@onesub/server 0.11.4 → 0.12.1

package/dist/errors.js

@@ -1,19 +0,0 @@
-import { ONESUB_ERROR_CODE } from '@onesub/shared';
-/**
- * Send a structured error response. Every onesub HTTP endpoint uses this
- * so consumers can rely on `errorCode` being present on every 4xx/5xx body.
- *
- * `extra` lets callers inject route-specific defaults (e.g. `purchase: null`
- * for ValidatePurchaseResponse shape compatibility).
- */
-export function sendError(res, status, code, error, extra = {}) {
-    res.status(status).json({ ...extra, error, errorCode: code });
-}
-/**
- * 400 response for a failed zod parse. The ZodError's per-issue messages
- * are joined for the human-readable `error` field.
- */
-export function sendZodError(res, err, extra = {}) {
-    sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, err.issues.map((e) => e.message).join(', '), extra);
-}
-//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,GAAa,EACb,MAAc,EACd,IAAqB,EACrB,KAAa,EACb,QAAiC,EAAE;IAEnC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAa,EACb,GAAe,EACf,QAAiC,EAAE;IAEnC,SAAS,CACP,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC,aAAa,EAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAChE,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/http.js

@@ -1,36 +0,0 @@
-/**
- * Outbound HTTP helpers shared by Apple/Google providers.
- *
- * Why timeouts: Node's global fetch has no default timeout. If the upstream
- * (Apple App Store Server API, Google Play Developer API, Google OAuth) hangs,
- * webhook handlers and validate routes hang with it — Apple/Google retry on
- * their side, so a hung outbound call cascades into request pile-up here.
- */
-/** Default timeout for outbound API calls (10s). */
-export const DEFAULT_FETCH_TIMEOUT_MS = 10_000;
-/**
- * fetch with an `AbortController`-based timeout. Throws an `AbortError`-like
- * Error when the timer fires. Caller is expected to catch and decide
- * (return null, log, propagate as 5xx, etc.).
- */
-export async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
-    const controller = new AbortController();
-    // Allow caller-provided signal to compose with our timeout.
-    const callerSignal = init?.signal;
-    if (callerSignal) {
-        if (callerSignal.aborted)
-            controller.abort(callerSignal.reason);
-        else
-            callerSignal.addEventListener('abort', () => controller.abort(callerSignal.reason), { once: true });
-    }
-    const timer = setTimeout(() => {
-        controller.abort(new Error(`[onesub] fetch timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-    try {
-        return await fetch(input, { ...init, signal: controller.signal });
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAwB,EACxB,IAAkB,EAClB,SAAS,GAAG,wBAAwB;IAEpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,EAAE,MAAM,CAAC;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;;YAC3D,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,SAAS,CAAC,CAAC;IAEd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/logger.js

@@ -1,20 +0,0 @@
-/**
- * Process-wide logger used by @onesub/server's providers and routes.
- *
- * Defaults to `console`. `createOneSubMiddleware()` calls `setLogger()` once
- * during setup if `config.logger` is provided. All internal call sites should
- * import `log` from this module instead of calling `console.*` directly so
- * operators can redirect logs (pino / winston / bunyan) with a single config
- * setting.
- */
-let current = console;
-export function setLogger(logger) {
-    if (logger)
-        current = logger;
-}
-export const log = {
-    info: (...args) => current.info(...args),
-    warn: (...args) => current.warn(...args),
-    error: (...args) => current.error(...args),
-};
-//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,IAAI,OAAO,GAAiB,OAAO,CAAC;AAEpC,MAAM,UAAU,SAAS,CAAC,MAAgC;IACxD,IAAI,MAAM;QAAE,OAAO,GAAG,MAAM,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAiB;IAC/B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAC3C,CAAC"}

package/dist/providers/apple-root-ca.js

@@ -1,38 +0,0 @@
-/**
- * Apple Root CA certificates used to verify StoreKit 2 signed transactions.
- *
- * Apple signs JWS transactions with an ECDSA key; the signing certificate
- * chain is embedded in the JWS `x5c` header. To trust the leaf key we must
- * validate the chain all the way up to one of Apple's published root CAs.
- *
- * Source: https://www.apple.com/certificateauthority/
- * These certificates are public and static. Update this list if Apple
- * publishes a new root — existing JWS signed with older roots continue to
- * validate against their original root.
