@onesub/server 0.11.4 → 0.12.0

package/README.md

@@ -9,11 +9,17 @@ npm install @onesub/server
 ## Requirements
 
 - Node.js **>= 20**
-- **Express** as a peer dependency — `^4.17.0 || ^5.0.0`. Install in your app:
+- **Express** as a peer dependency — `^4.17.0 || ^5.0.0`:
   ```bash
   npm install @onesub/server express
   ```
-- PostgreSQL **12+** (optional, for production stores)
+- Optional peer dependencies (install only what you use):
+  ```bash
+  npm install ioredis        # Redis stores, cache, webhook idempotency
+  npm install bullmq         # Durable webhook queue with dead-letter list
+  npm install pg             # Postgres stores
+  npm install @opentelemetry/api   # Distributed tracing
+  ```
 
 ## Quick start
 
@@ -59,6 +65,9 @@ app.listen(4100);
 | `DELETE /onesub/purchase/admin/:userId/:productId` | Wipe a non-consumable (requires `adminSecret`) |
 | `POST /onesub/purchase/admin/grant` | Manually grant a purchase (requires `adminSecret`) |
 | `POST /onesub/purchase/admin/transfer` | Reassign a `transactionId` to a new `userId` (requires `adminSecret`) |
+| `GET  /onesub/admin/webhook-deadletters` | List failed webhook jobs in DLQ (requires `adminSecret` + BullMQ) |
+| `POST /onesub/admin/webhook-replay/:id` | Replay a dead-letter job (requires `adminSecret` + BullMQ) |
+| `GET  /openapi.json` | OpenAPI 3.1 spec (opt-in via `openapiHandler()`) |
 
 ## Lifecycle states (`0.4.0+`)
 
@@ -134,6 +143,114 @@ google: {
 }
 ```
 
+## Multi-instance deployments (`0.12.0+`)
+
+By default every option uses in-process memory — zero config, zero infra. For multi-node clusters, swap in the Redis-backed equivalents:
+
+```ts
+import Redis from 'ioredis';
+import {
+  createOneSubMiddleware,
+  RedisSubscriptionStore,
+  RedisPurchaseStore,
+  RedisCacheAdapter,
+  RedisWebhookEventStore,
+} from '@onesub/server';
+
+const redis = new Redis(process.env.REDIS_URL!);
+
+app.use(createOneSubMiddleware({
+  // ...apple / google / database config...
+  store:              new RedisSubscriptionStore(redis),
+  purchaseStore:      new RedisPurchaseStore(redis),
+  cache:              new RedisCacheAdapter(redis),      // share Apple JWT + Google OAuth tokens across nodes
+  webhookEventStore:  new RedisWebhookEventStore(redis), // atomic SET NX dedup — one node handles each event
+}));
+```
+
+| Class | Replaces | What it does |
+|-------|----------|--------------|
+| `RedisSubscriptionStore` | `InMemorySubscriptionStore` | Sorted-set index, newest-first pagination |
+| `RedisPurchaseStore` | `InMemoryPurchaseStore` | Cross-node purchase ownership |
+| `RedisCacheAdapter` | `InMemoryCacheAdapter` | Shared Apple JWT / Google OAuth token cache |
+| `RedisWebhookEventStore` | `InMemoryWebhookEventStore` | Atomic `SET NX` dedup (no get→set race) |
+
+### Webhook queue with durable retries
+
+Replace the default in-process queue with BullMQ for decoupled retries and a dead-letter list:
+
+```ts
+import { BullMQWebhookQueue } from '@onesub/server';
+import Redis from 'ioredis';
+
+const connection = new Redis(process.env.REDIS_URL!, { maxRetriesPerRequest: null });
+const webhookQueue = new BullMQWebhookQueue({ connection });
+
+app.use(createOneSubMiddleware({
+  // ...
