@crvouga/mockingbird-service-stripe 3.5.0 → 3.7.0

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog — @crvouga/mockingbird-service-stripe
 
-## 3.5.0 (2026-10-16)
+## 3.7.0 (2026-10-19)
+
+### Features
+
+- resolve the agent-reported issue queue in one batch ([25c52b6](https://github.com/crvouga/mockingbird/commit/25c52b668a53ddb80b968419601a20abf33f956b))
+
+## 3.6.0 (2026-10-16)
+
+### Features
+
+- resolve fleet and emulator issue batch ([26d2f8c](https://github.com/crvouga/mockingbird/commit/26d2f8cee99fefed93192204bac44fb1be35c1da))
+
+## 3.5.0 (2026-10-15)
 
 ### Features
 

package/README.md

@@ -147,6 +147,17 @@ Every state change records an event in the account's log (`GET /v1/events`, filt
 - Delivery faults: presets `webhook_duplicate` (same event id twice — our receiver's in-flight
   dedupe answers 500), `webhook_reorder` (the next two swapped), `webhook_drop` (never delivered,
   still in `GET /v1/events` for the replay worker).
+- Payment holds, per customer and namespace, for delayed-payment flows:
+  `PUT /__admin/payment-holds/:customer {"webhooks"?: true, "lookups"?: true}` (both default on).
+  While `webhooks` is on, events whose `data.object.customer` is that customer are not delivered but
+  queued (the in-process `onWebhook` still sees them, and they are in `GET /v1/events`). While
+  `lookups` is on, secret-key `GET`s filtered by `?customer=` that customer, and the retrieve of a
+  PaymentIntent it owns, answer 503 `api_error`; publishable-key calls (Stripe.js) are unaffected.
+  `POST /__admin/payment-holds/:customer/release` ends the hold and delivers the queue oldest first,
+  each event signed with the `Stripe-Signature` timestamp it was held at (so a receiver's tolerance
+  check sees the age; retries are signed afresh). `DELETE` ends the hold and drops the queue.
+  `GET /__admin/payment-holds` lists holds with their queued event ids. A reset clears them; snapshots
+  do not include them.
 - Metadata is copied verbatim, so the PC route's quarantine rule (`metadata.intent ∈ {pc_order,
   kb_membership, shop_purchase, stripe_membership}` or `source=supplement` + `billingInvoiceId`)
   only fires for sessions that would trip it on Stripe.
@@ -344,7 +355,9 @@ hides objects younger than 60 s — search is consistent otherwise), `webhook_du
 {status, failure_reason}` (emits `refund.failed` / `refund.updated`), `POST /__admin/disputes
 {payment_intent|charge, reason?, amount?}` (emits `charge.dispute.created`),
 `POST /__admin/checkout/sessions/:id/complete|expire|async_payment_succeeded`,
-`POST /__admin/setup_intents/:id/succeed`, `GET /__admin/charges/:id`, `POST /__admin/tick`. The
+`POST /__admin/setup_intents/:id/succeed`, `GET /__admin/charges/:id`, `POST /__admin/tick`,
+`GET /__admin/payment-holds`, `PUT|DELETE /__admin/payment-holds/:customer`,
+`POST /__admin/payment-holds/:customer/release`. The
 standard ones (`/__admin/health`, reset, snapshots, clock, faults, metrics, `GET /__admin/requests`,
 credentials, webhooks) come from the shared runtime. The journal records operation, status and ids
 only — never bodies, card numbers or emails.
@@ -375,6 +388,7 @@ The filter composes with `active`, `coupon`, customer, created-time and paginati
 | `createRuntime` | `(options?) => StripeRuntime` — the emulator with the full contract. Options: `accounts`, `webhooks {endpoints, retryDelaysMs, fetch}`, `corpus`, `publicUrl`, `webhookApiVersion`, `lifecycle`, `tickMs`, `sqlite`, `clock`, `seed`, `adminKey`, `onLog`, `onWebhook`. The runtime adds `webhooks`, `accounts`, `tick()`, `stop()`. |
 | `StripeAPI` | Class; `new StripeAPI(options?)` implements `fetch(request)`. Members: `reset()`, `tick(force?)`, `webhookEvents(account?)`, `webhookDeliveryAttempts(account?)`, `apiWebhookEndpoints()`, `accountIds()`, `scopeFor(account)`, `importStateFrom(source)`, `accounts`, `app`, `sqlite`. |
 | `STRIPE_PRESETS` | The named fault presets above. |
+| `PaymentHolds` | Per-customer holds behind `/__admin/payment-holds` (`set`, `list`, `has`, `release`, `discard`, `clear`); `StripeAPI.holds` is the registry. |
 | `AccountDirectory` | Keys → accounts (`configure`, `accountFor`, `config`, `list`, `resolve`). |
 | `DEFAULT_WEBHOOK_API_VERSION` | `"2024-06-20"`. |
 | `accountOfKey` | `(key) => string` — the account id of an unconfigured key. |

package/dist/{chunk-EUF2MBTV.js → chunk-42WPENBP.js}

@@ -17,7 +17,7 @@ import {
   requestBaseUrl,
   resolveSchema,
   signers
-} from "./chunk-Z5GZOENC.js";
+} from "./chunk-BP7APLM4.js";
 
