@stardeck-customer-apps/testing 0.3.1 → 0.4.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/test-app.ts
-import crypto4 from "crypto";
+import crypto8 from "crypto";
 import { readFileSync, existsSync } from "fs";
 import { resolve } from "path";
 
@@ -54,7 +54,16 @@ var state = globalSingleton("state", () => ({
   emailCounter: 0,
   identities: /* @__PURE__ */ new Map(),
   identityLinks: [],
-  identityMemory: [],
+  checkouts: [],
+  checkoutCounter: 0,
+  sessionStatuses: /* @__PURE__ */ new Map(),
+  paymentLinks: /* @__PURE__ */ new Map(),
+  products: [],
+  uploads: [],
+  uploadCounter: 0,
+  storageFiles: /* @__PURE__ */ new Map(),
+  presignPending: /* @__PURE__ */ new Map(),
+  messages: [],
   allowNetwork: false
 }));
 function requireDb() {
@@ -70,13 +79,16 @@ function requireDb() {
 var TEST_DOMAIN_SUFFIX = ".stardeck.test";
 var CONTROL_PLANE_TEST_URL = "https://control-plane.stardeck.test";
 var DATA_STORE_TEST_HOST = "db.stardeck.test";
+var STORAGE_TEST_URL = "https://storage.stardeck.test";
+var STORAGE_TEST_HOST = "storage.stardeck.test";
 var TEST_ENV_DEFAULTS = {
   CONTROL_PLANE_URL: CONTROL_PLANE_TEST_URL,
   DEPLOYMENT_SECRET: "stardeck-test-deployment-secret",
   ORGANIZATION_ID: "00000000-0000-4000-8000-00000000000a",
   PROJECT_ID: "00000000-0000-4000-8000-00000000000b",
   DEPLOYMENT_ID: "00000000-0000-4000-8000-00000000000c",
-  DATA_STORE_URL: `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`
+  DATA_STORE_URL: `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`,
+  STORAGE_URL: STORAGE_TEST_URL
 };
 var DEFAULT_TEST_USER = {
   id: "test-user-1",
@@ -132,6 +144,13 @@ function success(data) {
 function failure(error, status = 400) {
   return json({ success: false, error }, status);
 }
+async function readJsonBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
 
 // src/simulator/data-store.ts
 function quoteIdent(name) {
@@ -614,13 +633,6 @@ function now() {
 function linksFor(identityId) {
   return state.identityLinks.filter((l) => l.identityId === identityId);
 }
-async function readBody(request) {
-  try {
-    return await request.json();
-  } catch {
-    return {};
-  }
-}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
@@ -628,7 +640,7 @@ function handleList(request) {
   return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
 }
 async function handleCreate(request) {
-  const body = await readBody(request);
+  const body = await readJsonBody(request);
   const type = body.type;
   if (type !== "person" && type !== "account") {
     return failure("type must be 'person' or 'account'");
@@ -665,7 +677,7 @@ function handleGet(identityId) {
 async function handleUpdate(identityId, request) {
   const identity = state.identities.get(identityId);
   if (!identity) return failure("identity not found", 404);
-  const body = await readBody(request);
+  const body = await readJsonBody(request);
   if (body.displayName !== void 0) {
     identity.displayName = body.displayName;
   }
@@ -687,7 +699,7 @@ async function handleAttachLink(identityId, request) {
   if (identity.status !== "active") {
     return failure("links attach only to active persons");
   }
-  const body = await readBody(request);
+  const body = await readJsonBody(request);
   const kind = body.kind;
   const externalId = body.externalId;
   if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
@@ -712,108 +724,16 @@ async function handleAttachLink(identityId, request) {
   state.identityLinks.push(link);
   return success({ link });
 }
-function memoryDto(m) {
-  return {
-    id: m.id,
-    source: m.source,
-    kind: m.kind,
-    content: m.content,
-    metadata: m.metadata,
-    createdAt: m.createdAt
-  };
-}
-async function handleResolve(request) {
-  const body = await readBody(request);
-  const type = body.type;
-  if (type !== "person" && type !== "account") {
-    return failure("type must be 'person' or 'account'");
-  }
-  if (type === "account") {
-    return failure(
-      "resolveOrCreate is for channel-linked persons; an account is not resolvable by link \u2014 create it explicitly instead.",
-      409
-    );
-  }
-  const link = body.link;
-  const kind = link?.kind;
-  const externalId = link?.externalId;
-  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
-    return failure(`link.kind must be one of: ${[...LINK_KINDS].join(", ")}`);
-  }
-  if (typeof externalId !== "string" || !externalId) {
-    return failure("link.externalId is required");
-  }
-  const existingLink = state.identityLinks.find(
-    (l) => l.kind === kind && l.externalId === externalId
-  );
-  if (existingLink) {
-    const identity2 = state.identities.get(existingLink.identityId);
-    if (identity2) return success({ identity: identity2, created: false });
-  }
-  const identity = {
-    id: crypto3.randomUUID(),
-    type,
-    parentId: null,
-    displayName: body.displayName ?? null,
