@crvouga/mockingbird-service-stripe 1.12.1 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog — @crvouga/mockingbird-service-stripe
 
+## 2.0.0 (2026-10-04)
+
+### ⚠️ Breaking changes
+
+- isolate internal routes ([5e19b21](https://github.com/crvouga/mockingbird/commit/5e19b21d403acc74b04778a8b545e80bcbdf8d51))
+
+### Features
+
+- add route filtering ([4e59b1d](https://github.com/crvouga/mockingbird/commit/4e59b1d42a76550f844b744f8431a637433a0781))
+- publish agent package indexes ([eca61d3](https://github.com/crvouga/mockingbird/commit/eca61d358b86982cf0b777ae8bd7feaa3663aaa6))
+
+### Fixes and improvements
+
+- clarify runtime prefix options ([f899a78](https://github.com/crvouga/mockingbird/commit/f899a7891f29413e4f08e9534d0c977f16acf7d7))
+- honor configured prefixes ([4f569d7](https://github.com/crvouga/mockingbird/commit/4f569d74ca8089f2ed5e33a1abf32b90973f41dd))
+- explain configurable internal paths ([21b47ae](https://github.com/crvouga/mockingbird/commit/21b47ae4d4a096cdf63189aaeaf721ccb369bcf3))
+- parse ISO journal timestamps ([20b39a2](https://github.com/crvouga/mockingbird/commit/20b39a2c738e278533d610dfc91f1cb3ae9b3f1e))
+- harden shared controls ([7822614](https://github.com/crvouga/mockingbird/commit/7822614f6cba0387aeb60ba7320b0379aa1ef690))
+
+### Dependencies
+
+- `@crvouga/mockingbird-service-sqlite`
+
+## 1.13.0 (2026-10-01)
+
+### Features
+
+- coordinate HTTP and protocol mocks ([3168653](https://github.com/crvouga/mockingbird/commit/31686534c55a9823fdaa92afc9cc456cf741b809))
+
+### Fixes and improvements
+
+- decouple smoke types from built packages ([a4b31c6](https://github.com/crvouga/mockingbird/commit/a4b31c6205d92aa0c6f7c9de3518d5ae44d38829))
+- protect child admin endpoints ([5410b94](https://github.com/crvouga/mockingbird/commit/5410b948a30dcedc21e9a70e44fd415c1ea25394))
+- harden protocol startup and state ([6f5b557](https://github.com/crvouga/mockingbird/commit/6f5b557e87b48b31985949e04f3b5ef58f51d295))
+- preserve checkpoints and lifecycle ([50e8c32](https://github.com/crvouga/mockingbird/commit/50e8c322feded2f7f45afce9d8cdef43c37ab9ab))
+- clean branch state on reset ([3b714d4](https://github.com/crvouga/mockingbird/commit/3b714d4a5df8e75fee0bb31e98d7c7566e164381))
+- type signal listener cleanup ([5279852](https://github.com/crvouga/mockingbird/commit/5279852e56ea60262ccf17aa6e46b3c31091a34a))
+
 ## 1.12.1 (2026-10-01)
 
