@12-apps/payments-frontend 1.3.0 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/payments-frontend",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "type": "module",
   "description": "Browser half of the vendor-agnostic payments platform: plug-and-play MUI components for the per-provider settings page (credential form from each provider's schema, masked hints, verify/enable) and the checkout page (PIX QR + polling, card tokenization, hosted-checkout redirect), plus the headless hooks and fetch clients they build on. Talks only to the host's payments HTTP surface — never to a provider directly. Microfrontend-ready: no app coupling, host injects theme and auth.",
   "exports": {
@@ -15,6 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@12-apps/payments-backend": "^1.4.0",
     "react-qr-code": "^2.2.0"
   },
   "peerDependencies": {
@@ -28,9 +29,8 @@
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.0",
     "@mui/material": "^6.5.0",
-    "@12-apps/eslint-config": "^1.4.0",
-    "@12-apps/payments-backend": "^1.3.0",
-    "@12-apps/typescript-config": "^1.4.0",
+    "@12-apps/eslint-config": "^1.5.0",
+    "@12-apps/typescript-config": "^1.5.0",
     "@testing-library/react": "^16.1.0",
     "@types/react": "19.2.2",
     "@types/react-dom": "19.2.2",

package/src/card/stripe-token.ts

@@ -37,6 +37,8 @@ export async function tokenizeWithStripe(
   publicKey: string,
   brand: string,
   last4: string,
+  /** Deadline for the round trip; an abort reads as "could not contact". */
+  signal?: AbortSignal,
 ): Promise<Result<CardToken>> {
   const match = /^(\d{2})\/(\d{2})$/.exec(card.expiry.trim());
   if (!match) return err("Validade inválida ou expirada.");
@@ -60,6 +62,7 @@ export async function tokenizeWithStripe(
         Authorization: `Bearer ${publicKey}`,
       },
       body: body.toString(),
+      signal,
     });
   } catch {
     return err("Não foi possível contatar o provedor do cartão. Verifique sua conexão.");

package/src/card/tokenize.ts

@@ -157,6 +157,8 @@ async function tokenizeWithPagarme(
   publicKey: string,
   brand: string,
   last4: string,
+  /** Deadline for the round trip; an abort reads as "could not contact". */
+  signal?: AbortSignal,
 ): Promise<Result<CardToken>> {
   const match = /^(\d{2})\/(\d{2})$/.exec(card.expiry.trim());
   if (!match) return err("Validade inválida ou expirada.");
@@ -166,6 +168,7 @@ async function tokenizeWithPagarme(
     response = await fetch(`${PAGARME_TOKENS_URL}?appId=${encodeURIComponent(publicKey)}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
+      signal,
       body: JSON.stringify({
         type: "card",
         card: {
@@ -203,6 +206,11 @@ export async function tokenizeCard(
   card: CardDetails,
   publicKey: string | null | undefined,
   tokenizer: CardTokenizer = "pagbank-sdk",
+  /**
+   * Bounds the network schemes (Pagar.me / Stripe). The PagBank one encrypts
+   * locally and has no request to abort.
+   */
+  signal?: AbortSignal,
 ): Promise<Result<CardToken>> {
   const validationError = validateCardInput(card);
   if (validationError) return err(validationError);
@@ -219,10 +227,10 @@ export async function tokenizeCard(
   const last4 = pan.slice(-4);
 
   if (tokenizer === "pagarme-token") {
-    return tokenizeWithPagarme(card, pan, publicKey, brand, last4);
+    return tokenizeWithPagarme(card, pan, publicKey, brand, last4, signal);
   }
   if (tokenizer === "stripe-pm") {
-    return tokenizeWithStripe(card, pan, publicKey, brand, last4);
+    return tokenizeWithStripe(card, pan, publicKey, brand, last4, signal);
   }
 
   if (!(await ensurePagBankSdk())) {
@@ -274,9 +282,15 @@ const CARD_PATH_UNAVAILABLE =
 export async function tokenizeForCheckout(
   card: CardDetails,
   config: CardTokenizationConfig,
+  /**
+   * Optional deadline for a provider that mints over the network. The chain
+   * path passes one so a backup acquirer nobody can reach cannot hold the
+   * buyer's Pagar button (FUT-563).
+   */
+  signal?: AbortSignal,
 ): Promise<Result<CardToken>> {
   const scheme = config.provider ? tokenizerFor(config.provider) : null;
-  if (scheme && config.publicKey) return tokenizeCard(card, config.publicKey, scheme);
+  if (scheme && config.publicKey) return tokenizeCard(card, config.publicKey, scheme, signal);
 
