@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/storefront.js

@@ -6230,6 +6230,8 @@ var SUBSCRIPTION_OK = {
   quantity:  "Quantity updated.",
   frequency: "Delivery frequency updated.",
   reactivated: "Your subscription has been reactivated.",
+  plan_changed:   "Your plan change is set.",
+  change_canceled: "Your scheduled plan change was canceled.",
 };
 function _subscriptionOkCopy(kind) {
   return Object.prototype.hasOwnProperty.call(SUBSCRIPTION_OK, kind) ? SUBSCRIPTION_OK[kind] : null;
@@ -6250,6 +6252,12 @@ var SUBSCRIPTION_ERR = {
   // A Stripe-side quantity push failed; the local quantity was NOT
   // changed, so the customer sees the unchanged value and can retry.
   processor:   "We couldn't update your subscription with the payment processor. Nothing changed — please try again.",
+  // A plan change already scheduled — the customer must cancel the
+  // pending one before queuing another.
+  pending_exists: "You already have a plan change scheduled. Cancel it before choosing another.",
+  // The requested plan can't be switched to (same plan / different
+  // currency / no longer offered).
+  plan:        "That plan isn't available to switch to. Pick another.",
 };
 function _subscriptionErrorCopy(code) {
   if (code == null) return null;
@@ -6279,6 +6287,12 @@ function renderAccountSubscriptions(opts) {
   // frequency control suppressed; a local-only controls instance keeps
   // offering it even on a Stripe-shaped row.
   var stripeAware = opts.stripe_backed === true;
+  // When the plan-change surface is wired, each active subscription gains a
+  // "Change plan" link, and any open (proposed/pending) change renders a
+  // banner with a cancel control. `opts.pending_changes` maps subscription
+  // id → the open change row (joined to its `to_plan`).
+  var canChange = opts.can_change === true;
+  var pendingChanges = opts.pending_changes || {};
   var rowsHtml = "";
   for (var i = 0; i < subs.length; i += 1) {
     var s = subs[i];
@@ -6332,6 +6346,38 @@ function renderAccountSubscriptions(opts) {
       cancelControl =
         "<a class=\"btn-ghost btn-ghost--sm subscription-card__cancel-link\" href=\"/account/subscriptions/" + esc(s.id) + "/cancel\">Cancel subscription</a>";
     }
+    // Change-plan link — offered only on a live (self-manageable, non-
+    // terminal) subscription with an active billing period, mirroring the
+    // change route's own preconditions. The proration preview + timing
+    // choice lives on the dedicated /change page.
+    var changeControl = "";
+    if (canChange && _subscriptionSelfManageable(s) && _subscriptionControlState(s) === "active" &&
+        s.current_period_start != null && s.current_period_end != null) {
+      changeControl =
+        "<a class=\"btn-ghost btn-ghost--sm subscription-card__change-link\" href=\"/account/subscriptions/" + esc(s.id) + "/change\">Change plan</a>";
+    }
+    // Pending plan-change banner — when an open change is scheduled for this
+    // row, show the target plan + timing and a cancel control. The cancel
+    // posts to the /change/cancel route; the change page also surfaces it.
+    var pendingBanner = "";
+    var pcRow = Object.prototype.hasOwnProperty.call(pendingChanges, s.id) ? pendingChanges[s.id] : null;
+    if (pcRow) {
+      var pcTo = pcRow.to_plan ? _planPriceCadence(pcRow.to_plan) : "a new plan";
+      var pcWhen = pcRow.change_kind === "next_billing_cycle"
+        ? "at your next billing date"
+        : "shortly";
+      var pcEff = pcRow.effective_at
+        ? new Date(Number(pcRow.effective_at)).toISOString().slice(0, 10)
+        : "";
+      pendingBanner =
+        "<div class=\"subscription-card__pending-change\" role=\"status\">" +
+          "<span class=\"subscription-card__pending-copy\">Plan change to " + pcTo + " scheduled " + esc(pcWhen) +
+            (pcEff ? " (<time datetime=\"" + esc(pcEff) + "\">" + esc(pcEff) + "</time>)" : "") + ".</span>" +
+          "<form class=\"subscription-card__control\" method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/change/cancel\">" +
+            "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Cancel change</button>" +
+          "</form>" +
+        "</div>";
+    }
     // Self-manage controls — state-gated, mirroring the primitive's FSM
     // (active ⇒ pause / skip / change-qty / change-freq; paused ⇒ resume;
     // cancelled-within-grace ⇒ reactivate). Pause is confirm-gated like
@@ -6408,7 +6454,9 @@ function renderAccountSubscriptions(opts) {
         "</div>" +
         (renewalNote ? "<p class=\"subscription-card__meta\">" + renewalNote + "</p>" : "") +
         (stateNote ? "<p class=\"subscription-card__state\">" + stateNote + "</p>" : "") +
+        pendingBanner +
         manageControls +
+        changeControl +
         cancelControl +
       "</li>";
   }
@@ -6639,6 +6687,162 @@ function renderSubscriptionPauseConfirm(opts) {
   });
 }
 
+// Render a plan's "price + cadence" one-liner (e.g. "$24.99 per month").