 ### Fixes and improvements

package/DISCOVERY.md

@@ -0,0 +1,55 @@
+# @crvouga/mockingbird-service-stripe discovery
+
+This is the installed-package index for coding agents and tooling. All relative links resolve
+inside `node_modules/@crvouga/mockingbird-service-stripe/`; no repository checkout is needed to discover the mock's
+supported surface or documented behavior.
+
+## Capability and behavior sources
+
+| Question | Authoritative file | What it contains |
+| --- | --- | --- |
+| Behaviour and integration | [`README.md`](README.md) | Routes, state transitions, auth, webhooks, controls, presets and deliberate omissions. |
+| Exact capabilities | [`SUPPORT.md`](SUPPORT.md) | Supported, unsupported and parity-covered operations or commands, including reasons for gaps. |
+| Wire contract | [`openapi.yaml`](openapi.yaml) | Machine-readable paths, methods, schemas, responses and parity annotations. |
+| Public API | [`dist/index.d.ts`](dist/index.d.ts) | The installed package's exact TypeScript exports and signatures. |
+| Package metadata | [`package.json`](package.json) | Runtime/entry-point claims, vendor links, parity scope/tier and `mockingbird.discovery`. |
+
+Read these together: the contract/capability matrix says *what* is available, while the README
+defines stateful behavior, lifecycle rules, test controls, and intentional oracle differences.
+If prose and an executable surface disagree, report a parity mismatch instead of adding a
+consumer-side workaround.
+
+## Parity and oracle
+
+- Declared parity surface: **Payments, billing, and webhooks**.
+- Parity tier: **cold** (the repository controls when live checks run).
+- Oracle: **Live vendor API or sandbox**.
+- Repository command: `bun run parity:service -- stripe`.
+- Evidence model: Run from a Mockingbird checkout; credentials come only from .env.local or GitHub Actions secrets. Missing credentials exit 2.
+
+The npm package contains evidence summaries and the exact contract, not credentials or the
+repository-only parity harness. Self-parity/property and acceptance tests run in the Mockingbird
+repository; live parity is an additional oracle check, not a substitute for the packaged matrix.
+
+## Runtime introspection
+
+- `GET /__admin/health`
+- `GET /__admin`
+- `GET /__admin/state`
+- `GET /__admin/requests`
+- `GET /__admin/metrics`
+- `GET /__admin/faults/presets`
+- `GET /__admin/ui`
+
+For HTTP services, use `x-mockingbird-namespace` (or the documented credential/path carrier) so
+parallel tests do not share state. Admin state, journal, metrics and fault-preset endpoints are
+designed for assertions and diagnosis by consuming test suites.
+
+## Report a mismatch or missing capability
+
+Follow the [agent reporting contract](https://github.com/crvouga/mockingbird/blob/main/docs/REPORTING_ISSUES.md). Include package version,
+operation/command, a minimal redacted request, actual mock result, expected oracle result or vendor
+documentation, and whether the mismatch appears in the matrix. Never include keys, tokens,
+customer data, prompts, PHI, card data, or unredacted recordings.
+
+Service key: `stripe`.

package/README.md

@@ -100,9 +100,9 @@ State is partitioned by **account**, and the account is chosen by API key:
   (see Lifecycles and the clock); unset fields use `createRuntime({lifecycle: {paymentRetries}})`.
 
 **Namespaces** isolate parallel workers; each namespace has its own copy of every account. Carriers:
-the `x-mockingbird-namespace` header, the `/ns/<namespace>/…` path prefix, or **by API key**:
+the `x-mockingbird-namespace` header, the `/__admin/ns/<namespace>/…` path prefix, or **by API key**:
 `PUT /__admin/credentials {"credentials": {"sk_test_worker1": "w1"}}` (stripe-node cannot add
-headers). Hosted-page URLs carry the `/ns/<namespace>` prefix so the browser lands in the same one.
+headers). Hosted-page URLs carry the `/__admin/ns/<namespace>` prefix so the browser lands in the same one.
 
 ### API versions
 
@@ -337,7 +337,7 @@ hides objects younger than 60 s — search is consistent otherwise), `webhook_du
 {payment_intent|charge, reason?, amount?}` (emits `charge.dispute.created`),
 `POST /__admin/checkout/sessions/:id/complete|expire|async_payment_succeeded`,
 `POST /__admin/setup_intents/:id/succeed`, `GET /__admin/charges/:id`, `POST /__admin/tick`. The
-standard ones (`/health`, reset, snapshots, clock, faults, metrics, `GET /__admin/requests`,
+standard ones (`/__admin/health`, reset, snapshots, clock, faults, metrics, `GET /__admin/requests`,
 credentials, webhooks) come from the shared runtime. The journal records operation, status and ids
 only — never bodies, card numbers or emails.
 

