mppx 0.8.15 → 0.8.18

package/src/stripe/client/Charge.test.ts

@@ -1,205 +0,0 @@
-import { Challenge, Credential } from 'mppx'
-import { Mppx, stripe } from 'mppx/client'
-import { Mppx as Mppx_server, stripe as stripe_server } from 'mppx/server'
-import { describe, expect, test, vi } from 'vp/test'
-
-import type { StripeJs } from '../internal/types.js'
-import { charge as clientCharge_ } from './Charge.js'
-
-const realm = 'api.example.com'
-const secretKey = 'test-secret-key-test-secret-key-32'
-
-const dummyClientCharge = clientCharge_({
-  createToken: async () => 'spt_test',
-  paymentMethod: 'pm_test',
-})
-
-async function createChallenge(request: { externalId?: string } = {}) {
-  const server = Mppx_server.create({
-    methods: [
-      stripe_server.charge({
-        networkId: 'internal',
-        paymentMethodTypes: ['card'],
-        secretKey: 'sk_test',
-      }),
-    ],
-    realm,
-    secretKey,
-  })
-
-  const handle = server.charge({ amount: '100', currency: 'usd', decimals: 2, ...request })
-  const result = await handle(new Request('https://example.com'))
-  if (result.status !== 402) throw new Error('Expected 402')
-  return Challenge.fromResponse(result.challenge, { methods: [dummyClientCharge] })
-}
-
-function createMockStripeJs(): StripeJs {
-  return {
-    createPaymentMethod: vi.fn(async () => ({
-      error: null,
-      paymentMethod: { id: 'pm_mock_123' },
-    })),
-    elements: vi.fn(() => ({})),
-  }
-}
-
-describe('stripe.charge client param', () => {
-  test('default: forwards client to createToken callback', async () => {
-    const mockClient = createMockStripeJs()
-    let receivedClient: StripeJs | undefined
-
-    const charge = stripe.charge({
-      client: mockClient,
-      createToken: async (params) => {
-        receivedClient = params.client
-        return 'spt_test_123'
-      },
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge()
-    await charge.createCredential({ challenge, context: {} })
-
-    expect(receivedClient).toBe(mockClient)
-  })
-
-  test('behavior: client is undefined when not provided', async () => {
-    let receivedClient: StripeJs | undefined = createMockStripeJs()
-
-    const charge = stripe.charge({
-      createToken: async (params) => {
-        receivedClient = params.client
-        return 'spt_test_123'
-      },
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge()
-    await charge.createCredential({ challenge, context: {} })
-
-    expect(receivedClient).toBeUndefined()
-  })
-
-  test('behavior: createToken receives all expected params', async () => {
-    const mockClient = createMockStripeJs()
-    let receivedParams: Record<string, unknown> | undefined
-
-    const charge = stripe.charge({
-      client: mockClient,
-      createToken: async (params) => {
-        receivedParams = params as unknown as Record<string, unknown>
-        return 'spt_test_123'
-      },
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge()
-    await charge.createCredential({ challenge, context: {} })
-
-    expect(receivedParams).toBeDefined()
-    expect(receivedParams!.amount).toBe('10000')
-    expect(receivedParams!.currency).toBe('usd')
-    expect(receivedParams!.networkId).toBe('internal')
