@stardeck-customer-apps/testing 0.21.0 → 0.22.0

package/SKILL.md

@@ -421,6 +421,24 @@ externalId })` helper models a trusted platform/channel link, and
   `isVirtual: false`; create/list validation matches the control plane
   (expiry 90–600s, amount positive int, payment-method enum, deploymentId UUID,
   list `limit` 1–100, status filter values).
+  Beam direct charges (inline checkout): `.directCharges`, `.getDirectCharge(id)`,
+  `.completeDirectCharge(id)` and `.failDirectCharge(id, failureCode?)` settle a
+  PENDING charge and return the `charge.succeeded` / `charge.failed` payload to
+  pass to `.deliverBeamEvent`. `QR_PROMPT_PAY` returns `ENCODED_IMAGE` (expiry
+  honours `expiryDurationInSec`), wallets and mobile banking return `REDIRECT`
+  to `https://beam.stardeck.test/pay/<id>?returnUrl=…`, and the same
+  `idempotencyKey` returns the same charge. Card tokens: `tokenizeBeamCard`
+  against the simulated Beam host returns `ctok_sim_<n>`; the card number picks
+  the outcome of a `CARD_TOKEN` charge — `4111111111111111` / `5372074248113841`
+  succeed (`NONE`), `4953261730509988` / `4389783280144506` need OTP
+  (`REDIRECT`), `4943129900084541` fails `CH_INSUFFICIENT_FUNDS`,
+  `4111111111000025` fails `CH_CARD_DECLINED`, `4111111111000033` fails
+  `CH_CARD_RESTRICTED`, anything else fails `CH_PROCESSING_FAILED`.
+  `.setCardTokenization(false)` models a merchant with no publishable key
+  (`getCardTokenizationConfig` throws `CARD_TOKENIZATION_NOT_CONFIGURED`).
+  Raw `CARD` / `CARD_INSTALLMENTS`, token methods without a `cardToken`, and
+  non-QR methods without a `returnUrl` are
+  refused with 400, as on the control plane.
 - `app.storage` — uploads through storage-sdk: `.uploads`, `.latest()`, `.count`, `.clear()`.
 - `app.messages` — outbound Slack/LINE/Facebook sends:
   `.all()`, `.latest()`, `.to(recipient)`, `.channel("line")`, `.count`, `.clear()`. LINE Flex
@@ -497,8 +515,8 @@ true })` remains source-compatible but the simulator (like the control plane)
 - For merge-correct reads, request aliases in batches and include every id in
   the returned canonical set. Page directory UIs through `search({ query,
 cursor, limit })`; `list()` intentionally keeps its previous array shape.
-- `PaymentsServerClient` (Stripe checkout + Beam payment links + Bolt+
-  connections/intents/charges, product list) — captured in `app.payments`;
+- `PaymentsServerClient` (Stripe checkout + Beam payment links + Beam direct
+  charges and card tokenization + Bolt+ connections/intents/charges, product list) — captured in `app.payments`;
   fulfill checkout via `markPaid` (poll) or `deliverStripeEvent` /
   `deliverBeamEvent` (webhook push). Drive a terminal without hardware via
   `approveBoltIntent` / `declineBoltIntent` / `expireBoltIntent`. Beam payment-link
@@ -512,7 +530,8 @@ cursor, limit })`; `list()` intentionally keeps its previous array shape.
   one-shot HTTP or network failures during Stripe checkout creation/status polling
   and Beam payment-link creation/status polling. The operation names are
   `stripe.createCheckout`, `stripe.getCheckoutSessionStatus`,
-  `beam.createPaymentLink`, and `beam.getPaymentLinkStatus`. HTTP failures support
+  `beam.createPaymentLink`, `beam.getPaymentLinkStatus`, `beam.createDirectCharge`,
+  and `beam.getCharge`. HTTP failures support
   statuses 400, 402, 409, 429, 500, and 503 plus optional `code`, `details`, and
   `retryAfterSeconds`; `{ kind: "network", message }` rejects fetch instead.
