@mesub/node 0.0.0-stage → 0.1.0

package/dist/chunk-SGSYQJYT.cjs

@@ -0,0 +1,2038 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3;// src/cache/access-cache.ts
+var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
+var AccessCache = class _AccessCache {
+  constructor(store, options = {}) {
+    this.store = store;
+    this.maxStaleMs = _nullishCoalesce(options.maxStaleMs, () => ( DEFAULT_MAX_STALE_MS));
+    this.now = _nullishCoalesce(options.now, () => ( Date.now));
+  }
+  
+  
+  
+  /**
+   * `mesub:access:<scope>:<plan>:<who>`, prefixed so it can share a Redis
+   * with anything. The scope (the client passes a hash of its API key) keeps
+   * two projects sharing one store apart; without one, `mesub:access:<plan>:<who>`.
+   *
+   * `who` is whatever names the customer, the client's being
+   * `<kind>:<wallet or hash>`. A null plan is the list of every plan they
+   * have, under its own prefix, `mesub:access-list:`: no plan slug can reach it.
+   */
+  static key(who, plan, scope) {
+    const prefix = plan === null ? "mesub:access-list" : "mesub:access";
+    const path = plan === null ? who : `${plan}:${who}`;
+    return scope === void 0 ? `${prefix}:${path}` : `${prefix}:${scope}:${path}`;
+  }
+  /** With a `deadline` (epoch ms), a store that has not answered by then is a miss. */
+  async read(who, plan, scope, deadline) {
+    let entry;
+    try {
+      const pending = this.store.get(_AccessCache.key(who, plan, scope));
+      entry = deadline === void 0 ? await pending : await this.within(pending, deadline);
+    } catch (e) {
+      return void 0;
+    }
+    const now = this.now();
+    if (!entry || now > entry.keepUntil) return void 0;
+    return { value: entry.value, fresh: now < entry.freshUntil };
+  }
+  /** What `pending` gives by `deadline`, or undefined, as a miss, when it has not answered. */
+  async within(pending, deadline) {
+    let timer;
+    const late = new Promise((resolve) => {
+      timer = setTimeout(resolve, Math.max(0, deadline - this.now()), void 0);
+    });
+    try {
+      return await Promise.race([pending, late]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async write(who, plan, value, scope) {
+    if (!Number.isFinite(value.revalidate_after)) return;
+    const now = this.now();
+    const freshUntil = now + Math.max(0, value.revalidate_after) * 1e3;
+    const keepUntil = freshUntil + this.maxStaleMs;
+    try {
+      await this.store.set(
+        _AccessCache.key(who, plan, scope),
+        { value, freshUntil, keepUntil },
+        keepUntil - now
+      );
+    } catch (e2) {
+    }
+  }
+  /**
+   * Drops the cached answer when `outdated` says it no longer holds, so the
+   * next call asks Mesub. A store without `delete` gets it back as stale
+   * instead: never served as is again, only as the outage fallback.
+   */
+  async forget(who, plan, scope, outdated) {
+    const key = _AccessCache.key(who, plan, scope);
+    try {
+      const entry = await this.store.get(key);
+      if (!entry || !outdated(entry.value)) return;
+      if (this.store.delete) {
+        await this.store.delete(key);
+        return;
+      }
+      const now = this.now();
+      if (now < entry.keepUntil) {
+        await this.store.set(key, { ...entry, freshUntil: now }, entry.keepUntil - now);
+      }
+    } catch (e3) {
+    }
+  }
+};
+
+// src/version.ts
+var VERSION = "0.1.0";
+var API_VERSION = "2026-10-02";
+var API_VERSION_HEADER = "Mesub-Version";
+
+// src/options.ts
+var MAX_DELAY = 2147483647;
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function apiKeyOf(given) {
+  if (given !== void 0 && typeof given !== "string") {
+    throw new TypeError("apiKey must be a string.");
+  }
+  const apiKey = given || envKey();
+  if (!apiKey) {
+    throw new TypeError(
+      typeof process === "undefined" ? "Missing Mesub API key: there is no process.env here (an edge runtime such as Cloudflare Workers), so pass it: `new Mesub({ apiKey: env.MESUB_API_KEY })`." : "Missing Mesub API key: pass `new Mesub({ apiKey })` or set MESUB_API_KEY."
+    );
+  }
+  return apiKey;
+}
+function envKey() {
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _ => _.env, 'optionalAccess', _2 => _2["MESUB_API_KEY"]]);
+}
+function baseUrlOf(given, fallback) {
+  if (given === void 0) return fallback;
+  if (typeof given !== "string") throw new TypeError("baseUrl must be a string.");
+  let url;
+  try {
+    url = new URL(given);
+  } catch (e4) {
+    throw new TypeError(`baseUrl must be an absolute URL, not ${JSON.stringify(given)}.`);
+  }
+  if (url.search !== "" || url.hash !== "" || given.includes("?") || given.includes("#")) {
+    throw new TypeError(
+      `baseUrl must have no query nor fragment, not ${JSON.stringify(given)}.`
+    );
+  }
+  const local = url.protocol === "http:" && LOOPBACK.has(url.hostname);
+  if (url.protocol !== "https:" && !local) {
+    throw new TypeError(
+      `baseUrl must be https (http only to localhost or 127.0.0.1), not ${url.protocol}//${url.host}: every call carries the API key.`
+    );
+  }
+  return given.replace(/\/+$/, "");
+}
+function numberOf(name, given, fallback, rule = {}) {
+  if (given === void 0) return fallback;
+  const ok = typeof given === "number" && Number.isFinite(given) && (rule.zero ? given >= 0 : given > 0) && (!rule.integer || Number.isInteger(given)) && (!rule.delay || given <= MAX_DELAY);
+  if (!ok) {
+    const what = rule.integer ? "an integer" : "a number of milliseconds";
+    const range = rule.zero ? "0 or more" : "above 0";
+    const cap = rule.delay ? `, ${MAX_DELAY} at most` : "";
+    const shown = typeof given === "string" ? JSON.stringify(given) : String(given);
+    throw new TypeError(`${name} must be ${what}, ${range}${cap}, not ${shown}.`);
+  }
+  return given;
+}
+var OWN_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "user-agent",
+  "accept",
+  "content-type",
+  API_VERSION_HEADER.toLowerCase()
+]);
+function headersOf(given) {
+  if (given === void 0) return {};
+  if (typeof given !== "object" || given === null || Array.isArray(given)) {
+    throw new TypeError("headers must be an object of header names to string values.");
+  }
+  const headers = {};
+  for (const [name, value] of Object.entries(given)) {
+    if (typeof value !== "string") {
+      throw new TypeError(`headers.${name} must be a string.`);
+    }
+    if (OWN_HEADERS.has(name.toLowerCase())) {
+      throw new TypeError(`headers cannot set ${name}: the SDK sets it itself.`);
+    }
+    try {
+      new Headers([[name, value]]);
+    } catch (e5) {
+      throw new TypeError(`headers.${name} is not a valid header name and value.`);
+    }
+    headers[name] = value;
+  }
+  return headers;
+}
+
+// src/cache/memory-store.ts
+var DEFAULT_MAX_ENTRIES = 1e4;
+var MemoryStore = (_class = class {
+  __init() {this.entries = /* @__PURE__ */ new Map()}
+  
+  
+  constructor(options = {}) {;_class.prototype.__init.call(this);
+    this.maxEntries = numberOf("maxEntries", options.maxEntries, DEFAULT_MAX_ENTRIES, {
+      integer: true
+    });
+    this.now = _nullishCoalesce(options.now, () => ( Date.now));
+  }
+  /** How many entries are held, expired ones included until they are read. */
+  get size() {
+    return this.entries.size;
+  }
+  get(key) {
+    const result = this.entries.get(key);
+    if (!result) return void 0;
+    if (result.keepUntil < this.now()) {
+      this.entries.delete(key);
+      return void 0;
+    }
+    this.entries.delete(key);
+    this.entries.set(key, result);
+    return result;
+  }
+  set(key, entry, _ttlMs) {
+    this.entries.delete(key);
+    this.entries.set(key, entry);
+    while (this.entries.size > this.maxEntries) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === void 0) break;
+      this.entries.delete(oldest);
+    }
+  }
+  delete(key) {
+    this.entries.delete(key);
+  }
+}, _class);
+
+// src/customer.ts
+var CUSTOMER_KINDS = ["wallet", "external_id", "email"];
+function customerOf(customer) {
+  if (typeof customer === "string") return { kind: "wallet", value: customer };
+  const named = CUSTOMER_KINDS.filter(
+    (kind2) => _optionalChain([customer, 'optionalAccess', _3 => _3[kind2]]) !== void 0
+  );
+  const kind = named[0];
+  const value = kind && customer[kind];
+  if (named.length !== 1 || !kind || typeof value !== "string") {
+    throw new TypeError("Ask about exactly one of wallet, external_id or email, as a string.");
+  }
+  if (kind === "email") return { kind, value: value.trim().toLowerCase() };
+  if (kind === "external_id") return { kind, value: value.trim() };
+  return { kind, value };
+}
+
+// src/errors.ts
+var MesubError = (_class2 = class extends Error {
+  __init2() {this.name = "MesubError"}
+  /**
+   * The HTTP status, or `null` when no response came back (network error,
+   * timeout). On the copy an Express middleware hands to `next(err)` for a
+   * 4xx of Mesub's, 500: Mesub's own is on `cause`.
+   */
+  
+  
+  /**
+   * The code Mesub's error body names (`subscription_not_found`,
+   * `pending_cap_reached`, ...), finer than `code` and as stable: never
+   * renamed nor reused, though new ones get added. Null when no Mesub error
+   * came back: a network error, a timeout, a body that is not Mesub's.
+   */
+  
+  /**
+   * Whether the same call, sent again unchanged, may succeed later without
+   * anybody doing anything: Mesub's own `retryable` when it sent one. Not
+   * "at once": the SDK has already retried what it retries.
+   */
+  
+  /**
+   * The body Mesub answered, parsed when it is JSON, the text otherwise;
+   * undefined when no response came back.
