@onesub/server 0.1.0

package/dist/__tests__/store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.test.d.ts.map

package/dist/__tests__/store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/store.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/store.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { InMemorySubscriptionStore } from '../store.js';
+const makeSub = (overrides) => ({
+    userId: 'user_123',
+    productId: 'com.example.pro_monthly',
+    platform: 'apple',
+    status: 'active',
+    expiresAt: '2025-12-31T00:00:00.000Z',
+    originalTransactionId: 'txn_abc123',
+    purchasedAt: '2025-01-01T00:00:00.000Z',
+    willRenew: true,
+    ...overrides,
+});
+describe('InMemorySubscriptionStore', () => {
+    let store;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+    });
+    it('save() and getByUserId() returns the correct subscription', async () => {
+        const sub = makeSub();
+        await store.save(sub);
+        const result = await store.getByUserId('user_123');
+        expect(result).toEqual(sub);
+    });
+    it('save() and getByTransactionId() returns the correct subscription', async () => {
+        const sub = makeSub();
+        await store.save(sub);
+        const result = await store.getByTransactionId('txn_abc123');
+        expect(result).toEqual(sub);
+    });
+    it('getByUserId() returns null for an unknown user', async () => {
+        const result = await store.getByUserId('nonexistent_user');
+        expect(result).toBeNull();
+    });
+    it('getByTransactionId() returns null for an unknown transaction', async () => {
+        const result = await store.getByTransactionId('nonexistent_txn');
+        expect(result).toBeNull();
+    });
+    it('save() overwrites an existing subscription for the same userId', async () => {
+        const original = makeSub({ status: 'active', expiresAt: '2025-06-01T00:00:00.000Z' });
+        await store.save(original);
+        const updated = makeSub({
+            status: 'expired',
+            expiresAt: '2025-01-15T00:00:00.000Z',
+            originalTransactionId: 'txn_abc123',
+        });
+        await store.save(updated);
+        const result = await store.getByUserId('user_123');
+        expect(result?.status).toBe('expired');
+        expect(result?.expiresAt).toBe('2025-01-15T00:00:00.000Z');
+    });
+    it('save() overwrites an existing subscription indexed by the same transactionId', async () => {
+        const original = makeSub({ willRenew: true });
+        await store.save(original);
+        const updated = makeSub({ willRenew: false, originalTransactionId: 'txn_abc123' });
+        await store.save(updated);
+        const result = await store.getByTransactionId('txn_abc123');
+        expect(result?.willRenew).toBe(false);
+    });
+    it('stores multiple subscriptions independently', async () => {
+        const sub1 = makeSub({ userId: 'user_1', originalTransactionId: 'txn_1' });
+        const sub2 = makeSub({ userId: 'user_2', originalTransactionId: 'txn_2', platform: 'google' });
+        await store.save(sub1);
+        await store.save(sub2);
+        expect(await store.getByUserId('user_1')).toEqual(sub1);
+        expect(await store.getByUserId('user_2')).toEqual(sub2);
+        expect(await store.getByTransactionId('txn_1')).toEqual(sub1);
+        expect(await store.getByTransactionId('txn_2')).toEqual(sub2);
+    });
+});
+//# sourceMappingURL=store.test.js.map