   `app.reset()` clears pending failures.

package/dist/index.d.mts

@@ -210,7 +210,7 @@ interface CapturedCheckout {
     metadata?: Record<string, string>;
     createdAt: Date;
 }
-type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus";
+type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus" | "beam.createDirectCharge" | "beam.getCharge";
 type PaymentSimulatorFailure = {
     kind?: "http";
     status: 400 | 402 | 409 | 429 | 500 | 503;
@@ -269,6 +269,26 @@ interface SimBoltCharge {
     sourceId?: string;
     createdAt?: string;
 }
+/** A direct charge (`createDirectCharge`) as the simulator holds it. */
+interface SimDirectCharge {
+    id: string;
+    status: "SUCCEEDED" | "FAILED" | "PENDING";
+    amount: number;
+    currency: string;
+    paymentMethodType: string;
+    referenceId: string | null;
+    deviceType: string | null;
+    returnUrl: string | null;
+    actionRequired: "NONE" | "REDIRECT" | "ENCODED_IMAGE";
+    redirectUrl: string | null;
+    /** When the QR (or the charge) stops being payable. */
+    expiresAt: string;
+    failureCode: string | null;
+    /** Last four digits of a CARD_TOKEN charge's card. */
+    cardLast4: string | null;
+    idempotencyKey: string | null;
+    createdAt: string;
+}
 interface TestPayments {
     get checkouts(): CapturedCheckout[];
     latest(): CapturedCheckout | undefined;
@@ -317,6 +337,19 @@ interface TestPayments {
     expireBoltIntent(intentId: string): void;
     listBoltIntents(): SimBoltIntentRecord[];
     getBoltIntent(intentId: string): SimBoltIntentRecord | undefined;
+    /** Every direct charge created so far, oldest first. */
+    get directCharges(): SimDirectCharge[];
+    getDirectCharge(chargeId: string): SimDirectCharge | undefined;
+    /**
+     * The shopper paid: mark a PENDING direct charge SUCCEEDED and return the
+     * `charge.succeeded` payload. Delivers no webhook; pass the payload to
+     * `deliverBeamEvent` the way Beam would.
+     */
+    completeDirectCharge(chargeId: string): Record<string, unknown>;
+    /** Mark a PENDING direct charge FAILED; returns the `charge.failed` payload. */
+    failDirectCharge(chargeId: string, failureCode?: string): Record<string, unknown>;
+    /** Turn card tokenization off, as for a merchant with no publishable key. On by default. */
+    setCardTokenization(enabled: boolean): void;
     clear(): void;
     get count(): number;
 }

package/dist/index.d.ts

@@ -210,7 +210,7 @@ interface CapturedCheckout {
     metadata?: Record<string, string>;
     createdAt: Date;
 }
-type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus";
+type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus" | "beam.createDirectCharge" | "beam.getCharge";
 type PaymentSimulatorFailure = {
     kind?: "http";
     status: 400 | 402 | 409 | 429 | 500 | 503;
@@ -269,6 +269,26 @@ interface SimBoltCharge {
     sourceId?: string;
     createdAt?: string;
 }
+/** A direct charge (`createDirectCharge`) as the simulator holds it. */
+interface SimDirectCharge {
+    id: string;
+    status: "SUCCEEDED" | "FAILED" | "PENDING";
+    amount: number;
+    currency: string;
+    paymentMethodType: string;
+    referenceId: string | null;
+    deviceType: string | null;
+    returnUrl: string | null;
+    actionRequired: "NONE" | "REDIRECT" | "ENCODED_IMAGE";
+    redirectUrl: string | null;
+    /** When the QR (or the charge) stops being payable. */
+    expiresAt: string;
+    failureCode: string | null;
+    /** Last four digits of a CARD_TOKEN charge's card. */
+    cardLast4: string | null;
+    idempotencyKey: string | null;
+    createdAt: string;
+}
 interface TestPayments {
     get checkouts(): CapturedCheckout[];
     latest(): CapturedCheckout | undefined;
@@ -317,6 +337,19 @@ interface TestPayments {
     expireBoltIntent(intentId: string): void;
     listBoltIntents(): SimBoltIntentRecord[];
     getBoltIntent(intentId: string): SimBoltIntentRecord | undefined;
+    /** Every direct charge created so far, oldest first. */
+    get directCharges(): SimDirectCharge[];
+    getDirectCharge(chargeId: string): SimDirectCharge | undefined;
+    /**
+     * The shopper paid: mark a PENDING direct charge SUCCEEDED and return the
+     * `charge.succeeded` payload. Delivers no webhook; pass the payload to
+     * `deliverBeamEvent` the way Beam would.