+  webhookQueue,
+  adminSecret: process.env.ADMIN_SECRET, // required for DLQ endpoints
+}));
+```
+
+The webhook route 200s immediately once the job is enqueued. The BullMQ worker retries up to 5× (exponential backoff, 1 s base) before moving the job to the dead-letter list. Inspect and replay via the admin endpoints above.
+
+## Cache adapter (`0.12.0+`)
+
+The `cache` option controls how Apple JWT assertions and Google OAuth access tokens are cached between requests. Default is `InMemoryCacheAdapter` (process-local). Shared Redis cache prevents every cluster node from minting its own token:
+
+```ts
+import { InMemoryCacheAdapter, RedisCacheAdapter } from '@onesub/server';
+
+// single instance (default — no config needed)
+cache: new InMemoryCacheAdapter()
+
+// multi-instance
+cache: new RedisCacheAdapter(redis)
+cache: new RedisCacheAdapter(redis, 'myapp:cache:') // custom key prefix
+```
+
+You can also pass any object implementing `CacheAdapter`:
+
+```ts
+export interface CacheAdapter {
+  get<T>(key: string): Promise<T | null>;
+  set<T>(key: string, value: T, ttlSeconds?: number): Promise<void>;
+  del(key: string): Promise<void>;
+}
+```
+
+## OpenAPI (`0.12.0+`)
+
+The full OpenAPI 3.1 document is exported as `ONESUB_OPENAPI`. Self-host it on your existing Express app:
+
+```ts
+import { openapiHandler } from '@onesub/server';
+
+app.get('/openapi.json', openapiHandler());
+```
+
+Or import the spec directly for client generation:
+
+```ts
+import { ONESUB_OPENAPI } from '@onesub/server';
+// use with openapi-typescript, swagger-ui-express, etc.
+```
+
+## OpenTelemetry tracing (`0.12.0+`)
+
+Install `@opentelemetry/api` alongside an OTel SDK and spans appear automatically for receipt validation and webhook processing. The helper is zero-overhead when the package is absent — no `require` error, no performance hit.
+
+You can wrap your own code in the same tracer:
+
+```ts
+import { withSpan } from '@onesub/server';
+
+const result = await withSpan('my-operation', { 'user.id': userId }, async () => {
+  return await doWork();
+});
+```
+
 ## Schema
 
 Canonical Postgres DDL shipped at [`sql/schema.sql`](./sql/schema.sql). Apply with `psql -f` or let `store.initSchema()` run it for you on startup.

package/dist/__tests__/cache.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cache.test.d.ts.map

package/dist/__tests__/cache.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/cache.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/cache.test.js

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import { InMemoryCacheAdapter } from '../cache.js';
+describe('InMemoryCacheAdapter', () => {
+    it('returns null for missing keys', async () => {
+        const cache = new InMemoryCacheAdapter();
+        expect(await cache.get('absent')).toBeNull();
+    });
+    it('round-trips a value', async () => {
+        const cache = new InMemoryCacheAdapter();
+        await cache.set('k', { token: 'abc', n: 1 });
+        expect(await cache.get('k')).toEqual({ token: 'abc', n: 1 });
+    });
+    it('expires entries after the TTL elapses', async () => {
+        const cache = new InMemoryCacheAdapter();
+        await cache.set('k', 'v', 1);
+        expect(await cache.get('k')).toBe('v');
+        // Force expiry by moving the clock forward via a sleep substitute.
