@onesub/server 0.11.4 → 0.12.1

package/dist/index.cjs

@@ -0,0 +1,3084 @@
+'use strict';
+
+var express = require('express');
+var shared = require('@onesub/shared');
+var zod = require('zod');
+var jose = require('jose');
+var crypto = require('crypto');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var express__default = /*#__PURE__*/_interopDefault(express);
+
+// src/index.ts
+
+// src/store.ts
+var InMemorySubscriptionStore = class {
+  // Multiple records per user (different originalTransactionIds) — required
+  // for entitlement evaluation across multiple productIds. Ordering is
+  // last-written-first so getByUserId returns "most recent" naturally.
+  byUserId = /* @__PURE__ */ new Map();
+  byTransactionId = /* @__PURE__ */ new Map();
+  async save(sub) {
+    this.byTransactionId.set(sub.originalTransactionId, sub);
+    const existing = this.byUserId.get(sub.userId) ?? [];
+    const filtered = existing.filter((s) => s.originalTransactionId !== sub.originalTransactionId);
+    filtered.unshift(sub);
+    this.byUserId.set(sub.userId, filtered);
+  }
+  async getByUserId(userId) {
+    const list = this.byUserId.get(userId);
+    return list?.[0] ?? null;
+  }
+  async getAllByUserId(userId) {
+    return [...this.byUserId.get(userId) ?? []];
+  }
+  async getByTransactionId(txId) {
+    return this.byTransactionId.get(txId) ?? null;
+  }
+  async listAll() {
+    return [...this.byTransactionId.values()];
+  }
+  async listFiltered(opts) {
+    const limit = opts.limit ?? 50;
+    const offset = opts.offset ?? 0;
+    const all = [];
+    for (const list of this.byUserId.values()) {
+      for (const s of list) all.push(s);
+    }
+    const filtered = all.filter((s) => {
+      if (opts.userId && s.userId !== opts.userId) return false;
+      if (opts.status && s.status !== opts.status) return false;
+      if (opts.productId && s.productId !== opts.productId) return false;
+      if (opts.platform && s.platform !== opts.platform) return false;
+      return true;
+    });
+    return {
+      items: filtered.slice(offset, offset + limit),
+      total: filtered.length,
+      limit,
+      offset
+    };
+  }
+};
+var InMemoryPurchaseStore = class {
+  byTransactionId = /* @__PURE__ */ new Map();
+  byUserId = /* @__PURE__ */ new Map();
+  async savePurchase(purchase) {
+    const existing = this.byTransactionId.get(purchase.transactionId);
+    if (existing) {
+      if (existing.userId !== purchase.userId) {
+        const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
+        err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
+        throw err;
+      }
+      return;
+    }
+    this.byTransactionId.set(purchase.transactionId, purchase);
+    const list = this.byUserId.get(purchase.userId) ?? [];
+    list.push(purchase);
+    this.byUserId.set(purchase.userId, list);
+  }
+  async getPurchasesByUserId(userId) {
+    return this.byUserId.get(userId) ?? [];
+  }
+  async getPurchaseByTransactionId(txId) {
+    return this.byTransactionId.get(txId) ?? null;
+  }
+  async hasPurchased(userId, productId) {
+    const purchases = this.byUserId.get(userId);
+    if (!purchases) return false;
+    return purchases.some((p) => p.productId === productId);
+  }
+  async reassignPurchase(transactionId, newUserId) {
+    const existing = this.byTransactionId.get(transactionId);
+    if (!existing) return false;
+    const oldUserId = existing.userId;
+    if (oldUserId === newUserId) return true;
+    const updated = { ...existing, userId: newUserId };
+    this.byTransactionId.set(transactionId, updated);
+    const oldList = (this.byUserId.get(oldUserId) ?? []).filter((p) => p.transactionId !== transactionId);
+    if (oldList.length) this.byUserId.set(oldUserId, oldList);
+    else this.byUserId.delete(oldUserId);
+    const newList = this.byUserId.get(newUserId) ?? [];
+    newList.push(updated);
+    this.byUserId.set(newUserId, newList);
+    return true;
+  }
+  async deletePurchases(userId, productId) {
+    const list = this.byUserId.get(userId) ?? [];
+    const kept = list.filter((p) => p.productId !== productId);
+    const deleted = list.length - kept.length;
+    this.byUserId.set(userId, kept);
+    for (const p of list) {
+      if (p.productId === productId) this.byTransactionId.delete(p.transactionId);
+    }
+    return deleted;
+  }
+  async listAll() {
+    return [...this.byTransactionId.values()];
+  }
+  async deletePurchaseByTransactionId(transactionId) {
+    const existing = this.byTransactionId.get(transactionId);
+    if (!existing) return false;
+    this.byTransactionId.delete(transactionId);
+    const list = (this.byUserId.get(existing.userId) ?? []).filter(
+      (p) => p.transactionId !== transactionId
+    );
+    if (list.length) this.byUserId.set(existing.userId, list);
+    else this.byUserId.delete(existing.userId);
+    return true;
+  }
+};
+
+// src/providers/apple-root-ca.ts
+var APPLE_ROOT_CA_G3_PEM = `-----BEGIN CERTIFICATE-----
+MIICQzCCAcmgAwIBAgIILcX8iNLFS5UwCgYIKoZIzj0EAwMwZzEbMBkGA1UEAwwS
+QXBwbGUgUm9vdCBDQSAtIEczMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9u
+IEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcN
+MTQwNDMwMTgxOTA2WhcNMzkwNDMwMTgxOTA2WjBnMRswGQYDVQQDDBJBcHBsZSBS
+b290IENBIC0gRzMxJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9y
+aXR5MRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABJjpLz1AcqTtkyJygRMc3RCV8cWjTnHcFBbZDuWmBSp3ZHtf
+TjjTuxxEtX/1H7YyYl3J6YRbTzBPEVoA/VhYDKX1DyxNB0cTddqXl5dvMVztK517
+IDvYuVTZXpmkOlEKMaNCMEAwHQYDVR0OBBYEFLuw3qFYM4iapIqZ3r6966/ayySr
+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gA
+MGUCMQCD6cHEFl4aXTQY2e3v9GwOAEZLuN+yRhHFD/3meoyhpmvOwgPUnPWTxnS4
+at+qIxUCMG1mihDK1A3UT82NQz60imOlM27jbdoXt2QfyFMm+YhidDkLF1vLUagM
+6BgD56KyKA==
+-----END CERTIFICATE-----`;
+var APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
+
+// src/logger.ts
+var current = console;
+function setLogger(logger) {
+  if (logger) current = logger;
+}
+var log = {
+  info: (...args) => current.info(...args),
+  warn: (...args) => current.warn(...args),
+  error: (...args) => current.error(...args)
+};
+
+// src/http.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const callerSignal = init?.signal;
+  if (callerSignal) {
+    if (callerSignal.aborted) controller.abort(callerSignal.reason);
+    else callerSignal.addEventListener("abort", () => controller.abort(callerSignal.reason), { once: true });
+  }
+  const timer = setTimeout(() => {
+    controller.abort(new Error(`[onesub] fetch timed out after ${timeoutMs}ms`));
+  }, timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/cache.ts
+var InMemoryCacheAdapter = class {
+  entries = /* @__PURE__ */ new Map();
+  async get(key) {
+    const entry = this.entries.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt !== 0 && entry.expiresAt < Date.now()) {
+      this.entries.delete(key);
+      return null;
+    }
+    return entry.value;
+  }
+  async set(key, value, ttlSeconds) {
+    const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1e3 : 0;
+    this.entries.set(key, { value, expiresAt });
+  }
+  async del(key) {
+    this.entries.delete(key);
+  }
+  /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
+  clear() {
+    this.entries.clear();
+  }
+};
+var defaultAdapter = new InMemoryCacheAdapter();
+function getDefaultCache() {
+  return defaultAdapter;
+}
+function setDefaultCache(adapter) {
+  defaultAdapter = adapter;
+}
+function classifyMockReceipt(receipt) {
+  if (receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.NETWORK_ERROR)) return { kind: "network-error" };
+  if (receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.REVOKED)) return { kind: "revoked" };
+  if (receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.EXPIRED)) return { kind: "expired" };
+  if (receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.INVALID) || receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.BAD_SIG)) {
+    return { kind: "invalid" };
+  }
+  if (receipt.startsWith(shared.MOCK_RECEIPT_PREFIX.SANDBOX)) return { kind: "sandbox" };
+  return { kind: "valid" };
+}
+function outcomePasses(outcome, tag) {
+  if (outcome.kind === "network-error") {
+    throw new Error(`[onesub/mock/${tag}] simulated upstream network error`);
+  }
+  if (outcome.kind === "valid" || outcome.kind === "sandbox") return true;
+  log.warn(`[onesub/mock/${tag}] receipt rejected`, { outcome: outcome.kind });
+  return false;
+}
+function deterministicTransactionId(prefix, receipt) {
+  const digest = crypto.createHash("sha256").update(receipt).digest("hex").slice(0, 24);
+  return `${prefix}_${digest}`;
+}
+var HOURS = 60 * 60 * 1e3;
+var DAYS = 24 * HOURS;
+function mockValidateAppleSubscription(receipt) {
+  const outcome = classifyMockReceipt(receipt);
+  if (!outcomePasses(outcome, "apple")) return null;
+  const now = Date.now();
+  const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  return {
+    userId: "",
+    productId: "mock_subscription",
+    platform: "apple",
+    status: shared.SUBSCRIPTION_STATUS.ACTIVE,
+    expiresAt: new Date(expiresAt).toISOString(),
+    originalTransactionId: deterministicTransactionId("mock_apple_orig", receipt),
+    purchasedAt: new Date(now).toISOString(),
+    willRenew: true
+  };
+}
+function mockValidateAppleProduct(receipt, expectedProductId) {
+  const outcome = classifyMockReceipt(receipt);
+  if (!outcomePasses(outcome, "apple")) return null;
+  const productId = expectedProductId ?? "mock_product";
+  return {
+    transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
+    productId,
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function mockValidateGoogleSubscription(receipt, productId) {
+  const outcome = classifyMockReceipt(receipt);
+  if (!outcomePasses(outcome, "google")) return null;
+  const now = Date.now();
+  const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  return {
+    userId: "",
+    productId,
+    platform: "google",
+    status: shared.SUBSCRIPTION_STATUS.ACTIVE,
+    expiresAt: new Date(expiresAt).toISOString(),
+    originalTransactionId: deterministicTransactionId("mock_google_orig", receipt),
+    purchasedAt: new Date(now).toISOString(),
+    willRenew: true
+  };
+}
+function mockValidateGoogleProduct(receipt, productId) {
+  const outcome = classifyMockReceipt(receipt);
+  if (!outcomePasses(outcome, "google")) return null;
+  return {
+    transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/providers/apple.ts
+var MAX_CONSUMABLE_RECEIPT_AGE_MS = 72 * 60 * 60 * 1e3;
+function derBase64ToPem(der) {
+  return "-----BEGIN CERTIFICATE-----\n" + (der.match(/.{1,64}/g) ?? []).join("\n") + "\n-----END CERTIFICATE-----";
+}
+var APPLE_ROOT_CERTS = APPLE_ROOT_CA_PEMS.map((pem) => new crypto.X509Certificate(pem));
+function verifyAppleCertChain(x5c) {
+  if (x5c.length === 0) {
+    throw new Error("[onesub/apple] empty x5c");
+  }
+  const chain = x5c.map((der) => new crypto.X509Certificate(derBase64ToPem(der)));
+  const now = /* @__PURE__ */ new Date();
+  for (let i = 0; i < chain.length; i++) {
+    const cert = chain[i];
+    if (new Date(cert.validFrom) > now || new Date(cert.validTo) < now) {
+      throw new Error(`[onesub/apple] cert[${i}] outside validity window`);
+    }
+    if (i + 1 < chain.length) {
+      if (!cert.checkIssued(chain[i + 1]) || !cert.verify(chain[i + 1].publicKey)) {
+        throw new Error(`[onesub/apple] cert[${i}] not signed by cert[${i + 1}]`);
+      }
+    }
+  }
+  const top = chain[chain.length - 1];
+  const topDer = top.raw.toString("base64");
+  const trustsRoot = APPLE_ROOT_CERTS.some((root) => {
+    if (root.raw.toString("base64") === topDer) return true;
+    if (!top.checkIssued(root)) return false;
+    try {
+      return top.verify(root.publicKey);
+    } catch {
+      return false;
+    }
+  });
+  if (!trustsRoot) {
+    throw new Error("[onesub/apple] cert chain does not terminate at a trusted Apple root");
+  }
+  return chain[0].toString();
+}
+async function decodeJws(jws, skipVerification = false) {
+  if (skipVerification) {
+    if (process.env["NODE_ENV"] === "production") {
+      log.warn(
+        "[onesub/apple] WARNING: skipJwsVerification is enabled in production. JWS signatures are NOT being verified. This is a security risk."
