palbase 0.0.0-stage → 0.1.0

package/types/internal/src/modules/purchases.d.ts

@@ -0,0 +1,2944 @@
+import { type Reply, type Transport } from '../transport.js';
+/**
+ * What App Review needs to see of a product (the App Store's alone): without it the product is saved, but not sent to the App Store.
+ */
+export type AppReview = {
+    /**
+     * A note to the reviewer.
+     */
+    note?: string;
+    /**
+     * The id of an image the project uploaded: the product in the app.
+     */
+    screenshot?: string;
+};
+/**
+ * The project's App Store connection as the API shows it: never the key itself.
+ */
+export type AppleAccount = {
+    /**
+     * What the person has to do, when Apple refuses the key or the App Store does not report here.
+     */
+    action?: string;
+    /**
+     * The app's Apple ID, as App Store Connect names it: production purchases and notifications are taken once it is known (the stores module reads it when it binds the notification address).
+     */
+    app_apple_id?: number;
+    /**
+     * The app the key is connected for: one of this environment's registered iOS apps.
+     */
+    bundle_id?: string;
+    /**
+     * When Apple was last asked of the key.
+     */
+    checked_at?: string | null;
+    /**
+     * Whether an In-App Purchase key is connected.
+     */
+    connected: boolean;
+    /**
+     * When the key was connected.
+     */
+    connected_at?: string | null;
+    /**
+     * Who asked for the grant the key was connected with (the API key that asked).
+     */
+    connected_by?: string;
+    /**
+     * The key's issuer (the Apple account's team-wide id).
+     */
+    issuer_id?: string;
+    /**
+     * The key's id, as App Store Connect lists it: what tells it apart.
+     */
+    key_id?: string;
+    notifications?: AppleNotifications;
+    /**
+     * What Apple last said of the key: active (it takes it), refused (it no longer does: connect a new one).
+     */
+    status?: "active" | "refused";
+    xcode_certificate?: XcodeCertificate;
+};
+/**
+ * What names the customer to the App Store without saying who they are.
+ */
+export type AppleAccountToken = {
+    /**
+     * A UUID, the customer's for the connected app: pass it to StoreKit's purchase (Product.PurchaseOption.appAccountToken). The App Store's notifications carry it back, and the purchase is the customer's before their app reports it.
+     */
+    app_account_token: string;
+};
+/**
+ * What the stores module answered of a plan's App Store part once it was confirmed: absent until it answers.
+ */
+export type AppleCatalogResult = {
+    /**
+     * The app's Apple ID.
+     */
+    asc_app_id: number;
+    /**
+     * The app it was written for.
+     */
+    bundle_id: string;
+    /**
+     * Why it was not, as a whole.
+     */
+    error?: string;
+    /**
+     * Whether every step was written.
+     */
+    ok: boolean;
+    /**
+     * The plan.
+     */
+    plan_id: string;
+    /**
+     * Each step, as App Store Connect holds it.
+     */
+    steps: AppleStepResult[];
+};
+/**
+ * A one-time grant to connect an In-App Purchase key: the key goes from the person's browser (connect_url) or terminal (POST /purchases/apple/connect with the grant) straight to the module.
+ */
+export type AppleGrant = {
+    /**
+     * The page that takes the key from a browser. The grant rides in the URL's fragment, which a browser never sends to a server.
+     */
+    connect_url: string;
+    /**
+     * When the grant stops working.
+     */
+    expires_at: string;
+    /**
+     * The grant: spent by the first key Apple takes, or after 30 minutes.
+     */
+    grant: string;
+};
+/**
+ * The App Store's notification, as Apple signs and sends it: its signedPayload is verified, and what it signs is read.
+ */
+export type AppleNotification = {
+    /**
+     * The notification, signed by the App Store (JWS).
+     */
+    signedPayload: string;
+    [key: string]: unknown;
+};
+/**
+ * Where the App Store reports the app's purchases, and whether it does.
+ */
+export type AppleNotifications = {
+    /**
+     * Whether the stores module set it as the app's notification address in App Store Connect (both environments).
+     */
+    bound: boolean;
+    /**
+     * When it was bound; null until then.
+     */
+    bound_at: string | null;
+    /**
+     * Why it is not bound, or cannot be verified, as the stores module or Apple said it.
+     */
+    error?: string;
+    /**
+     * The address: POST /purchases/webhooks/apple of this environment, one for Apple's sandbox and production.
+     */
+    url: string;
+    /**
+     * When the App Store's TEST notification, asked for once it was bound, arrived: the address is reached; null until then.
+     */
+    verified_at: string | null;
+};
+/**
+ * The App Store's price point a step's price was resolved to, in the base currency's storefront.
+ */
+export type ApplePrice = {
+    /**
+     * Its currency.
+     */
+    currency: string;
+    /**
+     * What the customer pays there, as App Store Connect writes it (9.99).
+     */
+    customer_price: string;
+    /**
+     * The storefront (USA).
+     */
+    territory: string;
+};
+/**
+ * Whether the environment sells in the App Store, check by check.
+ */
+export type AppleReadiness = {
+    /**
+     * The checks, in a fixed order.
+     */
+    checks: ReadinessCheck[];
+    /**
+     * Every check that is not informational holds.
+     */
+    ready: boolean;
+};
+/**
+ * One step of a plan's App Store part, as App Store Connect holds it now.
+ */
+export type AppleStepResult = {
+    /**
+     * App Store Connect's own id of what was made.
+     */
+    apple_id?: string;
+    /**
+     * Why the step was not written, as App Store Connect said it.
+     */
+    error?: string;
+    /**
+     * The step's op.
+     */
+    op: string;
+    price?: ApplePrice;
+    /**
+     * Its state at App Store Connect (MISSING_METADATA, READY_TO_SUBMIT, WAITING_FOR_REVIEW, APPROVED …).
+     */
+    state?: string;
+    /**
+     * The App Store's product id (or the subscription group's reference name).
+     */
+    store_id: string;
+};
+/**
+ * What StoreKit gave the customer's app.
+ */
+export type AppleTransactionReport = {
+    /**
+     * The reporting device's AppStore.deviceVerificationID (its uuidString). StoreKit signs each transaction for one device: its deviceVerification is the SHA-384 of its deviceVerificationNonce and this id, both lowercase. A restore moves a purchase another customer has only when the transaction was signed for this device; without it, a restore moves none.
+     */
+    device_verification_id?: string;
+    /**
+     * The customer asked to restore their purchases: each purchase moves to them from the customer that has it — only with a transaction StoreKit signed for this device (`device_verification_id`), never an account's by a guest's restore, and one purchase 3 times in 30 days at most; one that stays is answered (403, 409) once the rest is applied. Without it (false, the default), a purchase another customer has stays theirs.
+     */
+    restore?: boolean;
+    /**
+     * The transactions, as StoreKit 2 signs each (Transaction.jwsRepresentation): a purchase just made, Transaction.updates, or every one of currentEntitlements on a restore.
+     */
+    transactions: string[];
+};
+/**
+ * What the Stripe account holds of the catalog once a plan was written, read back from Stripe; null maps when the plan failed before reading it.
+ */
+export type AppliedStripe = {
+    /**
+     * The prices, by lookup key.
+     */
+    prices: ({
+        [key: string]: StripePrice;
+    }) | null;
+    /**
+     * The products, by the catalog's product key.
+     */
+    products: ({
+        [key: string]: StripeProduct;
+    }) | null;
+};
+/**
+ * The project's one definition of what it sells: each product once — its kind, plans and prices, its names in each language, the channels it is sold on and what it gives. Read strictly: a field it does not know is refused (400 `invalid_catalog`). What a store's rules allow is not part of the shape: POST /purchases/catalog/validate says it, problem by problem.
+ */
+export type Catalog = {
+    /**
+     * The language every product names itself in (a tag such as en or pt-BR); the others are translations. Stripe keeps one name: this one's.
+     */
+    base_locale: string;
+    /**
+     * The kinds of credit the project counts ("tokens").
+     */
+    credits: CatalogCredit[];
+    /**
+     * What a customer has or not ("pro").
+     */
+    entitlements: CatalogEntitlement[];
+    /**
+     * The metered quotas ("ai_requests a month").
+     */
+    limits: CatalogLimit[];
+    /**
+     * The products.
+     */
+    products: Product[];
+};
+/**
+ * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store part.
+ */
+export type CatalogAppliedEvent = {
+    /**
+     * The plan.
+     */
+    plan_id: string;
+    /**
+     * Its revision.
+     */
+    revision: number;
+    /**
+     * How it ended.
+     */
+    status: "applied" | "failed";
+    /**
+     * The store written.
+     */
+    store: "stripe" | "app_store";
+};
+/**
+ * purchases.catalog.changed: a new revision of the catalog was saved; plans of older ones went stale.
+ */
+export type CatalogChangedEvent = {
+    /**
+     * The new revision.
+     */
+    revision: number;
+};
+/**
+ * A kind of credit the project counts.
+ */
+export type CatalogCredit = {
+    /**
+     * Whether the customer's own app may spend its credits with the publishable key — for an app with no backend; off, only the secret key spends.
+     */
+    client_spend?: boolean;
+    /**
+     * Its key: lowercase letters, digits and _, starting with a letter, at most 40.
+     */
+    key: string;
+    /**
+     * The balance under which the project's backend hears `purchases.credits.low` (0 or absent: never).
+     */
+    low_at?: number;
+    /**
+     * Its name, for people.
+     */
+    name: string;
+};
+/**
+ * The catalog as saved: a revision.
+ */
+export type CatalogDoc = {
+    catalog: Catalog;
+    /**
+     * When the revision was saved; absent before the first.
+     */
+    created_at?: string | null;
+    /**
+     * Who saved it (the API key that asked).
+     */
+    created_by?: string;
+    /**
+     * The revision: 0 before the first save, then one more with each.
+     */
+    revision: number;
+};
+/**
+ * Something a customer has or not.
+ */
+export type CatalogEntitlement = {
+    /**
+     * Its key: lowercase letters, digits and _, starting with a letter, at most 40.
+     */
+    key: string;
+    /**
+     * Its name, for people.
+     */
+    name: string;
+};
+/**
+ * A metered quota, counted in a window.
+ */
+export type CatalogLimit = {
+    /**
+     * What a customer gets with nothing that gives more.
+     */
+    free: number;
+    /**
+     * Its key: lowercase letters, digits and _, starting with a letter, at most 40.
+     */
+    key: string;
+    /**
+     * Its name, for people.
+     */
+    name: string;
+    overflow?: LimitOverflow;
+    /**
+     * What it is counted in: calendar_month, calendar_day (both from midnight in the project's time zone) or billing_period (the period of the subscription that gives it; a calendar month without one).
+     */
+    window: string;
+};
+/**
+ * What bringing the stores to a revision of the catalog writes, store by store, before anything is written.
