0b486fc · 9ee9be5 · a985b29 · c3a3390 · 6b2678b · e89189b
@@ -18,8 +18,8 @@
Beside `forge.json`, at the root of the repository:
{ "uses": [{ "vendor": "s3", "use": "backup", "why": "off-machine copy of the encrypted snapshot" }] }
```
- `vendor`: `cloudflare`, `fly`, `hetzner`, `s3`, `github`, `vercel`, `digitalocean` or `azure`.
- `use`: `compute`, `storage`, `backup`, `dns` or `cdn`.
- `vendor`: `cloudflare`, `fly`, `hetzner`, `s3`, `github`, `vercel`, `digitalocean`, `azure` or `stripe`.
- `use`: `compute`, `storage`, `backup`, `dns`, `cdn` or `payments`. The forge declares `stripe`/`payments` for itself (`FORGE_STRIPE`): `api.stripe.com`, for connecting (its webhook endpoint), and nothing else.
- `why`: one line, up to 300 characters.
No file means no uses. A malformed file is refused with one sentence
@@ -125,3 +125,11 @@
plans by hand (`PUT /api/v1/forges/{name}/plan`, the Billing page, the
terminal, the MCP `forges` tool). A forge with no row is active on the plan
its size names. Nothing reads a plan to limit a forge yet. How to use it:
`docs/features/billing.md`.
### Connect Stripe
1. In Stripe, make a secret or restricted key (a `sk_test_`/`rk_test_` key is a sandbox; `sk_live_`/`rk_live_` is live). A restricted key needs write on Webhook Endpoints.
2. Settings → Billing → Provider: paste it and press Connect. The forge seals it with its secrets and never shows it again; the page says **sandbox** or **live**. In the terminal: Billing, `c`, paste the key (shown as dots).
3. The forge registers its own webhook at its configured public address (`FORGE_URL`) `/hooks/stripe` for five events and seals the signing secret. A key that may not do that is told so; paste a `whsec_` signing secret instead.
4. Plain `fetch` calls, nothing to create in Stripe's dashboard (`src/billing/stripe.ts`, API version pinned in `STRIPE_VERSION`). Reconnecting forgets the old key's secret and removes its endpoint.
5. Disconnect (page, or `x` in the terminal) removes the endpoint and the sealed key, and says so when Stripe could not remove the endpoint. `api.stripe.com` is the one declared vendor (`stripe`/`payments`, docs/CLOUD.md).
@@ -5,7 +5,8 @@
Billing records the plan each forge is on (`src/billing/`): a store of entitleme
- **Plans:** small, medium or large, the sizes. A forge never granted a plan reads as `active` on its size, source `granted`.
- **Grant by hand (admin, a person):** the Billing page, the terminal screen, `PUT /api/v1/forges/{name}/plan` with `{ "plan": "large" }` (`GET` reads it), or the MCP `forges` tool with `{ forge, plan }` (planned first; `dryRun: false` grants).
- **Audit:** every grant is a row in `entitlement_change` and a `billing.plan` event.
- **Terminal:** the palette's *Billing* (admins), `src/tui/screens/billing.ts`: `j`/`k` pick a forge, `s`, `m` or `l` grants that plan after a yes/no.
- **Terminal:** the palette's *Billing* (admins), `src/tui/screens/billing.ts`: `j`/`k` pick a forge, `s`, `m` or `l` grants that plan after a yes/no; `c` connects Stripe (key shown as dots), `w` saves a signing secret, `x` disconnects after a yes/no.
- **Stripe (#11136):** Settings → Billing → Provider takes one key (`src/billing/stripe.ts`, `connection.ts`); how to connect it is in `docs/PROFIT.md`. Not yet: the `/hooks/stripe` receiver, and checkout, portal and reconcile, which come with the pull that calls them.
## Gift codes
A code gives a plan for free, with or without a payment provider (`src/billing/codes.ts`, `src/actions/codes.ts`). No provider is asked: a redeemed code writes the entitlement itself, source `code:<id>`.
@@ -1,5 +1,4 @@
[
  "src/apps/cloud.ts",
  "src/crew/governor_log.ts",
  "src/flow/alarm_unproposed.ts",
  "src/flow/approved_wait.ts",
@@ -11,11 +11,27 @@
import { changesOf, entitlementOf, putEntitlement, type EntitlementChange } from
import type { Entitlement } from "../billing/types.ts";
import type { User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { connectionOf, forget, openKey, sealKey, sealWebhook, type Connection } from "../billing/connection.ts";
import { isStripeKey, stripeClient, type StripeError } from "../billing/stripe.ts";
import { publicOrigin } from "../core/public_origin.ts";
import { holdValues } from "../kernel/log.ts";
import { listChildrenNow } from "./spawn.ts";
import { parseSize } from "../spawn/sizes.ts";
export type BillingError = "not_found" | "no_such_forge" | "bad_plan";
export type StripeWords = "no_origin" | "left_at_stripe" | "bad_key" | "bad_secret" | "not_connected" | "no_permission" | "refused" | "unreachable";
export const STRIPE_WORDS: Record<StripeWords, string> = {
  no_origin: "This forge does not know its public address; set FORGE_URL so it can register its webhook, or paste a signing secret with the key",
  left_at_stripe: "Disconnected here, but Stripe's webhook endpoint could not be removed; delete it on Stripe's webhook page",
  bad_key: "That is not a Stripe secret or restricted key (it starts sk_ or rk_)",
  bad_secret: "A signing secret starts whsec_",
  not_connected: "Stripe is not connected",
  no_permission: "Connected, but this key may not create webhook endpoints. Paste a signing secret from Stripe's webhook page below",
  refused: "Stripe refused the key",
  unreachable: "Stripe could not be reached",
};
export const BILLING_WORDS: Record<Exclude<BillingError, "not_found">, string> = {
  no_such_forge: "No forge by that name was sent from here",
  bad_plan: "A plan is small, medium or large",
@@ -23,6 +39,8 @@
export const BILLING_WORDS: Record<Exclude<BillingError, "not_found">, string> =
export interface BillingView {
  readonly forges: readonly (Entitlement & { size: string })[];
  /** The Stripe connection (mode, whether events are signed), never the key. */
  readonly stripe: Connection | undefined;
}
const admin = (a: User | undefined): Result<User, "not_found"> => (a?.isAdmin === true && a.kind !== "agent" ? ok(a) : err("not_found"));
@@ -32,6 +50,7 @@
export function readBilling(app: App, actor: User | undefined): Result<BillingVi
  if (!who.ok) return who;
  return ok({
    forges: listChildrenNow(app).map((c) => ({ ...entitlementOf(app.db, c.name, c.size), size: c.size })),
    stripe: connectionOf(app.db),
  });
}
@@ -67,3 +86,79 @@
export function grantPlan(app: App, actor: User | undefined, forge: unknown, pla
  app.bus.append({ kind: "billing.plan", actorId: who.id, payload: { forge: to.forge, from: from.plan, to: to.plan, source: "granted" } });
  return ok({ entitlement, changes: changesOf(app.db, to.forge) });
}
const SIGNING = /^whsec_[A-Za-z0-9]{8,}$/;
const failure = (e: StripeError): StripeWords => (e.kind === "permission" ? "no_permission" : e.kind === "unreachable" ? "unreachable" : "refused");
/**
 * Connect Stripe with one pasted key: the forge registers its own webhook
 * endpoint (`<public origin>/hooks/stripe`, from the forge's configuration,
 * never from a request's Host) and seals the signing secret it gets. A key
 * Stripe rejects is not kept, and the connection it would have replaced
 * stays. A key that may not create endpoints is kept, and the answer
 * `no_permission` asks for a signing secret (`saveSigningSecret`).
 * `signingSecret` given with the key skips the call. Whatever the previous
 * connection sealed is forgotten first, and its endpoint removed at Stripe,
 * so no secret or endpoint id outlives the key it belonged to.
 */
export async function connectStripe(
  app: App,
  actor: User | undefined,
  key: unknown,
  signingSecret: unknown,
  fetchFn: typeof fetch = fetch,
): Promise<Result<Connection, BillingError | StripeWords>> {
  const who = admin(actor);
  if (!who.ok) return who;
  const k = typeof key === "string" ? key.trim() : "";
  const sec = typeof signingSecret === "string" ? signingSecret.trim() : "";
  if (!isStripeKey(k)) return err("bad_key");
  if (sec !== "" && !SIGNING.test(sec)) return err("bad_secret");
  if (sec === "" && app.config.url === undefined) return err("no_origin");
  holdValues("stripe", [k, ...(sec === "" ? [] : [sec])]);
  let denied: StripeWords | undefined;
  let hook: { id: string; secret: string } | undefined;
  if (sec === "") {
    const made = await stripeClient(k, fetchFn).addWebhook(`${publicOrigin(app.config.url, "")}/hooks/stripe`);
    if (made.ok) hook = made.value;
    else if (made.error.kind === "permission") denied = "no_permission";
    else return err(failure(made.error));
  }
  const old = openKey(app.db, app.config.dataDir, app.bus, who.value.id);
  if (old && old.endpointId !== "" && old.endpointId !== hook?.id) await stripeClient(old.key, fetchFn).removeWebhook(old.endpointId);
  forget(app.db);
  if (!sealKey(app.db, app.config.dataDir, k)) return err("bad_key");
  if (hook) sealWebhook(app.db, app.config.dataDir, hook.secret, hook.id);
  else if (sec !== "") sealWebhook(app.db, app.config.dataDir, sec);
  const c = connectionOf(app.db) as Connection;
  app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "stripe", mode: c.mode, signed: c.signed } });
  return denied ? err(denied) : ok(c);
}
/** A signing secret pasted by hand, for a key that may not register one. */
export function saveSigningSecret(app: App, actor: User | undefined, secret: unknown): Result<Connection, BillingError | StripeWords> {
  const who = admin(actor);
  if (!who.ok) return who;
  if (!connectionOf(app.db)) return err("not_connected");
  const sec = typeof secret === "string" ? secret.trim() : "";
  if (!SIGNING.test(sec)) return err("bad_secret");
  holdValues("stripe", [sec]);
  sealWebhook(app.db, app.config.dataDir, sec);
  app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "stripe", signed: true } });
  return ok(connectionOf(app.db) as Connection);
}
/**
 * Remove the webhook endpoint and the sealed key and secret; the key and secret go even when Stripe cannot be reached,
 * and `left_at_stripe` says the endpoint is still there.
