@crvouga/mockingbird-service-stripe 3.4.0 → 3.6.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog — @crvouga/mockingbird-service-stripe
 
+## 3.6.0 (2026-10-17)
+
+### Features
+
+- resolve fleet and emulator issue batch ([26d2f8c](https://github.com/crvouga/mockingbird/commit/26d2f8cee99fefed93192204bac44fb1be35c1da))
+
+## 3.5.0 (2026-10-15)
+
+### Features
+
+- resolve SQL, routing and writer gaps ([73f97d0](https://github.com/crvouga/mockingbird/commit/73f97d0d2379f44b9131180498f4fab76648fed9))
+
 ## 3.4.0 (2026-10-15)
 
 ### Features

package/dist/{chunk-VV2ZADSQ.js → chunk-53CRCMWH.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-EUF2MBTV.js";
 import {
   listen
-} from "./chunk-XEIHQZPI.js";
+} from "./chunk-Q3J6JUZM.js";
 
 // src/server.ts
 import { readFileSync } from "node:fs";
@@ -87,4 +87,4 @@ export {
   createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-VV2ZADSQ.js.map
+//# sourceMappingURL=chunk-53CRCMWH.js.map

package/dist/{chunk-XEIHQZPI.js → chunk-Q3J6JUZM.js}

@@ -12,6 +12,38 @@ import {
 
 // ../../adapters/node/dist/fleet-archive.js
 import { createHash } from "node:crypto";
+function validateCompatibilityTags(tags) {
+  if (!tags || typeof tags !== "object" || Array.isArray(tags))
+    throw new Error("invalid archive compatibility tags");
+  const entries = Object.entries(tags);
+  if (entries.length > 32 || entries.some(([key, value]) => !/^[A-Za-z0-9_.-]{1,64}$/.test(key) || typeof value !== "string" || value.length < 1 || value.length > 256 || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)))
+    throw new Error("invalid archive compatibility tags");
+}
+function assertCompatibilityTags(tags, policy) {
+  if (tags !== void 0)
+    validateCompatibilityTags(tags);
+  if (!policy)
+    return;
+  validateCompatibilityTags(policy.tags);
+  if (policy.missing !== void 0 && !["allow", "reject"].includes(policy.missing))
+    throw new Error("invalid missing compatibility policy");
+  if (tags === void 0 && policy.missing === "allow")
+    return;
+  if (canonical(tags) !== canonical(policy.tags))
+    throw new Error("application archive compatibility mismatch");
+}
+function assertArchiveCompatibility(input, policy) {
+  const archive = validateArchive(input);
+  assertCompatibilityTags(archive.compatibility, policy);
+  return archive;
+}
+async function migrateApplicationArchive(input, migration) {
+  const source = assertArchiveCompatibility(input, migration.from);
+  validateCompatibilityTags(migration.to);
+  const transformed = await migration.transform(structuredClone(source));
+  const { sha256: _sha, ...content } = transformed;
+  return validateArchive(sealArchive({ ...content, compatibility: structuredClone(migration.to) }));
+}
 var canonical = (value) => {
   if (Array.isArray(value))
     return `[${value.map(canonical).join(",")}]`;
@@ -31,6 +63,8 @@ function validateArchive(value) {
   const { sha256, ...content } = doc;
   if (doc.format !== "mockingbird.fleet/v1" || typeof doc.sourceId !== "string" || typeof doc.createdAt !== "string" || !doc.namespaces || typeof doc.namespaces !== "object" || Array.isArray(doc.namespaces) || sha256 !== digest(content))
     throw new Error("unsupported or corrupt fleet archive");
+  if (doc.compatibility !== void 0)
+    validateCompatibilityTags(doc.compatibility);
   for (const [namespace, entry] of Object.entries(doc.namespaces)) {
     if (!/^[A-Za-z0-9_.-]{1,64}$/.test(namespace) || !entry || !Number.isFinite(entry.clock?.now) || typeof entry.clock?.frozen !== "boolean" || !entry.services || !Object.keys(entry.services).length)
       throw new Error("invalid archive namespace");
@@ -46,6 +80,7 @@ function inspectArchive(input) {
     format: archive.format,
     createdAt: archive.createdAt,
     sha256: archive.sha256,