-    profile: body.profile ?? {},
-    status: "active",
-    mergedIntoId: null,
-    externalRef: null,
-    createdAt: now(),
-    updatedAt: now()
-  };
-  state.identities.set(identity.id, identity);
-  state.identityLinks.push({
-    id: crypto3.randomUUID(),
-    identityId: identity.id,
-    kind,
-    externalId,
-    verified: true,
-    createdAt: now()
-  });
-  return success({ identity, created: true });
-}
-async function handleWriteMemory(identityId, request) {
-  if (!state.identities.get(identityId)) return failure("Identity not found", 404);
-  const body = await readBody(request);
-  if (typeof body.content !== "string" || !body.content) return failure("content is required");
-  const entry = {
-    id: crypto3.randomUUID(),
-    identityId,
-    source: typeof body.source === "string" ? body.source : "app",
-    kind: typeof body.kind === "string" ? body.kind : "fact",
-    content: body.content,
-    metadata: body.metadata ?? {},
-    createdAt: now()
-  };
-  state.identityMemory.push(entry);
-  return success({ memory: memoryDto(entry) });
-}
-function handleListMemory(identityId, request) {
-  if (!state.identities.get(identityId)) return failure("Identity not found", 404);
-  let rows = state.identityMemory.filter((m) => m.identityId === identityId).reverse();
-  const limitParam = new URL(request.url).searchParams.get("limit");
-  if (limitParam) rows = rows.slice(0, Math.max(1, parseInt(limitParam, 10) || 0));
-  return success({ memories: rows.map(memoryDto) });
-}
 async function handleIdentitiesRequest(request, subPath) {
   const method = request.method;
   if (subPath === "" || subPath === "/") {
     if (method === "GET") return handleList(request);
     if (method === "POST") return handleCreate(request);
   }
-  if (subPath === "/resolve" && method === "POST") {
-    return handleResolve(request);
-  }
   const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
   if (linksMatch && method === "POST") {
     return handleAttachLink(linksMatch[1], request);
   }
-  const memoryMatch = subPath.match(/^\/([^/]+)\/memory$/);
-  if (memoryMatch) {
-    if (method === "GET") return handleListMemory(memoryMatch[1], request);
-    if (method === "POST") return handleWriteMemory(memoryMatch[1], request);
-  }
   const singleMatch = subPath.match(/^\/([^/]+)$/);
   if (singleMatch) {
     if (method === "GET") return handleGet(singleMatch[1]);
@@ -836,6 +756,679 @@ function createDirectory() {
   };
 }
 
+// src/simulator/payments.ts
+import crypto5 from "crypto";
+
+// src/next/headers-shim.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestScopeStorage = globalSingleton(
+  "request-scope",
+  () => new AsyncLocalStorage()
+);
+
+// src/next/call-route.ts
+function parseCookieHeader(header) {
+  const map = /* @__PURE__ */ new Map();
+  if (!header) return map;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    map.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+  }
+  return map;
+}
+async function importNextServer() {
+  try {
+    return await import("next/server.js");
+  } catch {
+    return await import("next/server");
+  }
+}
+async function callRoute(handler, options = {}) {
+  const { NextRequest } = await importNextServer();
+  const path = options.path ?? "/api/test-route";
+  const url = new URL(`http://localhost:3333${path}`);
+  for (const [key, value] of Object.entries(options.searchParams ?? {})) {
+    url.searchParams.set(key, value);
+  }
+  const method = options.method ?? (options.body !== void 0 ? "POST" : "GET");
+  const headers = new Headers(options.headers);
+  const user = options.user !== void 0 ? options.user : state.currentUser;
+  if (user && !headers.has("x-stardeck-user")) {
+    headers.set("x-stardeck-user", JSON.stringify(user));
+  }
+  if (options.body !== void 0 && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
+  }
+  const cookiePairs = Object.entries(options.cookies ?? {});
+  if (cookiePairs.length > 0) {
+    const existing = headers.get("cookie");
+    const cookieString = cookiePairs.map(([k, v]) => `${k}=${v}`).join("; ");
+    headers.set("cookie", existing ? `${existing}; ${cookieString}` : cookieString);
+  }
+  const request = new NextRequest(url, {
+    method,
+    headers,
+    body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+  });
+  const scope = {
+    headers,
+    cookies: parseCookieHeader(headers.get("cookie"))
+  };
+  try {
+    return await requestScopeStorage.run(
+      scope,
+      () => Promise.resolve(
+        handler(request, {
+          params: Promise.resolve(options.params ?? {})
+        })
+      )
+    );
+  } catch (error) {
+    const redirect = decodeNextRedirect(error);
+    if (redirect) return redirect;
+    throw error;
+  }
+}
+function decodeNextRedirect(error) {
+  const digest = error?.digest;
+  if (typeof digest !== "string" || !digest.startsWith("NEXT_REDIRECT")) return null;
