@onesub/server 0.11.4 → 0.12.0

package/dist/tracing.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Optional OpenTelemetry tracing.
+ *
+ * `@opentelemetry/api` is an optional peer dependency — when it's installed
+ * onesub wraps its hot paths in spans. When it isn't, every span helper is
+ * a zero-cost no-op (no dynamic import, no Promise overhead).
+ *
+ * Why a custom helper instead of @opentelemetry/instrumentation-express:
+ * the express instrumentation traces every request, but onesub's interesting
+ * spans are specific operations (Apple JWT mint, Google OAuth refresh,
+ * receipt validation, webhook dispatch). Hand-spanned hot paths give
+ * actionable traces without doubling latency-tracker overhead.
+ */
+type Span = {
+    setAttribute: (key: string, value: string | number | boolean) => void;
+    recordException: (err: unknown) => void;
+    setStatus: (status: {
+        code: number;
+        message?: string;
+    }) => void;
+    end: () => void;
+};
+/**
+ * Wrap an async operation in a span. When otel isn't installed the function
+ * runs unmodified — no span object is allocated.
+ *
+ * Use for operations whose latency or failure rate is operationally
+ * interesting: receipt validation, store writes, outbound API calls.
+ */
+export declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: (span: Span) => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=tracing.d.ts.map

package/dist/tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,KAAK,IAAI,GAAG;IACV,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,KAAK,IAAI,CAAC;IACtE,eAAe,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAChE,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB,CAAC;AAkCF;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACrD,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,CAmBZ"}

package/dist/tracing.js

@@ -0,0 +1,74 @@
+/**
+ * Optional OpenTelemetry tracing.
+ *
+ * `@opentelemetry/api` is an optional peer dependency — when it's installed
+ * onesub wraps its hot paths in spans. When it isn't, every span helper is
+ * a zero-cost no-op (no dynamic import, no Promise overhead).
+ *
+ * Why a custom helper instead of @opentelemetry/instrumentation-express:
+ * the express instrumentation traces every request, but onesub's interesting
+ * spans are specific operations (Apple JWT mint, Google OAuth refresh,
+ * receipt validation, webhook dispatch). Hand-spanned hot paths give
+ * actionable traces without doubling latency-tracker overhead.
+ */
+const NOOP_SPAN = {
+    setAttribute: () => { },
+    recordException: () => { },
+    setStatus: () => { },
+    end: () => { },
+};
+/**
+ * Lazy-loaded tracer. We don't reach for `@opentelemetry/api` until the
+ * first `withSpan` call so process startup pays nothing when otel is absent.
+ */
+let cachedTracer = null;
+let resolved = false;
+function getTracer() {
+    if (resolved)
+        return cachedTracer;
+    resolved = true;
+    try {
+        // Resolve synchronously via require — otel api is CJS-friendly.
+        // require is undefined in pure ESM at runtime; in that case skip otel.
+        const req = globalThis.require;
+        if (!req)
+            return null;
+        const otel = req('@opentelemetry/api');
+        cachedTracer = otel.trace.getTracer('@onesub/server', '1.0.0');
+        return cachedTracer;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Wrap an async operation in a span. When otel isn't installed the function
+ * runs unmodified — no span object is allocated.
+ *
+ * Use for operations whose latency or failure rate is operationally
+ * interesting: receipt validation, store writes, outbound API calls.
+ */
+export async function withSpan(name, attributes, fn) {
+    const tracer = getTracer();
+    if (!tracer)
+        return fn(NOOP_SPAN);
+    return tracer.startActiveSpan(name, async (span) => {
+        for (const [k, v] of Object.entries(attributes))
+            span.setAttribute(k, v);
+        try {
+            const result = await fn(span);
+            // status code 1 = OK, 2 = ERROR (avoid importing the enum from otel api)
+            span.setStatus({ code: 1 });
+            return result;
+        }
+        catch (err) {
+            span.recordException(err);
+            span.setStatus({ code: 2, message: err.message });
+            throw err;
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+//# sourceMappingURL=tracing.js.map

