better-supabase 0.13.0 → 0.15.0

package/dist/blocks/billing/index.d.ts

@@ -1,20 +1,21 @@
 /// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, t as AsyncResult } from "../../result-mijqfoJN.js";
-import { C as BillingEventData, O as BlockEventType, o as EventHub, wt as Events } from "../../events-DhGgwqQA.js";
+import { T as ErrorMapper, b as DbError, f as Result, t as AsyncResult } from "../../result-DZeA5KS6.js";
+import { C as BillingEventData, Ct as Events, O as BlockEventType, o as EventHub } from "../../events-vcqenSYU.js";
 import { n as Logger } from "../../logger-DWVYUmwi.js";
-import { n as SqlClient } from "../../executor-DXfgDsKd.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DBPhgF3W.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "../../block-helpers-DyA5BAW4.js";
-import { n as BlockHooks } from "../../block-hooks-BadAniNI.js";
-import { n as StripeSource, r as StripeTaxId, t as StripeClient } from "../../stripe-BSEwKCni.js";
-import { i as EventSink } from "../../cloud-event-CidL9jiw.js";
-import { s as BlockOf } from "../../define-block-MyM4lH42.js";
-import { d as stripeInboxVerify, f as verifyStripeWebhook, u as signStripeWebhook } from "../../verify-BTAEsJbF.js";
-import { a as PlanPickerController, c as createPlanPickerController, i as PlanPickerActions, n as PlanCatalog, o as PlanPickerControllerOptions, r as PlanOption, s as PlanPickerSnapshot, t as CheckoutStarted } from "../../client-5IVhjmtl.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "../../block-helpers-CRpAHrp_.js";
+import { n as SqlClient } from "../../executor-hGjrop3A.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DWZSJrwN.js";
+import { n as BlockHooks } from "../../block-hooks-DZN2w69m.js";
+import { n as StripeSource, r as StripeTaxId, t as StripeClient } from "../../stripe-X22LjuH-.js";
+import { c as BlockOf } from "../../define-block-BVcLQ3DF.js";
+import { i as EventSink } from "../../cloud-event-CzZTJkXv.js";
+import { n as Controller, t as AuthPort } from "../../controller-BrP0gn47.js";
+import { d as stripeInboxVerify, f as verifyStripeWebhook, u as signStripeWebhook } from "../../verify-CMou8dWZ.js";
 //#region src/blocks/billing/events.d.ts
 /** The events of the `billing` block: type to data. */
 type BillingEvents = {
   readonly "billing.customer_linked": BillingEventData;
+  readonly "billing.account_linked": BillingEventData;
   readonly "billing.checkout_completed": BillingEventData;
   readonly "billing.subscription_created": BillingEventData;
   readonly "billing.subscription_updated": BillingEventData;
@@ -75,6 +76,39 @@ interface BillingOptions extends BlockTemporalOptions {
     readonly sql: SqlClient;
     readonly invalidate: (userId: string) => void;
   };
+  /**
+   * Bills tenants as Stripe Accounts v2 accounts with the `customer`
+   * configuration instead of v1 customers. `checkout` creates or reuses the
+   * tenant's account and passes it as `customer_account` to Checkout, as does
+   * `portal`. Stripe creates the account's linked customer at the first
+   * checkout, and `handleStripeEvent` records it. A tenant that already has a
+   * v1 customer keeps it. Needs `v2.core.accounts` on the Stripe client.
+   * Default `false`.
+   */
+  readonly customerAccounts?: boolean | CustomerAccountOptions;
+  /**
+   * `ignore` skips Connect events (those with `event.account`, sent for a
+   * connected account) in `handleStripeEvent`, for an endpoint or event
+   * destination that receives both platform and connected account events while
+   * the block bills on the platform. Default `handle`.
+   */
+  readonly connectEvents?: "handle" | "ignore";
+}
+/** `customerAccounts` in `createBilling`. */
+interface CustomerAccountOptions {
+  /**
+   * The tenant's existing Accounts v2 account, such as the connected account it
+   * already sells through, or `undefined` to create one. The account needs the
+   * `customer` configuration before Stripe bills it.
