@onesub/server 0.12.1 → 0.13.1

package/dist/providers/mock.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { SUBSCRIPTION_STATUS, MOCK_RECEIPT_PREFIX } from '@onesub/shared';
+import { log } from '../logger.js';
+export function classifyMockReceipt(receipt) {
+    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.NETWORK_ERROR))
+        return { kind: 'network-error' };
+    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.REVOKED))
+        return { kind: 'revoked' };
+    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.EXPIRED))
+        return { kind: 'expired' };
+    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.INVALID) ||
+        receipt.startsWith(MOCK_RECEIPT_PREFIX.BAD_SIG)) {
+        return { kind: 'invalid' };
+    }
+    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.SANDBOX))
+        return { kind: 'sandbox' };
+    return { kind: 'valid' };
+}
+/**
+ * Gate the outcome against `valid` / `sandbox`. Throws for network-error,
+ * logs + returns false for rejection cases, returns true for pass-through.
+ * Every mock validator uses this so their rejection behavior stays in sync.
+ */
+function outcomePasses(outcome, tag) {
+    if (outcome.kind === 'network-error') {
+        throw new Error(`[onesub/mock/${tag}] simulated upstream network error`);
+    }
+    if (outcome.kind === 'valid' || outcome.kind === 'sandbox')
+        return true;
+    log.warn(`[onesub/mock/${tag}] receipt rejected`, { outcome: outcome.kind });
+    return false;
+}
+function deterministicTransactionId(prefix, receipt) {
+    const digest = createHash('sha256').update(receipt).digest('hex').slice(0, 24);
+    return `${prefix}_${digest}`;
+}
+const HOURS = 60 * 60 * 1000;
+const DAYS = 24 * HOURS;
+export function mockValidateAppleSubscription(receipt) {
+    const outcome = classifyMockReceipt(receipt);
+    if (!outcomePasses(outcome, 'apple'))
+        return null;
+    const now = Date.now();
+    const expiresAt = outcome.kind === 'sandbox' ? now + 1 * HOURS : now + 30 * DAYS;
+    return {
+        userId: '',
+        productId: 'mock_subscription',
+        platform: 'apple',
+        status: SUBSCRIPTION_STATUS.ACTIVE,
+        expiresAt: new Date(expiresAt).toISOString(),
+        originalTransactionId: deterministicTransactionId('mock_apple_orig', receipt),
+        purchasedAt: new Date(now).toISOString(),
+        willRenew: true,
+    };
+}
+export function mockValidateAppleProduct(receipt, expectedProductId) {
+    const outcome = classifyMockReceipt(receipt);
+    if (!outcomePasses(outcome, 'apple'))
+        return null;
+    const productId = expectedProductId ?? 'mock_product';
+    return {
+        transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
+        productId,
+        purchasedAt: new Date().toISOString(),
+    };
+}
+export function mockValidateGoogleSubscription(receipt, productId) {
+    const outcome = classifyMockReceipt(receipt);
+    if (!outcomePasses(outcome, 'google'))
+        return null;
+    const now = Date.now();
+    const expiresAt = outcome.kind === 'sandbox' ? now + 1 * HOURS : now + 30 * DAYS;
+    return {
+        userId: '',
+        productId,
+        platform: 'google',
+        status: SUBSCRIPTION_STATUS.ACTIVE,
+        expiresAt: new Date(expiresAt).toISOString(),
+        originalTransactionId: deterministicTransactionId('mock_google_orig', receipt),
+        purchasedAt: new Date(now).toISOString(),
+        willRenew: true,
+    };
+}
+export function mockValidateGoogleProduct(receipt, productId) {
+    const outcome = classifyMockReceipt(receipt);
+    if (!outcomePasses(outcome, 'google'))
+        return null;
+    return {
+        transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
+        purchasedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=mock.js.map