package/dist/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,MAAM,SAAS,GAAS;IACtB,YAAY,EAAE,GAAG,EAAE,GAAE,CAAC;IACtB,eAAe,EAAE,GAAG,EAAE,GAAE,CAAC;IACzB,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;IACnB,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;CACd,CAAC;AAEF;;;GAGG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,SAAS,SAAS;IAChB,IAAI,QAAQ;QAAE,OAAO,YAAY,CAAC;IAClC,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,gEAAgE;QAChE,uEAAuE;QACvE,MAAM,GAAG,GACP,UACD,CAAC,OAAO,CAAC;QACV,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAA+D,CAAC;QACrG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,UAAqD,EACrD,EAA8B;IAE9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9B,yEAAyE;YACzE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/webhook-events.d.ts

@@ -0,0 +1,58 @@
+import type { CacheAdapter } from './cache.js';
+/**
+ * Pluggable webhook-event idempotency store.
+ *
+ * Apple sends `notificationUUID` and Google Pub/Sub sends `messageId` — both
+ * are guaranteed unique per notification. Apple/Google will retry on any
+ * non-2xx response (Apple: ~3 days, Google: configurable Pub/Sub policy), so
+ * the same notification can hit our handler multiple times if the previous
+ * response timed out, the DB was briefly down, etc. We must not double-apply
+ * state changes (extra subscription days, refunded purchase being deleted
+ * twice, consumption response being PUT twice).
+ *
+ * `markIfNew` returns `true` when the caller should process the event,
+ * `false` when it has been seen before. Implementations decide retention —
+ * once-seen IDs are kept long enough that retries from the source can't beat
+ * the TTL (we recommend ≥ 7 days).
+ */
+export interface WebhookEventStore {
+    /**
+     * Atomically register the given event id. Returns `true` if it's new (first
+     * time we've seen it), `false` if it was already seen.
+     *
+     * `provider` lets us key by source so Apple's notificationUUID and Google's
+     * messageId never collide.
+     */
+    markIfNew(provider: 'apple' | 'google', eventId: string): Promise<boolean>;
+}
+/**
+ * In-memory implementation. Suitable for single-instance dev/test; for
+ * production multi-instance use the Redis or Postgres variants so retries to
+ * other nodes are still deduped.
+ */
+export declare class InMemoryWebhookEventStore implements WebhookEventStore {
+    private readonly ttlSeconds;
+    private readonly seen;
+    constructor(ttlSeconds?: number);
+    markIfNew(provider: 'apple' | 'google', eventId: string): Promise<boolean>;
+    private evictExpired;
+}
+/**
+ * Cache-backed implementation — works with any `CacheAdapter`.
+ *
+ * Uses a `get` → `set` sequence, which is **not** atomic under concurrent
+ * retries: two simultaneous calls for the same id can both read null and
+ * both return `true`. The downstream store PKs / BullMQ jobId dedup catch
+ * this worst case.
+ *
+ * For Redis deployments prefer `RedisWebhookEventStore` (from
+ * `@onesub/server`) which uses a single `SET NX` command and is fully
+ * atomic.
+ */
+export declare class CacheWebhookEventStore implements WebhookEventStore {
+    private readonly cache;
+    private readonly ttlSeconds;
+    constructor(cache: CacheAdapter, ttlSeconds?: number);
+    markIfNew(provider: 'apple' | 'google', eventId: string): Promise<boolean>;
+}
+//# sourceMappingURL=webhook-events.d.ts.map

package/dist/webhook-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-events.d.ts","sourceRoot":"","sources":["../src/webhook-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E;AAKD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IAGrD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;gBAErB,UAAU,SAAsB;IAEvD,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF,OAAO,CAAC,YAAY;CAMrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,KAAK,EAAE,YAAY,EACnB,UAAU,SAAsB;IAG7C,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAOjF"}

