@stardeck-customer-apps/testing 0.27.0 → 0.29.0

package/dist/next/headers-shim.js

@@ -82,6 +82,12 @@ var state = globalSingleton("state", () => ({
   stripePaymentIntents: /* @__PURE__ */ new Map(),
   stripePaymentIntentCounter: 0,
   stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeRefunds: /* @__PURE__ */ new Map(),
+  stripeRefundCounter: 0,
+  stripeIdempotentRefunds: /* @__PURE__ */ new Map(),
+  beamRefunds: /* @__PURE__ */ new Map(),
+  beamRefundCounter: 0,
+  beamIdempotentRefunds: /* @__PURE__ */ new Map(),
   stripeAllowedMethods: ["card", "promptpay"],
   stripeChargesEnabled: true,
   uploads: [],
@@ -103,6 +109,14 @@ var state = globalSingleton("state", () => ({
   starlensCalls: [],
   starlensReplies: [],
   starlensDefaultReply: null,
+  controls: {
+    seed: {},
+    values: {},
+    unavailable: /* @__PURE__ */ new Set(),
+    lastUsage: null,
+    writes: [],
+    refusal: null
+  },
   allowNetwork: false
 }));
 

package/dist/next/headers-shim.mjs

@@ -55,6 +55,12 @@ var state = globalSingleton("state", () => ({
   stripePaymentIntents: /* @__PURE__ */ new Map(),
   stripePaymentIntentCounter: 0,
   stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeRefunds: /* @__PURE__ */ new Map(),
+  stripeRefundCounter: 0,
+  stripeIdempotentRefunds: /* @__PURE__ */ new Map(),
+  beamRefunds: /* @__PURE__ */ new Map(),
+  beamRefundCounter: 0,
+  beamIdempotentRefunds: /* @__PURE__ */ new Map(),
   stripeAllowedMethods: ["card", "promptpay"],
   stripeChargesEnabled: true,
   uploads: [],
@@ -76,6 +82,14 @@ var state = globalSingleton("state", () => ({
   starlensCalls: [],
   starlensReplies: [],
   starlensDefaultReply: null,
+  controls: {
+    seed: {},
+    values: {},
+    unavailable: /* @__PURE__ */ new Set(),
+    lastUsage: null,
+    writes: [],
+    refusal: null
+  },
   allowNetwork: false
 }));
 

package/dist/setup.js

@@ -87,6 +87,12 @@ var state = globalSingleton("state", () => ({
   stripePaymentIntents: /* @__PURE__ */ new Map(),
   stripePaymentIntentCounter: 0,
   stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeRefunds: /* @__PURE__ */ new Map(),
+  stripeRefundCounter: 0,
+  stripeIdempotentRefunds: /* @__PURE__ */ new Map(),
+  beamRefunds: /* @__PURE__ */ new Map(),
+  beamRefundCounter: 0,
+  beamIdempotentRefunds: /* @__PURE__ */ new Map(),
   stripeAllowedMethods: ["card", "promptpay"],
   stripeChargesEnabled: true,
   uploads: [],
@@ -108,6 +114,14 @@ var state = globalSingleton("state", () => ({
   starlensCalls: [],
   starlensReplies: [],
   starlensDefaultReply: null,
+  controls: {
+    seed: {},
+    values: {},
+    unavailable: /* @__PURE__ */ new Set(),
+    lastUsage: null,
+    writes: [],
+    refusal: null
+  },
   allowNetwork: false
 }));
 function requireDb() {
@@ -1545,7 +1559,11 @@ var requestScopeStorage = globalSingleton(
 var SIM_STRIPE_PUBLISHABLE_KEY = "pk_test_sim_stripe";
 var SIM_STRIPE_DEFAULT_ACCOUNT = "acct_sim_default";
 var METHODS = ["card", "promptpay"];
-var RESERVED_METADATA_KEYS = ["projectId", "stardeckReferenceId", "stardeckStagingDeploymentId"];
+var RESERVED_METADATA_KEYS = [
+  "projectId",
+  "stardeckReferenceId",
+  "stardeckStagingDeploymentId"
+];
 var PROMPTPAY_QR_TTL_SECONDS = 15 * 60;
 var PATH_RE = /^\/api\/store\/(?!beam\/)([^/]+)\/(payment-intents(?:\/([^/]+)(?:\/(cancel))?)?|elements-config|readiness)$/;
 function err(error, status, code) {
@@ -1816,6 +1834,350 @@ async function handleStripePaymentIntentRequest(request, url, projectId) {
   return null;
