@crvouga/mockingbird-service-flex 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog — @crvouga/mockingbird-service-flex
+
+## 0.1.0 (2026-09-22)
+
+Initial release.

package/README.md

@@ -0,0 +1,213 @@
+# @crvouga/mockingbird-service-flex
+
+Stateful mock of the **Flex** (withflex.com) HSA/FSA payments API for test suites: products
+(answered from a recorded catalog corpus), checkout sessions in `payment`, `off_session` and
+`setup` modes, customers, setup intents, refunds, the **hosted checkout page**, and the
+Svix-signed webhooks Flex posts back. A UI checkout that drove the real
+`checkout.withflex.com` page and then waited on a 5-minute reconciler settles here in
+milliseconds: the page is local, and the signed webhook reaches the app as soon as the card is
+accepted.
+
+- Operation coverage: [SUPPORT.md](https://github.com/crvouga/mockingbird/blob/main/packages/service/flex/SUPPORT.md)
+- Flex publishes no machine-readable spec: the contract (`openapi.yaml`) is hand-authored from
+  the wire shapes our consumer reads and writes (`B/billing/flex/`), and every field its zod
+  schemas require is served.
+
+## Install
+
+```bash
+npm install -D @crvouga/mockingbird-service-flex
+```
+
+ESM only. Node >= 22 or Bun >= 1.2. No native dependencies. Serve it with
+`npx mockingbird-flex serve`, `createServer` from `./server` (Node), or `createRuntime` with any
+Fetch server.
+
+## Usage
+
+Point the app at the mock:
+
+| Env | Value |
+| --- | --- |
+| `FLEX_API_BASE_URL` | `http://127.0.0.1:8792` (or `…/ns/<namespace>`) |
+| `FLEX_API_KEY` | any `fsk_test_…` key (test mode); `fsk_…` is live mode; other formats get 401 |
+| `FLEX_WEBHOOK_SECRET` | the same value as `--webhook-secret`: `fwhsec_<base64>` or `whsec_<base64>` |
+
+```bash
+npx mockingbird-flex serve --port 8792 \
+  --webhook-url http://127.0.0.1:3000/billing/webhooks/flex \
+  --webhook-secret "$FLEX_WEBHOOK_SECRET"
+```
+
+```ts
+import { createRuntime } from "@crvouga/mockingbird-service-flex"
+
+const flex = createRuntime({
+  webhooks: {
+    url: "http://127.0.0.1:3000/billing/webhooks/flex",
+    secret: "fwhsec_ZmxleC1tb2NrLXNpZ25pbmcta2V5",
+  },
+})
+const post = (path: string, body: unknown) =>
+  flex.fetch(
+    new Request(`http://flex.test${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: "Bearer fsk_test_suite" },
+      body: JSON.stringify(body),
+    }),
+  )
+
+const { checkout_session } = (await (
+  await post("/v1/checkout/sessions", {
+    checkout_session: {
+      success_url: "https://app.test/done?session_id={CHECKOUT_SESSION_ID}",
+      cancel_url: "https://app.test/cart",
+      client_reference_id: "attempt-1",
+      line_items: [
+        { price_data: { product: "fprod_01m0tgysj4ahvf8fas60c2ef2d", unit_amount: 4500 }, quantity: 1 },
+      ],
+    },
+  })
+).json()) as { checkout_session: { checkout_session_id: string; url: string } }
+// …open checkout_session.url in the browser and pay with 4000 0512 3000 0072, or:
+await post(`/__admin/sessions/${checkout_session.checkout_session_id}/complete`, {})
+```
+
+### Routes
+
+All API bodies are wrapped: `{product: {…}}`, `{checkout_session: {…}}`, `{customer: {…}}`,
+`{setup_intent: {…}}`, `{products: […], has_more}`, `{checkout_sessions: […], has_more}`.
+Errors are `{error: {type, message, param?}}`.