 */
export async function disconnectStripe(app: App, actor: User | undefined, fetchFn: typeof fetch = fetch): Promise<Result<true, BillingError | StripeWords>> {
  const who = admin(actor);
  if (!who.ok) return who;
  const open = openKey(app.db, app.config.dataDir, app.bus, who.value.id);
  if (!open) return err("not_connected");
  const removed = open.endpointId === "" ? undefined : await stripeClient(open.key, fetchFn).removeWebhook(open.endpointId);
  forget(app.db);
  app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "none", ...(removed && !removed.ok ? { endpointLeft: true } : {}) } });
  return removed && !removed.ok ? err("left_at_stripe") : ok(true);
}
@@ -496,9 +496,9 @@
export function parseCheck(
}
/** The vendors a repository may name in `cloud.json`; a closed set. */
export const CLOUD_VENDORS = ["cloudflare", "fly", "hetzner", "s3", "github", "vercel", "digitalocean", "azure"] as const;
export const CLOUD_VENDORS = ["cloudflare", "fly", "hetzner", "s3", "github", "vercel", "digitalocean", "azure", "stripe"] as const;
/** What a vendor may be used for; a closed set. */
export const CLOUD_USES = ["compute", "storage", "backup", "dns", "cdn"] as const;
export const CLOUD_USES = ["compute", "storage", "backup", "dns", "cdn", "payments"] as const;
export type CloudVendor = (typeof CLOUD_VENDORS)[number];
export type CloudUse = (typeof CLOUD_USES)[number];
@@ -0,0 +1,59 @@
/**
 * The Stripe connection as stored (#11136): the pasted key and the webhook's
 * signing secret, sealed with the forge's secrets (`core/secret_store.ts`).
 * The mode is in the secret's NAME (`STRIPE_KEY_TEST` or `STRIPE_KEY_LIVE`),
 * so every admin view can say sandbox or live without opening the key.
 * Opening a value is only `openKey`, and it makes the value redacted from
 * logs for the life of the process.
 */
import type { Database } from "bun:sqlite";
import type { EventBus } from "../core/events.ts";
import { deleteSecret, listSecretNames, resolveSecrets, setSecret } from "../core/secret_store.ts";
import { holdValues } from "../kernel/log.ts";
import { modeOf, type StripeMode } from "./stripe.ts";
const KEY_NAME: Record<StripeMode, string> = { sandbox: "STRIPE_KEY_TEST", live: "STRIPE_KEY_LIVE" };
const SECRET = "STRIPE_WEBHOOK_SECRET";
const ENDPOINT = "STRIPE_WEBHOOK_ID";
export interface Connection {
  readonly mode: StripeMode;
  /** True when a signing secret is sealed, so events can be verified. */
  readonly signed: boolean;
}
/** What is connected, from names alone: nothing is opened. */
export function connectionOf(db: Database): Connection | undefined {
  const names = new Set(listSecretNames(db, "forge").map((s) => s.name));
  const mode = names.has(KEY_NAME.live) ? "live" : names.has(KEY_NAME.sandbox) ? "sandbox" : undefined;
  return mode === undefined ? undefined : { mode, signed: names.has(SECRET) };
}
/** Seal the key under its mode's name, forgetting the other mode's. False when it is not a Stripe key. */
export function sealKey(db: Database, dataDir: string, key: string): boolean {
  const mode = modeOf(key);
  if (mode === undefined) return false;
  deleteSecret(db, "forge", "", KEY_NAME[mode === "live" ? "sandbox" : "live"]);
  return setSecret(db, dataDir, "forge", "", KEY_NAME[mode], key).ok;
}
export function sealWebhook(db: Database, dataDir: string, secret: string, endpointId = ""): boolean {
  if (endpointId !== "" && !setSecret(db, dataDir, "forge", "", ENDPOINT, endpointId).ok) return false;
  return setSecret(db, dataDir, "forge", "", SECRET, secret).ok;
}
/** The sealed key and the endpoint id, opened (audited as `secret.read`). */
export function openKey(db: Database, dataDir: string, bus: EventBus, actor: string): { key: string; endpointId: string } | undefined {
  const c = connectionOf(db);
  if (!c) return undefined;
  const got = resolveSecrets(db, dataDir, bus, [KEY_NAME[c.mode], ENDPOINT], { actor });
  const key = got[KEY_NAME[c.mode]];
  if (key === undefined) return undefined;
  holdValues("stripe", [key]);
  return { key, endpointId: got[ENDPOINT] ?? "" };
}
export function forget(db: Database): void {
  for (const n of [...Object.values(KEY_NAME), SECRET, ENDPOINT]) deleteSecret(db, "forge", "", n);
}
@@ -0,0 +1,116 @@
/**
 * The `stripe` provider of the Billing seam (#11136): Stripe over `fetch`
 * and nothing else, no SDK. The owner pastes one secret or restricted key;
 * checkout uses inline `price_data`, so nothing is set up in Stripe's
 * dashboard. Plain data in, a Result out. A key is held only in the closure
 * of `stripeClient`: it goes in one `Authorization` header and into no error,
 * no log line and no argument list. A failed call says what Stripe said
 * about the request (its status and error code), never what was sent.
 *
 * The vendor is declared (`FORGE_STRIPE`, docs/CLOUD.md) and every call asks
 * `mayUse` first. The way out: disconnect removes the webhook endpoint and
 * the sealed key; the entitlements stay in the store.
 */
import { mayUse } from "../apps/cloud.ts";
import type { CloudDeclaration } from "../apps/manifest.ts";
import { err, ok, type Result } from "../kernel/result.ts";
export const STRIPE_API = "https://api.stripe.com";
/** The one API version every call is pinned to. */
export const STRIPE_VERSION = "2025-09-30.clover";
export const WEBHOOK_EVENTS = [
  "checkout.session.completed",
  "customer.subscription.updated",
  "customer.subscription.deleted",
  "invoice.paid",
  "invoice.payment_failed",
] as const;
/** What the forge declares for itself: the only vendor its own process calls. */
export const FORGE_STRIPE: readonly CloudDeclaration[] = [
  { vendor: "stripe", use: "payments", why: "the plans payment webhook; leave by disconnecting" },
];
export type StripeMode = "sandbox" | "live";
const KEY = /^(sk|rk)_(test|live)_[A-Za-z0-9]{8,}$/;
export const isStripeKey = (key: string): boolean => KEY.test(key);
/** `sandbox` for a test key, `live` for a live one; undefined when it is no Stripe key. */
export function modeOf(key: string): StripeMode | undefined {
  const m = KEY.exec(key);
  return m ? (m[2] === "test" ? "sandbox" : "live") : undefined;
}
export type StripeError =
  | { kind: "permission"; message: string }
  | { kind: "rejected"; message: string; status: number }
  | { kind: "unreachable"; message: string };
type Value = string | number | boolean | undefined | Value[] | { [k: string]: Value };
/** Stripe's form encoding: nested keys in brackets, arrays by index. */
export function formBody(data: { [k: string]: Value }): string {
  const parts: string[] = [];
  const add = (name: string, v: Value): void => {
    if (v === undefined) return;
    if (Array.isArray(v)) v.forEach((x, i) => add(`${name}[${i}]`, x));
    else if (typeof v === "object") for (const [k, x] of Object.entries(v)) add(`${name}[${k}]`, x);
    else parts.push(`${encodeURIComponent(name)}=${encodeURIComponent(String(v))}`);
  };
  for (const [k, v] of Object.entries(data)) add(k, v);
  return parts.join("&");
}
export interface StripeClient {
  addWebhook(url: string): Promise<Result<{ id: string; secret: string }, StripeError>>;
  removeWebhook(id: string): Promise<Result<true, StripeError>>;
}
const PERMISSION = "This key may not create webhook endpoints. Paste a signing secret from Stripe's webhook page instead.";
export function stripeClient(key: string, fetchFn: typeof fetch = fetch): StripeClient {
  const call = async (method: "GET" | "POST" | "DELETE", path: string, data?: { [k: string]: Value }, idem?: string): Promise<Result<Record<string, unknown>, StripeError>> => {
    if (!mayUse(FORGE_STRIPE, "stripe", "payments")) return err({ kind: "unreachable", message: "Stripe is not declared for this forge." });
    const headers: Record<string, string> = { authorization: `Bearer ${key}`, "stripe-version": STRIPE_VERSION };
    if (method === "POST") {
      headers["content-type"] = "application/x-www-form-urlencoded";
      if (idem) headers["idempotency-key"] = idem;
    }
    let res: Response;
    try {
      res = await fetchFn(`${STRIPE_API}${path}`, { method, headers, ...(method === "POST" ? { body: formBody(data ?? {}) } : {}) });
    } catch {
      return err({ kind: "unreachable", message: "Stripe could not be reached." });
    }
    let json: Record<string, unknown> = {};
    try {
      json = (await res.json()) as Record<string, unknown>;
    } catch {
      // an empty or non-JSON body: the status says enough
    }
    if (res.ok) return ok(json);
    const e = (json["error"] ?? {}) as Record<string, unknown>;
    const code = typeof e["code"] === "string" ? e["code"] : typeof e["type"] === "string" ? e["type"] : "error";
    if (res.status === 403 || e["type"] === "invalid_request_error" && res.status === 401) return err({ kind: "permission", message: PERMISSION });
    return err({ kind: "rejected", status: res.status, message: `Stripe refused the request (${res.status}, ${String(code).replace(/[^\w.-]/g, "").slice(0, 60)}).` });
  };
  const str = (o: Record<string, unknown>, k: string): string => (typeof o[k] === "string" ? (o[k] as string) : "");
  const missing = (what: string): StripeError => ({ kind: "rejected", status: 502, message: `Stripe's answer had no ${what}.` });
  return {
    async addWebhook(url) {
      const r = await call("POST", "/v1/webhook_endpoints", { url, enabled_events: [...WEBHOOK_EVENTS] },
        // fresh per attempt: Stripe replays an answer for a repeated key for 24h, and a reconnect must not get a deleted endpoint back
        crypto.randomUUID());
      if (!r.ok) return r;
      const id = str(r.value, "id"), secret = str(r.value, "secret");
      return id && secret ? ok({ id, secret }) : err(missing("signing secret"));
    },
    async removeWebhook(id) {
      const r = await call("DELETE", `/v1/webhook_endpoints/${encodeURIComponent(id)}`);
      return r.ok ? ok(true as const) : r;
    },
  };
}
@@ -18,7 +18,7 @@
import { teamPage, teamSet, teamsPage, teamsStream } from "../web/pages/teams.ts
import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
import { flagsPage, flagsSet } from "../web/pages/flags.ts";
import { appTemplatesPage, appTemplatesSet } from "../web/pages/app_templates.ts";
import { billingPage, billingGrant, billingMakeCode, billingRevokeCode } from "../web/pages/billing.ts";
import { billingPage, billingGrant, billingMakeCode, billingRevokeCode, stripeConnect, stripeDisconnect, stripeSecret } from "../web/pages/billing.ts";
import { economicsPage, economicsSet } from "../web/pages/economics.ts";
import { trustedAdd, trustedPage, trustedRemove, trustedRevert, trustedStop } from "../web/pages/trusted.ts";
import { usagePage } from "../web/pages/usage.ts";
@@ -210,6 +210,9 @@
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
  router.add("POST", "/settings/economics", economicsSet);
  router.add("GET", "/settings/billing", billingPage);
  router.add("POST", "/settings/billing/grant", billingGrant);
  router.add("POST", "/settings/billing/stripe/connect", stripeConnect);
  router.add("POST", "/settings/billing/stripe/secret", stripeSecret);
  router.add("POST", "/settings/billing/stripe/disconnect", stripeDisconnect);
  router.add("POST", "/settings/billing/codes", billingMakeCode);
  router.add("POST", "/settings/billing/codes/revoke", billingRevokeCode);
  router.add("GET", "/settings/flags", flagsPage);
@@ -3,9 +3,11 @@
 * and the hand grant, through the same `readBilling` and `grantPlan` the page
 * and API use. `s`, `m` or `l` grants the forge under the cursor that plan
 * after a yes/no; the change is kept in the audit trail like any other.