 // src/account.ts
 var accountOfKey = (key) => `acct_${opaqueToken(key, 8)}`;
@@ -10075,6 +10075,92 @@ var ledgerHandlers = (services) => ({
   }
 });
 
+// src/payment-holds.ts
+var customerOfEvent = (event) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(event.body);
+  } catch {
+    return void 0;
+  }
+  const object = parsed?.data?.object;
+  const customer = object?.customer;
+  if (typeof customer === "string") return customer;
+  const id = customer?.id;
+  return typeof id === "string" ? id : void 0;
+};
+var PaymentHolds = class {
+  holds = /* @__PURE__ */ new Map();
+  queue = [];
+  set(customer, hold) {
+    const next = { customer, ...hold };
+    this.holds.set(customer, next);
+    return next;
+  }
+  list() {
+    return [...this.holds.values()].map((hold) => ({
+      ...hold,
+      held: this.queue.filter((entry) => entry.customer === hold.customer).map((entry) => ({ id: entry.event.id, type: entry.event.type }))
+    }));
+  }
+  has(customer) {
+    return this.holds.has(customer);
+  }
+  /** Whether any hold exists, so the common case skips parsing event bodies. */
+  get active() {
+    return this.holds.size > 0;
+  }
+  /** The held customer an event belongs to, when its webhooks are held. */
+  webhookHold(event) {
+    if (!this.holds.size) return void 0;
+    const customer = customerOfEvent(event);
+    return customer !== void 0 && this.holds.get(customer)?.webhooks ? customer : void 0;
+  }
+  holdsLookups(customer) {
+    return customer !== null && customer !== void 0 && this.holds.get(customer)?.lookups === true;
+  }
+  enqueue(entry) {
+    this.queue.push(entry);
+  }
+  /** End the hold. The customer's queued events, oldest first, are returned to be delivered. */
+  release(customer) {
+    return this.take(customer);
+  }
+  /** End the hold and forget the queued events (they stay in `GET /v1/events`). */
+  discard(customer) {
+    return this.take(customer).length;
+  }
+  clear() {
+    this.holds.clear();
+    this.queue = [];
+  }
+  take(customer) {
+    this.holds.delete(customer);
+    const taken = this.queue.filter((entry) => entry.customer === customer);
+    this.queue = this.queue.filter((entry) => entry.customer !== customer);
+    return taken;
+  }
+};
+var SigningPins = class {
+  signedAt = /* @__PURE__ */ new Map();
+  signedOnce = /* @__PURE__ */ new Set();
+  pin(messageId, seconds2) {
+    this.signedAt.set(messageId, seconds2);
+  }
+  /** The pinned timestamp for a message's first signing at this URL; `undefined` once used or unpinned. */
+  firstSigning(messageId, url) {
+    const pinned = this.signedAt.get(messageId);
+    const key = `${messageId}\0${url}`;
+    if (pinned === void 0 || this.signedOnce.has(key)) return void 0;
+    this.signedOnce.add(key);
+    return pinned;
+  }
+  clear() {
+    this.signedAt.clear();
+    this.signedOnce.clear();
+  }
+};
+
 // src/payment-methods.ts
 var paymentMethodHandlers = (services) => ({
   GetPaymentMethods: async (context) => {
@@ -14994,8 +15080,14 @@ var createRuntime2 = (options = {}) => {
   const accounts = new AccountDirectory(options.accounts ?? []);
   const baseClock = options.clock ?? createClock();
   const timers = options.clock ? createClockTimers(options.clock) : void 0;
+  const hubNow = options.webhooks?.now ?? (options.clock ? () => baseClock.now() : Date.now);
+  const pins = new SigningPins();
+  const stripeSigner = signers.timestamped("Stripe-Signature");
   const hub = createWebhookHub({
-    signer: signers.timestamped("Stripe-Signature"),
+    signer: (input) => {
+      const pinned = pins.firstSigning(input.messageId, input.url);
+      return pinned === void 0 ? stripeSigner(input) : stripeSigner({ ...input, timestampSeconds: pinned });
+    },
     ...options.webhooks?.retryDelaysMs ? { retryDelaysMs: options.webhooks.retryDelaysMs } : {},
     ...options.webhooks?.fetch ? { fetch: options.webhooks.fetch } : {},
     ...options.clock ? { now: () => baseClock.now() } : {},
@@ -15007,6 +15099,16 @@ var createRuntime2 = (options = {}) => {
     endpoints: options.webhooks?.endpoints ?? []
   });
   let runtimeRef;
