@onesub/server 0.12.0 → 0.13.0

package/dist/index.cjs

@@ -1,7 +1,5 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 var express = require('express');
 var shared = require('@onesub/shared');
 var zod = require('zod');
@@ -479,7 +477,9 @@ async function decodeAppleNotification(payload, skipJwsVerification = false) {
     environment,
     status,
     willRenew,
-    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null
+    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
+    appAccountToken: tx.appAccountToken ?? null,
+    inAppOwnershipType: tx.inAppOwnershipType ?? null
   };
 }
 var appleJwtMintPromises = /* @__PURE__ */ new Map();
@@ -625,6 +625,91 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     willRenew: renewal?.autoRenewStatus === 1
   };
 }
+async function fetchAppleTransactionHistory(originalTransactionId, config, options) {
+  if (config.mockMode) return null;
+  let jwt;
+  try {
+    jwt = await makeAppleApiJwt(config);
+  } catch (err) {
+    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed:", err);
+    return null;
+  }
+  const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
+  const results = [];
+  let revision;
+  for (; ; ) {
+    const url = new URL(`https://${host}/inApps/v2/history/${encodeURIComponent(originalTransactionId)}`);
+    if (revision) url.searchParams.set("revision", revision);
+    let page;
+    try {
+      const resp = await fetchWithTimeout(url.toString(), {
+        headers: { Authorization: `Bearer ${jwt}` }
+      });
+      if (!resp.ok) {
+        const text = await resp.text();
+        log.warn(`[onesub/apple] Transaction History API error ${resp.status}: ${text}`);
+        return null;
+      }
+      page = await resp.json();
+    } catch (err) {
+      log.warn("[onesub/apple] Transaction History API network error:", err);
+      return null;
+    }
+    for (const signed of page.signedTransactions ?? []) {
+      try {
+        const tx = await decodeJws(signed, config.skipJwsVerification);
+        if (!tx.originalTransactionId || !tx.transactionId || !tx.productId) continue;
+        results.push({
+          originalTransactionId: tx.originalTransactionId,
+          transactionId: tx.transactionId,
+          productId: tx.productId,
+          type: tx.type ?? "Unknown",
+          purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+          expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
+          appAccountToken: tx.appAccountToken ?? null,
+          inAppOwnershipType: tx.inAppOwnershipType ?? null,
+          revocationDate: tx.revocationDate ? new Date(tx.revocationDate).toISOString() : null
+        });
+      } catch {
+      }
+    }
+    if (!page.hasMore) break;
+    revision = page.revision;
+  }
+  return results;
+}
+async function signApplePromotionalOffer(input, config) {
+  const { offerKeyId, offerPrivateKey } = config;
+  if (!offerKeyId || !offerPrivateKey) {
+    throw new Error("[onesub/apple] Promotional Offer signing requires config.apple.offerKeyId and config.apple.offerPrivateKey");
+  }
+  const nonce = crypto.randomUUID().toLowerCase();
+  const timestamp = Date.now();
+  const separator = "\u2063";
+  const message = [
+    input.bundleId,
+    offerKeyId,
+    input.productId,
+    input.offerId,
+    input.applicationUsername,
+    nonce,
+    String(timestamp)
+  ].join(separator);
+  if (!offerPrivateKey.includes("BEGIN") || !offerPrivateKey.includes("END")) {
+    throw new Error("[onesub/apple] offerPrivateKey does not appear to be PEM-encoded");
+  }
+  let signatureBuffer;
+  try {
+    const sign = crypto.createSign("SHA256");
+    sign.update(message);
+    sign.end();
+    signatureBuffer = sign.sign(offerPrivateKey);
+  } catch (err) {
+    throw new Error(`[onesub/apple] Failed to sign promotional offer \u2014 check that offerPrivateKey is a valid ES256 PEM key: ${err.message}`);
+  }
+  const signature = signatureBuffer.toString("base64");
+  return { keyId: offerKeyId, nonce, timestamp, signature };
+}
 var GOOGLE_NOTIFICATION_TYPE = {
   SUBSCRIPTION_RECOVERED: 1,
   SUBSCRIPTION_RENEWED: 2,
@@ -687,8 +772,8 @@ async function getAccessToken(serviceAccountKey) {
     })
   ).toString("base64url");
   const signingInput = `${header}.${payload}`;
-  const { createSign } = await import('crypto');
-  const sign = createSign("RSA-SHA256");
+  const { createSign: createSign2 } = await import('crypto');
+  const sign = createSign2("RSA-SHA256");
   sign.update(signingInput);
   const signature = sign.sign(key.private_key, "base64url");
   const assertion = `${signingInput}.${signature}`;
@@ -732,6 +817,7 @@ async function fetchProductPurchase(packageName, productId, purchaseToken, acces
 async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
   if (config.mockMode) return;
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -757,6 +843,7 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
 async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
   if (config.mockMode) return;
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -781,6 +868,7 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
 }
