@stardeck-customer-apps/testing 0.23.0 → 0.24.0

package/SKILL.md

@@ -208,6 +208,14 @@ app.payments.failNext("stripe.getCheckoutSessionStatus", {
   message: "connection reset",
 });
 
+// Stripe createCheckout idempotency + expiry (payments-sdk >= 4.11.0) is simulated like the
+// platform: same idempotencyKey + same payload replays the same session (one captured
+// checkout); same key + different payload -> PaymentError "idempotency_conflict" (409); keys
+// are scoped per account; expiresAt (unix seconds) must be 30 min - 24 h out or
+// "expiry_out_of_range" (400); the default is 24 h and session.expiresAt is returned.
+// Beam payment links reject idempotencyKey ("idempotency_unsupported") and echo expiresAt.
+// The simulator does not model Stripe's 24 h key retention.
+
 // File upload
 const storage = new StorageClient();
 await storage.upload(new File(["hi"], "note.txt", { type: "text/plain" }));

package/dist/index.js

@@ -340,6 +340,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],
@@ -2131,6 +2132,8 @@ function signEventDelivery(secret, context, rawBody) {
 }
 
 // src/simulator/payments.ts
+var STRIPE_MIN_EXPIRY_SECONDS = 30 * 60;
+var STRIPE_MAX_EXPIRY_SECONDS = 24 * 60 * 60;
 var BEAM_BOLT_PAYMENT_METHODS = [
   "CARD",
   "CARD_INSTALLMENTS",
@@ -2200,6 +2203,15 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var ISO_8601_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
 function nextCheckoutId() {
   state.checkoutCounter += 1;
   return `cs_test_${state.checkoutCounter}`;
@@ -2220,7 +2232,7 @@ function nextBoltChargeId() {
   state.boltChargeCounter += 1;
   return `chrg_${state.boltChargeCounter}`;
 }
-function seedStripeSession(id, body) {
+function seedStripeSession(id, body, expiresAt) {
   const lineItems = body.lineItems ?? [];
   let amountTotal = null;
   let currency = null;
@@ -2240,7 +2252,7 @@ function seedStripeSession(id, body) {
     currency,
     customerEmail: body.customerEmail ? String(body.customerEmail) : null,
     metadata: body.metadata ?? {},
-    expiresAt: Math.floor(Date.now() / 1e3) + 3600
+    expiresAt
   });
 }
 function seedBeamLink(id, body, merchantId) {
@@ -2260,7 +2272,8 @@ function seedBeamLink(id, body, merchantId) {
     },
     redirectUrl: body.redirectUrl ? String(body.redirectUrl) : void 0,
     linkSettings: body.linkSettings,
-    collectDeliveryAddress: body.collectDeliveryAddress === true
+    collectDeliveryAddress: body.collectDeliveryAddress === true,
+    ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
   });
 }
 function deriveBoltIntentStatus(storedStatus, expiresAt, now3 = /* @__PURE__ */ new Date()) {
@@ -2562,6 +2575,16 @@ async function handlePaymentsRequest(request, url) {
     const linkId = beamProductsMatch[2];
     if (!linkId && request.method === "POST") {
       const body = await readJsonBody(request);
+      if ("idempotencyKey" in body) {
+        return payErr(
+          "idempotencyKey is not supported for Beam payment links.",
+          400,
+          "idempotency_unsupported"
+        );
+      }
+      if (typeof body.expiresAt === "string" && (!ISO_8601_WITH_ZONE.test(body.expiresAt) || Number.isNaN(Date.parse(body.expiresAt)))) {
+        return payErr("expiresAt must be an ISO 8601 timestamp", 400);
