+
+async function signatureOk(key: string, text: string, given: string) {
+  const k = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(key),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['verify'],
+  )
+  let bytes: Uint8Array<ArrayBuffer>
+  try {
+    bytes = Uint8Array.from(atob(given), (c) => c.charCodeAt(0))
+  } catch {
+    return false
+  }
+  return crypto.subtle.verify('HMAC', k, bytes, encoder.encode(text))
+}
+
+/** One Square payment as a ledger state: a whole refund is final, a part refund keeps what was bought. */
+function stateOf(p: SquarePayment): PurchaseState | null {
+  const paid = p.total_money?.amount ?? p.amount_money?.amount ?? 0
+  if (p.refunded_money?.amount && paid && p.refunded_money.amount >= paid) return 'refunded'
+  return PAYMENT[p.status ?? ''] ?? null
+}
+
+function squareCall(options: SquareOptions, fetcher: typeof fetch) {
+  const sandbox = (options.environment ?? env('SQUARE_ENV')) === 'sandbox'
+  const api =
+    options.api ??
+    (sandbox ? 'https://connect.squareupsandbox.com' : 'https://connect.squareup.com')
+  const version = options.apiVersion ?? '2025-10-16'
+  return async function call(path: string, body?: unknown) {
+    const token = options.accessToken ?? env('SQUARE_ACCESS_TOKEN')
+    if (!token) throw new PayError('PAY003', '`SQUARE_ACCESS_TOKEN` is not set on the server', 500)
+    const res = await fetcher(`${api}${path}`, {
+      method: body === undefined ? 'GET' : 'POST',
+      headers: {
+        authorization: `Bearer ${token}`,
+        'content-type': 'application/json',
+        'square-version': version,
+      },
+      ...(body !== undefined && { body: JSON.stringify(body) }),
+    })
+    const data = (await res.json().catch(() => null)) as Record<string, unknown> | null
+    if (!res.ok) {
+      const errors = (data?.errors as { detail?: string }[] | undefined) ?? []
+      throw new PayError(
+        'PAY030',
+        `Square refused ${path}: ${errors[0]?.detail ?? res.status}`,
+        res.status === 429 ? 503 : 502,
+      )
+    }
+    return data ?? {}
+  }
+}
+
+const upper = (c: string) => c.toUpperCase()
+const lineItem = (l: CheckoutLine) => ({
+  name: l.name,
+  quantity: String(l.quantity),
+  base_price_money: { amount: l.amount, currency: upper(l.currency) },
+})
+
+type Call = ReturnType<typeof squareCall>
+
+/** One payment link for a checkout's lines, with the metadata its order carries back to `verify`. */
+async function paymentLink(call: Call, options: SquareOptions, request: CheckoutRequest) {
+  const { line, user } = request
+  if (line.mode !== 'payment')
+    throw new PayError(
+      'PAY022',
+      'The Square rail takes one-time payments: sell subscriptions with Stripe',
+      501,
+    )
+  const location = options.locationId ?? env('SQUARE_LOCATION_ID')
+  if (!location) throw new PayError('PAY003', '`SQUARE_LOCATION_ID` is not set on the server', 500)
+  const data = (await call('/v2/online-checkout/payment-links', {
+    idempotency_key: request.idempotencyKey.slice(0, 45),
+    order: {
+      location_id: location,
+      ...(line.plan && line.product === 'order' && { reference_id: line.plan.slice(0, 40) }),
+      line_items: (request.lines ?? [line]).map(lineItem),
+      metadata: {
+        weft_user: user.slice(0, 255),
+        weft_product: line.product,
+        ...(line.plan && { weft_plan: line.plan }),
+      },
+    },
+    checkout_options: { redirect_url: request.successUrl },
+    ...(request.email && { pre_populated_data: { buyer_email: request.email } }),
+  })) as { payment_link?: { url?: string } }
+  const url = data.payment_link?.url
+  if (typeof url !== 'string')
+    throw new PayError('PAY030', 'Square answered a link with no url', 502)
+  return { url }
+}
+
+/** The Square `pay.rail` provider: hosted payment links and webhooks verified here. One-time payments only. */
+export function squareRail(options: SquareOptions = {}): PayRail {
+  const fetcher = options.fetch ?? ((...args: Parameters<typeof fetch>) => fetch(...args))
+  const call = squareCall(options, fetcher)
+
+  async function identity(orderId: string) {
+    const { order } = (await call(`/v2/orders/${encodeURIComponent(orderId)}`)) as {
+      order?: { metadata?: Record<string, string> }
+    }
+    const m = order?.metadata ?? {}
+    return {
+      ...(m.weft_user && { user: m.weft_user }),
+      ...(m.weft_product && { product: m.weft_product }),
+      ...(m.weft_plan && { plan: m.weft_plan }),
+    }
+  }
+
+  return {
+    id: 'square',
+    modes: ['payment'],
+    checkout: (request) => paymentLink(call, options, request),
+    portal() {
+      return Promise.reject(
+        new PayError('PAY022', 'Square has no customer portal: a buyer manages nothing here', 501),
+      )
+    },
+    async verify({ body, headers }) {
+      const key = options.signatureKey ?? env('SQUARE_WEBHOOK_SIGNATURE_KEY')
+      const url = options.notificationUrl ?? env('SQUARE_WEBHOOK_URL')
+      if (!key || !url)
+        throw new PayError(
+          'PAY011',
+          '`SQUARE_WEBHOOK_SIGNATURE_KEY` and `SQUARE_WEBHOOK_URL` must both be set: refusing every webhook rather than trusting one',
+        )
+      const given = headers.get('x-square-hmacsha256-signature') ?? ''
+      if (!given || !(await signatureOk(key, url + body, given)))
+        throw new PayError('PAY011', 'the signature does not match this body and URL')
+      const event = JSON.parse(body) as SquareEvent
+      const p = event.data?.object?.payment
+      if (!event.event_id || !p?.order_id || !event.type?.startsWith('payment.')) return []
+      const state = stateOf(p)
+      if (!state) return []
+      const at = Date.parse(p.updated_at ?? event.created_at ?? '') || Date.now()
+      const out: RailEvent = {
+        id: event.event_id,
+        at,
+        purchase: p.order_id,
+        state,
+        ...(await identity(p.order_id)),
+        ...(p.customer_id && { customer: p.customer_id }),
+      }
+      return [out]
+    },
+    async refund({ purchase }) {
+      const { order } = (await call(`/v2/orders/${encodeURIComponent(purchase)}`)) as {
+        order?: { tenders?: { payment_id?: string }[]; total_money?: Money }
+      }
+      const payment = order?.tenders?.[0]?.payment_id
+      if (!payment || !order?.total_money)
+        throw new PayError('PAY024', `order \`${purchase}\` has no payment to refund`, 404)
+      await call('/v2/refunds', {
+        idempotency_key: `refund-${purchase}`.slice(0, 45),
+        payment_id: payment,
+        amount_money: order.total_money,
+      })
+    },
+  }
+}