+     */
+    completeDirectCharge(chargeId: string): Record<string, unknown>;
+    /** Mark a PENDING direct charge FAILED; returns the `charge.failed` payload. */
+    failDirectCharge(chargeId: string, failureCode?: string): Record<string, unknown>;
+    /** Turn card tokenization off, as for a merchant with no publishable key. On by default. */
+    setCardTokenization(enabled: boolean): void;
     clear(): void;
     get count(): number;
 }

package/dist/index.js

@@ -348,6 +348,11 @@ var state = globalSingleton("state", () => ({
   boltIntentCounter: 0,
   boltCharges: [],
   boltChargeCounter: 0,
+  directCharges: /* @__PURE__ */ new Map(),
+  directChargeCounter: 0,
+  cardTokens: /* @__PURE__ */ new Map(),
+  cardTokenCounter: 0,
+  cardTokenizationEnabled: true,
   uploads: [],
   uploadCounter: 0,
   storageFiles: /* @__PURE__ */ new Map(),
@@ -1715,6 +1720,311 @@ function createDirectory() {
   };
 }
 
+// src/simulator/beam-direct-charges.ts
+var SIM_BEAM_HOST = "beam.stardeck.test";
+var SIM_BEAM_MERCHANT_ID = "sim_merchant";
+var SIM_BEAM_PUBLISHABLE_KEY = "pk_test_sim";
+var DIRECT_CHARGE_METHODS = /* @__PURE__ */ new Set([
+  "CARD",
+  "CARD_INSTALLMENTS",
+  "CARD_TOKEN",
+  "CARD_TOKEN_INSTALLMENTS",
+  "QR_PROMPT_PAY",
+  "ALIPAY",
+  "ALIPAY_PLUS",
+  "WECHAT_PAY",
+  "TRUE_MONEY",
+  "LINE_PAY",
+  "SHOPEE_PAY",
+  "KPLUS",
+  "MAKE",
+  "SCB_EASY",
+  "KRUNGSRI_APP",
+  "BANGKOK_BANK_APP",
+  "SPAY_LATER"
+]);
+var TEST_CARDS = {
+  "4111111111111111": { outcome: "SUCCEEDED" },
+  "5372074248113841": { outcome: "SUCCEEDED" },
+  "378282246310005": { outcome: "SUCCEEDED" },
+  "4953261730509988": { outcome: "REDIRECT" },
+  "4389783280144506": { outcome: "REDIRECT" },
+  "4943129900084541": { outcome: "FAILED", failureCode: "CH_INSUFFICIENT_FUNDS" },
+  "4111111111000025": { outcome: "FAILED", failureCode: "CH_CARD_DECLINED" },
+  "4111111111000033": { outcome: "FAILED", failureCode: "CH_CARD_RESTRICTED" }
+};
+var SIM_QR_PNG = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function invalid(issues) {
+  return json({ error: "Invalid request body", details: issues }, 400);
+}
+var DEVICE_TYPES = /* @__PURE__ */ new Set(["ANDROID", "IOS", "WEB"]);
+function issue(path, message, code = "custom") {
+  return { path, message, code };
+}
+function validateChargeFields(body) {
+  const issues = [];
+  const isInt = (v) => typeof v === "number" && Number.isInteger(v);
+  if (!isInt(body.amount) || body.amount < 1) {
+    issues.push(issue(["amount"], "Number must be greater than 0", "too_small"));
+  }
+  if (typeof body.deploymentId !== "string" || !UUID_RE.test(body.deploymentId)) {
+    issues.push(issue(["deploymentId"], "Invalid deployment ID", "invalid_string"));
+  }
+  if (body.referenceId !== void 0 && (typeof body.referenceId !== "string" || body.referenceId.length > 100)) {
+    issues.push(issue(["referenceId"], "Too long", "too_big"));
+  }
+  const expiry = body.expiryDurationInSec;
+  if (expiry !== void 0 && (!isInt(expiry) || expiry < 60 || expiry > 3600)) {
+    issues.push(issue(["expiryDurationInSec"], "Must be an integer from 60 to 3600", "too_big"));
+  }
+  if (body.returnUrl !== void 0 && (typeof body.returnUrl !== "string" || !URL.canParse(body.returnUrl))) {