+      );
+    }
+    return jose.decodeJwt(jws);
+  }
+  const header = jose.decodeProtectedHeader(jws);
+  const x5c = header.x5c;
+  if (!x5c || x5c.length === 0) {
+    throw new Error("[onesub/apple] JWS header missing x5c certificate chain");
+  }
+  const leafPem = verifyAppleCertChain(x5c);
+  const alg = header.alg ?? "ES256";
+  const key = await jose.importX509(leafPem, alg);
+  const { payload } = await jose.jwtVerify(jws, key);
+  return payload;
+}
+function deriveStatus(tx, renewal) {
+  if (tx.revocationDate) return shared.SUBSCRIPTION_STATUS.CANCELED;
+  const now = Date.now();
+  const expires = tx.expiresDate ?? 0;
+  if (expires > now) return shared.SUBSCRIPTION_STATUS.ACTIVE;
+  if (renewal?.autoRenewStatus === 0) return shared.SUBSCRIPTION_STATUS.CANCELED;
+  return shared.SUBSCRIPTION_STATUS.EXPIRED;
+}
+async function validateAppleReceipt(receipt, config) {
+  if (config.mockMode) return mockValidateAppleSubscription(receipt);
+  let tx;
+  try {
+    tx = await decodeJws(receipt, config.skipJwsVerification);
+  } catch (err) {
+    const preview = receipt.slice(0, 60);
+    const parts = receipt.split(".").length;
+    log.warn(
+      "[onesub/apple] Failed to decode receipt as JWS:",
+      err?.message ?? err,
+      `| preview: "${preview}..." (len=${receipt.length}, parts=${parts})`
+    );
+    return null;
+  }
+  if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
+    return null;
+  }
+  if (!tx.bundleId || tx.bundleId !== config.bundleId) {
+    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    return null;
+  }
+  if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
+    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    return null;
+  }
+  const status = deriveStatus(tx, null);
+  const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
+  return {
+    userId: "",
+    // caller fills this in from the request body
+    productId: tx.productId,
+    platform: "apple",
+    status,
+    expiresAt: new Date(tx.expiresDate).toISOString(),
+    originalTransactionId: tx.originalTransactionId,
+    purchasedAt: new Date(purchasedAt).toISOString(),
+    willRenew: status === shared.SUBSCRIPTION_STATUS.ACTIVE
+    // refined by renewal info in webhook
+  };
+}
+async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
+  if (config.mockMode) return mockValidateAppleProduct(signedTransaction, expectedProductId);
+  let tx;
+  try {
+    tx = await decodeJws(signedTransaction, config.skipJwsVerification);
+  } catch (err) {
+    const preview = signedTransaction.slice(0, 60);
+    const parts = signedTransaction.split(".").length;
+    const looksLikeJws = parts === 3;
+    log.warn(
+      "[onesub/apple] Failed to decode consumable JWS:",
+      err?.message ?? err,
+      `| receipt preview: "${preview}..." (len=${signedTransaction.length}, parts=${parts}, looksLikeJws=${looksLikeJws})`
+    );
+    return null;
+  }
+  if (!tx.bundleId || tx.bundleId !== config.bundleId) {
+    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    return null;
+  }
+  if (tx.type !== "Consumable" && tx.type !== "Non-Consumable") {
+    log.warn("[onesub/apple] Invalid purchase type for product validation:", tx.type);
+    return null;
+  }
+  if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
+    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    return null;
+  }
+  if (!tx.productId) {
+    log.warn("[onesub/apple] No productId in transaction");
+    return null;
+  }
+  if (expectedProductId && tx.productId !== expectedProductId) {
+    log.warn("[onesub/apple] Product ID mismatch:", tx.productId, "!==", expectedProductId);
+    return null;
+  }
+  if (tx.revocationDate) {
+    log.warn("[onesub/apple] Purchase was revoked/refunded");
+    return null;
+  }
+  if (tx.purchaseDate && Date.now() - tx.purchaseDate > MAX_CONSUMABLE_RECEIPT_AGE_MS) {
+    log.warn("[onesub/apple] Consumable receipt too old (>72h)");
+    return null;
+  }
+  const transactionId = tx.transactionId ?? tx.originalTransactionId;
+  if (!transactionId) {
+    log.warn("[onesub/apple] No transactionId in consumable transaction");
+    return null;
+  }
+  return {
+    transactionId,
+    productId: tx.productId,
+    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function decodeAppleNotification(payload, skipJwsVerification = false) {
+  const { signedTransactionInfo, signedRenewalInfo } = payload.data;
+  let tx;
+  let renewal = null;
+  try {
+    tx = await decodeJws(signedTransactionInfo, skipJwsVerification);
+  } catch {
+    return null;
+  }
+  try {
+    renewal = await decodeJws(signedRenewalInfo, skipJwsVerification);
+  } catch {
+  }
+  if (!tx.originalTransactionId) return null;
+  const status = deriveStatus(tx, renewal);
+  const willRenew = renewal?.autoRenewStatus === 1;
+  const txEnv = tx.environment;
+  const dataEnv = payload.data.environment;
+  const environment = txEnv === "Sandbox" || dataEnv === "Sandbox" ? "Sandbox" : "Production";
+  return {
+    originalTransactionId: tx.originalTransactionId,
+    transactionId: tx.transactionId ?? null,
+    type: tx.type ?? null,
+    productId: tx.productId ?? null,
+    bundleId: tx.bundleId ?? payload.data.bundleId ?? null,
+    environment,
+    status,
+    willRenew,
+    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null
+  };
+}
+var appleJwtMintPromises = /* @__PURE__ */ new Map();
+var APPLE_JWT_TTL_MS = 20 * 60 * 1e3;
+var APPLE_JWT_REFRESH_BEFORE_MS = 60 * 1e3;
+async function makeAppleApiJwt(config) {
+  const { issuerId, keyId, privateKey, bundleId } = config;
+  if (!issuerId || !keyId || !privateKey) {
+    throw new Error("[onesub/apple] App Store Server API requires issuerId, keyId, and privateKey");
+  }
+  const cache = getDefaultCache();
+  const cacheKey = `apple:jwt:${issuerId}|${keyId}`;
+  const now = Date.now();
+  const cached = await cache.get(cacheKey);
+  if (cached && cached.expiresAt - now > APPLE_JWT_REFRESH_BEFORE_MS) {
+    return cached.token;
+  }
+  const inflight = appleJwtMintPromises.get(cacheKey);
+  if (inflight) return inflight;
+  const promise = (async () => {
+    const key = await jose.importPKCS8(privateKey, "ES256");
+    const issuedAt = Math.floor(Date.now() / 1e3);
+    const token = await new jose.SignJWT({ bid: bundleId }).setProtectedHeader({ alg: "ES256", kid: keyId, typ: "JWT" }).setIssuer(issuerId).setAudience("appstoreconnect-v1").setIssuedAt(issuedAt).setExpirationTime(issuedAt + Math.floor(APPLE_JWT_TTL_MS / 1e3)).sign(key);
+    const expiresAt = Date.now() + APPLE_JWT_TTL_MS;
+    await cache.set(cacheKey, { token, expiresAt }, 19 * 60);
+    return token;
+  })().finally(() => {
+    appleJwtMintPromises.delete(cacheKey);
+  });
+  appleJwtMintPromises.set(cacheKey, promise);
+  return promise;
+}
+async function sendAppleConsumptionResponse(transactionId, body, config, options) {
+  if (config.mockMode) return;
+  let jwt;
+  try {
+    jwt = await makeAppleApiJwt(config);
+  } catch (err) {
+    log.warn("[onesub/apple] Cannot send consumption response \u2014 JWT mint failed:", err);
+    return;
+  }
+  const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
+  const url = `https://${host}/inApps/v1/transactions/consumption/${encodeURIComponent(transactionId)}`;
+  try {
+    const resp = await fetchWithTimeout(url, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!resp.ok) {
+      const text = await resp.text();
+      log.warn(`[onesub/apple] Consumption response API error ${resp.status}: ${text}`);
+    }
+  } catch (err) {
+    log.warn("[onesub/apple] Consumption response network error:", err);
+  }
+}
+var APPLE_SUBSCRIPTION_STATUS_CODE = {
+  ACTIVE: 1,
+  EXPIRED: 2,
+  BILLING_RETRY: 3,
+  GRACE_PERIOD: 4,
+  REVOKED: 5
+};
+function mapAppleStatusCode(code) {
+  switch (code) {
+    case APPLE_SUBSCRIPTION_STATUS_CODE.ACTIVE:
+      return shared.SUBSCRIPTION_STATUS.ACTIVE;
+    case APPLE_SUBSCRIPTION_STATUS_CODE.GRACE_PERIOD:
+      return shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    case APPLE_SUBSCRIPTION_STATUS_CODE.BILLING_RETRY:
+      return shared.SUBSCRIPTION_STATUS.ON_HOLD;
+    case APPLE_SUBSCRIPTION_STATUS_CODE.REVOKED:
+      return shared.SUBSCRIPTION_STATUS.CANCELED;
+    case APPLE_SUBSCRIPTION_STATUS_CODE.EXPIRED:
+    default:
+      return shared.SUBSCRIPTION_STATUS.EXPIRED;
+  }
+}
+async function fetchAppleSubscriptionStatus(originalTransactionId, config, options) {
+  if (config.mockMode) return null;
+  let jwt;
+  try {
+    jwt = await makeAppleApiJwt(config);
+  } catch (err) {
+    log.warn("[onesub/apple] Cannot fetch subscription status \u2014 JWT mint failed:", err);
+    return null;
+  }
+  const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
+  const url = `https://${host}/inApps/v1/subscriptions/${encodeURIComponent(originalTransactionId)}`;
+  let body;
+  try {
+    const resp = await fetchWithTimeout(url, {
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+    if (!resp.ok) {
+      const text = await resp.text();
+      log.warn(`[onesub/apple] Status API error ${resp.status}: ${text}`);
+      return null;
+    }
+    body = await resp.json();
+  } catch (err) {
+    log.warn("[onesub/apple] Status API network error:", err);
+    return null;
+  }
+  const entry = body.data?.flatMap((g) => g.lastTransactions ?? []).find((t) => t.originalTransactionId === originalTransactionId);
+  if (!entry || entry.status == null || !entry.signedTransactionInfo) {
+    log.warn("[onesub/apple] Status API returned no matching transaction for", originalTransactionId);
+    return null;
+  }
+  let tx;
+  try {
+    tx = await decodeJws(entry.signedTransactionInfo, config.skipJwsVerification);
+  } catch (err) {
+    log.warn("[onesub/apple] Failed to decode signedTransactionInfo from Status API:", err);
+    return null;
+  }
+  let renewal = null;
+  if (entry.signedRenewalInfo) {
+    try {
+      renewal = await decodeJws(entry.signedRenewalInfo, config.skipJwsVerification);
+    } catch {
+    }
+  }
+  if (!tx.productId || !tx.expiresDate) {
+    log.warn("[onesub/apple] Status API transaction missing productId or expiresDate");
+    return null;
+  }
+  const status = mapAppleStatusCode(entry.status);
+  const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
+  return {
+    userId: "",
+    // caller fills this in
+    productId: tx.productId,
+    platform: "apple",
+    status,
+    expiresAt: new Date(tx.expiresDate).toISOString(),
+    originalTransactionId,
+    purchasedAt: new Date(purchasedAt).toISOString(),
+    willRenew: renewal?.autoRenewStatus === 1
+  };
+}
+var GOOGLE_NOTIFICATION_TYPE = {
+  SUBSCRIPTION_RECOVERED: 1,
+  SUBSCRIPTION_RENEWED: 2,
+  SUBSCRIPTION_CANCELED: 3,
+  SUBSCRIPTION_PURCHASED: 4,
+  SUBSCRIPTION_ON_HOLD: 5,
+  SUBSCRIPTION_IN_GRACE_PERIOD: 6,
+  SUBSCRIPTION_RESTARTED: 7,
+  SUBSCRIPTION_PRICE_CHANGE_CONFIRMED: 8,
+  SUBSCRIPTION_PAUSED: 10,
+  SUBSCRIPTION_REVOKED: 12,
+  SUBSCRIPTION_EXPIRED: 13
+};
+var MAX_PRODUCT_RECEIPT_AGE_MS = 72 * 60 * 60 * 1e3;
+var refreshPromises = /* @__PURE__ */ new Map();
+function googleTokenCacheKey(serviceAccountKey) {
+  let hash = 0;
+  for (let i = 0; i < serviceAccountKey.length; i++) {
+    hash = hash * 31 + serviceAccountKey.charCodeAt(i) | 0;
+  }
+  return `google:oauth:${hash}`;
+}
+async function getCachedAccessToken(serviceAccountKey) {
+  const cache = getDefaultCache();
+  const cacheKey = googleTokenCacheKey(serviceAccountKey);
+  const cached = await cache.get(cacheKey);
+  if (cached && cached.expiresAt - Date.now() > 6e4) {
+    return cached.token;
+  }
+  const inflight = refreshPromises.get(cacheKey);
+  if (inflight) return inflight;
+  const promise = getAccessToken(serviceAccountKey).then(async (token) => {
+    const expiresAt = Date.now() + 36e5;
+    await cache.set(cacheKey, { token, expiresAt }, 3540);
+    return token;
+  }).finally(() => {
+    refreshPromises.delete(cacheKey);
+  });
+  refreshPromises.set(cacheKey, promise);
+  return promise;
+}
+async function getAccessToken(serviceAccountKey) {
+  let key;
+  try {
+    key = JSON.parse(serviceAccountKey);
+  } catch {
+    throw new Error("[onesub/google] Invalid serviceAccountKey JSON");
+  }
+  const tokenUri = key.token_uri ?? "https://oauth2.googleapis.com/token";
+  const scope = "https://www.googleapis.com/auth/androidpublisher";
+  const now = Math.floor(Date.now() / 1e3);
+  const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+  const payload = Buffer.from(
+    JSON.stringify({
+      iss: key.client_email,
+      scope,
+      aud: tokenUri,
+      iat: now,
+      exp: now + 3600
+    })
+  ).toString("base64url");
+  const signingInput = `${header}.${payload}`;
+  const { createSign } = await import('crypto');
+  const sign = createSign("RSA-SHA256");
+  sign.update(signingInput);
+  const signature = sign.sign(key.private_key, "base64url");
+  const assertion = `${signingInput}.${signature}`;
+  const resp = await fetchWithTimeout(tokenUri, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion
+    })
+  });
+  if (!resp.ok) {
+    throw new Error(`[onesub/google] Token request failed: ${resp.status}`);
+  }
+  const data = await resp.json();
+  if (!data.access_token) throw new Error("[onesub/google] No access_token in response");
+  return data.access_token;
+}
+async function fetchSubscriptionPurchaseV2(packageName, purchaseToken, accessToken) {
+  const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(packageName)}/purchases/subscriptionsv2/tokens/${encodeURIComponent(purchaseToken)}`;
+  const resp = await fetchWithTimeout(url, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+  if (!resp.ok) {
+    const body = await resp.text();
+    throw new Error(`[onesub/google] Play API v2 error ${resp.status}: ${body}`);
+  }
+  return resp.json();
+}
+async function fetchProductPurchase(packageName, productId, purchaseToken, accessToken) {
+  const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}`;
+  const resp = await fetchWithTimeout(url, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+  if (!resp.ok) {
+    const body = await resp.text();
+    throw new Error(`[onesub/google] Play Products API error ${resp.status}: ${body}`);
+  }
+  return resp.json();
+}
+async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
+  if (config.mockMode) return;
+  if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
+  let accessToken;
+  try {
+    accessToken = await getCachedAccessToken(config.serviceAccountKey);
+  } catch (err) {
+    log.warn("[onesub/google] Could not get access token for subscription ack:", err);
+    return;
+  }
+  const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/subscriptions/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
+  try {
+    const resp = await fetchWithTimeout(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+      body: "{}"
+    });
+    if (!resp.ok) {
+      const body = await resp.text();
+      log.warn(`[onesub/google] Subscription acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+    }
+  } catch (err) {
+    log.warn("[onesub/google] Subscription acknowledge network error \u2014 auto-refund risk:", err);
+  }
+}
