@onesub/server 0.12.1 → 0.13.0

package/dist/routes/admin.js

@@ -0,0 +1,287 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { PURCHASE_TYPE, ONESUB_ERROR_CODE, ROUTES, SUBSCRIPTION_STATUS } from '@onesub/shared';
+import { evaluateEntitlement } from './entitlements.js';
+import { sendError, sendZodError } from '../errors.js';
+const ADMIN_SECRET_HEADER = 'x-admin-secret';
+/**
+ * Admin routes for testing / operational tasks. Require `X-Admin-Secret`
+ * header matching config.adminSecret. If config.adminSecret is not set, the
+ * entire admin router is not mounted (returns 404 from the parent router).
+ *
+ * Endpoints:
+ *   DELETE /onesub/purchase/admin/:userId/:productId
+ *     → reset a non-consumable so the user can test the purchase flow again
+ *
+ *   POST /onesub/purchase/admin/grant
+ *     → manually insert a purchase record (skips store verification)
+ *     body: { userId, productId, platform, type?, transactionId? }
+ *
+ *   POST /onesub/purchase/admin/transfer
+ *     → reassign a transactionId to a new userId (device migration)
+ *
+ *   GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
+ *     → filtered/paginated subscription list (used by dashboard + scripts)
+ *
+ *   GET /onesub/admin/subscriptions/:transactionId
+ *     → single subscription record by originalTransactionId (dashboard detail page)
+ *
+ *   GET /onesub/admin/customers/:userId
+ *     → bundle of every record onesub knows for one user (subs + purchases +
+ *       entitlements when configured). Backs the dashboard customer detail page.
+ */
+export function createAdminRouter(config, purchaseStore, store, webhookQueue) {
+    if (!config.adminSecret)
+        return null;
+    const router = Router();
+    const adminSecret = config.adminSecret;
+    // Auth middleware — applied to both admin scopes. Without this guard, a
+    // misconfigured mount on the parent root would expose admin endpoints
+    // alongside host-app routes (e.g. /health).
+    const adminAuth = (req, res, next) => {
+        const provided = req.headers[ADMIN_SECRET_HEADER];
+        if (typeof provided !== 'string' || provided !== adminSecret) {
+            sendError(res, 401, ONESUB_ERROR_CODE.INVALID_ADMIN_SECRET, 'INVALID_ADMIN_SECRET');
+            return;
+        }
+        next();
+    };
+    router.use('/onesub/purchase/admin', adminAuth);
+    router.use('/onesub/admin', adminAuth);
+    // DELETE /onesub/purchase/admin/:userId/:productId
+    // Express 5 types route params as `string | string[]` — narrow via zod.
+    const resetParamsSchema = z.object({
+        userId: z.string().min(1).max(256),
+        productId: z.string().min(1).max(256),
+    });
+    router.delete('/onesub/purchase/admin/:userId/:productId', async (req, res) => {
+        let params;
+        try {
+            params = resetParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId and productId required');
+            return;
+        }
+        const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
+        res.json({ ok: true, deleted });
+    });
+    // POST /onesub/purchase/admin/transfer — reassign transactionId to a new userId
+    // (legitimate device/account migration)
+    const transferSchema = z.object({
+        transactionId: z.string().min(1).max(256),
+        newUserId: z.string().min(1).max(256),
+    });
+    router.post('/onesub/purchase/admin/transfer', async (req, res) => {
+        let body;
+        try {
+            body = transferSchema.parse(req.body);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
+        if (!existing) {
+            sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
+            return;
+        }
+        // Delete the old row, then save under new userId
+        await purchaseStore.deletePurchases(existing.userId, existing.productId);
+        const migrated = { ...existing, userId: body.newUserId };
+        await purchaseStore.savePurchase(migrated);
+        res.json({ ok: true, purchase: migrated });
+    });
+    // POST /onesub/purchase/admin/grant
+    const grantSchema = z.object({
+        userId: z.string().min(1).max(256),
+        productId: z.string().min(1).max(256),
+        platform: z.enum(['apple', 'google']),
+        type: z.enum([PURCHASE_TYPE.CONSUMABLE, PURCHASE_TYPE.NON_CONSUMABLE]).default(PURCHASE_TYPE.NON_CONSUMABLE),
+        transactionId: z.string().min(1).max(256).optional(),
+    });
+    router.post('/onesub/purchase/admin/grant', async (req, res) => {
+        let body;
+        try {
+            body = grantSchema.parse(req.body);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+        const purchase = {
+            transactionId,
+            userId: body.userId,
+            productId: body.productId,
+            platform: body.platform,
+            type: body.type,
+            quantity: 1,
+            purchasedAt: new Date().toISOString(),
+        };
+        await purchaseStore.savePurchase(purchase);
+        res.json({ ok: true, purchase });
+    });
+    // GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
+    // Filtered + paginated subscription list. Backs the dashboard's
+    // subscriptions page and ad-hoc operational scripts.
+    const listQuerySchema = z.object({
+        userId: z.string().min(1).max(256).optional(),
+        status: z.enum([
+            SUBSCRIPTION_STATUS.ACTIVE,
+            SUBSCRIPTION_STATUS.GRACE_PERIOD,
+            SUBSCRIPTION_STATUS.ON_HOLD,
+            SUBSCRIPTION_STATUS.PAUSED,
+            SUBSCRIPTION_STATUS.EXPIRED,
+            SUBSCRIPTION_STATUS.CANCELED,
+            SUBSCRIPTION_STATUS.NONE,
+        ]).optional(),
+        productId: z.string().min(1).max(256).optional(),
+        platform: z.enum(['apple', 'google']).optional(),
+        // Cap at 200 server-side so a runaway dashboard query can't tip the DB.
+        limit: z.coerce.number().int().positive().max(200).optional(),
+        offset: z.coerce.number().int().nonnegative().optional(),
+    });
+    router.get(ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
+        let query;
+        try {
+            query = listQuerySchema.parse(req.query);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        try {