 async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
   if (!config.serviceAccountKey) return;
+  if (!config.packageName) return;
   let accessToken;
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
@@ -828,6 +916,10 @@ async function validateGoogleReceipt(receipt, productId, config) {
     log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API");
     return null;
   }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API");
+    return null;
+  }
   let purchase;
   try {
     const token = await getCachedAccessToken(config.serviceAccountKey);
@@ -880,6 +972,10 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
     log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt");
     return null;
   }
+  if (!config.packageName) {
+    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt");
+    return null;
+  }
   let purchase;
   try {
     const token = await getCachedAccessToken(config.serviceAccountKey);
@@ -949,6 +1045,22 @@ function decodeGoogleVoidedNotification(payload) {
     packageName: notification.packageName
   };
 }
+function decodeGoogleOneTimeProductNotification(payload) {
+  let notification;
+  try {
+    const json = Buffer.from(payload.message.data, "base64").toString("utf-8");
+    notification = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!notification.oneTimeProductNotification) return null;
+  const { notificationType, purchaseToken, sku } = notification.oneTimeProductNotification;
+  if (notificationType !== 1 && notificationType !== 2) {
+    log.warn("[onesub/google] Unknown oneTimeProductNotification type:", notificationType);
+    return null;
+  }
+  return { notificationType, purchaseToken, sku, packageName: notification.packageName };
+}
 function isGoogleActiveNotification(notificationType) {
   return notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_PURCHASED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RENEWED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RECOVERED || notificationType === GOOGLE_NOTIFICATION_TYPE.SUBSCRIPTION_RESTARTED;
 }
@@ -1072,41 +1184,9 @@ function createStatusRouter(store) {
   });
   return router;
 }
-var GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs";
-var googleJwks = null;
-function getGoogleJwks() {
-  if (!googleJwks) {
-    googleJwks = jose.createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
-  }
-  return googleJwks;
-}
-async function verifyGooglePushToken(req, expectedAudience) {
-  const authHeader = req.headers["authorization"];
-  if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) {
-    return false;
-  }
-  const token = authHeader.slice("Bearer ".length).trim();
-  try {
-    await jose.jwtVerify(token, getGoogleJwks(), { audience: expectedAudience });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set([
-  "SUBSCRIBED",
-  "DID_RENEW",
-  "DID_RECOVER",
-  "OFFER_REDEEMED"
-]);
-var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set([
-  "REVOKE",
-  "REFUND",
-  "CONSUMPTION_REQUEST"
-]);
-var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set([
-  "EXPIRED"
-]);
+var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set(["SUBSCRIBED", "DID_RENEW", "DID_RECOVER", "OFFER_REDEEMED"]);
+var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND", "CONSUMPTION_REQUEST"]);
+var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set(["EXPIRED"]);
 function mapAppleNotificationStatus(notificationType, subtype) {
   if (notificationType === "DID_FAIL_TO_RENEW") {
     return subtype === "GRACE_PERIOD" ? shared.SUBSCRIPTION_STATUS.GRACE_PERIOD : shared.SUBSCRIPTION_STATUS.ON_HOLD;
@@ -1117,283 +1197,315 @@ function mapAppleNotificationStatus(notificationType, subtype) {
   if (APPLE_ACTIVE_TYPES.has(notificationType)) return shared.SUBSCRIPTION_STATUS.ACTIVE;
   return null;
 }
-function createWebhookRouter(config, store, purchaseStore, webhookEventStore) {
-  const router = express.Router();
-  router.post(shared.ROUTES.WEBHOOK_APPLE, async (req, res) => {
-    const body = req.body;
-    if (!body.signedPayload) {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_SIGNED_PAYLOAD, "Missing signedPayload");
-      return;
-    }
-    let payload;
-    try {
-      payload = await decodeJws(
-        body.signedPayload,
-        config.apple?.skipJwsVerification
-      );
-    } catch (err) {
-      log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err);
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
+async function handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  const body = req.body;
+  if (!body.signedPayload) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_SIGNED_PAYLOAD, "Missing signedPayload");
+    return;
+  }
+  let payload;
+  try {
+    payload = await decodeJws(
+      body.signedPayload,
+      config.apple?.skipJwsVerification
+    );
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err);
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
+    return;
+  }
+  if (webhookEventStore && typeof payload.notificationUUID === "string") {
+    const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
+    if (!fresh) {
+      log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