+async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
+  if (config.mockMode) return;
+  if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
+  let accessToken;
+  try {
+    accessToken = await getCachedAccessToken(config.serviceAccountKey);
+  } catch (err) {
+    log.warn("[onesub/google] Could not get access token for product ack:", err);
+    return;
+  }
+  const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
+  try {
+    const resp = await fetchWithTimeout(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+      body: "{}"
+    });
+    if (!resp.ok) {
+      const body = await resp.text();
+      log.warn(`[onesub/google] Product acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+    }
+  } catch (err) {
+    log.warn("[onesub/google] Product acknowledge network error \u2014 auto-refund risk:", err);
+  }
+}
+async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
+  if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
+  let accessToken;
+  try {
+    accessToken = await getCachedAccessToken(config.serviceAccountKey);
+  } catch (err) {
+    log.warn("[onesub/google] Could not get access token for consume:", err);
+    return;
+  }
+  const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:consume`;
+  try {
+    const resp = await fetchWithTimeout(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!resp.ok) {
+      const body = await resp.text();
+      log.warn(`[onesub/google] Consume API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+    }
+  } catch (err) {
+    log.warn("[onesub/google] Consume network error \u2014 auto-refund risk:", err);
+  }
+}
+function deriveStatusV2(state) {
+  switch (state) {
+    case "SUBSCRIPTION_STATE_ACTIVE":
+      return shared.SUBSCRIPTION_STATUS.ACTIVE;
+    case "SUBSCRIPTION_STATE_IN_GRACE_PERIOD":
+      return shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    case "SUBSCRIPTION_STATE_ON_HOLD":
+      return shared.SUBSCRIPTION_STATUS.ON_HOLD;
+    case "SUBSCRIPTION_STATE_PAUSED":
+      return shared.SUBSCRIPTION_STATUS.PAUSED;
+    case "SUBSCRIPTION_STATE_CANCELED":
+      return shared.SUBSCRIPTION_STATUS.CANCELED;
+    case "SUBSCRIPTION_STATE_EXPIRED":
+      return shared.SUBSCRIPTION_STATUS.EXPIRED;
+    case "SUBSCRIPTION_STATE_PENDING":
+    case "SUBSCRIPTION_STATE_UNSPECIFIED":
+    default:
+      return null;
+  }
+}
+async function validateGoogleReceipt(receipt, productId, config) {
+  if (config.mockMode) return mockValidateGoogleSubscription(receipt, productId);
+  if (!config.serviceAccountKey) {
+    log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API");
+    return null;
+  }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API");
+    return null;
+  }
+  let purchase;
+  try {
+    const token = await getCachedAccessToken(config.serviceAccountKey);
+    purchase = await fetchSubscriptionPurchaseV2(config.packageName, receipt, token);
+  } catch (err) {
+    log.error("[onesub/google] Receipt validation failed:", err);
+    return null;
+  }
+  const status = deriveStatusV2(purchase.subscriptionState);
+  if (!status) {
+    log.warn(
+      "[onesub/google] Unrecognised or pending subscriptionState \u2014 rejecting:",
+      purchase.subscriptionState
+    );
+    return null;
+  }
+  const lineItem = purchase.lineItems?.find((item) => item.productId === productId);
+  if (!lineItem) {
+    log.warn(
+      "[onesub/google] productId not found in subscription lineItems:",
+      productId,
+      "available:",
+      purchase.lineItems?.map((i) => i.productId).join(", ") ?? "(none)"
+    );
+    return null;
+  }
+  const expiresAt = lineItem.expiryTime ?? (/* @__PURE__ */ new Date()).toISOString();
+  const purchasedAt = purchase.startTime ?? (/* @__PURE__ */ new Date()).toISOString();
+  const willRenew = lineItem.autoRenewingPlan?.autoRenewEnabled ?? false;
+  const autoResumeTime = status === shared.SUBSCRIPTION_STATUS.PAUSED ? purchase.pausedStateContext?.autoResumeTime : void 0;
+  return {
+    userId: "",
+    // caller fills this in
+    productId,
+    platform: "google",
+    status,
+    expiresAt,
+    originalTransactionId: purchase.latestOrderId ?? receipt.slice(0, 64),
+    purchasedAt,
+    willRenew,
+    // Surface the linked token so host apps (and our webhook userId-continuity
+    // logic) can follow upgrade/downgrade chains.
+    linkedPurchaseToken: purchase.linkedPurchaseToken,
+    autoResumeTime
+  };
+}
+async function validateGoogleProductReceipt(purchaseToken, productId, config, type = "non_consumable") {
+  if (config.mockMode) return mockValidateGoogleProduct(purchaseToken, productId);
+  if (!config.serviceAccountKey) {
+    log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt");
+    return null;
+  }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt");
+    return null;
+  }
+  let purchase;
+  try {
+    const token = await getCachedAccessToken(config.serviceAccountKey);
+    purchase = await fetchProductPurchase(config.packageName, productId, purchaseToken, token);
+  } catch (err) {
+    log.error("[onesub/google] Product receipt validation failed:", err);
+    return null;
+  }
+  if (purchase.purchaseState !== 0) {
+    log.warn("[onesub/google] Purchase not completed, state:", purchase.purchaseState);
+    return null;
+  }
+  if (type === "consumable" && purchase.consumptionState === 1) {
+    log.warn("[onesub/google] Consumable already consumed \u2014 possible replay attack");
+    return null;
+  }
+  if (purchase.purchaseTimeMillis) {
+    const purchaseTime = parseInt(purchase.purchaseTimeMillis, 10);
+    if (Date.now() - purchaseTime > MAX_PRODUCT_RECEIPT_AGE_MS) {
+      log.warn("[onesub/google] Product receipt too old (>72h)");
+      return null;
+    }
+  }
+  if (!purchase.orderId) {
+    log.warn("[onesub/google] No orderId in product purchase");
+    return null;
+  }
+  return {
+    transactionId: purchase.orderId,
+    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function decodeGoogleNotification(payload) {
+  let notification;
+  try {
+    const json = Buffer.from(payload.message.data, "base64").toString("utf-8");
+    notification = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!notification.subscriptionNotification) {
+    return null;
+  }
+  const { notificationType, purchaseToken, subscriptionId } = notification.subscriptionNotification;
+  return {
+    notificationType,
+    purchaseToken,
+    subscriptionId,
+    packageName: notification.packageName
+  };
+}
+function decodeGoogleVoidedNotification(payload) {
+  let notification;
+  try {
+    const json = Buffer.from(payload.message.data, "base64").toString("utf-8");
+    notification = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!notification.voidedPurchaseNotification) return null;
+  const { purchaseToken, orderId, productType, refundType } = notification.voidedPurchaseNotification;
+  return {
+    purchaseToken,
+    orderId,
+    productType,
+    refundType,
+    packageName: notification.packageName
+  };
+}
+function isGoogleActiveNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PURCHASED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RENEWED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RECOVERED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RESTARTED;
+}
+function isGoogleCanceledNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_CANCELED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_REVOKED;
+}
+function isGoogleExpiredNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_EXPIRED;
+}
+function isGoogleGracePeriodNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_IN_GRACE_PERIOD;
+}
+function isGoogleOnHoldNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_ON_HOLD;
+}
+function isGooglePausedNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PAUSED;
+}
+function isGooglePriceChangeConfirmedNotification(notificationType) {
+  return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PRICE_CHANGE_CONFIRMED;
+}
+function sendError(res, status, code, error, extra = {}) {
+  res.status(status).json({ ...extra, error, errorCode: code });
+}
+function sendZodError(res, err, extra = {}) {
+  sendError(
+    res,
+    400,
+    shared.ONESUB_ERROR_CODE.INVALID_INPUT,
+    err.issues.map((e) => e.message).join(", "),
+    extra
+  );
+}
+
+// src/routes/validate.ts
+var NO_SUB = { valid: false, subscription: null };
+var validateSchema = zod.z.object({
+  platform: zod.z.enum(["apple", "google"]),
+  receipt: zod.z.string().min(1).max(1e4),
+  userId: zod.z.string().min(1).max(256),
+  productId: zod.z.string().min(1).max(256)
+});
+function createValidateRouter(config, store) {
+  const router = express.Router();
+  router.post(shared.ROUTES.VALIDATE, async (req, res) => {
+    let platform;
+    let receipt;
+    let userId;
+    let productId;
+    try {
+      ({ platform, receipt, userId, productId } = validateSchema.parse(req.body));
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err, NO_SUB);
+        return;
+      }
+      throw err;
+    }
+    try {
+      let sub = null;
+      if (platform === "apple") {
+        if (!config.apple) {
+          sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_SUB);
+          return;
+        }
+        sub = await validateAppleReceipt(receipt, config.apple);
+      } else {
+        if (!config.google) {
+          sendError(res, 500, shared.ONESUB_ERROR_CODE.GOOGLE_CONFIG_MISSING, "Google configuration not provided", NO_SUB);
+          return;
+        }
+        sub = await validateGoogleReceipt(receipt, productId, config.google);
+      }
+      if (!sub) {
+        sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_SUB);
+        return;
+      }
+      sub.userId = userId;
+      await store.save(sub);
+      if (platform === "google" && config.google) {
+        void acknowledgeGoogleSubscription(receipt, productId, config.google);
+      }
+      const response = { valid: true, subscription: sub };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/validate] Unexpected error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error during receipt validation", NO_SUB);
+    }
+  });
+  return router;
+}
+var NO_SUB2 = { active: false, subscription: null };
+function createStatusRouter(store) {
+  const router = express.Router();
+  router.get(shared.ROUTES.STATUS, async (req, res) => {
+    const userId = req.query["userId"];
+    if (!userId || typeof userId !== "string") {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "Missing required query param: userId", NO_SUB2);
+      return;
+    }
+    if (userId.length > 256) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.USER_ID_TOO_LONG, "userId must not exceed 256 characters", NO_SUB2);
+      return;
+    }
+    try {
+      const sub = await store.getByUserId(userId);
+      if (!sub) {
+        const response2 = { active: false, subscription: null };
+        res.status(200).json(response2);
+        return;
+      }
+      const statusAllows = sub.status === shared.SUBSCRIPTION_STATUS.ACTIVE || sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+      const notYetExpired = new Date(sub.expiresAt).getTime() > Date.now();
+      const active = statusAllows && notYetExpired;
+      const response = { active, subscription: sub };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/status] Store error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", NO_SUB2);
+    }
+  });
+  return router;
+}
+var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set(["SUBSCRIBED", "DID_RENEW", "DID_RECOVER", "OFFER_REDEEMED"]);
+var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND", "CONSUMPTION_REQUEST"]);
+var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set(["EXPIRED"]);
+function mapAppleNotificationStatus(notificationType, subtype) {
+  if (notificationType === "DID_FAIL_TO_RENEW") {
+    return subtype === "GRACE_PERIOD" ? shared.SUBSCRIPTION_STATUS.GRACE_PERIOD : shared.SUBSCRIPTION_STATUS.ON_HOLD;
+  }
+  if (notificationType === "GRACE_PERIOD_EXPIRED") return shared.SUBSCRIPTION_STATUS.ON_HOLD;
+  if (APPLE_CANCELED_TYPES.has(notificationType)) return shared.SUBSCRIPTION_STATUS.CANCELED;
+  if (APPLE_EXPIRED_TYPES.has(notificationType)) return shared.SUBSCRIPTION_STATUS.EXPIRED;
+  if (APPLE_ACTIVE_TYPES.has(notificationType)) return shared.SUBSCRIPTION_STATUS.ACTIVE;
+  return null;
+}
+async function handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  const body = req.body;
+  if (!body.signedPayload) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_SIGNED_PAYLOAD, "Missing signedPayload");
+    return;
+  }
+  let payload;
+  try {
+    payload = await decodeJws(
+      body.signedPayload,
+      config.apple?.skipJwsVerification
+    );
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err);
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
+    return;
+  }
+  if (webhookEventStore && typeof payload.notificationUUID === "string") {
+    const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
+    if (!fresh) {
+      log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
+      res.status(200).json({ received: true, deduped: true });
+      return;
+    }
+  }
+  const decoded = await decodeAppleNotification(payload, config.apple?.skipJwsVerification);
+  if (!decoded) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const {
+    originalTransactionId,
+    transactionId,
+    type,
+    productId,
+    bundleId,
+    environment,
+    status,
+    willRenew,
+    expiresAt
+  } = decoded;
+  const notificationType = payload.notificationType;
+  const subtype = payload.subtype;
+  const mapped = mapAppleNotificationStatus(notificationType, subtype);
+  const finalStatus = mapped ?? status;
+  if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
+    const provider = config.apple.consumptionInfoProvider;
+    const appleConfig = config.apple;
+    void (async () => {
+      try {
+        const info = await provider({
+          transactionId,
+          originalTransactionId,
+          productId,
+          bundleId: bundleId ?? appleConfig.bundleId,
+          environment
+        });
+        if (info) {
+          await sendAppleConsumptionResponse(transactionId, info, appleConfig, {
+            sandbox: environment === "Sandbox"
+          });
+        }
+      } catch (err) {
+        log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err);
+      }
+    })();
+  }
+  const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
+  const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
+  try {
+    if (isOneTimePurchase && isRefundOrRevoke) {
+      const lookupId = transactionId ?? originalTransactionId;
+      const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
+      if (!removed) {
+        log.warn("[onesub/webhook/apple] IAP refund for unknown transaction:", lookupId);
+      }
+      res.status(200).json({ received: true });
+      return;
+    }
+    const existing = await store.getByTransactionId(originalTransactionId);
+    if (existing) {
+      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
+      const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