+  const parts = digest.split(";");
+  const location = parts[2] ?? "/";
+  const status = Number(parts[3]) || 307;
+  return new Response(null, { status, headers: { location } });
+}
+
+// src/simulator/webhook-signing.ts
+import crypto4 from "crypto";
+function signEventDelivery(secret, context, rawBody) {
+  const payload = {
+    type: "deployment-request",
+    organizationId: context.organizationId,
+    projectId: context.projectId,
+    deploymentId: context.deploymentId,
+    timestamp: Math.floor(Date.now() / 1e3),
+    nonce: crypto4.randomUUID()
+  };
+  const payloadJson = JSON.stringify(payload);
+  const payloadB64 = Buffer.from(payloadJson).toString("base64");
+  const signature = crypto4.createHmac("sha256", secret).update(payloadJson).update(rawBody).digest("hex");
+  return `${payloadB64}.${signature}`;
+}
+
+// src/simulator/payments.ts
+function payErr(error, status = 400, code) {
+  return json(code ? { error, code } : { error }, status);
+}
+function nextCheckoutId() {
+  state.checkoutCounter += 1;
+  return `cs_test_${state.checkoutCounter}`;
+}
+function nextPaymentLinkId() {
+  state.checkoutCounter += 1;
+  return `plink_test_${state.checkoutCounter}`;
+}
+function seedStripeSession(id, body) {
+  const lineItems = body.lineItems ?? [];
+  let amountTotal = null;
+  let currency = null;
+  if (lineItems.length > 0) {
+    amountTotal = lineItems.reduce(
+      (sum, item) => sum + (item.priceData?.unitAmount ?? 0) * (item.quantity ?? 1),
+      0
+    );
+    currency = lineItems[0].priceData?.currency ?? null;
+  }
+  state.sessionStatuses.set(id, {
+    id,
+    status: "open",
+    paymentStatus: "unpaid",
+    mode: body.mode ?? "payment",
+    amountTotal,
+    currency,
+    customerEmail: body.customerEmail ? String(body.customerEmail) : null,
+    metadata: body.metadata ?? {},
+    expiresAt: Math.floor(Date.now() / 1e3) + 3600
+  });
+}
+function seedBeamLink(id, body, merchantId) {
+  const order = body.order;
+  state.paymentLinks.set(id, {
+    paymentLinkId: id,
+    merchantId,
+    url: `https://beam.test/pay/${id}`,
+    status: "ACTIVE",
+    order: {
+      netAmount: Number(order?.netAmount ?? 0),
+      currency: String(order?.currency ?? "THB"),
+      description: String(order?.description ?? ""),
+      referenceId: order?.referenceId ? String(order.referenceId) : void 0,
+      internalNote: order?.internalNote ? String(order.internalNote) : void 0,
+      orderItems: order?.orderItems
+    },
+    redirectUrl: body.redirectUrl ? String(body.redirectUrl) : void 0,
+    linkSettings: body.linkSettings,
+    collectDeliveryAddress: body.collectDeliveryAddress === true
+  });
+}
+async function deliverEvent(envelope, handler, options) {
+  const rawBody = JSON.stringify(envelope);
+  const secret = options?.deploymentSecret ?? TEST_ENV_DEFAULTS.DEPLOYMENT_SECRET;
+  const authHeader = signEventDelivery(
+    secret,
+    {
+      organizationId: TEST_ENV_DEFAULTS.ORGANIZATION_ID,
+      projectId: TEST_ENV_DEFAULTS.PROJECT_ID,
+      deploymentId: TEST_ENV_DEFAULTS.DEPLOYMENT_ID
+    },
+    rawBody
+  );
+  return callRoute(handler, {
+    method: "POST",
+    path: options?.path ?? "/api/payments/webhooks",
+    params: { path: ["webhooks"] },
+    headers: { "X-Stardeck-Auth": authHeader },
+    body: envelope
+  });
+}
+async function handlePaymentsRequest(request, url) {
+  const pathname = url.pathname;
+  if (/\/bolt-connections/.test(pathname) || /\/bolt-intents/.test(pathname) || /\/charges(\/|$)/.test(pathname) || /\/billing-portal$/.test(pathname)) {
+    return payErr("Not found", 404, "NOT_FOUND");
+  }
+  const beamProductsMatch = pathname.match(
+    /^\/api\/store\/beam\/([^/]+)\/payment-links(?:\/([^/]+))?$/
+  );
+  if (beamProductsMatch) {
+    const merchantId = beamProductsMatch[1];
+    const linkId = beamProductsMatch[2];
+    if (!linkId && request.method === "POST") {
+      const body = await readJsonBody(request);
+      const id = nextPaymentLinkId();
+      const checkoutUrl = `https://beam.test/pay/${id}`;
+      const captured = {
+        id,
+        url: checkoutUrl,
+        provider: "beam",
+        options: body,
+        metadata: body.metadata,
+        createdAt: /* @__PURE__ */ new Date()
+      };
+      state.checkouts.push(captured);
+      seedBeamLink(id, body, merchantId);
+      return json({ id, url: checkoutUrl });
+    }
+    if (linkId && request.method === "GET") {
+      const link = state.paymentLinks.get(linkId);
+      if (!link) return payErr("Payment link not found", 404, "NOT_FOUND");
+      return json({ paymentLink: link });
+    }
+  }
+  const stripeStoreMatch = pathname.match(/^\/api\/store\/([^/]+)\/(.+)$/);
+  if (stripeStoreMatch) {
+    const accountId = stripeStoreMatch[1];
+    const subPath = stripeStoreMatch[2];
+    if (accountId === "beam") {
+      return payErr(`No payments simulator for ${request.method} ${pathname}`, 404);
