@molecule/api-resource-user 1.2.1 → 1.3.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-08-14T16:52:47.963Z
+Generated: 2026-08-15T19:34:04.935Z
 -->
 
 # @molecule/api-resource-user
@@ -73,6 +73,7 @@ interface UserRequestHandlerMap {
   verifyTwoFactor: MoleculeRequestHandler
   updatePlan: MoleculeRequestHandler
   verifyPayment: MoleculeRequestHandler
+  billingPortal: MoleculeRequestHandler
   handlePaymentNotification: MoleculeRequestHandler
   requireWebhookAuthenticity: MoleculeRequestHandler
 }
@@ -531,6 +532,7 @@ Members:
 
 Members:
 
+- `handlers.billingPortal` — function: Opens the bonded provider's hosted billing portal for the user, so they can
 - `handlers.handlePaymentNotification` — function: Generic payment notification handler that works with any bonded PaymentProvider. Reads the
 - `handlers.verifyPayment` — function: Generic payment verification handler that works with any bonded PaymentProvider. Reads the
 - `handlers.CreateRequest` — interface: Request body for user creation, including password and optional device name.
@@ -953,7 +955,18 @@ client method; call them with raw `http.*`. Use these EXACT paths — a weak mod
 - `POST   /api/users/reset-password` — confirm with the emailed token (body `{ token, password }`)
 - `PATCH  /api/users/:id` — update profile fields (name, username, email, bio); NOT `PUT /api/user`
 - `PATCH  /api/users/:id/password` — change password · `DELETE /api/users/:id` — delete account
-- `PATCH  /api/users/:id/plan` — update the subscription plan
+- `PATCH  /api/users/:id/plan` — update the subscription plan (a paid plan with no
+  existing subscription answers 201 `{ checkoutUrl }`; send the browser there)
+- `POST   /api/users/:id/verify-payment/:provider` — confirm a purchase server-side
+  (body/query `subscriptionId`); the provider returns the buyer to the APP's
+  `/plan-updated?provider=…&sessionId=…`, and THAT page calls this from the app
+  origin so the session cookie applies. A hosted checkout must never redirect
+  straight to this route on a separate API host: the top-level navigation carries
+  no credentials, so it answers 401 and the paid plan is never granted.
+- `POST   /api/users/:id/billing-portal/:provider` — open the provider's hosted
+  billing portal (update card, invoices, cancel); responds `{ url }`, optional body
+  `{ returnPath }` to come back to a specific app page. 404 `user.payment.noBillingAccount`
+  when the user has no customer record yet
 - `GET    /api/users/me` — the current user (session restore) · `GET /api/users/:id` — read one
   The full, authoritative route list is the `routes` export (see `routes.ts`).
 

package/dist/handlers/index.d.ts

@@ -5,7 +5,7 @@ export * from './logIn.js';
 export * from './logInOAuth.js';
 export * from './logout.js';
 export * from './oauthAuthorize.js';
-export { handlePaymentNotification, verifyPayment } from './payments/registry.js';
+export { billingPortal, handlePaymentNotification, verifyPayment } from './payments/registry.js';
 export * from './read.js';
 export * from './readSelf.js';
 export * from './resetPassword.js';

package/dist/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACjF,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAChG,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/dist/handlers/index.js

@@ -5,7 +5,7 @@ export * from './logIn.js';
 export * from './logInOAuth.js';
 export * from './logout.js';
 export * from './oauthAuthorize.js';
-export { handlePaymentNotification, verifyPayment } from './payments/registry.js';
+export { billingPortal, handlePaymentNotification, verifyPayment } from './payments/registry.js';
 export * from './read.js';
 export * from './readSelf.js';
 export * from './resetPassword.js';

package/dist/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACjF,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAChG,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/dist/handlers/payments/billingPortal.d.ts

