@onesub/server 0.12.0 → 0.13.0

package/dist/providers/apple.d.ts

@@ -58,6 +58,19 @@ export declare function decodeAppleNotification(payload: AppleNotificationPayloa
     willRenew: boolean;
     /** May be null for non-subscription notifications (consumable refund). */
     expiresAt: string | null;
+    /**
+     * UUID the app set via setAppAccountToken at purchase time. For onesub this
+     * maps directly to userId. Present for both PURCHASED and FAMILY_SHARED
+     * ownership types when the host linked a user account at checkout time.
+     * Null when not set (sandbox, or host didn't call setAppAccountToken).
+     */
+    appAccountToken: string | null;
+    /**
+     * 'PURCHASED' — the user bought this directly.
+     * 'FAMILY_SHARED' — a family member of the purchaser. The originalTransactionId
+     * and appAccountToken belong to the family member, not the purchaser.
+     */
+    inAppOwnershipType: string | null;
 } | null>;
 /** Test-only: clear the Apple JWT cache. Not exported. */
 declare function clearAppleJwtCacheForTests(): void;
@@ -98,5 +111,68 @@ export declare function sendAppleConsumptionResponse(transactionId: string, body
 export declare function fetchAppleSubscriptionStatus(originalTransactionId: string, config: AppleConfig, options?: {
     sandbox?: boolean;
 }): Promise<SubscriptionInfo | null>;
+/**
+ * Decoded lightweight transaction record from transaction history.
+ */
+export interface AppleTransactionRecord {
+    originalTransactionId: string;
+    transactionId: string;
+    productId: string;
+    type: string;
+    purchasedAt: string;
+    expiresAt: string | null;
+    appAccountToken: string | null;
+    inAppOwnershipType: string | null;
+    revocationDate: string | null;
+}
+/**
+ * Fetch all transactions for an originalTransactionId from the App Store
+ * Transaction History API (GET /inApps/v2/history/{originalTransactionId}).
+ *
+ * Paginates automatically until `hasMore` is false. Returns all decoded
+ * transaction records, oldest-first (Apple's default sort).
+ *
+ * Returns null when API credentials are missing or the call fails.
+ */
+export declare function fetchAppleTransactionHistory(originalTransactionId: string, config: AppleConfig, options?: {
+    sandbox?: boolean;
+}): Promise<AppleTransactionRecord[] | null>;
+/**
+ * Input for signing an Apple Promotional Offer payload.
+ * https://developer.apple.com/documentation/storekit/generating-a-signature-for-promotional-offers
+ */
+export interface AppleOfferSignatureInput {
+    /** App Bundle ID (e.g. com.example.app) */
+    bundleId: string;
+    /** The product ID of the subscription being offered */
+    productId: string;
+    /** The promotional offer ID defined in App Store Connect */
+    offerId: string;
+    /** A unique UUID generated per request (the nonce) */
+    applicationUsername: string;
+}
+/**
+ * Result returned to the client so StoreKit can verify the offer.
+ */
+export interface AppleOfferSignatureResult {
+    keyId: string;
+    nonce: string;
+    timestamp: number;
+    signature: string;
+}
+/**
+ * Sign an Apple Promotional Offer payload with ES256 (ECDSA P-256).
+ *
+ * The message to sign is:
+ *   appBundleId + '⁣' + keyIdentifier + '⁣' + productIdentifier + '⁣'
+ *   + offerIdentifier + '⁣' + applicationUsername + '⁣'
+ *   + nonce (lowercase) + '⁣' + timestamp (ms, string)
+ *
+ * Requires `config.offerKeyId` and `config.offerPrivateKey` (PEM ES256 key from
+ * App Store Connect → Subscriptions → Promotional Offers → Keys).
+ *
+ * Throws if the required keys are not configured.
+ */
+export declare function signApplePromotionalOffer(input: AppleOfferSignatureInput, config: AppleConfig): Promise<AppleOfferSignatureResult>;
 export {};
 //# sourceMappingURL=apple.d.ts.map

package/dist/providers/apple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA2F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgFpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,IAAI,CAAC,CA2CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC"}
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA4F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgFpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAAC,CA6CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC;AAeD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CA+D1C;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAoCpC"}