-    expect(receivedParams!.paymentMethod).toBe('pm_card_visa')
-    expect(receivedParams!.client).toBe(mockClient)
-    expect(receivedParams!.challenge).toBeDefined()
-    expect(typeof receivedParams!.expiresAt).toBe('number')
-  })
-
-  test('behavior: produces valid credential string', async () => {
-    const charge = stripe.charge({
-      createToken: async () => 'spt_test_123',
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge()
-    const credential = await charge.createCredential({ challenge, context: {} })
-
-    expect(credential).toMatch(/^Payment /)
-
-    const parsed = Credential.deserialize(credential)
-    expect(parsed.payload).toMatchObject({ spt: 'spt_test_123' })
-  })
-
-  test('behavior: echoes request-bound externalId in credential payload', async () => {
-    const charge = stripe.charge({
-      createToken: async () => 'spt_test_123',
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge({ externalId: 'order_456' })
-    const credential = await charge.createCredential({ challenge, context: {} })
-    const parsed = Credential.deserialize(credential)
-    expect(parsed.payload).toMatchObject({
-      externalId: 'order_456',
-      spt: 'spt_test_123',
-    })
-  })
-
-  test('behavior: request-bound externalId overrides local externalId', async () => {
-    const charge = stripe.charge({
-      createToken: async () => 'spt_test_123',
-      externalId: 'client_order_999',
-      paymentMethod: 'pm_card_visa',
-    })
-
-    const challenge = await createChallenge({ externalId: 'server_order_456' })
-    const credential = await charge.createCredential({ challenge, context: {} })
-    const parsed = Credential.deserialize(credential)
-    expect(parsed.payload).toMatchObject({
-      externalId: 'server_order_456',
-      spt: 'spt_test_123',
-    })
-  })
-
-  test('behavior: context paymentMethod overrides default', async () => {
-    let receivedPaymentMethod: string | undefined
-
-    const charge = stripe.charge({
-      createToken: async (params) => {
-        receivedPaymentMethod = params.paymentMethod
-        return 'spt_test_123'
-      },
-      paymentMethod: 'pm_default',
-    })
-
-    const challenge = await createChallenge()
-    await charge.createCredential({
-      challenge,
-      context: { paymentMethod: 'pm_override' },
-    })
-
-    expect(receivedPaymentMethod).toBe('pm_override')
-  })
-
-  test('behavior: Mppx.create with client forwards through createCredential', async () => {
-    const mockClient = createMockStripeJs()
-    let receivedClient: StripeJs | undefined
-
-    const mppx = Mppx.create({
-      methods: [
-        stripe.charge({
-          client: mockClient,
-          createToken: async (params) => {
-            receivedClient = params.client
-            return 'spt_test_123'
-          },
-          paymentMethod: 'pm_card_visa',
-        }),
-      ],
-      polyfill: false,
-    })
-
-    const challenge = await createChallenge()
-    const response = new Response(null, {
-      status: 402,
-      headers: {
-        'WWW-Authenticate': Challenge.serialize(challenge),
-      },
-    })
-
-    await mppx.createCredential(response)
-
-    expect(receivedClient).toBe(mockClient)
-  })
-})