package/dist/providers/mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../src/providers/mock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AA8BnC,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC5F,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,IACE,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC/C,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAA2B,EAAE,GAAW;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACjF,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,mBAAmB;QAC9B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,mBAAmB,CAAC,MAAM;QAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,qBAAqB,EAAE,0BAA0B,CAAC,iBAAiB,EAAE,OAAO,CAAC;QAC7E,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,iBAA0B;IAE1B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,iBAAiB,IAAI,cAAc,CAAC;IACtD,OAAO;QACL,aAAa,EAAE,0BAA0B,CAAC,cAAc,SAAS,EAAE,EAAE,OAAO,CAAC;QAC7E,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAe,EACf,SAAiB;IAEjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACjF,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS;QACT,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,mBAAmB,CAAC,MAAM;QAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,qBAAqB,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,OAAO,CAAC;QAC9E,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,SAAiB;IAEjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO;QACL,aAAa,EAAE,0BAA0B,CAAC,eAAe,SAAS,EAAE,EAAE,OAAO,CAAC;QAC9E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CAiQf"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CA2Sf"}

package/dist/routes/admin.js

@@ -0,0 +1,327 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { PURCHASE_TYPE, ONESUB_ERROR_CODE, ROUTES, SUBSCRIPTION_STATUS } from '@onesub/shared';
+import { evaluateEntitlement } from './entitlements.js';
+import { sendError, sendZodError } from '../errors.js';
+import { fetchAppleSubscriptionStatus } from '../providers/apple.js';
+const ADMIN_SECRET_HEADER = 'x-admin-secret';
+/**
+ * Admin routes for testing / operational tasks. Require `X-Admin-Secret`
+ * header matching config.adminSecret. If config.adminSecret is not set, the
+ * entire admin router is not mounted (returns 404 from the parent router).
+ *
+ * Endpoints:
+ *   DELETE /onesub/purchase/admin/:userId/:productId
+ *     → reset a non-consumable so the user can test the purchase flow again
+ *
+ *   POST /onesub/purchase/admin/grant
+ *     → manually insert a purchase record (skips store verification)
+ *     body: { userId, productId, platform, type?, transactionId? }
+ *
+ *   POST /onesub/purchase/admin/transfer
+ *     → reassign a transactionId to a new userId (device migration)
+ *
+ *   GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
+ *     → filtered/paginated subscription list (used by dashboard + scripts)
+ *
+ *   GET /onesub/admin/subscriptions/:transactionId
+ *     → single subscription record by originalTransactionId (dashboard detail page)
+ *
+ *   GET /onesub/admin/customers/:userId
+ *     → bundle of every record onesub knows for one user (subs + purchases +
+ *       entitlements when configured). Backs the dashboard customer detail page.
+ */
+export function createAdminRouter(config, purchaseStore, store, webhookQueue) {
+    if (!config.adminSecret)
+        return null;
+    const router = Router();
+    const adminSecret = config.adminSecret;
+    // Auth middleware — applied to both admin scopes. Without this guard, a
+    // misconfigured mount on the parent root would expose admin endpoints
+    // alongside host-app routes (e.g. /health).
+    const adminAuth = (req, res, next) => {
+        const provided = req.headers[ADMIN_SECRET_HEADER];
+        if (typeof provided !== 'string' || provided !== adminSecret) {
+            sendError(res, 401, ONESUB_ERROR_CODE.INVALID_ADMIN_SECRET, 'INVALID_ADMIN_SECRET');
+            return;
+        }
+        next();
+    };
+    router.use('/onesub/purchase/admin', adminAuth);
+    router.use('/onesub/admin', adminAuth);
+    // DELETE /onesub/purchase/admin/:userId/:productId
+    // Express 5 types route params as `string | string[]` — narrow via zod.
+    const resetParamsSchema = z.object({
+        userId: z.string().min(1).max(256),
+        productId: z.string().min(1).max(256),
+    });
+    router.delete('/onesub/purchase/admin/:userId/:productId', async (req, res) => {
+        let params;
+        try {
+            params = resetParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId and productId required');
+            return;
+        }
+        const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
+        res.json({ ok: true, deleted });
+    });
+    // POST /onesub/purchase/admin/transfer — reassign transactionId to a new userId
+    // (legitimate device/account migration)
+    const transferSchema = z.object({
+        transactionId: z.string().min(1).max(256),
+        newUserId: z.string().min(1).max(256),
+    });
+    router.post('/onesub/purchase/admin/transfer', async (req, res) => {
+        let body;
+        try {
+            body = transferSchema.parse(req.body);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
+        if (!existing) {
+            sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
+            return;
+        }
+        // Delete the old row, then save under new userId
+        await purchaseStore.deletePurchases(existing.userId, existing.productId);
+        const migrated = { ...existing, userId: body.newUserId };
