@onesub/server 0.12.0 → 0.12.1

package/dist/index.d.ts

@@ -85,5 +85,4 @@ export { validateAppleReceipt, fetchAppleSubscriptionStatus } from './providers/
 export { validateGoogleReceipt } from './providers/google.js';
 export { evaluateEntitlement } from './routes/entitlements.js';
 export { setLogger, log } from './logger.js';
-export default createOneSubMiddleware;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AASnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE;;;OAGG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CA6C7E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAW7F;AAGD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGpF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAI/D,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAG7C,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AASnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE;;;OAGG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CA6C7E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAW7F;AAGD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGpF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAI/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAI/D,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -723,6 +723,7 @@ async function fetchProductPurchase(packageName, productId, purchaseToken, acces
 async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
   if (config.mockMode) return;
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -748,6 +749,7 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
 async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
   if (config.mockMode) return;
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -772,6 +774,7 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
 }
 async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -819,6 +822,10 @@ async function validateGoogleReceipt(receipt, productId, config) {
     log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API");
     return null;
   }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API");
+    return null;
+  }
   let purchase;
   try {
     const token = await getCachedAccessToken(config.serviceAccountKey);
@@ -871,6 +878,10 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
     log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt");
     return null;
   }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt");
+    return null;
+  }
   let purchase;
   try {
     const token = await getCachedAccessToken(config.serviceAccountKey);
@@ -1063,41 +1074,9 @@ function createStatusRouter(store) {
   });
   return router;
 }
-var GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs";
-var googleJwks = null;
-function getGoogleJwks() {
-  if (!googleJwks) {
-    googleJwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
-  }
-  return googleJwks;
-}
-async function verifyGooglePushToken(req, expectedAudience) {
-  const authHeader = req.headers["authorization"];
-  if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) {
-    return false;
-  }
-  const token = authHeader.slice("Bearer ".length).trim();
-  try {
-    await jwtVerify(token, getGoogleJwks(), { audience: expectedAudience });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set([
-  "SUBSCRIBED",
-  "DID_RENEW",
-  "DID_RECOVER",
-  "OFFER_REDEEMED"
-]);
-var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set([
-  "REVOKE",
-  "REFUND",
-  "CONSUMPTION_REQUEST"
-]);
-var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set([
-  "EXPIRED"
-]);
+var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set(["SUBSCRIBED", "DID_RENEW", "DID_RECOVER", "OFFER_REDEEMED"]);
+var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND", "CONSUMPTION_REQUEST"]);
+var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set(["EXPIRED"]);
 function mapAppleNotificationStatus(notificationType, subtype) {
   if (notificationType === "DID_FAIL_TO_RENEW") {
     return subtype === "GRACE_PERIOD" ? SUBSCRIPTION_STATUS.GRACE_PERIOD : SUBSCRIPTION_STATUS.ON_HOLD;
@@ -1108,283 +1087,278 @@ function mapAppleNotificationStatus(notificationType, subtype) {
   if (APPLE_ACTIVE_TYPES.has(notificationType)) return SUBSCRIPTION_STATUS.ACTIVE;
   return null;
 }
-function createWebhookRouter(config, store, purchaseStore, webhookEventStore) {
-  const router = Router();
-  router.post(ROUTES.WEBHOOK_APPLE, async (req, res) => {
-    const body = req.body;
-    if (!body.signedPayload) {
-      sendError(res, 400, ONESUB_ERROR_CODE.MISSING_SIGNED_PAYLOAD, "Missing signedPayload");
-      return;
-    }
-    let payload;
-    try {
-      payload = await decodeJws(
-        body.signedPayload,
-        config.apple?.skipJwsVerification
-      );
-    } catch (err) {
-      log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err);
-      sendError(res, 400, ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