package/dist/providers/google.d.ts

@@ -20,6 +20,20 @@ declare const GOOGLE_NOTIFICATION_TYPE: {
     readonly SUBSCRIPTION_EXPIRED: 13;
 };
 type GoogleNotificationType = (typeof GOOGLE_NOTIFICATION_TYPE)[keyof typeof GOOGLE_NOTIFICATION_TYPE];
+/**
+ * Decoded Google RTDN oneTimeProductNotification — sent when a consumable or
+ * non-consumable product is purchased or canceled before acknowledgment.
+ *
+ * https://developer.android.com/google/play/billing/rtdn-reference#one-time
+ */
+export interface GoogleOneTimeProductNotification {
+    /** 1 = PURCHASED, 2 = CANCELED (user canceled before purchase completed) */
+    notificationType: 1 | 2;
+    purchaseToken: string;
+    /** Product SKU / productId */
+    sku: string;
+    packageName: string;
+}
 /**
  * Acknowledge a Google Play subscription purchase.
  * Google auto-refunds purchases that are not acknowledged within 3 days.
@@ -110,6 +124,17 @@ export interface GoogleVoidedNotification {
  * Returns null when the payload is a different notification kind.
  */
 export declare function decodeGoogleVoidedNotification(payload: GoogleNotificationPayload): GoogleVoidedNotification | null;
+/**
+ * Decode a Google RTDN oneTimeProductNotification, if the payload is one.
+ * Returns null when the payload is a different notification kind.
+ *
+ * Note: the notification does NOT carry userId context. For PURCHASED, the
+ * receipt must be acknowledged via acknowledgeGoogleProduct to prevent the
+ * 3-day auto-refund window. The userId is only known after the client calls
+ * POST /onesub/purchase/validate, which is the authoritative record-creation
+ * path. The webhook handler therefore acknowledges without creating a record.
+ */
+export declare function decodeGoogleOneTimeProductNotification(payload: GoogleNotificationPayload): GoogleOneTimeProductNotification | null;
 /**
  * Determine if a Google RTDN notification type represents an active subscription
  * inside the paid window (excludes grace period — that's a separate state now).

package/dist/providers/google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAUtG,KAAK,YAAY,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAmD9D;;;GAGG;AACH,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;CAcpB,CAAC;AAEX,KAAK,sBAAsB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AA8NvG;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AA+BD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiElC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,YAAY,GAAG,gBAAmC,GACvD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAiDrC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC5E,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAuBP;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,uEAAuE;IACvE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,GAAG,IAAI,CAqBjC;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAO5F;AAED,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAK9F;AAED,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE7F;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAEjG;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE5F;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE5F;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE1G"}
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAUtG,KAAK,YAAY,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAmD9D;;;GAGG;AACH,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;CAcpB,CAAC;AAEX,KAAK,sBAAsB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAoCvG;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACrB;AAoMD;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AA+BD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqElC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,YAAY,GAAG,gBAAmC,GACvD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAqDrC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC5E,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAuBP;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACnB,uEAAuE;IACvE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,GAAG,IAAI,CAqBjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,yBAAyB,GACjC,gCAAgC,GAAG,IAAI,CAezC;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAO5F;AAED,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAK9F;AAED,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE7F;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAEjG;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE5F;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE5F;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,OAAO,CAE1G"}

package/dist/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CAiQf"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CA2Sf"}

package/dist/routes/apple-offer.d.ts

@@ -0,0 +1,21 @@
+import { Router } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+/**
+ * POST /onesub/apple/offer-signature
+ *
+ * Sign an Apple Promotional Offer payload server-side.
+ * Requires config.apple.offerKeyId and config.apple.offerPrivateKey.
+ *
+ * Authentication: if config.adminSecret is set, the request must carry
+ * `X-Onesub-Offer-Secret: <adminSecret>` (same value). Hosts that mount
+ * onesub without adminSecret are responsible for securing this endpoint
+ * themselves (e.g. behind their own auth middleware).
+ *
+ * Body: { productId, offerId, applicationUsername }
+ * Response: { keyId, nonce, timestamp, signature }
+ *
+ * The client passes these four values to StoreKit's
+ * Product.SubscriptionOffer.Signature to redeem the offer.
+ */
+export declare function createAppleOfferRouter(config: OneSubServerConfig): Router | null;
+//# sourceMappingURL=apple-offer.d.ts.map