+    }
+    if (subPath === "products" && request.method === "GET") {
+      return json({ products: state.products });
+    }
+    const productMatch = subPath.match(/^products\/([^/]+)$/);
+    if (productMatch && request.method === "GET") {
+      const product = state.products.find((p) => p.id === productMatch[1]);
+      if (!product) return payErr("Product not found", 404, "NOT_FOUND");
+      return json({ product });
+    }
+    if (subPath === "checkout" && request.method === "POST") {
+      const body = await readJsonBody(request);
+      const id = nextCheckoutId();
+      const checkoutUrl = `https://checkout.stripe.test/c/pay/${id}`;
+      const captured = {
+        id,
+        url: checkoutUrl,
+        provider: "stripe",
+        options: body,
+        mode: body.mode,
+        metadata: body.metadata,
+        createdAt: /* @__PURE__ */ new Date()
+      };
+      state.checkouts.push(captured);
+      seedStripeSession(id, body);
+      return json({ id, url: checkoutUrl });
+    }
+    const sessionMatch = subPath.match(/^checkout-sessions\/([^/]+)$/);
+    if (sessionMatch && request.method === "GET") {
+      const session = state.sessionStatuses.get(sessionMatch[1]);
+      if (!session) return payErr("Checkout session not found", 404, "NOT_FOUND");
+      return json({ session });
+    }
+  }
+  return payErr(`No payments simulator for ${request.method} ${pathname}`, 404);
+}
+function createPayments() {
+  return {
+    get checkouts() {
+      return [...state.checkouts];
+    },
+    latest() {
+      return state.checkouts[state.checkouts.length - 1];
+    },
+    setProducts(products) {
+      state.products = products;
+    },
+    markPaid(id) {
+      const session = state.sessionStatuses.get(id);
+      if (session) {
+        session.status = "complete";
+        session.paymentStatus = "paid";
+        return;
+      }
+      const link = state.paymentLinks.get(id);
+      if (link) {
+        link.status = "PAID";
+        return;
+      }
+      throw new Error(`[stardeck-testing] Unknown checkout or payment link id: ${id}`);
+    },
+    setSessionStatus(id, status) {
+      const session = state.sessionStatuses.get(id);
+      if (!session) {
+        throw new Error(`[stardeck-testing] Unknown checkout session id: ${id}`);
+      }
+      Object.assign(session, status);
+    },
+    setPaymentLinkStatus(id, status) {
+      const link = state.paymentLinks.get(id);
+      if (!link) {
+        throw new Error(`[stardeck-testing] Unknown payment link id: ${id}`);
+      }
+      link.status = status;
+    },
+    async deliverStripeEvent(handler, event, options) {
+      const envelope = {
+        id: `evt_test_${crypto5.randomUUID()}`,
+        kind: "stripe_webhook",
+        timestamp: Date.now(),
+        stripeEvent: {
+          type: event.type,
+          accountId: event.accountId ?? process.env.STRIPE_CONNECT_ACCOUNT_ID ?? "acct_test",
+          data: event.data
+        }
+      };
+      return deliverEvent(envelope, handler, options);
+    },
+    async deliverBeamEvent(handler, event, options) {
+      const envelope = {
+        id: `beam_evt_test_${crypto5.randomUUID()}`,
+        kind: "beam_webhook",
+        timestamp: Date.now(),
+        beamEvent: {
+          type: event.type,
+          payload: event.payload
+        }
+      };
+      return deliverEvent(envelope, handler, options);
+    },
+    clear() {
+      state.checkouts = [];
+      state.checkoutCounter = 0;
+      state.sessionStatuses.clear();
+      state.paymentLinks.clear();
+      state.products = [];
+    },
+    get count() {
+      return state.checkouts.length;
+    }
+  };
+}
+
+// src/simulator/storage.ts
+import crypto6 from "crypto";
+function storageErr(error, status = 400) {
+  return json({ error }, status);
+}
+function fileExtension(filename) {
+  const dot = filename.lastIndexOf(".");
+  return dot === -1 ? "bin" : filename.slice(dot + 1);
+}
+function buildKey(fileId, filename) {
+  const orgId = process.env.ORGANIZATION_ID ?? TEST_ENV_DEFAULTS.ORGANIZATION_ID;
+  const projectId = process.env.PROJECT_ID ?? TEST_ENV_DEFAULTS.PROJECT_ID;
+  const deploymentId = process.env.DEPLOYMENT_ID ?? TEST_ENV_DEFAULTS.DEPLOYMENT_ID;
+  return `${orgId}/${projectId}/${deploymentId}/${fileId}.${fileExtension(filename)}`;
+}
+function buildUrl(key) {
+  return `${STORAGE_TEST_URL}/files/${key}`;
+}
+function toUploadResponse(record) {
+  return {
+    id: record.id,
+    key: record.key,
+    filename: record.filename,
+    contentType: record.contentType,
+    sizeBytes: record.sizeBytes,
+    url: record.url,
+    uploadedAt: record.uploadedAt,
+    isPublic: record.isPublic,
+    metadata: record.metadata
+  };
+}
+function captureUpload(record, method, path) {
+  const captured = {
+    id: record.id,
+    key: record.key,
+    filename: record.filename,
