@mesub/node 0.1.0 → 0.1.3

package/README.md

@@ -11,9 +11,12 @@ have the wallet sign.
 **[Read the docs](https://docs.mesub.io)** for the walkthroughs. This page is
 the short version and the reference of the options.
 
-> **Status: early, 0.x, not on npm yet.** The API may still change between
-> minor versions. See the [board](https://github.com/orgs/Mesub-io/projects/4)
-> for what is next.
+[![npm](https://img.shields.io/npm/v/@mesub/node)](https://www.npmjs.com/package/@mesub/node)
+
+> **Status: early, 0.x.** The API may still change between minor versions:
+> `npm update` takes patches (0.1.x), a new minor (0.2.0) takes
+> `npm install @mesub/node@latest`. See the
+> [board](https://github.com/orgs/Mesub-io/projects/4) for what is next.
 
 ## Install
 
@@ -21,7 +24,9 @@ the short version and the reference of the options.
 npm install @mesub/node
 ```
 
-Node 22 or later. No runtime dependency.
+Node 22 or later. No runtime dependency. Every release is built by GitHub
+Actions from a tagged commit and published with a provenance statement:
+`npm audit signatures` verifies it.
 
 ## How it fits
 
@@ -679,7 +684,7 @@ Guards, webhooks, subscribing and managing against it:
 ```ts
 new Mesub({
     apiKey, // default: process.env.MESUB_API_KEY
-    baseUrl, // default: https://api.mesub.io, may carry a path
+    baseUrl, // default: process.env.MESUB_BASE_URL, then https://api.mesub.io; may carry a path
     headers, // extra headers on every call, e.g. for a proxy
     timeout, // per attempt, ms, default 5000
     maxRetries, // default 2

package/dist/{chunk-ELK7IBLO.js → chunk-35MOUS4W.js}

@@ -1,7 +1,7 @@
 import {
   MesubError,
   customerOf
-} from "./chunk-KMPBFNJE.js";
+} from "./chunk-JCDJZDEJ.js";
 
 // src/routes.ts
 var MAX_BODY_BYTES = 64 * 1024;
@@ -337,4 +337,4 @@ export {
   widgetCustomer,
   checkWidgetOptions
 };
-//# sourceMappingURL=chunk-ELK7IBLO.js.map
+//# sourceMappingURL=chunk-35MOUS4W.js.map

package/dist/{chunk-XDLLXY7Y.js → chunk-6HGYY2KN.js}

@@ -1,7 +1,7 @@
 import {
   Mesub,
   customerOf
-} from "./chunk-KMPBFNJE.js";
+} from "./chunk-JCDJZDEJ.js";
 
 // src/guard.ts
 var DENIAL_STATUS = {
@@ -117,4 +117,4 @@ export {
   accessOf,
   denialOf
 };
-//# sourceMappingURL=chunk-XDLLXY7Y.js.map
+//# sourceMappingURL=chunk-6HGYY2KN.js.map

package/dist/{chunk-SGSYQJYT.cjs → chunk-BP5D5I66.cjs}

@@ -86,7 +86,7 @@ var AccessCache = class _AccessCache {
 };
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.3";
 var API_VERSION = "2026-10-02";
 var API_VERSION_HEADER = "Mesub-Version";
 