@@ -0,0 +1,35 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+/**
+ * Opens the bonded provider's hosted billing portal for the user, so they can
+ * update their payment method, see invoices, and cancel — the self-service
+ * surface an app otherwise has to build (and usually doesn't, leaving a
+ * subscriber with no way out but support).
+ *
+ * Reads the provider name from the `:provider` route parameter and returns the
+ * portal URL for the client to open. Providers whose purchases are managed by
+ * the platform store (Apple/Google) implement no portal and answer 400 —
+ * their subscribers manage the subscription in the store app.
+ *
+ * The user is returned to the APP origin on exit (never the API origin, whose
+ * host holds no session cookie); an app-relative `returnPath` in the request
+ * body sends them back to the exact page they opened the portal from.
+ * @returns A request handler that responds `{ url, id }` with the portal session.
+ */
+export declare const billingPortal: () => (req: MoleculeRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        id?: undefined;
+        url?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        id: string;
+        url: string;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=billingPortal.d.ts.map

package/dist/handlers/payments/billingPortal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billingPortal.d.ts","sourceRoot":"","sources":["../../../src/handlers/payments/billingPortal.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAK7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SACV,KAAK,eAAe;;;;;;;;;;;;;;;;EAsFnC,CAAA"}

package/dist/handlers/payments/billingPortal.js

@@ -0,0 +1,92 @@
+import { getAnalytics, getLogger, require as bondRequire } from '@molecule/api-bond';
+import { t } from '@molecule/api-i18n';
+import { isConfigNotConfiguredError, resolveBillingPortalReturnUrl, } from '@molecule/api-payments';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Opens the bonded provider's hosted billing portal for the user, so they can
+ * update their payment method, see invoices, and cancel — the self-service
+ * surface an app otherwise has to build (and usually doesn't, leaving a
+ * subscriber with no way out but support).
+ *
+ * Reads the provider name from the `:provider` route parameter and returns the
+ * portal URL for the client to open. Providers whose purchases are managed by
+ * the platform store (Apple/Google) implement no portal and answer 400 —
+ * their subscribers manage the subscription in the store app.
+ *
+ * The user is returned to the APP origin on exit (never the API origin, whose
+ * host holds no session cookie); an app-relative `returnPath` in the request
+ * body sends them back to the exact page they opened the portal from.
+ * @returns A request handler that responds `{ url, id }` with the portal session.
+ */
+export const billingPortal = () => {
+    return async (req) => {
+        const providerName = req.params.provider;
+        const id = req.params.id;
+        if (!providerName) {
+            return {
+                statusCode: 400,
+                body: {
+                    error: t('user.payment.providerRequired'),
+                    errorKey: 'user.payment.providerRequired',
+                },
+            };
+        }
+        try {
+            const provider = bondRequire('payments', providerName);
+            if (!provider.createPortalSession) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.payment.portalNotSupported', { provider: providerName }, { defaultValue: '{{provider}} does not offer a billing portal.' }),
+                        errorKey: 'user.payment.portalNotSupported',
+                    },
+                };
+            }
+            const session = await provider.createPortalSession({
+                userId: id,
+                returnUrl: resolveBillingPortalReturnUrl(req.body?.returnPath),
+            });
+            if (!session?.url) {
+                // No customer record for this user (never purchased, or the purchase
+                // was never linked) — a distinct, actionable outcome, not a failure.
+                return {
+                    statusCode: 404,
+                    body: {
+                        error: t('user.payment.noBillingAccount', { provider: providerName }, { defaultValue: 'No {{provider}} billing account found for this user.' }),
+                        errorKey: 'user.payment.noBillingAccount',
+                    },
+                };
+            }
+            analytics
+                .track({
+                name: 'payment.portal_opened',
+                userId: id,
+                properties: { provider: providerName },
+            })
+                .catch(() => { });
+            return { statusCode: 200, body: { id: session.id, url: session.url } };
+        }
+        catch (error) {
+            // A missing provider secret is a config problem, not a billing problem —
+            // pass its real 503 + errorKey through so the operator sees which key to
+            // set (same contract as verifyPayment).
+            if (isConfigNotConfiguredError(error)) {
+                logger.warn(error.message, { errorKey: error.errorKey, provider: providerName });
+                return {
+                    statusCode: error.statusCode,
+                    body: { error: error.message, errorKey: error.errorKey },
+                };
+            }
+            logger.error(`${providerName} billingPortal error:`, error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.payment.portalFailed', { provider: providerName }, { defaultValue: 'Could not open the {{provider}} billing portal.' }),
+                    errorKey: 'user.payment.portalFailed',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=billingPortal.js.map

package/dist/handlers/payments/billingPortal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billingPortal.js","sourceRoot":"","sources":["../../../src/handlers/payments/billingPortal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACpF,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EACL,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAA;AAG/B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,EAAE;IAChC,OAAO,KAAK,EAAE,GAAoB,EAAE,EAAE;QACpC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,QAAkB,CAAA;QAClD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;QAElC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;oBACzC,QAAQ,EAAE,+BAA+B;iBAC1C;aACF,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAkB,UAAU,EAAE,YAAY,CAAC,CAAA;YAEvE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;gBAClC,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CACN,iCAAiC,EACjC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,+CAA+C,EAAE,CAClE;wBACD,QAAQ,EAAE,iCAAiC;qBAC5C;iBACF,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC;gBACjD,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE,UAAgC,CAAC;aACrF,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;gBAClB,qEAAqE;gBACrE,qEAAqE;gBACrE,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CACN,+BAA+B,EAC/B,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,sDAAsD,EAAE,CACzE;wBACD,QAAQ,EAAE,+BAA+B;qBAC1C;iBACF,CAAA;YACH,CAAC;YAED,SAAS;iBACN,KAAK,CAAC;gBACL,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;aACvC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAA;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,yEAAyE;YACzE,wCAAwC;YACxC,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;gBAChF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;iBACzD,CAAA;YACH,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,uBAAuB,EAAE,KAAK,CAAC,CAAA;YAC3D,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CACN,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,iDAAiD,EAAE,CACpE;oBACD,QAAQ,EAAE,2BAA2B;iBACtC;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/payments/registry.d.ts

@@ -8,6 +8,7 @@
  *
  * @module
  */
+export { billingPortal } from './billingPortal.js';
 export { handlePaymentNotification } from './handlePaymentNotification.js';
 export { verifyPayment } from './verifyPayment.js';
 //# sourceMappingURL=registry.d.ts.map

package/dist/handlers/payments/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/handlers/payments/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/handlers/payments/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/handlers/payments/registry.js

@@ -8,6 +8,7 @@
  *
  * @module
  */
+export { billingPortal } from './billingPortal.js';
 export { handlePaymentNotification } from './handlePaymentNotification.js';
 export { verifyPayment } from './verifyPayment.js';
 //# sourceMappingURL=registry.js.map

package/dist/handlers/payments/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/handlers/payments/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/handlers/payments/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/index.d.ts

@@ -33,7 +33,18 @@
  * - `POST   /api/users/reset-password` — confirm with the emailed token (body `{ token, password }`)
  * - `PATCH  /api/users/:id` — update profile fields (name, username, email, bio); NOT `PUT /api/user`
  * - `PATCH  /api/users/:id/password` — change password · `DELETE /api/users/:id` — delete account
- * - `PATCH  /api/users/:id/plan` — update the subscription plan
+ * - `PATCH  /api/users/:id/plan` — update the subscription plan (a paid plan with no
+ *   existing subscription answers 201 `{ checkoutUrl }`; send the browser there)
+ * - `POST   /api/users/:id/verify-payment/:provider` — confirm a purchase server-side
+ *   (body/query `subscriptionId`); the provider returns the buyer to the APP's
+ *   `/plan-updated?provider=…&sessionId=…`, and THAT page calls this from the app
+ *   origin so the session cookie applies. A hosted checkout must never redirect
+ *   straight to this route on a separate API host: the top-level navigation carries
+ *   no credentials, so it answers 401 and the paid plan is never granted.
+ * - `POST   /api/users/:id/billing-portal/:provider` — open the provider's hosted
+ *   billing portal (update card, invoices, cancel); responds `{ url }`, optional body
+ *   `{ returnPath }` to come back to a specific app page. 404 `user.payment.noBillingAccount`
+ *   when the user has no customer record yet
  * - `GET    /api/users/me` — the current user (session restore) · `GET /api/users/:id` — read one
  * The full, authoritative route list is the `routes` export (see `routes.ts`).
  *