+
+| Route | Behaviour |
+| --- | --- |
+| `GET /v1/products?limit=&starting_after=` | Oldest first; `limit` 1–100 (default 10). The corpus comes first, then created products. |
+| `POST /v1/products` | `{product: {name, description?, url?, client_reference_id?, metadata?}}`. New products are active, `hsa_fsa_eligibility: null` until classified (`PUT /__admin/products/:id`). |
+| `GET /v1/products/{id}` | `product_id, name, description, url, client_reference_id, hsa_fsa_eligibility, visit_type, active, test_mode, metadata, created_at`. |
+| `PATCH /v1/products/{id}` | `{product: {active?, name?, description?, url?, metadata?}}`; emits `product.updated`. |
+| `POST /v1/checkout/sessions` | `Idempotency-Key` honoured. `mode` `payment` (≥1 line item), `setup` (a customer and no line items, else 400), `off_session` (customer + a saved `payment_method`, charged before answering: the response is already `complete`, or its expanded payment intent is `requires_payment_method` / `requires_action` per `offSessionOutcome`). Unknown or inactive products, customers and payment methods are 400. `redirect_url` and `url` are the hosted page. |
+| `GET /v1/checkout/sessions/{id}?expand_customer=true&expand_payment_intent=true` | The session; expansions return `customer` / `payment_intent` objects instead of ids. |
+| `GET /v1/checkout/sessions?client_reference_id=&limit=&starting_after=` | Newest first (our ambiguous-create recovery). |
+| `POST /v1/checkout/sessions/{id}/refund` | `Idempotency-Key` honoured. `{checkout_session: {}}` (full) or `{checkout_session: {amount}}`; 400 when unpaid or over-refunded. |
+| `POST /v1/customers` | `Idempotency-Key` honoured. `{customer: {first_name, last_name, email, phone}}` (all required). |
+| `GET /v1/setup_intents/{id}?expand=customer,payment_method` | `setup_intent_id, status, customer, payment_method`. |
+
+Auth: `Authorization: Bearer fsk_test_…` or `fsk_…`; a missing key, or any other format
+(`sk_test_…`, `whsec_…`), is 401 `authentication_error`. `test_mode` on created objects follows
+the key. Same key + same body replays the stored response; same key + a different body is 400
+`idempotency_error`; a concurrent request with an in-flight key is 409.
+
+### Hosted page
+
+`GET /pay/{sessionId}` renders a plain form (no scripts) with `data-testid`s
+`flex-mock-email`, `-first-name`, `-last-name`, `-phone`, `-card`, `-exp`, `-cvc`, `-zip`,
+`-pay`, `-cancel`, `-error`, `-amount`, and on the letter step `-lmn-submit`. Inputs also carry
+the `name`s and placeholders our codecept locators look for (`cardNumber`, `expiry`, `cvc`,
+`postalCode`, `email`, …). `POST /pay/{sessionId}` submits it:
+
+| Card | Result |
+| --- | --- |
+| `4000 0512 3000 0072` | HSA card: succeeds. |
+| `4242 4242 4242 4242` (or any other valid card) | Succeeds; if a line item's product is `letter_of_medical_necessity`, the session gets `next_action: {type: "collect_letter_of_medical_necessity", collect_letter_of_medical_necessity: {url}}` and the browser goes to that step; submitting it completes the payment. |
+| `4000 0000 0000 0002` | Declines: 402 page with `<div role="alert">Your card was declined.</div>`; the payment intent is `requires_payment_method`. |
+
+Success 302s to `success_url` with `{CHECKOUT_SESSION_ID}` substituted (raw and
+`%7BCHECKOUT_SESSION_ID%7D`); `GET /pay/{id}/cancel` (the Cancel link) 302s to `cancel_url`,
+leaving the session open. A contact email on a session without a customer creates one. In a
+namespace the page URL carries `/ns/<name>` (the browser sends no headers); `publicUrl`
+overrides the origin.
+
+### Webhooks
+
+Svix-signed (`svix-id`, `svix-timestamp` = wall clock, `svix-signature: v1,<base64
+HMAC-SHA256(key, "<id>.<ts>.<body>")>`, key = base64-decoded secret after `fwhsec_`/`whsec_`).
+Body: `{event: {event_id, event_type, object, event_dt, test_mode, created_at}}`.
+Checkout events carry the session (so `object.checkout_session_id`), payment-intent events the
+intent plus `checkout_session_id`, refund events `checkout_session` and `payment_intent`, and
+`product.updated` the product (`object.product_id`).