- */
-/**
- * Apple Root CA - G3 (current root for StoreKit 2 / App Store Server API).
- * SHA-256 fingerprint: 63343ABF B89A6A03 EB994052 C5ADBBF8 A87E2C46 81F6F0FC C8A4DA48 95F0FBBF
- * Valid: 2014-04-30 — 2039-04-30
- */
-export const APPLE_ROOT_CA_G3_PEM = `-----BEGIN CERTIFICATE-----
-MIICQzCCAcmgAwIBAgIILcX8iNLFS5UwCgYIKoZIzj0EAwMwZzEbMBkGA1UEAwwS
-QXBwbGUgUm9vdCBDQSAtIEczMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9u
-IEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcN
-MTQwNDMwMTgxOTA2WhcNMzkwNDMwMTgxOTA2WjBnMRswGQYDVQQDDBJBcHBsZSBS
-b290IENBIC0gRzMxJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5MRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzB2MBAGByqGSM49
-AgEGBSuBBAAiA2IABJjpLz1AcqTtkyJygRMc3RCV8cWjTnHcFBbZDuWmBSp3ZHtf
-TjjTuxxEtX/1H7YyYl3J6YRbTzBPEVoA/VhYDKX1DyxNB0cTddqXl5dvMVztK517
-IDvYuVTZXpmkOlEKMaNCMEAwHQYDVR0OBBYEFLuw3qFYM4iapIqZ3r6966/ayySr
-MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gA
-MGUCMQCD6cHEFl4aXTQY2e3v9GwOAEZLuN+yRhHFD/3meoyhpmvOwgPUnPWTxnS4
-at+qIxUCMG1mihDK1A3UT82NQz60imOlM27jbdoXt2QfyFMm+YhidDkLF1vLUagM
-6BgD56KyKA==
------END CERTIFICATE-----`;
-/**
- * All Apple root CAs accepted for StoreKit 2 JWS validation.
- * Currently only G3; add G4 here when Apple publishes it.
- */
-export const APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
-//# sourceMappingURL=apple-root-ca.js.map

package/dist/providers/apple-root-ca.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"apple-root-ca.js","sourceRoot":"","sources":["../../src/providers/apple-root-ca.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;0BAcV,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/providers/apple.js

@@ -1,499 +0,0 @@
-import { decodeJwt, decodeProtectedHeader, importPKCS8, importX509, jwtVerify, SignJWT } from 'jose';
-import { X509Certificate } from 'node:crypto';
-import { SUBSCRIPTION_STATUS } from '@onesub/shared';
-import { APPLE_ROOT_CA_PEMS } from './apple-root-ca.js';
-import { log } from '../logger.js';
-import { fetchWithTimeout } from '../http.js';
-import { mockValidateAppleSubscription, mockValidateAppleProduct, } from './mock.js';
-/** Maximum age for consumable receipts (72 hours). Older receipts may indicate replay attacks. */
-const MAX_CONSUMABLE_RECEIPT_AGE_MS = 72 * 60 * 60 * 1000;
-function derBase64ToPem(der) {
-    return ('-----BEGIN CERTIFICATE-----\n' +
-        (der.match(/.{1,64}/g) ?? []).join('\n') +
-        '\n-----END CERTIFICATE-----');
-}
-const APPLE_ROOT_CERTS = APPLE_ROOT_CA_PEMS.map((pem) => new X509Certificate(pem));
-/**
- * Validate that the x5c chain from the JWS terminates at one of Apple's
- * bundled root CAs. Each cert in the chain must be signed by the next (or
- * the bundled root), and all certs must currently be within their validity
- * window.
- *
- * Returns the leaf certificate PEM on success. Throws on any failure.
- */
-function verifyAppleCertChain(x5c) {
-    if (x5c.length === 0) {
-        throw new Error('[onesub/apple] empty x5c');
-    }
-    const chain = x5c.map((der) => new X509Certificate(derBase64ToPem(der)));
-    const now = new Date();
-    // Validity window + leaf→intermediate→... signature chain
-    for (let i = 0; i < chain.length; i++) {
-        const cert = chain[i];
-        if (new Date(cert.validFrom) > now || new Date(cert.validTo) < now) {
-            throw new Error(`[onesub/apple] cert[${i}] outside validity window`);
-        }
-        if (i + 1 < chain.length) {
-            if (!cert.checkIssued(chain[i + 1]) || !cert.verify(chain[i + 1].publicKey)) {
-                throw new Error(`[onesub/apple] cert[${i}] not signed by cert[${i + 1}]`);
-            }
-        }
-    }
-    // Final cert in chain (typically intermediate) must be signed by an Apple root.