   if (!config.mockTokenization) return err(CARD_PATH_UNAVAILABLE);
 

package/src/components/checkout/__tests__/chain-instruments.test.tsx

@@ -0,0 +1,244 @@
+// @vitest-environment jsdom
+/**
+ * FUT-563 — "o comprador digita o cartão UMA vez e a compra sobrevive ao
+ * primeiro provedor falhar": the browser half of it.
+ *
+ * A card instrument is bound to the provider that minted it, so a chain the
+ * checkout tokenized for only ONCE is a chain the gateway can attempt only
+ * once — it skips the rest rather than send a blob they cannot read. What is
+ * pinned here is that the same validated card produces one instrument per
+ * chain entry and they all travel on ONE charge, with nothing re-typed.
+ *
+ * The browser journey (the `cadeia-de-provedores` Gherkin feature)
+ * covers the happy path end to end; these are the halves it cannot stage — a
+ * tail provider whose tokenization fails while the head's works, and a store
+ * whose host published no chain at all.
+ */
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { JSX } from "react";
+
+const client = vi.hoisted(() => ({
+  chargeCard: vi.fn(),
+  listSavedCards: vi.fn(),
+  refreshCardPublicKey: vi.fn(),
+  pollOrderStatus: vi.fn(),
+  fetchCheckoutConfig: vi.fn(),
+}));
+
+vi.mock("../client", () => client);
+
+import type { CardTokenizationConfig } from "../../../card";
+import type { CardChainLink } from "../method-capability";
+import type { CheckoutOrder } from "../types";
+import { useCardCheckout } from "../use-card-checkout";
+
+const ORDER: CheckoutOrder = {
+  orderId: "o1",
+  status: "AWAITING_PAYMENT",
+  method: "CARD",
+  totalCents: 1250,
+  subtotalCents: 1250,
+  discountTotalCents: 0,
+  appliedDiscounts: [],
+  totalLabel: "R$ 12,50",
+};
+
+/** Stub-mode entries: the mock tokenizer mints without a real key or network. */
+const HEAD: CardChainLink = {
+  provider: "pagbank",
+  publicKey: null,
+  mockTokenization: true,
+  mintable: true,
+};
+const TAIL: CardChainLink = {
+  provider: "stone",
+  publicKey: null,
+  mockTokenization: true,
+  mintable: true,
+};
+/**
+ * Declares an in-browser scheme, but this browser has none for it: no
+ * tokenizer, no key, no mock grant. The mint FAILS — a different thing from
+ * an entry that asks for no instrument.
+ */
+const UNMINTABLE: CardChainLink = {
+  provider: "unknown-vendor",
+  publicKey: null,
+  mockTokenization: false,
+  mintable: true,
+};
+/** A hosted page: its own site takes the card, so nothing is minted for it. */
+const HOSTED: CardChainLink = {
+  provider: "infinitepay",
+  publicKey: null,
+  mockTokenization: false,
+  mintable: false,
+};
+/**
+ * The ACTIVE provider of a hosted-headed store, as the config's head triple:
+ * no scheme, no key, no stub grant. Nothing this browser can mint against.
+ */
+const HOSTED_HEAD: CardTokenizationConfig = {
+  provider: "infinitepay",
+  publicKey: null,
+  mockTokenization: false,
+};
+
+const CARD = { number: "4111111111111111", holder: "VERA CADEIA", expiry: "12/34", cvv: "123" };
+
+/**
+ * Filling and paying are two BUTTONS, not one handler: `handlePay` closes over
+ * the card in state, so a submit fired in the same tick as `setCard` validates
+ * the empty form and never reaches the tokenizer.
+ */
+function Harness({
+  chain,
+  config = HEAD,
+}: {
+  chain: CardChainLink[];
+  config?: CardTokenizationConfig;
+}): JSX.Element {
+  const cc = useCardCheckout(ORDER, {}, config, vi.fn(), 10, undefined, chain);
+  return (
+    <div>
+      <button type="button" data-testid="fill" onClick={() => cc.setCard(CARD)}>
+        Preencher
+      </button>
+      <button type="button" data-testid="pay" onClick={() => void cc.handlePay()}>
+        Pagar
+      </button>
+      {cc.error ? <p data-testid="pay-error">{cc.error}</p> : null}
+    </div>
+  );
+}
+
+/** The `tokensByProvider` of the single charge submitted. */
+function sentInstruments(): Record<string, string> | undefined {
+  const input = client.chargeCard.mock.calls[0]?.[0] as
+    | { tokensByProvider?: Record<string, string> }
+    | undefined;
+  return input?.tokensByProvider;
+}
+
+async function payWith(chain: CardChainLink[], config?: CardTokenizationConfig): Promise<void> {
+  render(<Harness chain={chain} config={config} />);
+  await waitFor(() => {
+    expect(client.listSavedCards).toHaveBeenCalled();
+  });
+  fireEvent.click(screen.getByTestId("fill"));
+  fireEvent.click(screen.getByTestId("pay"));
+  await waitFor(() => {
+    expect(client.chargeCard).toHaveBeenCalled();
+  });
+}
+
+/** Fill + tap Pagar, then prove the submit never reached the charge route. */
+async function expectNoCharge(
+  chain: CardChainLink[],
+  config?: CardTokenizationConfig,
+): Promise<void> {
