Overview

PaymentChaos sends provider-accurate webhook deliveries through deterministic chaos, then asserts on your application’s business state. New here? Start with the early-access quickstart.

What it is

PaymentChaos is a local-first CLI and TypeScript library for testing payment and subscription webhook handling. It creates provider-shaped events, preserves the exact body bytes used for signing, schedules deliveries under a reproducible seed, and runs your own command to verify business state.

The key question is not only “did the endpoint return 2xx?” It is:

Did duplicates, stale ordering, delay, or concurrency corrupt an entitlement, subscription, order, or ledger?

What it is not

PaymentChaos is not a payment processor, production gateway, tunnel, request bin, API client, load tester, observability platform, or AI reviewer. Capture-and-replay tools solve a useful but different HTTP-inspection problem; PaymentChaos adds controlled failure schedules and application-state assertions.

Current status

PaymentChaos is an open-source prototype for developer validation. It is not published to npm. Clone the source repository and follow the quickstart to try it locally; no signup is required.

Use the pinned Node and pnpm toolchain and run the built CLI from that checkout. The current implementation includes:

• provider adapters for Stripe, Razorpay and generic HMAC webhooks;
• six built-in scenarios (see Scenarios and chaos);
• two Stripe example apps, stripe-express-naive and stripe-express-correct, plus a golden harness that runs both through the real CLI;
• the four M1 chaos operators, command assertions, and terminal, JSON and JUnit reports;
• guided project setup with init and terminal reproduction commands with the seed;
• stable exit codes.

These pages walk through the Stripe example. Razorpay and generic HMAC run the same way with their own providers entry; dedicated guides for them are not written yet.

HTTP assertions and HTML reports are not implemented. Generated provider IDs are synthetic; apps that fetch provider objects may need test API mocks. A passing concurrency run does not prove that every race is absent.