+  const publishEvent = (namespace, event, pinnedAt) => {
+    if (pinnedAt !== void 0) pins.pin(event.id, pinnedAt);
+    hub.publish({
+      namespace,
+      type: event.type,
+      body: event.body,
+      id: event.id,
+      tags: { account: event.account }
+    });
+  };
   const derivedEndpoints = (namespace) => {
     const fromAccounts = accounts.list().flatMap(
       (account) => Object.entries(account.webhookSecrets ?? {}).map(([url, secret], index) => ({
@@ -15061,6 +15163,7 @@ var createRuntime2 = (options = {}) => {
         for (const row of api.adminWebhookEndpoints.list()) api.adminWebhookEndpoints.delete(row.id);
       }
       hub.clear(namespace);
+      pins.clear();
       if (namespace === void 0) syncAll();
       else syncEndpoints(namespace);
     }
@@ -15242,6 +15345,35 @@ var createRuntime2 = (options = {}) => {
       const charge = scope?.account.charges.get(id);
       return charge ? json(200, renderCharge(charge)) : adminError(404, `no charge ${id}`);
     },
+    "GET /payment-holds": ({ namespace }) => json(200, { holds: runtime2.instance(namespace).holds.list() }),
+    "PUT /payment-holds/:customer": ({ params, body, namespace }) => {
+      const customer = params.customer;
+      const flag = (key) => isRecord3(body) && key in body ? body[key] : true;
+      const webhooks = flag("webhooks");
+      const lookups = flag("lookups");
+      if (typeof webhooks !== "boolean" || typeof lookups !== "boolean")
+        return adminError(400, 'expected {"webhooks"?: boolean, "lookups"?: boolean}');
+      if (!webhooks && !lookups) return adminError(400, "a hold needs webhooks or lookups");
+      const hold = runtime2.instance(namespace).holds.set(customer, { webhooks, lookups });
+      return json(200, hold);
+    },
+    "POST /payment-holds/:customer/release": ({ params, namespace }) => {
+      const customer = params.customer;
+      const holds = runtime2.instance(namespace).holds;
+      if (!holds.has(customer)) return adminError(404, `no payment hold on ${customer}`);
+      const released = holds.release(customer);
+      for (const entry of released) publishEvent(namespace, entry.event, entry.signedAt);
+      return json(200, {
+        customer,
+        released: released.map((entry) => ({ id: entry.event.id, type: entry.event.type }))
+      });
+    },
+    "DELETE /payment-holds/:customer": ({ params, namespace }) => {
+      const customer = params.customer;
+      const holds = runtime2.instance(namespace).holds;
+      if (!holds.has(customer)) return adminError(404, `no payment hold on ${customer}`);
+      return json(200, { customer, discarded: holds.discard(customer) });
+    },
     "POST /tick": ({ namespace }) => {
       runtime2.instance(namespace).tick(true);
       return json(200, { status: "ok" });
@@ -15269,34 +15401,38 @@ var createRuntime2 = (options = {}) => {
       accounts: accounts.list().map((account) => account.id),
       webhooks: hub.endpoints("default").length > 0 ? "on" : "off"
     }),
-    create: ({ sqlite, namespace, publicNamespace, adminPrefix, clock: instanceClock }) => new StripeAPI({
-      sqlite,
-      namespace,
-      now: instanceClock.now,
-      accounts,
-      corpus,
-      publicNamespace,
-      adminPrefix,
-      ...options.publicUrl ? {
-        publicUrl: `${options.publicUrl.replace(/\/$/, "")}${publicNamespace === "default" ? "" : `${adminPrefix}/ns/${encodeURIComponent(publicNamespace)}`}`
-      } : {},
-      ...options.webhookApiVersion ? { webhookApiVersion: options.webhookApiVersion } : {},
-      ...options.lifecycle ? { lifecycle: options.lifecycle } : {},
-      pendingWebhooks: (account, type) => hub.endpoints(publicNamespace).filter(
-        (endpoint) => (endpoint.tags?.account === void 0 || endpoint.tags.account === account) && (endpoint.events === void 0 || endpoint.events.includes("*") || endpoint.events.includes(type))
-      ).length,
-      onEndpointsChanged: () => syncEndpoints(publicNamespace),
-      onWebhook: (event) => {
-        options.onWebhook?.(event);
-        hub.publish({
-          namespace: publicNamespace,
-          type: event.type,
-          body: event.body,