+   */
+  readonly resolve?: (tenant: string) => string | undefined | Promise<string | undefined>;
+  /**
+   * More `v2.core.accounts.create` parameters, merged deeply over the block's
+   * (`contact_email`, `display_name`, `configuration.customer` and the tenant
+   * in `metadata.organization_id`), or a function of the tenant and the details
+   * that returns them.
+   */
+  readonly params?: Readonly<Record<string, unknown>> | ((tenant: string, details: CustomerDetails) => Readonly<Record<string, unknown>>);
 }
 interface CustomerDetails {
   readonly email?: string;
@@ -129,6 +163,8 @@ interface SubscriptionItem {
 }
 interface BillingStatus {
   readonly customerId: string | undefined;
+  /** The tenant's Accounts v2 account, when it is billed as one. */
+  readonly accountId: string | undefined;
   readonly seats: number;
   readonly subscription: SubscriptionItem | undefined;
 }
@@ -142,6 +178,8 @@ interface SeatSync {
 interface StripeEvent {
   readonly id: string;
   readonly type: string;
+  /** The connected account a Connect event happened on. */
+  readonly account?: string | null;
   /** Unix seconds; orders subscription events in webhook mode. */
   readonly created?: number;
   readonly data: {
@@ -153,6 +191,8 @@ interface StripeEventOutcome {
   readonly event: BlockEventType<BillingEvents> | undefined;
   readonly organizationId: string | undefined;
   readonly customerId: string | undefined;
+  /** The event object's `customer_account`, for a tenant billed as an account. */
+  readonly accountId: string | undefined;
   /** Members whose sessions were invalidated. */
   readonly invalidated: readonly string[];
 }
@@ -211,16 +251,34 @@ interface BillingCustomerUpdate {
 interface Billing {
   /** The tenant's Stripe customer, or `undefined` before the first checkout. */
   customer(organizationId: string): AsyncResult<string | undefined>;
+  /**
+   * The tenant's Stripe Accounts v2 account (`acct_`), or `undefined` when it
+   * is not billed as one.
+   */
+  account(organizationId: string): AsyncResult<string | undefined>;
   /**
    * The tenant's customer, created in Stripe (with the tenant in `metadata`)
-   * when there is none.
+   * when there is none. With `customerAccounts`, a tenant without a customer
+   * gets its account instead, and this fails with `not_found`
+   * (`BILLING_CUSTOMER_PENDING`) until Stripe creates the account's customer at
+   * the first checkout.
    */
   ensureCustomer(organizationId: string, details?: CustomerDetails): AsyncResult<string>;
+  /**
+   * The tenant's Accounts v2 account: the linked one, the one
+   * `customerAccounts.resolve` returns, or a new one with the `customer`
+   * configuration (and the tenant in `metadata`), which it links.
+   */
+  ensureAccount(organizationId: string, details?: CustomerDetails): AsyncResult<string>;
   checkout(organizationId: string, options: CheckoutOptions): AsyncResult<{
     readonly id: string;
     readonly url: string | undefined;
   }>;
-  /** A customer portal session; `not_found` before the tenant has a customer. */
+  /**
+   * A customer portal session, for the tenant's account with
+   * `customerAccounts`; `not_found` before the tenant has a customer or an
+   * account.
+   */
   portal(organizationId: string, options: {
     readonly returnUrl: string;
   }): AsyncResult<{
@@ -320,8 +378,9 @@ interface Billing {
   updateCustomer(organizationId: string, update: BillingCustomerUpdate): AsyncResult<string>;
   /**
    * Handles `checkout.session.completed` and `customer.subscription.*`: links
-   * the customer, emits `billing.*` events and invalidates sessions. Other
-   * events are ignored. Call it from `inbox.process`.
+   * the customer, emits `billing.*` events and invalidates sessions. Any other
+   * event with a `customer_account` of a linked tenant records the account's
+   * customer; other events are ignored. Call it from `inbox.process`.