package/dist/routes/apple-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-offer.d.ts","sourceRoot":"","sources":["../../src/routes/apple-offer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAazD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CA+ChF"}

package/dist/routes/webhook-apple.d.ts

@@ -0,0 +1,6 @@
+import type { Request, Response } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+import type { SubscriptionStore, PurchaseStore } from '../store.js';
+import type { WebhookEventStore } from '../webhook-events.js';
+export declare function handleAppleWebhook(req: Request, res: Response, config: OneSubServerConfig, store: SubscriptionStore, purchaseStore: PurchaseStore, webhookEventStore?: WebhookEventStore): Promise<void>;
+//# sourceMappingURL=webhook-apple.d.ts.map

package/dist/routes/webhook-apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-apple.d.ts","sourceRoot":"","sources":["../../src/routes/webhook-apple.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAsB9D,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,IAAI,CAAC,CAwJf"}

package/dist/routes/webhook-google.d.ts

@@ -0,0 +1,7 @@
+import type { Request, Response } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+import type { SubscriptionStore, PurchaseStore } from '../store.js';
+import type { WebhookEventStore } from '../webhook-events.js';
+export declare function verifyGooglePushToken(req: Request, expectedAudience: string): Promise<boolean>;
+export declare function handleGoogleWebhook(req: Request, res: Response, config: OneSubServerConfig, store: SubscriptionStore, purchaseStore: PurchaseStore, webhookEventStore?: WebhookEventStore): Promise<void>;
+//# sourceMappingURL=webhook-google.d.ts.map

package/dist/routes/webhook-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-google.d.ts","sourceRoot":"","sources":["../../src/routes/webhook-google.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAA6B,kBAAkB,EAAoB,MAAM,gBAAgB,CAAC;AAEtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAiBpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAW9D,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpG;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,IAAI,CAAC,CAmLf"}

package/dist/routes/webhook.d.ts

@@ -5,23 +5,10 @@ import type { WebhookEventStore } from '../webhook-events.js';
 /**
  * Retry / durability semantics.
  *
- * Both Apple (App Store Server Notifications V2) and Google (Pub/Sub RTDN)
- * retry on any non-2xx response:
- *   - Apple: up to 5 retries over ~3 days, exponential backoff.
- *   - Google: per-Pub/Sub-subscription retry policy (default: retries until
- *     the message is ack'd or the retention window expires, up to 7 days).
- *
- * This router uses that built-in retry instead of a local dead-letter queue:
- *
- *   4xx — the payload is unusable (missing signedPayload, bad signature,
- *         package mismatch). Return 4xx so the sender does NOT retry, since
- *         the same request would fail again.
- *   5xx — a transient failure on our side (DB down, network to Play API).
- *         Return 5xx so Apple / Google retry the notification for us.
- *   2xx — processed, or intentionally ignored (e.g. test notification).
- *
- * If you need an explicit DLQ, wrap `store.save()` with your own error
- * handler before passing the store to `createOneSubMiddleware()`.
+ * Both Apple and Google retry on any non-2xx response.
+ *   4xx — payload is unusable; do NOT retry.
+ *   5xx — transient failure; source will retry.
+ *   2xx — processed or intentionally ignored.
  */
 export declare function createWebhookRouter(config: OneSubServerConfig, store: SubscriptionStore, purchaseStore: PurchaseStore, webhookEventStore?: WebhookEventStore): Router;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/routes/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/routes/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAiG9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,MAAM,CAmZR"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/routes/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI9D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,EAC5B,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,MAAM,CAYR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesub/server",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Server-side receipt validation middleware for react-native-iap. Apple StoreKit 2 + Google Play Billing. One line.",
   "main": "dist/index.cjs",
   "module": "dist/index.js",
@@ -53,7 +53,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@onesub/shared": "0.7.5",
+    "@onesub/shared": "0.8.0",
     "jose": "^6.2.2",
     "zod": "^4.3.6"
   },