PayPal simulator

Request access for a licensed download.

rystic login ./rystic-license.json
rystic run paypal-twin -d --scenario busy_merchant
curl -fsS http://localhost:8080/_rystic/version

Expect product paypal-twin and version 0.0.2. rystic pull paypal-twin installs the current release. The archive includes check.sh, HOWTO.md and SCENARIOS.md.

Point your HTTP client at http://localhost:8080 and send a placeholder bearer token. Wallet orders start CREATED; approved-order worlds let you exercise capture and authorization without a hosted approval screen. Card-backed synthetic orders can complete at creation. Use PayPal-Request-Id for retries and Prefer: return=representation for full responses.

20 routes cover Orders v2, Payments v2, OAuth2 and measured method refusals. Twelve embedded worlds include approved wallet orders, open/voided/partially captured authorizations, partial/full refunds and a busy merchant. List them with --list-scenarios; select one with --scenario.

The licensed control plane supports seed, inspect, reset and explicit clock changes. Repeated flows are deterministic. State is in memory and is lost when the process exits.

The 2026-09-24 sandbox round matched 55/55 probes; 48 reached their intended branch. Skipped branches and OAuth bootstrap limits remain documented in the packaged HOWTO. Aged reauthorization wire semantics are unverified; local tests enforce conservative balance conservation. The simulator does not provide a hosted approval UI or real settlement.

Newest first.

v0.0.2 — 2026-09-24

1. More accurate authentication errors. Requests without credentials now return PayPal-compatible 401 responses before resource lookup across checkout and payment endpoints. OAuth token requests with a missing or unsupported grant type return the corresponding unsupported_grant_type error.

   Order validation and replay. Multiple purchase units require reference IDs. PATCH rejects removal of required amounts, empty purchase units, unsupported moves, invalid currencies, and missing reference selectors without changing state. Order reads reject XML-only response requests. Replayed order creation returns the current order after a successful PATCH.

2. Complete PATCH validation errors. Invalid order updates now report structural errors in request order, including repeated errors, before applying changes or validating amount values. Replacing the entire purchase-unit array is rejected. Failed compound updates preserve the original order and payment state.

3. USD refunds retain the original capture processing fee instead of returning a prorated amount. Ordinary USD refunds report zero PayPal fee and net equal to gross, including partial refunds and the final remainder. Replays preserve the stored refund and do not move money again.

   Direct-card creation and order capture use the existing synthetic USD capture policy already used by authorization capture and scenario seeds: 3.49% plus USD 0.49, rounded to cents. This is deterministic simulator pricing, not a claim about a merchant’s current PayPal rate. Non-USD capture pricing and platform-fee return rules are unchanged and are not newly validated.

v0.0.1 — 2026-09-24

1. Exercise PayPal checkout, authorizations, captures and refunds locally with twelve payment-history worlds, deterministic reset and clock control, validated retries and error contracts, and a packaged installation check. (RYS-1056)