+
+| Event | When |
+| --- | --- |
+| `payment_intent.succeeded`, then `checkout.session.completed` | the page (or `…/complete`, or an off-session charge) settles a session |
+| `checkout.session.async_payment_succeeded` | settling a session whose intent was `processing` |
+| `checkout.session.async_payment_failed` | a decline (page, admin, off-session) |
+| `checkout.session.expired` | `…/expire`, or `expires_at` passing on the mock clock (default 24 h) |
+| `refund.created`, `charge.refunded`, `checkout.session.refunded`, `refund.updated`, `charge.refund.updated` | each refund |
+| `product.updated` | `PATCH /v1/products/{id}` and `PUT /__admin/products/:id` |
+| `checkout_session.completed`, `checkout_session.expired` | the aliases, with `PUT /__admin/settings {"eventNaming": "underscored"}` |
+
+`POST /__admin/events {type, session | product}` emits any type on demand. Non-2xx answers are
+retried (immediately, 5 s, 5 min, 30 min, 2 h); `GET /__admin/webhooks`, `…/events`,
+`POST /__admin/webhooks/flush`, `…/:id/replay`, `PUT /__admin/webhook-endpoints` as usual.
+
+### Admin (beyond the standard contract)
+
+| Route | Effect |
+| --- | --- |
+| `PUT /__admin/products/:id` | `{hsa_fsa_eligibility?, active?, test_mode?, visit_type?, client_reference_id?, name?, metadata?}`; emits `product.updated`. |
+| `POST /__admin/sessions/:id/complete` | `{card?}`: settle as if paid (HSA card unless `card` is `4242…`). |
+| `POST /__admin/sessions/:id/decline` | Payment intent → `requires_payment_method`. |
+| `POST /__admin/sessions/:id/expire` | Session → `expired`. |
+| `POST /__admin/sessions/:id/require_action` | `{next_action_type?}`: `collect_letter_of_medical_necessity` (default), `provide_second_payment_method`, `provide_alternative_payment_method`, `payment_failed`. |
+| `PUT /__admin/sessions/:id/payment-intent` | `{status, amount_received?}`: `requires_payment_method`, `requires_action`, `processing`, `succeeded`, `canceled`. |
+| `GET /__admin/sessions`, `GET /__admin/sessions/:id` | The namespace's sessions. |
+| `POST /__admin/events` | Emit any event type for a session or product. |
+| `GET/PUT /__admin/settings` | `{eventNaming, offSessionOutcome, sessionTtlSeconds, lmnOnRegularCard, publicUrl}`. |
+| `POST /__admin/tick` | Expire due sessions now (the served mock ticks every 100 ms). |
+
+Every orchestrator state is reachable: pending (open), action_required (`require_action`, or an
+intent `requires_action`), processing, canceled (intent `canceled`, or expired), failed
+(`decline`), succeeded, refunded (full refund), quarantined (partial refund,
+`amount_mismatch`, duplicate sessions).
+
+Fault presets (`POST /__admin/faults {"preset": "<name>", "count"?: n}`; `GET /__admin/faults/presets`):
+`create_4xx` (400, nothing created), `create_5xx` (creates, then 500: recovery adopts it),
+`create_5xx_not_created`, `timeout` (creates, answers after 16 s, past the client's 15 s abort;
+`params.delayMs` overrides), `invalid_shape` (no `redirect_url`/`url`), `amount_mismatch`
+(`amount_total` + 100), `duplicate_sessions_for_client_reference` (two sessions, then 500),
+`refund_4xx`, `server_error`, `webhook_duplicate`, `webhook_reorder`, `webhook_drop`.
+
+### Namespaces
+
+`x-mockingbird-namespace`, a `/ns/<name>` prefix on `FLEX_API_BASE_URL`, or by API key:
+`PUT /__admin/credentials {"credentials": {"<FLEX_API_KEY>": "<namespace>"}}`.
+
+### Corpus
+
+`src/corpus/products.ts` is the product side of every row of the consumer's
+`flexCatalogMappings` reference fixture (663 rows, regenerated with
+`bun scripts/corpus.ts <fixture.json>`): product id, client reference, the `geviti_purpose` /
+`geviti_merchant_product_id` / `geviti_client_reference_id` metadata our catalog validation
+compares, eligibility and visit type. Every product is active and test-mode, so our validation
+reproduces each mapping row's own `active` flag. No sandbox recording exists (no credentials),
+so product names are synthesised.
