@develemit/commerce-server 0.4.0 → 0.6.0

package/docs/admin.md

@@ -9,8 +9,11 @@ management under `/admin`. Without it, no admin routes exist (404).
   The kit owns no identity: check a session, token or header yourself.
 - `storage` implements `FileStorage` (`put(key, stream, contentType)` and
   `delete(key)`). Keys look like `products/<productId>/<uuid>.<ext>`.
-  `createMemoryStorage()` is for tests; a local-disk example lives in
-  `apps/playground-api/src/storage.ts`.
+  `createMemoryStorage()` is for tests. `createDiskStorage({ dir, publicUrl })`
+  is a development-grade local disk store that rejects keys escaping `dir`
+  (`..`, absolute paths, encoded traversal, NUL bytes, symlinks out); serve its
+  files with `openStoredFile(dir, key)`, which returns `{ stream, contentType,
+size }` or `null` (answer 404).
 
 | Route                                    | Purpose                                                |
 | ---------------------------------------- | ------------------------------------------------------ |

package/docs/payments.md

@@ -10,13 +10,30 @@ Two ship with the package:
 - `createStripeGateway({ secretKey, webhookSecret })` loads `stripe` lazily, so
   it's an optional peer. Refunds look up the session's PaymentIntent and call
   `refunds.create` with the idempotency key.
-- `createFakeGateway()` for tests. Its session URL is the success URL, and
+- `createFakeGateway()` for tests and local development. By default its
+  session URL is the success URL (see [Local checkout](#local-checkout-without-stripe)
+  for a click-through flow), and
   `completed(sessionId)` / `expired(sessionId)` / `asyncPaid(sessionId)` /
   `asyncFailed(sessionId)` return signed webhook bodies to
   post to the webhook route. `refunds` lists the refunds it made (one per
   key), `refundCalls` every call, and `failNextRefund()` makes the next one
   throw.
 
+## Local checkout without Stripe
+
+Pass `devCheckout: true` (or `{ apiUrl: 'http://localhost:3301' }` when the
+browser reaches the api on another origin) to `commercePlugin` while using the
+fake gateway. Checkout then returns a session URL pointing at
+`GET <prefix>/checkout/dev/:sessionId/complete`, which applies a paid
+`checkout.completed` event through the same path the webhook uses (holds and
+discount redemptions commit, `onOrderPaid` runs) and answers 302 to
+`urls.success(sessionId)`. `?outcome=expired` releases the order instead and
+redirects to `urls.cancel`. The route is only registered for the fake gateway,
+only knows sessions created since the process started (404 otherwise), and
+`commercePlugin` throws at registration when `NODE_ENV=production`. Gate the
+option on `NODE_ENV !== 'production'` so one config works in every
+environment.
+
 ## Discounts
 
 A discount code is an amount off the merchandise subtotal, never shipping. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@develemit/commerce-server",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "file-type": "^22.2.0",
-    "@develemit/commerce-contracts": "0.4.0"
+    "@develemit/commerce-contracts": "0.6.0"
   },
   "peerDependencies": {
     "drizzle-orm": "^0.45.0",