 }
 
+// src/simulator/refunds.ts
+var REFUND_ROW_KEY = "refundRowId";
+var REFUND_METADATA_MAX_KEYS = 50 - RESERVED_METADATA_KEYS.length - 1;
+var REFUND_REASONS = ["duplicate", "fraudulent", "requested_by_customer"];
+var PROMPTPAY_BANK_DETAILS_WINDOW_SECONDS = 7 * 24 * 60 * 60;
+var BEAM_PARTIAL_METHODS = ["CARD", "CARD_TOKEN"];
+function refundFailure(plan) {
+  return err(plan.message, plan.status, plan.code);
+}
+function isPositiveInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function hasValidKey(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 255;
+}
+function isValidDeploymentId(value) {
+  return typeof value === "string" && UUID_RE2.test(value);
+}
+function isValidRefundMetadata(value) {
+  if (!isStringRecord(value)) return false;
+  const entries = Object.entries(value);
+  return entries.length <= REFUND_METADATA_MAX_KEYS && entries.every(
+    ([k, v]) => k.length >= 1 && k.length <= 40 && v.length <= 500 && !RESERVED_METADATA_KEYS.includes(k) && k !== REFUND_ROW_KEY
+  );
+}
+var COUNTED_STRIPE_STATUSES = [
+  "pending",
+  "requires_action",
+  "succeeded"
+];
+function refundedAmount(intentId) {
+  let total = 0;
+  for (const refund of state.stripeRefunds.values()) {
+    if (refund.paymentIntentId === intentId && COUNTED_STRIPE_STATUSES.includes(refund.status)) {
+      total += refund.amount;
+    }
+  }
+  return total;
+}
+function syncAmountRefunded(intent) {
+  intent.amountRefunded = refundedAmount(intent.id);
+}
+function validateStripeRefund(body) {
+  const checks = [
+    [isValidDeploymentId(body.deploymentId), "Invalid deployment ID"],
+    [hasValidKey(body.idempotencyKey), "idempotencyKey is required (1 to 255 characters)"],
+    [isOptional(body.amount, isPositiveInt), "amount must be a positive integer in minor units"],
+    [
+      isOptional(body.reason, (v) => typeof v === "string" && REFUND_REASONS.includes(v)),
+      `reason must be one of: ${REFUND_REASONS.join(", ")}`
+    ],
+    [isOptional(body.instructionsEmail, isEmail), "instructionsEmail must be an email address"],
+    [
+      isOptional(
+        body.refundRowId,
+        (v) => typeof v === "string" && v.length >= 1 && v.length <= 500
+      ),
+      "refundRowId must be 1 to 500 characters"
+    ],
+    [
+      isOptional(body.metadata, isValidRefundMetadata),
+      `metadata must map keys (1-40 chars) to strings (max 500), at most ${REFUND_METADATA_MAX_KEYS} keys, without the keys the platform reserves (use refundRowId instead)`
+    ]
+  ];
+  const failed = checks.find(([ok]) => !ok);
+  return failed ? failed[1] : null;
+}
+function planStripeRefund(intent, requested) {
+  if (intent.status !== "succeeded") {
+    return {
+      ok: false,
+      status: 409,
+      code: "payment_not_refundable",
+      message: "This payment hasn't succeeded, so there is nothing to refund"
+    };
+  }
+  const remaining = intent.amount - refundedAmount(intent.id);
+  const amount = requested ?? remaining;
+  if (remaining <= 0 || amount > remaining) {
+    return {
+      ok: false,
+      status: 409,
+      code: "refund_exceeds_remaining",
+      message: `Only ${remaining} can still be refunded on this payment`
+    };
+  }
+  return { ok: true, amount };
+}
+function toStripeRefundSummary(refund) {
+  const intent = state.stripePaymentIntents.get(refund.paymentIntentId);
+  return {
+    id: refund.id,
+    paymentIntentId: refund.paymentIntentId,
+    amount: refund.amount,
+    currency: refund.currency,
+    status: refund.status,