+      const updated = keepEntitlement ? { ...existing, willRenew: false } : {
+        ...existing,
+        status: finalStatus,
+        willRenew,
+        expiresAt: expiresAt ?? existing.expiresAt
+      };
+      await store.save(updated);
+    } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
+      const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
+        sandbox: environment === "Sandbox"
+      });
+      if (fresh) {
+        fresh.userId = originalTransactionId;
+        await store.save(fresh);
+      } else {
+        log.warn(
+          "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
+          originalTransactionId
+        );
+      }
+    } else {
+      log.warn(
+        "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
+        originalTransactionId
+      );
+    }
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Store update error:", err);
+    sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
+  }
+}
+var GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+var googleJwks = null;
+function getGoogleJwks() {
+  if (!googleJwks) googleJwks = jose.createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
+  return googleJwks;
+}
+async function verifyGooglePushToken(req, expectedAudience) {
+  const authHeader = req.headers["authorization"];
+  if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) return false;
+  try {
+    await jose.jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
+      audience: expectedAudience
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  if (config.google?.pushAudience) {
+    const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
+    if (!authenticated) {
+      sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+      return;
+    }
+  }
+  const body = req.body;
+  if (!body.message?.data) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
+    return;
+  }
+  if (webhookEventStore && typeof body.message.messageId === "string") {
+    const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
+    if (!fresh) {
+      log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
+      res.status(200).json({ received: true, deduped: true });
+      return;
+    }
+  }
+  const voided = decodeGoogleVoidedNotification(body);
+  if (voided) {
+    if (config.google?.packageName && voided.packageName !== config.google.packageName) {
+      log.warn("[onesub/webhook/google] voided package name mismatch:", voided.packageName, "!==", config.google.packageName);
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+      return;
+    }
+    try {
+      if (voided.productType === 1) {
+        const existing = await store.getByTransactionId(voided.purchaseToken);
+        if (existing) {
+          const updated = config.refundPolicy === "until_expiry" ? { ...existing, willRenew: false } : { ...existing, status: shared.SUBSCRIPTION_STATUS.CANCELED };
+          await store.save(updated);
+        } else {
+          log.warn("[onesub/webhook/google] voided subscription for unknown purchaseToken:", voided.purchaseToken);
+        }
+      } else {
+        const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
+        if (!removed) {
+          log.warn("[onesub/webhook/google] voided IAP for unknown orderId:", voided.orderId);
+        }
+      }
+      res.status(200).json({ received: true });
+    } catch (err) {
+      log.error("[onesub/webhook/google] voided notification error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
+    }
+    return;
+  }
+  const notification = decodeGoogleNotification(body);
+  if (!notification) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const { notificationType, purchaseToken, subscriptionId, packageName } = notification;
+  if (config.google?.packageName && packageName !== config.google.packageName) {
+    log.warn("[onesub/webhook/google] Package name mismatch:", packageName, "!==", config.google.packageName);
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+    return;
+  }
+  try {
+    const existing = await store.getByTransactionId(purchaseToken);
+    let finalStatus;
+    if (isGoogleActiveNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleGracePeriodNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    } else if (isGoogleOnHoldNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ON_HOLD;
+    } else if (isGooglePausedNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.PAUSED;
+    } else if (isGooglePriceChangeConfirmedNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleCanceledNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.CANCELED;
+    } else if (isGoogleExpiredNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.EXPIRED;
+    } else {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    }
+    if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
+      const hook = config.google.onPriceChangeConfirmed;
+      void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err));
+    }
+    if (existing) {
+      let updated = { ...existing, status: finalStatus };
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          const preserveNotificationStatus = finalStatus === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === shared.SUBSCRIPTION_STATUS.ON_HOLD;
+          updated = {
+            ...existing,
+            status: preserveNotificationStatus ? finalStatus : fresh.status,
+            expiresAt: fresh.expiresAt,
+            willRenew: fresh.willRenew,
+            autoResumeTime: fresh.autoResumeTime,
+            linkedPurchaseToken: fresh.linkedPurchaseToken ?? existing.linkedPurchaseToken
+          };
+        }
+      }
+      await store.save(updated);
+    } else {
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          if (fresh.linkedPurchaseToken) {
+            const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
+            fresh.userId = previous ? previous.userId : purchaseToken;
+            if (previous) {
+              log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
+            }
+          } else {
+            fresh.userId = purchaseToken;
+          }
+          await store.save(fresh);
+        }
+      } else {
+        log.warn("[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:", purchaseToken);
+      }
+    }
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/google] Error handling notification:", err);
+    sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
+  }
+}
+
+// src/routes/webhook.ts
+function createWebhookRouter(config, store, purchaseStore, webhookEventStore) {
+  const router = express.Router();
+  router.post(
+    shared.ROUTES.WEBHOOK_APPLE,
+    (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
+  router.post(
+    shared.ROUTES.WEBHOOK_GOOGLE,
+    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
+  return router;
+}
+var NO_PURCHASE = { valid: false, purchase: null };
+var validatePurchaseSchema = zod.z.object({
+  platform: zod.z.enum(["apple", "google"]),
+  receipt: zod.z.string().min(1).max(1e4),
+  userId: zod.z.string().min(1).max(256),
+  productId: zod.z.string().min(1).max(256),
+  type: zod.z.enum([shared.PURCHASE_TYPE.CONSUMABLE, shared.PURCHASE_TYPE.NON_CONSUMABLE])
+});
+var purchaseStatusQuerySchema = zod.z.object({
+  userId: zod.z.string().min(1).max(256),
+  productId: zod.z.string().min(1).max(256).optional()
+});
+function createPurchaseRouter(config, purchaseStore) {
+  const router = express.Router();
+  router.post(shared.ROUTES.VALIDATE_PURCHASE, async (req, res) => {
+    let body;
+    try {
+      body = validatePurchaseSchema.parse(req.body);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err, NO_PURCHASE);
+        return;
+      }
+      throw err;
+    }
+    const { platform, receipt, userId, productId, type } = body;
+    try {
+      if (type === shared.PURCHASE_TYPE.NON_CONSUMABLE) {
+        const alreadyOwned = await purchaseStore.hasPurchased(userId, productId);
+        if (alreadyOwned) {
+          sendError(res, 409, shared.ONESUB_ERROR_CODE.NON_CONSUMABLE_ALREADY_OWNED, "NON_CONSUMABLE_ALREADY_OWNED", NO_PURCHASE);
+          return;
+        }
+      }
+      let transactionId = null;
+      let purchasedAt = (/* @__PURE__ */ new Date()).toISOString();
+      if (platform === "apple") {
+        if (!config.apple) {
+          sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_PURCHASE);
+          return;
+        }
+        const result = await validateAppleConsumableReceipt(receipt, config.apple, productId);
+        if (result) {
+          transactionId = result.transactionId;
+          purchasedAt = result.purchasedAt;
+        }
+      } else {
+        if (!config.google) {
+          sendError(res, 500, shared.ONESUB_ERROR_CODE.GOOGLE_CONFIG_MISSING, "Google configuration not provided", NO_PURCHASE);
+          return;
+        }
+        const result = await validateGoogleProductReceipt(
+          receipt,
+          productId,
+          config.google,
+          type === shared.PURCHASE_TYPE.CONSUMABLE ? "consumable" : "non_consumable"
+        );
+        if (result) {
+          transactionId = result.transactionId;
+          purchasedAt = result.purchasedAt;
+        }
+      }
+      if (!transactionId) {
+        sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_PURCHASE);
+        return;
+      }
+      const existing = await purchaseStore.getPurchaseByTransactionId(transactionId);
+      let action = "new";
+      if (existing) {
+        action = "restored";
+        if (existing.userId !== userId) {
+          if (type === shared.PURCHASE_TYPE.NON_CONSUMABLE) {
+            await purchaseStore.reassignPurchase(transactionId, userId);
+            log.info(
+              `[onesub/purchase] reassigned transaction ${transactionId} from ${existing.userId} to ${userId}`
+            );
+          } else {
+            sendError(
+              res,
+              409,
+              shared.ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+              "TRANSACTION_BELONGS_TO_OTHER_USER",
+              NO_PURCHASE
+            );
+            return;
+          }
+        }
+        const response2 = {
+          valid: true,
+          purchase: { ...existing, userId },
+          action
+        };
+        res.status(200).json(response2);
+        return;
+      }
+      const purchase = {
+        userId,
+        productId,
+        platform,
+        type,
+        transactionId,
+        purchasedAt,
+        quantity: 1
+      };
+      await purchaseStore.savePurchase(purchase);
+      if (platform === "google" && config.google) {
+        if (type === shared.PURCHASE_TYPE.CONSUMABLE) {
+          void consumeGoogleProductReceipt(receipt, productId, config.google);
+        } else {
+          void acknowledgeGoogleProduct(receipt, productId, config.google);
+        }
+      }
+      const response = {
+        valid: true,
+        purchase,
+        action
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/purchase/validate] Unexpected error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error during purchase validation", NO_PURCHASE);
+    }
+  });
+  router.get(shared.ROUTES.PURCHASE_STATUS, async (req, res) => {
+    let query;
+    try {
+      query = purchaseStatusQuerySchema.parse(req.query);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err, { purchases: [] });
+        return;
+      }
+      throw err;
+    }
+    const { userId, productId } = query;
+    try {
+      let purchases = await purchaseStore.getPurchasesByUserId(userId);
+      if (productId !== void 0) {
+        purchases = purchases.filter((p) => p.productId === productId);
+      }
+      const response = { purchases };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/purchase/status] Store error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", { purchases: [] });
+    }
+  });
+  return router;
+}
+async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
+  const productIdSet = new Set(entitlement.productIds);
+  const now = Date.now();
+  const subs = await store.getAllByUserId(userId);
+  for (const sub of subs) {
+    if (!productIdSet.has(sub.productId)) continue;
+    const statusAllows = sub.status === shared.SUBSCRIPTION_STATUS.ACTIVE || sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    if (!statusAllows) continue;
+    if (new Date(sub.expiresAt).getTime() <= now) continue;
+    return {
+      active: true,
+      source: "subscription",
+      productId: sub.productId,
+      expiresAt: sub.expiresAt
+    };
+  }
+  const purchases = await purchaseStore.getPurchasesByUserId(userId);
+  for (const p of purchases) {
+    if (p.type !== shared.PURCHASE_TYPE.NON_CONSUMABLE) continue;
+    if (!productIdSet.has(p.productId)) continue;
+    return {
+      active: true,
+      source: "purchase",
+      productId: p.productId
+    };
+  }
+  return { active: false, source: null };
+}
+var userIdSchema = zod.z.string().min(1).max(256);
+var entitlementIdSchema = zod.z.string().min(1).max(128);
+function createEntitlementRouter(config, store, purchaseStore) {
+  if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
+    return null;
+  }
+  const entitlements = config.entitlements;
+  const router = express.Router();
+  router.get(shared.ROUTES.ENTITLEMENT, async (req, res) => {
+    let userId;
+    let id;
+    try {
+      userId = userIdSchema.parse(req.query["userId"]);
+      id = entitlementIdSchema.parse(req.query["id"]);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and id are required");
+      return;
+    }
+    const entitlement = entitlements[id];
+    if (!entitlement) {
+      sendError(res, 404, shared.ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
+      return;
+    }
+    try {
+      const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
+      const response = { id, ...status };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/entitlement] evaluation error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
+    }
+  });
+  router.get(shared.ROUTES.ENTITLEMENTS, async (req, res) => {
+    let userId;
+    try {
+      userId = userIdSchema.parse(req.query["userId"]);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId is required");
+      return;
+    }
+    try {
+      const entries = await Promise.all(
+        Object.entries(entitlements).map(async ([id, entitlement]) => {
+          const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
+          return [id, status];
+        })
+      );
+      const response = {
+        entitlements: Object.fromEntries(entries)
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/entitlements] evaluation error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", { entitlements: {} });
+    }
+  });
+  return router;
+}
+
+// src/routes/admin.ts
+var ADMIN_SECRET_HEADER = "x-admin-secret";
+function createAdminRouter(config, purchaseStore, store, webhookQueue) {
+  if (!config.adminSecret) return null;
+  const router = express.Router();
+  const adminSecret = config.adminSecret;
+  const adminAuth = (req, res, next) => {
+    const provided = req.headers[ADMIN_SECRET_HEADER];
+    if (typeof provided !== "string" || provided !== adminSecret) {