-    // Accept either (a) explicit signature match or (b) the cert itself being one
-    // of our bundled Apple roots (happens when Apple embeds the full chain).
-    const top = chain[chain.length - 1];
-    const topDer = top.raw.toString('base64');
-    const trustsRoot = APPLE_ROOT_CERTS.some((root) => {
-        if (root.raw.toString('base64') === topDer)
-            return true;
-        if (!top.checkIssued(root))
-            return false;
-        try {
-            return top.verify(root.publicKey);
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!trustsRoot) {
-        throw new Error('[onesub/apple] cert chain does not terminate at a trusted Apple root');
-    }
-    return chain[0].toString();
-}
-/**
- * Decode and verify a StoreKit 2 signed transaction JWS.
- *
- * 1. Extract the x5c certificate chain from the JWS header.
- * 2. Validate the chain terminates at a bundled Apple Root CA (G3).
- * 3. Use the leaf certificate's public key to verify the JWS signature.
- *
- * skipVerification=true skips all of the above and just decodes the payload
- * (dev/test only).
- */
-export async function decodeJws(jws, skipVerification = false) {
-    if (skipVerification) {
-        if (process.env['NODE_ENV'] === 'production') {
-            log.warn('[onesub/apple] WARNING: skipJwsVerification is enabled in production. ' +
-                'JWS signatures are NOT being verified. This is a security risk.');
-        }
-        return decodeJwt(jws);
-    }
-    const header = decodeProtectedHeader(jws);
-    const x5c = header.x5c;
-    if (!x5c || x5c.length === 0) {
-        throw new Error('[onesub/apple] JWS header missing x5c certificate chain');
-    }
-    const leafPem = verifyAppleCertChain(x5c);
-    const alg = header.alg ?? 'ES256';
-    const key = await importX509(leafPem, alg);
-    const { payload } = await jwtVerify(jws, key);
-    return payload;
-}
-/**
- * Derive a SubscriptionStatus from the transaction + renewal payloads.
- */
-function deriveStatus(tx, renewal) {
-    if (tx.revocationDate)
-        return SUBSCRIPTION_STATUS.CANCELED;
-    const now = Date.now();
-    const expires = tx.expiresDate ?? 0;
-    if (expires > now)
-        return SUBSCRIPTION_STATUS.ACTIVE;
-    // Expired — check if it was voluntarily canceled
-    if (renewal?.autoRenewStatus === 0)
-        return SUBSCRIPTION_STATUS.CANCELED;
-    return SUBSCRIPTION_STATUS.EXPIRED;
-}
-/**
- * Validate an Apple receipt string.
- *
- * StoreKit 2 receipts are JWS-encoded signed transactions (the `signedTransaction`
- * field from the client). For legacy base64 receipts from StoreKit 1, you would
- * POST to verifyReceipt — that path is left as a stub here because Apple is
- * deprecating it.
- */
-export async function validateAppleReceipt(receipt, config) {
-    if (config.mockMode)
-        return mockValidateAppleSubscription(receipt);
-    let tx;
-    try {
-        tx = await decodeJws(receipt, config.skipJwsVerification);
-    }
-    catch (err) {
-        const preview = receipt.slice(0, 60);
-        const parts = receipt.split('.').length;
-        log.warn('[onesub/apple] Failed to decode receipt as JWS:', err?.message ?? err, `| preview: "${preview}..." (len=${receipt.length}, parts=${parts})`);
-        return null;
-    }
-    if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
-        return null;
-    }
-    // Validate bundle ID — missing or mismatched both rejected
-    if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-        log.warn('[onesub/apple] Bundle ID mismatch:', tx.bundleId, '!==', config.bundleId);
-        return null;
-    }
-    // Reject Sandbox receipts in production unless explicitly allowed.
-    // Set ONESUB_ALLOW_SANDBOX=true to permit TestFlight sandbox receipts on
-    // production servers (useful during QA before App Store release).