+    issues.push(issue(["returnUrl"], "Invalid URL", "invalid_format"));
+  }
+  if (body.deviceType !== void 0 && !DEVICE_TYPES.has(String(body.deviceType))) {
+    issues.push(issue(["deviceType"], "Invalid enum value", "invalid_value"));
+  }
+  const key = body.idempotencyKey;
+  if (key !== void 0 && (typeof key !== "string" || key.length < 1 || key.length > 255)) {
+    issues.push(issue(["idempotencyKey"], "Must be 1 to 255 characters", "too_small"));
+  }
+  return issues;
+}
+function validateChargeMethod(body) {
+  const method = body.paymentMethod;
+  const type = method?.paymentMethodType;
+  if (typeof type !== "string" || !DIRECT_CHARGE_METHODS.has(type)) {
+    return [issue(["paymentMethod", "paymentMethodType"], "Invalid enum value", "invalid_value")];
+  }
+  const issues = [];
+  const isToken = type === "CARD_TOKEN" || type === "CARD_TOKEN_INSTALLMENTS";
+  const token = method?.cardToken;
+  if (isToken && (typeof token?.cardTokenId !== "string" || token.cardTokenId === "")) {
+    issues.push(
+      issue(["paymentMethod", "cardToken"], `${type} requires paymentMethod.cardToken.cardTokenId`)
+    );
+  }
+  if (token?.securityCode !== void 0 && !/^\d{3,4}$/.test(String(token.securityCode))) {
+    issues.push(
+      issue(
+        ["paymentMethod", "cardToken", "securityCode"],
+        "Invalid security code",
+        "invalid_format"
+      )
+    );
+  }
+  if (type === "CARD_TOKEN_INSTALLMENTS" && ![3, 4, 6, 10].includes(method?.installmentPeriod)) {
+    issues.push(
+      issue(
+        ["paymentMethod", "installmentPeriod"],
+        "CARD_TOKEN_INSTALLMENTS requires paymentMethod.installmentPeriod (3, 4, 6 or 10)"
+      )
+    );
+  }
+  if (type !== "QR_PROMPT_PAY" && !body.returnUrl) {
+    issues.push(
+      issue(
+        ["returnUrl"],
+        `${type} sends the shopper away to pay; returnUrl is required to bring them back`
+      )
+    );
+  }
+  if (type === "CARD" || type === "CARD_INSTALLMENTS") {
+    issues.push(
+      issue(
+        ["paymentMethod", "paymentMethodType"],
+        `${type} takes raw card data; tokenize the card in the browser and charge CARD_TOKEN instead`
+      )
+    );
+  }
+  return issues;
+}
+function validateDirectCharge(body) {
+  return [...validateChargeFields(body), ...validateChargeMethod(body)];
+}
+function chargeResponse(charge) {
+  const response = {
+    chargeId: charge.id,
+    actionRequired: charge.actionRequired,
+    paymentMethodType: charge.paymentMethodType
+  };
+  if (charge.actionRequired === "ENCODED_IMAGE") {
+    response.encodedImage = {
+      imageBase64Encoded: SIM_QR_PNG,
+      rawData: `00020101021230SIM${charge.id}`,
+      expiry: charge.expiresAt
+    };
+  }
+  if (charge.actionRequired === "REDIRECT") {
+    response.redirect = { redirectUrl: charge.redirectUrl };
+    response.redirectUrl = charge.redirectUrl;
+  }
+  return response;
+}
+function nextChargeId() {
+  state.directChargeCounter += 1;
+  return `ch_sim_${state.directChargeCounter}`;
+}
+function createCharge(body) {
+  const method = body.paymentMethod;
+  const type = method.paymentMethodType;
+  const id = nextChargeId();
+  const now3 = /* @__PURE__ */ new Date();
+  const expirySec = typeof body.expiryDurationInSec === "number" ? body.expiryDurationInSec : 30 * 60;
