@relume_io/partner-node 0.0.0-stage → 2.0.0

package/dist/index.cjs

@@ -0,0 +1,1275 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_API_BASE_URL: () => DEFAULT_API_BASE_URL,
+  EMBED_HEADER: () => EMBED_HEADER,
+  EMBED_HEADER_VALUE: () => EMBED_HEADER_VALUE,
+  InvalidCallbackResultError: () => InvalidCallbackResultError,
+  MAX_SIGNATURES: () => MAX_SIGNATURES,
+  PagedList: () => PagedList,
+  REQUEST_ID_HEADER: () => REQUEST_ID_HEADER,
+  Relume: () => Relume,
+  RelumeError: () => RelumeError,
+  SIGNATURE_HEADER: () => SIGNATURE_HEADER,
+  SIGNATURE_TOLERANCE_SECONDS: () => SIGNATURE_TOLERANCE_SECONDS,
+  computeSignature: () => computeSignature,
+  parseSignatureHeader: () => parseSignatureHeader,
+  signCall: () => signCall,
+  verifySignature: () => verifySignature
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/response.ts
+var MAX_BODY_BYTES = 1024 * 1024;
+var JSON_HEADERS = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Cache-Control": "no-store"
+};
+function jsonResponse(status, body, headers = {}) {
+  return { status, headers: { ...JSON_HEADERS, ...headers }, body };
+}
+function errorResponse(status, code, message, headers) {
+  return jsonResponse(status, { error: { code, message } }, headers);
+}
+var METHOD_FOR = { session: "GET", calls: "POST" };
+function routeOf(pathname) {
+  const last = pathname.replace(/\/+$/, "").split("/").pop();
+  return last === "session" || last === "calls" ? last : null;
+}
+function mountedRouteOf(pathname, mounted) {
+  const path = pathname.replace(/(.)\/+$/, "$1");
+  const prefix = mounted ? "" : "/relume";
+  if (path === `${prefix}/session`) return "session";
+  if (path === `${prefix}/calls`) return "calls";
+  return null;
+}
+function methodNotAllowed(route, method) {
+  const allowed = METHOD_FOR[route];
+  if (method === allowed) return null;
+  return errorResponse(
+    405,
+    "method_not_allowed",
+    `Use ${allowed} for this route.`,
+    { Allow: allowed }
+  );
+}
+function payloadTooLarge() {
+  return errorResponse(413, "payload_too_large", "The body is too large.");
+}
+function preflight(route) {
+  return { status: 204, headers: { Allow: METHOD_FOR[route] }, body: null };
+}
+
+// src/signing.ts
+var SIGNATURE_HEADER = "Relume-Signature";
+var REQUEST_ID_HEADER = "Relume-Request-Id";
+var SIGNATURE_SCHEME = "v1";
+var SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
+var MAX_SIGNATURES = 2;
+var HEX_SHA256 = /^[0-9a-f]{64}$/i;
+var UNIX_SECONDS = /^(0|[1-9]\d{0,11})$/;
+var encoder = new TextEncoder();
+function bodyBytes(rawBody) {
+  return typeof rawBody === "string" ? encoder.encode(rawBody) : rawBody;
+}
+function signedMessage(timestamp, rawBody) {
+  const prefix = encoder.encode(`${timestamp}.`);
+  const body = bodyBytes(rawBody);
+  const message = new Uint8Array(prefix.length + body.length);
+  message.set(prefix, 0);
+  message.set(body, prefix.length);
+  return message;
+}
+function hmacKey(secret, usage) {
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    [usage]
+  );
+}
+function toHex(bytes) {
+  return Array.from(
+    new Uint8Array(bytes),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+function fromHex(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function assertTimestamp(timestamp) {
+  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {
+    throw new TypeError("timestamp must be whole unix seconds");
+  }
+}
+async function computeSignature(secret, timestamp, rawBody) {
+  if (typeof secret !== "string" || secret.length === 0) {
+    throw new TypeError("secret must be a non-empty string");
+  }
+  assertTimestamp(timestamp);
+  const key = await hmacKey(secret, "sign");
+  return toHex(
+    await crypto.subtle.sign("HMAC", key, signedMessage(timestamp, rawBody))
+  );
+}
+async function signCall(secrets, timestamp, rawBody) {
+  const list = typeof secrets === "string" ? [secrets] : secrets;
+  if (list.length === 0 || list.length > MAX_SIGNATURES) {
+    throw new TypeError(
+      `expected 1 to ${MAX_SIGNATURES} secrets, got ${list.length}`
+    );
+  }
+  const signatures = await Promise.all(
+    list.map(async (secret) => {
+      const hex = await computeSignature(secret, timestamp, rawBody);
+      return `${SIGNATURE_SCHEME}=${hex}`;
+    })
+  );
+  return [`t=${timestamp}`, ...signatures].join(",");
+}
+function parseSignatureHeader(header2) {
+  let timestamp = null;
+  const signatures = [];
+  for (const part of header2.split(",")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    const name = part.slice(0, separator).trim();
+    const value = part.slice(separator + 1).trim();
+    if (name === "t") {
+      if (timestamp !== null || !UNIX_SECONDS.test(value)) return null;
+      timestamp = Number(value);
+    } else if (name === SIGNATURE_SCHEME) {
+      if (signatures.length === MAX_SIGNATURES) return null;
+      signatures.push(value);
+    }
+  }
+  if (timestamp === null || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+async function verifySignature(input) {