package/src/stripe/client/Charge.ts

@@ -1,132 +0,0 @@
-import type * as Challenge from '../../Challenge.js'
-import * as Credential from '../../Credential.js'
-import * as Method from '../../Method.js'
-import * as z from '../../zod.js'
-import type { StripeJs } from '../internal/types.js'
-import * as Methods from '../Methods.js'
-
-/**
- * Creates a Stripe charge method intent for usage on the client.
- *
- * Accepts a `createToken` callback that handles SPT creation (requires
- * a secret key, so typically proxied through a server endpoint) and
- * returns a credential for retrying the request.
- *
- * The `paymentMethod` (e.g. from Stripe Elements) can be provided at
- * initialization or at credential-creation time via `context`.
- *
- * Optionally accepts a `client` (a Stripe.js instance from `@stripe/stripe-js`)
- * which is forwarded to the `createToken` callback for use with Elements.
- *
- * @example
- * ```ts
- * import { loadStripe } from '@stripe/stripe-js'
- * import { stripe } from 'mppx/client'
- *
- * const stripeJs = await loadStripe('pk_...')
- *
- * const charge = stripe.charge({
- *   client: stripeJs,
- *   createToken: async ({ amount, currency, expiresAt, metadata, networkId, paymentMethod }) => {
- *     const res = await fetch('/api/create-spt', {
- *       method: 'POST',
- *       headers: { 'Content-Type': 'application/json' },
- *       body: JSON.stringify({ paymentMethod, amount, currency, networkId, expiresAt, metadata }),
- *     })
- *     const { spt } = await res.json()
- *     return spt
- *   },
- * })
- * ```
- */
-export function charge(parameters: charge.Parameters) {
-  const { client, createToken, externalId, paymentMethod: defaultPaymentMethod } = parameters
-
-  return Method.toClient(Methods.charge, {
-    context: z.object({
-      paymentMethod: z.optional(z.string()),
-    }),
-
-    async createCredential({ challenge, context }) {
-      const paymentMethod = context?.paymentMethod ?? defaultPaymentMethod
-      if (!paymentMethod) {
-        throw new Error('paymentMethod is required (pass via context or parameters)')
-      }
-
-      const amount = challenge.request.amount as string
-      const currency = challenge.request.currency as string
-      const requestExternalId =
-        typeof challenge.request.externalId === 'string' ? challenge.request.externalId : undefined
-      const networkId = challenge.request.methodDetails?.networkId as string | undefined
-      if (!networkId) throw new Error('networkId is required in challenge.methodDetails')
-      const metadata = challenge.request.methodDetails?.metadata as
-        | Record<string, string>
-        | undefined
-      if (metadata?.externalId) {
-        throw new Error(
-          'methodDetails.metadata.externalId is reserved; use credential externalId instead',
-        )
-      }
-
-      const expiresAt = challenge.expires
-        ? Math.floor(new Date(challenge.expires).getTime() / 1000)
-        : Math.floor(Date.now() / 1000) + 3600
-
-      const spt = await createToken({
-        amount,
-        challenge,
-        client,
-        currency,
-        expiresAt,
-        metadata,
-        networkId,
-        paymentMethod,
-      })
-
-      const payloadExternalId = requestExternalId ?? externalId
-
-      return Credential.serialize({
-        challenge,
-        payload: {
-          spt,
-          ...(payloadExternalId !== undefined ? { externalId: payloadExternalId } : {}),
-        },
-      })
-    },
-  })
-}
-
-export declare namespace charge {
-  type Parameters = {
-    /** Stripe.js instance from `@stripe/stripe-js`. Forwarded to `createToken` for use with Elements. */
-    client?: StripeJs | undefined
-    /** Called when a Stripe challenge is received. Create an SPT to retry. */
-    createToken: (parameters: OnChallengeParameters) => Promise<string>
-    /** Optional fallback external reference ID. A request-bound externalId is echoed and takes precedence. */
-    externalId?: string | undefined
-    /** Default payment method ID. Overridden by `context.paymentMethod`. */
-    paymentMethod?: string | undefined
-  }
-
-  type OnChallengeParameters = {
-    /** Payment amount (in smallest currency unit). */
-    amount: string
-    challenge: Challenge.Challenge<
-      z.output<typeof Methods.charge.schema.request>,
-      typeof Methods.charge.intent,
-      typeof Methods.charge.name
-    >
-    /** Stripe.js instance, if provided to `stripe.charge()`. */
-    client?: StripeJs | undefined
-    /** Three-letter ISO currency code. */
-    currency: string
-    /** SPT expiration as a Unix timestamp (seconds). */
-    expiresAt: number
-    /** Optional metadata to associate with the SPT. */
-    metadata?: Record<string, string> | undefined
-    /** Stripe Business Network profile ID. */
-    networkId: string | undefined
-    /** Stripe payment method ID (e.g. from Stripe Elements). */
-    paymentMethod?: string | undefined
-  }
-}

package/src/stripe/client/Methods.ts

@@ -1,37 +0,0 @@
-import { charge as charge_ } from './Charge.js'
-
-/**
- * Creates a Stripe `charge` client method.
- *
- * @example
- * ```ts
- * import { Mppx, stripe } from 'mppx/client'
- *
- * const mppx = Mppx.create({
- *   methods: [
- *     stripe({
- *       createToken: async (params) => {
- *         const res = await fetch('/api/create-spt', {
- *           method: 'POST',
- *           headers: { 'Content-Type': 'application/json' },
- *           body: JSON.stringify(params),
- *         })
- *         const { spt } = await res.json()
- *         return spt
- *       },
- *       paymentMethod: 'pm_card_visa',
- *     }),
- *   ],
- * })
- * ```
- */
-export function stripe(parameters: stripe.Parameters) {
-  return [charge_(parameters)] as const
-}
-
-export namespace stripe {
-  export type Parameters = charge_.Parameters
-
-  /** Creates a Stripe `charge` client method for SPT-based payments. */
-  export const charge = charge_
-}

package/src/stripe/client/index.ts

@@ -1,2 +0,0 @@
-export { charge } from './Charge.js'
-export { stripe } from './Methods.js'