 * `c` connects Stripe with a pasted key (shown as dots), `w` saves a webhook
 * signing secret, `x` disconnects after a yes/no: the same actions as the page.
 */
import { grantPlan, readBilling, BILLING_WORDS } from "../../actions/billing.ts";
import { grantPlan, readBilling, connectStripe, disconnectStripe, saveSigningSecret, BILLING_WORDS, STRIPE_WORDS } from "../../actions/billing.ts";
import type { Ctx, Screen } from "../app/app.ts";
import { binding } from "../app/keys.ts";
import { fill, len, split } from "../ui/layout.ts";
@@ -13,10 +15,12 @@
import { style } from "../term/style.ts";
import { truncate } from "../term/width.ts";
import type { Session } from "../session.ts";
import { emptyState } from "../ui/widgets.ts";
import { ListState, confirmScreen, drawList, yesNo, type ListRow } from "./common.ts";
import { ListState, confirmScreen, drawList, promptScreen, yesNo, type ListRow } from "./common.ts";
import type { PaletteEntry } from "./entries.ts";
const isAdmin = (f: Session): boolean => f.user?.isAdmin === true && f.user.kind !== "agent";
const stripeWords = (e: keyof typeof STRIPE_WORDS | "not_found" | "no_such_forge" | "bad_plan"): string =>
  e === "not_found" ? "Not found." : e in STRIPE_WORDS ? `${STRIPE_WORDS[e as keyof typeof STRIPE_WORDS]}.` : `${BILLING_WORDS[e as keyof typeof BILLING_WORDS]}.`;
const PLANS: Record<string, string> = { s: "small", m: "medium", l: "large" };
export function billingRows(f: Session): ListRow[] {
@@ -30,21 +34,50 @@
export function billingScreen(f: Session, ctx: Ctx): Screen {
  let note = "";
  const screen: Screen = {
    title: "Billing",
    keys: [binding(["j", "k"], "move cursor"), binding(["s", "m", "l"], "grant small, medium, large"), binding(["esc"], "back")],
    keys: [binding(["j", "k"], "move cursor"), binding(["s", "m", "l"], "grant small, medium, large"), binding(["c"], "connect Stripe"), binding(["w"], "signing secret"), binding(["x"], "disconnect Stripe"), binding(["esc"], "back")],
    render(area, s) {
      const c = ctx.theme.c;
      const rows = billingRows(f);
      state.clamp(rows.length);
      const sc = readBilling(f.app, f.user);
      const stripe = sc.ok && sc.value.stripe ? `Stripe ${sc.value.stripe.mode}, ${sc.value.stripe.signed ? "signed" : "no signing secret"}` : "Stripe not connected";
      if (rows.length === 0) {
        emptyState(s, area, c, { title: "No forge has been sent from here.", body: "Billing has nothing to grant yet." });
        emptyState(s, area, c, { title: "No forge has been sent from here.", body: note === "" ? `Billing has nothing to grant yet. ${stripe}.` : note });
        return;
      }
      const [head, body] = split(area, "v", [len(1), fill(1)]);
      const line = note === "" ? "Every forge is free within its plan; a grant is recorded by hand" : note;
      const line = note === "" ? `${stripe} (c connect, w secret, x disconnect)` : note;
      s.text(head!.x, head!.y, truncate(line, head!.w), style(c.mutedFg, c.bg), head!.x + head!.w);
      drawList(s, body!, c, state, rows);
    },
    key(e) {
      if (isAdmin(f) && (e.key === "c" || e.key === "w")) {
        const connect = e.key === "c";
        ctx.push(
          promptScreen(ctx, screen, {
            title: connect ? "Connect Stripe" : "Webhook signing secret",
            label: connect ? "Stripe secret or restricted key" : "Signing secret (whsec_…)",
            mask: true,
            onSubmit: async (value) => {
              const done = connect ? await connectStripe(f.app, f.user, value, "") : saveSigningSecret(f.app, f.user, value);
              note = done.ok ? (connect ? "Stripe is connected." : "Signing secret saved.") : stripeWords(done.error);
              ctx.invalidate();
            },
          }),
        );
        return true;
      }
      if (isAdmin(f) && e.key === "x") {
        const go = (i: number): void => {
          if (i !== 0) return;
          void disconnectStripe(f.app, f.user).then((r) => {
            note = r.ok ? "Stripe is disconnected." : stripeWords(r.error);
            ctx.invalidate();
          });
        };
        ctx.push(yesNo(ctx, confirmScreen(ctx, screen, { title: "Disconnect Stripe", body: ["Remove the webhook and forget the key?"], actions: [{ label: "Disconnect" }, { label: "Cancel" }], onChoose: go }), go));
        return true;
      }
      const plan = PLANS[e.key];
      const rows = billingRows(f);
      const target = rows[state.index];
@@ -5,7 +5,7 @@
 * Anyone else gets the not-found page.
 */
import { BILLING_WORDS, grantPlan, readBilling, type BillingError } from "../../actions/billing.ts";
import { BILLING_WORDS, STRIPE_WORDS, connectStripe, disconnectStripe, grantPlan, readBilling, saveSigningSecret, type BillingError, type StripeWords } from "../../actions/billing.ts";
import { CODE_ERRORS, makeCode, readCodes, revoke, type CodeError } from "../../actions/codes.ts";
import { publicOrigin } from "../../core/public_origin.ts";
import { notePhase, takeSessionTime } from "../../core/route_timing.ts";
@@ -19,7 +19,7 @@
import { btn, copyField, field as formField, selectField } from "../ui.ts";
import { accountSections } from "./origins.ts";
const PATH = "/settings/billing";
const words = (e: BillingError) => (e === "not_found" ? "Not found" : BILLING_WORDS[e]);
const words = (e: BillingError | StripeWords) => (e === "not_found" ? "Not found" : e in BILLING_WORDS ? BILLING_WORDS[e as keyof typeof BILLING_WORDS] : STRIPE_WORDS[e as StripeWords]);
/** A code just made: the plain code and its link, shown once and never kept. */
interface Shown {
@@ -101,7 +101,28 @@
function billingView(ctx: Ctx, shown?: Shown, values: Record<string, string> = {
    </li>`,
  );
  const rendering = performance.now();
  const body = html`<section class="settings-block">
  const s = b.stripe;
  const stripe = html`<section class="settings-block">
      <h2>Provider</h2>
      ${s
        ? html`<dl class="status-rows">
              <div class="status-row"><dt>Stripe</dt><dd data-mode="${s.mode}">${s.mode}</dd></div>
              <div class="status-row"><dt>Events</dt><dd>${s.signed ? "signed" : "no signing secret yet"}</dd></div>
            </dl>
          ${s.signed
            ? null
            : html`<form class="row-fields" method="post" action="${PATH}/stripe/secret">
                <input class="input mono" type="password" name="secret" autocomplete="off" placeholder="whsec_…" aria-label="Webhook signing secret" required />
                ${btn("Save signing secret")}
              </form>`}
          <form method="post" action="${PATH}/stripe/disconnect">${btn("Disconnect")}</form>`
        : html`<p class="muted small">Paste a Stripe secret or restricted key; the forge registers its own webhook.</p>
          <form class="row-fields" method="post" action="${PATH}/stripe/connect">
            <input class="input mono" type="password" name="key" autocomplete="off" placeholder="sk_test_… or rk_live_…" aria-label="Stripe key" required />
            ${btn("Connect")}
          </form>`}
    </section>`;
  const body = html`${stripe}<section class="settings-block">
      <h2>Plans</h2>
      <p class="muted small">Choose the plan each forge is on.</p>
      ${rows.length === 0
@@ -151,3 +172,35 @@
export async function billingGrant(ctx: Ctx): Promise<Response> {
  if (!set.ok && set.error === "not_found") return notFoundPage(ctx);
  return flashTo(ctx, PATH, set.ok ? { message: `${set.value.entitlement.forge} is on ${set.value.entitlement.plan}.` } : { tone: "danger", message: `${words(set.error)}.` });
}
const back = (ctx: Ctx, r: { ok: true; message: string } | { ok: false; error: BillingError | StripeWords }): Response | Promise<Response> =>
  r.ok ? flashTo(ctx, PATH, { message: r.message }) : r.error === "not_found" ? notFoundPage(ctx) : flashTo(ctx, PATH, { tone: "danger", message: `${words(r.error)}.` });
const isPerson = (ctx: Ctx): boolean => ctx.auth.user?.isAdmin === true && ctx.auth.user.kind !== "agent";
// POST /settings/billing/stripe/connect
export async function stripeConnect(ctx: Ctx): Promise<Response> {
  if (!isPerson(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const r = await connectStripe(ctx.app, ctx.auth.user, field(form, "key"), field(form, "secret"));
  return back(ctx, r.ok ? { ok: true, message: `Stripe is connected (${r.value.mode}).` } : r);
}
// POST /settings/billing/stripe/secret
export async function stripeSecret(ctx: Ctx): Promise<Response> {
  if (!isPerson(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const r = saveSigningSecret(ctx.app, ctx.auth.user, field(form, "secret"));
  return back(ctx, r.ok ? { ok: true, message: "Signing secret saved." } : r);
}
// POST /settings/billing/stripe/disconnect
export async function stripeDisconnect(ctx: Ctx): Promise<Response> {
  if (!isPerson(ctx)) return notFoundPage(ctx);
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const r = await disconnectStripe(ctx.app, ctx.auth.user);