+  const parsed = input.header ? parseSignatureHeader(input.header) : null;
+  if (parsed === null) return { valid: false, reason: "malformed_header" };
+  if (typeof input.secret !== "string" || input.secret.length === 0) {
+    return { valid: false, reason: "signature_mismatch" };
+  }
+  const key = await hmacKey(input.secret, "verify");
+  const message = signedMessage(parsed.timestamp, input.rawBody);
+  const results = await Promise.all(
+    parsed.signatures.map(
+      (signature) => HEX_SHA256.test(signature) ? crypto.subtle.verify("HMAC", key, fromHex(signature), message) : Promise.resolve(false)
+    )
+  );
+  if (!results.includes(true)) {
+    return { valid: false, reason: "signature_mismatch" };
+  }
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  if (Math.abs(now - parsed.timestamp) > SIGNATURE_TOLERANCE_SECONDS) {
+    return { valid: false, reason: "timestamp_out_of_tolerance" };
+  }
+  return { valid: true, timestamp: parsed.timestamp };
+}
+
+// src/adapters/express.ts
+var PayloadTooLargeError = class extends Error {
+};
+var BodyAlreadyReadError = class extends Error {
+  constructor() {
+    super(
+      "The request body was already read by a body parser, so the Relume signature can't be checked. Mount relume.express() before express.json(), or give it express.raw({ type: 'application/json' })."
+    );
+    this.name = "BodyAlreadyReadError";
+  }
+};
+function header(request, name) {
+  const value = request.headers[name.toLowerCase()];
+  if (Array.isArray(value)) return value[0] ?? null;
+  return value ?? null;
+}
+async function readRawBody(request, maxBodyBytes) {
+  if (request.body instanceof Uint8Array) return request.body;
+  if (typeof request.body === "string") return request.body;
+  if (request.readableEnded) throw new BodyAlreadyReadError();
+  if (Number(header(request, "content-length")) > maxBodyBytes) {
+    throw new PayloadTooLargeError();
+  }
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    const cleanup = () => {
+      request.off("data", onData);
+      request.off("end", onEnd);
+      request.off("error", onError);
+    };
+    const onData = (chunk) => {
+      const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+      size += bytes.byteLength;
+      if (size > maxBodyBytes) {
+        cleanup();
+        chunks.length = 0;
+        request.resume();
+        reject(new PayloadTooLargeError());
+        return;
+      }
+      chunks.push(bytes);
+    };
+    const onEnd = () => {
+      cleanup();
+      const body = new Uint8Array(size);
+      let offset = 0;
+      for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      resolve(body);
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    request.on("data", onData);
+    request.on("end", onEnd);
+    request.on("error", onError);
+  });
+}
+function send(request, response, result) {
+  if (response.headersSent) return;
+  response.statusCode = result.status;
+  for (const [name, value] of Object.entries(result.headers)) {
+    response.setHeader(name, value);
+  }
+  response.end(
+    request.method === "HEAD" || result.status === 204 ? void 0 : JSON.stringify(result.body)
+  );
+}
+function expressHandler(client, maxBodyBytes, onError) {
+  return (request, response, next) => {
+    const route = mountedRouteOf(
+      new URL(request.url ?? "/", "http://localhost").pathname,
+      Boolean(request.baseUrl)
+    );
+    if (!route) {
+      if (next) next();
+      else
+        send(request, response, errorResponse(404, "not_found", "Not found."));
+      return;
+    }
+    if (request.method === "OPTIONS") {
+      if (next) next();
+      else send(request, response, preflight(route));
+      return;
+    }
+    const wrongMethod = methodNotAllowed(route, request.method);
+    if (wrongMethod) {
+      send(request, response, wrongMethod);
+      return;
+    }
+    const run = async () => {
+      if (route === "session") return client.handleSession(request);
+      let rawBody;
+      try {
+        rawBody = await readRawBody(request, maxBodyBytes);
+      } catch (error) {
+        if (error instanceof PayloadTooLargeError) return payloadTooLarge();
+        if (error instanceof BodyAlreadyReadError) {
+          onError(error, route);
+          return errorResponse(
+            500,
+            "internal_error",
+            "The partner failed to handle the call."
+          );
+        }
+        throw error;
+      }
+      return client.handleCall({
+        rawBody,
+        signatureHeader: header(request, SIGNATURE_HEADER),
+        requestId: header(request, REQUEST_ID_HEADER)
+      });
+    };
+    run().then(
+      (result) => send(request, response, result),
+      (error) => {
+        if (next) next(error);
+        else {
+          onError(error, route);
+          send(
+            request,
+            response,
+            errorResponse(
+              500,
+              "internal_error",
+              "The partner failed to handle the call."