+        await purchaseStore.savePurchase(migrated);
+        res.json({ ok: true, purchase: migrated });
+    });
+    // POST /onesub/purchase/admin/grant
+    const grantSchema = z.object({
+        userId: z.string().min(1).max(256),
+        productId: z.string().min(1).max(256),
+        platform: z.enum(['apple', 'google']),
+        type: z.enum([PURCHASE_TYPE.CONSUMABLE, PURCHASE_TYPE.NON_CONSUMABLE]).default(PURCHASE_TYPE.NON_CONSUMABLE),
+        transactionId: z.string().min(1).max(256).optional(),
+    });
+    router.post('/onesub/purchase/admin/grant', async (req, res) => {
+        let body;
+        try {
+            body = grantSchema.parse(req.body);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+        const purchase = {
+            transactionId,
+            userId: body.userId,
+            productId: body.productId,
+            platform: body.platform,
+            type: body.type,
+            quantity: 1,
+            purchasedAt: new Date().toISOString(),
+        };
+        await purchaseStore.savePurchase(purchase);
+        res.json({ ok: true, purchase });
+    });
+    // GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
+    // Filtered + paginated subscription list. Backs the dashboard's
+    // subscriptions page and ad-hoc operational scripts.
+    const listQuerySchema = z.object({
+        userId: z.string().min(1).max(256).optional(),
+        status: z.enum([
+            SUBSCRIPTION_STATUS.ACTIVE,
+            SUBSCRIPTION_STATUS.GRACE_PERIOD,
+            SUBSCRIPTION_STATUS.ON_HOLD,
+            SUBSCRIPTION_STATUS.PAUSED,
+            SUBSCRIPTION_STATUS.EXPIRED,
+            SUBSCRIPTION_STATUS.CANCELED,
+            SUBSCRIPTION_STATUS.NONE,
+        ]).optional(),
+        productId: z.string().min(1).max(256).optional(),
+        platform: z.enum(['apple', 'google']).optional(),
+        // Cap at 200 server-side so a runaway dashboard query can't tip the DB.
+        limit: z.coerce.number().int().positive().max(200).optional(),
+        offset: z.coerce.number().int().nonnegative().optional(),
+    });
+    router.get(ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
+        let query;
+        try {
+            query = listQuerySchema.parse(req.query);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        try {
+            const result = await store.listFiltered(query);
+            const response = {
+                items: result.items,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset,
+            };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            // Bubble the message up but not the stack — admin clients log status code
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
+        }
+    });
+    // GET /onesub/admin/subscriptions/:transactionId — single record by
+    // originalTransactionId. Backs the dashboard's subscription detail page.
+    const detailParamsSchema = z.object({
+        transactionId: z.string().min(1).max(256),
+    });
+    router.get('/onesub/admin/subscriptions/:transactionId', async (req, res) => {
+        let params;
+        try {
+            params = detailParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'transactionId required');
+            return;
+        }
+        try {
+            const sub = await store.getByTransactionId(params.transactionId);
+            if (!sub) {
+                sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
+                return;
+            }
+            res.status(200).json(sub);
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'detail error');
+        }
+    });
+    // GET /onesub/admin/customers/:userId — full per-user profile. Combines the
+    // store calls a CS dashboard makes for "show me everything about this user"
+    // into a single round-trip.
+    //
+    // Always returns 200 (even for unknown userIds) — empty arrays + no
+    // entitlements means "we have no record of this user", which is a valid
+    // signal for the dashboard to render rather than an error condition.
+    const customerParamsSchema = z.object({
+        userId: z.string().min(1).max(256),
+    });
+    router.get('/onesub/admin/customers/:userId', async (req, res) => {
+        let params;
+        try {
+            params = customerParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId required');
+            return;
+        }
+        try {
+            const [subscriptions, purchases] = await Promise.all([
+                store.getAllByUserId(params.userId),
+                purchaseStore.getPurchasesByUserId(params.userId),
+            ]);
+            // Evaluate entitlements only when configured. Hosts that don't use the
+            // entitlement abstraction get the field omitted (dashboard hides panel).
+            let entitlements;
+            if (config.entitlements && Object.keys(config.entitlements).length > 0) {
+                entitlements = {};
+                for (const [id, def] of Object.entries(config.entitlements)) {
+                    entitlements[id] = await evaluateEntitlement(params.userId, def, store, purchaseStore);
+                }
+            }
+            const response = {
+                userId: params.userId,
+                subscriptions,
+                purchases,
+                ...(entitlements ? { entitlements } : {}),
+            };
+            res.status(200).json(response);
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'customer error');
+        }