  return back(ctx, r.ok ? { ok: true, message: "Stripe is disconnected." } : r);
}
@@ -5,6 +5,8 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { connectStripe } from "../src/actions/billing.ts";
import { connectionOf } from "../src/billing/connection.ts";
import { entitlementOf } from "../src/billing/store.ts";
import { createUser, type User } from "../src/core/users.ts";
import { ok } from "../src/kernel/result.ts";
@@ -107,3 +109,52 @@
test("a non-admin who reaches the screen sees no forge and cannot grant", async
  expect(entitlementOf(app.db, "kid", "small").plan).toBe("large");
  tui.stop?.();
});
const type = (tui: ReturnType<typeof open>["tui"], text: string) => {
  for (const ch of text) tui.dispatch(key(ch));
};
test("the admin connects Stripe's signing secret, sees it masked, and disconnects after a yes", async () => {
  const k = "sk_test_AbCdEf1234567890";
  expect((await connectStripe(app, alice, k, "whsec_first1234567")).ok).toBe(true);
  expect(connectionOf(app.db)).toEqual({ mode: "sandbox", signed: true });
  const { tui, session } = open(alice);
  tui.ctx.push(billingScreen(session, tui.ctx));
  await settleApp(tui);
  expect(tui.screen.toText()).toContain("Stripe sandbox, signed");
  tui.dispatch(key("w"));
  await settleApp(tui);
  type(tui, "whsec_second123456");
  await settleApp(tui);
  expect(tui.screen.toText()).not.toContain("whsec_second123456");
  tui.dispatch(key("enter"));
  await settleApp(tui);
  expect(tui.screen.toText()).toContain("Signing secret saved.");
  tui.dispatch(key("x"));
  await settleApp(tui);
  expect(tui.screen.toText()).toContain("Remove the webhook and forget the key?");
  tui.dispatch(key("n"));
  await settleApp(tui);
  expect(connectionOf(app.db)).toBeDefined();
  tui.stop?.();
});
test("a bad key typed into the connect prompt is refused in words; a non-admin cannot open the prompt", async () => {
  const { tui, session } = open(alice);
  tui.ctx.push(billingScreen(session, tui.ctx));
  await settleApp(tui);
  tui.dispatch(key("c"));
  await settleApp(tui);
  type(tui, "pk_live_abcdefgh12");
  tui.dispatch(key("enter"));
  await settleApp(tui);
  expect(tui.screen.toText()).toContain("That is not a Stripe secret or restricted key");
  tui.stop?.();
  const bobs = open(bob);
  bobs.tui.ctx.push(billingScreen(bobs.session, bobs.tui.ctx));
  await settleApp(bobs.tui);
  bobs.tui.dispatch(key("x"));
  await settleApp(bobs.tui);
  expect(bobs.tui.screen.toText()).not.toContain("Remove the webhook");
  bobs.tui.stop?.();
});
@@ -137,7 +137,7 @@
describe("billing seam", () => {
    expect(page.status).toBe(200);
    const text = await page.text();
    expect(text).toContain("Choose the plan each forge is on.");
    expect(text).not.toContain("Stripe");
    expect(text).toContain("Paste a Stripe secret or restricted key");
    expect(text).toContain('data-forge="kid"');
    expect((await send("GET", "/settings/billing", bob)).status).toBe(404);
  });
@@ -28,6 +28,7 @@
const AUDITED_CLEAR: string[] = [
  "degraded_span.sentence",
  "feed_chip.value",
  "fleet_operation.value",
  "gift_redeem.code_id",
  "issue.body",
  "oauth_flow.detail",
  "oidc_key.public_jwk",
@@ -0,0 +1,238 @@
/**
 * The stripe provider (#11136): exact form bodies and headers against a fake
 * fetch, the connection sealed and never shown, the sandbox/live word.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { connectStripe, disconnectStripe, readBilling, saveSigningSecret } from "../src/actions/billing.ts";
import { connectionOf } from "../src/billing/connection.ts";
import { FORGE_STRIPE, STRIPE_VERSION, formBody, modeOf, stripeClient } from "../src/billing/stripe.ts";
import { mayUse } from "../src/apps/cloud.ts";
import { createUser, type User } from "../src/core/users.ts";
import { createToken } from "../src/core/tokens.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const KEY = "sk_test_AbCdEf1234567890";
type Call = { url: string; method: string; headers: Record<string, string>; body: string };
function fake(answer: (c: Call) => { status?: number; body: unknown } | Error) {
  const calls: Call[] = [];
  const f = (async (url: string, init: RequestInit) => {
    const c = { url, method: init.method ?? "GET", headers: init.headers as Record<string, string>, body: String(init.body ?? "") };
    calls.push(c);
    const a = answer(c);
    if (a instanceof Error) throw a;
    return new Response(JSON.stringify(a.body), { status: a.status ?? 200 });
  }) as unknown as typeof fetch;
  return { f, calls };
}
describe("stripe client", () => {
  test("the webhook endpoint: exact form, a fresh idempotency key each attempt, delete", async () => {
    const { f, calls } = fake((c) => (c.method === "DELETE" ? { body: { deleted: true } } : { body: { id: "we_1", secret: "whsec_abcdefgh12" } }));
    const s = stripeClient(KEY, f);
    expect(await s.addWebhook("https://f.test/hooks/stripe")).toEqual({ ok: true, value: { id: "we_1", secret: "whsec_abcdefgh12" } });
    await s.addWebhook("https://f.test/hooks/stripe");
    const c = calls[0]!;
    expect(c.url).toBe("https://api.stripe.com/v1/webhook_endpoints");
    expect(c.headers).toMatchObject({ authorization: `Bearer ${KEY}`, "stripe-version": STRIPE_VERSION, "content-type": "application/x-www-form-urlencoded" });
    expect(decodeURIComponent(c.body)).toBe(
      "url=https://f.test/hooks/stripe&enabled_events[0]=checkout.session.completed&enabled_events[1]=customer.subscription.updated&enabled_events[2]=customer.subscription.deleted&enabled_events[3]=invoice.paid&enabled_events[4]=invoice.payment_failed",
    );
    expect(calls[0]!.headers["idempotency-key"]).toBeTruthy();
    expect(calls[1]!.headers["idempotency-key"]).not.toBe(calls[0]!.headers["idempotency-key"]);
    await s.removeWebhook("we_1");
    expect(calls[2]).toMatchObject({ url: "https://api.stripe.com/v1/webhook_endpoints/we_1", method: "DELETE" });
    expect(calls[2]!.headers["idempotency-key"]).toBeUndefined();
  });
  test("modes read, form nesting encodes", () => {
    expect([modeOf("sk_test_abcdefgh"), modeOf("rk_live_abcdefgh"), modeOf("pk_live_abcdefgh")]).toEqual(["sandbox", "live", undefined]);
    expect(formBody({ a: { b: [1, 2] }, c: "x y&z", d: undefined })).toBe("a%5Bb%5D%5B0%5D=1&a%5Bb%5D%5B1%5D=2&c=x%20y%26z");
  });
  test("an error never carries the key or what was sent", async () => {
    const { f } = fake(() => ({ status: 400, body: { error: { code: "bad", message: `bad key ${KEY}` } } }));
    const r = await stripeClient(KEY, f).addWebhook("https://f.test/hooks/stripe");
    expect(r.ok).toBe(false);
    expect(JSON.stringify(r)).not.toContain(KEY);
    const down = await stripeClient(KEY, fake(() => new Error(`connect ${KEY}`)).f).removeWebhook("we_1");
    expect(JSON.stringify(down)).not.toContain(KEY);
    expect(down).toMatchObject({ ok: false, error: { kind: "unreachable" } });
  });
  test("the vendor is declared and mayUse says so", () => {
    expect(mayUse(FORGE_STRIPE, "stripe", "payments")).toBe(true);
    expect(mayUse(FORGE_STRIPE, "stripe", "dns")).toBe(false);
  });
});
describe("connecting stripe", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let alice: User;
  let bob: User;
  let token = "";
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-stripe-"));
    app = createApp({ dataDir, port: 0, url: "https://f.test" });
    servers = await serve(app);
    const a = await createUser(app.db, { origin: "seed", trusted: true, username: "alice", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true });
    const b = await createUser(app.db, { origin: "seed", trusted: true, username: "bob", email: "[email protected]", password: "a-good-passphrase" });
    if (!a.ok || !b.ok) throw new Error("user");
    alice = a.value;
    bob = b.value;
    token = createToken(app.db, alice.id, "admin", "admin").token;
  }, 30_000);
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const ok = () => fake(() => ({ body: { id: "we_9", secret: "whsec_abcdefgh12" } }));
  test("a non-admin and a bad key change nothing", async () => {
    const { f, calls } = ok();
    expect(await connectStripe(app, bob, KEY, "", f)).toEqual({ ok: false, error: "not_found" });
    expect(await connectStripe(app, alice, "pk_live_abcdefgh12", "", f)).toEqual({ ok: false, error: "bad_key" });
    expect(await connectStripe(app, alice, KEY, "nope", f)).toEqual({ ok: false, error: "bad_secret" });
    expect(calls).toEqual([]);
    expect(connectionOf(app.db)).toBeUndefined();
  });
  test("a key Stripe rejects is not kept", async () => {
    const { f } = fake(() => ({ status: 401, body: { error: { type: "authentication_error" } } }));
    expect(await connectStripe(app, alice, KEY, "", f)).toEqual({ ok: false, error: "refused" });
    expect(connectionOf(app.db)).toBeUndefined();
  });
  test("a key without permission is kept, told so, and takes a signing secret", async () => {
    const { f } = fake(() => ({ status: 403, body: { error: { type: "invalid_request_error" } } }));