+            )
+          );
+        }
+      }
+    );
+  };
+}
+
+// src/adapters/fetch.ts
+function toResponse(response, head) {
+  const empty = head || response.status === 204;
+  return new Response(empty ? null : JSON.stringify(response.body), {
+    status: response.status,
+    headers: response.headers
+  });
+}
+async function readCapped(request, maxBodyBytes) {
+  if (Number(request.headers.get("content-length")) > maxBodyBytes) {
+    return null;
+  }
+  if (!request.body) return new Uint8Array(0);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBodyBytes) {
+      reader.releaseLock();
+      return null;
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+function fetchHandler(client, maxBodyBytes) {
+  return async (request) => {
+    const head = request.method === "HEAD";
+    const route = routeOf(new URL(request.url).pathname);
+    if (!route) {
+      return toResponse(errorResponse(404, "not_found", "Not found."), head);
+    }
+    if (request.method === "OPTIONS") return toResponse(preflight(route), true);
+    const wrongMethod = methodNotAllowed(route, request.method);
+    if (wrongMethod) return toResponse(wrongMethod, head);
+    if (route === "session") {
+      return toResponse(await client.handleSession(request), head);
+    }
+    const rawBody = await readCapped(request, maxBodyBytes);
+    if (rawBody === null) return toResponse(payloadTooLarge(), false);
+    return toResponse(
+      await client.handleCall({
+        rawBody,
+        signatureHeader: request.headers.get(SIGNATURE_HEADER),
+        requestId: request.headers.get(REQUEST_ID_HEADER)
+      }),
+      false
+    );
+  };
+}
+
+// src/guards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isString(value, min, max) {
+  return typeof value === "string" && value.length >= min && value.length <= max;
+}
+function isWhole(value, min) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= min;
+}
+function absent(value) {
+  return value === void 0 || value === null || value === "";
+}
+var EMAIL = /^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+function isEmail(value) {
+  return typeof value === "string" && EMAIL.test(value);
+}
+function isHttpsUrl(value) {
+  if (typeof value !== "string") return false;
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// src/api.ts
+var DEFAULT_API_BASE_URL = "https://apis.relume.io/nova/partner/v1";
+var SDK_VERSION = "2.0.0";
+var USER_AGENT = `relume-partner-node/${SDK_VERSION}`;
+var DEFAULT_API_TIMEOUT_MS = 15e3;
+var DEFAULT_MAX_RETRIES = 2;
+var RETRY_BASE_DELAY_MS = 500;
+var RETRY_MAX_DELAY_MS = 8e3;
+var MAX_RETRY_AFTER_MS = 6e4;
+var NON_RETRYABLE_5XX = /* @__PURE__ */ new Set([501, 505]);
+var RelumeError = class extends Error {
+  /** The HTTP status, or 0 when no response arrived. */
+  status;
+  /** The API's `error.code`, safe to switch on. */
+  code;
+  requestId;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "RelumeError";
+    this.status = input.status;
+    this.code = input.code;
+    this.requestId = input.requestId ?? null;
+  }
+};
+async function apiRequest(config, method, path, options = {}) {
+  const { body, query } = options;
+  let response;
+  try {
+    response = await config.fetch(
+      `${config.baseUrl}${path}${queryString(query)}`,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${config.secretKey}`,
+          Accept: "application/json",
+          "User-Agent": USER_AGENT,
+          ...body === void 0 ? {} : { "Content-Type": "application/json" }
+        },
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal: AbortSignal.timeout(config.timeoutMs),
+        // Not 'error': Cloudflare Workers refuse it. A redirect is turned
+        // into a network error below instead.
+        redirect: "manual"
+      }
+    );
+  } catch (cause) {
+    const timedOut = cause instanceof Error && (cause.name === "TimeoutError" || cause.name === "AbortError");
+    throw new RelumeError({
+      status: 0,
+      code: timedOut ? "timeout" : "network_error",
+      message: timedOut ? `The Relume API didn't answer within ${config.timeoutMs}ms.` : "Couldn't reach the Relume API.",
+      cause
+    });
+  }
+  if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
+    const status = response.status === 0 ? "" : ` (${response.status})`;
+    throw new RedirectedError({
+      status: 0,
+      code: "network_error",
+      message: `The Relume API answered with a redirect${status}; check apiBaseUrl.`
+    });
+  }
+  const text = await response.text().catch(() => "");
+  let parsed = null;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+  }
+  return {
+    status: response.status,
+    body: parsed,
+    requestId: response.headers.get(REQUEST_ID_HEADER),
+    retryAfterMs: parseRetryAfter(
+      response.headers.get("Retry-After"),
+      config.now()
+    )
+  };
+}
+function queryString(query) {
+  if (!query) return "";
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== void 0) params.set(key, String(value));
+  }
+  const encoded = params.toString();
+  return encoded ? `?${encoded}` : "";
+}
+function parseRetryAfter(header2, nowMs) {
+  if (header2 === null) return null;
+  const value = header2.trim();
+  if (/^\d+$/.test(value)) return Number(value) * 1e3;
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? null : Math.max(0, date - nowMs);
+}
+function errorFromResponse(response) {
+  const error = isRecord(response.body) ? response.body.error : void 0;
+  const code = isRecord(error) ? error.code : void 0;
+  const message = isRecord(error) ? error.message : void 0;
