@crvouga/mockingbird-service-flex 3.9.0 → 4.0.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog — @crvouga/mockingbird-service-flex
 
+## 4.0.0 (2026-10-29)
+
+### ⚠️ Breaking changes
+
+- nest webhook objects under their resource key and send refunds as Flex does ([e460af6](https://github.com/crvouga/mockingbird/commit/e460af601280becdf8bd7c4f16dfada2cf181545))
+
+## 3.10.0 (2026-10-24)
+
+### Features
+
+- add buffered SQL durability ([288bdcc](https://github.com/crvouga/mockingbird/commit/288bdcca84582787a54c4fdf9e803db9aac0b8d7))
+- add efficient browser durability ([a8be579](https://github.com/crvouga/mockingbird/commit/a8be5799a883ddf6f731208e06f399410de4661a))
+
 ## 3.9.0 (2026-10-21)
 
 ### Features

package/README.md

@@ -140,10 +140,14 @@ overrides the origin.
 
 Svix-signed (`svix-id`, `svix-timestamp` = wall clock, `svix-signature: v1,<base64
 HMAC-SHA256(key, "<id>.<ts>.<body>")>`, key = base64-decoded secret after `fwhsec_`/`whsec_`).
-Body: `{event: {event_id, event_type, object, event_dt, test_mode, created_at}}`.
-Checkout events carry the session (so `object.checkout_session_id`), payment-intent events the
-intent plus `checkout_session_id`, refund events `checkout_session` and `payment_intent`, and
-`product.updated` the product (`object.product_id`).
+Body: `{event: {event_id, event_type, object, event_dt, test_mode, created_at}}`. As in Flex's
+OpenAPI (`EventObject`) and production deliveries, `object` holds one key named for the
+resource: checkout events `{checkout_session}` (so `object.checkout_session.checkout_session_id`),
+payment-intent events `{payment_intent}`, `charge.*` events `{charge}` (its intent is
+`charge.payment_intent`), `refund.*` and `charge.refund.updated` events `{refund}` (its intent is
+`refund.payment_intent_id`), `customer.subscription.*` `{subscription}` and `product.updated`
+`{product}`. Payment-intent, charge and refund objects name no checkout session: a receiver
+finds the payment through the payment intent.
 
 | Event | When |
 | --- | --- |
@@ -152,7 +156,7 @@ intent plus `checkout_session_id`, refund events `checkout_session` and `payment
 | `checkout.session.async_payment_succeeded` | settling a session whose intent was `processing` |
 | `checkout.session.async_payment_failed` | a decline (page, admin, off-session) |
 | `checkout.session.expired` | `…/expire`, or `expires_at` passing on the emulator clock (default 24 h) |
-| `refund.created`, `charge.refunded`, `checkout.session.refunded`, `refund.updated`, `charge.refund.updated` | each refund |
+| `refund.created` (twice), `charge.refunded`, `refund.updated`, `charge.refund.updated` | each refund, through the API or the dashboard (`POST /__admin/sessions/:id/refund`), in the order production delivers a dashboard refund. `checkout.session.refunded` is in Flex's event list but has never been seen on a refund, so it is only sent through `POST /__admin/events` |
 | `product.updated` | `PATCH /v1/products/{id}` and `PUT /__admin/products/:id` |
 | `checkout_session.completed`, `checkout_session.expired` | the aliases, with `PUT /__admin/settings {"eventNaming": "underscored"}` |
 
@@ -168,6 +172,7 @@ retried (immediately, 5 s, 5 min, 30 min, 2 h); `GET /__admin/webhooks`, `…/ev
 | `POST /__admin/sessions/:id/complete` | `{card?}`: settle as if paid (HSA card unless `card` is `4242…`). |
 | `POST /__admin/sessions/:id/decline` | Payment intent → `requires_payment_method`. |
 | `POST /__admin/sessions/:id/expire` | Session → `expired`. |
+| `POST /__admin/sessions/:id/refund` | `{amount?}`: a refund made in Flex's dashboard (full by default); emits the refund events. 409 when unpaid, 400 over the unrefunded amount. |
 | `POST /__admin/sessions/:id/require_action` | `{next_action_type?}`: `collect_letter_of_medical_necessity` (default), `provide_second_payment_method`, `provide_alternative_payment_method`, `payment_failed`. |
 | `PUT /__admin/sessions/:id/payment-intent` | `{status, amount_received?}`: `requires_payment_method`, `requires_action`, `processing`, `succeeded`, `canceled`. |
 | `GET /__admin/sessions`, `GET /__admin/sessions/:id` | The namespace's sessions. |
@@ -221,11 +226,12 @@ so product names are synthesised.
 