    expect(await connectStripe(app, alice, KEY, "", f)).toEqual({ ok: false, error: "no_permission" });
    expect(connectionOf(app.db)).toEqual({ mode: "sandbox", signed: false });
    expect(saveSigningSecret(app, alice, "nope")).toEqual({ ok: false, error: "bad_secret" });
    expect(saveSigningSecret(app, alice, "whsec_pasted12345")).toEqual({ ok: true, value: { mode: "sandbox", signed: true } });
  });
  test("connect registers the endpoint, seals key and secret, and shows only the mode", async () => {
    await disconnectStripe(app, alice, ok().f);
    const { f, calls } = ok();
    const r = await connectStripe(app, alice, ` ${KEY} `, "", f);
    expect(r).toEqual({ ok: true, value: { mode: "sandbox", signed: true } });
    expect(calls[0]!.body).toContain("url=https%3A%2F%2Ff.test%2Fhooks%2Fstripe");
    const view = readBilling(app, alice);
    expect(view.ok && view.value.stripe).toEqual({ mode: "sandbox", signed: true });
    const rows = JSON.stringify([
      app.db.query("SELECT * FROM secret").all(),
      app.db.query("SELECT payload FROM event").all(),
    ]);
    expect(rows).not.toContain(KEY);
    expect(rows).not.toContain("whsec_abcdefgh12");
  });
  test("a live key reads live; the page says the word and never the key", async () => {
    const live = "rk_live_ZyXwVu0987654321";
    await connectStripe(app, alice, live, "", ok().f);
    expect(connectionOf(app.db)?.mode).toBe("live");
    expect(app.db.query<{ name: string }, []>("SELECT name FROM secret WHERE name LIKE 'STRIPE_KEY%'").all()).toEqual([{ name: "STRIPE_KEY_LIVE" }]);
    const res = await fetch(`${servers.url}/settings/billing`, { headers: { authorization: `Bearer ${token}` } });
    const text = await res.text();
    expect(text).toContain('data-mode="live"');
    expect(text).not.toContain(live);
  });
  test("the form route is same-origin only, and disconnect removes the endpoint and the secrets", async () => {
    const post = (origin: boolean) =>
      fetch(`${servers.url}/settings/billing/stripe/disconnect`, { method: "POST", redirect: "manual", headers: { authorization: `Bearer ${token}`, ...(origin ? {} : { origin: "https://evil.example" }) } });
    expect((await post(false)).status).toBe(403);
    expect(connectionOf(app.db)).toBeDefined();
    const { f, calls } = fake(() => ({ body: { deleted: true } }));
    expect(await disconnectStripe(app, bob, f)).toEqual({ ok: false, error: "not_found" });
    expect(await disconnectStripe(app, alice, f)).toEqual({ ok: true, value: true });
    expect(calls[0]).toMatchObject({ method: "DELETE", url: "https://api.stripe.com/v1/webhook_endpoints/we_9" });
    expect(connectionOf(app.db)).toBeUndefined();
    expect(app.db.query("SELECT COUNT(*) AS n FROM secret WHERE name LIKE 'STRIPE_%'").get()).toEqual({ n: 0 });
    expect((await post(true)).status).toBeLessThan(400);
  });
  const form = (path: string, body: Record<string, string>) =>
    fetch(`${servers.url}/settings/billing/stripe/${path}`, { method: "POST", redirect: "manual", headers: { authorization: `Bearer ${token}`, "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(body) });
  const flashOf = async (res: Response): Promise<string> => {
    const to = res.headers.get("location") ?? "/settings/billing";
    const cookie = (res.headers.get("set-cookie") ?? "").split(";")[0]!;
    const page = await fetch(new URL(to, servers.url), { headers: { authorization: `Bearer ${token}`, cookie } });
    return await page.text();
  };
  test("reconnecting forgets what the last key sealed, and removes its endpoint", async () => {
    await disconnectStripe(app, alice, ok().f);
    await connectStripe(app, alice, KEY, "", ok().f);
    const { f, calls } = fake(() => ({ status: 403, body: { error: { type: "invalid_request_error" } } }));
    const second = "sk_test_ZzZzZz9999999999";
    expect(await connectStripe(app, alice, second, "", f)).toEqual({ ok: false, error: "no_permission" });
    expect(calls.map((c) => c.method)).toEqual(["POST", "DELETE"]);
    // the old key's endpoint was removed, and its secret and id are gone
    expect(connectionOf(app.db)).toEqual({ mode: "sandbox", signed: false });
    expect(app.db.query("SELECT COUNT(*) AS n FROM secret WHERE name IN ('STRIPE_WEBHOOK_SECRET','STRIPE_WEBHOOK_ID')").get()).toEqual({ n: 0 });
    await connectStripe(app, alice, KEY, "whsec_pasted12345", ok().f);
    expect(app.db.query("SELECT COUNT(*) AS n FROM secret WHERE name = 'STRIPE_WEBHOOK_ID'").get()).toEqual({ n: 0 });
  });
  test("a reconnect with a new endpoint deletes the old one at Stripe", async () => {
    await disconnectStripe(app, alice, ok().f);
    await connectStripe(app, alice, KEY, "", fake(() => ({ body: { id: "we_old", secret: "whsec_oldoldold1" } })).f);
    const { f, calls } = fake((c) => (c.method === "DELETE" ? { body: { deleted: true } } : { body: { id: "we_new", secret: "whsec_newnewnew1" } }));
    expect(await connectStripe(app, alice, "sk_test_Another1234567890", "", f)).toEqual({ ok: true, value: { mode: "sandbox", signed: true } });
    expect(calls.map((c) => `${c.method} ${c.url.split("/").pop()}`)).toEqual(["POST webhook_endpoints", "DELETE we_old"]);
    expect(calls[1]!.headers["authorization"]).toBe(`Bearer ${KEY}`);
    expect(await disconnectStripe(app, alice, f)).toEqual({ ok: true, value: true });
    expect(calls[2]).toMatchObject({ method: "DELETE", url: "https://api.stripe.com/v1/webhook_endpoints/we_new" });
  });
  test("disconnect says so when the endpoint could not be removed, and still forgets the key", async () => {
    await connectStripe(app, alice, KEY, "", ok().f);
    const down = fake(() => ({ status: 500, body: {} }));
    expect(await disconnectStripe(app, alice, down.f)).toEqual({ ok: false, error: "left_at_stripe" });
    expect(connectionOf(app.db)).toBeUndefined();
  });
  test("the webhook address is the configured origin, not the request's Host", async () => {
    const { f, calls } = ok();
    await connectStripe(app, alice, KEY, "", f);
    expect(decodeURIComponent(calls[0]!.body)).toContain("url=https://f.test/hooks/stripe&");
    const bare = createApp({ dataDir: await mkdtemp(join(tmpdir(), "forge-stripe-bare-")), port: 0 });
    const a = await createUser(bare.db, { origin: "seed", trusted: true, username: "carol", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true });
    if (!a.ok) throw new Error("user");
    const none = ok();
    expect(await connectStripe(bare, a.value, KEY, "", none.f)).toEqual({ ok: false, error: "no_origin" });
    expect(none.calls).toEqual([]);
    bare.close();
  });
  test("the connect and secret routes, through HTTP, with their flash words", async () => {
    await disconnectStripe(app, alice, ok().f);
    const bad = await form("connect", { key: "pk_live_abcdefgh12" });
    expect(bad.status).toBeLessThan(400);
    expect(await flashOf(bad)).toContain("That is not a Stripe secret or restricted key");
    expect(connectionOf(app.db)).toBeUndefined();
    // no network in tests: a key and a pasted signing secret seal without a Stripe call
    const good = await form("connect", { key: KEY, secret: "whsec_pasted12345" });
    expect(await flashOf(good)).toContain("Stripe is connected (sandbox).");
    expect(connectionOf(app.db)).toEqual({ mode: "sandbox", signed: true });
    const worse = await form("secret", { secret: "nope" });
    expect(await flashOf(worse)).toContain("A signing secret starts whsec_");
    const saved = await form("secret", { secret: "whsec_another12345" });
    expect(await flashOf(saved)).toContain("Signing secret saved.");
    const asBob = await fetch(`${servers.url}/settings/billing/stripe/connect`, { method: "POST", redirect: "manual", headers: { authorization: `Bearer ${createToken(app.db, bob.id, "bob", "admin").token}`, "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ key: KEY }) });
    expect(asBob.status).toBe(404);
  });
});
@@ -51,7 +51,7 @@
const allowed: readonly { file: string; action: string; reason: string }[] = [
  { file: "src/tui/screens/deploys.ts", action: "stopEnv", reason: "in `act`, called from `go` after the Stop confirm" },
  { file: "src/tui/screens/boards.ts", action: "deleteBoard", reason: "in `remove`, called only on the y of the delete y/n" },
  { file: "src/tui/screens/about.ts", action: "detachFromParent", reason: "the first call is the dry run; the real one is in onChoose" },
  { file: "src/tui/screens/devices.ts", action: "revoke", reason: "passed to `askApp`, run only from the slug prompt's onSubmit" },
  { file: "src/tui/screens/codes.ts", action: "revoke", reason: "in `go`, passed to confirmScreen and yesNo as onChoose" },
];
/** How many lines above a call a `y` key check still guards it. */
		@@ -18,8 +18,8 @@ Beside `forge.json`, at the root of the repository:
18	18	{ "uses": [{ "vendor": "s3", "use": "backup", "why": "off-machine copy of the encrypted snapshot" }] }
19	19	```
20	20
21		- `vendor`: `cloudflare`, `fly`, `hetzner`, `s3`, `github`, `vercel`, `digitalocean` or `azure`.