+  return new RelumeError({
+    status: response.status,
+    code: typeof code === "string" ? code : "unexpected_response",
+    message: typeof message === "string" ? message : `The Relume API answered ${response.status}.`,
+    requestId: response.requestId
+  });
+}
+var RedirectedError = class extends RelumeError {
+};
+async function requestJson(config, spec) {
+  for (let attempt = 0; ; attempt += 1) {
+    const canRetry = attempt < config.maxRetries;
+    let response;
+    try {
+      response = await apiRequest(config, spec.method, spec.path, {
+        body: spec.body,
+        query: spec.query
+      });
+    } catch (error) {
+      const transient = !(error instanceof RedirectedError);
+      if (!canRetry || spec.retry !== "safe" || !transient) throw error;
+      await config.sleep(backoffMs(attempt));
+      continue;
+    }
+    if (response.status >= 200 && response.status < 300) {
+      if (spec.isResult(response.body)) return response.body;
+      throw new RelumeError({
+        status: response.status,
+        code: "unexpected_response",
+        message: `${spec.method} ${spec.path} answered ${response.status} without the expected body.`,
+        requestId: response.requestId
+      });
+    }
+    const retryable = response.status === 429 || spec.retry === "safe" && response.status >= 500 && !NON_RETRYABLE_5XX.has(response.status);
+    const delay = response.retryAfterMs === null ? backoffMs(attempt) : response.status === 429 ? response.retryAfterMs : Math.min(response.retryAfterMs, RETRY_MAX_DELAY_MS);
+    if (!canRetry || !retryable || delay > MAX_RETRY_AFTER_MS) {
+      throw errorFromResponse(response);
+    }
+    await config.sleep(delay);
+  }
+}
+function backoffMs(attempt) {
+  const ceiling = Math.min(
+    RETRY_MAX_DELAY_MS,
+    RETRY_BASE_DELAY_MS * 2 ** attempt
+  );
+  return Math.round(Math.random() * ceiling);
+}
+function isSession(value) {
+  return isRecord(value) && typeof value.clientSecret === "string" && typeof value.expiresAt === "string";
+}
+
+// src/calls.ts
+var CALL_TYPES = [
+  "user.get",
+  "credits.get",
+  "credits.charge",
+  "credits.reverse"
+];
+var InvalidCallbackResultError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidCallbackResultError";
+  }
+};
+function optionalString(value, max) {
+  if (value === void 0 || value === null) {
+    return { ok: true, value: void 0 };
+  }
+  return isString(value, 1, max) ? { ok: true, value } : { ok: false };
+}
+function isCallType(value) {
+  return CALL_TYPES.some((type) => type === value);
+}
+function parseCall(body) {
+  if (!isRecord(body)) {
+    return {
+      ok: false,
+      code: "invalid_request",
+      message: "The body must be a JSON object."
+    };
+  }
+  const { type } = body;
+  if (!isCallType(type)) {
+    return {
+      ok: false,
+      code: "unsupported_call_type",
+      message: `Unsupported call type: ${JSON.stringify(type ?? null).slice(0, 64)}.`
+    };
+  }
+  const invalid = (field) => ({
+    ok: false,
+    code: "invalid_request",
+    message: `Invalid ${field} for ${type}.`,
+    type
+  });
+  const { userId } = body;
+  if (!isString(userId, 1, 128)) return invalid("userId");
+  switch (type) {
+    case "user.get":
+    case "credits.get":
+      return { ok: true, call: { type, userId } };
+    case "credits.charge": {
+      const { chargeId, partnerCredits, relumeCredits, action, description } = body;
+      if (!isString(chargeId, 1, 64)) return invalid("chargeId");
+      if (!isWhole(partnerCredits, 1)) return invalid("partnerCredits");
+      if (!isWhole(relumeCredits, 0)) return invalid("relumeCredits");
+      if (!isString(action, 1, 200)) return invalid("action");
+      if (!isString(description, 0, 200)) return invalid("description");
+      const siteId = optionalString(body.siteId, 200);
+      if (!siteId.ok) return invalid("siteId");
+      const pageId = optionalString(body.pageId, 200);
+      if (!pageId.ok) return invalid("pageId");
+      const charge = {
+        userId,
+        chargeId,
+        partnerCredits,
+        relumeCredits,
+        action,
+        description
+      };
+      if (siteId.value !== void 0) charge.siteId = siteId.value;
+      if (pageId.value !== void 0) charge.pageId = pageId.value;
+      return { ok: true, call: { type, charge } };
+    }
+    case "credits.reverse": {
+      const { reversalId, partnerCredits, relumeCredits, reason } = body;
+      if (!isString(reversalId, 1, 64)) return invalid("reversalId");
+      if (!isWhole(partnerCredits, 1)) return invalid("partnerCredits");
+      if (!isWhole(relumeCredits, 0)) return invalid("relumeCredits");
+      if (!isString(reason, 1, 200)) return invalid("reason");
+      const chargeId = optionalString(body.chargeId, 64);
+      if (!chargeId.ok) return invalid("chargeId");
+      const reversal = {
+        userId,
+        reversalId,
+        partnerCredits,
+        relumeCredits,
+        reason
+      };
+      if (chargeId.value !== void 0) reversal.chargeId = chargeId.value;
+      return { ok: true, call: { type, reversal } };
+    }
+  }
+}
+function balanceOrThrow(value, callback) {
+  if (!isWhole(value, 0)) {
+    throw new InvalidCallbackResultError(
+      `${callback} must return a balance that is a whole number, zero or more; got ${JSON.stringify(value)}.`
+    );
+  }
+  return value;
+}
+function checkUserProfile(value) {
+  if (value === null || value === void 0) return null;
+  if (!isRecord(value)) {
+    throw new InvalidCallbackResultError(
+      "onGetUser must return { name?, email?, avatarUrl? } or null."