+            const result = await store.listFiltered(query);
+            const response = {
+                items: result.items,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset,
+            };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            // Bubble the message up but not the stack — admin clients log status code
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
+        }
+    });
+    // GET /onesub/admin/subscriptions/:transactionId — single record by
+    // originalTransactionId. Backs the dashboard's subscription detail page.
+    const detailParamsSchema = z.object({
+        transactionId: z.string().min(1).max(256),
+    });
+    router.get('/onesub/admin/subscriptions/:transactionId', async (req, res) => {
+        let params;
+        try {
+            params = detailParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'transactionId required');
+            return;
+        }
+        try {
+            const sub = await store.getByTransactionId(params.transactionId);
+            if (!sub) {
+                sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
+                return;
+            }
+            res.status(200).json(sub);
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'detail error');
+        }
+    });
+    // GET /onesub/admin/customers/:userId — full per-user profile. Combines the
+    // store calls a CS dashboard makes for "show me everything about this user"
+    // into a single round-trip.
+    //
+    // Always returns 200 (even for unknown userIds) — empty arrays + no
+    // entitlements means "we have no record of this user", which is a valid
+    // signal for the dashboard to render rather than an error condition.
+    const customerParamsSchema = z.object({
+        userId: z.string().min(1).max(256),
+    });
+    router.get('/onesub/admin/customers/:userId', async (req, res) => {
+        let params;
+        try {
+            params = customerParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId required');
+            return;
+        }
+        try {
+            const [subscriptions, purchases] = await Promise.all([
+                store.getAllByUserId(params.userId),
+                purchaseStore.getPurchasesByUserId(params.userId),
+            ]);
+            // Evaluate entitlements only when configured. Hosts that don't use the
+            // entitlement abstraction get the field omitted (dashboard hides panel).
+            let entitlements;
+            if (config.entitlements && Object.keys(config.entitlements).length > 0) {
+                entitlements = {};
+                for (const [id, def] of Object.entries(config.entitlements)) {
+                    entitlements[id] = await evaluateEntitlement(params.userId, def, store, purchaseStore);
+                }
+            }
+            const response = {
+                userId: params.userId,
+                subscriptions,
+                purchases,
+                ...(entitlements ? { entitlements } : {}),
+            };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'customer error');
+        }
+    });
+    // GET /onesub/admin/webhook-deadletters
+    // POST /onesub/admin/webhook-replay/:id
+    // Only mounted when the configured queue supports dead-letter inspection
+    // (the default in-process queue does not — Apple/Google retries are the
+    // durability layer for that mode).
+    if (webhookQueue?.listDeadLetters) {
+        router.get('/onesub/admin/webhook-deadletters', async (_req, res) => {
+            try {
+                const items = await webhookQueue.listDeadLetters();
+                res.status(200).json({ items });
+            }
+            catch (err) {
+                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
+            }
+        });
+    }
+    if (webhookQueue?.replayDeadLetter) {
+        const replayParamsSchema = z.object({ id: z.string().min(1).max(256) });
+        router.post('/onesub/admin/webhook-replay/:id', async (req, res) => {
+            let params;
+            try {
+                params = replayParamsSchema.parse(req.params);
+            }
+            catch {
+                sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'id required');
+                return;
+            }
+            try {
+                await webhookQueue.replayDeadLetter(params.id);
+                res.status(200).json({ ok: true });
+            }
+            catch (err) {
+                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'replay error');
+            }
+        });
+    }
+    return router;
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,aAA4B,EAC5B,KAAwB,EACxB,YAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEvC,wEAAwE;IACxE,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAEvC,mDAAmD;IACnD,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,iDAAiD;QACjD,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAiB,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC;QAC5G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAiB;YAC7B,aAAa;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,gEAAgE;IAChE,qDAAqD;IACrD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,YAAY;YAChC,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,QAAQ;YAC5B,mBAAmB,CAAC,IAAI;SACwB,CAAC,CAAC,QAAQ,EAAE;QAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAA8B,CAAC,CAAC,QAAQ,EAAE;QAC7E,wEAAwE;QACxE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAA8B;gBAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,4BAA4B;IAC5B,EAAE;IACF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnD,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;aAClD,CAAC,CAAC;YAEH,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,YAA2D,CAAC;YAChE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAA4B;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa;gBACb,SAAS;gBACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAgB,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,EAAE,gBAAgB,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACpF,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,gBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/apple-offer.d.ts

