@stardeck-customer-apps/testing 0.26.0 → 0.28.0

package/dist/index.mjs

@@ -318,6 +318,11 @@ var state = globalSingleton("state", () => ({
   cardTokens: /* @__PURE__ */ new Map(),
   cardTokenCounter: 0,
   cardTokenizationEnabled: true,
+  stripePaymentIntents: /* @__PURE__ */ new Map(),
+  stripePaymentIntentCounter: 0,
+  stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeAllowedMethods: ["card", "promptpay"],
+  stripeChargesEnabled: true,
   uploads: [],
   uploadCounter: 0,
   storageFiles: /* @__PURE__ */ new Map(),
@@ -337,6 +342,14 @@ var state = globalSingleton("state", () => ({
   starlensCalls: [],
   starlensReplies: [],
   starlensDefaultReply: null,
+  controls: {
+    seed: {},
+    values: {},
+    unavailable: /* @__PURE__ */ new Set(),
+    lastUsage: null,
+    writes: [],
+    refusal: null
+  },
   allowNetwork: false
 }));
 function requireDb() {
@@ -784,8 +797,8 @@ async function handleNeonSql(db, request) {
       rowAsArray: arrayMode
     });
   } catch (error) {
-    const err = error;
-    return json({ message: err.message, code: err.code }, 400);
+    const err2 = error;
+    return json({ message: err2.message, code: err2.code }, 400);
   }
 }
 
@@ -2078,6 +2091,348 @@ function decodeNextRedirect(error) {
   return new Response(null, { status, headers: { location } });
 }
 
+// src/simulator/stripe-payment-intents.ts
+var SIM_STRIPE_PUBLISHABLE_KEY = "pk_test_sim_stripe";
+var SIM_STRIPE_DEFAULT_ACCOUNT = "acct_sim_default";
+var METHODS = ["card", "promptpay"];
+var RESERVED_METADATA_KEYS = ["projectId", "stardeckReferenceId", "stardeckStagingDeploymentId"];
+var PROMPTPAY_QR_TTL_SECONDS = 15 * 60;
+var PATH_RE = /^\/api\/store\/(?!beam\/)([^/]+)\/(payment-intents(?:\/([^/]+)(?:\/(cancel))?)?|elements-config|readiness)$/;
+function err(error, status, code) {
+  return json({ error, code }, status);
+}
+function decode(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function isPlayground(account) {
+  return account === "playground";
+}
+function resolveAccount(account) {
+  if (isPlayground(account)) return null;
+  if (account === "default") {
+    return process.env.STRIPE_CONNECT_ACCOUNT_ID || SIM_STRIPE_DEFAULT_ACCOUNT;
+  }
+  return account;
+}
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var APP_METADATA_MAX_KEYS = 50 - RESERVED_METADATA_KEYS.length;
+function isStringRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function isValidMetadata(value) {
+  if (!isStringRecord(value)) return false;
+  const entries = Object.entries(value);
+  return entries.length <= APP_METADATA_MAX_KEYS && entries.every(([k, v]) => k.length >= 1 && k.length <= 40 && v.length <= 500);
+}
+function isOptional(value, test) {
+  return value === void 0 || test(value);
+}
+var isEmail = (v) => typeof v === "string" && EMAIL_RE.test(v);
+function validateCreate(body) {
+  const { amount, currency, method, referenceId, idempotencyKey } = body;
+  const checks = [
+    [
+      typeof amount === "number" && Number.isInteger(amount) && amount > 0,
+      "amount must be a positive integer in minor units"
+    ],
+    [typeof currency === "string" && currency.length === 3, "currency must be a 3-letter ISO code"],
+    [
+      typeof method === "string" && METHODS.includes(method),
+      `method must be one of: ${METHODS.join(", ")}`
+    ],
+    [
+      typeof referenceId === "string" && referenceId.length >= 1 && referenceId.length <= 200,
+      "referenceId must be 1 to 200 characters"
+    ],
+    [
+      typeof idempotencyKey === "string" && idempotencyKey.length >= 1 && idempotencyKey.length <= 200,
+      "idempotencyKey is required (1 to 200 characters)"
+    ],
+    [
+      isOptional(body.description, (v) => typeof v === "string" && v.length <= 1e3),
+      "description must be at most 1000 characters"
+    ],
+    [isOptional(body.receiptEmail, isEmail), "receiptEmail must be an email address"],
+    [isOptional(body.billingEmail, isEmail), "billingEmail must be an email address"],
+    [
+      isOptional(body.returnUrl, (v) => typeof v === "string" && URL.canParse(v)),
+      "returnUrl must be an absolute URL"