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,cAAc,oBAAoB,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,cAAc,oBAAoB,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -33,7 +33,18 @@
  * - `POST   /api/users/reset-password` — confirm with the emailed token (body `{ token, password }`)
  * - `PATCH  /api/users/:id` — update profile fields (name, username, email, bio); NOT `PUT /api/user`
  * - `PATCH  /api/users/:id/password` — change password · `DELETE /api/users/:id` — delete account
- * - `PATCH  /api/users/:id/plan` — update the subscription plan
+ * - `PATCH  /api/users/:id/plan` — update the subscription plan (a paid plan with no
+ *   existing subscription answers 201 `{ checkoutUrl }`; send the browser there)
+ * - `POST   /api/users/:id/verify-payment/:provider` — confirm a purchase server-side
+ *   (body/query `subscriptionId`); the provider returns the buyer to the APP's
+ *   `/plan-updated?provider=…&sessionId=…`, and THAT page calls this from the app
+ *   origin so the session cookie applies. A hosted checkout must never redirect
+ *   straight to this route on a separate API host: the top-level navigation carries
+ *   no credentials, so it answers 401 and the paid plan is never granted.
+ * - `POST   /api/users/:id/billing-portal/:provider` — open the provider's hosted
+ *   billing portal (update card, invoices, cancel); responds `{ url }`, optional body
+ *   `{ returnPath }` to come back to a specific app page. 404 `user.payment.noBillingAccount`
+ *   when the user has no customer record yet
  * - `GET    /api/users/me` — the current user (session restore) · `GET /api/users/:id` — read one
  * The full, authoritative route list is the `routes` export (see `routes.ts`).
  *

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,cAAc,oBAAoB,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,cAAc,oBAAoB,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA"}

package/dist/requestHandlerMap.d.ts

@@ -27,6 +27,7 @@ export interface UserRequestHandlerMap {
     verifyTwoFactor: MoleculeRequestHandler;
     updatePlan: MoleculeRequestHandler;
     verifyPayment: MoleculeRequestHandler;
+    billingPortal: MoleculeRequestHandler;
     handlePaymentNotification: MoleculeRequestHandler;
     requireWebhookAuthenticity: MoleculeRequestHandler;
 }