+    );
+  }
+  const profile = {};
+  const { name, email, avatarUrl } = value;
+  if (!absent(name)) {
+    if (!isString(name, 1, 200)) {
+      throw new InvalidCallbackResultError(
+        "onGetUser: name must be a string of at most 200 characters."
+      );
+    }
+    profile.name = name;
+  }
+  if (!absent(email)) {
+    if (!isEmail(email)) {
+      throw new InvalidCallbackResultError(
+        "onGetUser: email must be a valid email address."
+      );
+    }
+    profile.email = email;
+  }
+  if (!absent(avatarUrl)) {
+    if (!isHttpsUrl(avatarUrl)) {
+      throw new InvalidCallbackResultError(
+        "onGetUser: avatarUrl must be an https URL."
+      );
+    }
+    profile.avatarUrl = avatarUrl;
+  }
+  return profile;
+}
+function checkCredits(value) {
+  if (!isRecord(value)) {
+    throw new InvalidCallbackResultError(
+      "onGetCredits must return { balance }."
+    );
+  }
+  return { balance: balanceOrThrow(value.balance, "onGetCredits") };
+}
+function optionalBalance(value, callback) {
+  return absent(value.balance) ? {} : { balance: balanceOrThrow(value.balance, callback) };
+}
+function checkChargeResult(value) {
+  if (!isRecord(value) || typeof value.ok !== "boolean") {
+    throw new InvalidCallbackResultError(
+      "onChargeCredits must return { ok: boolean, balance? }."
+    );
+  }
+  return { ok: value.ok, ...optionalBalance(value, "onChargeCredits") };
+}
+function checkReversalResult(value) {
+  if (value === void 0 || value === null) return {};
+  if (!isRecord(value)) {
+    throw new InvalidCallbackResultError(
+      "onReverseCharge must return { balance? } or nothing."
+    );
+  }
+  return optionalBalance(value, "onReverseCharge");
+}
+
+// src/pages.ts
+function isPage(value) {
+  return isRecord(value) && Array.isArray(value.data) && typeof value.nextCursor === "string" && typeof value.hasMore === "boolean";
+}
+var PagedList = class {
+  #fetchPage;
+  #after;
+  #nextCursor;
+  constructor(fetchPage, after) {
+    this.#fetchPage = fetchPage;
+    this.#after = after;
+    this.#nextCursor = after ?? null;
+  }
+  /**
+   * Where to resume: the `nextCursor` of the last page whose items have all
+   * been handed out, or the starting `after` (null when there was none)
+   * before that. Once iteration ends, store it and pass it as `after` later
+   * to get only what is new (on the ledger; site cursors don't poll).
+   */
+  get nextCursor() {
+    return this.#nextCursor;
+  }
+  /** Every page in turn. The cursor advances when you ask for the next one. */
+  async *pages() {
+    let after = this.#after;
+    for (; ; ) {
+      const page = await this.#fetchPage(after);
+      yield page;
+      this.#nextCursor = page.nextCursor;
+      if (!page.hasMore) return;
+      if (page.nextCursor === after) {
+        throw new RelumeError({
+          status: 200,
+          code: "unexpected_response",
+          message: "The Relume API returned hasMore with the same cursor."
+        });
+      }
+      after = page.nextCursor;
+    }
+  }
+  async *[Symbol.asyncIterator]() {
+    for await (const page of this.pages()) yield* page.data;
+  }
+  /** Every item in one array. Mind the size of what you're listing. */
+  async toArray() {
+    const items = [];
+    for await (const item of this) items.push(item);
+    return items;
+  }
+};
+
+// src/resources.ts
+function hasStrings(...keys) {
+  return (value) => isRecord(value) && keys.every((key) => typeof value[key] === "string");
+}
+var isUser = hasStrings("userId", "status");
+var isSite = hasStrings("siteId", "userId");
+var isCreatedSite = hasStrings("siteId");
+var isExport = hasStrings("exportId", "status");
+var isLedgerEntryDetail = hasStrings(
+  "id",
+  "type",
+  "status"
+);
+function isPriceList(value) {
+  return isRecord(value) && Array.isArray(value.data);
+}
+function segment(name, value) {
+  if (typeof value !== "string" || value === "") {
+    throw new TypeError(`${name} must be a non-empty string.`);
+  }
+  return encodeURIComponent(value);
+}
+function partnerApi(config) {
+  const get = (path, isResult, query) => requestJson(config, {
+    method: "GET",
+    path,
+    query,
+    retry: "safe",
+    isResult
+  });
+  const list = (path, { after, ...query }) => new PagedList(
+    (cursor) => get(path, (body) => isPage(body), {
+      ...query,
+      after: cursor
+    }),
+    after
+  );
+  return {
+    sessions: {
+      create: async ({ userId }) => requestJson(config, {
+        method: "POST",
+        path: "/sessions",
+        body: { userId },
+        // Safe to retry: Relume provisions a new user once (later sessions
+        // wait for or find the account), so a retry at most mints another
+        // client secret.