+ */
+export type CatalogPlan = {
+    apple: StorePlan;
+    apple_result?: AppleCatalogResult;
+    /**
+     * When it was written.
+     */
+    applied_at?: string | null;
+    /**
+     * When it was made.
+     */
+    created_at: string;
+    /**
+     * Why it failed, as Stripe said it.
+     */
+    error?: string;
+    google: StorePlan;
+    /**
+     * The plan's id.
+     */
+    id: string;
+    /**
+     * What the check found of the revision (warnings: a saved revision has no other).
+     */
+    problems: CatalogProblem[];
+    result?: AppliedStripe;
+    /**
+     * The revision it was made from.
+     */
+    revision: number;
+    /**
+     * planned (waits on a person), stale (the catalog changed since), applying, applied, failed (`error` says why), declined.
+     */
+    status: "planned" | "stale" | "applying" | "applied" | "failed" | "declined";
+    /**
+     * The Stripe part, against what the account held when the plan was made: the one confirmed here. Null when no Stripe account is connected.
+     */
+    stripe: StorePlan | null;
+};
+/**
+ * One thing wrong with a catalog.
+ */
+export type CatalogProblem = {
+    /**
+     * The store whose rule it breaks: ios, android or web; absent for every channel.
+     */
+    channel?: string;
+    /**
+     * What it is (too_long, unsupported_period, unknown_entitlement, review_missing …).
+     */
+    code: string;
+    /**
+     * What to do about it.
+     */
+    message: string;
+    /**
+     * Where it is (products[0].channels.ios.locales.en.name).
+     */
+    path: string;
+    /**
+     * A warning does not stop a save: the product is sold without what the channel lacks.
+     */
+    warning?: boolean;
+};
+/**
+ * What a catalog's check found.
+ */
+export type CatalogValidation = {
+    /**
+     * Every problem, by path.
+     */
+    problems: CatalogProblem[];
+    /**
+     * Whether it can be saved: no problem that is not a warning.
+     */
+    valid: boolean;
+};
+/**
+ * What a product is on one store beyond what it is everywhere.
+ */
+export type Channel = {
+    /**
+     * Shares the purchase with the buyer's family (the App Store's alone).
+     */
+    family_shareable?: boolean;
+    /**
+     * Its own text, field by field, in each language named: where the store's limits or audience call for it (Apple's 30-character names, Google's benefits).
+     */
+    locales?: {
+        [key: string]: Locale;
+    };
+    /**
+     * Its own price for a plan, by the plan's key: a web price without the stores' commission.
+     */
+    prices?: {
+        [key: string]: Price;
+    };
+    review?: AppReview;
+    /**
+     * Stripe's tax code for the product (the web's alone).
+     */
+    tax_code?: string;
+};
+/**
+ * A Stripe Checkout session to send the customer to.
+ */
+export type Checkout = {
+    /**
+     * Stripe's session id.
+     */
+    session_id: string;
+    /**
+     * Where the customer pays.
+     */
+    url: string;
+};
+/**
+ * The error envelope of a refused checkout, with where the customer already has it when that is why (`already_entitled`): buying it again would charge twice for one thing.
+ */
+export type CheckoutConflictError = {
+    /**
+     * Machine-readable error code (snake_case)
+     */
+    error: string;
+    /**
+     * Human-readable explanation
+     */
+    error_description: string;
+    /**
+     * The catalog's product they have — the same, or one of its group: with `already_entitled`, absent otherwise.
+     */
+    product?: string;
+    /**
+     * Correlation ID for log/audit lookup
+     */
+    request_id: string;
+    /**
+     * Seconds to wait before retrying; present on a refusal that ends with time.
+     */
+    retry_after?: number;
+    /**
+     * HTTP status code (mirrors the response status)
+     */
+    status: number;
+    /**
+     * Where they have it: with `already_entitled`, absent otherwise.
+     */
+    store?: "app_store" | "play_store" | "stripe";
+};
+/**
+ * What the signed-in customer buys on the web.
+ */
+export type CheckoutRequest = {
+    /**
+     * Where Stripe sends the customer back when they do not pay; the same rule.
+     */
+    cancel_url: string;
+    /**
+     * Its plan.
+     */
+    plan: string;
+    /**
+     * The catalog's product (sold on the web).
+     */
+    product: string;
+    /**
+     * Where Stripe sends the customer back once paid: a registered web app's origin, or a native app's own scheme.
+     */
+    success_url: string;
+};
+/**
+ * An In-App Purchase key handed over with a grant, for one of the environment's iOS apps.
+ */
+export type ConnectAppleKeyRequest = {
+    /**
+     * The app the key is for: one of this environment's registered iOS apps.
+     */
+    bundle_id: string;
+    /**
+     * The grant a connect link carries.
+     */
+    grant: string;
+    /**
+     * The key's issuer: App Store Connect → Users and Access → Integrations → In-App Purchase.
+     */
+    issuer_id: string;
+    /**
+     * The key's id (10 capital letters and digits).
+     */
+    key_id: string;
+    /**
+     * The key's .p8 file as Apple let it be downloaded (SubscriptionKey_<key id>.p8: PEM, PKCS#8). An App Store Connect API key is not this key.
+     */
+    private_key: string;
+};
+/**
+ * A Stripe restricted key handed over with a grant.
+ */
+export type ConnectStripeKeyRequest = {
+    /**
+     * The grant a connect link carries.
+     */
+    grant: string;
+    /**
+     * A restricted key made for Palbase (rk_live_… or rk_test_…) that may read products, prices, customers, Checkout Sessions, subscriptions, invoices, payment intents and charges, and write webhook endpoints. An unrestricted secret key is refused: it can do anything on the account.
+     */
+    key: string;
+};
+/**
+ * A customer's balance in one credit.
+ */
+export type CreditBalance = {
+    /**
+     * What a spend can take now: the balance less what open holds keep.
+     */
+    available: number;
+    /**
+     * What the live lots hold less what the customer owes: below zero while they owe (a refund took back credits already spent).
+     */
+    balance: number;
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * What the customer owes: the next credits pay it first.
+     */
+    debt: number;
+    /**
+     * When credits next expire; null when none do.
+     */
+    next_expiry: string | null;
+    /**
+     * What open holds keep.
+     */
+    reserved: number;
+};
+/**
+ * What a spend took from one lot.
+ */
+export type CreditConsumption = {
+    /**
+     * How much.
+     */
+    amount: number;
+    /**
+     * The lot; absent for debt.
+     */
+    lot_id?: string;
+    /**
+     * Where the lot came from: purchase (credits bought), period (a subscription's), promotion, support; debt — what a refund in between left uncovered.
+     */
+    source: "purchase" | "period" | "promotion" | "support" | "debt";
+};
+/**
+ * A page of a customer's credit movements, newest first.
+ */
+export type CreditEntries = {
+    /**
+     * The movements.
+     */
+    entries: CreditEntry[];
+    /**
+     * Goes on to the next page (send it as `cursor`); absent on the last page.
+     */
+    next_cursor?: string;
+};
+/**
+ * One movement of a customer's credits.
+ */
+export type CreditEntry = {
+    /**
+     * Who moved them: the wallet itself (`wallet`: a spend, an expiry, a merge), a store (`store`, `store:<environment>`), a key (`key:<id>`) or a user (`user:<id>`).
+     */
+    actor: string;
+    /**
+     * When.
+     */
+    created_at: string;
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * What it changed the debt by: above zero a refund took back credits already spent, below zero the debt was paid or forgiven.
+     */
+    debt_delta: number;
+    /**
+     * What it changed the balance by: above zero it gave, below zero it took.
+     */
+    delta: number;
+    /**
+     * The movement's id: newer ones are larger.
+     */
+    id: number;
+    /**
+     * What moved them: grant (bought, a period's, a promotion, support), spend, shortfall (a refund took back more than was left: the rest is owed), revoke (a refund or chargeback took them back), unrevoke (that was reversed), expire, reversal (a spend handed back), merge (a guest's went to the account), forgive (support forgave a debt).
+     */
+    kind: "grant" | "spend" | "shortfall" | "revoke" | "unrevoke" | "expire" | "reversal" | "merge" | "forgive";
+    /**
+     * The lot it moved, when it moved one.
+     */
+    lot_id?: string;
+    /**
+     * Why, when a person said it (a grant's, a forgiveness's).
+     */
+    reason?: string;
+    /**
+     * The spend it was part of, when it was one's.
+     */
+    spend_id?: string;
+};
+/**
+ * A debt forgiven.
+ */
+export type CreditForgiveRequest = {
+    /**
+     * How much of the debt, at most all of it; absent or 0: all of it.
+     */
+    amount?: number;
+    /**
+     * The credit (a key of the catalog's credits).
+     */
+    credits: string;
+    /**
+     * Why: the record.
+     */
+    reason: string;
+};
+/**
+ * What a forgiveness took off a debt, and the account it left.
+ */
+export type CreditForgiven = {
+    /**
+     * What a spend can take now.
+     */
+    available: number;
+    /**
+     * The balance after: what the live lots hold less what is still owed.
+     */
+    balance: number;
+    /**
+     * The credit.
+     */
+    credits: string;
+    /**
+     * What is still owed.
+     */
+    debt: number;
+    /**
+     * What it took off: 0 when the customer owed nothing.
+     */
+    forgiven: number;
+};
+/**
+ * Credits given to a customer.
+ */
+export type CreditGrantRequest = {
+    /**
+     * How many.
+     */
+    amount: number;
+    /**
+     * The credit (a key of the catalog's credits).
+     */
+    credits: string;
+    /**
+     * When they expire, in the future; absent: never.
+     */
+    expires_at?: string | null;
+    /**
+     * Why: the record.
+     */
+    reason: string;
+    /**
+     * Why, in kind.
+     */
+    source: "promotion" | "support";
+};
+/**
+ * A lot of credits, as granted.
+ */
+export type CreditLot = {
+    /**
+     * When it was given.
+     */
+    created_at: string;
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * Its customer.
+     */
+    customer: string;
+    /**
+     * When it expires; absent: never.
+     */
+    expires_at?: string | null;
+    /**
+     * The lot's id.
+     */
+    id: string;
+    /**
+     * What it gave.
+     */
+    original: number;
+    /**
+     * What is left of it (less what paid a debt).
+     */
+    remaining: number;
+    /**
+     * What was taken back of it.
+     */
+    revoked: number;
+    /**
+     * Where it came from.
+     */
+    source: "purchase" | "period" | "promotion" | "support";
+    /**
+     * What made it (a grant's: grant:<customer>:<Idempotency-Key>).
+     */
+    source_ref: string;
+};
+/**
+ * A spend or a hold of credits.
+ */
+export type CreditSpendRequest = {
+    /**
+     * How many credits or units.
+     */
+    amount: number;
+    /**
+     * The credit spent (a key of the catalog's credits).