+// Returns an already-escaped string. The price is formatted only when the
+// amount + currency are well-formed (a validated plan row always is); a
+// malformed row degrades to the cadence-only phrase by an EXPLICIT check
+// rather than by swallowing a thrown pricing.format error — so bad data
+// degrades visibly-by-design and never hides a defect behind a catch.
+function _planPriceCadence(plan) {
+  var esc = b.template.escapeHtml;
+  if (!plan) return "Plan unavailable";
+  var ccy = String(plan.currency || "").toUpperCase();
+  var amount = Number(plan.amount_minor);
+  var every = Number(plan.interval_count) > 1
+    ? "every " + Number(plan.interval_count) + " " + esc(String(plan.interval)) + "s"
+    : "per " + esc(String(plan.interval));
+  // pricing.format throws on a non-integer/negative amount or a non-ISO-4217
+  // currency; gate on exactly those preconditions so it is only ever called
+  // with input it accepts (no try/catch needed).
+  if (Number.isInteger(amount) && amount >= 0 && /^[A-Z]{3}$/.test(ccy)) {
+    return esc(pricing.format(amount, ccy)) + " " + every;
+  }
+  return every;
+}
+
+// Customer-facing plan-change page. `opts.subscription` carries the
+// resolved current `plan`; `opts.candidates` is an array of
+// { plan, preview } where preview is the proposeChange result for the
+// IMMEDIATE timing (proration_credit_minor + first_charge_minor +
+// currency). `opts.pending` is the open change to offer a cancel for, or
+// null. Confirm-gated: a single form, one radio per candidate plan, an
+// immediate-vs-next-cycle timing choice, and a submit. CSP forbids
+// inline script, so the proration math is server-rendered as static copy
+// — there's no client recompute. The CSRF field is spliced into the POST
+// form by `_injectCsrfFields` at send time. Everything dynamic is esc()'d.
+function renderSubscriptionPlanChange(opts) {
+  var esc = b.template.escapeHtml;
+  var s = opts.subscription || {};
+  var candidates = opts.candidates || [];
+  var pending = opts.pending || null;
+  var currentSummary = _planPriceCadence(s.plan || null);
+
+  var noticeHtml = opts.error
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.error)) + "</p>"
+    : "";
+
+  // A pending change blocks queuing a new one (the primitive refuses a
+  // second). Render the standing change + a cancel control instead of the
+  // candidate picker.
+  var pendingHtml = "";
+  if (pending) {
+    var toSummary = _planPriceCadence(pending.to_plan || null);
+    var kindCopy = pending.change_kind === "next_billing_cycle"
+      ? "at your next billing date"
+      : "immediately";
+    var effDate = pending.effective_at
+      ? new Date(Number(pending.effective_at)).toISOString().slice(0, 10)
+      : "";
+    pendingHtml =
+      "<div class=\"plan-change-pending\">" +
+        "<p class=\"plan-change-pending__lede\">A change to " + toSummary + " is scheduled " + esc(kindCopy) +
+          (effDate ? " (<time datetime=\"" + esc(effDate) + "\">" + esc(effDate) + "</time>)" : "") + ".</p>" +
+        "<form method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/change/cancel\">" +
+          "<button type=\"submit\" class=\"btn-ghost\">Cancel scheduled change</button>" +
+        "</form>" +
+      "</div>";
+  }
+
+  // Candidate picker — only when there's no pending change to clear first.