+        retry: "safe",
+        isResult: isSession
+      })
+    },
+    users: {
+      get: async (userId) => get(`/users/${segment("userId", userId)}`, isUser),
+      deactivate: async (userId) => requestJson(config, {
+        method: "POST",
+        path: `/users/${segment("userId", userId)}/deactivate`,
+        retry: "safe",
+        isResult: isUser
+      }),
+      reactivate: async (userId) => requestJson(config, {
+        method: "POST",
+        path: `/users/${segment("userId", userId)}/reactivate`,
+        retry: "safe",
+        isResult: isUser
+      })
+    },
+    sites: {
+      list: (userId, params = {}) => list(`/users/${segment("userId", userId)}/sites`, { ...params }),
+      create: async (userId, input = {}) => requestJson(config, {
+        method: "POST",
+        path: `/users/${segment("userId", userId)}/sites`,
+        body: input.name === void 0 ? {} : { name: input.name },
+        retry: "unsafe",
+        isResult: isCreatedSite
+      }),
+      get: async (siteId) => get(`/sites/${segment("siteId", siteId)}`, isSite)
+    },
+    exports: {
+      get: async (siteId, exportId) => get(
+        `/sites/${segment("siteId", siteId)}/exports/${segment("exportId", exportId)}`,
+        isExport
+      )
+    },
+    ledger: {
+      list: (params = {}) => list("/ledger", { ...params }),
+      get: async (id) => get(`/ledger/${segment("id", id)}`, isLedgerEntryDetail)
+    },
+    usage: {
+      get: ({ groupBy, ...params }) => list("/usage", {
+        ...params,
+        groupBy: groupBy?.length ? groupBy.join(",") : void 0
+      })
+    },
+    prices: {
+      list: async () => (await get("/prices", isPriceList)).data
+    }
+  };
+}
+
+// src/session.ts
+var EMBED_HEADER = "Relume-Embed";
+var EMBED_HEADER_VALUE = "1";
+function isHeadersLike(value) {
+  return isRecord(value) && typeof value.get === "function";
+}
+function headerReader(request) {
+  const headers = isRecord(request) ? request.headers : void 0;
+  if (isHeadersLike(headers)) return (name) => headers.get(name);
+  if (!isRecord(headers)) return null;
+  return (name) => {
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+      if (key.toLowerCase() !== wanted) continue;
+      const first = Array.isArray(value) ? value[0] : value;
+      return typeof first === "string" ? first : null;
+    }
+    return null;
+  };
+}
+function refuseSessionRequest(request) {
+  const header2 = headerReader(request);
+  if (!header2) {
+    return {
+      response: errorResponse(
+        500,
+        "internal_error",
+        "The partner failed to handle the call."
+      ),
+      error: new TypeError(
+        "handleSession couldn't read the request's headers. Pass it the fetch Request, the Node request, or an object with headers."
+      )
+    };
+  }
+  if (header2("sec-fetch-site")?.trim().toLowerCase() === "cross-site") {
+    return {
+      response: errorResponse(
+        403,
+        "cross_site_request",
+        "The session route only answers your own pages."
+      )
+    };
+  }
+  if (header2(EMBED_HEADER)?.trim() !== EMBED_HEADER_VALUE) {
+    return {
+      response: errorResponse(
+        400,
+        "embed_header_missing",
+        `The session route needs the ${EMBED_HEADER} header that @relume_io/partner-embed sends.`
+      ),
+      error: new Error(
+        `GET /relume/session was refused: no ${EMBED_HEADER}: ${EMBED_HEADER_VALUE} header. @relume_io/partner-embed sends it from 2.0.0; update the script tag or package. On another origin, allow the header in the route's CORS preflight.`
+      )
+    };
+  }
+  return null;
+}
+
+// src/client.ts
+var CALLBACK_FOR = {
+  "user.get": "onGetUser",
+  "credits.get": "onGetCredits",
+  "credits.charge": "onChargeCredits",
+  "credits.reverse": "onReverseCharge"
+};
+var INTERNAL_ERROR = () => errorResponse(
+  500,
+  "internal_error",
+  "The partner failed to handle the call."
+);
+function defaultOnHandlerError(error, info) {
+  const where = info.route === "calls" ? `${info.type ?? "call"}` : "GET /relume/session";
+  const requestId = info.requestId ? ` (Relume-Request-Id ${info.requestId})` : "";
+  console.error(`[relume] ${where} failed${requestId}:`, error);
+}
+var Relume = class _Relume {
+  // The partner API. Each method throws RelumeError when the API refuses.
+  sessions;
+  users;
+  sites;
+  exports;
+  ledger;
+  usage;
+  prices;
+  /**
+   * A fetch-style handler for Next.js route handlers, Hono, Cloudflare
+   * Workers, Bun and Deno. Answers `GET …/session` and `POST …/calls`.