package/dist/requestHandlerMap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestHandlerMap.d.ts","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,IAAI,oBAAoB,EAC5C,sBAAsB,EACvB,MAAM,wBAAwB,CAAA;AAM/B,KAAK,qBAAqB,GAAG,OAAO,oBAAoB,CAAA;AAExD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,aAAa,EAAE,sBAAsB,CAAA;IACrC,kBAAkB,EAAE,sBAAsB,CAAA;IAC1C,MAAM,EAAE,sBAAsB,CAAA;IAC9B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,cAAc,EAAE,sBAAsB,CAAA;IACtC,UAAU,EAAE,sBAAsB,CAAA;IAClC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,GAAG,EAAE,sBAAsB,CAAA;IAC3B,cAAc,EAAE,sBAAsB,CAAA;IACtC,cAAc,EAAE,sBAAsB,CAAA;IACtC,aAAa,EAAE,sBAAsB,CAAA;IACrC,eAAe,EAAE,sBAAsB,CAAA;IACvC,UAAU,EAAE,sBAAsB,CAAA;IAClC,aAAa,EAAE,sBAAsB,CAAA;IACrC,yBAAyB,EAAE,sBAAsB,CAAA;IACjD,0BAA0B,EAAE,sBAAsB,CAAA;CACnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,sBAAsB,qBAAqB,KAC1C,qBA0DF,CAAA"}
+{"version":3,"file":"requestHandlerMap.d.ts","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,IAAI,oBAAoB,EAC5C,sBAAsB,EACvB,MAAM,wBAAwB,CAAA;AAM/B,KAAK,qBAAqB,GAAG,OAAO,oBAAoB,CAAA;AAExD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,aAAa,EAAE,sBAAsB,CAAA;IACrC,kBAAkB,EAAE,sBAAsB,CAAA;IAC1C,MAAM,EAAE,sBAAsB,CAAA;IAC9B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,cAAc,EAAE,sBAAsB,CAAA;IACtC,UAAU,EAAE,sBAAsB,CAAA;IAClC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,GAAG,EAAE,sBAAsB,CAAA;IAC3B,cAAc,EAAE,sBAAsB,CAAA;IACtC,cAAc,EAAE,sBAAsB,CAAA;IACtC,aAAa,EAAE,sBAAsB,CAAA;IACrC,eAAe,EAAE,sBAAsB,CAAA;IACvC,UAAU,EAAE,sBAAsB,CAAA;IAClC,aAAa,EAAE,sBAAsB,CAAA;IACrC,aAAa,EAAE,sBAAsB,CAAA;IACrC,yBAAyB,EAAE,sBAAsB,CAAA;IACjD,0BAA0B,EAAE,sBAAsB,CAAA;CACnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,sBAAsB,qBAAqB,KAC1C,qBA2DF,CAAA"}

package/dist/requestHandlerMap.js

@@ -58,6 +58,7 @@ export const createRequestHandlerMap = (createRequestHandler) => {
         // requested :provider. Adding a new payment provider requires only a
         // new bond package — no source changes here.
         verifyPayment: createRequestHandler(handlers.verifyPayment(resource)),
+        billingPortal: createRequestHandler(handlers.billingPortal()),
         handlePaymentNotification: createRequestHandler(handlers.handlePaymentNotification(resource)),
     };
     // Suppress unused-import warning while keeping the bond-registry import

package/dist/requestHandlerMap.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestHandlerMap.js","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAO3C,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAmCxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,oBAA2C,EACpB,EAAE;IACzB,MAAM,GAAG,GAA0B;QACjC,cAAc;QACd,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;QACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;QAChC,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC;YACnC,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,eAAe,CAAC;SACxE,CAAC;QACF,8EAA8E;QAC9E,0DAA0D;QAC1D,kBAAkB,EAAE,WAAW,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,CAAC;YACN,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;SAC7C,CAAC;QACF,0EAA0E;QAC1E,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,EAAE;QAEpE,gBAAgB;QAChB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,GAAG,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACzE,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,qEAAqE;QACrE,uEAAuE;QACvE,4CAA4C;QAC5C,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC/D,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,6CAA6C;QAC7C,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,yBAAyB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;KAC9F,CAAA;IAED,wEAAwE;IACxE,8FAA8F;IAC9F,KAAK,MAAuB,CAAA;IAE5B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"requestHandlerMap.js","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAO3C,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAoCxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,oBAA2C,EACpB,EAAE;IACzB,MAAM,GAAG,GAA0B;QACjC,cAAc;QACd,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;QACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;QAChC,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC;YACnC,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,eAAe,CAAC;SACxE,CAAC;QACF,8EAA8E;QAC9E,0DAA0D;QAC1D,kBAAkB,EAAE,WAAW,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,CAAC;YACN,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;SAC7C,CAAC;QACF,0EAA0E;QAC1E,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,EAAE;QAEpE,gBAAgB;QAChB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,GAAG,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACzE,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,qEAAqE;QACrE,uEAAuE;QACvE,4CAA4C;QAC5C,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC/D,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,6CAA6C;QAC7C,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7D,yBAAyB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;KAC9F,CAAA;IAED,wEAAwE;IACxE,8FAA8F;IAC9F,KAAK,MAAuB,CAAA;IAE5B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsHlB,CAAA"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiIlB,CAAA"}