+
+### Deliberately not modelled
+
+- Real card processing, Stripe iframes and split-tender payments: the page is a plain form, and
+  split payment is reachable only as `next_action: provide_second_payment_method`.
+- The letter-of-medical-necessity questionnaire: one submit button stands in for it.
+- Test/live data separation: a live key sees the same objects (only `test_mode` differs).
+- Subscriptions, coupons, promotion codes (`allow_promotion_codes` is echoed only), partial
+  captures, disputes.
+- Flex's exact error texts and ids: shapes follow what our consumer reads; ids look like
+  `fprod_01z…`, `fcs_01z…`, `fcus_…`, `fpi_…`, `fseti_…`, `fpm_…`, `fevt_…`.
+
+## API
+
+| Export | Kind | Description |
+| --- | --- | --- |
+| `FlexAPI` | class | The in-process mock: `fetch(request)`, `reset()`, `settle(id)`, `decline(id)`, `expire(id)`, `requireAction(id, type)`, `setPaymentIntent(id, patch)`, `applyRefund(id, amount)`, `putProduct(product)`, `emitFor(type, target)`, `tick()`, `sessions()`, `present(session, view)`. Options: `sqlite`, `now`, `namespace`, `publicNamespace`, `products`, `settings`, `onEvent`. |
+| `createRuntime` | function | The mock with the full service contract. Options: `webhooks: {url, secret, retryDelaysMs?, fetch?}`, `products`, `settings`, `tickMs`, `clock`, `seed`, `adminKey`, `onLog`. |
+| `FLEX_PRESETS` | object | Every named fault preset. |
+| `FLEX_NAMESPACE` | string | The service name, `"flex"`. |
+| `FLEX_EVENT_TYPES` | array | Every webhook event type, aliases included. |
+| `keyMode` | function | `"test"` for `fsk_test_…`, `"live"` for `fsk_…`, otherwise `undefined`. |
+| `isNextActionType` | function | Whether a string is a next-action type. |
+| `CARDS`, `classifyCard`, `substituteSessionId` | values | The hosted page's test cards, its card classifier, and the `{CHECKOUT_SESSION_ID}` substitution. |
+| `CORPUS_ROWS`, `corpusProduct` | values | The recorded product corpus and its row → product mapping. |
+| `DEFAULT_SETTINGS`, `ELIGIBILITIES`, `NEXT_ACTION_TYPES`, `PAYMENT_INTENT_STATUSES` | values | Defaults and enums. |
+| `document`, `operationIds`, `supportedOperationIds` | values | The vendored OpenAPI contract and its operation ids. |
+| `createServer`, `serveTarget`, `DEFAULT_PORT` (`./server`) | Node | Serve over `node:http` (expiry ticks every 100 ms); the `serve` CLI target (`--webhook-url`, `--webhook-secret`, `--public-url`, `--event-naming`); port 8792. |
+
+Part of [mockingbird](https://github.com/crvouga/mockingbird).