@@ -0,0 +1,21 @@
+import { Router } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+/**
+ * POST /onesub/apple/offer-signature
+ *
+ * Sign an Apple Promotional Offer payload server-side.
+ * Requires config.apple.offerKeyId and config.apple.offerPrivateKey.
+ *
+ * Authentication: if config.adminSecret is set, the request must carry
+ * `X-Onesub-Offer-Secret: <adminSecret>` (same value). Hosts that mount
+ * onesub without adminSecret are responsible for securing this endpoint
+ * themselves (e.g. behind their own auth middleware).
+ *
+ * Body: { productId, offerId, applicationUsername }
+ * Response: { keyId, nonce, timestamp, signature }
+ *
+ * The client passes these four values to StoreKit's
+ * Product.SubscriptionOffer.Signature to redeem the offer.
+ */
+export declare function createAppleOfferRouter(config: OneSubServerConfig): Router | null;
+//# sourceMappingURL=apple-offer.d.ts.map

package/dist/routes/apple-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-offer.d.ts","sourceRoot":"","sources":["../../src/routes/apple-offer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAazD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CA+ChF"}

package/dist/routes/entitlements.js

@@ -0,0 +1,130 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { ROUTES, SUBSCRIPTION_STATUS, ONESUB_ERROR_CODE, PURCHASE_TYPE } from '@onesub/shared';
+import { log } from '../logger.js';
+import { sendError } from '../errors.js';
+/**
+ * Evaluate a single entitlement for a user.
+ *
+ * A user is entitled when EITHER condition holds for any productId in
+ * `entitlement.productIds`:
+ *   1. an active subscription (status === active|grace_period AND
+ *      expiresAt > now) for that productId exists
+ *   2. a non-consumable purchase for that productId exists
+ *
+ * Consumables are intentionally excluded — they grant a one-time resource,
+ * not an ongoing right.
+ *
+ * Subscription is preferred over purchase when both match (subs carry an
+ * expiry; non-consumables are forever) so the source field skews toward the
+ * more "interesting" signal for ops/analytics.
+ */
+export async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
+    const productIdSet = new Set(entitlement.productIds);
+    const now = Date.now();
+    // 1. Check subscriptions first (richer signal — has expiry).
+    const subs = await store.getAllByUserId(userId);
+    for (const sub of subs) {
+        if (!productIdSet.has(sub.productId))
+            continue;
+        const statusAllows = sub.status === SUBSCRIPTION_STATUS.ACTIVE ||
+            sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD;
+        if (!statusAllows)
+            continue;
+        if (new Date(sub.expiresAt).getTime() <= now)
+            continue;
+        return {
+            active: true,
+            source: 'subscription',
+            productId: sub.productId,
+            expiresAt: sub.expiresAt,
+        };
+    }
+    // 2. Check non-consumable purchases.
+    const purchases = await purchaseStore.getPurchasesByUserId(userId);
+    for (const p of purchases) {
+        if (p.type !== PURCHASE_TYPE.NON_CONSUMABLE)
+            continue;
+        if (!productIdSet.has(p.productId))
+            continue;
+        return {
+            active: true,
+            source: 'purchase',
+            productId: p.productId,
+        };
+    }
+    return { active: false, source: null };
+}
+const userIdSchema = z.string().min(1).max(256);
+const entitlementIdSchema = z.string().min(1).max(128);
+export function createEntitlementRouter(config, store, purchaseStore) {
+    // Only mount when entitlements are configured. Without this guard, the
+    // routes would always 503 — better to make the absence loud (404 from
