@voltro/plugin-billing 0.86.0 → 0.87.0

package/dist/service.js

@@ -1,24 +1,38 @@
 import { BillingError as e, BillingService as t, EntitlementExceeded as n } from "./types.js";
-import { evaluateEntitlement as r } from "./entitlement.js";
-import { DUNNING_LOCK_STEP_ID as i, defaultDunningEmail as a, dueSteps as o, episodeKeyOf as s, evaluateBillingEntitlement as c, resolveDunningConfig as l } from "./dunning.js";
-import { isLive as u, memoryStores as d } from "./stores.js";
-import { Effect as f, Layer as p, Schedule as m } from "effect";
-import { createLogger as h } from "@voltro/logger";
+import { captureProviderAccount as r, sameProviderAccount as i } from "./providerIdentity.js";
+import { evaluateEntitlement as a } from "./entitlement.js";
+import { assertInvoiceSnapshot as o, invoiceSnapshotError as s } from "./invoiceSnapshot.js";
+import { captureInvoiceHistoryInput as c, captureInvoiceHistoryPage as l, historyError as u } from "./invoiceHistory.js";
+import { DUNNING_LOCK_STEP_ID as d, defaultDunningEmail as f, dueSteps as p, episodeKeyOf as m, evaluateBillingEntitlement as h, resolveDunningConfig as g } from "./dunning.js";
+import { isLive as _, memoryStores as v } from "./stores.js";
+import { Effect as y, Layer as b, Schedule as x } from "effect";
+import { createLogger as S } from "@voltro/logger";
 //#region src/service.ts
-var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new Set([
+var C = S({ scope: "@voltro/plugin-billing" }), w = 3, T = /* @__PURE__ */ new Set([
 	"active",
 	"trialing",
 	"pastDue"
-]), y = (e = /* @__PURE__ */ new Date()) => `${e.getUTCFullYear()}-${String(e.getUTCMonth() + 1).padStart(2, "0")}`, b = (e) => ({ stores: e ?? d() }), x = (e, t) => e.pipe(f.retry({
-	schedule: m.recurs(Math.max(0, t - 1)),
+]), E = /* @__PURE__ */ new Set([...T, "incomplete"]), D = (e = /* @__PURE__ */ new Date()) => `${e.getUTCFullYear()}-${String(e.getUTCMonth() + 1).padStart(2, "0")}`, ee = (e) => ({ stores: e ?? v() }), O = (e, t) => e.pipe(y.retry({
+	schedule: x.recurs(Math.max(0, t - 1)),
 	while: (e) => e.transient
-})), S = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,99}$/, C = "usage key must be 1–100 characters of A–Z, a–z, 0–9, \"_\", \".\", \":\" or \"-\", starting with a letter or digit", w = (t) => {
-	let { provider: d, plans: p } = t, m = t.attempts ?? 3, h = t.checkout, w = t.now ?? (() => /* @__PURE__ */ new Date()), T = (n, r) => n.length === 0 ? f.fail(new e({
-		source: "billing",
-		message: "no tenant on this call",
-		transient: !1
-	})) : t.admit === void 0 ? f.void : t.admit(n, r), E = t.redirectOrigins?.map((e) => new URL(e).origin), D = (t, n) => {
-		let r = (t) => f.fail(new e({
+})), k = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,99}$/, te = "usage key must be 1–100 characters of A–Z, a–z, 0–9, \"_\", \".\", \":\" or \"-\", starting with a letter or digit", A = (t) => {
+	let { provider: v, plans: b } = t, x = t.attempts ?? 3, S = t.checkout, A = t.now ?? (() => /* @__PURE__ */ new Date()), j = (n, r, i) => y.gen(function* () {
+		if (n.length === 0) return yield* y.fail(new e({
+			source: "billing",
+			message: "no tenant on this call",
+			transient: !1
+		}));
+		if (r !== "cancel" && (yield* N.stores.closures.getAccount(n)) !== null) return yield* y.fail(new e({
+			source: "billing",
+			message: "This billing account is closing. New paid actions are unavailable.",
+			transient: !1
+		}));
+		if (t.admit !== void 0 && (yield* t.admit(n, r)), yield* L(n), i !== void 0) {
+			let e = yield* N.stores.customers.getByTenant(n);
+			if (e === null || e.providerCustomerId !== i) return yield* y.fail(s("Checkout customer custody changed before dispatch or private URL replay."));
+		}
+	}), ne = t.redirectOrigins?.map((e) => new URL(e).origin), M = (t, n) => {
+		let r = (t) => y.fail(new e({
 			source: "billing",
 			message: `${n} ${t}`,
 			transient: !1
@@ -28,61 +42,140 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 		} catch {
 			return r("is not an absolute URL");
 		}
-		return i.protocol !== "https:" && i.protocol !== "http:" ? r("must be an http(s) URL") : E !== void 0 && !E.includes(i.origin) ? r(`must point at one of the configured redirect origins, not ${i.origin}`) : f.void;
-	}, O = b(t.stores), k = t.dunning ?? l(void 0, {}), A = (e) => O.stores.subscriptions.getByTenant(e).pipe(f.map((t) => c(t, k, w(), e))), j = (e) => A(e).pipe(f.map((e) => e.plan)), ee = (e) => O.stores.subscriptions.getByTenant(e), M = (e, n) => f.gen(function* () {
+		return i.protocol !== "https:" && i.protocol !== "http:" ? r("must be an http(s) URL") : ne !== void 0 && !ne.includes(i.origin) ? r(`must point at one of the configured redirect origins, not ${i.origin}`) : y.void;
+	}, N = ee(t.stores), P = t.dunning ?? g(void 0, {}), F, I = () => {
+		if (F !== void 0) return y.succeed(F);
+		let e = v.fetchAccountIdentity?.bind(v);
+		return e === void 0 ? y.fail(s("Account-qualified billing is unsupported by this provider.")) : e().pipe(y.flatMap((e) => y.try({
+			try: () => {
+				let t = Object.freeze({
+					provider: v.name,
+					account: r(e)
+				});
+				if (F !== void 0 && !i(F.account, t.account)) throw s("The provider account changed during observation.");
+				return F ??= t, F;
+			},
+			catch: () => s("A fixed provider account/mode is required.")
+		})));
+	}, L = (e) => I().pipe(y.flatMap((t) => N.stores.customers.assertAccount(e, t))), R = (e) => I().pipe(y.flatMap((t) => N.stores.customers.reserveAccount(e, t))), re = (e) => N.stores.customers.accountForTenant(e).pipe(y.flatMap((t) => t === null ? R(e) : y.void)), z = (e) => L(e).pipe(y.andThen(N.stores.customers.getByTenant(e))), B = (e, t) => y.gen(function* () {
+		let n = yield* I(), r = v.fetchCustomerSnapshot?.bind(v);
+		if (r === void 0) return yield* y.fail(s("Positive provider customer evidence is required."));
+		if ((yield* N.stores.customers.getByTenant(e)) === null && (yield* N.stores.subscriptions.listByTenant(e)).some((e) => _(e.status))) return yield* y.fail(s("A previous live subscription must be reconciled before customer relinking."));
+		let i = yield* O(r({
+			account: n.account,
+			providerCustomerId: t
+		}), x);
+		return yield* N.stores.customers.bind({
+			...n,
+			tenantId: e,
+			providerCustomerId: t
+		}, i);
+	}), ie = (e) => N.stores.subscriptions.getByTenant(e).pipe(y.flatMap((t) => N.stores.customers.accountForTenant(e).pipe(y.flatMap((n) => t !== null && n === null ? y.fail(s("The retained subscription has no qualified billing account.")) : y.succeed(h(t, P, A(), e)))))), ae = (e) => ie(e).pipe(y.map((e) => e.plan)), oe = (e) => N.stores.subscriptions.getByTenant(e), se = (e, n) => y.gen(function* () {
 		if (t.resolveEntitlementLimit !== void 0) {
 			let r = yield* t.resolveEntitlementLimit(e, n);
 			if (r !== null) return r;
 		}
-		let r = yield* j(e);
-		return p.entitlementLimit(r, n);
-	}), te = (e, t, n) => f.gen(function* () {
-		let i = yield* M(e, t), a = yield* O.stores.usage.used(e, t, y(w()));
-		return r(t, i, a, n);
-	}), ne = (e, t, r) => f.gen(function* () {
-		let i = yield* M(e, t);
+		let r = yield* ae(e);
+		return b.entitlementLimit(r, n);
+	}), ce = (e, t, n) => y.gen(function* () {
+		let r = yield* se(e, t), i = yield* N.stores.usage.used(e, t, D(A()));
+		return a(t, r, i, n);
+	}), le = (e, t, r) => y.gen(function* () {
+		let i = yield* se(e, t);
 		if (!Number.isFinite(i) || r <= 0) return;
-		let a = y(w()), o = yield* O.stores.usage.consume(e, t, a, r, i);
-		if (!o.allowed) return yield* f.fail(new n({
+		let a = D(A());
+		yield* re(e);
+		let o = yield* N.stores.usage.consume(e, t, a, r, i);
+		if (!o.allowed) return yield* y.fail(new n({
 			entitlement: t,
 			limit: o.limit,
 			used: o.used,
 			cost: r
 		}));
-	}), N = (t, n, r) => S.test(n) ? Number.isFinite(r) ? r <= 0 ? f.void : O.stores.usage.increment(t, n, y(w()), r).pipe(f.asVoid) : f.fail(new e({
+	}), ue = (t, n, r) => k.test(n) ? Number.isFinite(r) ? r <= 0 ? y.void : re(t).pipe(y.andThen(N.stores.usage.increment(t, n, D(A()), r)), y.asVoid) : y.fail(new e({
 		source: "billing",
 		message: `usage quantity must be a finite number, got ${r}`,
 		transient: !1
-	})) : f.fail(new e({
+	})) : y.fail(new e({
+		source: "billing",
+		message: te,
+		transient: !1
+	})), de = (t) => y.gen(function* () {
+		if (!k.test(t.entitlementKey) || !(t.occurredAt instanceof Date) || !Number.isFinite(t.occurredAt.getTime()) || t.occurredAt.getTime() < 0 || !Number.isFinite(A().getTime())) return yield* y.fail(new e({
+			source: "usageEvent",
+			message: "Usage event requires a valid meter key and a completed occurrence timestamp.",
+			transient: !1
+		}));
+		if (t.occurredAt.getTime() > A().getTime()) return yield* y.fail(new e({
+			source: "usageEvent",
+			message: "Usage completion is ahead of this replica clock. Retry the same event after its completion time.",
+			transient: !0
+		}));
+		let n = new Date(t.occurredAt);
+		if ((yield* N.stores.customers.accountForTenant(t.tenantId)) === null) return yield* y.fail(s("Usage occurrence requires its already recorded original billing account."));