+      }
       const id = nextPaymentLinkId();
       const checkoutUrl = `https://beam.test/pay/${id}`;
       const captured = {
@@ -2574,7 +2597,11 @@ async function handlePaymentsRequest(request, url) {
       };
       state.checkouts.push(captured);
       seedBeamLink(id, body, merchantId);
-      return json({ id, url: checkoutUrl });
+      return json({
+        id,
+        url: checkoutUrl,
+        ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
+      });
     }
     if (linkId && request.method === "GET") {
       const link = state.paymentLinks.get(linkId);
@@ -2600,6 +2627,34 @@ async function handlePaymentsRequest(request, url) {
     }
     if (subPath === "checkout" && request.method === "POST") {
       const body = await readJsonBody(request);
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const requestedExpiry = typeof body.expiresAt === "number" ? body.expiresAt : void 0;
+      const callerKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0;
+      const scopedKey = callerKey ? JSON.stringify(["stripe", accountId, callerKey]) : void 0;
+      const comparable = { ...body };
+      delete comparable.deploymentId;
+      delete comparable.idempotencyKey;
+      const fingerprint = stableStringify(comparable);
+      if (scopedKey) {
+        const saved = state.idempotentCheckouts.get(scopedKey);
+        if (saved) {
+          if (saved.fingerprint !== fingerprint) {
+            return payErr(
+              "This idempotency key was already used with different checkout parameters. Use a new key for a different checkout.",
+              409,
+              "idempotency_conflict"
+            );
+          }
+          return json(saved.response);
+        }
+      }
+      if (requestedExpiry !== void 0 && (requestedExpiry < nowSeconds + STRIPE_MIN_EXPIRY_SECONDS || requestedExpiry > nowSeconds + STRIPE_MAX_EXPIRY_SECONDS)) {
+        return payErr(
+          "expiresAt must be between 30 minutes and 24 hours after the checkout is created (Unix seconds).",
+          400,
+          "expiry_out_of_range"
+        );
+      }
       const id = nextCheckoutId();
       const checkoutUrl = `https://checkout.stripe.test/c/pay/${id}`;
       const captured = {
@@ -2612,8 +2667,11 @@ async function handlePaymentsRequest(request, url) {
         createdAt: /* @__PURE__ */ new Date()
       };
       state.checkouts.push(captured);
-      seedStripeSession(id, body);
-      return json({ id, url: checkoutUrl });
+      const expiresAt = requestedExpiry ?? nowSeconds + STRIPE_MAX_EXPIRY_SECONDS;
+      seedStripeSession(id, body, expiresAt);
+      const response = { id, url: checkoutUrl, expiresAt };
+      if (scopedKey) state.idempotentCheckouts.set(scopedKey, { fingerprint, response });
+      return json(response);
     }
     const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
     if (sessionMatch && request.method === "GET") {
@@ -2778,6 +2836,7 @@ function createPayments() {
       state.checkouts = [];
       state.checkoutCounter = 0;
       state.sessionStatuses.clear();
+      state.idempotentCheckouts.clear();
       state.paymentLinks.clear();
       state.paymentFailures = [];
       state.products = [];

