@onesub/server 0.13.1 → 0.15.0

package/dist/__tests__/google-subscriptions-v2.test.d.ts

@@ -6,7 +6,7 @@
  *   - subscriptionState string enum → onesub SubscriptionStatus mapping
  *   - lineItems productId match (success / mismatch)
  *   - autoRenewingPlan.autoRenewEnabled → willRenew
- *   - latestOrderId → originalTransactionId
+ *   - purchaseToken → originalTransactionId (webhooks look records up by token)
  *   - PENDING / UNSPECIFIED states rejected (return null)
  */
 export {};

package/dist/__tests__/tracing.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tracing.test.d.ts.map

package/dist/__tests__/tracing.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tracing.test.ts"],"names":[],"mappings":""}

package/dist/cache.d.ts

@@ -21,11 +21,16 @@ export interface CacheAdapter {
  */
 export declare class InMemoryCacheAdapter implements CacheAdapter {
     private readonly entries;
+    private setsSinceSweep;
     get<T>(key: string): Promise<T | null>;
     set<T>(key: string, value: T, ttlSeconds?: number): Promise<void>;
     del(key: string): Promise<void>;
+    /** Evict every entry whose TTL has elapsed. */
+    private sweepExpired;
     /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
     clear(): void;
+    /** Test helper — number of entries currently held (including not-yet-swept expired ones). */
+    get size(): number;
 }
 export declare function getDefaultCache(): CacheAdapter;
 export declare function setDefaultCache(adapter: CacheAdapter): void;

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,wDAAwD;IACxD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAQD;;GAEG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAE9C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAUtC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,oFAAoF;IACpF,KAAK,IAAI,IAAI;CAGd;AAQD,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAE3D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,wDAAwD;IACxD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAWD;;GAEG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,cAAc,CAAK;IAErB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAUtC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,+CAA+C;IAC/C,OAAO,CAAC,YAAY;IAQpB,oFAAoF;IACpF,KAAK,IAAI,IAAI;IAKb,6FAA6F;IAC7F,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAQD,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAE3D"}

package/dist/index.cjs

@@ -5,13 +5,19 @@ var shared = require('@onesub/shared');
 var zod = require('zod');
 var jose = require('jose');
 var crypto = require('crypto');
+var module$1 = require('module');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var express__default = /*#__PURE__*/_interopDefault(express);
 
-// src/index.ts
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/store.ts
 var InMemorySubscriptionStore = class {
@@ -21,6 +27,14 @@ var InMemorySubscriptionStore = class {
   byUserId = /* @__PURE__ */ new Map();
   byTransactionId = /* @__PURE__ */ new Map();
   async save(sub) {
+    const prev = this.byTransactionId.get(sub.originalTransactionId);
+    if (prev && prev.userId !== sub.userId) {
+      const oldList = (this.byUserId.get(prev.userId) ?? []).filter(
+        (s) => s.originalTransactionId !== sub.originalTransactionId
+      );
+      if (oldList.length) this.byUserId.set(prev.userId, oldList);
+      else this.byUserId.delete(prev.userId);
+    }
     this.byTransactionId.set(sub.originalTransactionId, sub);
     const existing = this.byUserId.get(sub.userId) ?? [];
     const filtered = existing.filter((s) => s.originalTransactionId !== sub.originalTransactionId);
@@ -181,8 +195,10 @@ async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_M
 }
 
