@onesub/server 0.13.1 → 0.15.0

package/dist/providers/mock.js

@@ -1,93 +0,0 @@
-import { createHash } from 'node:crypto';
-import { SUBSCRIPTION_STATUS, MOCK_RECEIPT_PREFIX } from '@onesub/shared';
-import { log } from '../logger.js';
-export function classifyMockReceipt(receipt) {
-    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.NETWORK_ERROR))
-        return { kind: 'network-error' };
-    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.REVOKED))
-        return { kind: 'revoked' };
-    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.EXPIRED))
-        return { kind: 'expired' };
-    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.INVALID) ||
-        receipt.startsWith(MOCK_RECEIPT_PREFIX.BAD_SIG)) {
-        return { kind: 'invalid' };
-    }
-    if (receipt.startsWith(MOCK_RECEIPT_PREFIX.SANDBOX))
-        return { kind: 'sandbox' };
-    return { kind: 'valid' };
-}
-/**
- * Gate the outcome against `valid` / `sandbox`. Throws for network-error,
- * logs + returns false for rejection cases, returns true for pass-through.
- * Every mock validator uses this so their rejection behavior stays in sync.
- */
-function outcomePasses(outcome, tag) {
-    if (outcome.kind === 'network-error') {
-        throw new Error(`[onesub/mock/${tag}] simulated upstream network error`);
-    }
-    if (outcome.kind === 'valid' || outcome.kind === 'sandbox')
-        return true;
-    log.warn(`[onesub/mock/${tag}] receipt rejected`, { outcome: outcome.kind });
-    return false;
-}
-function deterministicTransactionId(prefix, receipt) {
-    const digest = createHash('sha256').update(receipt).digest('hex').slice(0, 24);
-    return `${prefix}_${digest}`;
-}
-const HOURS = 60 * 60 * 1000;
-const DAYS = 24 * HOURS;
-export function mockValidateAppleSubscription(receipt) {
-    const outcome = classifyMockReceipt(receipt);
-    if (!outcomePasses(outcome, 'apple'))
-        return null;
-    const now = Date.now();
-    const expiresAt = outcome.kind === 'sandbox' ? now + 1 * HOURS : now + 30 * DAYS;
-    return {
-        userId: '',
-        productId: 'mock_subscription',
-        platform: 'apple',
-        status: SUBSCRIPTION_STATUS.ACTIVE,
-        expiresAt: new Date(expiresAt).toISOString(),
-        originalTransactionId: deterministicTransactionId('mock_apple_orig', receipt),
-        purchasedAt: new Date(now).toISOString(),
-        willRenew: true,
-    };
-}
-export function mockValidateAppleProduct(receipt, expectedProductId) {
-    const outcome = classifyMockReceipt(receipt);
-    if (!outcomePasses(outcome, 'apple'))
-        return null;
-    const productId = expectedProductId ?? 'mock_product';
-    return {
-        transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
-        productId,
-        purchasedAt: new Date().toISOString(),
-    };
-}
-export function mockValidateGoogleSubscription(receipt, productId) {
-    const outcome = classifyMockReceipt(receipt);
-    if (!outcomePasses(outcome, 'google'))
-        return null;
-    const now = Date.now();
-    const expiresAt = outcome.kind === 'sandbox' ? now + 1 * HOURS : now + 30 * DAYS;
-    return {
-        userId: '',
-        productId,
-        platform: 'google',
-        status: SUBSCRIPTION_STATUS.ACTIVE,
-        expiresAt: new Date(expiresAt).toISOString(),
-        originalTransactionId: deterministicTransactionId('mock_google_orig', receipt),
-        purchasedAt: new Date(now).toISOString(),
-        willRenew: true,
-    };
-}
-export function mockValidateGoogleProduct(receipt, productId) {
-    const outcome = classifyMockReceipt(receipt);
-    if (!outcomePasses(outcome, 'google'))
-        return null;
-    return {
-        transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
-        purchasedAt: new Date().toISOString(),
-    };
-}
-//# sourceMappingURL=mock.js.map

package/dist/providers/mock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../src/providers/mock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AA8BnC,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC5F,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,IACE,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC/C,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAA2B,EAAE,GAAW;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,OAAe;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACjF,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,mBAAmB;QAC9B,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,mBAAmB,CAAC,MAAM;QAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,qBAAqB,EAAE,0BAA0B,CAAC,iBAAiB,EAAE,OAAO,CAAC;QAC7E,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,iBAA0B;IAE1B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,iBAAiB,IAAI,cAAc,CAAC;IACtD,OAAO;QACL,aAAa,EAAE,0BAA0B,CAAC,cAAc,SAAS,EAAE,EAAE,OAAO,CAAC;QAC7E,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAe,EACf,SAAiB;IAEjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACjF,OAAO;QACL,MAAM,EAAE,EAAE;QACV,SAAS;QACT,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,mBAAmB,CAAC,MAAM;QAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,qBAAqB,EAAE,0BAA0B,CAAC,kBAAkB,EAAE,OAAO,CAAC;QAC9E,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,SAAiB;IAEjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO;QACL,aAAa,EAAE,0BAA0B,CAAC,eAAe,SAAS,EAAE,EAAE,OAAO,CAAC;QAC9E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/routes/admin.js

@@ -1,327 +0,0 @@
-import { Router } from 'express';
-import { z } from 'zod';
-import { PURCHASE_TYPE, ONESUB_ERROR_CODE, ROUTES, SUBSCRIPTION_STATUS } from '@onesub/shared';
-import { evaluateEntitlement } from './entitlements.js';
-import { sendError, sendZodError } from '../errors.js';
-import { fetchAppleSubscriptionStatus } from '../providers/apple.js';
-const ADMIN_SECRET_HEADER = 'x-admin-secret';
-/**
- * Admin routes for testing / operational tasks. Require `X-Admin-Secret`
- * header matching config.adminSecret. If config.adminSecret is not set, the
- * entire admin router is not mounted (returns 404 from the parent router).