+		yield* N.stores.usage.recordEvent({
+			...t,
+			occurredAt: n,
+			period: D(n)
+		});
+	}), V = () => new e({
 		source: "billing",
-		message: C,
+		message: "Usage arrived after final billing dispatch was sealed. Financial reconciliation is required before account deletion.",
 		transient: !1
-	})), P = () => f.gen(function* () {
-		if (!d.supportsMeteredUsage) return;
-		let e = yield* O.stores.usage.pending();
-		for (let t of e) {
-			let e = t.used - t.reportedToProvider;
-			if (e <= 0) continue;
-			let n = yield* O.stores.customers.getByTenant(t.tenantId);
-			n === null && d.usageRequiresCustomer === !0 ? yield* f.logWarning("billing usage not flushed: no provider customer linked").pipe(f.annotateLogs({
-				tenantId: t.tenantId,
-				key: t.entitlementKey,
-				pending: e
-			})) : (yield* x(d.reportUsage({
-				tenantId: t.tenantId,
-				entitlementKey: t.entitlementKey,
-				quantity: e,
-				idempotencyKey: `${t.tenantId}:${t.entitlementKey}:${t.period}:${t.used}`,
-				...n === null ? {} : { providerCustomerId: n.providerCustomerId }
-			}), m), yield* O.stores.usage.markReported(t.tenantId, t.entitlementKey, t.period, t.used));
+	}), H = (e) => N.stores.closures.getAccount(e).pipe(y.map((e) => e?.usageSealed === 1)), U = (t) => y.gen(function* () {
+		if (!v.supportsMeteredUsage) return;
+		let n = yield* N.stores.usage.pending();
+		for (let r of n) {
+			if (t !== void 0 && r.tenantId !== t) continue;
+			let n = r.used - r.reportedToProvider;
+			if (n <= 0) continue;
+			if (r.period !== D(A())) {
+				if (t !== void 0) return yield* y.fail(new e({
+					source: "billing",
+					message: "Historical usage requires original-period financial reconciliation before account deletion.",
+					transient: !1
+				}));
+				yield* y.logWarning("historical billing usage retained for original-period reconciliation").pipe(y.annotateLogs({
+					tenantId: r.tenantId,
+					period: r.period
+				}));
+				continue;
+			}
+			if (yield* H(r.tenantId)) {
+				if (t !== void 0) return yield* y.fail(V());
+				yield* y.logWarning("billing usage retained: final dispatch is sealed").pipe(y.annotateLogs({ tenantId: r.tenantId }));
+				continue;
+			}
+			let i = yield* N.stores.customers.getByTenant(r.tenantId);
+			if (i === null && v.usageRequiresCustomer === !0) {
+				if (t !== void 0) return yield* y.fail(new e({
+					source: "billing",
+					message: "Final usage requires a confirmed provider customer before account closure.",
+					transient: !0
+				}));
+				yield* y.logWarning("billing usage not flushed: no provider customer linked").pipe(y.annotateLogs({
+					tenantId: r.tenantId,
+					key: r.entitlementKey,
+					pending: n
+				}));
+			} else yield* O(y.gen(function* () {
+				if (yield* H(r.tenantId)) return yield* y.fail(V());
+				yield* v.reportUsage({
+					tenantId: r.tenantId,
+					entitlementKey: r.entitlementKey,
+					quantity: n,
+					idempotencyKey: `${r.tenantId}:${r.entitlementKey}:${r.period}:${r.used}`,
+					...i === null ? {} : { providerCustomerId: i.providerCustomerId }
+				});
+			}), x), yield* N.stores.usage.markReported(r.tenantId, r.entitlementKey, r.period, r.used);
 		}
-	}), F = (t) => f.fail(new e({
+	}), fe = () => U(), W = (t) => y.fail(new e({
 		source: "billing",
 		message: `tenant '${t}' already has a paying subscription — change its plan instead of checking out again`,
 		transient: !1
-	})), I = (e, t, n) => t.status === "canceled" ? O.stores.subscriptions.markCanceled(t.providerSubscriptionId) : O.stores.subscriptions.upsert({
+	})), G = (e, t, n) => L(e).pipe(y.flatMap((r) => r ? t.status === "canceled" ? N.stores.subscriptions.markCanceled(t.providerSubscriptionId) : N.stores.subscriptions.upsert({
 		tenantId: e,
-		provider: d.name,
+		provider: v.name,
 		providerSubscriptionId: t.providerSubscriptionId,
 		plan: t.plan ?? "free",
 		status: t.status,
@@ -92,111 +185,221 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 		cancelAt: t.cancelAt,
 		pastDueSince: null,
 		statusEventAt: n
-	}), L = (t) => f.gen(function* () {
-		let n = p.priceIdFor(t.plan);
-		if (n === null) return yield* f.fail(new e({
+	}) : y.fail(s("A qualified billing account is required before subscription writes.")))), pe = (t) => y.gen(function* () {
+		let { tenantId: n, plan: r, successUrl: i, cancelUrl: a } = t, o = t.quantity ?? 1, s = t.authorize ?? (() => y.void), c = b.priceIdFor(r), l = (t) => y.fail(new e({
 			source: "billing",
-			message: `plan '${t.plan}' has no provider priceId — not a paid plan`,
+			message: t,
 			transient: !1
 		}));
-		if (yield* T(t.tenantId, "checkout"), t.quantity !== void 0 && (!Number.isSafeInteger(t.quantity) || t.quantity <= 0)) return yield* f.fail(new e({
-			source: "billing",
-			message: `seat quantity must be a positive integer, got ${t.quantity}`,
-			transient: !1
-		}));
-		yield* D(t.successUrl, "successUrl"), yield* D(t.cancelUrl, "cancelUrl");
-		let r = yield* O.stores.subscriptions.getByTenant(t.tenantId);
-		if (r !== null && v.has(r.status)) return yield* F(t.tenantId);
-		let i = yield* O.stores.customers.getByTenant(t.tenantId), a = i?.providerCustomerId ?? (yield* x(d.ensureCustomer({ tenantId: t.tenantId }), m));
-		i === null && (yield* O.stores.customers.upsert({
-			tenantId: t.tenantId,
-			provider: d.name,
-			providerCustomerId: a
-		}));
-		let o = (yield* x(d.listSubscriptions({ providerCustomerId: a }), m)).filter((e) => v.has(e.status));
-		if (o.length > 0) {
-			for (let e of o) yield* I(t.tenantId, e, w());
-			return yield* F(t.tenantId);
+		if (c === null) return yield* l("The selected plan has no provider checkout price.");
+		if (!Number.isSafeInteger(o) || o < 1) return yield* l("Seat quantity must be a positive integer.");
+		yield* j(n, "checkout"), yield* s(), yield* M(i, "successUrl"), yield* M(a, "cancelUrl");
+		let u = yield* N.stores.subscriptions.getByTenant(n);
+		if (u !== null && E.has(u.status)) return yield* W(n);
+		let d = [...new Set(b.meteredPriceIdsFor(r))].sort(), f = S?.adjustableQuantity === void 0 ? void 0 : {
+			min: S.adjustableQuantity.min,
+			max: S.adjustableQuantity.max
+		}, p = S?.trialDays, m = yield* y.tryPromise({
+			try: async () => {
+				let e = new TextEncoder().encode(JSON.stringify([
+					n,
+					v.name,
+					r,
+					c,
+					d,
+					o,
+					i,
+					a,
+					f ?? null,
+					p ?? null
+				])), t = await globalThis.crypto.subtle.digest("SHA-256", e);
+				return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
+			},
+			catch: () => new e({
+				source: "billing",
+				message: "Checkout request identity could not be established.",
+				transient: !1
+			})
+		});
+		for (let e = 0; e < 4; e++) {
+			yield* j(n, "checkout"), yield* s(), yield* R(n);
+			let e = new Date(A());
+			if (!Number.isFinite(e.getTime())) return yield* l("The checkout clock could not be confirmed.");
+			let t = yield* N.stores.checkouts.reserve({
+				tenantId: n,
+				provider: v.name,
+				requestDigest: m,
+				plan: r,
+				quantity: o,
+				createdAt: e,
+				expiresAt: /* @__PURE__ */ new Date(Math.floor((e.getTime() + 36e5) / 1e3) * 1e3)
+			});
+			if (t.provider !== v.name) return yield* l("The checkout provider changed. Its previous operation needs reconciliation.");
+			let u = t.providerCustomerId, h = yield* z(n);
+			if (h !== null && (h.provider !== v.name || u !== null && h.providerCustomerId !== u)) return yield* l("The checkout customer binding changed. Its operation needs reconciliation.");
+			if (t.requestDigest === m && u === null) {
+				yield* j(n, "checkout"), yield* s(), u = h?.providerCustomerId ?? (yield* O(s().pipe(y.andThen(j(n, "checkout")), y.andThen(v.ensureCustomer({ tenantId: n }))), x));
+				let e = yield* N.stores.checkouts.patch(t.id, { providerCustomerId: u });
+				if (e.active !== 1 || e.providerCustomerId !== u) return yield* l("Checkout ownership changed during customer resolution.");
+				let r = yield* z(n);
+				if (r !== null && (r.provider !== v.name || r.providerCustomerId !== u)) return yield* l("The current customer binding requires reconciliation.");
+				yield* s(), r === null && (yield* B(n, u));
+			}
+			if (u !== null) {
+				let e = yield* z(n);
+				if (e === null) yield* B(n, u);
+				else if (e.providerCustomerId !== u) return yield* l("Checkout customer custody differs from the retained operation.");
+			}
+			let g = yield* O(v.findCheckoutSession({
+				tenantId: n,
+				operationId: t.id,
+				...u === null ? {} : { providerCustomerId: u }
+			}), x), _ = g.receipt;
+			if (_ !== null) {
+				if (_.operationId !== t.id || _.tenantId !== n || _.providerCustomerId === null || u !== null && _.providerCustomerId !== u || _.expiresAt.getTime() !== t.expiresAt.getTime() || _.id === "") return yield* l("The provider checkout receipt does not match its retained operation.");
+				if (u === null && (u = _.providerCustomerId, yield* N.stores.checkouts.patch(t.id, { providerCustomerId: u })), _.status === "expired") {
+					yield* N.stores.checkouts.patch(t.id, {
+						phase: "expired",
+						providerSessionId: _.id
+					});
+					continue;
+				}
+				if (_.status === "complete") {