package/src/stripe.ts

@@ -1,12 +1,14 @@
-// `pay.rail@1` on Stripe (research 10 §5): hosted Checkout and the customer portal, over `fetch` with no SDK, and webhooks
-// checked here rather than left to the app. Nothing runs in the browser: `checkout` is a redirect, so a page needs neither
-// Stripe.js nor a publishable key.
-//
 // Stripe's signature is HMAC-SHA256 of `<t>.<raw body>`, in a header `t=…,v1=…` that can carry several `v1` while a secret
 // rolls. Stripe has no ordering guarantee, so each event carries the object's `created` or the event's own time, and the
 // ledger orders by that. A price is the catalog's unless `prices` maps `pro.month` to a Stripe id, on the server.
 
-import { PayError, type CheckoutRequest, type PayRail, type PurchaseState, type RailEvent } from './index'
+import {
+  PayError,
+  type CheckoutLine,
+  type PayRail,
+  type PurchaseState,
+  type RailEvent,
+} from './index'
 
 /** Options of `stripeRail()`. The keys default to the environment, which is where they belong. */
 export interface StripeOptions {
@@ -29,22 +31,36 @@ export interface StripeOptions {
 }
 
 const STATES: Record<string, PurchaseState> = {
-  active: 'active', trialing: 'trial', past_due: 'grace', unpaid: 'billing-retry', paused: 'paused', canceled: 'expired', incomplete_expired: 'expired', incomplete: 'pending',
+  active: 'active',
+  trialing: 'trial',
+  past_due: 'grace',
+  unpaid: 'billing-retry',
+  paused: 'paused',
+  canceled: 'expired',
+  incomplete_expired: 'expired',
+  incomplete: 'pending',
 }
 
 const API = 'https://api.stripe.com'
 const encoder = new TextEncoder()
 
-const fromHex = (s: string) => (/^[0-9a-f]{64}$/.test(s) ? Uint8Array.from(s.match(/../g)!, b => parseInt(b, 16)) : undefined)
+const fromHex = (s: string) =>
+  /^[0-9a-f]{64}$/.test(s) ? Uint8Array.from(s.match(/../g)!, (b) => parseInt(b, 16)) : undefined
 