+      sendError(res, 401, shared.ONESUB_ERROR_CODE.INVALID_ADMIN_SECRET, "INVALID_ADMIN_SECRET");
+      return;
+    }
+    next();
+  };
+  router.use("/onesub/purchase/admin", adminAuth);
+  router.use("/onesub/admin", adminAuth);
+  const resetParamsSchema = zod.z.object({
+    userId: zod.z.string().min(1).max(256),
+    productId: zod.z.string().min(1).max(256)
+  });
+  router.delete("/onesub/purchase/admin/:userId/:productId", async (req, res) => {
+    let params;
+    try {
+      params = resetParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId and productId required");
+      return;
+    }
+    const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
+    res.json({ ok: true, deleted });
+  });
+  const transferSchema = zod.z.object({
+    transactionId: zod.z.string().min(1).max(256),
+    newUserId: zod.z.string().min(1).max(256)
+  });
+  router.post("/onesub/purchase/admin/transfer", async (req, res) => {
+    let body;
+    try {
+      body = transferSchema.parse(req.body);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err);
+        return;
+      }
+      throw err;
+    }
+    const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
+    if (!existing) {
+      sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
+      return;
+    }
+    await purchaseStore.deletePurchases(existing.userId, existing.productId);
+    const migrated = { ...existing, userId: body.newUserId };
+    await purchaseStore.savePurchase(migrated);
+    res.json({ ok: true, purchase: migrated });
+  });
+  const grantSchema = zod.z.object({
+    userId: zod.z.string().min(1).max(256),
+    productId: zod.z.string().min(1).max(256),
+    platform: zod.z.enum(["apple", "google"]),
+    type: zod.z.enum([shared.PURCHASE_TYPE.CONSUMABLE, shared.PURCHASE_TYPE.NON_CONSUMABLE]).default(shared.PURCHASE_TYPE.NON_CONSUMABLE),
+    transactionId: zod.z.string().min(1).max(256).optional()
+  });
+  router.post("/onesub/purchase/admin/grant", async (req, res) => {
+    let body;
+    try {
+      body = grantSchema.parse(req.body);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err);
+        return;
+      }
+      throw err;
+    }
+    const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+    const purchase = {
+      transactionId,
+      userId: body.userId,
+      productId: body.productId,
+      platform: body.platform,
+      type: body.type,
+      quantity: 1,
+      purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await purchaseStore.savePurchase(purchase);
+    res.json({ ok: true, purchase });
+  });
+  const listQuerySchema = zod.z.object({
+    userId: zod.z.string().min(1).max(256).optional(),
+    status: zod.z.enum([
+      shared.SUBSCRIPTION_STATUS.ACTIVE,
+      shared.SUBSCRIPTION_STATUS.GRACE_PERIOD,
+      shared.SUBSCRIPTION_STATUS.ON_HOLD,
+      shared.SUBSCRIPTION_STATUS.PAUSED,
+      shared.SUBSCRIPTION_STATUS.EXPIRED,
+      shared.SUBSCRIPTION_STATUS.CANCELED,
+      shared.SUBSCRIPTION_STATUS.NONE
+    ]).optional(),
+    productId: zod.z.string().min(1).max(256).optional(),
+    platform: zod.z.enum(["apple", "google"]).optional(),
+    // Cap at 200 server-side so a runaway dashboard query can't tip the DB.
+    limit: zod.z.coerce.number().int().positive().max(200).optional(),
+    offset: zod.z.coerce.number().int().nonnegative().optional()
+  });
+  router.get(shared.ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
+    let query;
+    try {
+      query = listQuerySchema.parse(req.query);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err);
+        return;
+      }
+      throw err;
+    }
+    try {
+      const result = await store.listFiltered(query);
+      const response = {
+        items: result.items,
+        total: result.total,
+        limit: result.limit,
+        offset: result.offset
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "list error");
+    }
+  });
+  const detailParamsSchema = zod.z.object({
+    transactionId: zod.z.string().min(1).max(256)
+  });
+  router.get("/onesub/admin/subscriptions/:transactionId", async (req, res) => {
+    let params;
+    try {
+      params = detailParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "transactionId required");
+      return;
+    }
+    try {
+      const sub = await store.getByTransactionId(params.transactionId);
+      if (!sub) {
+        sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
+        return;
+      }
+      res.status(200).json(sub);
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "detail error");
+    }
+  });
+  const customerParamsSchema = zod.z.object({
+    userId: zod.z.string().min(1).max(256)
+  });
+  router.get("/onesub/admin/customers/:userId", async (req, res) => {
+    let params;
+    try {
+      params = customerParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "userId required");
+      return;
+    }
+    try {
+      const [subscriptions, purchases] = await Promise.all([
+        store.getAllByUserId(params.userId),
+        purchaseStore.getPurchasesByUserId(params.userId)
+      ]);
+      let entitlements;
+      if (config.entitlements && Object.keys(config.entitlements).length > 0) {
+        entitlements = {};
+        for (const [id, def] of Object.entries(config.entitlements)) {
+          entitlements[id] = await evaluateEntitlement(params.userId, def, store, purchaseStore);
+        }
+      }
+      const response = {
+        userId: params.userId,
+        subscriptions,
+        purchases,
+        ...entitlements ? { entitlements } : {}
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "customer error");
+    }
+  });
+  if (webhookQueue?.listDeadLetters) {
+    router.get("/onesub/admin/webhook-deadletters", async (_req, res) => {
+      try {
+        const items = await webhookQueue.listDeadLetters();
+        res.status(200).json({ items });
+      } catch (err) {
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "list error");
+      }
+    });
+  }
+  if (webhookQueue?.replayDeadLetter) {
+    const replayParamsSchema = zod.z.object({ id: zod.z.string().min(1).max(256) });
+    router.post("/onesub/admin/webhook-replay/:id", async (req, res) => {
+      let params;
+      try {
+        params = replayParamsSchema.parse(req.params);
+      } catch {
+        sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "id required");
+        return;
+      }
+      try {
+        await webhookQueue.replayDeadLetter(params.id);
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "replay error");
+      }
+    });
+  }
+  return router;
+}
+var ADMIN_SECRET_HEADER2 = "x-admin-secret";
+function createMetricsRouter(config, store, purchaseStore) {
+  if (!config.adminSecret) return null;
+  const router = express.Router();
+  const adminSecret = config.adminSecret;
+  router.use("/onesub/metrics", (req, res, next) => {
+    const provided = req.headers[ADMIN_SECRET_HEADER2];
+    if (typeof provided !== "string" || provided !== adminSecret) {
+      sendError(res, 401, shared.ONESUB_ERROR_CODE.INVALID_ADMIN_SECRET, "INVALID_ADMIN_SECRET");
+      return;
+    }
+    next();
+  });
+  const isActiveSub = (sub, now) => {
+    const statusAllows = sub.status === shared.SUBSCRIPTION_STATUS.ACTIVE || sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    return statusAllows && new Date(sub.expiresAt).getTime() > now;
+  };
+  const bump = (map, key) => {
+    map[key] = (map[key] ?? 0) + 1;
+  };
+  router.get(shared.ROUTES.METRICS_ACTIVE, async (_req, res) => {
+    try {
+      const [subs, purchases] = await Promise.all([
+        store.listAll(),
+        purchaseStore.listAll()
+      ]);
+      const now = Date.now();
+      const byProduct = {};
+      const byProductPurchases = {};
+      const byPlatform = {};
+      let activeSubscriptions = 0;
+      let gracePeriodSubscriptions = 0;
+      let nonConsumablePurchases = 0;
+      for (const sub of subs) {
+        if (!isActiveSub(sub, now)) continue;
+        activeSubscriptions++;
+        if (sub.status === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD) {
+          gracePeriodSubscriptions++;
+        }
+        bump(byProduct, sub.productId);
+        bump(byPlatform, sub.platform);
+      }
+      for (const p of purchases) {
+        if (p.type !== shared.PURCHASE_TYPE.NON_CONSUMABLE) continue;
+        nonConsumablePurchases++;
+        bump(byProductPurchases, p.productId);
+        bump(byPlatform, p.platform);
+      }
+      const response = {
+        total: activeSubscriptions + nonConsumablePurchases,
+        activeSubscriptions,
+        gracePeriodSubscriptions,
+        nonConsumablePurchases,
+        byProduct,
+        byProductPurchases,
+        byPlatform
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/metrics/active] error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
+    }
+  });
+  const rangeSchema = zod.z.object({
+    from: zod.z.string().min(1),
+    to: zod.z.string().min(1),
+    groupBy: zod.z.enum(["none", "day"]).optional()
+  });
+  function parseRange(req) {
+    const parsed = rangeSchema.safeParse(req.query);
+    if (!parsed.success) return { error: "from and to are required (ISO 8601)" };
+    const fromMs = new Date(parsed.data.from).getTime();
+    const toMs = new Date(parsed.data.to).getTime();
+    if (Number.isNaN(fromMs) || Number.isNaN(toMs)) {
+      return { error: "from / to must be ISO 8601 timestamps" };
+    }
+    if (fromMs > toMs) return { error: "from must be \u2264 to" };
+    return { fromMs, toMs, groupBy: parsed.data.groupBy ?? "none" };
+  }
+  function utcDateKey(ms) {
+    const d = new Date(ms);
+    const yyyy = d.getUTCFullYear();
+    const mm = String(d.getUTCMonth() + 1).padStart(2, "0");
+    const dd = String(d.getUTCDate()).padStart(2, "0");
+    return `${yyyy}-${mm}-${dd}`;
+  }
+  function emptyDailyBuckets(fromMs, toMs) {
+    const out = [];
+    const start = new Date(fromMs);
+    start.setUTCHours(0, 0, 0, 0);
+    let cur = start.getTime();
+    while (cur <= toMs) {
+      out.push({ date: utcDateKey(cur), count: 0 });
+      cur += 864e5;
+    }
+    return out;
+  }
+  router.get(shared.ROUTES.METRICS_STARTED, async (req, res) => {
+    const range = parseRange(req);
+    if ("error" in range) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
+      return;
+    }
+    try {
+      const subs = await store.listAll();
+      const byProduct = {};
+      const byPlatform = {};
+      let total = 0;
+      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
+      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
+      for (const sub of subs) {
+        const purchasedMs = new Date(sub.purchasedAt).getTime();
+        if (purchasedMs < range.fromMs || purchasedMs > range.toMs) continue;
+        total++;
+        bump(byProduct, sub.productId);
+        bump(byPlatform, sub.platform);
+        if (buckets && bucketIndex) {
+          const idx = bucketIndex.get(utcDateKey(purchasedMs));
+          if (idx !== void 0) buckets[idx].count++;
+        }
+      }
+      const response = {
+        from: req.query["from"],
+        to: req.query["to"],
+        total,
+        byProduct,
+        byPlatform,
+        ...buckets ? { buckets } : {}
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/metrics/started] error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
+    }
+  });
+  router.get(shared.ROUTES.METRICS_EXPIRED, async (req, res) => {
+    const range = parseRange(req);
+    if ("error" in range) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
+      return;
+    }
+    try {
+      const subs = await store.listAll();
+      const byProduct = {};
+      const byPlatform = {};
+      let total = 0;
+      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
+      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
+      for (const sub of subs) {
+        if (sub.status !== shared.SUBSCRIPTION_STATUS.EXPIRED && sub.status !== shared.SUBSCRIPTION_STATUS.CANCELED) continue;
+        const expiredMs = new Date(sub.expiresAt).getTime();
+        if (expiredMs < range.fromMs || expiredMs > range.toMs) continue;
+        total++;
+        bump(byProduct, sub.productId);
+        bump(byPlatform, sub.platform);
+        if (buckets && bucketIndex) {
+          const idx = bucketIndex.get(utcDateKey(expiredMs));
+          if (idx !== void 0) buckets[idx].count++;
+        }
+      }
+      const response = {
+        from: req.query["from"],
+        to: req.query["to"],
+        total,
+        byProduct,
+        byPlatform,
+        ...buckets ? { buckets } : {}
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/metrics/expired] error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
+    }
+  });
+  router.get(shared.ROUTES.METRICS_PURCHASES_STARTED, async (req, res) => {
+    const range = parseRange(req);
+    if ("error" in range) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, range.error);
+      return;
+    }
+    try {
+      const purchases = await purchaseStore.listAll();
+      const byProduct = {};
+      const byPlatform = {};
+      let total = 0;
+      const buckets = range.groupBy === "day" ? emptyDailyBuckets(range.fromMs, range.toMs) : null;
+      const bucketIndex = buckets ? new Map(buckets.map((b, i) => [b.date, i])) : null;
+      for (const p of purchases) {
+        if (p.type !== shared.PURCHASE_TYPE.NON_CONSUMABLE) continue;
+        const purchasedMs = new Date(p.purchasedAt).getTime();
+        if (purchasedMs < range.fromMs || purchasedMs > range.toMs) continue;
+        total++;
+        bump(byProduct, p.productId);
+        bump(byPlatform, p.platform);
+        if (buckets && bucketIndex) {
+          const idx = bucketIndex.get(utcDateKey(purchasedMs));
+          if (idx !== void 0) buckets[idx].count++;
+        }
+      }
+      const response = {
+        from: req.query["from"],
+        to: req.query["to"],
+        total,
+        byProduct,
+        byPlatform,
+        ...buckets ? { buckets } : {}
+      };
+      res.status(200).json(response);
+    } catch (err) {
+      log.error("[onesub/metrics/purchases/started] error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
+    }
+  });
+  return router;
+}
+
+// src/stores/schema.ts
+var SUBSCRIPTIONS_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS onesub_subscriptions (
+  original_transaction_id TEXT        PRIMARY KEY,
+  user_id                 TEXT        NOT NULL,
+  product_id              TEXT        NOT NULL,
+  platform                TEXT        NOT NULL,
+  status                  TEXT        NOT NULL,
+  expires_at              TIMESTAMPTZ NOT NULL,
+  purchased_at            TIMESTAMPTZ NOT NULL,
+  will_renew              BOOLEAN     NOT NULL,
+  linked_purchase_token   TEXT,
+  auto_resume_time        TIMESTAMPTZ,
+  updated_at              TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_user_id
+  ON onesub_subscriptions (user_id, updated_at DESC);
+
+-- Filter-helper indexes for /onesub/admin/subscriptions. Each filter column
+-- is paired with updated_at DESC so the planner can serve "latest matching"
+-- without sorting the full table once row count grows.
