@mesub/node 0.0.0-stage → 0.1.0

package/dist/errors-CtPucyOh.d.cts

@@ -0,0 +1,112 @@
+import { j as ServerSubscription } from './subscriptions-D1hE7MUc.cjs';
+
+/**
+ * Stable codes to branch on, one per kind of failure; `apiCode` tells the
+ * causes within one apart. `unexpected` covers any status without its own
+ * code (408, 413, a 2xx whose body is not JSON or not of the shape the SDK
+ * reads, a 404 whose body is not a Mesub error, so a wrong `baseUrl`, ...).
+ * `invalid_webhook` is a webhook that fails verification: a header missing,
+ * no signature matching the secret, a timestamp too far from now.
+ */
+type MesubErrorCode = 'invalid_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'plan_not_found' | 'conflict' | 'rate_limited' | 'unavailable' | 'invalid_webhook' | 'unexpected';
+interface MesubErrorOptions {
+    status: number | null;
+    code: MesubErrorCode;
+    /** The back's own code, from the error body. Defaults to null. */
+    apiCode?: string | null;
+    /** Defaults to true for `unavailable` and `rate_limited`, false otherwise. */
+    retryable?: boolean;
+    /** What Mesub answered, when it answered. */
+    body?: unknown;
+    /** Milliseconds, from the response's `Retry-After`. Defaults to null. */
+    retryAfter?: number | null;
+    /** The response's `Mesub-Request-Id`, or the body's `request_id`. Defaults to null. */
+    requestId?: string | null;
+    cause?: unknown;
+}
+/** Every failure of a call to the Mesub API, after retries. */
+declare class MesubError extends Error {
+    readonly name = "MesubError";
+    /**
+     * The HTTP status, or `null` when no response came back (network error,
+     * timeout). On the copy an Express middleware hands to `next(err)` for a
+     * 4xx of Mesub's, 500: Mesub's own is on `cause`.
+     */
+    readonly status: number | null;
+    readonly code: MesubErrorCode;
+    /**
+     * The code Mesub's error body names (`subscription_not_found`,
+     * `pending_cap_reached`, ...), finer than `code` and as stable: never
+     * renamed nor reused, though new ones get added. Null when no Mesub error
+     * came back: a network error, a timeout, a body that is not Mesub's.
+     */
+    readonly apiCode: string | null;
+    /**
+     * Whether the same call, sent again unchanged, may succeed later without
+     * anybody doing anything: Mesub's own `retryable` when it sent one. Not
+     * "at once": the SDK has already retried what it retries.
+     */
+    readonly retryable: boolean;
+    /**
+     * The body Mesub answered, parsed when it is JSON, the text otherwise;
+     * undefined when no response came back.
+     */
+    readonly body: unknown;
+    /**
+     * How long Mesub asked to wait before the same call is sent again, in
+     * milliseconds, from the response's `Retry-After`, as sent. It comes on
+     * a 429 (`rate_limited`, or `pending_cap_reached` on create: a quota,
+     * not a rate, and the wait may be most of an hour), on every 503 of a
+     * route that builds, sends or queues (`network_unavailable`, about 10 s;
+     * `unavailable` on `submit`, about 2 s, and on `retry`, about 20 s),
+     * and on two 409s:
+     * `retry_too_soon` on `retry`, and `comeback_period_rolling` on
+     * `create`, `transaction` and `submit`. Null when the response had none,
+     * or none came back.
+     */
+    readonly retryAfter: number | null;
+    /**
+     * The id Mesub gave the request (`req_` and 24 letters or digits), from
+     * the response's `Mesub-Request-Id` header, or the error body's
+     * `request_id` when a proxy dropped the header (Mesub-io/backend#472).
+     * Log it, and quote it to Mesub support: it finds the request in Mesub's
+     * logs. Null when no response came back, or one that is not Mesub's.
+     */
+    readonly requestId: string | null;
+    constructor(message: string, options: MesubErrorOptions);
+}
+/** What a `MesubSubmitError` carries beyond a `MesubError`'s. */
+interface MesubSubmitErrorOptions extends MesubErrorOptions {
+    subscription: ServerSubscription | null;
+    sends: number;
+}
+/**
+ * A submit whose outcome Mesub never told, thrown with the subscription read
+ * back. The wallet may have paid: `subscription` is never `active` nor
+ * `cancelled` (those are returned), and null when that read failed too. Read
+ * it again with `retrieve` before creating anew; a `pending` one may still
+ * land, and Mesub settles it on its own within the hour. Three cases:
+ *
+ * - no send got an answer that says (a timeout, a network error, a 5xx,
+ *   after the replays): `code` is `unavailable` and `retryable` true, since
+ *   the same submit, sent again with the same transaction and terms
+ *   signature, co-signs nothing more and is answered from the chain
+ *   (Mesub-io/backend#190). `status`, `apiCode`, `body`, `retryAfter` and `requestId` are
+ *   those of the last send that got a response (a 503, a 429), or all null
+ *   when none did (timeouts, network errors);
+ * - a replay refused with `not_awaiting_signature` after a send that got no
+ *   answer: the row moved on (`failed`, `expired`), and the error is that
+ *   refusal's, `conflict`, not retryable;
+ * - a 2xx this SDK cannot read: `unexpected`, not retryable, its fields.
+ *
+ * `cause` is always the last send's own error.
+ */
+declare class MesubSubmitError extends MesubError {
+    /** The subscription as read back after the last send, or null if that read failed. */
+    readonly subscription: ServerSubscription | null;
+    /** How many times the submit was sent, the same request each time. */
+    readonly sends: number;
+    constructor(message: string, options: MesubSubmitErrorOptions);
+}
+
+export { MesubError as M, type MesubErrorCode as a, type MesubErrorOptions as b, MesubSubmitError as c, type MesubSubmitErrorOptions as d };

package/dist/errors-DqW3DMBS.d.ts

@@ -0,0 +1,112 @@
+import { j as ServerSubscription } from './subscriptions-D1hE7MUc.js';
+
+/**
+ * Stable codes to branch on, one per kind of failure; `apiCode` tells the
+ * causes within one apart. `unexpected` covers any status without its own
+ * code (408, 413, a 2xx whose body is not JSON or not of the shape the SDK
+ * reads, a 404 whose body is not a Mesub error, so a wrong `baseUrl`, ...).
+ * `invalid_webhook` is a webhook that fails verification: a header missing,
+ * no signature matching the secret, a timestamp too far from now.