+    ...archive.compatibility ? { compatibility: archive.compatibility } : {},
     namespaces: Object.fromEntries(Object.entries(archive.namespaces).map(([name, ns]) => [
       name,
       {
@@ -746,9 +781,9 @@ var RepositoryWriter = class {
     if (!owner || !Number.isSafeInteger(ttlMs) || ttlMs < 1)
       throw new Error("owner and positive lease duration required");
     const current = await this.control.read();
-    if (current && current.value.lease.expiresAt > this.now())
+    if (current && !current.value.released && current.value.lease.expiresAt > this.now())
       throw new Error("repository writer already owned");
-    if (current && !takeoverExpired)
+    if (current && !current.value.released && !takeoverExpired)
       throw new Error("expired writer requires explicit takeover policy");
     const lease = {
       owner,
@@ -764,8 +799,26 @@ var RepositoryWriter = class {
     return lease;
   }
   valid(state, lease) {
-    if (!state || state.lease.id !== lease.id || state.lease.generation !== lease.generation || state.lease.owner !== lease.owner || state.lease.expiresAt <= this.now())
+    if (!state || state.released || state.lease.id !== lease.id || state.lease.generation !== lease.generation || state.lease.owner !== lease.owner || state.lease.expiresAt <= this.now())
+      throw new Error("stale or expired repository writer");
+  }
+  /** Release after draining workloads and awaiting the final verified publish.
+   * A failed/uncertain storage operation throws; retry with the same lease to
+   * discover whether it completed. Never clears the verified recovery pointer.
+   */
+  async release(lease) {
+    const current = await this.control.read();
+    if (!current)
       throw new Error("stale or expired repository writer");
+    if (current.value.released && current.value.lease.id === lease.id && current.value.lease.generation === lease.generation && current.value.lease.owner === lease.owner)
+      return "already-released";
+    this.valid(current.value, lease);
+    if (!await this.control.compareAndSwap(current.revision, {
+      ...current.value,
+      released: true
+    }))
+      throw new Error("writer release conflict");
+    return "released";
   }
   async renew(lease, ttlMs) {
     if (!Number.isSafeInteger(ttlMs) || ttlMs < 1)
@@ -1262,11 +1315,28 @@ var ingressSupport = {
     streaming: true,
     signing: "vendor request signing is not used; webhook signatures remain payload based"
   },
+  cognito: {
+    publicOrigin: true,
+    pathPrefix: true,
+    namespaces: "path-or-header",
+    streaming: true,
+    signing: "JWT issuer and JWKS use the configured public namespace; SigV4 verification is not modelled"
+  },
+  medplum: {
+    publicOrigin: true,
+    pathPrefix: true,
+    namespaces: "path-or-header",
+    streaming: true,
+    signing: "FHIR, OAuth and storage URLs use the configured public namespace"
+  },
   other: {
     publicOrigin: false,
     reason: "host/path-sensitive signing and hosted URL rewriting are not certified; use a direct endpoint"
   }
 };
+function supportsPublicIngress(service) {
+  return service === "stripe" || service === "cognito" || service === "medplum";
+}
 function advertisedHttpBase(entry) {
   if (entry.publicPath !== void 0 && !entry.publicOrigin)
     throw new Error("publicPath requires publicOrigin");
@@ -1285,7 +1355,7 @@ function createFleetIngress(config, manifest, transport = fetch) {
     const base = advertisedHttpBase(entry);
     if (!base)
       return [];
-    if ((entry.target ?? service) !== "stripe")
+    if (!supportsPublicIngress(entry.target ?? service))
       throw new Error(`public ingress unsupported for ${entry.target ?? service}; host/path-sensitive signatures require a direct endpoint`);
     const privateEndpoint = manifest.services[service];