-          id: event.id,
-          tags: { account: event.account }
-        });
-      }
-    }),
+    create: ({ sqlite, namespace, publicNamespace, adminPrefix, clock: instanceClock }) => {
+      const api = new StripeAPI({
+        sqlite,
+        namespace,
+        now: instanceClock.now,
+        accounts,
+        corpus,
+        publicNamespace,
+        adminPrefix,
+        ...options.publicUrl ? {
+          publicUrl: `${options.publicUrl.replace(/\/$/, "")}${publicNamespace === "default" ? "" : `${adminPrefix}/ns/${encodeURIComponent(publicNamespace)}`}`
+        } : {},
+        ...options.webhookApiVersion ? { webhookApiVersion: options.webhookApiVersion } : {},
+        ...options.lifecycle ? { lifecycle: options.lifecycle } : {},
+        pendingWebhooks: (account, type) => hub.endpoints(publicNamespace).filter(
+          (endpoint) => (endpoint.tags?.account === void 0 || endpoint.tags.account === account) && (endpoint.events === void 0 || endpoint.events.includes("*") || endpoint.events.includes(type))
+        ).length,
+        onEndpointsChanged: () => syncEndpoints(publicNamespace),
+        onWebhook: (event) => {
+          options.onWebhook?.(event);
+          const held = api.holds.webhookHold(event);
+          if (held === void 0) publishEvent(publicNamespace, event);
+          else
+            api.holds.enqueue({
+              event,
+              customer: held,
+              signedAt: Math.floor(hubNow() / 1e3)
+            });
+        }
+      });
+      return api;
+    },
     admin
   });
   runtimeRef = runtime;
@@ -15354,6 +15490,8 @@ var StripeAPI = class {
   sqlite;
   accounts;
   adminWebhookEndpoints;
+  /** Customers whose webhooks are held and whose lookups fail (`/__admin/payment-holds`). */
+  holds = new PaymentHolds();
   service;
   state;
   services;
@@ -15533,6 +15671,17 @@ var StripeAPI = class {
     const config = this.accounts.config(account);
     if (config?.corpus && this.corpus) seedCorpus(partition, this.corpus);
     this.tick();
+    const heldLookup = this.heldLookup(request, url, partition);
+    if (heldLookup)
+      return this.decorate(
+        this.errorResponse({
+          status: 503,
+          type: "api_error",
+          message: "An unknown error occurred"
+        }),
+        version,
+        cors
+      );
     const idempotencyKey = request.method === "POST" ? request.headers.get("idempotency-key") : null;
     if (idempotencyKey !== null && (idempotencyKey.length === 0 || idempotencyKey.length > 255))
       return fail({ status: 400, message: INVALID_IDEMPOTENCY_KEY });
@@ -15567,6 +15716,23 @@ var StripeAPI = class {
     }
     return this.decorate(response, version, cors);
   }
+  /**
+   * A secret-key read a payment hold fails: a list filtered by a held customer, or the retrieve
+   * of a PaymentIntent that customer owns. Publishable-key calls (Stripe.js) are not affected.
+   */
+  heldLookup(request, url, partition) {
+    if (!this.holds.active || request.method !== "GET" || requestInfo(request).publishable)
+      return false;
+    if (this.holds.holdsLookups(url.searchParams.get("customer"))) return true;
+    const intentId = /^\/v1\/payment_intents\/([^/]+)$/.exec(url.pathname)?.[1];
+    if (intentId === void 0) return false;
+    let id = intentId;
+    try {
+      id = decodeURIComponent(intentId);
+    } catch {
+    }
+    return this.holds.holdsLookups(partition.paymentIntents.get(id)?.customer);
+  }
   /** Expand and version-shape a JSON response. */
   async finish(request, response, partition, era) {
     const type = response.headers.get("content-type") ?? "";
@@ -15653,6 +15819,7 @@ var StripeAPI = class {
   }
   async reset() {
     this.lastTick = Number.NEGATIVE_INFINITY;
+    this.holds.clear();
     await this.service.reset();
   }
 };
@@ -15673,6 +15840,7 @@ export {
   operationIds,
   supportedOperationIds,
   STRIPE_NAMESPACE,
+  PaymentHolds,
   ACME_CORPUS,
   QA_SURFACE_OPS,
   QA_METADATA,
@@ -15687,4 +15855,4 @@ export {
   createRuntime2 as createRuntime,
   StripeAPI
 };
-//# sourceMappingURL=chunk-EUF2MBTV.js.map
+//# sourceMappingURL=chunk-42WPENBP.js.map