+  var pickerHtml = "";
+  if (!pending) {
+    if (!candidates.length) {
+      pickerHtml = "<p class=\"plan-change__empty\">There are no other plans to switch to right now.</p>";
+    } else {
+      var optionsHtml = "";
+      for (var i = 0; i < candidates.length; i += 1) {
+        var c = candidates[i];
+        var plan = c.plan;
+        var preview = c.preview || {};
+        var prevCcy = String(preview.currency || (plan && plan.currency) || "usd").toUpperCase();
+        var creditMinor = Number(preview.proration_credit_minor) || 0;
+        var chargeMinor = Number(preview.first_charge_minor) || 0;
+        // Net the proration into the single number the customer cares about:
+        // an upgrade charges (charge − credit) now; a downgrade leaves them
+        // (credit − charge) in store credit. Exactly one is non-zero, both
+        // floored at 0. Mirrors the primitive's executeChange split.
+        var netCharge = chargeMinor - creditMinor > 0 ? chargeMinor - creditMinor : 0;
+        var netCredit = creditMinor - chargeMinor > 0 ? creditMinor - chargeMinor : 0;
+        // netCharge/netCredit are non-negative integers by construction; the
+        // only value that could make pricing.format throw is a malformed
+        // currency, so gate the formatted copy on a valid ISO-4217 code by an
+        // EXPLICIT check rather than catching a thrown format error. A bad
+        // currency degrades to the amount-free phrase, visibly-by-design.
+        var validCcy = /^[A-Z]{3}$/.test(prevCcy);
+        var prorationCopy;
+        if (validCcy && netCharge > 0) {
+          prorationCopy = "Switch now and you'll be charged " + esc(pricing.format(netCharge, prevCcy)) + " for the rest of this period.";
+        } else if (validCcy && netCredit > 0) {
+          prorationCopy = "Switch now and you'll get " + esc(pricing.format(netCredit, prevCcy)) + " in store credit for the unused part of this period.";
+        } else if (validCcy) {
+          prorationCopy = "Switch now at no extra charge for the rest of this period.";
+        } else {
+          prorationCopy = "Switch now — proration applies for the rest of this period.";
+        }
+        optionsHtml +=
+          "<li class=\"plan-change-option\">" +
+            "<label class=\"plan-change-option__label\">" +
+              "<input type=\"radio\" name=\"new_plan_id\" value=\"" + esc(String(plan.id)) + "\"" + (i === 0 ? " checked" : "") + " required>" +
+              "<span class=\"plan-change-option__plan\">" + _planPriceCadence(plan) + "</span>" +
+              "<span class=\"plan-change-option__proration\">" + prorationCopy + "</span>" +
+            "</label>" +
+          "</li>";
+      }
+      pickerHtml =
+        "<form method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/change\">" +
+          "<fieldset class=\"plan-change__plans\">" +
+            "<legend class=\"plan-change__legend\">Choose a new plan</legend>" +
+            "<ul class=\"plan-change-options\">" + optionsHtml + "</ul>" +
+          "</fieldset>" +
+          "<fieldset class=\"plan-change__timing\">" +
+            "<legend class=\"plan-change__legend\">When should it take effect?</legend>" +
+            "<label class=\"plan-change-timing__option\">" +
+              "<input type=\"radio\" name=\"timing\" value=\"immediate\" checked>" +
+              "<span>Now — with proration for the rest of this period</span>" +
+            "</label>" +
+            "<label class=\"plan-change-timing__option\">" +
+              "<input type=\"radio\" name=\"timing\" value=\"next_cycle\">" +
+              "<span>At my next billing date — no proration, the new plan starts clean</span>" +
+            "</label>" +
+          "</fieldset>" +
+          "<button type=\"submit\" class=\"btn-primary\">Change plan</button>" +
+        "</form>";
+    }
+  }
+
+  var body =
+    "<section class=\"account-confirm plan-change\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/subscriptions\">Subscriptions</a></li>" +
+        "<li aria-current=\"page\">Change plan</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-confirm__title\">Change your plan</h1>" +
+      "<p class=\"plan-change__current\">You're currently on " + currentSummary + ".</p>" +
+      noticeHtml +
+      pendingHtml +
+      pickerHtml +
+      "<a class=\"btn-ghost\" href=\"/account/subscriptions\">Back to subscriptions</a>" +
+    "</section>";
+  return _wrap({
+    title:      "Change plan",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Product-level "Save to wishlist" control + social-proof count.