+   */
+  fetchHandler;
+  #secretKey;
+  #api;
+  #callbacks = {};
+  #onHandlerError;
+  #now;
+  static init(options) {
+    return new _Relume(options);
+  }
+  constructor(options) {
+    const secretKey = typeof options?.secretKey === "string" ? options.secretKey.trim() : "";
+    if (secretKey === "") {
+      throw new TypeError(
+        "Relume.init: secretKey is required (sk_test_\u2026 or sk_live_\u2026). Is the environment variable set?"
+      );
+    }
+    if (secretKey.startsWith("pk_")) {
+      throw new TypeError(
+        "Relume.init: that is a publishable key. Pass the secret key (sk_\u2026); the publishable key goes to the embed."
+      );
+    }
+    const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+    if (!Number.isSafeInteger(maxRetries) || maxRetries < 0) {
+      throw new TypeError(
+        "Relume.init: maxRetries must be a whole number, 0 or more."
+      );
+    }
+    this.#secretKey = secretKey;
+    this.#now = options.now ?? Date.now;
+    this.#api = {
+      secretKey,
+      baseUrl: checkApiBaseUrl(options.apiBaseUrl ?? DEFAULT_API_BASE_URL),
+      timeoutMs: options.apiTimeoutMs ?? DEFAULT_API_TIMEOUT_MS,
+      fetch: options.fetch ?? ((...args) => fetch(...args)),
+      maxRetries,
+      sleep: options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+      now: this.#now
+    };
+    this.#onHandlerError = options.onHandlerError ?? defaultOnHandlerError;
+    const api = partnerApi(this.#api);
+    this.sessions = api.sessions;
+    this.users = api.users;
+    this.sites = api.sites;
+    this.exports = api.exports;
+    this.ledger = api.ledger;
+    this.usage = api.usage;
+    this.prices = api.prices;
+    this.fetchHandler = fetchHandler(this, MAX_BODY_BYTES);
+  }
+  /** Who is signed in, for the browser's `GET /relume/session`. */
+  getUserIdFromRequest(callback) {
+    this.#callbacks.getUserIdFromRequest = assertFunction(
+      callback,
+      "getUserIdFromRequest"
+    );
+    return this;
+  }
+  /** Answers `user.get`: the user's profile, or null if you don't know them. */
+  onGetUser(callback) {
+    this.#callbacks.onGetUser = assertFunction(callback, "onGetUser");
+    return this;
+  }
+  /** Answers `credits.get`: `{ balance }` in your own credits. */
+  onGetCredits(callback) {
+    this.#callbacks.onGetCredits = assertFunction(callback, "onGetCredits");
+    return this;
+  }
+  /**
+   * Answers `credits.charge`. Debit `partnerCredits` (never `relumeCredits`),
+   * at most once per `chargeId`, and return `{ ok, balance }`.
+   */
+  onChargeCredits(callback) {
+    this.#callbacks.onChargeCredits = assertFunction(
+      callback,
+      "onChargeCredits"
+    );
+    return this;
+  }
+  /**
+   * Answers `credits.reverse`. Credit back `partnerCredits` (never
+   * `relumeCredits`), at most once per `reversalId`. If `chargeId` names a
+   * debit you never made, change nothing and return normally.
+   */
+  onReverseCharge(callback) {
+    this.#callbacks.onReverseCharge = assertFunction(
+      callback,
+      "onReverseCharge"
+    );
+    return this;
+  }
+  /**
+   * Express (or Connect, or plain `node:http`) middleware. Mount it before
+   * any body parser: `app.use('/relume', relume.express())`.
+   */
+  express() {
+    return expressHandler(
+      this,
+      MAX_BODY_BYTES,
+      (error, route) => this.#onHandlerError(error, { route })
+    );
+  }
+  /**
+   * `POST /relume/calls`, framework-agnostic: verifies the signature and the
+   * 5-minute window, routes by `type`, runs your callback and validates what
+   * it returns. Pass the raw body exactly as received.
+   */
+  async handleCall(input) {
+    const requestId = input.requestId ?? null;
+    const verified = await verifySignature({
+      secret: this.#secretKey,
+      header: input.signatureHeader,
+      rawBody: input.rawBody,
+      nowSeconds: Math.floor(this.#now() / 1e3)
+    });
+    if (!verified.valid) {
+      const message = verified.reason === "timestamp_out_of_tolerance" ? "The signature timestamp is more than 5 minutes from this server\u2019s clock." : verified.reason === "malformed_header" ? "Missing or malformed Relume-Signature header." : "The signature doesn't match this server's secret key.";
+      return errorResponse(401, "invalid_signature", message);
+    }
+    let body;
+    try {
+      body = typeof input.rawBody === "string" ? JSON.parse(input.rawBody) : JSON.parse(new TextDecoder().decode(input.rawBody));
+    } catch {
+      return errorResponse(
+        400,
+        "invalid_request",
+        "The body is not valid JSON."
