@crvouga/mockingbird-service-flex 1.8.0 → 2.0.0

package/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog — @crvouga/mockingbird-service-flex
 
-## 1.8.0 (2026-10-02)
+## 2.0.0 (2026-10-04)
+
+### ⚠️ Breaking changes
+
+- isolate internal routes ([5e19b21](https://github.com/crvouga/mockingbird/commit/5e19b21d403acc74b04778a8b545e80bcbdf8d51))
+
+### Features
+
+- add route filtering ([4e59b1d](https://github.com/crvouga/mockingbird/commit/4e59b1d42a76550f844b744f8431a637433a0781))
+- publish agent package indexes ([eca61d3](https://github.com/crvouga/mockingbird/commit/eca61d358b86982cf0b777ae8bd7feaa3663aaa6))
+
+### Fixes and improvements
+
+- honor configured prefixes ([4f569d7](https://github.com/crvouga/mockingbird/commit/4f569d74ca8089f2ed5e33a1abf32b90973f41dd))
+- explain configurable internal paths ([21b47ae](https://github.com/crvouga/mockingbird/commit/21b47ae4d4a096cdf63189aaeaf721ccb369bcf3))
+- parse ISO journal timestamps ([20b39a2](https://github.com/crvouga/mockingbird/commit/20b39a2c738e278533d610dfc91f1cb3ae9b3f1e))
+- harden shared controls ([7822614](https://github.com/crvouga/mockingbird/commit/7822614f6cba0387aeb60ba7320b0379aa1ef690))
+
+### Dependencies
+
+- `@crvouga/mockingbird-service-sqlite`
+
+## 1.8.0 (2026-10-01)
 
 ### Features
 

package/DISCOVERY.md

@@ -0,0 +1,55 @@
+# @crvouga/mockingbird-service-flex discovery
+
+This is the installed-package index for coding agents and tooling. All relative links resolve
+inside `node_modules/@crvouga/mockingbird-service-flex/`; no repository checkout is needed to discover the mock's
+supported surface or documented behavior.
+
+## Capability and behavior sources
+
+| Question | Authoritative file | What it contains |
+| --- | --- | --- |
+| Behaviour and integration | [`README.md`](README.md) | Routes, state transitions, auth, webhooks, controls, presets and deliberate omissions. |
+| Exact capabilities | [`SUPPORT.md`](SUPPORT.md) | Supported, unsupported and parity-covered operations or commands, including reasons for gaps. |
+| Wire contract | [`openapi.yaml`](openapi.yaml) | Machine-readable paths, methods, schemas, responses and parity annotations. |
+| Public API | [`dist/index.d.ts`](dist/index.d.ts) | The installed package's exact TypeScript exports and signatures. |
+| Package metadata | [`package.json`](package.json) | Runtime/entry-point claims, vendor links, parity scope/tier and `mockingbird.discovery`. |
+
+Read these together: the contract/capability matrix says *what* is available, while the README
+defines stateful behavior, lifecycle rules, test controls, and intentional oracle differences.
+If prose and an executable surface disagree, report a parity mismatch instead of adding a
+consumer-side workaround.
+
+## Parity and oracle
+
+- Declared parity surface: **Checkout, subscriptions, and webhooks**.
+- Parity tier: **cold** (the repository controls when live checks run).
+- Oracle: **Live vendor API or sandbox**.
+- Repository command: `bun run parity:service -- flex`.
+- Evidence model: Run from a Mockingbird checkout; credentials come only from .env.local or GitHub Actions secrets. Missing credentials exit 2.
+
+The npm package contains evidence summaries and the exact contract, not credentials or the
+repository-only parity harness. Self-parity/property and acceptance tests run in the Mockingbird
+repository; live parity is an additional oracle check, not a substitute for the packaged matrix.
+
+## Runtime introspection
+
+- `GET /__admin/health`
+- `GET /__admin`
+- `GET /__admin/state`
+- `GET /__admin/requests`
+- `GET /__admin/metrics`
+- `GET /__admin/faults/presets`
+- `GET /__admin/ui`
+
+For HTTP services, use `x-mockingbird-namespace` (or the documented credential/path carrier) so
+parallel tests do not share state. Admin state, journal, metrics and fault-preset endpoints are
+designed for assertions and diagnosis by consuming test suites.
+
+## Report a mismatch or missing capability
+
+Follow the [agent reporting contract](https://github.com/crvouga/mockingbird/blob/main/docs/REPORTING_ISSUES.md). Include package version,
+operation/command, a minimal redacted request, actual mock result, expected oracle result or vendor
+documentation, and whether the mismatch appears in the matrix. Never include keys, tokens,
+customer data, prompts, PHI, card data, or unredacted recordings.
+
+Service key: `flex`.