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_status_updated
+  ON onesub_subscriptions (status, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_platform_updated
+  ON onesub_subscriptions (platform, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_onesub_subscriptions_product
+  ON onesub_subscriptions (product_id, updated_at DESC);
+
+-- Backfill columns for installs that already created the table from an older
+-- schema. Safe to re-run.
+ALTER TABLE onesub_subscriptions ADD COLUMN IF NOT EXISTS linked_purchase_token TEXT;
+ALTER TABLE onesub_subscriptions ADD COLUMN IF NOT EXISTS auto_resume_time TIMESTAMPTZ;
+`.trim();
+var PURCHASES_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS onesub_purchases (
+  transaction_id  TEXT        PRIMARY KEY,
+  user_id         TEXT        NOT NULL,
+  product_id      TEXT        NOT NULL,
+  platform        TEXT        NOT NULL,
+  type            TEXT        NOT NULL,
+  quantity        INTEGER     NOT NULL DEFAULT 1,
+  purchased_at    TIMESTAMPTZ NOT NULL,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_onesub_purchases_user_id
+  ON onesub_purchases (user_id, purchased_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_onesub_purchases_user_product
+  ON onesub_purchases (user_id, product_id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_onesub_purchases_non_consumable
+  ON onesub_purchases (user_id, product_id)
+  WHERE type = 'non_consumable';
+`.trim();
+
+// src/stores/postgres.ts
+var PostgresSubscriptionStore = class {
+  constructor(connectionString) {
+    this.connectionString = connectionString;
+  }
+  connectionString;
+  // Lazy-loaded to avoid requiring `pg` unless this class is actually instantiated.
+  poolPromise = null;
+  getPool() {
+    if (!this.poolPromise) {
+      this.poolPromise = (async () => {
+        const pg = await import('pg').catch(() => {
+          throw new Error(
+            "[onesub] PostgresSubscriptionStore requires the `pg` package. Run: npm install pg"
+          );
+        });
+        const Pool = pg.default?.Pool ?? pg.Pool;
+        return new Pool({ connectionString: this.connectionString, max: 10 });
+      })();
+    }
+    return this.poolPromise;
+  }
+  /**
+   * Creates the `onesub_subscriptions` table and indexes if they do not
+   * already exist. Call this once during application startup.
+   */
+  async initSchema() {
+    const pool = await this.getPool();
+    await pool.query(SUBSCRIPTIONS_SCHEMA_SQL);
+  }
+  /**
+   * Upserts the given subscription.
+   * If a row with the same `original_transaction_id` already exists it is
+   * updated in place; otherwise a new row is inserted.
+   */
+  async save(sub) {
+    const pool = await this.getPool();
+    await pool.query(
+      `INSERT INTO onesub_subscriptions
+         (original_transaction_id, user_id, product_id, platform, status,
+          expires_at, purchased_at, will_renew, linked_purchase_token,
+          auto_resume_time, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, NOW())
+       ON CONFLICT (original_transaction_id) DO UPDATE SET
+         user_id    = EXCLUDED.user_id,
+         product_id = EXCLUDED.product_id,
+         platform   = EXCLUDED.platform,
+         status     = EXCLUDED.status,
+         expires_at = EXCLUDED.expires_at,
+         purchased_at = EXCLUDED.purchased_at,
+         will_renew = EXCLUDED.will_renew,
+         linked_purchase_token = EXCLUDED.linked_purchase_token,
+         auto_resume_time = EXCLUDED.auto_resume_time,
+         updated_at = NOW()`,
+      [
+        sub.originalTransactionId,
+        sub.userId,
+        sub.productId,
+        sub.platform,
+        sub.status,
+        sub.expiresAt,
+        sub.purchasedAt,
+        sub.willRenew,
+        sub.linkedPurchaseToken ?? null,
+        sub.autoResumeTime ?? null
+      ]
+    );
+  }
+  /**
+   * Returns the most recently updated subscription for the given user, or
+   * `null` if no record exists.
+   *
+   * "Most recent" is determined by `updated_at DESC` so that the latest
+   * status change is always returned when a user has multiple subscriptions.
+   */
+  async getByUserId(userId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_subscriptions
+        WHERE user_id = $1
+        ORDER BY updated_at DESC
+        LIMIT 1`,
+      [userId]
+    );
+    return result.rows.length > 0 ? rowToSubscriptionInfo(result.rows[0]) : null;
+  }
+  /**
+   * Returns every subscription record for the user (across all productIds),
+   * ordered most-recent-first. Used by entitlement evaluation, which needs to
+   * see all of a user's active subscriptions to decide whether any of them
+   * grants the requested entitlement.
+   */
+  async getAllByUserId(userId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_subscriptions
+        WHERE user_id = $1
+        ORDER BY updated_at DESC`,
+      [userId]
+    );
+    return result.rows.map(rowToSubscriptionInfo);
+  }
+  /**
+   * Returns the subscription identified by `originalTransactionId` (the
+   * table primary key), or `null` if it does not exist.
+   */
+  async getByTransactionId(txId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_subscriptions
+        WHERE original_transaction_id = $1`,
+      [txId]
+    );
+    return result.rows.length > 0 ? rowToSubscriptionInfo(result.rows[0]) : null;
+  }
+  async listAll() {
+    const pool = await this.getPool();
+    const result = await pool.query(`SELECT * FROM onesub_subscriptions`);
+    return result.rows.map(rowToSubscriptionInfo);
+  }
+  async listFiltered(opts) {
+    const pool = await this.getPool();
+    const limit = opts.limit ?? 50;
+    const offset = opts.offset ?? 0;
+    const conditions = [];
+    const params = [];
+    if (opts.userId) {
+      params.push(opts.userId);
+      conditions.push(`user_id = $${params.length}`);
+    }
+    if (opts.status) {
+      params.push(opts.status);
+      conditions.push(`status = $${params.length}`);
+    }
+    if (opts.productId) {
+      params.push(opts.productId);
+      conditions.push(`product_id = $${params.length}`);
+    }
+    if (opts.platform) {
+      params.push(opts.platform);
+      conditions.push(`platform = $${params.length}`);
+    }
+    const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+    const [countResult, pageResult] = await Promise.all([
+      pool.query(
+        `SELECT COUNT(*)::text AS total FROM onesub_subscriptions ${where}`,
+        params
+      ),
+      pool.query(
+        `SELECT * FROM onesub_subscriptions ${where}
+           ORDER BY updated_at DESC
+           LIMIT $${params.length + 1} OFFSET $${params.length + 2}`,
+        [...params, limit, offset]
+      )
+    ]);
+    return {
+      items: pageResult.rows.map(rowToSubscriptionInfo),
+      total: parseInt(countResult.rows[0]?.total ?? "0", 10),
+      limit,
+      offset
+    };
+  }
+  /** Gracefully close the underlying connection pool. */
+  async close() {
+    if (this.poolPromise) {
+      const pool = await this.poolPromise;
+      await pool.end();
+      this.poolPromise = null;
+    }
+  }
+};
+var PostgresPurchaseStore = class {
+  constructor(connectionString) {
+    this.connectionString = connectionString;
+  }
+  connectionString;
+  poolPromise = null;
+  getPool() {
+    if (!this.poolPromise) {
+      this.poolPromise = (async () => {
+        const pg = await import('pg').catch(() => {
+          throw new Error(
+            "[onesub] PostgresPurchaseStore requires the `pg` package. Run: npm install pg"
+          );
+        });
+        const Pool = pg.default?.Pool ?? pg.Pool;
+        return new Pool({ connectionString: this.connectionString, max: 10 });
+      })();
+    }
+    return this.poolPromise;
+  }
+  /**
+   * Creates the `onesub_purchases` table and indexes if they do not already exist.
+   * Call this once during application startup.
+   */
+  async initSchema() {
+    const pool = await this.getPool();
+    await pool.query(PURCHASES_SCHEMA_SQL);
+  }
+  async savePurchase(purchase) {
+    const pool = await this.getPool();
+    const existing = await pool.query(
+      `SELECT user_id FROM onesub_purchases WHERE transaction_id = $1`,
+      [purchase.transactionId]
+    );
+    if (existing.rows.length > 0) {
+      const owner = existing.rows[0].user_id;
+      if (owner !== purchase.userId) {
+        const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
+        err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
+        throw err;
+      }
+      return;
+    }
+    await pool.query(
+      `INSERT INTO onesub_purchases
+         (transaction_id, user_id, product_id, platform, type, quantity, purchased_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        purchase.transactionId,
+        purchase.userId,
+        purchase.productId,
+        purchase.platform,
+        purchase.type,
+        purchase.quantity,
+        purchase.purchasedAt
+      ]
+    );
+  }
+  async getPurchasesByUserId(userId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_purchases
+        WHERE user_id = $1
+        ORDER BY purchased_at DESC`,
+      [userId]
+    );
+    return result.rows.map(rowToPurchaseInfo);
+  }
+  async getPurchaseByTransactionId(txId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT *
+         FROM onesub_purchases
+        WHERE transaction_id = $1`,
+      [txId]
+    );
+    return result.rows.length > 0 ? rowToPurchaseInfo(result.rows[0]) : null;
+  }
+  async hasPurchased(userId, productId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `SELECT EXISTS(
+         SELECT 1 FROM onesub_purchases
+          WHERE user_id = $1 AND product_id = $2
+       ) AS exists`,
+      [userId, productId]
+    );
+    return result.rows[0]?.exists === true;
+  }
+  async reassignPurchase(transactionId, newUserId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `UPDATE onesub_purchases SET user_id = $2 WHERE transaction_id = $1`,
+      [transactionId, newUserId]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+  async deletePurchases(userId, productId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `DELETE FROM onesub_purchases WHERE user_id = $1 AND product_id = $2`,
+      [userId, productId]
+    );
+    return result.rowCount ?? 0;
+  }
+  async deletePurchaseByTransactionId(transactionId) {
+    const pool = await this.getPool();
+    const result = await pool.query(
+      `DELETE FROM onesub_purchases WHERE transaction_id = $1`,
+      [transactionId]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+  async listAll() {
+    const pool = await this.getPool();
+    const result = await pool.query(`SELECT * FROM onesub_purchases`);
+    return result.rows.map(rowToPurchaseInfo);
+  }
+  /** Gracefully close the underlying connection pool. */
+  async close() {
+    if (this.poolPromise) {
+      const pool = await this.poolPromise;
+      await pool.end();
+      this.poolPromise = null;
+    }
+  }
+};
+function rowToSubscriptionInfo(row) {
+  return {
+    originalTransactionId: row.original_transaction_id,
+    userId: row.user_id,
+    productId: row.product_id,
+    platform: row.platform,
+    status: row.status,
+    expiresAt: row.expires_at.toISOString(),
+    purchasedAt: row.purchased_at.toISOString(),
+    willRenew: row.will_renew,
+    linkedPurchaseToken: row.linked_purchase_token ?? void 0,
+    autoResumeTime: row.auto_resume_time?.toISOString()
+  };
+}
+function rowToPurchaseInfo(row) {
+  return {
+    transactionId: row.transaction_id,
+    userId: row.user_id,
+    productId: row.product_id,
+    platform: row.platform,
+    type: row.type,
+    quantity: row.quantity,
+    purchasedAt: row.purchased_at.toISOString()
+  };
+}
+
+// src/stores/redis.ts
+var SUB_TX_PREFIX = "onesub:sub:tx:";
+var SUB_USER_PREFIX = "onesub:sub:user:";
+var SUB_ALL = "onesub:sub:all";
+var SUB_ALL_SORTED = "onesub:sub:all:sorted";
+var PUR_TX_PREFIX = "onesub:purchase:tx:";
+var PUR_USER_PREFIX = "onesub:purchase:user:";
+var PUR_USER_PRODUCT_PREFIX = "onesub:purchase:user_product:";
+var PUR_ALL = "onesub:purchase:all";
+var RedisSubscriptionStore = class {
+  constructor(redis) {
+    this.redis = redis;
+  }
+  redis;
+  async save(sub) {
+    const score = Date.now();
+    const txKey = SUB_TX_PREFIX + sub.originalTransactionId;
+    const userKey = SUB_USER_PREFIX + sub.userId;
+    const pipeline = this.redis.multi();
+    pipeline.set(txKey, JSON.stringify(sub));
+    pipeline.zadd(userKey, score, sub.originalTransactionId);
+    pipeline.sadd(SUB_ALL, sub.originalTransactionId);
+    pipeline.zadd(SUB_ALL_SORTED, score, sub.originalTransactionId);
+    await pipeline.exec();
+  }
+  async getByUserId(userId) {
+    const userKey = SUB_USER_PREFIX + userId;
+    const ids = await this.redis.zrevrange(userKey, 0, 0);
+    if (ids.length === 0) return null;
+    const raw = await this.redis.get(SUB_TX_PREFIX + ids[0]);
+    return raw ? JSON.parse(raw) : null;
+  }
+  async getAllByUserId(userId) {
+    const userKey = SUB_USER_PREFIX + userId;
+    const ids = await this.redis.zrevrange(userKey, 0, -1);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => SUB_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r));
+  }
+  async getByTransactionId(txId) {
+    const raw = await this.redis.get(SUB_TX_PREFIX + txId);
+    return raw ? JSON.parse(raw) : null;
+  }
+  async listAll() {
+    const ids = await this.redis.zrevrange(SUB_ALL_SORTED, 0, -1);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => SUB_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r));
+  }
+  async listFiltered(opts) {
+    const limit = opts.limit ?? 50;
+    const offset = opts.offset ?? 0;
+    const hasSecondaryFilters = !!(opts.status || opts.productId || opts.platform);
+    if (opts.userId) {
+      const candidates = await this.getAllByUserId(opts.userId);
+      const filtered2 = candidates.filter((s) => {
+        if (opts.status && s.status !== opts.status) return false;
+        if (opts.productId && s.productId !== opts.productId) return false;
+        if (opts.platform && s.platform !== opts.platform) return false;
+        return true;
+      });
+      return { items: filtered2.slice(offset, offset + limit), total: filtered2.length, limit, offset };
+    }
+    if (!hasSecondaryFilters) {
+      const [ids, total] = await Promise.all([
+        this.redis.zrevrange(SUB_ALL_SORTED, offset, offset + limit - 1),
+        this.redis.zcard(SUB_ALL_SORTED)
+      ]);
+      if (ids.length === 0) return { items: [], total, limit, offset };
+      const raws2 = await this.redis.mget(...ids.map((id) => SUB_TX_PREFIX + id));
+      const items = raws2.filter((r) => r != null).map((r) => JSON.parse(r));
+      return { items, total, limit, offset };
+    }
+    const allIds = await this.redis.zrevrange(SUB_ALL_SORTED, 0, -1);
+    if (allIds.length === 0) return { items: [], total: 0, limit, offset };
+    const raws = await this.redis.mget(...allIds.map((id) => SUB_TX_PREFIX + id));
+    const all = raws.filter((r) => r != null).map((r) => JSON.parse(r));
+    const filtered = all.filter((s) => {
+      if (opts.status && s.status !== opts.status) return false;
+      if (opts.productId && s.productId !== opts.productId) return false;
+      if (opts.platform && s.platform !== opts.platform) return false;
+      return true;
+    });
+    return { items: filtered.slice(offset, offset + limit), total: filtered.length, limit, offset };
+  }
+};
+var RedisPurchaseStore = class {
+  constructor(redis) {
+    this.redis = redis;
+  }
+  redis;
+  async savePurchase(purchase) {
+    const txKey = PUR_TX_PREFIX + purchase.transactionId;
+    const existing = await this.redis.get(txKey);
+    if (existing) {
+      const owner = JSON.parse(existing).userId;
+      if (owner !== purchase.userId) {
+        const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
+        err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
+        throw err;
+      }
+      return;
+    }
+    const score = Date.parse(purchase.purchasedAt) || Date.now();
+    const pipeline = this.redis.multi();
+    pipeline.set(txKey, JSON.stringify(purchase));
+    pipeline.zadd(PUR_USER_PREFIX + purchase.userId, score, purchase.transactionId);
+    pipeline.sadd(PUR_USER_PRODUCT_PREFIX + purchase.userId + ":" + purchase.productId, purchase.transactionId);
+    pipeline.sadd(PUR_ALL, purchase.transactionId);
+    await pipeline.exec();
+  }
+  async getPurchasesByUserId(userId) {
+    const ids = await this.redis.zrevrange(PUR_USER_PREFIX + userId, 0, -1);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r));
+  }
+  async getPurchaseByTransactionId(txId) {
+    const raw = await this.redis.get(PUR_TX_PREFIX + txId);
+    return raw ? JSON.parse(raw) : null;
+  }
+  async hasPurchased(userId, productId) {
+    const count = await this.redis.scard(PUR_USER_PRODUCT_PREFIX + userId + ":" + productId);
+    return count > 0;
+  }
+  async reassignPurchase(transactionId, newUserId) {
+    const txKey = PUR_TX_PREFIX + transactionId;
+    const raw = await this.redis.get(txKey);
+    if (!raw) return false;
+    const existing = JSON.parse(raw);
+    if (existing.userId === newUserId) return true;
+    const updated = { ...existing, userId: newUserId };
+    const score = Date.parse(updated.purchasedAt) || Date.now();
+    const oldUserProductKey = PUR_USER_PRODUCT_PREFIX + existing.userId + ":" + existing.productId;
+    const newUserProductKey = PUR_USER_PRODUCT_PREFIX + newUserId + ":" + existing.productId;
+    const pipeline = this.redis.multi();
+    pipeline.set(txKey, JSON.stringify(updated));
+    pipeline.zrem(PUR_USER_PREFIX + existing.userId, transactionId);
+    pipeline.zadd(PUR_USER_PREFIX + newUserId, score, transactionId);
+    pipeline.srem(oldUserProductKey, transactionId);
+    pipeline.sadd(newUserProductKey, transactionId);
+    await pipeline.exec();
+    return true;
+  }
+  async deletePurchases(userId, productId) {
+    const userProductKey = PUR_USER_PRODUCT_PREFIX + userId + ":" + productId;
+    const ids = await this.redis.smembers(userProductKey);
+    if (ids.length === 0) return 0;
+    const pipeline = this.redis.multi();
+    for (const id of ids) {
+      pipeline.del(PUR_TX_PREFIX + id);
+      pipeline.zrem(PUR_USER_PREFIX + userId, id);
+      pipeline.srem(PUR_ALL, id);
+    }
+    pipeline.del(userProductKey);
+    await pipeline.exec();
+    return ids.length;
+  }
+  async deletePurchaseByTransactionId(transactionId) {
+    const txKey = PUR_TX_PREFIX + transactionId;
+    const raw = await this.redis.get(txKey);
+    if (!raw) return false;
+    const existing = JSON.parse(raw);
+    const pipeline = this.redis.multi();
+    pipeline.del(txKey);
+    pipeline.zrem(PUR_USER_PREFIX + existing.userId, transactionId);
+    pipeline.srem(PUR_USER_PRODUCT_PREFIX + existing.userId + ":" + existing.productId, transactionId);
+    pipeline.srem(PUR_ALL, transactionId);
+    await pipeline.exec();
+    return true;
+  }
+  async listAll() {
+    const ids = await this.redis.smembers(PUR_ALL);
+    if (ids.length === 0) return [];
+    const raws = await this.redis.mget(...ids.map((id) => PUR_TX_PREFIX + id));
+    return raws.filter((r) => r != null).map((r) => JSON.parse(r));
+  }
+};
+var RedisCacheAdapter = class {
+  constructor(redis, prefix = "onesub:cache:") {
+    this.redis = redis;
+    this.prefix = prefix;
+  }
+  redis;
+  prefix;
+  async get(key) {
+    const raw = await this.redis.get(this.prefix + key);
+    return raw ? JSON.parse(raw) : null;
+  }
+  async set(key, value, ttlSeconds) {
+    const fullKey = this.prefix + key;
+    const payload = JSON.stringify(value);
+    if (ttlSeconds && ttlSeconds > 0) {
+      await this.redis.set(fullKey, payload, "EX", ttlSeconds);
+    } else {
+      await this.redis.set(fullKey, payload);
+    }
+  }
+  async del(key) {
+    await this.redis.del(this.prefix + key);
+  }
+};
+var WEBHOOK_EVENT_PREFIX = "onesub:webhook:event:";
+var DEFAULT_WEBHOOK_TTL_SECONDS = 7 * 24 * 60 * 60;
+var RedisWebhookEventStore = class {
+  constructor(redis, ttlSeconds = DEFAULT_WEBHOOK_TTL_SECONDS) {
+    this.redis = redis;
+    this.ttlSeconds = ttlSeconds;
+  }
+  redis;
+  ttlSeconds;
+  async markIfNew(provider, eventId) {
+    const key = WEBHOOK_EVENT_PREFIX + provider + ":" + eventId;
+    const result = await this.redis.set(key, "1", "EX", this.ttlSeconds, "NX");
+    return result === "OK";
+  }
+};
+
+// src/webhook-events.ts
+var DEFAULT_TTL_SECONDS = 7 * 24 * 60 * 60;
+var InMemoryWebhookEventStore = class {
+  constructor(ttlSeconds = DEFAULT_TTL_SECONDS) {
+    this.ttlSeconds = ttlSeconds;
+  }
+  ttlSeconds;
+  seen = /* @__PURE__ */ new Map();
+  async markIfNew(provider, eventId) {
+    this.evictExpired();
+    const key = `${provider}:${eventId}`;
+    if (this.seen.has(key)) return false;
+    this.seen.set(key, Date.now() + this.ttlSeconds * 1e3);
+    return true;
+  }
+  evictExpired() {
+    const now = Date.now();
+    for (const [key, expiresAt] of this.seen) {
+      if (expiresAt < now) this.seen.delete(key);
+    }
+  }
+};
+var CacheWebhookEventStore = class {
+  constructor(cache, ttlSeconds = DEFAULT_TTL_SECONDS) {
+    this.cache = cache;
+    this.ttlSeconds = ttlSeconds;
+  }
+  cache;
+  ttlSeconds;
+  async markIfNew(provider, eventId) {
+    const key = `webhook:event:${provider}:${eventId}`;
+    const existing = await this.cache.get(key);
+    if (existing) return false;
+    await this.cache.set(key, "1", this.ttlSeconds);
+    return true;
+  }
+};
+
+// src/webhook-queue.ts
+var InProcessWebhookQueue = class {
+  handler = null;
+  setHandler(handler) {
+    this.handler = handler;
+  }
+  async enqueue(job) {
+    if (!this.handler) {
+      throw new Error("[onesub] webhook queue has no handler registered");
+    }
+    await this.handler(job);
+  }
+};
+var BullMQWebhookQueue = class {
+  queueName;
+  maxAttempts;
+  backoffMs;
+  concurrency;
+  connection;
+  // Lazy-loaded so `bullmq` doesn't have to be installed unless this class
+  // is instantiated.
+  queuePromise = null;
+  workerPromise = null;
+  handler = null;
+  constructor(opts) {
+    this.connection = opts.connection;
+    this.queueName = opts.queueName ?? "onesub-webhooks";
+    this.maxAttempts = opts.maxAttempts ?? 5;
+    this.backoffMs = opts.backoffMs ?? 1e3;
+    this.concurrency = opts.concurrency ?? 4;
+  }
+  async getBullMQ() {
+    return import('bullmq').catch(() => {
+      throw new Error("[onesub] BullMQWebhookQueue requires the `bullmq` package. Run: npm install bullmq");
+    });
+  }
+  getQueue() {
+    if (!this.queuePromise) {
+      this.queuePromise = (async () => {
+        const { Queue } = await this.getBullMQ();
+        return new Queue(this.queueName, { connection: this.connection });
+      })();
+    }
+    return this.queuePromise;
+  }
+  setHandler(handler) {
+    this.handler = handler;
+    if (!this.workerPromise) {
+      this.workerPromise = (async () => {
+        const { Worker } = await this.getBullMQ();
+        return new Worker(
+          this.queueName,
+          async (job) => {
+            if (!this.handler) throw new Error("[onesub] handler not set");
+            await this.handler(job.data);
+          },
+          {
+            connection: this.connection,
+            concurrency: this.concurrency
+          }
+        );
+      })();
+    }
+  }
+  async enqueue(job) {
+    const queue = await this.getQueue();
+    await queue.add("webhook", job, {
+      attempts: this.maxAttempts,
+      backoff: { type: "exponential", delay: this.backoffMs },
+      removeOnFail: false,
+      removeOnComplete: { age: 24 * 60 * 60, count: 1e3 },
+      jobId: `${job.provider}:${job.eventId}`
+    });
+  }
+  async listDeadLetters() {
+    const queue = await this.getQueue();
+    const failed = await queue.getFailed();
+    return failed.map((j) => ({
+      id: String(j.id),
+      job: j.data,
+      attempts: j.attemptsMade,
+      lastError: j.failedReason ?? "unknown",
+      failedAt: new Date(j.finishedOn ?? Date.now()).toISOString()
+    }));
+  }
+  async replayDeadLetter(id) {
+    const queue = await this.getQueue();
+    const job = await queue.getJob(id);
+    if (!job) throw new Error(`[onesub] dead-letter job ${id} not found`);
+    await job.retry();
+  }
+  async close() {
+    if (this.workerPromise) {
+      const worker = await this.workerPromise;
+      await worker.close();
+    }
+    if (this.queuePromise) {
+      const queue = await this.queuePromise;
+      await queue.close();
+    }
+  }
+};
+var ONESUB_OPENAPI = {
+  openapi: "3.1.0",
+  info: {
+    title: "onesub HTTP API",
+    version: "1.0.0",
+    description: "Receipt validation, subscription status, webhooks, and admin endpoints exposed by `createOneSubMiddleware`."