package/dist/__tests__/store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.js","sourceRoot":"","sources":["../../src/__tests__/store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,OAAO,GAAG,CAAC,SAAqC,EAAoB,EAAE,CAAC,CAAC;IAC5E,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,0BAA0B;IACrC,qBAAqB,EAAE,YAAY;IACnC,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,IAAI;IACf,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,KAAgC,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAG,OAAO,CAAC;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,0BAA0B;YACrC,qBAAqB,EAAE,YAAY;SACpC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvB,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,47 @@
+import express, { Router } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+import type { SubscriptionStore } from './store.js';
+/**
+ * Extended config with optional pluggable store.
+ */
+export interface OneSubMiddlewareConfig extends OneSubServerConfig {
+    /**
+     * Custom subscription store. Defaults to InMemorySubscriptionStore.
+     * For production, provide a PostgreSQL or Redis backed implementation.
+     */
+    store?: SubscriptionStore;
+}
+/**
+ * Create an Express Router with all OneSub routes mounted.
+ *
+ * Mount this in your existing Express app:
+ * ```ts
+ * import { createOneSubMiddleware } from '@onesub/server';
+ * app.use(createOneSubMiddleware(config));
+ * ```
+ *
+ * The routes registered are (all prefixed with nothing — mount at root or use
+ * a prefix via `app.use('/prefix', createOneSubMiddleware(config))`):
+ *
+ *   POST /onesub/validate
+ *   GET  /onesub/status
+ *   POST /onesub/webhook/apple
+ *   POST /onesub/webhook/google
+ */
+export declare function createOneSubMiddleware(config: OneSubMiddlewareConfig): Router;
+/**
+ * Create a standalone Express application with all OneSub routes.
+ *
+ * ```ts
+ * import { createOneSubServer } from '@onesub/server';
+ * createOneSubServer(config).listen(4100);
+ * ```
+ */
+export declare function createOneSubServer(config: OneSubMiddlewareConfig): ReturnType<typeof express>;
+export { InMemorySubscriptionStore } from './store.js';
+export type { SubscriptionStore } from './store.js';
+export { PostgresSubscriptionStore } from './stores/postgres.js';
+export { validateAppleReceipt } from './providers/apple.js';
+export { validateGoogleReceipt } from './providers/google.js';
+export default createOneSubMiddleware;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAKpD;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE;;;OAGG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAa7E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAW7F;AAGD,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAGjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,eAAe,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,91 @@
+import express, { Router } from 'express';
+import { DEFAULT_PORT } from '@onesub/shared';
+import { InMemorySubscriptionStore } from './store.js';
+import { createValidateRouter } from './routes/validate.js';
+import { createStatusRouter } from './routes/status.js';
+import { createWebhookRouter } from './routes/webhook.js';
+/**
+ * Create an Express Router with all OneSub routes mounted.
+ *
+ * Mount this in your existing Express app:
+ * ```ts
+ * import { createOneSubMiddleware } from '@onesub/server';
+ * app.use(createOneSubMiddleware(config));
+ * ```
+ *
+ * The routes registered are (all prefixed with nothing — mount at root or use
+ * a prefix via `app.use('/prefix', createOneSubMiddleware(config))`):
+ *
+ *   POST /onesub/validate
+ *   GET  /onesub/status
+ *   POST /onesub/webhook/apple
+ *   POST /onesub/webhook/google
+ */
+export function createOneSubMiddleware(config) {
+    const store = config.store ?? new InMemorySubscriptionStore();
+    const router = Router();
+    // Parse JSON bodies for all OneSub routes (50 kb cap to prevent payload flooding)
+    router.use(express.json({ limit: '50kb' }));
+    router.use(createValidateRouter(config, store));
+    router.use(createStatusRouter(store));
+    router.use(createWebhookRouter(config, store));
+    return router;
+}
+/**
+ * Create a standalone Express application with all OneSub routes.
+ *
+ * ```ts
+ * import { createOneSubServer } from '@onesub/server';
+ * createOneSubServer(config).listen(4100);
+ * ```
+ */
+export function createOneSubServer(config) {
+    const app = express();
+    // Health check
+    app.get('/health', (_req, res) => {
+        res.json({ ok: true, service: 'onesub' });
+    });
+    app.use(createOneSubMiddleware(config));
+    return app;
+}
+// Named re-exports for consumers who want to bring their own store
+export { InMemorySubscriptionStore } from './store.js';
+export { PostgresSubscriptionStore } from './stores/postgres.js';
+// Provider functions for direct (non-HTTP) usage
+export { validateAppleReceipt } from './providers/apple.js';
+export { validateGoogleReceipt } from './providers/google.js';
+// Default export: the middleware factory
+export default createOneSubMiddleware;
+// Allow running directly: node dist/index.js
+// Reads config from environment variables for quick local testing.
+const isMain = typeof process !== 'undefined' &&
+    process.argv[1] != null &&
+    new URL(import.meta.url).pathname.endsWith(process.argv[1].replace(/\\/g, '/'));
+if (isMain) {
+    const config = {
+        apple: process.env['APPLE_BUNDLE_ID']
+            ? {
+                bundleId: process.env['APPLE_BUNDLE_ID'],
+                sharedSecret: process.env['APPLE_SHARED_SECRET'],
+                keyId: process.env['APPLE_KEY_ID'],
+                issuerId: process.env['APPLE_ISSUER_ID'],
+                privateKey: process.env['APPLE_PRIVATE_KEY'],
+            }
+            : undefined,
+        google: process.env['GOOGLE_PACKAGE_NAME']
+            ? {
+                packageName: process.env['GOOGLE_PACKAGE_NAME'],
+                serviceAccountKey: process.env['GOOGLE_SERVICE_ACCOUNT_KEY'],
+            }
+            : undefined,
+        database: {
+            url: process.env['DATABASE_URL'] ?? '',
+        },
+        webhookSecret: process.env['WEBHOOK_SECRET'],
+    };
+    const port = process.env['PORT'] ? parseInt(process.env['PORT'], 10) : DEFAULT_PORT;
+    createOneSubServer(config).listen(port, () => {
+        console.log(`[onesub] Server listening on port ${port}`);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAa1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,MAAM,KAAK,GAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,yBAAyB,EAAE,CAAC;IAEjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAE/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,iDAAiD;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,yCAAyC;AACzC,eAAe,sBAAsB,CAAC;AAEtC,6CAA6C;AAC7C,mEAAmE;AACnE,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;IACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACnC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;aAC7C;YACH,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACxC,CAAC,CAAC;gBACE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAC/C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;aAC7D;YACH,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACvC;QACD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC7C,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEpF,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/providers/apple.d.ts