+        await new Promise((resolve) => setTimeout(resolve, 1100));
+        expect(await cache.get('k')).toBeNull();
+    });
+    it('treats ttl=0 / undefined as no-expiry', async () => {
+        const cache = new InMemoryCacheAdapter();
+        await cache.set('forever', 'v');
+        await new Promise((resolve) => setTimeout(resolve, 50));
+        expect(await cache.get('forever')).toBe('v');
+    });
+    it('del removes a key', async () => {
+        const cache = new InMemoryCacheAdapter();
+        await cache.set('k', 'v');
+        await cache.del('k');
+        expect(await cache.get('k')).toBeNull();
+    });
+});
+//# sourceMappingURL=cache.test.js.map

package/dist/__tests__/cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.test.js","sourceRoot":"","sources":["../../src/__tests__/cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,mEAAmE;QACnE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openapi.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=openapi.test.d.ts.map

package/dist/__tests__/openapi.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/openapi.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import { ONESUB_OPENAPI } from '../openapi.js';
+import { ROUTES } from '@onesub/shared';
+describe('OpenAPI document', () => {
+    it('declares every public route', () => {
+        const declared = Object.keys(ONESUB_OPENAPI.paths);
+        // Spot-check the main public routes — the spec is hand-written, so this
+        // is the parity guard. Routes added to ROUTES that aren't in the spec
+        // should fail this test.
+        for (const path of [
+            ROUTES.VALIDATE,
+            ROUTES.STATUS,
+            ROUTES.WEBHOOK_APPLE,
+            ROUTES.WEBHOOK_GOOGLE,
+            ROUTES.ENTITLEMENTS,
+            ROUTES.ADMIN_SUBSCRIPTIONS,
+        ]) {
+            expect(declared).toContain(path);
+        }
+    });
+    it('uses 3.1.0', () => {
+        expect(ONESUB_OPENAPI.openapi).toBe('3.1.0');
+    });
+    it('declares the AdminSecret security scheme', () => {
+        expect(ONESUB_OPENAPI.components.securitySchemes.AdminSecret).toMatchObject({
+            type: 'apiKey',
+            in: 'header',
+            name: 'X-Admin-Secret',
+        });
+    });
+});
+//# sourceMappingURL=openapi.test.js.map

package/dist/__tests__/openapi.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.test.js","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnD,wEAAwE;QACxE,sEAAsE;QACtE,yBAAyB;QACzB,KAAK,MAAM,IAAI,IAAI;YACjB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,YAAY;YACnB,MAAM,CAAC,mBAAmB;SAC3B,EAAE,CAAC;YACF,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;QACpB,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC;YAC1E,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/redis-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redis-store.test.d.ts.map

package/dist/__tests__/redis-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/redis-store.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/redis-store.test.js

@@ -0,0 +1,117 @@
+import { describe, expect, it, beforeEach } from 'vitest';
+import IORedisMock from 'ioredis-mock';
+import { RedisSubscriptionStore, RedisPurchaseStore, RedisCacheAdapter } from '../stores/redis.js';
+import { SUBSCRIPTION_STATUS } from '@onesub/shared';
+function makeRedis() {
+    // ioredis-mock's surface matches ioredis enough for our store's methods
+    // (set/get/zadd/zrevrange/sadd/smembers/multi). Cast to keep TS happy.
+    return new IORedisMock();
+}
+const baseSub = {
+    originalTransactionId: 'tx-1',
+    userId: 'alice',
+    productId: 'pro_monthly',
+    platform: 'apple',
+    status: SUBSCRIPTION_STATUS.ACTIVE,
+    expiresAt: '2030-01-01T00:00:00.000Z',
+    purchasedAt: '2025-01-01T00:00:00.000Z',
+    willRenew: true,
+};
+describe('RedisSubscriptionStore', () => {
+    let redis;
+    let store;
+    beforeEach(() => {
+        redis = makeRedis();
+        store = new RedisSubscriptionStore(redis);
+    });
+    it('save + getByTransactionId round-trip', async () => {
+        await store.save(baseSub);
+        const fetched = await store.getByTransactionId('tx-1');
+        expect(fetched).toEqual(baseSub);
+    });
+    it('getByUserId returns the most-recent record', async () => {
+        await store.save({ ...baseSub, originalTransactionId: 'tx-1', expiresAt: '2026-01-01T00:00:00.000Z' });
+        // Force a 1ms gap so the second save lands with a higher zadd score.