+    // express) so misconfiguration is obvious during dev.
+    if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
+        return null;
+    }
+    const entitlements = config.entitlements;
+    const router = Router();
+    /**
+     * GET /onesub/entitlement?userId=&id=premium
+     * Single entitlement check.
+     */
+    router.get(ROUTES.ENTITLEMENT, async (req, res) => {
+        let userId;
+        let id;
+        try {
+            userId = userIdSchema.parse(req.query['userId']);
+            id = entitlementIdSchema.parse(req.query['id']);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId and id are required');
+            return;
+        }
+        const entitlement = entitlements[id];
+        if (!entitlement) {
+            sendError(res, 404, ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
+            return;
+        }
+        try {
+            const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
+            const response = { id, ...status };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            log.error('[onesub/entitlement] evaluation error:', err);
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, 'Internal server error');
+        }
+    });
+    /**
+     * GET /onesub/entitlements?userId=
+     * Evaluate every configured entitlement in one round-trip — useful on
+     * app launch / login when the host wants the full entitlement map.
+     */
+    router.get(ROUTES.ENTITLEMENTS, async (req, res) => {
+        let userId;
+        try {
+            userId = userIdSchema.parse(req.query['userId']);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId is required');
+            return;
+        }
+        try {
+            const entries = await Promise.all(Object.entries(entitlements).map(async ([id, entitlement]) => {
+                const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
+                return [id, status];
+            }));
+            const response = {
+                entitlements: Object.fromEntries(entries),
+            };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            log.error('[onesub/entitlements] evaluation error:', err);
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, 'Internal server error', { entitlements: {} });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=entitlements.js.map

package/dist/routes/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../src/routes/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/F,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,WAAwB,EACxB,KAAwB,EACxB,aAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC/C,MAAM,YAAY,GAChB,GAAG,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM;YACzC,GAAG,CAAC,MAAM,KAAK,mBAAmB,CAAC,YAAY,CAAC;QAClD,IAAI,CAAC,YAAY;YAAE,SAAS;QAC5B,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG;YAAE,SAAS;QACvD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,cAAc;YAAE,SAAS;QACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS;QAC7C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEvD,MAAM,UAAU,uBAAuB,CACrC,MAA0B,EAC1B,KAAwB,EACxB,aAA4B;IAE5B,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAuB,MAAM,CAAC,YAAY,CAAC;IAE7D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,IAAI,MAAc,CAAC;QACnB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAwB,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;YACzD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACpF,OAAO,CAAC,EAAE,EAAE,MAAM,CAAU,CAAC;YAC/B,CAAC,CAAC,CACH,CAAC;YACF,MAAM,QAAQ,GAAyB;gBACrC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;aAC1C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC1D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAE,uBAAuB,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}