fix(console): account for partial Zen refunds

[opencode-agent]

Summary

• make the Stripe charge.refunded webhook deduct the actual refunded amount instead of always deducting the original top-up amount
• only mark/deduct once by guarding on payment.time_refunded is null, so webhook retries do not double-deduct
• keep subscription/lite enriched payments from mutating Zen balance

Validation

• bun run typecheck from packages/console/app

Note: local git push pre-push hook runs full monorepo bun turbo typecheck; that failed outside this change in @opencode-ai/server via packages/core/src/tool/{apply-patch,edit}.ts missing diff type declarations. Branch was pushed with HUSKY=0 after the targeted Console app typecheck passed.

[andrei-hasna]

Merge review result: not merging yet.

Validation/status checked:

• GitHub checks are green and GitHub reports the PR as mergeable/clean.
• Local focused validation passed in an isolated worktree: bun install --frozen-lockfile, then bun run --cwd packages/console/app typecheck.
• Synthetic merge-tree against refreshed origin/dev was clean.

Merge blockers:

• This PR is still a draft and has no reviews.
• The branch is currently 1 commit ahead and 12 commits behind origin/dev.
• More importantly, the refund accounting change still under-deducts multiple partial refunds. charge.refunded sends a Charge object, and Stripe's amount_refunded is the cumulative refunded amount on that charge; Stripe also allows multiple partial refunds. This patch marks PaymentTable.timeRefunded on the first refund and then requires time_refunded is null plus marked.rowsAffected > 0 before deducting balance. A second partial refund for the same payment will therefore deduct nothing, even though the cumulative refunded amount increased.

Suggested fix: persist the refunded amount already accounted for, or process individual refund events with refund-id idempotency, then deduct only the new delta: min(charge.amount_refunded, payment.amount) - already_accounted_refund_amount. timeRefunded should only be used as a full-refund marker once the payment is fully refunded.

Reference docs:

• https://docs.stripe.com/api/events/types (charge.refunded includes partial refunds)
• https://docs.stripe.com/api/charges/object (amount_refunded on Charge)
• https://docs.stripe.com/api/refunds/create (partial refunds can happen multiple times)

[andrei-hasna]

Merge review result: still not merging.

Validation evidence from a fresh isolated worktree on current origin/dev (61a7f6db3):

• Synthetic merge of b95318f36aafa092413296cbed8fc80745550b65 applied cleanly.
• bun install --frozen-lockfile passed.
• bun run --cwd packages/console/app typecheck passed.
• bun run --cwd packages/console/core typecheck passed.
• bun run lint -- packages/console/app/src/routes/stripe/webhook.ts exited 0 with existing warnings only.
• Existing console app tests providerUsage.test.ts and rateLimiter.test.ts passed 6/6.

Merge blockers remain:

• The PR is still a draft and has no reviews.
• The branch is now 14 commits behind current dev.
• More importantly, the accounting behavior is still unsafe for multiple partial refunds. charge.amount_refunded is cumulative on the Stripe Charge object, but this patch sets PaymentTable.timeRefunded on the first refund and then requires time_refunded is null / rowsAffected > 0 before deducting balance. A later partial refund for the same payment will deduct nothing.
• A partial refund is also represented as a full refund in the current schema/UI because timeRefunded drives the refunded display state.

Needed before merge: store or ledger the already-accounted refunded amount/refund IDs, deduct only the new refund delta up to payment.amount, avoid treating partial refunds as full refunds, and add targeted tests for duplicate events, first partial refund, sequential partial refunds, and full refund idempotency.

[andrei-hasna]

Merge review refresh for task 95480452: still not merging.

Current state checked on 2026-06-28:

• PR head is b95318f36aafa092413296cbed8fc80745550b65; current dev is dfeb1b5051a05b359bd4af711b204d2c0342c5f4.
• Branch is 1 commit ahead and 15 commits behind current dev.
• GitHub reports mergeable/clean and all 10 checks pass.
• Local isolated merge into current dev applied cleanly.
• Focused validation passed: bun install --frozen-lockfile, bun run --cwd packages/console/app typecheck, and bun run lint -- packages/console/app/src/routes/stripe/webhook.ts exited 0 with existing warnings only.

Merge blockers remain:

• The PR is still a draft and has no reviews.
• The refund accounting is still unsafe for multiple partial refunds. In packages/console/app/src/routes/stripe/webhook.ts, the patch deducts charge.amount_refunded only when PaymentTable.timeRefunded is null. Since Stripe Charge amount_refunded is cumulative, a second partial refund for the same payment gets rowsAffected === 0 and deducts no new refund delta.
• The schema/UI still only use timeRefunded as a boolean refunded marker, so partial refunds are represented like full refunds.

Needed before merge: persist the already-accounted refunded amount or process refund IDs idempotently, deduct only the new delta up to the original payment amount, represent partial vs full refunds accurately, and add targeted tests for duplicate events, first partial refund, sequential partial refunds, and full refund idempotency. Existing follow-up task: 363923ed.

[andrei-hasna]

Merge review refresh for task 99f73a07: not merging.

Current state checked on 2026-06-28 at 13:52 +03:00:

• PR head is b95318f36aafa092413296cbed8fc80745550b65; current origin/dev is 6ee817d0416cc902bdf1e05b0a3db1e94d07434a.
• Branch is 1 commit ahead and 16 commits behind current dev.
• GitHub REST reports mergeable: true / mergeable_state: clean, and all 10 visible checks are green.
• Local isolated synthetic merge into current origin/dev applied cleanly.
• Focused validation passed: bun install --frozen-lockfile, bun run --cwd packages/console/app typecheck, and bun run lint -- packages/console/app/src/routes/stripe/webhook.ts exited 0 with existing warnings only.
• A fresh adversarial verifier independently recommended no-merge.

Merge blockers remain:

• The PR is still a draft and has no reviews.
• Maintainer edits are disabled on the PR.
• The accounting behavior is still unsafe for multiple partial refunds. In packages/console/app/src/routes/stripe/webhook.ts, the patch deducts charge.amount_refunded only when PaymentTable.timeRefunded is null. Since Stripe Charge amount_refunded is cumulative, a second partial refund for the same payment gets rowsAffected === 0 and deducts no new refund delta. Example: a $100 top-up with $30 refunded first and $20 refunded later deducts $30, then ignores the later $20.
• The current schema/UI still only model timeRefunded as a refunded marker, so a partial refund is represented like a full refund.

Needed before merge: persist the already-accounted refunded amount or process refund IDs idempotently, deduct only the new delta up to the original payment amount, avoid treating partial refunds as full refunds, and add targeted tests for duplicate events, first partial refund, sequential partial refunds, and full-after-partial refund capping.