+    contentType: record.contentType,
+    sizeBytes: record.sizeBytes,
+    url: record.url,
+    uploadedAt: record.uploadedAt,
+    isPublic: record.isPublic,
+    metadata: record.metadata,
+    method,
+    path
+  };
+  state.uploads.push(captured);
+}
+function createFileRecord(input) {
+  state.uploadCounter += 1;
+  const id = `file_test_${state.uploadCounter}`;
+  const key = buildKey(id, input.filename);
+  return {
+    id,
+    key,
+    filename: input.filename,
+    contentType: input.contentType,
+    sizeBytes: input.sizeBytes,
+    url: buildUrl(key),
+    uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    metadata: input.metadata,
+    isPublic: input.isPublic,
+    deleted: false
+  };
+}
+function activeFiles() {
+  return [...state.storageFiles.values()].filter((f) => !f.deleted);
+}
+async function handleStorageRequest(request, url) {
+  const pathname = url.pathname;
+  if (pathname.startsWith("/upload/presign/multipart")) {
+    return storageErr("Not found", 404);
+  }
+  const presignedPutMatch = pathname.match(/^\/presigned\/([^/]+)$/);
+  if (presignedPutMatch && request.method === "PUT") {
+    const fileId = presignedPutMatch[1];
+    if (!state.presignPending.has(fileId)) {
+      return storageErr("Presign session not found", 404);
+    }
+    return new Response(null, {
+      status: 200,
+      headers: { etag: `"${crypto6.randomUUID()}"` }
+    });
+  }
+  if (pathname === "/upload/presign/complete" && request.method === "POST") {
+    const body = await readJsonBody(request);
+    const fileId = String(body.fileId ?? "");
+    const pending = state.presignPending.get(fileId);
+    if (!pending) return storageErr("Presign session not found", 404);
+    const record = {
+      id: fileId,
+      key: pending.key,
+      filename: pending.fileName,
+      contentType: pending.contentType,
+      sizeBytes: pending.sizeBytes,
+      url: buildUrl(pending.key),
+      uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata: pending.metadata,
+      isPublic: pending.isPublic,
+      deleted: false
+    };
+    state.storageFiles.set(record.id, record);
+    state.presignPending.delete(fileId);
+    captureUpload(record, "POST", "/upload/presign/complete");
+    return json(toUploadResponse(record));
+  }
+  if (pathname === "/upload/presign" && request.method === "POST") {
+    const body = await readJsonBody(request);
+    const fileName = String(body.fileName ?? "upload.bin");
+    const contentType = String(body.contentType ?? "application/octet-stream");
+    const sizeBytes = Number(body.sizeBytes ?? 0);
+    const isPublic = body.isPublic !== false;
+    const metadata = body.metadata;
+    state.uploadCounter += 1;
+    const fileId = `file_test_${state.uploadCounter}`;
+    const key = buildKey(fileId, fileName);
+    state.presignPending.set(fileId, {
+      fileName,
+      contentType,
+      sizeBytes,
+      isPublic,
+      metadata,
+      key
+    });
+    return json({
+      fileId,
+      key,
+      presignedUrl: `${STORAGE_TEST_URL}/presigned/${fileId}`,
+      contentType,
+      expiresIn: 3600
+    });
+  }
+  if (pathname === "/upload" && request.method === "POST") {
+    const isPublic = url.searchParams.get("isPublic") !== "false";
+    const formData = await request.formData();
+    const file = formData.get("file");
+    if (!(file instanceof Blob)) {
+      return storageErr("file is required");
+    }
+    const filename = formData.get("filename") ?? (file instanceof File ? file.name : "upload.bin");
+    const metadataRaw = formData.get("metadata");
+    let metadata;
+    if (typeof metadataRaw === "string" && metadataRaw) {
+      try {
+        metadata = JSON.parse(metadataRaw);
+      } catch {
+        return storageErr("metadata must be valid JSON");
+      }
+    }
+    const record = createFileRecord({
+      filename,
+      contentType: file.type || "application/octet-stream",
+      sizeBytes: file.size,
+      isPublic,
+      metadata
+    });
+    state.storageFiles.set(record.id, record);
+    captureUpload(record, "POST", "/upload");
+    return json(toUploadResponse(record));
+  }
+  const fileMatch = pathname.match(/^\/api\/files\/([^/]+)$/);
+  if (fileMatch) {
+    const fileId = fileMatch[1];
+    const record = state.storageFiles.get(fileId);
+    if (!record || record.deleted) {
+      return storageErr("File not found", 404);
+    }
+    if (request.method === "GET") {
+      return json(toUploadResponse(record));
+    }
+    if (request.method === "PATCH") {
+      const body = await readJsonBody(request);
+      if (body.fileName !== void 0) record.filename = String(body.fileName);
+      if (body.metadata !== void 0) {
+        record.metadata = body.metadata;
+      }
+      if (body.isPublic !== void 0) record.isPublic = body.isPublic === true;
+      return json(toUploadResponse(record));
+    }
