feat(cart): pass off_session=true on PaymentIntent for SCA exemption eligibility

* feat(refund): add refund request flow

- tui modal composer with reason select + free-form message
  (pkg/tui/refund.go)
- POST /api/v1/orders/{id}/refund-request posts to orders slack thread
- 15 min server side cooldown via Order.LastRefundRequestAt (429 +
  retry-after)
- shared refundrequestreasons + can requestrefund hoisted to pkg/models
- slack message includes customer name, email, order total, quoted body
- tests over invalid-state, missing-message, and cooldown paths

* style(tui): run gofmt to fix formatting

.gitignore

@@ -5,6 +5,9 @@
 .env.example
 .env.prod
 
+docs/sca-psd2-compliance.md
+accept-a-payment/
+
 
 FULFILLMENT.md
 .tmp-gocache/

api/handlers/cart.go

@@ -395,6 +395,7 @@ func (h *CartHandler) ConvertCart(w http.ResponseWriter, r *http.Request) {
 		Currency:      stripe.String(string(stripe.CurrencyUSD)),
 		Customer:      stripe.String(user.StripeCustomerID),
 		PaymentMethod: stripe.String(paymentMethodID),
+		OffSession:    stripe.Bool(true),
 		AutomaticPaymentMethods: &stripe.PaymentIntentAutomaticPaymentMethodsParams{
 			Enabled:        stripe.Bool(true),
 			AllowRedirects: stripe.String("never"),

api/handlers/orders.go

@@ -114,7 +114,7 @@ func (h *OrderHandler) CreateRefundRequest(w http.ResponseWriter, r *http.Reques
 		text += "\n\n" + quoted
 	}
 
-	if err := notify.SlackPostToOrderThread(order.ID, text); err != nil {
+	if err := notify.SlackPostToOrderThreadBroadcast(order.ID, text); err != nil {
 		utils.RespondError(w, http.StatusBadGateway, "SLACK_ERROR", "failed to send refund request", nil)
 		return
 	}

pkg/models/order_display.go

@@ -11,10 +11,27 @@ const (
 	DisplayKindBrand   DisplayKind = "brand"   // shipped / in transit
 	DisplayKindSuccess DisplayKind = "success" // delivered
 	DisplayKindError   DisplayKind = "error"   // cancelled, failed, refunded
-	DisplayKindWarning DisplayKind = "warning" // refund pending, delivery issue
+	DisplayKindWarning DisplayKind = "warning" // delivery issue, returned
+	DisplayKindRefund  DisplayKind = "refund"  // refund requested, awaiting review
 )
 
+// refundPending reports whether the order has an open customer refund request
+// that has not yet been resolved by a terminal status change.
+func (order *Order) refundPending() bool {
+	if order.LastRefundRequestAt == nil {
+		return false
+	}
+	switch order.Status {
+	case OrderStatusRefunded, OrderStatusCancelled, OrderStatusFailed:
+		return false
+	}
+	return true
+}
+
 func (order *Order) DisplayState() string {
+	if order.refundPending() {
+		return "Refund Requested"
+	}
 	switch order.Status {
 	case OrderStatusPending:
 		return "Awaiting payment"
@@ -54,6 +71,9 @@ func (order *Order) DisplayState() string {
 }
 
 func (order *Order) DisplayKind() DisplayKind {
+	if order.refundPending() {
+		return DisplayKindRefund
+	}
 	switch order.Status {
 	case OrderStatusPending:
 		return DisplayKindNeutral

pkg/models/order_display_test.go

@@ -1,8 +1,12 @@
 package models
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
 func TestOrderDisplayState(t *testing.T) {
+	now := time.Now()
 	tests := []struct {
 		name  string
 		order Order
@@ -23,6 +27,10 @@ func TestOrderDisplayState(t *testing.T) {
 		{"cancelled", Order{Status: OrderStatusCancelled}, "Cancelled", DisplayKindError},
 		{"refunded", Order{Status: OrderStatusRefunded}, "Refunded", DisplayKindError},
 		{"failed", Order{Status: OrderStatusFailed}, "Payment failed", DisplayKindError},
+		{"paid with open refund request", Order{Status: OrderStatusPaid, LastRefundRequestAt: &now}, "Refund Requested", DisplayKindRefund},
+		{"delivered with open refund request", Order{Status: OrderStatusDelivered, LastRefundRequestAt: &now}, "Refund Requested", DisplayKindRefund},
+		{"refunded order ignores prior request", Order{Status: OrderStatusRefunded, LastRefundRequestAt: &now}, "Refunded", DisplayKindError},
+		{"cancelled order ignores prior request", Order{Status: OrderStatusCancelled, LastRefundRequestAt: &now}, "Cancelled", DisplayKindError},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {

pkg/notify/slack.go

@@ -191,6 +191,17 @@ func SlackUnpinOrder(orderID uint) {
 // It looks up the thread ts from the database and returns an error when the
 // reply cannot be posted.
 func SlackPostToOrderThread(orderID uint, text string) error {
+	return slackPostToOrderThread(orderID, text, false)
+}
+
+// SlackPostToOrderThreadBroadcast posts a thread reply that is also surfaced
+// to the channel (reply_broadcast=true) so channel members get a normal
+// notification. Use for messages that need immediate operator attention.
+func SlackPostToOrderThreadBroadcast(orderID uint, text string) error {
+	return slackPostToOrderThread(orderID, text, true)
+}
+
+func slackPostToOrderThread(orderID uint, text string, broadcast bool) error {
 	token := os.Getenv("SLACK_BOT_TOKEN")
 	channel := os.Getenv("SLACK_CHANNEL")
 	if token == "" || channel == "" {
@@ -206,11 +217,16 @@ func SlackPostToOrderThread(orderID uint, text string) error {
 		return fmt.Errorf("order has no slack thread")
 	}
 
-	if _, ok := postSlackMessage(token, map[string]any{
+	payload := map[string]any{
 		"channel":   channel,
 		"thread_ts": *order.SlackThreadTS,
 		"text":      text,
-	}); !ok {
+	}
+	if broadcast {
+		payload["reply_broadcast"] = true
+	}
+
+	if _, ok := postSlackMessage(token, payload); !ok {
 		slog.Warn("failed to post slack thread reply", "order_id", orderID)
 		return fmt.Errorf("failed to post slack thread reply")
 	}

pkg/tui/account_orders.go

@@ -278,10 +278,9 @@ func (m Model) displayStyle(k models.DisplayKind) lipgloss.Style {
 	case models.DisplayKindError:
 		return m.theme.TextError()
 	case models.DisplayKindWarning:
-		// !TODO add refunds and change this
-		// No warning color in theme yet, reuse loading pink as visual flag
-		// for now
 		return m.theme.TextLoading()
+	case models.DisplayKindRefund:
+		return m.theme.TextBrand()
 	}
 	return m.theme.TextHighlight()
 }

pkg/tui/refund.go

@@ -27,6 +27,15 @@ const (
 	refundTextareaHPad = 4
 )
 
+// Nerd-font glyphs used in the refund composer. Requires a Nerd Font in the
+// SSH client terminal; renders as tofu otherwise.
+const (
+	refundIconUndo    = "\uf0e2" // nf-fa-undo
+	refundIconTag     = "\uf02b" // nf-oct-tag
+	refundIconComment = "\uf41f" // nf-oct-comment
+	refundIconKey     = "\uf11c" // nf-fa-keyboard_o
+)
+
 // refundFocus identifies which field in the refund composer has keyboard focus.
 type refundFocus int
 
@@ -161,22 +170,23 @@ func (m Model) buildRefundForm(state *refundState) *huh.Form {
 func (m Model) newRefundTextarea() textarea.Model {
 	ta := textarea.New()
 	ta.Prompt = ""
-	ta.Placeholder = "Describe the issue (optional)..."
+	ta.Placeholder = "Describe the issue"
 	ta.ShowLineNumbers = true
 	ta.CharLimit = 65536
-	ta.DynamicHeight = true
-	ta.MinHeight = refundMinTextareaRows
-	ta.MaxHeight = max(refundMinTextareaRows, min(refundMaxTextareaRows, m.heightContainer-refundModalChrome))
-	ta.SetHeight(refundMinTextareaRows)
+	ta.DynamicHeight = false
+	ta.SetHeight(m.refundTextareaHeight())
 	ta.SetWidth(m.refundTextareaWidth())
 
 	base := lipgloss.NewStyle()
+	// Cursor-line uses a darker grey than theme.Border() so the active line
+	// reads as a subtle wash, not a bright bar competing with the highlight.
+	cursorLineBG := lipgloss.Color("236")
 	ta.SetStyles(textarea.Styles{
 		Focused: textarea.StyleState{
 			Base:             base,
 			Text:             base.Foreground(m.theme.Accent()),
 			LineNumber:       base.Foreground(m.theme.Dim()),
-			CursorLine:       base.Background(m.theme.Border()).Foreground(m.theme.Accent()),
+			CursorLine:       base.Background(cursorLineBG).Foreground(m.theme.Accent()),
 			CursorLineNumber: base.Foreground(m.theme.Body()),
 			Placeholder:      base.Foreground(m.theme.Dim()),
 			EndOfBuffer:      base.Foreground(m.theme.Dim()),
@@ -200,8 +210,7 @@ func (m Model) newRefundTextarea() textarea.Model {
 }
 
 func (m Model) resizeRefundTextarea(state *refundState) {
-	state.textarea.MinHeight = refundMinTextareaRows
-	state.textarea.MaxHeight = max(refundMinTextareaRows, min(refundMaxTextareaRows, m.heightContainer-refundModalChrome))
+	state.textarea.SetHeight(m.refundTextareaHeight())
 	state.textarea.SetWidth(m.refundTextareaWidth())
 }
 
