@mesub/node 0.1.2 → 0.1.4

package/README.md

@@ -684,7 +684,7 @@ Guards, webhooks, subscribing and managing against it:
 ```ts
 new Mesub({
     apiKey, // default: process.env.MESUB_API_KEY
-    baseUrl, // default: https://api.mesub.io, may carry a path
+    baseUrl, // default: process.env.MESUB_BASE_URL, then https://api.mesub.io; may carry a path
     headers, // extra headers on every call, e.g. for a proxy
     timeout, // per attempt, ms, default 5000
     maxRetries, // default 2

package/dist/{chunk-4AAPR37Y.js → chunk-EPOLIEGY.js}

@@ -1,7 +1,7 @@
 import {
   Mesub,
   customerOf
-} from "./chunk-NOS4FWWQ.js";
+} from "./chunk-IG4QRQSJ.js";
 
 // src/guard.ts
 var DENIAL_STATUS = {
@@ -117,4 +117,4 @@ export {
   accessOf,
   denialOf
 };
-//# sourceMappingURL=chunk-4AAPR37Y.js.map
+//# sourceMappingURL=chunk-EPOLIEGY.js.map

package/dist/{chunk-4JSJOX35.cjs → chunk-IAYUXSDD.cjs}

@@ -86,7 +86,7 @@ var AccessCache = class _AccessCache {
 };
 
 // src/version.ts
-var VERSION = "0.1.2";
+var VERSION = "0.1.4";
 var API_VERSION = "2026-10-02";
 var API_VERSION_HEADER = "Mesub-Version";
 
@@ -109,23 +109,30 @@ function envKey() {
   return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _ => _.env, 'optionalAccess', _2 => _2["MESUB_API_KEY"]]);
 }
 function baseUrlOf(given, fallback) {
-  if (given === void 0) return fallback;
-  if (typeof given !== "string") throw new TypeError("baseUrl must be a string.");
+  if (given !== void 0) return checkedBaseUrl("baseUrl", given);
+  const fromEnv = envBaseUrl();
+  return fromEnv ? checkedBaseUrl("MESUB_BASE_URL", fromEnv) : fallback;
+}
+function envBaseUrl() {
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _3 => _3.env, 'optionalAccess', _4 => _4["MESUB_BASE_URL"]]);
+}
+function checkedBaseUrl(name, given) {
+  if (typeof given !== "string") throw new TypeError(`${name} must be a string.`);
   let url;
   try {
     url = new URL(given);
   } catch (e4) {
-    throw new TypeError(`baseUrl must be an absolute URL, not ${JSON.stringify(given)}.`);
+    throw new TypeError(`${name} must be an absolute URL, not ${JSON.stringify(given)}.`);
   }
   if (url.search !== "" || url.hash !== "" || given.includes("?") || given.includes("#")) {
     throw new TypeError(
-      `baseUrl must have no query nor fragment, not ${JSON.stringify(given)}.`
+      `${name} must have no query nor fragment, not ${JSON.stringify(given)}.`
     );
   }
   const local = url.protocol === "http:" && LOOPBACK.has(url.hostname);
   if (url.protocol !== "https:" && !local) {
     throw new TypeError(
-      `baseUrl must be https (http only to localhost or 127.0.0.1), not ${url.protocol}//${url.host}: every call carries the API key.`
+      `${name} must be https (http only to localhost or 127.0.0.1), not ${url.protocol}//${url.host}: every call carries the API key.`
     );
   }
   return given.replace(/\/+$/, "");
@@ -218,7 +225,7 @@ var CUSTOMER_KINDS = ["wallet", "external_id", "email"];
 function customerOf(customer) {
   if (typeof customer === "string") return { kind: "wallet", value: customer };
   const named = CUSTOMER_KINDS.filter(
-    (kind2) => _optionalChain([customer, 'optionalAccess', _3 => _3[kind2]]) !== void 0
+    (kind2) => _optionalChain([customer, 'optionalAccess', _5 => _5[kind2]]) !== void 0
   );
   const kind = named[0];
   const value = kind && customer[kind];
@@ -882,7 +889,7 @@ function webhookSecretOf(given) {
   return secret || void 0;
 }
 function envSecret() {
-  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _4 => _4.env, 'optionalAccess', _5 => _5["MESUB_WEBHOOK_SECRET"]]);
+  return typeof process === "undefined" ? void 0 : _optionalChain([process, 'access', _6 => _6.env, 'optionalAccess', _7 => _7["MESUB_WEBHOOK_SECRET"]]);
 }
 function headerIn(headers, name) {
   if (typeof headers.get === "function") {