- *
- * Endpoints:
- *   DELETE /onesub/purchase/admin/:userId/:productId
- *     → reset a non-consumable so the user can test the purchase flow again
- *
- *   POST /onesub/purchase/admin/grant
- *     → manually insert a purchase record (skips store verification)
- *     body: { userId, productId, platform, type?, transactionId? }
- *
- *   POST /onesub/purchase/admin/transfer
- *     → reassign a transactionId to a new userId (device migration)
- *
- *   GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
- *     → filtered/paginated subscription list (used by dashboard + scripts)
- *
- *   GET /onesub/admin/subscriptions/:transactionId
- *     → single subscription record by originalTransactionId (dashboard detail page)
- *
- *   GET /onesub/admin/customers/:userId
- *     → bundle of every record onesub knows for one user (subs + purchases +
- *       entitlements when configured). Backs the dashboard customer detail page.
- */
-export function createAdminRouter(config, purchaseStore, store, webhookQueue) {
-    if (!config.adminSecret)
-        return null;
-    const router = Router();
-    const adminSecret = config.adminSecret;
-    // Auth middleware — applied to both admin scopes. Without this guard, a
-    // misconfigured mount on the parent root would expose admin endpoints
-    // alongside host-app routes (e.g. /health).
-    const adminAuth = (req, res, next) => {
-        const provided = req.headers[ADMIN_SECRET_HEADER];
-        if (typeof provided !== 'string' || provided !== adminSecret) {
-            sendError(res, 401, ONESUB_ERROR_CODE.INVALID_ADMIN_SECRET, 'INVALID_ADMIN_SECRET');
-            return;
-        }
-        next();
-    };
-    router.use('/onesub/purchase/admin', adminAuth);
-    router.use('/onesub/admin', adminAuth);
-    // DELETE /onesub/purchase/admin/:userId/:productId
-    // Express 5 types route params as `string | string[]` — narrow via zod.
-    const resetParamsSchema = z.object({
-        userId: z.string().min(1).max(256),
-        productId: z.string().min(1).max(256),
-    });
-    router.delete('/onesub/purchase/admin/:userId/:productId', async (req, res) => {
-        let params;
-        try {
-            params = resetParamsSchema.parse(req.params);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId and productId required');
-            return;
-        }
-        const deleted = await purchaseStore.deletePurchases(params.userId, params.productId);
-        res.json({ ok: true, deleted });
-    });
-    // POST /onesub/purchase/admin/transfer — reassign transactionId to a new userId
-    // (legitimate device/account migration)
-    const transferSchema = z.object({
-        transactionId: z.string().min(1).max(256),
-        newUserId: z.string().min(1).max(256),
-    });
-    router.post('/onesub/purchase/admin/transfer', async (req, res) => {
-        let body;
-        try {
-            body = transferSchema.parse(req.body);
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                sendZodError(res, err);
-                return;
-            }
-            throw err;
-        }
-        const existing = await purchaseStore.getPurchaseByTransactionId(body.transactionId);
-        if (!existing) {
-            sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
-            return;
-        }
-        // Delete the old row, then save under new userId
-        await purchaseStore.deletePurchases(existing.userId, existing.productId);
-        const migrated = { ...existing, userId: body.newUserId };
-        await purchaseStore.savePurchase(migrated);
-        res.json({ ok: true, purchase: migrated });
-    });
-    // POST /onesub/purchase/admin/grant
-    const grantSchema = z.object({
-        userId: z.string().min(1).max(256),
-        productId: z.string().min(1).max(256),
-        platform: z.enum(['apple', 'google']),
-        type: z.enum([PURCHASE_TYPE.CONSUMABLE, PURCHASE_TYPE.NON_CONSUMABLE]).default(PURCHASE_TYPE.NON_CONSUMABLE),
-        transactionId: z.string().min(1).max(256).optional(),
-    });
-    router.post('/onesub/purchase/admin/grant', async (req, res) => {
-        let body;
-        try {
-            body = grantSchema.parse(req.body);
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                sendZodError(res, err);
-                return;
-            }
-            throw err;
-        }
-        const transactionId = body.transactionId ?? `admin_grant_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-        const purchase = {
-            transactionId,
-            userId: body.userId,
-            productId: body.productId,
-            platform: body.platform,
-            type: body.type,
-            quantity: 1,
-            purchasedAt: new Date().toISOString(),
-        };
-        await purchaseStore.savePurchase(purchase);
-        res.json({ ok: true, purchase });
-    });
-    // GET /onesub/admin/subscriptions?userId=&status=&productId=&platform=&limit=&offset=
-    // Filtered + paginated subscription list. Backs the dashboard's
-    // subscriptions page and ad-hoc operational scripts.