+ */
+type MesubErrorCode = 'invalid_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'plan_not_found' | 'conflict' | 'rate_limited' | 'unavailable' | 'invalid_webhook' | 'unexpected';
+interface MesubErrorOptions {
+    status: number | null;
+    code: MesubErrorCode;
+    /** The back's own code, from the error body. Defaults to null. */
+    apiCode?: string | null;
+    /** Defaults to true for `unavailable` and `rate_limited`, false otherwise. */
+    retryable?: boolean;
+    /** What Mesub answered, when it answered. */
+    body?: unknown;
+    /** Milliseconds, from the response's `Retry-After`. Defaults to null. */
+    retryAfter?: number | null;
+    /** The response's `Mesub-Request-Id`, or the body's `request_id`. Defaults to null. */
+    requestId?: string | null;
+    cause?: unknown;
+}
+/** Every failure of a call to the Mesub API, after retries. */
+declare class MesubError extends Error {
+    readonly name = "MesubError";
+    /**
+     * The HTTP status, or `null` when no response came back (network error,
+     * timeout). On the copy an Express middleware hands to `next(err)` for a
+     * 4xx of Mesub's, 500: Mesub's own is on `cause`.
+     */
+    readonly status: number | null;
+    readonly code: MesubErrorCode;
+    /**
+     * The code Mesub's error body names (`subscription_not_found`,
+     * `pending_cap_reached`, ...), finer than `code` and as stable: never
+     * renamed nor reused, though new ones get added. Null when no Mesub error
+     * came back: a network error, a timeout, a body that is not Mesub's.
+     */
+    readonly apiCode: string | null;
+    /**
+     * Whether the same call, sent again unchanged, may succeed later without
+     * anybody doing anything: Mesub's own `retryable` when it sent one. Not
+     * "at once": the SDK has already retried what it retries.
+     */
+    readonly retryable: boolean;
+    /**
+     * The body Mesub answered, parsed when it is JSON, the text otherwise;
+     * undefined when no response came back.
+     */
+    readonly body: unknown;
+    /**
+     * How long Mesub asked to wait before the same call is sent again, in
+     * milliseconds, from the response's `Retry-After`, as sent. It comes on
+     * a 429 (`rate_limited`, or `pending_cap_reached` on create: a quota,
+     * not a rate, and the wait may be most of an hour), on every 503 of a
+     * route that builds, sends or queues (`network_unavailable`, about 10 s;
+     * `unavailable` on `submit`, about 2 s, and on `retry`, about 20 s),
+     * and on two 409s:
+     * `retry_too_soon` on `retry`, and `comeback_period_rolling` on
+     * `create`, `transaction` and `submit`. Null when the response had none,
+     * or none came back.
+     */
+    readonly retryAfter: number | null;
+    /**
+     * The id Mesub gave the request (`req_` and 24 letters or digits), from
+     * the response's `Mesub-Request-Id` header, or the error body's
+     * `request_id` when a proxy dropped the header (Mesub-io/backend#472).
+     * Log it, and quote it to Mesub support: it finds the request in Mesub's
+     * logs. Null when no response came back, or one that is not Mesub's.
+     */
+    readonly requestId: string | null;
+    constructor(message: string, options: MesubErrorOptions);
+}
+/** What a `MesubSubmitError` carries beyond a `MesubError`'s. */
+interface MesubSubmitErrorOptions extends MesubErrorOptions {
+    subscription: ServerSubscription | null;
+    sends: number;
+}
+/**
+ * A submit whose outcome Mesub never told, thrown with the subscription read
+ * back. The wallet may have paid: `subscription` is never `active` nor
+ * `cancelled` (those are returned), and null when that read failed too. Read
+ * it again with `retrieve` before creating anew; a `pending` one may still
+ * land, and Mesub settles it on its own within the hour. Three cases:
+ *
+ * - no send got an answer that says (a timeout, a network error, a 5xx,
+ *   after the replays): `code` is `unavailable` and `retryable` true, since
+ *   the same submit, sent again with the same transaction and terms
+ *   signature, co-signs nothing more and is answered from the chain
+ *   (Mesub-io/backend#190). `status`, `apiCode`, `body`, `retryAfter` and `requestId` are
+ *   those of the last send that got a response (a 503, a 429), or all null
+ *   when none did (timeouts, network errors);
+ * - a replay refused with `not_awaiting_signature` after a send that got no
+ *   answer: the row moved on (`failed`, `expired`), and the error is that
+ *   refusal's, `conflict`, not retryable;
+ * - a 2xx this SDK cannot read: `unexpected`, not retryable, its fields.
+ *
+ * `cause` is always the last send's own error.
+ */
+declare class MesubSubmitError extends MesubError {
+    /** The subscription as read back after the last send, or null if that read failed. */
+    readonly subscription: ServerSubscription | null;
+    /** How many times the submit was sent, the same request each time. */
+    readonly sends: number;
+    constructor(message: string, options: MesubSubmitErrorOptions);
+}
+
+export { MesubError as M, type MesubErrorCode as a, type MesubErrorOptions as b, MesubSubmitError as c, type MesubSubmitErrorOptions as d };

package/dist/express.cjs

@@ -0,0 +1,129 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
+
+
+
+
+var _chunkPCDZI7B4cjs = require('./chunk-PCDZI7B4.cjs');
+
+
+
+
+
+
+
+
+
+
+
+var _chunkVMKI4VVAcjs = require('./chunk-VMKI4VVA.cjs');
+
+
+var _chunkSGSYQJYTcjs = require('./chunk-SGSYQJYT.cjs');
+
+// src/express.ts
+function forNext(error) {
+  if (!(error instanceof _chunkSGSYQJYTcjs.MesubError) || error.status === null) return error;
+  if (error.status < 400 || error.status >= 500) return error;
+  return new (0, _chunkSGSYQJYTcjs.MesubError)(error.message, {
+    status: 500,
+    code: error.code,
+    apiCode: error.apiCode,
+    retryable: error.retryable,
+    body: error.body,
+    retryAfter: error.retryAfter,
+    requestId: error.requestId,
+    cause: error
+  });
+}
+function requirePlan(plan, options) {
+  _chunkVMKI4VVAcjs.checkPlan.call(void 0, plan);
+  _chunkVMKI4VVAcjs.checkCustomer.call(void 0, options);
+  return async (req, res, next) => {
+    try {
+      const client = _nullishCoalesce(options.client, () => ( _chunkVMKI4VVAcjs.defaultClient.call(void 0, )));
+      const outcome = await _chunkVMKI4VVAcjs.guard.call(void 0, 
+        client,
+        await _chunkVMKI4VVAcjs.askerOf.call(void 0, req, options.customer),
+        () => _chunkVMKI4VVAcjs.plansOf.call(void 0, plan, req)
+      );
+      if (outcome.allowed) {
+        const locals = _chunkVMKI4VVAcjs.accessOf.call(void 0, outcome);
+        res.locals["mesub"] = locals;
+        return next();
+      }
+      const denial = _chunkVMKI4VVAcjs.denialOf.call(void 0, outcome);
+      if (options.onDenied) {
+        await options.onDenied(denial, req, res, next);
+        return;
+      }
+      if (outcome.reason === "unavailable") {
+        res.setHeader("Retry-After", _chunkVMKI4VVAcjs.retryAfterOf.call(void 0, outcome));
+      }
+      res.status(denial.status).json(_chunkVMKI4VVAcjs.denialBody.call(void 0, outcome));
+    } catch (error) {
+      next(forNext(error));
+    }
+  };
+}
+async function jsonBody(req) {
+  const parsed = req.body;
+  if (parsed !== void 0 && !(typeof parsed === "string" && parsed === "")) return parsed;
+  if (req.method === "GET") return void 0;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += bytes.length;
+    if (size > _chunkPCDZI7B4cjs.MAX_BODY_BYTES) throw new RangeError("The body is too large.");
+    chunks.push(bytes);
+  }
+  if (size === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function mesubRoutes(options) {
+  _chunkPCDZI7B4cjs.checkWidgetOptions.call(void 0, options);
+  return async (req, res, next) => {
+    try {
+      let body;
+      try {
+        body = await jsonBody(req);
+      } catch (error) {
+        const tooLarge = error instanceof RangeError;
+        res.status(tooLarge ? 413 : 400).json({
+          error: {
+            code: tooLarge ? "payload_too_large" : "invalid_request",
+            message: tooLarge ? "The body is too large." : "The body is not JSON."
+          }
+        });
+        return;
+      }
+      const publicRead = req.method === "GET" && req.path.startsWith("/plans/");
+      const asked = publicRead ? null : await _chunkPCDZI7B4cjs.widgetCustomer.call(void 0, req, options.customer);
+      const email = asked && options.email ? await options.email(req) : void 0;
+      const answer = await _chunkPCDZI7B4cjs.handleWidget.call(void 0, 
+        _nullishCoalesce(options.client, () => ( _chunkVMKI4VVAcjs.defaultClient.call(void 0, ))),
+        {
+          method: req.method,
+          path: req.path,
+          body,
+          contentType: _nullishCoalesce(req.get("content-type"), () => ( null))
+        },
+        asked,
+        { email, ...options.plans && { plans: options.plans } }
+      );
+      for (const [name, value] of Object.entries(_nullishCoalesce(answer.headers, () => ( {})))) {
+        res.setHeader(name, value);
+      }
+      res.setHeader("Cache-Control", "no-store");
+      res.status(answer.status).json(answer.body);
+    } catch (error) {
+      next(forNext(error));
+    }
+  };
+}
+
+
+
+
+exports.MesubError = _chunkSGSYQJYTcjs.MesubError; exports.mesubRoutes = mesubRoutes; exports.requirePlan = requirePlan;
+//# sourceMappingURL=express.cjs.map

package/dist/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/node-sdk/node-sdk/dist/express.cjs","../src/express.ts"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACA;AC2BA,SAAS,OAAA,CAAQ,KAAA,EAAyB;AACtC,EAAA,GAAA,CAAI,CAAA,CAAE,MAAA,WAAiB,4BAAA,EAAA,GAAe,KAAA,CAAM,OAAA,IAAW,IAAA,EAAM,OAAO,KAAA;AACpE,EAAA,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,IAAA,GAAO,KAAA,CAAM,OAAA,GAAU,GAAA,EAAK,OAAO,KAAA;AAEtD,EAAA,OAAO,IAAI,iCAAA,CAAW,KAAA,CAAM,OAAA,EAAS;AAAA,IACjC,MAAA,EAAQ,GAAA;AAAA,IACR,IAAA,EAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAA,EAAS,KAAA,CAAM,OAAA;AAAA,IACf,SAAA,EAAW,KAAA,CAAM,SAAA;AAAA,IACjB,IAAA,EAAM,KAAA,CAAM,IAAA;AAAA,IACZ,UAAA,EAAY,KAAA,CAAM,UAAA;AAAA,IAClB,SAAA,EAAW,KAAA,CAAM,SAAA;AAAA,IACjB,KAAA,EAAO;AAAA,EACX,CAAC,CAAA;AACL;AAoCO,SAAS,WAAA,CACZ,IAAA,EACA,OAAA,EACc;AACd,EAAA,yCAAA,IAAc,CAAA;AACd,EAAA,6CAAA,OAAqB,CAAA;AAErB,EAAA,OAAO,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,IAAA,EAAA,GAAS;AAC7B,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,mBAAS,OAAA,CAAQ,MAAA,UAAU,6CAAA,GAAc;AAC/C,MAAA,MAAM,QAAA,EAAU,MAAM,qCAAA;AAAA,QAAM,MAAA;AAAA,QAAQ,MAAM,uCAAA,GAAQ,EAAK,OAAA,CAAQ,QAAQ,CAAA;AAAA,QAAG,CAAA,EAAA,GACtE,uCAAA,IAAQ,EAAM,GAAG;AAAA,MACrB,CAAA;AAEA,MAAA,GAAA,CAAI,OAAA,CAAQ,OAAA,EAAS;AACjB,QAAA,MAAM,OAAA,EAAsB,wCAAA,OAAgB,CAAA;AAC5C,QAAA,GAAA,CAAI,MAAA,CAAO,OAAO,EAAA,EAAI,MAAA;AAEtB,QAAA,OAAO,IAAA,CAAK,CAAA;AAAA,MAChB;AAEA,MAAA,MAAM,OAAA,EAAS,wCAAA,OAAgB,CAAA;AAE/B,MAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU;AAElB,QAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,GAAA,EAAK,GAAA,EAAK,IAAI,CAAA;AAE7C,QAAA,MAAA;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,OAAA,CAAQ,OAAA,IAAW,aAAA,EAAe;AAClC,QAAA,GAAA,CAAI,SAAA,CAAU,aAAA,EAAe,4CAAA,OAAoB,CAAC,CAAA;AAAA,MACtD;AAEA,MAAA,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,IAAA,CAAK,0CAAA,OAAkB,CAAC,CAAA;AAAA,IACtD,EAAA,MAAA,CAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACvB;AAAA,EACJ,CAAA;AACJ;AAGA,MAAA,SAAe,QAAA,CAAS,GAAA,EAAgC;AACpD,EAAA,MAAM,OAAA,EAAmB,GAAA,CAA2B,IAAA;AAEpD,EAAA,GAAA,CAAI,OAAA,IAAW,KAAA,EAAA,GAAa,CAAA,CAAE,OAAO,OAAA,IAAW,SAAA,GAAY,OAAA,IAAW,EAAA,CAAA,EAAK,OAAO,MAAA;AACnF,EAAA,GAAA,CAAI,GAAA,CAAI,OAAA,IAAW,KAAA,EAAO,OAAO,KAAA,CAAA;AAEjC,EAAA,MAAM,OAAA,EAAmB,CAAC,CAAA;AAC1B,EAAA,IAAI,KAAA,EAAO,CAAA;AAEX,EAAA,IAAA,MAAA,CAAA,MAAiB,MAAA,GAAS,GAAA,EAAK;AAC3B,IAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,QAAA,CAAS,KAAK,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AACxE,IAAA,KAAA,GAAQ,KAAA,CAAM,MAAA;AACd,IAAA,GAAA,CAAI,KAAA,EAAO,gCAAA,EAAgB,MAAM,IAAI,UAAA,CAAW,wBAAwB,CAAA;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAAA,EACrB;AAEA,EAAA,GAAA,CAAI,KAAA,IAAS,CAAA,EAAG,OAAO,KAAA,CAAA;AAEvB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAC5D;AAYO,SAAS,WAAA,CAAY,OAAA,EAAuD;AAC/E,EAAA,kDAAA,OAA0B,CAAA;AAE1B,EAAA,OAAO,MAAA,CAAO,GAAA,EAAK,GAAA,EAAK,IAAA,EAAA,GAAS;AAC7B,IAAA,IAAI;AACA,MAAA,IAAI,IAAA;AAEJ,MAAA,IAAI;AACA,QAAA,KAAA,EAAO,MAAM,QAAA,CAAS,GAAG,CAAA;AAAA,MAC7B,EAAA,MAAA,CAAS,KAAA,EAAO;AACZ,QAAA,MAAM,SAAA,EAAW,MAAA,WAAiB,UAAA;AAElC,QAAA,GAAA,CAAI,MAAA,CAAO,SAAA,EAAW,IAAA,EAAM,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,UAClC,KAAA,EAAO;AAAA,YACH,IAAA,EAAM,SAAA,EAAW,oBAAA,EAAsB,iBAAA;AAAA,YACvC,OAAA,EAAS,SAAA,EAAW,yBAAA,EAA2B;AAAA,UACnD;AAAA,QACJ,CAAC,CAAA;AACD,QAAA,MAAA;AAAA,MACJ;AAGA,MAAA,MAAM,WAAA,EAAa,GAAA,CAAI,OAAA,IAAW,MAAA,GAAS,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AACxE,MAAA,MAAM,MAAA,EAAQ,WAAA,EAAa,KAAA,EAAO,MAAM,8CAAA,GAAe,EAAK,OAAA,CAAQ,QAAQ,CAAA;AAC5E,MAAA,MAAM,MAAA,EAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,MAAM,OAAA,CAAQ,KAAA,CAAM,GAAG,EAAA,EAAI,KAAA,CAAA;AAClE,MAAA,MAAM,OAAA,EAAS,MAAM,4CAAA;AAAA,yBACjB,OAAA,CAAQ,MAAA,UAAU,6CAAA,GAAc;AAAA,QAChC;AAAA,UACI,MAAA,EAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA,EAAM,GAAA,CAAI,IAAA;AAAA,UACV,IAAA;AAAA,UACA,WAAA,mBAAa,GAAA,CAAI,GAAA,CAAI,cAAc,CAAA,UAAK;AAAA,QAC5C,CAAA;AAAA,QACA,KAAA;AAAA,QACA,EAAE,KAAA,EAAO,GAAI,OAAA,CAAQ,MAAA,GAAS,EAAE,KAAA,EAAO,OAAA,CAAQ,MAAM,EAAG;AAAA,MAC5D,CAAA;AAEA,MAAA,IAAA,CAAA,MAAW,CAAC,IAAA,EAAM,KAAK,EAAA,GAAK,MAAA,CAAO,OAAA,kBAAQ,MAAA,CAAO,OAAA,UAAW,CAAC,GAAC,CAAA,EAAG;AAC9D,QAAA,GAAA,CAAI,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA;AAAA,MAC7B;AAEA,MAAA,GAAA,CAAI,SAAA,CAAU,eAAA,EAAiB,UAAU,CAAA;AACzC,MAAA,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA;AAAA,IAC9C,EAAA,MAAA,CAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACvB;AAAA,EACJ,CAAA;AACJ;ADhGA;AACE;AACA;AACA;AACF,wHAAC","file":"/home/runner/work/node-sdk/node-sdk/dist/express.cjs","sourcesContent":[null,"/** `@mesub/node/express`: `requirePlan()`. */\nimport type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport type { Mesub } from './client.js';\nimport {\n    accessOf,\n    askerOf,\n    checkCustomer,\n    checkPlan,\n    type CustomerOption,\n    type Denial,\n    defaultClient,\n    denialBody,\n    denialOf,\n    guard,\n    type MesubAccess,\n    type PlanOption,\n    plansOf,\n    retryAfterOf,\n} from './guard.js';\n\nimport {\n    checkWidgetOptions,\n    handleWidget,\n    MAX_BODY_BYTES,\n    widgetCustomer,\n    type WidgetRoutesOptions,\n} from './routes.js';\n\nimport { MesubError } from './errors.js';\n\nexport { MesubError } from './errors.js';\nexport type {\n    WidgetPayment,\n    WidgetRoutesOptions,\n    WidgetSubscriptionDetail,\n    WidgetSubscriptionList,\n} from './routes.js';\nexport type { CustomerOption, Denial, DenialReason, MesubAccess, PlanOption } from './guard.js';\nexport type { Asked } from './customer.js';\nexport type { Customer } from './answer.js';\n\n/**\n * What `next()` is handed for a thrown error. Express's own handler answers\n * an error's `status` when it is 4xx or 5xx, so Mesub's 401 to a bad API key\n * would reach the browser as \"nobody is signed in\". A MesubError of a 4xx\n * goes as a copy of status 500, the original as its `cause`; anything else\n * as it is.\n */\nfunction forNext(error: unknown): unknown {\n    if (!(error instanceof MesubError) || error.status === null) return error;\n    if (error.status < 400 || error.status >= 500) return error;\n\n    return new MesubError(error.message, {\n        status: 500,\n        code: error.code,\n        apiCode: error.apiCode,\n        retryable: error.retryable,\n        body: error.body,\n        retryAfter: error.retryAfter,\n        requestId: error.requestId,\n        cause: error,\n    });\n}\n\n/** What `requirePlan` leaves on `res.locals.mesub` for the route. */\nexport type MesubLocals = MesubAccess;\n\nexport interface RequirePlanOptions {\n    /** Defaults to one client built from MESUB_API_KEY. */\n    client?: Mesub;\n    /**\n     * Who is asking, from your own auth:\n     * `(req) => ({ external_id: req.user.id })`, a wallet or an email. Null when\n     * nobody is signed in. It must come from a session you verified, never\n     * from the request itself.\n     */\n    customer: CustomerOption<Request>;\n    /**\n     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be\n     * async: what it returns is awaited, and a throw or a rejection goes to\n     * `next(err)`, under Express 4 as under 5.\n     */\n    onDenied?: (denial: Denial, req: Request, res: Response, next: NextFunction) => unknown;\n}\n\n/**\n * Lets a request through only for a subscriber with access to that plan: a\n * slug, a list of which any one will do (`['pro', 'team']`), or either worked\n * out per request from a list you wrote, never read from the request itself.\n * `res.locals.mesub.plan` says which one let it through.\n *\n * Who is asking is who `customer` says, from your own auth. Refusals answer\n * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub\n * unreachable, with no answer known for that subscriber). Integration errors\n * go to `next(err)`: one Mesub answered with a 4xx (a bad API key, an unknown\n * plan) as a MesubError of status 500, the original as its `cause`, so that\n * Express answers 500 without an error handler of yours.\n */\nexport function requirePlan(\n    plan: PlanOption<Request>,\n    options: RequirePlanOptions,\n): RequestHandler {\n    checkPlan(plan);\n    checkCustomer(options);\n\n    return async (req, res, next) => {\n        try {\n            const client = options.client ?? defaultClient();\n            const outcome = await guard(client, await askerOf(req, options.customer), () =>\n                plansOf(plan, req),\n            );\n\n            if (outcome.allowed) {\n                const locals: MesubLocals = accessOf(outcome);\n                res.locals['mesub'] = locals;\n\n                return next();\n            }\n\n            const denial = denialOf(outcome);\n\n            if (options.onDenied) {\n                // Awaited here, inside the try: Express 4 drops a rejected promise.\n                await options.onDenied(denial, req, res, next);\n\n                return;\n            }\n\n            if (outcome.reason === 'unavailable') {\n                res.setHeader('Retry-After', retryAfterOf(outcome));\n            }\n\n            res.status(denial.status).json(denialBody(outcome));\n        } catch (error) {\n            next(forNext(error));\n        }\n    };\n}\n\n/** The JSON body, from `express.json()` when it ran, read here otherwise. */\nasync function jsonBody(req: Request): Promise<unknown> {\n    const parsed: unknown = (req as { body?: unknown }).body;\n\n    if (parsed !== undefined && !(typeof parsed === 'string' && parsed === '')) return parsed;\n    if (req.method === 'GET') return undefined;\n\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    for await (const chunk of req) {\n        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));\n        size += bytes.length;\n        if (size > MAX_BODY_BYTES) throw new RangeError('The body is too large.');\n        chunks.push(bytes);\n    }\n\n    if (size === 0) return undefined;\n\n    return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown;\n}\n\n/**\n * The routes `@mesub/react` calls, mounted on your server:\n * `app.use('/api/mesub', mesubRoutes({ customer: (req) => ... }))`. Under\n * Nest, the same line with `app.use` in `main.ts`.\n *\n * `customer` says who is asking from your own verified auth, so put your\n * login before it. A request it cannot answer is answered 404 here, never\n * handed to `next()`; an integration error goes to `next(err)`, Mesub's 4xx\n * as a MesubError of status 500 as on `requirePlan`.\n */\nexport function mesubRoutes(options: WidgetRoutesOptions<Request>): RequestHandler {\n    checkWidgetOptions(options);\n\n    return async (req, res, next) => {\n        try {\n            let body: unknown;\n\n            try {\n                body = await jsonBody(req);\n            } catch (error) {\n                const tooLarge = error instanceof RangeError;\n\n                res.status(tooLarge ? 413 : 400).json({\n                    error: {\n                        code: tooLarge ? 'payload_too_large' : 'invalid_request',\n                        message: tooLarge ? 'The body is too large.' : 'The body is not JSON.',\n                    },\n                });\n                return;\n            }\n\n            // A plan is public: nobody needs to be signed in to read a price.\n            const publicRead = req.method === 'GET' && req.path.startsWith('/plans/');\n            const asked = publicRead ? null : await widgetCustomer(req, options.customer);\n            const email = asked && options.email ? await options.email(req) : undefined;\n            const answer = await handleWidget(\n                options.client ?? defaultClient(),\n                {\n                    method: req.method,\n                    path: req.path,\n                    body,\n                    contentType: req.get('content-type') ?? null,\n                },\n                asked,\n                { email, ...(options.plans && { plans: options.plans }) },\n            );\n\n            for (const [name, value] of Object.entries(answer.headers ?? {})) {\n                res.setHeader(name, value);\n            }\n            // Per customer, and it moves: never a shared cache's to keep.\n            res.setHeader('Cache-Control', 'no-store');\n            res.status(answer.status).json(answer.body);\n        } catch (error) {\n            next(forNext(error));\n        }\n    };\n}\n"]}

package/dist/express.d.cts

@@ -0,0 +1,57 @@
+import { Request, Response, NextFunction, RequestHandler } from 'express';
+import { M as Mesub } from './client-Dm1jamju.cjs';
+import { M as MesubAccess, C as CustomerOption, D as Denial, P as PlanOption } from './guard-Dhy4fI6n.cjs';
+export { A as Asked, a as DenialReason } from './guard-Dhy4fI6n.cjs';
+import { W as WidgetRoutesOptions } from './routes-DWkRFOP0.cjs';
+export { a as WidgetPayment, b as WidgetSubscriptionDetail, c as WidgetSubscriptionList } from './routes-DWkRFOP0.cjs';
+export { M as MesubError } from './errors-CtPucyOh.cjs';
+export { C as Customer } from './subscriptions-D1hE7MUc.cjs';
+
+/** `@mesub/node/express`: `requirePlan()`. */
+
+/** What `requirePlan` leaves on `res.locals.mesub` for the route. */
+type MesubLocals = MesubAccess;
+interface RequirePlanOptions {
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from your own auth:
+     * `(req) => ({ external_id: req.user.id })`, a wallet or an email. Null when
+     * nobody is signed in. It must come from a session you verified, never
+     * from the request itself.
+     */
+    customer: CustomerOption<Request>;
+    /**
+     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be
+     * async: what it returns is awaited, and a throw or a rejection goes to
+     * `next(err)`, under Express 4 as under 5.
+     */
+    onDenied?: (denial: Denial, req: Request, res: Response, next: NextFunction) => unknown;
+}
+/**
+ * Lets a request through only for a subscriber with access to that plan: a
+ * slug, a list of which any one will do (`['pro', 'team']`), or either worked
+ * out per request from a list you wrote, never read from the request itself.
+ * `res.locals.mesub.plan` says which one let it through.
+ *
+ * Who is asking is who `customer` says, from your own auth. Refusals answer
+ * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub
+ * unreachable, with no answer known for that subscriber). Integration errors
+ * go to `next(err)`: one Mesub answered with a 4xx (a bad API key, an unknown
+ * plan) as a MesubError of status 500, the original as its `cause`, so that
+ * Express answers 500 without an error handler of yours.
+ */
+declare function requirePlan(plan: PlanOption<Request>, options: RequirePlanOptions): RequestHandler;
+/**
+ * The routes `@mesub/react` calls, mounted on your server:
+ * `app.use('/api/mesub', mesubRoutes({ customer: (req) => ... }))`. Under
+ * Nest, the same line with `app.use` in `main.ts`.
+ *
+ * `customer` says who is asking from your own verified auth, so put your
+ * login before it. A request it cannot answer is answered 404 here, never
+ * handed to `next()`; an integration error goes to `next(err)`, Mesub's 4xx
+ * as a MesubError of status 500 as on `requirePlan`.
+ */
+declare function mesubRoutes(options: WidgetRoutesOptions<Request>): RequestHandler;
+
+export { CustomerOption, Denial, MesubAccess, type MesubLocals, PlanOption, type RequirePlanOptions, WidgetRoutesOptions, mesubRoutes, requirePlan };

package/dist/express.d.ts

@@ -0,0 +1,57 @@
+import { Request, Response, NextFunction, RequestHandler } from 'express';
+import { M as Mesub } from './client-BQuRYSdB.js';
+import { M as MesubAccess, C as CustomerOption, D as Denial, P as PlanOption } from './guard-DKb6iU1z.js';
+export { A as Asked, a as DenialReason } from './guard-DKb6iU1z.js';
+import { W as WidgetRoutesOptions } from './routes-CLtZnUzl.js';
+export { a as WidgetPayment, b as WidgetSubscriptionDetail, c as WidgetSubscriptionList } from './routes-CLtZnUzl.js';
+export { M as MesubError } from './errors-DqW3DMBS.js';
+export { C as Customer } from './subscriptions-D1hE7MUc.js';
+
+/** `@mesub/node/express`: `requirePlan()`. */
+
+/** What `requirePlan` leaves on `res.locals.mesub` for the route. */
+type MesubLocals = MesubAccess;
+interface RequirePlanOptions {
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from your own auth:
+     * `(req) => ({ external_id: req.user.id })`, a wallet or an email. Null when
+     * nobody is signed in. It must come from a session you verified, never
+     * from the request itself.
+     */
+    customer: CustomerOption<Request>;
+    /**
+     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be
+     * async: what it returns is awaited, and a throw or a rejection goes to
+     * `next(err)`, under Express 4 as under 5.
+     */
+    onDenied?: (denial: Denial, req: Request, res: Response, next: NextFunction) => unknown;
+}
+/**
+ * Lets a request through only for a subscriber with access to that plan: a
+ * slug, a list of which any one will do (`['pro', 'team']`), or either worked
+ * out per request from a list you wrote, never read from the request itself.
+ * `res.locals.mesub.plan` says which one let it through.
+ *
+ * Who is asking is who `customer` says, from your own auth. Refusals answer
+ * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub
+ * unreachable, with no answer known for that subscriber). Integration errors
+ * go to `next(err)`: one Mesub answered with a 4xx (a bad API key, an unknown
+ * plan) as a MesubError of status 500, the original as its `cause`, so that
+ * Express answers 500 without an error handler of yours.
+ */
+declare function requirePlan(plan: PlanOption<Request>, options: RequirePlanOptions): RequestHandler;
+/**
+ * The routes `@mesub/react` calls, mounted on your server:
+ * `app.use('/api/mesub', mesubRoutes({ customer: (req) => ... }))`. Under
+ * Nest, the same line with `app.use` in `main.ts`.
+ *
+ * `customer` says who is asking from your own verified auth, so put your
+ * login before it. A request it cannot answer is answered 404 here, never
+ * handed to `next()`; an integration error goes to `next(err)`, Mesub's 4xx
+ * as a MesubError of status 500 as on `requirePlan`.
+ */
+declare function mesubRoutes(options: WidgetRoutesOptions<Request>): RequestHandler;
+
+export { CustomerOption, Denial, MesubAccess, type MesubLocals, PlanOption, type RequirePlanOptions, WidgetRoutesOptions, mesubRoutes, requirePlan };

package/dist/express.js

@@ -0,0 +1,129 @@
+import {
+  MAX_BODY_BYTES,
+  checkWidgetOptions,
+  handleWidget,
+  widgetCustomer
+} from "./chunk-ELK7IBLO.js";
+import {
+  accessOf,
+  askerOf,
+  checkCustomer,
+  checkPlan,
+  defaultClient,
+  denialBody,
+  denialOf,
+  guard,
+  plansOf,
+  retryAfterOf
+} from "./chunk-XDLLXY7Y.js";
+import {
+  MesubError
+} from "./chunk-KMPBFNJE.js";
+
+// src/express.ts
+function forNext(error) {
+  if (!(error instanceof MesubError) || error.status === null) return error;
+  if (error.status < 400 || error.status >= 500) return error;
+  return new MesubError(error.message, {
+    status: 500,
+    code: error.code,
+    apiCode: error.apiCode,
+    retryable: error.retryable,
+    body: error.body,
+    retryAfter: error.retryAfter,
+    requestId: error.requestId,
+    cause: error
+  });
+}
+function requirePlan(plan, options) {
+  checkPlan(plan);
+  checkCustomer(options);
+  return async (req, res, next) => {
+    try {
+      const client = options.client ?? defaultClient();
+      const outcome = await guard(
+        client,
+        await askerOf(req, options.customer),
+        () => plansOf(plan, req)
+      );
+      if (outcome.allowed) {
+        const locals = accessOf(outcome);
+        res.locals["mesub"] = locals;
+        return next();
+      }
+      const denial = denialOf(outcome);
+      if (options.onDenied) {
+        await options.onDenied(denial, req, res, next);
+        return;
+      }
+      if (outcome.reason === "unavailable") {
+        res.setHeader("Retry-After", retryAfterOf(outcome));
+      }
+      res.status(denial.status).json(denialBody(outcome));
+    } catch (error) {
+      next(forNext(error));
+    }
+  };
+}
+async function jsonBody(req) {
+  const parsed = req.body;
+  if (parsed !== void 0 && !(typeof parsed === "string" && parsed === "")) return parsed;
+  if (req.method === "GET") return void 0;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += bytes.length;
+    if (size > MAX_BODY_BYTES) throw new RangeError("The body is too large.");
+    chunks.push(bytes);
+  }
+  if (size === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function mesubRoutes(options) {
+  checkWidgetOptions(options);
+  return async (req, res, next) => {
+    try {
+      let body;
+      try {
+        body = await jsonBody(req);
+      } catch (error) {
+        const tooLarge = error instanceof RangeError;
+        res.status(tooLarge ? 413 : 400).json({
+          error: {
+            code: tooLarge ? "payload_too_large" : "invalid_request",
+            message: tooLarge ? "The body is too large." : "The body is not JSON."