package/SUPPORT.md

@@ -0,0 +1,135 @@
+# Stripe API (Mockingbird subset) — operation support
+
+Generated from `openapi.yaml`; do not edit by hand.
+
+- operations in spec: **125**
+- supported by the mock: **121**
+- parity enabled: **114**
+
+| operationId | route | mock | parity | notes |
+| --- | --- | --- | --- | --- |
+| `PostThreeDSecureAuthenticate` | `POST /c/3ds/{intent}/authenticate` | ✅ supported | ❌ disabled | the 3-D Secure challenge the Stripe.js stand-in completes has no public API |
+| `GetCheckoutPage` | `GET /c/pay/{session}` | ✅ supported | ❌ disabled | the hosted Checkout page is HTML served by the mock in place of checkout.stripe.com |
+| `PostCheckoutPage` | `POST /c/pay/{session}` | ✅ supported | ❌ disabled | the hosted Checkout page form post is served by the mock in place of checkout.stripe.com |
+| `GetPortalPage` | `GET /p/session/{session}` | ✅ supported | ❌ disabled | the customer portal is HTML served by the mock in place of billing.stripe.com |
+| `PostPortalPage` | `POST /p/session/{session}` | ✅ supported | ❌ disabled | the customer portal form post is served by the mock in place of billing.stripe.com |
+| `GetAccount` | `GET /v1/account` | ✅ supported | ✅ |  |
+| `GetBalance` | `GET /v1/balance` | ✅ supported | ✅ |  |
+| `GetBalanceTransactions` | `GET /v1/balance_transactions` | ✅ supported | ✅ |  |
+| `GetBalanceTransactionsId` | `GET /v1/balance_transactions/{id}` | ✅ supported | ✅ |  |
+| `GetBillingPortalConfigurations` | `GET /v1/billing_portal/configurations` | ✅ supported | ✅ |  |
+| `PostBillingPortalConfigurations` | `POST /v1/billing_portal/configurations` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetBillingPortalConfigurationsConfiguration` | `GET /v1/billing_portal/configurations/{configuration}` | ✅ supported | ✅ |  |
+| `PostBillingPortalConfigurationsConfiguration` | `POST /v1/billing_portal/configurations/{configuration}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostBillingPortalSessions` | `POST /v1/billing_portal/sessions` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCharges` | `GET /v1/charges` | ✅ supported | ✅ |  |
+| `PostCharges` | `POST /v1/charges` | ❌ unsupported | — | charges are always created through PaymentIntents |
+| `GetChargesCharge` | `GET /v1/charges/{charge}` | ✅ supported | ✅ |  |
+| `PostChargesCharge` | `POST /v1/charges/{charge}` | ❌ unsupported | — | charges are only read in the e2e path |
+| `GetCheckoutSessions` | `GET /v1/checkout/sessions` | ✅ supported | ✅ |  |
+| `PostCheckoutSessions` | `POST /v1/checkout/sessions` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCheckoutSessionsSession` | `GET /v1/checkout/sessions/{session}` | ✅ supported | ✅ |  |
+| `PostCheckoutSessionsSession` | `POST /v1/checkout/sessions/{session}` | ❌ unsupported | — | sessions complete through their payment intent, never by update |
+| `PostCheckoutSessionsSessionExpire` | `POST /v1/checkout/sessions/{session}/expire` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCheckoutSessionsSessionLineItems` | `GET /v1/checkout/sessions/{session}/line_items` | ✅ supported | ✅ |  |
+| `GetCoupons` | `GET /v1/coupons` | ✅ supported | ✅ |  |
+| `PostCoupons` | `POST /v1/coupons` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCouponsCoupon` | `GET /v1/coupons/{coupon}` | ✅ supported | ✅ |  |
+| `PostCouponsCoupon` | `POST /v1/coupons/{coupon}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteCouponsCoupon` | `DELETE /v1/coupons/{coupon}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCustomers` | `GET /v1/customers` | ✅ supported | ✅ |  |
+| `PostCustomers` | `POST /v1/customers` | ✅ supported | ✅ |  |
+| `GetCustomersCustomer` | `GET /v1/customers/{customer}` | ✅ supported | ✅ |  |
+| `PostCustomersCustomer` | `POST /v1/customers/{customer}` | ✅ supported | ✅ |  |
+| `DeleteCustomersCustomer` | `DELETE /v1/customers/{customer}` | ✅ supported | ✅ |  |
+| `GetCustomersCustomerBalanceTransactions` | `GET /v1/customers/{customer}/balance_transactions` | ✅ supported | ✅ |  |
+| `PostCustomersCustomerBalanceTransactions` | `POST /v1/customers/{customer}/balance_transactions` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetCustomersSearch` | `GET /v1/customers/search` | ✅ supported | ✅ |  |
+| `GetDisputes` | `GET /v1/disputes` | ✅ supported | ✅ |  |
+| `GetDisputesDispute` | `GET /v1/disputes/{dispute}` | ✅ supported | ✅ |  |