+    ],
+    [
+      isOptional(body.metadata, isValidMetadata),
+      `metadata must map keys (1-40 chars) to strings (max 500), at most ${APP_METADATA_MAX_KEYS} keys`
+    ],
+    [
+      typeof body.deploymentId === "string" && UUID_RE2.test(body.deploymentId),
+      "Invalid deployment ID"
+    ]
+  ];
+  const failed = checks.find(([ok]) => !ok);
+  return failed ? failed[1] : null;
+}
+function appMetadata(raw) {
+  if (!isStringRecord(raw)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (!RESERVED_METADATA_KEYS.includes(key)) out[key] = value;
+  }
+  return out;
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function toStripePaymentIntentSummary(intent) {
+  const open = intent.status !== "succeeded" && intent.status !== "canceled";
+  let actionRequired = "NONE";
+  if (open && intent.method === "card") actionRequired = "CLIENT_CONFIRM";
+  if (open && intent.method === "promptpay" && intent.status === "requires_action") {
+    actionRequired = "ENCODED_IMAGE";
+  }
+  return {
+    id: intent.id,
+    status: intent.status,
+    amount: intent.amount,
+    currency: intent.currency,
+    method: intent.method,
+    referenceId: intent.referenceId,
+    metadata: { ...intent.appMetadata },
+    actionRequired,
+    clientSecret: intent.method === "card" ? intent.clientSecret : null,
+    qr: actionRequired === "ENCODED_IMAGE" ? { ...intent.qr } : null,
+    latestChargeId: intent.latestChargeId,
+    amountRefunded: intent.amountRefunded,
+    lastPaymentError: intent.lastPaymentError ? { ...intent.lastPaymentError } : null,
+    created: intent.created,
+    livemode: false,
+    playground: intent.playground
+  };
+}
+function promptPayQr(id, created) {
+  return {
+    imageUrlPng: `https://qr.stripe.test/${id}.png`,
+    imageUrlSvg: `https://qr.stripe.test/${id}.svg`,
+    data: `00020101021230SIM${id}`,
+    hostedInstructionsUrl: `https://payments.stripe.test/promptpay/${id}`,
+    expiresAt: created + PROMPTPAY_QR_TTL_SECONDS
+  };
+}
+function createIntent(body, account, projectId) {
+  const problem = validateCreate(body);
+  if (problem) return err(problem, 400, "invalid_request");
+  const method = body.method;
+  const currency = body.currency.toLowerCase();
+  if (!state.stripeAllowedMethods.includes(method)) {
+    return err(
+      `The ${method} payment method is turned off for this account`,
+      422,
+      "method_not_allowed"
+    );
+  }
+  if (method === "promptpay" && currency !== "thb") {
+    return err("PromptPay only takes THB", 422, "currency_not_supported");
+  }
+  if (!state.stripeChargesEnabled) {
+    return err("This Stripe account can't take payments yet", 503, "account_not_ready");
+  }
+  const scopedKey = JSON.stringify(["pi", projectId, account, body.idempotencyKey]);
+  const comparable = { ...body };
+  delete comparable.deploymentId;
+  delete comparable.idempotencyKey;
+  const fingerprint = stableStringify(comparable);
+  const saved = state.stripeIdempotentIntents.get(scopedKey);
+  if (saved) {
+    if (saved.fingerprint !== fingerprint) {
+      return err(
+        "This idempotency key was already used with different parameters. Use a new key for a different payment.",
+        409,
+        "idempotency_conflict"
+      );
+    }
+    const existing = state.stripePaymentIntents.get(saved.id);
+    return json({ paymentIntent: toStripePaymentIntentSummary(existing) }, 201);
+  }
+  state.stripePaymentIntentCounter += 1;
+  const id = `pi_sim_${state.stripePaymentIntentCounter}`;
+  const created = Math.floor(Date.now() / 1e3);
+  const referenceId = body.referenceId;
+  const metadata = appMetadata(body.metadata);
+  const intent = {
+    id,
+    projectId,
+    account,
+    connectedAccountId: resolveAccount(account),
+    playground: isPlayground(account),
+    status: method === "card" ? "requires_payment_method" : "requires_action",
+    amount: body.amount,
+    currency,
+    method,
+    referenceId,
+    appMetadata: metadata,
+    metadata: { ...metadata, projectId, stardeckReferenceId: referenceId },