 | Export | Kind | Description |
 | --- | --- | --- |
-| `FlexAPI` | class | The in-process emulator: `fetch(request)`, `reset()`, `settle(id)`, `decline(id)`, `expire(id)`, `requireAction(id, type)`, `setPaymentIntent(id, patch)`, `applyRefund(id, amount)`, `putProduct(product)`, `emitFor(type, target)`, `tick()`, `sessions()`, `subscriptions()`, `present(session, view)`. Options: `sqlite`, `now`, `namespace`, `publicNamespace`, `products`, `settings`, `onEvent`. |
+| `FlexAPI` | class | The in-process emulator: `fetch(request)`, `reset()`, `settle(id)`, `decline(id)`, `expire(id)`, `requireAction(id, type)`, `setPaymentIntent(id, patch)`, `applyRefund(id, amount)`, `dashboardRefund(id, amount?)`, `putProduct(product)`, `emitFor(type, target)`, `tick()`, `sessions()`, `subscriptions()`, `present(session, view)`. Options: `sqlite`, `now`, `namespace`, `publicNamespace`, `products`, `settings`, `onEvent`. |
 | `createRuntime` | function | The emulator with the full service contract. Options: `webhooks: {url, secret, retryDelaysMs?, fetch?}`, `products`, `settings`, `tickMs`, `clock`, `seed`, `adminKey`, `onLog`. |
 | `FLEX_PRESETS` | object | Every named fault preset. |
 | `FLEX_NAMESPACE` | string | The service name, `"flex"`. |
 | `FLEX_EVENT_TYPES` | array | Every webhook event type, aliases included. |
+| `eventObjectKey` | function | The key an event type's `object` is nested under (`refund.created` → `refund`, `charge.refund.updated` → `refund`). |
 | `keyMode` | function | `"test"` for `fsk_test_…`, `"live"` for `fsk_…`, otherwise `undefined`. |
 | `isNextActionType` | function | Whether a string is a next-action type. |
 | `CARDS`, `classifyCard`, `substituteSessionId` | values | The hosted page's test cards, its card classifier, and the `{CHECKOUT_SESSION_ID}` substitution. |

