@onesub/server 0.12.1 → 0.13.0

package/dist/logger.js

@@ -0,0 +1,20 @@
+/**
+ * Process-wide logger used by @onesub/server's providers and routes.
+ *
+ * Defaults to `console`. `createOneSubMiddleware()` calls `setLogger()` once
+ * during setup if `config.logger` is provided. All internal call sites should
+ * import `log` from this module instead of calling `console.*` directly so
+ * operators can redirect logs (pino / winston / bunyan) with a single config
+ * setting.
+ */
+let current = console;
+export function setLogger(logger) {
+    if (logger)
+        current = logger;
+}
+export const log = {
+    info: (...args) => current.info(...args),
+    warn: (...args) => current.warn(...args),
+    error: (...args) => current.error(...args),
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,IAAI,OAAO,GAAiB,OAAO,CAAC;AAEpC,MAAM,UAAU,SAAS,CAAC,MAAgC;IACxD,IAAI,MAAM;QAAE,OAAO,GAAG,MAAM,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAiB;IAC/B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAC3C,CAAC"}

package/dist/openapi.js

@@ -0,0 +1,196 @@
+/**
+ * OpenAPI 3.1 spec for the onesub HTTP surface.
+ *
+ * Hand-maintained — kept in sync with the routes by a parity test (see
+ * __tests__/openapi.test.ts) that asserts every mounted path is described
+ * here. Generated clients live downstream:
+ *
+ *   - swagger-typescript-api → typed fetch client
+ *   - openapi-generator-cli  → Kotlin/Swift/etc. clients
+ *
+ * Why hand-maintained instead of zod-to-openapi: the routes use zod for
+ * input validation but the request/response shapes the public docs need are
+ * a thin slice of those internal types. Hand-writing keeps the doc readable
+ * without coupling client output to internal validation strictness changes.
+ */
+import { ROUTES } from '@onesub/shared';
+export const ONESUB_OPENAPI = {
+    openapi: '3.1.0',
+    info: {
+        title: 'onesub HTTP API',
+        version: '1.0.0',
+        description: 'Receipt validation, subscription status, webhooks, and admin endpoints exposed by `createOneSubMiddleware`.',
+    },
+    servers: [
+        { url: 'http://localhost:4100', description: 'Local dev (examples/server)' },
+    ],
+    paths: {
+        [ROUTES.VALIDATE]: {
+            post: {
+                summary: 'Validate an Apple/Google receipt and persist subscription state.',
+                requestBody: {
+                    required: true,
+                    content: { 'application/json': { schema: { $ref: '#/components/schemas/ValidateRequest' } } },
+                },
+                responses: {
+                    200: { description: 'Validation succeeded; subscription state persisted.', content: { 'application/json': { schema: { $ref: '#/components/schemas/ValidateResponse' } } } },
+                    400: { description: 'Bad request — missing fields, malformed receipt, package mismatch.' },
+                },
+            },
+        },
+        [ROUTES.STATUS]: {
+            get: {
+                summary: 'Fetch the most recent subscription state for a user.',
+                parameters: [{ in: 'query', name: 'userId', required: true, schema: { type: 'string' } }],
+                responses: {
+                    200: { description: 'OK', content: { 'application/json': { schema: { $ref: '#/components/schemas/StatusResponse' } } } },
+                },
+            },
+        },
+        [ROUTES.WEBHOOK_APPLE]: {
+            post: {
+                summary: 'Apple App Store Server Notification V2 receiver.',
+                description: 'Apple POSTs `{ signedPayload }`. JWS-verified, idempotent when `webhookEventStore` is configured.',
+                responses: {
+                    200: { description: 'Acknowledged.' },
+                    400: { description: 'Missing or invalid signedPayload.' },
+                },
+            },
+        },
+        [ROUTES.WEBHOOK_GOOGLE]: {
+            post: {
+                summary: 'Google Play Real-Time Developer Notification (Pub/Sub push) receiver.',
+                responses: {
+                    200: { description: 'Acknowledged.' },
+                    400: { description: 'Missing message.data or package mismatch.' },
+                    401: { description: 'pushAudience configured and JWT verification failed.' },
+                },
+            },
+        },
+        [ROUTES.ENTITLEMENTS]: {
+            get: {
+                summary: 'Evaluate every configured entitlement for a user.',
+                parameters: [{ in: 'query', name: 'userId', required: true, schema: { type: 'string' } }],
+                responses: {
+                    200: { description: 'Map of entitlementId → { granted, source }.' },
+                },
+            },
+        },
+        [ROUTES.ADMIN_SUBSCRIPTIONS]: {
+            get: {
+                summary: 'Filtered, paginated subscription list (admin).',
+                parameters: [
+                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
+                    { in: 'query', name: 'userId', schema: { type: 'string' } },
+                    { in: 'query', name: 'status', schema: { type: 'string', enum: ['active', 'grace_period', 'on_hold', 'paused', 'expired', 'canceled', 'none'] } },
+                    { in: 'query', name: 'productId', schema: { type: 'string' } },
+                    { in: 'query', name: 'platform', schema: { type: 'string', enum: ['apple', 'google'] } },
+                    { in: 'query', name: 'limit', schema: { type: 'integer', minimum: 1, maximum: 200 } },
+                    { in: 'query', name: 'offset', schema: { type: 'integer', minimum: 0 } },
+                ],
+                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
+            },
+        },
+        '/onesub/admin/customers/{userId}': {
+            get: {
+                summary: 'Customer profile bundle: subscriptions + purchases + entitlements (admin).',
+                parameters: [
+                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
+                    { in: 'path', name: 'userId', required: true, schema: { type: 'string' } },
+                ],
+                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
+            },
+        },
+        '/onesub/admin/webhook-deadletters': {
+            get: {
+                summary: 'List failed webhook jobs (when a queue with DLQ support is configured).',
+                parameters: [{ in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } }],
+                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
+            },
+        },
+        '/onesub/admin/webhook-replay/{id}': {
+            post: {
+                summary: 'Replay a dead-letter job through the webhook handler.',
+                parameters: [
+                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
+                    { in: 'path', name: 'id', required: true, schema: { type: 'string' } },
+                ],
+                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
+            },
+        },
+    },
+    components: {
+        schemas: {
+            ValidateRequest: {
+                type: 'object',
+                required: ['userId', 'platform', 'productId', 'receipt'],
+                properties: {
+                    userId: { type: 'string' },
+                    platform: { type: 'string', enum: ['apple', 'google'] },
+                    productId: { type: 'string' },
+                    receipt: { type: 'string', description: 'Apple JWS or Google purchaseToken' },
+                    purchaseType: { type: 'string', enum: ['subscription', 'consumable', 'non_consumable'] },
+                },
+            },
+            ValidateResponse: {
+                type: 'object',
+                properties: {
+                    valid: { type: 'boolean' },
+                    subscription: { $ref: '#/components/schemas/SubscriptionInfo' },
+                    purchase: { $ref: '#/components/schemas/PurchaseInfo' },
+                },
+            },
+            StatusResponse: {
+                type: 'object',
+                properties: {
+                    active: { type: 'boolean' },
+                    subscription: { $ref: '#/components/schemas/SubscriptionInfo' },
+                },
+            },
+            SubscriptionInfo: {
+                type: 'object',
+                properties: {
+                    originalTransactionId: { type: 'string' },
+                    userId: { type: 'string' },
+                    productId: { type: 'string' },
+                    platform: { type: 'string', enum: ['apple', 'google'] },
+                    status: { type: 'string', enum: ['active', 'grace_period', 'on_hold', 'paused', 'expired', 'canceled', 'none'] },
+                    expiresAt: { type: 'string', format: 'date-time' },
+                    purchasedAt: { type: 'string', format: 'date-time' },
+                    willRenew: { type: 'boolean' },
+                },
+            },
+            PurchaseInfo: {
+                type: 'object',
+                properties: {
+                    transactionId: { type: 'string' },
+                    userId: { type: 'string' },
+                    productId: { type: 'string' },
+                    platform: { type: 'string', enum: ['apple', 'google'] },
+                    type: { type: 'string', enum: ['consumable', 'non_consumable'] },
+                    quantity: { type: 'integer' },
+                    purchasedAt: { type: 'string', format: 'date-time' },
+                },
+            },
+        },
+        securitySchemes: {
+            AdminSecret: {
+                type: 'apiKey',
+                in: 'header',
+                name: 'X-Admin-Secret',
+            },
+        },
+    },
+};
+/**
+ * Mount a route that serves the OpenAPI document. Useful for hosts that want
+ * to expose `/openapi.json` to API explorers / SDK generators.
+ *
+ *   app.use('/openapi.json', openapiHandler());
+ */
+export function openapiHandler() {
+    return (_req, res) => {
+        res.json(ONESUB_OPENAPI);
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAiBxC,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,6GAA6G;KAChH;IACD,OAAO,EAAE;QACP,EAAE,GAAG,EAAE,uBAAuB,EAAE,WAAW,EAAE,6BAA6B,EAAE;KAC7E;IACD,KAAK,EAAE;QACL,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACjB,IAAI,EAAE;gBACJ,OAAO,EAAE,kEAAkE;gBAC3E,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,EAAE;iBAC9F;gBACD,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE,EAAE,EAAE,EAAE;oBAC3K,GAAG,EAAE,EAAE,WAAW,EAAE,oEAAoE,EAAE;iBAC3F;aACF;SACF;QACD,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACf,GAAG,EAAE;gBACH,OAAO,EAAE,sDAAsD;gBAC/D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBACzF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,EAAE;iBACzH;aACF;SACF;QACD,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;YACtB,IAAI,EAAE;gBACJ,OAAO,EAAE,kDAAkD;gBAC3D,WAAW,EACT,mGAAmG;gBACrG,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;oBACrC,GAAG,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;iBAC1D;aACF;SACF;QACD,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,uEAAuE;gBAChF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;oBACrC,GAAG,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE;oBACjE,GAAG,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE;iBAC7E;aACF;SACF;QACD,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YACrB,GAAG,EAAE;gBACH,OAAO,EAAE,mDAAmD;gBAC5D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBACzF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;iBACpE;aACF;SACF;QACD,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;YAC5B,GAAG,EAAE;gBACH,OAAO,EAAE,gDAAgD;gBACzD,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC3D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;oBACjJ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC9D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE;oBACxF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;oBACrF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;iBACzE;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,kCAAkC,EAAE;YAClC,GAAG,EAAE;gBACH,OAAO,EAAE,4EAA4E;gBACrF,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC3E;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,mCAAmC,EAAE;YACnC,GAAG,EAAE;gBACH,OAAO,EAAE,yEAAyE;gBAClF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClG,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,mCAAmC,EAAE;YACnC,IAAI,EAAE;gBACJ,OAAO,EAAE,uDAAuD;gBAChE,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACvE;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;KACF;IACD,UAAU,EAAE;QACV,OAAO,EAAE;YACP,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC;gBACxD,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAC7E,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE;iBACzF;aACF;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;oBAC/D,QAAQ,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE;iBACxD;aACF;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;iBAChE;aACF;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;oBAChH,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBAClD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBACpD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC/B;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE;oBAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;iBACrD;aACF;SACF;QACD,eAAe,EAAE;YACf,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,gBAAgB;aACvB;SACF;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,IAA+B,EAAE,GAA+B,EAAE,EAAE;QAC1E,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/providers/apple-root-ca.js

@@ -0,0 +1,38 @@
+/**
+ * Apple Root CA certificates used to verify StoreKit 2 signed transactions.
+ *
+ * Apple signs JWS transactions with an ECDSA key; the signing certificate
+ * chain is embedded in the JWS `x5c` header. To trust the leaf key we must
+ * validate the chain all the way up to one of Apple's published root CAs.
+ *
+ * Source: https://www.apple.com/certificateauthority/
+ * These certificates are public and static. Update this list if Apple
+ * publishes a new root — existing JWS signed with older roots continue to
+ * validate against their original root.
+ */
+/**
+ * Apple Root CA - G3 (current root for StoreKit 2 / App Store Server API).
+ * SHA-256 fingerprint: 63343ABF B89A6A03 EB994052 C5ADBBF8 A87E2C46 81F6F0FC C8A4DA48 95F0FBBF
+ * Valid: 2014-04-30 — 2039-04-30
+ */
+export const APPLE_ROOT_CA_G3_PEM = `-----BEGIN CERTIFICATE-----
+MIICQzCCAcmgAwIBAgIILcX8iNLFS5UwCgYIKoZIzj0EAwMwZzEbMBkGA1UEAwwS
+QXBwbGUgUm9vdCBDQSAtIEczMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9u
+IEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcN
+MTQwNDMwMTgxOTA2WhcNMzkwNDMwMTgxOTA2WjBnMRswGQYDVQQDDBJBcHBsZSBS
+b290IENBIC0gRzMxJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9y
+aXR5MRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABJjpLz1AcqTtkyJygRMc3RCV8cWjTnHcFBbZDuWmBSp3ZHtf
+TjjTuxxEtX/1H7YyYl3J6YRbTzBPEVoA/VhYDKX1DyxNB0cTddqXl5dvMVztK517
+IDvYuVTZXpmkOlEKMaNCMEAwHQYDVR0OBBYEFLuw3qFYM4iapIqZ3r6966/ayySr
+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gA
+MGUCMQCD6cHEFl4aXTQY2e3v9GwOAEZLuN+yRhHFD/3meoyhpmvOwgPUnPWTxnS4
+at+qIxUCMG1mihDK1A3UT82NQz60imOlM27jbdoXt2QfyFMm+YhidDkLF1vLUagM
+6BgD56KyKA==
+-----END CERTIFICATE-----`;
+/**
+ * All Apple root CAs accepted for StoreKit 2 JWS validation.
+ * Currently only G3; add G4 here when Apple publishes it.
+ */
+export const APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
+//# sourceMappingURL=apple-root-ca.js.map

package/dist/providers/apple-root-ca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-root-ca.js","sourceRoot":"","sources":["../../src/providers/apple-root-ca.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;0BAcV,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/providers/apple.d.ts