@@ -0,0 +1,29 @@
+import type { SubscriptionInfo, AppleNotificationPayload, OneSubServerConfig } from '@onesub/shared';
+type AppleConfig = NonNullable<OneSubServerConfig['apple']>;
+/**
+ * Decode and verify a JWS compact serialisation using Apple's JWKS.
+ * When skipVerification is true, falls back to decodeJwt() without signature
+ * verification (useful for dev/testing environments).
+ */
+export declare function decodeJws<T>(jws: string, skipVerification?: boolean): Promise<T>;
+/**
+ * Validate an Apple receipt string.
+ *
+ * StoreKit 2 receipts are JWS-encoded signed transactions (the `signedTransaction`
+ * field from the client). For legacy base64 receipts from StoreKit 1, you would
+ * POST to verifyReceipt — that path is left as a stub here because Apple is
+ * deprecating it.
+ */
+export declare function validateAppleReceipt(receipt: string, config: AppleConfig): Promise<SubscriptionInfo | null>;
+/**
+ * Decode an Apple Server Notification V2 payload.
+ * Returns the derived subscription update to be merged into the store.
+ */
+export declare function decodeAppleNotification(payload: AppleNotificationPayload, skipJwsVerification?: boolean): Promise<{
+    originalTransactionId: string;
+    status: SubscriptionInfo['status'];
+    willRenew: boolean;
+    expiresAt: string;
+} | null>;
+export {};
+//# sourceMappingURL=apple.d.ts.map

package/dist/providers/apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGrG,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAwC5D;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAepF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkClC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA6B9H"}

package/dist/providers/apple.js

@@ -0,0 +1,111 @@
+import { decodeJwt, createRemoteJWKSet, jwtVerify } from 'jose';
+import { SUBSCRIPTION_STATUS } from '@onesub/shared';
+/**
+ * Module-level JWKS fetcher for Apple's public keys.
+ * Cached automatically by jose's createRemoteJWKSet.
+ */
+const appleJWKS = createRemoteJWKSet(new URL('https://appleid.apple.com/auth/keys'));
+/**
+ * Decode and verify a JWS compact serialisation using Apple's JWKS.
+ * When skipVerification is true, falls back to decodeJwt() without signature
+ * verification (useful for dev/testing environments).
+ */
+export async function decodeJws(jws, skipVerification = false) {
+    if (skipVerification) {
+        if (process.env['NODE_ENV'] === 'production') {
+            console.warn('[onesub/apple] WARNING: skipJwsVerification is enabled in production. ' +
+                'JWS signatures are NOT being verified. This is a security risk. ' +
+                'Disable skipJwsVerification before going live.');
+        }
+        // Dev/test path: decode payload only, no signature check
+        return decodeJwt(jws);
+    }
+    const { payload } = await jwtVerify(jws, appleJWKS);
+    return payload;
+}
+/**
+ * Derive a SubscriptionStatus from the transaction + renewal payloads.
+ */
+function deriveStatus(tx, renewal) {
+    if (tx.revocationDate)
+        return SUBSCRIPTION_STATUS.CANCELED;
+    const now = Date.now();
+    const expires = tx.expiresDate ?? 0;
+    if (expires > now)
+        return SUBSCRIPTION_STATUS.ACTIVE;
+    // Expired — check if it was voluntarily canceled
+    if (renewal?.autoRenewStatus === 0)
+        return SUBSCRIPTION_STATUS.CANCELED;
+    return SUBSCRIPTION_STATUS.EXPIRED;
+}
+/**
+ * Validate an Apple receipt string.
+ *
+ * StoreKit 2 receipts are JWS-encoded signed transactions (the `signedTransaction`
+ * field from the client). For legacy base64 receipts from StoreKit 1, you would
+ * POST to verifyReceipt — that path is left as a stub here because Apple is
+ * deprecating it.
+ */
+export async function validateAppleReceipt(receipt, config) {
+    let tx;
+    try {
+        // StoreKit 2: receipt is a signed JWS transaction
+        tx = await decodeJws(receipt, config.skipJwsVerification);
+    }
+    catch {
+        console.warn('[onesub/apple] Failed to decode receipt as JWS. Falling back to null.');
+        return null;
+    }
+    if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
+        return null;
+    }
+    // Validate bundle ID if provided
+    if (tx.bundleId && tx.bundleId !== config.bundleId) {
+        console.warn('[onesub/apple] Bundle ID mismatch:', tx.bundleId, '!==', config.bundleId);
+        return null;
+    }
+    const status = deriveStatus(tx, null);
+    const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
+    return {
+        userId: '', // caller fills this in from the request body
+        productId: tx.productId,
+        platform: 'apple',
+        status,
+        expiresAt: new Date(tx.expiresDate).toISOString(),
+        originalTransactionId: tx.originalTransactionId,
+        purchasedAt: new Date(purchasedAt).toISOString(),
+        willRenew: status === SUBSCRIPTION_STATUS.ACTIVE, // refined by renewal info in webhook
+    };
+}
+/**
+ * Decode an Apple Server Notification V2 payload.
+ * Returns the derived subscription update to be merged into the store.
+ */
+export async function decodeAppleNotification(payload, skipJwsVerification = false) {
+    const { signedTransactionInfo, signedRenewalInfo } = payload.data;
+    let tx;
+    let renewal = null;
+    try {
+        tx = await decodeJws(signedTransactionInfo, skipJwsVerification);
+    }
+    catch {
+        return null;
+    }
+    try {
+        renewal = await decodeJws(signedRenewalInfo, skipJwsVerification);
+    }
+    catch {
+        // renewal info is optional for some notification types
+    }
+    if (!tx.originalTransactionId || !tx.expiresDate)
+        return null;
+    const status = deriveStatus(tx, renewal);
+    const willRenew = renewal?.autoRenewStatus === 1;
+    return {
+        originalTransactionId: tx.originalTransactionId,
+        status,
+        willRenew,
+        expiresAt: new Date(tx.expiresDate).toISOString(),
+    };
+}
+//# sourceMappingURL=apple.js.map