+    failureReason: refund.failureReason,
+    pendingReason: refund.pendingReason,
+    nextActionExpiresAt: refund.nextActionExpiresAt,
+    refundRowId: refund.refundRowId,
+    metadata: { ...refund.appMetadata },
+    created: refund.created,
+    livemode: false,
+    playground: intent?.playground ?? false
+  };
+}
+function newStripeRefund(input) {
+  state.stripeRefundCounter += 1;
+  const refund = {
+    id: `re_sim_${state.stripeRefundCounter}`,
+    paymentIntentId: input.intent.id,
+    projectId: input.intent.projectId,
+    amount: input.amount,
+    currency: input.intent.currency,
+    // A refund made in the Stripe dashboard is already done; the app's waits for `settleRefund`.
+    status: input.origin === "dashboard" ? "succeeded" : "pending",
+    failureReason: null,
+    pendingReason: null,
+    nextActionExpiresAt: null,
+    refundRowId: input.refundRowId ?? null,
+    appMetadata: input.appMetadata ?? {},
+    reason: input.reason ?? null,
+    origin: input.origin,
+    revision: 0,
+    created: Math.floor(Date.now() / 1e3)
+  };
+  state.stripeRefunds.set(refund.id, refund);
+  syncAmountRefunded(input.intent);
+  console.log(
+    `[stardeck-testing] stripe refund ${refund.id} created payment=${refund.paymentIntentId} amount=${refund.amount} origin=${refund.origin}`
+  );
+  return refund;
+}
+function createStripeRefund(body, intent, projectId) {
+  const scopedKey = JSON.stringify(["refund", projectId, intent.account, body.idempotencyKey]);
+  const fingerprint = stableStringify({
+    paymentIntentId: intent.id,
+    amount: body.amount,
+    reason: body.reason,
+    instructionsEmail: body.instructionsEmail,
+    refundRowId: body.refundRowId,
+    metadata: body.metadata
+  });
+  const saved = state.stripeIdempotentRefunds.get(scopedKey);
+  if (saved) {
+    if (saved.fingerprint !== fingerprint) {
+      return err(
+        "This idempotency key was already used with different parameters. Use a new key for a different refund.",
+        409,
+        "idempotency_conflict"
+      );
+    }
+    return json({ refund: toStripeRefundSummary(state.stripeRefunds.get(saved.id)) });
+  }
+  const plan = planStripeRefund(intent, body.amount);
+  if (!plan.ok) return refundFailure(plan);
+  const refund = newStripeRefund({
+    intent,
+    amount: plan.amount,
+    origin: "app",
+    refundRowId: typeof body.refundRowId === "string" ? body.refundRowId : null,
+    appMetadata: appMetadata(body.metadata),
+    reason: typeof body.reason === "string" ? body.reason : null
+  });
+  state.stripeIdempotentRefunds.set(scopedKey, { fingerprint, id: refund.id });
+  return json({ refund: toStripeRefundSummary(refund) });
+}
+var STRIPE_REFUND_PATH = /^\/api\/store\/(?!beam\/)[^/]+\/(?:payment-intents\/([^/]+)\/refunds|refunds\/([^/]+))$/;
+async function handleStripeRefundRequest(request, url, projectId) {
+  const match = url.pathname.match(STRIPE_REFUND_PATH);
+  if (!match) return null;
+  const [, intentId, refundId] = match;
+  const isCreate = request.method === "POST" && intentId !== void 0;
+  const isRead = request.method === "GET" && refundId !== void 0;
+  if (!isCreate && !isRead) return null;
+  if (!projectId) return err("Missing authentication", 401, "unauthorized");
+  if (isRead) {
+    if (!url.searchParams.get("deploymentId")) {
+      return err("deploymentId is required", 400, "invalid_request");
+    }
+    const refund = state.stripeRefunds.get(decode(refundId));
+    if (!refund || refund.projectId !== projectId) {