    */
   handleStripeEvent(event: unknown): AsyncResult<StripeEventOutcome>;
 }
@@ -337,4 +396,75 @@ export declare function createBilling(options: BillingOptions): Billing;
 /** The `billing` block's manifest (ADR 0029). */
 export declare const billingBlock: BlockOf<"billing", typeof createBilling, BillingEvents>;
 //#endregion
-export { type Billing, type BillingCustomer, type BillingCustomerUpdate, type BillingEventData, type BillingEvents, type BillingOptions, type BillingStatus, type BlockTransport, type CheckoutItem, type CheckoutOptions, type CheckoutStarted, type CustomerDetails, type PlanCatalog, type PlanChange, type PlanOption, type PlanPickerActions, type PlanPickerController, type PlanPickerControllerOptions, type PlanPickerSnapshot, type PlatformListOptions, type SeatSync, type StripeClient, type StripeEvent, type StripeEventOutcome, type StripeRow, type StripeSource, type StripeTaxId, type SubscriptionItem, type TenantStripeRow, createPlanPickerController, dbTransport, rpcTransport, signStripeWebhook, sqlTransport, stripeInboxVerify, verifyStripeWebhook };
+//#region src/blocks/billing/client.d.ts
+/**
+ * A plan the picker lists: a key from the app's plan catalog, plus whatever the
+ * app shows.
+ */
+interface PlanOption {
+  readonly key: string;
+  readonly name: string;
+}
+/** The plans to offer and the tenant's current plan. */
+interface PlanCatalog<P> {
+  readonly plans: readonly P[];
+  /** The key of the tenant's current plan, `undefined` without a subscription. */
+  readonly current: string | undefined;
+}
+/**
+ * Where Checkout continues: Stripe's hosted page, or `undefined` when the
+ * server finished the change itself.
+ */
+interface CheckoutStarted {
+  readonly url: string | undefined;
+}
+interface PlanPickerControllerOptions<P extends {
+  readonly key: string;
+} = PlanOption> {
+  readonly auth: AuthPort;
+  /**
+   * The plans and the current one, such as a server action that reads the app's
+   * plan catalog and the tenant's subscription. It throws on failure.
+   */
+  readonly load: () => Promise<PlanCatalog<P>>;
+  /** What a server already loaded: the first load is skipped. */
+  readonly initial?: PlanCatalog<P>;
+  /**
+   * Starts Checkout for a plan key on the server, such as a server action that
+   * calls `billing.checkout()`. The controller never talks to Stripe: the
+   * secret key stays on the server.
+   */
+  readonly checkout: (plan: string) => Promise<Result<CheckoutStarted>>;
+  /**
+   * Opens the Checkout URL: `location.assign(url)` on the web,
+   * `WebBrowser.openBrowserAsync(url)` from `expo-web-browser` in React
+   * Native.
+   */
+  readonly open: (url: string) => void | Promise<void>;
+}
+interface PlanPickerSnapshot<P> {
+  /** `undefined` until the first load. */
+  readonly plans: readonly P[] | undefined;
+  readonly current: string | undefined;
+  /** The plan whose Checkout is starting. */
+  readonly pending: string | undefined;
+  readonly error: DbError | undefined;
+}
+interface PlanPickerActions {
+  /**
+   * Starts Checkout for `plan` and opens its URL; a failure is also kept in
+   * `error`. Choosing the current plan does nothing.
+   */
+  readonly choose: (plan: string) => Promise<Result<CheckoutStarted>>;
+  readonly refresh: () => Promise<void>;
+}
+type PlanPickerController<P> = Controller<PlanPickerSnapshot<P>, PlanPickerActions>;
+/**
+ * The plans with the tenant's current one, for a plan picker: `choose` starts
+ * Checkout through the injected server action and opens the URL it returns.