+					if (yield* N.stores.checkouts.patch(t.id, {
+						phase: "completed",
+						providerSessionId: _.id
+					}), _.providerSubscriptionId === null) return yield* l("Completed checkout settlement is not yet confirmed.");
+					if ((yield* O(v.fetchSubscription(_.providerSubscriptionId), x))?.status === "canceled") {
+						yield* N.stores.checkouts.patch(t.id, { phase: "retired" });
+						continue;
+					}
+					return yield* W(n);
+				}
+				let e = yield* N.stores.checkouts.patch(t.id, {
+					phase: "ready",
+					providerSessionId: _.id
+				});
+				return t.requestDigest === m ? _.url === null || g.observedAt !== null && g.observedAt.getTime() >= _.expiresAt.getTime() ? yield* l("The current checkout URL could not be confirmed.") : e.active !== 1 || e.phase !== "ready" ? yield* l("Checkout state changed before its URL could be returned.") : (yield* j(n, "checkout", u ?? void 0), { url: _.url }) : yield* l("Another checkout is still open for this organization.");
+			}
+			if (g.observedAt !== null && g.observedAt.getTime() > t.expiresAt.getTime()) {
+				yield* N.stores.checkouts.patch(t.id, { phase: "expired" });
+				continue;
+			}
+			if (t.requestDigest !== m) return yield* l("An earlier checkout request is unresolved. Check its current state first.");
+			if (u === null || A().getTime() >= t.expiresAt.getTime()) return yield* l("The earlier checkout needs provider deadline/receipt reconciliation.");
+			let b = (yield* O(v.listSubscriptions({ providerCustomerId: u }), x)).filter((e) => E.has(e.status));
+			if (b.length > 0) {
+				for (let e of b) yield* G(n, e, A());
+				return yield* W(n);
+			}
+			let S = yield* N.stores.checkouts.patch(t.id, { phase: "creating" });
+			if (S.active !== 1 || S.phase === "completed") return yield* l("Checkout state changed before provider dispatch.");
+			yield* j(n, "checkout", u ?? void 0), yield* s(), yield* O(s().pipe(y.andThen(j(n, "checkout", u ?? void 0)), y.andThen(v.expireOpenCheckouts({
+				providerCustomerId: u,
+				exceptOperationId: t.id
+			}))), x), yield* j(n, "checkout", u ?? void 0), yield* s();
+			let C = yield* O(s().pipe(y.andThen(j(n, "checkout", u ?? void 0)), y.andThen(v.createCheckoutSession({
+				tenantId: n,
+				priceId: c,
+				meteredPriceIds: d,
+				successUrl: i,
+				cancelUrl: a,
+				quantity: o,
+				providerCustomerId: u,
+				idempotencyKey: t.id,
+				expiresAt: t.expiresAt,
+				...f === void 0 ? {} : { adjustableQuantity: f },
+				...p === void 0 ? {} : { trialDays: p }
+			}))), x);
+			if (C.operationId !== t.id || C.tenantId !== n || C.providerCustomerId !== u || C.expiresAt.getTime() !== t.expiresAt.getTime() || !C.id) return yield* l("Checkout creation returned an inconsistent provider receipt.");
+			if (C.status === "expired") {
+				yield* N.stores.checkouts.patch(t.id, {
+					phase: "expired",
+					providerSessionId: C.id
+				});
+				continue;
+			}
+			if (C.status === "complete") return yield* N.stores.checkouts.patch(t.id, {
+				phase: "completed",
+				providerSessionId: C.id
+			}), yield* W(n);
+			if (C.url === null) return yield* l("Checkout creation returned no confirmed URL.");
+			let w = yield* N.stores.checkouts.patch(t.id, {
+				phase: "ready",
+				providerSessionId: C.id
+			});
+			return w.active !== 1 || w.phase !== "ready" ? yield* l("Checkout state changed before its URL could be returned.") : (yield* j(n, "checkout", u ?? void 0), { url: C.url });
 		}
-		return yield* x(d.expireOpenCheckouts({ providerCustomerId: a }), m), yield* x(d.createCheckoutSession({
-			tenantId: t.tenantId,
-			priceId: n,
-			meteredPriceIds: p.meteredPriceIdsFor(t.plan),
-			successUrl: t.successUrl,
-			cancelUrl: t.cancelUrl,
-			providerCustomerId: a,
-			...t.quantity === void 0 ? {} : { quantity: t.quantity },
-			...h?.adjustableQuantity === void 0 ? {} : { adjustableQuantity: h.adjustableQuantity },
-			...h?.trialDays === void 0 ? {} : { trialDays: h.trialDays }
-		}), m);
-	}), R = (t, n) => f.gen(function* () {
-		yield* T(t, "portal"), yield* D(n, "returnUrl");
-		let r = yield* O.stores.customers.getByTenant(t);
-		return r === null ? yield* f.fail(new e({
+		return yield* l("Checkout operations changed concurrently. Check current billing state before retrying.");
+	}), me = (t, n) => y.gen(function* () {
+		yield* j(t, "portal"), yield* M(n, "returnUrl");
+		let r = yield* z(t);
+		return r === null ? yield* y.fail(new e({
 			source: "billing",
 			message: `no provider customer linked for tenant '${t}'`,
 			transient: !1
-		})) : yield* x(d.createPortalSession({
+		})) : yield* O(v.createPortalSession({
 			tenantId: t,
 			providerCustomerId: r.providerCustomerId,
 			returnUrl: n
-		}), m);
-	}), z = (e) => f.gen(function* () {
-		if (k.resolveRecipient !== void 0) {
-			let t = yield* k.resolveRecipient(e);
+		}), x);
+	}), he = (e) => y.gen(function* () {
+		if (P.resolveRecipient !== void 0) {
+			let t = yield* P.resolveRecipient(e);
 			if (t !== null) return t;
 		}
-		if (d.customerEmail === void 0) return null;
-		let t = yield* O.stores.customers.getByTenant(e);
-		return t === null ? null : yield* d.customerEmail(t.providerCustomerId);
-	}), B = (e) => {
-		let t = k.portalReturnUrl;
-		return t === void 0 ? f.succeed(null) : R(e, t).pipe(f.map((e) => e.url), f.catch(() => f.succeed(null)));
-	}, V = (e, t, n, r, i) => f.gen(function* () {
-		let o = yield* z(e.tenantId).pipe(f.catch(() => f.succeed(null))), s = yield* B(e.tenantId), c = t.lockedSince !== null, l = a({
+		if (v.customerEmail === void 0) return null;
+		let t = yield* z(e);
+		return t === null ? null : yield* v.customerEmail(t.providerCustomerId);
+	}), ge = (e) => {
+		let t = P.portalReturnUrl;
+		return t === void 0 ? y.succeed(null) : me(e, t).pipe(y.map((e) => e.url), y.catch(() => y.succeed(null)));
+	}, _e = (e, t, n, r, i) => y.gen(function* () {
+		let a = yield* he(e.tenantId).pipe(y.catch(() => y.succeed(null))), o = yield* ge(e.tenantId), s = t.lockedSince !== null, c = f({
 			stepId: n,
-			locked: c,
+			locked: s,
 			graceEndsAt: i,
-			portalUrl: s
-		}), u = {
+			portalUrl: o
+		}), l = {
 			stepId: n,
 			tenantId: e.tenantId,
-			to: o,
+			to: a,
 			plan: e.plan,
 			status: e.status,
 			pastDueSince: r,
 			graceEndsAt: i,
-			locked: c,
-			lockout: k.lockout,
-			portalUrl: s,
-			...l
+			locked: s,
+			lockout: P.lockout,
+			portalUrl: o,
+			...c
 		};
-		g.info("billing dunning notice", {
+		C.info("billing dunning notice", {
 			tenant: e.tenantId,
 			step: n,
-			locked: c,
+			locked: s,
 			graceEndsAt: i.toISOString(),
-			delivered: k.notify !== void 0 && o !== null
+			delivered: P.notify !== void 0 && a !== null
 		});
-		let d = k.notify;
-		d !== void 0 && (yield* d(u).pipe(f.catchCause((t) => f.sync(() => {
-			g.warn("billing dunning notify failed", {
+		let u = P.notify;
+		u !== void 0 && (yield* u(l).pipe(y.catchCause((t) => y.sync(() => {
+			C.warn("billing dunning notify failed", {
 				tenant: e.tenantId,
 				step: n,
 				cause: String(t)
 			});
 		}))));
-	}), H = (e) => f.gen(function* () {
-		let t = yield* O.stores.subscriptions.getByTenant(e);
-		if (t === null) return c(null, k, w(), e);
-		let n = yield* d.fetchSubscription(t.providerSubscriptionId).pipe(f.catch((t) => f.sync(() => (g.warn("billing dunning reconcile: provider unreachable, not escalating", {
+	}), K = (e) => y.gen(function* () {
+		yield* L(e);
+		let t = yield* N.stores.subscriptions.getByTenant(e);
+		if (t === null) return h(null, P, A(), e);
+		let n = yield* v.fetchSubscription(t.providerSubscriptionId).pipe(y.catch((t) => y.sync(() => (C.warn("billing dunning reconcile: provider unreachable, not escalating", {
 			tenant: e,
 			source: t.source,
 			message: t.message
 		}), null)))), r = t;
 		if (n !== null) {
-			let i = w(), a = n.status === "pastDue" ? t.status === "pastDue" && t.pastDueSince !== null ? t.pastDueSince : i : null;
-			yield* O.stores.subscriptions.patchByTenant(e, {
+			let i = A(), a = n.status === "pastDue" ? t.status === "pastDue" && t.pastDueSince !== null ? t.pastDueSince : i : null;
+			yield* N.stores.subscriptions.patchByTenant(e, {
 				status: n.status,
 				...n.plan === null ? {} : { plan: n.plan },
 				quantity: n.quantity,
@@ -215,32 +418,32 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 				statusEventAt: i
 			};
 		}
-		let a = c(r, k, w(), e);
-		if (!k.enabled || r.status !== "pastDue" || r.pastDueSince === null) return a;
-		let l = r.pastDueSince, u = s(l), p = a.graceEndsAt ?? l, m = o(k.steps, l, w()).map((e) => e.id);
-		a.lockedSince !== null && m.push(i);
-		for (let t of m) (yield* O.stores.dunningNotices.claim(e, u, t, w())) && (yield* V(r, a, t, l, p));
-		return a;
-	}), re = () => f.gen(function* () {
-		let e = yield* O.stores.subscriptions.listByStatus("pastDue"), t = 0;
-		for (let n of e) yield* H(n.tenantId).pipe(f.catch((e) => f.sync(() => {
-			g.warn("billing dunning sweep: tenant failed", {
+		let i = h(r, P, A(), e);
+		if (!P.enabled || r.status !== "pastDue" || r.pastDueSince === null) return i;
+		let a = r.pastDueSince, o = m(a), s = i.graceEndsAt ?? a, c = p(P.steps, a, A()).map((e) => e.id);