+    if (request.method === "DELETE") {
+      record.deleted = true;
+      return json({ success: true });
+    }
+  }
+  if (pathname === "/api/files" && request.method === "GET") {
+    const parseParam = (raw, fallback, min) => {
+      const n = Number(raw);
+      return Number.isFinite(n) && n >= min ? Math.floor(n) : fallback;
+    };
+    const limit = parseParam(url.searchParams.get("limit"), 50, 1);
+    const offset = parseParam(url.searchParams.get("offset"), 0, 0);
+    const prefix = url.searchParams.get("prefix") ?? "";
+    let files = activeFiles();
+    if (prefix) {
+      files = files.filter((f) => f.key.startsWith(prefix) || f.filename.startsWith(prefix));
+    }
+    const total = files.length;
+    const slice = files.slice(offset, offset + limit);
+    return json({
+      files: slice.map((f) => toUploadResponse(f)),
+      total,
+      limit,
+      offset,
+      hasMore: offset + slice.length < total
+    });
+  }
+  return storageErr(`No storage simulator for ${request.method} ${pathname}`, 404);
+}
+function createStorage() {
+  return {
+    get uploads() {
+      return [...state.uploads];
+    },
+    latest() {
+      return state.uploads[state.uploads.length - 1];
+    },
+    clear() {
+      state.uploads = [];
+      state.uploadCounter = 0;
+      state.storageFiles.clear();
+      state.presignPending.clear();
+    },
+    get count() {
+      return state.uploads.length;
+    }
+  };
+}
+
+// src/simulator/messaging.ts
+import crypto7 from "crypto";
+function captureMessage(channel, recipient, body, connectionId) {
+  const message = {
+    channel,
+    recipient,
+    body: {
+      text: body.text ? String(body.text) : void 0,
+      blocks: body.blocks,
+      threadTs: body.threadTs ? String(body.threadTs) : void 0,
+      messagingType: body.messagingType ? String(body.messagingType) : void 0,
+      tag: body.tag ? String(body.tag) : void 0
+    },
+    connectionId,
+    sentAt: /* @__PURE__ */ new Date()
+  };
+  state.messages.push(message);
+}
+async function handleMessagingRequest(request, channel, subPath) {
+  const method = request.method;
+  if ((subPath === "" || subPath === "/" || subPath === "/connections") && method === "GET") {
+    return success({ connections: [] });
+  }
+  if (channel === "slack" && subPath === "/send" && method === "POST") {
+    const body = await readJsonBody(request);
+    if (!body.text && !body.blocks) {
+      return failure("text or blocks is required");
+    }
+    const slackChannel = String(body.channel ?? "");
+    if (!slackChannel) {
+      return failure("channel is required");
+    }
+    captureMessage(
+      "slack",
+      slackChannel,
+      body,
+      body.connectionId ? String(body.connectionId) : void 0
+    );
+    return success({
+      ok: true,
+      ts: `${Date.now()}.${crypto7.randomUUID().slice(0, 6)}`,
+      channel: slackChannel
+    });
+  }
+  if (channel === "line" && subPath === "/push" && method === "POST") {
+    const body = await readJsonBody(request);
+    const userId = String(body.userId ?? "");
+    const message = body.message;
+    if (!userId) return failure("userId is required");
+    if (!message || message.type !== "text" || !message.text) {
+      return failure("message must be { type: 'text', text: string }");
+    }
+    if (message.text.length > 5e3) {
+      return failure("message text exceeds maximum length");
+    }
+    captureMessage(
+      "line",
+      userId,
+      { text: message.text },
+      body.connectionId ? String(body.connectionId) : void 0
+    );
+    return success({ success: true });
+  }
+  if (channel === "facebook" && subPath === "/send" && method === "POST") {
+    const body = await readJsonBody(request);
+    const recipientId = String(body.recipientId ?? "");
+    const message = body.message;
+    if (!recipientId) return failure("recipientId is required");
+    if (!message || message.type !== "text" || !message.text) {
+      return failure("message must be { type: 'text', text: string }");
+    }
+    if (message.text.length > 2e3) {
+      return failure("message text exceeds maximum length");
+    }
+    captureMessage(
+      "facebook",
+      recipientId,
+      {
+        text: message.text,
+        messagingType: body.messagingType ? String(body.messagingType) : void 0,
+        tag: body.tag ? String(body.tag) : void 0
+      },
+      body.connectionId ? String(body.connectionId) : void 0
+    );
+    return success({ success: true });
+  }
+  return failure(`No messaging simulator for ${method} .../integrations/${channel}${subPath}`, 404);
+}
+function createMessages() {
+  return {
+    all() {
+      return [...state.messages];
+    },
+    latest() {
+      return state.messages[state.messages.length - 1];
+    },
+    to(recipient) {
+      return state.messages.filter((m) => m.recipient === recipient);
+    },
+    channel(kind) {