+   */
+  
+  /**
+   * How long Mesub asked to wait before the same call is sent again, in
+   * milliseconds, from the response's `Retry-After`, as sent. It comes on
+   * a 429 (`rate_limited`, or `pending_cap_reached` on create: a quota,
+   * not a rate, and the wait may be most of an hour), on every 503 of a
+   * route that builds, sends or queues (`network_unavailable`, about 10 s;
+   * `unavailable` on `submit`, about 2 s, and on `retry`, about 20 s),
+   * and on two 409s:
+   * `retry_too_soon` on `retry`, and `comeback_period_rolling` on
+   * `create`, `transaction` and `submit`. Null when the response had none,
+   * or none came back.
+   */
+  
+  /**
+   * The id Mesub gave the request (`req_` and 24 letters or digits), from
+   * the response's `Mesub-Request-Id` header, or the error body's
+   * `request_id` when a proxy dropped the header (Mesub-io/backend#472).
+   * Log it, and quote it to Mesub support: it finds the request in Mesub's
+   * logs. Null when no response came back, or one that is not Mesub's.
+   */
+  
+  constructor(message, options) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });_class2.prototype.__init2.call(this);;
+    this.status = options.status;
+    this.code = options.code;
+    this.apiCode = _nullishCoalesce(options.apiCode, () => ( null));
+    this.retryable = _nullishCoalesce(options.retryable, () => ( (options.code === "unavailable" || options.code === "rate_limited")));
+    this.body = options.body;
+    this.retryAfter = _nullishCoalesce(options.retryAfter, () => ( null));
+    this.requestId = _nullishCoalesce(options.requestId, () => ( null));
+  }
+}, _class2);
+var MesubSubmitError = class extends MesubError {
+  /** The subscription as read back after the last send, or null if that read failed. */
+  
+  /** How many times the submit was sent, the same request each time. */
+  
+  constructor(message, options) {
+    super(message, options);
+    this.subscription = options.subscription;
+    this.sends = options.sends;
+  }
+};
+function codeFor(status, apiCode) {
+  if (status === 404 && apiCode === "plan_not_found") return "plan_not_found";
+  if (status === 400) return "invalid_request";
+  if (status === 401) return "unauthorized";
+  if (status === 403) return "forbidden";
+  if (status === 404) return "not_found";
+  if (status === 409) return "conflict";
+  if (status === 429) return "rate_limited";
+  if (status >= 500) return "unavailable";
+  return "unexpected";
+}
+
+// src/validate.ts
+var STRING = { check: (value) => typeof value === "string", expected: "a string" };
+var STRING_OR_NULL = {
+  check: (value) => value === null || typeof value === "string",
+  expected: "a string or null"
+};
+var OPTIONAL_STRING = { ...STRING, optional: true };
+var COUNT = {
+  check: (value) => typeof value === "number" && Number.isInteger(value) && value >= 0,
+  expected: "a whole number"
+};
+var BOOLEAN = { check: (value) => typeof value === "boolean", expected: "a boolean" };
+var OBJECT = { check: isObject, expected: "an object" };
+var LIST_OF = { check: Array.isArray, expected: "a list" };
+var DATE = { check: isDate, expected: "a date" };
+var DATE_OR_NULL = {
+  check: (value) => value === null || isDate(value),
+  expected: "a date or null"
+};
+var RETRY_DEADLINE = { ...DATE_OR_NULL, absent: null };
+var PAUSED = { ...BOOLEAN, absent: false };
+var END_REASON = { ...STRING_OR_NULL, absent: null };
+var BLOCKED_SINCE = { ...DATE_OR_NULL, absent: null };
+var BLOCKED_REASON = { ...STRING_OR_NULL, absent: null };
+var SUBSCRIPTION_ID = { ...STRING_OR_NULL, absent: null };
+var STOP_REASON = { ...STRING_OR_NULL, absent: null };
+var CLOSABLE = { ...BOOLEAN, absent: false };
+var CLOSABLE_FROM = { ...DATE_OR_NULL, absent: null };
+var TRANSACTION_EXPIRES_AT = { ...DATE_OR_NULL, absent: null };
+var AMOUNT_USD = { ...STRING_OR_NULL, absent: null };
+var TOKEN = {
+  ...OBJECT,
+  absent: () => ({ symbol: null, name: null, logo_url: null, verified: false })
+};
+var RETRY_COUNT = {
+  check: (value) => value === null || COUNT.check(value),
+  expected: "a whole number or null",
+  absent: null
+};
+var SECONDS = {
+  check: (value) => typeof value === "number" && Number.isFinite(value),
+  expected: "a finite number of seconds"
+};
+var ANSWER = {
+  /** Null asked by external id or email, for a customer with nothing on that plan. */
+  wallet: STRING_OR_NULL,
+  plan: STRING,
+  subscription_id: SUBSCRIPTION_ID,
+  access: BOOLEAN,
+  status: STRING,
+  paused: PAUSED,
+  end_reason: END_REASON,
+  late_reason: STRING_OR_NULL,
+  stop_reason: STOP_REASON,
+  payment_status: STRING,
+  blocked_since: BLOCKED_SINCE,
+  blocked_reason: BLOCKED_REASON,
+  subscribed_since: DATE_OR_NULL,
+  first_subscribed_at: DATE_OR_NULL,
+  current_period_end: DATE_OR_NULL,
+  cancelled_at: DATE_OR_NULL,
+  access_until: DATE_OR_NULL,
+  next_charge_at: DATE_OR_NULL,
+  next_retry_at: DATE_OR_NULL,
+  retry_deadline: RETRY_DEADLINE,
+  closable: CLOSABLE,
+  closable_from: CLOSABLE_FROM,
+  revalidate_after: SECONDS
+};
+var ATTEMPT = {
+  outcome: STRING,
+  reason: STRING_OR_NULL,
+  amount: STRING,
+  attempted_at: DATE,
+  signature: STRING_OR_NULL
+};
+function accessAnswerFrom(body) {
+  const problem = answerProblem(body);
+  if (problem !== null) throw unreadable(problem, body);
+  return body;
+}
+function accessListFrom(body) {
+  const problem = _nullishCoalesce(problemWith(body, LIST), () => ( plansProblem(body)));
+  if (problem !== null) throw unreadable(problem, body);
+  return body;
+}
+var LIST = {
+  plans: LIST_OF,
+  revalidate_after: SECONDS
+};
+function answerProblem(body, label) {
+  return _nullishCoalesce(problemWith(body, ANSWER, label), () => ( attemptsProblem(body, label)));
+}
+function plansProblem(body) {
+  const { plans } = body;
+  for (const [index, answer] of plans.entries()) {
+    const problem = answerProblem(answer, `plans[${index}]`);
+    if (problem !== null) return problem;
+  }
+  return null;
+}
+var SUBSCRIPTION = {
+  id: STRING,
+  status: STRING,
+  paused: PAUSED,
+  end_reason: END_REASON,
+  late_reason: STRING_OR_NULL,
+  stop_reason: STOP_REASON,
+  access: BOOLEAN,
+  payment_status: STRING,
+  blocked_since: BLOCKED_SINCE,
+  blocked_reason: BLOCKED_REASON,
+  plan: STRING_OR_NULL,
+  wallet: STRING,
+  email: STRING_OR_NULL,
+  external_id: STRING_OR_NULL,
+  current_period_start: DATE_OR_NULL,
+  current_period_end: DATE_OR_NULL,
+  next_charge_at: DATE_OR_NULL,
+  next_retry_at: DATE_OR_NULL,
+  retry_deadline: RETRY_DEADLINE,
+  next_retry_number: RETRY_COUNT,
+  retries_allowed: RETRY_COUNT,
+  access_until: DATE_OR_NULL,
+  closable: CLOSABLE,
+  closable_from: CLOSABLE_FROM,
+  created_at: DATE,
+  confirmed_at: DATE_OR_NULL
+};
+var SUBSCRIPTION_LIST = {
+  data: LIST_OF,
+  has_more: BOOLEAN
+};
+var SUBSCRIPTION_ATTEMPT = {
+  id: STRING,
+  attempted_at: DATE,
+  outcome: STRING,
+  reason: STRING_OR_NULL,
+  amount: STRING,
+  amount_usd: AMOUNT_USD,
+  signature: STRING_OR_NULL,
+  retry: BOOLEAN,
+  retry_number: RETRY_COUNT,
+  retries_allowed: RETRY_COUNT,
+  period_start: DATE_OR_NULL
+};
+var SUBSCRIPTION_ATTEMPT_LIST = {
+  data: LIST_OF,
+  has_more: BOOLEAN,
+  paid: OBJECT
+};
+var BASE_UNITS = {
+  check: (value) => typeof value === "string" && /^\d+$/.test(value),
+  expected: "a whole number as a string"
+};
+var SUBSCRIBE_TRANSACTION = {
+  subscription: OBJECT,
+  transaction: STRING,
+  last_valid_block_height: STRING,
+  transaction_expires_at: TRANSACTION_EXPIRES_AT,
+  costs: OBJECT,
+  terms: OBJECT
+};
+var COSTS = {
+  rent: OBJECT,
+  fee: OBJECT,
+  total: BASE_UNITS
+};
+var RENT = {
+  subscription: BASE_UNITS,
+  // Null when the authority exists already: no rent for it.
+  authority: {
+    check: (value) => value === null || BASE_UNITS.check(value),
+    expected: "a whole number as a string or null"
+  },
+  total: BASE_UNITS
+};
+var FEE = {
+  signatures: COUNT,
+  per_signature: BASE_UNITS,
+  priority: BASE_UNITS,
+  total: BASE_UNITS
+};
+var PLAN = {
+  slug: STRING,
+  name: STRING,
+  description: STRING_OR_NULL,
+  project_name: STRING,
+  logo_url: STRING_OR_NULL,
+  amount: STRING,
+  amount_display: STRING,
+  amount_usd: AMOUNT_USD,
+  decimals: COUNT,
+  symbol: STRING_OR_NULL,
+  token: TOKEN,
+  mint: STRING,
+  period_hours: COUNT,
+  network: STRING,
+  // A string, not one of two: a status added later is handed back, not refused.