@@ -251,14 +260,19 @@ func (m Model) createRefundRequestCmd(orderID uint, gen uint64, reason string, m
 }
 
 // RenderRefundOverlay renders the refund composer as a centered modal.
+// The modal has no border or background fill — only padding for breathing
+// room. lipgloss.Place handles centering against the container.
 func (m Model) RenderRefundOverlay() string {
 	state := &m.refund
 	contentWidth := m.refundContentWidth()
 
+	titleText := fmt.Sprintf("%s  Refund request — Order #%d", refundIconUndo, state.orderID)
 	title := m.theme.TextAccent().
 		Bold(true).
 		Width(contentWidth).
-		Render(fmt.Sprintf("Refund request - Order #%d", state.orderID))
+		Border(lipgloss.NormalBorder(), false, false, true, false).
+		BorderForeground(m.theme.Highlight()).
+		Render(titleText)
 
 	body := lipgloss.JoinVertical(
 		lipgloss.Left,
@@ -272,9 +286,6 @@ func (m Model) RenderRefundOverlay() string {
 	)
 
 	modal := lipgloss.NewStyle().
-		Width(contentWidth).
-		Border(lipgloss.NormalBorder()).
-		BorderForeground(m.theme.Border()).
 		Padding(1, 2).
 		Render(body)
 
@@ -295,7 +306,7 @@ func (m Model) renderRefundReason(state *refundState) string {
 		value = "Select a reason"
 	}
 
-	label := m.theme.TextLabel().Render("Reason")
+	label := m.theme.TextLabel().Render(refundIconTag + "  Reason")
 	selected := m.theme.TextAccent().
 		Border(lipgloss.HiddenBorder()).
 		PaddingLeft(1).
@@ -311,7 +322,7 @@ func (m Model) renderRefundReason(state *refundState) string {
 
 func (m Model) renderRefundTextarea(state *refundState) string {
 	label := "Message (optional)"
-	placeholder := "Describe the issue (optional)..."
+	placeholder := "Describe the issue"
 	if state.reason == models.RefundRequestReasonOther {
 		label = "Message (required)"
 		placeholder = "Describe the issue..."
@@ -323,22 +334,26 @@ func (m Model) renderRefundTextarea(state *refundState) string {
 		border = m.theme.Highlight()
 	}
 
+	wrapper := lipgloss.NewStyle().
+		Border(lipgloss.ThickBorder()).
+		BorderForeground(border)
+
+	contentWidth := m.refundContentWidth()
+	state.textarea.SetWidth(contentWidth - wrapper.GetHorizontalFrameSize())
+	state.textarea.SetHeight(m.refundTextareaHeight())
+
+	textareaBox := wrapper.Render(state.textarea.View())
+
 	counter := m.theme.TextDim().
-		Width(m.refundTextareaWidth()).
+		Width(contentWidth).
 		Align(lipgloss.Right).
 		Render(fmt.Sprintf("%d chars", state.textarea.Length()))
 
-	box := lipgloss.NewStyle().
-		Border(lipgloss.NormalBorder()).
-		BorderForeground(border).
-		Padding(0, 1).
-		Width(m.refundContentWidth()).
-		Render(state.textarea.View() + "\n" + counter)
-
 	out := lipgloss.JoinVertical(
 		lipgloss.Left,
-		m.theme.TextLabel().Render(label),
-		box,
+		m.theme.TextLabel().Render(refundIconComment+"  "+label),
+		textareaBox,
+		counter,
 	)
 	if state.messageErr != "" {
 		out += "\n" + m.theme.TextError().Render(state.messageErr)
@@ -353,7 +368,14 @@ func (m Model) renderRefundFooter(state *refundState) string {
 	if state.err != "" {
 		return m.theme.TextError().Render(state.err)
 	}
-	return m.theme.TextDim().Render("tab next field | shift+tab prev | ctrl+s submit | esc cancel")
+	key := m.theme.TextHighlight().Bold(true)
+	sep := m.theme.TextDim().Render("  ·  ")
+	dim := m.theme.TextDim()
+	return dim.Render(refundIconKey+"  ") +
+		key.Render("tab") + dim.Render(" next") + sep +
+		key.Render("shift+tab") + dim.Render(" prev") + sep +
+		key.Render("ctrl+s") + dim.Render(" submit") + sep +
+		key.Render("esc") + dim.Render(" cancel")
 }
 
 func (m Model) refundContentWidth() int {
@@ -367,3 +389,7 @@ func (m Model) refundContentWidth() int {
 func (m Model) refundTextareaWidth() int {
 	return max(1, m.refundContentWidth()-refundTextareaHPad)
 }
+
+func (m Model) refundTextareaHeight() int {
+	return max(refundMinTextareaRows, min(refundMaxTextareaRows, m.heightContainer-refundModalChrome))
+}