+     */
+    credits: string;
+    /**
+     * The caller's own notes, kept with the spend (a JSON object, 2048 bytes at most).
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    /**
+     * A hold's life: it runs out after it (600 unless said). A spend in one step holds nothing and refuses it (400 `ttl_for_holds`).
+     */
+    ttl_seconds?: number;
+};
+/**
+ * purchases.credits.depleted: a customer's balance of a credit came down to nothing (or below).
+ */
+export type CreditsDepletedEvent = {
+    /**
+     * What is available now.
+     */
+    available: number;
+    /**
+     * The balance now.
+     */
+    balance: number;
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * What the customer owes now.
+     */
+    debt: number;
+    /**
+     * The low mark, when the same change crossed it.
+     */
+    low_at?: number;
+};
+/**
+ * purchases.credits.low: a customer's balance of a credit fell under its low mark (the catalog's low_at); told once, until it is back above.
+ */
+export type CreditsLowEvent = {
+    /**
+     * What is available now.
+     */
+    available: number;
+    /**
+     * The balance now.
+     */
+    balance: number;
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * What the customer owes now.
+     */
+    debt: number;
+    /**
+     * The low mark.
+     */
+    low_at: number;
+};
+/**
+ * purchases.customer.changed: what a customer has changed — a purchase, a renewal or its end, a refund, a grant, credits or quota used, a merge — and their revision rose. Realtime carries it to the customer's apps, which read GET /purchases/me again.
+ */
+export type CustomerChangedEvent = {
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * The customer's new revision.
+     */
+    revision: number;
+};
+/**
+ * purchases.customer.erased: a deleted user's purchases record was erased (and the guests merged into them); their id is never a customer again.
+ */
+export type CustomerErasedEvent = {
+    /**
+     * The customer.
+     */
+    customer_id: string;
+};
+/**
+ * Everything a customer has: the one answer every app of the project reads, whatever store a purchase was made in.
+ */
+export type CustomerInfo = {
+    /**
+     * Their balance in every credit they have one in.
+     */
+    credits: CreditBalance[];
+    /**
+     * The customer: the user's id.
+     */
+    customer_id: string;
+    /**
+     * Every entitlement the customer has or had, by key.
+     */
+    entitlements: {
+        [key: string]: EntitlementInfo;
+    };
+    /**
+     * Whether the user is a guest (anonymous): what a guest buys moves to the account it signs in to.
+     */
+    guest: boolean;
+    /**
+     * Their use of every limit of the catalog.
+     */
+    limits: LimitUse[];
+    /**
+     * Their one-time purchases, oldest first.
+     */
+    purchases: PurchaseInfo[];
+    /**
+     * The time it was computed at: what was active is as of then.
+     */
+    requested_at: string;
+    /**
+     * Rises with every change of what the customer has (0: nothing yet). The customer's apps join the realtime channel `purchases:<project ref>:<user id>` — theirs alone, read-only — whose state and `changed` broadcast carry `{"revision": N}`: a revision above the one read means reading GET /purchases/me again. `purchases.customer.changed` carries it to the project's webhooks.
+     */
+    revision: number;
+    /**
+     * Their subscriptions and non-renewing periods, oldest first.
+     */
+    subscriptions: SubscriptionInfo[];
+};
+/**
+ * purchases.customer.merged: a guest's purchases, grants, credits and quota use went to the account it signed in to; the guest's id points to the account from then on.
+ */
+export type CustomerMergedEvent = {
+    /**
+     * The guest.
+     */
+    from: string;
+    /**
+     * The account.
+     */
+    into: string;
+};
+/**
+ * purchases.entitlement.changed: an entitlement of a customer turned on or off.
+ */
+export type EntitlementChangedEvent = {
+    /**
+     * Whether the customer has it now.
+     */
+    active: boolean;
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * The entitlement.
+     */
+    entitlement: string;
+    /**
+     * When it ends; null for life (or off).
+     */
+    expires_at: string | null;
+    /**
+     * Whether a store's test purchase gives it.
+     */
+    is_sandbox: boolean;
+    /**
+     * The catalog's product that gives it; empty for a grant, or once nothing gives it.
+     */
+    product: string;
+    /**
+     * Where it comes from now: app_store, play_store, stripe, promotional; empty once nothing gives it.
+     */
+    store: string;
+};
+/**
+ * An entitlement as the customer has it: from the source that gives it longest (one for life wins; a real purchase over a test one).
+ */
+export type EntitlementInfo = {
+    /**
+     * Whether the customer has it now.
+     */
+    active: boolean;
+    /**
+     * The store could not charge the renewal: the customer keeps access in its grace period.
+     */
+    billing_issue: boolean;
+    /**
+     * When it ends; null for life.
+     */
+    expires_at: string | null;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    manage?: Management;
+    /**
+     * How the customer has it.
+     */
+    ownership: "purchased";
+    /**
+     * normal, trial (a free trial), or promotional (a grant).
+     */
+    period_type: "normal" | "trial" | "promotional";
+    /**
+     * Its plan.
+     */
+    plan?: string;
+    /**
+     * The catalog's product that gives it.
+     */
+    product?: string;
+    /**
+     * Everything that gives it, active ones first.
+     */
+    sources: EntitlementSource[];
+    /**
+     * Where it comes from.
+     */
+    store: "app_store" | "play_store" | "stripe" | "promotional";
+    /**
+     * Whether it renews.
+     */
+    will_renew: boolean;
+};
+/**
+ * One thing that gives an entitlement.
+ */
+export type EntitlementSource = {
+    /**
+     * Whether it gives the entitlement now.
+     */
+    active: boolean;
+    /**
+     * When it ends; null for life.
+     */
+    expires_at: string | null;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    /**
+     * The catalog's product.
+     */
+    product?: string;
+    /**
+     * Where it comes from: a store, or promotional (a grant).
+     */
+    store: "app_store" | "play_store" | "stripe" | "promotional";
+    /**
+     * Whether it renews.
+     */
+    will_renew: boolean;
+};
+export type ErrorResponse = {
+    /**
+     * Machine-readable error code (snake_case)
+     */
+    error: string;
+    /**
+     * Human-readable explanation
+     */
+    error_description: string;
+    /**
+     * Correlation ID for log/audit lookup
+     */
+    request_id: string;
+    /**
+     * Seconds to wait before retrying; present on a refusal that ends with time.
+     */
+    retry_after?: number;
+    /**
+     * HTTP status code (mirrors the response status)
+     */
+    status: number;
+};
+/**
+ * A granted (promotional) entitlement.
+ */
+export type GrantInfo = {
+    /**
+     * Its customer.
+     */
+    customer_id: string;
+    /**
+     * The entitlement.
+     */
+    entitlement: string;
+    /**
+     * When it ends; null for life.
+     */
+    expires_at: string | null;
+    /**
+     * Who gave it (the API key).
+     */
+    granted_by: string;
+    /**
+     * The grant's id.
+     */
+    id: string;
+    /**
+     * Why.
+     */
+    reason: string;
+    /**
+     * When it was revoked.
+     */
+    revoked_at: string | null;
+    /**
+     * When it started.
+     */
+    starts_at: string;
+};
+/**
+ * An entitlement given to a customer.
+ */
+export type GrantRequest = {
+    /**
+     * The catalog's entitlement.
+     */
+    entitlement: string;
+    /**
+     * When it ends, in the future; absent or null for life.
+     */
+    expires_at?: string | null;
+    /**
+     * Why: the record.
+     */
+    reason: string;
+};
+/**
+ * A subscription plan's introductory offer: once per customer, across every channel.
+ */
+export type IntroOffer = {
+    /**
+     * How long it lasts, an ISO 8601 duration (the App Store's free trials: P3D, P1W, P2W, P1M, P2M, P3M, P6M, P1Y).
+     */
+    duration: string;
+    /**
+     * free_trial, pay_as_you_go (a price for a number of periods) or pay_up_front (one price for the whole offer; not on the web).
+     */
+    mode: string;
+    /**
+     * How many periods pay_as_you_go lasts.
+     */
+    periods?: number;
+    /**
+     * A paid offer's price, in the plan's currency's minor units; a free trial has none.
+     */
+    price?: number | null;
+};
+/**
+ * More of a limit, in the window it is in now.
+ */
+export type LimitGrantRequest = {
+    /**
+     * How many units more.
+     */
+    amount: number;
+    /**
+     * Why: the record.
+     */
+    reason: string;
+    /**
+     * Why, in kind.
+     */
+    source: "promotion" | "support";
+};
+/**
+ * Past the limit, a unit is spent in credits instead of refused.
+ */
+export type LimitOverflow = {
+    /**
+     * The credit spent (a key of the catalog's credits).
+     */
+    currency: string;
+    /**
+     * How many credits a unit costs.
+     */
+    per_unit: number;
+};
+/**
+ * A customer's own limit: what each window allows them, in place of what their products give.
+ */
+export type LimitOverrideRequest = {
+    /**
+     * When it ends, in the future; absent: until it is cleared.
+     */
+    expires_at?: string | null;
+    /**
+     * What a window allows them.
+     */
+    max: number;
+    /**
+     * Why: the record.
+     */
+    reason: string;
+};
+/**
+ * A customer's use of a limit in its current window.
+ */
+export type LimitUse = {
+    /**
+     * The limit.
+     */
+    limit: string;
+    /**
+     * What the window allows them: the largest any product they hold gives, or the free tier — their own limit instead when the project set one — and what was granted them in the window on top.
+     */
+    max: number;
+    /**
+     * What is left.
+     */
+    remaining: number;
+    /**
+     * What open holds keep.
+     */
+    reserved: number;
+    /**
+     * When the window ends.
+     */
+    resets_at: string;
+    /**
+     * What they used.
+     */
+    used: number;
+};
+/**
+ * A product's text in one language.
+ */
+export type Locale = {
+    /**
+     * What it gives, line by line (Google Play lists 4, of 40 characters at most).
+     */
+    benefits?: string[];
+    /**
+     * Its description (the App Store shows 45 characters at most, Google Play 200).
+     */
+    description?: string;
+    /**
+     * Its name (the App Store shows 2 to 30 characters, Google Play 55 at most).
+     */
+    name?: string;
+};
+/**
+ * Where a subscription is managed: where it was bought.
+ */
+export type Management = {
+    /**
+     * The store.
+     */
+    store: "app_store" | "play_store" | "stripe";
+    /**
+     * The store's page for it; absent for Stripe, whose portal is opened on request (POST /purchases/stripe/portal).
+     */
+    url?: string;
+};
+/**
+ * A guest's proof that it may hand its purchases over.
+ */
+export type MergeGrant = {
+    /**
+     * When it stops working: 5 minutes, a sign-in.
+     */
+    expires_at: string;
+    /**
+     * The proof: spent with the account's session.