+ */
+export declare function createPlanPickerController<P extends {
+  readonly key: string;
+} = PlanOption>(options: PlanPickerControllerOptions<P>): PlanPickerController<P>;
+//#endregion
+export { type Billing, type BillingCustomer, type BillingCustomerUpdate, type BillingEventData, type BillingEvents, type BillingOptions, type BillingStatus, type BlockTransport, type CheckoutItem, type CheckoutOptions, type CheckoutStarted, type CustomerAccountOptions, type CustomerDetails, type PlanCatalog, type PlanChange, type PlanOption, type PlanPickerActions, type PlanPickerController, type PlanPickerControllerOptions, type PlanPickerSnapshot, type PlatformListOptions, type SeatSync, type StripeClient, type StripeEvent, type StripeEventOutcome, type StripeRow, type StripeSource, type StripeTaxId, type SubscriptionItem, type TenantStripeRow, dbTransport, rpcTransport, signStripeWebhook, sqlTransport, stripeInboxVerify, verifyStripeWebhook };

package/dist/blocks/billing/index.js

@@ -1,17 +1,17 @@
-import { n as dbError } from "../../errors-D7u24ZJH.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-DIT_qp4G.js";
+import { n as dbError } from "../../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-ntFBW2p2.js";
 import { t as billingSqlOptions } from "../../options-BCrqe3HH.js";
+import { n as whileSignedIn, t as defineController } from "../../controller-BEliOBOv.js";
+import { B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, n as applyTemporal, o as blockCall, w as pageOf } from "../../block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "../../block-hooks-BfxX3682.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { r as blockEmitter } from "../../block-events-BURaqwyp.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-Ds0C2mUf.js";
-import { C as optionalText, D as recordOf, I as textOf, S as optionalInstant, n as applyTemporal, o as blockCall, w as pageOf } from "../../block-helpers-DwE32_gT.js";
-import { r as withBlockHooks } from "../../block-hooks-C1r-R2r0.js";
-import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-import { a as signStripeWebhook, o as stripeInboxVerify, s as verifyStripeWebhook } from "../../verify-BCmBaHlN.js";
-import { r as entitlementMembers } from "../../entitlements-_tw0V3BY.js";
+import { r as blockEmitter } from "../../block-events-pBXPzwnW.js";
+import { n as defineBlock } from "../../define-block-BGqOO8B3.js";
+import { n as DATABASE_URL_ENV, t as CRON_SECRET_ENV } from "../../wiring-CDNuQoJJ.js";
+import { a as signStripeWebhook, o as stripeInboxVerify, s as verifyStripeWebhook } from "../../verify-ZLFUdlqE.js";
+import { r as entitlementMembers } from "../../entitlements-NZAE_vLj.js";
 import { t as lazyStripe } from "../../stripe-BJUfp5jM.js";
-import { t as createPlanPickerController } from "../../client-DkQcRKhm.js";
 //#region src/blocks/billing/stripe-helpers.ts
 const ORGANIZATION_KEY = "organization_id";
 const SEAT_EVENT = /(?:^|\.)organization\.(?:member_added|member_removed|member_left|role_changed)$/;
@@ -64,19 +64,35 @@ function deepMerge(base, extra) {
 }
 /**
 * The block's Checkout Session parameters with the app's `params` merged in
-* deeply, then the customer, `client_reference_id` and the tenant metadata (on
-* the session and, for a subscription, on `subscription_data`) set again, so
+* deeply, then the party, `client_reference_id` and the tenant metadata (on the
+* session and, for a subscription, on `subscription_data`) set again, so
 * `params` adds metadata without dropping the link the webhook needs.
 */
-function checkoutParams(base, extra, organizationId, customerId) {
+function checkoutParams(base, extra, organizationId, party) {
 	const merged = extra === void 0 ? { ...base } : deepMerge(base, extra);
 	const tenant = { metadata: { [ORGANIZATION_KEY]: organizationId } };
-	return deepMerge(merged, {
-		customer: customerId,
+	const params = deepMerge(merged, {
+		...party,
 		client_reference_id: organizationId,
 		...tenant,
 		...merged["mode"] === "subscription" ? { subscription_data: tenant } : {}
 	});
+	delete params["customer" in party ? "customer_account" : "customer"];
+	return params;
+}
+/**
+* The `v2.core.accounts.create` parameters for a tenant's account: the contact,
+* the `customer` configuration and the app's `params` merged in deeply, then
+* the tenant in `metadata` set again.