package/dist/{chunk-5DQQEGW6.js → chunk-3FSLZROR.js}

@@ -331,15 +331,24 @@ var Collection = class {
   sqlite;
   namespace;
   collectionName;
+  statements = /* @__PURE__ */ new Map();
+  prepare(sql) {
+    let statement = this.statements.get(sql);
+    if (!statement) {
+      statement = this.sqlite.prepare(sql);
+      this.statements.set(sql, statement);
+    }
+    return statement;
+  }
   constructor(sqlite, namespace, collectionName) {
     this.sqlite = sqlite;
     this.namespace = namespace;
     this.collectionName = collectionName;
   }
   bumpCollectionSeq() {
-    const row = this.sqlite.prepare("SELECT value FROM mockingbird_sequences WHERE namespace = ? AND name = ? AND kind = 'collection'").get(this.namespace, this.collectionName);
+    const row = this.prepare("SELECT value FROM mockingbird_sequences WHERE namespace = ? AND name = ? AND kind = 'collection'").get(this.namespace, this.collectionName);
     const next = (row?.value ?? 0) + 1;
-    this.sqlite.prepare(`INSERT INTO mockingbird_sequences (namespace, name, kind, value) VALUES (?, ?, 'collection', ?)
+    this.prepare(`INSERT INTO mockingbird_sequences (namespace, name, kind, value) VALUES (?, ?, 'collection', ?)
          ON CONFLICT(namespace, name, kind) DO UPDATE SET value = excluded.value`).run(this.namespace, this.collectionName, next);
     return next;
   }
@@ -347,13 +356,13 @@ var Collection = class {
     return this.sqlite.transaction(() => this.bumpCollectionSeq());
   }
   get(id) {
-    const row = this.sqlite.prepare("SELECT value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
+    const row = this.prepare("SELECT value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
     if (!row)
       return void 0;
     return JSON.parse(row.value).value;
   }
   has(id) {
-    const row = this.sqlite.prepare("SELECT 1 AS ok FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
+    const row = this.prepare("SELECT 1 AS ok FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
     return row !== void 0;
   }
   /** Insert a new record, assigning it the next sequence number. */
@@ -361,7 +370,7 @@ var Collection = class {
     return this.sqlite.transaction(() => {
       const seq = this.bumpCollectionSeq();
       const stored = { seq, value };
-      this.sqlite.prepare(`INSERT INTO mockingbird_records (namespace, collection, id, seq, value)
+      this.prepare(`INSERT INTO mockingbird_records (namespace, collection, id, seq, value)
            VALUES (?, ?, ?, ?, ?)
            ON CONFLICT(namespace, collection, id) DO UPDATE SET seq = excluded.seq, value = excluded.value`).run(this.namespace, this.collectionName, id, seq, JSON.stringify(stored));
       return stored;
@@ -370,25 +379,25 @@ var Collection = class {
   /** Replace an existing record's value, keeping its position. */
   update(id, value) {
     return this.sqlite.transaction(() => {
-      const row = this.sqlite.prepare("SELECT seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
+      const row = this.prepare("SELECT seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.collectionName, id);
       if (!row)
         return void 0;
       const stored = { seq: row.seq, value };
-      this.sqlite.prepare("UPDATE mockingbird_records SET value = ? WHERE namespace = ? AND collection = ? AND id = ?").run(JSON.stringify(stored), this.namespace, this.collectionName, id);
+      this.prepare("UPDATE mockingbird_records SET value = ? WHERE namespace = ? AND collection = ? AND id = ?").run(JSON.stringify(stored), this.namespace, this.collectionName, id);
       return stored;
     });
   }
   delete(id) {
-    const result = this.sqlite.prepare("DELETE FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").run(this.namespace, this.collectionName, id);
+    const result = this.prepare("DELETE FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").run(this.namespace, this.collectionName, id);
     return result.changes > 0;
   }
   /** How many records the collection holds, without reading them. */
   count() {
-    const row = this.sqlite.prepare("SELECT COUNT(*) AS n FROM mockingbird_records WHERE namespace = ? AND collection = ?").get(this.namespace, this.collectionName);
+    const row = this.prepare("SELECT COUNT(*) AS n FROM mockingbird_records WHERE namespace = ? AND collection = ?").get(this.namespace, this.collectionName);
     return Number(row?.n ?? 0);
   }
   list(options = {}) {
-    const rows = this.sqlite.prepare("SELECT id, seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ?").all(this.namespace, this.collectionName);
+    const rows = this.prepare("SELECT id, seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ?").all(this.namespace, this.collectionName);
     const out = [];
     for (const row of rows) {
       const stored = JSON.parse(row.value);
@@ -4088,7 +4097,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.9.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "4.0.0" : UNRELEASED_VERSION;
 