+  const returnUrl = typeof body.returnUrl === "string" ? body.returnUrl : null;
+  let actionRequired = "REDIRECT";
+  let status = "PENDING";
+  let failureCode = null;
+  let cardLast4 = null;
+  if (type === "QR_PROMPT_PAY") {
+    actionRequired = "ENCODED_IMAGE";
+  } else if (type === "CARD_TOKEN" || type === "CARD_TOKEN_INSTALLMENTS") {
+    const token = state.cardTokens.get(method.cardToken.cardTokenId);
+    if (!token) {
+      return json({ error: "Card token not found", code: "CARD_TOKEN_NOT_FOUND" }, 404);
+    }
+    cardLast4 = token.last4;
+    const card = TEST_CARDS[token.pan] ?? {
+      outcome: "FAILED",
+      failureCode: "CH_PROCESSING_FAILED"
+    };
+    if (card.outcome === "REDIRECT") {
+      actionRequired = "REDIRECT";
+    } else {
+      actionRequired = "NONE";
+      status = card.outcome;
+      failureCode = card.failureCode ?? null;
+    }
+  }
+  const charge = {
+    id,
+    status,
+    amount: body.amount,
+    currency: String(body.currency ?? "THB"),
+    paymentMethodType: type,
+    referenceId: typeof body.referenceId === "string" ? body.referenceId : null,
+    deviceType: typeof body.deviceType === "string" ? body.deviceType : null,
+    returnUrl,
+    actionRequired,
+    redirectUrl: actionRequired === "REDIRECT" ? `https://${SIM_BEAM_HOST}/pay/${id}${returnUrl ? `?returnUrl=${encodeURIComponent(returnUrl)}` : ""}` : null,
+    expiresAt: new Date(now3.getTime() + expirySec * 1e3).toISOString(),
+    failureCode,
+    cardLast4,
+    idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey : null,
+    createdAt: now3.toISOString()
+  };
+  state.directCharges.set(id, charge);
+  return charge;
+}
+async function handleDirectChargeRequest(request, pathname) {
+  if (request.method === "POST" && /^\/api\/store\/beam\/[^/]+\/charges$/.test(pathname)) {
+    const body = await readJsonBody(request);
+    const issues = validateDirectCharge(body);
+    if (issues.length > 0) return invalid(issues);
+    const key = typeof body.idempotencyKey === "string" ? body.idempotencyKey : null;
+    if (key) {
+      const existing = [...state.directCharges.values()].find((c) => c.idempotencyKey === key);
+      if (existing) return json(chargeResponse(existing));
+    }
+    const created = createCharge(body);
+    if (created instanceof Response) return created;
+    return json(chargeResponse(created));
+  }
+  const getMatch = pathname.match(/^\/api\/store\/beam\/[^/]+\/charges\/([^/]+)$/);
+  if (request.method === "GET" && getMatch) {
+    const charge = state.directCharges.get(decodeURIComponent(getMatch[1]));
+    if (!charge) return json({ error: "Charge not found", code: "NOT_FOUND" }, 404);
+    return json({ charge: toChargeDetail(charge) });
+  }
+  if (request.method === "GET" && /^\/api\/store\/beam\/[^/]+\/card-tokenization$/.test(pathname)) {
+    if (!state.cardTokenizationEnabled) {
+      return json(
+        {
+          error: "Add the Beam publishable key to this merchant account to take cards in your own checkout",
+          code: "CARD_TOKENIZATION_NOT_CONFIGURED"
+        },
+        409
+      );
+    }
+    return json({
+      merchantId: SIM_BEAM_MERCHANT_ID,
+      publishableKey: SIM_BEAM_PUBLISHABLE_KEY,
+      tokenizeUrl: `https://${SIM_BEAM_HOST}/client/v1/card-tokens`,