+  render(<Harness chain={chain} config={config} />);
+  await waitFor(() => {
+    expect(client.listSavedCards).toHaveBeenCalled();
+  });
+  fireEvent.click(screen.getByTestId("fill"));
+  fireEvent.click(screen.getByTestId("pay"));
+  // The refusal is what ends the submit, so waiting for it is what proves the
+  // charge was skipped rather than merely still in flight.
+  await waitFor(() => {
+    expect(screen.getByTestId("pay-error").textContent).toMatch(/indisponível nesta loja/i);
+  });
+  expect(client.chargeCard).not.toHaveBeenCalled();
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  client.listSavedCards.mockResolvedValue([]);
+  // The head is PagBank with no key, so the hook's on-demand key refresh runs
+  // on mount (FUT-174). It finds none here — stub mode is what mints the token.
+  client.refreshCardPublicKey.mockResolvedValue({ ok: true, data: { publicKey: null } });
+  client.pollOrderStatus.mockResolvedValue({ ok: true, data: "AWAITING_PAYMENT" });
+  client.chargeCard.mockResolvedValue({ ok: true, data: { status: "AWAITING_PAYMENT" } });
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("one instrument per provider (FUT-563)", () => {
+  it("mints for EVERY entry of the chain from one typed card", async () => {
+    await payWith([HEAD, TAIL]);
+
+    const minted = sentInstruments();
+    expect(Object.keys(minted ?? {}).sort()).toEqual(["pagbank", "stone"]);
+    // Distinct instruments: one blob reused across providers is the exact
+    // thing the gateway refuses to send.
+    expect(minted?.["pagbank"]).not.toBe(minted?.["stone"]);
+    // The buyer typed once.
+    expect(client.chargeCard).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps the head's own token as the bare `token`", async () => {
+    await payWith([HEAD, TAIL]);
+
+    const input = client.chargeCard.mock.calls[0]?.[0] as { token: string };
+    expect(sentInstruments()?.["pagbank"]).toBe(input.token);
+  });
+
+  it("still pays when a TAIL provider cannot be tokenized for", async () => {
+    // That provider is one the walk will skip — strictly better than failing
+    // the whole payment because the second acquirer's key was missing. The map
+    // still travels, naming who DID mint: the server then skips the tail by
+    // name instead of reading the bare token as the head's and skipping
+    // everyone else.
+    await payWith([HEAD, UNMINTABLE]);
+
+    expect(sentInstruments()).toEqual({ pagbank: expect.any(String) });
+    expect(client.chargeCard).toHaveBeenCalledTimes(1);
+  });
+
+  it("sends the map when the TAIL is a provider that needs NO instrument", async () => {
+    // The two-provider shape this feature exists for: a card acquirer plus a
+    // hosted-page fallback. Nothing is minted for the hosted entry — its own
+    // site takes the card — so a map counted by minted keys would be dropped,
+    // the bare token read as the head's, and the fallback refused for
+    // "holding someone else's instrument". The chain has TWO entries, so the
+    // map goes.
+    await payWith([HEAD, HOSTED]);
+
+    expect(sentInstruments()).toEqual({ pagbank: expect.any(String) });
+    // And never a mocked one for the hosted provider.
+    expect(sentInstruments()).not.toHaveProperty("infinitepay");
+  });
+
+  it("mints against the first MINTABLE entry when the HEAD is a hosted page", async () => {
+    // The store this feature creates by simply enabling a second provider:
+    // InfinitePay (REDIRECT) first, an acquirer behind it. The server asks the
+    // WHOLE chain whether anybody tokenizes in the browser, so it shows our
+    // card form — and the submit must mint against the entry the form is being
+    // shown FOR. Minting against the head refused the payment outright, with a
+    // full PAN already typed and no provider ever asked.
+    await payWith([HOSTED, HEAD], HOSTED_HEAD);
+
+    expect(client.chargeCard).toHaveBeenCalledTimes(1);
+    expect(sentInstruments()).toEqual({ pagbank: expect.any(String) });
+    // The bare token is the one that was actually minted, not the head's.
+    const input = client.chargeCard.mock.calls[0]?.[0] as { token: string };
+    expect(input.token).toBe(sentInstruments()?.["pagbank"]);
+  });
+
+  it("still refuses when NO entry of the chain can be minted for", async () => {
+    // Nothing to fall back to — the buyer is told so before any charge, which
+    // is the honest answer and the one FUT-697 wrote.
+    await expectNoCharge([HOSTED, UNMINTABLE], HOSTED_HEAD);
+  });
+
+  it("sends no map at all for a single-provider store", async () => {
+    // The pre-FUT-563 wire shape, unchanged: one token, no map.
+    await payWith([HEAD]);
+
+    expect(sentInstruments()).toBeUndefined();
+  });
+});