package/dist/index.mjs

@@ -301,6 +301,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],
@@ -2092,6 +2093,8 @@ function signEventDelivery(secret, context, rawBody) {
 }
 
 // src/simulator/payments.ts
+var STRIPE_MIN_EXPIRY_SECONDS = 30 * 60;
+var STRIPE_MAX_EXPIRY_SECONDS = 24 * 60 * 60;
 var BEAM_BOLT_PAYMENT_METHODS = [
   "CARD",
   "CARD_INSTALLMENTS",
@@ -2161,6 +2164,15 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var ISO_8601_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
 function nextCheckoutId() {
   state.checkoutCounter += 1;
   return `cs_test_${state.checkoutCounter}`;
@@ -2181,7 +2193,7 @@ function nextBoltChargeId() {
   state.boltChargeCounter += 1;
   return `chrg_${state.boltChargeCounter}`;
 }
-function seedStripeSession(id, body) {
+function seedStripeSession(id, body, expiresAt) {
   const lineItems = body.lineItems ?? [];
   let amountTotal = null;
   let currency = null;
@@ -2201,7 +2213,7 @@ function seedStripeSession(id, body) {
     currency,
     customerEmail: body.customerEmail ? String(body.customerEmail) : null,
     metadata: body.metadata ?? {},
-    expiresAt: Math.floor(Date.now() / 1e3) + 3600
+    expiresAt
   });
 }
 function seedBeamLink(id, body, merchantId) {
@@ -2221,7 +2233,8 @@ function seedBeamLink(id, body, merchantId) {
     },
     redirectUrl: body.redirectUrl ? String(body.redirectUrl) : void 0,
     linkSettings: body.linkSettings,
-    collectDeliveryAddress: body.collectDeliveryAddress === true
+    collectDeliveryAddress: body.collectDeliveryAddress === true,
+    ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
   });
 }
 function deriveBoltIntentStatus(storedStatus, expiresAt, now3 = /* @__PURE__ */ new Date()) {
@@ -2523,6 +2536,16 @@ async function handlePaymentsRequest(request, url) {
     const linkId = beamProductsMatch[2];
     if (!linkId && request.method === "POST") {
       const body = await readJsonBody(request);
+      if ("idempotencyKey" in body) {
+        return payErr(
+          "idempotencyKey is not supported for Beam payment links.",
+          400,
+          "idempotency_unsupported"
+        );
+      }
+      if (typeof body.expiresAt === "string" && (!ISO_8601_WITH_ZONE.test(body.expiresAt) || Number.isNaN(Date.parse(body.expiresAt)))) {
+        return payErr("expiresAt must be an ISO 8601 timestamp", 400);
+      }
       const id = nextPaymentLinkId();
       const checkoutUrl = `https://beam.test/pay/${id}`;
       const captured = {
@@ -2535,7 +2558,11 @@ async function handlePaymentsRequest(request, url) {
       };
       state.checkouts.push(captured);
       seedBeamLink(id, body, merchantId);
-      return json({ id, url: checkoutUrl });
+      return json({
+        id,
+        url: checkoutUrl,
+        ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
+      });
     }
     if (linkId && request.method === "GET") {
       const link = state.paymentLinks.get(linkId);
@@ -2561,6 +2588,34 @@ async function handlePaymentsRequest(request, url) {
     }
     if (subPath === "checkout" && request.method === "POST") {
       const body = await readJsonBody(request);
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const requestedExpiry = typeof body.expiresAt === "number" ? body.expiresAt : void 0;
+      const callerKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0;
+      const scopedKey = callerKey ? JSON.stringify(["stripe", accountId, callerKey]) : void 0;
+      const comparable = { ...body };
+      delete comparable.deploymentId;
+      delete comparable.idempotencyKey;
+      const fingerprint = stableStringify(comparable);
+      if (scopedKey) {
+        const saved = state.idempotentCheckouts.get(scopedKey);
+        if (saved) {
+          if (saved.fingerprint !== fingerprint) {
+            return payErr(
+              "This idempotency key was already used with different checkout parameters. Use a new key for a different checkout.",
+              409,
+              "idempotency_conflict"
+            );
+          }
+          return json(saved.response);
+        }
+      }
+      if (requestedExpiry !== void 0 && (requestedExpiry < nowSeconds + STRIPE_MIN_EXPIRY_SECONDS || requestedExpiry > nowSeconds + STRIPE_MAX_EXPIRY_SECONDS)) {
+        return payErr(
+          "expiresAt must be between 30 minutes and 24 hours after the checkout is created (Unix seconds).",
+          400,
+          "expiry_out_of_range"
+        );
+      }
       const id = nextCheckoutId();
       const checkoutUrl = `https://checkout.stripe.test/c/pay/${id}`;
       const captured = {
@@ -2573,8 +2628,11 @@ async function handlePaymentsRequest(request, url) {
         createdAt: /* @__PURE__ */ new Date()
       };
       state.checkouts.push(captured);
-      seedStripeSession(id, body);
-      return json({ id, url: checkoutUrl });
+      const expiresAt = requestedExpiry ?? nowSeconds + STRIPE_MAX_EXPIRY_SECONDS;
+      seedStripeSession(id, body, expiresAt);
+      const response = { id, url: checkoutUrl, expiresAt };
+      if (scopedKey) state.idempotentCheckouts.set(scopedKey, { fingerprint, response });
+      return json(response);
     }
     const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
     if (sessionMatch && request.method === "GET") {
@@ -2739,6 +2797,7 @@ function createPayments() {
       state.checkouts = [];
       state.checkoutCounter = 0;
       state.sessionStatuses.clear();
+      state.idempotentCheckouts.clear();
       state.paymentLinks.clear();
       state.paymentFailures = [];
       state.products = [];