-    if (process.env['NODE_ENV'] === 'production' &&
-        tx.environment !== 'Production' &&
-        process.env['ONESUB_ALLOW_SANDBOX'] !== 'true') {
-        log.warn('[onesub/apple] Sandbox receipt rejected in production:', tx.environment);
-        return null;
-    }
-    const status = deriveStatus(tx, null);
-    const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
-    return {
-        userId: '', // caller fills this in from the request body
-        productId: tx.productId,
-        platform: 'apple',
-        status,
-        expiresAt: new Date(tx.expiresDate).toISOString(),
-        originalTransactionId: tx.originalTransactionId,
-        purchasedAt: new Date(purchasedAt).toISOString(),
-        willRenew: status === SUBSCRIPTION_STATUS.ACTIVE, // refined by renewal info in webhook
-    };
-}
-/**
- * Validate an Apple StoreKit 2 JWS signedTransaction for a consumable or
- * non-consumable product.
- *
- * Differences from validateAppleReceipt (subscriptions):
- * - Checks tx.type is 'Consumable' or 'Non-Consumable' (not a subscription)
- * - Uses tx.transactionId (per-purchase unique) instead of originalTransactionId
- * - Enforces a 72-hour receipt age limit to block replay attacks
- * - Does NOT check expiresDate (one-time purchases don't expire)
- */
-export async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
-    if (config.mockMode)
-        return mockValidateAppleProduct(signedTransaction, expectedProductId);
-    let tx;
-    try {
-        tx = await decodeJws(signedTransaction, config.skipJwsVerification);
-    }
-    catch (err) {
-        const preview = signedTransaction.slice(0, 60);
-        const parts = signedTransaction.split('.').length;
-        const looksLikeJws = parts === 3;
-        log.warn('[onesub/apple] Failed to decode consumable JWS:', err?.message ?? err, `| receipt preview: "${preview}..." (len=${signedTransaction.length}, parts=${parts}, looksLikeJws=${looksLikeJws})`);
-        return null;
-    }
-    // bundleId must be present and match
-    if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-        log.warn('[onesub/apple] Bundle ID mismatch:', tx.bundleId, '!==', config.bundleId);
-        return null;
-    }
-    // Must be a one-time purchase type (not a subscription)
-    if (tx.type !== 'Consumable' && tx.type !== 'Non-Consumable') {
-        log.warn('[onesub/apple] Invalid purchase type for product validation:', tx.type);
-        return null;
-    }
-    // Reject Sandbox receipts in production unless explicitly allowed.
-    // Set ONESUB_ALLOW_SANDBOX=true to permit TestFlight sandbox receipts on
-    // production servers (useful during QA before App Store release).
-    if (process.env['NODE_ENV'] === 'production' &&
-        tx.environment !== 'Production' &&
-        process.env['ONESUB_ALLOW_SANDBOX'] !== 'true') {
-        log.warn('[onesub/apple] Sandbox receipt rejected in production:', tx.environment);
-        return null;
-    }
-    if (!tx.productId) {
-        log.warn('[onesub/apple] No productId in transaction');
-        return null;
-    }
-    if (expectedProductId && tx.productId !== expectedProductId) {
-        log.warn('[onesub/apple] Product ID mismatch:', tx.productId, '!==', expectedProductId);
-        return null;
-    }
-    // Reject refunded purchases
-    if (tx.revocationDate) {
-        log.warn('[onesub/apple] Purchase was revoked/refunded');
-        return null;
-    }
-    // Reject receipts older than 72 hours (replay attack prevention)
-    if (tx.purchaseDate && Date.now() - tx.purchaseDate > MAX_CONSUMABLE_RECEIPT_AGE_MS) {
-        log.warn('[onesub/apple] Consumable receipt too old (>72h)');
-        return null;
-    }
-    // For consumables, transactionId is per-purchase unique.
-    // originalTransactionId is shared across re-purchases, so it must not be used
-    // as the deduplication key for consumables.
-    const transactionId = tx.transactionId ?? tx.originalTransactionId;
-    if (!transactionId) {
-        log.warn('[onesub/apple] No transactionId in consumable transaction');
-        return null;
-    }
-    return {
-        transactionId,
-        productId: tx.productId,
-        purchasedAt: tx.purchaseDate
-            ? new Date(tx.purchaseDate).toISOString()
-            : new Date().toISOString(),
-    };
-}
-/**
- * Decode an Apple Server Notification V2 payload.