+    description: typeof body.description === "string" ? body.description : null,
+    receiptEmail: typeof body.receiptEmail === "string" ? body.receiptEmail : null,
+    returnUrl: typeof body.returnUrl === "string" ? body.returnUrl : null,
+    clientSecret: `${id}_secret_sim`,
+    qr: method === "promptpay" ? promptPayQr(id, created) : null,
+    latestChargeId: null,
+    amountRefunded: 0,
+    lastPaymentError: null,
+    created
+  };
+  state.stripePaymentIntents.set(id, intent);
+  state.stripeIdempotentIntents.set(scopedKey, { fingerprint, id });
+  console.log(
+    `[stardeck-testing] stripe payment intent ${id} created method=${method} amount=${intent.amount} ${currency}`
+  );
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) }, 201);
+}
+function ownedIntent(id, projectId) {
+  const intent = state.stripePaymentIntents.get(id);
+  return intent && intent.projectId === projectId ? intent : void 0;
+}
+function cancelIntent(intent) {
+  if (intent.status === "succeeded") {
+    return err("This payment already succeeded and can't be canceled", 409, "already_succeeded");
+  }
+  intent.status = "canceled";
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+}
+function handleIntents(request, url, account, intentId, action, projectId) {
+  if (!intentId && request.method === "POST") {
+    return readJsonBody(request).then((body) => createIntent(body, account, projectId));
+  }
+  if (!intentId && request.method === "GET") {
+    const referenceId = url.searchParams.get("referenceId");
+    if (!referenceId) return err("referenceId is required", 400, "invalid_request");
+    const paymentIntents = [...state.stripePaymentIntents.values()].filter((i) => i.projectId === projectId && i.referenceId === referenceId).map(toStripePaymentIntentSummary);
+    return json({ paymentIntents });
+  }
+  if (!intentId) return null;
+  const intent = ownedIntent(decode(intentId), projectId);
+  if (!action && request.method === "GET") {
+    if (!intent) return err("Payment intent not found", 404, "not_found");
+    return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+  }
+  if (action === "cancel" && request.method === "POST") {
+    return readJsonBody(request).then((body) => {
+      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+        return err("deploymentId is required", 400, "invalid_request");
+      }
+      if (!intent) return err("Payment intent not found", 404, "not_found");
+      return cancelIntent(intent);
+    });
+  }
+  return null;
+}
+async function handleStripePaymentIntentRequest(request, url, projectId) {
+  const match = url.pathname.match(PATH_RE);
+  if (!match) return null;
+  if (!projectId) return err("Missing authentication", 401, "unauthorized");
+  const account = decode(match[1]);
+  const resource = match[2];
+  if (request.method === "GET" && !url.searchParams.get("deploymentId")) {
+    return err("deploymentId is required", 400, "invalid_request");
+  }
+  if (resource === "elements-config" && request.method === "GET") {
+    return json({
+      publishableKey: SIM_STRIPE_PUBLISHABLE_KEY,
+      stripeAccount: resolveAccount(account),
+      playground: isPlayground(account)
+    });
+  }
+  if (resource === "readiness" && request.method === "GET") {
+    const methods = [...state.stripeAllowedMethods];
+    return json({
+      provider: "stripe",
+      ready: state.stripeChargesEnabled && methods.length > 0,
+      chargesEnabled: state.stripeChargesEnabled,
+      methods,
+      playground: isPlayground(account)
+    });
+  }
+  if (resource.startsWith("payment-intents")) {
+    return handleIntents(request, url, account, match[3], match[4], projectId);
+  }
+  return null;
+}
+function requireIntent(id) {
+  const intent = state.stripePaymentIntents.get(id);
+  if (!intent) throw new Error(`[stardeck-testing] Unknown payment intent id: ${id}`);
+  return intent;
+}
+function requireOpenIntent(id, verb) {
+  const intent = requireIntent(id);
+  if (intent.status === "succeeded" || intent.status === "canceled") {
+    throw new Error(
+      `[stardeck-testing] Can't ${verb} payment intent ${id}: it is ${intent.status}`