package/dist/next/headers-shim.js

@@ -62,6 +62,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],

package/dist/next/headers-shim.mjs

@@ -35,6 +35,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],

package/dist/setup.js

@@ -67,6 +67,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],
@@ -1536,6 +1537,8 @@ var requestScopeStorage = globalSingleton(
 var import_node_crypto4 = __toESM(require("crypto"));
 
 // src/simulator/payments.ts
+var STRIPE_MIN_EXPIRY_SECONDS = 30 * 60;
+var STRIPE_MAX_EXPIRY_SECONDS = 24 * 60 * 60;
 var BEAM_BOLT_PAYMENT_METHODS = [
   "CARD",
   "CARD_INSTALLMENTS",
@@ -1605,6 +1608,15 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var ISO_8601_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
 function nextCheckoutId() {
   state.checkoutCounter += 1;
   return `cs_test_${state.checkoutCounter}`;
@@ -1621,7 +1633,7 @@ function nextBoltIntentId() {
   state.boltIntentCounter += 1;
   return `bolti_${state.boltIntentCounter}`;
 }
-function seedStripeSession(id, body) {
+function seedStripeSession(id, body, expiresAt) {
   const lineItems = body.lineItems ?? [];
   let amountTotal = null;
   let currency = null;
@@ -1641,7 +1653,7 @@ function seedStripeSession(id, body) {
     currency,
     customerEmail: body.customerEmail ? String(body.customerEmail) : null,
     metadata: body.metadata ?? {},
-    expiresAt: Math.floor(Date.now() / 1e3) + 3600
+    expiresAt
   });
 }
 function seedBeamLink(id, body, merchantId) {
@@ -1661,7 +1673,8 @@ function seedBeamLink(id, body, merchantId) {
     },
     redirectUrl: body.redirectUrl ? String(body.redirectUrl) : void 0,
     linkSettings: body.linkSettings,
-    collectDeliveryAddress: body.collectDeliveryAddress === true
+    collectDeliveryAddress: body.collectDeliveryAddress === true,
+    ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
   });
 }
 function deriveBoltIntentStatus(storedStatus, expiresAt, now3 = /* @__PURE__ */ new Date()) {
@@ -1932,6 +1945,16 @@ async function handlePaymentsRequest(request, url) {
     const linkId = beamProductsMatch[2];
     if (!linkId && request.method === "POST") {
       const body = await readJsonBody(request);
+      if ("idempotencyKey" in body) {
+        return payErr(
+          "idempotencyKey is not supported for Beam payment links.",
+          400,
+          "idempotency_unsupported"
+        );
+      }
+      if (typeof body.expiresAt === "string" && (!ISO_8601_WITH_ZONE.test(body.expiresAt) || Number.isNaN(Date.parse(body.expiresAt)))) {
+        return payErr("expiresAt must be an ISO 8601 timestamp", 400);
+      }
       const id = nextPaymentLinkId();
       const checkoutUrl = `https://beam.test/pay/${id}`;
       const captured = {
@@ -1944,7 +1967,11 @@ async function handlePaymentsRequest(request, url) {
       };
       state.checkouts.push(captured);
       seedBeamLink(id, body, merchantId);
-      return json({ id, url: checkoutUrl });
+      return json({
+        id,
+        url: checkoutUrl,
+        ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
+      });
     }
     if (linkId && request.method === "GET") {
       const link = state.paymentLinks.get(linkId);
@@ -1970,6 +1997,34 @@ async function handlePaymentsRequest(request, url) {
     }
     if (subPath === "checkout" && request.method === "POST") {
       const body = await readJsonBody(request);
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const requestedExpiry = typeof body.expiresAt === "number" ? body.expiresAt : void 0;
+      const callerKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0;
+      const scopedKey = callerKey ? JSON.stringify(["stripe", accountId, callerKey]) : void 0;
+      const comparable = { ...body };
+      delete comparable.deploymentId;
+      delete comparable.idempotencyKey;
+      const fingerprint = stableStringify(comparable);
+      if (scopedKey) {
+        const saved = state.idempotentCheckouts.get(scopedKey);
+        if (saved) {
+          if (saved.fingerprint !== fingerprint) {
+            return payErr(
+              "This idempotency key was already used with different checkout parameters. Use a new key for a different checkout.",
+              409,
+              "idempotency_conflict"
+            );
+          }
+          return json(saved.response);
+        }
+      }
+      if (requestedExpiry !== void 0 && (requestedExpiry < nowSeconds + STRIPE_MIN_EXPIRY_SECONDS || requestedExpiry > nowSeconds + STRIPE_MAX_EXPIRY_SECONDS)) {
+        return payErr(
+          "expiresAt must be between 30 minutes and 24 hours after the checkout is created (Unix seconds).",
+          400,
+          "expiry_out_of_range"
+        );
+      }
       const id = nextCheckoutId();
       const checkoutUrl = `https://checkout.stripe.test/c/pay/${id}`;
       const captured = {
@@ -1982,8 +2037,11 @@ async function handlePaymentsRequest(request, url) {
         createdAt: /* @__PURE__ */ new Date()
       };
       state.checkouts.push(captured);
-      seedStripeSession(id, body);
-      return json({ id, url: checkoutUrl });
+      const expiresAt = requestedExpiry ?? nowSeconds + STRIPE_MAX_EXPIRY_SECONDS;
+      seedStripeSession(id, body, expiresAt);
+      const response = { id, url: checkoutUrl, expiresAt };
+      if (scopedKey) state.idempotentCheckouts.set(scopedKey, { fingerprint, response });
+      return json(response);
     }
     const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
     if (sessionMatch && request.method === "GET") {