package/dist/webhook-events.js

@@ -0,0 +1,57 @@
+/** Default 7-day retention — covers Apple's 3-day retry window plus headroom. */
+const DEFAULT_TTL_SECONDS = 7 * 24 * 60 * 60;
+/**
+ * In-memory implementation. Suitable for single-instance dev/test; for
+ * production multi-instance use the Redis or Postgres variants so retries to
+ * other nodes are still deduped.
+ */
+export class InMemoryWebhookEventStore {
+    ttlSeconds;
+    seen = new Map();
+    constructor(ttlSeconds = DEFAULT_TTL_SECONDS) {
+        this.ttlSeconds = ttlSeconds;
+    }
+    async markIfNew(provider, eventId) {
+        this.evictExpired();
+        const key = `${provider}:${eventId}`;
+        if (this.seen.has(key))
+            return false;
+        this.seen.set(key, Date.now() + this.ttlSeconds * 1000);
+        return true;
+    }
+    evictExpired() {
+        const now = Date.now();
+        for (const [key, expiresAt] of this.seen) {
+            if (expiresAt < now)
+                this.seen.delete(key);
+        }
+    }
+}
+/**
+ * Cache-backed implementation — works with any `CacheAdapter` (including
+ * `RedisCacheAdapter`), so multi-instance deployments dedupe across nodes.
+ *
+ * Uses the cache's atomic `set` semantics: we call `get` then `set` with TTL.
+ * This is correct under low contention; for very high concurrency the
+ * implementation may want a backend with native SETNX. RedisCacheAdapter's
+ * `set` is idempotent, so concurrent first-writes converge — the behavior is
+ * "at-most-twice" rather than "exactly once" in the worst race, which the
+ * downstream store-level idempotency (`originalTransactionId` PK) catches.
+ */
+export class CacheWebhookEventStore {
+    cache;
+    ttlSeconds;
+    constructor(cache, ttlSeconds = DEFAULT_TTL_SECONDS) {
+        this.cache = cache;
+        this.ttlSeconds = ttlSeconds;
+    }
+    async markIfNew(provider, eventId) {
+        const key = `webhook:event:${provider}:${eventId}`;
+        const existing = await this.cache.get(key);
+        if (existing)
+            return false;
+        await this.cache.set(key, '1', this.ttlSeconds);
+        return true;
+    }
+}
+//# sourceMappingURL=webhook-events.js.map