+     */
+    grant: string;
+};
+/**
+ * A guest's proof, spent with the account's session.
+ */
+export type MergeRequest = {
+    /**
+     * The proof the guest asked for.
+     */
+    grant: string;
+};
+/**
+ * A product on sale.
+ */
+export type Offering = {
+    channels: OfferingChannels;
+    /**
+     * What it gives.
+     */
+    entitlements: string[];
+    /**
+     * A subscription's group.
+     */
+    group?: string;
+    /**
+     * The catalog's product key.
+     */
+    key: string;
+    /**
+     * A subscription's level in its group.
+     */
+    tier?: number;
+    /**
+     * Its kind.
+     */
+    type: "subscription" | "non_consumable" | "consumable" | "non_renewing";
+};
+/**
+ * A product as one channel sells it.
+ */
+export type OfferingChannel = {
+    /**
+     * Its text in every language it has, as the channel shows it.
+     */
+    locales: {
+        [key: string]: Locale;
+    };
+    /**
+     * Its plans, with the channel's price.
+     */
+    plans: OfferingPlan[];
+};
+/**
+ * The channels a product is sold on: only those.
+ */
+export type OfferingChannels = {
+    android?: OfferingChannel;
+    ios?: OfferingChannel;
+    web?: OfferingChannel;
+};
+/**
+ * A plan with the id the channel's store sells it by.
+ */
+export type OfferingPlan = {
+    /**
+     * Google Play's base plan, for a subscription.
+     */
+    base_plan_id?: string;
+    /**
+     * A non-renewing product's duration.
+     */
+    duration?: string;
+    intro?: IntroOffer;
+    /**
+     * The catalog's plan key.
+     */
+    key: string;
+    /**
+     * A subscription's period.
+     */
+    period?: string;
+    price: Price;
+    /**
+     * What the store sells it by: the App Store's product id, Google Play's product id, Stripe's price lookup key.
+     */
+    store_id: string;
+};
+/**
+ * The paywall's catalog: the products on sale.
+ */
+export type Offerings = {
+    /**
+     * The products, each on the channels it is sold on.
+     */
+    products: Offering[];
+    /**
+     * The catalog's revision.
+     */
+    revision: number;
+};
+/**
+ * What a quota spend took in credits past its limit.
+ */
+export type OverflowReceipt = {
+    /**
+     * What is available of it after.
+     */
+    available_after: number;
+    /**
+     * The credit's balance after.
+     */
+    balance_after: number;
+    /**
+     * Credits taken.
+     */
+    committed: number;
+    /**
+     * What it took, lot by lot.
+     */
+    consumed: CreditConsumption[];
+    /**
+     * The credit.
+     */
+    currency: string;
+    /**
+     * Credits held.
+     */
+    held: number;
+    /**
+     * What a unit cost.
+     */
+    per_unit: number;
+    /**
+     * Credits handed back.
+     */
+    reversed: number;
+    /**
+     * How many units went past the limit.
+     */
+    units: number;
+};
+/**
+ * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the App Store purchases of the Apple ID it was made with.
+ */
+export type OwnershipTransferredEvent = {
+    /**
+     * The purchase's id in the ledger.
+     */
+    chain_id: string;
+    /**
+     * Who had it.
+     */
+    from_customer_id: string;
+    /**
+     * The catalog's product; empty when unmapped.
+     */
+    product: string;
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+    /**
+     * Who has it now.
+     */
+    to_customer_id: string;
+    /**
+     * How.
+     */
+    via: "restore";
+};
+/**
+ * How a product is paid for.
+ */
+export type Plan = {
+    /**
+     * A non-renewing product's duration, an ISO 8601 duration such as P1M.
+     */
+    duration?: string;
+    intro?: IntroOffer;
+    /**
+     * Its key: lowercase letters, digits and _, starting with a letter.
+     */
+    key: string;
+    /**
+     * A subscription's billing period, an ISO 8601 duration: the App Store sells by P1W, P1M, P2M, P3M, P6M, P1Y; Google Play adds P4W, P4M, P8M; Stripe bills at most once a year.
+     */
+    period?: string;
+    price: Price;
+};
+/**
+ * A confirmation, with the hash of the plan shown.
+ */
+export type PlanConfirmation = {
+    /**
+     * The Stripe part's hash; with no Stripe account connected, the App Store part's.
+     */
+    hash: string;
+};
+/**
+ * One write a store will get to come to the catalog.
+ */
+export type PlanStep = {
+    /**
+     * What it writes, as the store names it.
+     */
+    fields?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Whether it makes something the store never lets go of: a product id at Apple or Google stays taken even once deleted.
+     */
+    irreversible: boolean;
+    /**
+     * What the person should know of it: how a price is resolved, why it waits.
+     */
+    note?: string;
+    /**
+     * What it does: create_product, update_product, create_price (Stripe); create_subscription_group, create_subscription, create_in_app_purchase (the App Store); create_subscription, create_onetime_product (Google Play).
+     */
+    op: string;
+    /**
+     * The catalog's plan.
+     */
+    plan?: string;
+    /**
+     * The catalog's product.
+     */
+    product: string;
+    /**
+     * The store's id of what it writes.
+     */
+    store_id?: string;
+};
+/**
+ * Where Stripe's portal sends the customer back.
+ */
+export type PortalRequest = {
+    /**
+     * A registered web app's origin, or a native app's own scheme.
+     */
+    return_url: string;
+};
+/**
+ * Stripe's customer portal, opened for the customer.
+ */
+export type PortalSession = {
+    /**
+     * Where to send the customer.
+     */
+    url: string;
+};
+/**
+ * The one price entered: each store prices the other currencies its own way (Apple's price points, Google's conversion, Stripe's), except those set by hand.
+ */
+export type Price = {
+    /**
+     * The amount in the currency's minor units (999 is 9.99).
+     */
+    amount: number;
+    /**
+     * Its ISO 4217 currency (USD).
+     */
+    currency: string;
+    /**
+     * Amounts set by hand in other currencies, in their minor units.
+     */
+    overrides?: {
+        [key: string]: number;
+    };
+};
+/**
+ * One thing sold, on every channel it names.
+ */
+export type Product = {
+    /**
+     * Where it is sold — ios (the App Store), android (Google Play), web (Stripe) — each with what is its own there; {} when it is sold there as it is.
+     */
+    channels: {
+        [key: string]: Channel;
+    };
+    credits?: ProductCredits;
+    /**
+     * The entitlements it gives (a consumable gives none).
+     */
+    entitlements?: string[];
+    /**
+     * A subscription's group: the subscriptions a customer can move between (Apple's subscription group, the plans a Stripe customer can switch to). The App Store sells every subscription in one.
+     */
+    group?: string;
+    /**
+     * Its key: lowercase letters, digits and _, starting with a letter, at most 40. The stores know a plan of it as <product>.<plan> (40 characters at most).
+     */
+    key: string;
+    /**
+     * Its text by language: the base locale's at least.
+     */
+    locales: {
+        [key: string]: Locale;
+    };
+    /**
+     * How it is paid for: a subscription's periods and prices; one price for anything else.
+     */
+    plans: Plan[];
+    /**
+     * How much of each limit it gives.
+     */
+    quota?: QuotaAllowance[];
+    /**
+     * A subscription's level in its group, 1 or more: higher is more.
+     */
+    tier?: number;
+    /**
+     * Its kind: subscription (renews until canceled), non_consumable (bought once, kept), consumable (bought again and again: credits), non_renewing (a period bought once).
+     */
+    type: string;
+};
+/**
+ * The credits a product gives: per purchase for a consumable, per period for a subscription.
+ */
+export type ProductCredits = {
+    /**
+     * How many.
+     */
+    amount: number;
+    /**
+     * The credit (a key of the catalog's credits).
+     */
+    currency: string;
+    /**
+     * A subscription's: none (a period's credits end with the period) or all (they stay). Credits bought never end.
+     */
+    rollover?: string;
+};
+/**
+ * purchases.purchase.completed: a purchase new to the ledger: a subscription's start or a one-time product, in any store.
+ */
+export type PurchaseCompletedEvent = {
+    /**
+     * The purchase's id in the ledger.
+     */
+    chain_id: string;
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    /**
+     * Its plan; empty when unmapped.
+     */
+    plan: string;
+    /**
+     * The catalog's product; empty when unmapped.
+     */
+    product: string;
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+};
+/**
+ * A one-time purchase the customer owns.
+ */
+export type PurchaseInfo = {
+    /**
+     * Its id in the ledger.
+     */
+    id: string;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    /**
+     * The catalog's product; absent when the catalog does not map what the store sold.
+     */
+    product?: string;
+    /**
+     * When it was bought.
+     */
+    purchased_at: string;
+    /**
+     * Where it is: active, or revoked once refunded.
+     */
+    state: "pending" | "trial" | "active" | "grace" | "billing_retry" | "paused" | "expired" | "revoked" | "replaced";
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+};
+/**
+ * How much of a limit a product gives: the largest a customer holds counts.
+ */
+export type QuotaAllowance = {
+    /**
+     * The limit (a key of the catalog's limits).
+     */
+    limit: string;
+    /**
+     * How much, in each window.
+     */
+    max: number;
+};
+/**
+ * purchases.quota.exhausted: a customer used all of a limit's window; told once a window.
+ */
+export type QuotaExhaustedEvent = {
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * The limit.
+     */
+    limit: string;
+    /**
+     * What it allows them.
+     */
+    max: number;
+    /**
+     * How much of it is used (at most 100).
+     */
+    percent: number;
+    /**
+     * When the window ends.
+     */
+    resets_at: string;
+    /**
+     * What the customer used in it.
+     */
+    used: number;
+    /**
+     * The window.
+     */
+    window_id: string;
+};
+/**
+ * A spend or a hold of a quota.
+ */
+export type QuotaSpendRequest = {
+    /**
+     * How many credits or units.
+     */
+    amount: number;
+    /**
+     * The limit spent (a key of the catalog's limits).
+     */
+    limit: string;
+    /**
+     * The caller's own notes, kept with the spend (a JSON object, 2048 bytes at most).
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    /**
+     * A hold's life: it runs out after it (600 unless said). A spend in one step holds nothing and refuses it (400 `ttl_for_holds`).
+     */
+    ttl_seconds?: number;
+};
+/**
+ * purchases.quota.threshold: a customer used 80% of a limit's window; told once a window.
+ */
+export type QuotaThresholdEvent = {
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * The limit.
+     */
+    limit: string;
+    /**
+     * What it allows them.
+     */
+    max: number;
+    /**
+     * How much of it is used (at most 100).
+     */
+    percent: number;
+    /**
+     * When the window ends.
+     */
+    resets_at: string;
+    /**
+     * What the customer used in it.
+     */
+    used: number;
+    /**
+     * The window.
+     */
+    window_id: string;
+};
+/**
+ * The window a quota spend counts in.