package/dist/setup.mjs

@@ -43,6 +43,7 @@ var state = globalSingleton("state", () => ({
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
+  idempotentCheckouts: /* @__PURE__ */ new Map(),
   paymentLinks: /* @__PURE__ */ new Map(),
   paymentFailures: [],
   products: [],
@@ -1512,6 +1513,8 @@ var requestScopeStorage = globalSingleton(
 import crypto4 from "crypto";
 
 // src/simulator/payments.ts
+var STRIPE_MIN_EXPIRY_SECONDS = 30 * 60;
+var STRIPE_MAX_EXPIRY_SECONDS = 24 * 60 * 60;
 var BEAM_BOLT_PAYMENT_METHODS = [
   "CARD",
   "CARD_INSTALLMENTS",
@@ -1581,6 +1584,15 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+var ISO_8601_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
 function nextCheckoutId() {
   state.checkoutCounter += 1;
   return `cs_test_${state.checkoutCounter}`;
@@ -1597,7 +1609,7 @@ function nextBoltIntentId() {
   state.boltIntentCounter += 1;
   return `bolti_${state.boltIntentCounter}`;
 }
-function seedStripeSession(id, body) {
+function seedStripeSession(id, body, expiresAt) {
   const lineItems = body.lineItems ?? [];
   let amountTotal = null;
   let currency = null;
@@ -1617,7 +1629,7 @@ function seedStripeSession(id, body) {
     currency,
     customerEmail: body.customerEmail ? String(body.customerEmail) : null,
     metadata: body.metadata ?? {},
-    expiresAt: Math.floor(Date.now() / 1e3) + 3600
+    expiresAt
   });
 }
 function seedBeamLink(id, body, merchantId) {
@@ -1637,7 +1649,8 @@ function seedBeamLink(id, body, merchantId) {
     },
     redirectUrl: body.redirectUrl ? String(body.redirectUrl) : void 0,
     linkSettings: body.linkSettings,
-    collectDeliveryAddress: body.collectDeliveryAddress === true
+    collectDeliveryAddress: body.collectDeliveryAddress === true,
+    ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
   });
 }
 function deriveBoltIntentStatus(storedStatus, expiresAt, now3 = /* @__PURE__ */ new Date()) {
@@ -1908,6 +1921,16 @@ async function handlePaymentsRequest(request, url) {
     const linkId = beamProductsMatch[2];
     if (!linkId && request.method === "POST") {
       const body = await readJsonBody(request);
+      if ("idempotencyKey" in body) {
+        return payErr(
+          "idempotencyKey is not supported for Beam payment links.",
+          400,
+          "idempotency_unsupported"
+        );
+      }
+      if (typeof body.expiresAt === "string" && (!ISO_8601_WITH_ZONE.test(body.expiresAt) || Number.isNaN(Date.parse(body.expiresAt)))) {
+        return payErr("expiresAt must be an ISO 8601 timestamp", 400);
+      }
       const id = nextPaymentLinkId();
       const checkoutUrl = `https://beam.test/pay/${id}`;
       const captured = {
@@ -1920,7 +1943,11 @@ async function handlePaymentsRequest(request, url) {
       };
       state.checkouts.push(captured);
       seedBeamLink(id, body, merchantId);
-      return json({ id, url: checkoutUrl });