package/dist/webhook-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-events.js","sourceRoot":"","sources":["../src/webhook-events.ts"],"names":[],"mappings":"AA6BA,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE7C;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAGP;IAFZ,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YAA6B,aAAa,mBAAmB;QAAhC,eAAU,GAAV,UAAU,CAAsB;IAAG,CAAC;IAEjE,KAAK,CAAC,SAAS,CAAC,QAA4B,EAAE,OAAe;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAEd;IACA;IAFnB,YACmB,KAAmB,EACnB,aAAa,mBAAmB;QADhC,UAAK,GAAL,KAAK,CAAc;QACnB,eAAU,GAAV,UAAU,CAAsB;IAChD,CAAC;IAEJ,KAAK,CAAC,SAAS,CAAC,QAA4B,EAAE,OAAe;QAC3D,MAAM,GAAG,GAAG,iBAAiB,QAAQ,IAAI,OAAO,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAS,GAAG,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/webhook-queue.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Webhook processing queue.
+ *
+ * The default in-process queue runs the handler synchronously inside the HTTP
+ * request — the same behavior you got before this interface existed. For
+ * production deployments that want decoupled retries, swap in a queue-backed
+ * implementation (BullMQ, SQS, etc.) so a slow DB or Apple/Google API call
+ * doesn't block the webhook from acknowledging.
+ *
+ * Failure semantics:
+ *   - Handler throws  → queue records the failure and (for retrying queues)
+ *                       re-runs with backoff. After max attempts the job
+ *                       lands in the dead-letter store.
+ *   - Handler returns → ack to source.
+ *
+ * The HTTP route should always 200 once the job is *enqueued*. Synchronous
+ * processing happens to acknowledge later only because the in-process queue
+ * runs inline; for any async queue the route should ack after `enqueue()`.
+ */
+export interface WebhookJob<T = unknown> {
+    provider: 'apple' | 'google';
+    /** Source-supplied event id (notificationUUID / messageId) for tracing. */
+    eventId: string;
+    payload: T;
+}
+export type WebhookHandler<T = unknown> = (job: WebhookJob<T>) => Promise<void>;
+export interface WebhookQueue {
+    /**
+     * Enqueue a job. Returns once the job is durably accepted (synchronous for
+     * in-process; persisted-to-Redis for BullMQ).
+     */
+    enqueue<T>(job: WebhookJob<T>): Promise<void>;
+    /** Register the worker handler. Called once during middleware setup. */
+    setHandler<T>(handler: WebhookHandler<T>): void;
+    /** Optional: list jobs in the dead-letter queue (for the admin replay UI). */
+    listDeadLetters?(): Promise<DeadLetterRecord[]>;
+    /** Optional: replay a specific dead-letter job back through the handler. */
+    replayDeadLetter?(id: string): Promise<void>;
+    /** Optional: graceful shutdown. */
+    close?(): Promise<void>;
+}
+export interface DeadLetterRecord {
+    id: string;
+    job: WebhookJob;
+    attempts: number;
+    lastError: string;
+    failedAt: string;
+}
+/**
+ * Synchronous, in-process implementation. Default — no extra infra required.
+ * Handler runs inside the HTTP request, so route latency = handler latency.
+ *
+ * Failures are NOT retried — the original Apple/Google source retry policy
+ * is the durability layer (4xx = no retry, 5xx = source retries). This
+ * matches the pre-queue behavior.
+ */
+export declare class InProcessWebhookQueue implements WebhookQueue {
+    private handler;
+    setHandler<T>(handler: WebhookHandler<T>): void;
+    enqueue<T>(job: WebhookJob<T>): Promise<void>;
+}
+export interface BullMQWebhookQueueOptions {
+    /** ioredis connection (or compatible options). Required. */
+    connection: unknown;
+    /** Queue name. Defaults to 'onesub-webhooks'. */
+    queueName?: string;
+    /** Max retry attempts before sending the job to the dead-letter list. */
+    maxAttempts?: number;
+    /** Backoff (ms) between attempts. Exponential: backoffMs * 2^(attempt-1). */
+    backoffMs?: number;
+    /** Worker concurrency. Defaults to 4. */
+    concurrency?: number;
+}
+export declare class BullMQWebhookQueue implements WebhookQueue {
+    private queueName;
+    private maxAttempts;
+    private backoffMs;
+    private concurrency;
+    private connection;
+    private queuePromise;
+    private workerPromise;
+    private handler;
+    constructor(opts: BullMQWebhookQueueOptions);
+    private getBullMQ;
+    private getQueue;
+    setHandler<T>(handler: WebhookHandler<T>): void;
+    enqueue<T>(job: WebhookJob<T>): Promise<void>;
+    listDeadLetters(): Promise<DeadLetterRecord[]>;
+    replayDeadLetter(id: string): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=webhook-queue.d.ts.map

package/dist/webhook-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-queue.d.ts","sourceRoot":"","sources":["../src/webhook-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC7B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,wEAAwE;IACxE,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,8EAA8E;IAC9E,eAAe,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,4EAA4E;IAC5E,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,mCAAmC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,UAAU,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IACxD,OAAO,CAAC,OAAO,CAA+B;IAE9C,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI;IAIzC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAsDD,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAU;IAI5B,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,OAAO,CAA+B;gBAElC,IAAI,EAAE,yBAAyB;YAQ7B,SAAS;IAMvB,OAAO,CAAC,QAAQ;IAUhB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI;IAoBzC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY9C,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B"}