+ */
+export type QuotaWindow = {
+    /**
+     * The window's id.
+     */
+    id: string;
+    /**
+     * What it allows the customer, when the limit is known.
+     */
+    max?: number | null;
+    /**
+     * What open holds keep of it.
+     */
+    reserved: number;
+    /**
+     * When it ends.
+     */
+    resets_at: string;
+    /**
+     * When it began.
+     */
+    starts_at: string;
+    /**
+     * What the customer used in it.
+     */
+    used: number;
+};
+/**
+ * One check of the environment's readiness to sell in the App Store.
+ */
+export type ReadinessCheck = {
+    /**
+     * The palbase command (or Studio's place) that fixes it; empty when nothing is the developer's to do.
+     */
+    fix: string;
+    /**
+     * What it checks; never changes: apple_key (an In-App Purchase key connected, and Apple takes it — asked now), apple_notifications_bound (the App Store reports to this environment), apple_test_notification (Apple's TEST notification arrived), catalog_confirmed (the newest revision of the catalog was confirmed for the stores), catalog_applied (App Store Connect took its App Store part), sandbox_access (what test purchases open; informational), xcode_certificate (whether Xcode's StoreKit Testing purchases are taken; informational — taken where the App Store's production notifications come, it says so, with the command that removes the certificate: the module cannot tell a production environment from a test one).
+     */
+    id: "apple_key" | "apple_notifications_bound" | "apple_test_notification" | "catalog_confirmed" | "catalog_applied" | "sandbox_access" | "xcode_certificate";
+    /**
+     * What was found, in one sentence a developer understands.
+     */
+    message: string;
+    /**
+     * Whether it holds. An informational check always does.
+     */
+    ok: boolean;
+};
+/**
+ * purchases.refund.changed: a store took a payment back (a refund, a chargeback, family sharing ended), or reversed that; the credits it gave are taken back, or given back.
+ */
+export type RefundChangedEvent = {
+    /**
+     * The purchase's id in the ledger.
+     */
+    chain_id: string;
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * Why.
+     */
+    kind: "refund" | "family" | "chargeback" | "other";
+    /**
+     * The taking back was reversed (a dispute won).
+     */
+    reversed: boolean;
+    /**
+     * How much of the payment was taken back, in thousandths (1000: all of it).
+     */
+    share_milli: number;
+    /**
+     * The payment taken back.
+     */
+    transaction_id: string;
+};
+/**
+ * The error envelope of a refused save, with every problem when the catalog breaks a rule (`invalid_catalog`).
+ */
+export type SaveCatalogError = {
+    /**
+     * Machine-readable error code (snake_case)
+     */
+    error: string;
+    /**
+     * Human-readable explanation
+     */
+    error_description: string;
+    /**
+     * Every problem, by path: with `invalid_catalog`, absent otherwise.
+     */
+    problems?: CatalogProblem[];
+    /**
+     * Correlation ID for log/audit lookup
+     */
+    request_id: string;
+    /**
+     * Seconds to wait before retrying; present on a refusal that ends with time.
+     */
+    retry_after?: number;
+    /**
+     * HTTP status code (mirrors the response status)
+     */
+    status: number;
+};
+/**
+ * The project's choices for its customers' purchases; the defaults (everyone, cancel on delete, UTC) until it makes its own.
+ */
+export type Settings = {
+    /**
+     * Whether a deleted user's renewing web (Stripe) subscriptions stop renewing; they keep the period they paid. Only the customer can cancel what they bought in the App Store or Google Play.
+     */
+    cancel_on_delete: boolean;
+    /**
+     * Whether a store's test purchases — Apple's sandbox (where App Review and TestFlight buy), Google Play's license testers, Stripe's test mode — open entitlements here: everyone, only the customers on sandbox_allowlist, or nobody.
+     */
+    sandbox_access: "everyone" | "allowlist" | "nobody";
+    /**
+     * The customers whose test purchases open entitlements when sandbox_access is allowlist.
+     */
+    sandbox_allowlist: string[];
+    /**
+     * Where the quotas' calendar windows (a day, a month) begin: an IANA name such as Europe/Istanbul.
+     */
+    time_zone: string;
+    /**
+     * When the settings were last changed; absent while they are the defaults.
+     */
+    updated_at?: string | null;
+};
+/**
+ * A change of the settings: the fields given change, the others stay.
+ */
+export type SettingsUpdate = {
+    /**
+     * Whether a deleted user's renewing web (Stripe) subscriptions stop renewing; they keep the period they paid. Only the customer can cancel what they bought in the App Store or Google Play.
+     */
+    cancel_on_delete?: boolean;
+    /**
+     * Whether a store's test purchases — Apple's sandbox (where App Review and TestFlight buy), Google Play's license testers, Stripe's test mode — open entitlements here: everyone, only the customers on sandbox_allowlist, or nobody.
+     */
+    sandbox_access?: "everyone" | "allowlist" | "nobody";
+    /**
+     * The customers whose test purchases open entitlements when sandbox_access is allowlist.
+     */
+    sandbox_allowlist?: string[];
+    /**
+     * Where the quotas' calendar windows (a day, a month) begin: an IANA name such as Europe/Istanbul.
+     */
+    time_zone?: string;
+};
+/**
+ * What a commit, an extension or a reversal takes; a release takes nothing.
+ */
+export type SpendAction = {
+    /**
+     * commit: how much of the hold is taken, at most what it holds — absent, all of it; 0, nothing (the hold is released). reverse: how much of what the spend took is handed back in all — absent or 0, everything.
+     */
+    amount?: number;
+    /**
+     * extend: the hold runs out this long from now (600 unless said).
+     */
+    ttl_seconds?: number;
+};
+/**
+ * A spend or a hold, as it stands.
+ */
+export type SpendReceipt = {
+    /**
+     * A credit spend's: what is available after. A quota spend's: what of the window no hold keeps.
+     */
+    available_after?: number | null;
+    /**
+     * A credit spend's: the balance after. A quota spend's: what is left of the window.
+     */
+    balance_after?: number | null;
+    /**
+     * What it took.
+     */
+    committed: number;
+    /**
+     * What a credit spend took, lot by lot.
+     */
+    consumed: CreditConsumption[];
+    /**
+     * When it was made.
+     */
+    created_at: string;
+    /**
+     * Its customer (the account, for a guest merged into one).
+     */
+    customer: string;
+    /**
+     * When a hold runs out; absent once it is not held.
+     */
+    expires_at?: string | null;
+    /**
+     * What it holds.
+     */
+    held: number;
+    /**
+     * The spend's id.
+     */
+    id: string;
+    /**
+     * The Idempotency-Key that named it.
+     */
+    idempotency_key: string;
+    /**
+     * The credit or the limit.
+     */
+    key: string;
+    /**
+     * Of credits or of a quota.
+     */
+    kind: "credit" | "quota";
+    /**
+     * The caller's own notes, kept with the spend (a JSON object, 2048 bytes at most).
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    overflow?: OverflowReceipt;
+    /**
+     * What was handed back of it.
+     */
+    reversed: number;
+    /**
+     * held (a hold, until committed, released or run out), committed, released, expired.
+     */
+    status: "held" | "committed" | "released" | "expired";
+    window?: QuotaWindow;
+};
+/**
+ * A spend or a hold: of credits (`credits`) or of a quota (`limit`), exactly one of them (400 `credits_or_limit` otherwise).
+ */
+export type SpendRequest = CreditSpendRequest | QuotaSpendRequest;
+/**
+ * purchases.store.changed: the project's Stripe account or In-App Purchase key was connected, disconnected, or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
+ */
+export type StoreChangedEvent = {
+    /**
+     * The Stripe account (Stripe's).
+     */
+    account_id?: string;
+    /**
+     * The app the key is connected for (the App Store's).
+     */
+    bundle_id?: string;
+    /**
+     * What happened.
+     */
+    change: "connected" | "active" | "refused" | "disconnected";
+    /**
+     * Whether the key is a live one (Stripe's, connected).
+     */
+    livemode?: boolean;
+    /**
+     * The store.
+     */
+    store: "stripe" | "app_store";
+};
+/**
+ * One store's part of a plan.
+ */
+export type StorePlan = {
+    /**
+     * The part's hash: a confirmation names the Stripe part's, or — with no Stripe account connected — the App Store part's.
+     */
+    hash?: string;
+    /**
+     * What waits on what: the App Store and Google Play parts are written by the stores module once their accounts are connected.
+     */
+    note?: string;
+    /**
+     * What it writes, in order.
+     */
+    steps: PlanStep[];
+    /**
+     * The Stripe account's mode the part is for.
+     */
+    store_env?: "sandbox" | "production";
+};
+/**
+ * The project's Stripe account as the API shows it: never the key itself.
+ */
+export type StripeAccount = {
+    /**
+     * The Stripe account's id (acct_…).
+     */
+    account_id?: string;
+    /**
+     * What the person has to do, when Stripe waits on them.
+     */
+    action?: string;
+    /**
+     * When Stripe was last asked.
+     */
+    checked_at?: string | null;
+    /**
+     * Whether the project has a Stripe account connected.
+     */
+    connected: boolean;
+    /**
+     * When the key was connected.
+     */
+    connected_at?: string | null;
+    /**
+     * Who asked for the grant the key was connected with (the API key that asked).
+     */
+    connected_by?: string;
+    /**
+     * The key's last characters, to tell it apart.
+     */
+    key_hint?: string;
+    /**
+     * Whether the key is a live one (rk_live_…): live payments, not Stripe's test mode.
+     */
+    livemode: boolean;
+    /**
+     * What the key may read, as Stripe answered when it was last checked.
+     */
+    permissions?: string[];
+    /**
+     * What Stripe last said of the key: active (accepts it), refused (no longer does: connect a new key).
+     */
+    status?: "active" | "refused";
+    /**
+     * Where Stripe reports changes on the account: the endpoint the module made there (POST /purchases/webhooks/stripe).
+     */
+    webhook_url?: string;
+};
+/**
+ * A Stripe event, as Stripe signs and sends it: only its id, type and the id of the object it names are read; the object is read again from Stripe.
+ */
+export type StripeEvent = {
+    [key: string]: unknown;
+};
+/**
+ * A one-time grant to connect a Stripe key: the key goes from the person's browser (connect_url) or terminal (POST /purchases/connect with the grant) straight to the module.
+ */
+export type StripeGrant = {
+    /**
+     * The page that takes the key from a browser. The grant rides in the URL's fragment, which a browser never sends to a server.
+     */
+    connect_url: string;
+    /**
+     * When the grant stops working.
+     */
+    expires_at: string;
+    /**
+     * The grant: spent by the first key Stripe accepts, or after 30 minutes.
+     */
+    grant: string;
+};
+/**
+ * A price on the project's Stripe account.
+ */
+export type StripePrice = {
+    /**
+     * Whether it is on sale.