-/** The runtime's own constant-time compare, in native code. A wasm build was measured against it: see research 38. */
+/** The runtime's constant-time compare. */
 async function verified(secret: string, text: string, signatures: string[]) {
-  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify'])
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['verify'],
+  )
   const message = encoder.encode(text)
   let ok = false
   for (const s of signatures) {
     const bytes = fromHex(s)
-    if (bytes && await crypto.subtle.verify('HMAC', key, bytes, message)) ok = true
+    if (bytes && (await crypto.subtle.verify('HMAC', key, bytes, message))) ok = true
   }
   return ok
 }
@@ -76,17 +92,28 @@ interface StripeObject {
   current_period_end?: number | null
   items?: { data?: { current_period_end?: number | null }[] } | null
 }
-interface StripeEvent { id?: string; type: string; created: number; data?: { object?: StripeObject } }
+interface StripeEvent {
+  id?: string
+  type: string
+  created: number
+  data?: { object?: StripeObject }
+}
 
 /** A reference that Stripe expands into its object on some API versions. */
-const id = (x: unknown): string | undefined => (typeof x === 'string' ? x : (x as { id?: string } | null | undefined)?.id)
+const id = (x: unknown): string | undefined =>
+  typeof x === 'string' ? x : (x as { id?: string } | null | undefined)?.id
 const identity = (object: StripeObject) => {
   const m = object?.metadata ?? {}
-  return { ...(m.weft_user && { user: m.weft_user }), ...(m.weft_product && { product: m.weft_product }), ...(m.weft_plan && { plan: m.weft_plan }) }
+  return {
+    ...(m.weft_user && { user: m.weft_user }),
+    ...(m.weft_product && { product: m.weft_product }),
+    ...(m.weft_plan && { plan: m.weft_plan }),
+  }
 }
 
 /** A subscription's paid-through time, which moved onto its items in 2025 API versions. */
-const periodEnd = (sub: StripeObject) => seconds(sub.current_period_end ?? sub.items?.data?.[0]?.current_period_end)
+const periodEnd = (sub: StripeObject) =>
+  seconds(sub.current_period_end ?? sub.items?.data?.[0]?.current_period_end)
 
 /** One Stripe event as the ledger's, or null for one that says nothing about access. */
 function normalise(event: StripeEvent): RailEvent | null {
@@ -99,19 +126,36 @@ function normalise(event: StripeEvent): RailEvent | null {
     if (!state) return null
     const customer = id(object.customer)
     const expires = periodEnd(object)
-    return { ...base, purchase: object.id, state, ...identity(object), ...(customer && { customer }), ...(expires && { expires }) }
+    return {
+      ...base,
+      purchase: object.id,
+      state,
+      ...identity(object),
+      ...(customer && { customer }),
+      ...(expires && { expires }),
+    }
   }
-  if (type === 'checkout.session.completed' || type === 'checkout.session.async_payment_succeeded' || type === 'checkout.session.async_payment_failed') {
+  if (
+    type === 'checkout.session.completed' ||
+    type === 'checkout.session.async_payment_succeeded' ||
+    type === 'checkout.session.async_payment_failed'
+  ) {
     if (object.mode !== 'payment') return null // `customer.subscription.*` says what a subscription is doing, trial included
     const purchase = id(object.payment_intent)
     if (!purchase) return null
     const customer = id(object.customer)
-    const state: PurchaseState = type.endsWith('failed') ? 'expired' : object.payment_status === 'unpaid' ? 'pending' : 'active'
+    const state: PurchaseState = type.endsWith('failed')
+      ? 'expired'
+      : object.payment_status === 'unpaid'
+        ? 'pending'
+        : 'active'
     return { ...base, purchase, state, ...identity(object), ...(customer && { customer }) }
   }
   if (type === 'charge.refunded') {
     const purchase = id(object.payment_intent)
-    return purchase && object.refunded ? { ...base, purchase, state: 'refunded', ...identity(object) } : null // `refunded` is whole: a part refund keeps what was bought
+    return purchase && object.refunded
+      ? { ...base, purchase, state: 'refunded', ...identity(object) }
+      : null // `refunded` is whole: a part refund keeps what was bought
   }
   if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
     const purchase = id(object.payment_intent)
@@ -122,34 +166,92 @@ function normalise(event: StripeEvent): RailEvent | null {
   return null
 }
 