package/dist/webhook-queue.js

@@ -0,0 +1,108 @@
+/**
+ * Synchronous, in-process implementation. Default — no extra infra required.
+ * Handler runs inside the HTTP request, so route latency = handler latency.
+ *
+ * Failures are NOT retried — the original Apple/Google source retry policy
+ * is the durability layer (4xx = no retry, 5xx = source retries). This
+ * matches the pre-queue behavior.
+ */
+export class InProcessWebhookQueue {
+    handler = null;
+    setHandler(handler) {
+        this.handler = handler;
+    }
+    async enqueue(job) {
+        if (!this.handler) {
+            throw new Error('[onesub] webhook queue has no handler registered');
+        }
+        await this.handler(job);
+    }
+}
+export class BullMQWebhookQueue {
+    queueName;
+    maxAttempts;
+    backoffMs;
+    concurrency;
+    connection;
+    // Lazy-loaded so `bullmq` doesn't have to be installed unless this class
+    // is instantiated.
+    queuePromise = null;
+    workerPromise = null;
+    handler = null;
+    constructor(opts) {
+        this.connection = opts.connection;
+        this.queueName = opts.queueName ?? 'onesub-webhooks';
+        this.maxAttempts = opts.maxAttempts ?? 5;
+        this.backoffMs = opts.backoffMs ?? 1000;
+        this.concurrency = opts.concurrency ?? 4;
+    }
+    async getBullMQ() {
+        return import('bullmq').catch(() => {
+            throw new Error('[onesub] BullMQWebhookQueue requires the `bullmq` package. Run: npm install bullmq');
+        });
+    }
+    getQueue() {
+        if (!this.queuePromise) {
+            this.queuePromise = (async () => {
+                const { Queue } = await this.getBullMQ();
+                return new Queue(this.queueName, { connection: this.connection });
+            })();
+        }
+        return this.queuePromise;
+    }
+    setHandler(handler) {
+        this.handler = handler;
+        if (!this.workerPromise) {
+            this.workerPromise = (async () => {
+                const { Worker } = await this.getBullMQ();
+                return new Worker(this.queueName, async (job) => {
+                    if (!this.handler)
+                        throw new Error('[onesub] handler not set');
+                    await this.handler(job.data);
+                }, {
+                    connection: this.connection,
+                    concurrency: this.concurrency,
+                });
+            })();
+        }
+    }
+    async enqueue(job) {
+        const queue = await this.getQueue();
+        await queue.add('webhook', job, {
+            attempts: this.maxAttempts,
+            backoff: { type: 'exponential', delay: this.backoffMs },
+            removeOnFail: false,
+            removeOnComplete: { age: 24 * 60 * 60, count: 1000 },
+            jobId: `${job.provider}:${job.eventId}`,
+        });
+    }
+    async listDeadLetters() {
+        const queue = await this.getQueue();
+        const failed = await queue.getFailed();
+        return failed.map((j) => ({
+            id: String(j.id),
+            job: j.data,
+            attempts: j.attemptsMade,
+            lastError: j.failedReason ?? 'unknown',
+            failedAt: new Date(j.finishedOn ?? Date.now()).toISOString(),
+        }));
+    }
+    async replayDeadLetter(id) {
+        const queue = await this.getQueue();
+        const job = await queue.getJob(id);
+        if (!job)
+            throw new Error(`[onesub] dead-letter job ${id} not found`);
+        await job.retry();
+    }
+    async close() {
+        if (this.workerPromise) {
+            const worker = await this.workerPromise;
+            await worker.close();
+        }
+        if (this.queuePromise) {
+            const queue = await this.queuePromise;
+            await queue.close();
+        }
+    }
+}
+//# sourceMappingURL=webhook-queue.js.map