 // Byte-compatible with the edge renderer (`worker/render/product.js`)
 // so both paths emit identical markup. Action-only label — the toggle
@@ -18865,6 +19069,14 @@ function mount(router, deps) {
       // state — so they're available even on a deploy with no payment
       // handle. The list above stays a read-only view when this is absent.
       var subControls = deps.subscriptionControls || null;
+      // Proration-aware plan upgrade / downgrade. Mounts the
+      // /account/subscriptions/:id/change confirm-gated surface (preview the
+      // proration credit / first charge per candidate plan + pick immediate
+      // vs next-cycle timing) plus the cancel-pending POST. Wired only when
+      // server.js composed it (needs subscriptions + store credit — the
+      // vehicle a mid-cycle downgrade's owed credit pays into). Absent it,
+      // the list stays the lifecycle-only view above.
+      var planChanges = deps.planChanges || null;
 
       async function _subsAuth(req, res) {
         var auth;
@@ -18939,6 +19151,33 @@ function mount(router, deps) {
           ? "Your subscription has been canceled."
           : _subscriptionOkCopy(okKind);
         var errKind = url ? url.searchParams.get("error") : null;
+        // Pending plan changes — when the plan-change surface is wired, look
+        // up the open (proposed/pending) change per subscription so the list
+        // can show a "change scheduled" banner with a cancel control. The
+        // banner is an enhancement to a critical page (the list must render),
+        // so a read failure is OBSERVED via _log.error and the banners are
+        // dropped for this render — degrade-with-observability, never a silent
+        // swallow. plans.get returns null for a deleted target plan (handled
+        // by the renderer); only a genuine failure reaches the catch.
+        var pendingChanges = {};
+        if (planChanges) {
+          try {
+            for (var pci = 0; pci < rows.length; pci += 1) {
+              var pcSub = rows[pci];
+              var pcRow = await planChanges.pendingChangeFor(pcSub.id);
+              if (pcRow) {
+                pcRow.to_plan = await subscriptions.plans.get(pcRow.to_plan_id);
+                pendingChanges[pcSub.id] = pcRow;
+              }
+            }
+          } catch (e) {
+            _log.error("subscription list: pending plan-change lookup failed", {
+              request_id: (req && req.requestId) || null,
+              err:        (e && e.message) || String(e),
+            });
+            pendingChanges = {};
+          }
+        }
         _send(res, 200, renderAccountSubscriptions({
           subscriptions: rows,
           can_cancel:    subsCanCancel,
@@ -18948,6 +19187,10 @@ function mount(router, deps) {
           // handle with retrieve + update was wired) — otherwise the
           // controls are local-only and the cadence is still editable.
           stripe_backed: !!(subControls && subControls.stripeBacked),
+          // Plan-change link + pending-change banner render only when the
+          // surface is wired.
+          can_change:      !!planChanges,
+          pending_changes: pendingChanges,
           notice:        notice,
           error:         _subscriptionErrorCopy(errKind),
           shop_name:     shopName,
@@ -19172,6 +19415,183 @@ function mount(router, deps) {
           return res.end ? res.end() : res.send("");
         });
       }
+
+      // Plan change — proration-aware self-serve upgrade / downgrade. Mounts
+      // only when the plan-change primitive is wired (server.js composes it
+      // from subscriptions + store credit). The GET renders a confirm-gated
+      // page listing every candidate plan with its proration preview; the
+      // POST executes the chosen change (immediate or next-cycle); a third
+      // POST cancels a still-pending change. Every route owns its
+      // subscription through the same `_ownedSubscription` IDOR check the
+      // cancel flow uses (a forged/foreign id 404s before any read), and
+      // every primitive refusal maps to a fixed ?error code rather than a
+      // 500.