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        await store.save({ ...baseSub, originalTransactionId: 'tx-2', expiresAt: '2027-01-01T00:00:00.000Z' });
+        const latest = await store.getByUserId('alice');
+        expect(latest?.originalTransactionId).toBe('tx-2');
+    });
+    it('getAllByUserId returns every tx newest-first', async () => {
+        await store.save({ ...baseSub, originalTransactionId: 'tx-1' });
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        await store.save({ ...baseSub, originalTransactionId: 'tx-2' });
+        const all = await store.getAllByUserId('alice');
+        expect(all.map((s) => s.originalTransactionId)).toEqual(['tx-2', 'tx-1']);
+    });
+    it('listAll surfaces subs across users', async () => {
+        await store.save({ ...baseSub, originalTransactionId: 'tx-a', userId: 'alice' });
+        await store.save({ ...baseSub, originalTransactionId: 'tx-b', userId: 'bob' });
+        const all = await store.listAll();
+        expect(all).toHaveLength(2);
+    });
+    it('listFiltered respects userId + status filters', async () => {
+        await store.save({ ...baseSub, originalTransactionId: 'tx-a', userId: 'alice' });
+        await store.save({ ...baseSub, originalTransactionId: 'tx-b', userId: 'alice', status: SUBSCRIPTION_STATUS.EXPIRED });
+        const result = await store.listFiltered({ userId: 'alice', status: SUBSCRIPTION_STATUS.ACTIVE });
+        expect(result.total).toBe(1);
+        expect(result.items[0].originalTransactionId).toBe('tx-a');
+    });
+});
+const basePurchase = {
+    transactionId: 'p-1',
+    userId: 'alice',
+    productId: 'remove_ads',
+    platform: 'apple',
+    type: 'non_consumable',
+    quantity: 1,
+    purchasedAt: '2025-01-01T00:00:00.000Z',
+};
+describe('RedisPurchaseStore', () => {
+    let redis;
+    let store;
+    beforeEach(() => {
+        redis = makeRedis();
+        store = new RedisPurchaseStore(redis);
+    });
+    it('savePurchase + getPurchaseByTransactionId round-trip', async () => {
+        await store.savePurchase(basePurchase);
+        const fetched = await store.getPurchaseByTransactionId('p-1');
+        expect(fetched).toEqual(basePurchase);
+    });
+    it('refuses cross-user reuse of the same transactionId', async () => {
+        await store.savePurchase(basePurchase);
+        await expect(store.savePurchase({ ...basePurchase, userId: 'mallory' })).rejects.toThrow(/TRANSACTION_BELONGS_TO_OTHER_USER/);
+    });
+    it('hasPurchased detects a non-consumable buy', async () => {
+        await store.savePurchase(basePurchase);
+        expect(await store.hasPurchased('alice', 'remove_ads')).toBe(true);
+        expect(await store.hasPurchased('alice', 'other_product')).toBe(false);
+    });
+    it('reassignPurchase moves ownership without losing the row', async () => {
+        await store.savePurchase(basePurchase);
+        expect(await store.reassignPurchase('p-1', 'bob')).toBe(true);
+        const fetched = await store.getPurchaseByTransactionId('p-1');
+        expect(fetched?.userId).toBe('bob');
+        expect(await store.hasPurchased('alice', 'remove_ads')).toBe(false);
+        expect(await store.hasPurchased('bob', 'remove_ads')).toBe(true);
+    });
+    it('deletePurchaseByTransactionId removes everywhere', async () => {
+        await store.savePurchase(basePurchase);
+        expect(await store.deletePurchaseByTransactionId('p-1')).toBe(true);
+        expect(await store.getPurchaseByTransactionId('p-1')).toBeNull();
+        expect(await store.hasPurchased('alice', 'remove_ads')).toBe(false);
+    });
+});
+describe('RedisCacheAdapter', () => {
+    it('round-trips with TTL', async () => {
+        const cache = new RedisCacheAdapter(makeRedis());
+        await cache.set('k', { token: 'abc' }, 60);