package/README.md

@@ -33,7 +33,7 @@ Point the app at the mock:
 
 | Env | Value |
 | --- | --- |
-| `FLEX_API_BASE_URL` | `http://127.0.0.1:8792` (or `…/ns/<namespace>`) |
+| `FLEX_API_BASE_URL` | `http://127.0.0.1:8792` (or `…/__admin/ns/<namespace>`) |
 | `FLEX_API_KEY` | any `fsk_test_…` key (test mode); `fsk_…` is live mode; other formats get 401 |
 | `FLEX_WEBHOOK_SECRET` | the same value as `--webhook-secret`: `fwhsec_<base64>` or `whsec_<base64>` |
 
@@ -129,7 +129,7 @@ the `name`s and placeholders our codecept locators look for (`cardNumber`, `expi
 Success 302s to `success_url` with `{CHECKOUT_SESSION_ID}` substituted (raw and
 `%7BCHECKOUT_SESSION_ID%7D`); `GET /pay/{id}/cancel` (the Cancel link) 302s to `cancel_url`,
 leaving the session open. A contact email on a session without a customer creates one. In a
-namespace the page URL carries `/ns/<name>` (the browser sends no headers); `publicUrl`
+namespace the page URL carries `/__admin/ns/<name>` (the browser sends no headers); `publicUrl`
 overrides the origin.
 
 ### Webhooks
@@ -185,7 +185,7 @@ Fault presets (`POST /__admin/faults {"preset": "<name>", "count"?: n}`; `GET /_
 
 ### Namespaces
 
-`x-mockingbird-namespace`, a `/ns/<name>` prefix on `FLEX_API_BASE_URL`, or by API key:
+`x-mockingbird-namespace`, a `/__admin/ns/<name>` prefix on `FLEX_API_BASE_URL`, or by API key:
 `PUT /__admin/credentials {"credentials": {"<FLEX_API_KEY>": "<namespace>"}}`.
 
 ### Corpus

package/SUPPORT.md

@@ -0,0 +1,24 @@
+# Flex HSA/FSA payments API (Mockingbird subset) — operation support
+
+Generated from `openapi.yaml`; do not edit by hand.
+
+- operations in spec: **14**
+- supported by the mock: **14**
+- parity enabled: **11**
+
+| operationId | route | mock | parity | notes |
+| --- | --- | --- | --- | --- |
+| `ListProducts` | `GET /v1/products` | ✅ supported | ✅ |  |
+| `CreateProduct` | `POST /v1/products` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetProduct` | `GET /v1/products/{productId}` | ✅ supported | ✅ |  |
+| `UpdateProduct` | `PATCH /v1/products/{productId}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `ListCheckoutSessions` | `GET /v1/checkout/sessions` | ✅ supported | ✅ |  |
+| `CreateCheckoutSession` | `POST /v1/checkout/sessions` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCheckoutSession` | `GET /v1/checkout/sessions/{sessionId}` | ✅ supported | ✅ |  |
+| `RefundCheckoutSession` | `POST /v1/checkout/sessions/{sessionId}/refund` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `CreateCustomer` | `POST /v1/customers` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSetupIntent` | `GET /v1/setup_intents/{setupIntentId}` | ✅ supported | ✅ |  |
+| `GetSubscription` | `GET /v1/subscriptions/{subscriptionId}` | ✅ supported | ✅ |  |
+| `HostedCheckoutPage` | `GET /pay/{sessionId}` | ✅ supported | ❌ disabled | A browser-facing HTML page; covered by the acceptance suite, not by JSON walks. |
+| `SubmitHostedCheckout` | `POST /pay/{sessionId}` | ✅ supported | ❌ disabled | A browser form post; covered by the acceptance suite. |
+| `CancelHostedCheckout` | `GET /pay/{sessionId}/cancel` | ✅ supported | ❌ disabled | A browser navigation to cancel_url; covered by the acceptance suite. |