-      return;
-    }
-    if (webhookEventStore && typeof payload.notificationUUID === "string") {
-      const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
-      if (!fresh) {
-        log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
-        res.status(200).json({ received: true, deduped: true });
-        return;
-      }
-    }
-    const decoded = await decodeAppleNotification(payload, config.apple?.skipJwsVerification);
-    if (!decoded) {
-      res.status(200).json({ received: true });
+async function handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  const body = req.body;
+  if (!body.signedPayload) {
+    sendError(res, 400, ONESUB_ERROR_CODE.MISSING_SIGNED_PAYLOAD, "Missing signedPayload");
+    return;
+  }
+  let payload;
+  try {
+    payload = await decodeJws(
+      body.signedPayload,
+      config.apple?.skipJwsVerification
+    );
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err);
+    sendError(res, 400, ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
+    return;
+  }
+  if (webhookEventStore && typeof payload.notificationUUID === "string") {
+    const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
+    if (!fresh) {
+      log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
+      res.status(200).json({ received: true, deduped: true });
       return;
     }
-    const {
-      originalTransactionId,
-      transactionId,
-      type,
-      productId,
-      bundleId,
-      environment,
-      status,
-      willRenew,
-      expiresAt
-    } = decoded;
-    const notificationType = payload.notificationType;
-    const subtype = payload.subtype;
-    const mapped = mapAppleNotificationStatus(notificationType, subtype);
-    const finalStatus = mapped ?? status;
-    if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
-      const provider = config.apple.consumptionInfoProvider;
-      const appleConfig = config.apple;
-      void (async () => {
-        try {
-          const info = await provider({
-            transactionId,
-            originalTransactionId,
-            productId,
-            bundleId: bundleId ?? appleConfig.bundleId,
-            environment
+  }
+  const decoded = await decodeAppleNotification(payload, config.apple?.skipJwsVerification);
+  if (!decoded) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const {
+    originalTransactionId,
+    transactionId,
+    type,
+    productId,
+    bundleId,
+    environment,
+    status,
+    willRenew,
+    expiresAt
+  } = decoded;
+  const notificationType = payload.notificationType;
+  const subtype = payload.subtype;
+  const mapped = mapAppleNotificationStatus(notificationType, subtype);
+  const finalStatus = mapped ?? status;
+  if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
+    const provider = config.apple.consumptionInfoProvider;
+    const appleConfig = config.apple;
+    void (async () => {
+      try {
+        const info = await provider({
+          transactionId,
+          originalTransactionId,
+          productId,
+          bundleId: bundleId ?? appleConfig.bundleId,
+          environment
+        });
+        if (info) {
+          await sendAppleConsumptionResponse(transactionId, info, appleConfig, {
+            sandbox: environment === "Sandbox"
           });
-          if (info) {
-            await sendAppleConsumptionResponse(transactionId, info, appleConfig, {
-              sandbox: environment === "Sandbox"
-            });
-          }
-        } catch (err) {
-          log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err);
         }
-      })();
-    }
-    const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
-    const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
-    try {
-      if (isOneTimePurchase && isRefundOrRevoke) {
-        const lookupId = transactionId ?? originalTransactionId;
-        const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
-        if (!removed) {
-          log.warn(
-            "[onesub/webhook/apple] IAP refund for unknown transaction:",
-            lookupId
-          );
-        }
-        res.status(200).json({ received: true });
-        return;
+      } catch (err) {
+        log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err);
       }
-      const existing = await store.getByTransactionId(originalTransactionId);
-      if (existing) {
-        const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
-        const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
-        const updated = keepEntitlement ? { ...existing, willRenew: false } : {
-          ...existing,
-          status: finalStatus,
-          willRenew,
-          // expiresAt may be absent on non-subscription payloads — keep the
-          // previously-stored value rather than overwriting with null/empty.