+      isSandbox: true
+    });
+  }
+  return null;
+}
+function toChargeDetail(charge) {
+  return {
+    id: charge.id,
+    chargeId: charge.id,
+    status: charge.status,
+    amount: charge.amount,
+    currency: charge.currency,
+    paymentMethodType: charge.paymentMethodType,
+    ...charge.referenceId !== null ? { referenceId: charge.referenceId } : {},
+    ...charge.failureCode ? { failureCode: charge.failureCode } : {},
+    source: "API",
+    createdAt: charge.createdAt
+  };
+}
+async function handleCardTokenRequest(request, url) {
+  if (request.method !== "POST" || url.pathname !== "/client/v1/card-tokens") {
+    return json({ error: `No Beam simulator for ${request.method} ${url.pathname}` }, 404);
+  }
+  const expected = `Basic ${btoa(`${SIM_BEAM_MERCHANT_ID}:${SIM_BEAM_PUBLISHABLE_KEY}`)}`;
+  if (request.headers.get("Authorization") !== expected) {
+    return json(
+      {
+        message: "invalid credentials",
+        error: { errorCode: "INVALID_CREDENTIALS_ERROR", errorMessage: "invalid credentials" }
+      },
+      401
+    );
+  }
+  const body = await readJsonBody(request);
+  const pan = typeof body.pan === "string" ? body.pan : "";
+  const month = body.expiryMonth;
+  const year = body.expiryYear;
+  if (!/^\d{12,19}$/.test(pan) || typeof month !== "number" || month < 1 || month > 12 || typeof year !== "number" || year < 0 || year > 99) {
+    return json(
+      {
+        message: "inputs are failing validation",
+        error: {
+          errorCode: "API_VALIDATION_ERROR",
+          errorMessage: "inputs are failing validation"
+        }
+      },
+      400
+    );
+  }
+  state.cardTokenCounter += 1;
+  const token = {
+    id: `ctok_sim_${state.cardTokenCounter}`,
+    pan,
+    last4: pan.slice(-4),
+    expiryMonth: month,
+    expiryYear: year
+  };
+  state.cardTokens.set(token.id, token);
+  return json({ id: token.id });
+}
+function chargeWebhookPayload(charge) {
+  return {
+    chargeId: charge.id,
+    merchantId: SIM_BEAM_MERCHANT_ID,
+    ...charge.referenceId !== null ? { referenceId: charge.referenceId } : {},
+    status: charge.status,
+    currency: charge.currency,
+    amount: charge.amount,
+    source: "API",
+    sourceId: charge.id,
+    ...charge.failureCode ? { failureCode: charge.failureCode } : {},
+    paymentMethod: { paymentMethodType: charge.paymentMethodType }
+  };
+}
+
 // src/simulator/payments.ts
 var import_node_crypto6 = __toESM(require("crypto"));
 
@@ -1829,7 +2139,7 @@ var BEAM_BOLT_PAYMENT_METHODS = [
   "SPAY_LATER"
 ];
 var BEAM_BOLT_INTENT_STATUSES = ["PENDING", "PAID", "FAILED", "CANCELED", "EXPIRED"];
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function payErr(error, status = 400, code, details) {
   const body = { error };
   if (code) body.code = code;
@@ -1843,6 +2153,12 @@ function paymentOperationForRequest(request, pathname) {
   if (request.method === "GET" && /^\/api\/store\/beam\/[^/]+\/payment-links\/[^/]+$/.test(pathname)) {
     return "beam.getPaymentLinkStatus";
   }
+  if (request.method === "POST" && /^\/api\/store\/beam\/[^/]+\/charges$/.test(pathname)) {
+    return "beam.createDirectCharge";
+  }
+  if (request.method === "GET" && /^\/api\/store\/beam\/[^/]+\/charges\/[^/]+$/.test(pathname)) {