+      return err("Refund not found", 404, "refund_not_found");
+    }
+    return json({ refund: toStripeRefundSummary(refund) });
+  }
+  const body = await readJsonBody(request);
+  const problem = validateStripeRefund(body);
+  if (problem) return err(problem, 400, "invalid_request");
+  const intent = ownedIntent(decode(intentId), projectId);
+  if (!intent) return err("No such payment for this app", 404, "payment_not_owned");
+  return createStripeRefund(body, intent, projectId);
+}
+function refundsOfCharge(chargeId) {
+  return [...state.beamRefunds.values()].filter((r) => r.chargeId === chargeId);
+}
+function planBeamRefund(charge, requested) {
+  if (charge.status !== "SUCCEEDED") {
+    return {
+      ok: false,
+      status: 409,
+      code: "payment_not_refundable",
+      message: "This charge hasn't succeeded, so there is nothing to refund"
+    };
+  }
+  const refunds = refundsOfCharge(charge.id);
+  if (refunds.some((r) => r.status === "PENDING")) {
+    return {
+      ok: false,
+      status: 409,
+      code: "refund_in_progress",
+      message: "This charge already has a refund in progress. Wait for it to finish."
+    };
+  }
+  const refunded = refunds.filter((r) => r.status === "SUCCEEDED").reduce((n, r) => n + r.amount, 0);
+  const remaining = charge.amount - refunded;
+  const amount = requested ?? remaining;
+  if (remaining <= 0 || amount > remaining) {
+    return {
+      ok: false,
+      status: 409,
+      code: "refund_exceeds_remaining",
+      message: `Only ${remaining} can still be refunded on this charge`
+    };
+  }
+  if (amount < charge.amount && !BEAM_PARTIAL_METHODS.includes(charge.paymentMethodType)) {
+    return {
+      ok: false,
+      status: 409,
+      code: "refund_partial_not_allowed",
+      message: `${charge.paymentMethodType} charges can only be refunded in full`
+    };
+  }
+  return { ok: true, amount };
+}
+function toBeamRefundSummary(refund) {
+  return {
+    refundId: refund.refundId,
+    chargeId: refund.chargeId,
+    amount: refund.amount,
+    currency: refund.currency,
+    status: refund.status,
+    failureCode: refund.failureCode,
+    reason: refund.reason,
+    createdAt: refund.createdAt
+  };
+}
+function newBeamRefund(input) {
+  state.beamRefundCounter += 1;
+  const refund = {
+    refundId: `rf_sim_${state.beamRefundCounter}`,
+    chargeId: input.charge.id,
+    amount: input.amount,
+    currency: input.charge.currency,
+    status: input.origin === "dashboard" ? "SUCCEEDED" : "PENDING",
+    failureCode: null,
+    reason: input.reason ?? null,
+    origin: input.origin,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  state.beamRefunds.set(refund.refundId, refund);
+  console.log(
+    `[stardeck-testing] beam refund ${refund.refundId} created charge=${refund.chargeId} amount=${refund.amount} origin=${refund.origin}`
+  );
+  return refund;
+}
+function validateBeamRefund(body) {
+  const checks = [
+    [isValidDeploymentId(body.deploymentId), "Invalid deployment ID"],
+    [hasValidKey(body.idempotencyKey), "idempotencyKey is required (1 to 255 characters)"],
+    [isOptional(body.amount, isPositiveInt), "amount must be a positive integer in satang"],
+    [
+      isOptional(body.reason, (v) => typeof v === "string" && v.length <= 500),
+      "reason must be at most 500 characters"
+    ]
+  ];
+  const failed = checks.find(([ok]) => !ok);
+  return failed ? failed[1] : null;
+}
+function createBeamRefund(body, charge, merchant) {
+  const scopedKey = JSON.stringify(["beam-refund", merchant, body.idempotencyKey]);
