@volter/twin-stripe 2.0.2 → 2.0.3

package/dist/src/stripe-capabilities.js

@@ -213,6 +213,20 @@ export const STRIPE_CAPABILITIES = [
         const l = await h({ m: 'GET', p: '/v1/customers' });
         return ok(g) && id(g) === id(c) && ok(u) && field(u, 'name') === 'Ada Lovelace' && field(l, 'object') === 'list';
     })),
+    // stripe-node posts a null metadata value as `metadata[key]=` (Cal.com's PaymentIntent metadata, a guest with no phone)
+    done('stripe.metadata.create_empty_value_unset', 'metadata', 'A create\'s metadata key posted empty is not set (an empty value unsets a key); metadata posted empty is {}', 'api', 'common', () => withRoot(async (h) => {
+        const c = await h({ m: 'POST', p: '/v1/customers', b: 'email=sam@twin.test&metadata[identifier]=cal.com&metadata[bookerPhoneNumber]=' });
+        const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=5000&currency=usd&customer=${id(c)}&metadata[bookingId]=12&metadata[calAccountId]=` });
+        const none = await h({ m: 'POST', p: '/v1/products', b: 'name=Consultation&metadata=' });
+        const got = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}` });
+        const md = (r) => r.body.metadata;
+        return ok(c) && JSON.stringify(md(c)) === JSON.stringify({ identifier: 'cal.com' })
+            && ok(pi) && JSON.stringify(md(pi)) === JSON.stringify({ bookingId: '12' }) && JSON.stringify(md(got)) === JSON.stringify({ bookingId: '12' })
+            && ok(none) && JSON.stringify(md(none)) === '{}';
+    })),
+    // Objects on a connected account are that account's: Stripe answers a retrieve of one without its Stripe-Account
+    // header (or with another account's) 404 resource_missing. The twin keeps one store for the platform and its accounts.
+    todo('stripe.connect.account_scoped_objects', 'connect', 'Objects made with a Stripe-Account header are visible only as that account (retrieve/list/update from the platform or another account is resource_missing)', 'api', 'common'),
     done('stripe.customers.list_filter', 'customers', 'Customer list filter by email', 'api', 'core', () => withRoot(async (h) => {
         await h({ m: 'POST', p: '/v1/customers', b: 'email=match@twin.test' });
         await h({ m: 'POST', p: '/v1/customers', b: 'email=other@twin.test' });

package/dist/src/stripe-server.js

@@ -346,6 +346,34 @@ export async function createStripeTwinServer(options) {
     });
     return { port: server.port ?? options.port ?? 0, stop: () => server.stop(true) };
 }
+/** A create's `metadata` holds no key posted empty. "Individual keys can be unset by posting an empty value to them. All
+ *  keys can be unset by posting an empty value to `metadata`" (every metadata parameter of docs.stripe.com/api): an empty
+ *  value is the absence of the key, on a create as on an update, so an object never holds a key set to "". Clients post
+ *  one without meaning to: stripe-node encodes a `null` value as `metadata[key]=` (Cal.com's PaymentIntent metadata
+ *  carries `bookerPhoneNumber: null` for a guest who gave no phone). The request is rewritten as JSON without them. */
+async function createMetadata(request, path) {
+    const op = CREATES.find((c) => c.re.test(path))?.op;
+    if (!op)
+        return request;
+    const params = await readParams(manifest, request.clone(), op);
+    if (!('metadata' in params))
+        return request;
+    const given = params.metadata;
+    let metadata;
+    if (given === '')
+        metadata = {};
+    else if (given && typeof given === 'object' && !Array.isArray(given) && Object.values(given).includes('')) {
+        metadata = Object.fromEntries(Object.entries(given).filter(([, v]) => v !== ''));
+    }
+    else
+        return request;
+    const headers = new Headers(request.headers);
+    headers.set('content-type', 'application/json');
+    return new Request(request.url, { method: request.method, headers, body: JSON.stringify({ ...params, metadata }) });
+}
+// the create operations, by their path as a pattern, for createMetadata
+const CREATES = surface.operations.filter((o) => o.class === 'create' && o.method.toUpperCase() === 'POST')
+    .map((op) => ({ op, re: new RegExp(`^${op.path.replace(/[.*+?^$()|[\]\\]/g, '\\$&').replace(/\\\{[^}]+\\\}|\{[^}]+\}/g, '([^/]+)')}/?$`) }));
 // the update operations, by their path as a pattern, for mergeMetadata
 const UPDATES = surface.operations.filter((o) => o.class === 'update' && o.method.toUpperCase() === 'POST')
     .map((op) => ({ op, re: new RegExp(`^${op.path.replace(/[.*+?^$()|[\]\\]/g, '\\$&').replace(/\\\{[^}]+\\\}|\{[^}]+\}/g, '([^/]+)')}/?$`) }));
@@ -371,7 +399,9 @@ async function mergeMetadata(request, coreMerges, scope) {
             break;
         }
     }
-    if (!op?.resource)
+    if (!op)
+        return createMetadata(request, path);
+    if (!op.resource)
         return request;
     const params = await readParams(manifest, request.clone(), op);
     if (!('metadata' in params))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-stripe",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Local Stripe twin — a faithful, stateful local Stripe API your real `stripe` SDK talks to unmodified. Mirror, simulate, and fork. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -56,15 +56,15 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "dependencies": {
-    "@volter/world-ui": "0.1.2",
+    "@volter/world-ui": "0.1.3",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.2"
+    "@volter/world-core": "2.0.3"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.2",
+    "@volter/world-core": "2.0.3",
     "@volter/world-tooling": "0.1.0",
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",