+| `PostDisputesDispute` | `POST /v1/disputes/{dispute}` | ❌ unsupported | — | the mock never creates or mutates disputes |
+| `GetEvents` | `GET /v1/events` | ✅ supported | ✅ |  |
+| `GetEventsId` | `GET /v1/events/{id}` | ✅ supported | ✅ |  |
+| `GetInvoicePayments` | `GET /v1/invoice_payments` | ✅ supported | ✅ |  |
+| `GetInvoicePaymentsInvoicePayment` | `GET /v1/invoice_payments/{invoice_payment}` | ✅ supported | ✅ |  |
+| `GetInvoiceitems` | `GET /v1/invoiceitems` | ✅ supported | ✅ |  |
+| `PostInvoiceitems` | `POST /v1/invoiceitems` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetInvoiceitemsInvoiceitem` | `GET /v1/invoiceitems/{invoiceitem}` | ✅ supported | ✅ |  |
+| `PostInvoiceitemsInvoiceitem` | `POST /v1/invoiceitems/{invoiceitem}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteInvoiceitemsInvoiceitem` | `DELETE /v1/invoiceitems/{invoiceitem}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetInvoices` | `GET /v1/invoices` | ✅ supported | ✅ |  |
+| `PostInvoices` | `POST /v1/invoices` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetInvoicesInvoice` | `GET /v1/invoices/{invoice}` | ✅ supported | ✅ |  |
+| `PostInvoicesInvoice` | `POST /v1/invoices/{invoice}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteInvoicesInvoice` | `DELETE /v1/invoices/{invoice}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostInvoicesInvoiceFinalize` | `POST /v1/invoices/{invoice}/finalize` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetInvoicesInvoiceLines` | `GET /v1/invoices/{invoice}/lines` | ✅ supported | ✅ |  |
+| `PostInvoicesInvoicePay` | `POST /v1/invoices/{invoice}/pay` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostInvoicesInvoiceVoid` | `POST /v1/invoices/{invoice}/void` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetInvoicesUpcoming` | `GET /v1/invoices/upcoming` | ✅ supported | ❌ disabled | route is absent from the pinned upstream spec (2026-08-26.dahlia previews invoices instead); the e2e SDK still calls it |
+| `GetPaymentIntents` | `GET /v1/payment_intents` | ✅ supported | ✅ |  |
+| `PostPaymentIntents` | `POST /v1/payment_intents` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetPaymentIntentsIntent` | `GET /v1/payment_intents/{intent}` | ✅ supported | ✅ |  |
+| `PostPaymentIntentsIntent` | `POST /v1/payment_intents/{intent}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostPaymentIntentsIntentCancel` | `POST /v1/payment_intents/{intent}/cancel` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostPaymentIntentsIntentCapture` | `POST /v1/payment_intents/{intent}/capture` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostPaymentIntentsIntentConfirm` | `POST /v1/payment_intents/{intent}/confirm` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetPaymentIntentsSearch` | `GET /v1/payment_intents/search` | ✅ supported | ✅ |  |
+| `GetPaymentMethods` | `GET /v1/payment_methods` | ✅ supported | ✅ |  |
+| `PostPaymentMethods` | `POST /v1/payment_methods` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetPaymentMethodsPaymentMethod` | `GET /v1/payment_methods/{payment_method}` | ✅ supported | ✅ |  |
+| `PostPaymentMethodsPaymentMethod` | `POST /v1/payment_methods/{payment_method}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostPaymentMethodsPaymentMethodAttach` | `POST /v1/payment_methods/{payment_method}/attach` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostPaymentMethodsPaymentMethodDetach` | `POST /v1/payment_methods/{payment_method}/detach` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetPrices` | `GET /v1/prices` | ✅ supported | ✅ |  |
+| `PostPrices` | `POST /v1/prices` | ✅ supported | ✅ |  |
+| `GetPricesPrice` | `GET /v1/prices/{price}` | ✅ supported | ✅ |  |
+| `PostPricesPrice` | `POST /v1/prices/{price}` | ✅ supported | ✅ |  |
+| `GetProducts` | `GET /v1/products` | ✅ supported | ✅ |  |
+| `PostProducts` | `POST /v1/products` | ✅ supported | ✅ |  |
+| `GetProductsId` | `GET /v1/products/{id}` | ✅ supported | ✅ |  |
+| `PostProductsId` | `POST /v1/products/{id}` | ✅ supported | ✅ |  |
+| `DeleteProductsId` | `DELETE /v1/products/{id}` | ✅ supported | ✅ |  |
+| `GetProductsSearch` | `GET /v1/products/search` | ✅ supported | ✅ |  |
+| `GetPromotionCodes` | `GET /v1/promotion_codes` | ✅ supported | ✅ |  |
+| `PostPromotionCodes` | `POST /v1/promotion_codes` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetPromotionCodesPromotionCode` | `GET /v1/promotion_codes/{promotion_code}` | ✅ supported | ✅ |  |