+    );
+  }
+  return intent;
+}
+function succeedStripePaymentIntent(id) {
+  const intent = requireOpenIntent(id, "mark paid");
+  intent.status = "succeeded";
+  intent.latestChargeId = `ch_sim_${id}`;
+  intent.lastPaymentError = null;
+}
+function failStripePaymentIntent(id, code) {
+  const intent = requireOpenIntent(id, "fail");
+  intent.status = "requires_payment_method";
+  intent.latestChargeId = `ch_sim_${id}_failed`;
+  intent.lastPaymentError = {
+    code,
+    declineCode: code === "card_declined" ? "generic_decline" : null,
+    message: `Simulated payment failure: ${code}`
+  };
+}
+function cancelStripePaymentIntentById(id) {
+  const intent = requireOpenIntent(id, "cancel");
+  intent.status = "canceled";
+}
+function stripePaymentIntentEvent(id) {
+  const intent = requireIntent(id);
+  let type;
+  if (intent.status === "succeeded") type = "payment_intent.succeeded";
+  else if (intent.status === "canceled") type = "payment_intent.canceled";
+  else if (intent.lastPaymentError) type = "payment_intent.payment_failed";
+  else {
+    throw new Error(
+      `[stardeck-testing] Payment intent ${id} is ${intent.status}; call markPaid, failPayment or cancelPayment first`
+    );
+  }
+  const error = intent.lastPaymentError;
+  return {
+    type,
+    accountId: intent.connectedAccountId ?? "acct_stardeck_playground",
+    data: {
+      id: intent.id,
+      object: "payment_intent",
+      amount: intent.amount,
+      amount_received: intent.status === "succeeded" ? intent.amount : 0,
+      currency: intent.currency,
+      status: intent.status,
+      metadata: { ...intent.metadata },
+      payment_method_types: [intent.method],
+      latest_charge: intent.latestChargeId,
+      last_payment_error: error ? { code: error.code, decline_code: error.declineCode, message: error.message } : null,
+      description: intent.description,
+      receipt_email: intent.receiptEmail,
+      created: intent.created,
+      livemode: false
+    }
+  };
+}
+
 // src/simulator/webhook-signing.ts
 import crypto4 from "crypto";
 function signEventDelivery(secret, context, rawBody) {
@@ -2111,7 +2466,7 @@ var BEAM_BOLT_PAYMENT_METHODS = [
   "SPAY_LATER"
 ];
 var BEAM_BOLT_INTENT_STATUSES = ["PENDING", "PAID", "FAILED", "CANCELED", "EXPIRED"];
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function payErr(error, status = 400, code, details) {
   const body = { error };
   if (code) body.code = code;
@@ -2137,7 +2492,23 @@ function paymentOperationForRequest(request, pathname) {
   if (request.method === "GET" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout-sessions\/[^/]+$/.test(pathname)) {
     return "stripe.getCheckoutSessionStatus";
   }
-  return null;
+  return stripeInlineOperation(request.method, pathname);
+}
+var STRIPE_INLINE_OPERATIONS = [
+  ["POST", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.createPaymentIntent"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.findPaymentIntents"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+$/, "stripe.getPaymentIntent"],
+  [
+    "POST",
+    /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+\/cancel$/,
+    "stripe.cancelPaymentIntent"
+  ],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/elements-config$/, "stripe.getElementsConfig"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/readiness$/, "stripe.getReadiness"]
+];
+function stripeInlineOperation(method, pathname) {
+  const hit = STRIPE_INLINE_OPERATIONS.find(([m, re]) => m === method && re.test(pathname));
+  return hit ? hit[2] : null;
 }
 function consumePaymentFailure(request, pathname) {
   const operation = paymentOperationForRequest(request, pathname);
@@ -2167,11 +2538,11 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
-function stableStringify(value) {
-  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+function stableStringify2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify2).join(",")}]`;
   if (value && typeof value === "object") {
     const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify2(v)}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
