@stardeck-customer-apps/testing 0.26.0 → 0.28.0

package/dist/setup.mjs

@@ -60,6 +60,11 @@ var state = globalSingleton("state", () => ({
   cardTokens: /* @__PURE__ */ new Map(),
   cardTokenCounter: 0,
   cardTokenizationEnabled: true,
+  stripePaymentIntents: /* @__PURE__ */ new Map(),
+  stripePaymentIntentCounter: 0,
+  stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeAllowedMethods: ["card", "promptpay"],
+  stripeChargesEnabled: true,
   uploads: [],
   uploadCounter: 0,
   storageFiles: /* @__PURE__ */ new Map(),
@@ -79,6 +84,14 @@ var state = globalSingleton("state", () => ({
   starlensCalls: [],
   starlensReplies: [],
   starlensDefaultReply: null,
+  controls: {
+    seed: {},
+    values: {},
+    unavailable: /* @__PURE__ */ new Set(),
+    lastUsage: null,
+    writes: [],
+    refusal: null
+  },
   allowNetwork: false
 }));
 function requireDb() {
@@ -546,8 +559,8 @@ async function handleNeonSql(db, request) {
       rowAsArray: arrayMode
     });
   } catch (error) {
-    const err = error;
-    return json({ message: err.message, code: err.code }, 400);
+    const err2 = error;
+    return json({ message: err2.message, code: err2.code }, 400);
   }
 }
 
@@ -1512,6 +1525,281 @@ var requestScopeStorage = globalSingleton(
   () => new AsyncLocalStorage()
 );
 
+// src/simulator/stripe-payment-intents.ts
+var SIM_STRIPE_PUBLISHABLE_KEY = "pk_test_sim_stripe";
+var SIM_STRIPE_DEFAULT_ACCOUNT = "acct_sim_default";
+var METHODS = ["card", "promptpay"];
+var RESERVED_METADATA_KEYS = ["projectId", "stardeckReferenceId", "stardeckStagingDeploymentId"];
+var PROMPTPAY_QR_TTL_SECONDS = 15 * 60;
+var PATH_RE = /^\/api\/store\/(?!beam\/)([^/]+)\/(payment-intents(?:\/([^/]+)(?:\/(cancel))?)?|elements-config|readiness)$/;
+function err(error, status, code) {
+  return json({ error, code }, status);
+}
+function decode(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function isPlayground(account) {
+  return account === "playground";
+}
+function resolveAccount(account) {
+  if (isPlayground(account)) return null;
+  if (account === "default") {
+    return process.env.STRIPE_CONNECT_ACCOUNT_ID || SIM_STRIPE_DEFAULT_ACCOUNT;
+  }
+  return account;
+}
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var APP_METADATA_MAX_KEYS = 50 - RESERVED_METADATA_KEYS.length;
+function isStringRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function isValidMetadata(value) {
+  if (!isStringRecord(value)) return false;
+  const entries = Object.entries(value);
+  return entries.length <= APP_METADATA_MAX_KEYS && entries.every(([k, v]) => k.length >= 1 && k.length <= 40 && v.length <= 500);
+}
+function isOptional(value, test) {
+  return value === void 0 || test(value);
+}
+var isEmail = (v) => typeof v === "string" && EMAIL_RE.test(v);
+function validateCreate(body) {
+  const { amount, currency, method, referenceId, idempotencyKey } = body;
+  const checks = [
+    [
+      typeof amount === "number" && Number.isInteger(amount) && amount > 0,
+      "amount must be a positive integer in minor units"
+    ],
+    [typeof currency === "string" && currency.length === 3, "currency must be a 3-letter ISO code"],
+    [
+      typeof method === "string" && METHODS.includes(method),
+      `method must be one of: ${METHODS.join(", ")}`
+    ],
+    [
+      typeof referenceId === "string" && referenceId.length >= 1 && referenceId.length <= 200,
+      "referenceId must be 1 to 200 characters"
+    ],
+    [
+      typeof idempotencyKey === "string" && idempotencyKey.length >= 1 && idempotencyKey.length <= 200,
+      "idempotencyKey is required (1 to 200 characters)"
+    ],
+    [
+      isOptional(body.description, (v) => typeof v === "string" && v.length <= 1e3),
+      "description must be at most 1000 characters"
+    ],
+    [isOptional(body.receiptEmail, isEmail), "receiptEmail must be an email address"],
+    [isOptional(body.billingEmail, isEmail), "billingEmail must be an email address"],