+      return json({
+        id,
+        url: checkoutUrl,
+        ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {}
+      });
     }
     if (linkId && request.method === "GET") {
       const link = state.paymentLinks.get(linkId);
@@ -1946,6 +1973,34 @@ async function handlePaymentsRequest(request, url) {
     }
     if (subPath === "checkout" && request.method === "POST") {
       const body = await readJsonBody(request);
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const requestedExpiry = typeof body.expiresAt === "number" ? body.expiresAt : void 0;
+      const callerKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0;
+      const scopedKey = callerKey ? JSON.stringify(["stripe", accountId, callerKey]) : void 0;
+      const comparable = { ...body };
+      delete comparable.deploymentId;
+      delete comparable.idempotencyKey;
+      const fingerprint = stableStringify(comparable);
+      if (scopedKey) {
+        const saved = state.idempotentCheckouts.get(scopedKey);
+        if (saved) {
+          if (saved.fingerprint !== fingerprint) {
+            return payErr(
+              "This idempotency key was already used with different checkout parameters. Use a new key for a different checkout.",
+              409,
+              "idempotency_conflict"
+            );
+          }
+          return json(saved.response);
+        }
+      }
+      if (requestedExpiry !== void 0 && (requestedExpiry < nowSeconds + STRIPE_MIN_EXPIRY_SECONDS || requestedExpiry > nowSeconds + STRIPE_MAX_EXPIRY_SECONDS)) {
+        return payErr(
+          "expiresAt must be between 30 minutes and 24 hours after the checkout is created (Unix seconds).",
+          400,
+          "expiry_out_of_range"
+        );
+      }
       const id = nextCheckoutId();
       const checkoutUrl = `https://checkout.stripe.test/c/pay/${id}`;
       const captured = {
@@ -1958,8 +2013,11 @@ async function handlePaymentsRequest(request, url) {
         createdAt: /* @__PURE__ */ new Date()
       };
       state.checkouts.push(captured);
-      seedStripeSession(id, body);
-      return json({ id, url: checkoutUrl });
+      const expiresAt = requestedExpiry ?? nowSeconds + STRIPE_MAX_EXPIRY_SECONDS;
+      seedStripeSession(id, body, expiresAt);
+      const response = { id, url: checkoutUrl, expiresAt };
+      if (scopedKey) state.idempotentCheckouts.set(scopedKey, { fingerprint, response });
+      return json(response);
     }
     const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
     if (sessionMatch && request.method === "GET") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/testing",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Vitest test harness for Stardeck customer apps — in-process Postgres (PGlite) plus a control-plane simulator so the real Stardeck SDKs run unmodified in tests",
   "main": "dist/index.js",
   "module": "dist/index.mjs",