+		i.lockedSince !== null && c.push(d);
+		for (let t of c) (yield* N.stores.dunningNotices.claim(e, o, t, A())) && (yield* _e(r, i, t, a, s));
+		return i;
+	}), ve = () => y.gen(function* () {
+		let e = yield* N.stores.subscriptions.listByStatus("pastDue"), t = 0;
+		for (let n of e) yield* K(n.tenantId).pipe(y.catch((e) => y.sync(() => {
+			C.warn("billing dunning sweep: tenant failed", {
 				tenant: n.tenantId,
 				message: e.message
 			});
 		}))), t += 1;
 		return t;
-	}), U = (e) => {
-		if (!k.enabled) return f.void;
-		if (e._tag === "invoicePaymentFailed") return H(e.tenantId).pipe(f.asVoid);
-		if (e._tag !== "invoicePaid" && e._tag !== "subscriptionUpserted") return f.void;
+	}), q = (e) => {
+		if (!P.enabled) return y.void;
+		if (e._tag === "invoicePaymentFailed") return K(e.tenantId).pipe(y.asVoid);
+		if (e._tag !== "invoicePaid" && e._tag !== "subscriptionUpserted") return y.void;
 		let t = e.tenantId;
-		return O.stores.subscriptions.getByTenant(t).pipe(f.flatMap((e) => e !== null && (e.status === "pastDue" || e.pastDueSince !== null) ? H(t).pipe(f.asVoid) : f.void));
-	}, ie = (e) => {
+		return N.stores.subscriptions.getByTenant(t).pipe(y.flatMap((e) => e !== null && (e.status === "pastDue" || e.pastDueSince !== null) ? K(t).pipe(y.asVoid) : y.void));
+	}, ye = (e) => {
 		switch (e._tag) {
-			case "subscriptionUpserted": return O.stores.subscriptions.upsert({
+			case "subscriptionUpserted": return N.stores.subscriptions.upsert({
 				tenantId: e.tenantId,
-				provider: d.name,
+				provider: v.name,
 				providerSubscriptionId: e.providerSubscriptionId,
 				plan: e.plan,
 				status: e.status,
@@ -251,58 +454,71 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 				pastDueSince: null,
 				statusEventAt: e.occurredAt
 			});
-			case "subscriptionCanceled": return O.stores.subscriptions.markCanceled(e.providerSubscriptionId);
-			case "invoicePaid": return O.stores.invoices.upsert({
-				tenantId: e.tenantId,
-				provider: d.name,
-				providerInvoiceId: e.providerInvoiceId,
-				amountMinor: e.amountMinor,
-				currency: e.currency,
-				status: "paid",
-				statusEventAt: e.occurredAt
-			});
-			case "invoicePaymentFailed": return O.stores.invoices.upsert({
-				tenantId: e.tenantId,
-				provider: d.name,
-				providerInvoiceId: e.providerInvoiceId,
-				amountMinor: e.amountMinor,
-				currency: e.currency,
-				status: "open",
-				statusEventAt: e.occurredAt
-			});
-			case "customerLinked": return O.stores.customers.upsert({
-				tenantId: e.tenantId,
-				provider: d.name,
-				providerCustomerId: e.providerCustomerId
-			});
-			case "customerUnlinked": return O.stores.customers.removeByProviderCustomerId(e.providerCustomerId).pipe(f.asVoid);
+			case "subscriptionCanceled": return N.stores.subscriptions.markCanceled(e.providerSubscriptionId);
+			case "customerLinked": return B(e.tenantId, e.providerCustomerId).pipe(y.asVoid);
 		}
-	}, ae = (e) => ie(e).pipe(f.andThen(U(e))), W = (t, n) => f.gen(function* () {
-		yield* T(t, "change"), yield* Q(t);
-		let r = yield* O.stores.subscriptions.getByTenant(t);
-		if (r === null) return yield* f.fail(new e({
+	}, be = (e) => {
+		if (e._tag === "customerUnlinked") return y.gen(function* () {
+			let t = yield* I(), n = v.fetchCustomerSnapshot?.bind(v);
+			if (n === void 0) return yield* y.fail(s("Positive customer deletion evidence is required."));
+			let r = yield* n({
+				account: t.account,
+				providerCustomerId: e.providerCustomerId
+			}), i = yield* N.stores.customers.retire(t, r);
+			return {
+				...e,
+				tenantId: i?.tenantId ?? null
+			};
+		});
+		if (e._tag !== "invoicePaid" && e._tag !== "invoicePaymentFailed") return (e._tag === "customerLinked" ? y.void : z(e.tenantId).pipe(y.flatMap((e) => e === null ? y.fail(s("A qualified current customer is required before subscription events.")) : y.void))).pipe(y.andThen(ye(e)), y.andThen(q(e)), y.as(e));
+		let t = {
+			...e,
+			occurredAt: e.occurredAt === null ? null : new Date(e.occurredAt)
+		};
+		return y.gen(function* () {
+			let e = t.providerCustomerId;
+			if (typeof e != "string" || e.length === 0 || e.trim() !== e) return yield* y.fail(s("An exact provider customer identity is required."));
+			let n = yield* N.stores.customers.getByProviderCustomerId(e, yield* I());
+			if (n === null) return yield* y.fail(s("The invoice customer must be linked before reconciliation.", !0));
+			if (n.provider !== v.name) return yield* y.fail(s("The invoice customer belongs to a different provider."));
+			let r = n.tenantId;
+			yield* J(r, t.providerInvoiceId, e);
+			let i = {
+				_tag: t._tag,
+				tenantId: r,
+				providerInvoiceId: t.providerInvoiceId,
+				amountMinor: t.amountMinor,
+				currency: t.currency,
+				occurredAt: t.occurredAt
+			}, a = yield* N.stores.customers.getByTenant(r);
+			return n.retiredAt === null && a?.id === n.id && (yield* q(i)), i;
+		});
+	}, xe = (t, n) => y.gen(function* () {
+		yield* j(t, "change"), yield* Z(t);
+		let r = yield* N.stores.subscriptions.getByTenant(t);
+		if (r === null) return yield* y.fail(new e({
 			source: "billing",
 			message: `no subscription for tenant '${t}' to change`,
 			transient: !1
 		}));
 		let i = n.plan ?? r.plan, a = n.quantity ?? r.quantity;
-		if (n.plan !== void 0 && !p.has(i)) return yield* f.fail(new e({
+		if (n.plan !== void 0 && !b.has(i)) return yield* y.fail(new e({
 			source: "billing",
 			message: `unknown plan '${i}' — not in the plan registry`,
 			transient: !1
 		}));
-		if (!Number.isInteger(a) || a <= 0) return yield* f.fail(new e({
+		if (!Number.isInteger(a) || a <= 0) return yield* y.fail(new e({
 			source: "billing",
 			message: `seat quantity must be a positive integer, got ${a}`,
 			transient: !1
 		}));
-		let o = yield* x(d.updateSubscription({
+		let o = yield* O(v.updateSubscription({
 			providerSubscriptionId: r.providerSubscriptionId,
-			...n.plan === void 0 ? {} : { priceId: p.priceIdFor(i) ?? i },
+			...n.plan === void 0 ? {} : { priceId: b.priceIdFor(i) ?? i },
 			...n.quantity === void 0 ? {} : { quantity: a },
 			proration: "prorate"
-		}), m);
-		return yield* O.stores.subscriptions.patchByTenant(t, {
+		}), x);
+		return yield* N.stores.subscriptions.patchByTenant(t, {
 			...n.plan === void 0 ? {} : { plan: i },
 			quantity: o.quantity,
 			...o.currentPeriodStart === null ? {} : { currentPeriodStart: o.currentPeriodStart },
@@ -314,19 +530,19 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 			prorationMinor: o.prorationMinor,
 			currency: o.currency
 		};
-	}), oe = (t, n) => f.gen(function* () {
-		let r = yield* O.stores.subscriptions.getByTenant(t);
-		if (r === null) return yield* f.fail(new e({
+	}), Se = (t, n) => y.gen(function* () {
+		let r = yield* N.stores.subscriptions.getByTenant(t);
+		if (r === null) return yield* y.fail(new e({
 			source: "billing",
 			message: `no subscription for tenant '${t}' to preview`,
 			transient: !1
 		}));
-		let i = n.plan ?? r.plan, a = yield* x(d.previewSubscriptionChange({
+		let i = n.plan ?? r.plan, a = yield* O(v.previewSubscriptionChange({
 			providerSubscriptionId: r.providerSubscriptionId,
-			...n.plan === void 0 ? {} : { priceId: p.priceIdFor(i) ?? i },
+			...n.plan === void 0 ? {} : { priceId: b.priceIdFor(i) ?? i },
 			...n.quantity === void 0 ? {} : { quantity: n.quantity },
 			proration: "prorate"
-		}), m);
+		}), x);
 		return {
 			tenantId: t,
 			plan: i,
@@ -334,32 +550,111 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 			prorationMinor: a.prorationMinor,
 			currency: a.currency
 		};
-	}), se = (e) => f.gen(function* () {
-		let t = yield* O.stores.customers.getByTenant(e);
-		return t === null ? [] : yield* x(d.listInvoices({ providerCustomerId: t.providerCustomerId }), m);
-	}), ce = (t, n) => f.gen(function* () {
+	}), Ce = (e) => y.gen(function* () {
+		let t = yield* z(e);
+		return t === null ? [] : yield* O(v.listInvoices({ providerCustomerId: t.providerCustomerId }), x);
+	}), we = (t, n, r = N.stores) => y.gen(function* () {
+		let a = v.fetchInvoiceSnapshot?.bind(v), c = v.fetchAccountIdentity?.bind(v);
+		if (a === void 0 || c === void 0) return yield* y.fail(s("Complete account-owned invoice evidence is unsupported."));
+		if (N.stores !== r) return yield* y.fail(s("Billing stores changed before invoice observation.", !0));
+		let l = yield* I();
+		if (l.provider !== t.provider || !i(l.account, t.account)) return yield* y.fail(s("The invoice account differs from retained custody."));
+		let u = yield* c();
+		if (!i(u, t.account)) return yield* y.fail(s("The provider account changed before invoice observation."));
+		let d = yield* O(a({
+			providerCustomerId: t.providerCustomerId,
+			providerInvoiceId: n
+		}), x);
+		yield* y.try({
+			try: () => {
+				if (o(d), d.providerInvoiceId !== n || d.providerCustomerId !== t.providerCustomerId || d.livemode !== t.account.livemode) throw s("The invoice does not match retained account/customer custody.");
+			},
+			catch: (t) => t instanceof e ? t : s("The provider invoice could not be confirmed.")