+     */
+    active: boolean;
+    /**
+     * Its currency (lowercase, as Stripe writes it).
+     */
+    currency: string;
+    /**
+     * Its amounts in other currencies.
+     */
+    currency_options?: {
+        [key: string]: number;
+    };
+    /**
+     * Stripe's id.
+     */
+    id: string;
+    /**
+     * A subscription's: day, week, month or year.
+     */
+    interval?: string;
+    /**
+     * How many intervals a period is.
+     */
+    interval_count?: number;
+    /**
+     * Its lookup key: palbase:<ref>:<product>.<plan>.
+     */
+    lookup_key: string;
+    /**
+     * Its Stripe product.
+     */
+    product: string;
+    /**
+     * Its amount, in minor units.
+     */
+    unit_amount: number;
+};
+/**
+ * A product on the project's Stripe account.
+ */
+export type StripeProduct = {
+    /**
+     * Whether it is on sale.
+     */
+    active: boolean;
+    /**
+     * Its description.
+     */
+    description: string;
+    /**
+     * Stripe's id.
+     */
+    id: string;
+    /**
+     * Its name.
+     */
+    name: string;
+};
+/**
+ * purchases.subscription.changed: a customer's subscription started, renewed, stopped renewing (canceled) or renews again (uncanceled), could not be charged (billing_issue) or was again (recovered), ended (expired), or moved to another product (product_changed).
+ */
+export type SubscriptionChangedEvent = {
+    /**
+     * The subscription's id in the ledger.
+     */
+    chain_id: string;
+    /**
+     * What happened.
+     */
+    change: "started" | "renewed" | "canceled" | "uncanceled" | "billing_issue" | "recovered" | "expired" | "product_changed";
+    /**
+     * The customer.
+     */
+    customer_id: string;
+    /**
+     * When access ends.
+     */
+    expires_at: string | null;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    /**
+     * Its plan; empty when unmapped.
+     */
+    plan: string;
+    /**
+     * The catalog's product; empty when unmapped.
+     */
+    product: string;
+    /**
+     * Where it is now.
+     */
+    state: "pending" | "trial" | "active" | "grace" | "billing_retry" | "paused" | "expired" | "revoked" | "replaced";
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+    /**
+     * Whether it renews.
+     */
+    will_renew: boolean;
+};
+/**
+ * A subscription (or a non-renewing period) the customer owns.
+ */
+export type SubscriptionInfo = {
+    /**
+     * Whether it gives access now.
+     */
+    active: boolean;
+    /**
+     * When access ends.
+     */
+    expires_at: string | null;
+    /**
+     * Its id in the ledger.
+     */
+    id: string;
+    /**
+     * Whether it is a store's test purchase.
+     */
+    is_sandbox: boolean;
+    manage?: Management;
+    /**
+     * Its plan.
+     */
+    plan?: string;
+    /**
+     * The catalog's product; absent when the catalog does not map what the store sold.
+     */
+    product?: string;
+    /**
+     * Where it is: trial, active and grace give access; billing_retry, paused, expired, revoked (refunded) and replaced (another purchase took it over) do not.
+     */
+    state: "pending" | "trial" | "active" | "grace" | "billing_retry" | "paused" | "expired" | "revoked" | "replaced";
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+    /**
+     * Whether it renews (false once canceled: it runs to expires_at).
+     */
+    will_renew: boolean;
+};
+/**
+ * The certificate the environment takes Xcode's StoreKit Testing purchases signed with: test purchases made on a developer's Mac with no App Store at all, the sandbox's. It is public: Xcode saves it for whoever asks (Editor › Save Public Certificate).
+ */
+export type XcodeCertificate = {
+    /**
+     * The SHA-256 of its DER, hex: what it is pinned by.
+     */
+    fingerprint: string;
+    /**
+     * When it expires: Xcode makes a new one, to be set again.
+     */
+    not_after: string;
+    /**
+     * When it was set.
+     */
+    set_at: string;
+    /**
+     * Who set it (the API key that asked).
+     */
+    set_by: string;
+    /**
+     * Its subject, as Xcode names it.
+     */
+    subject: string;
+};
+/**
+ * The certificate Xcode signs StoreKit Testing purchases with, as Editor › Save Public Certificate saves it.
+ */
+export type XcodeCertificateRequest = {
+    /**
+     * The saved .cer: PEM, or the base64 of its DER. A P-256 certificate that signed itself, not expired.
+     */
+    certificate: string;
+};
+/** The events this module sends the project's webhooks (x-palbase-events), by type: each one's payload, the event's data. */
+export interface Events {
+    /**
+     * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store part.
+     */
+    "purchases.catalog.applied": CatalogAppliedEvent;
+    /**
+     * purchases.catalog.changed: a new revision of the catalog was saved; plans of older ones went stale.
+     */
+    "purchases.catalog.changed": CatalogChangedEvent;
+    /**
+     * purchases.credits.depleted: a customer's balance of a credit came down to nothing (or below).
+     */
+    "purchases.credits.depleted": CreditsDepletedEvent;
+    /**
+     * purchases.credits.low: a customer's balance of a credit fell under its low mark (the catalog's low_at); told once, until it is back above.
+     */
+    "purchases.credits.low": CreditsLowEvent;
+    /**
+     * purchases.customer.changed: what a customer has changed — a purchase, a renewal or its end, a refund, a grant, credits or quota used, a merge — and their revision rose. Realtime carries it to the customer's apps, which read GET /purchases/me again.
+     */
+    "purchases.customer.changed": CustomerChangedEvent;
+    /**
+     * purchases.customer.erased: a deleted user's purchases record was erased (and the guests merged into them); their id is never a customer again.
+     */
+    "purchases.customer.erased": CustomerErasedEvent;
+    /**
+     * purchases.customer.merged: a guest's purchases, grants, credits and quota use went to the account it signed in to; the guest's id points to the account from then on.
+     */
+    "purchases.customer.merged": CustomerMergedEvent;
+    /**
+     * purchases.entitlement.changed: an entitlement of a customer turned on or off.
+     */
+    "purchases.entitlement.changed": EntitlementChangedEvent;
+    /**
+     * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the App Store purchases of the Apple ID it was made with.
+     */
+    "purchases.ownership.transferred": OwnershipTransferredEvent;
+    /**
+     * purchases.purchase.completed: a purchase new to the ledger: a subscription's start or a one-time product, in any store.
+     */
+    "purchases.purchase.completed": PurchaseCompletedEvent;
+    /**
+     * purchases.quota.exhausted: a customer used all of a limit's window; told once a window.
+     */
+    "purchases.quota.exhausted": QuotaExhaustedEvent;
+    /**
+     * purchases.quota.threshold: a customer used 80% of a limit's window; told once a window.
+     */
+    "purchases.quota.threshold": QuotaThresholdEvent;
+    /**
+     * purchases.refund.changed: a store took a payment back (a refund, a chargeback, family sharing ended), or reversed that; the credits it gave are taken back, or given back.
+     */
+    "purchases.refund.changed": RefundChangedEvent;
+    /**
+     * purchases.store.changed: the project's Stripe account or In-App Purchase key was connected, disconnected, or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
+     */
+    "purchases.store.changed": StoreChangedEvent;
+    /**
+     * purchases.subscription.changed: a customer's subscription started, renewed, stopped renewing (canceled) or renews again (uncanceled), could not be charged (billing_issue) or was again (recovered), ended (expired), or moved to another product (product_changed).
+     */
+    "purchases.subscription.changed": SubscriptionChangedEvent;
+}
+/** Palbase Purchases */
+export declare function client(t: Transport): {
+    /**
+     * Read the App Store connection
+     *
+     * The project's App Store connection: the app the In-App Purchase key is connected for, the key's ids, the app's Apple ID once known, and where the App Store reports — bound by the stores module, verified by Apple's TEST notification — never the key.
+     */
+    getAppleAccount(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, AppleAccount>>;
+    /**
+     * Disconnect the In-App Purchase key
+     *
+     * Forgets the key for good. Purchases already made stay in the ledger; the App Store's notifications and the apps' reports are refused from then on. With nothing connected, nothing changes. Emits `purchases.store.changed` (disconnected).
+     */
+    disconnectApple(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
+    /**
+     * The customer's App Store token
+     *
+     * The signed-in customer's appAccountToken for the connected app — with no key connected and an Xcode certificate set, for Xcode's StoreKit Testing — a guest's too: a random UUID made the first time it is asked for, the same afterwards. The app passes it to StoreKit's purchase; the App Store's notifications carry it back, so a purchase is the customer's before the app reports it, and nothing personal goes to Apple. A guest's goes with it when it merges into an account.
+     */
+    getAppleAccountToken(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, AppleAccountToken>>;
+    /**
+     * The In-App Purchase key's connect page
+     *
+     * The page an App Store connect link opens: it names the project the key goes to, lists the environment's iOS apps to connect it for, reads the grant from the link's fragment and posts the key with it. No credential: the grant is the authorization.
+     */
+    getAppleConnectPage(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Response>>;
+    /**
+     * Hand over an In-App Purchase key with a grant
+     *
+     * Takes an In-App Purchase key with a grant, for one of the environment's registered iOS apps. Apple is asked, with a call that changes nothing (the app's notification history of the last hour, in the sandbox), whether it takes the key for the app; the key is kept sealed with the project's own key, the grant is spent, and the stores module is asked to set this environment's address (POST /purchases/webhooks/apple) as the app's notification address in App Store Connect. Each key tried counts against the grant — 10 at most. A key connected again replaces the one before. Emits `purchases.store.changed` (connected).
+     */
+    connectAppleKey(input: {
+        body: ConnectAppleKeyRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, AppleAccount>>;
+    /**
+     * Grant an In-App Purchase key's connection
+     *
+     * A one-time grant, good for 30 minutes, to hand the project an In-App Purchase key for one of its iOS apps. Whoever asks for it never holds the key: the person opens `connect_url` in a browser, or a terminal posts the key to POST /purchases/apple/connect with the grant. A project holds 10 open grants at most, Stripe's and the App Store's together (429 `too_many_grants`).
+     */
+    createAppleGrant(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, AppleGrant>>;
+    /**
+     * Check readiness to sell in the App Store
+     *
+     * Whether the environment sells in the App Store, check by check, each with what was found in one sentence and the palbase command that fixes it: the In-App Purchase key (Apple is asked now whether it takes it — a call that changes nothing), the notification address bound and Apple's TEST notification arrived, the newest revision of the catalog confirmed and App Store Connect's answer of it (with each failing step's error), what test purchases open, and whether Xcode's StoreKit Testing purchases are taken. The checks' ids never change.