+  status: STRING,
+  available: BOOLEAN,
+  ends_at: DATE_OR_NULL
+};
+var PLAN_TOKEN = {
+  symbol: STRING_OR_NULL,
+  name: STRING_OR_NULL,
+  logo_url: STRING_OR_NULL,
+  verified: BOOLEAN
+};
+function planProblem(body, label) {
+  return _nullishCoalesce(problemWith(body, PLAN, label), () => ( problemWith(
+    body.token,
+    PLAN_TOKEN,
+    label === void 0 ? "token" : `${label}.token`
+  )));
+}
+function planFrom(body) {
+  const problem = planProblem(body);
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/plans/:slug");
+  return body;
+}
+function planListFrom(body) {
+  const problem = _nullishCoalesce(problemWith(body, { plans: LIST_OF }), () => ( firstProblem(body.plans, "plans", planProblem)));
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/plans");
+  return body.plans;
+}
+function serverSubscriptionFrom(body, route = "GET /v1/subscriptions/:id", status = 200) {
+  const problem = problemWith(body, SUBSCRIPTION);
+  if (problem !== null) throw unreadable(problem, body, route, status);
+  return body;
+}
+function serverSubscriptionListFrom(body) {
+  const problem = _nullishCoalesce(problemWith(body, SUBSCRIPTION_LIST), () => ( firstProblem(body.data, "data", SUBSCRIPTION)));
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/subscriptions");
+  return body;
+}
+function subscriptionAttemptListFrom(body) {
+  const problem = _nullishCoalesce(_nullishCoalesce(problemWith(body, SUBSCRIPTION_ATTEMPT_LIST), () => ( firstProblem(body.data, "data", SUBSCRIPTION_ATTEMPT))), () => ( problemWith(
+    body.paid,
+    { count: COUNT, amount: BASE_UNITS },
+    "paid"
+  )));
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/subscriptions/:id/attempts");
+  return body;
+}
+function subscribeTransactionFrom(body, route = "POST /v1/subscriptions") {
+  const problem = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(problemWith(body, SUBSCRIBE_TRANSACTION), () => ( problemWith(
+    body.subscription,
+    { id: STRING, status: STRING },
+    "subscription"
+  ))), () => ( problemWith(body.costs, COSTS, "costs"))), () => ( problemWith(body.costs.rent, RENT, "costs.rent"))), () => ( problemWith(body.costs.fee, FEE, "costs.fee"))), () => ( problemWith(
+    body.terms,
+    { message: STRING, expires_at: DATE },
+    "terms"
+  )));
+  if (problem !== null) throw unreadable(problem, body, route, 201);
+  return body;
+}
+function submitResultFrom(body) {
+  return confirmResultFrom(body, "POST /v1/subscriptions/:id/submit");
+}
+function confirmResultFrom(body, route) {
+  const problem = _nullishCoalesce(_nullishCoalesce(problemWith(body, { subscription: OBJECT }), () => ( problemWith(body.subscription, SUBSCRIPTION, "subscription"))), () => ( reasonProblem(body)));
+  if (problem !== null) throw unreadable(problem, body, route, 201);
+  return body;
+}
+var WALLET_TRANSACTION = {
+  transaction: STRING,
+  last_valid_block_height: STRING,
+  transaction_expires_at: TRANSACTION_EXPIRES_AT
+};
+function walletTransactionFrom(body, route) {
+  const problem = problemWith(body, WALLET_TRANSACTION);
+  if (problem !== null) throw unreadable(problem, body, route, 201);
+  return body;
+}
+function reasonProblem({ reason, reason_code }) {
+  if (reason !== void 0 && typeof reason !== "string") return "reason is not a string";
+  if (reason_code !== void 0 && typeof reason_code !== "string") {
+    return "reason_code is not a string";
+  }
+  return null;
+}
+var SEQUENCE = {
+  check: (value) => typeof value === "number" && Number.isInteger(value) && value >= 1,
+  expected: "a whole number from 1",
+  optional: true
+};
+var EVENT = {
+  id: STRING,
+  object: { check: (value) => value === "event", expected: '"event"' },
+  type: STRING,
+  created_at: DATE,
+  network: STRING,
+  api_version: STRING,
+  sequence: SEQUENCE,
+  data: OBJECT,
+  detail: OBJECT
+};
+var TEST = { check: (value) => value === true, expected: "true", optional: true };
+var OLDER_WEBHOOK = { type: STRING, created_at: DATE, data: OBJECT, test: TEST };
+var FIRST_PAYMENT = {
+  check: (value) => value === null || problemWith(value, { amount: STRING, mint: STRING_OR_NULL, signature: STRING_OR_NULL }) === null,
+  expected: "null or a payment (amount, mint, signature)",
+  optional: true
+};
+var ACCESS_CHANGED = {
+  changed_at: DATE,
+  blocked_reason: { ...STRING_OR_NULL, optional: true },
+  access_until: { ...DATE_OR_NULL, optional: true }
+};
+var DETAILS = {
+  "subscription.created": {
+    previous_id: OPTIONAL_STRING,
+    first_payment: FIRST_PAYMENT
+  },
+  "subscription.ended": {
+    changed_at: { ...DATE, optional: true },
+    // Only `cancelled` today: a newer word is let through, as a status is.
+    end_reason: OPTIONAL_STRING
+  },
+  "subscription.renewal_upcoming": {
+    can_pay: BOOLEAN,
+    renewal_issue: STRING_OR_NULL,
+    amount: STRING,
+    mint: STRING,
+    due_at: DATE
+  },
+  "subscription.renewed": {
+    amount: STRING,
+    mint: STRING,
+    period_start: DATE,
+    period_end: DATE,
+    signature: STRING
+  },
+  "subscription.payment_failed": {
+    reason: STRING,
+    amount: STRING,
+    mint: STRING,
+    period_start: DATE_OR_NULL,
+    period_end: DATE_OR_NULL,
+    next_retry_at: DATE_OR_NULL,
+    retry_deadline: DATE_OR_NULL,
+    retries_left: COUNT,
+    retry_mode: STRING_OR_NULL
+  },
+  "subscription.stopped": {
+    reason: STRING
+  },
+  "subscription.access_granted": ACCESS_CHANGED,
+  "subscription.access_revoked": ACCESS_CHANGED
+};
+function eventProblem(body, label) {
+  const prefix = label === void 0 ? "" : `${label}.`;
+  const { type, data, detail } = body;
+  const fields = DETAILS[type];
+  return _nullishCoalesce(_nullishCoalesce(problemWith(body, EVENT, label), () => ( problemWith(data, SUBSCRIPTION, `${prefix}data`))), () => ( (fields ? problemWith(detail, fields, `${prefix}detail`) : null)));
+}
+function eventFrom(body) {
+  const problem = eventProblem(body);
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/events/:id");
+  return body;
+}
+function eventListFrom(body) {
+  const problem = _nullishCoalesce(problemWith(body, EVENT_LIST), () => ( firstProblem(body.data, "data", eventProblem)));
+  if (problem !== null) throw unreadable(problem, body, "GET /v1/events");
+  return body;
+}
+var EVENT_LIST = {
+  data: LIST_OF,
+  has_more: BOOLEAN,
+  available_since: DATE
+};
+function webhookEventFrom(body, deliveryId) {
+  const older = isObject(body) && !("id" in body) && !("object" in body);
+  const problem = older ? olderWebhookProblem(body) : _nullishCoalesce(eventProblem(body), () => ( problemWith(body, { test: TEST })));
+  if (problem !== null) {
+    throw new MesubError(`Mesub sent a webhook this SDK cannot read: ${problem}.`, {
+      status: null,
+      code: "unexpected",
+      body
+    });
+  }
+  if (!older) return { ...body, delivery_id: deliveryId };
+  const { type, created_at, data, test } = body;
+  const { detail, ...subscription } = data;
+  return {
+    id: null,
+    delivery_id: deliveryId,
+    object: "event",
+    type,
+    created_at,
+    network: null,
+    api_version: null,
+    data: subscription,
+    detail,
+    ...test !== void 0 && { test }
+  };
+}
+function olderWebhookProblem(body) {
+  const { type, data } = body;
+  const fields = DETAILS[type];
+  return _nullishCoalesce(_nullishCoalesce(problemWith(body, OLDER_WEBHOOK), () => ( problemWith(data, { ...SUBSCRIPTION, detail: OBJECT }, "data"))), () => ( (fields ? problemWith(data.detail, fields, "data.detail") : null)));
+}
+function firstProblem(items, label, fields) {
+  for (const [index, item] of items.entries()) {
+    const at = `${label}[${index}]`;
+    const problem = typeof fields === "function" ? fields(item, at) : problemWith(item, fields, at);
+    if (problem !== null) return problem;
+  }
+  return null;
+}
+function unreadable(problem, body, route = "/v1/access", status = 200) {
+  return new MesubError(
+    `Mesub answered ${route} with an answer this SDK cannot read: ${problem}.`,
+    { status, code: "unexpected", body }
+  );
+}
+function problemWith(body, fields, label) {
+  if (!isObject(body)) {
+    return `${_nullishCoalesce(label, () => ( "the body"))} is not an object`;
+  }
+  const prefix = label === void 0 ? "" : `${label}.`;
+  for (const [name, field] of Object.entries(fields)) {
+    const value = body[name];
+    if (value === void 0 && field.optional) continue;
+    if (value === void 0 && "absent" in field) {
+      body[name] = typeof field.absent === "function" ? field.absent() : field.absent;
+      continue;
+    }
+    if (value === void 0) return `${prefix}${name} is missing`;
+    if (!field.check(value)) return `${prefix}${name} is not ${field.expected}`;
+  }
+  return null;
+}
+function attemptsProblem(body, label) {
+  const { attempts } = body;
+  const prefix = label === void 0 ? "" : `${label}.`;
+  if (attempts === void 0) return null;
+  if (!Array.isArray(attempts)) return `${prefix}attempts is not a list`;
+  for (const [index, attempt] of attempts.entries()) {
+    const problem = problemWith(attempt, ATTEMPT, `${prefix}attempts[${index}]`);
+    if (problem !== null) return problem;
+  }
+  return null;
+}
+function isDate(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value));
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/webhooks.ts
+var SECRET_PREFIX = "whsec_";
+var DEFAULT_TOLERANCE = 5 * 60 * 1e3;
+var TIMESTAMP = /^[0-9]{1,15}$/;
+async function verifyWebhook(body, headers, options = {}) {
+  return verify(body, headers, options, void 0);
+}
+var Webhooks = class {
+  #secret;
+  #received;
+  /** @internal */
+  constructor(secret, received) {
+    this.#secret = secret;
+    this.#received = received;
+  }
+  /**
+   * `verifyWebhook`, with `webhookSecret` unless `options.secret` says
+   * otherwise. A verified event also drops every access answer cached for
+   * its customer, the yes and the no, so the next check asks Mesub.