+      if (planChanges) {
+        function _pcRedirect(res, suffix) {
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/account/subscriptions" + suffix);
+          return res.end ? res.end() : res.send("");
+        }
+
+        // Translate a planChanges rejection into a fixed ?error code. A
+        // pending-change collision, an unknown subscription/plan, and a
+        // validation TypeError (cross-currency / same-plan / archived plan)
+        // each map to a stable code; a Stripe-backed change whose target
+        // plan has no Stripe price (PLAN_CHANGE_STRIPE_PRICE_MISSING) is a
+        // misconfiguration the customer can't act on but must not 500;
+        // a transient Stripe push failure (PLAN_CHANGE_STRIPE_PUSH_FAILED /
+        // _NO_ITEM) leaves the local plan untouched and surfaces a "nothing
+        // changed, retry" notice rather than a 500. Anything else rethrows
+        // (a real 500, e.g. an unmigrated table on a misconfigured deploy).
+        function _planChangeError(e) {
+          if (e && e.code === "PLAN_CHANGE_REFUSED")              return "pending_exists";
+          if (e && e.code === "SUBSCRIPTION_NOT_FOUND")           return "state";
+          if (e && e.code === "PLAN_NOT_FOUND")                   return "state";
+          if (e && e.code === "NO_PENDING_CHANGE")                return "state";
+          if (e && e.code === "PLAN_CHANGE_STRIPE_PRICE_MISSING") return "plan";
+          if (e && e.code === "PLAN_CHANGE_STRIPE_PUSH_FAILED")   return "processor";
+          if (e && e.code === "PLAN_CHANGE_STRIPE_NO_ITEM")       return "processor";
+          if (e instanceof TypeError)                              return "plan";
+          return null;
+        }
+
+        // Resolve every plan a subscription can switch TO: every active plan
+        // sharing the current plan's currency, minus the current plan
+        // itself. A cross-currency or archived plan is excluded here so the
+        // confirm page never offers a candidate the primitive would refuse.
+        // For each candidate, compute the immediate-timing proration preview
+        // (credit + first charge) — the page shows both timings, but only
+        // the immediate one prorates, so a single proposeChange per candidate
+        // covers the preview. proposeChange persists nothing.
+        async function _changeCandidates(sub) {
+          // A read failure here is a real error, not a "no candidates" state —
+          // let it propagate to the route's _routeError (logged + generic),
+          // never mask it. The current-plan lookup returns null for a deleted
+          // plan (a legitimate value handled below), and only throws on a real
+          // DB failure (which also propagates).
+          var allPlans = await subscriptions.plans.list({ active: true });
+          var fromPlan = sub.plan_id != null ? await subscriptions.plans.get(sub.plan_id) : null;
+          if (!fromPlan) return [];   // no resolvable current plan → nothing to prorate a switch against
+          var fromCcy     = String(fromPlan.currency);
+          var fromAmount  = Number(fromPlan.amount_minor);
+          var periodStart = Number(sub.current_period_start);
+          var periodEnd   = Number(sub.current_period_end);
+          var nowMs       = Date.now();
+          var out = [];
+          for (var i = 0; i < allPlans.length; i += 1) {
+            var p = allPlans[i];
+            if (p.id === sub.plan_id) continue;             // never the current plan
+            if (!p.active) continue;                        // archived → executeChange refuses
+            if (String(p.currency) !== fromCcy) continue;   // cross-currency → executeChange refuses
+            // Immediate-timing proration preview via the primitive's exported
+            // PURE math — no DB round-trip and no throw for valid integers, so
+            // there is no error to swallow. The actual switch re-validates the
+            // full shape through executeChange on POST.
+            var pr = planChanges.prorate(fromAmount, Number(p.amount_minor), periodStart, periodEnd, nowMs);
+            out.push({
+              plan: p,
+              preview: {
+                proration_credit_minor: pr.proration_credit_minor,
+                first_charge_minor:     pr.first_charge_minor,
+                currency:               fromCcy,
+              },
+            });
+          }
+          return out;
+        }
+
+        router.get("/account/subscriptions/:id/change", async function (req, res) {
+          var auth = await _subsAuth(req, res); if (!auth) return;
+          var sub = await _ownedSubscription(req, res, auth); if (!sub) return;
+          // Only an active, self-manageable subscription can change plans — a
+          // terminal / paused / cancelled row (even one that still carries
+          // period columns) is refused here, matching the display gate that
+          // decides whether to show the "Change plan" link.