+*/
+function accountParams(organizationId, details, extra) {
+	const base = {
+		...details.email === void 0 ? {} : { contact_email: details.email },
+		...details.name === void 0 ? {} : { display_name: details.name },
+		configuration: { customer: {} }
+	};
+	const own = typeof extra === "function" ? extra(organizationId, details) : extra;
+	return deepMerge(own === void 0 ? base : deepMerge(base, own), { metadata: { [ORGANIZATION_KEY]: organizationId } });
 }
 /** Stripe calls as results: a thrown Stripe error becomes a `DbError`. */
 function stripeCall(work) {
@@ -135,8 +151,38 @@ function createBilling(options) {
 		tenant: organizationId,
 		customer: customerId
 	}, textOf);
+	const missing = (what) => err(dbError("invalid_request", `The Stripe client has no ${what}`, { hint: "BILLING_STRIPE_CLIENT" }));
+	const accountMode = options.customerAccounts !== void 0 && options.customerAccounts !== false;
+	const accountOptions = typeof options.customerAccounts === "object" ? options.customerAccounts : {};
+	const account = (organizationId) => call("billing_account", { tenant: organizationId }, optionalText);
+	const linkAccount = (organizationId, accountId) => call("link_billing_account", {
+		tenant: organizationId,
+		account: accountId
+	}, textOf);
+	const ensureAccount = (organizationId, details = {}) => account(organizationId).andThen(async (existing) => {
+		if (existing !== void 0) return ok(existing);
+		const resolved = await stripeCall(async () => accountOptions.resolve?.(organizationId));
+		if (!resolved.ok) return resolved;
+		let accountId = resolved.data;
+		if (accountId === void 0) {
+			const created = await withStripe(async (client) => client.v2?.core.accounts.create(accountParams(organizationId, details, accountOptions.params), { idempotencyKey: `account:${organizationId}` }));
+			if (!created.ok) return created;
+			if (created.data === void 0) return missing("v2.core.accounts");
+			accountId = created.data.id;
+		}
+		const linked = await linkAccount(organizationId, accountId);
+		if (linked.ok && linked.data === accountId) emit("billing.account_linked", {
+			organizationId,
+			accountId
+		});
+		return linked;
+	});
 	const ensureCustomer = (organizationId, details = {}) => customer(organizationId).andThen(async (existing) => {
 		if (existing !== void 0) return ok(existing);
+		if (accountMode) {
+			const ensured = await ensureAccount(organizationId, details);
+			return ensured.ok ? err(dbError("not_found", "Stripe creates the account's customer at its first checkout", { hint: "BILLING_CUSTOMER_PENDING" })) : ensured;
+		}
 		const created = await withStripe((client) => client.customers.create({
 			...details.email === void 0 ? {} : { email: details.email },
 			...details.name === void 0 ? {} : { name: details.name },
@@ -150,6 +196,19 @@ function createBilling(options) {
 		});
 		return linked;
 	});
+	/**
+	* Whom Stripe bills for the tenant, without creating anyone: the account
+	* first with `customerAccounts`, the customer first without.
+	*/
+	const partyOf = (organizationId) => customer(organizationId).andThen(async (customerId) => {
+		if (customerId !== void 0 && !accountMode) return ok({ customer: customerId });
+		const accountId = await account(organizationId);
+		if (!accountId.ok) return accountId;
+		if (accountId.data !== void 0) return ok({ customer_account: accountId.data });
+		return ok(customerId === void 0 ? void 0 : { customer: customerId });
+	});
+	const checkoutParty = (organizationId, details) => accountMode ? partyOf(organizationId).andThen(async (found) => found === void 0 ? ensureAccount(organizationId, details).map((accountId) => ({ customer_account: accountId })) : ok(found)) : ensureCustomer(organizationId, details).map((customerId) => ({ customer: customerId }));
+	const tenantOf = (id) => call("billing_customer_tenant", { customer: id }, optionalText);
 	const seats = (organizationId) => call("billing_seat_count", { tenant: organizationId }, (value) => Number(value ?? 0));