+   * Three drop nothing: `subscription.renewal_upcoming`, which moves no
+   * access, the `test` event, and any body with `test: true`, whose
+   * subscription is made up.
+   */
+  async verify(body, headers, options = {}) {
+    const event = await verify(body, headers, options, this.#secret);
+    const moves = event.test !== true && event.type !== "test" && event.type !== "subscription.renewal_upcoming";
+    if (moves) await this.#received(event);
+    return event;
+  }
+};
+async function verify(body, headers, options, fallback) {
+  const key = options.secret !== void 0 || fallback !== void 0 ? keyOf(_nullishCoalesce(options.secret, () => ( fallback)), "secret") : keyOf(envSecret(), "MESUB_WEBHOOK_SECRET");
+  const tolerance = numberOf("tolerance", options.tolerance, DEFAULT_TOLERANCE);
+  const bytes = bytesOf(body);
+  if (typeof headers !== "object" || headers === null) {
+    throw new TypeError("headers must be the request headers: a Headers or a plain object.");
+  }
+  const id = headerIn(headers, "webhook-id");
+  const timestamp = headerIn(headers, "webhook-timestamp");
+  const signatures = headerIn(headers, "webhook-signature");
+  if (!id || !timestamp || !signatures) {
+    const missing = [
+      !id && "webhook-id",
+      !timestamp && "webhook-timestamp",
+      !signatures && "webhook-signature"
+    ].filter(Boolean);
+    throw invalid(`The webhook has no ${missing.join(", ")} header: it is not one of Mesub's.`);
+  }
+  if (!TIMESTAMP.test(timestamp)) {
+    throw invalid("The webhook-timestamp header is not a number of seconds.");
+  }
+  const expected = await signatureOf(key, id, timestamp, bytes);
+  let matched = false;
+  for (const candidate of signatures.split(" ")) {
+    const [version, encoded] = candidate.split(",");
+    const given = version === "v1" && encoded !== void 0 ? fromBase64(encoded) : null;
+    if (given !== null && sameBytes(given, expected)) matched = true;
+  }
+  if (!matched) {
+    throw invalid(
+      "No signature of the webhook matches the secret: not Mesub's, another endpoint's secret, or a body changed on its way (parsed then serialized again?). Verify the raw body."
+    );
+  }
+  const skew = Date.now() - Number(timestamp) * 1e3;
+  if (Math.abs(skew) > tolerance) {
+    throw invalid(
+      `The webhook was signed ${Math.round(Math.abs(skew) / 1e3)} s ${skew > 0 ? "ago" : "ahead of this clock"}, beyond the ${tolerance / 1e3} s tolerance: a replay, or this server's clock is off.`
+    );
+  }
+  return webhookEventFrom(parsed(body, bytes), id);
+}
+function bytesOf(body) {
+  if (typeof body === "string") return new TextEncoder().encode(body);
+  if (body instanceof Uint8Array) return new Uint8Array(body);
+  if (body instanceof ArrayBuffer) return new Uint8Array(body.slice(0));
+  throw new TypeError(
+    "body must be the raw body as received, a string or a Buffer, never parsed: the signature is over its exact bytes. With Express, read it with express.raw({ type: 'application/json' }); in a Next route, await request.text()."
+  );
+}
+function parsed(body, bytes) {
+  try {
+    const text = typeof body === "string" ? body : new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return JSON.parse(text);
+  } catch (cause) {
+    throw new MesubError("Mesub sent a webhook whose body is not JSON.", {
+      status: null,
+      code: "unexpected",
+      cause
+    });
+  }
+}
+function keyOf(secret, name) {
+  if (secret === void 0 || secret === "") {
+    throw new TypeError(
+      typeof process === "undefined" ? "Missing Mesub webhook secret: there is no process.env here, so pass it: `{ secret: env.MESUB_WEBHOOK_SECRET }` or `new Mesub({ webhookSecret })`." : "Missing Mesub webhook secret: pass `{ secret }` or `new Mesub({ webhookSecret })`, or set MESUB_WEBHOOK_SECRET."
+    );
+  }
+  const key = typeof secret === "string" && secret.startsWith(SECRET_PREFIX) ? fromBase64(secret.slice(SECRET_PREFIX.length)) : null;
+  if (key === null || key.length === 0) {
+    throw new TypeError(
+      `${name} must be the endpoint's signing secret, whsec_..., from its page in the Mesub dashboard` + (typeof secret === "string" && /^(SUB|PUB)_/.test(secret) ? ", not an API key." : ".")
+    );
+  }
+  return key;
+}
+function webhookSecretOf(given) {
+  if (given !== void 0 && typeof given !== "string") {
+    throw new TypeError("webhookSecret must be a string.");
+  }
+  const secret = given || envSecret();
+  if (secret) keyOf(secret, given ? "webhookSecret" : "MESUB_WEBHOOK_SECRET");
+  return secret || void 0;
+}
+function envSecret() {
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _4 => _4.env, 'optionalAccess', _5 => _5["MESUB_WEBHOOK_SECRET"]]);
+}
+function headerIn(headers, name) {
+  if (typeof headers.get === "function") {
+    return _nullishCoalesce(headers.get(name), () => ( void 0));
+  }
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === name) return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+async function signatureOf(key, id, timestamp, body) {
+  const prefix = new TextEncoder().encode(`${id}.${timestamp}.`);
+  const signed = new Uint8Array(prefix.length + body.length);
+  signed.set(prefix);
+  signed.set(body, prefix.length);
+  const hmac = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", hmac, signed));
+}
+async function signedHeaders(secret, id, timestamp, body) {
+  const key = keyOf(secret, "secret");
+  const signature = await signatureOf(key, id, String(timestamp), new TextEncoder().encode(body));
+  return {
+    "webhook-id": id,
+    "webhook-timestamp": String(timestamp),
+    "webhook-signature": `v1,${toBase64(signature)}`
+  };
+}
+function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let difference = 0;
+  for (let index = 0; index < a.length; index += 1) {
+    difference |= (_nullishCoalesce(a[index], () => ( 0))) ^ (_nullishCoalesce(b[index], () => ( 0)));
+  }
+  return difference === 0;
+}
+function fromBase64(text) {
+  try {
+    return Uint8Array.from(atob(text), (char) => char.charCodeAt(0));
+  } catch (e6) {
+    return null;
+  }
+}
+function toBase64(bytes) {
+  return btoa(String.fromCharCode(...bytes));
+}
+function invalid(message) {
+  return new MesubError(message, { status: null, code: "invalid_webhook" });
+}
+
+// src/transport.ts
+var REQUEST_ID_HEADER = "Mesub-Request-Id";
+var INITIAL_RETRY_DELAY = 500;
+var MAX_RETRY_DELAY = 8e3;
+var MAX_RETRY_AFTER = 6e4;
+var Transport = class {
+  #config;
+  constructor(config) {
+    this.#config = config;
+  }
+  async get(path, query = {}, options = {}) {
+    const url = endpoint(this.#config.baseUrl, path);
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+    return this.#send("GET", url, void 0, options);
+  }
+  /**
+   * A POST with a JSON body, sent once: never retried here, whatever the
+   * status, a timeout or a network error. A write that got no answer may
+   * still have been done: its caller decides, knowing the route, whether
+   * the same body may be sent again (`submit` does, Mesub-io/backend#190)
+   * or the state read back.
+   */
+  async post(path, body, options = {}) {
+    return this.#send("POST", endpoint(this.#config.baseUrl, path), body, options);
+  }
+  async #send(method, url, body, options) {
+    const maxRetries = method === "POST" ? 0 : _nullishCoalesce(options.maxRetries, () => ( this.#config.maxRetries));
+    const { deadline, signal } = options;
+    numberOf("timeout", options.timeout, this.#config.timeout, { delay: true });
+    for (let retry = 0; ; retry++) {
+      const attempt = await this.#attempt(method, url, body, options);
+      if (attempt.ok) return attempt.body;
+      if (!attempt.retry || retry >= maxRetries) throw attempt.error;
+      if (options.retryRateLimited === false && attempt.error.status === 429) {
+        throw attempt.error;
+      }
+      const wait = _nullishCoalesce(attempt.retryAfter, () => ( backoff(retry)));
+      if (deadline !== void 0 && Date.now() + wait >= deadline) {
+        throw attempt.error;
+      }
+      await sleep(wait, signal);
+    }
+  }
+  async #attempt(method, url, body, { deadline, signal, ...options }) {
+    _optionalChain([signal, 'optionalAccess', _6 => _6.throwIfAborted, 'call', _7 => _7()]);
+    const perAttempt = _nullishCoalesce(options.timeout, () => ( this.#config.timeout));
+    const left = deadline === void 0 ? Infinity : deadline - Date.now();
+    if (left <= 0) {
+      const error = new MesubError("No time was left to call Mesub.", {
+        status: null,
+        code: "unavailable"
+      });
+      return { ok: false, error, retry: false, retryAfter: null };
+    }
+    const timeout = Math.min(perAttempt, left);
+    const cutByDeadline = timeout < perAttempt;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    const stop = () => controller.abort(_optionalChain([signal, 'optionalAccess', _8 => _8.reason]));
+    _optionalChain([signal, 'optionalAccess', _9 => _9.addEventListener, 'call', _10 => _10("abort", stop, { once: true })]);
+    try {
+      const response = await this.#config.fetch(url, {
+        method,
+        headers: {
+          ...this.#config.headers,
+          Authorization: `Bearer ${this.#config.apiKey}`,
+          Accept: "application/json",
+          "User-Agent": `@mesub/node/${VERSION}`,
+          [API_VERSION_HEADER]: API_VERSION,
+          ...body !== void 0 && { "Content-Type": "application/json" }
+        },
+        ...body !== void 0 && { body: JSON.stringify(body) },
+        signal: controller.signal
+      });
+      const text = await response.text();
+      const requestId = response.headers.get(REQUEST_ID_HEADER);
+      if (response.ok) {
+        try {
+          return { ok: true, body: JSON.parse(text) };
+        } catch (cause) {
+          const error2 = new MesubError("Mesub answered with a body that is not JSON.", {
+            status: response.status,
+            code: "unexpected",
+            body: text,
+            requestId,
+            cause
+          });
+          return { ok: false, error: error2, retry: false, retryAfter: null };
+        }
+      }
+      const answered = parsed2(text);
+      const asked = retryAfter(response.headers.get("retry-after"));
+      const error = response.status === 404 && !isMesubErrorBody(answered) ? new MesubError(
+        `${url.pathname} answered 404 with no Mesub error: is baseUrl (${this.#config.baseUrl}) the Mesub API?`,
+        {
+          status: 404,
+          code: "unexpected",
+          body: answered,
+          retryAfter: asked,
+          requestId
+        }
+      ) : errorFrom(response.status, answered, asked, requestId);
+      return {
+        ok: false,
+        error,
+        // Sent again (a GET only, a POST never is) when the error is `retryable`:
+        // Mesub's flag when the body has one, the status's otherwise.