+      const filtered = () => state.messages.filter((m) => m.channel === kind);
+      return {
+        all: () => filtered(),
+        latest: () => {
+          const pool = filtered();
+          return pool[pool.length - 1];
+        },
+        to: (recipient) => filtered().filter((m) => m.recipient === recipient)
+      };
+    },
+    clear() {
+      state.messages = [];
+    },
+    get count() {
+      return state.messages.length;
+    }
+  };
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -843,6 +1436,21 @@ var fetchHolder = globalSingleton("fetch-holder", () => ({
 function isLocalHost(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0";
 }
+function requiresDeploymentHmac(request, url) {
+  const isStorageHost = url.hostname === STORAGE_TEST_HOST;
+  const isPresignedPut = isStorageHost && request.method === "PUT" && /^\/presigned\/[^/]+$/.test(url.pathname);
+  if (isStorageHost) {
+    return !isPresignedPut;
+  }
+  const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
+  const isEmail = url.pathname === "/api/email/send";
+  const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
+  const storeMatch = url.pathname.match(/^\/api\/store\//);
+  const messagingMatch = url.pathname.match(
+    /^\/api\/deployments\/[^/]+\/integrations\/(slack|line|facebook)(\/.*)?$/
+  );
+  return !!(dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch);
+}
 async function handleSimulatedRequest(request, url) {
   if (url.pathname === "/sql") {
     return handleNeonSql(requireDb(), request);
@@ -854,7 +1462,12 @@ async function handleSimulatedRequest(request, url) {
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
-  if (dataStoreMatch || isEmail || identitiesMatch) {
+  const storeMatch = url.pathname.match(/^\/api\/store\//);
+  const messagingMatch = url.pathname.match(
+    /^\/api\/deployments\/[^/]+\/integrations\/(slack|line|facebook)(\/.*)?$/
+  );
+  const isStorageHost = url.hostname === STORAGE_TEST_HOST;
+  if (requiresDeploymentHmac(request, url)) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
       return failure("Missing authentication header", 401);
@@ -864,34 +1477,44 @@ async function handleSimulatedRequest(request, url) {
       return failure("Invalid authentication", 401);
     }
   }
+  if (isStorageHost) {
+    return handleStorageRequest(request, url);
+  }
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }
   if (identitiesMatch) {
     return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
   }
+  if (storeMatch) {
+    return handlePaymentsRequest(request, url);
+  }
+  if (messagingMatch) {
+    const channel = messagingMatch[1];
+    return handleMessagingRequest(request, channel, messagingMatch[2] ?? "");
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
-    const readBody2 = async () => await request.json();
+    const readBody = async () => await request.json();
     if (subPath === "/query" && request.method === "POST") {
-      return handleQuery(db, await readBody2());
+      return handleQuery(db, await readBody());
     }
     if (subPath === "/mutate" && request.method === "POST") {
-      return handleMutate(db, await readBody2());
+      return handleMutate(db, await readBody());
     }
     if (subPath === "/schema" && request.method === "GET") {
       return handleGetSchema(db);
     }
     if (subPath === "/schema/tables" && request.method === "POST") {
-      return handleCreateTable(db, await readBody2());
+      return handleCreateTable(db, await readBody());
     }
     if (subPath === "/schema/columns" && request.method === "POST") {
-      return handleAddColumn(db, await readBody2());
+      return handleAddColumn(db, await readBody());
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, auth verify/refresh, Neon /sql.`,
     404
   );
 }
@@ -977,10 +1600,16 @@ async function createTestApp(options = {}) {
   }
   const inbox = createInbox();
   const directory = createDirectory();
+  const payments = createPayments();
+  const storage = createStorage();
+  const messages = createMessages();
   const app = {
     db,
     inbox,
     identities: directory,
+    payments,
+    storage,
+    messages,
     async query(sql, params = []) {
       const result = await db.query(sql, params);
       return result.rows;
@@ -996,8 +1625,8 @@ async function createTestApp(options = {}) {
     issueSession(user) {
       const fullUser = buildUser(user);
       const tokens = {
-        accessToken: `test-access-${crypto4.randomUUID()}`,
-        refreshToken: `test-refresh-${crypto4.randomUUID()}`
+        accessToken: `test-access-${crypto8.randomUUID()}`,
+        refreshToken: `test-refresh-${crypto8.randomUUID()}`
       };
       state.sessions.set(tokens.accessToken, fullUser);
       state.refreshSessions.set(tokens.refreshToken, fullUser);
@@ -1013,7 +1642,9 @@ async function createTestApp(options = {}) {
       state.emailCounter = 0;