@@ -109,23 +109,30 @@ function envKey() {
   return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _ => _.env, 'optionalAccess', _2 => _2["MESUB_API_KEY"]]);
 }
 function baseUrlOf(given, fallback) {
-  if (given === void 0) return fallback;
-  if (typeof given !== "string") throw new TypeError("baseUrl must be a string.");
+  if (given !== void 0) return checkedBaseUrl("baseUrl", given);
+  const fromEnv = envBaseUrl();
+  return fromEnv ? checkedBaseUrl("MESUB_BASE_URL", fromEnv) : fallback;
+}
+function envBaseUrl() {
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _3 => _3.env, 'optionalAccess', _4 => _4["MESUB_BASE_URL"]]);
+}
+function checkedBaseUrl(name, given) {
+  if (typeof given !== "string") throw new TypeError(`${name} must be a string.`);
   let url;
   try {
     url = new URL(given);
   } catch (e4) {
-    throw new TypeError(`baseUrl must be an absolute URL, not ${JSON.stringify(given)}.`);
+    throw new TypeError(`${name} must be an absolute URL, not ${JSON.stringify(given)}.`);
   }
   if (url.search !== "" || url.hash !== "" || given.includes("?") || given.includes("#")) {
     throw new TypeError(
-      `baseUrl must have no query nor fragment, not ${JSON.stringify(given)}.`
+      `${name} must have no query nor fragment, not ${JSON.stringify(given)}.`
     );
   }
   const local = url.protocol === "http:" && LOOPBACK.has(url.hostname);
   if (url.protocol !== "https:" && !local) {
     throw new TypeError(
-      `baseUrl must be https (http only to localhost or 127.0.0.1), not ${url.protocol}//${url.host}: every call carries the API key.`
+      `${name} must be https (http only to localhost or 127.0.0.1), not ${url.protocol}//${url.host}: every call carries the API key.`
     );
   }
   return given.replace(/\/+$/, "");
@@ -218,7 +225,7 @@ var CUSTOMER_KINDS = ["wallet", "external_id", "email"];
 function customerOf(customer) {
   if (typeof customer === "string") return { kind: "wallet", value: customer };
   const named = CUSTOMER_KINDS.filter(
-    (kind2) => _optionalChain([customer, 'optionalAccess', _3 => _3[kind2]]) !== void 0
+    (kind2) => _optionalChain([customer, 'optionalAccess', _5 => _5[kind2]]) !== void 0
   );
   const kind = named[0];
   const value = kind && customer[kind];
@@ -343,6 +350,7 @@ var CLOSABLE = { ...BOOLEAN, absent: false };
 var CLOSABLE_FROM = { ...DATE_OR_NULL, absent: null };
 var TRANSACTION_EXPIRES_AT = { ...DATE_OR_NULL, absent: null };
 var AMOUNT_USD = { ...STRING_OR_NULL, absent: null };
+var AMOUNT_RECEIVED = { ...STRING_OR_NULL, absent: null };
 var TOKEN = {
   ...OBJECT,
   absent: () => ({ symbol: null, name: null, logo_url: null, verified: false })
@@ -453,6 +461,7 @@ var SUBSCRIPTION_ATTEMPT = {
   reason: STRING_OR_NULL,
   amount: STRING,
   amount_usd: AMOUNT_USD,
+  amount_received: AMOUNT_RECEIVED,
   signature: STRING_OR_NULL,
   retry: BOOLEAN,
   retry_number: RETRY_COUNT,
@@ -880,7 +889,7 @@ function webhookSecretOf(given) {
   return secret || void 0;
 }
 function envSecret() {
-  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _4 => _4.env, 'optionalAccess', _5 => _5["MESUB_WEBHOOK_SECRET"]]);
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _6 => _6.env, 'optionalAccess', _7 => _7["MESUB_WEBHOOK_SECRET"]]);
 }
 function headerIn(headers, name) {
   if (typeof headers.get === "function") {
@@ -982,7 +991,7 @@ var Transport = class {
     }
   }
   async #attempt(method, url, body, { deadline, signal, ...options }) {
-    _optionalChain([signal, 'optionalAccess', _6 => _6.throwIfAborted, 'call', _7 => _7()]);
+    _optionalChain([signal, 'optionalAccess', _8 => _8.throwIfAborted, 'call', _9 => _9()]);
     const perAttempt = _nullishCoalesce(options.timeout, () => ( this.#config.timeout));
     const left = deadline === void 0 ? Infinity : deadline - Date.now();
     if (left <= 0) {
@@ -996,8 +1005,8 @@ var Transport = class {
     const cutByDeadline = timeout < perAttempt;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
-    const stop = () => controller.abort(_optionalChain([signal, 'optionalAccess', _8 => _8.reason]));
-    _optionalChain([signal, 'optionalAccess', _9 => _9.addEventListener, 'call', _10 => _10("abort", stop, { once: true })]);
+    const stop = () => controller.abort(_optionalChain([signal, 'optionalAccess', _10 => _10.reason]));
+    _optionalChain([signal, 'optionalAccess', _11 => _11.addEventListener, 'call', _12 => _12("abort", stop, { once: true })]);
     try {
       const response = await this.#config.fetch(url, {
         method,
@@ -1049,7 +1058,7 @@ var Transport = class {
         retryAfter: asked === null ? null : Math.min(asked, MAX_RETRY_AFTER)
       };
     } catch (cause) {
-      if (_optionalChain([signal, 'optionalAccess', _11 => _11.aborted])) throw signal.reason;
+      if (_optionalChain([signal, 'optionalAccess', _13 => _13.aborted])) throw signal.reason;
       if (controller.signal.aborted && cutByDeadline) {
         const error2 = new MesubError(
           `Mesub did not answer within the ${Math.round(timeout)} ms left before the deadline.`,
@@ -1062,7 +1071,7 @@ var Transport = class {
       return { ok: false, error, retry: true, retryAfter: null };
     } finally {
       clearTimeout(timer);
-      _optionalChain([signal, 'optionalAccess', _12 => _12.removeEventListener, 'call', _13 => _13("abort", stop)]);
+      _optionalChain([signal, 'optionalAccess', _14 => _14.removeEventListener, 'call', _15 => _15("abort", stop)]);
     }
   }
 };
@@ -1130,13 +1139,13 @@ function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     const stop = () => {
       clearTimeout(timer);
-      reject(_optionalChain([signal, 'optionalAccess', _14 => _14.reason]));
+      reject(_optionalChain([signal, 'optionalAccess', _16 => _16.reason]));
     };
     const timer = setTimeout(() => {
-      _optionalChain([signal, 'optionalAccess', _15 => _15.removeEventListener, 'call', _16 => _16("abort", stop)]);
+      _optionalChain([signal, 'optionalAccess', _17 => _17.removeEventListener, 'call', _18 => _18("abort", stop)]);
       resolve();
     }, ms);
-    _optionalChain([signal, 'optionalAccess', _17 => _17.addEventListener, 'call', _18 => _18("abort", stop, { once: true })]);
+    _optionalChain([signal, 'optionalAccess', _19 => _19.addEventListener, 'call', _20 => _20("abort", stop, { once: true })]);
   });
 }
 