+        retry: error.retryable,
+        retryAfter: asked === null ? null : Math.min(asked, MAX_RETRY_AFTER)
+      };
+    } catch (cause) {
+      if (_optionalChain([signal, 'optionalAccess', _11 => _11.aborted])) throw signal.reason;
+      if (controller.signal.aborted && cutByDeadline) {
+        const error2 = new MesubError(
+          `Mesub did not answer within the ${Math.round(timeout)} ms left before the deadline.`,
+          { status: null, code: "unavailable", cause }
+        );
+        return { ok: false, error: error2, retry: false, retryAfter: null };
+      }
+      const message = controller.signal.aborted ? `Mesub did not answer within ${perAttempt} ms.` : `Could not reach Mesub: ${cause instanceof Error ? cause.message : String(cause)}`;
+      const error = new MesubError(message, { status: null, code: "unavailable", cause });
+      return { ok: false, error, retry: true, retryAfter: null };
+    } finally {
+      clearTimeout(timer);
+      _optionalChain([signal, 'optionalAccess', _12 => _12.removeEventListener, 'call', _13 => _13("abort", stop)]);
+    }
+  }
+};
+function endpoint(baseUrl, path) {
+  return new URL(baseUrl + path);
+}
+function errorFrom(status, body, retryAfter2, header) {
+  const { code, retryable, request_id } = isRecord(body) ? body : {};
+  const apiCode = typeof code === "string" ? code : null;
+  return new MesubError(messageFrom(body, status), {
+    status,
+    code: codeFor(status, apiCode),
+    apiCode,
+    retryable: typeof retryable === "boolean" ? retryable : retryableStatus(status),
+    body,
+    retryAfter: retryAfter2,
+    // The header first: the body's says the same, and is the fallback
+    // when a proxy in front drops the header (Mesub-io/backend#472).
+    requestId: _nullishCoalesce(header, () => ( (typeof request_id === "string" ? request_id : null)))
+  });
+}
+function retryableStatus(status) {
+  return status === 408 || status === 429 || status >= 500;
+}
+function retryAfter(header) {
+  if (header === null || header.trim() === "") return null;
+  const seconds = Number(header);
+  const ms = Number.isNaN(seconds) ? Date.parse(header) - Date.now() : seconds * 1e3;
+  if (!Number.isFinite(ms) || ms < 0) return null;
+  return ms;
+}
+function backoff(retry) {
+  const delay = Math.min(INITIAL_RETRY_DELAY * 2 ** retry, MAX_RETRY_DELAY);
+  return delay * (1 - Math.random() * 0.25);
+}
+function messageFrom(body, status) {
+  const fallback = `Mesub answered with HTTP ${status}.`;
+  if (!isRecord(body)) return fallback;
+  const { message, error } = body;
+  if (typeof message === "string" && message !== "") return message;
+  if (Array.isArray(message)) {
+    const parts = message.filter((part) => typeof part === "string");
+    if (parts.length > 0) return parts.join("; ");
+  }
+  if (typeof error === "string" && error !== "") return error;
+  return fallback;
+}
+function isMesubErrorBody(body) {
+  if (!isRecord(body)) return false;
+  const { code, statusCode, message } = body;
+  if (typeof message === "string" && /^Cannot [A-Z]+ \//.test(message)) return false;
+  return typeof code === "string" || typeof statusCode === "number";
+}
+function parsed2(text) {
+  try {
+    return JSON.parse(text);
+  } catch (e7) {
+    return text;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const stop = () => {
+      clearTimeout(timer);
+      reject(_optionalChain([signal, 'optionalAccess', _14 => _14.reason]));
+    };
+    const timer = setTimeout(() => {
+      _optionalChain([signal, 'optionalAccess', _15 => _15.removeEventListener, 'call', _16 => _16("abort", stop)]);
+      resolve();
+    }, ms);
+    _optionalChain([signal, 'optionalAccess', _17 => _17.addEventListener, 'call', _18 => _18("abort", stop, { once: true })]);
+  });
+}
+
+// src/subscriptions.ts
+var SUBMIT_TIMEOUT = 9e4;
+var REPLAY_ROOM = 3e4;
+var MAX_SENDS = 3;
+var REPLAY_WAIT = 1e4;
+var READ_BACK_TIME = 1e4;
+var CONFIRM_TIMEOUT = SUBMIT_TIMEOUT;
+var Subscriptions = class {
+  #transport;
+  /**
+   * Told of every subscription `submit`, `retrieve` and `list` answer, so
+   * the client drops the cached access answers one that landed outdates.
+   */
+  #seen;
+  /**
+   * Told of the subscription a confirm moved, so the client drops every
+   * access answer cached for its customer, the yes as well as the no.
+   */
+  #changed;
+  /** @internal */
+  constructor(transport, seen = async () => {
+  }, changed = seen) {
+    this.#transport = transport;
+    this.#seen = seen;
+    this.#changed = changed;
+  }
+  /**
+   * Reserves a subscription to that plan for that wallet, and builds what
+   * it signs: `terms.message`, then `transaction`. Hand both to your front,
+   * then their signatures to `submit`. Called again for the same plan,
+   * wallet and customer (`external_id`, else `email`) while nothing landed,
+   * it answers the same subscription with a fresh transaction; by its id,
+   * `transaction` does. Another
+   * customer naming that wallet gets a subscription of its own
+   * (Mesub-io/backend#311): only the one the wallet signs for lands, and
+   * the others then expire. Sent once, never retried.
+   */
+  async create(params, options = {}) {
+    const { plan, wallet, email, external_id } = params;
+    const body = { plan, wallet, email, external_id };
+    return subscribeTransactionFrom(
+      await this.#transport.post("/v1/subscriptions", body, options)
+    );
+  }
+  /**
+   * Relays what the wallet signed. Mesub checks it, co-signs, sends it and
+   * waits for the chain, so one send takes up to a minute or so: 90 s
+   * unless `options.timeout` says otherwise.
+   *
+   * When the send gets no answer that says what became of it (a timeout,
+   * a network error, a 5xx), or an error Mesub marks `retryable`, the same
+   * request, the same body, is sent again, up to twice, after the
+   * `Retry-After` Mesub asked for or 10 s, within `options.budget` (120 s
+   * by default). That is safe since Mesub-io/backend#190 and #202: Mesub
+   * recognises the transaction and the terms signature it already
+   * co-signed, signs nothing again, and answers from the chain or from the
+   * subscription it settled. Its answer is then returned as if the first
+   * send had got it, a `pending` with Mesub's own `reason` included.
+   *
+   * When no send got an answer, the subscription is read back once, within
+   * 10 s: it is returned if `active` or `cancelled` (it landed), and
+   * otherwise a `MesubSubmitError` `unavailable` is thrown with it attached
+   * as `subscription` (null if that read failed too): the wallet may have
+   * paid and the transaction may still land, so read it again with
+   * `retrieve` rather than create anew. A 2xx this SDK cannot read is read
+   * back the same way, and thrown as `unexpected`; so is a replay refused
+   * with `not_awaiting_signature` after a send that got no answer, thrown
+   * as that `conflict`.
+   *
+   * A 503 `unavailable` (too many submits waiting on the project,
+   * Mesub-io/backend#505) says nothing was signed or sent: it is replayed
+   * after its `Retry-After` (2 s) like any retryable refusal, and when the
+   * replays run out it is thrown as is, `retryable`, with no read back,
+   * unless an earlier send got no answer.
+   *
+   * Any other refusal (`terms_expired`, `transaction_expired`, ...) is
+   * thrown as is. After `transaction_expired` nothing was sent and the same
+   * submit cannot land: call `transaction(id)` for a new one, never
+   * `create` again.
+   * An abort through `options.signal` stops everything, sends, waits and
+   * the read back, and rejects with the signal's reason; a send already out
+   * may have been co-signed, so read the subscription back.
+   *
+   * A subscription returned with `access` (`active`, or `cancelled` before
+   * its end) drops the `/v1/access` answers cached for that customer (its
+   * wallet, external id and email) that still say no: `hasAccess` right
+   * after asks Mesub again.
+   */
+  async submit(id, params, options = {}) {
+    const result = await this.#submit(id, params, options);
+    await this.#seen(result.subscription);
+    return result;
+  }
+  /**
+   * A fresh transaction for a subscription still `pending`, with the terms
+   * it names (Mesub-io/backend#427). A transaction lives about half a
+   * minute, the terms five: have the terms signed first, call this when the
+   * wallet is ready, have it sign the transaction at once, then `submit`.
+   * Always sign the transaction of the last call. It is also what follows
+   * a submit refused with `transaction_expired`.
+   *
+   * A terms signature you hold is still good when `terms.message` is, to
+   * the letter, the message the wallet signed. Another text is new terms:
+   * have the wallet sign it, the old signature is refused
+   * (`invalid_terms_signature`).