+    [
+      isOptional(body.returnUrl, (v) => typeof v === "string" && URL.canParse(v)),
+      "returnUrl must be an absolute URL"
+    ],
+    [
+      isOptional(body.metadata, isValidMetadata),
+      `metadata must map keys (1-40 chars) to strings (max 500), at most ${APP_METADATA_MAX_KEYS} keys`
+    ],
+    [
+      typeof body.deploymentId === "string" && UUID_RE2.test(body.deploymentId),
+      "Invalid deployment ID"
+    ]
+  ];
+  const failed = checks.find(([ok]) => !ok);
+  return failed ? failed[1] : null;
+}
+function appMetadata(raw) {
+  if (!isStringRecord(raw)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (!RESERVED_METADATA_KEYS.includes(key)) out[key] = value;
+  }
+  return out;
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function toStripePaymentIntentSummary(intent) {
+  const open = intent.status !== "succeeded" && intent.status !== "canceled";
+  let actionRequired = "NONE";
+  if (open && intent.method === "card") actionRequired = "CLIENT_CONFIRM";
+  if (open && intent.method === "promptpay" && intent.status === "requires_action") {
+    actionRequired = "ENCODED_IMAGE";
+  }
+  return {
+    id: intent.id,
+    status: intent.status,
+    amount: intent.amount,
+    currency: intent.currency,
+    method: intent.method,
+    referenceId: intent.referenceId,
+    metadata: { ...intent.appMetadata },
+    actionRequired,
+    clientSecret: intent.method === "card" ? intent.clientSecret : null,
+    qr: actionRequired === "ENCODED_IMAGE" ? { ...intent.qr } : null,
+    latestChargeId: intent.latestChargeId,
+    amountRefunded: intent.amountRefunded,
+    lastPaymentError: intent.lastPaymentError ? { ...intent.lastPaymentError } : null,
+    created: intent.created,
+    livemode: false,
+    playground: intent.playground
+  };
+}
+function promptPayQr(id, created) {
+  return {
+    imageUrlPng: `https://qr.stripe.test/${id}.png`,
+    imageUrlSvg: `https://qr.stripe.test/${id}.svg`,
+    data: `00020101021230SIM${id}`,
+    hostedInstructionsUrl: `https://payments.stripe.test/promptpay/${id}`,
+    expiresAt: created + PROMPTPAY_QR_TTL_SECONDS
+  };
+}
+function createIntent(body, account, projectId) {
+  const problem = validateCreate(body);
+  if (problem) return err(problem, 400, "invalid_request");
+  const method = body.method;
+  const currency = body.currency.toLowerCase();
+  if (!state.stripeAllowedMethods.includes(method)) {
+    return err(
+      `The ${method} payment method is turned off for this account`,
+      422,
+      "method_not_allowed"
+    );
+  }
+  if (method === "promptpay" && currency !== "thb") {
+    return err("PromptPay only takes THB", 422, "currency_not_supported");
+  }
+  if (!state.stripeChargesEnabled) {
+    return err("This Stripe account can't take payments yet", 503, "account_not_ready");
+  }
+  const scopedKey = JSON.stringify(["pi", projectId, account, body.idempotencyKey]);
+  const comparable = { ...body };
+  delete comparable.deploymentId;
+  delete comparable.idempotencyKey;
+  const fingerprint = stableStringify(comparable);
+  const saved = state.stripeIdempotentIntents.get(scopedKey);
+  if (saved) {
+    if (saved.fingerprint !== fingerprint) {
+      return err(
+        "This idempotency key was already used with different parameters. Use a new key for a different payment.",
+        409,
+        "idempotency_conflict"
+      );
+    }
+    const existing = state.stripePaymentIntents.get(saved.id);
+    return json({ paymentIntent: toStripePaymentIntentSummary(existing) }, 201);
+  }
+  state.stripePaymentIntentCounter += 1;
+  const id = `pi_sim_${state.stripePaymentIntentCounter}`;
+  const created = Math.floor(Date.now() / 1e3);
+  const referenceId = body.referenceId;
+  const metadata = appMetadata(body.metadata);
+  const intent = {
+    id,
+    projectId,
+    account,
+    connectedAccountId: resolveAccount(account),
+    playground: isPlayground(account),