+     */
+    getAppleReadiness(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, AppleReadiness>>;
+    /**
+     * Report what StoreKit gave the app
+     *
+     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the transactions StoreKit gave it: a purchase just made, Transaction.updates, or on a restore every one of currentEntitlements. Each is verified as the App Store signed it for the connected app, of the sandbox or production; with an Xcode certificate set, one Xcode signed with it on the developer's Mac (StoreKit Testing, environment Xcode, for one of the environment's iOS apps) is taken too — a test purchase, the sandbox's, gated by `sandbox_access` as the sandbox's are, of which nothing is asked of Apple — key connected or not. One that is neither refuses the report, naming it. A subscription's state is not taken from the device: it is read from Apple with the project's own key (Get All Subscription Statuses). Whose a purchase is: one nobody has becomes the customer's its appAccountToken names, or the reporter's; one another customer has stays theirs — unless `restore` from the device StoreKit signed its transaction for (`device_verification_id`), which moves it to the reporter (an account's is never taken by a guest's restore, and one purchase moves 3 times in 30 days at most). A restore that leaves a purchase where it was answers why once the rest of the report is applied (403 `restore_not_this_device`, 403 `restore_account_owned`, 409 `restore_limit`). Apple is asked of a subscription once however many copies of it the report holds. A guest that signed in to an account reports for the account: what StoreKit gave it is the account's, and the answer is the account's. Sent again, a report applies nothing twice. Answers what the customer has now, as GET /purchases/me. Emits what a purchase changed — `purchases.purchase.completed`, `purchases.subscription.changed`, `purchases.entitlement.changed`, `purchases.ownership.transferred` on a move, credits' events — and `purchases.customer.changed`.
+     */
+    reportAppleTransactions(input: {
+        body: AppleTransactionReport; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * Take Xcode's StoreKit Testing purchases
+     *
+     * Sets the certificate Xcode signs a developer's StoreKit Testing purchases with (Editor › Save Public Certificate): from then on, what the app reports signed with it — environment Xcode alone, for one of the environment's iOS apps — is taken as a test purchase, the sandbox's, gated by `sandbox_access`, with or without an In-App Purchase key connected; nothing of it is asked of Apple. It never speaks for the App Store's sandbox or production. Set it on a development environment: Studio and the CLI refuse to on production. Set again, it replaces the one before.
+     */
+    setXcodeCertificate(input: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: XcodeCertificateRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, XcodeCertificate>>;
+    /**
+     * Stop taking Xcode's purchases
+     *
+     * Forgets the Xcode certificate: what Xcode signs is refused from then on. Test purchases already taken stay in the ledger. With none set, nothing changes.
+     */
+    clearXcodeCertificate(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
+    /**
+     * Read the catalog
+     *
+     * The project's catalog: its newest revision (revision 0, empty, before the first save). The ETag is the revision: send it back as If-Match to save an edit.
+     */
+    getCatalog(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogDoc>>;
+    /**
+     * Save the catalog
+     *
+     * Saves a new revision of the whole catalog. It is checked first: a problem that is not a warning refuses it, with every problem listed (422 `invalid_catalog`); a warning (a channel's feature the product goes without) does not. If-Match names the revision it was edited from (0 for the first): of two people editing at once, the second is told (412 `catalog_changed`), not overwritten. Nothing is written to a store: a plan made from an older revision goes stale, and a new one is made (POST /purchases/catalog/plans). Emits `purchases.catalog.changed`.
+     */
+    saveCatalog(input: {
+        headers: {
+            "If-Match": string; /** Makes the write safe to send again (at most 255 characters). A retry with the same key and the same request gets the first answer back, marked `Idempotent-Replayed: true`, and changes nothing; the same key with a different request is refused with 422, and while the first request still runs a retry gets 409 with Retry-After. Answers are kept for 24 hours. */
+            "Idempotency-Key"?: string;
+        };
+        body: Catalog; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogDoc>>;
+    /**
+     * Plan bringing the stores to the catalog
+     *
+     * Computes what writing the newest revision to the stores takes, store by store, before anything is written. The Stripe part is against what the project's Stripe account holds now: a product for each web product, a price for each plan — a price never changes at Stripe: a new amount is a new price, which takes the old one's lookup key, and customers on the old one keep paying it. The App Store and Google Play parts are as the stores module writes them once their accounts are connected; each creation there is permanent. A plan is confirmed with the Stripe part's hash (POST /purchases/catalog/plans/{plan_id}/confirm) — the Stripe part is null with no Stripe account connected, and the App Store part's hash confirms it then.
+     */
+    planCatalog(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, CatalogPlan>>;
+    /**
+     * Read a plan
+     *
+     * A plan and where it is — planned, stale once the catalog changed, applying, applied, failed, declined — and, once written, what the Stripe account holds of the catalog (`result`) and what App Store Connect holds of its App Store part, step by step (`apple_result`, once the stores module answered).
+     */
+    getCatalogPlan(input: {
+        path: {
+            plan_id: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogPlan>>;
+    /**
+     * Confirm a plan
+     *
+     * Writes the plan: only with the hash of the plan shown (the Stripe part's; with no Stripe account connected, the App Store part's), and only while it is planned — a plan the catalog moved past is refused, not written as something nobody saw. The Stripe part is written now, each write with an idempotency key of its own at Stripe: answers the plan applied, with what the account holds now, or failed, with what Stripe said; a new plan picks up where a failed one stopped. The App Store part goes to the stores module, which writes it to App Store Connect with the project's Apple account and answers later (`apple_result`; a plan with no Stripe part stays applying until then); from the confirmation on, a purchase of what it sells maps to the catalog's product and plan. Emits `purchases.catalog.applied`.
+     */
+    confirmCatalogPlan(input: {
+        path: {
+            plan_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: PlanConfirmation; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogPlan>>;
+    /**
+     * Decline a plan
+     *
+     * Declines a planned plan: nothing of it is written.
+     */
+    declineCatalogPlan(input: {
+        path: {
+            plan_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogPlan>>;
+    /**
+     * Check a catalog
+     *
+     * Checks a catalog without saving it: every problem, with its path and the store whose rule it breaks — Apple's 30-character names and six subscription periods, Google Play's limits, Stripe's yearly longest period, keys, prices, what a product gives. `valid` says whether it can be saved.
+     */
+    validateCatalog(input: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: Catalog; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CatalogValidation>>;
+    /**
+     * The connect page
+     *
+     * The page a connect link opens: it names the project the key goes to, reads the grant from the link's fragment and posts the restricted key with it. No credential: the grant is the authorization.
+     */
+    getStripeConnectPage(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Response>>;
+    /**
+     * Hand over a Stripe key with a grant
+     *
+     * Takes a Stripe restricted key with a grant. Stripe is asked whose account it is and what the key may read; the module makes its webhook endpoint on the account at this environment's address, keeps the key and the endpoint's secret sealed with the project's own key, and spends the grant. Each key tried counts against the grant — 10 at most — and one Stripe refuses leaves the grant for the right one. A key connected again (rolled, or another of the same account) replaces the one before, and its endpoint. Emits `purchases.store.changed` (connected).
+     */
+    connectStripeKey(input: {
+        body: ConnectStripeKeyRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, StripeAccount>>;
+    /**
+     * Read a customer
+     *
+     * What a customer has, as GET /purchases/me answers it to them, for the project's backend. A guest merged into an account answers the account's. A user never seen here has nothing yet but the free tier of every quota; the read writes nothing — they become a customer when something is theirs.
+     */
+    getCustomer(input: {
+        path: {
+            customer_id: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * Grant credits
+     *
+     * Gives a customer credits as a promotion or by support, saying why; they may expire. They pay what the customer owes first (a refund can leave a debt). The Idempotency-Key names the grant for good: sent again it answers the same lot and gives nothing more. A customer not seen before is made; a guest merged into an account gives the account. Emits the credits' events it crosses and `purchases.customer.changed`.
+     */
+    grantCredits(input: {
+        path: {
+            customer_id: string;
+        };
+        headers: {
+            "Idempotency-Key": string;
+        };
+        body: CreditGrantRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, CreditLot>>;
+    /**
+     * List credit movements
+     *
+     * A customer's credit movements, newest first, a page at a time: what they were given and by whom, what each spend took, what expired, what a refund took back and what they owe — support's answer to "where did my credits go". `credits` reads one credit; `cursor` goes on from a page's `next_cursor`. A user never seen here has none.
+     */
+    listCreditEntries(input: {
+        path: {
+            customer_id: string;
+        };
+        query?: {
+            credits?: string; /** The `next_cursor` of the page before. */
+            cursor?: string; /** How many movements a page holds (50 unless said). */
+            limit?: number;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CreditEntries>>;
+    /**
+     * Forgive a debt
+     *
+     * Takes what a customer owes in a credit off their debt — all of it, or `amount` of it — saying why: a refund took back credits they had already spent, and support lets it go. The next credits they get then count in full. Answers what it took off and the account it left; a customer who owes nothing is forgiven 0. A credit the catalog no longer defines can still be forgiven while the customer has an account in it. Emits the credits' events it crosses and `purchases.customer.changed`.
+     */
+    forgiveCredits(input: {
+        path: {
+            customer_id: string;
+        };
+        headers: {
+            "Idempotency-Key": string;
+        };
+        body: CreditForgiveRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CreditForgiven>>;
+    /**
+     * Grant an entitlement
+     *
+     * Gives a customer one of the catalog's entitlements, for a while or for life — a promotion, a support case, a tester — saying why: the reason is the record. A customer not seen before is made; a guest merged into an account gives the account. Emits `purchases.entitlement.changed` when the entitlement turns on, and `purchases.customer.changed`.
+     */
+    grantEntitlement(input: {
+        path: {
+            customer_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: GrantRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, GrantInfo>>;
+    /**
+     * Revoke a granted entitlement
+     *
+     * Ends a grant now. What the customer bought is not touched: the entitlement stays on while another source gives it. Emits `purchases.entitlement.changed` when it turns off, and `purchases.customer.changed`.
+     */
+    revokeGrant(input: {
+        path: {
+            customer_id: string; /** The grant's id. */
+            grant_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
+    /**
+     * Hold credits or a quota for a job
+     *
+     * Keeps a customer's credits or quota units for a job that has yet to run: they stay the customer's, but no other spend can take them, until the hold is committed (the job ran), released (it did not) or runs out (`ttl_seconds`: 10 minutes unless said, 24 hours at most). A quota hold counts in the window it was made in, even when committed after it ends. Named for good by its Idempotency-Key, as a spend is.
+     */
+    holdSpend(input: {
+        path: {
+            customer_id: string;
+        };
+        headers: {
+            "Idempotency-Key": string;
+        };
+        body: SpendRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt> | Reply<201, SpendReceipt>>;
+    /**
+     * Set a customer's own limit
+     *
+     * Sets what each window of a limit allows one customer — more for a customer support looks after, less for one who abuses it — in place of what their products give, until `expires_at` or until cleared, saying why. Use already counted in the window stays counted. A customer not seen before is made; a guest merged into an account sets the account's. Answers the limit as it stands for them now. Emits `purchases.customer.changed`.