+    return "beam.getCharge";
+  }
   if (request.method === "POST" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout$/.test(pathname)) {
     return "stripe.createCheckout";
   }
@@ -2018,6 +2334,8 @@ async function handlePaymentsRequest(request, url) {
   const pathname = url.pathname;
   const injectedFailure = consumePaymentFailure(request, pathname);
   if (injectedFailure) return injectedFailure;
+  const directChargeResponse = await handleDirectChargeRequest(request, pathname);
+  if (directChargeResponse) return directChargeResponse;
   if (/\/billing-portal$/.test(pathname)) {
     return payErr("Not found", 404, "NOT_FOUND");
   }
@@ -2114,7 +2432,7 @@ async function handlePaymentsRequest(request, url) {
           code: "too_small"
         });
       }
-      if (typeof body.deploymentId !== "string" || !UUID_RE.test(body.deploymentId)) {
+      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
         issues.push({
           path: ["deploymentId"],
           message: "Invalid uuid",
@@ -2301,6 +2619,18 @@ async function handlePaymentsRequest(request, url) {
   }
   return payErr(`No payments simulator for ${request.method} ${pathname}`, 404);
 }
+function requirePendingDirectCharge(chargeId) {
+  const charge = state.directCharges.get(chargeId);
+  if (!charge) {
+    throw new Error(`[stardeck-testing] Unknown direct charge id: ${chargeId}`);
+  }
+  if (charge.status !== "PENDING") {
+    throw new Error(
+      `[stardeck-testing] Direct charge ${chargeId} is ${charge.status}, not PENDING`
+    );
+  }
+  return charge;
+}
 function createPayments() {
   return {
     get checkouts() {
@@ -2419,6 +2749,26 @@ function createPayments() {
       if (!intent) return void 0;
       return toBoltIntentRecord(intent);
     },
+    get directCharges() {
+      return [...state.directCharges.values()];
+    },
+    getDirectCharge(chargeId) {
+      return state.directCharges.get(chargeId);
+    },
+    completeDirectCharge(chargeId) {
+      const charge = requirePendingDirectCharge(chargeId);
+      charge.status = "SUCCEEDED";
+      return chargeWebhookPayload(charge);
+    },
+    failDirectCharge(chargeId, failureCode = "CH_PROCESSING_FAILED") {
+      const charge = requirePendingDirectCharge(chargeId);
+      charge.status = "FAILED";
+      charge.failureCode = failureCode;
+      return chargeWebhookPayload(charge);
+    },
+    setCardTokenization(enabled) {
+      state.cardTokenizationEnabled = enabled;
+    },
     clear() {
       state.checkouts = [];
       state.checkoutCounter = 0;
@@ -2433,6 +2783,11 @@ function createPayments() {
       state.boltIntentCounter = 0;
       state.boltCharges = [];
       state.boltChargeCounter = 0;
+      state.directCharges.clear();
+      state.directChargeCounter = 0;
+      state.cardTokens.clear();
+      state.cardTokenCounter = 0;
+      state.cardTokenizationEnabled = true;
     },
     get count() {
       return state.checkouts.length;
@@ -3312,6 +3667,9 @@ async function handleSimulatedRequest(request, url) {
   if (isStorageHost) {
     return handleStorageRequest(request, url);
   }
+  if (url.hostname === SIM_BEAM_HOST) {
+    return handleCardTokenRequest(request, url);
+  }
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }