@mesub/node 0.0.0-stage → 0.1.0

package/dist/next.cjs

@@ -0,0 +1,113 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+
+
+var _chunkPCDZI7B4cjs = require('./chunk-PCDZI7B4.cjs');
+
+
+
+
+
+
+
+
+
+
+
+var _chunkVMKI4VVAcjs = require('./chunk-VMKI4VVA.cjs');
+
+
+var _chunkSGSYQJYTcjs = require('./chunk-SGSYQJYT.cjs');
+
+// src/next.ts
+function withMesub(handler, options) {
+  _chunkVMKI4VVAcjs.checkPlan.call(void 0, options.plan);
+  _chunkVMKI4VVAcjs.checkCustomer.call(void 0, options);
+  return async (request, context) => {
+    const client = _nullishCoalesce(options.client, () => ( _chunkVMKI4VVAcjs.defaultClient.call(void 0, )));
+    const outcome = await _chunkVMKI4VVAcjs.guard.call(void 0, 
+      client,
+      await _chunkVMKI4VVAcjs.askerOf.call(void 0, request, options.customer),
+      () => _chunkVMKI4VVAcjs.plansOf.call(void 0, options.plan, request)
+    );
+    if (outcome.allowed) return handler(request, _chunkVMKI4VVAcjs.accessOf.call(void 0, outcome), context);
+    const denial = _chunkVMKI4VVAcjs.denialOf.call(void 0, outcome);
+    if (options.onDenied) return await options.onDenied(denial, request);
+    const headers = outcome.reason === "unavailable" ? { "Retry-After": _chunkVMKI4VVAcjs.retryAfterOf.call(void 0, outcome) } : {};
+    return Response.json(_chunkVMKI4VVAcjs.denialBody.call(void 0, outcome), { status: denial.status, headers });
+  };
+}
+async function pathOf(context) {
+  const params = await _asyncNullishCoalesce(await _optionalChain([context, 'optionalAccess', _ => _.params]), async () => ( {}));
+  const segments = Object.values(params).find((value) => Array.isArray(value));
+  return `/${(_nullishCoalesce(segments, () => ( []))).map((segment) => encodeURIComponent(String(segment))).join("/")}`;
+}
+async function textOf(request) {
+  if (Number(request.headers.get("content-length")) > _chunkPCDZI7B4cjs.MAX_BODY_BYTES) return null;
+  if (request.body === null) return "";
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) return text + decoder.decode();
+    size += value.byteLength;
+    if (size > _chunkPCDZI7B4cjs.MAX_BODY_BYTES) {
+      await reader.cancel();
+      return null;
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+}
+function mesubRouteHandlers(options) {
+  _chunkPCDZI7B4cjs.checkWidgetOptions.call(void 0, options);
+  const handle = async (request, context) => {
+    const path = await pathOf(context);
+    let body;
+    if (request.method !== "GET") {
+      const text = await textOf(request);
+      if (text === null) {
+        return Response.json(
+          { error: { code: "payload_too_large", message: "The body is too large." } },
+          { status: 413 }
+        );
+      }
+      try {
+        body = text === "" ? void 0 : JSON.parse(text);
+      } catch (e) {
+        return Response.json(
+          { error: { code: "invalid_request", message: "The body is not JSON." } },
+          { status: 400 }
+        );
+      }
+    }
+    const publicRead = request.method === "GET" && path.startsWith("/plans/");
+    const asked = publicRead ? null : await _chunkPCDZI7B4cjs.widgetCustomer.call(void 0, request, options.customer);
+    const email = asked && options.email ? await options.email(request) : void 0;
+    const answer = await _chunkPCDZI7B4cjs.handleWidget.call(void 0, 
+      _nullishCoalesce(options.client, () => ( _chunkVMKI4VVAcjs.defaultClient.call(void 0, ))),
+      {
+        method: request.method,
+        path,
+        body,
+        contentType: request.headers.get("content-type")
+      },
+      asked,
+      { email, ...options.plans && { plans: options.plans } }
+    );
+    return Response.json(answer.body, {
+      status: answer.status,
+      // Per customer, and it moves: never a shared cache's to keep.
+      headers: { "Cache-Control": "no-store", ...answer.headers }
+    });
+  };
+  return { GET: handle, POST: handle };
+}
+
+
+
+
+exports.MesubError = _chunkSGSYQJYTcjs.MesubError; exports.mesubRouteHandlers = mesubRouteHandlers; exports.withMesub = withMesub;
+//# sourceMappingURL=next.cjs.map

package/dist/next.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/node-sdk/node-sdk/dist/next.cjs","../src/next.ts"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACA;ACuDO,SAAS,SAAA,CACZ,OAAA,EACA,OAAA,EACyD;AACzD,EAAA,yCAAA,OAAU,CAAQ,IAAI,CAAA;AACtB,EAAA,6CAAA,OAAqB,CAAA;AAErB,EAAA,OAAO,MAAA,CAAO,OAAA,EAAS,OAAA,EAAA,GAAY;AAC/B,IAAA,MAAM,OAAA,mBAAS,OAAA,CAAQ,MAAA,UAAU,6CAAA,GAAc;AAC/C,IAAA,MAAM,QAAA,EAAU,MAAM,qCAAA;AAAA,MAAM,MAAA;AAAA,MAAQ,MAAM,uCAAA,OAAQ,EAAS,OAAA,CAAQ,QAAQ,CAAA;AAAA,MAAG,CAAA,EAAA,GAC1E,uCAAA,OAAQ,CAAQ,IAAA,EAAM,OAAO;AAAA,IACjC,CAAA;AAEA,IAAA,GAAA,CAAI,OAAA,CAAQ,OAAA,EAAS,OAAO,OAAA,CAAQ,OAAA,EAAS,wCAAA,OAAgB,CAAA,EAAG,OAAO,CAAA;AAEvE,IAAA,MAAM,OAAA,EAAS,wCAAA,OAAgB,CAAA;AAE/B,IAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,OAAO,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AAEnE,IAAA,MAAM,QAAA,EACF,OAAA,CAAQ,OAAA,IAAW,cAAA,EAAgB,EAAE,aAAA,EAAe,4CAAA,OAAoB,EAAE,EAAA,EAAI,CAAC,CAAA;AAEnF,IAAA,OAAO,QAAA,CAAS,IAAA,CAAK,0CAAA,OAAkB,CAAA,EAAG,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAAA,EAChF,CAAA;AACJ;AAQA,MAAA,SAAe,MAAA,CAAO,OAAA,EAAuD;AACzE,EAAA,MAAM,OAAA,8BAAU,sBAAM,OAAA,2BAAS,QAAA,gBAAW,CAAC,GAAA;AAC3C,EAAA,MAAM,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAC,CAAA;AAG3E,EAAA,OAAO,CAAA,CAAA,EAAA,kBAAK,QAAA,UAAY,CAAC,GAAA,CAAA,CAAG,GAAA,CAAI,CAAC,OAAA,EAAA,GAAY,kBAAA,CAAmB,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAC/F;AAMgE;AACe,EAAA;AACzC,EAAA;AAEI,EAAA;AACN,EAAA;AACrB,EAAA;AACA,EAAA;AAEF,EAAA;AACqC,IAAA;AAEH,IAAA;AAEzB,IAAA;AACa,IAAA;AACH,MAAA;AACb,MAAA;AACX,IAAA;AAC8C,IAAA;AAClD,EAAA;AACJ;AAcE;AAC4B,EAAA;AAE+D,EAAA;AACpD,IAAA;AAC7B,IAAA;AAE0B,IAAA;AACO,MAAA;AAEd,MAAA;AACC,QAAA;AAC8D,UAAA;AAC5D,UAAA;AAClB,QAAA;AACJ,MAAA;AACI,MAAA;AACiD,QAAA;AAC7C,MAAA;AACY,QAAA;AAC2D,UAAA;AACzD,UAAA;AAClB,QAAA;AACJ,MAAA;AACJ,IAAA;AAGwE,IAAA;AACQ,IAAA;AACV,IAAA;AACjD,IAAA;AACe,uBAAA;AAChC,MAAA;AACoB,QAAA;AAChB,QAAA;AACA,QAAA;AAC+C,QAAA;AACnD,MAAA;AACA,MAAA;AACwD,MAAA;AAC5D,IAAA;AAEkC,IAAA;AACf,MAAA;AAAA;AAE2C,MAAA;AAC7D,IAAA;AACL,EAAA;AAEmC,EAAA;AACvC;ADnG8F;AACA;AACA;AACA;AACA","file":"/home/runner/work/node-sdk/node-sdk/dist/next.cjs","sourcesContent":[null,"/** `@mesub/node/next`: `withMesub()`. Web `Request`/`Response` only, nothing imported from `next`. */\nimport type { Mesub } from './client.js';\nimport {\n    accessOf,\n    askerOf,\n    checkCustomer,\n    checkPlan,\n    type CustomerOption,\n    type Denial,\n    defaultClient,\n    denialBody,\n    denialOf,\n    guard,\n    type MesubAccess,\n    type PlanOption,\n    plansOf,\n    retryAfterOf,\n} from './guard.js';\n\nimport {\n    checkWidgetOptions,\n    handleWidget,\n    MAX_BODY_BYTES,\n    widgetCustomer,\n    type WidgetRoutesOptions,\n} from './routes.js';\n\nexport { MesubError } from './errors.js';\nexport type {\n    WidgetPayment,\n    WidgetRoutesOptions,\n    WidgetSubscriptionDetail,\n    WidgetSubscriptionList,\n} from './routes.js';\nexport type { CustomerOption, Denial, DenialReason, MesubAccess, PlanOption } from './guard.js';\nexport type { Asked } from './customer.js';\nexport type { Customer } from './answer.js';\n\nexport interface WithMesubOptions {\n    /**\n     * A slug, a list of which any one will do (`['pro', 'team']`), or either\n     * worked out per request. `mesub.plan` says which one let it through.\n     */\n    plan: PlanOption<Request>;\n    /** Defaults to one client built from MESUB_API_KEY. */\n    client?: Mesub;\n    /**\n     * Who is asking, from your own auth:\n     * `(req) => ({ external_id: session.userId })`, a wallet or an email. Null when\n     * nobody is signed in. It must come from a session you verified, never\n     * from the request itself.\n     */\n    customer: CustomerOption<Request>;\n    /**\n     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be\n     * async; a throw or a rejection is thrown, for Next to answer 500.\n     */\n    onDenied?: (denial: Denial, request: Request) => Response | Promise<Response>;\n}\n\n/** Your route handler, with who is asking and Mesub's answer as the second argument. */\nexport type MesubRouteHandler<Context = unknown> = (\n    request: Request,\n    mesub: MesubAccess,\n    context: Context,\n) => Response | Promise<Response>;\n\n/**\n * Wraps an App Router route handler so it runs only for a subscriber with\n * access to `plan`. Next's `context` (with `params`) is passed through as is.\n *\n * Who is asking is who `customer` says, from your own auth. Refusals answer\n * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub\n * unreachable, with no answer known for that subscriber). Integration errors\n * are thrown, for Next to log and answer 500. Not for `middleware.ts`, server\n * components or pages.\n */\nexport function withMesub<Context = unknown>(\n    handler: MesubRouteHandler<Context>,\n    options: WithMesubOptions,\n): (request: Request, context: Context) => Promise<Response> {\n    checkPlan(options.plan);\n    checkCustomer(options);\n\n    return async (request, context) => {\n        const client = options.client ?? defaultClient();\n        const outcome = await guard(client, await askerOf(request, options.customer), () =>\n            plansOf(options.plan, request),\n        );\n\n        if (outcome.allowed) return handler(request, accessOf(outcome), context);\n\n        const denial = denialOf(outcome);\n\n        if (options.onDenied) return await options.onDenied(denial, request);\n\n        const headers: Record<string, string> =\n            outcome.reason === 'unavailable' ? { 'Retry-After': retryAfterOf(outcome) } : {};\n\n        return Response.json(denialBody(outcome), { status: denial.status, headers });\n    };\n}\n\n/** Next's `context` of a catch-all route: `params` is a promise since Next 15. */\ninterface CatchAllContext {\n    params?: Promise<Record<string, unknown>> | Record<string, unknown>;\n}\n\n/** The path after the mount point, from the catch-all segment: `/subscriptions/sub_1/cancel`. */\nasync function pathOf(context: CatchAllContext | undefined): Promise<string> {\n    const params = (await context?.params) ?? {};\n    const segments = Object.values(params).find((value) => Array.isArray(value)) as\n        unknown[] | undefined;\n\n    return `/${(segments ?? []).map((segment) => encodeURIComponent(String(segment))).join('/')}`;\n}\n\n/**\n * The body as text, read up to the limit and no further. Null past it, by\n * `Content-Length` before anything is read, else by the bytes counted.\n */\nasync function textOf(request: Request): Promise<string | null> {\n    if (Number(request.headers.get('content-length')) > MAX_BODY_BYTES) return null;\n    if (request.body === null) return '';\n\n    const reader = request.body.getReader();\n    const decoder = new TextDecoder();\n    let text = '';\n    let size = 0;\n\n    for (;;) {\n        const { done, value } = await reader.read();\n\n        if (done) return text + decoder.decode();\n\n        size += value.byteLength;\n        if (size > MAX_BODY_BYTES) {\n            await reader.cancel();\n            return null;\n        }\n        text += decoder.decode(value, { stream: true });\n    }\n}\n\n/**\n * The routes `@mesub/react` calls, as an App Router catch-all:\n *\n *     // app/api/mesub/[...mesub]/route.ts\n *     export const { GET, POST } = mesubRouteHandlers({ customer: async (request) => ... });\n *\n * `customer` says who is asking from your own verified session. Integration\n * errors are thrown, for Next to log and answer 500.\n */\nexport function mesubRouteHandlers(options: WidgetRoutesOptions<Request>): {\n    GET: (request: Request, context?: CatchAllContext) => Promise<Response>;\n    POST: (request: Request, context?: CatchAllContext) => Promise<Response>;\n} {\n    checkWidgetOptions(options);\n\n    const handle = async (request: Request, context?: CatchAllContext): Promise<Response> => {\n        const path = await pathOf(context);\n        let body: unknown;\n\n        if (request.method !== 'GET') {\n            const text = await textOf(request);\n\n            if (text === null) {\n                return Response.json(\n                    { error: { code: 'payload_too_large', message: 'The body is too large.' } },\n                    { status: 413 },\n                );\n            }\n            try {\n                body = text === '' ? undefined : (JSON.parse(text) as unknown);\n            } catch {\n                return Response.json(\n                    { error: { code: 'invalid_request', message: 'The body is not JSON.' } },\n                    { status: 400 },\n                );\n            }\n        }\n\n        // A plan is public: nobody needs to be signed in to read a price.\n        const publicRead = request.method === 'GET' && path.startsWith('/plans/');\n        const asked = publicRead ? null : await widgetCustomer(request, options.customer);\n        const email = asked && options.email ? await options.email(request) : undefined;\n        const answer = await handleWidget(\n            options.client ?? defaultClient(),\n            {\n                method: request.method,\n                path,\n                body,\n                contentType: request.headers.get('content-type'),\n            },\n            asked,\n            { email, ...(options.plans && { plans: options.plans }) },\n        );\n\n        return Response.json(answer.body, {\n            status: answer.status,\n            // Per customer, and it moves: never a shared cache's to keep.\n            headers: { 'Cache-Control': 'no-store', ...answer.headers },\n        });\n    };\n\n    return { GET: handle, POST: handle };\n}\n"]}

package/dist/next.d.cts

@@ -0,0 +1,63 @@
+import { M as Mesub } from './client-Dm1jamju.cjs';
+import { M as MesubAccess, P as PlanOption, C as CustomerOption, D as Denial } from './guard-Dhy4fI6n.cjs';
+export { A as Asked, a as DenialReason } from './guard-Dhy4fI6n.cjs';
+import { W as WidgetRoutesOptions } from './routes-DWkRFOP0.cjs';
+export { a as WidgetPayment, b as WidgetSubscriptionDetail, c as WidgetSubscriptionList } from './routes-DWkRFOP0.cjs';
+export { M as MesubError } from './errors-CtPucyOh.cjs';
+export { C as Customer } from './subscriptions-D1hE7MUc.cjs';
+
+/** `@mesub/node/next`: `withMesub()`. Web `Request`/`Response` only, nothing imported from `next`. */
+
+interface WithMesubOptions {
+    /**
+     * A slug, a list of which any one will do (`['pro', 'team']`), or either
+     * worked out per request. `mesub.plan` says which one let it through.
+     */
+    plan: PlanOption<Request>;
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from your own auth:
+     * `(req) => ({ external_id: session.userId })`, a wallet or an email. Null when
+     * nobody is signed in. It must come from a session you verified, never
+     * from the request itself.
+     */
+    customer: CustomerOption<Request>;
+    /**
+     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be
+     * async; a throw or a rejection is thrown, for Next to answer 500.
+     */
+    onDenied?: (denial: Denial, request: Request) => Response | Promise<Response>;
+}
+/** Your route handler, with who is asking and Mesub's answer as the second argument. */
+type MesubRouteHandler<Context = unknown> = (request: Request, mesub: MesubAccess, context: Context) => Response | Promise<Response>;
+/**
+ * Wraps an App Router route handler so it runs only for a subscriber with
+ * access to `plan`. Next's `context` (with `params`) is passed through as is.
+ *
+ * Who is asking is who `customer` says, from your own auth. Refusals answer
+ * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub
+ * unreachable, with no answer known for that subscriber). Integration errors
+ * are thrown, for Next to log and answer 500. Not for `middleware.ts`, server
+ * components or pages.
+ */
+declare function withMesub<Context = unknown>(handler: MesubRouteHandler<Context>, options: WithMesubOptions): (request: Request, context: Context) => Promise<Response>;
+/** Next's `context` of a catch-all route: `params` is a promise since Next 15. */
+interface CatchAllContext {
+    params?: Promise<Record<string, unknown>> | Record<string, unknown>;
+}
+/**
+ * The routes `@mesub/react` calls, as an App Router catch-all:
+ *
+ *     // app/api/mesub/[...mesub]/route.ts
+ *     export const { GET, POST } = mesubRouteHandlers({ customer: async (request) => ... });
+ *
+ * `customer` says who is asking from your own verified session. Integration
+ * errors are thrown, for Next to log and answer 500.
+ */
+declare function mesubRouteHandlers(options: WidgetRoutesOptions<Request>): {
+    GET: (request: Request, context?: CatchAllContext) => Promise<Response>;
+    POST: (request: Request, context?: CatchAllContext) => Promise<Response>;
+};
+
+export { CustomerOption, Denial, MesubAccess, type MesubRouteHandler, PlanOption, WidgetRoutesOptions, type WithMesubOptions, mesubRouteHandlers, withMesub };

package/dist/next.d.ts

@@ -0,0 +1,63 @@
+import { M as Mesub } from './client-BQuRYSdB.js';
+import { M as MesubAccess, P as PlanOption, C as CustomerOption, D as Denial } from './guard-DKb6iU1z.js';
+export { A as Asked, a as DenialReason } from './guard-DKb6iU1z.js';
+import { W as WidgetRoutesOptions } from './routes-CLtZnUzl.js';
+export { a as WidgetPayment, b as WidgetSubscriptionDetail, c as WidgetSubscriptionList } from './routes-CLtZnUzl.js';
+export { M as MesubError } from './errors-DqW3DMBS.js';
+export { C as Customer } from './subscriptions-D1hE7MUc.js';
+
+/** `@mesub/node/next`: `withMesub()`. Web `Request`/`Response` only, nothing imported from `next`. */
+
+interface WithMesubOptions {
+    /**
+     * A slug, a list of which any one will do (`['pro', 'team']`), or either
+     * worked out per request. `mesub.plan` says which one let it through.
+     */
+    plan: PlanOption<Request>;
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from your own auth:
+     * `(req) => ({ external_id: session.userId })`, a wallet or an email. Null when
+     * nobody is signed in. It must come from a session you verified, never
+     * from the request itself.
+     */
+    customer: CustomerOption<Request>;
+    /**
+     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be
+     * async; a throw or a rejection is thrown, for Next to answer 500.
+     */
+    onDenied?: (denial: Denial, request: Request) => Response | Promise<Response>;
+}
+/** Your route handler, with who is asking and Mesub's answer as the second argument. */
+type MesubRouteHandler<Context = unknown> = (request: Request, mesub: MesubAccess, context: Context) => Response | Promise<Response>;
+/**
+ * Wraps an App Router route handler so it runs only for a subscriber with
+ * access to `plan`. Next's `context` (with `params`) is passed through as is.
+ *
+ * Who is asking is who `customer` says, from your own auth. Refusals answer
+ * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub
+ * unreachable, with no answer known for that subscriber). Integration errors
+ * are thrown, for Next to log and answer 500. Not for `middleware.ts`, server
+ * components or pages.
+ */
+declare function withMesub<Context = unknown>(handler: MesubRouteHandler<Context>, options: WithMesubOptions): (request: Request, context: Context) => Promise<Response>;
+/** Next's `context` of a catch-all route: `params` is a promise since Next 15. */
+interface CatchAllContext {
+    params?: Promise<Record<string, unknown>> | Record<string, unknown>;
+}
+/**
+ * The routes `@mesub/react` calls, as an App Router catch-all:
+ *
+ *     // app/api/mesub/[...mesub]/route.ts
+ *     export const { GET, POST } = mesubRouteHandlers({ customer: async (request) => ... });
+ *
+ * `customer` says who is asking from your own verified session. Integration
+ * errors are thrown, for Next to log and answer 500.
+ */
+declare function mesubRouteHandlers(options: WidgetRoutesOptions<Request>): {
+    GET: (request: Request, context?: CatchAllContext) => Promise<Response>;
+    POST: (request: Request, context?: CatchAllContext) => Promise<Response>;
+};
+
+export { CustomerOption, Denial, MesubAccess, type MesubRouteHandler, PlanOption, WidgetRoutesOptions, type WithMesubOptions, mesubRouteHandlers, withMesub };

package/dist/next.js

@@ -0,0 +1,113 @@
+import {
+  MAX_BODY_BYTES,
+  checkWidgetOptions,
+  handleWidget,
+  widgetCustomer
+} from "./chunk-ELK7IBLO.js";
+import {
+  accessOf,
+  askerOf,
+  checkCustomer,
+  checkPlan,
+  defaultClient,
+  denialBody,
+  denialOf,
+  guard,
+  plansOf,
+  retryAfterOf
+} from "./chunk-XDLLXY7Y.js";
+import {
+  MesubError
+} from "./chunk-KMPBFNJE.js";
+
+// src/next.ts
+function withMesub(handler, options) {
+  checkPlan(options.plan);
+  checkCustomer(options);
+  return async (request, context) => {
+    const client = options.client ?? defaultClient();
+    const outcome = await guard(
+      client,
+      await askerOf(request, options.customer),
+      () => plansOf(options.plan, request)
+    );
+    if (outcome.allowed) return handler(request, accessOf(outcome), context);
+    const denial = denialOf(outcome);
+    if (options.onDenied) return await options.onDenied(denial, request);
+    const headers = outcome.reason === "unavailable" ? { "Retry-After": retryAfterOf(outcome) } : {};
+    return Response.json(denialBody(outcome), { status: denial.status, headers });
+  };
+}
+async function pathOf(context) {
+  const params = await context?.params ?? {};
+  const segments = Object.values(params).find((value) => Array.isArray(value));
+  return `/${(segments ?? []).map((segment) => encodeURIComponent(String(segment))).join("/")}`;
+}
+async function textOf(request) {
+  if (Number(request.headers.get("content-length")) > MAX_BODY_BYTES) return null;
+  if (request.body === null) return "";
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) return text + decoder.decode();
+    size += value.byteLength;
+    if (size > MAX_BODY_BYTES) {
+      await reader.cancel();
+      return null;
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+}
+function mesubRouteHandlers(options) {
+  checkWidgetOptions(options);
+  const handle = async (request, context) => {
+    const path = await pathOf(context);
+    let body;
+    if (request.method !== "GET") {
+      const text = await textOf(request);
+      if (text === null) {
+        return Response.json(
+          { error: { code: "payload_too_large", message: "The body is too large." } },
+          { status: 413 }
+        );
+      }
+      try {
+        body = text === "" ? void 0 : JSON.parse(text);
+      } catch {
+        return Response.json(
+          { error: { code: "invalid_request", message: "The body is not JSON." } },
+          { status: 400 }
+        );
+      }
+    }
+    const publicRead = request.method === "GET" && path.startsWith("/plans/");
+    const asked = publicRead ? null : await widgetCustomer(request, options.customer);
+    const email = asked && options.email ? await options.email(request) : void 0;
+    const answer = await handleWidget(
+      options.client ?? defaultClient(),
+      {
+        method: request.method,
+        path,
+        body,
+        contentType: request.headers.get("content-type")
+      },
+      asked,
+      { email, ...options.plans && { plans: options.plans } }
+    );
+    return Response.json(answer.body, {
+      status: answer.status,
+      // Per customer, and it moves: never a shared cache's to keep.
+      headers: { "Cache-Control": "no-store", ...answer.headers }
+    });
+  };
+  return { GET: handle, POST: handle };
+}
+export {
+  MesubError,
+  mesubRouteHandlers,
+  withMesub
+};
+//# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/next.ts"],"sourcesContent":["/** `@mesub/node/next`: `withMesub()`. Web `Request`/`Response` only, nothing imported from `next`. */\nimport type { Mesub } from './client.js';\nimport {\n    accessOf,\n    askerOf,\n    checkCustomer,\n    checkPlan,\n    type CustomerOption,\n    type Denial,\n    defaultClient,\n    denialBody,\n    denialOf,\n    guard,\n    type MesubAccess,\n    type PlanOption,\n    plansOf,\n    retryAfterOf,\n} from './guard.js';\n\nimport {\n    checkWidgetOptions,\n    handleWidget,\n    MAX_BODY_BYTES,\n    widgetCustomer,\n    type WidgetRoutesOptions,\n} from './routes.js';\n\nexport { MesubError } from './errors.js';\nexport type {\n    WidgetPayment,\n    WidgetRoutesOptions,\n    WidgetSubscriptionDetail,\n    WidgetSubscriptionList,\n} from './routes.js';\nexport type { CustomerOption, Denial, DenialReason, MesubAccess, PlanOption } from './guard.js';\nexport type { Asked } from './customer.js';\nexport type { Customer } from './answer.js';\n\nexport interface WithMesubOptions {\n    /**\n     * A slug, a list of which any one will do (`['pro', 'team']`), or either\n     * worked out per request. `mesub.plan` says which one let it through.\n     */\n    plan: PlanOption<Request>;\n    /** Defaults to one client built from MESUB_API_KEY. */\n    client?: Mesub;\n    /**\n     * Who is asking, from your own auth:\n     * `(req) => ({ external_id: session.userId })`, a wallet or an email. Null when\n     * nobody is signed in. It must come from a session you verified, never\n     * from the request itself.\n     */\n    customer: CustomerOption<Request>;\n    /**\n     * Answer a refusal yourself: a redirect, a page, your own JSON. It may be\n     * async; a throw or a rejection is thrown, for Next to answer 500.\n     */\n    onDenied?: (denial: Denial, request: Request) => Response | Promise<Response>;\n}\n\n/** Your route handler, with who is asking and Mesub's answer as the second argument. */\nexport type MesubRouteHandler<Context = unknown> = (\n    request: Request,\n    mesub: MesubAccess,\n    context: Context,\n) => Response | Promise<Response>;\n\n/**\n * Wraps an App Router route handler so it runs only for a subscriber with\n * access to `plan`. Next's `context` (with `params`) is passed through as is.\n *\n * Who is asking is who `customer` says, from your own auth. Refusals answer\n * 401 (nobody signed in), 402 (Mesub said no) or 503 with Retry-After (Mesub\n * unreachable, with no answer known for that subscriber). Integration errors\n * are thrown, for Next to log and answer 500. Not for `middleware.ts`, server\n * components or pages.\n */\nexport function withMesub<Context = unknown>(\n    handler: MesubRouteHandler<Context>,\n    options: WithMesubOptions,\n): (request: Request, context: Context) => Promise<Response> {\n    checkPlan(options.plan);\n    checkCustomer(options);\n\n    return async (request, context) => {\n        const client = options.client ?? defaultClient();\n        const outcome = await guard(client, await askerOf(request, options.customer), () =>\n            plansOf(options.plan, request),\n        );\n\n        if (outcome.allowed) return handler(request, accessOf(outcome), context);\n\n        const denial = denialOf(outcome);\n\n        if (options.onDenied) return await options.onDenied(denial, request);\n\n        const headers: Record<string, string> =\n            outcome.reason === 'unavailable' ? { 'Retry-After': retryAfterOf(outcome) } : {};\n\n        return Response.json(denialBody(outcome), { status: denial.status, headers });\n    };\n}\n\n/** Next's `context` of a catch-all route: `params` is a promise since Next 15. */\ninterface CatchAllContext {\n    params?: Promise<Record<string, unknown>> | Record<string, unknown>;\n}\n\n/** The path after the mount point, from the catch-all segment: `/subscriptions/sub_1/cancel`. */\nasync function pathOf(context: CatchAllContext | undefined): Promise<string> {\n    const params = (await context?.params) ?? {};\n    const segments = Object.values(params).find((value) => Array.isArray(value)) as\n        unknown[] | undefined;\n\n    return `/${(segments ?? []).map((segment) => encodeURIComponent(String(segment))).join('/')}`;\n}\n\n/**\n * The body as text, read up to the limit and no further. Null past it, by\n * `Content-Length` before anything is read, else by the bytes counted.\n */\nasync function textOf(request: Request): Promise<string | null> {\n    if (Number(request.headers.get('content-length')) > MAX_BODY_BYTES) return null;\n    if (request.body === null) return '';\n\n    const reader = request.body.getReader();\n    const decoder = new TextDecoder();\n    let text = '';\n    let size = 0;\n\n    for (;;) {\n        const { done, value } = await reader.read();\n\n        if (done) return text + decoder.decode();\n\n        size += value.byteLength;\n        if (size > MAX_BODY_BYTES) {\n            await reader.cancel();\n            return null;\n        }\n        text += decoder.decode(value, { stream: true });\n    }\n}\n\n/**\n * The routes `@mesub/react` calls, as an App Router catch-all:\n *\n *     // app/api/mesub/[...mesub]/route.ts\n *     export const { GET, POST } = mesubRouteHandlers({ customer: async (request) => ... });\n *\n * `customer` says who is asking from your own verified session. Integration\n * errors are thrown, for Next to log and answer 500.\n */\nexport function mesubRouteHandlers(options: WidgetRoutesOptions<Request>): {\n    GET: (request: Request, context?: CatchAllContext) => Promise<Response>;\n    POST: (request: Request, context?: CatchAllContext) => Promise<Response>;\n} {\n    checkWidgetOptions(options);\n\n    const handle = async (request: Request, context?: CatchAllContext): Promise<Response> => {\n        const path = await pathOf(context);\n        let body: unknown;\n\n        if (request.method !== 'GET') {\n            const text = await textOf(request);\n\n            if (text === null) {\n                return Response.json(\n                    { error: { code: 'payload_too_large', message: 'The body is too large.' } },\n                    { status: 413 },\n                );\n            }\n            try {\n                body = text === '' ? undefined : (JSON.parse(text) as unknown);\n            } catch {\n                return Response.json(\n                    { error: { code: 'invalid_request', message: 'The body is not JSON.' } },\n                    { status: 400 },\n                );\n            }\n        }\n\n        // A plan is public: nobody needs to be signed in to read a price.\n        const publicRead = request.method === 'GET' && path.startsWith('/plans/');\n        const asked = publicRead ? null : await widgetCustomer(request, options.customer);\n        const email = asked && options.email ? await options.email(request) : undefined;\n        const answer = await handleWidget(\n            options.client ?? defaultClient(),\n            {\n                method: request.method,\n                path,\n                body,\n                contentType: request.headers.get('content-type'),\n            },\n            asked,\n            { email, ...(options.plans && { plans: options.plans }) },\n        );\n\n        return Response.json(answer.body, {\n            status: answer.status,\n            // Per customer, and it moves: never a shared cache's to keep.\n            headers: { 'Cache-Control': 'no-store', ...answer.headers },\n        });\n    };\n\n    return { GET: handle, POST: handle };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA6EO,SAAS,UACZ,SACA,SACyD;AACzD,YAAU,QAAQ,IAAI;AACtB,gBAAc,OAAO;AAErB,SAAO,OAAO,SAAS,YAAY;AAC/B,UAAM,SAAS,QAAQ,UAAU,cAAc;AAC/C,UAAM,UAAU,MAAM;AAAA,MAAM;AAAA,MAAQ,MAAM,QAAQ,SAAS,QAAQ,QAAQ;AAAA,MAAG,MAC1E,QAAQ,QAAQ,MAAM,OAAO;AAAA,IACjC;AAEA,QAAI,QAAQ,QAAS,QAAO,QAAQ,SAAS,SAAS,OAAO,GAAG,OAAO;AAEvE,UAAM,SAAS,SAAS,OAAO;AAE/B,QAAI,QAAQ,SAAU,QAAO,MAAM,QAAQ,SAAS,QAAQ,OAAO;AAEnE,UAAM,UACF,QAAQ,WAAW,gBAAgB,EAAE,eAAe,aAAa,OAAO,EAAE,IAAI,CAAC;AAEnF,WAAO,SAAS,KAAK,WAAW,OAAO,GAAG,EAAE,QAAQ,OAAO,QAAQ,QAAQ,CAAC;AAAA,EAChF;AACJ;AAQA,eAAe,OAAO,SAAuD;AACzE,QAAM,SAAU,MAAM,SAAS,UAAW,CAAC;AAC3C,QAAM,WAAW,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,QAAQ,KAAK,CAAC;AAG3E,SAAO,KAAK,YAAY,CAAC,GAAG,IAAI,CAAC,YAAY,mBAAmB,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC;AAC/F;AAMA,eAAe,OAAO,SAA0C;AAC5D,MAAI,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,IAAI,eAAgB,QAAO;AAC3E,MAAI,QAAQ,SAAS,KAAM,QAAO;AAElC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,OAAO;AACX,MAAI,OAAO;AAEX,aAAS;AACL,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAE1C,QAAI,KAAM,QAAO,OAAO,QAAQ,OAAO;AAEvC,YAAQ,MAAM;AACd,QAAI,OAAO,gBAAgB;AACvB,YAAM,OAAO,OAAO;AACpB,aAAO;AAAA,IACX;AACA,YAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,EAClD;AACJ;AAWO,SAAS,mBAAmB,SAGjC;AACE,qBAAmB,OAAO;AAE1B,QAAM,SAAS,OAAO,SAAkB,YAAiD;AACrF,UAAM,OAAO,MAAM,OAAO,OAAO;AACjC,QAAI;AAEJ,QAAI,QAAQ,WAAW,OAAO;AAC1B,YAAM,OAAO,MAAM,OAAO,OAAO;AAEjC,UAAI,SAAS,MAAM;AACf,eAAO,SAAS;AAAA,UACZ,EAAE,OAAO,EAAE,MAAM,qBAAqB,SAAS,yBAAyB,EAAE;AAAA,UAC1E,EAAE,QAAQ,IAAI;AAAA,QAClB;AAAA,MACJ;AACA,UAAI;AACA,eAAO,SAAS,KAAK,SAAa,KAAK,MAAM,IAAI;AAAA,MACrD,QAAQ;AACJ,eAAO,SAAS;AAAA,UACZ,EAAE,OAAO,EAAE,MAAM,mBAAmB,SAAS,wBAAwB,EAAE;AAAA,UACvE,EAAE,QAAQ,IAAI;AAAA,QAClB;AAAA,MACJ;AAAA,IACJ;AAGA,UAAM,aAAa,QAAQ,WAAW,SAAS,KAAK,WAAW,SAAS;AACxE,UAAM,QAAQ,aAAa,OAAO,MAAM,eAAe,SAAS,QAAQ,QAAQ;AAChF,UAAM,QAAQ,SAAS,QAAQ,QAAQ,MAAM,QAAQ,MAAM,OAAO,IAAI;AACtE,UAAM,SAAS,MAAM;AAAA,MACjB,QAAQ,UAAU,cAAc;AAAA,MAChC;AAAA,QACI,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA;AAAA,QACA,aAAa,QAAQ,QAAQ,IAAI,cAAc;AAAA,MACnD;AAAA,MACA;AAAA,MACA,EAAE,OAAO,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM,EAAG;AAAA,IAC5D;AAEA,WAAO,SAAS,KAAK,OAAO,MAAM;AAAA,MAC9B,QAAQ,OAAO;AAAA;AAAA,MAEf,SAAS,EAAE,iBAAiB,YAAY,GAAG,OAAO,QAAQ;AAAA,IAC9D,CAAC;AAAA,EACL;AAEA,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACvC;","names":[]}

package/dist/routes-CLtZnUzl.d.ts

@@ -0,0 +1,130 @@
+import { C as Customer, j as ServerSubscription } from './subscriptions-D1hE7MUc.js';
+import { M as Mesub } from './client-BQuRYSdB.js';
+
+/**
+ * The routes `@mesub/react` calls on your own server, so the browser never
+ * talks to Mesub nor holds a key: a plan to show, the customer's
+ * subscriptions, one of them with its payments, and each step of
+ * subscribing (a fresh transaction to sign included), cancelling, resuming,
+ * closing and paying a late payment now. One function, `handleWidget`; the
+ * Express and Next entries only carry a request to it.
+ *
+ * Who is asking comes from `customer`, your own verified auth, as on the
+ * guards. A subscription that is not that customer's is answered 404, the
+ * same as one that does not exist.
+ */
+/** Who is asking, from your own auth. Null when nobody is signed in, a 401. */
+type WidgetCustomer<Req> = (request: Req) => Customer | string | null | undefined | Promise<Customer | string | null | undefined>;
+interface WidgetRoutesOptions<Req> {
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from a session you verified, never from the request
+     * itself: `(req) => ({ external_id: req.user.id })`, a wallet or an email.
+     * Every subscription created is tied to it, and only its own are reached.
+     */
+    customer: WidgetCustomer<Req>;
+    /**
+     * Where that customer's notices go, when `customer` is not an email:
+     * `(req) => req.user.email`. Not verified by Mesub.
+     */
+    email?: (request: Req) => string | null | undefined | Promise<string | null | undefined>;
+    /**
+     * The plans the widget may subscribe to. Any plan of your project by
+     * default; name them to keep one off your site.
+     */
+    plans?: readonly string[];
+}
+/** What `GET /subscriptions` answers. */
+interface WidgetSubscriptionList {
+    /** Newest first, expired checkouts included: the 500 newest at most. */
+    subscriptions: Array<Omit<ServerSubscription, 'email' | 'external_id'>>;
+    /** True when the customer has more than those, which are not read. */
+    has_more: boolean;
+}
+/** One pull attempt as the browser gets it: the fields Mesub serves, and no other. */
+interface WidgetPayment {
+    attempted_at: string;
+    /** `paid`, `skipped`, `rejected` or `blocked` today; a newer one is handed on as is. */
+    outcome: string;
+    /** What was asked for, in the mint's smallest unit; on a paid one, what was paid. */
+    amount: string;
+    /**
+     * That amount in dollars when it was attempted, a decimal string. Null
+     * until Mesub priced it, and from a Mesub that does not say.
+     */
+    amount_usd: string | null;
+    /**
+     * Mesub's short reason, null on a paid one, as on `ServedAttempt`: snake
+     * case, an open string with the `program_${number}` and
+     * `solana_${number}` families.
+     */
+    reason: string | null;
+    /** The transaction that paid. Null on every outcome but `paid`. */
+    signature: string | null;
+    /** A retry of a missed charge. Null from a Mesub that does not say. */
+    retry: boolean | null;
+    /**
+     * Which retry and out of how many, as Mesub recorded them when it ran:
+     * 2 and 3 for "retry 2 / 3". Null when it is no retry of the plan's, or
+     * Mesub does not say.
+     */
+    retry_number: number | null;
+    retries_allowed: number | null;
+    /** The start of the period it was for. Null when Mesub recorded none or does not say. */
+    period_start: string | null;
+}
+/** What `GET /subscriptions/:id` answers. */
+interface WidgetSubscriptionDetail {
+    subscription: Omit<ServerSubscription, 'email' | 'external_id'>;
+    /** What Mesub pulls next, soonest first: one entry at most, none when nothing is due. */
+    upcoming: WidgetUpcoming[];
+    /**
+     * This subscription's own pull attempts, newest first: the first page,
+     * twenty at most, so not always its full history. Null when they could
+     * not be read: `payments_error` says why.
+     */
+    payments: WidgetPayment[] | null;
+    /**
+     * What it paid since it began, counted by Mesub over all its attempts,
+     * not over `payments`: how many were paid, and their sum in the mint's
+     * smallest unit. Null when the read failed, and from a Mesub that does
+     * not serve it: never summed here.
+     */
+    paid: {
+        count: number;
+        amount: string;
+    } | null;
+    /** Why `payments` is null; null otherwise. */
+    payments_error: {
+        code: string;
+        message: string;
+    } | null;
+}
+/** The one pull Mesub announces next for a subscription. */
+interface WidgetUpcoming {
+    /** `charge` at the due date of a running one, `retry` of a missed one. */
+    kind: 'charge' | 'retry';
+    due_at: string;
+    /**
+     * The plan's price in the mint's smallest unit, and as a person counts
+     * it. Null when the plan could not be read, never guessed.
+     */
+    amount: string | null;
+    amount_display: string | null;
+    /**
+     * The plan's amount in dollars at the latest price Mesub knows, a decimal
+     * string such as `"9.99"`: an estimate to show beside the amount, never
+     * what is charged. Null when Mesub knows no price, and when the plan could
+     * not be read.
+     */
+    amount_usd: string | null;
+    /**
+     * On a `retry`, which one it will be and out of how many: 2 and 3 for
+     * "next try 2 / 3". Null on a `charge`, and when Mesub does not say.
+     */
+    retry_number: number | null;
+    retries_allowed: number | null;
+}
+
+export type { WidgetRoutesOptions as W, WidgetPayment as a, WidgetSubscriptionDetail as b, WidgetSubscriptionList as c };

package/dist/routes-DWkRFOP0.d.cts

@@ -0,0 +1,130 @@
+import { C as Customer, j as ServerSubscription } from './subscriptions-D1hE7MUc.cjs';
+import { M as Mesub } from './client-Dm1jamju.cjs';
+
+/**
+ * The routes `@mesub/react` calls on your own server, so the browser never
+ * talks to Mesub nor holds a key: a plan to show, the customer's
+ * subscriptions, one of them with its payments, and each step of
+ * subscribing (a fresh transaction to sign included), cancelling, resuming,
+ * closing and paying a late payment now. One function, `handleWidget`; the
+ * Express and Next entries only carry a request to it.
+ *
+ * Who is asking comes from `customer`, your own verified auth, as on the
+ * guards. A subscription that is not that customer's is answered 404, the
+ * same as one that does not exist.
+ */
+/** Who is asking, from your own auth. Null when nobody is signed in, a 401. */
+type WidgetCustomer<Req> = (request: Req) => Customer | string | null | undefined | Promise<Customer | string | null | undefined>;
+interface WidgetRoutesOptions<Req> {
+    /** Defaults to one client built from MESUB_API_KEY. */
+    client?: Mesub;
+    /**
+     * Who is asking, from a session you verified, never from the request
+     * itself: `(req) => ({ external_id: req.user.id })`, a wallet or an email.
+     * Every subscription created is tied to it, and only its own are reached.
+     */
+    customer: WidgetCustomer<Req>;
+    /**
+     * Where that customer's notices go, when `customer` is not an email:
+     * `(req) => req.user.email`. Not verified by Mesub.
+     */
+    email?: (request: Req) => string | null | undefined | Promise<string | null | undefined>;
+    /**
+     * The plans the widget may subscribe to. Any plan of your project by
+     * default; name them to keep one off your site.
+     */
+    plans?: readonly string[];
+}
+/** What `GET /subscriptions` answers. */
+interface WidgetSubscriptionList {
+    /** Newest first, expired checkouts included: the 500 newest at most. */
+    subscriptions: Array<Omit<ServerSubscription, 'email' | 'external_id'>>;
+    /** True when the customer has more than those, which are not read. */
+    has_more: boolean;
+}
+/** One pull attempt as the browser gets it: the fields Mesub serves, and no other. */
+interface WidgetPayment {
+    attempted_at: string;
+    /** `paid`, `skipped`, `rejected` or `blocked` today; a newer one is handed on as is. */
+    outcome: string;
+    /** What was asked for, in the mint's smallest unit; on a paid one, what was paid. */
+    amount: string;
+    /**
+     * That amount in dollars when it was attempted, a decimal string. Null
+     * until Mesub priced it, and from a Mesub that does not say.
+     */
+    amount_usd: string | null;
+    /**
+     * Mesub's short reason, null on a paid one, as on `ServedAttempt`: snake
+     * case, an open string with the `program_${number}` and
+     * `solana_${number}` families.
+     */
+    reason: string | null;
+    /** The transaction that paid. Null on every outcome but `paid`. */
+    signature: string | null;
+    /** A retry of a missed charge. Null from a Mesub that does not say. */
+    retry: boolean | null;
+    /**
+     * Which retry and out of how many, as Mesub recorded them when it ran:
+     * 2 and 3 for "retry 2 / 3". Null when it is no retry of the plan's, or
+     * Mesub does not say.
+     */
+    retry_number: number | null;
+    retries_allowed: number | null;
+    /** The start of the period it was for. Null when Mesub recorded none or does not say. */
+    period_start: string | null;
+}
+/** What `GET /subscriptions/:id` answers. */
+interface WidgetSubscriptionDetail {
+    subscription: Omit<ServerSubscription, 'email' | 'external_id'>;
+    /** What Mesub pulls next, soonest first: one entry at most, none when nothing is due. */
+    upcoming: WidgetUpcoming[];
+    /**
+     * This subscription's own pull attempts, newest first: the first page,
+     * twenty at most, so not always its full history. Null when they could
+     * not be read: `payments_error` says why.
+     */
+    payments: WidgetPayment[] | null;
+    /**
+     * What it paid since it began, counted by Mesub over all its attempts,
+     * not over `payments`: how many were paid, and their sum in the mint's
+     * smallest unit. Null when the read failed, and from a Mesub that does
+     * not serve it: never summed here.
+     */
+    paid: {
+        count: number;
+        amount: string;
+    } | null;
+    /** Why `payments` is null; null otherwise. */
+    payments_error: {
+        code: string;
+        message: string;
+    } | null;
+}
+/** The one pull Mesub announces next for a subscription. */
+interface WidgetUpcoming {
+    /** `charge` at the due date of a running one, `retry` of a missed one. */
+    kind: 'charge' | 'retry';
+    due_at: string;
+    /**
+     * The plan's price in the mint's smallest unit, and as a person counts
+     * it. Null when the plan could not be read, never guessed.
+     */
+    amount: string | null;
+    amount_display: string | null;
+    /**
+     * The plan's amount in dollars at the latest price Mesub knows, a decimal
+     * string such as `"9.99"`: an estimate to show beside the amount, never
+     * what is charged. Null when Mesub knows no price, and when the plan could
+     * not be read.
+     */
+    amount_usd: string | null;
+    /**
+     * On a `retry`, which one it will be and out of how many: 2 and 3 for
+     * "next try 2 / 3". Null on a `charge`, and when Mesub does not say.
+     */
+    retry_number: number | null;
+    retries_allowed: number | null;
+}
+
+export type { WidgetRoutesOptions as W, WidgetPayment as a, WidgetSubscriptionDetail as b, WidgetSubscriptionList as c };