     if (!privateEndpoint || entry.protocol && entry.protocol !== "http")
@@ -1309,6 +1379,8 @@ function createFleetIngress(config, manifest, transport = fetch) {
     const route = routes.find((r) => url.origin === r.origin && (url.pathname === r.prefix || url.pathname.startsWith(`${r.prefix}/`)));
     if (!route)
       return new Response("public ingress route not found", { status: 404 });
+    if ((route.entry.target ?? route.service) === "cognito" && request.headers.get("authorization")?.startsWith("AWS4-HMAC-SHA256"))
+      return new Response("SigV4 requests require a direct endpoint", { status: 403 });
     const path = url.pathname.slice(route.prefix.length) || "/";
     const adminPrefix = route.entry.adminPrefix ?? config.adminPrefix ?? "/__admin";
     if ((path === adminPrefix || path.startsWith(`${adminPrefix}/`)) && !path.startsWith(`${adminPrefix}/ns/`))
@@ -2329,7 +2401,7 @@ data: ${JSON.stringify(data)}
         {
           protocol: c.protocol,
           coverage: c.coverage,
-          ingress: c.targetName === "stripe" ? ingressSupport.stripe : ingressSupport.other,
+          ingress: supportsPublicIngress(c.targetName ?? "") ? ingressSupport[c.targetName] : ingressSupport.other,
           target: c.targetName,
           outboundPolicy: c.outboundPolicy ?? "unsupported",
           version: 1,
@@ -3413,11 +3485,12 @@ data: ${JSON.stringify(data)}
       format: "mockingbird.fleet/v1",
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       sourceId: this.ctx.id,
+      ...this.ctx.options.archiveCompatibility ? { compatibility: structuredClone(this.ctx.options.archiveCompatibility.tags) } : {},
       namespaces: contents
     });
   }
   async restoreArchive(input, selectedNamespace) {
-    const archive = validateArchive(input);
+    const archive = assertArchiveCompatibility(input, this.ctx.options.archiveCompatibility);
     const entries = Object.entries(archive.namespaces).filter(([ns]) => selectedNamespace === void 0 || ns === selectedNamespace);
     if (!entries.length)
       throw new Error("selected namespace absent from archive");
@@ -3701,7 +3774,7 @@ async function preflightFleet(config, options) {
       if (entry.target !== void 0 && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(entry.target))
         throw new Error("target must name a supported service suffix");
       const service = entry.target ?? name;
-      if (advertisedHttpBase(entry) && service !== "stripe")
+      if (advertisedHttpBase(entry) && !supportsPublicIngress(service))
         throw new Error(`public ingress unsupported for ${service}; use a direct endpoint to preserve signed targets`);
       const target = await options.load(service);
       const protocol = "protocol" in target ? target.protocol : "http";
@@ -3752,7 +3825,7 @@ async function preflightFleet(config, options) {
             break;
         }
       }
-      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.4.0" });
+      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.6.0" });
     } catch (error) {
       throw new Error(`service ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -3796,6 +3869,11 @@ async function preflightFleet(config, options) {
   return ordered;
 }
 function validateFleetPolicies(options) {
+  if (options.archiveCompatibility) {
+    validateCompatibilityTags(options.archiveCompatibility.tags);
+    if (options.archiveCompatibility.missing !== void 0 && !["allow", "reject"].includes(options.archiveCompatibility.missing))
+      throw new Error("archiveCompatibility.missing must be allow or reject");
+  }
   if (options.journal && !options.repository)
     throw new Error("durable operation journal requires an archive repository");
   if (options.cors) {
@@ -4627,6 +4705,40 @@ async function startFleet(config, options) {
   }
 }
 