-          expiresAt: expiresAt ?? existing.expiresAt
-        };
-        await store.save(updated);
-      } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
-        const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
-          sandbox: environment === "Sandbox"
-        });
-        if (fresh) {
-          fresh.userId = originalTransactionId;
-          await store.save(fresh);
-        } else {
-          log.warn(
-            "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
-            originalTransactionId
-          );
-        }
-      } else {
-        log.warn(
-          "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
-          originalTransactionId
-        );
+    })();
+  }
+  const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
+  const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
+  try {
+    if (isOneTimePurchase && isRefundOrRevoke) {
+      const lookupId = transactionId ?? originalTransactionId;
+      const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
+      if (!removed) {
+        log.warn("[onesub/webhook/apple] IAP refund for unknown transaction:", lookupId);
       }
       res.status(200).json({ received: true });
-    } catch (err) {
-      log.error("[onesub/webhook/apple] Store update error:", err);
-      sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
-    }
-  });
-  router.post(ROUTES.WEBHOOK_GOOGLE, async (req, res) => {
-    if (config.google?.pushAudience) {
-      const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
-      if (!authenticated) {
-        sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
-        return;
-      }
-    }
-    const body = req.body;
-    if (!body.message?.data) {
-      sendError(res, 400, ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
       return;
     }
-    if (webhookEventStore && typeof body.message.messageId === "string") {
-      const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
-      if (!fresh) {
-        log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
-        res.status(200).json({ received: true, deduped: true });
-        return;
-      }
-    }
-    const voided = decodeGoogleVoidedNotification(body);
-    if (voided) {
-      if (config.google?.packageName && voided.packageName !== config.google.packageName) {
+    const existing = await store.getByTransactionId(originalTransactionId);
+    if (existing) {
+      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
+      const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
+      const updated = keepEntitlement ? { ...existing, willRenew: false } : {
+        ...existing,
+        status: finalStatus,
+        willRenew,
+        expiresAt: expiresAt ?? existing.expiresAt
+      };
+      await store.save(updated);
+    } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
+      const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
+        sandbox: environment === "Sandbox"
+      });
+      if (fresh) {
+        fresh.userId = originalTransactionId;
+        await store.save(fresh);
+      } else {
         log.warn(
-          "[onesub/webhook/google] voided package name mismatch:",
-          voided.packageName,
-          "!==",
-          config.google.packageName
+          "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
+          originalTransactionId
         );
-        sendError(res, 400, ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
-        return;
-      }
-      try {
-        if (voided.productType === 1) {
-          const existing = await store.getByTransactionId(voided.purchaseToken);
-          if (existing) {
-            const updated = config.refundPolicy === "until_expiry" ? { ...existing, willRenew: false } : { ...existing, status: SUBSCRIPTION_STATUS.CANCELED };
-            await store.save(updated);
-          } else {
-            log.warn(
-              "[onesub/webhook/google] voided subscription for unknown purchaseToken:",
-              voided.purchaseToken
-            );
-          }
-        } else {
-          const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
-          if (!removed) {
-            log.warn(
-              "[onesub/webhook/google] voided IAP for unknown orderId:",
-              voided.orderId
-            );
-          }
-        }
-        res.status(200).json({ received: true });
-      } catch (err) {
-        log.error("[onesub/webhook/google] voided notification error:", err);
-        sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
       }
+    } else {
+      log.warn(
+        "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
+        originalTransactionId
+      );
+    }
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Store update error:", err);
+    sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
+  }
+}
+var GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+var googleJwks = null;
+function getGoogleJwks() {
+  if (!googleJwks) googleJwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
+  return googleJwks;
+}
+async function verifyGooglePushToken(req, expectedAudience) {
+  const authHeader = req.headers["authorization"];
+  if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) return false;
+  try {
+    await jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
+      audience: expectedAudience