+  const fingerprint = stableStringify({
+    chargeId: charge.id,
+    amount: body.amount,
+    reason: body.reason
+  });
+  const saved = state.beamIdempotentRefunds.get(scopedKey);
+  if (saved) {
+    if (saved.fingerprint !== fingerprint) {
+      return err(
+        "This idempotency key was already used with different parameters. Use a new key for a different refund.",
+        409,
+        "idempotency_conflict"
+      );
+    }
+    return json({ refund: toBeamRefundSummary(state.beamRefunds.get(saved.id)) });
+  }
+  const plan = planBeamRefund(charge, body.amount);
+  if (!plan.ok) return refundFailure(plan);
+  const refund = newBeamRefund({
+    charge,
+    amount: plan.amount,
+    origin: "app",
+    reason: typeof body.reason === "string" ? body.reason : null
+  });
+  state.beamIdempotentRefunds.set(scopedKey, { fingerprint, id: refund.refundId });
+  return json({ refund: toBeamRefundSummary(refund) });
+}
+var BEAM_REFUND_PATH = /^\/api\/store\/beam\/([^/]+)\/(?:charges\/([^/]+)\/refunds|refunds\/([^/]+))$/;
+async function handleBeamRefundRequest(request, url) {
+  const match = url.pathname.match(BEAM_REFUND_PATH);
+  if (!match) return null;
+  const [, merchant, chargeId, refundId] = match;
+  const isCreate = request.method === "POST" && chargeId !== void 0;
+  const isRead = request.method === "GET" && refundId !== void 0;
+  if (!isCreate && !isRead) return null;
+  if (isRead) {
+    if (!url.searchParams.get("deploymentId")) {
+      return err("deploymentId is required", 400, "invalid_request");
+    }
+    const refund = state.beamRefunds.get(decode(refundId));
+    if (!refund) return err("Refund not found", 404, "refund_not_found");
+    return json({ refund: toBeamRefundSummary(refund) });
+  }
+  const body = await readJsonBody(request);
+  const problem = validateBeamRefund(body);
+  if (problem) return err(problem, 400, "invalid_request");
+  const charge = state.directCharges.get(decode(chargeId));
+  if (!charge) return err("No such charge for this app", 404, "payment_not_owned");
+  return createBeamRefund(body, charge, decode(merchant));
+}
+function findCheckoutSessionByIntent(url, projectId) {
+  if (!projectId) return err("Missing authentication", 401, "unauthorized");
+  if (!url.searchParams.get("deploymentId")) {
+    return err("deploymentId is required", 400, "invalid_request");
+  }
+  const intentId = url.searchParams.get("paymentIntentId");
+  if (!intentId) return err("paymentIntentId is required", 400, "invalid_request");
+  const intent = state.stripePaymentIntents.get(intentId);
+  if (intent && intent.projectId !== projectId) return json({ session: null });
+  const session = [...state.sessionStatuses.values()].find((s) => s.paymentIntentId === intentId);
+  return json({ session: session ?? null });
+}
+
 // src/simulator/webhook-signing.ts
 var import_node_crypto4 = __toESM(require("crypto"));
 
@@ -1861,6 +2223,15 @@ function paymentOperationForRequest(request, pathname) {
   if (request.method === "GET" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout-sessions\/[^/]+$/.test(pathname)) {
     return "stripe.getCheckoutSessionStatus";
   }
+  if (request.method === "POST" && /^\/api\/store\/beam\/[^/]+\/charges\/[^/]+\/refunds$/.test(pathname)) {
+    return "beam.refundCharge";
+  }
+  if (request.method === "GET" && /^\/api\/store\/beam\/[^/]+\/refunds\/[^/]+$/.test(pathname)) {
+    return "beam.getRefund";
+  }