 // ../core/dist/signing.js
 var encoder = new TextEncoder();
@@ -7286,6 +7295,17 @@ var adminRoutes = (runtime) => {
         `session ${params.id}`
       );
     },
+    "POST /sessions/:id/refund": ({ namespace, params, body }) => {
+      if (body !== void 0 && body !== null && !isRecord5(body)) {
+        return adminError4(400, 'expected {"amount"?: <cents>}');
+      }
+      const amount = isRecord5(body) ? body.amount : void 0;
+      if (amount !== void 0 && typeof amount !== "number") {
+        return adminError4(400, "amount: integer cents");
+      }
+      const outcome = runtime.instance(namespace).dashboardRefund(params.id, amount);
+      return "session" in outcome ? json5(200, outcome.session) : adminError4(outcome.status, outcome.message);
+    },
     "PUT /sessions/:id/payment-intent": ({ namespace, params, body }) => {
       if (!isRecord5(body) || !PAYMENT_INTENT_STATUSES.includes(String(body.status))) {
         return adminError4(400, `status: ${PAYMENT_INTENT_STATUSES.join(" | ")}`);
@@ -7426,6 +7446,17 @@ var FLEX_EVENT_TYPES = [
   "charge.refunded",
   "charge.refund.updated"
 ];
+var eventObjectKey = (type) => {
+  const prefixes2 = [
+    ["checkout.session.", "checkout_session"],
+    ["checkout_session.", "checkout_session"],
+    ["charge.refund.", "refund"],
+    ["charge.dispute.", "dispute"],
+    ["customer.subscription.", "subscription"]
+  ];
+  const match = prefixes2.find(([prefix]) => type.startsWith(prefix));
+  return match ? match[1] : type.split(".")[0];
+};
 var keyMode = (key) => {
   if (!key) return void 0;
   if (/^fsk_test_[A-Za-z0-9_-]+$/.test(key)) return "test";
@@ -7901,7 +7932,11 @@ var FlexAPI = class {
     this.applyRefund(id, amount);
     return this.sessionResponse(context, id);
   }
-  /** Refund part or all of a paid session, emitting the refund events. */
+  /**
+   * Refund part or all of a paid session, emitting the refund events in the order Flex sends
+   * them for a dashboard refund: `refund.created` twice, `charge.refunded`, then
+   * `refund.updated` and `charge.refund.updated`.
+   */
   applyRefund(id, amount) {
     const session = this.state.sessions.get(id);
     if (!session) return void 0;
@@ -7916,20 +7951,74 @@ var FlexAPI = class {
       created_at: this.iso()
     };
     this.state.refunds.insert(refund.refund_id, refund);
-    const charge = {
-      charge_id: `fch_${refund.refund_id.slice(4)}`,
-      checkout_session_id: id,
+    const refundObject = this.presentRefund(refund, session.test_mode);
+    const chargeObject = this.presentCharge(next, refund.refund_id);
+    this.emit("refund.created", refundObject, session.test_mode);
+    this.emit("refund.created", refundObject, session.test_mode);
+    this.emit("charge.refunded", chargeObject, session.test_mode);
+    this.emit("refund.updated", refundObject, session.test_mode);
+    this.emit("charge.refund.updated", refundObject, session.test_mode);
+    return this.state.sessions.get(id);
+  }
+  /** Refund a paid session from Flex's dashboard (`POST /__admin/sessions/:id/refund`). */
+  dashboardRefund(id, amount) {
+    const session = this.state.sessions.get(id);
+    if (!session) return { status: 404, message: `no session ${id}` };
+    const received = session.amount_received ?? 0;
+    if (session.status !== "complete" || received <= 0) {
+      return { status: 409, message: `session ${id} has no payment to refund` };
+    }
+    const remaining = received - session.amount_refunded;
+    const value = amount ?? remaining;
+    if (!Number.isInteger(value) || value <= 0 || value > remaining) {
+      return { status: 400, message: `amount must be between 1 and ${remaining}` };
+    }
+    return { session: this.applyRefund(id, value) };
+  }
+  presentRefund(refund, testMode) {
+    return {
+      refund_id: refund.refund_id,
+      amount: refund.amount,
+      status: refund.status,
+      payment_intent_id: refund.payment_intent,
+      items: [],
+      metadata: null,
+      reason: null,
+      reference_id: null,
+      reference_type: null,
+      reference_status: null,
+      balance_transaction: null,
+      failure_balance_transaction: null,
+      test_mode: testMode,
+      created_at: refund.created_at
+    };
+  }
+  presentCharge(session, seed) {
+    const intent = session.payment_intent ? this.state.paymentIntents.get(session.payment_intent) : void 0;
+    const received = session.amount_received ?? 0;
+    return {