 // src/cache.ts
+var SWEEP_EVERY_N_SETS = 256;
 var InMemoryCacheAdapter = class {
   entries = /* @__PURE__ */ new Map();
+  setsSinceSweep = 0;
   async get(key) {
     const entry = this.entries.get(key);
     if (!entry) return null;
@@ -195,13 +211,29 @@ var InMemoryCacheAdapter = class {
   async set(key, value, ttlSeconds) {
     const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1e3 : 0;
     this.entries.set(key, { value, expiresAt });
+    if (++this.setsSinceSweep >= SWEEP_EVERY_N_SETS) {
+      this.sweepExpired();
+    }
   }
   async del(key) {
     this.entries.delete(key);
   }
+  /** Evict every entry whose TTL has elapsed. */
+  sweepExpired() {
+    this.setsSinceSweep = 0;
+    const now = Date.now();
+    for (const [key, entry] of this.entries) {
+      if (entry.expiresAt !== 0 && entry.expiresAt < now) this.entries.delete(key);
+    }
+  }
   /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
   clear() {
     this.entries.clear();
+    this.setsSinceSweep = 0;
+  }
+  /** Test helper — number of entries currently held (including not-yet-swept expired ones). */
+  get size() {
+    return this.entries.size;
   }
 };
 var defaultAdapter = new InMemoryCacheAdapter();
@@ -240,6 +272,7 @@ function mockValidateAppleSubscription(receipt) {
   if (!outcomePasses(outcome, "apple")) return null;
   const now = Date.now();
   const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     userId: "",
     productId: "mock_subscription",
@@ -248,17 +281,20 @@ function mockValidateAppleSubscription(receipt) {
     expiresAt: new Date(expiresAt).toISOString(),
     originalTransactionId: deterministicTransactionId("mock_apple_orig", receipt),
     purchasedAt: new Date(now).toISOString(),
-    willRenew: true
+    willRenew: true,
+    ...tokenMatch ? { boundAccountId: tokenMatch[1] } : {}
   };
 }
 function mockValidateAppleProduct(receipt, expectedProductId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "apple")) return null;
   const productId = expectedProductId ?? "mock_product";
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
     productId,
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { appAccountToken: tokenMatch[1] } : {}
   };
 }
 function mockValidateGoogleSubscription(receipt, productId) {
@@ -266,23 +302,29 @@ function mockValidateGoogleSubscription(receipt, productId) {
   if (!outcomePasses(outcome, "google")) return null;
   const now = Date.now();
   const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     userId: "",
     productId,
     platform: "google",
     status: shared.SUBSCRIPTION_STATUS.ACTIVE,
     expiresAt: new Date(expiresAt).toISOString(),
-    originalTransactionId: deterministicTransactionId("mock_google_orig", receipt),
+    // Same keying as production: Google records are keyed by the purchaseToken
+    // (the receipt itself) so mock webhooks can find them by token.
+    originalTransactionId: receipt,
     purchasedAt: new Date(now).toISOString(),
-    willRenew: true
+    willRenew: true,
+    ...tokenMatch ? { boundAccountId: tokenMatch[1] } : {}
   };
 }
 function mockValidateGoogleProduct(receipt, productId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "google")) return null;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { obfuscatedExternalAccountId: tokenMatch[1] } : {}
   };
 }
 