package/dist/providers/apple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.js","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAkCrD;;;GAGG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAClC,IAAI,GAAG,CAAC,qCAAqC,CAAC,CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,GAAW,EAAE,gBAAgB,GAAG,KAAK;IACtE,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CACV,wEAAwE;gBACtE,kEAAkE;gBAClE,gDAAgD,CACnD,CAAC;QACJ,CAAC;QACD,yDAAyD;QACzD,OAAO,SAAS,CAAC,GAAG,CAAM,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,OAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,EAA2B,EAC3B,OAAmC;IAEnC,IAAI,EAAE,CAAC,cAAc;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC;IAEpC,IAAI,OAAO,GAAG,GAAG;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC;IAErD,iDAAiD;IACjD,IAAI,OAAO,EAAE,eAAe,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IAExE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,MAAmB;IAEnB,IAAI,EAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,kDAAkD;QAClD,EAAE,GAAG,MAAM,SAAS,CAA0B,OAAO,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7E,OAAO;QACL,MAAM,EAAE,EAAE,EAAG,6CAA6C;QAC1D,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QACjD,qBAAqB,EAAE,EAAE,CAAC,qBAAqB;QAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QAChD,SAAS,EAAE,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,qCAAqC;KACxF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiC,EACjC,mBAAmB,GAAG,KAAK;IAE3B,MAAM,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAElE,IAAI,EAA2B,CAAC;IAChC,IAAI,OAAO,GAA+B,IAAI,CAAC;IAE/C,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAA0B,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAsB,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,EAAE,eAAe,KAAK,CAAC,CAAC;IAEjD,OAAO;QACL,qBAAqB,EAAE,EAAE,CAAC,qBAAqB;QAC/C,MAAM;QACN,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;KAClD,CAAC;AACJ,CAAC"}

package/dist/providers/google.d.ts

@@ -0,0 +1,48 @@
+import type { SubscriptionInfo, GoogleNotificationPayload, OneSubServerConfig } from '@onesub/shared';
+type GoogleConfig = NonNullable<OneSubServerConfig['google']>;
+/**
+ * Google RTDN notification types.
+ * https://developer.android.com/google/play/billing/rtdn-reference
+ */
+declare const GOOGLE_NOTIFICATION_TYPE: {
+    readonly SUBSCRIPTION_RECOVERED: 1;
+    readonly SUBSCRIPTION_RENEWED: 2;
+    readonly SUBSCRIPTION_CANCELED: 3;
+    readonly SUBSCRIPTION_PURCHASED: 4;
+    readonly SUBSCRIPTION_ON_HOLD: 5;
+    readonly SUBSCRIPTION_IN_GRACE_PERIOD: 6;
+    readonly SUBSCRIPTION_RESTARTED: 7;
+    readonly SUBSCRIPTION_PRICE_CHANGE_CONFIRMED: 8;
+    readonly SUBSCRIPTION_DEFERRED: 9;
+    readonly SUBSCRIPTION_PAUSED: 10;
+    readonly SUBSCRIPTION_PAUSE_SCHEDULE_CHANGED: 11;
+    readonly SUBSCRIPTION_REVOKED: 12;
+    readonly SUBSCRIPTION_EXPIRED: 13;
+};
+type GoogleNotificationType = (typeof GOOGLE_NOTIFICATION_TYPE)[keyof typeof GOOGLE_NOTIFICATION_TYPE];
+/**
+ * Validate a Google Play purchase token.
+ *
+ * @param receipt  - The purchaseToken from the client (Google Play Billing)
+ * @param productId - The subscription product ID
+ * @param config   - Google config with packageName and optional serviceAccountKey
+ */
+export declare function validateGoogleReceipt(receipt: string, productId: string, config: GoogleConfig): Promise<SubscriptionInfo | null>;
+/**
+ * Decode a Google RTDN Pub/Sub notification.
+ * Returns the extracted subscription notification data, or null for test pings.
+ */
+export declare function decodeGoogleNotification(payload: GoogleNotificationPayload): {
+    notificationType: GoogleNotificationType;
+    purchaseToken: string;
+    subscriptionId: string;
+    packageName: string;
+} | null;
+/**
+ * Determine if a Google RTDN notification type represents an active subscription.
+ */
+export declare function isGoogleActiveNotification(notificationType: GoogleNotificationType): boolean;
+export declare function isGoogleCanceledNotification(notificationType: GoogleNotificationType): boolean;
+export declare function isGoogleExpiredNotification(notificationType: GoogleNotificationType): boolean;
+export {};
+//# sourceMappingURL=google.d.ts.map