+      res.status(200).json({ received: true, deduped: true });
       return;
     }
-    if (webhookEventStore && typeof payload.notificationUUID === "string") {
-      const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
-      if (!fresh) {
-        log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
-        res.status(200).json({ received: true, deduped: true });
-        return;
+  }
+  const decoded = await decodeAppleNotification(payload, config.apple?.skipJwsVerification);
+  if (!decoded) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const {
+    originalTransactionId,
+    transactionId,
+    type,
+    productId,
+    bundleId,
+    environment,
+    status,
+    willRenew,
+    expiresAt,
+    appAccountToken,
+    inAppOwnershipType
+  } = decoded;
+  const notificationType = payload.notificationType;
+  const subtype = payload.subtype;
+  const mapped = mapAppleNotificationStatus(notificationType, subtype);
+  const finalStatus = mapped ?? status;
+  if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
+    const provider = config.apple.consumptionInfoProvider;
+    const appleConfig = config.apple;
+    void (async () => {
+      try {
+        const info = await provider({
+          transactionId,
+          originalTransactionId,
+          productId,
+          bundleId: bundleId ?? appleConfig.bundleId,
+          environment
+        });
+        if (info) {
+          await sendAppleConsumptionResponse(transactionId, info, appleConfig, {
+            sandbox: environment === "Sandbox"
+          });
+        }
+      } catch (err) {
+        log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err);
+      }
+    })();
+  }
+  const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
+  const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
+  try {
+    if (isOneTimePurchase && isRefundOrRevoke) {
+      const lookupId = transactionId ?? originalTransactionId;
+      const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
+      if (!removed) {
+        log.warn("[onesub/webhook/apple] IAP refund for unknown transaction:", lookupId);
       }
-    }
-    const decoded = await decodeAppleNotification(payload, config.apple?.skipJwsVerification);
-    if (!decoded) {
       res.status(200).json({ received: true });
       return;
     }
-    const {
-      originalTransactionId,
-      transactionId,
-      type,
-      productId,
-      bundleId,
-      environment,
-      status,
-      willRenew,
-      expiresAt
-    } = decoded;
-    const notificationType = payload.notificationType;
-    const subtype = payload.subtype;
-    const mapped = mapAppleNotificationStatus(notificationType, subtype);
-    const finalStatus = mapped ?? status;
-    if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
-      const provider = config.apple.consumptionInfoProvider;
-      const appleConfig = config.apple;
-      void (async () => {
-        try {
-          const info = await provider({
-            transactionId,
-            originalTransactionId,
-            productId,
-            bundleId: bundleId ?? appleConfig.bundleId,
-            environment
-          });
-          if (info) {
-            await sendAppleConsumptionResponse(transactionId, info, appleConfig, {
-              sandbox: environment === "Sandbox"
-            });
-          }
-        } catch (err) {
-          log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err);
-        }
-      })();
-    }
-    const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
-    const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
-    try {
-      if (isOneTimePurchase && isRefundOrRevoke) {
-        const lookupId = transactionId ?? originalTransactionId;
-        const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
-        if (!removed) {
-          log.warn(
-            "[onesub/webhook/apple] IAP refund for unknown transaction:",
-            lookupId
-          );
-        }
-        res.status(200).json({ received: true });
-        return;
+    const existing = await store.getByTransactionId(originalTransactionId);
+    if (existing) {
+      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
+      const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
+      const correctedUserId = appAccountToken && existing.userId === originalTransactionId ? appAccountToken : existing.userId;
+      if (correctedUserId !== existing.userId) {
+        log.info("[onesub/webhook/apple] correcting userId from originalTransactionId to appAccountToken:", correctedUserId);
       }
-      const existing = await store.getByTransactionId(originalTransactionId);
-      if (existing) {
-        const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
-        const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
-        const updated = keepEntitlement ? { ...existing, willRenew: false } : {
-          ...existing,
-          status: finalStatus,
-          willRenew,
-          // expiresAt may be absent on non-subscription payloads — keep the
-          // previously-stored value rather than overwriting with null/empty.