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  if (config.google?.pushAudience) {
+    const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
+    if (!authenticated) {
+      sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
       return;
     }
-    const notification = decodeGoogleNotification(body);
-    if (!notification) {
-      res.status(200).json({ received: true });
+  }
+  const body = req.body;
+  if (!body.message?.data) {
+    sendError(res, 400, ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
+    return;
+  }
+  if (webhookEventStore && typeof body.message.messageId === "string") {
+    const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
+    if (!fresh) {
+      log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
+      res.status(200).json({ received: true, deduped: true });
       return;
     }
-    const { notificationType, purchaseToken, subscriptionId, packageName } = notification;
-    if (config.google?.packageName && packageName !== config.google.packageName) {
-      log.warn(
-        "[onesub/webhook/google] Package name mismatch:",
-        packageName,
-        "!==",
-        config.google.packageName
-      );
+  }
+  const voided = decodeGoogleVoidedNotification(body);
+  if (voided) {
+    if (config.google?.packageName && voided.packageName !== config.google.packageName) {
+      log.warn("[onesub/webhook/google] voided package name mismatch:", voided.packageName, "!==", config.google.packageName);
       sendError(res, 400, ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
       return;
     }
     try {
-      const existing = await store.getByTransactionId(purchaseToken);
-      let finalStatus;
-      if (isGoogleActiveNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
-      } else if (isGoogleGracePeriodNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.GRACE_PERIOD;
-      } else if (isGoogleOnHoldNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.ON_HOLD;
-      } else if (isGooglePausedNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.PAUSED;
-      } else if (isGooglePriceChangeConfirmedNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
-      } else if (isGoogleCanceledNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.CANCELED;
-      } else if (isGoogleExpiredNotification(notificationType)) {
-        finalStatus = SUBSCRIPTION_STATUS.EXPIRED;
+      if (voided.productType === 1) {
+        const existing = await store.getByTransactionId(voided.purchaseToken);
+        if (existing) {
+          const updated = config.refundPolicy === "until_expiry" ? { ...existing, willRenew: false } : { ...existing, status: SUBSCRIPTION_STATUS.CANCELED };
+          await store.save(updated);
+        } else {
+          log.warn("[onesub/webhook/google] voided subscription for unknown purchaseToken:", voided.purchaseToken);
+        }
       } else {
-        finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
-      }
-      if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
-        const hook = config.google.onPriceChangeConfirmed;
-        void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err));
+        const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
+        if (!removed) {
+          log.warn("[onesub/webhook/google] voided IAP for unknown orderId:", voided.orderId);
+        }
       }
-      if (existing) {
-        let updated = { ...existing, status: finalStatus };
-        if (config.google?.serviceAccountKey) {
-          const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
-          if (fresh) {
-            const preserveNotificationStatus = finalStatus === SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === SUBSCRIPTION_STATUS.ON_HOLD;
-            updated = {
-              ...existing,
-              status: preserveNotificationStatus ? finalStatus : fresh.status,
-              expiresAt: fresh.expiresAt,
-              willRenew: fresh.willRenew,
-              // Propagate v2-only fields that fresh may have updated. Without
-              // these, paused→active transitions left autoResumeTime stale and
-              // upgrade chains lost their linkedPurchaseToken on subsequent
-              // notifications. Use ?? undefined so cleared values become undefined
-              // (e.g. resume from paused → autoResumeTime should disappear).
-              autoResumeTime: fresh.autoResumeTime,
-              linkedPurchaseToken: fresh.linkedPurchaseToken ?? existing.linkedPurchaseToken
-            };
-          }
+      res.status(200).json({ received: true });
+    } catch (err) {
+      log.error("[onesub/webhook/google] voided notification error:", err);
+      sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
+    }
+    return;
+  }
+  const notification = decodeGoogleNotification(body);
+  if (!notification) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const { notificationType, purchaseToken, subscriptionId, packageName } = notification;
+  if (config.google?.packageName && packageName !== config.google.packageName) {
+    log.warn("[onesub/webhook/google] Package name mismatch:", packageName, "!==", config.google.packageName);
+    sendError(res, 400, ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+    return;
+  }
+  try {
+    const existing = await store.getByTransactionId(purchaseToken);
+    let finalStatus;