+          }
+        });
+        return;
+      }
+      const publicRead = req.method === "GET" && req.path.startsWith("/plans/");
+      const asked = publicRead ? null : await widgetCustomer(req, options.customer);
+      const email = asked && options.email ? await options.email(req) : void 0;
+      const answer = await handleWidget(
+        options.client ?? defaultClient(),
+        {
+          method: req.method,
+          path: req.path,
+          body,
+          contentType: req.get("content-type") ?? null
+        },
+        asked,
+        { email, ...options.plans && { plans: options.plans } }
+      );
+      for (const [name, value] of Object.entries(answer.headers ?? {})) {
+        res.setHeader(name, value);
+      }
+      res.setHeader("Cache-Control", "no-store");
+      res.status(answer.status).json(answer.body);
+    } catch (error) {
+      next(forNext(error));
+    }
+  };
+}
+export {
+  MesubError,
+  mesubRoutes,
+  requirePlan
+};
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["/** `@mesub/node/express`: `requirePlan()`. */\nimport type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport type { Mesub } from './client.js';\nimport {\n    accessOf,\n    askerOf,\n    checkCustomer,\n    checkPlan,\n    type CustomerOption,\n    type Denial,\n    defaultClient,\n    denialBody,\n    denialOf,\n    guard,\n    type MesubAccess,\n    type PlanOption,\n    plansOf,\n    retryAfterOf,\n} from './guard.js';\n\nimport {\n    checkWidgetOptions,\n    handleWidget,\n    MAX_BODY_BYTES,\n    widgetCustomer,\n    type WidgetRoutesOptions,\n} from './routes.js';\n\nimport { MesubError } from './errors.js';\n\nexport { MesubError } from './errors.js';\nexport type {\n    WidgetPayment,\n    WidgetRoutesOptions,\n    WidgetSubscriptionDetail,\n    WidgetSubscriptionList,\n} from './routes.js';\nexport type { CustomerOption, Denial, DenialReason, MesubAccess, PlanOption } from './guard.js';\nexport type { Asked } from './customer.js';\nexport type { Customer } from './answer.js';\n\n/**\n * What `next()` is handed for a thrown error. Express's own handler answers\n * an error's `status` when it is 4xx or 5xx, so Mesub's 401 to a bad API key\n * would reach the browser as \"nobody is signed in\". A MesubError of a 4xx\n * goes as a copy of status 500, the original as its `cause`; anything else\n * as it is.\n */\nfunction forNext(error: unknown): unknown {\n    if (!(error instanceof MesubError) || error.status === null) return error;\n    if (error.status < 400 || error.status >= 500) return error;\n\n    return new MesubError(error.message, {\n        status: 500,\n        code: error.code,\n        apiCode: error.apiCode,\n        retryable: error.retryable,\n        body: error.body,\n        retryAfter: error.retryAfter,\n        requestId: error.requestId,\n        cause: error,\n    });\n}\n\n/** What `requirePlan` leaves on `res.locals.mesub` for the route. */\nexport type MesubLocals = MesubAccess;\n\nexport interface RequirePlanOptions {\n    /** Defaults to one client built from MESUB_API_KEY. */\n    client?: Mesub;\n    /**\n     * Who is asking, from your own auth:\n     * `(req) => ({ external_id: req.user.id })`, a wallet or an email. Null when\n     * nobody is signed in. It must come from a session you verified, never\n     * from the request itself.\n     */\n    customer: CustomerOption<Request>;\n    /**\n     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be\n     * async: what it returns is awaited, and a throw or a rejection goes to\n     * `next(err)`, under Express 4 as under 5.\n     */\n    onDenied?: (denial: Denial, req: Request, res: Response, next: NextFunction) => unknown;\n}\n\n/**\n * Lets a request through only for a subscriber with access to that plan: a\n * slug, a list of which any one will do (`['pro', 'team']`), or either worked\n * out per request from a list you wrote, never read from the request itself.\n * `res.locals.mesub.plan` says which one let it through.\n *\n * Who is asking is who `customer` says, from your own auth. Refusals answer\n * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub\n * unreachable, with no answer known for that subscriber). Integration errors\n * go to `next(err)`: one Mesub answered with a 4xx (a bad API key, an unknown\n * plan) as a MesubError of status 500, the original as its `cause`, so that\n * Express answers 500 without an error handler of yours.\n */\nexport function requirePlan(\n    plan: PlanOption<Request>,\n    options: RequirePlanOptions,\n): RequestHandler {\n    checkPlan(plan);\n    checkCustomer(options);\n\n    return async (req, res, next) => {\n        try {\n            const client = options.client ?? defaultClient();\n            const outcome = await guard(client, await askerOf(req, options.customer), () =>\n                plansOf(plan, req),\n            );\n\n            if (outcome.allowed) {\n                const locals: MesubLocals = accessOf(outcome);\n                res.locals['mesub'] = locals;\n\n                return next();\n            }\n\n            const denial = denialOf(outcome);\n\n            if (options.onDenied) {\n                // Awaited here, inside the try: Express 4 drops a rejected promise.\n                await options.onDenied(denial, req, res, next);\n\n                return;\n            }\n\n            if (outcome.reason === 'unavailable') {\n                res.setHeader('Retry-After', retryAfterOf(outcome));\n            }\n\n            res.status(denial.status).json(denialBody(outcome));\n        } catch (error) {\n            next(forNext(error));\n        }\n    };\n}\n\n/** The JSON body, from `express.json()` when it ran, read here otherwise. */\nasync function jsonBody(req: Request): Promise<unknown> {\n    const parsed: unknown = (req as { body?: unknown }).body;\n\n    if (parsed !