-          expiresAt: expiresAt ?? existing.expiresAt
-        };
-        await store.save(updated);
-      } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
-        const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
-          sandbox: environment === "Sandbox"
-        });
-        if (fresh) {
-          fresh.userId = originalTransactionId;
-          await store.save(fresh);
-        } else {
-          log.warn(
-            "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
-            originalTransactionId
-          );
+      const updated = keepEntitlement ? { ...existing, userId: correctedUserId, willRenew: false } : {
+        ...existing,
+        userId: correctedUserId,
+        status: finalStatus,
+        willRenew,
+        expiresAt: expiresAt ?? existing.expiresAt
+      };
+      await store.save(updated);
+    } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
+      const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
+        sandbox: environment === "Sandbox"
+      });
+      if (fresh) {
+        fresh.userId = appAccountToken ?? originalTransactionId;
+        if (inAppOwnershipType === "FAMILY_SHARED") {
+          const source = appAccountToken ? "appAccountToken" : "originalTransactionId (fallback)";
+          log.info(`[onesub/webhook/apple] FAMILY_SHARED \u2014 userId: ${fresh.userId} (source: ${source})`);
         }
+        await store.save(fresh);
       } else {
         log.warn(
-          "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
+          "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
           originalTransactionId
         );
       }
-      res.status(200).json({ received: true });
-    } catch (err) {
-      log.error("[onesub/webhook/apple] Store update error:", err);
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
+    } else {
+      log.warn(
+        "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
+        originalTransactionId
+      );
     }
-  });
-  router.post(shared.ROUTES.WEBHOOK_GOOGLE, async (req, res) => {
-    if (config.google?.pushAudience) {
-      const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
-      if (!authenticated) {
-        sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
-        return;
-      }
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/apple] Store update error:", err);
+    sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
+  }
+}
+var GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs";
+var googleJwks = null;
+function getGoogleJwks() {
+  if (!googleJwks) googleJwks = jose.createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
+  return googleJwks;
+}
+async function verifyGooglePushToken(req, expectedAudience) {
+  const authHeader = req.headers["authorization"];
+  if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) return false;
+  try {
+    await jose.jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
+      audience: expectedAudience
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
+  if (config.google?.pushAudience) {
+    const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
+    if (!authenticated) {
+      sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+      return;
     }
-    const body = req.body;
-    if (!body.message?.data) {
-      sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
+  }
+  const body = req.body;
+  if (!body.message?.data) {
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
+    return;
+  }
+  if (webhookEventStore && typeof body.message.messageId === "string") {
+    const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
+    if (!fresh) {
+      log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
+      res.status(200).json({ received: true, deduped: true });
       return;
     }
-    if (webhookEventStore && typeof body.message.messageId === "string") {
-      const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
-      if (!fresh) {
-        log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
-        res.status(200).json({ received: true, deduped: true });
-        return;
-      }
+  }
+  const voided = decodeGoogleVoidedNotification(body);
+  if (voided) {
+    if (config.google?.packageName && voided.packageName !== config.google.packageName) {
+      log.warn("[onesub/webhook/google] voided package name mismatch:", voided.packageName, "!==", config.google.packageName);
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+      return;
     }
-    const voided = decodeGoogleVoidedNotification(body);
-    if (voided) {
-      if (config.google?.packageName && voided.packageName !== config.google.packageName) {
-        log.warn(
-          "[onesub/webhook/google] voided package name mismatch:",
-          voided.packageName,
-          "!==",
-          config.google.packageName
-        );
-        sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
-        return;
-      }
-      try {
-        if (voided.productType === 1) {
-          const existing = await store.getByTransactionId(voided.purchaseToken);
-          if (existing) {
-            const updated = config.refundPolicy === "until_expiry" ? { ...existing, willRenew: false } : { ...existing, status: shared.SUBSCRIPTION_STATUS.CANCELED };