- * Returns the derived subscription update to be merged into the store.
- */
-export async function decodeAppleNotification(payload, skipJwsVerification = false) {
-    const { signedTransactionInfo, signedRenewalInfo } = payload.data;
-    let tx;
-    let renewal = null;
-    try {
-        tx = await decodeJws(signedTransactionInfo, skipJwsVerification);
-    }
-    catch {
-        return null;
-    }
-    try {
-        renewal = await decodeJws(signedRenewalInfo, skipJwsVerification);
-    }
-    catch {
-        // renewal info is optional for some notification types
-    }
-    // expiresDate is only required for subscription notifications.
-    // Consumable / non-consumable refund notifications (REFUND for IAP) have no expiry.
-    if (!tx.originalTransactionId)
-        return null;
-    const status = deriveStatus(tx, renewal);
-    const willRenew = renewal?.autoRenewStatus === 1;
-    // environment is on the notification data envelope but Apple also includes
-    // it inside the signed transaction payload. Prefer the JWS-protected one.
-    const txEnv = tx.environment;
-    const dataEnv = payload.data.environment;
-    const environment = txEnv === 'Sandbox' || dataEnv === 'Sandbox' ? 'Sandbox' : 'Production';
-    return {
-        originalTransactionId: tx.originalTransactionId,
-        transactionId: tx.transactionId ?? null,
-        type: tx.type ?? null,
-        productId: tx.productId ?? null,
-        bundleId: tx.bundleId ?? payload.data.bundleId ?? null,
-        environment,
-        status,
-        willRenew,
-        expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
-    };
-}
-// ───────────────────────────────────────────────────────────────────────────
-// App Store Server API — outbound calls (consumption response, etc.)
-// ───────────────────────────────────────────────────────────────────────────
-/**
- * Module-level JWT cache for the App Store Server API. Apple caps token TTL
- * at 20 minutes; we mint with that TTL and re-use until 60 seconds before
- * expiry (so long-running webhook bursts don't pay the ECDSA-sign cost on
- * every request). Promise dedup prevents thundering-herd JWT mints when many
- * concurrent callers race the cache miss.
- *
- * Keyed by `${issuerId}|${keyId}` since rotating either invalidates the JWT.
- */
-let cachedAppleJwt = null;
-let appleJwtMintPromise = null;
-const APPLE_JWT_TTL_MS = 20 * 60 * 1000;
-const APPLE_JWT_REFRESH_BEFORE_MS = 60 * 1000;
-/**
- * Mint a JWT for the App Store Server API (audience `appstoreconnect-v1`).
- * Requires keyId, issuerId, and privateKey (PKCS8 ES256 from App Store Connect).
- * Token TTL is capped at 20 minutes per Apple's spec.
- */
-async function makeAppleApiJwt(config) {
-    const { issuerId, keyId, privateKey, bundleId } = config;
-    if (!issuerId || !keyId || !privateKey) {
-        throw new Error('[onesub/apple] App Store Server API requires issuerId, keyId, and privateKey');
-    }
-    const cacheKey = `${issuerId}|${keyId}`;
-    const now = Date.now();
-    if (cachedAppleJwt &&
-        cachedAppleJwt.key === cacheKey &&
-        cachedAppleJwt.expiresAt - now > APPLE_JWT_REFRESH_BEFORE_MS) {
-        return cachedAppleJwt.token;
-    }
-    if (!appleJwtMintPromise) {
-        appleJwtMintPromise = (async () => {
-            const key = await importPKCS8(privateKey, 'ES256');
-            const issuedAt = Math.floor(Date.now() / 1000);
-            const token = await new SignJWT({ bid: bundleId })
-                .setProtectedHeader({ alg: 'ES256', kid: keyId, typ: 'JWT' })
-                .setIssuer(issuerId)
-                .setAudience('appstoreconnect-v1')
-                .setIssuedAt(issuedAt)
-                .setExpirationTime(issuedAt + Math.floor(APPLE_JWT_TTL_MS / 1000))
-                .sign(key);
-            cachedAppleJwt = { token, expiresAt: Date.now() + APPLE_JWT_TTL_MS, key: cacheKey };
-            return token;
-        })().finally(() => {
-            appleJwtMintPromise = null;
-        });
-    }
-    return appleJwtMintPromise;
-}
-/** Test-only: clear the module-level Apple JWT cache. Not exported. */
-function clearAppleJwtCacheForTests() {
-    cachedAppleJwt = null;
-    appleJwtMintPromise = null;
-}
-// Expose for the test suite without polluting the public API surface.