22		- `use`: `compute`, `storage`, `backup`, `dns` or `cdn`.
	21	- `vendor`: `cloudflare`, `fly`, `hetzner`, `s3`, `github`, `vercel`, `digitalocean`, `azure` or `stripe`.
	22	- `use`: `compute`, `storage`, `backup`, `dns`, `cdn` or `payments`. The forge declares `stripe`/`payments` for itself (`FORGE_STRIPE`): `api.stripe.com`, for connecting (its webhook endpoint), and nothing else.
23	23	- `why`: one line, up to 300 characters.
24	24
25	25	No file means no uses. A malformed file is refused with one sentence
		@@ -125,3 +125,11 @@ plans by hand (`PUT /api/v1/forges/{name}/plan`, the Billing page, the
125	125	terminal, the MCP `forges` tool). A forge with no row is active on the plan
126	126	its size names. Nothing reads a plan to limit a forge yet. How to use it:
127	127	`docs/features/billing.md`.
	128
	129	### Connect Stripe
	130
	131	1. In Stripe, make a secret or restricted key (a `sk_test_`/`rk_test_` key is a sandbox; `sk_live_`/`rk_live_` is live). A restricted key needs write on Webhook Endpoints.
	132	2. Settings → Billing → Provider: paste it and press Connect. The forge seals it with its secrets and never shows it again; the page says sandbox or live. In the terminal: Billing, `c`, paste the key (shown as dots).
	133	3. The forge registers its own webhook at its configured public address (`FORGE_URL`) `/hooks/stripe` for five events and seals the signing secret. A key that may not do that is told so; paste a `whsec_` signing secret instead.
	134	4. Plain `fetch` calls, nothing to create in Stripe's dashboard (`src/billing/stripe.ts`, API version pinned in `STRIPE_VERSION`). Reconnecting forgets the old key's secret and removes its endpoint.
	135	5. Disconnect (page, or `x` in the terminal) removes the endpoint and the sealed key, and says so when Stripe could not remove the endpoint. `api.stripe.com` is the one declared vendor (`stripe`/`payments`, docs/CLOUD.md).
		@@ -5,7 +5,8 @@ Billing records the plan each forge is on (`src/billing/`): a store of entitleme
5	5	- Plans: small, medium or large, the sizes. A forge never granted a plan reads as `active` on its size, source `granted`.
6	6	- Grant by hand (admin, a person): the Billing page, the terminal screen, `PUT /api/v1/forges/{name}/plan` with `{ "plan": "large" }` (`GET` reads it), or the MCP `forges` tool with `{ forge, plan }` (planned first; `dryRun: false` grants).
7	7	- Audit: every grant is a row in `entitlement_change` and a `billing.plan` event.
8		- Terminal: the palette's Billing (admins), `src/tui/screens/billing.ts`: `j`/`k` pick a forge, `s`, `m` or `l` grants that plan after a yes/no.
	8	- Terminal: the palette's Billing (admins), `src/tui/screens/billing.ts`: `j`/`k` pick a forge, `s`, `m` or `l` grants that plan after a yes/no; `c` connects Stripe (key shown as dots), `w` saves a signing secret, `x` disconnects after a yes/no.
	9	- Stripe (#11136): Settings → Billing → Provider takes one key (`src/billing/stripe.ts`, `connection.ts`); how to connect it is in `docs/PROFIT.md`. Not yet: the `/hooks/stripe` receiver, and checkout, portal and reconcile, which come with the pull that calls them.
9	10
10	11	## Gift codes
11	12	A code gives a plan for free, with or without a payment provider (`src/billing/codes.ts`, `src/actions/codes.ts`). No provider is asked: a redeemed code writes the entitlement itself, source `code:<id>`.
		@@ -1,5 +1,4 @@
1	1	[
2		"src/apps/cloud.ts",
3	2	"src/crew/governor_log.ts",
4	3	"src/flow/alarm_unproposed.ts",
5	4	"src/flow/approved_wait.ts",
		@@ -11,11 +11,27 @@ import { changesOf, entitlementOf, putEntitlement, type EntitlementChange } from
11	11	import type { Entitlement } from "../billing/types.ts";
12	12	import type { User } from "../core/users.ts";
13	13	import { err, ok, type Result } from "../kernel/result.ts";
	14	import { connectionOf, forget, openKey, sealKey, sealWebhook, type Connection } from "../billing/connection.ts";
	15	import { isStripeKey, stripeClient, type StripeError } from "../billing/stripe.ts";
	16	import { publicOrigin } from "../core/public_origin.ts";
	17	import { holdValues } from "../kernel/log.ts";
14	18	import { listChildrenNow } from "./spawn.ts";
15	19	import { parseSize } from "../spawn/sizes.ts";
16	20
17	21	export type BillingError = "not_found" \| "no_such_forge" \| "bad_plan";
18	22
	23	export type StripeWords = "no_origin" \| "left_at_stripe" \| "bad_key" \| "bad_secret" \| "not_connected" \| "no_permission" \| "refused" \| "unreachable";
	24	export const STRIPE_WORDS: Record<StripeWords, string> = {
	25	no_origin: "This forge does not know its public address; set FORGE_URL so it can register its webhook, or paste a signing secret with the key",
	26	left_at_stripe: "Disconnected here, but Stripe's webhook endpoint could not be removed; delete it on Stripe's webhook page",
	27	bad_key: "That is not a Stripe secret or restricted key (it starts sk_ or rk_)",
	28	bad_secret: "A signing secret starts whsec_",
	29	not_connected: "Stripe is not connected",
	30	no_permission: "Connected, but this key may not create webhook endpoints. Paste a signing secret from Stripe's webhook page below",
	31	refused: "Stripe refused the key",
	32	unreachable: "Stripe could not be reached",
	33	};
	34
19	35	export const BILLING_WORDS: Record<Exclude<BillingError, "not_found">, string> = {
20	36	no_such_forge: "No forge by that name was sent from here",
21	37	bad_plan: "A plan is small, medium or large",
		@@ -23,6 +39,8 @@ export const BILLING_WORDS: Record<Exclude<BillingError, "not_found">, string> =
23	39
24	40	export interface BillingView {
25	41	readonly forges: readonly (Entitlement & { size: string })[];
	42	/** The Stripe connection (mode, whether events are signed), never the key. */
	43	readonly stripe: Connection \| undefined;
26	44	}
27	45
28	46	const admin = (a: User \| undefined): Result<User, "not_found"> => (a?.isAdmin === true && a.kind !== "agent" ? ok(a) : err("not_found"));
		@@ -32,6 +50,7 @@ export function readBilling(app: App, actor: User \| undefined): Result<BillingVi
32	50	if (!who.ok) return who;
33	51	return ok({
34	52	forges: listChildrenNow(app).map((c) => ({ ...entitlementOf(app.db, c.name, c.size), size: c.size })),
	53	stripe: connectionOf(app.db),
35	54	});
36	55	}
37	56
		@@ -67,3 +86,79 @@ export function grantPlan(app: App, actor: User \| undefined, forge: unknown, pla
67	86	app.bus.append({ kind: "billing.plan", actorId: who.id, payload: { forge: to.forge, from: from.plan, to: to.plan, source: "granted" } });
68	87	return ok({ entitlement, changes: changesOf(app.db, to.forge) });
69	88	}
	89
	90	const SIGNING = /^whsec_[A-Za-z0-9]{8,}$/;
	91	const failure = (e: StripeError): StripeWords => (e.kind === "permission" ? "no_permission" : e.kind === "unreachable" ? "unreachable" : "refused");
	92
	93	/**
	94	* Connect Stripe with one pasted key: the forge registers its own webhook
	95	* endpoint (`<public origin>/hooks/stripe`, from the forge's configuration,
	96	* never from a request's Host) and seals the signing secret it gets. A key
	97	* Stripe rejects is not kept, and the connection it would have replaced
	98	* stays. A key that may not create endpoints is kept, and the answer
	99	* `no_permission` asks for a signing secret (`saveSigningSecret`).
	100	* `signingSecret` given with the key skips the call. Whatever the previous
	101	* connection sealed is forgotten first, and its endpoint removed at Stripe,
	102	* so no secret or endpoint id outlives the key it belonged to.
	103	*/
	104	export async function connectStripe(
	105	app: App,
	106	actor: User \| undefined,
	107	key: unknown,
	108	signingSecret: unknown,
	109	fetchFn: typeof fetch = fetch,
	110	): Promise<Result<Connection, BillingError \| StripeWords>> {
	111	const who = admin(actor);
	112	if (!who.ok) return who;
	113	const k = typeof key === "string" ? key.trim() : "";
	114	const sec = typeof signingSecret === "string" ? signingSecret.trim() : "";
	115	if (!isStripeKey(k)) return err("bad_key");
	116	if (sec !== "" && !SIGNING.test(sec)) return err("bad_secret");
	117	if (sec === "" && app.config.url === undefined) return err("no_origin");
	118	holdValues("stripe", [k, ...(sec === "" ? [] : [sec])]);
	119	let denied: StripeWords \| undefined;
	120	let hook: { id: string; secret: string } \| undefined;
	121	if (sec === "") {
	122	const made = await stripeClient(k, fetchFn).addWebhook(`${publicOrigin(app.config.url, "")}/hooks/stripe`);
	123	if (made.ok) hook = made.value;
	124	else if (made.error.kind === "permission") denied = "no_permission";
	125	else return err(failure(made.error));
	126	}
	127	const old = openKey(app.db, app.config.dataDir, app.bus, who.value.id);
	128	if (old && old.endpointId !== "" && old.endpointId !== hook?.id) await stripeClient(old.key, fetchFn).removeWebhook(old.endpointId);
	129	forget(app.db);
	130	if (!sealKey(app.db, app.config.dataDir, k)) return err("bad_key");
	131	if (hook) sealWebhook(app.db, app.config.dataDir, hook.secret, hook.id);
	132	else if (sec !== "") sealWebhook(app.db, app.config.dataDir, sec);
	133	const c = connectionOf(app.db) as Connection;
	134	app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "stripe", mode: c.mode, signed: c.signed } });
	135	return denied ? err(denied) : ok(c);
	136	}
	137
	138	/** A signing secret pasted by hand, for a key that may not register one. */
	139	export function saveSigningSecret(app: App, actor: User \| undefined, secret: unknown): Result<Connection, BillingError \| StripeWords> {
	140	const who = admin(actor);
	141	if (!who.ok) return who;
	142	if (!connectionOf(app.db)) return err("not_connected");
	143	const sec = typeof secret === "string" ? secret.trim() : "";
	144	if (!SIGNING.test(sec)) return err("bad_secret");
	145	holdValues("stripe", [sec]);
	146	sealWebhook(app.db, app.config.dataDir, sec);
	147	app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "stripe", signed: true } });
	148	return ok(connectionOf(app.db) as Connection);
	149	}
	150
	151	/**
	152	* Remove the webhook endpoint and the sealed key and secret; the key and secret go even when Stripe cannot be reached,
	153	* and `left_at_stripe` says the endpoint is still there.