-            await store.save(updated);
-          } else {
-            log.warn(
-              "[onesub/webhook/google] voided subscription for unknown purchaseToken:",
-              voided.purchaseToken
-            );
-          }
+    try {
+      if (voided.productType === 1) {
+        const existing = await store.getByTransactionId(voided.purchaseToken);
+        if (existing) {
+          const updated = config.refundPolicy === "until_expiry" ? { ...existing, willRenew: false } : { ...existing, status: shared.SUBSCRIPTION_STATUS.CANCELED };
+          await store.save(updated);
         } else {
-          const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
-          if (!removed) {
-            log.warn(
-              "[onesub/webhook/google] voided IAP for unknown orderId:",
-              voided.orderId
-            );
-          }
+          log.warn("[onesub/webhook/google] voided subscription for unknown purchaseToken:", voided.purchaseToken);
+        }
+      } else {
+        const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
+        if (!removed) {
+          log.warn("[onesub/webhook/google] voided IAP for unknown orderId:", voided.orderId);
         }
-        res.status(200).json({ received: true });
-      } catch (err) {
-        log.error("[onesub/webhook/google] voided notification error:", err);
-        sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
       }
-      return;
-    }
-    const notification = decodeGoogleNotification(body);
-    if (!notification) {
       res.status(200).json({ received: true });
-      return;
+    } catch (err) {
+      log.error("[onesub/webhook/google] voided notification error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
     }
-    const { notificationType, purchaseToken, subscriptionId, packageName } = notification;
-    if (config.google?.packageName && packageName !== config.google.packageName) {
-      log.warn(
-        "[onesub/webhook/google] Package name mismatch:",
-        packageName,
-        "!==",
-        config.google.packageName
-      );
+    return;
+  }
+  const oneTimeProduct = decodeGoogleOneTimeProductNotification(body);
+  if (oneTimeProduct) {
+    if (config.google?.packageName && oneTimeProduct.packageName !== config.google.packageName) {
+      log.warn("[onesub/webhook/google] oneTimeProduct package name mismatch:", oneTimeProduct.packageName, "!==", config.google.packageName);
       sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
       return;
     }
     try {
-      const existing = await store.getByTransactionId(purchaseToken);
-      let finalStatus;
-      if (isGoogleActiveNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
-      } else if (isGoogleGracePeriodNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
-      } else if (isGoogleOnHoldNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.ON_HOLD;
-      } else if (isGooglePausedNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.PAUSED;
-      } else if (isGooglePriceChangeConfirmedNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
-      } else if (isGoogleCanceledNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.CANCELED;
-      } else if (isGoogleExpiredNotification(notificationType)) {
-        finalStatus = shared.SUBSCRIPTION_STATUS.EXPIRED;
+      const { notificationType: notificationType2, purchaseToken: purchaseToken2, sku } = oneTimeProduct;
+      if (notificationType2 === 1) {
+        log.info("[onesub/webhook/google] oneTimeProduct PURCHASED:", sku);
+        if (config.google?.serviceAccountKey && config.google.packageName) {
+          void acknowledgeGoogleProduct(purchaseToken2, sku, config.google).catch(
+            (err) => log.warn(`[onesub/webhook/google] oneTimeProduct ack failed for SKU ${sku} \u2014 3-day auto-refund risk:`, err)
+          );
+        }
       } else {
-        finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+        log.info("[onesub/webhook/google] oneTimeProduct CANCELED (pre-completion):", sku);
       }
-      if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
-        const hook = config.google.onPriceChangeConfirmed;
-        void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err));
-      }
-      if (existing) {
-        let updated = { ...existing, status: finalStatus };
-        if (config.google?.serviceAccountKey) {
-          const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
-          if (fresh) {
-            const preserveNotificationStatus = finalStatus === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === shared.SUBSCRIPTION_STATUS.ON_HOLD;
-            updated = {
-              ...existing,
-              status: preserveNotificationStatus ? finalStatus : fresh.status,
-              expiresAt: fresh.expiresAt,
-              willRenew: fresh.willRenew,
-              // Propagate v2-only fields that fresh may have updated. Without
-              // these, paused→active transitions left autoResumeTime stale and
-              // upgrade chains lost their linkedPurchaseToken on subsequent
-              // notifications. Use ?? undefined so cleared values become undefined
-              // (e.g. resume from paused → autoResumeTime should disappear).