@@ -390,8 +432,9 @@ async function validateAppleReceipt(receipt, config) {
     expiresAt: new Date(tx.expiresDate).toISOString(),
     originalTransactionId: tx.originalTransactionId,
     purchasedAt: new Date(purchasedAt).toISOString(),
-    willRenew: status === shared.SUBSCRIPTION_STATUS.ACTIVE
+    willRenew: status === shared.SUBSCRIPTION_STATUS.ACTIVE,
     // refined by renewal info in webhook
+    ...tx.appAccountToken ? { boundAccountId: tx.appAccountToken } : {}
   };
 }
 async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
@@ -446,7 +489,8 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
   return {
     transactionId,
     productId: tx.productId,
-    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    appAccountToken: tx.appAccountToken ?? void 0
   };
 }
 async function decodeAppleNotification(payload, skipJwsVerification = false) {
@@ -950,6 +994,7 @@ async function validateGoogleReceipt(receipt, productId, config) {
   const purchasedAt = purchase.startTime ?? (/* @__PURE__ */ new Date()).toISOString();
   const willRenew = lineItem.autoRenewingPlan?.autoRenewEnabled ?? false;
   const autoResumeTime = status === shared.SUBSCRIPTION_STATUS.PAUSED ? purchase.pausedStateContext?.autoResumeTime : void 0;
+  const boundAccountId = purchase.externalAccountIdentifiers?.obfuscatedExternalAccountId;
   return {
     userId: "",
     // caller fills this in
@@ -957,13 +1002,18 @@ async function validateGoogleReceipt(receipt, productId, config) {
     platform: "google",
     status,
     expiresAt,
-    originalTransactionId: purchase.latestOrderId ?? receipt.slice(0, 64),
+    // Keyed by the purchaseToken, NOT latestOrderId: RTDN webhooks and
+    // linkedPurchaseToken chains only carry the token, so records keyed by
+    // order id are invisible to the entire webhook lifecycle (refund/cancel/
+    // renewal would never find them).
+    originalTransactionId: receipt,
     purchasedAt,
     willRenew,
     // Surface the linked token so host apps (and our webhook userId-continuity
     // logic) can follow upgrade/downgrade chains.
     linkedPurchaseToken: purchase.linkedPurchaseToken,
-    autoResumeTime
+    autoResumeTime,
+    ...boundAccountId ? { boundAccountId } : {}
   };
 }
 async function validateGoogleProductReceipt(purchaseToken, productId, config, type = "non_consumable") {
@@ -1005,7 +1055,8 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
   }
   return {
     transactionId: purchase.orderId,
-    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    obfuscatedExternalAccountId: purchase.obfuscatedExternalAccountId
   };
 }
 function decodeGoogleNotification(payload) {
@@ -1138,6 +1189,22 @@ function createValidateRouter(config, store) {
         sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_SUB);
         return;
       }
+      const boundAccountId = sub.boundAccountId;
+      delete sub.boundAccountId;
+      const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
+      if (bindingMismatch) {
+        log.warn(
+          `[onesub/validate] account binding mismatch for ${sub.originalTransactionId}: receipt token does not match userId ${userId}`
+        );
+        sendError(
+          res,
+          409,
+          shared.ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+          "TRANSACTION_BELONGS_TO_OTHER_USER",
+          NO_SUB
+        );
+        return;
+      }
       sub.userId = userId;
       await store.save(sub);
       if (platform === "google" && config.google) {
@@ -1185,7 +1252,7 @@ function createStatusRouter(store) {
   return router;
 }
 var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set(["SUBSCRIBED", "DID_RENEW", "DID_RECOVER", "OFFER_REDEEMED"]);
-var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND", "CONSUMPTION_REQUEST"]);
+var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND"]);
 var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set(["EXPIRED"]);
 function mapAppleNotificationStatus(notificationType, subtype) {
   if (notificationType === "DID_FAIL_TO_RENEW") {
@@ -1242,6 +1309,11 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   } = decoded;
   const notificationType = payload.notificationType;
   const subtype = payload.subtype;
+  if (config.apple?.bundleId && bundleId && bundleId !== config.apple.bundleId) {
+    log.warn("[onesub/webhook/apple] Bundle ID mismatch:", bundleId, "!==", config.apple.bundleId);
+    sendError(res, 400, shared.ONESUB_ERROR_CODE.BUNDLE_ID_MISMATCH, "Bundle ID mismatch");
+    return;
+  }
   const mapped = mapAppleNotificationStatus(notificationType, subtype);
   const finalStatus = mapped ?? status;
   if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
@@ -1268,6 +1340,10 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   }
   const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
   const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
+  if (isOneTimePurchase && notificationType === "CONSUMPTION_REQUEST") {
+    res.status(200).json({ received: true });
+    return;
+  }
   try {
     if (isOneTimePurchase && isRefundOrRevoke) {
       const lookupId = transactionId ?? originalTransactionId;
@@ -1280,7 +1356,7 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     }
     const existing = await store.getByTransactionId(originalTransactionId);
     if (existing) {
-      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
+      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase;
       const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
       const correctedUserId = appAccountToken && existing.userId === originalTransactionId ? appAccountToken : existing.userId;
       if (correctedUserId !== existing.userId) {
@@ -1320,6 +1396,12 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     res.status(200).json({ received: true });
   } catch (err) {
     log.error("[onesub/webhook/apple] Store update error:", err);
+    if (webhookEventStore?.unmark && typeof payload.notificationUUID === "string") {
+      try {
+        await webhookEventStore.unmark("apple", payload.notificationUUID);
+      } catch {
+      }
+    }
     sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
   }
 }
@@ -1329,13 +1411,23 @@ function getGoogleJwks() {