-export const __testing = { clearAppleJwtCacheForTests };
-/**
- * PUT a ConsumptionRequest to Apple's
- * /inApps/v1/transactions/consumption/{transactionId} endpoint.
- *
- * Apple sends CONSUMPTION_REQUEST notifications when a customer asks for a
- * refund on a consumable. Without a response Apple has no usage signal and
- * tends to grant the refund. This call provides the data Apple uses to weigh
- * the refund decision.
- *
- * Fire-and-forget: failures are logged, never thrown — the webhook should
- * still 200 to Apple even if our outbound call fails.
- */
-export async function sendAppleConsumptionResponse(transactionId, body, config, options) {
-    if (config.mockMode)
-        return;
-    let jwt;
-    try {
-        jwt = await makeAppleApiJwt(config);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Cannot send consumption response — JWT mint failed:', err);
-        return;
-    }
-    const host = options?.sandbox
-        ? 'api.storekit-sandbox.itunes.apple.com'
-        : 'api.storekit.itunes.apple.com';
-    const url = `https://${host}/inApps/v1/transactions/consumption/${encodeURIComponent(transactionId)}`;
-    try {
-        const resp = await fetchWithTimeout(url, {
-            method: 'PUT',
-            headers: {
-                Authorization: `Bearer ${jwt}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(body),
-        });
-        if (!resp.ok) {
-            const text = await resp.text();
-            log.warn(`[onesub/apple] Consumption response API error ${resp.status}: ${text}`);
-        }
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Consumption response network error:', err);
-    }
-}
-/**
- * Apple's status code in the GET /inApps/v1/subscriptions/{originalTxId} response.
- * https://developer.apple.com/documentation/appstoreserverapi/status
- */
-const APPLE_SUBSCRIPTION_STATUS_CODE = {
-    ACTIVE: 1,
-    EXPIRED: 2,
-    BILLING_RETRY: 3,
-    GRACE_PERIOD: 4,
-    REVOKED: 5,
-};
-function mapAppleStatusCode(code) {
-    switch (code) {
-        case APPLE_SUBSCRIPTION_STATUS_CODE.ACTIVE:
-            return SUBSCRIPTION_STATUS.ACTIVE;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.GRACE_PERIOD:
-            return SUBSCRIPTION_STATUS.GRACE_PERIOD;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.BILLING_RETRY:
-            return SUBSCRIPTION_STATUS.ON_HOLD;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.REVOKED:
-            return SUBSCRIPTION_STATUS.CANCELED;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.EXPIRED:
-        default:
-            return SUBSCRIPTION_STATUS.EXPIRED;
-    }
-}
-/**
- * Fetch the current state of a subscription directly from Apple's App Store
- * Server API — the canonical source of truth when webhooks have been missed,
- * delivered out of order, or the local store has no record at all.
- *
- * GET /inApps/v1/subscriptions/{originalTransactionId}
- * https://developer.apple.com/documentation/appstoreserverapi/get_all_subscription_statuses
- *
- * Returns null on:
- *   - Missing API credentials (issuerId/keyId/privateKey)
- *   - Network or auth failure
- *   - Empty response (transaction not found)
- *
- * Hosts can call this directly (e.g. from a reconciliation cron) or it runs
- * automatically as the unknown-transaction fallback inside the Apple webhook.