+// ../../adapters/node/dist/fleet-loader.js
+import { createRequire as createRequire2 } from "node:module";
+import { resolve as resolve2 } from "node:path";
+import { pathToFileURL } from "node:url";
+var suffix = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function createInstalledServiceLoader(options) {
+  if (!options.projectRoot)
+    throw new Error("consumer projectRoot required");
+  const allowed = new Set(options.services);
+  for (const name of allowed)
+    if (!suffix.test(name))
+      throw new Error("invalid service suffix");
+  const require2 = createRequire2(resolve2(options.projectRoot, "package.json"));
+  const targets = new Map((options.targets ?? []).map((target) => [target.name, target]));
+  return async (name) => {
+    if (!suffix.test(name) || !allowed.has(name))
+      throw new Error("service is not declared in loader allowlist");
+    const own = targets.get(name);
+    if (own)
+      return own;
+    const specifier = `@crvouga/mockingbird-service-${name}/server`;
+    let location;
+    try {
+      location = require2.resolve(specifier);
+    } catch {
+      throw new Error(`cannot load service "${name}": install @crvouga/mockingbird-service-${name} in the consumer project; its /server export is required`);
+    }
+    const mod = await import(pathToFileURL(location).href);
+    if (!mod.serveTarget || mod.serveTarget.name !== name || ("protocol" in mod.serveTarget ? typeof mod.serveTarget.start !== "function" : typeof mod.serveTarget.create !== "function"))
+      throw new Error(`${specifier} exports no matching serveTarget`);
+    return mod.serveTarget;
+  };
+}
+
 // ../../adapters/node/dist/fleet-client.js
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { chmod as chmod2, readFile as readFile5, rename as rename4, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
@@ -4639,6 +4751,14 @@ var FleetClientError = class extends Error {
     this.details = details;
   }
 };
+var FleetClientResponseError = class extends FleetClientError {
+  code;
+  constructor(code, status, origin) {
+    super(status, { code, body: "omitted", ...origin ? { origin } : {} });
+    this.code = code;
+    this.name = "FleetClientResponseError";
+  }
+};
 var FleetClient = class {
   base;
   options;
@@ -4651,7 +4771,14 @@ var FleetClient = class {
     if (url.username || url.password)
       throw new Error("fleet client URL must not contain credentials");
     url.searchParams.set("namespace", options.namespace ?? this.options.namespace ?? "default");
+    const limit = options.maxResponseBytes ?? this.options.maxResponseBytes ?? 64 * 1024 * 1024;
+    if (!Number.isSafeInteger(limit) || limit < 1)
+      throw new Error("invalid response byte limit");
+    const deadline = AbortSignal.timeout(this.options.timeoutMs ?? 3e4);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    signal.throwIfAborted();
     const response = await (this.options.fetch ?? fetch)(url, {
+      redirect: "manual",
       method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
       headers: {
         "content-type": "application/json",
@@ -4659,11 +4786,71 @@ var FleetClient = class {
         ...options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}
       },
       ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
-      signal: options.signal ?? AbortSignal.timeout(this.options.timeoutMs ?? 3e4)
+      signal
     });
-    const data = await response.json();
-    if (!response.ok)
-      throw new FleetClientError(response.status, data);
+    if (response.status >= 300 && response.status < 400) {
+      await response.body?.cancel();
+      throw new FleetClientResponseError("redirect", response.status, url.origin);
+    }
+    if (Number(response.headers.get("content-length")) > limit) {
+      await response.body?.cancel();
+      throw new FleetClientResponseError("response_too_large", response.status);
+    }
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    const abort = () => {
+      void reader?.cancel(signal.reason).catch(() => {
+      });
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    try {
+      if (reader)
+        while (true) {
+          signal.throwIfAborted();
+          const { done, value } = await reader.read();
+          signal.throwIfAborted();
+          if (done)
+            break;
+          size += value.byteLength;
+          if (size > limit) {
+            await reader.cancel();
+            throw new FleetClientResponseError("response_too_large", response.status);
+          }
+          chunks.push(value);
+        }
+    } finally {
+      signal.removeEventListener("abort", abort);
+      if (signal.aborted)
+        await reader?.cancel(signal.reason).catch(() => {
+        });
+      reader?.releaseLock();
+    }
+    const bytes2 = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes2.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const text = new TextDecoder().decode(bytes2);
+    let data;
+    try {
+      data = text.length ? JSON.parse(text) : void 0;
+    } catch {
+      if (response.ok)
+        throw new FleetClientResponseError("invalid_json", response.status);
+    }
+    if (!response.ok) {
+      const error = data && typeof data === "object" ? data.error : void 0;
+      const detail = { body: "omitted" };
+      if (error && typeof error === "object")
+        for (const key of ["type", "code"]) {
+          const value = error[key];
+          if (typeof value === "string" && /^[A-Za-z0-9_.-]{1,128}$/.test(value))
+            detail[key] = value;
+        }
+      throw new FleetClientError(response.status, detail);
+    }
     return data;
   }
   discover() {
@@ -4729,17 +4916,52 @@ function renderConnections(manifest, privateManifest, namespace, mapping) {
     const child = manifest.services[entry.service], secret = privateManifest.services[entry.service];
     if (!child || !secret)
       throw new Error(`missing service mapping ${entry.service}`);
+    let endpoint;
     if (child.protocol === "http") {
       const template = child.namespaces.path;
       if (typeof template !== "string")
         throw new Error(`missing HTTP namespace mapping ${entry.service}`);
-      result[variable] = new URL(template.replace("{name}", encodeURIComponent(namespace)), secret.url).href;
+      endpoint = new URL(template.replace("{name}", encodeURIComponent(namespace)), secret.url).href;
     } else {
-      const endpoint = secret.namespaces?.[namespace];
-      if (!endpoint)
+      const selected = secret.namespaces?.[namespace];
+      if (!selected)
         throw new Error(`missing namespace mapping ${namespace}/${entry.service}`);
-      result[variable] = endpoint;
+      endpoint = selected;
+    }
+    const url = new URL(endpoint);
+    const field = entry.field ?? "url";
+    let value;
+    switch (field) {
+      case "url":
+        value = endpoint;
+        break;
+      case "hostname":
+        value = url.hostname.replace(/^\[|\]$/g, "");
+        break;
+      case "port":
+        value = url.port;
+        break;
+      case "username":
+        value = decodeURIComponent(url.username);
+        break;
+      case "password":
+        value = decodeURIComponent(url.password);
+        break;
+      case "pathname":
+        value = decodeURIComponent(url.pathname);
+        break;
+      case "database":
+        value = decodeURIComponent(url.pathname.replace(/^\//, ""));
+        break;
+      default:
+        throw new Error("unsupported connection field");
     }
+    if (!value) {
+      if (typeof entry.fallback !== "string")
+        throw new Error(`missing connection component ${field}`);
+      value = entry.fallback;
+    }
+    result[variable] = value;
   }
   return result;
 }
@@ -4759,14 +4981,14 @@ async function writeConnections(path, values, format = "json") {
 