+    status: method === "card" ? "requires_payment_method" : "requires_action",
+    amount: body.amount,
+    currency,
+    method,
+    referenceId,
+    appMetadata: metadata,
+    metadata: { ...metadata, projectId, stardeckReferenceId: referenceId },
+    description: typeof body.description === "string" ? body.description : null,
+    receiptEmail: typeof body.receiptEmail === "string" ? body.receiptEmail : null,
+    returnUrl: typeof body.returnUrl === "string" ? body.returnUrl : null,
+    clientSecret: `${id}_secret_sim`,
+    qr: method === "promptpay" ? promptPayQr(id, created) : null,
+    latestChargeId: null,
+    amountRefunded: 0,
+    lastPaymentError: null,
+    created
+  };
+  state.stripePaymentIntents.set(id, intent);
+  state.stripeIdempotentIntents.set(scopedKey, { fingerprint, id });
+  console.log(
+    `[stardeck-testing] stripe payment intent ${id} created method=${method} amount=${intent.amount} ${currency}`
+  );
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) }, 201);
+}
+function ownedIntent(id, projectId) {
+  const intent = state.stripePaymentIntents.get(id);
+  return intent && intent.projectId === projectId ? intent : void 0;
+}
+function cancelIntent(intent) {
+  if (intent.status === "succeeded") {
+    return err("This payment already succeeded and can't be canceled", 409, "already_succeeded");
+  }
+  intent.status = "canceled";
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+}
+function handleIntents(request, url, account, intentId, action, projectId) {
+  if (!intentId && request.method === "POST") {
+    return readJsonBody(request).then((body) => createIntent(body, account, projectId));
+  }
+  if (!intentId && request.method === "GET") {
+    const referenceId = url.searchParams.get("referenceId");
+    if (!referenceId) return err("referenceId is required", 400, "invalid_request");
+    const paymentIntents = [...state.stripePaymentIntents.values()].filter((i) => i.projectId === projectId && i.referenceId === referenceId).map(toStripePaymentIntentSummary);
+    return json({ paymentIntents });
+  }
+  if (!intentId) return null;
+  const intent = ownedIntent(decode(intentId), projectId);
+  if (!action && request.method === "GET") {
+    if (!intent) return err("Payment intent not found", 404, "not_found");
+    return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+  }
+  if (action === "cancel" && request.method === "POST") {
+    return readJsonBody(request).then((body) => {
+      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+        return err("deploymentId is required", 400, "invalid_request");
+      }
+      if (!intent) return err("Payment intent not found", 404, "not_found");
+      return cancelIntent(intent);
+    });
+  }
+  return null;
+}
+async function handleStripePaymentIntentRequest(request, url, projectId) {
+  const match = url.pathname.match(PATH_RE);
+  if (!match) return null;
+  if (!projectId) return err("Missing authentication", 401, "unauthorized");
+  const account = decode(match[1]);
+  const resource = match[2];
+  if (request.method === "GET" && !url.searchParams.get("deploymentId")) {
+    return err("deploymentId is required", 400, "invalid_request");
+  }
+  if (resource === "elements-config" && request.method === "GET") {
+    return json({
+      publishableKey: SIM_STRIPE_PUBLISHABLE_KEY,
+      stripeAccount: resolveAccount(account),
+      playground: isPlayground(account)
+    });
+  }
+  if (resource === "readiness" && request.method === "GET") {
+    const methods = [...state.stripeAllowedMethods];
+    return json({
+      provider: "stripe",
+      ready: state.stripeChargesEnabled && methods.length > 0,
+      chargesEnabled: state.stripeChargesEnabled,
+      methods,
+      playground: isPlayground(account)
+    });
+  }
+  if (resource.startsWith("payment-intents")) {
+    return handleIntents(request, url, account, match[3], match[4], projectId);
+  }
+  return null;
+}
+