+  },
+  servers: [
+    { url: "http://localhost:4100", description: "Local dev (examples/server)" }
+  ],
+  paths: {
+    [shared.ROUTES.VALIDATE]: {
+      post: {
+        summary: "Validate an Apple/Google receipt and persist subscription state.",
+        requestBody: {
+          required: true,
+          content: { "application/json": { schema: { $ref: "#/components/schemas/ValidateRequest" } } }
+        },
+        responses: {
+          200: { description: "Validation succeeded; subscription state persisted.", content: { "application/json": { schema: { $ref: "#/components/schemas/ValidateResponse" } } } },
+          400: { description: "Bad request \u2014 missing fields, malformed receipt, package mismatch." }
+        }
+      }
+    },
+    [shared.ROUTES.STATUS]: {
+      get: {
+        summary: "Fetch the most recent subscription state for a user.",
+        parameters: [{ in: "query", name: "userId", required: true, schema: { type: "string" } }],
+        responses: {
+          200: { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/StatusResponse" } } } }
+        }
+      }
+    },
+    [shared.ROUTES.WEBHOOK_APPLE]: {
+      post: {
+        summary: "Apple App Store Server Notification V2 receiver.",
+        description: "Apple POSTs `{ signedPayload }`. JWS-verified, idempotent when `webhookEventStore` is configured.",
+        responses: {
+          200: { description: "Acknowledged." },
+          400: { description: "Missing or invalid signedPayload." }
+        }
+      }
+    },
+    [shared.ROUTES.WEBHOOK_GOOGLE]: {
+      post: {
+        summary: "Google Play Real-Time Developer Notification (Pub/Sub push) receiver.",
+        responses: {
+          200: { description: "Acknowledged." },
+          400: { description: "Missing message.data or package mismatch." },
+          401: { description: "pushAudience configured and JWT verification failed." }
+        }
+      }
+    },
+    [shared.ROUTES.ENTITLEMENTS]: {
+      get: {
+        summary: "Evaluate every configured entitlement for a user.",
+        parameters: [{ in: "query", name: "userId", required: true, schema: { type: "string" } }],
+        responses: {
+          200: { description: "Map of entitlementId \u2192 { granted, source }." }
+        }
+      }
+    },
+    [shared.ROUTES.ADMIN_SUBSCRIPTIONS]: {
+      get: {
+        summary: "Filtered, paginated subscription list (admin).",
+        parameters: [
+          { in: "header", name: "X-Admin-Secret", required: true, schema: { type: "string" } },
+          { in: "query", name: "userId", schema: { type: "string" } },
+          { in: "query", name: "status", schema: { type: "string", enum: ["active", "grace_period", "on_hold", "paused", "expired", "canceled", "none"] } },
+          { in: "query", name: "productId", schema: { type: "string" } },
+          { in: "query", name: "platform", schema: { type: "string", enum: ["apple", "google"] } },
+          { in: "query", name: "limit", schema: { type: "integer", minimum: 1, maximum: 200 } },
+          { in: "query", name: "offset", schema: { type: "integer", minimum: 0 } }
+        ],
+        responses: { 200: { description: "OK" }, 401: { description: "Invalid admin secret" } }
+      }
+    },
+    "/onesub/admin/customers/{userId}": {
+      get: {
+        summary: "Customer profile bundle: subscriptions + purchases + entitlements (admin).",
+        parameters: [
+          { in: "header", name: "X-Admin-Secret", required: true, schema: { type: "string" } },
+          { in: "path", name: "userId", required: true, schema: { type: "string" } }
+        ],
+        responses: { 200: { description: "OK" }, 401: { description: "Invalid admin secret" } }
+      }
+    },
+    "/onesub/admin/webhook-deadletters": {
+      get: {
+        summary: "List failed webhook jobs (when a queue with DLQ support is configured).",
+        parameters: [{ in: "header", name: "X-Admin-Secret", required: true, schema: { type: "string" } }],
+        responses: { 200: { description: "OK" }, 401: { description: "Invalid admin secret" } }
+      }
+    },
+    "/onesub/admin/webhook-replay/{id}": {
+      post: {
+        summary: "Replay a dead-letter job through the webhook handler.",
+        parameters: [
+          { in: "header", name: "X-Admin-Secret", required: true, schema: { type: "string" } },
+          { in: "path", name: "id", required: true, schema: { type: "string" } }
+        ],
+        responses: { 200: { description: "OK" }, 401: { description: "Invalid admin secret" } }
+      }
+    }
+  },
+  components: {
+    schemas: {
+      ValidateRequest: {
+        type: "object",
+        required: ["userId", "platform", "productId", "receipt"],
+        properties: {
+          userId: { type: "string" },
+          platform: { type: "string", enum: ["apple", "google"] },
+          productId: { type: "string" },
+          receipt: { type: "string", description: "Apple JWS or Google purchaseToken" },
+          purchaseType: { type: "string", enum: ["subscription", "consumable", "non_consumable"] }
+        }
+      },
+      ValidateResponse: {
+        type: "object",
+        properties: {
+          valid: { type: "boolean" },
+          subscription: { $ref: "#/components/schemas/SubscriptionInfo" },
+          purchase: { $ref: "#/components/schemas/PurchaseInfo" }
+        }
+      },
+      StatusResponse: {
+        type: "object",
+        properties: {
+          active: { type: "boolean" },
+          subscription: { $ref: "#/components/schemas/SubscriptionInfo" }
+        }
+      },
+      SubscriptionInfo: {
+        type: "object",
+        properties: {
+          originalTransactionId: { type: "string" },
+          userId: { type: "string" },
+          productId: { type: "string" },
+          platform: { type: "string", enum: ["apple", "google"] },
+          status: { type: "string", enum: ["active", "grace_period", "on_hold", "paused", "expired", "canceled", "none"] },
+          expiresAt: { type: "string", format: "date-time" },
+          purchasedAt: { type: "string", format: "date-time" },
+          willRenew: { type: "boolean" }
+        }
+      },
+      PurchaseInfo: {
+        type: "object",
+        properties: {
+          transactionId: { type: "string" },
+          userId: { type: "string" },
+          productId: { type: "string" },
+          platform: { type: "string", enum: ["apple", "google"] },
+          type: { type: "string", enum: ["consumable", "non_consumable"] },
+          quantity: { type: "integer" },
+          purchasedAt: { type: "string", format: "date-time" }
+        }
+      }
+    },
+    securitySchemes: {
+      AdminSecret: {
+        type: "apiKey",
+        in: "header",
+        name: "X-Admin-Secret"
+      }
+    }
+  }
+};
+function openapiHandler() {
+  return (_req, res) => {
+    res.json(ONESUB_OPENAPI);
+  };
+}
+
+// src/tracing.ts
+var NOOP_SPAN = {
+  setAttribute: () => {
+  },
+  recordException: () => {
+  },
+  setStatus: () => {
+  },
+  end: () => {
+  }
+};
+var cachedTracer = null;
+var resolved = false;
+function getTracer() {
+  if (resolved) return cachedTracer;
+  resolved = true;
+  try {
+    const req = globalThis.require;
+    if (!req) return null;
+    const otel = req("@opentelemetry/api");
+    cachedTracer = otel.trace.getTracer("@onesub/server", "1.0.0");
+    return cachedTracer;
+  } catch {
+    return null;
+  }
+}
+async function withSpan(name, attributes, fn) {
+  const tracer = getTracer();
+  if (!tracer) return fn(NOOP_SPAN);
+  return tracer.startActiveSpan(name, async (span) => {
+    for (const [k, v] of Object.entries(attributes)) span.setAttribute(k, v);
+    try {
+      const result = await fn(span);
+      span.setStatus({ code: 1 });
+      return result;
+    } catch (err) {
+      span.recordException(err);
+      span.setStatus({ code: 2, message: err.message });
+      throw err;
+    } finally {
+      span.end();
+    }
+  });
+}
+
+// src/index.ts
+function createOneSubMiddleware(config) {
+  setLogger(config.logger);
+  if ((config.apple?.mockMode || config.google?.mockMode) && process.env["NODE_ENV"] === "production") {
+    throw new Error(
+      "[onesub] apple.mockMode / google.mockMode cannot be enabled when NODE_ENV=production \u2014 these modes accept any receipt as valid."
+    );
+  }
+  const store = config.store ?? new InMemorySubscriptionStore();
+  const purchaseStore = config.purchaseStore ?? new InMemoryPurchaseStore();
+  if (config.cache) setDefaultCache(config.cache);
+  const router = express.Router();
+  router.use(express__default.default.json({ limit: "50kb" }));
+  router.use(createValidateRouter(config, store));
+  router.use(createStatusRouter(store));
+  router.use(createWebhookRouter(config, store, purchaseStore, config.webhookEventStore));
+  router.use(createPurchaseRouter(config, purchaseStore));
+  const adminRouter = createAdminRouter(config, purchaseStore, store, config.webhookQueue);
+  if (adminRouter) router.use(adminRouter);
+  const entitlementRouter = createEntitlementRouter(config, store, purchaseStore);
+  if (entitlementRouter) router.use(entitlementRouter);
+  const metricsRouter = createMetricsRouter(config, store, purchaseStore);
+  if (metricsRouter) router.use(metricsRouter);
+  return router;
+}
+function createOneSubServer(config) {
+  const app = express__default.default();
+  app.get("/health", (_req, res) => {
+    res.json({ ok: true, service: "onesub" });
+  });
+  app.use(createOneSubMiddleware(config));
+  return app;
+}
+var isMain = typeof process !== "undefined" && process.argv[1] != null && new URL((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))).pathname.endsWith(process.argv[1].replace(/\\/g, "/"));
+if (isMain) {
+  const config = {
+    apple: process.env["APPLE_BUNDLE_ID"] ? {
+      bundleId: process.env["APPLE_BUNDLE_ID"],
+      sharedSecret: process.env["APPLE_SHARED_SECRET"],
+      keyId: process.env["APPLE_KEY_ID"],
+      issuerId: process.env["APPLE_ISSUER_ID"],
+      privateKey: process.env["APPLE_PRIVATE_KEY"]
+    } : void 0,
+    google: process.env["GOOGLE_PACKAGE_NAME"] ? {
+      packageName: process.env["GOOGLE_PACKAGE_NAME"],
+      serviceAccountKey: process.env["GOOGLE_SERVICE_ACCOUNT_KEY"]
+    } : void 0,
+    database: {
+      url: process.env["DATABASE_URL"] ?? ""
+    },
+    webhookSecret: process.env["WEBHOOK_SECRET"]
+  };
+  const port = process.env["PORT"] ? parseInt(process.env["PORT"], 10) : shared.DEFAULT_PORT;
+  createOneSubServer(config).listen(port, () => {
+    console.log(`[onesub] Server listening on port ${port}`);
+  });
+}
+
+exports.BullMQWebhookQueue = BullMQWebhookQueue;
+exports.CacheWebhookEventStore = CacheWebhookEventStore;
+exports.InMemoryCacheAdapter = InMemoryCacheAdapter;
+exports.InMemoryPurchaseStore = InMemoryPurchaseStore;
+exports.InMemorySubscriptionStore = InMemorySubscriptionStore;
+exports.InMemoryWebhookEventStore = InMemoryWebhookEventStore;
+exports.InProcessWebhookQueue = InProcessWebhookQueue;
+exports.ONESUB_OPENAPI = ONESUB_OPENAPI;
+exports.PostgresPurchaseStore = PostgresPurchaseStore;
+exports.PostgresSubscriptionStore = PostgresSubscriptionStore;
+exports.RedisCacheAdapter = RedisCacheAdapter;
+exports.RedisPurchaseStore = RedisPurchaseStore;
+exports.RedisSubscriptionStore = RedisSubscriptionStore;
+exports.RedisWebhookEventStore = RedisWebhookEventStore;
+exports.createOneSubMiddleware = createOneSubMiddleware;
+exports.createOneSubServer = createOneSubServer;
+exports.evaluateEntitlement = evaluateEntitlement;
+exports.fetchAppleSubscriptionStatus = fetchAppleSubscriptionStatus;
+exports.getDefaultCache = getDefaultCache;
+exports.log = log;
+exports.openapiHandler = openapiHandler;
+exports.setDefaultCache = setDefaultCache;
+exports.setLogger = setLogger;
+exports.validateAppleReceipt = validateAppleReceipt;
+exports.validateGoogleReceipt = validateGoogleReceipt;
+exports.withSpan = withSpan;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map