+  if (request.method === "GET" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout-sessions$/.test(pathname)) {
+    return "stripe.findCheckoutSessionByIntent";
+  }
   return stripeInlineOperation(request.method, pathname);
 }
 var STRIPE_INLINE_OPERATIONS = [
@@ -1872,6 +2243,12 @@ var STRIPE_INLINE_OPERATIONS = [
     /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+\/cancel$/,
     "stripe.cancelPaymentIntent"
   ],
+  [
+    "POST",
+    /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+\/refunds$/,
+    "stripe.refundPaymentIntent"
+  ],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/refunds\/[^/]+$/, "stripe.getRefund"],
   ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/elements-config$/, "stripe.getElementsConfig"],
   ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/readiness$/, "stripe.getReadiness"]
 ];
@@ -1952,7 +2329,8 @@ function seedStripeSession(id, body, expiresAt) {
     currency,
     customerEmail: body.customerEmail ? String(body.customerEmail) : null,
     metadata: body.metadata ?? {},
-    expiresAt
+    expiresAt,
+    paymentIntentId: null
   });
 }
 function seedBeamLink(id, body, merchantId) {
@@ -2027,6 +2405,10 @@ async function handlePaymentsRequest(request, url, signedProjectId = null) {
     signedProjectId
   );
   if (inlineStripeResponse) return inlineStripeResponse;
+  const stripeRefundResponse = await handleStripeRefundRequest(request, url, signedProjectId);
+  if (stripeRefundResponse) return stripeRefundResponse;
+  const beamRefundResponse = await handleBeamRefundRequest(request, url);
+  if (beamRefundResponse) return beamRefundResponse;
   const directChargeResponse = await handleDirectChargeRequest(request, pathname);
   if (directChargeResponse) return directChargeResponse;
   if (/\/billing-portal$/.test(pathname)) {
@@ -2348,6 +2730,9 @@ async function handlePaymentsRequest(request, url, signedProjectId = null) {
       if (scopedKey) state.idempotentCheckouts.set(scopedKey, { fingerprint, response });
       return json(response);
     }
+    if (subPath === "checkout-sessions" && request.method === "GET") {
+      return findCheckoutSessionByIntent(url, signedProjectId);
+    }
     const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
     if (sessionMatch && request.method === "GET") {
       const session = state.sessionStatuses.get(sessionMatch[1]);
@@ -3010,6 +3395,91 @@ async function handleEdgeRequest(request, subPath) {
   return edgeFailure(`No edge simulator for ${method} .../edge${subPath}`, 404);
 }
 
+// src/simulator/controls.ts
+var USER_TOKEN_HEADER = "x-stardeck-user-token";
+var REFUSAL_STATUS = {
+  NOT_WRITABLE: 400,
+  INVALID_VALUE: 400,
+  UNAUTHENTICATED: 401,
+  FORBIDDEN: 403,
+  WRITE_NOT_ALLOWED_HERE: 403,
+  PROVIDER_NOT_READY: 409,
+  UNAVAILABLE: 503
+};
+var controlsModule = null;
+function loadControls() {
+  controlsModule ??= import("@stardeck-customer-apps/controls");
+  return controlsModule;
+}
+function currentControlsBody() {
+  const controls = {};
+  for (const [key, value] of Object.entries(state.controls.values)) {
+    controls[key] = state.controls.unavailable.has(key) ? { ok: false, reason: "unavailable (simulated)" } : { ok: true, value };
+  }
+  return controls;
+}
+function refusalResponse(refusal) {
+  return json({ error: refusal }, REFUSAL_STATUS[refusal.code]);
+}
+function handleSync(body) {
+  const usage = body.usage;
+  if (typeof usage === "object" && usage !== null) {
+    const locations = usage.locations;