+     */
+    setCustomerLimit(input: {
+        path: {
+            customer_id: string; /** The limit (a key of the catalog's limits). */
+            limit_key: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: LimitOverrideRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, LimitUse>>;
+    /**
+     * Clear a customer's own limit
+     *
+     * Ends a customer's own limit: their products give it again. Clearing one that is not set changes nothing and emits nothing. Answers the limit as it stands for them now. Emits `purchases.customer.changed` when one was set.
+     */
+    clearCustomerLimit(input: {
+        path: {
+            customer_id: string; /** The limit (a key of the catalog's limits). */
+            limit_key: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, LimitUse>>;
+    /**
+     * Grant more of a limit
+     *
+     * Gives a customer more units of a limit in the window it is in now — a promotion, a support case — saying why; the next window starts from what their products give again. The Idempotency-Key names the grant in the project for good: sent again — a minute or a month later — it gives nothing more (200, `Idempotent-Replayed`); with another customer, limit, amount or source it is refused (422 `idempotency_key_reused`). A customer not seen before is made; a guest merged into an account gives the account. Answers the limit as it stands for them now. Emits `purchases.customer.changed` when it gave.
+     */
+    grantLimit(input: {
+        path: {
+            customer_id: string; /** The limit (a key of the catalog's limits). */
+            limit_key: string;
+        };
+        headers: {
+            "Idempotency-Key": string;
+        };
+        body: LimitGrantRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, LimitUse> | Reply<201, LimitUse>>;
+    /**
+     * Spend credits or a quota
+     *
+     * Takes a customer's credits (`credits`, a credit of the catalog) or units of a quota (`limit`) in one step. Credits go from the lots that expire first, bought ones last. A quota counts in its current window, up to the most any product the customer holds gives (the limit's free tier otherwise); past it, a limit with overflow takes credits instead, and one without is refused (409 `limit_reached`). The Idempotency-Key names the spend for good: sent again — a minute or a month later — it is the same spend (200, `Idempotent-Replayed`), never a second. A customer not seen before is made. Emits the credits' and quota's events when a balance crosses its low mark or runs out and when a window reaches 80% or 100%, and `purchases.customer.changed`.
+     */
+    spend(input: {
+        path: {
+            customer_id: string;
+        };
+        headers: {
+            "Idempotency-Key": string;
+        };
+        body: SpendRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt> | Reply<201, SpendReceipt>>;
+    /**
+     * Commit a hold
+     *
+     * Takes `amount` of what a hold keeps — all of it when no amount is given — and frees the rest; an `amount` of 0 takes nothing and releases the hold. Committed again with the same amount, it answers the same. A hold that ran out is refused (409 `hold_expired`): what it kept is free again. Emits the credits' and quota's events it crosses, and `purchases.customer.changed`.
+     */
+    commitSpend(input: {
+        path: {
+            customer_id: string; /** The spend's id. */
+            spend_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body?: SpendAction; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt>>;
+    /**
+     * Give a hold more time
+     *
+     * The hold runs out `ttl_seconds` from now: 10 minutes unless said, 24 hours at most.
+     */
+    extendHold(input: {
+        path: {
+            customer_id: string; /** The spend's id. */
+            spend_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body?: SpendAction; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt>>;
+    /**
+     * Release a hold
+     *
+     * Frees all a hold keeps: the job did not run. A hold that ran out answers itself, expired.
+     */
+    releaseSpend(input: {
+        path: {
+            customer_id: string; /** The spend's id. */
+            spend_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body?: SpendAction; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt>>;
+    /**
+     * Reverse a spend
+     *
+     * Hands back what a committed spend took — the job failed. `amount` is how much is handed back in all (absent or 0: everything), so asked again it is the same reversal. Credits go back to the lots they came from (what fell on a lot that expired since is gone with it, what fell on one refunded since pays the debt); a quota's units go back to the window while it is open; credits a quota spend took past its limit come back first. Emits `purchases.customer.changed`.
+     */
+    reverseSpend(input: {
+        path: {
+            customer_id: string; /** The spend's id. */
+            spend_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body?: SpendAction; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, SpendReceipt>>;
+    /**
+     * Read what the customer has
+     *
+     * Everything the signed-in customer has, whatever store they bought in: each entitlement (whether it is on, until when, whether it renews, which store gives it, every source), their subscriptions and one-time purchases, credit balances and quota use. The first read makes the user a customer. A store's test purchases open entitlements as the project's sandbox setting says. The ETag is the customer's revision. The customer's apps join the realtime channel `purchases:<project ref>:<user id>` — theirs alone, read-only — whose state and `changed` broadcast carry `{"revision": N}`: a revision above the one read means reading GET /purchases/me again.
+     */
+    getMyCustomerInfo(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * Move a guest's purchases to the account
+     *
+     * With the account's session and the guest's proof: everything the guest bought — subscriptions and purchases, grants, credits and quota use — goes to the account in one step, and the guest's id points to the account from then on (its session reads 409 `customer_merged`). It cannot be undone; asked again, it is the same merge. Answers what the account has now. Emits `purchases.customer.merged`, the credits' events and `purchases.customer.changed` for both.
+     */
+    mergeGuest(input: {
+        body: MergeRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * Prove a guest's purchases
+     *
+     * Asked with a guest's session before it signs in to an existing account: a proof, good for 5 minutes, that whoever signs in held the guest. Spent with the account's session (POST /purchases/me/merge), it moves what the guest bought to the account. A guest that signs up instead keeps its id, and its purchases with it: nothing to merge.
+     */
+    createMergeGrant(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<201, MergeGrant>>;
+    /**
+     * Read the offerings
+     *
+     * The catalog's products as an app shows them on a paywall: each channel's own text in every language and its price, and the id the channel's store sells each plan by — the App Store's product id, Google Play's product id (and base plan, for a subscription), Stripe's price lookup key. Nobody's purchases: any of the project's keys reads it, the publishable one included.
+     */
+    getOfferings(input?: {
+        query?: {
+            channel?: "ios" | "android" | "web";
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Offerings>>;
+    /**
+     * Read the settings
+     *
+     * The project's choices for its customers' purchases; the defaults until it makes its own.
+     */
+    getSettings(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Settings>>;
+    /**
+     * Change the settings
+     *
+     * Changes the settings given — whether a store's test purchases open entitlements, ending a deleted user's renewing web subscriptions, where the quotas' calendar windows begin — and leaves the others as they are.
+     */
+    updateSettings(input: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: SettingsUpdate; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Settings>>;
+    /**
+     * Read the Stripe account
+     *
+     * The project's Stripe account as connected — its id, its mode, the key's last characters, what Stripe last said of the key and what it may read, the webhook endpoint's address — never the key.
+     */
+    getStripeAccount(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, StripeAccount>>;
+    /**
+     * Disconnect the Stripe account
+     *
+     * Forgets the key for good and removes the webhook endpoint the module made on the account. Purchases already made stay in the ledger; nothing new is sold on the web. With nothing connected, nothing changes. Emits `purchases.store.changed` (disconnected).
+     */
+    disconnectStripe(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
+    /**
+     * Check the Stripe account again
+     *
+     * Asks Stripe again what the connected key may read: after its permissions were edited, or once Stripe stopped accepting it (status `refused`: connect a new key). Emits `purchases.store.changed` when the status changed.
+     */
+    checkStripeAccount(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, StripeAccount>>;
+    /**
+     * Buy on the web
+     *
+     * Opens a Stripe Checkout session for the signed-in customer to buy one of the catalog's products sold on the web, at the plan's price on the project's Stripe account: send the customer to `url`. Stripe sends them back to `success_url` or `cancel_url`, which go back to one of the project's registered apps — a web app's origin, or a native app's own scheme — and nowhere else. What is bought on the web is the account's on every device: a guest is refused. A customer who already has the product, or a subscription of its group, from any store is refused (409 `already_entitled`, naming the store to manage it in): nothing is charged twice. Credits can always be bought again. A free trial is given once per customer, across every channel. The purchase is the customer's once Stripe reports it (POST /purchases/webhooks/stripe).
+     */
+    createCheckout(input: {
+        body: CheckoutRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, Checkout>>;
+    /**
+     * Grant a key's connection
+     *
+     * A one-time grant, good for 30 minutes, to hand the project a Stripe restricted key. Whoever asks for it never holds the key: the person opens `connect_url` in a browser, or a terminal posts the key to POST /purchases/connect with the grant. A project holds 10 open grants at most (429 `too_many_grants`).
+     */
+    createStripeGrant(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, StripeGrant>>;
+    /**
+     * Manage what was bought on the web
+     *
+     * Opens Stripe's customer portal for the signed-in customer, where they change, cancel or renew what they bought on the web and how they pay: send them to `url`. `return_url` goes back to one of the project's registered apps.
+     */
+    createPortalSession(input: {
+        body: PortalRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, PortalSession>>;
+    /**
+     * Take the App Store's notification
+     *
+     * Where the App Store reports the connected app's purchases (App Store Server Notifications V2), sandbox's and production's alike — no key. The signed payload is verified: Apple's root, the app's bundle, the sandbox or production (production naming the app's Apple ID); a developer's machine's (Xcode, LocalTesting) is refused. Each notification is kept once, sealed, by its notificationUUID: one sent again is answered and not applied twice. A TEST notification proves the address (`notifications.verified_at`). One about a purchase applies what Apple signed of it — the transaction, the renewal info, the subscription's status — to the ledger: the newest by Apple's time is the state, an older one is recorded and not applied. A purchase new to the ledger is the customer's its appAccountToken names, else nobody's until the app reports it. Apple hears 200 once that is written; anything else, and it sends the notification again.
+     */
+    receiveAppleNotification(input: {
+        body: AppleNotification; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, undefined>>;
+    /**
+     * Take Stripe's notification
+     *
+     * Where Stripe reports a change on the project's account: the endpoint the module made there when the key was connected, with the endpoint's signature (Stripe-Signature) — no key. What a delivery says is not believed: the object it names is read again from Stripe and what Stripe holds now is applied to the ledger — a Checkout completed, a subscription started, renewed, canceled or ended, a one-time payment, a refund or a dispute. Each delivery is kept once, sealed, by its event id: one sent again is answered and not applied twice. An event of the account's other mode, or of an object another integration made, is answered and ignored. Stripe hears 2xx only once the change is written; any other answer makes it send the delivery again. Emits what changed: `purchases.purchase.completed`, `purchases.subscription.changed`, `purchases.refund.changed`, `purchases.entitlement.changed`, the credits' events and `purchases.customer.changed`.
+     */
+    receiveStripeEvent(input: {
+        headers: {
+            "Stripe-Signature": string;
+        };
+        body: StripeEvent; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, undefined>>;
+};
+export type Client = ReturnType<typeof client>;