+    });
+    // POST /onesub/admin/sync-apple/:originalTransactionId
+    // Fetch the current subscription state directly from Apple's Status API and
+    // upsert into the local store. Useful for reconciliation / missed-webhook recovery.
+    const syncAppleParamsSchema = z.object({
+        originalTransactionId: z.string().min(1).max(256),
+    });
+    router.post(ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
+        let params;
+        try {
+            params = syncAppleParamsSchema.parse(req.params);
+        }
+        catch {
+            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'originalTransactionId required');
+            return;
+        }
+        if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
+            sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, 'Apple API credentials not configured');
+            return;
+        }
+        try {
+            const { originalTransactionId } = params;
+            // Allow callers to force sandbox mode; otherwise infer from the stored record.
+            const existingForEnv = await store.getByTransactionId(originalTransactionId);
+            const isSandbox = req.query['sandbox'] === 'true' ||
+                existingForEnv?.environment === 'Sandbox';
+            const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, { sandbox: isSandbox });
+            if (!fresh) {
+                sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'Apple Status API returned no record');
+                return;
+            }
+            const existing = existingForEnv;
+            fresh.userId = existing?.userId ?? originalTransactionId;
+            await store.save(fresh);
+            res.status(200).json({ ok: true, subscription: fresh });
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? 'sync error');
+        }
+    });
+    // GET /onesub/admin/webhook-deadletters
+    // POST /onesub/admin/webhook-replay/:id
+    // Only mounted when the configured queue supports dead-letter inspection
+    // (the default in-process queue does not — Apple/Google retries are the
+    // durability layer for that mode).
+    if (webhookQueue?.listDeadLetters) {
+        router.get('/onesub/admin/webhook-deadletters', async (_req, res) => {
+            try {
+                const items = await webhookQueue.listDeadLetters();
+                res.status(200).json({ items });
+            }
+            catch (err) {
+                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
+            }
+        });
+    }
+    if (webhookQueue?.replayDeadLetter) {
+        const replayParamsSchema = z.object({ id: z.string().min(1).max(256) });
+        router.post('/onesub/admin/webhook-replay/:id', async (req, res) => {
+            let params;
+            try {
+                params = replayParamsSchema.parse(req.params);
+            }
+            catch {
+                sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'id required');
+                return;
+            }
+            try {
+                await webhookQueue.replayDeadLetter(params.id);
+                res.status(200).json({ ok: true });
+            }
+            catch (err) {
+                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'replay error');
+            }
+        });
+    }
+    return router;
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,aAA4B,EAC5B,KAAwB,EACxB,YAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEvC,wEAAwE;IACxE,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAEvC,mDAAmD;IACnD,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,iDAAiD;QACjD,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAiB,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC;QAC5G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAiB;YAC7B,aAAa;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,gEAAgE;IAChE,qDAAqD;IACrD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,YAAY;YAChC,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,QAAQ;YAC5B,mBAAmB,CAAC,IAAI;SACwB,CAAC,CAAC,QAAQ,EAAE;QAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAA8B,CAAC,CAAC,QAAQ,EAAE;QAC7E,wEAAwE;QACxE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAA8B;gBAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,4BAA4B;IAC5B,EAAE;IACF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnD,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;aAClD,CAAC,CAAC;YAEH,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,YAA2D,CAAC;YAChE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAA4B;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa;gBACb,SAAS;gBACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,4EAA4E;IAC5E,oFAAoF;IACpF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;QACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACjF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC;YACzC,+EAA+E;YAC/E,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YAC7E,MAAM,SAAS,GACb,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM;gBAC9B,cAA4E,EAAE,WAAW,KAAK,SAAS,CAAC;YAC3G,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,cAAc,CAAC;YAChC,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,qBAAqB,CAAC;YACzD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAgB,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,EAAE,gBAAgB,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACpF,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,gBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/apple-offer.d.ts