+   *
+   * Reserves nothing and sends no body: the wallet, the plan and the
+   * customer are the subscription's own. Refused with `apiCode`
+   * `not_awaiting_signature` once it is signed, expired or ended (call
+   * `create` again for an expired one), and with what `create` refuses of
+   * a plan or a wallet (`plan_ended`, `insufficient_balance`,
+   * `already_subscribed`, ...). Sent once, never retried: asking twice is
+   * safe, only the last transaction is to be signed.
+   */
+  async transaction(id, options = {}) {
+    return subscribeTransactionFrom(
+      await this.#transport.post(`${pathOf(id)}/transaction`, void 0, options),
+      "POST /v1/subscriptions/:id/transaction"
+    );
+  }
+  async #submit(id, params, options) {
+    const path = `${pathOf(id)}/submit`;
+    const body = { transaction: params.transaction, terms_signature: params.terms_signature };
+    const { signal } = options;
+    const timeout = numberOf("timeout", options.timeout, SUBMIT_TIMEOUT, { delay: true });
+    const budget = _nullishCoalesce(options.budget, () => ( timeout + REPLAY_ROOM));
+    if (!Number.isFinite(budget) || budget <= 0) {
+      throw new TypeError(`budget must be a positive number of ms, not ${budget}.`);
+    }
+    const deadline = Date.now() + budget;
+    let lost = false;
+    let responded = null;
+    for (let sent = 1; ; sent++) {
+      let error;
+      try {
+        const answer = await this.#transport.post(path, body, {
+          timeout,
+          deadline,
+          ...signal !== void 0 && { signal }
+        });
+        return submitResultFrom(answer);
+      } catch (caught) {
+        if (!(caught instanceof MesubError)) throw caught;
+        error = caught;
+      }
+      const lostBefore = lost;
+      if (unanswered(error)) lost = true;
+      if (error.status !== null) responded = error;
+      const unsettled = { sends: sent, cause: error, from: error, lead: error.message };
+      if (error.status !== null && error.status < 300) {
+        return this.#settle(id, signal, {
+          ...unsettled,
+          code: "unexpected",
+          retryable: false
+        });
+      }
+      if (lostBefore && error.apiCode === "not_awaiting_signature") {
+        return this.#settle(id, signal, {
+          ...unsettled,
+          code: error.code,
+          retryable: error.retryable
+        });
+      }
+      const rebuild = error.apiCode === "comeback_period_rolling";
+      const replay = !rebuild && (error.status === null || error.retryable);
+      const wait = _nullishCoalesce(error.retryAfter, () => ( REPLAY_WAIT));
+      if (!replay || sent >= MAX_SENDS || Date.now() + wait >= deadline) {
+        if (!lost || !unanswered(error) && !error.retryable) throw error;
+        return this.#settle(id, signal, {
+          ...unsettled,
+          from: _nullishCoalesce(responded, () => ( error)),
+          code: "unavailable",
+          retryable: true,
+          lead: `Mesub never said what became of the submit, sent ${sent} ${sent === 1 ? "time" : "times"}: ${error.message}`
+        });
+      }
+      await sleep(wait, signal);
+    }
+  }
+  /**
+   * A submit whose outcome is unknown, settled from the subscription read
+   * back: returned if it landed, thrown with it otherwise.
+   */
+  async #settle(id, signal, { sends, cause, from, code, retryable, lead }) {
+    const subscription = await this.#readBack(id, signal);
+    if (_optionalChain([subscription, 'optionalAccess', _19 => _19.status]) === "active" || _optionalChain([subscription, 'optionalAccess', _20 => _20.status]) === "cancelled") {
+      return { subscription };
+    }
+    const then = subscription === null ? "Reading the subscription back failed too" : `The subscription read back is ${subscription.status}`;
+    throw new MesubSubmitError(
+      `${lead} ${then}: read it again with retrieve before creating anew.`,
+      {
+        status: from.status,
+        code,
+        apiCode: from.apiCode,
+        retryable,
+        body: from.body,
+        retryAfter: from.retryAfter,
+        requestId: from.requestId,
+        cause,
+        subscription,
+        sends
+      }
+    );
+  }
+  /**
+   * The subscription after a submit, within `READ_BACK_TIME`: no attempt
+   * nor retry wait goes past it. Null when it cannot be read; the caller's
+   * abort is thrown as is.
+   */
+  async #readBack(id, signal) {
+    try {
+      const body = await this.#transport.get(
+        pathOf(id),
+        {},
+        {
+          deadline: Date.now() + READ_BACK_TIME,
+          ...signal !== void 0 && { signal }
+        }
+      );
+      return serverSubscriptionFrom(body);
+    } catch (error) {
+      if (_optionalChain([signal, 'optionalAccess', _21 => _21.aborted])) throw error;
+      return null;
+    }
+  }
+  /**
+   * Builds the transaction that cancels an `active`, `unpaid` or `stopped`
+   * subscription. Hand it to your front: the subscription's wallet signs
+   * and sends it, then `confirmCancel` takes the signature. Nothing is
+   * cancelled until then. Sent once, never retried.
+   *
+   * One paid up keeps its access to the end of its period; a late or
+   * stopped one has none, and its missed period is never collected.
+   */
+  async cancel(id, options = {}) {
+    return this.#build("cancel", id, options);
+  }
+  /**
+   * Settles a cancellation the wallet sent, by the signature it answered:
+   * `cancelled`, or the subscription as it was with a `reason` when nothing
+   * landed. Mesub waits for the chain, so up to a minute or so: 90 s unless
+   * `options.timeout` says otherwise. Sent once, never retried; the same
+   * confirm sent again is answered the same.
+   *
+   * Settled without a `reason`, it drops every `/v1/access` answer cached
+   * for that customer on that plan: `access` right after asks Mesub again.
+   */
+  async confirmCancel(id, params, options = {}) {
+    return this.#confirm("cancel", id, params, options);
+  }
+  /**
+   * Builds the transaction that takes a `cancelled` subscription back,
+   * before the period it paid for is over. Hand it to your front: the
+   * wallet signs and sends it, then `confirmResume` takes the signature.
+   * Sent once, never retried.
+   */
+  async resume(id, options = {}) {
+    return this.#build("resume", id, options);
+  }
+  /** As `confirmCancel`, for a resume: `active` again, or a `reason`. */
+  async confirmResume(id, params, options = {}) {
+    return this.#confirm("resume", id, params, options);
+  }
+  /**
+   * Builds the transaction that closes the wallet's authorisation on a
+   * subscription that is over: its rent goes back to the wallet. Mesub
+   * builds it for a cancelled one past its end; for a stopped one
+   * cancelled on chain and past its end, or whose authority is closed for
+   * good; and for one `ended` with its plan (`end_reason` `plan_removed`,
+   * `plan_replaced` or `plan_ended`). A stopped one that nothing cancelled
+   * is refused with `subscription_not_cancelled`: cancel it first.
+   * Hand the transaction to your front: the wallet signs and sends it,
+   * then `confirmClose` takes the signature. Sent once, never retried.
+   */
+  async close(id, options = {}) {
+    return this.#build("close", id, options);
+  }
+  /** As `confirmCancel`, for a close: `ended` with `end_reason` `closed`, or a `reason`. */
+  async confirmClose(id, params, options = {}) {
+    return this.#confirm("close", id, params, options);
+  }
+  /**
+   * Pays a late payment now (Mesub-io/backend#354): the pull of the missed
+   * period runs at once rather than at its next retry, with nothing for the
+   * wallet to sign, since it approved the plan when it subscribed. Answers
+   * the subscription, still `unpaid`: the outcome comes with the pull, as
+   * the `subscription.renewed` or `subscription.payment_failed` webhook.
+   *
+   * The merchant's hand retry from the dashboard follows the same rules: on
+   * Free it is one of the missed period's three, whoever fires it; on Dev
+   * and Business it runs beside the schedule, the wait between two doubling.
+   * Mesub refuses it first when it cannot succeed, so it never spends a
+   * retry for nothing: `apiCode` `insufficient_balance` (top up, then pay
+   * again), `retry_cannot_succeed` (the wallet no longer approves it, its
+   * token account is frozen, or its authority is closed), `retry_too_soon`
+   * (`retryAfter` says when), `retries_spent`, `retry_deadline_passed`,
+   * `subscription_not_late`, `subscription_paused`, `plan_ended`. Two more
+   * are `retryable`: `subscription_changed` (two retries met, or a pull
+   * moved the subscription on) and, on Free, `pull_running` (a pull runs
+   * now). Read the subscription back before you ask again. A 503 is
+   * `retryable` too, and nothing changed: `unavailable` (the charge could
+   * not be queued) or `network_unavailable`, with `retryAfter` saying when
+   * to ask again (20 s and 10 s). Sent once, never retried: a second one is
+   * a second retry.
+   */
+  async retry(id, options = {}) {
+    return serverSubscriptionFrom(
+      await this.#transport.post(`${pathOf(id)}/retry`, void 0, options),
+      "POST /v1/subscriptions/:id/retry",
+      202
+    );
+  }
+  async #build(action, id, options) {
+    const path = `${pathOf(id)}/${action}`;
+    return walletTransactionFrom(
+      await this.#transport.post(path, void 0, options),
+      `POST /v1/subscriptions/:id/${action}`
+    );
+  }
+  async #confirm(action, id, params, options) {
+    const path = `${pathOf(id)}/${action}/confirm`;
+    const result = confirmResultFrom(
+      await this.#transport.post(
+        path,
+        { signature: params.signature },
+        { ...options, timeout: _nullishCoalesce(options.timeout, () => ( CONFIRM_TIMEOUT)) }
+      ),
+      `POST /v1/subscriptions/:id/${action}/confirm`
+    );
+    await (result.reason === void 0 ? this.#changed : this.#seen)(result.subscription);
+    return result;
+  }
+  /**
+   * One subscription of your project, by id. Found with `access`, it drops
+   * the access answers cached that still say no, as `submit` does.
+   */
+  async retrieve(id, options = {}) {
+    const subscription = serverSubscriptionFrom(
+      await this.#transport.get(pathOf(id), {}, options)
+    );
+    await this.#seen(subscription);
+    return subscription;
+  }
+  /**
+   * A customer's subscriptions, newest first, one page at a time; expired
+   * checkouts included. `listAll` walks every page.
+   *
+   * The customer is named as for `access`, and normalised the same way;
+   * none or two of `wallet`, `external_id` and `email` throws a TypeError.