+		});
+		let f = yield* c(), p = yield* r.customers.getByProviderCustomerId(t.providerCustomerId, l);
+		return N.stores !== r || !i(f, t.account) || p === null || p.id !== t.id || p.tenantId !== t.tenantId ? yield* y.fail(s("Invoice account/customer custody changed during observation.", !0)) : d;
+	}), Te = (t, n, a) => y.gen(function* () {
+		let o = N.stores;
+		if (!t || t.trim() !== t) return yield* y.fail(u("Exact tenant/customer identities are required."));
+		let s = yield* y.try({
+			try: () => {
+				let e = a?.cursor, t = e === void 0 ? void 0 : Object.freeze({
+					...r(e),
+					providerCustomerId: e.providerCustomerId,
+					afterInvoiceId: e.afterInvoiceId
+				}), n = a?.limit;
+				return Object.freeze({
+					...t === void 0 ? {} : { cursor: t },
+					...n === void 0 ? {} : { limit: n }
+				});
+			},
+			catch: (t) => t instanceof e ? t : u()
+		}), d = yield* I(), f = yield* y.try({
+			try: () => c({
+				account: d.account,
+				providerCustomerId: n,
+				...s
+			}),
+			catch: (t) => t instanceof e ? t : u()
+		}), p = yield* o.customers.getByProviderCustomerId(f.providerCustomerId, d);
+		if (p === null || p.tenantId !== t || p.provider !== v.name) return yield* y.fail(u("Positive current or retained customer custody is required."));
+		let m = v.listInvoiceHistory?.bind(v), h = v.fetchAccountIdentity?.bind(v);
+		if (m === void 0 || h === void 0) return yield* y.fail(u("Complete account-owned invoice history is unsupported."));
+		let g = yield* h();
+		if (!i(g, p.account)) return yield* y.fail(u("The provider account differs before invoice history access."));
+		let _ = yield* O(m(f), x), b = yield* y.try({
+			try: () => l(f, _),
+			catch: (t) => t instanceof e ? t : u()
+		}), S = yield* h(), C = yield* o.customers.getByProviderCustomerId(f.providerCustomerId, d);
+		return N.stores !== o || !i(S, p.account) || C === null || C.id !== p.id || C.tenantId !== t ? yield* y.fail(u("Invoice history account/customer custody changed during observation.", !0)) : b;
+	}), Ee = (e, t) => y.gen(function* () {
+		if (!e || e.trim() !== e || !t || t.trim() !== t) return yield* y.fail(s("Exact tenant/invoice identities are required."));
+		let n = yield* z(e);
+		return n === null ? yield* y.fail(s("A qualified current customer is required.")) : yield* we(n, t);
+	}), J = (e, t, n) => y.gen(function* () {
+		let r = N.stores;
+		if (!e || e.trim() !== e || !t || t.trim() !== t) return yield* y.fail(s("Exact tenant/invoice identities are required."));
+		let i = yield* I();
+		for (let a = 0; a < 3; a++) {
+			if (N.stores !== r) return yield* y.fail(s("Billing stores changed during invoice reconciliation.", !0));
+			let a = n === void 0 ? yield* z(e) : yield* r.customers.getByProviderCustomerId(n, i);
+			if (a === null || a.tenantId !== e) return yield* y.fail(s("Positive current or retained customer custody is required.", !0));
+			let o = Object.freeze({
+				tenantId: e,
+				provider: i.provider,
+				...i.account,
+				providerCustomerId: a.providerCustomerId,
+				providerInvoiceId: t
+			}), c = yield* r.invoices.get(o), l = yield* we(a, t, r);
+			if (N.stores !== r) return yield* y.fail(s("Billing stores changed before native invoice persistence.", !0));
+			if (!(yield* r.invoices.complete(o, c, l))) continue;
+			let u = yield* r.invoices.get(o);
+			return u === null || u.revision <= (c?.revision ?? 0) ? yield* y.fail(s("Invoice persistence could not be confirmed.", !0)) : u;
+		}
+		return yield* y.fail(s("Concurrent invoice observation requires retry.", !0));
+	}), De = (t, n) => y.gen(function* () {
 		if (n === "free") {
-			let e = yield* q(t);
+			let e = yield* Ae(t);
 			return {
 				tenantId: t,
 				plan: e.plan,
 				quantity: e.quantity,
 				prorationMinor: 0,
-				currency: p.currencyFor(e.plan)
+				currency: b.currencyFor(e.plan)
 			};
 		}
-		return p.has(n) && p.priceIdFor(n) === null ? yield* f.fail(new e({
+		return b.has(n) && b.priceIdFor(n) === null ? yield* y.fail(new e({
 			source: "billing",
 			message: `plan '${n}' has no provider price — it is not a self-serve plan`,
 			transient: !1
-		})) : yield* W(t, { plan: n });
-	}), G = (t, n) => O.stores.subscriptions.getByTenant(t).pipe(f.flatMap((r) => r !== null && u(r.status) ? f.succeed(r) : f.fail(new e({
+		})) : yield* xe(t, { plan: n });
+	}), Oe = (t, n) => N.stores.subscriptions.getByTenant(t).pipe(y.flatMap((r) => r !== null && _(r.status) ? y.succeed(r) : y.fail(new e({
 		source: "billing",
 		message: `no live subscription for tenant '${t}' to ${n}`,
 		transient: !1
-	})))), K = (e, t) => f.gen(function* () {
-		let n = w();
-		return yield* I(e.tenantId, {
+	})))), ke = (e, t) => y.gen(function* () {
+		let n = A();
+		return yield* G(e.tenantId, {
 			...t,
 			providerSubscriptionId: e.providerSubscriptionId
 		}, n), {
@@ -368,106 +663,198 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 			plan: t.plan ?? e.plan,
 			statusEventAt: n
 		};
-	}), q = (e) => f.gen(function* () {
-		yield* T(e, "cancel"), yield* Q(e);
-		let t = yield* G(e, "cancel"), n = yield* x(d.cancelSubscription({
+	}), Ae = (e) => y.gen(function* () {
+		yield* j(e, "cancel"), yield* Z(e);
+		let t = yield* Oe(e, "cancel"), n = yield* O(v.cancelSubscription({
 			providerSubscriptionId: t.providerSubscriptionId,
 			mode: "periodEnd"
-		}), m);
-		return yield* K(t, n);
-	}), le = (e) => f.gen(function* () {
-		yield* T(e, "resume"), yield* Q(e);
-		let t = yield* G(e, "resume"), n = yield* x(d.resumeSubscription(t.providerSubscriptionId), m);
-		return yield* K(t, n);
-	}), J = (e) => f.gen(function* () {
-		yield* P();
-		let t = yield* O.stores.customers.getByTenant(e), n = yield* O.stores.subscriptions.listByTenant(e), r = new Set(n.filter((e) => u(e.status)).map((e) => e.providerSubscriptionId));
-		if (t !== null) {
-			let e = yield* x(d.listSubscriptions({ providerCustomerId: t.providerCustomerId }), m);
-			for (let t of e) r.add(t.providerSubscriptionId);
+		}), x);
+		return yield* ke(t, n);
+	}), je = (e) => y.gen(function* () {
+		yield* j(e, "resume"), yield* Z(e);
+		let t = yield* Oe(e, "resume"), n = yield* O(v.resumeSubscription(t.providerSubscriptionId), x);
+		return yield* ke(t, n);
+	}), Y = (t) => y.gen(function* () {
+		yield* L(t), yield* R(t);
+		let n = () => new e({
+			source: "billing",
+			message: "Billing closure is pending provider confirmation. Retry reconciliation before completing account deletion.",
+			transient: !0
+		});
+		if (t.length === 0) return yield* y.fail(n());
+		yield* N.stores.closures.reserveAccount(t, v.name, A());
+		let r = yield* z(t), i = yield* N.stores.checkouts.getActive(t);
+		if (r !== null && r.provider !== v.name || i !== null && i.provider !== v.name || r !== null && i?.providerCustomerId !== null && i?.providerCustomerId !== void 0 && r.providerCustomerId !== i.providerCustomerId) return yield* y.fail(n());
+		let a = /* @__PURE__ */ new Set();
+		r !== null && a.add(r.providerCustomerId), i?.providerCustomerId && a.add(i.providerCustomerId);
+		for (let e of a) yield* O(v.expireOpenCheckouts({ providerCustomerId: e }), x);
+		let o = null;
+		if (i !== null) {
+			let e = yield* O(v.findCheckoutSession({
+				tenantId: t,
+				operationId: i.id,
+				...i.providerCustomerId === null ? {} : { providerCustomerId: i.providerCustomerId }
+			}), x), r = e.receipt;
+			if (r === null) {
+				if (e.observedAt === null || !Number.isFinite(e.observedAt.getTime()) || e.observedAt.getTime() < i.expiresAt.getTime()) return yield* y.fail(n());
+				yield* N.stores.checkouts.patch(i.id, { phase: "expired" });
+			} else {
+				if (r.operationId !== i.id || r.tenantId !== t || !r.id || r.providerCustomerId === null || r.expiresAt.getTime() !== i.expiresAt.getTime() || i.providerCustomerId !== null && r.providerCustomerId !== i.providerCustomerId || i.providerSessionId !== null && r.id !== i.providerSessionId) return yield* y.fail(n());
+				if (a.add(r.providerCustomerId), yield* N.stores.checkouts.patch(i.id, {
+					providerCustomerId: r.providerCustomerId,
+					providerSessionId: r.id
+				}), r.status === "open") return yield* O(v.expireOpenCheckouts({ providerCustomerId: r.providerCustomerId }), x), yield* y.fail(n());
+				if (r.status === "expired") yield* N.stores.checkouts.patch(i.id, { phase: "expired" });
+				else {