-              autoResumeTime: fresh.autoResumeTime,
-              linkedPurchaseToken: fresh.linkedPurchaseToken ?? existing.linkedPurchaseToken
-            };
-          }
+      res.status(200).json({ received: true });
+    } catch (err) {
+      log.error("[onesub/webhook/google] oneTimeProduct error:", err);
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process oneTimeProduct notification");
+    }
+    return;
+  }
+  const notification = decodeGoogleNotification(body);
+  if (!notification) {
+    res.status(200).json({ received: true });
+    return;
+  }
+  const { notificationType, purchaseToken, subscriptionId, packageName } = notification;
+  if (config.google?.packageName && packageName !== config.google.packageName) {
+    log.warn("[onesub/webhook/google] Package name mismatch:", packageName, "!==", config.google.packageName);
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
+    return;
+  }
+  try {
+    const existing = await store.getByTransactionId(purchaseToken);
+    let finalStatus;
+    if (isGoogleActiveNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleGracePeriodNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.GRACE_PERIOD;
+    } else if (isGoogleOnHoldNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ON_HOLD;
+    } else if (isGooglePausedNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.PAUSED;
+    } else if (isGooglePriceChangeConfirmedNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    } else if (isGoogleCanceledNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.CANCELED;
+    } else if (isGoogleExpiredNotification(notificationType)) {
+      finalStatus = shared.SUBSCRIPTION_STATUS.EXPIRED;
+    } else {
+      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+    }
+    if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
+      const hook = config.google.onPriceChangeConfirmed;
+      void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err));
+    }
+    if (existing) {
+      let updated = { ...existing, status: finalStatus };
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          const preserveNotificationStatus = finalStatus === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === shared.SUBSCRIPTION_STATUS.ON_HOLD;
+          updated = {
+            ...existing,
+            status: preserveNotificationStatus ? finalStatus : fresh.status,
+            expiresAt: fresh.expiresAt,
+            willRenew: fresh.willRenew,
+            autoResumeTime: fresh.autoResumeTime,
+            linkedPurchaseToken: fresh.linkedPurchaseToken ?? existing.linkedPurchaseToken
+          };
         }
-        await store.save(updated);
-      } else {
-        if (config.google?.serviceAccountKey) {
-          const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
-          if (fresh) {
-            if (fresh.linkedPurchaseToken) {
-              const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
-              if (previous) {
-                fresh.userId = previous.userId;
-                log.info(
-                  `[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`
-                );
-              } else {
-                fresh.userId = purchaseToken;
-              }
-            } else {
-              fresh.userId = purchaseToken;
+      }
+      await store.save(updated);
+    } else {
+      if (config.google?.serviceAccountKey) {
+        const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+        if (fresh) {
+          if (fresh.linkedPurchaseToken) {
+            const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
+            fresh.userId = previous ? previous.userId : purchaseToken;
+            if (previous) {
+              log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
             }
-            await store.save(fresh);
+          } else {
+            fresh.userId = purchaseToken;
           }
-        } else {
-          log.warn(
-            "[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:",
-            purchaseToken
-          );
+          await store.save(fresh);
         }
+      } else {
+        log.warn("[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:", purchaseToken);
       }
-      res.status(200).json({ received: true });
-    } catch (err) {
-      log.error("[onesub/webhook/google] Error handling notification:", err);
-      sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
     }
-  });
+    res.status(200).json({ received: true });
+  } catch (err) {
+    log.error("[onesub/webhook/google] Error handling notification:", err);
+    sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
+  }
+}
+
+// src/routes/webhook.ts
+function createWebhookRouter(config, store, purchaseStore, webhookEventStore) {
+  const router = express.Router();
+  router.post(
+    shared.ROUTES.WEBHOOK_APPLE,
+    (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
+  router.post(
+    shared.ROUTES.WEBHOOK_GOOGLE,
+    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore)
+  );
   return router;