-/** The Stripe `pay.rail` provider: hosted Checkout, the customer portal, and webhooks verified here. */
-export function stripeRail(options: StripeOptions = {}): PayRail {
-  const { prices = {}, api = API, apiVersion = '2025-09-30.clover', tolerance = 300 } = options
-  const fetcher = options.fetch ?? ((...args: Parameters<typeof fetch>) => fetch(...args))
+function stripeCall(
+  options: StripeOptions,
+  api: string,
+  apiVersion: string,
+  fetcher: typeof fetch,
+) {
   const secret = () => {
     const key = options.secretKey ?? process.env.STRIPE_SECRET_KEY
     if (!key) throw new PayError('PAY003', '`STRIPE_SECRET_KEY` is not set on the server', 500)
-    if (api === API && /placeholder/i.test(key)) throw new PayError('PAY003', '`STRIPE_SECRET_KEY` is still the placeholder `weft add pay` wrote: nothing was sent to Stripe', 500) // a mock may take one
+    if (api === API && /placeholder/i.test(key))
+      throw new PayError(
+        'PAY003',
+        '`STRIPE_SECRET_KEY` is still the placeholder `weft add pay` wrote: nothing was sent to Stripe',
+        500,
+      ) // a mock may take one
     return key
   }
 
   async function call(path: string, body: Record<string, unknown>, idempotencyKey?: string) {
     const res = await fetcher(`${api}${path}`, {
       method: 'POST',
-      headers: { authorization: `Bearer ${secret()}`, 'content-type': 'application/x-www-form-urlencoded', 'stripe-version': apiVersion, ...(idempotencyKey && { 'idempotency-key': idempotencyKey }) },
+      headers: {
+        authorization: `Bearer ${secret()}`,
+        'content-type': 'application/x-www-form-urlencoded',
+        'stripe-version': apiVersion,
+        ...(idempotencyKey && { 'idempotency-key': idempotencyKey }),
+      },
       body: form(body),
     })
-    const data = await res.json().catch(() => null) as { url?: string; error?: { message?: string } } | null
-    if (!res.ok) throw new PayError('PAY030', `Stripe refused ${path}: ${data?.error?.message ?? res.status}`, res.status === 429 ? 503 : 502)
+    const data = (await res.json().catch(() => null)) as {
+      url?: string
+      error?: { message?: string }
+    } | null
+    if (!res.ok)
+      throw new PayError(
+        'PAY030',
+        `Stripe refused ${path}: ${data?.error?.message ?? res.status}`,
+        res.status === 429 ? 503 : 502,
+      )
     return data
   }
 
-  function lineItem({ line }: CheckoutRequest) {
+  return call
+}
+
+async function verifyStripe(
+  options: StripeOptions,
+  tolerance: number,
+  { body, headers }: Parameters<PayRail['verify']>[0],
+) {
+  const signing = options.webhookSecret ?? process.env.STRIPE_WEBHOOK_SECRET
+  if (!signing)
+    throw new PayError(
+      'PAY011',
+      '`STRIPE_WEBHOOK_SECRET` is not set: refusing every webhook rather than trusting one',
+    )
+  const parts = (headers.get('stripe-signature') ?? '').split(',').map((p) => p.trim().split('='))
+  const t = Number(parts.find(([k]) => k === 't')?.[1])
+  const given = parts.filter(([k]) => k === 'v1').map(([, v]) => v ?? '')
+  if (!Number.isInteger(t) || !given.length)
+    throw new PayError('PAY011', 'no `stripe-signature` to check')
+  if (!(await verified(signing, `${t}.${body}`, given)))
+    throw new PayError('PAY011', 'the signature does not match this body')
+  if (Math.abs(Date.now() / 1000 - t) > tolerance)
+    throw new PayError('PAY011', 'the signature is too old: a replay, or a clock adrift')
+  const event = normalise(JSON.parse(body) as StripeEvent)
+  return event ? [event] : []
+}
+
+/** The Stripe `pay.rail` provider: hosted Checkout, the customer portal, and webhooks verified here. */
+export function stripeRail(options: StripeOptions = {}): PayRail {
+  const { prices = {}, api = API, apiVersion = '2025-09-30.clover', tolerance = 300 } = options
+  const fetcher = options.fetch ?? ((...args: Parameters<typeof fetch>) => fetch(...args))
+  const call = stripeCall(options, api, apiVersion, fetcher)
+
+  function lineItem(line: CheckoutLine) {
     const known = prices[line.plan ? `${line.product}.${line.plan}` : line.product]
     if (known) return { price: known, quantity: line.quantity }
     return {
       quantity: line.quantity,
-      price_data: { currency: line.currency, unit_amount: line.amount, product_data: { name: line.name }, ...(line.interval && { recurring: { interval: line.interval } }) },
+      price_data: {
+        currency: line.currency,
+        unit_amount: line.amount,
+        product_data: { name: line.name },
+        ...(line.interval && { recurring: { interval: line.interval } }),
+      },
     }
   }
 