+					if (r.providerSubscriptionId === null) return yield* y.fail(n());
+					o = r.providerSubscriptionId, yield* N.stores.checkouts.patch(i.id, { phase: "completed" });
+				}
+			}
 		}
-		let i = [];
-		for (let t of r) {
-			let n = yield* x(d.cancelSubscription({
-				providerSubscriptionId: t,
-				mode: "close"
-			}), m);
-			yield* I(e, {
-				...n,
-				providerSubscriptionId: t
-			}, w()), i.push(t);
+		yield* U(t), yield* N.stores.closures.sealUsage(t);
+		let s = yield* N.stores.usage.pending();
+		if (v.supportsMeteredUsage && s.some((e) => e.tenantId === t && e.used > e.reportedToProvider)) return yield* y.fail(V());
+		let c = yield* N.stores.subscriptions.listByTenant(t), l = new Set(c.filter((e) => _(e.status)).map((e) => e.providerSubscriptionId));
+		o !== null && l.add(o);
+		for (let e of a) {
+			let t = yield* O(v.listSubscriptions({ providerCustomerId: e }), x);
+			for (let e of t) l.add(e.providerSubscriptionId);
 		}
-		return g.info("billing account closed", {
-			tenant: e,
-			canceled: i.length
+		let u = [], d = !1;
+		for (let e of l) {
+			let r = yield* O(v.fetchSubscription(e), x);
+			if (r === null) {
+				d = !0;
+				continue;
+			}
+			let i = r;
+			if (r.status !== "canceled") {
+				let r = yield* N.stores.closures.getSubscription(t, e);
+				if (r === null) {
+					let n = yield* O(v.prepareSubscriptionClose(e), x);
+					r = yield* N.stores.closures.reserveSubscription({
+						tenantId: t,
+						provider: v.name,
+						providerSubscriptionId: e,
+						cancelAt: n.cancelAt,
+						createdAt: A()
+					});
+				}
+				if (r.provider !== v.name || r.providerSubscriptionId !== e || r.cancelAt === null) return yield* y.fail(n());
+				i = yield* O(v.cancelSubscription({
+					providerSubscriptionId: e,
+					mode: "close",
+					closeOperation: {
+						id: r.id,
+						cancelAt: r.cancelAt
+					}
+				}), x);
+			}
+			yield* G(t, {
+				...i,
+				providerSubscriptionId: e
+			}, A()), i.status === "canceled" ? u.push(e) : d = !0;
+		}
+		for (let e of a) (yield* O(v.listSubscriptions({ providerCustomerId: e }), x)).some((e) => e.status !== "canceled") && (d = !0);
+		if (d) return yield* y.fail(n());
+		let f = yield* N.stores.usage.pending();
+		return v.supportsMeteredUsage && f.some((e) => e.tenantId === t && e.used > e.reportedToProvider) ? yield* y.fail(V()) : (i !== null && o !== null && (yield* N.stores.checkouts.patch(i.id, { phase: "retired" })), C.info("billing account closed", {
+			tenant: t,
+			canceled: u.length
 		}), {
-			tenantId: e,
-			canceled: i
-		};
-	}), Y = (e) => {
-		let n = t.isTenantClosed;
-		return n === void 0 ? f.succeed(!1) : n(e).pipe(f.catch((t) => f.sync(() => (g.warn("billing: could not tell whether a tenant is closed — leaving it", {
-			tenant: e,
-			message: t.message
-		}), !1))));
-	}, X = (e, t) => f.gen(function* () {
-		let n = w(), r = yield* x(d.listSubscriptions({ providerCustomerId: e }), m), i = yield* O.stores.customers.getByProviderCustomerId(e), a = i?.tenantId ?? t ?? r.find((e) => e.tenantId !== null)?.tenantId ?? null;
-		if (a === null) return g.warn("billing sync: customer names no tenant — nothing to attribute it to", { customer: e }), {
+			tenantId: t,
+			canceled: u
+		});
+	}), Me = (e) => y.gen(function* () {
+		return (yield* N.stores.closures.getAccount(e)) === null ? t.isTenantClosed === void 0 ? !1 : yield* t.isTenantClosed(e) : !0;
+	}), Ne = (e) => Me(e).pipe(y.catch((t) => y.sync(() => (C.warn("billing: could not tell whether a tenant is closed — leaving it", {
+		tenant: e,
+		message: t.message
+	}), !1)))), X = (e) => y.gen(function* () {
+		let t = v.fetchSubscriptionSnapshot;
+		if (t === void 0) return yield* y.fail(s("Customer-qualified subscription observations are required."));
+		let n = yield* I(), r = v.fetchAccountIdentity;
+		if (r === void 0) return yield* y.fail(s("Provider account observations are required."));
+		let a = yield* r();
+		if (!i(a, n.account)) return yield* y.fail(s("The provider account changed before subscription observation."));
+		let o = yield* O(t(e), x), c = yield* r();
+		return !i(c, n.account) || o === null || o.providerSubscriptionId !== e || o.providerCustomerId === null ? yield* y.fail(s("A complete subscription observation in the retained provider account is required.")) : o;
+	}), Pe = (t, n) => y.gen(function* () {
+		let r = A(), i = yield* N.stores.customers.getByProviderCustomerId(t, yield* I());
+		if (i !== null && i.retiredAt !== null) {
+			let e = [];
+			for (let n of yield* N.stores.subscriptions.listByTenant(i.tenantId)) {
+				let a = yield* X(n.providerSubscriptionId);
+				if (a.providerCustomerId !== t) continue;
+				if (a.status !== "canceled") return yield* y.fail(s("A retired customer still has an unsettled provider subscription."));
+				let o = yield* N.stores.customers.getByProviderCustomerId(t, yield* I());
+				if (o === null || o.id !== i.id || o.tenantId !== i.tenantId || o.retiredAt === null) return yield* y.fail(s("Retired customer custody changed during reconciliation."));
+				yield* G(i.tenantId, a, r), e.push(Q(i.tenantId, a, r));
+			}
+			for (let t of e) yield* q(t);
+			return {
+				tenantId: i.tenantId,
+				events: e
+			};
+		}
+		let a = yield* O(v.listSubscriptions({ providerCustomerId: t }), x);
+		if (a.some((e) => e.providerCustomerId !== t)) return yield* y.fail(s("The subscription listing names another customer."));
+		let o = i?.tenantId ?? n ?? a.find((e) => e.tenantId !== null)?.tenantId ?? null;
+		if (o === null) return C.warn("billing sync: customer names no tenant — nothing to attribute it to", { customer: t }), {
 			tenantId: null,
 			events: []
 		};
-		let o = [];
-		i === null && (yield* O.stores.customers.upsert({
-			tenantId: a,
-			provider: d.name,
-			providerCustomerId: e
-		}), o.push({
-			_tag: "customerLinked",
-			tenantId: a,
-			providerCustomerId: e,
-			occurredAt: n
-		})), r.some((e) => v.has(e.status) && e.cancelAt === null) && (yield* Y(a)) && (g.error("billing sync: a closed tenant still has a paying subscription — closing it", { tenant: a }), yield* J(a), r = yield* x(d.listSubscriptions({ providerCustomerId: e }), m));
-		for (let e of r) if (yield* I(a, e, n), o.push($(a, e, n)), e.plan !== null && v.has(e.status)) {
-			let t = p.meteredPriceIdsFor(e.plan).filter((t) => !e.priceIds.includes(t));
-			t.length > 0 && (yield* x(d.addSubscriptionPrices({
+		let c = [], l = yield* z(o);
+		if (i !== null && i.provider !== v.name || l !== null && (l.provider !== v.name || l.providerCustomerId !== t)) return yield* y.fail(new e({
+			source: "billing.syncCustomer",
+			message: "Customer discovery cannot replace existing native billing custody.",
+			transient: !1
+		}));
+		if (i === null) {
+			if (yield* Me(o)) return yield* y.fail(s("Closed tenant customer custody requires reconciliation."));
+			yield* B(o, t), c.push({
+				_tag: "customerLinked",
+				tenantId: o,
+				providerCustomerId: t,
+				occurredAt: r
+			});
+		}
+		a.some((e) => T.has(e.status) && e.cancelAt === null) && (yield* Ne(o)) && (C.error("billing sync: a closed tenant still has a paying subscription — closing it", { tenant: o }), yield* Y(o), a = yield* O(v.listSubscriptions({ providerCustomerId: t }), x));
+		for (let e of a) if (yield* G(o, e, r), c.push(Q(o, e, r)), e.plan !== null && T.has(e.status)) {
+			let t = b.meteredPriceIdsFor(e.plan).filter((t) => !e.priceIds.includes(t));
+			t.length > 0 && (yield* O(v.addSubscriptionPrices({
 				providerSubscriptionId: e.providerSubscriptionId,
 				priceIds: t
-			}), m));
+			}), x));
 		}
-		let s = new Set(r.map((e) => e.providerSubscriptionId));
-		for (let e of yield* O.stores.subscriptions.listByTenant(a)) {
-			if (!u(e.status) || s.has(e.providerSubscriptionId)) continue;
-			let t = yield* x(d.fetchSubscription(e.providerSubscriptionId), m), r = t === null ? {
-				...e,
-				status: "canceled",
-				providerSubscriptionId: e.providerSubscriptionId
-			} : {
-				...t,
-				providerSubscriptionId: e.providerSubscriptionId
-			};
-			yield* I(a, r, n), o.push($(a, r, n));
+		let u = new Set(a.map((e) => e.providerSubscriptionId));
+		for (let e of yield* N.stores.subscriptions.listByTenant(o)) {
+			if (!_(e.status) || u.has(e.providerSubscriptionId)) continue;
+			let n = yield* X(e.providerSubscriptionId);