 	const item = (organizationId) => call("billing_subscription_item", {
 		tenant: organizationId,
@@ -194,30 +253,46 @@ function createBilling(options) {
 			event: void 0,
 			organizationId: void 0,
 			customerId: void 0,
+			accountId: void 0,
 			invalidated: []
 		};
 		if (!isStripeEvent(input)) return ok(ignored);
+		if (options.connectEvents === "ignore" && typeof input.account === "string" && input.account !== "") return ok(ignored);
 		const object = input.data.object;
 		if (!isRecord(object)) return ok(ignored);
 		const customerId = customerIdOf(object["customer"]);
+		const accountId = customerIdOf(object["customer_account"]);
+		const unlinked = {
+			...ignored,
+			customerId,
+			accountId
+		};
 		if (input.type === "checkout.session.completed") {
 			const organizationId = metadataTenant(object) ?? optionalText(object["client_reference_id"]);
-			if (organizationId === void 0 || customerId === void 0) return ok({
-				...ignored,
-				customerId
-			});
-			const linked = await link(organizationId, customerId);
-			if (!linked.ok) return linked;
+			if (organizationId === void 0 || customerId === void 0 && accountId === void 0) return ok(unlinked);
+			if (accountId !== void 0) {
+				const linked = await linkAccount(organizationId, accountId);
+				if (!linked.ok) return linked;
+				if (linked.data !== accountId) return ok(unlinked);
+			}
+			let linkedCustomer;
+			if (customerId !== void 0) {
+				const linked = await link(organizationId, customerId);
+				if (!linked.ok) return linked;
+				linkedCustomer = linked.data;
+			}
 			emit("billing.checkout_completed", {
 				organizationId,
-				customerId: linked.data,
+				...linkedCustomer === void 0 ? {} : { customerId: linkedCustomer },
+				...accountId === void 0 ? {} : { accountId },
 				stripeEventId: input.id,
 				...typeof object["subscription"] === "string" ? { subscriptionId: object["subscription"] } : {}
 			});
 			return ok({
 				event: "billing.checkout_completed",
 				organizationId,
-				customerId: linked.data,
+				customerId: linkedCustomer,
+				accountId,
 				invalidated: []
 			});
 		}
@@ -226,27 +301,56 @@ function createBilling(options) {
 			"customer.subscription.updated": "billing.subscription_updated",
 			"customer.subscription.deleted": "billing.subscription_deleted"
 		}[input.type];
-		if (type === void 0 || customerId === void 0) return ok(ignored);
-		const tenant = await call("billing_customer_tenant", { customer: customerId }, optionalText);
+		if (type === void 0) {
+			if (accountId === void 0 || customerId === void 0) return ok(ignored);
+			const tenant = await tenantOf(accountId);
+			if (!tenant.ok) return tenant;
+			if (tenant.data !== void 0) {
+				const linked = await link(tenant.data, customerId);
+				if (!linked.ok) return linked;
+			}
+			return ok({
+				...unlinked,
+				organizationId: tenant.data
+			});
+		}
+		if (customerId === void 0 && accountId === void 0) return ok(ignored);
+		const tenant = customerId === void 0 ? ok(void 0) : await tenantOf(customerId);
 		if (!tenant.ok) return tenant;
 		let organizationId = tenant.data;
+		if (organizationId === void 0 && accountId !== void 0) {
+			const byAccount = await tenantOf(accountId);
+			if (!byAccount.ok) return byAccount;
+			organizationId = byAccount.data;
+			if (organizationId !== void 0 && customerId !== void 0) {
+				const linked = await link(organizationId, customerId);
+				if (!linked.ok) return linked;
+			}
+		}
 		const claimed = metadataTenant(object);
 		if (organizationId === void 0 && claimed !== void 0) {
-			const linked = await link(claimed, customerId);
-			if (!linked.ok) return linked;
-			if (linked.data === customerId) organizationId = claimed;
+			let matches = true;
+			if (accountId !== void 0) {
+				const linked = await linkAccount(claimed, accountId);
+				if (!linked.ok) return linked;
+				matches = linked.data === accountId;
+			}
+			if (matches && customerId !== void 0) {
+				const linked = await link(claimed, customerId);