 // ../../adapters/node/dist/fleet-tools.js
 import { readFile as readFile6 } from "node:fs/promises";
-import { createRequire as createRequire2 } from "node:module";
-import { resolve as resolve2 } from "node:path";
+import { createRequire as createRequire3 } from "node:module";
+import { resolve as resolve3 } from "node:path";
 async function doctorFleet(config, options, probes = []) {
   const findings = [];
   const plan = [];
   try {
     const targets = await preflightFleet(config, options);
-    const require2 = createRequire2(resolve2(process.cwd(), "package.json"));
+    const require2 = createRequire3(resolve3(process.cwd(), "package.json"));
     for (const [service, target] of targets) {
       let version = "development";
       try {
@@ -4821,7 +5043,7 @@ async function doctorFleet(config, options, probes = []) {
   };
 }
 async function rehearseFleet(config, options, input, probes = [], timeoutMs = 3e4) {
-  const archive = validateArchive(input);
+  const archive = assertArchiveCompatibility(input, options.archiveCompatibility);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const isolated = {
     ...config,
@@ -4833,7 +5055,7 @@ async function rehearseFleet(config, options, input, probes = [], timeoutMs = 3e
   };
   let fleet;
   try {
-    fleet = await startFleet(isolated, { load: options.load });
+    fleet = await startFleet(isolated, options);
     const client = new FleetClient(fleet.manifest.adminBase, {
       ...config.adminKey ? { adminKey: config.adminKey } : {}
     });
@@ -4972,9 +5194,6 @@ function fleetCommands(load) {
 