package/src/components/checkout/__tests__/mint-deadline.test.ts

@@ -0,0 +1,99 @@
+// @vitest-environment jsdom
+/**
+ * FUT-563 — a BACKUP acquirer nobody can reach must not hold the payment.
+ *
+ * Minting one instrument per chain entry puts the buyer's Pagar button behind
+ * every acquirer in the chain, and a tokenizer is a cross-origin POST with no
+ * deadline of its own — browser `fetch` has none either. A middlebox that
+ * accepts the socket and never answers therefore left "Pagar R$ …" spinning
+ * and disabled for as long as the OS kept the connection: the failover feature
+ * blocking on the provider it exists to fall back TO, with the head's own
+ * token already minted and nothing wrong with it.
+ *
+ * These are the halves the browser journey cannot stage — it has no way to
+ * make an acquirer stop answering.
+ */
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { resolveNewCardToken } from "../card-instruments";
+import type { CardChainLink } from "../method-capability";
+
+vi.mock("../client", () => ({ refreshCardPublicKey: vi.fn() }));
+
+const CARD = { number: "4111111111111111", holder: "VERA CADEIA", expiry: "12/34", cvv: "123" };
+
+/** Stub mode: the head mints locally, with no network and no key. */
+const HEAD: CardChainLink = {
+  provider: "pagbank",
+  publicKey: null,
+  mockTokenization: true,
+  mintable: true,
+};
+/** A real Pagar.me tokenizer — this one goes to the network. */
+const STONE: CardChainLink = {
+  provider: "stone",
+  publicKey: "pk_stone",
+  mockTokenization: false,
+  mintable: true,
+};
+/** A real Stripe tokenizer — likewise. */
+const STRIPE: CardChainLink = {
+  provider: "stripe",
+  publicKey: "pk_stripe",
+  mockTokenization: false,
+  mintable: true,
+};
+
+/** A tokenizer endpoint that accepts the request and never answers. */
+function blackHole(): ReturnType<typeof vi.fn> {
+  const fetchMock = vi.fn(() => new Promise<Response>(() => undefined));
+  vi.stubGlobal("fetch", fetchMock);
+  return fetchMock;
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("minting the chain is bounded and concurrent", () => {
+  it("charges on the head when a TAIL acquirer never answers", async () => {
+    const fetchMock = blackHole();
+
+    const resolved = await resolveNewCardToken(CARD, HEAD, "o1", vi.fn(), false, [HEAD, STONE], 20);
+
+    // The degradation this module already documents: the provider we could not
+    // mint for is one the walk will skip. The payment still goes out.
+    expect(resolved.ok).toBe(true);
+    const instruments = resolved.ok ? resolved.data : null;
+    expect(instruments?.tokensByProvider).toEqual({ pagbank: expect.any(String) });
+    // And the abandoned request is ABORTED, not merely ignored — a token that
+    // arrives after we gave up on it is one nothing will ever charge.
+    const init = fetchMock.mock.calls[0]?.[1] as RequestInit | undefined;
+    expect(init?.signal?.aborted).toBe(true);
+  });
+
+  it("asks every tail at ONCE, not one after the other", async () => {
+    // Sequentially, two unreachable backups cost the buyer two full deadlines
+    // before a charge they could have had immediately.
+    const fetchMock = blackHole();
+    const deadlineMs = 400;
+
+    const minting = resolveNewCardToken(
+      CARD,
+      HEAD,
+      "o1",
+      vi.fn(),
+      false,
+      [HEAD, STONE, STRIPE],
+      deadlineMs,
+    );
+    // Both requests are in flight well inside ONE deadline — which they could
+    // not be if the second waited for the first to time out.
+    await vi.waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+    });
+
+    const resolved = await minting;
+    expect(resolved.ok).toBe(true);
+  });
+});