@@ -58,6 +58,19 @@ export declare function decodeAppleNotification(payload: AppleNotificationPayloa
     willRenew: boolean;
     /** May be null for non-subscription notifications (consumable refund). */
     expiresAt: string | null;
+    /**
+     * UUID the app set via setAppAccountToken at purchase time. For onesub this
+     * maps directly to userId. Present for both PURCHASED and FAMILY_SHARED
+     * ownership types when the host linked a user account at checkout time.
+     * Null when not set (sandbox, or host didn't call setAppAccountToken).
+     */
+    appAccountToken: string | null;
+    /**
+     * 'PURCHASED' — the user bought this directly.
+     * 'FAMILY_SHARED' — a family member of the purchaser. The originalTransactionId
+     * and appAccountToken belong to the family member, not the purchaser.
+     */
+    inAppOwnershipType: string | null;
 } | null>;
 /** Test-only: clear the Apple JWT cache. Not exported. */
 declare function clearAppleJwtCacheForTests(): void;
@@ -98,5 +111,68 @@ export declare function sendAppleConsumptionResponse(transactionId: string, body
 export declare function fetchAppleSubscriptionStatus(originalTransactionId: string, config: AppleConfig, options?: {
     sandbox?: boolean;
 }): Promise<SubscriptionInfo | null>;
+/**
+ * Decoded lightweight transaction record from transaction history.
+ */
+export interface AppleTransactionRecord {
+    originalTransactionId: string;
+    transactionId: string;
+    productId: string;
+    type: string;
+    purchasedAt: string;
+    expiresAt: string | null;
+    appAccountToken: string | null;
+    inAppOwnershipType: string | null;
+    revocationDate: string | null;
+}
+/**
+ * Fetch all transactions for an originalTransactionId from the App Store
+ * Transaction History API (GET /inApps/v2/history/{originalTransactionId}).
+ *
+ * Paginates automatically until `hasMore` is false. Returns all decoded
+ * transaction records, oldest-first (Apple's default sort).
+ *
+ * Returns null when API credentials are missing or the call fails.
+ */
+export declare function fetchAppleTransactionHistory(originalTransactionId: string, config: AppleConfig, options?: {
+    sandbox?: boolean;
+}): Promise<AppleTransactionRecord[] | null>;
+/**
+ * Input for signing an Apple Promotional Offer payload.
+ * https://developer.apple.com/documentation/storekit/generating-a-signature-for-promotional-offers
+ */
+export interface AppleOfferSignatureInput {
+    /** App Bundle ID (e.g. com.example.app) */
+    bundleId: string;
+    /** The product ID of the subscription being offered */
+    productId: string;
+    /** The promotional offer ID defined in App Store Connect */
+    offerId: string;
+    /** A unique UUID generated per request (the nonce) */
+    applicationUsername: string;
+}
+/**
+ * Result returned to the client so StoreKit can verify the offer.
+ */
+export interface AppleOfferSignatureResult {
+    keyId: string;
+    nonce: string;
+    timestamp: number;
+    signature: string;
+}
+/**
+ * Sign an Apple Promotional Offer payload with ES256 (ECDSA P-256).
+ *
+ * The message to sign is:
+ *   appBundleId + '⁣' + keyIdentifier + '⁣' + productIdentifier + '⁣'
+ *   + offerIdentifier + '⁣' + applicationUsername + '⁣'
+ *   + nonce (lowercase) + '⁣' + timestamp (ms, string)
+ *
+ * Requires `config.offerKeyId` and `config.offerPrivateKey` (PEM ES256 key from
+ * App Store Connect → Subscriptions → Promotional Offers → Keys).
+ *
+ * Throws if the required keys are not configured.
+ */
+export declare function signApplePromotionalOffer(input: AppleOfferSignatureInput, config: AppleConfig): Promise<AppleOfferSignatureResult>;
 export {};
 //# sourceMappingURL=apple.d.ts.map

package/dist/providers/apple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA2F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgFpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,IAAI,CAAC,CA2CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC"}
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA4F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgFpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAAC,CA6CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC;AAeD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CA+D1C;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAoCpC"}