@@ -2312,10 +2683,16 @@ async function deliverEvent(envelope, handler, options) {
     body: envelope
   });
 }
-async function handlePaymentsRequest(request, url) {
+async function handlePaymentsRequest(request, url, signedProjectId = null) {
   const pathname = url.pathname;
   const injectedFailure = consumePaymentFailure(request, pathname);
   if (injectedFailure) return injectedFailure;
+  const inlineStripeResponse = await handleStripePaymentIntentRequest(
+    request,
+    url,
+    signedProjectId
+  );
+  if (inlineStripeResponse) return inlineStripeResponse;
   const directChargeResponse = await handleDirectChargeRequest(request, pathname);
   if (directChargeResponse) return directChargeResponse;
   if (/\/billing-portal$/.test(pathname)) {
@@ -2414,7 +2791,7 @@ async function handlePaymentsRequest(request, url) {
           code: "too_small"
         });
       }
-      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+      if (typeof body.deploymentId !== "string" || !UUID_RE3.test(body.deploymentId)) {
         issues.push({
           path: ["deploymentId"],
           message: "Invalid uuid",
@@ -2598,7 +2975,7 @@ async function handlePaymentsRequest(request, url) {
       const comparable = { ...body };
       delete comparable.deploymentId;
       delete comparable.idempotencyKey;
-      const fingerprint = stableStringify(comparable);
+      const fingerprint = stableStringify2(comparable);
       if (scopedKey) {
         const saved = state.idempotentCheckouts.get(scopedKey);
         if (saved) {
@@ -2673,6 +3050,10 @@ function createPayments() {
       state.paymentFailures.push({ operation, failure: failure2 });
     },
     markPaid(id) {
+      if (state.stripePaymentIntents.has(id)) {
+        succeedStripePaymentIntent(id);
+        return;
+      }
       const session = state.sessionStatuses.get(id);
       if (session) {
         session.status = "complete";
@@ -2700,7 +3081,26 @@ function createPayments() {
       }
       link.status = status;
     },
-    async deliverStripeEvent(handler, event, options) {
+    failPayment(paymentIntentId, code = "card_declined") {
+      failStripePaymentIntent(paymentIntentId, code);
+    },
+    cancelPayment(paymentIntentId) {
+      cancelStripePaymentIntentById(paymentIntentId);
+    },
+    get stripePaymentIntents() {
+      return [...state.stripePaymentIntents.values()];
+    },
+    getStripePaymentIntent(paymentIntentId) {
+      return state.stripePaymentIntents.get(paymentIntentId);
+    },
+    setStripePaymentMethods(methods) {
+      state.stripeAllowedMethods = [...methods];
+    },
+    setStripeChargesEnabled(enabled) {
+      state.stripeChargesEnabled = enabled;
+    },
+    async deliverStripeEvent(handler, input, options) {
+      const event = "paymentIntentId" in input ? stripePaymentIntentEvent(input.paymentIntentId) : input;
       const envelope = {
         id: `evt_test_${crypto5.randomUUID()}`,
         kind: "stripe_webhook",
@@ -2816,6 +3216,11 @@ function createPayments() {
       state.cardTokens.clear();
       state.cardTokenCounter = 0;
       state.cardTokenizationEnabled = true;
+      state.stripePaymentIntents.clear();
+      state.stripePaymentIntentCounter = 0;
+      state.stripeIdempotentIntents.clear();
+      state.stripeAllowedMethods = ["card", "promptpay"];
+      state.stripeChargesEnabled = true;
     },
     get count() {
       return state.checkouts.length;
@@ -3588,6 +3993,141 @@ function createEdge() {
   };
 }
 
+// src/simulator/controls.ts
+var CONTROLS_STATE_SYMBOL = /* @__PURE__ */ Symbol.for("stardeck.controls.state");
+var USER_TOKEN_HEADER = "x-stardeck-user-token";
+var DEFAULTS = {
+  "flag.paymentsSetupStep": false,
+  "plan.locations": { included: 3, max: null, extraMonthly: { amount: 990, currency: "THB" } },
+  "plan.multiEntity": true,
+  "payments.provider": "beam",
+  "payments.methods": { card: true, promptPay: true }
+};
+var REFUSAL_STATUS = {
+  NOT_WRITABLE: 400,
+  INVALID_VALUE: 400,
+  UNAUTHENTICATED: 401,
+  FORBIDDEN: 403,
+  WRITE_NOT_ALLOWED_HERE: 403,
+  PROVIDER_NOT_READY: 409,