+    if (isGoogleActiveNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleGracePeriodNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    } else if (isGoogleOnHoldNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.ON_HOLD;
+    } else if (isGooglePausedNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.PAUSED;
+    } else if (isGooglePriceChangeConfirmedNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleCanceledNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.CANCELED;
+    } else if (isGoogleExpiredNotification(notificationType)) {
+      finalStatus = SUBSCRIPTION_STATUS.EXPIRED;
+    } else {
+      finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
+    }
+    if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
+      const hook = config.google.onPriceChangeConfirmed;
+      void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err));
+    }
+    if (existing) {
+      let updated = { ...existing, status: finalStatus };
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          const preserveNotificationStatus = finalStatus === SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === SUBSCRIPTION_STATUS.ON_HOLD;
+          updated = {
+            ...existing,
+            status: preserveNotificationStatus ? finalStatus : fresh.status,
+            expiresAt: fresh.expiresAt,
+            willRenew: fresh.willRenew,
+            autoResumeTime: fresh.autoResumeTime,
+            linkedPurchaseToken: fresh.linkedPurchaseToken ?? existing.linkedPurchaseToken
+          };
         }
-        await store.save(updated);
-      } else {
-        if (config.google?.serviceAccountKey) {
-          const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
-          if (fresh) {
-            if (fresh.linkedPurchaseToken) {
-              const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
-              if (previous) {
-                fresh.userId = previous.userId;
-                log.info(
-                  `[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`
-                );
-              } else {
-                fresh.userId = purchaseToken;
-              }
-            } else {
-              fresh.userId = purchaseToken;
+      }
+      await store.save(updated);
+    } else {
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          if (fresh.linkedPurchaseToken) {
+            const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
+            fresh.userId = previous ? previous.userId : purchaseToken;
+            if (previous) {
+              log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
             }
-            await store.save(fresh);
+          } else {
+            fresh.userId = purchaseToken;
           }
-        } else {
-          log.warn(
-            "[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:",
-            purchaseToken
-          );
+          await store.save(fresh);
         }
+      } else {
+        log.warn("[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:", purchaseToken);
       }
-      res.status(200).json({ received: true });
-    } catch (err) {
-      log.error("[onesub/webhook/google] Error handling notification:", err);
-      sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
     }
-  });
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/google] Error handling notification:", err);
+    sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
+  }
+}
+
+// src/routes/webhook.ts
+function createWebhookRouter(config, store, purchaseStore, webhookEventStore) {
+  const router = Router();
+  router.post(
+    ROUTES.WEBHOOK_APPLE,
+    (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
+  router.post(
+    ROUTES.WEBHOOK_GOOGLE,
+    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
   return router;
 }
 var NO_PURCHASE = { valid: false, purchase: null };
@@ -3048,7 +3022,6 @@ function createOneSubServer(config) {
   app.use(createOneSubMiddleware(config));
   return app;
 }
-var index_default = createOneSubMiddleware;
 var isMain = typeof process !== "undefined" && process.argv[1] != null && new URL(import.meta.url).pathname.endsWith(process.argv[1].replace(/\\/g, "/"));
 if (isMain) {
   const config = {
@@ -3074,6 +3047,6 @@ if (isMain) {
   });
 }
 
-export { BullMQWebhookQueue, CacheWebhookEventStore, InMemoryCacheAdapter, InMemoryPurchaseStore, InMemorySubscriptionStore, InMemoryWebhookEventStore, InProcessWebhookQueue, ONESUB_OPENAPI, PostgresPurchaseStore, PostgresSubscriptionStore, RedisCacheAdapter, RedisPurchaseStore, RedisSubscriptionStore, RedisWebhookEventStore, createOneSubMiddleware, createOneSubServer, index_default as default, evaluateEntitlement, fetchAppleSubscriptionStatus, getDefaultCache, log, openapiHandler, setDefaultCache, setLogger, validateAppleReceipt, validateGoogleReceipt, withSpan };
+export { BullMQWebhookQueue, CacheWebhookEventStore, InMemoryCacheAdapter, InMemoryPurchaseStore, InMemorySubscriptionStore, InMemoryWebhookEventStore, InProcessWebhookQueue, ONESUB_OPENAPI, PostgresPurchaseStore, PostgresSubscriptionStore, RedisCacheAdapter, RedisPurchaseStore, RedisSubscriptionStore, RedisWebhookEventStore, createOneSubMiddleware, createOneSubServer, evaluateEntitlement, fetchAppleSubscriptionStatus, getDefaultCache, log, openapiHandler, setDefaultCache, setLogger, validateAppleReceipt, validateGoogleReceipt, withSpan };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map