   if (!googleJwks) googleJwks = jose.createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
   return googleJwks;
 }
-async function verifyGooglePushToken(req, expectedAudience) {
+async function verifyGooglePushToken(req, expectedAudience, expectedServiceAccountEmail) {
   const authHeader = req.headers["authorization"];
   if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) return false;
   try {
-    await jose.jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
-      audience: expectedAudience
+    const { payload } = await jose.jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
+      audience: expectedAudience,
+      // Any Google Cloud principal can mint an OIDC token with an arbitrary
+      // audience — issuer (and, when configured, the push service-account
+      // email) narrows acceptance to real Pub/Sub push auth tokens. Google
+      // documents both issuer forms, so accept either.
+      issuer: ["https://accounts.google.com", "accounts.google.com"]
     });
+    if (expectedServiceAccountEmail) {
+      if (payload["email"] !== expectedServiceAccountEmail || payload["email_verified"] !== true) {
+        return false;
+      }
+    }
     return true;
   } catch {
     return false;
@@ -1343,7 +1435,11 @@ async function verifyGooglePushToken(req, expectedAudience) {
 }
 async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
   if (config.google?.pushAudience) {
-    const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
+    const authenticated = await verifyGooglePushToken(
+      req,
+      config.google.pushAudience,
+      config.google.pushServiceAccountEmail
+    );
     if (!authenticated) {
       sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
       return;
@@ -1354,6 +1450,14 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     sendError(res, 400, shared.ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
     return;
   }
+  const unmarkEvent = async () => {
+    if (webhookEventStore?.unmark && typeof body.message?.messageId === "string") {
+      try {
+        await webhookEventStore.unmark("google", body.message.messageId);
+      } catch {
+      }
+    }
+  };
   if (webhookEventStore && typeof body.message.messageId === "string") {
     const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
     if (!fresh) {
@@ -1387,6 +1491,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       res.status(200).json({ received: true });
     } catch (err) {
       log.error("[onesub/webhook/google] voided notification error:", err);
+      await unmarkEvent();
       sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
     }
     return;
@@ -1413,6 +1518,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       res.status(200).json({ received: true });
     } catch (err) {
       log.error("[onesub/webhook/google] oneTimeProduct error:", err);
+      await unmarkEvent();
       sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process oneTimeProduct notification");
     }
     return;
@@ -1446,7 +1552,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     } else if (isGoogleExpiredNotification(notificationType)) {
       finalStatus = shared.SUBSCRIPTION_STATUS.EXPIRED;
     } else {
-      finalStatus = shared.SUBSCRIPTION_STATUS.ACTIVE;
+      finalStatus = existing?.status ?? shared.SUBSCRIPTION_STATUS.ACTIVE;
     }
     if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
       const hook = config.google.onPriceChangeConfirmed;
@@ -1457,7 +1563,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       if (config.google?.serviceAccountKey) {
         const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
         if (fresh) {
-          const preserveNotificationStatus = finalStatus === shared.SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === shared.SUBSCRIPTION_STATUS.ON_HOLD;
+          const preserveNotificationStatus = isGoogleGracePeriodNotification(notificationType) || isGoogleOnHoldNotification(notificationType);
           updated = {
             ...existing,
             status: preserveNotificationStatus ? finalStatus : fresh.status,
@@ -1473,14 +1579,16 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       if (config.google?.serviceAccountKey) {
         const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
         if (fresh) {
+          const boundAccountId = fresh.boundAccountId;
+          delete fresh.boundAccountId;
           if (fresh.linkedPurchaseToken) {
             const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
-            fresh.userId = previous ? previous.userId : purchaseToken;
+            fresh.userId = previous ? previous.userId : boundAccountId ?? purchaseToken;
             if (previous) {
               log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
             }
           } else {
-            fresh.userId = purchaseToken;
+            fresh.userId = boundAccountId ?? purchaseToken;
           }
           await store.save(fresh);
         }
@@ -1491,6 +1599,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     res.status(200).json({ received: true });
   } catch (err) {
     log.error("[onesub/webhook/google] Error handling notification:", err);
+    await unmarkEvent();
     sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
   }
 }
@@ -1551,6 +1660,7 @@ function createPurchaseRouter(config, purchaseStore) {
       }
       let transactionId = null;
       let purchasedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let boundAccountId = null;
       if (platform === "apple") {
         if (!config.apple) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_PURCHASE);
@@ -1560,6 +1670,7 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.appAccountToken ?? null;
         }
       } else {
         if (!config.google) {
@@ -1575,12 +1686,27 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.obfuscatedExternalAccountId ?? null;
         }
       }
       if (!transactionId) {
         sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_PURCHASE);
         return;
       }
+      const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
+      if (bindingMismatch) {
+        log.warn(
+          `[onesub/purchase] account binding mismatch for transaction ${transactionId}: token does not match userId ${userId}`