package/dist/webhook-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-queue.js","sourceRoot":"","sources":["../src/webhook-queue.ts"],"names":[],"mappings":"AAoDA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACxB,OAAO,GAA0B,IAAI,CAAC;IAE9C,UAAU,CAAI,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAyB,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,GAAkB;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAmED,MAAM,OAAO,kBAAkB;IACrB,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,UAAU,CAAU;IAE5B,yEAAyE;IACzE,mBAAmB;IACX,YAAY,GAAgC,IAAI,CAAC;IACjD,aAAa,GAAiC,IAAI,CAAC;IACnD,OAAO,GAA0B,IAAI,CAAC;IAE9C,YAAY,IAA+B;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,OAAO,MAAM,CAAC,QAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACxG,CAAC,CAA0B,CAAC;IAC9B,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,UAAU,CAAI,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAyB,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1C,OAAO,IAAI,MAAM,CACf,IAAI,CAAC,SAAS,EACd,KAAK,EAAE,GAAG,EAAE,EAAE;oBACZ,IAAI,CAAC,IAAI,CAAC,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAkB,CAAC,CAAC;gBAC7C,CAAC,EACD;oBACE,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,GAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE;YAC9B,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACvD,YAAY,EAAE,KAAK;YACnB,gBAAgB,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACpD,KAAK,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,GAAG,EAAE,CAAC,CAAC,IAAkB;YACzB,QAAQ,EAAE,CAAC,CAAC,YAAY;YACxB,SAAS,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;YACtC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;QACtE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACtC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,17 +1,29 @@
 {
   "name": "@onesub/server",
-  "version": "0.11.4",
+  "version": "0.12.0",
   "description": "Server-side receipt validation middleware for react-native-iap. Apple StoreKit 2 + Google Play Billing. One line.",
-  "main": "dist/index.js",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "sideEffects": false,
   "files": [
     "dist",
     "sql"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "npm run build:types && npm run build:bundle",
+    "build:types": "tsc --emitDeclarationOnly",
+    "build:bundle": "tsup",
     "dev": "tsc --watch",
+    "size": "size-limit",
     "start": "node dist/index.js"
   },
   "keywords": [
@@ -41,24 +53,41 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@onesub/shared": "0.7.4",
+    "@onesub/shared": "0.7.5",
     "jose": "^6.2.2",
     "zod": "^4.3.6"
   },
   "peerDependencies": {
+    "@opentelemetry/api": ">=1.7.0",
+    "bullmq": ">=5.0.0",
     "express": "^4.17.0 || ^5.0.0",
+    "ioredis": ">=5.0.0",
     "pg": ">=8.0.0"
   },
   "peerDependenciesMeta": {
+    "@opentelemetry/api": {
+      "optional": true
+    },
+    "bullmq": {
+      "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    },
     "pg": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@size-limit/file": "^11.1.6",
     "@types/express": "^5.0.6",
+    "@types/ioredis-mock": "^8.2.5",
     "@types/node": "^20.17.0",
     "@types/pg": "^8.20.0",
     "express": "^5.2.1",
+    "ioredis-mock": "^8.9.0",
+    "size-limit": "^11.1.6",
+    "tsup": "^8.3.5",
     "typescript": "^5.7.0"
   },
   "engines": {

package/sql/schema.sql

@@ -32,6 +32,16 @@ CREATE TABLE IF NOT EXISTS onesub_subscriptions (
 CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_user_id
   ON onesub_subscriptions (user_id, updated_at DESC);
 
+-- Filter-helper indexes for /onesub/admin/subscriptions. Each filter column
+-- is paired with updated_at DESC so the planner can serve "latest matching"
+-- without sorting the full table once row count grows.
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_status_updated
+  ON onesub_subscriptions (status, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_platform_updated
+  ON onesub_subscriptions (platform, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_product
+  ON onesub_subscriptions (product_id, updated_at DESC);
+
 -- Backfill columns for installs that already created the table from an older
 -- schema. Safe to re-run.
 ALTER TABLE onesub_subscriptions ADD COLUMN IF NOT EXISTS linked_purchase_token TEXT;