 // src/simulator/webhook-signing.ts
 import crypto4 from "crypto";
 
@@ -1531,7 +1819,7 @@ var BEAM_BOLT_PAYMENT_METHODS = [
   "SPAY_LATER"
 ];
 var BEAM_BOLT_INTENT_STATUSES = ["PENDING", "PAID", "FAILED", "CANCELED", "EXPIRED"];
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function payErr(error, status = 400, code, details) {
   const body = { error };
   if (code) body.code = code;
@@ -1557,7 +1845,23 @@ function paymentOperationForRequest(request, pathname) {
   if (request.method === "GET" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout-sessions\/[^/]+$/.test(pathname)) {
     return "stripe.getCheckoutSessionStatus";
   }
-  return null;
+  return stripeInlineOperation(request.method, pathname);
+}
+var STRIPE_INLINE_OPERATIONS = [
+  ["POST", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.createPaymentIntent"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.findPaymentIntents"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+$/, "stripe.getPaymentIntent"],
+  [
+    "POST",
+    /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+\/cancel$/,
+    "stripe.cancelPaymentIntent"
+  ],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/elements-config$/, "stripe.getElementsConfig"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/readiness$/, "stripe.getReadiness"]
+];
+function stripeInlineOperation(method, pathname) {
+  const hit = STRIPE_INLINE_OPERATIONS.find(([m, re]) => m === method && re.test(pathname));
+  return hit ? hit[2] : null;
 }
 function consumePaymentFailure(request, pathname) {
   const operation = paymentOperationForRequest(request, pathname);
@@ -1587,11 +1891,11 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
-function stableStringify(value) {
-  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+function stableStringify2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify2).join(",")}]`;
   if (value && typeof value === "object") {
     const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify2(v)}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
@@ -1697,10 +2001,16 @@ function storedStatusesForFilter(statuses) {
   }
   return [...stored];
 }
-async function handlePaymentsRequest(request, url) {
+async function handlePaymentsRequest(request, url, signedProjectId = null) {
   const pathname = url.pathname;
   const injectedFailure = consumePaymentFailure(request, pathname);
   if (injectedFailure) return injectedFailure;
+  const inlineStripeResponse = await handleStripePaymentIntentRequest(
+    request,
+    url,
+    signedProjectId
+  );
+  if (inlineStripeResponse) return inlineStripeResponse;
   const directChargeResponse = await handleDirectChargeRequest(request, pathname);
   if (directChargeResponse) return directChargeResponse;
   if (/\/billing-portal$/.test(pathname)) {
@@ -1799,7 +2109,7 @@ async function handlePaymentsRequest(request, url) {
           code: "too_small"
         });
       }
-      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+      if (typeof body.deploymentId !== "string" || !UUID_RE3.test(body.deploymentId)) {
         issues.push({
           path: ["deploymentId"],
           message: "Invalid uuid",
@@ -1983,7 +2293,7 @@ async function handlePaymentsRequest(request, url) {
       const comparable = { ...body };
       delete comparable.deploymentId;
       delete comparable.idempotencyKey;
-      const fingerprint = stableStringify(comparable);
+      const fingerprint = stableStringify2(comparable);
       if (scopedKey) {
         const saved = state.idempotentCheckouts.get(scopedKey);
         if (saved) {
@@ -2684,6 +2994,91 @@ async function handleEdgeRequest(request, subPath) {
   return edgeFailure(`No edge simulator for ${method} .../edge${subPath}`, 404);
 }
 
+// src/simulator/controls.ts
+var USER_TOKEN_HEADER = "x-stardeck-user-token";
+var REFUSAL_STATUS = {
+  NOT_WRITABLE: 400,
+  INVALID_VALUE: 400,
+  UNAUTHENTICATED: 401,
+  FORBIDDEN: 403,
+  WRITE_NOT_ALLOWED_HERE: 403,