+      );
+    }
+    const parsed = parseCall(body);
+    if (!parsed.ok) return errorResponse(400, parsed.code, parsed.message);
+    const { call } = parsed;
+    const context = { type: call.type, requestId };
+    const callbackName = CALLBACK_FOR[call.type];
+    if (!this.#callbacks[callbackName]) {
+      this.#onHandlerError(
+        new Error(
+          `No ${callbackName} callback is registered, so ${call.type} was answered 400.`
+        ),
+        { route: "calls", type: call.type, requestId }
+      );
+      return errorResponse(
+        400,
+        "unsupported_call_type",
+        `This partner doesn't handle ${call.type}.`
+      );
+    }
+    try {
+      return await this.#runCallback(call, context);
+    } catch (error) {
+      this.#onHandlerError(error, {
+        route: "calls",
+        type: call.type,
+        requestId
+      });
+      return INTERNAL_ERROR();
+    }
+  }
+  async #runCallback(call, context) {
+    const callbacks = this.#callbacks;
+    switch (call.type) {
+      case "user.get": {
+        const profile = checkUserProfile(
+          await callbacks.onGetUser(call.userId, context)
+        );
+        return profile ? jsonResponse(200, profile) : errorResponse(404, "user_not_found", "Unknown user.");
+      }
+      case "credits.get":
+        return jsonResponse(
+          200,
+          checkCredits(await callbacks.onGetCredits(call.userId, context))
+        );
+      case "credits.charge": {
+        const { ok, ...rest } = checkChargeResult(
+          await callbacks.onChargeCredits(call.charge, context)
+        );
+        return ok ? jsonResponse(200, rest) : jsonResponse(402, {
+          ...rest,
+          error: {
+            code: "insufficient_credits",
+            message: "The user can't afford this action."
+          }
+        });
+      }
+      case "credits.reverse":
+        return jsonResponse(
+          200,
+          checkReversalResult(
+            await callbacks.onReverseCharge(call.reversal, context)
+          )
+        );
+    }
+  }
+  /**
+   * `GET /relume/session`, framework-agnostic: refuses a request from
+   * another site or without the embed's `Relume-Embed` header, works out the
+   * signed-in user with `getUserIdFromRequest`, calls `POST /sessions` and
+   * returns the client secret, or passes the API's error through unchanged.
+   * `request` must carry its headers: the fetch Request, the Node request,
+   * or an object with `headers`.
+   */
+  async handleSession(request) {
+    const refused = refuseSessionRequest(request);
+    if (refused) {
+      if (refused.error) {
+        this.#onHandlerError(refused.error, { route: "session" });
+      }
+      return refused.response;
+    }
+    const resolve = this.#callbacks.getUserIdFromRequest;
+    if (!resolve) {
+      this.#onHandlerError(
+        new Error("No getUserIdFromRequest callback is registered."),
+        { route: "session" }
+      );
+      return INTERNAL_ERROR();
+    }
+    let userId;
+    try {
+      const resolved = await resolve(request);
+      if (resolved === null || resolved === void 0 || resolved === "") {
+        return errorResponse(401, "not_signed_in", "Nobody is signed in.");
+      }
+      if (typeof resolved === "number" && Number.isSafeInteger(resolved)) {
+        userId = String(resolved);
+      } else if (typeof resolved === "string" && resolved.length >= 1 && resolved.length <= 128) {
+        userId = resolved;
+      } else {
+        throw new TypeError(
+          "getUserIdFromRequest must return a string of 1 to 128 characters, a whole number, or null."
+        );
+      }
+    } catch (error) {
+      this.#onHandlerError(error, { route: "session" });
+      return INTERNAL_ERROR();
+    }
+    let response;
+    try {
+      response = await apiRequest(this.#api, "POST", "/sessions", {
+        body: { userId }
+      });
+    } catch (error) {
+      this.#onHandlerError(error, { route: "session" });
+      const status = error instanceof RelumeError && error.code === "timeout" ? 504 : 502;
+      return errorResponse(status, "session_failed", "Couldn't reach Relume.");
+    }
+    if (response.status >= 200 && response.status < 300) {
+      if (isSession(response.body)) {
+        return jsonResponse(200, {
+          clientSecret: response.body.clientSecret,
+          expiresAt: response.body.expiresAt
+        });
+      }
+      this.#onHandlerError(errorFromResponse(response), {
+        route: "session",
+        requestId: response.requestId
+      });
+      return errorResponse(
+        502,
+        "session_failed",
+        "Relume answered without a session."
+      );
+    }
+    const hasError = typeof response.body === "object" && response.body !== null && "error" in response.body;
+    const body = hasError ? response.body : {
+      error: {
+        code: "session_failed",
+        message: `Relume answered ${response.status}.`
+      }
+    };
+    if (response.status === 401) {
+      this.#onHandlerError(errorFromResponse(response), {
+        route: "session",
+        requestId: response.requestId
+      });
+    }
+    return jsonResponse(response.status, body);
+  }
+};
+var LOOPBACK = /^(localhost|127(\.\d{1,3}){3}|\[::1\])$/;
+function checkApiBaseUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError(`Relume.init: apiBaseUrl isn't a URL: ${value}`);
+  }
+  const local = url.protocol === "http:" && LOOPBACK.test(url.hostname);
+  if (url.protocol !== "https:" && !local) {
+    throw new TypeError(
+      "Relume.init: apiBaseUrl must be an https URL (http only for localhost): every request carries your secret key."
+    );
+  }
+  return value.replace(/\/+$/, "");
+}
+function assertFunction(callback, name) {
+  if (typeof callback !== "function") {
+    throw new TypeError(`relume.${name} expects a function.`);
+  }
+  return callback;
+}
+//# sourceMappingURL=index.cjs.map