@crvouga/mockingbird-service-stripe 2.1.0 → 2.2.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog — @crvouga/mockingbird-service-stripe
 
+## 2.2.1 (2026-10-05)
+
+### Fixes and improvements
+
+- validate card element input ([d53f042](https://github.com/crvouga/mockingbird/commit/d53f042089ee20b2708b489e5412065013309a55))
+- reject empty customer account filters ([b7910c7](https://github.com/crvouga/mockingbird/commit/b7910c73ad24fb1ae6767fc83effce76bfd09eaa))
+- render split card elements independently ([99e9a5d](https://github.com/crvouga/mockingbird/commit/99e9a5d82f9189ca5d347ff5d071d05f2d9fbf21))
+
+## 2.2.0 (2026-10-04)
+
+### Features
+
+- add scripted local API mock ([4a76a11](https://github.com/crvouga/mockingbird/commit/4a76a114e2efad45934e0a93cf29576fd418e15c))
+
+### Fixes and improvements
+
+- support embedded route parameters ([127cad9](https://github.com/crvouga/mockingbird/commit/127cad997ef106950c1b866070eea191ba54403f))
+
 ## 2.1.0 (2026-10-04)
 
 ### Features
@@ -12,10 +30,6 @@
 - fill the embedded viewport ([c1a35a4](https://github.com/crvouga/mockingbird/commit/c1a35a4789389ee9cd06c286d09bd47c4d06c71e))
 - make dialog cleanup immediate ([0c1a3c5](https://github.com/crvouga/mockingbird/commit/0c1a3c5b12584d50c19dcae595b951b8e5417b9c))
 
-### Dependencies
-
-- `@crvouga/mockingbird-service-sqlite`
-
 ## 2.0.0 (2026-10-04)
 
 ### ⚠️ Breaking changes

package/README.md

@@ -252,7 +252,12 @@ finalize; a customer credit balance is applied at finalize; `void` works only on
   payment mode, inactive prices, mixed currencies, quantities below 1, `trial_end` under 48 h.
 - `POST /__admin/checkout/sessions/:id/complete {"card": "4242…"}` does the same without a browser;
   `…/expire` and `…/async_payment_succeeded` too.
-- `GET /v3` — the Stripe.js stand-in: `Stripe(pk)`, `elements()` → `create("payment"|"card")`,
+- `GET /v3` — the Stripe.js stand-in: `Stripe(pk)`, `elements()` → combined `create("payment"|"card")`
+  or split `create("cardNumber"|"cardExpiry"|"cardCvc")` inputs. Split inputs share card data
+  within their `Elements` group, add no visible labels, and the combined card honors
+  `hidePostalCode`. Card inputs format number/expiry/CVC values, report field-level `empty`,
+  `complete`, `brand`, and validation errors through change events, and refuse tokenization until
+  all required split or combined values are valid. It also provides
   `confirmPayment`, `confirmSetup`, `confirmCardPayment`, `confirmCardSetup`,
   `retrievePaymentIntent`, `retrieveSetupIntent`, `createPaymentMethod`, `handleCardAction`. It calls
   `POST /v1/{payment,setup}_intents/:id/confirm` with the publishable key and `client_secret` (the

package/dist/{chunk-IWIBLNQX.js → chunk-4G5L7P7I.js}

@@ -4,7 +4,7 @@ import {
   parseDuration,
   resolveAdminPrefix,
   validateAccounts
-} from "./chunk-LUKVBQDH.js";
+} from "./chunk-7ZVXTTT4.js";
 