package/dist/chunk-Q6AKODYZ.js

@@ -0,0 +1,380 @@
+import {
+  createRuntime
+} from "./chunk-RB3RIE5G.js";
+
+// ../../adapters/node/dist/cli.js
+import { readFile } from "node:fs/promises";
+import { parseArgs } from "node:util";
+
+// ../../adapters/node/dist/serve.js
+import { createServer } from "node:http";
+var serve = async (api, options = {}) => {
+  const server = createServer(async (req, res) => {
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(Buffer.from(chunk));
+    }
+    const body = Buffer.concat(chunks);
+    const address = server.address();
+    const port = typeof address === "object" && address !== null ? address.port : void 0;
+    const base = `http://${req.headers.host ?? `localhost:${port ?? 80}`}`;
+    const raw = req.url ?? "/";
+    const url = new URL(raw.replace(/^\/+/, "/"), base);
+    const method = req.method ?? "GET";
+    const init = { method, headers: req.headers };
+    if (method !== "GET" && method !== "HEAD" && body.length > 0) {
+      init.body = body;
+    }
+    const aborted = new AbortController();
+    res.once("close", () => {
+      if (!res.writableFinished)
+        aborted.abort();
+    });
+    init.signal = aborted.signal;
+    const request = new Request(url, init);
+    let response;
+    try {
+      response = await api.fetch(request);
+    } catch (error) {
+      if (error.code === "MOCKINGBIRD_DROP") {
+        req.socket.destroy();
+        return;
+      }
+      res.writeHead(500, { "content-type": "application/json" });
+      res.end(JSON.stringify({
+        error: {
+          type: "mockingbird_internal",
+          message: error instanceof Error ? error.message : String(error)
+        }
+      }));
+      return;
+    }
+    const headers = Object.fromEntries(response.headers);
+    const cookies = response.headers.getSetCookie();
+    if (cookies.length > 0)
+      headers["set-cookie"] = cookies;
+    if (!response.body) {
+      res.writeHead(response.status, headers);
+      res.end();
+      return;
+    }
+    res.writeHead(response.status, headers);
+    res.flushHeaders();
+    const reader = response.body.getReader();
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        if (!res.write(value))
+          await new Promise((resolve) => res.once("drain", resolve));
+      }
+      res.end();
+    } catch {
+      res.destroy();
+    } finally {
+      reader.releaseLock();
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, options.host, resolve);
+  });
+  return server;
+};
+
+// ../../adapters/node/dist/listen.js
+var listen = async (api, options = {}) => {
+  const host = options.host ?? "127.0.0.1";
+  const server = await serve(api, { port: options.port ?? 0, host });
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port ?? 0;
+  const shown = host.includes(":") ? `[${host}]` : host;
+  return {
+    url: `http://${shown}:${port}`,
+    port,
+    host,
+    server,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error && error.code !== "ERR_SERVER_NOT_RUNNING")
+          reject(error);
+        else
+          resolve();
+      });
+      server.closeAllConnections?.();
+    })
+  };
+};
+
+// ../../adapters/node/dist/cli.js
+var optionHelp = (options) => Object.entries(options).map(([name, option]) => {
+  const flag = `--${name}${option.type === "string" ? ` ${option.value ?? "<value>"}` : ""}`;
+  const fallback = option.default !== void 0 ? ` (default: ${String(option.default)})` : "";
+  return `  ${flag.padEnd(30)} ${option.description}${fallback}`;
+});
+var help = (spec) => [
+  `${spec.bin} \u2014 ${spec.description}`,
+  "",
+  "Usage:",
+  `  ${spec.bin} <command> [options]`,
+  "",
+  "Commands:",
+  ...Object.entries(spec.commands).map(([name, c]) => `  ${name.padEnd(30)} ${c.summary}`),
+  "",
+  `Run \`${spec.bin} <command> --help\` for a command's options.`
+].join("\n");
+var commandHelp = (spec, name, command) => [
+  `${spec.bin} ${name} \u2014 ${command.summary}`,
+  "",
+  "Usage:",
+  `  ${command.usage ?? `${spec.bin} ${name} [options]`}`,
+  ...command.options ? ["", "Options:", ...optionHelp(command.options)] : []
+].join("\n");
+var runCli = async (spec, argv) => {
+  const pair = argv.length >= 2 ? `${argv[0]} ${argv[1]}` : void 0;
+  const words = pair !== void 0 && spec.commands[pair] ? 2 : 1;