+          if (!_subscriptionSelfManageable(sub) || _subscriptionControlState(sub) !== "active") {
+            return _pcRedirect(res, "?error=state");
+          }
+          // A subscription with no live billing period can't be prorated;
+          // bounce to the list rather than render an empty change page.
+          if (sub.current_period_start == null || sub.current_period_end == null) {
+            return _pcRedirect(res, "?error=state");
+          }
+          try {
+            // A read failure on any of these is a real error — route it
+            // through _routeError (logs server-side + returns a generic,
+            // leak-free message) rather than masking it with a per-read
+            // catch. plans.get returns null for a deleted plan (a value the
+            // renderer handles); only a genuine failure throws here.
+            if (sub.plan_id != null) sub.plan = await subscriptions.plans.get(sub.plan_id);
+            var candidates = await _changeCandidates(sub);
+            var pending = await planChanges.pendingChangeFor(sub.id);
+            if (pending) pending.to_plan = await subscriptions.plans.get(pending.to_plan_id);
+            var url = req.url ? new URL(req.url, "http://localhost") : null;
+            var errKind = url ? url.searchParams.get("error") : null;
+            var cartCount = await _cartCountForReq(req);
+            _send(res, 200, renderSubscriptionPlanChange({
+              subscription: sub,
+              candidates:   candidates,
+              pending:      pending,
+              error:        _subscriptionErrorCopy(errKind),
+              shop_name:    shopName,
+              cart_count:   cartCount,
+            }));
+          } catch (e) {
+            return _routeError(req, res, e);
+          }
+        });
+
+        router.post("/account/subscriptions/:id/change", async function (req, res) {
+          var auth = await _subsAuth(req, res); if (!auth) return;
+          var sub = await _ownedSubscription(req, res, auth); if (!sub) return;
+          // Reject a plan change on a non-active subscription (terminal /
+          // paused / cancelled) before any write — the same gate the display
+          // and GET enforce, so a forged POST can't re-plan a wound-down row.
+          if (!_subscriptionSelfManageable(sub) || _subscriptionControlState(sub) !== "active") {
+            return _pcRedirect(res, "?error=state");
+          }
+          var body = req.body || {};
+          var newPlanId = String(body.new_plan_id || "");
+          // Backend validates: an empty / missing plan id is a client error
+          // → bounce with the plan code rather than handing garbage to the
+          // primitive.
+          if (!newPlanId) return _pcRedirect(res, "/" + encodeURIComponent(sub.id) + "/change?error=plan");
+          var timing = String(body.timing || "immediate");
+          if (timing !== "immediate" && timing !== "next_cycle") {
+            return _pcRedirect(res, "/" + encodeURIComponent(sub.id) + "/change?error=state");
+          }
+          // next_cycle defers the change to the period boundary: the
+          // primitive derives `next_billing_cycle` (and zero proration) when
+          // change_at >= current_period_end. Immediate omits change_at, so
+          // the primitive applies it at Date.now() with full proration.
+          var changeArgs = { subscription_id: sub.id, new_plan_id: newPlanId };
+          if (timing === "next_cycle") {
+            if (sub.current_period_end == null) {
+              return _pcRedirect(res, "/" + encodeURIComponent(sub.id) + "/change?error=state");
+            }
+            changeArgs.change_at = Number(sub.current_period_end);
+          }
+          try {
+            await planChanges.executeChange(changeArgs);
+          } catch (e) {
+            var code = _planChangeError(e); if (code == null) throw e;
+            return _pcRedirect(res, "/" + encodeURIComponent(sub.id) + "/change?error=" + code);
+          }
+          return _pcRedirect(res, "?ok=plan_changed");
+        });
+
+        router.post("/account/subscriptions/:id/change/cancel", async function (req, res) {
+          var auth = await _subsAuth(req, res); if (!auth) return;
+          var sub = await _ownedSubscription(req, res, auth); if (!sub) return;
+          try {
+            await planChanges.cancelPendingChange({ subscription_id: sub.id });
+          } catch (e) {
+            var code = _planChangeError(e); if (code == null) throw e;
+            return _pcRedirect(res, "?error=" + code);
+          }
+          return _pcRedirect(res, "?ok=change_canceled");
+        });
+      }
     }
 
     // Pre-order reservations — the PDP reserve POST + the customer's