 // src/server.ts
 import { readFileSync } from "node:fs";
@@ -874,4 +874,4 @@ export {
   createServer2 as createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-IWIBLNQX.js.map
+//# sourceMappingURL=chunk-4G5L7P7I.js.map

package/dist/{chunk-LUKVBQDH.js → chunk-7ZVXTTT4.js}

@@ -1028,7 +1028,40 @@ var decodeBody = (contentType, bytes) => {
   return { kind: "bytes", value: bytes };
 };
 var readBody = async (message) => {
-  const bytes = new Uint8Array(await message.arrayBuffer());
+  if (!(message instanceof Request) || !message.body) {
+    if (message instanceof Request)
+      message.signal.throwIfAborted();
+    return decodeBody(message.headers.get("content-type"), new Uint8Array(await message.arrayBuffer()));
+  }
+  message.signal.throwIfAborted();
+  const reader = message.body.getReader();
+  const cancel = () => {
+    void reader.cancel(message.signal.reason).catch(() => {
+    });
+  };
+  message.signal.addEventListener("abort", cancel, { once: true });
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      message.signal.throwIfAborted();
+      const { done, value } = await reader.read();
+      message.signal.throwIfAborted();
+      if (done)
+        break;
+      chunks.push(value);
+      size += value.byteLength;
+    }
+  } finally {
+    message.signal.removeEventListener("abort", cancel);
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
   return decodeBody(message.headers.get("content-type"), bytes);
 };
 
@@ -1743,7 +1776,42 @@ var verifyOperations = (document2, handlers) => {
   }
   return problems;
 };
-var honoPath = (template) => template.replace(/\{([^}]+)\}/g, ":$1");
+var escapePattern = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var serviceRoute = (template) => {
+  const names = [];
+  let pattern = "", end = 0;
+  for (const match of template.matchAll(/\{([^}]+)\}/g)) {
+    pattern += `${escapePattern(template.slice(end, match.index))}([^/]+?)`;
+    const name = match[1];
+    if (!name)
+      throw new Error(`Invalid OpenAPI route template: ${template}`);
+    names.push(name);
+    end = match.index + match[0].length;
+  }
+  pattern += escapePattern(template.slice(end));
+  const matcher = new RegExp(`^${pattern}$`);
+  const path = template.split("/").map((segment, index) => {
+    if (!segment.includes("{"))
+      return segment;
+    const literal = /^\{([^}]+)\}$/.exec(segment);
+    if (literal)
+      return `:${literal[1]}`;
+    let expression = "", offset = 0;
+    for (const match of segment.matchAll(/\{[^}]+\}/g)) {
+      expression += `${escapePattern(segment.slice(offset, match.index))}[^/]+?`;
+      offset = match.index + match[0].length;
+    }
+    expression += escapePattern(segment.slice(offset));
+    return `:mockingbirdSegment${index}{${expression}}`;
+  }).join("/");
+  return {
+    path,
+    params: (pathname) => {
+      const values = matcher.exec(pathname);
+      return Object.fromEntries(names.map((name, index) => [name, decodeURIComponent(values?.[index + 1] ?? "")]));
+    }
+  };
+};
 var routeOrder = (a, b) => {
   const sa = a.path.split("/");
   const sb = b.path.split("/");
@@ -1778,6 +1846,7 @@ var createService = (options) => {
   for (const operation of operations) {
     const metadata = operationMetadata(operation.operation);
     const handler = options.handlers[operation.operationId];
+    const registeredRoute = serviceRoute(operation.path);
     const route = async (c) => {
       const request = c.req.raw;
       if (!metadata.supported || !handler) {
@@ -1787,7 +1856,7 @@ var createService = (options) => {
       const context = {
         request,
         url,
-        params: c.req.param(),
+        params: registeredRoute.params(url.pathname),
         query: queryOf(url),
         body: await readBody(request),
         sqlite: options.sqlite,
@@ -1799,7 +1868,7 @@ var createService = (options) => {
       const short = await options.before?.(context);
       return withIssues(request, short ?? await handler(context));
     };
-    app.on(operation.method.toUpperCase(), honoPath(operation.path), route);
+    app.on(operation.method.toUpperCase(), registeredRoute.path, route);
   }
   return {
     app,
@@ -2268,7 +2337,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "2.1.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "2.2.1" : UNRELEASED_VERSION;
 