+| `PostPromotionCodesPromotionCode` | `POST /v1/promotion_codes/{promotion_code}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetRefunds` | `GET /v1/refunds` | ✅ supported | ✅ |  |
+| `PostRefunds` | `POST /v1/refunds` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetRefundsRefund` | `GET /v1/refunds/{refund}` | ✅ supported | ✅ |  |
+| `PostRefundsRefund` | `POST /v1/refunds/{refund}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSetupIntents` | `GET /v1/setup_intents` | ✅ supported | ✅ |  |
+| `PostSetupIntents` | `POST /v1/setup_intents` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSetupIntentsIntent` | `GET /v1/setup_intents/{intent}` | ✅ supported | ✅ |  |
+| `PostSetupIntentsIntent` | `POST /v1/setup_intents/{intent}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostSetupIntentsIntentCancel` | `POST /v1/setup_intents/{intent}/cancel` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostSetupIntentsIntentConfirm` | `POST /v1/setup_intents/{intent}/confirm` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptionItems` | `GET /v1/subscription_items` | ✅ supported | ✅ |  |
+| `PostSubscriptionItems` | `POST /v1/subscription_items` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptionItemsItem` | `GET /v1/subscription_items/{item}` | ✅ supported | ✅ |  |
+| `PostSubscriptionItemsItem` | `POST /v1/subscription_items/{item}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteSubscriptionItemsItem` | `DELETE /v1/subscription_items/{item}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptionSchedules` | `GET /v1/subscription_schedules` | ✅ supported | ✅ |  |
+| `PostSubscriptionSchedules` | `POST /v1/subscription_schedules` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptionSchedulesSchedule` | `GET /v1/subscription_schedules/{schedule}` | ✅ supported | ✅ |  |
+| `PostSubscriptionSchedulesSchedule` | `POST /v1/subscription_schedules/{schedule}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostSubscriptionSchedulesScheduleCancel` | `POST /v1/subscription_schedules/{schedule}/cancel` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostSubscriptionSchedulesScheduleRelease` | `POST /v1/subscription_schedules/{schedule}/release` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptions` | `GET /v1/subscriptions` | ✅ supported | ✅ |  |
+| `PostSubscriptions` | `POST /v1/subscriptions` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetSubscriptionsSubscriptionExposedId` | `GET /v1/subscriptions/{subscription_exposed_id}` | ✅ supported | ✅ |  |
+| `PostSubscriptionsSubscriptionExposedId` | `POST /v1/subscriptions/{subscription_exposed_id}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteSubscriptionsSubscriptionExposedId` | `DELETE /v1/subscriptions/{subscription_exposed_id}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostSubscriptionsSubscriptionResume` | `POST /v1/subscriptions/{subscription}/resume` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetTestHelpersTestClocks` | `GET /v1/test_helpers/test_clocks` | ✅ supported | ✅ |  |
+| `PostTestHelpersTestClocks` | `POST /v1/test_helpers/test_clocks` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetTestHelpersTestClocksTestClock` | `GET /v1/test_helpers/test_clocks/{test_clock}` | ✅ supported | ✅ |  |
+| `DeleteTestHelpersTestClocksTestClock` | `DELETE /v1/test_helpers/test_clocks/{test_clock}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `PostTestHelpersTestClocksTestClockAdvance` | `POST /v1/test_helpers/test_clocks/{test_clock}/advance` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetWebhookEndpoints` | `GET /v1/webhook_endpoints` | ✅ supported | ✅ |  |
+| `PostWebhookEndpoints` | `POST /v1/webhook_endpoints` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetWebhookEndpointsWebhookEndpoint` | `GET /v1/webhook_endpoints/{webhook_endpoint}` | ✅ supported | ✅ |  |
+| `PostWebhookEndpointsWebhookEndpoint` | `POST /v1/webhook_endpoints/{webhook_endpoint}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `DeleteWebhookEndpointsWebhookEndpoint` | `DELETE /v1/webhook_endpoints/{webhook_endpoint}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `GetStripeJs` | `GET /v3` | ✅ supported | ❌ disabled | the Stripe.js stand-in is JavaScript served by the mock in place of js.stripe.com/v3 |