       state.identities.clear();
       state.identityLinks = [];
-      state.identityMemory = [];
+      payments.clear();
+      storage.clear();
+      messages.clear();
     },
     async close() {
       state.db = null;
@@ -1021,9 +1652,12 @@ async function createTestApp(options = {}) {
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];
+      state.emailCounter = 0;
       state.identities.clear();
       state.identityLinks = [];
-      state.identityMemory = [];
+      payments.clear();
+      storage.clear();
+      messages.clear();
       uninstallFetchRouter();
       await db.close();
     }
@@ -1031,122 +1665,6 @@ async function createTestApp(options = {}) {
   return app;
 }
 
-// src/module-app.ts
-import {
-  makeSqlPort,
-  renderSchemaOpsToSql
-} from "@stardeck-customer-apps/core";
-async function createModuleApp(options) {
-  const schemaSql = options.modules.map((m) => renderSchemaOpsToSql(m.schema)).join("\n\n");
-  const app = await createTestApp({ schemaSql, allowNetwork: options.allowNetwork });
-  const sql = { query: (text, params) => app.db.query(text, params ?? []) };
-  const data = makeSqlPort(sql);
-  const { createIntegrationsClient } = await import("@stardeck-customer-apps/integrations-sdk");
-  const identities = createIntegrationsClient({
-    controlPlaneUrl: TEST_ENV_DEFAULTS.CONTROL_PLANE_URL,
-    organizationId: TEST_ENV_DEFAULTS.ORGANIZATION_ID,
-    projectId: TEST_ENV_DEFAULTS.PROJECT_ID,
-    deploymentId: TEST_ENV_DEFAULTS.DEPLOYMENT_ID,
-    deploymentSecret: TEST_ENV_DEFAULTS.DEPLOYMENT_SECRET
-  }).identities;
-  const runSeed = async () => {
-    if (options.seed) await options.seed({ data, identities });
-  };
-  await runSeed();
-  return {
-    app,
-    data,
-    identities,
-    async reset() {
-      await app.reset();
-      await runSeed();
-    },
-    async close() {
-      await app.close();
-    }
-  };
-}
-
-// src/next/headers-shim.ts
-import { AsyncLocalStorage } from "async_hooks";
-var requestScopeStorage = globalSingleton(
-  "request-scope",
-  () => new AsyncLocalStorage()
-);
-
-// src/next/call-route.ts
-function parseCookieHeader(header) {
-  const map = /* @__PURE__ */ new Map();
-  if (!header) return map;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    map.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
-  }
-  return map;
-}
-async function importNextServer() {
-  try {
-    return await import("next/server.js");
-  } catch {
-    return await import("next/server");
-  }
-}
-async function callRoute(handler, options = {}) {
-  const { NextRequest } = await importNextServer();
-  const path = options.path ?? "/api/test-route";
-  const url = new URL(`http://localhost:3333${path}`);
-  for (const [key, value] of Object.entries(options.searchParams ?? {})) {
-    url.searchParams.set(key, value);
-  }
-  const method = options.method ?? (options.body !== void 0 ? "POST" : "GET");
-  const headers = new Headers(options.headers);
-  const user = options.user !== void 0 ? options.user : state.currentUser;
-  if (user && !headers.has("x-stardeck-user")) {
-    headers.set("x-stardeck-user", JSON.stringify(user));
-  }
-  if (options.body !== void 0 && !headers.has("Content-Type")) {
-    headers.set("Content-Type", "application/json");
-  }
-  const cookiePairs = Object.entries(options.cookies ?? {});
-  if (cookiePairs.length > 0) {
-    const existing = headers.get("cookie");
-    const cookieString = cookiePairs.map(([k, v]) => `${k}=${v}`).join("; ");
-    headers.set("cookie", existing ? `${existing}; ${cookieString}` : cookieString);
-  }
-  const request = new NextRequest(url, {
-    method,
-    headers,
-    body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
-  });
-  const scope = {
-    headers,
-    cookies: parseCookieHeader(headers.get("cookie"))
-  };
-  try {
-    return await requestScopeStorage.run(
-      scope,
-      () => Promise.resolve(
-        handler(request, {
-          params: Promise.resolve(options.params ?? {})
-        })
-      )
-    );
-  } catch (error) {
-    const redirect = decodeNextRedirect(error);
-    if (redirect) return redirect;
-    throw error;
-  }
-}
-function decodeNextRedirect(error) {
-  const digest = error?.digest;
-  if (typeof digest !== "string" || !digest.startsWith("NEXT_REDIRECT")) return null;
-  const parts = digest.split(";");
-  const location = parts[2] ?? "/";
-  const status = Number(parts[3]) || 307;
-  return new Response(null, { status, headers: { location } });
-}
-
 // src/workflow.ts
 import { describe } from "vitest";
 function describeWorkflow(name, fn) {
@@ -1160,10 +1678,11 @@ export {
   CONTROL_PLANE_TEST_URL,
   DATA_STORE_TEST_HOST,
   DEFAULT_SCHEMA_PATH,
+  STORAGE_TEST_HOST,
+  STORAGE_TEST_URL,
   TEST_ENV_DEFAULTS,
   WORKFLOW_NAME_PREFIX,
   callRoute,
-  createModuleApp,
   createTestApp,
   describeWorkflow,
   parseWorkflowName