package/src/components/checkout/__tests__/provider-chain.test.ts

@@ -0,0 +1,161 @@
+// @vitest-environment jsdom
+/**
+ * FUT-563 — the browser mints ONE instrument PER PROVIDER, so a card charge
+ * can walk the merchant's chain.
+ *
+ * A card token is bound to whoever minted it: the gateway refuses to hand
+ * provider #2 provider #1's blob and skips it instead. So the checkout's whole
+ * contribution to failover is this — take the card the buyer typed ONCE, and
+ * produce an instrument for each entry of the chain the server published.
+ *
+ * The scenarios the browser journey cannot reach live here: a chain entry with
+ * no in-browser scheme (a hosted page needs no instrument), a chain the host
+ * never published (an older server, or a fetch blip), and an entry whose
+ * tokenization fails while the others succeed.
+ */
+import { describe, expect, it } from "vitest";
+
+import { cardChain, cardPathAvailable, cardTokenization } from "../method-capability";
+import type { CheckoutProviderConfig } from "../types";
+
+function link(
+  provider: string,
+  tokenization: CheckoutProviderConfig["tokenization"],
+  publicKey: string | null = null,
+) {
+  return {
+    provider,
+    tokenization: tokenization as "NONE" | "PUBLIC_KEY" | "SDK" | "REDIRECT",
+    publicKey,
+    mockTokenization: false,
+    methods: ["PIX" as const, "CARD" as const],
+  };
+}
+
+function config(over: Partial<CheckoutProviderConfig> = {}): CheckoutProviderConfig {
+  return {
+    provider: "pagbank",
+    tokenization: "PUBLIC_KEY",
+    publicKey: "pk_pagbank",
+    mockTokenization: false,
+    methods: ["PIX", "CARD"],
+    ...over,
+  };
+}
+
+describe("cardChain", () => {
+  it("gives one tokenization config per entry, in the merchant's order", async () => {
+    const chain = cardChain(
+      config({
+        chain: [link("pagbank", "PUBLIC_KEY", "pk_pagbank"), link("stone", "PUBLIC_KEY", "pk_stone")],
+      }),
+    );
+
+    expect(chain.map((entry) => entry.provider)).toEqual(["pagbank", "stone"]);
+    expect(chain.map((entry) => entry.publicKey)).toEqual(["pk_pagbank", "pk_stone"]);
+  });
+
+  it("marks entries with no in-browser scheme unmintable instead of dropping them", async () => {
+    // A REDIRECT provider's own page takes the card, and a NONE one asks for no
+    // instrument. Minting for either would produce a fake token under stub mode
+    // and an error everywhere else — and the gateway passes an unattributed
+    // charge straight through to them anyway.
+    //
+    // They stay in the LIST because the charge walks them: the card path counts
+    // this list to decide whether `tokensByProvider` has to travel at all, and
+    // a chain counted by "who minted" hides the hosted page from the server.
+    const chain = cardChain(
+      config({
+        chain: [
+          link("pagbank", "PUBLIC_KEY", "pk_pagbank"),
+          link("infinitepay", "REDIRECT"),
+          link("nothing", "NONE"),
+        ],
+      }),
+    );
+
+    expect(chain.map((entry) => entry.provider)).toEqual(["pagbank", "infinitepay", "nothing"]);
+    expect(chain.map((entry) => entry.mintable)).toEqual([true, false, false]);
+  });
+
+  it("falls back to the HEAD alone when the host published no chain", async () => {