@@ -0,0 +1,21 @@
+import { Router } from 'express';
+import type { OneSubServerConfig } from '@onesub/shared';
+/**
+ * POST /onesub/apple/offer-signature
+ *
+ * Sign an Apple Promotional Offer payload server-side.
+ * Requires config.apple.offerKeyId and config.apple.offerPrivateKey.
+ *
+ * Authentication: if config.adminSecret is set, the request must carry
+ * `X-Onesub-Offer-Secret: <adminSecret>` (same value). Hosts that mount
+ * onesub without adminSecret are responsible for securing this endpoint
+ * themselves (e.g. behind their own auth middleware).
+ *
+ * Body: { productId, offerId, applicationUsername }
+ * Response: { keyId, nonce, timestamp, signature }
+ *
+ * The client passes these four values to StoreKit's
+ * Product.SubscriptionOffer.Signature to redeem the offer.
+ */
+export declare function createAppleOfferRouter(config: OneSubServerConfig): Router | null;
+//# sourceMappingURL=apple-offer.d.ts.map

package/dist/routes/apple-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-offer.d.ts","sourceRoot":"","sources":["../../src/routes/apple-offer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAazD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CA+ChF"}

package/dist/routes/apple-offer.js

@@ -0,0 +1,72 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { ONESUB_ERROR_CODE } from '@onesub/shared';
+import { signApplePromotionalOffer } from '../providers/apple.js';
+import { sendError, sendZodError } from '../errors.js';
+const OFFER_SECRET_HEADER = 'x-onesub-offer-secret';
+const offerBodySchema = z.object({
+    productId: z.string().min(1).max(256),
+    offerId: z.string().min(1).max(256),
+    applicationUsername: z.string().min(1).max(256),
+});
+/**
+ * POST /onesub/apple/offer-signature
+ *
+ * Sign an Apple Promotional Offer payload server-side.
+ * Requires config.apple.offerKeyId and config.apple.offerPrivateKey.
+ *
+ * Authentication: if config.adminSecret is set, the request must carry
+ * `X-Onesub-Offer-Secret: <adminSecret>` (same value). Hosts that mount
+ * onesub without adminSecret are responsible for securing this endpoint
+ * themselves (e.g. behind their own auth middleware).
+ *
+ * Body: { productId, offerId, applicationUsername }
+ * Response: { keyId, nonce, timestamp, signature }
+ *
+ * The client passes these four values to StoreKit's
+ * Product.SubscriptionOffer.Signature to redeem the offer.
+ */
+export function createAppleOfferRouter(config) {
+    const apple = config.apple;
+    if (!apple?.offerKeyId || !apple?.offerPrivateKey)
+        return null;
+    const router = Router();
+    router.post('/onesub/apple/offer-signature', async (req, res) => {
+        if (config.adminSecret) {
+            const provided = req.headers[OFFER_SECRET_HEADER];
+            if (typeof provided !== 'string' || provided !== config.adminSecret) {
+                sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, 'Unauthorized');
+                return;
+            }
+        }
+        let body;
+        try {
+            body = offerBodySchema.parse(req.body);
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                sendZodError(res, err);
+                return;
+            }
+            throw err;
+        }
+        if (!apple.bundleId) {
+            sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, 'config.apple.bundleId is required for offer signing');
+            return;
+        }
+        try {
+            const result = await signApplePromotionalOffer({
+                bundleId: apple.bundleId,
+                productId: body.productId,
+                offerId: body.offerId,
+                applicationUsername: body.applicationUsername,
+            }, apple);
+            res.status(200).json(result);
+        }
+        catch (err) {
+            sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? 'Offer signing failed');
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=apple-offer.js.map

package/dist/routes/apple-offer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-offer.js","sourceRoot":"","sources":["../../src/routes/apple-offer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAsG,CAAC;IAC5H,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,IAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;gBACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,EACD,KAAK,CACN,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAG,GAAa,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}