- */
-export async function fetchAppleSubscriptionStatus(originalTransactionId, config, options) {
-    if (config.mockMode)
-        return null;
-    let jwt;
-    try {
-        jwt = await makeAppleApiJwt(config);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Cannot fetch subscription status — JWT mint failed:', err);
-        return null;
-    }
-    const host = options?.sandbox
-        ? 'api.storekit-sandbox.itunes.apple.com'
-        : 'api.storekit.itunes.apple.com';
-    const url = `https://${host}/inApps/v1/subscriptions/${encodeURIComponent(originalTransactionId)}`;
-    let body;
-    try {
-        const resp = await fetchWithTimeout(url, {
-            headers: { Authorization: `Bearer ${jwt}` },
-        });
-        if (!resp.ok) {
-            const text = await resp.text();
-            log.warn(`[onesub/apple] Status API error ${resp.status}: ${text}`);
-            return null;
-        }
-        body = (await resp.json());
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Status API network error:', err);
-        return null;
-    }
-    // Find the lastTransactions entry matching the requested originalTransactionId.
-    // Apple groups by subscriptionGroupIdentifier; one originalTxId is in exactly one group.
-    const entry = body.data
-        ?.flatMap((g) => g.lastTransactions ?? [])
-        .find((t) => t.originalTransactionId === originalTransactionId);
-    if (!entry || entry.status == null || !entry.signedTransactionInfo) {
-        log.warn('[onesub/apple] Status API returned no matching transaction for', originalTransactionId);
-        return null;
-    }
-    let tx;
-    try {
-        tx = await decodeJws(entry.signedTransactionInfo, config.skipJwsVerification);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Failed to decode signedTransactionInfo from Status API:', err);
-        return null;
-    }
-    let renewal = null;
-    if (entry.signedRenewalInfo) {
-        try {
-            renewal = await decodeJws(entry.signedRenewalInfo, config.skipJwsVerification);
-        }
-        catch {
-            // renewal info is optional
-        }
-    }
-    if (!tx.productId || !tx.expiresDate) {
-        log.warn('[onesub/apple] Status API transaction missing productId or expiresDate');
-        return null;
-    }
-    const status = mapAppleStatusCode(entry.status);
-    const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
-    return {
-        userId: '', // caller fills this in
-        productId: tx.productId,
-        platform: 'apple',
-        status,
-        expiresAt: new Date(tx.expiresDate).toISOString(),
-        originalTransactionId,
-        purchasedAt: new Date(purchasedAt).toISOString(),
-        willRenew: renewal?.autoRenewStatus === 1,
-    };
-}
-//# sourceMappingURL=apple.js.map

package/dist/providers/apple.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"apple.js","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,WAAW,CAAC;AAInB,kGAAkG;AAClG,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgC1D,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,CACL,+BAA+B;QAC/B,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,6BAA6B,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,GAAa;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0DAA0D;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,CAAC;YAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,GAAW,EAAE,gBAAgB,GAAG,KAAK;IACtE,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CACN,wEAAwE;gBACtE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAM,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAqC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,OAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,EAA2B,EAC3B,OAAmC;IAEnC,IAAI,EAAE,CAAC,cAAc;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC;IAEpC,IAAI,OAAO,GAAG,GAAG;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC;IAErD,iDAAiD;IACjD,IAAI,OAAO,EAAE,eAAe,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IAExE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,MAAmB;IAEnB,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,EAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAA0B,OAAO,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,GAAG,CAAC,IAAI,CACN,iDAAiD,EAChD,GAAa,EAAE,OAAO,IAAI,GAAG,EAC9B,eAAe,OAAO,aAAa,OAAO,CAAC,MAAM,WAAW,KAAK,GAAG,CACrE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,kEAAkE;IAClE,IACE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QACxC,EAAE,CAAC,WAAW,KAAK,YAAY;QAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,MAAM,EAC9C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7E,OAAO;QACL,MAAM,EAAE,EAAE,EAAG,6CAA6C;QAC1D,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QACjD,qBAAqB,EAAE,EAAE,CAAC,qBAAqB;QAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QAChD,SAAS,EAAE,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,qCAAqC;KACxF,CAAC;AACJ,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,iBAAyB,EACzB,MAAmB,EACnB,iBAA0B;IAE1B,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,wBAAwB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC3F,IAAI,EAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAA0B,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,KAAK,CAAC,CAAC;QACjC,GAAG,CAAC,IAAI,CACN,iDAAiD,EAChD,GAAa,EAAE,OAAO,IAAI,GAAG,EAC9B,uBAAuB,OAAO,aAAa,iBAAiB,CAAC,MAAM,WAAW,KAAK,kBAAkB,YAAY,GAAG,CACrH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,kEAAkE;IAClE,IACE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QACxC,EAAE,CAAC,WAAW,KAAK,YAAY;QAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,MAAM,EAC9C,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,IAAI,EAAE,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4BAA4B;IAC5B,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iEAAiE;IACjE,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,GAAG,6BAA6B,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,aAAa,GAAG,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,qBAAqB,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,aAAa;QACb,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,WAAW,EAAE,EAAE,CAAC,YAAY;YAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;YACzC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiC,EACjC,mBAAmB,GAAG,KAAK;IAgB3B,MAAM,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAElE,IAAI,EAA2B,CAAC;IAChC,IAAI,OAAO,GAA+B,IAAI,CAAC;IAE/C,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAA0B,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAsB,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,+DAA+D;IAC/D,oFAAoF;IACpF,IAAI,CAAC,EAAE,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,EAAE,eAAe,KAAK,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,KAAK,GAAI,EAA+B,CAAC,WAAW,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;IACzC,MAAM,WAAW,GACf,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAE1E,OAAO;QACL,qBAAqB,EAAE,EAAE,CAAC,qBAAqB;QAC/C,aAAa,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI;QACvC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI;QACrB,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,IAAI;QAC/B,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI;QACtD,WAAW;QACX,MAAM;QACN,SAAS;QACT,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,IAAI,cAAc,GAA6D,IAAI,CAAC;AACpF,IAAI,mBAAmB,GAA2B,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,MAAmB;IAChD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IACE,cAAc;QACd,cAAc,CAAC,GAAG,KAAK,QAAQ;QAC/B,cAAc,CAAC,SAAS,GAAG,GAAG,GAAG,2BAA2B,EAC5D,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;iBAC/C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;iBAC5D,SAAS,CAAC,QAAQ,CAAC;iBACnB,WAAW,CAAC,oBAAoB,CAAC;iBACjC,WAAW,CAAC,QAAQ,CAAC;iBACrB,iBAAiB,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;iBACjE,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,cAAc,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,uEAAuE;AACvE,SAAS,0BAA0B;IACjC,cAAc,GAAG,IAAI,CAAC;IACtB,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AACD,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,0BAA0B,EAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,IAA6B,EAC7B,MAAmB,EACnB,OAA+B;IAE/B,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO;IAE5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,OAAO;QAC3B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,+BAA+B,CAAC;IACpC,MAAM,GAAG,GAAG,WAAW,IAAI,uCAAuC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;IAEtG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,iDAAiD,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,8BAA8B,GAAG;IACrC,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,YAAY,EAAE,CAAC;IACf,OAAO,EAAE,CAAC;CACF,CAAC;AAEX,SAAS,kBAAkB,CAAC,IAAY;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,8BAA8B,CAAC,MAAM;YACxC,OAAO,mBAAmB,CAAC,MAAM,CAAC;QACpC,KAAK,8BAA8B,CAAC,YAAY;YAC9C,OAAO,mBAAmB,CAAC,YAAY,CAAC;QAC1C,KAAK,8BAA8B,CAAC,aAAa;YAC/C,OAAO,mBAAmB,CAAC,OAAO,CAAC;QACrC,KAAK,8BAA8B,CAAC,OAAO;YACzC,OAAO,mBAAmB,CAAC,QAAQ,CAAC;QACtC,KAAK,8BAA8B,CAAC,OAAO,CAAC;QAC5C;YACE,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACvC,CAAC;AACH,CAAC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,qBAA6B,EAC7B,MAAmB,EACnB,OAA+B;IAE/B,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEjC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,OAAO;QAC3B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,+BAA+B,CAAC;IACpC,MAAM,GAAG,GAAG,WAAW,IAAI,4BAA4B,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC;IAEnG,IAAI,IAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAChF,yFAAyF;IACzF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI;QACrB,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,CAAC;IAElE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,gEAAgE,EAAE,qBAAqB,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,EAA2B,CAAC;IAChC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAA0B,KAAK,CAAC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,wEAAwE,EAAE,GAAG,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,SAAS,CAAsB,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7E,OAAO;QACL,MAAM,EAAE,EAAE,EAAG,uBAAuB;QACpC,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QACjD,qBAAqB;QACrB,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QAChD,SAAS,EAAE,OAAO,EAAE,eAAe,KAAK,CAAC;KAC1C,CAAC;AACJ,CAAC"}