+        expect(await cache.get('k')).toEqual({ token: 'abc' });
+    });
+    it('returns null for missing keys', async () => {
+        const cache = new RedisCacheAdapter(makeRedis());
+        expect(await cache.get('absent')).toBeNull();
+    });
+});
+//# sourceMappingURL=redis-store.test.js.map

package/dist/__tests__/redis-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.test.js","sourceRoot":"","sources":["../../src/__tests__/redis-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,WAAW,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,SAAS,SAAS;IAChB,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,IAAI,WAAW,EAAsB,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,GAAqB;IAChC,qBAAqB,EAAE,MAAM;IAC7B,MAAM,EAAE,OAAO;IACf,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,mBAAmB,CAAC,MAAM;IAClC,SAAS,EAAE,0BAA0B;IACrC,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,IAAI;CAChB,CAAC;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,KAAY,CAAC;IACjB,IAAI,KAA6B,CAAC;IAElC,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,SAAS,EAAE,CAAC;QACpB,KAAK,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,qEAAqE;QACrE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAiB;IACjC,aAAa,EAAE,KAAK;IACpB,MAAM,EAAE,OAAO;IACf,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,0BAA0B;CACxC,CAAC;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,KAAY,CAAC;IACjB,IAAI,KAAyB,CAAC;IAE9B,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,SAAS,EAAE,CAAC;QACpB,KAAK,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtF,mCAAmC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/webhook-events.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-events.test.d.ts.map

package/dist/__tests__/webhook-events.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-events.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-events.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/webhook-events.test.js

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest';
+import { CacheWebhookEventStore, InMemoryWebhookEventStore } from '../webhook-events.js';
+import { InMemoryCacheAdapter } from '../cache.js';
+describe('InMemoryWebhookEventStore', () => {
+    it('returns true the first time, false on retry', async () => {
+        const store = new InMemoryWebhookEventStore();
+        expect(await store.markIfNew('apple', 'uuid-1')).toBe(true);
+        expect(await store.markIfNew('apple', 'uuid-1')).toBe(false);
+    });
+    it('keys by provider so apple/google ids never collide', async () => {
+        const store = new InMemoryWebhookEventStore();
+        expect(await store.markIfNew('apple', 'shared')).toBe(true);
+        expect(await store.markIfNew('google', 'shared')).toBe(true);
+    });
+    it('expires entries after the TTL', async () => {
+        const store = new InMemoryWebhookEventStore(1); // 1-second TTL
+        expect(await store.markIfNew('apple', 'uuid-1')).toBe(true);
+        await new Promise((resolve) => setTimeout(resolve, 1100));
+        // Re-eligible after expiry — Apple/Google retries beyond the window are
+        // effectively new events, which is the intended behavior.
+        expect(await store.markIfNew('apple', 'uuid-1')).toBe(true);
+    });
+});
+describe('CacheWebhookEventStore', () => {
+    it('uses any CacheAdapter for cluster-shared dedupe', async () => {
+        const cache = new InMemoryCacheAdapter();
+        const store = new CacheWebhookEventStore(cache);
+        expect(await store.markIfNew('google', 'msg-1')).toBe(true);
+        expect(await store.markIfNew('google', 'msg-1')).toBe(false);
+        // A second store backed by the same cache sees the prior write — this is
+        // the multi-instance idempotency guarantee we ship.