+      charge_id: `fch_${seed.slice(4)}`,
       payment_intent: session.payment_intent,
-      amount: session.amount_received,
-      amount_refunded: next.amount_refunded,
-      refunded: next.amount_refunded >= (session.amount_received ?? 0)
+      amount: received,
+      amount_captured: received,
+      amount_refunded: session.amount_refunded,
+      refunded: session.amount_refunded >= received,
+      paid: true,
+      captured: true,
+      status: "succeeded",
+      customer: session.customer,
+      payment_method_id: intent?.payment_method ?? null,
+      invoice: null,
+      refunds: null,
+      disputed: false,
+      failure_message: null,
+      balance_transaction: null,
+      failure_balance_transaction: null,
+      application_fee_amount: null,
+      transfer_group: null,
+      test_mode: session.test_mode,
+      created_at: intent?.created_at ?? this.iso()
     };
-    this.emit("refund.created", { ...refund, status: "pending" }, session.test_mode);
-    this.emit("charge.refunded", charge, session.test_mode);
-    this.emitSession("checkout.session.refunded", id);
-    this.emit("refund.updated", refund, session.test_mode);
-    this.emit("charge.refund.updated", { ...refund, charge: charge.charge_id }, session.test_mode);
-    return this.state.sessions.get(id);
   }
   // --- customers and setup intents ---------------------------------------------------------
   createCustomer(context) {
@@ -8043,11 +8132,7 @@ var FlexAPI = class {
     const intent = { ...this.paymentIntentFor(session), ...patch };
     this.state.paymentIntents.update(intent.payment_intent_id, intent);
     if (patch.status === "succeeded") {
-      this.emit(
-        "payment_intent.succeeded",
-        { ...intent, checkout_session_id: id },
-        session.test_mode
-      );
+      this.emit("payment_intent.succeeded", { ...intent }, session.test_mode);
     }
     return intent;
   }
@@ -8174,8 +8259,40 @@ var FlexAPI = class {
       const product = this.state.products.get(target.productId);
       return product ? this.emit(type, { ...product }, product.test_mode) : void 0;
     }
-    if (target.sessionId) return this.emitSession(type, target.sessionId);
-    return void 0;
+    if (!target.sessionId) return void 0;
+    const session = this.state.sessions.get(target.sessionId);
+    if (!session) return void 0;
+    const key = eventObjectKey(type);
+    const existingIntent = session.payment_intent ? this.state.paymentIntents.get(session.payment_intent) : void 0;
+    if (key === "payment_intent") {
+      const intent = existingIntent ?? {
+        payment_intent_id: `fpi_${session.checkout_session_id.slice(4)}`,
+        amount: session.amount_total,
+        amount_received: null,
+        customer: session.customer,
+        payment_method: null,
+        status: "requires_payment_method",
+        created_at: session.created_at
+      };
+      return this.emit(type, { ...intent }, session.test_mode);
+    }
+    if (key === "refund" || key === "charge") {
+      const refund = this.state.refunds.list().map((row) => row.value).filter((row) => row.checkout_session === session.checkout_session_id).at(-1) ?? {
+        refund_id: this.state.nextId("fre_"),
+        checkout_session: session.checkout_session_id,
+        payment_intent: session.payment_intent,
+        amount: session.amount_received ?? session.amount_total,
+        status: "succeeded",
+        created_at: this.iso()
+      };
+      const current = this.state.sessions.get(session.checkout_session_id);
+      return this.emit(
+        type,
+        key === "refund" ? this.presentRefund(refund, session.test_mode) : this.presentCharge(current, refund.refund_id),
+        session.test_mode
+      );
+    }
+    return this.emitSession(type, target.sessionId);
   }
   emitSession(type, id) {
     const session = this.state.sessions.get(id);
@@ -8190,7 +8307,7 @@ var FlexAPI = class {
     const event = {
       event_id: this.state.nextId("fevt_"),
       event_type: type,
-      object,
+      object: { [eventObjectKey(type)]: object },
       event_dt: Math.floor(this.now() / 1e3),
       test_mode: testMode,
       created_at: this.iso()
@@ -8318,9 +8435,10 @@ export {
   createRuntime2 as createRuntime,
   FLEX_NAMESPACE,
   FLEX_EVENT_TYPES,
+  eventObjectKey,
   keyMode,
   periodEnd,
   FlexAPI,
   isNextActionType
 };
-//# sourceMappingURL=chunk-5DQQEGW6.js.map
+//# sourceMappingURL=chunk-3FSLZROR.js.map