 }
 var NO_PURCHASE = { valid: false, purchase: null };
@@ -1816,6 +1928,38 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? "customer error");
     }
   });
+  const syncAppleParamsSchema = zod.z.object({
+    originalTransactionId: zod.z.string().min(1).max(256)
+  });
+  router.post(shared.ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
+    let params;
+    try {
+      params = syncAppleParamsSchema.parse(req.params);
+    } catch {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_INPUT, "originalTransactionId required");
+      return;
+    }
+    if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple API credentials not configured");
+      return;
+    }
+    try {
+      const { originalTransactionId } = params;
+      const existingForEnv = await store.getByTransactionId(originalTransactionId);
+      const isSandbox = req.query["sandbox"] === "true" || existingForEnv?.environment === "Sandbox";
+      const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, { sandbox: isSandbox });
+      if (!fresh) {
+        sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "Apple Status API returned no record");
+        return;
+      }
+      const existing = existingForEnv;
+      fresh.userId = existing?.userId ?? originalTransactionId;
+      await store.save(fresh);
+      res.status(200).json({ ok: true, subscription: fresh });
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? "sync error");
+    }
+  });
   if (webhookQueue?.listDeadLetters) {
     router.get("/onesub/admin/webhook-deadletters", async (_req, res) => {
       try {
@@ -2061,6 +2205,55 @@ function createMetricsRouter(config, store, purchaseStore) {
   });
   return router;
 }
+var OFFER_SECRET_HEADER = "x-onesub-offer-secret";
+var offerBodySchema = zod.z.object({
+  productId: zod.z.string().min(1).max(256),
+  offerId: zod.z.string().min(1).max(256),
+  applicationUsername: zod.z.string().min(1).max(256)
+});
+function createAppleOfferRouter(config) {
+  const apple = config.apple;
+  if (!apple?.offerKeyId || !apple?.offerPrivateKey) return null;
+  const router = express.Router();
+  router.post("/onesub/apple/offer-signature", async (req, res) => {
+    if (config.adminSecret) {
+      const provided = req.headers[OFFER_SECRET_HEADER];
+      if (typeof provided !== "string" || provided !== config.adminSecret) {
+        sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
+        return;
+      }
+    }
+    let body;
+    try {
+      body = offerBodySchema.parse(req.body);
+    } catch (err) {
+      if (err instanceof zod.z.ZodError) {
+        sendZodError(res, err);
+        return;
+      }
+      throw err;
+    }
+    if (!apple.bundleId) {
+      sendError(res, 400, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "config.apple.bundleId is required for offer signing");
+      return;
+    }
+    try {
+      const result = await signApplePromotionalOffer(
+        {
+          bundleId: apple.bundleId,
+          productId: body.productId,
+          offerId: body.offerId,
+          applicationUsername: body.applicationUsername
+        },
+        apple
+      );
+      res.status(200).json(result);
+    } catch (err) {
+      sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? "Offer signing failed");
+    }
+  });
+  return router;
+}
 
 // src/stores/schema.ts
 var SUBSCRIPTIONS_SCHEMA_SQL = `
@@ -3047,6 +3240,8 @@ function createOneSubMiddleware(config) {
   if (entitlementRouter) router.use(entitlementRouter);
   const metricsRouter = createMetricsRouter(config, store, purchaseStore);
   if (metricsRouter) router.use(metricsRouter);
+  const appleOfferRouter = createAppleOfferRouter(config);
+  if (appleOfferRouter) router.use(appleOfferRouter);
   return router;
 }
 function createOneSubServer(config) {
@@ -3057,7 +3252,6 @@ function createOneSubServer(config) {
   app.use(createOneSubMiddleware(config));
   return app;
 }
-var index_default = createOneSubMiddleware;
 var isMain = typeof process !== "undefined" && process.argv[1] != null && new URL((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))).pathname.endsWith(process.argv[1].replace(/\\/g, "/"));
 if (isMain) {
   const config = {
@@ -3099,14 +3293,15 @@ exports.RedisSubscriptionStore = RedisSubscriptionStore;
 exports.RedisWebhookEventStore = RedisWebhookEventStore;
 exports.createOneSubMiddleware = createOneSubMiddleware;
 exports.createOneSubServer = createOneSubServer;
-exports.default = index_default;
 exports.evaluateEntitlement = evaluateEntitlement;
 exports.fetchAppleSubscriptionStatus = fetchAppleSubscriptionStatus;
+exports.fetchAppleTransactionHistory = fetchAppleTransactionHistory;
 exports.getDefaultCache = getDefaultCache;
 exports.log = log;
 exports.openapiHandler = openapiHandler;
 exports.setDefaultCache = setDefaultCache;
 exports.setLogger = setLogger;
+exports.signApplePromotionalOffer = signApplePromotionalOffer;
 exports.validateAppleReceipt = validateAppleReceipt;
 exports.validateGoogleReceipt = validateGoogleReceipt;
 exports.withSpan = withSpan;