+  UNAVAILABLE: 503
+};
+var controlsModule = null;
+function loadControls() {
+  controlsModule ??= import("@stardeck-customer-apps/controls");
+  return controlsModule;
+}
+function resetControlsClientCache() {
+  const clientState = globalThis[CONTROLS_STATE_SYMBOL];
+  clientState?.reset?.();
+}
+function initControls(seed) {
+  state.controls.seed = { ...seed };
+  restoreControls();
+}
+function restoreControls() {
+  state.controls.values = { ...DEFAULTS, ...state.controls.seed };
+  state.controls.unavailable = /* @__PURE__ */ new Set();
+  state.controls.lastUsage = null;
+  state.controls.writes = [];
+  state.controls.refusal = null;
+  resetControlsClientCache();
+}
+function clearControls() {
+  restoreControls();
+}
+function currentControlsBody() {
+  const controls = {};
+  for (const [key, value] of Object.entries(state.controls.values)) {
+    controls[key] = state.controls.unavailable.has(key) ? { ok: false, reason: "unavailable (simulated)" } : { ok: true, value };
+  }
+  return controls;
+}
+function refusalResponse(refusal) {
+  return json({ error: refusal }, REFUSAL_STATUS[refusal.code]);
+}
+function handleSync(body) {
+  const usage = body.usage;
+  if (typeof usage === "object" && usage !== null) {
+    const locations = usage.locations;
+    state.controls.lastUsage = typeof locations === "number" && Number.isInteger(locations) && locations >= 0 ? { locations } : {};
+  }
+  return json({ controls: currentControlsBody() });
+}
+async function handleWrite(request, key) {
+  const { CONTROLS, isWritableControl } = await loadControls();
+  if (!isWritableControl(key)) {
+    return refusalResponse({
+      code: "NOT_WRITABLE",
+      message: `${key} cannot be changed from the app`
+    });
+  }
+  const userToken = request.headers.get(USER_TOKEN_HEADER);
+  if (!userToken) {
+    return refusalResponse({
+      code: "UNAUTHENTICATED",
+      message: "A signed-in person is required (X-Stardeck-User-Token)"
+    });
+  }
+  const body = await readJsonBody(request);
+  const parsed = CONTROLS[key].schema.safeParse(body.value);
+  if (!parsed.success) {
+    return refusalResponse({
+      code: "INVALID_VALUE",
+      message: parsed.error.issues[0]?.message ?? "Invalid value"
+    });
+  }
+  const refusal = state.controls.refusal;
+  if (refusal) {
+    state.controls.refusal = null;
+    return refusalResponse(refusal);
+  }
+  state.controls.values[key] = parsed.data;
+  state.controls.unavailable.delete(key);
+  state.controls.writes.push({ key, value: parsed.data, userToken });
+  return json({ controls: currentControlsBody() });
+}
+var CONTROLS_PATH = /^\/api\/deployments\/[^/]+\/controls(?:\/([^/]+))?$/;
+async function handleControlsRequest(request, url) {
+  const match = url.pathname.match(CONTROLS_PATH);
+  const key = match?.[1] ? decodeURIComponent(match[1]) : null;
+  if (!key && request.method === "POST") {
+    return handleSync(await readJsonBody(request));
+  }
+  if (key && request.method === "PUT") {
+    return handleWrite(request, key);
+  }
+  return json(
+    {
+      error: { code: "UNAVAILABLE", message: `No simulator for ${request.method} ${url.pathname}` }
+    },
+    404
+  );
+}
+function createControls() {
+  return {
+    set(key, value) {
+      state.controls.values[key] = value;
+      state.controls.unavailable.delete(key);
+      resetControlsClientCache();
+    },
+    setUnavailable(key) {
+      state.controls.unavailable.add(key);
+      resetControlsClientCache();
+    },
+    lastUsage() {
+      return state.controls.lastUsage;
+    },
+    writes() {
+      return state.controls.writes;
+    },
+    refuseNextWrite(refusal) {
+      state.controls.refusal = refusal;
+    },
+    clear: restoreControls
+  };
+}
+
 // src/simulator/schedules.ts
 async function handleScheduleWake(request, scheduleKey) {
   if (request.method !== "POST") return failure(`Method ${request.method} not allowed`, 405);
@@ -3770,7 +4310,7 @@ function requiresDeploymentHmac(request, url) {
     return !isPresignedPut;