+        const store2 = new CacheWebhookEventStore(cache);
+        expect(await store2.markIfNew('google', 'msg-1')).toBe(false);
+    });
+});
+//# sourceMappingURL=webhook-events.test.js.map

package/dist/__tests__/webhook-events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-events.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;QAC/D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7D,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/webhook-queue.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-queue.test.d.ts.map

package/dist/__tests__/webhook-queue.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-queue.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-queue.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/webhook-queue.test.js

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest';
+import { InProcessWebhookQueue } from '../webhook-queue.js';
+describe('InProcessWebhookQueue', () => {
+    it('runs the handler synchronously inside enqueue', async () => {
+        const queue = new InProcessWebhookQueue();
+        const seen = [];
+        queue.setHandler(async (job) => {
+            seen.push(job);
+        });
+        await queue.enqueue({ provider: 'apple', eventId: 'uuid-1', payload: { foo: 'bar' } });
+        expect(seen).toHaveLength(1);
+        expect(seen[0].eventId).toBe('uuid-1');
+    });
+    it('throws if no handler has been registered', async () => {
+        const queue = new InProcessWebhookQueue();
+        await expect(queue.enqueue({ provider: 'apple', eventId: 'uuid-1', payload: {} })).rejects.toThrow(/no handler/);
+    });
+    it('propagates handler errors to enqueue', async () => {
+        const queue = new InProcessWebhookQueue();
+        queue.setHandler(async () => {
+            throw new Error('downstream failed');
+        });
+        await expect(queue.enqueue({ provider: 'apple', eventId: 'uuid-1', payload: {} })).rejects.toThrow(/downstream failed/);
+    });
+});
+//# sourceMappingURL=webhook-queue.test.js.map

package/dist/__tests__/webhook-queue.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-queue.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-queue.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACrE,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CACV,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACrE,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cache.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Pluggable cache adapter.
+ *
+ * Used internally by the Apple JWT minter, Google OAuth token minter, and any
+ * future per-process cache. The default `InMemoryCacheAdapter` matches the
+ * pre-adapter behavior — module-level state, lost on restart, not shared
+ * between cluster nodes.
+ *
+ * For multi-instance deployments, pass a `RedisCacheAdapter` in
+ * `OneSubMiddlewareConfig.cache` so all nodes share the same JWKS / token
+ * cache and avoid every node re-minting on its own schedule.
+ */
+export interface CacheAdapter {
+    get<T = unknown>(key: string): Promise<T | null>;
+    /** TTL in seconds. Pass 0 / undefined for no expiry. */
+    set<T = unknown>(key: string, value: T, ttlSeconds?: number): Promise<void>;
+    del(key: string): Promise<void>;
+}
+/**
+ * Process-local in-memory cache. Default for single-instance deployments.
+ */
+export declare class InMemoryCacheAdapter implements CacheAdapter {
+    private readonly entries;
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, ttlSeconds?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
+    clear(): void;
+}
+export declare function getDefaultCache(): CacheAdapter;
+export declare function setDefaultCache(adapter: CacheAdapter): void;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,wDAAwD;IACxD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAQD;;GAEG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAE9C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAUtC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,oFAAoF;IACpF,KAAK,IAAI,IAAI;CAGd;AAQD,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAE3D"}

package/dist/cache.js

@@ -0,0 +1,43 @@
+/**
+ * Process-local in-memory cache. Default for single-instance deployments.
+ */
+export class InMemoryCacheAdapter {
+    entries = new Map();
+    async get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt !== 0 && entry.expiresAt < Date.now()) {
+            this.entries.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds) {
+        const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1000 : 0;
+        this.entries.set(key, { value, expiresAt });
+    }
+    async del(key) {
+        this.entries.delete(key);
+    }
+    /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
+    clear() {
+        this.entries.clear();
+    }
+}
+/**
+ * Module-level singleton used by providers when no per-call adapter is
+ * supplied. Keeps the existing single-instance behavior with zero config.
+ */
+let defaultAdapter = new InMemoryCacheAdapter();
+export function getDefaultCache() {
+    return defaultAdapter;
+}
+export function setDefaultCache(adapter) {
+    defaultAdapter = adapter;
+}
+/** Test helper — reset the default adapter to a fresh in-memory one. */
+export function __resetDefaultCacheForTests() {
+    defaultAdapter = new InMemoryCacheAdapter();
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,UAAmB;QACrD,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,IAAI,cAAc,GAAiB,IAAI,oBAAoB,EAAE,CAAC;AAE9D,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,cAAc,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,2BAA2B;IACzC,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC9C,CAAC"}