+				if (!linked.ok) return linked;
+				matches = linked.data === customerId;
+			}
+			if (matches) organizationId = claimed;
 		}
-		if (organizationId === void 0) return ok({
-			...ignored,
-			customerId
-		});
+		if (organizationId === void 0) return ok(unlinked);
 		if (options.subscriptions === "webhook") {
 			const stored = await call("upsert_billing_subscription", subscriptionRecord(organizationId, object, input.created), (value) => value === true);
 			if (!stored.ok) return stored;
 		}
 		emit(type, {
 			organizationId,
-			customerId,
+			...customerId === void 0 ? {} : { customerId },
+			...accountId === void 0 ? {} : { accountId },
 			subscriptionId: textOf(object["id"]),
 			stripeEventId: input.id,
 			...typeof object["status"] === "string" ? { status: object["status"] } : {}
@@ -255,6 +359,7 @@ function createBilling(options) {
 			event: type,
 			organizationId,
 			customerId,
+			accountId,
 			invalidated: await invalidate(input)
 		});
 	});
@@ -277,7 +382,6 @@ function createBilling(options) {
 			variant: choice.variant
 		}, optionalText).andThen((price) => Promise.resolve(price === void 0 ? err(dbError("not_found", `No price for plan "${plan}"`, { hint: "BILLING_PLAN_UNKNOWN" })) : ok(price)));
 	};
-	const missing = (what) => err(dbError("invalid_request", `The Stripe client has no ${what}`, { hint: "BILLING_STRIPE_CLIENT" }));
 	const subscription = (organizationId) => call("billing_subscription_item", { tenant: organizationId }, subscriptionItemOf).andThen((found) => Promise.resolve(found === void 0 ? err(dbError("not_found", "This tenant has no active subscription", { hint: "BILLING_NO_SUBSCRIPTION" })) : ok(found)));
 	const rows = (value) => Array.isArray(value) ? value.filter(isRecord) : [];
 	const tenantRows = (key) => (value) => rows(value).flatMap((entry) => {
@@ -300,7 +404,9 @@ function createBilling(options) {
 	const ownInvoice = (organizationId, invoiceId) => invoices(organizationId, { limit: 500 }).andThen((list) => Promise.resolve(list.some((row) => row["id"] === invoiceId) ? ok(invoiceId) : err(dbError("not_found", "This tenant has no such invoice", { hint: "BILLING_INVOICE_NOT_FOUND" }))));
 	return withBlockHooks({
 		customer,
+		account,
 		ensureCustomer,
+		ensureAccount,
 		changePlan: (organizationId, change) => priceOf(change).andThen((price) => subscription(organizationId).andThen(async (found) => {
 			const updated = await withStripe(async (client) => client.subscriptions.update?.(found.subscriptionId, {
 				items: [{
@@ -370,7 +476,7 @@ function createBilling(options) {
 			if (!updated.ok) return updated;
 			return updated.data === void 0 ? missing("customers.update") : ok(updated.data.id);
 		}),
-		checkout: (organizationId, checkout) => checkoutBlock(organizationId).andThen(() => priceOf(checkout)).andThen((price) => ensureCustomer(organizationId, checkout).andThen(async (customerId) => {
+		checkout: (organizationId, checkout) => checkoutBlock(organizationId).andThen(() => priceOf(checkout)).andThen((price) => checkoutParty(organizationId, checkout).andThen(async (party) => {
 			const quantity = checkout.quantity === "seats" ? await seats(organizationId) : ok(checkout.quantity ?? 1);
 			if (!quantity.ok) return quantity;
 			const lineItems = [{
@@ -388,13 +494,12 @@ function createBilling(options) {
 			const mode = checkout.mode ?? "subscription";
 			return withStripe(async (client) => {
 				const params = checkoutParams({
-					customer: customerId,
 					mode,
 					client_reference_id: organizationId,
 					line_items: lineItems,
 					success_url: checkout.successUrl,
 					...checkout.cancelUrl === void 0 ? {} : { cancel_url: checkout.cancelUrl }
-				}, checkout.params, organizationId, customerId);
+				}, checkout.params, organizationId, party);
 				const session = await client.checkout.sessions.create(params, checkout.idempotencyKey === void 0 ? void 0 : { idempotencyKey: checkout.idempotencyKey });
 				return {
 					id: session.id,
@@ -402,11 +507,11 @@ function createBilling(options) {