+  PROVIDER_NOT_READY: 409,
+  UNAVAILABLE: 503
+};
+var controlsModule = null;
+function loadControls() {
+  controlsModule ??= import("@stardeck-customer-apps/controls");
+  return controlsModule;
+}
+function currentControlsBody() {
+  const controls = {};
+  for (const [key, value] of Object.entries(state.controls.values)) {
+    controls[key] = state.controls.unavailable.has(key) ? { ok: false, reason: "unavailable (simulated)" } : { ok: true, value };
+  }
+  return controls;
+}
+function refusalResponse(refusal) {
+  return json({ error: refusal }, REFUSAL_STATUS[refusal.code]);
+}
+function handleSync(body) {
+  const usage = body.usage;
+  if (typeof usage === "object" && usage !== null) {
+    const locations = usage.locations;
+    state.controls.lastUsage = typeof locations === "number" && Number.isInteger(locations) && locations >= 0 ? { locations } : {};
+  }
+  return json({ controls: currentControlsBody() });
+}
+async function handleWrite(request, key) {
+  const { CONTROLS, isWritableControl } = await loadControls();
+  if (!isWritableControl(key)) {
+    return refusalResponse({
+      code: "NOT_WRITABLE",
+      message: `${key} cannot be changed from the app`
+    });
+  }
+  const userToken = request.headers.get(USER_TOKEN_HEADER);
+  if (!userToken) {
+    return refusalResponse({
+      code: "UNAUTHENTICATED",
+      message: "A signed-in person is required (X-Stardeck-User-Token)"
+    });
+  }
+  const body = await readJsonBody(request);
+  const parsed = CONTROLS[key].schema.safeParse(body.value);
+  if (!parsed.success) {
+    return refusalResponse({
+      code: "INVALID_VALUE",
+      message: parsed.error.issues[0]?.message ?? "Invalid value"
+    });
+  }
+  const refusal = state.controls.refusal;
+  if (refusal) {
+    state.controls.refusal = null;
+    return refusalResponse(refusal);
+  }
+  state.controls.values[key] = parsed.data;
+  state.controls.unavailable.delete(key);
+  state.controls.writes.push({ key, value: parsed.data, userToken });
+  return json({ controls: currentControlsBody() });
+}
+var CONTROLS_PATH = /^\/api\/deployments\/[^/]+\/controls(?:\/([^/]+))?$/;
+async function handleControlsRequest(request, url) {
+  const match = url.pathname.match(CONTROLS_PATH);
+  const key = match?.[1] ? decodeURIComponent(match[1]) : null;
+  if (!key && request.method === "POST") {
+    return handleSync(await readJsonBody(request));
+  }
+  if (key && request.method === "PUT") {
+    return handleWrite(request, key);
+  }
+  return json(
+    {
+      error: { code: "UNAVAILABLE", message: `No simulator for ${request.method} ${url.pathname}` }
+    },
+    404
+  );
+}
+
 // src/simulator/schedules.ts
 async function handleScheduleWake(request, scheduleKey) {
   if (request.method !== "POST") return failure(`Method ${request.method} not allowed`, 405);
@@ -2823,7 +3218,7 @@ function requiresDeploymentHmac(request, url) {
     return !isPresignedPut;
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -2832,8 +3227,10 @@ function requiresDeploymentHmac(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStarlens = url.pathname === "/api/starlens/extract";
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
-  return !!(isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
+  const controlsMatch = url.pathname.match(CONTROLS_PATH2);
+  return !!(controlsMatch || isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail2 || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
+var CONTROLS_PATH2 = /^\/api\/deployments\/[^/]+\/controls(\/[^/]+)?$/;
 var SCHEDULE_WAKE_PATH = /^\/api\/deployments\/[^/]+\/schedules\/([^/]+)\/wake$/;
 function deploymentIdFromPath(url) {
   const match = url.pathname.match(/\/api\/deployments\/([^/]+)(?:\/|$)/);
@@ -2855,7 +3252,7 @@ async function handleSimulatedRequest(request, url) {
     return authMatch[1].endsWith("verify") ? handleAuthVerify(request) : handleAuthRefresh(request);