@@ -157,41 +259,53 @@ export function stripeRail(options: StripeOptions = {}): PayRail {
     id: 'stripe',
     async checkout(request) {
       const { line, user, customer } = request
-      const metadata = { weft_user: user, weft_product: line.product, ...(line.plan && { weft_plan: line.plan }) }
-      const session = await call('/v1/checkout/sessions', {
-        mode: line.mode,
-        line_items: [lineItem(request)],
-        success_url: request.successUrl,
-        cancel_url: request.cancelUrl,
-        client_reference_id: user,
-        customer,
-        metadata,
-        // What the later events carry: a charge and a subscription don't inherit the session's metadata.
-        ...(line.mode === 'subscription'
-          ? { subscription_data: { metadata, trial_period_days: line.trialDays } }
-          : { payment_intent_data: { metadata }, customer_creation: customer ? undefined : 'always', ...(line.shipping && { shipping_address_collection: { allowed_countries: options.shippingCountries ?? ['US', 'CA'] } }) }),
-      }, request.idempotencyKey)
-      if (typeof session?.url !== 'string') throw new PayError('PAY030', 'Stripe answered a session with no url', 502)
+      const metadata = {
+        weft_user: user,
+        weft_product: line.product,
+        ...(line.plan && { weft_plan: line.plan }),
+      }
+      const session = await call(
+        '/v1/checkout/sessions',
+        {
+          mode: line.mode,
+          line_items: (request.lines ?? [line]).map(lineItem),
+          success_url: request.successUrl,
+          cancel_url: request.cancelUrl,
+          client_reference_id: user,
+          customer,
+          customer_email: customer ? undefined : request.email,
+          metadata,
+          // What the later events carry: a charge and a subscription don't inherit the session's metadata.
+          ...(line.mode === 'subscription'
+            ? { subscription_data: { metadata, trial_period_days: line.trialDays } }
+            : {
+                payment_intent_data: { metadata },
+                customer_creation: customer ? undefined : 'always',
+                ...(line.shipping && {
+                  shipping_address_collection: {
+                    allowed_countries: options.shippingCountries ?? ['US', 'CA'],
+                  },
+                }),
+              }),
+        },
+        request.idempotencyKey,
+      )
+      if (typeof session?.url !== 'string')
+        throw new PayError('PAY030', 'Stripe answered a session with no url', 502)
       return { url: session.url }
     },
     async portal({ customer, returnUrl }) {
       const session = await call('/v1/billing_portal/sessions', { customer, return_url: returnUrl })
       return { url: session!.url! }
     },
-    async verify({ body, headers }) {
-      const signing = options.webhookSecret ?? process.env.STRIPE_WEBHOOK_SECRET
-      if (!signing) throw new PayError('PAY011', '`STRIPE_WEBHOOK_SECRET` is not set: refusing every webhook rather than trusting one')
-      const parts = (headers.get('stripe-signature') ?? '').split(',').map(p => p.trim().split('='))
-      const t = Number(parts.find(([k]) => k === 't')?.[1])
-      const given = parts.filter(([k]) => k === 'v1').map(([, v]) => v ?? '')
-      if (!Number.isInteger(t) || !given.length) throw new PayError('PAY011', 'no `stripe-signature` to check')
-      if (!(await verified(signing, `${t}.${body}`, given))) throw new PayError('PAY011', 'the signature does not match this body')
-      if (Math.abs(Date.now() / 1000 - t) > tolerance) throw new PayError('PAY011', 'the signature is too old: a replay, or a clock adrift')
-      const event = normalise(JSON.parse(body) as StripeEvent)
-      return event ? [event] : []
-    },
+    verify: (delivery) => verifyStripe(options, tolerance, delivery),
     async refund({ purchase }) {
-      if (!purchase.startsWith('pi_')) throw new PayError('PAY022', 'Only a one-time payment refunds here: a subscription is cancelled in the portal', 400)
+      if (!purchase.startsWith('pi_'))
+        throw new PayError(
+          'PAY022',
+          'Only a one-time payment refunds here: a subscription is cancelled in the portal',
+          400,
+        )
       await call('/v1/refunds', { payment_intent: purchase }, `refund:${purchase}`)
     },
   }