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -3779,8 +4319,10 @@ function requiresDeploymentHmac(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStarlens = url.pathname === "/api/starlens/extract";
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
-  return !!(isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
+  const controlsMatch = url.pathname.match(CONTROLS_PATH2);
+  return !!(controlsMatch || isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail2 || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
+var CONTROLS_PATH2 = /^\/api\/deployments\/[^/]+\/controls(\/[^/]+)?$/;
 var SCHEDULE_WAKE_PATH = /^\/api\/deployments\/[^/]+\/schedules\/([^/]+)\/wake$/;
 function deploymentIdFromPath(url) {
   const match = url.pathname.match(/\/api\/deployments\/([^/]+)(?:\/|$)/);
@@ -3802,7 +4344,7 @@ async function handleSimulatedRequest(request, url) {
     return authMatch[1].endsWith("verify") ? handleAuthVerify(request) : handleAuthRefresh(request);
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -3811,6 +4353,7 @@ async function handleSimulatedRequest(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStorageHost = url.hostname === STORAGE_TEST_HOST;
   let signedDeploymentId = null;
+  let signedProjectId = null;
   if (requiresDeploymentHmac(request, url)) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
@@ -3823,6 +4366,7 @@ async function handleSimulatedRequest(request, url) {
       return failure("Invalid authentication", 401);
     }
     signedDeploymentId = authPayload.deploymentId;
+    signedProjectId = authPayload.projectId;
   }
   if (isStorageHost) {
     return handleStorageRequest(request, url);
@@ -3830,14 +4374,14 @@ async function handleSimulatedRequest(request, url) {
   if (url.hostname === SIM_BEAM_HOST) {
     return handleCardTokenRequest(request, url);
   }
-  if (isEmail && request.method === "POST") {
+  if (isEmail2 && request.method === "POST") {
     return handleEmailSend(request);
   }
   if (identitiesMatch) {
     return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
   }
   if (storeMatch) {
-    return handlePaymentsRequest(request, url);
+    return handlePaymentsRequest(request, url, signedProjectId);
   }
   if (messagingMatch) {
     const channel = messagingMatch[1];
@@ -3846,6 +4390,9 @@ async function handleSimulatedRequest(request, url) {
   if (edgeMatch) {
     return handleEdgeRequest(request, edgeMatch[1] ?? "");
   }
+  if (CONTROLS_PATH2.test(url.pathname)) {
+    return handleControlsRequest(request, url);
+  }
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
   if (scheduleWakeMatch) {
     return handleScheduleWake(request, decodeURIComponent(scheduleWakeMatch[1]));
@@ -3874,7 +4421,7 @@ async function handleSimulatedRequest(request, url) {
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, app controls sync/write, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
     404
   );
 }
@@ -4023,6 +4570,7 @@ async function createTestApp(options = {}) {
   const initialLiffId = options.liffId ?? null;
   state.liffId = initialLiffId;
   installFetchRouter();
+  initControls(options.controls);
   const schemaSql = loadSchemaSql(options) ?? "";
   const db = await bootWithSchema(schemaSql);
   state.db = db;
@@ -4054,6 +4602,7 @@ async function createTestApp(options = {}) {
   const edge = createEdge();
   const starlens = createStarlens();
   const schedules = createSchedules();
+  const controls = createControls();
   const app = {
     db,
     inbox,
@@ -4064,6 +4613,7 @@ async function createTestApp(options = {}) {
     edge,
     starlens,
     schedules,
+    controls,
     async query(sql, params = []) {
       const result = await db.query(sql, params);
       return result.rows;
@@ -4113,6 +4663,7 @@ async function createTestApp(options = {}) {
       edge.clear();
       starlens.clear();
       schedules.clear();
+      clearControls();
     },
     async close() {
       state.db = null;
@@ -4129,6 +4680,7 @@ async function createTestApp(options = {}) {
       edge.clear();
       starlens.clear();
       schedules.clear();
+      clearControls();
       uninstallFetchRouter();
       await db.close();
     }