@@ -984,7 +991,7 @@ var Transport = class {
     }
   }
   async #attempt(method, url, body, { deadline, signal, ...options }) {
-    _optionalChain([signal, 'optionalAccess', _6 => _6.throwIfAborted, 'call', _7 => _7()]);
+    _optionalChain([signal, 'optionalAccess', _8 => _8.throwIfAborted, 'call', _9 => _9()]);
     const perAttempt = _nullishCoalesce(options.timeout, () => ( this.#config.timeout));
     const left = deadline === void 0 ? Infinity : deadline - Date.now();
     if (left <= 0) {
@@ -998,8 +1005,8 @@ var Transport = class {
     const cutByDeadline = timeout < perAttempt;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
-    const stop = () => controller.abort(_optionalChain([signal, 'optionalAccess', _8 => _8.reason]));
-    _optionalChain([signal, 'optionalAccess', _9 => _9.addEventListener, 'call', _10 => _10("abort", stop, { once: true })]);
+    const stop = () => controller.abort(_optionalChain([signal, 'optionalAccess', _10 => _10.reason]));
+    _optionalChain([signal, 'optionalAccess', _11 => _11.addEventListener, 'call', _12 => _12("abort", stop, { once: true })]);
     try {
       const response = await this.#config.fetch(url, {
         method,
@@ -1012,8 +1019,24 @@ var Transport = class {
           ...body !== void 0 && { "Content-Type": "application/json" }
         },
         ...body !== void 0 && { body: JSON.stringify(body) },
-        signal: controller.signal
+        signal: controller.signal,
+        // Every call carries the key, and Mesub never redirects: a
+        // redirect is never followed, so the key is never sent on (#171).
+        redirect: "manual"
       });
+      if (isRedirect(response)) {
+        await _optionalChain([response, 'access', _13 => _13.body, 'optionalAccess', _14 => _14.cancel, 'call', _15 => _15()]);
+        const to = response.headers.get("location");
+        const error2 = new MesubError(
+          `${url.pathname} answered a redirect${to ? ` to ${to}` : ""}, and Mesub never redirects: is baseUrl (${this.#config.baseUrl}) the Mesub API?`,
+          {
+            status: response.status || null,
+            code: "unexpected",
+            requestId: response.headers.get(REQUEST_ID_HEADER)
+          }
+        );
+        return { ok: false, error: error2, retry: false, retryAfter: null };
+      }
       const text = await response.text();
       const requestId = response.headers.get(REQUEST_ID_HEADER);
       if (response.ok) {
@@ -1051,7 +1074,7 @@ var Transport = class {
         retryAfter: asked === null ? null : Math.min(asked, MAX_RETRY_AFTER)
       };
     } catch (cause) {
-      if (_optionalChain([signal, 'optionalAccess', _11 => _11.aborted])) throw signal.reason;
+      if (_optionalChain([signal, 'optionalAccess', _16 => _16.aborted])) throw signal.reason;
       if (controller.signal.aborted && cutByDeadline) {
         const error2 = new MesubError(
           `Mesub did not answer within the ${Math.round(timeout)} ms left before the deadline.`,
@@ -1064,10 +1087,13 @@ var Transport = class {
       return { ok: false, error, retry: true, retryAfter: null };
     } finally {
       clearTimeout(timer);
-      _optionalChain([signal, 'optionalAccess', _12 => _12.removeEventListener, 'call', _13 => _13("abort", stop)]);
+      _optionalChain([signal, 'optionalAccess', _17 => _17.removeEventListener, 'call', _18 => _18("abort", stop)]);
     }
   }
 };
+function isRedirect(response) {
+  return response.type === "opaqueredirect" || response.status >= 300 && response.status < 400;
+}
 function endpoint(baseUrl, path) {
   return new URL(baseUrl + path);
 }
@@ -1132,13 +1158,13 @@ function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     const stop = () => {
       clearTimeout(timer);
-      reject(_optionalChain([signal, 'optionalAccess', _14 => _14.reason]));