 // ../core/dist/signing.js
 var encoder = new TextEncoder();
@@ -11748,9 +11817,120 @@ var stripeJs = (base2) => `/* Mockingbird Stripe.js stand-in */
     ["cvc", "CVC", "stripe-mock-cvc", "123"],
     ["zip", "ZIP", "stripe-mock-zip", "94107"],
   ];
-  function Element(type, options) {
+  function fieldsFor(type, options) {
+    var names = type === "cardNumber" ? ["card"]
+      : type === "cardExpiry" ? ["exp"]
+      : type === "cardCvc" ? ["cvc"]
+      : type === "postalCode" ? ["zip"]
+      : FIELDS.map(function (field) { return field[0]; });
+    if (type === "card" && options && options.hidePostalCode) {
+      names = names.filter(function (name) { return name !== "zip"; });
+    }
+    return FIELDS.filter(function (field) { return names.indexOf(field[0]) !== -1; });
+  }
+  function digits(value) { return String(value || "").replace(/\\D/g, ""); }
+  function brandOf(value) {
+    var number = digits(value);
+    if (/^3[47]/.test(number)) return "amex";
+    if (/^(5[1-5]|2[2-7])/.test(number)) return "mastercard";
+    if (/^(6011|65)/.test(number)) return "discover";
+    if (/^4/.test(number)) return "visa";
+    return "unknown";
+  }
+  function luhn(number) {
+    var sum = 0;
+    var alternate = false;
+    for (var index = number.length - 1; index >= 0; index -= 1) {
+      var digit = Number(number[index]);
+      if (alternate) { digit *= 2; if (digit > 9) digit -= 9; }
+      sum += digit;
+      alternate = !alternate;
+    }
+    return number.length > 0 && sum % 10 === 0;
+  }
+  function cardError(code, message) {
+    return { type: "validation_error", code: code, message: message };
+  }
+  function validateField(element, name) {
+    var raw = element.value(name);
+    if (name === "card") {
+      var number = digits(raw);
+      var brand = brandOf(number);
+      var expected = brand === "amex" ? 15 : 16;
+      if (!number || number.length < expected) return cardError("incomplete_number", "Your card number is incomplete.");
+      if (number.length !== expected || !luhn(number)) return cardError("invalid_number", "Your card number is invalid.");
+    }
+    if (name === "exp") {
+      var expiry = digits(raw);
+      if (expiry.length < 4) return cardError("incomplete_expiry", "Your card's expiration date is incomplete.");
+      var month = Number(expiry.slice(0, 2));
+      var year = 2000 + Number(expiry.slice(2, 4));
+      if (month < 1 || month > 12) return cardError("invalid_expiry_month", "Your card's expiration month is invalid.");
+      var now = new Date();
+      if (year < now.getFullYear() || (year === now.getFullYear() && month < now.getMonth() + 1)) {
+        return cardError("invalid_expiry_year_past", "Your card's expiration year is in the past.");
+      }
+    }
+    if (name === "cvc") {
+      var cvc = digits(raw);
+      var cvcLength = brandOf(element.value("card")) === "amex" ? 4 : 3;
+      if (cvc.length < cvcLength) return cardError("incomplete_cvc", "Your card's security code is incomplete.");
+      if (cvc.length !== cvcLength) return cardError("invalid_cvc", "Your card's security code is invalid.");
+    }
+    if (name === "zip" && !String(raw || "").trim()) {
+      return cardError("incomplete_zip", "Your postal code is incomplete.");
+    }
+    return null;
+  }
+  function stateOf(element) {
+    var fields = fieldsFor(element.type, element.options);
+    var empty = fields.every(function (field) { return String(element.value(field[0]) || "") === ""; });
+    var error = null;
+    for (var index = 0; index < fields.length && !error; index += 1) error = validateField(element, fields[index][0]);
+    var event = { complete: !error, empty: empty, elementType: element.type };
+    if (error) event.error = error;
+    if (element.type === "card" || element.type === "cardNumber") event.brand = brandOf(element.value("card"));
+    return event;
+  }
+  function cardValidationOf(element) {
+    var card = element.card();
+    var values = {
+      card: card.number,
+      exp: String(card.exp_month || "").padStart(2, "0") + "/" + String(card.exp_year || "").slice(-2),