 				};
 			});
 		})),
-		portal: (organizationId, portal) => customer(organizationId).andThen(async (customerId) => {
-			if (customerId === void 0) return err(dbError("not_found", "This tenant has no Stripe customer yet", { hint: "BILLING_NO_CUSTOMER" }));
+		portal: (organizationId, portal) => partyOf(organizationId).andThen(async (party) => {
+			if (party === void 0) return err(dbError("not_found", "This tenant has no Stripe customer yet", { hint: "BILLING_NO_CUSTOMER" }));
 			return withStripe(async (client) => {
 				return { url: (await client.billingPortal.sessions.create({
-					customer: customerId,
+					...party,
 					return_url: portal.returnUrl
 				})).url };
 			});
@@ -415,6 +520,7 @@ function createBilling(options) {
 			const row = recordOf(value, "billing_status");
 			return {
 				customerId: optionalText(row["customer"]),
+				accountId: optionalText(row["account"]),
 				seats: Number(row["seats"] ?? 0),
 				subscription: subscriptionItemOf(row["subscription"])
 			};
@@ -454,6 +560,7 @@ function createBilling(options) {
 /** The `billing` block's event types, for its manifest and `onBlockEvent`. */
 const billingEvents = defineEvents({
 	"billing.customer_linked": event(),
+	"billing.account_linked": event(),
 	"billing.checkout_completed": event(),
 	"billing.subscription_created": event(),
 	"billing.subscription_updated": event(),
@@ -470,7 +577,90 @@ const billingBlock = defineBlock({
 	events: billingEvents,
 	create: createBilling,
 	category: "commerce",
-	recipes: ["plan-picker"]
+	recipes: ["plan-picker"],
+	env: [
+		{
+			key: "STRIPE_SECRET_KEY",
+			description: "Server-only: the Stripe secret key billing calls Stripe with."
+		},
+		{
+			key: "STRIPE_WEBHOOK_SECRET",
+			description: "Server-only: the signing secret of the Stripe webhook endpoint."
+		},
+		CRON_SECRET_ENV,
+		DATABASE_URL_ENV
+	],
+	routes: ["stripe-webhook"],
+	workers: [{
+		name: "stripe-process",
+		description: "Applies the Stripe events the webhook stored to subscriptions and invoices.",
+		path: "/api/stripe/process",
+		schedule: "* * * * *"
+	}]
 });
 //#endregion
+//#region src/blocks/billing/client.ts
+/**
+* The plans with the tenant's current one, for a plan picker: `choose` starts
+* Checkout through the injected server action and opens the URL it returns.
+*/
+function createPlanPickerController(options) {
+	return defineController({
+		plans: options.initial?.plans,
+		current: options.initial?.current,
+		pending: void 0,
+		error: void 0
+	}, (state) => {
+		let ticket = 0;
+		let seeded = options.initial !== void 0;
+		const refresh = async () => {
+			ticket += 1;
+			const request = ticket;
+			try {
+				const catalog = await options.load();
+				if (request === ticket) state.set({
+					plans: catalog.plans,
+					current: catalog.current,
+					error: void 0
+				});
+			} catch (cause) {
+				if (request === ticket) state.set({ error: toDbError(cause) });
+			}
+		};
+		return {
+			actions: {
+				refresh,
+				choose: async (plan) => {
+					if (plan === state.get().current) return ok({ url: void 0 });
+					state.set({
+						pending: plan,
+						error: void 0
+					});
+					let started;
+					try {
+						started = await options.checkout(plan);
+						if (started.ok && started.data.url !== void 0) await options.open(started.data.url);
+					} catch (cause) {
+						started = err(toDbError(cause));
+					}
+					if (!started.ok) {
+						state.set({
+							pending: void 0,
+							error: started.error
+						});
+						return started;
+					}
+					state.set({ pending: void 0 });
+					if (started.data.url === void 0) await refresh();
+					return started;
+				}
+			},
+			start: () => whileSignedIn(options.auth, () => {
+				if (seeded) seeded = false;
+				else refresh();
+			})
+		};
+	});
+}
+//#endregion
 export { billingBlock, billingEvents, createBilling, createPlanPickerController, dbTransport, rpcTransport, signStripeWebhook, sqlTransport, stripeInboxVerify, verifyStripeWebhook };