== undefined && !(typeof parsed === 'string' && parsed === '')) return parsed;\n    if (req.method === 'GET') return undefined;\n\n    const chunks: Buffer[] = [];\n    let size = 0;\n\n    for await (const chunk of req) {\n        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));\n        size += bytes.length;\n        if (size > MAX_BODY_BYTES) throw new RangeError('The body is too large.');\n        chunks.push(bytes);\n    }\n\n    if (size === 0) return undefined;\n\n    return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown;\n}\n\n/**\n * The routes `@mesub/react` calls, mounted on your server:\n * `app.use('/api/mesub', mesubRoutes({ customer: (req) => ... }))`. Under\n * Nest, the same line with `app.use` in `main.ts`.\n *\n * `customer` says who is asking from your own verified auth, so put your\n * login before it. A request it cannot answer is answered 404 here, never\n * handed to `next()`; an integration error goes to `next(err)`, Mesub's 4xx\n * as a MesubError of status 500 as on `requirePlan`.\n */\nexport function mesubRoutes(options: WidgetRoutesOptions<Request>): RequestHandler {\n    checkWidgetOptions(options);\n\n    return async (req, res, next) => {\n        try {\n            let body: unknown;\n\n            try {\n                body = await jsonBody(req);\n            } catch (error) {\n                const tooLarge = error instanceof RangeError;\n\n                res.status(tooLarge ? 413 : 400).json({\n                    error: {\n                        code: tooLarge ? 'payload_too_large' : 'invalid_request',\n                        message: tooLarge ? 'The body is too large.' : 'The body is not JSON.',\n                    },\n                });\n                return;\n            }\n\n            // A plan is public: nobody needs to be signed in to read a price.\n            const publicRead = req.method === 'GET' && req.path.startsWith('/plans/');\n            const asked = publicRead ? null : await widgetCustomer(req, options.customer);\n            const email = asked && options.email ? await options.email(req) : undefined;\n            const answer = await handleWidget(\n                options.client ?? defaultClient(),\n                {\n                    method: req.method,\n                    path: req.path,\n                    body,\n                    contentType: req.get('content-type') ?? null,\n                },\n                asked,\n                { email, ...(options.plans && { plans: options.plans }) },\n            );\n\n            for (const [name, value] of Object.entries(answer.headers ?? {})) {\n                res.setHeader(name, value);\n            }\n            // Per customer, and it moves: never a shared cache's to keep.\n            res.setHeader('Cache-Control', 'no-store');\n            res.status(answer.status).json(answer.body);\n        } catch (error) {\n            next(forNext(error));\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAS,QAAQ,OAAyB;AACtC,MAAI,EAAE,iBAAiB,eAAe,MAAM,WAAW,KAAM,QAAO;AACpE,MAAI,MAAM,SAAS,OAAO,MAAM,UAAU,IAAK,QAAO;AAEtD,SAAO,IAAI,WAAW,MAAM,SAAS;AAAA,IACjC,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,OAAO;AAAA,EACX,CAAC;AACL;AAoCO,SAAS,YACZ,MACA,SACc;AACd,YAAU,IAAI;AACd,gBAAc,OAAO;AAErB,SAAO,OAAO,KAAK,KAAK,SAAS;AAC7B,QAAI;AACA,YAAM,SAAS,QAAQ,UAAU,cAAc;AAC/C,YAAM,UAAU,MAAM;AAAA,QAAM;AAAA,QAAQ,MAAM,QAAQ,KAAK,QAAQ,QAAQ;AAAA,QAAG,MACtE,QAAQ,MAAM,GAAG;AAAA,MACrB;AAEA,UAAI,QAAQ,SAAS;AACjB,cAAM,SAAsB,SAAS,OAAO;AAC5C,YAAI,OAAO,OAAO,IAAI;AAEtB,eAAO,KAAK;AAAA,MAChB;AAEA,YAAM,SAAS,SAAS,OAAO;AAE/B,UAAI,QAAQ,UAAU;AAElB,cAAM,QAAQ,SAAS,QAAQ,KAAK,KAAK,IAAI;AAE7C;AAAA,MACJ;AAEA,UAAI,QAAQ,WAAW,eAAe;AAClC,YAAI,UAAU,eAAe,aAAa,OAAO,CAAC;AAAA,MACtD;AAEA,UAAI,OAAO,OAAO,MAAM,EAAE,KAAK,WAAW,OAAO,CAAC;AAAA,IACtD,SAAS,OAAO;AACZ,WAAK,QAAQ,KAAK,CAAC;AAAA,IACvB;AAAA,EACJ;AACJ;AAGA,eAAe,SAAS,KAAgC;AACpD,QAAM,SAAmB,IAA2B;AAEpD,MAAI,WAAW,UAAa,EAAE,OAAO,WAAW,YAAY,WAAW,IAAK,QAAO;AACnF,MAAI,IAAI,WAAW,MAAO,QAAO;AAEjC,QAAM,SAAmB,CAAC;AAC1B,MAAI,OAAO;AAEX,mBAAiB,SAAS,KAAK;AAC3B,UAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,KAAK,CAAC;AACxE,YAAQ,MAAM;AACd,QAAI,OAAO,eAAgB,OAAM,IAAI,WAAW,wBAAwB;AACxE,WAAO,KAAK,KAAK;AAAA,EACrB;AAEA,MAAI,SAAS,EAAG,QAAO;AAEvB,SAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAC5D;AAYO,SAAS,YAAY,SAAuD;AAC/E,qBAAmB,OAAO;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC7B,QAAI;AACA,UAAI;AAEJ,UAAI;AACA,eAAO,MAAM,SAAS,GAAG;AAAA,MAC7B,SAAS,OAAO;AACZ,cAAM,WAAW,iBAAiB;AAElC,YAAI,OAAO,WAAW,MAAM,GAAG,EAAE,KAAK;AAAA,UAClC,OAAO;AAAA,YACH,MAAM,WAAW,sBAAsB;AAAA,YACvC,SAAS,WAAW,2BAA2B;AAAA,UACnD;AAAA,QACJ,CAAC;AACD;AAAA,MACJ;AAGA,YAAM,aAAa,IAAI,WAAW,SAAS,IAAI,KAAK,WAAW,SAAS;AACxE,YAAM,QAAQ,aAAa,OAAO,MAAM,eAAe,KAAK,QAAQ,QAAQ;AAC5E,YAAM,QAAQ,SAAS,QAAQ,QAAQ,MAAM,QAAQ,MAAM,GAAG,IAAI;AAClE,YAAM,SAAS,MAAM;AAAA,QACjB,QAAQ,UAAU,cAAc;AAAA,QAChC;AAAA,UACI,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI;AAAA,UACV;AAAA,UACA,aAAa,IAAI,IAAI,cAAc,KAAK;AAAA,QAC5C;AAAA,QACA;AAAA,QACA,EAAE,OAAO,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM,EAAG;AAAA,MAC5D;AAEA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC,GAAG;AAC9D,YAAI,UAAU,MAAM,KAAK;AAAA,MAC7B;AAEA,UAAI,UAAU,iBAAiB,UAAU;AACzC,UAAI,OAAO,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI;AAAA,IAC9C,SAAS,OAAO;AACZ,WAAK,QAAQ,KAAK,CAAC;AAAA,IACvB;AAAA,EACJ;AACJ;","names":[]}