+  const name = words === 2 ? pair : argv[0];
+  const rest = argv.slice(words);
+  if (name === void 0 || name === "--help" || name === "-h" || name === "help") {
+    console.log(help(spec));
+    return 0;
+  }
+  const command = spec.commands[name];
+  if (!command) {
+    console.error(`${spec.bin}: unknown command ${JSON.stringify(name)}
+
+${help(spec)}`);
+    return 2;
+  }
+  if (rest.includes("--help") || rest.includes("-h")) {
+    console.log(commandHelp(spec, name, command));
+    return 0;
+  }
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      strict: true,
+      options: Object.fromEntries(Object.entries(command.options ?? {}).map(([key, option]) => [
+        key,
+        {
+          type: option.type,
+          ...option.default !== void 0 ? { default: option.default } : {}
+        }
+      ]))
+    });
+  } catch (error) {
+    console.error(`${spec.bin} ${name}: ${error instanceof Error ? error.message : String(error)}
+
+${commandHelp(spec, name, command)}`);
+    return 2;
+  }
+  return command.run(parsed.values, parsed.positionals);
+};
+var COMMON_SERVE_OPTIONS = {
+  port: { type: "string", value: "<port>", description: "Port to listen on" },
+  host: { type: "string", value: "<host>", description: "Interface to bind", default: "127.0.0.1" },
+  "admin-key": {
+    type: "string",
+    value: "<key>",
+    description: "Require x-mockingbird-admin-key on /__admin/* (env MOCKINGBIRD_ADMIN_KEY)"
+  },
+  seed: { type: "string", value: "<seed>", description: "Seed for every random choice" },
+  log: {
+    type: "string",
+    value: "<pretty|json|off>",
+    description: "Request log format",
+    default: "pretty"
+  },
+  "log-requests": {
+    type: "boolean",
+    description: "One JSON line per request: namespace, operationId, status, ids touched (never bodies). Same as --log json"
+  },
+  config: {
+    type: "string",
+    value: "<file>",
+    description: "Serve every service in a mockingbird.json config instead"
+  }
+};
+var formatLog = (format) => {
+  if (format === "off")
+    return void 0;
+  if (format === "json")
+    return (entry) => console.log(JSON.stringify(entry));
+  return (entry) => {
+    const op = entry.operationId ?? (entry.unmatched ? "UNMATCHED" : "-");
+    const ns = entry.namespace === "default" ? "" : ` [${entry.namespace}]`;
+    const fault = entry.faultId ? ` fault=${entry.faultId}` : "";
+    const adopted = entry.adopted ? " adopted" : "";
+    console.log(`${entry.service} ${entry.method} ${entry.path} ${entry.status} ${op} ${entry.durationMs}ms${ns}${fault}${adopted}`);
+  };
+};
+var asString = (value) => typeof value === "string" ? value : void 0;
+var loadTarget = async (name, own) => {
+  if (name === own.name)
+    return own;
+  const specifier = `@crvouga/mockingbird-service-${name}/server`;
+  try {
+    const mod = await import(specifier);
+    if (!mod.serveTarget)
+      throw new Error(`${specifier} exports no serveTarget`);
+    return mod.serveTarget;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`cannot load service "${name}": ${reason}. Install @crvouga/mockingbird-service-${name}.`);
+  }
+};
+var start = async (target, values, config) => {
+  const runtime = await target.create(values, {
+    adminKey: config.adminKey,
+    seed: config.seed,
+    onLog: formatLog(config.log)
+  });
+  const listening = await listen(runtime, { port: config.port, host: config.host });
+  console.log(`${target.name} mock listening on ${listening.url}`);
+  console.log(`${target.name} health: GET ${listening.url}/health`);
+  console.log(`${target.name} admin: ${listening.url}/__admin (${config.adminKey ? "x-mockingbird-admin-key required" : "open \u2014 pass --admin-key to lock"})`);
+  for (const line of target.banner?.(runtime) ?? [])
+    console.log(`${target.name} ${line}`);
+  return listening;
+};
+var untilSignal = async (servers) => new Promise((resolve) => {
+  const stop = async () => {
+    await Promise.allSettled(servers.map((s) => s.close()));
+    resolve(0);
+  };
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+});
+var serveCommand = (target) => ({
+  summary: `Serve the ${target.name} mock over HTTP`,
+  options: { ...COMMON_SERVE_OPTIONS, ...target.options },
+  async run(values) {
+    const log = values["log-requests"] === true ? "json" : asString(values.log) ?? "pretty";