	154	*/
	155	export async function disconnectStripe(app: App, actor: User \| undefined, fetchFn: typeof fetch = fetch): Promise<Result<true, BillingError \| StripeWords>> {
	156	const who = admin(actor);
	157	if (!who.ok) return who;
	158	const open = openKey(app.db, app.config.dataDir, app.bus, who.value.id);
	159	if (!open) return err("not_connected");
	160	const removed = open.endpointId === "" ? undefined : await stripeClient(open.key, fetchFn).removeWebhook(open.endpointId);
	161	forget(app.db);
	162	app.bus.append({ kind: "billing.provider", actorId: who.value.id, payload: { provider: "none", ...(removed && !removed.ok ? { endpointLeft: true } : {}) } });
	163	return removed && !removed.ok ? err("left_at_stripe") : ok(true);
	164	}
		@@ -496,9 +496,9 @@ export function parseCheck(
496	496	}
497	497
498	498	/** The vendors a repository may name in `cloud.json`; a closed set. */
499		export const CLOUD_VENDORS = ["cloudflare", "fly", "hetzner", "s3", "github", "vercel", "digitalocean", "azure"] as const;
	499	export const CLOUD_VENDORS = ["cloudflare", "fly", "hetzner", "s3", "github", "vercel", "digitalocean", "azure", "stripe"] as const;
500	500	/** What a vendor may be used for; a closed set. */
501		export const CLOUD_USES = ["compute", "storage", "backup", "dns", "cdn"] as const;
	501	export const CLOUD_USES = ["compute", "storage", "backup", "dns", "cdn", "payments"] as const;
502	502	export type CloudVendor = (typeof CLOUD_VENDORS)[number];
503	503	export type CloudUse = (typeof CLOUD_USES)[number];
504	504
		@@ -0,0 +1,59 @@
	1	/**
	2	* The Stripe connection as stored (#11136): the pasted key and the webhook's
	3	* signing secret, sealed with the forge's secrets (`core/secret_store.ts`).
	4	* The mode is in the secret's NAME (`STRIPE_KEY_TEST` or `STRIPE_KEY_LIVE`),
	5	* so every admin view can say sandbox or live without opening the key.
	6	* Opening a value is only `openKey`, and it makes the value redacted from
	7	* logs for the life of the process.
	8	*/
	9
	10	import type { Database } from "bun:sqlite";
	11	import type { EventBus } from "../core/events.ts";
	12	import { deleteSecret, listSecretNames, resolveSecrets, setSecret } from "../core/secret_store.ts";
	13	import { holdValues } from "../kernel/log.ts";
	14	import { modeOf, type StripeMode } from "./stripe.ts";
	15
	16	const KEY_NAME: Record<StripeMode, string> = { sandbox: "STRIPE_KEY_TEST", live: "STRIPE_KEY_LIVE" };
	17	const SECRET = "STRIPE_WEBHOOK_SECRET";
	18	const ENDPOINT = "STRIPE_WEBHOOK_ID";
	19
	20	export interface Connection {
	21	readonly mode: StripeMode;
	22	/** True when a signing secret is sealed, so events can be verified. */
	23	readonly signed: boolean;
	24	}
	25
	26	/** What is connected, from names alone: nothing is opened. */
	27	export function connectionOf(db: Database): Connection \| undefined {
	28	const names = new Set(listSecretNames(db, "forge").map((s) => s.name));
	29	const mode = names.has(KEY_NAME.live) ? "live" : names.has(KEY_NAME.sandbox) ? "sandbox" : undefined;
	30	return mode === undefined ? undefined : { mode, signed: names.has(SECRET) };
	31	}
	32
	33	/** Seal the key under its mode's name, forgetting the other mode's. False when it is not a Stripe key. */
	34	export function sealKey(db: Database, dataDir: string, key: string): boolean {
	35	const mode = modeOf(key);
	36	if (mode === undefined) return false;
	37	deleteSecret(db, "forge", "", KEY_NAME[mode === "live" ? "sandbox" : "live"]);
	38	return setSecret(db, dataDir, "forge", "", KEY_NAME[mode], key).ok;
	39	}
	40
	41	export function sealWebhook(db: Database, dataDir: string, secret: string, endpointId = ""): boolean {
	42	if (endpointId !== "" && !setSecret(db, dataDir, "forge", "", ENDPOINT, endpointId).ok) return false;
	43	return setSecret(db, dataDir, "forge", "", SECRET, secret).ok;
	44	}
	45
	46	/** The sealed key and the endpoint id, opened (audited as `secret.read`). */
	47	export function openKey(db: Database, dataDir: string, bus: EventBus, actor: string): { key: string; endpointId: string } \| undefined {
	48	const c = connectionOf(db);
	49	if (!c) return undefined;
	50	const got = resolveSecrets(db, dataDir, bus, [KEY_NAME[c.mode], ENDPOINT], { actor });
	51	const key = got[KEY_NAME[c.mode]];
	52	if (key === undefined) return undefined;
	53	holdValues("stripe", [key]);
	54	return { key, endpointId: got[ENDPOINT] ?? "" };
	55	}
	56
	57	export function forget(db: Database): void {
	58	for (const n of [...Object.values(KEY_NAME), SECRET, ENDPOINT]) deleteSecret(db, "forge", "", n);
	59	}
		@@ -0,0 +1,116 @@
	1	/**
	2	* The `stripe` provider of the Billing seam (#11136): Stripe over `fetch`
	3	* and nothing else, no SDK. The owner pastes one secret or restricted key;
	4	* checkout uses inline `price_data`, so nothing is set up in Stripe's
	5	* dashboard. Plain data in, a Result out. A key is held only in the closure
	6	* of `stripeClient`: it goes in one `Authorization` header and into no error,
	7	* no log line and no argument list. A failed call says what Stripe said
	8	* about the request (its status and error code), never what was sent.
	9	*
	10	* The vendor is declared (`FORGE_STRIPE`, docs/CLOUD.md) and every call asks
	11	* `mayUse` first. The way out: disconnect removes the webhook endpoint and
	12	* the sealed key; the entitlements stay in the store.