+    state.controls.lastUsage = typeof locations === "number" && Number.isInteger(locations) && locations >= 0 ? { locations } : {};
+  }
+  return json({ controls: currentControlsBody() });
+}
+async function handleWrite(request, key) {
+  const { CONTROLS, isWritableControl } = await loadControls();
+  if (!isWritableControl(key)) {
+    return refusalResponse({
+      code: "NOT_WRITABLE",
+      message: `${key} cannot be changed from the app`
+    });
+  }
+  const userToken = request.headers.get(USER_TOKEN_HEADER);
+  if (!userToken) {
+    return refusalResponse({
+      code: "UNAUTHENTICATED",
+      message: "A signed-in person is required (X-Stardeck-User-Token)"
+    });
+  }
+  const body = await readJsonBody(request);
+  const parsed = CONTROLS[key].schema.safeParse(body.value);
+  if (!parsed.success) {
+    return refusalResponse({
+      code: "INVALID_VALUE",
+      message: parsed.error.issues[0]?.message ?? "Invalid value"
+    });
+  }
+  const refusal = state.controls.refusal;
+  if (refusal) {
+    state.controls.refusal = null;
+    return refusalResponse(refusal);
+  }
+  state.controls.values[key] = parsed.data;
+  state.controls.unavailable.delete(key);
+  state.controls.writes.push({ key, value: parsed.data, userToken });
+  return json({ controls: currentControlsBody() });
+}
+var CONTROLS_PATH = /^\/api\/deployments\/[^/]+\/controls(?:\/([^/]+))?$/;
+async function handleControlsRequest(request, url) {
+  const match = url.pathname.match(CONTROLS_PATH);
+  const key = match?.[1] ? decodeURIComponent(match[1]) : null;
+  if (!key && request.method === "POST") {
+    return handleSync(await readJsonBody(request));
+  }
+  if (key && request.method === "PUT") {
+    return handleWrite(request, key);
+  }
+  return json(
+    {
+      error: { code: "UNAVAILABLE", message: `No simulator for ${request.method} ${url.pathname}` }
+    },
+    404
+  );
+}
+
 // src/simulator/schedules.ts
 async function handleScheduleWake(request, scheduleKey) {
   if (request.method !== "POST") return failure(`Method ${request.method} not allowed`, 405);
@@ -3158,8 +3628,10 @@ function requiresDeploymentHmac(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStarlens = url.pathname === "/api/starlens/extract";
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
-  return !!(isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail2 || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
+  const controlsMatch = url.pathname.match(CONTROLS_PATH2);
+  return !!(controlsMatch || isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail2 || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
+var CONTROLS_PATH2 = /^\/api\/deployments\/[^/]+\/controls(\/[^/]+)?$/;
 var SCHEDULE_WAKE_PATH = /^\/api\/deployments\/[^/]+\/schedules\/([^/]+)\/wake$/;
 function deploymentIdFromPath(url) {
   const match = url.pathname.match(/\/api\/deployments\/([^/]+)(?:\/|$)/);
@@ -3227,6 +3699,9 @@ async function handleSimulatedRequest(request, url) {
   if (edgeMatch) {
     return handleEdgeRequest(request, edgeMatch[1] ?? "");
   }
+  if (CONTROLS_PATH2.test(url.pathname)) {
+    return handleControlsRequest(request, url);
+  }
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
   if (scheduleWakeMatch) {
     return handleScheduleWake(request, decodeURIComponent(scheduleWakeMatch[1]));
@@ -3255,7 +3730,7 @@ async function handleSimulatedRequest(request, url) {
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, app controls sync/write, starlens extract, schedule wakes, auth verify/refresh, Neon /sql.`,
     404
   );
 }