+			if (n.providerCustomerId !== t) return yield* y.fail(s("The subscription belongs to another customer."));
+			yield* G(o, n, r), c.push(Q(o, n, r));
 		}
-		for (let e of o) yield* U(e);
+		for (let e of c) yield* q(e);
 		return {
-			tenantId: a,
-			events: o
+			tenantId: o,
+			events: c
 		};
-	}), Z = (e) => f.forEach(e, (e) => {
+	}), Fe = (e) => y.forEach(e, (e) => {
 		let n = t.onEvent?.[e._tag];
-		return n === void 0 ? f.void : n(e).pipe(f.catchCause((t) => f.sync(() => {
-			g.error("billing: onEvent failed for a correction — the next sync of this tenant retries it", {
+		return n === void 0 ? y.void : n(e).pipe(y.catchCause((t) => y.sync(() => {
+			C.error("billing: onEvent failed for a correction — the next sync of this tenant retries it", {
 				event: e._tag,
 				cause: String(t)
 			});
 		})));
-	}, { discard: !0 }), Q = (e) => f.gen(function* () {
-		let t = yield* O.stores.customers.getByTenant(e);
+	}, { discard: !0 }), Z = (e) => y.gen(function* () {
+		let t = yield* z(e);
 		if (t !== null) {
-			let n = yield* X(t.providerCustomerId, e);
-			yield* Z(n.events);
+			let n = yield* Pe(t.providerCustomerId, e);
+			yield* Fe(n.events);
 		}
-		return yield* O.stores.subscriptions.getByTenant(e);
-	}), ue = (e, t) => e !== void 0 && e.status === t.status && e.plan === (t.plan ?? "free") && e.quantity === t.quantity && (e.cancelAt?.getTime() ?? null) === (t.cancelAt?.getTime() ?? null), $ = (e, t, n) => t.status === "canceled" ? {
+		return yield* N.stores.subscriptions.getByTenant(e);
+	}), Ie = (e, t) => e !== void 0 && e.status === t.status && e.plan === (t.plan ?? "free") && e.quantity === t.quantity && (e.cancelAt?.getTime() ?? null) === (t.cancelAt?.getTime() ?? null), Q = (e, t, n) => t.status === "canceled" ? {
 		_tag: "subscriptionCanceled",
 		tenantId: e,
 		providerSubscriptionId: t.providerSubscriptionId,
@@ -483,133 +870,247 @@ var g = h({ scope: "@voltro/plugin-billing" }), _ = 3, v = /* @__PURE__ */ new S
 		currentPeriodEnd: t.currentPeriodEnd,
 		cancelAt: t.cancelAt,
 		occurredAt: n
-	};
+	}, Le = () => y.gen(function* () {
+		let e = A(), t = yield* O(v.listSubscriptions({}), x), n = yield* N.stores.customers.list(yield* I()), r = new Map(n.map((e) => [e.providerCustomerId, e.tenantId])), i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Set(), s = [], c = /* @__PURE__ */ new Set(), l = /* @__PURE__ */ new Map(), u = 0, d = 0, f = (e) => {
+			let t = l.get(e);
+			return t === void 0 ? Ne(e).pipe(y.tap((t) => y.sync(() => {
+				l.set(e, t);
+			}))) : y.succeed(t);
+		};
+		for (let n of t) {
+			o.add(n.providerSubscriptionId);
+			let t = null;
+			n.providerCustomerId !== null && (t = yield* N.stores.customers.getByProviderCustomerId(n.providerCustomerId, yield* I()));
+			let l = t === null ? null : t.tenantId, p = n.providerCustomerId === null ? null : r.get(n.providerCustomerId) ?? null, m = l === null ? p === null ? n.tenantId : p : l;
+			if (m === null) {
+				u += 1, C.warn("billing reconcile: provider subscription names no tenant", { subscription: n.providerSubscriptionId });
+				continue;
+			}
+			if (t !== null && t.retiredAt !== null) {
+				u++, C.warn("billing reconcile: retired customer subscriptions require financial reconciliation", {
+					tenant: t.tenantId,
+					customer: t.providerCustomerId
+				});
+				continue;
+			}
+			if (n.providerCustomerId !== null && r.get(n.providerCustomerId) !== m && (yield* B(m, n.providerCustomerId), r.set(n.providerCustomerId, m), s.push({
+				_tag: "customerLinked",
+				tenantId: m,
+				providerCustomerId: n.providerCustomerId,
+				occurredAt: e
+			}), i.add(m)), T.has(n.status) && n.cancelAt === null && !c.has(m) && (yield* f(m))) {
+				C.error("billing reconcile: a closed tenant still has a paying subscription — closing it", {
+					tenant: m,
+					subscription: n.providerSubscriptionId
+				}), (yield* Y(m).pipe(y.map(() => !0), y.catch((e) => y.sync(() => (C.error("billing reconcile: closing a closed tenant failed — retried next run", {
+					tenant: m,
+					message: e.message
+				}), !1))))) && c.add(m), i.add(m);
+				continue;
+			}
+			if (c.has(m)) continue;
+			T.has(n.status) && a.set(m, (a.get(m) ?? 0) + 1);
+			let h = yield* N.stores.subscriptions.listByTenant(m);
+			Ie(h.find((e) => e.providerSubscriptionId === n.providerSubscriptionId), n) || (yield* G(m, n, e), s.push(Q(m, n, e)), i.add(m));
+			let g = n.plan;
+			if (g !== null && T.has(n.status)) {
+				let e = b.meteredPriceIdsFor(g).filter((e) => !n.priceIds.includes(e));
+				e.length > 0 && (yield* O(v.addSubscriptionPrices({
+					providerSubscriptionId: n.providerSubscriptionId,
+					priceIds: e
+				}), x), d += 1);
+			}
+		}
+		let p = 0, m = [];
+		for (let e of [
+			"active",
+			"trialing",
+			"pastDue",
+			"incomplete"
+		]) m.push(...yield* N.stores.subscriptions.listByStatus(e));
+		let h = [];
+		for (let t of m) {
+			if (o.has(t.providerSubscriptionId)) continue;
+			p += 1;
+			let n = yield* O(v.fetchSubscription(t.providerSubscriptionId), x);
+			if (n === null) {
+				h.push(t);
+				continue;
+			}
+			let r = {
+				...n,
+				providerSubscriptionId: t.providerSubscriptionId
+			};
+			yield* G(t.tenantId, r, e), s.push(Q(t.tenantId, r, e)), i.add(t.tenantId);
+		}
+		let g = h.length >= w && h.length * 2 >= m.length;
+		if (g) C.error("billing reconcile: the provider knows none of these live subscriptions — wrong account or provider? Nothing was canceled", {
+			unknown: h.length,
+			live: m.length,
+			provider: v.name
+		});
+		else for (let t of h) yield* N.stores.subscriptions.markCanceled(t.providerSubscriptionId), s.push(Q(t.tenantId, {
+			...t,
+			status: "canceled",
+			providerSubscriptionId: t.providerSubscriptionId
+		}, e)), i.add(t.tenantId);
+		let _ = [...a].filter(([, e]) => e > 1).map(([e]) => e);
+		for (let e of _) C.error("billing reconcile: tenant has more than one paying subscription — billed twice, resolve by hand", { tenant: e });
+		let S = {
+			checked: t.length + p,
+			corrected: [...i],
+			duplicates: _,
+			unattributed: u,
+			meteredItemsRestored: d,
+			closedTenants: [...c],
+			refusedUnknown: g ? h.length : 0,
+			events: s
+		};
+		return C.info("billing reconcile from provider", {
+			checked: S.checked,
+			corrected: S.corrected.length,
+			duplicates: _.length,
+			unattributed: u,
+			meteredItemsRestored: d,
+			closedTenants: S.closedTenants.length
+		}), yield* Fe(s), S;
+	}), Re = (e, t) => xe(e, { quantity: t }), $ = (e, t, n) => y.gen(function* () {
+		if (![
+			e,
+			t,
+			n
+		].every((e) => typeof e == "string" && e.length > 0 && e.length <= 191 && e.trim() === e && e.isWellFormed())) return yield* y.fail(u("Exact owned invoice reference identities are required."));
+		let r = N.stores, i = yield* I(), a = yield* r.customers.getByProviderCustomerId(t, i);
+		if (a === null || a.tenantId !== e || a.provider !== v.name) return yield* y.fail(u("Positive current or retained customer custody is required."));
+		let o = yield* r.historyWork.claim(a, n, A());
+		if (o.kind !== "claimed") return {
+			kind: o.kind,
+			work: o.work
+		};
+		let s = o.attempt, c = r.historyWork.hold(s, () => A().getTime());
+		return yield* y.gen(function* () {
+			if (N.stores !== r) return yield* y.fail(u("Billing stores changed before invoice reference dispatch.", !0));
+			let n = yield* J(e, o.work.providerInvoiceId, t).pipe(y.timeout("5 minutes"));
+			if (N.stores !== r) return yield* y.fail(u("Billing stores changed during invoice reference observation.", !0));
+			let i = yield* r.historyWork.observed(a, s, n, A());
+			return i === null || i.state !== "observed" && i.state !== "deferred" ? yield* y.fail(u("Invoice reference acknowledgement no longer owns its attempt.", !0)) : {
+				kind: i.state === "observed" ? "observed" : "deferred",
+				work: i
+			};
+		}).pipe(y.catch(() => y.gen(function* () {
+			return yield* r.historyWork.failed(a, s, A()), yield* y.fail(u("The invoice reference remains unconfirmed and retryable.", !0));
+		})), y.ensuring(y.sync(c)));
+	});
 	return {
 		service: {
-			subscription: ee,
-			plan: j,
-			entitlementStatus: A,
-			reconcileDunning: H,
-			dunningSweep: re,
-			checkEntitlement: te,
-			consumeEntitlement: ne,
-			reportUsage: N,
-			flushUsage: P,
-			startCheckout: L,
-			portalUrl: R,
-			applyEvent: ae,
-			changePlan: ce,