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -2864,6 +3261,7 @@ async function handleSimulatedRequest(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStorageHost = url.hostname === STORAGE_TEST_HOST;
   let signedDeploymentId = null;
+  let signedProjectId = null;
   if (requiresDeploymentHmac(request, url)) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
@@ -2876,6 +3274,7 @@ async function handleSimulatedRequest(request, url) {
       return failure("Invalid authentication", 401);
     }
     signedDeploymentId = authPayload.deploymentId;
+    signedProjectId = authPayload.projectId;
   }
   if (isStorageHost) {
     return handleStorageRequest(request, url);
@@ -2883,14 +3282,14 @@ async function handleSimulatedRequest(request, url) {
   if (url.hostname === SIM_BEAM_HOST) {
     return handleCardTokenRequest(request, url);
   }
-  if (isEmail && request.method === "POST") {
+  if (isEmail2 && request.method === "POST") {
     return handleEmailSend(request);
   }
   if (identitiesMatch) {
     return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
   }
   if (storeMatch) {
-    return handlePaymentsRequest(request, url);
+    return handlePaymentsRequest(request, url, signedProjectId);
   }
   if (messagingMatch) {
     const channel = messagingMatch[1];
@@ -2899,6 +3298,9 @@ async function handleSimulatedRequest(request, url) {
   if (edgeMatch) {
     return handleEdgeRequest(request, edgeMatch[1] ?? "");
   }
+  if (CONTROLS_PATH2.test(url.pathname)) {
+    return handleControlsRequest(request, url);
+  }
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
   if (scheduleWakeMatch) {
     return handleScheduleWake(request, decodeURIComponent(scheduleWakeMatch[1]));
@@ -2927,7 +3329,7 @@ async function handleSimulatedRequest(request, url) {
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, app controls sync/write, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
     404
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/testing",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Vitest test harness for Stardeck customer apps — in-process Postgres (PGlite) plus a control-plane simulator so the real Stardeck SDKs run unmodified in tests",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -48,7 +48,7 @@
     "build": "tsup src/index.ts src/config.ts src/setup.ts src/next/headers-shim.ts src/server-only-shim.ts --format cjs,esm --dts --no-splitting",
     "dev": "tsup src/index.ts src/config.ts src/setup.ts src/next/headers-shim.ts src/server-only-shim.ts --format cjs,esm --dts --no-splitting --watch",
     "format": "prettier --write . && oxlint . --fix",
-    "typecheck": "tsgo --noEmit && tsgo -p tsconfig.test.json",
+    "typecheck": "node ../../scripts/typecheck.mjs --noEmit && node ../../scripts/typecheck.mjs -p tsconfig.test.json",
     "lint": "oxlint src/",
     "test": "vitest run",
     "test:watch": "vitest"
@@ -65,6 +65,7 @@
     "@electric-sql/pglite": "^0.3.0"
   },
   "peerDependencies": {
+    "@stardeck-customer-apps/controls": ">=0.1.0",
     "@stardeck-customer-apps/edge-sdk": ">=1.4.0",
     "@stardeck-customer-apps/integrations-sdk": ">=1.16.0",
     "@stardeck-customer-apps/payments-sdk": ">=0.1.0",
@@ -74,6 +75,9 @@
     "@stardeck-customer-apps/starlens": ">=0.1.0"
   },
   "peerDependenciesMeta": {
+    "@stardeck-customer-apps/controls": {
+      "optional": true
+    },
     "@stardeck-customer-apps/integrations-sdk": {
       "optional": true
     },
@@ -95,6 +99,7 @@
   },
   "devDependencies": {
     "@neondatabase/serverless": "^1.0.0",
+    "@stardeck-customer-apps/controls": "*",
     "@stardeck-customer-apps/data-store-sdk": "*",
     "@stardeck-customer-apps/edge-sdk": "*",
     "@stardeck-customer-apps/email-sdk": "*",
@@ -111,6 +116,8 @@
     "typescript": "^5.0.0",
     "vitest": "^3.2.4",
     "@stardeck-customer-apps/starlens": "*",
-    "zod": "^4.3.5"
+    "zod": "^4.3.5",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
   }
 }