+        );
+        sendError(
+          res,
+          409,
+          shared.ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+          "TRANSACTION_BELONGS_TO_OTHER_USER",
+          NO_PURCHASE
+        );
+        return;
+      }
       const existing = await purchaseStore.getPurchaseByTransactionId(transactionId);
       let action = "new";
       if (existing) {
@@ -1802,9 +1928,12 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
       return;
     }
-    await purchaseStore.deletePurchases(existing.userId, existing.productId);
+    const moved = await purchaseStore.reassignPurchase(body.transactionId, body.newUserId);
+    if (!moved) {
+      sendError(res, 404, shared.ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
+      return;
+    }
     const migrated = { ...existing, userId: body.newUserId };
-    await purchaseStore.savePurchase(migrated);
     res.json({ ok: true, purchase: migrated });
   });
   const grantSchema = zod.z.object({
@@ -2336,7 +2465,11 @@ var PostgresSubscriptionStore = class {
           );
         });
         const Pool = pg.default?.Pool ?? pg.Pool;
-        return new Pool({ connectionString: this.connectionString, max: 10 });
+        const pool = new Pool({ connectionString: this.connectionString, max: 10 });
+        pool.on("error", (err) => {
+          log.error("[onesub] PostgresSubscriptionStore pool error (idle client):", err);
+        });
+        return pool;
       })();
     }
     return this.poolPromise;
@@ -2508,7 +2641,11 @@ var PostgresPurchaseStore = class {
           );
         });
         const Pool = pg.default?.Pool ?? pg.Pool;
-        return new Pool({ connectionString: this.connectionString, max: 10 });
+        const pool = new Pool({ connectionString: this.connectionString, max: 10 });
+        pool.on("error", (err) => {
+          log.error("[onesub] PostgresPurchaseStore pool error (idle client):", err);
+        });
+        return pool;
       })();
     }
     return this.poolPromise;
@@ -2523,23 +2660,12 @@ var PostgresPurchaseStore = class {
   }
   async savePurchase(purchase) {
     const pool = await this.getPool();
-    const existing = await pool.query(
-      `SELECT user_id FROM onesub_purchases WHERE transaction_id = $1`,
-      [purchase.transactionId]
-    );
-    if (existing.rows.length > 0) {
-      const owner = existing.rows[0].user_id;
-      if (owner !== purchase.userId) {
-        const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
-        err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
-        throw err;
-      }
-      return;
-    }
-    await pool.query(
+    const inserted = await pool.query(
       `INSERT INTO onesub_purchases
          (transaction_id, user_id, product_id, platform, type, quantity, purchased_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (transaction_id) DO NOTHING
+       RETURNING transaction_id`,
       [
         purchase.transactionId,
         purchase.userId,
@@ -2550,6 +2676,17 @@ var PostgresPurchaseStore = class {
         purchase.purchasedAt
       ]
     );
+    if (inserted.rows.length > 0) return;
+    const existing = await pool.query(
+      `SELECT user_id FROM onesub_purchases WHERE transaction_id = $1`,
+      [purchase.transactionId]
+    );
+    const owner = existing.rows[0]?.user_id;
+    if (owner !== void 0 && owner !== purchase.userId) {
+      const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
+      err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
+      throw err;
+    }
   }
   async getPurchasesByUserId(userId) {
     const pool = await this.getPool();
@@ -2650,7 +2787,6 @@ function rowToPurchaseInfo(row) {
 // src/stores/redis.ts
 var SUB_TX_PREFIX = "onesub:sub:tx:";
 var SUB_USER_PREFIX = "onesub:sub:user:";
-var SUB_ALL = "onesub:sub:all";
 var SUB_ALL_SORTED = "onesub:sub:all:sorted";
 var PUR_TX_PREFIX = "onesub:purchase:tx:";
 var PUR_USER_PREFIX = "onesub:purchase:user:";
@@ -2665,10 +2801,14 @@ var RedisSubscriptionStore = class {
     const score = Date.now();
     const txKey = SUB_TX_PREFIX + sub.originalTransactionId;
     const userKey = SUB_USER_PREFIX + sub.userId;
+    const prevRaw = await this.redis.get(txKey);
+    const prevUserId = prevRaw ? JSON.parse(prevRaw).userId : null;
     const pipeline = this.redis.multi();
     pipeline.set(txKey, JSON.stringify(sub));
+    if (prevUserId !== null && prevUserId !== sub.userId) {
+      pipeline.zrem(SUB_USER_PREFIX + prevUserId, sub.originalTransactionId);
+    }
     pipeline.zadd(userKey, score, sub.originalTransactionId);
-    pipeline.sadd(SUB_ALL, sub.originalTransactionId);
     pipeline.zadd(SUB_ALL_SORTED, score, sub.originalTransactionId);
     await pipeline.exec();
   }
@@ -2740,19 +2880,18 @@ var RedisPurchaseStore = class {
   redis;
   async savePurchase(purchase) {
     const txKey = PUR_TX_PREFIX + purchase.transactionId;
-    const existing = await this.redis.get(txKey);
-    if (existing) {
-      const owner = JSON.parse(existing).userId;
-      if (owner !== purchase.userId) {
+    const claimed = await this.redis.set(txKey, JSON.stringify(purchase), "NX");
+    if (claimed !== "OK") {
+      const existing = await this.redis.get(txKey);
+      const owner = existing ? JSON.parse(existing).userId : null;
+      if (owner !== null && owner !== purchase.userId) {
         const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
         err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
         throw err;
       }
-      return;
     }
     const score = Date.parse(purchase.purchasedAt) || Date.now();
     const pipeline = this.redis.multi();
-    pipeline.set(txKey, JSON.stringify(purchase));
     pipeline.zadd(PUR_USER_PREFIX + purchase.userId, score, purchase.transactionId);
     pipeline.sadd(PUR_USER_PRODUCT_PREFIX + purchase.userId + ":" + purchase.productId, purchase.transactionId);
     pipeline.sadd(PUR_ALL, purchase.transactionId);
@@ -2863,6 +3002,9 @@ var RedisWebhookEventStore = class {
     const result = await this.redis.set(key, "1", "EX", this.ttlSeconds, "NX");
     return result === "OK";
   }
+  async unmark(provider, eventId) {
+    await this.redis.del(WEBHOOK_EVENT_PREFIX + provider + ":" + eventId);
+  }
 };
 