 // ../../adapters/node/dist/cli.js
 import { readFile as readFile7 } from "node:fs/promises";
-import { createRequire as createRequire3 } from "node:module";
-import { resolve as resolve3 } from "node:path";
-import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 var optionHelp = (options) => Object.entries(options).map(([name, option]) => {
   const flag = `--${name}${option.type === "string" ? ` ${option.value ?? "<value>"}` : ""}`;
@@ -5213,26 +5432,7 @@ var resolveServeControls = async (values, env = process.env, base) => {
   normalizeBootControls(document, "adminControls");
   return document;
 };
-var loadTarget = async (name, own) => {
-  if (name === own.name)
-    return own;
-  const specifier = `@crvouga/mockingbird-service-${name}/server`;
-  try {
-    let mod;
-    try {
-      mod = await import(specifier);
-    } catch {
-      const fromProject = createRequire3(resolve3(process.cwd(), "package.json"));
-      mod = await import(pathToFileURL(fromProject.resolve(specifier)).href);
-    }
-    if (!mod.serveTarget)
-      throw new Error(`${specifier} exports no serveTarget`);
-    return mod.serveTarget;
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(`cannot load service "${name}": ${reason}. Install @crvouga/mockingbird-service-${name}.`);
-  }
-};
+var loadTarget = (name, own) => createInstalledServiceLoader({ projectRoot: process.cwd(), services: [name], targets: [own] })(name);
 var start = async (target, values, config) => {
   const adminPrefix = resolveAdminPrefix(config.adminPrefix);
   const runtime = await target.create(values, {
@@ -5882,9 +6082,14 @@ var sourceArchive = (input) => {
     throw new Error("corrupt migration source");
   return structuredClone(source);
 };
-function archiveCompatibility(input, registry) {
+function archiveCompatibility(input, registry, policy) {
   const source = sourceArchive(input);
   const problems = [], steps = [];
+  try {
+    assertCompatibilityTags(source.compatibility, policy);
+  } catch (error) {
+    problems.push(error instanceof Error ? error.message : "invalid application compatibility");
+  }
   if (source.format !== "mockingbird.fleet/v1" && !registry.sourceFormats.includes(source.format))
     problems.push(`unsupported source format ${source.format}`);
   for (const [namespace, ns] of Object.entries(source.namespaces))
@@ -5936,6 +6141,7 @@ async function migrateArchive(input, registry, parameters = {}) {
   const content = {
     format: "mockingbird.fleet/v1",
     sourceId: source.sourceId,
+    ...source.compatibility ? { compatibility: source.compatibility } : {},
     createdAt: source.createdAt,
     namespaces,
     migration: {
@@ -6302,6 +6508,8 @@ var NamespacePool = class {
 };
 
 export {
+  assertArchiveCompatibility,
+  migrateApplicationArchive,
   validateArchive,
   inspectArchive,
   diffArchives,
@@ -6327,7 +6535,9 @@ export {
   serve,
   listen,
   startFleet,
+  createInstalledServiceLoader,
   FleetClientError,
+  FleetClientResponseError,
   FleetClient,
   renderConnections,
   writeConnections,
@@ -6355,4 +6565,4 @@ export {
   withFleetRun,
   NamespacePool
 };
-//# sourceMappingURL=chunk-XEIHQZPI.js.map
+//# sourceMappingURL=chunk-Q3J6JUZM.js.map