+      reject(_optionalChain([signal, 'optionalAccess', _19 => _19.reason]));
     };
     const timer = setTimeout(() => {
-      _optionalChain([signal, 'optionalAccess', _15 => _15.removeEventListener, 'call', _16 => _16("abort", stop)]);
+      _optionalChain([signal, 'optionalAccess', _20 => _20.removeEventListener, 'call', _21 => _21("abort", stop)]);
       resolve();
     }, ms);
-    _optionalChain([signal, 'optionalAccess', _17 => _17.addEventListener, 'call', _18 => _18("abort", stop, { once: true })]);
+    _optionalChain([signal, 'optionalAccess', _22 => _22.addEventListener, 'call', _23 => _23("abort", stop, { once: true })]);
   });
 }
 
@@ -1327,7 +1353,7 @@ var Subscriptions = class {
    */
   async #settle(id, signal, { sends, cause, from, code, retryable, lead }) {
     const subscription = await this.#readBack(id, signal);
-    if (_optionalChain([subscription, 'optionalAccess', _19 => _19.status]) === "active" || _optionalChain([subscription, 'optionalAccess', _20 => _20.status]) === "cancelled") {
+    if (_optionalChain([subscription, 'optionalAccess', _24 => _24.status]) === "active" || _optionalChain([subscription, 'optionalAccess', _25 => _25.status]) === "cancelled") {
       return { subscription };
     }
     const then = subscription === null ? "Reading the subscription back failed too" : `The subscription read back is ${subscription.status}`;
@@ -1364,7 +1390,7 @@ var Subscriptions = class {
       );
       return serverSubscriptionFrom(body);
     } catch (error) {
-      if (_optionalChain([signal, 'optionalAccess', _21 => _21.aborted])) throw error;
+      if (_optionalChain([signal, 'optionalAccess', _26 => _26.aborted])) throw error;
       return null;
     }
   }
@@ -1777,7 +1803,7 @@ var Mesub = (_class3 = class {
     if (options.attempts === true) return this.ask(asked, slug, null, boundOf(options));
     const slot = await this.slotOf(asked);
     const cached = await this.cache.read(slot.who, slug, slot.scope);
-    if (_optionalChain([cached, 'optionalAccess', _22 => _22.fresh])) return cached.value;
+    if (_optionalChain([cached, 'optionalAccess', _27 => _27.fresh])) return cached.value;
     return this.ask(asked, slug, slot);
   }
   /**
@@ -1793,7 +1819,7 @@ var Mesub = (_class3 = class {
     const slot = attempts ? null : await this.slotOf(asked);
     if (slot) {
       const cached = await this.lists.read(slot.who, null, slot.scope);
-      if (_optionalChain([cached, 'optionalAccess', _23 => _23.fresh])) return cached.value;
+      if (_optionalChain([cached, 'optionalAccess', _28 => _28.fresh])) return cached.value;
     }
     const request = async () => accessListFrom(
       await this.transport.get("/v1/access", {
@@ -1954,7 +1980,7 @@ var Mesub = (_class3 = class {
     const slug = planOf(plan);
     const slot = await this.slotOf(asked);
     const cached = await this.cache.read(slot.who, slug, slot.scope, deadline);
-    if (_optionalChain([cached, 'optionalAccess', _24 => _24.fresh])) {
+    if (_optionalChain([cached, 'optionalAccess', _29 => _29.fresh])) {
       return { access: cached.value.access, answer: cached.value, stale: false };
     }
     try {
@@ -2037,4 +2063,4 @@ function stillGrants(answer, now = Date.now()) {
 
 
 exports.DEFAULT_MAX_STALE_MS = DEFAULT_MAX_STALE_MS; exports.AccessCache = AccessCache; exports.VERSION = VERSION; exports.API_VERSION = API_VERSION; exports.API_VERSION_HEADER = API_VERSION_HEADER; exports.DEFAULT_MAX_ENTRIES = DEFAULT_MAX_ENTRIES; exports.MemoryStore = MemoryStore; exports.customerOf = customerOf; exports.MesubError = MesubError; exports.MesubSubmitError = MesubSubmitError; exports.verifyWebhook = verifyWebhook; exports.signedHeaders = signedHeaders; exports.Mesub = Mesub;
-//# sourceMappingURL=chunk-4JSJOX35.cjs.map
+//# sourceMappingURL=chunk-IAYUXSDD.cjs.map