+      cvc: card.cvc,
+    };
+    var cardView = { value: function (name) { return values[name] || ""; } };
+    var names = ["card", "exp", "cvc"];
+    for (var index = 0; index < names.length; index += 1) {
+      var error = validateField(cardView, names[index]);
+      if (error) return error;
+    }
+    return null;
+  }
+  function formatInput(element, input) {
+    if (input.name === "card") {
+      var number = digits(input.value).slice(0, 19);
+      var brand = brandOf(number);
+      var sizes = brand === "amex" ? [4, 6, 5] : [4, 4, 4, 4, 3];
+      var groups = [];
+      var offset = 0;
+      sizes.forEach(function (size) {
+        if (offset < number.length) groups.push(number.slice(offset, offset + size));
+        offset += size;
+      });
+      input.value = groups.join(" ");
+    } else if (input.name === "exp") {
+      var expiry = digits(input.value).slice(0, 4);
+      input.value = expiry.length > 2 ? expiry.slice(0, 2) + "/" + expiry.slice(2) : expiry;
+    } else if (input.name === "cvc") {
+      var limit = brandOf(element.value("card")) === "amex" ? 4 : 3;
+      input.value = digits(input.value).slice(0, limit);
+    }
+  }
+  function Element(type, options, group) {
     this.type = type;
     this.options = options || {};
+    this.group = group;
     this.node = null;
     this.handlers = {};
   }
@@ -11760,45 +11940,63 @@ var stripeJs = (base2) => `/* Mockingbird Stripe.js stand-in */
     var root = document.createElement("div");
     root.setAttribute("data-testid", "stripe-mock-element");
     root.setAttribute("data-element-type", this.type);
-    FIELDS.forEach(function (field) {
-      var label = document.createElement("label");
-      label.textContent = field[1];
+    var split = this.type === "cardNumber" || this.type === "cardExpiry" || this.type === "cardCvc" || this.type === "postalCode";
+    var self = this;
+    fieldsFor(this.type, this.options).forEach(function (field) {
       var input = document.createElement("input");
       input.name = field[0];
       input.setAttribute("data-testid", field[2]);
+      input.setAttribute("aria-label", field[1]);
       input.placeholder = field[3];
-      label.appendChild(input);
-      root.appendChild(label);
+      input.addEventListener("input", function () {
+        formatInput(self, input);
+        self.emit("change", stateOf(self));
+      });
+      input.addEventListener("focus", function () { self.emit("focus", { elementType: self.type }); });
+      input.addEventListener("blur", function () { self.emit("blur", { elementType: self.type }); });
+      if (split) {
+        root.appendChild(input);
+      } else {
+        var label = document.createElement("label");
+        label.textContent = field[1];
+        label.appendChild(input);
+        root.appendChild(label);
+      }
     });
     host.appendChild(root);
     this.node = root;
-    var self = this;
-    root.addEventListener("input", function () { self.emit("change", { complete: true, empty: false, elementType: self.type }); });
     setTimeout(function () { self.emit("ready", { elementType: self.type }); }, 0);
     return this;
   };
   Element.prototype.value = function (name) {
     var input = this.node && this.node.querySelector('[name="' + name + '"]');
-    return input ? input.value : "";
+    if (input) return input.value;
+    for (var index = 0; index < this.group.length; index += 1) {
+      var sibling = this.group[index];
+      var siblingInput = sibling !== this && sibling.node && sibling.node.querySelector('[name="' + name + '"]');
+      if (siblingInput) return siblingInput.value;
+    }
+    return "";
   };
   Element.prototype.card = function () {
-    var exp = (this.value("exp") || "12/34").split("/");
-    var year = Number(exp[1] || "34");
+    var exp = String(this.value("exp") || "").split("/");
+    var year = Number(exp[1] || "0");
     return {
-      number: (this.value("card") || "4242424242424242").replace(/\\s+/g, ""),
-      exp_month: Number(exp[0] || "12"),