@@ -1325,7 +1334,7 @@ var Subscriptions = class {
    */
   async #settle(id, signal, { sends, cause, from, code, retryable, lead }) {
     const subscription = await this.#readBack(id, signal);
-    if (_optionalChain([subscription, 'optionalAccess', _19 => _19.status]) === "active" || _optionalChain([subscription, 'optionalAccess', _20 => _20.status]) === "cancelled") {
+    if (_optionalChain([subscription, 'optionalAccess', _21 => _21.status]) === "active" || _optionalChain([subscription, 'optionalAccess', _22 => _22.status]) === "cancelled") {
       return { subscription };
     }
     const then = subscription === null ? "Reading the subscription back failed too" : `The subscription read back is ${subscription.status}`;
@@ -1362,7 +1371,7 @@ var Subscriptions = class {
       );
       return serverSubscriptionFrom(body);
     } catch (error) {
-      if (_optionalChain([signal, 'optionalAccess', _21 => _21.aborted])) throw error;
+      if (_optionalChain([signal, 'optionalAccess', _23 => _23.aborted])) throw error;
       return null;
     }
   }
@@ -1775,7 +1784,7 @@ var Mesub = (_class3 = class {
     if (options.attempts === true) return this.ask(asked, slug, null, boundOf(options));
     const slot = await this.slotOf(asked);
     const cached = await this.cache.read(slot.who, slug, slot.scope);
-    if (_optionalChain([cached, 'optionalAccess', _22 => _22.fresh])) return cached.value;
+    if (_optionalChain([cached, 'optionalAccess', _24 => _24.fresh])) return cached.value;
     return this.ask(asked, slug, slot);
   }
   /**
@@ -1791,7 +1800,7 @@ var Mesub = (_class3 = class {
     const slot = attempts ? null : await this.slotOf(asked);
     if (slot) {
       const cached = await this.lists.read(slot.who, null, slot.scope);
-      if (_optionalChain([cached, 'optionalAccess', _23 => _23.fresh])) return cached.value;
+      if (_optionalChain([cached, 'optionalAccess', _25 => _25.fresh])) return cached.value;
     }
     const request = async () => accessListFrom(
       await this.transport.get("/v1/access", {
@@ -1952,7 +1961,7 @@ var Mesub = (_class3 = class {
     const slug = planOf(plan);
     const slot = await this.slotOf(asked);
     const cached = await this.cache.read(slot.who, slug, slot.scope, deadline);
-    if (_optionalChain([cached, 'optionalAccess', _24 => _24.fresh])) {
+    if (_optionalChain([cached, 'optionalAccess', _26 => _26.fresh])) {
       return { access: cached.value.access, answer: cached.value, stale: false };
     }
     try {
@@ -2035,4 +2044,4 @@ function stillGrants(answer, now = Date.now()) {
 
 
 exports.DEFAULT_MAX_STALE_MS = DEFAULT_MAX_STALE_MS; exports.AccessCache = AccessCache; exports.VERSION = VERSION; exports.API_VERSION = API_VERSION; exports.API_VERSION_HEADER = API_VERSION_HEADER; exports.DEFAULT_MAX_ENTRIES = DEFAULT_MAX_ENTRIES; exports.MemoryStore = MemoryStore; exports.customerOf = customerOf; exports.MesubError = MesubError; exports.MesubSubmitError = MesubSubmitError; exports.verifyWebhook = verifyWebhook; exports.signedHeaders = signedHeaders; exports.Mesub = Mesub;
-//# sourceMappingURL=chunk-SGSYQJYT.cjs.map
+//# sourceMappingURL=chunk-BP5D5I66.cjs.map