 // src/webhook-events.ts
@@ -2880,6 +3022,9 @@ var InMemoryWebhookEventStore = class {
     this.seen.set(key, Date.now() + this.ttlSeconds * 1e3);
     return true;
   }
+  async unmark(provider, eventId) {
+    this.seen.delete(`${provider}:${eventId}`);
+  }
   evictExpired() {
     const now = Date.now();
     for (const [key, expiresAt] of this.seen) {
@@ -2901,6 +3046,9 @@ var CacheWebhookEventStore = class {
     await this.cache.set(key, "1", this.ttlSeconds);
     return true;
   }
+  async unmark(provider, eventId) {
+    await this.cache.del(`webhook:event:${provider}:${eventId}`);
+  }
 };
 
 // src/webhook-queue.ts
@@ -3178,8 +3326,6 @@ function openapiHandler() {
     res.json(ONESUB_OPENAPI);
   };
 }
-
-// src/tracing.ts
 var NOOP_SPAN = {
   setAttribute: () => {
   },
@@ -3196,8 +3342,7 @@ function getTracer() {
   if (resolved) return cachedTracer;
   resolved = true;
   try {
-    const req = globalThis.require;
-    if (!req) return null;
+    const req = typeof __require === "function" ? __require : module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
     const otel = req("@opentelemetry/api");
     cachedTracer = otel.trace.getTracer("@onesub/server", "1.0.0");
     return cachedTracer;