+   * Each one with `access` drops the access answers cached that still say
+   * no, as `submit` does.
+   */
+  async list(params, options = {}) {
+    const { kind, value } = customerOf(params);
+    const { plan, limit, starting_after } = params;
+    const query = {
+      [kind]: value,
+      plan,
+      limit,
+      starting_after
+    };
+    const page = serverSubscriptionListFrom(
+      await this.#transport.get("/v1/subscriptions", query, options)
+    );
+    for (const subscription of page.data) await this.#seen(subscription);
+    return page;
+  }
+  /**
+   * Every subscription `list` would answer, page after page, for `for await`.
+   * Each page is one call, made when the previous one is used up.
+   */
+  async *listAll(params, options = {}) {
+    let page = await this.list(params, options);
+    yield* page.data;
+    while (page.has_more && page.data.length > 0) {
+      page = await this.list({ ...params, starting_after: page.data.at(-1).id }, options);
+      yield* page.data;
+    }
+  }
+  /**
+   * That subscription's own pull attempts, newest first, one page at a
+   * time, and `paid`: what it paid since it began, whatever the page.
+   * `allAttempts` walks every page.
+   *
+   * The id asked and no other: a subscription the wallet came back over
+   * (`superseded`) keeps its own payments, and the one that replaced it
+   * starts from its first pull. Needs a Mesub that serves the route
+   * (Mesub-io/backend#289): from an older one it throws a `not_found`
+   * whose `apiCode` is null, where an id it does not hold is a `not_found`
+   * whose `apiCode` is `subscription_not_found`.
+   */
+  async attempts(id, params = {}, options = {}) {
+    const { limit, starting_after } = params;
+    const path = `${pathOf(id)}/attempts`;
+    try {
+      return subscriptionAttemptListFrom(
+        await this.#transport.get(path, { limit, starting_after }, options)
+      );
+    } catch (error) {
+      if (!(error instanceof MesubError) || !routeMissing(error)) throw error;
+      throw new MesubError(
+        "This Mesub does not serve GET /v1/subscriptions/:id/attempts yet.",
+        {
+          status: 404,
+          code: "not_found",
+          body: error.body,
+          requestId: error.requestId,
+          cause: error
+        }
+      );
+    }
+  }
+  /**
+   * Every attempt `attempts` would answer, page after page, for `for await`.
+   * Each page is one call, made when the previous one is used up.
+   */
+  async *allAttempts(id, params = {}, options = {}) {
+    let page = await this.attempts(id, params, options);
+    yield* page.data;
+    while (page.has_more && page.data.length > 0) {
+      page = await this.attempts(
+        id,
+        { ...params, starting_after: page.data.at(-1).id },
+        options
+      );
+      yield* page.data;
+    }
+  }
+};
+var ID = /^[A-Za-z0-9_-]{1,64}$/;
+function pathOf(id) {
+  if (typeof id !== "string" || id === "") {
+    throw new MesubError("A subscription id is required.", {
+      status: null,
+      code: "invalid_request"
+    });
+  }
+  if (!ID.test(id)) {
+    throw new MesubError(
+      "A subscription id is letters, digits, hyphens and underscores, 64 at most.",
+      { status: null, code: "invalid_request" }
+    );
+  }
+  return `/v1/subscriptions/${id}`;
+}
+function routeMissing(error) {
+  const { message } = _nullishCoalesce(error.body, () => ( {}));
+  return error.status === 404 && error.apiCode === null && typeof message === "string" && message.startsWith("Cannot GET /");
+}
+function unanswered(error) {
+  if (error.status === 503 && error.apiCode === "unavailable") return false;
+  return error.status === null || error.status >= 500;
+}
+
+// src/events.ts
+var Events = class {
+  #transport;
+  /** @internal */
+  constructor(transport) {
+    this.#transport = transport;
+  }
+  /**
+   * Your project's events of the last 30 days, newest first, one page at a
+   * time: each the very body its webhooks carried, the same `id`, `data`
+   * and `detail`. Read it to catch up on what an endpoint missed while it
+   * was down or turned off. Events before `available_since` are never
+   * served, whatever the window.
+   *
+   * An event is listed a moment after its `created_at`, so one can appear
+   * below one already read: when polling for what is new, page on until
+   * `created_at` is a minute older than the newest you held, and skip the
+   * ids you have seen.
+   *
+   * Needs a Mesub that serves the route (Mesub-io/backend#482): from an
+   * older one it throws a `not_found` whose `apiCode` is null.
+   */
+  async list(params = {}, options = {}) {
+    const { type, subscription, limit, starting_after } = params;
+    return eventListFrom(
+      await this.#get("/v1/events", { type, subscription, limit, starting_after }, options)
+    );
+  }
+  /**
+   * One event, by the `id` its webhook body carries, as `list` serves it.
+   * A `not_found` whose `apiCode` is `event_not_found` for an id older than
+   * 30 days or than `available_since`, or of another project. A delivery's
+   * `webhook-id` is not an event id: read `event.id`, not `delivery_id`.
+   */
+  async retrieve(id, options = {}) {
+    return eventFrom(await this.#get(pathOf2(id), {}, options));
+  }
+  async #get(path, query, options) {
+    try {
+      return await this.#transport.get(path, query, options);
+    } catch (error) {
+      if (!(error instanceof MesubError) || !routeMissing(error)) throw error;
+      throw new MesubError("This Mesub does not serve GET /v1/events yet.", {
+        status: 404,
+        code: "not_found",
+        body: error.body,
+        requestId: error.requestId,
+        cause: error
+      });
+    }
+  }
+};
+var ID2 = /^[A-Za-z0-9_-]{1,64}$/;
+function pathOf2(id) {
+  if (typeof id !== "string" || !ID2.test(id)) {
+    throw new MesubError(
+      "An event id is letters, digits, hyphens and underscores, 64 at most.",
+      { status: null, code: "invalid_request" }
+    );
+  }
+  return `/v1/events/${id}`;
+}
+
+// src/plans.ts
+var Plans = class {
+  #transport;
+  /** @internal */
+  constructor(transport) {
+    this.#transport = transport;
+  }
+  /**
+   * Every plan of your project a subscriber can hold, sorted by slug: the
+   * active ones, and the ones ending (`sunset`, `available: false`). Never
+   * cached: call it where you render, and cache it your way.
+   */
+  async list(options = {}) {
+    return planListFrom(await this.#transport.get("/v1/plans", {}, options));
+  }
+  /** One plan by its slug. A slug your project lacks throws `plan_not_found`. */
+  async retrieve(slug, options = {}) {
+    return planFrom(await this.#transport.get(pathOf3(slug), {}, options));
+  }
+};
+var SLUG = /^(?=.*[a-z])[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathOf3(slug) {
+  if (typeof slug !== "string" || !SLUG.test(slug)) {
+    throw new MesubError(
+      "A plan slug is lowercase letters, digits and hyphens, with at least one letter.",
+      { status: null, code: "invalid_request" }
+    );
+  }
+  return `/v1/plans/${slug}`;
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.mesub.io";
+var DEFAULT_GUARD_TIMEOUT = 2e3;
+var Mesub = (_class3 = class {
+  /** Subscribing from your server: create, submit, retrieve and list. */
+  
+  /** The plans of your project, for a pricing page: `list` and `retrieve`. */
+  
+  /** Checking the webhooks Mesub sends: `verify`. */
+  
+  /** The events of the last 30 days, as their webhooks carried them: `list` and `retrieve`. */
+  
+  /** @internal */
+  
+  /** @internal */
+  
+  /** The lists of `accessList`, in the same store, under their own keys. */
+  
+  /** What the cache keys are scoped by: a hash of the API key, computed once. */
+  
+  /** What hashes emails and external ids in the cache keys: the API key, imported once. */
+  
+  
+  /**
+   * The `/v1/access` requests in flight, by cache key: a call for the same
+   * answer waits for that one rather than send its own (#34).
+   */
+  __init3() {this.flights = /* @__PURE__ */ new Map()}
+  constructor(options = {}) {;_class3.prototype.__init3.call(this);
+    const apiKey = apiKeyOf(options.apiKey);
+    const baseUrl = baseUrlOf(options.baseUrl, DEFAULT_BASE_URL);
+    const headers = headersOf(options.headers);
+    const webhookSecret = webhookSecretOf(options.webhookSecret);
+    if (options.fetch !== void 0 && typeof options.fetch !== "function") {
+      throw new TypeError("fetch must be a function.");
+    }
+    const fetch = _nullishCoalesce(options.fetch, () => ( ((input, init) => globalThis.fetch(input, init))));
+    this.guardTimeout = numberOf("guardTimeout", options.guardTimeout, DEFAULT_GUARD_TIMEOUT, {
+      delay: true
+    });
+    this.transport = new Transport({
+      apiKey,
+      baseUrl,
+      headers,
+      fetch,
+      timeout: numberOf("timeout", options.timeout, 5e3, { delay: true }),
+      maxRetries: numberOf("maxRetries", options.maxRetries, 2, {
+        zero: true,
+        integer: true
+      })
+    });
+    this.subscriptions = new Subscriptions(
+      this.transport,
+      (subscription) => this.landed(subscription),
+      (subscription) => this.landed(subscription, true)
+    );
+    this.plans = new Plans(this.transport);
+    this.events = new Events(this.transport);
+    this.webhooks = new Webhooks(webhookSecret, (event) => this.landed(event.data, true));
+    const store = _nullishCoalesce(options.cache, () => ( new MemoryStore()));
+    const staleness = options.maxStaleMs === void 0 ? {} : { maxStaleMs: numberOf("maxStaleMs", options.maxStaleMs, 0, { zero: true }) };
+    this.cache = new AccessCache(store, staleness);
+    this.lists = new AccessCache(store, staleness);
+    let cacheScope;
+    this.cacheScope = () => cacheScope ??= hashScope(apiKey);
+    let cacheSecret;
+    this.cacheSecret = () => cacheSecret ??= importSecret(apiKey);
+  }
+  /**
+   * Everything Mesub knows about that customer on that plan: whether they
+   * have access, their status, their dates. Served from the cache while fresh.