package/src/stripe/index.ts

@@ -1 +0,0 @@
-export * as Methods from './Methods.js'

package/src/stripe/internal/constants.ts

@@ -1,7 +0,0 @@
-/**
- * Stripe API version with `.preview` suffix.
- *
- * Required for `shared_payment_granted_token` (SPTs are in private preview).
- * Bump this when upgrading to a newer Stripe API version.
- */
-export const stripePreviewVersion = '2026-02-25.preview'

package/src/stripe/internal/types.ts

@@ -1,46 +0,0 @@
-import * as StripeJsTypes from '../../stripe/server/internal/html/types.js'
-
-/**
- * Duck-typed interface for the Stripe Node SDK (`stripe` npm package).
- * Matches the subset of the API used by mppx for server-side payment verification.
- *
- * Uses loose signatures so any Stripe SDK version is assignable.
- */
-export type StripeClient = {
-  paymentIntents: {
-    create(...args: any[]): Promise<{
-      id: string
-      status: string
-      lastResponse?: { headers?: Record<string, string> }
-    }>
-  }
-}
-
-/**
- * Duck-typed interface for Stripe.js (`@stripe/stripe-js`).
- * Matches the subset of the API used by mppx for client-side payment method creation.
- *
- * Uses loose signatures so any Stripe.js version is assignable.
- */
-export type StripeJs = {
-  createPaymentMethod(...args: any[]): Promise<Record<string, unknown>>
-  elements(...args: any[]): unknown
-}
-
-export type CreatePaymentMethodFromElements = Omit<
-  StripeJsTypes.CreatePaymentMethodFromElements,
-  'elements'
-> & {}
-
-export type StripeElementsOptionsMode = Omit<
-  Extract<StripeJsTypes.StripeElementsOptionsMode, { mode: 'payment' }>,
-  | 'amount'
-  | 'currency'
-  | 'mode'
-  | 'excludedPaymentMethodTypes'
-  | 'paymentMethodCreation'
-  | 'paymentMethodTypes'
-  | 'payment_method_types'
-> & {}
-
-export type StripePaymentElementOptions = StripeJsTypes.StripePaymentElementOptions

package/src/stripe/server/Charge.test-d.ts

@@ -1,66 +0,0 @@
-import { Mppx, stripe } from 'mppx/server'
-import { test } from 'vp/test'
-
-import type { StripeClient } from '../internal/types.js'
-import type { charge as StripeCharge } from './Charge.js'
-
-const client = {} as StripeClient
-const secretKey = 'test-secret-key-test-secret-key-32'
-
-test('requires request fields not configured as Stripe defaults', () => {
-  const server = Mppx.create({
-    methods: [
-      stripe.charge({
-        client,
-        networkId: 'internal',
-        paymentMethodTypes: ['card'],
-      }),
-    ],
-    realm: 'api.example.com',
-    secretKey,
-  })
-
-  // @ts-expect-error decimals is required unless the factory supplied it.
-  void server.charge({ amount: '1', currency: 'usd' })
-  void server.charge({ amount: '1', currency: 'usd', decimals: 2 })
-})
-
-test('allows request fields configured as Stripe defaults', () => {
-  const server = Mppx.create({
-    methods: [
-      stripe.charge({
-        client,
-        decimals: 2,
-        networkId: 'internal',
-        paymentMethodTypes: ['card'],
-      }),
-    ],
-    realm: 'api.example.com',
-    secretKey,
-  })
-
-  void server.charge({ amount: '1', currency: 'usd' })
-})
-
-test('does not treat optional properties on widened config as defaults', () => {
-  const parameters: StripeCharge.Parameters = {
-    client,
-    networkId: 'internal',
-    paymentMethodTypes: ['card'],
-  }
-  const server = Mppx.create({
-    methods: [stripe.charge(parameters)],
-    realm: 'api.example.com',
-    secretKey,
-  })
-
-  // @ts-expect-error a widened optional decimals property is not a guaranteed default.
-  void server.charge({ amount: '1', currency: 'usd' })
-  void server.charge({
-    amount: '1',
-    currency: 'usd',
-    decimals: 2,
-    networkId: 'internal',
-    paymentMethodTypes: ['card'],
-  })
-})