package/dist/routes.js

@@ -106,6 +106,17 @@ export const routes = [
         handler: 'verifyPayment',
         optional: 'payments',
     },
+    // Hosted billing portal (payment-method updates, invoices, cancellation).
+    // authSelf: the portal session is minted for `:id`'s provider customer and
+    // its URL is a bearer credential for that account's whole billing history —
+    // an unauthenticated or cross-user POST must never mint one.
+    {
+        method: 'post',
+        path: '/users/:id/billing-portal/:provider',
+        middlewares: ['authSelf'],
+        handler: 'billingPortal',
+        optional: 'payments',
+    },
     // Payment notifications (webhooks, S2S). The authenticity guard lets
     // signature-verifying webhook providers (Stripe) through and requires a shared
     // secret for unsigned server-to-server providers (Apple/Google) so the public

package/dist/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO;IACP,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC/E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,OAAO;KACjB;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wDAAwD;IACxD,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,OAAO;KAClB;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,2DAA2D;IAC3D,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC5F;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,eAAe;KACzB;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,uBAAuB;IACvB,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;IAEzF,4BAA4B;IAC5B,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1F,EAAE,MAAM,EAAE,OAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9F,EAAE,MAAM,EAAE,QAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAE5F,iBAAiB;IACjB;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC/C,OAAO,EAAE,iBAAiB;KAC3B;IAED,QAAQ;IACR;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,YAAY;KACtB;IAED,gFAAgF;IAChF,uFAAuF;IACvF,uFAAuF;IACvF,wFAAwF;IACxF,+DAA+D;IAC/D;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,qEAAqE;IACrE,+EAA+E;IAC/E,8EAA8E;IAC9E,mCAAmC;IACnC;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EAAE,CAAC,4BAA4B,CAAC;QAC3C,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;CACF,CAAA"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO;IACP,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC/E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,OAAO;KACjB;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wDAAwD;IACxD,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,OAAO;KAClB;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,2DAA2D;IAC3D,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC5F;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,eAAe;KACzB;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,uBAAuB;IACvB,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;IAEzF,4BAA4B;IAC5B,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1F,EAAE,MAAM,EAAE,OAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9F,EAAE,MAAM,EAAE,QAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAE5F,iBAAiB;IACjB;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC/C,OAAO,EAAE,iBAAiB;KAC3B;IAED,QAAQ;IACR;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,YAAY;KACtB;IAED,gFAAgF;IAChF,uFAAuF;IACvF,uFAAuF;IACvF,wFAAwF;IACxF,+DAA+D;IAC/D;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,qEAAqE;IACrE,+EAA+E;IAC/E,8EAA8E;IAC9E,mCAAmC;IACnC;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EAAE,CAAC,4BAA4B,CAAC;QAC3C,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;CACF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-resource-user",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "User resource types and schema for molecule.dev.",
   "type": "module",
   "main": "dist/index.js",
@@ -36,7 +36,7 @@
     "@molecule/api-config": "1.0.1",
     "@molecule/api-locales-user": "1.0.1",
     "@molecule/api-locales-user-payments": "1.0.1",
-    "@molecule/api-payments": "1.0.1",
+    "@molecule/api-payments": "1.1.0",
     "@molecule/api-push-notifications": "1.0.1",
     "@molecule/api-rate-limit": "1.0.1",
     "@molecule/api-two-factor": "1.0.1",
@@ -54,7 +54,7 @@
     "@molecule/api-locales-user": "^1.0.1",
     "@molecule/api-locales-user-payments": "^1.0.1",
     "@molecule/api-password": "^1.0.1",
-    "@molecule/api-payments": "^1.0.1",
+    "@molecule/api-payments": "^1.1.0",
     "@molecule/api-push-notifications": "^1.0.1",
     "@molecule/api-rate-limit": "^1.0.1",
     "@molecule/api-resource": "^1.0.1",