package/src/stripe-capabilities.ts

@@ -256,6 +256,22 @@ export const STRIPE_CAPABILITIES: CapabilitySpec[] = [
       return ok(g) && id(g) === id(c) && ok(u) && field(u, 'name') === 'Ada Lovelace' && field(l, 'object') === 'list';
     }),
   ),
+  // stripe-node posts a null metadata value as `metadata[key]=` (Cal.com's PaymentIntent metadata, a guest with no phone)
+  done('stripe.metadata.create_empty_value_unset', 'metadata', 'A create\'s metadata key posted empty is not set (an empty value unsets a key); metadata posted empty is {}', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const c = await h({ m: 'POST', p: '/v1/customers', b: 'email=sam@twin.test&metadata[identifier]=cal.com&metadata[bookerPhoneNumber]=' });
+      const pi = await h({ m: 'POST', p: '/v1/payment_intents', b: `amount=5000&currency=usd&customer=${id(c)}&metadata[bookingId]=12&metadata[calAccountId]=` });
+      const none = await h({ m: 'POST', p: '/v1/products', b: 'name=Consultation&metadata=' });
+      const got = await h({ m: 'GET', p: `/v1/payment_intents/${id(pi)}` });
+      const md = (r: StripeResponse) => (r.body as Body).metadata as Body;
+      return ok(c) && JSON.stringify(md(c)) === JSON.stringify({ identifier: 'cal.com' })
+        && ok(pi) && JSON.stringify(md(pi)) === JSON.stringify({ bookingId: '12' }) && JSON.stringify(md(got)) === JSON.stringify({ bookingId: '12' })
+        && ok(none) && JSON.stringify(md(none)) === '{}';
+    }),
+  ),
+  // Objects on a connected account are that account's: Stripe answers a retrieve of one without its Stripe-Account
+  // header (or with another account's) 404 resource_missing. The twin keeps one store for the platform and its accounts.
+  todo('stripe.connect.account_scoped_objects', 'connect', 'Objects made with a Stripe-Account header are visible only as that account (retrieve/list/update from the platform or another account is resource_missing)', 'api', 'common'),
   done('stripe.customers.list_filter', 'customers', 'Customer list filter by email', 'api', 'core', () =>
     withRoot(async (h) => {
       await h({ m: 'POST', p: '/v1/customers', b: 'email=match@twin.test' });

package/src/stripe-server.ts

@@ -327,6 +327,31 @@ export async function createStripeTwinServer(options: StripeTwinOptions): Promis
   return { port: server.port ?? options.port ?? 0, stop: () => server.stop(true) };
 }
 
+/** A create's `metadata` holds no key posted empty. "Individual keys can be unset by posting an empty value to them. All
+ *  keys can be unset by posting an empty value to `metadata`" (every metadata parameter of docs.stripe.com/api): an empty
+ *  value is the absence of the key, on a create as on an update, so an object never holds a key set to "". Clients post
+ *  one without meaning to: stripe-node encodes a `null` value as `metadata[key]=` (Cal.com's PaymentIntent metadata
+ *  carries `bookerPhoneNumber: null` for a guest who gave no phone). The request is rewritten as JSON without them. */
+async function createMetadata(request: Request, path: string): Promise<Request> {
+  const op = CREATES.find((c) => c.re.test(path))?.op;
+  if (!op) return request;
+  const params = await readParams(manifest, request.clone(), op);
+  if (!('metadata' in params)) return request;
+  const given = params.metadata;
+  let metadata: Record<string, unknown>;
+  if (given === '') metadata = {};
+  else if (given && typeof given === 'object' && !Array.isArray(given) && Object.values(given).includes('')) {
+    metadata = Object.fromEntries(Object.entries(given as Record<string, unknown>).filter(([, v]) => v !== ''));
+  } else return request;
+  const headers = new Headers(request.headers);
+  headers.set('content-type', 'application/json');
+  return new Request(request.url, { method: request.method, headers, body: JSON.stringify({ ...params, metadata }) });
+}
+
+// the create operations, by their path as a pattern, for createMetadata
+const CREATES = (surface.operations as Array<DerivedCall['operation']>).filter((o) => o.class === 'create' && o.method.toUpperCase() === 'POST')
+  .map((op) => ({ op, re: new RegExp(`^${op.path.replace(/[.*+?^$()|[\]\\]/g, '\\$&').replace(/\\\{[^}]+\\\}|\{[^}]+\}/g, '([^/]+)')}/?$`) }));
+
 // the update operations, by their path as a pattern, for mergeMetadata
 const UPDATES = (surface.operations as Array<DerivedCall['operation']>).filter((o) => o.class === 'update' && o.method.toUpperCase() === 'POST')
   .map((op) => ({ op, re: new RegExp(`^${op.path.replace(/[.*+?^$()|[\]\\]/g, '\\$&').replace(/\\\{[^}]+\\\}|\{[^}]+\}/g, '([^/]+)')}/?$`) }));
@@ -345,7 +370,8 @@ async function mergeMetadata(request: Request, coreMerges: (op: DerivedCall['ope
   let op: DerivedCall['operation'] | undefined;
   let id = '';
   for (const u of UPDATES) { const m = u.re.exec(path); if (m) { op = u.op; id = decodeURIComponent(m.at(-1) ?? ''); break; } }
-  if (!op?.resource) return request;
+  if (!op) return createMetadata(request, path);
+  if (!op.resource) return request;
   const params = await readParams(manifest, request.clone(), op);
   if (!('metadata' in params)) return request;
   const given = params.metadata;