package/dist/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGtG,KAAK,YAAY,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAuB9D;;;GAGG;AACH,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;CAcpB,CAAC;AAEX,KAAK,sBAAsB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAyJvG;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6BlC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC5E,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAuBP;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAQ5F;AAED,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAK9F;AAED,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE7F"}

package/dist/providers/google.js

@@ -0,0 +1,203 @@
+import { SUBSCRIPTION_STATUS } from '@onesub/shared';
+/**
+ * Google RTDN notification types.
+ * https://developer.android.com/google/play/billing/rtdn-reference
+ */
+const GOOGLE_NOTIFICATION_TYPE = {
+    SUBSCRIPTION_RECOVERED: 1,
+    SUBSCRIPTION_RENEWED: 2,
+    SUBSCRIPTION_CANCELED: 3,
+    SUBSCRIPTION_PURCHASED: 4,
+    SUBSCRIPTION_ON_HOLD: 5,
+    SUBSCRIPTION_IN_GRACE_PERIOD: 6,
+    SUBSCRIPTION_RESTARTED: 7,
+    SUBSCRIPTION_PRICE_CHANGE_CONFIRMED: 8,
+    SUBSCRIPTION_DEFERRED: 9,
+    SUBSCRIPTION_PAUSED: 10,
+    SUBSCRIPTION_PAUSE_SCHEDULE_CHANGED: 11,
+    SUBSCRIPTION_REVOKED: 12,
+    SUBSCRIPTION_EXPIRED: 13,
+};
+/**
+ * Module-level token cache. Keyed by the raw serviceAccountKey string so that
+ * different service accounts (rare but possible) are cached independently.
+ */
+let cachedToken = null;
+let refreshPromise = null;
+/**
+ * Obtain a Google OAuth2 access token, returning a cached token if it has more
+ * than 60 seconds of remaining validity. Google tokens are valid for 3600 seconds,
+ * so this avoids a network round-trip on every API call.
+ *
+ * Promise deduplication prevents a thundering herd: concurrent callers that
+ * arrive while the token is being refreshed all await the same in-flight
+ * request instead of each issuing their own.
+ */
+async function getCachedAccessToken(serviceAccountKey) {
+    const now = Date.now();
+    if (cachedToken && cachedToken.key === serviceAccountKey && cachedToken.expiresAt - now > 60_000) {
+        return cachedToken.token;
+    }
+    if (!refreshPromise) {
+        refreshPromise = getAccessToken(serviceAccountKey)
+            .then((token) => {
+            cachedToken = { token, expiresAt: Date.now() + 3_600_000, key: serviceAccountKey };
+            return token;
+        })
+            .finally(() => { refreshPromise = null; });
+    }
+    return refreshPromise;
+}
+/**
+ * Obtain a Google OAuth2 access token using a service account key (JWT assertion flow).
+ * The serviceAccountKey is expected to be a JSON string of the service account credentials.
+ */
+async function getAccessToken(serviceAccountKey) {
+    let key;
+    try {
+        key = JSON.parse(serviceAccountKey);
+    }
+    catch {
+        throw new Error('[onesub/google] Invalid serviceAccountKey JSON');
+    }
+    const tokenUri = key.token_uri ?? 'https://oauth2.googleapis.com/token';
+    const scope = 'https://www.googleapis.com/auth/androidpublisher';
+    const now = Math.floor(Date.now() / 1000);
+    // Build a JWT assertion
+    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        iss: key.client_email,
+        scope,
+        aud: tokenUri,
+        iat: now,
+        exp: now + 3600,
+    })).toString('base64url');
+    const signingInput = `${header}.${payload}`;
+    // Sign with the private key using the native crypto module
+    const { createSign } = await import('crypto');
+    const sign = createSign('RSA-SHA256');
+    sign.update(signingInput);
+    const signature = sign.sign(key.private_key, 'base64url');
+    const assertion = `${signingInput}.${signature}`;
+    const resp = await fetch(tokenUri, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+        }),
+    });
+    if (!resp.ok) {
+        throw new Error(`[onesub/google] Token request failed: ${resp.status}`);
+    }
+    const data = (await resp.json());
+    if (!data.access_token)
+        throw new Error('[onesub/google] No access_token in response');
+    return data.access_token;
+}
+/**
+ * Fetch a subscription purchase from the Google Play Developer API.