+   *
+   * The customer is `{ wallet }`, `{ external_id }` or `{ email }`, or a
+   * wallet as a string. Asked by external id or email, the answer is about
+   * the wallet that grants access, if any: `wallet` is null when they have
+   * nothing on that plan.
+   *
+   * Throws a `MesubError` whenever Mesub cannot answer: it is for screens.
+   * A guard calls `hasAccess`, which falls back instead.
+   */
+  async access(customer, plan, options = {}) {
+    const asked = customerOf(customer);
+    const slug = planOf(plan);
+    if (options.attempts === true) return this.ask(asked, slug, null, boundOf(options));
+    const slot = await this.slotOf(asked);
+    const cached = await this.cache.read(slot.who, slug, slot.scope);
+    if (_optionalChain([cached, 'optionalAccess', _22 => _22.fresh])) return cached.value;
+    return this.ask(asked, slug, slot);
+  }
+  /**
+   * Every plan of the project that customer has anything on, each answered
+   * like `access`, for a page listing their entitlements in one call. Cached
+   * apart from the answers by plan, for its own `revalidate_after`.
+   *
+   * Throws a `MesubError` whenever Mesub cannot answer, like `access`.
+   */
+  async accessList(customer, options = {}) {
+    const asked = customerOf(customer);
+    const attempts = options.attempts === true;
+    const slot = attempts ? null : await this.slotOf(asked);
+    if (slot) {
+      const cached = await this.lists.read(slot.who, null, slot.scope);
+      if (_optionalChain([cached, 'optionalAccess', _23 => _23.fresh])) return cached.value;
+    }
+    const request = async () => accessListFrom(
+      await this.transport.get("/v1/access", {
+        [asked.kind]: asked.value,
+        attempts: attempts || void 0
+      })
+    );
+    if (!slot) return request();
+    return this.shared(
+      flightKey("call", slot, null),
+      request,
+      (list) => this.lists.write(slot.who, null, list, slot.scope)
+    );
+  }
+  /**
+   * `access` from Mesub, cached in the slot its caller computed once and
+   * already read, or without the cache at all (`null`) for an answer with
+   * its attempts.
+   */
+  async ask(asked, plan, slot, call = {}) {
+    const attempts = slot === null;
+    const request = async () => accessAnswerFrom(
+      await this.transport.get(
+        "/v1/access",
+        {
+          [asked.kind]: asked.value,
+          plan,
+          // Left out when not asked: the transport drops undefined values.
+          attempts: attempts || void 0
+        },
+        call
+      )
+    );
+    if (!slot) return request();
+    const mode = call.deadline === void 0 ? "call" : "guard";
+    return this.shared(
+      flightKey(mode, slot, plan),
+      request,
+      (answer) => this.cache.write(slot.who, plan, answer, slot.scope)
+    );
+  }
+  /**
+   * One request in flight per key (#34): fifty calls for a customer not in
+   * the cache made fifty requests to Mesub, and as many 429s to retry. The
+   * first sends it, the others wait for its answer or its error. Its answer
+   * is cached once, unless a subscription that landed dropped the flight
+   * meanwhile: then it is answered, not cached.
+   */
+  shared(key, request, keep) {
+    const pending = this.flights.get(key);
+    if (pending) return pending;
+    const flight = request().then((value) => {
+      if (this.flights.get(key) === flight) void keep(value);
+      return value;
+    });
+    const land = () => {
+      if (this.flights.get(key) === flight) this.flights.delete(key);
+    };
+    this.flights.set(key, flight);
+    void flight.then(land, land);
+    return flight;
+  }
+  /**
+   * Where a customer's answers are cached: the project's scope, and who
+   * they are as the key reads it. A wallet is public on chain and stays
+   * readable; an email or an external id is never written in clear, only
+   * as an HMAC under the API key, which a leaked Redis alone cannot reverse
+   * by guessing.
+   */
+  async slotOf(asked) {
+    const scope = await this.cacheScope();
+    if (asked.kind === "wallet") return { scope, who: `wallet:${asked.value}` };
+    const mac = await crypto.subtle.sign(
+      "HMAC",
+      await this.cacheSecret(),
+      new TextEncoder().encode(`${asked.kind}:${asked.value}`)
+    );
+    return { scope, who: `${asked.kind}:${hex(mac)}` };
+  }
+  /**
+   * A subscription `submit`, `retrieve` or `list` answered (#33): once it
+   * grants access (`active`, or `cancelled` before its end), the answers
+   * cached for its customer that say no are dropped, by wallet, external
+   * id and email, for its plan and in the list of every plan. Without it, a
+   * `hasAccess` right after a submit kept answering the cached no until
+   * `revalidate_after` ran out. A store that fails costs nothing more than
+   * that: it never throws.
+   *
+   * With `moved`, one a confirm just cancelled, resumed or closed, or one a
+   * verified webhook carried: every answer cached for its customer is
+   * dropped, the yes too, since its status and dates changed whatever its
+   * access. A `stopped` or `ended` event must not leave a yes behind.
+   */
+  async landed(subscription, moved = false) {
+    const { plan } = subscription;
+    if (!moved && !subscription.access) return;
+    try {
+      for (const asked of customersOf(subscription)) {
+        const slot = await this.slotOf(asked);
+        for (const mode of ["call", "guard"]) {
+          if (plan !== null) this.flights.delete(flightKey(mode, slot, plan));
+          this.flights.delete(flightKey(mode, slot, null));
+        }
+        if (plan !== null) {
+          await this.cache.forget(
+            slot.who,
+            plan,
+            slot.scope,
+            (answer) => moved || !answer.access
+          );
+        }
+        await this.lists.forget(
+          slot.who,
+          null,
+          slot.scope,
+          (list) => moved || !list.plans.some((answer) => answer.plan === plan && answer.access)
+        );
+      }
+    } catch (e8) {
+    }
+  }
+  /**
+   * Whether that customer has access to that plan, for a guard. The
+   * customer is the same as for `access`, a wallet string included.
+   *
+   * When Mesub is unavailable after the retries (`unavailable` or
+   * `rate_limited`), it answers the last answer it knew, even stale, and
+   * `false` for a customer it never saw. Any other error is thrown, never
+   * turned into `false`: a bad key or an unknown plan is a broken
+   * integration, not a denial.
+   *
+   * No time budget: it waits out the client's timeout and retries, and a
+   * 429's `Retry-After`. A guard answers within `guardTimeout` instead.
+   */
+  async hasAccess(customer, plan) {
+    return (await this.decideBy(customer, plan)).access;
+  }
+  /**
+   * `hasAccess`, with the answer it decided on, within `guardTimeout`: what
+   * the middlewares hand the route. `answer` is null only for a customer
+   * never seen during an outage, which is then `unavailable`; `stale` is
+   * true when the answer came from the fallback.
+   *
+   * @internal
+   */
+  async decide(customer, plan) {
+    return this.decideBy(customer, plan, Date.now() + this.guardTimeout);
+  }
+  /**
+   * The decision itself. With a deadline (the guards), every call to Mesub
+   * fits before it: attempts are cut at it and a Retry-After that would
+   * outlast it is not waited. Without one (`hasAccess` called directly),
+   * the client's timeout and retries, as configured.
+   */
+  async decideBy(customer, plan, deadline) {
+    const call = deadline === void 0 ? {} : { deadline, retryRateLimited: false };
+    const asked = customerOf(customer);
+    const slug = planOf(plan);
+    const slot = await this.slotOf(asked);
+    const cached = await this.cache.read(slot.who, slug, slot.scope, deadline);
+    if (_optionalChain([cached, 'optionalAccess', _24 => _24.fresh])) {
+      return { access: cached.value.access, answer: cached.value, stale: false };
+    }
+    try {
+      const answer = await this.ask(asked, slug, slot, call);
+      return { access: answer.access, answer, stale: false };
+    } catch (error) {
+      const unreachable = error instanceof MesubError && (error.code === "unavailable" || error.code === "rate_limited");
+      if (!unreachable) throw error;
+      if (cached) {
+        return { access: stillGrants(cached.value), answer: cached.value, stale: true };
+      }
+      return {
+        access: false,
+        answer: null,
+        stale: true,
+        unavailable: true,
+        ...error.retryAfter !== null && { retryAfter: error.retryAfter }
+      };
+    }
+  }
+}, _class3);
+function boundOf(options) {
+  const { deadline, retryRateLimited } = options;
+  return {
+    ...deadline !== void 0 && { deadline },
+    ...retryRateLimited !== void 0 && { retryRateLimited }
+  };
+}
+function flightKey(mode, slot, plan) {
+  return `${mode}|${AccessCache.key(slot.who, plan, slot.scope)}`;
+}
+function customersOf(subscription) {
+  const { wallet, external_id, email } = subscription;
+  const customers = [{ wallet }];
+  if (external_id) customers.push({ external_id });
+  if (email) customers.push({ email });
+  return customers.map(customerOf);
+}
+function planOf(plan) {
+  if (typeof plan !== "string" || plan === "") {
+    throw new TypeError("A plan is needed: accessList(customer) lists every plan instead.");
+  }
+  return plan;
+}
+async function hashScope(apiKey) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(apiKey));
+  return `key-${hex(digest).slice(0, 16)}`;
+}
+function importSecret(apiKey) {
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(apiKey),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+}
+function hex(bytes) {
+  return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function stillGrants(answer, now = Date.now()) {
+  if (!answer.access || !answer.access_until) return answer.access;
+  const renewing = Boolean(answer.next_charge_at || answer.next_retry_at);
+  if (renewing && !answer.blocked_since) return true;
+  return Date.parse(answer.access_until) > now;
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_MAX_STALE_MS = DEFAULT_MAX_STALE_MS; exports.AccessCache = AccessCache; exports.VERSION = VERSION; exports.API_VERSION = API_VERSION; exports.API_VERSION_HEADER = API_VERSION_HEADER; exports.DEFAULT_MAX_ENTRIES = DEFAULT_MAX_ENTRIES; exports.MemoryStore = MemoryStore; exports.customerOf = customerOf; exports.MesubError = MesubError; exports.MesubSubmitError = MesubSubmitError; exports.verifyWebhook = verifyWebhook; exports.signedHeaders = signedHeaders; exports.Mesub = Mesub;
+//# sourceMappingURL=chunk-SGSYQJYT.cjs.map