-			changeSeats: (e, t) => W(e, { quantity: t }),
-			previewChange: oe,
-			invoices: se,
-			cancelSubscription: q,
-			resumeSubscription: le,
-			closeAccount: J,
-			reconcileFromProvider: () => f.gen(function* () {
-				let e = w(), t = yield* x(d.listSubscriptions({}), m), n = yield* O.stores.customers.list(), r = new Map(n.map((e) => [e.providerCustomerId, e.tenantId])), i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Set(), s = [], c = /* @__PURE__ */ new Set(), l = /* @__PURE__ */ new Map(), u = 0, h = 0, y = (e) => {
-					let t = l.get(e);
-					return t === void 0 ? Y(e).pipe(f.tap((t) => f.sync(() => {
-						l.set(e, t);
-					}))) : f.succeed(t);
+			subscription: oe,
+			plan: ae,
+			entitlementStatus: ie,
+			reconcileDunning: K,
+			dunningSweep: ve,
+			checkEntitlement: ce,
+			consumeEntitlement: le,
+			reportUsage: ue,
+			reportUsageEvent: de,
+			flushUsage: fe,
+			startCheckout: pe,
+			portalUrl: me,
+			applyEvent: be,
+			changePlan: De,
+			changeSeats: Re,
+			previewChange: Se,
+			invoices: Ce,
+			invoiceSnapshot: Ee,
+			invoiceHistory: Te,
+			reconcileInvoice: J,
+			processInvoiceHistoryReference: $,
+			reconcileInvoiceHistory: () => y.gen(function* () {
+				let e = N.stores, t = () => N.stores === e ? y.void : y.fail(u("Billing stores changed during the invoice-history pass.", !0));
+				if (v.listInvoiceHistory === void 0 || v.fetchInvoiceSnapshot === void 0) return yield* y.fail(u("Complete account-owned invoice history and observations are required."));
+				let n = yield* I(), r = yield* e.historyProgress.account(n, A());
+				yield* t();
+				let i = yield* e.customers.inventory(n, {
+					...r.afterCustodyId === null ? {} : { afterCustodyId: r.afterCustodyId },
+					limit: 1
+				}), a = i.customers[0];
+				if (a === void 0) return yield* t(), {
+					kind: (r.afterCustodyId === null ? r : yield* e.historyProgress.advanceAccount(r, null, A())) === null ? "contended" : "idle",
+					customerCustodyId: null,
+					admittedPages: 0,
+					observed: 0,
+					deferred: 0,
+					busy: 0,
+					unconfirmed: 0
 				};
-				for (let n of t) {
-					o.add(n.providerSubscriptionId);
-					let t = n.tenantId ?? (n.providerCustomerId === null ? null : r.get(n.providerCustomerId) ?? null);
-					if (t === null) {
-						u += 1, g.warn("billing reconcile: provider subscription names no tenant", { subscription: n.providerSubscriptionId });
-						continue;
+				let o = yield* y.gen(function* () {
+					yield* t();
+					let n = yield* e.historyProgress.customer(a, A()), r = yield* e.historyJournal.begin(a), i = 0;
+					if (!r.exhausted) {
+						yield* t();
+						let n = yield* Te(a.tenantId, a.providerCustomerId, {
+							limit: 100,
+							...r.cursor === null ? {} : { cursor: r.cursor }
+						});
+						yield* t();
+						let o = yield* e.historyJournal.commitPage(r, n);
+						o === null ? r = yield* e.historyJournal.begin(a) : (r = o, i = 1);
 					}
-					if (v.has(n.status) && n.cancelAt === null && !c.has(t) && (yield* y(t))) {
-						g.error("billing reconcile: a closed tenant still has a paying subscription — closing it", {
-							tenant: t,
-							subscription: n.providerSubscriptionId
-						}), (yield* J(t).pipe(f.map(() => !0), f.catch((e) => f.sync(() => (g.error("billing reconcile: closing a closed tenant failed — retried next run", {
-							tenant: t,
-							message: e.message
-						}), !1))))) && c.add(t), i.add(t);
-						continue;
-					}
-					if (c.has(t)) continue;
-					v.has(n.status) && a.set(t, (a.get(t) ?? 0) + 1);
-					let l = yield* O.stores.subscriptions.listByTenant(t);
-					ue(l.find((e) => e.providerSubscriptionId === n.providerSubscriptionId), n) || (yield* I(t, n, e), s.push($(t, n, e)), i.add(t)), n.providerCustomerId !== null && r.get(n.providerCustomerId) !== t && (yield* O.stores.customers.upsert({
-						tenantId: t,
-						provider: d.name,
-						providerCustomerId: n.providerCustomerId
-					}), r.set(n.providerCustomerId, t), s.push({
-						_tag: "customerLinked",
-						tenantId: t,
-						providerCustomerId: n.providerCustomerId,
-						occurredAt: e
-					}), i.add(t));
-					let _ = n.plan;
-					if (_ !== null && v.has(n.status)) {
-						let e = p.meteredPriceIdsFor(_).filter((e) => !n.priceIds.includes(e));
-						e.length > 0 && (yield* x(d.addSubscriptionPrices({
-							providerSubscriptionId: n.providerSubscriptionId,
-							priceIds: e
-						}), m), h += 1);
+					let o = { ...n.cursors }, s = 0, c = 0, l = 0, u = 0;
+					for (let i of [
+						"unprepared",
+						"ready",
+						"working"
+					]) {
+						yield* t();
+						let d = n.walkId === r.id ? o[i] : null, f = yield* e.historyWork.pending(a, i, A(), {
+							limit: 1,
+							...d === null ? {} : { cursor: {
+								lane: i,
+								walkId: r.id,
+								afterId: d
+							} }
+						});
+						for (let e of f.entries) {
+							yield* t();
+							let n = yield* $(a.tenantId, a.providerCustomerId, e.reference.id).pipe(y.catch(() => y.succeed(null)));
+							n === null ? u++ : n.kind === "observed" ? s++ : n.kind === "deferred" ? c++ : l++;
+						}
+						o[i] = f.nextCursor?.afterId ?? null;
 					}
-				}
-				let b = 0, S = [];
-				for (let e of [
-					"active",
-					"trialing",
-					"pastDue",
-					"incomplete"
-				]) S.push(...yield* O.stores.subscriptions.listByStatus(e));
-				let C = [];
-				for (let t of S) {
-					if (o.has(t.providerSubscriptionId)) continue;
-					b += 1;
-					let n = yield* x(d.fetchSubscription(t.providerSubscriptionId), m);
-					if (n === null) {
-						C.push(t);
-						continue;
-					}
-					let r = {
-						...n,
-						providerSubscriptionId: t.providerSubscriptionId
+					yield* t();
+					let d = yield* e.historyProgress.advanceCustomer(n, {
+						walkId: r.id,
+						cursors: o
+					}, A());
+					return {
+						admittedPages: i,
+						observed: s,
+						deferred: c,
+						busy: l + +(d === null),
+						unconfirmed: u
 					};
-					yield* I(t.tenantId, r, e), s.push($(t.tenantId, r, e)), i.add(t.tenantId);
-				}
-				let T = C.length >= _ && C.length * 2 >= S.length;
-				if (T) g.error("billing reconcile: the provider knows none of these live subscriptions — wrong account or provider? Nothing was canceled", {
-					unknown: C.length,
-					live: S.length,
-					provider: d.name
-				});
-				else for (let t of C) yield* O.stores.subscriptions.markCanceled(t.providerSubscriptionId), s.push($(t.tenantId, {
-					...t,
-					status: "canceled",
-					providerSubscriptionId: t.providerSubscriptionId
-				}, e)), i.add(t.tenantId);
-				let E = [...a].filter(([, e]) => e > 1).map(([e]) => e);
-				for (let e of E) g.error("billing reconcile: tenant has more than one paying subscription — billed twice, resolve by hand", { tenant: e });
-				let D = {
-					checked: t.length + b,
-					corrected: [...i],
-					duplicates: E,
-					unattributed: u,
-					meteredItemsRestored: h,
-					closedTenants: [...c],
-					refusedUnknown: T ? C.length : 0,
-					events: s
+				}).pipe(y.catch(() => y.succeed({
+					admittedPages: 0,
+					observed: 0,
+					deferred: 0,
+					busy: 0,
+					unconfirmed: 1
+				})));
+				return yield* t(), {
+					kind: (yield* e.historyProgress.advanceAccount(r, i.nextCustodyId, A())) === null ? "contended" : "advanced",
+					customerCustodyId: a.id,
+					...o
 				};
-				return g.info("billing reconcile from provider", {
-					checked: D.checked,
-					corrected: D.corrected.length,
-					duplicates: E.length,
-					unattributed: u,
-					meteredItemsRestored: h,
-					closedTenants: D.closedTenants.length
-				}), yield* Z(s), D;
-			}),
-			syncCustomer: X,
-			syncTenant: Q
+			}).pipe(y.timeout("2 minutes"), y.mapError((t) => t instanceof e ? t : u("The bounded invoice-history pass timed out and remains retryable.", !0))),
+			cancelSubscription: Ae,
+			resumeSubscription: je,
+			closeAccount: Y,
+			reconcileFromProvider: Le,
+			syncCustomer: Pe,
+			syncTenant: Z
 		},
-		holder: O
+		holder: N
 	};
-}, T = (e) => p.succeed(t, e);
+}, j = (e) => b.succeed(t, e);
 //#endregion
-export { S as USAGE_KEY, C as USAGE_KEY_RULE, T as billingServiceLayer, w as buildBillingService, b as makeStoreHolder, y as periodKey };
+export { k as USAGE_KEY, te as USAGE_KEY_RULE, j as billingServiceLayer, A as buildBillingService, ee as makeStoreHolder, D as periodKey };