@crvouga/mockingbird-service-paddle 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog — @crvouga/mockingbird-service-paddle
 
+## 2.1.0 (2026-10-07)
+
+### Features
+
+- serve portal sessions and notification settings ([796e0e2](https://github.com/crvouga/mockingbird/commit/796e0e25eb0b071a478382a9fb3c526100bdf746))
+
+### Fixes and improvements
+
+- derive webhook destinations from stored settings ([5971ebd](https://github.com/crvouga/mockingbird/commit/5971ebde3d4759aab3c886eaebef2af3c0d90a17))
+
 ## 2.0.0 (2026-10-07)
 
 ### ⚠️ Breaking changes
@@ -14,10 +24,6 @@
 - typecheck the brand gate before builds ([fc36095](https://github.com/crvouga/mockingbird/commit/fc3609514de70ffe3170a5d216fb8a49f9ce7cbb))
 - format the emulates records query ([8698872](https://github.com/crvouga/mockingbird/commit/8698872509d06002be5a8fcdc85d79f8462320c3))
 
-### Dependencies
-
-- `@crvouga/mockingbird-service-sqlite`
-
 ## 1.3.0 (2026-10-04)
 
 ### Features

package/README.md

@@ -194,11 +194,15 @@ map API keys to namespaces: `PUT /__admin/credentials {"credentials": {"<PADDLE_
 - **Proration.** Changing a subscription's items with a `*_immediately` mode bills what the
   change adds in full, credits nothing for what it removes; the next-period modes bill nothing now. `PATCH /subscriptions/{id}/preview` and
   `…/charge/preview` are unsupported.
-- **The hosted checkout, customer portal and Paddle.js.** `checkout.url` and `management_urls`
-  are links, not pages; `POST /__admin/checkout` and `…/pay` replace the checkout.
-- **Payment methods and payment method changes**, payouts, reports, simulations, notification
-  settings through the API (endpoints are configured on the mock), invoice revisions, the
-  `imported` events, API key events and client tokens.
+- **The hosted checkout, customer portal pages and Paddle.js.** `checkout.url`, `management_urls`
+  and portal-session links are URLs, not pages; `POST /__admin/checkout` and `…/pay` replace the
+  checkout. `POST /customers/{id}/portal-sessions` returns the temporary https session links.
+- **Payment methods and payment method changes**, payouts, reports, simulations, invoice
+  revisions, the `imported` events, API key events and client tokens.
+- **Notification destinations** are the vendor API (`GET|POST /notification-settings`,
+  `GET|PATCH /notification-settings/{id}`). An active `url` destination is delivered with its
+  own `pdl_ntfset_…` secret. The secret is returned on create only. `--webhook-url` and
+  `PUT /__admin/webhook-endpoints` stay as extra receivers and are not replaced by the vendor list.
 - **Time.** Nothing renews on its own: call `…/renew` (or `…/payment-failed`) when the test's
   clock reaches `next_billed_at`. Retry schedules for past-due subscriptions are not modelled.
 - **Rate limits**, except through `rate_limited`. Legacy (pre-2025) API key formats are
@@ -215,7 +219,7 @@ map API keys to namespaces: `PUT /__admin/credentials {"credentials": {"<PADDLE_
 | `PADDLE_NAMESPACE` | string | The service name, `"paddle"`. |
 | `AUTH_TOKEN_TTL_MS` | number | The advertised lifetime of a customer auth token (30 min). |
 | `PaddleError` | class | The error a billing method throws: `status`, `code`, `detail`, `errors?`, `toResponse(requestId)`. |
-| `PaddleState` | class | The SQLite-backed collections (`customers`, `addresses`, `businesses`, `products`, `prices`, `transactions`, `subscriptions`, `events`) and `nextId(kind)`. |
+| `PaddleState` | class | The SQLite-backed collections (`customers`, `addresses`, `businesses`, `products`, `prices`, `transactions`, `subscriptions`, `events`, `notificationSettings`, `portalSessions`) and `nextId(kind)`. |
 | `ID_PREFIX` | object | Paddle's id prefix per entity (`customer: "ctm"`, `price: "pri"`, …). |
 | `document`, `operationIds`, `supportedOperationIds` | values | The vendored OpenAPI contract and its operation ids. |
 | `createServer`, `serveTarget`, `DEFAULT_PORT` (`./server`) | Node | Serve over `node:http`; the `serve` CLI target (`--webhook-url`, `--webhook-secret`, `--payment-link`, `--fixtures`); port 8795. |

package/SUPPORT.md

@@ -2,9 +2,9 @@
 
 Generated from `openapi.yaml`; do not edit by hand.
 
-- operations in spec: **48**
-- supported by the mock: **37**
-- parity enabled: **37**
+- operations in spec: **50**
+- supported by the mock: **42**
+- parity enabled: **42**
 
 | operationId | route | mock | parity | notes |
 | --- | --- | --- | --- | --- |
@@ -49,10 +49,12 @@ Generated from `openapi.yaml`; do not edit by hand.
 | `PreviewSubscriptionCharge` | `POST /subscriptions/{subscription_id}/charge/preview` | ❌ unsupported | — | One-time charge previews are not modelled; create the charge instead. |
 | `GetSubscriptionPaymentMethodChangeTransaction` | `GET /subscriptions/{subscription_id}/update-payment-method-transaction` | ❌ unsupported | — | Payment method changes go through the hosted checkout, which the mock does not serve. |
 | `ListEvents` | `GET /events` | ✅ supported | ✅ |  |
-| `ListNotificationSettings` | `GET /notification-settings` | ❌ unsupported | — | Notification destinations are configured on the mock (`--webhook-url`, `PUT /__admin/webhook-endpoints`), not through the API. |
-| `CreateNotificationSetting` | `POST /notification-settings` | ❌ unsupported | — | Notification destinations are configured on the mock (`--webhook-url`, `PUT /__admin/webhook-endpoints`), not through the API. |
+| `ListNotificationSettings` | `GET /notification-settings` | ✅ supported | ✅ |  |
+| `CreateNotificationSetting` | `POST /notification-settings` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetNotificationSetting` | `GET /notification-settings/{notification_setting_id}` | ✅ supported | ✅ |  |
+| `UpdateNotificationSetting` | `PATCH /notification-settings/{notification_setting_id}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
 | `ListDiscounts` | `GET /discounts` | ❌ unsupported | — | Discounts are not modelled; totals carry a zero discount. |
 | `CreateDiscount` | `POST /discounts` | ❌ unsupported | — | Discounts are not modelled; totals carry a zero discount. |
 | `ListAdjustments` | `GET /adjustments` | ❌ unsupported | — | Refunds and credits (adjustments) are not modelled. |
 | `CreateAdjustment` | `POST /adjustments` | ❌ unsupported | — | Refunds and credits (adjustments) are not modelled. |
-| `CreateCustomerPortalSession` | `POST /customers/{customer_id}/portal-sessions` | ❌ unsupported | — | The hosted customer portal is not served; `management_urls` on a subscription point at placeholder links. |
+| `CreateCustomerPortalSession` | `POST /customers/{customer_id}/portal-sessions` | ✅ supported | ⚠️ unsafe (opt-in) |  |