+ */
+async function fetchSubscriptionPurchase(packageName, productId, purchaseToken, accessToken) {
+    const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(packageName)}/purchases/subscriptions/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}`;
+    const resp = await fetch(url, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!resp.ok) {
+        const body = await resp.text();
+        throw new Error(`[onesub/google] Play API error ${resp.status}: ${body}`);
+    }
+    return resp.json();
+}
+/**
+ * Derive a SubscriptionStatus from a Google Play purchase resource.
+ */
+function deriveStatus(purchase) {
+    const now = Date.now();
+    const expiryMs = purchase.expiryTimeMillis ? parseInt(purchase.expiryTimeMillis, 10) : 0;
+    if (expiryMs > now) {
+        // paymentState 0 = pending (grace period treated as active)
+        return SUBSCRIPTION_STATUS.ACTIVE;
+    }
+    if (purchase.cancelReason !== undefined)
+        return SUBSCRIPTION_STATUS.CANCELED;
+    return SUBSCRIPTION_STATUS.EXPIRED;
+}
+/**
+ * Validate a Google Play purchase token.
+ *
+ * @param receipt  - The purchaseToken from the client (Google Play Billing)
+ * @param productId - The subscription product ID
+ * @param config   - Google config with packageName and optional serviceAccountKey
+ */
+export async function validateGoogleReceipt(receipt, productId, config) {
+    if (!config.serviceAccountKey) {
+        console.warn('[onesub/google] No serviceAccountKey provided — cannot call Play API');
+        return null;
+    }
+    let purchase;
+    try {
+        const token = await getCachedAccessToken(config.serviceAccountKey);
+        purchase = await fetchSubscriptionPurchase(config.packageName, productId, receipt, token);
+    }
+    catch (err) {
+        console.error('[onesub/google] Receipt validation failed:', err);
+        return null;
+    }
+    const status = deriveStatus(purchase);
+    const expiryMs = purchase.expiryTimeMillis ? parseInt(purchase.expiryTimeMillis, 10) : Date.now();
+    const startMs = purchase.startTimeMillis ? parseInt(purchase.startTimeMillis, 10) : Date.now();
+    return {
+        userId: '', // caller fills this in
+        productId,
+        platform: 'google',
+        status,
+        expiresAt: new Date(expiryMs).toISOString(),
+        originalTransactionId: purchase.orderId ?? receipt.slice(0, 64),
+        purchasedAt: new Date(startMs).toISOString(),
+        willRenew: purchase.autoRenewing ?? false,
+    };
+}
+/**
+ * Decode a Google RTDN Pub/Sub notification.
+ * Returns the extracted subscription notification data, or null for test pings.
+ */
+export function decodeGoogleNotification(payload) {
+    let notification;
+    try {
+        const json = Buffer.from(payload.message.data, 'base64').toString('utf-8');
+        notification = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    if (!notification.subscriptionNotification) {
+        // test notification or unsupported type
+        return null;
+    }
+    const { notificationType, purchaseToken, subscriptionId } = notification.subscriptionNotification;
+    return {
+        notificationType,
+        purchaseToken,
+        subscriptionId,
+        packageName: notification.packageName,
+    };
+}
+/**
+ * Determine if a Google RTDN notification type represents an active subscription.
+ */
+export function isGoogleActiveNotification(notificationType) {
+    return (notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PURCHASED ||
+        notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RENEWED ||
+        notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RECOVERED ||
+        notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RESTARTED ||
+        notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_IN_GRACE_PERIOD);
+}
+export function isGoogleCanceledNotification(notificationType) {
+    return (notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_CANCELED ||
+        notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_REVOKED);
+}
+export function isGoogleExpiredNotification(notificationType) {
+    return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_EXPIRED;
+}
+//# sourceMappingURL=google.js.map