+    if (!["pretty", "json", "off"].includes(log)) {
+      console.error(`--log must be pretty, json or off (got ${log})`);
+      return 2;
+    }
+    const configPath = asString(values.config);
+    if (configPath !== void 0) {
+      const config = JSON.parse(await readFile(configPath, "utf8"));
+      const servers = [];
+      try {
+        for (const [name, entry] of Object.entries(config.services ?? {})) {
+          const each = await loadTarget(name, target);
+          servers.push(await start(each, entry.options ?? {}, {
+            port: entry.port ?? each.defaultPort,
+            host: entry.host ?? "127.0.0.1",
+            ...entry.adminKey !== void 0 ? { adminKey: entry.adminKey } : {},
+            ...entry.seed !== void 0 ? { seed: entry.seed } : {},
+            log: config.log ?? log
+          }));
+        }
+      } catch (error) {
+        await Promise.allSettled(servers.map((s) => s.close()));
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+      }
+      return untilSignal(servers);
+    }
+    const port = asString(values.port);
+    const adminKey = asString(values["admin-key"]) ?? process.env.MOCKINGBIRD_ADMIN_KEY;
+    const seed = asString(values.seed);
+    let listening;
+    try {
+      listening = await start(target, values, {
+        port: port === void 0 ? target.defaultPort : Number.parseInt(port, 10),
+        host: asString(values.host) ?? "127.0.0.1",
+        ...adminKey !== void 0 ? { adminKey } : {},
+        ...seed !== void 0 ? { seed } : {},
+        log
+      });
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+    return untilSignal([listening]);
+  }
+});
+
+// src/server.ts
+var DEFAULT_PORT = 8792;
+var createServer2 = async (options = {}) => {
+  const { port, host, ...rest } = options;
+  const runtime = createRuntime({ tickMs: 100, ...rest });
+  const listening = await listen(runtime, {
+    port: port ?? 0,
+    ...host !== void 0 ? { host } : {}
+  });
+  return {
+    ...listening,
+    runtime,
+    close: async () => {
+      runtime.stop();
+      await listening.close();
+    }
+  };
+};
+var text = (value) => typeof value === "string" ? value : void 0;
+var serveTarget = {
+  name: "flex",
+  defaultPort: DEFAULT_PORT,
+  options: {
+    "webhook-url": {
+      type: "string",
+      value: "<url>",
+      description: "Deliver webhooks here (e.g. http://127.0.0.1:3000/billing/webhooks/flex)"
+    },
+    "webhook-secret": {
+      type: "string",
+      value: "<fwhsec_\u2026|whsec_\u2026>",
+      description: "Svix signing secret (the app's FLEX_WEBHOOK_SECRET)"
+    },
+    "public-url": {
+      type: "string",
+      value: "<url>",
+      description: "Base URL of the hosted page in session URLs (default: the request origin)"
+    },
+    "event-naming": {
+      type: "string",
+      value: "<dotted|underscored>",
+      description: "Send checkout.session.* (dotted, default) or the checkout_session.* aliases"
+    }
+  },
+  create: (values, common) => {
+    const url = text(values["webhook-url"]);
+    const secret = text(values["webhook-secret"]);
+    const publicUrl = text(values["public-url"]);
+    const naming = text(values["event-naming"]);
+    if (naming && naming !== "dotted" && naming !== "underscored") {
+      throw new Error("--event-naming must be dotted or underscored");
+    }
+    return createRuntime({
+      tickMs: 100,
+      ...url ? { webhooks: { url, ...secret ? { secret } : {} } } : {},
+      settings: {
+        ...publicUrl ? { publicUrl } : {},
+        ...naming ? { eventNaming: naming } : {}
+      },
+      ...common.adminKey !== void 0 ? { adminKey: common.adminKey } : {},
+      ...common.seed !== void 0 ? { seed: common.seed } : {},
+      ...common.onLog ? { onLog: common.onLog } : {}
+    });
+  },
+  banner: () => [
+    "auth: Authorization: Bearer fsk_test_\u2026 (test mode) or fsk_\u2026 (live mode)",
+    "hosted page: GET /pay/<checkout_session_id> (cards 4000051230000072 HSA, 4242424242424242, 4000000000000002 declines)",
+    "namespaces: x-mockingbird-namespace, /ns/<name>/\u2026, or PUT /__admin/credentials {<FLEX_API_KEY>: <ns>}"
+  ]
+};
+
+export {
+  runCli,
+  serveCommand,
+  DEFAULT_PORT,
+  createServer2 as createServer,
+  serveTarget
+};
+//# sourceMappingURL=chunk-Q6AKODYZ.js.map