	13	*/
	14
	15	import { mayUse } from "../apps/cloud.ts";
	16	import type { CloudDeclaration } from "../apps/manifest.ts";
	17	import { err, ok, type Result } from "../kernel/result.ts";
	18
	19	export const STRIPE_API = "https://api.stripe.com";
	20	/** The one API version every call is pinned to. */
	21	export const STRIPE_VERSION = "2025-09-30.clover";
	22	export const WEBHOOK_EVENTS = [
	23	"checkout.session.completed",
	24	"customer.subscription.updated",
	25	"customer.subscription.deleted",
	26	"invoice.paid",
	27	"invoice.payment_failed",
	28	] as const;
	29
	30	/** What the forge declares for itself: the only vendor its own process calls. */
	31	export const FORGE_STRIPE: readonly CloudDeclaration[] = [
	32	{ vendor: "stripe", use: "payments", why: "the plans payment webhook; leave by disconnecting" },
	33	];
	34
	35	export type StripeMode = "sandbox" \| "live";
	36	const KEY = /^(sk\|rk)_(test\|live)_[A-Za-z0-9]{8,}$/;
	37
	38	export const isStripeKey = (key: string): boolean => KEY.test(key);
	39
	40	/** `sandbox` for a test key, `live` for a live one; undefined when it is no Stripe key. */
	41	export function modeOf(key: string): StripeMode \| undefined {
	42	const m = KEY.exec(key);
	43	return m ? (m[2] === "test" ? "sandbox" : "live") : undefined;
	44	}
	45
	46	export type StripeError =
	47	\| { kind: "permission"; message: string }
	48	\| { kind: "rejected"; message: string; status: number }
	49	\| { kind: "unreachable"; message: string };
	50
	51	type Value = string \| number \| boolean \| undefined \| Value[] \| { [k: string]: Value };
	52
	53	/** Stripe's form encoding: nested keys in brackets, arrays by index. */
	54	export function formBody(data: { [k: string]: Value }): string {
	55	const parts: string[] = [];
	56	const add = (name: string, v: Value): void => {
	57	if (v === undefined) return;
	58	if (Array.isArray(v)) v.forEach((x, i) => add(`${name}[${i}]`, x));
	59	else if (typeof v === "object") for (const [k, x] of Object.entries(v)) add(`${name}[${k}]`, x);
	60	else parts.push(`${encodeURIComponent(name)}=${encodeURIComponent(String(v))}`);
	61	};
	62	for (const [k, v] of Object.entries(data)) add(k, v);
	63	return parts.join("&");
	64	}
	65
	66	export interface StripeClient {
	67	addWebhook(url: string): Promise<Result<{ id: string; secret: string }, StripeError>>;
	68	removeWebhook(id: string): Promise<Result<true, StripeError>>;
	69	}
	70
	71	const PERMISSION = "This key may not create webhook endpoints. Paste a signing secret from Stripe's webhook page instead.";
	72
	73	export function stripeClient(key: string, fetchFn: typeof fetch = fetch): StripeClient {
	74	const call = async (method: "GET" \| "POST" \| "DELETE", path: string, data?: { [k: string]: Value }, idem?: string): Promise<Result<Record<string, unknown>, StripeError>> => {
	75	if (!mayUse(FORGE_STRIPE, "stripe", "payments")) return err({ kind: "unreachable", message: "Stripe is not declared for this forge." });
	76	const headers: Record<string, string> = { authorization: `Bearer ${key}`, "stripe-version": STRIPE_VERSION };
	77	if (method === "POST") {
	78	headers["content-type"] = "application/x-www-form-urlencoded";
	79	if (idem) headers["idempotency-key"] = idem;
	80	}
	81	let res: Response;
	82	try {
	83	res = await fetchFn(`${STRIPE_API}${path}`, { method, headers, ...(method === "POST" ? { body: formBody(data ?? {}) } : {}) });
	84	} catch {
	85	return err({ kind: "unreachable", message: "Stripe could not be reached." });
	86	}
	87	let json: Record<string, unknown> = {};
	88	try {
	89	json = (await res.json()) as Record<string, unknown>;
	90	} catch {
	91	// an empty or non-JSON body: the status says enough
	92	}
	93	if (res.ok) return ok(json);
	94	const e = (json["error"] ?? {}) as Record<string, unknown>;
	95	const code = typeof e["code"] === "string" ? e["code"] : typeof e["type"] === "string" ? e["type"] : "error";
	96	if (res.status === 403 \|\| e["type"] === "invalid_request_error" && res.status === 401) return err({ kind: "permission", message: PERMISSION });
	97	return err({ kind: "rejected", status: res.status, message: `Stripe refused the request (${res.status}, ${String(code).replace(/[^\w.-]/g, "").slice(0, 60)}).` });
	98	};
	99	const str = (o: Record<string, unknown>, k: string): string => (typeof o[k] === "string" ? (o[k] as string) : "");
	100	const missing = (what: string): StripeError => ({ kind: "rejected", status: 502, message: `Stripe's answer had no ${what}.` });
	101
	102	return {
	103	async addWebhook(url) {
	104	const r = await call("POST", "/v1/webhook_endpoints", { url, enabled_events: [...WEBHOOK_EVENTS] },
	105	// fresh per attempt: Stripe replays an answer for a repeated key for 24h, and a reconnect must not get a deleted endpoint back
	106	crypto.randomUUID());
	107	if (!r.ok) return r;
	108	const id = str(r.value, "id"), secret = str(r.value, "secret");
	109	return id && secret ? ok({ id, secret }) : err(missing("signing secret"));
	110	},
	111	async removeWebhook(id) {
	112	const r = await call("DELETE", `/v1/webhook_endpoints/${encodeURIComponent(id)}`);
	113	return r.ok ? ok(true as const) : r;
	114	},
	115	};
	116	}
		@@ -18,7 +18,7 @@ import { teamPage, teamSet, teamsPage, teamsStream } from "../web/pages/teams.ts
18	18	import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
19	19	import { flagsPage, flagsSet } from "../web/pages/flags.ts";
20	20	import { appTemplatesPage, appTemplatesSet } from "../web/pages/app_templates.ts";
21		import { billingPage, billingGrant, billingMakeCode, billingRevokeCode } from "../web/pages/billing.ts";
	21	import { billingPage, billingGrant, billingMakeCode, billingRevokeCode, stripeConnect, stripeDisconnect, stripeSecret } from "../web/pages/billing.ts";
22	22	import { economicsPage, economicsSet } from "../web/pages/economics.ts";
23	23	import { trustedAdd, trustedPage, trustedRemove, trustedRevert, trustedStop } from "../web/pages/trusted.ts";
24	24	import { usagePage } from "../web/pages/usage.ts";
		@@ -210,6 +210,9 @@ export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
210	210	router.add("POST", "/settings/economics", economicsSet);
211	211	router.add("GET", "/settings/billing", billingPage);
212	212	router.add("POST", "/settings/billing/grant", billingGrant);
	213	router.add("POST", "/settings/billing/stripe/connect", stripeConnect);
	214	router.add("POST", "/settings/billing/stripe/secret", stripeSecret);
	215	router.add("POST", "/settings/billing/stripe/disconnect", stripeDisconnect);
213	216	router.add("POST", "/settings/billing/codes", billingMakeCode);
214	217	router.add("POST", "/settings/billing/codes/revoke", billingRevokeCode);
215	218	router.add("GET", "/settings/flags", flagsPage);
		@@ -3,9 +3,11 @@
3	3	* and the hand grant, through the same `readBilling` and `grantPlan` the page
4	4	* and API use. `s`, `m` or `l` grants the forge under the cursor that plan
5	5	* after a yes/no; the change is kept in the audit trail like any other.
	6	* `c` connects Stripe with a pasted key (shown as dots), `w` saves a webhook
	7	* signing secret, `x` disconnects after a yes/no: the same actions as the page.
6	8	*/
7	9
8		import { grantPlan, readBilling, BILLING_WORDS } from "../../actions/billing.ts";
	10	import { grantPlan, readBilling, connectStripe, disconnectStripe, saveSigningSecret, BILLING_WORDS, STRIPE_WORDS } from "../../actions/billing.ts";
9	11	import type { Ctx, Screen } from "../app/app.ts";
10	12	import { binding } from "../app/keys.ts";
11	13	import { fill, len, split } from "../ui/layout.ts";
		@@ -13,10 +15,12 @@ import { style } from "../term/style.ts";
13	15	import { truncate } from "../term/width.ts";
14	16	import type { Session } from "../session.ts";
15	17	import { emptyState } from "../ui/widgets.ts";
16		import { ListState, confirmScreen, drawList, yesNo, type ListRow } from "./common.ts";
	18	import { ListState, confirmScreen, drawList, promptScreen, yesNo, type ListRow } from "./common.ts";
17	19	import type { PaletteEntry } from "./entries.ts";
18	20
19	21	const isAdmin = (f: Session): boolean => f.user?.isAdmin === true && f.user.kind !== "agent";
	22	const stripeWords = (e: keyof typeof STRIPE_WORDS \| "not_found" \| "no_such_forge" \| "bad_plan"): string =>
	23	e === "not_found" ? "Not found." : e in STRIPE_WORDS ? `${STRIPE_WORDS[e as keyof typeof STRIPE_WORDS]}.` : `${BILLING_WORDS[e as keyof typeof BILLING_WORDS]}.`;
20	24	const PLANS: Record<string, string> = { s: "small", m: "medium", l: "large" };
21	25
22	26	export function billingRows(f: Session): ListRow[] {
		@@ -30,21 +34,50 @@ export function billingScreen(f: Session, ctx: Ctx): Screen {
30	34	let note = "";
31	35	const screen: Screen = {
32	36	title: "Billing",
33		keys: [binding(["j", "k"], "move cursor"), binding(["s", "m", "l"], "grant small, medium, large"), binding(["esc"], "back")],
	37	keys: [binding(["j", "k"], "move cursor"), binding(["s", "m", "l"], "grant small, medium, large"), binding(["c"], "connect Stripe"), binding(["w"], "signing secret"), binding(["x"], "disconnect Stripe"), binding(["esc"], "back")],
34	38	render(area, s) {
35	39	const c = ctx.theme.c;
36	40	const rows = billingRows(f);
37	41	state.clamp(rows.length);
	42	const sc = readBilling(f.app, f.user);
	43	const stripe = sc.ok && sc.value.stripe ? `Stripe ${sc.value.stripe.mode}, ${sc.value.stripe.signed ? "signed" : "no signing secret"}` : "Stripe not connected";
38	44	if (rows.length === 0) {
39		emptyState(s, area, c, { title: "No forge has been sent from here.", body: "Billing has nothing to grant yet." });
	45	emptyState(s, area, c, { title: "No forge has been sent from here.", body: note === "" ? `Billing has nothing to grant yet. ${stripe}.` : note });
40	46	return;
41	47	}
42	48	const [head, body] = split(area, "v", [len(1), fill(1)]);
43		const line = note === "" ? "Every forge is free within its plan; a grant is recorded by hand" : note;
	49	const line = note === "" ? `${stripe} (c connect, w secret, x disconnect)` : note;
44	50	s.text(head!.x, head!.y, truncate(line, head!.w), style(c.mutedFg, c.bg), head!.x + head!.w);
45	51	drawList(s, body!, c, state, rows);
46	52	},
47	53	key(e) {
	54	if (isAdmin(f) && (e.key === "c" \|\| e.key === "w")) {
	55	const connect = e.key === "c";
	56	ctx.push(
	57	promptScreen(ctx, screen, {
	58	title: connect ? "Connect Stripe" : "Webhook signing secret",
	59	label: connect ? "Stripe secret or restricted key" : "Signing secret (whsec_…)",
	60	mask: true,
	61	onSubmit: async (value) => {
	62	const done = connect ? await connectStripe(f.app, f.user, value, "") : saveSigningSecret(f.app, f.user, value);
	63	note = done.ok ? (connect ? "Stripe is connected." : "Signing secret saved.") : stripeWords(done.error);
	64	ctx.invalidate();
	65	},
	66	}),
	67	);
	68	return true;
	69	}
	70	if (isAdmin(f) && e.key === "x") {
	71	const go = (i: number): void => {
	72	if (i !== 0) return;
	73	void disconnectStripe(f.app, f.user).then((r) => {
	74	note = r.ok ? "Stripe is disconnected." : stripeWords(r.error);
	75	ctx.invalidate();
	76	});
	77	};
	78	ctx.push(yesNo(ctx, confirmScreen(ctx, screen, { title: "Disconnect Stripe", body: ["Remove the webhook and forget the key?"], actions: [{ label: "Disconnect" }, { label: "Cancel" }], onChoose: go }), go));
	79	return true;
	80	}
48	81	const plan = PLANS[e.key];
49	82	const rows = billingRows(f);
50	83	const target = rows[state.index];