+    // Exactly the pre-FUT-563 behaviour: one instrument, for the active
+    // provider. A server that does not answer a chain must not break checkout.
+    expect(cardChain(config())).toEqual([{ ...cardTokenization(config()), mintable: true }]);
+  });
+
+  it("has nothing to mint for a store with no provider at all", async () => {
+    expect(cardChain(null)).toEqual([]);
+  });
+
+  it("never re-heads or reorders the merchant's list", async () => {
+    // The storefront is a READER of the priority list. Preferring the entry
+    // with a key, or sorting by anything, would silently override the order the
+    // owner set and the plan ceiling already truncated.
+    const chain = cardChain(
+      config({
+        provider: "stone",
+        chain: [link("stone", "PUBLIC_KEY", null), link("pagbank", "PUBLIC_KEY", "pk_pagbank")],
+      }),
+    );
+
+    expect(chain.map((entry) => entry.provider)).toEqual(["stone", "pagbank"]);
+  });
+
+  it("counts the whole chain, hosted entries included", async () => {
+    // What `tokensByProvider`'s presence is decided on. A card acquirer plus a
+    // hosted-page fallback is TWO providers the walk may reach, even though
+    // only one of them is ever minted for.
+    const chain = cardChain(
+      config({ chain: [link("pagbank", "PUBLIC_KEY", "pk_pagbank"), link("infinitepay", "REDIRECT")] }),
+    );
+
+    expect(chain).toHaveLength(2);
+    expect(chain.filter((entry) => entry.mintable)).toHaveLength(1);
+  });
+});
+
+/**
+ * FUT-563 — the picker and the SERVER must answer the same question.
+ *
+ * `usesHostedCheckout` asks the WHOLE chain whether anybody tokenizes in the
+ * browser, so a REDIRECT head no longer means "the buyer is handed over". A
+ * client that still read the head alone offered a card the submit could not
+ * mint, and a store whose only mintable entry has no key offered one nobody
+ * could pay.
+ */
+describe("cardPathAvailable", () => {
+  it("offers CARD for a hosted-page store: its own site takes the card", async () => {
+    expect(cardPathAvailable(config({ chain: [link("infinitepay", "REDIRECT")] }))).toBe(true);
+  });
+
+  it("offers CARD when a LATER entry can be minted for, not just the head", async () => {
+    // The server shows our form for exactly this chain, so the picker must
+    // agree — and the submit mints against the tail.
+    const mixed = config({
+      provider: "infinitepay",
+      tokenization: "REDIRECT",
+      publicKey: null,
+      chain: [link("infinitepay", "REDIRECT"), link("pagbank", "PUBLIC_KEY", "pk_pagbank")],
+    });
+
+    expect(cardPathAvailable(mixed)).toBe(true);
+  });
+
+  it("refuses CARD when the only mintable entry has no key this browser can use", async () => {
+    // Stone with no publishable key: the form would render and the submit
+    // would die. Better a disabled tile that says so.
+    const unusable = config({
+      provider: "infinitepay",
+      tokenization: "REDIRECT",
+      publicKey: null,
+      chain: [link("infinitepay", "REDIRECT"), link("stone", "PUBLIC_KEY", null)],
+    });
+
+    expect(cardPathAvailable(unusable)).toBe(false);
+  });
+
+  it("still fails OPEN while the config has not answered", async () => {
+    expect(cardPathAvailable(null)).toBe(true);
+  });
+});