+      number: digits(this.value("card")),
+      exp_month: Number(exp[0] || "0"),
       exp_year: year < 100 ? 2000 + year : year,
-      cvc: this.value("cvc") || "123",
+      cvc: digits(this.value("cvc")),
     };
   };
+  Element.prototype.validation = function () { return stateOf(this); };
   Element.prototype.on = function (name, handler) { (this.handlers[name] = this.handlers[name] || []).push(handler); return this; };
   Element.prototype.off = function (name, handler) { this.handlers[name] = (this.handlers[name] || []).filter(function (h) { return h !== handler; }); return this; };
   Element.prototype.once = function (name, handler) { var self = this; var wrapped = function (e) { self.off(name, wrapped); handler(e); }; return this.on(name, wrapped); };
   Element.prototype.emit = function (name, event) { (this.handlers[name] || []).forEach(function (h) { h(event); }); };
-  Element.prototype.update = function (options) { this.options = Object.assign(this.options, options || {}); };
+  Element.prototype.update = function (options) { this.options = Object.assign(this.options, options || {}); if (this.node) this.emit("change", stateOf(this)); };
   Element.prototype.focus = function () { var input = this.node && this.node.querySelector("input"); if (input) input.focus(); };
-  Element.prototype.blur = function () {};
-  Element.prototype.clear = function () { if (this.node) this.node.querySelectorAll("input").forEach(function (i) { i.value = ""; }); };
+  Element.prototype.blur = function () { var input = this.node && this.node.querySelector("input"); if (input && input.blur) input.blur(); };
+  Element.prototype.clear = function () { if (this.node) this.node.querySelectorAll("input").forEach(function (i) { i.value = ""; }); this.emit("change", stateOf(this)); };
   Element.prototype.collapse = function () {};
   Element.prototype.unmount = function () { if (this.node && this.node.parentNode) this.node.parentNode.removeChild(this.node); this.node = null; };
   Element.prototype.destroy = Element.prototype.unmount;
@@ -11814,7 +12012,7 @@ var stripeJs = (base2) => `/* Mockingbird Stripe.js stand-in */
     return {
       _clientSecret: clientSecret,
       _elements: created,
-      create: function (type, opts) { var element = new Element(type, opts); created.push(element); return element; },
+      create: function (type, opts) { var element = new Element(type, opts, created); created.push(element); return element; },
       getElement: function (type) {
         var elementType = type && type.__elementType ? type.__elementType : type;
         return created.filter(function (e) { return e.type === elementType || (e.type === "payment" && type && type.type === "payment"); })[0] || null;
@@ -11845,6 +12043,13 @@ var stripeJs = (base2) => `/* Mockingbird Stripe.js stand-in */
     "4000051230000072": "tok_hsa",
   };
   Stripe.prototype.createToken = function (element) {
+    var validation = element && typeof element.validation === "function" ? cardValidationOf(element) : null;
+    if (validation) {
+      return Promise.resolve({ error: validation });
+    }
+    if (!element) {
+      return Promise.resolve({ error: cardError("incomplete_number", "Your card number is incomplete.") });
+    }
     var card = element && typeof element.card === "function" ? element.card() : null;
     var number = card && String(card.number || "").replace(/[\\s-]/g, "");
     var token = number && CARD_TOKENS[number];
@@ -13358,6 +13563,7 @@ var paymentMethodHandlers = (services) => ({
       render: renderPaymentMethod
     });
     const account = stringOf(params, "customer_account");
+    if (context.query.customer_account === "") throw parameterInvalidEmpty("customer_account");
     if (account !== null && account !== "")
       throw resourceMissing("customer", account, "customer_account", 400);
     return jsonRes(200, page);
@@ -18950,4 +19156,4 @@ export {
   createRuntime2 as createRuntime,
   StripeAPI
 };
-//# sourceMappingURL=chunk-LUKVBQDH.js.map
+//# sourceMappingURL=chunk-7ZVXTTT4.js.map