-    const listQuerySchema = z.object({
-        userId: z.string().min(1).max(256).optional(),
-        status: z.enum([
-            SUBSCRIPTION_STATUS.ACTIVE,
-            SUBSCRIPTION_STATUS.GRACE_PERIOD,
-            SUBSCRIPTION_STATUS.ON_HOLD,
-            SUBSCRIPTION_STATUS.PAUSED,
-            SUBSCRIPTION_STATUS.EXPIRED,
-            SUBSCRIPTION_STATUS.CANCELED,
-            SUBSCRIPTION_STATUS.NONE,
-        ]).optional(),
-        productId: z.string().min(1).max(256).optional(),
-        platform: z.enum(['apple', 'google']).optional(),
-        // Cap at 200 server-side so a runaway dashboard query can't tip the DB.
-        limit: z.coerce.number().int().positive().max(200).optional(),
-        offset: z.coerce.number().int().nonnegative().optional(),
-    });
-    router.get(ROUTES.ADMIN_SUBSCRIPTIONS, async (req, res) => {
-        let query;
-        try {
-            query = listQuerySchema.parse(req.query);
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                sendZodError(res, err);
-                return;
-            }
-            throw err;
-        }
-        try {
-            const result = await store.listFiltered(query);
-            const response = {
-                items: result.items,
-                total: result.total,
-                limit: result.limit,
-                offset: result.offset,
-            };
-            res.status(200).json(response);
-        }
-        catch (err) {
-            // Bubble the message up but not the stack — admin clients log status code
-            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
-        }
-    });
-    // GET /onesub/admin/subscriptions/:transactionId — single record by
-    // originalTransactionId. Backs the dashboard's subscription detail page.
-    const detailParamsSchema = z.object({
-        transactionId: z.string().min(1).max(256),
-    });
-    router.get('/onesub/admin/subscriptions/:transactionId', async (req, res) => {
-        let params;
-        try {
-            params = detailParamsSchema.parse(req.params);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'transactionId required');
-            return;
-        }
-        try {
-            const sub = await store.getByTransactionId(params.transactionId);
-            if (!sub) {
-                sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'TRANSACTION_NOT_FOUND');
-                return;
-            }
-            res.status(200).json(sub);
-        }
-        catch (err) {
-            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'detail error');
-        }
-    });
-    // GET /onesub/admin/customers/:userId — full per-user profile. Combines the
-    // store calls a CS dashboard makes for "show me everything about this user"
-    // into a single round-trip.
-    //
-    // Always returns 200 (even for unknown userIds) — empty arrays + no
-    // entitlements means "we have no record of this user", which is a valid
-    // signal for the dashboard to render rather than an error condition.
-    const customerParamsSchema = z.object({
-        userId: z.string().min(1).max(256),
-    });
-    router.get('/onesub/admin/customers/:userId', async (req, res) => {
-        let params;
-        try {
-            params = customerParamsSchema.parse(req.params);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId required');
-            return;
-        }
-        try {
-            const [subscriptions, purchases] = await Promise.all([
-                store.getAllByUserId(params.userId),
-                purchaseStore.getPurchasesByUserId(params.userId),
-            ]);
-            // Evaluate entitlements only when configured. Hosts that don't use the
-            // entitlement abstraction get the field omitted (dashboard hides panel).
-            let entitlements;
-            if (config.entitlements && Object.keys(config.entitlements).length > 0) {
-                entitlements = {};
-                for (const [id, def] of Object.entries(config.entitlements)) {
-                    entitlements[id] = await evaluateEntitlement(params.userId, def, store, purchaseStore);
-                }
-            }
-            const response = {
-                userId: params.userId,
-                subscriptions,
-                purchases,
-                ...(entitlements ? { entitlements } : {}),
-            };
-            res.status(200).json(response);
-        }
-        catch (err) {
-            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'customer error');
-        }
-    });
-    // POST /onesub/admin/sync-apple/:originalTransactionId
-    // Fetch the current subscription state directly from Apple's Status API and
-    // upsert into the local store. Useful for reconciliation / missed-webhook recovery.
-    const syncAppleParamsSchema = z.object({
-        originalTransactionId: z.string().min(1).max(256),
-    });
-    router.post(ROUTES.ADMIN_SYNC_APPLE, async (req, res) => {
-        let params;
-        try {
-            params = syncAppleParamsSchema.parse(req.params);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'originalTransactionId required');
-            return;
-        }
-        if (!config.apple?.issuerId || !config.apple?.keyId || !config.apple?.privateKey) {
-            sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, 'Apple API credentials not configured');
-            return;
-        }
-        try {
-            const { originalTransactionId } = params;
-            // Allow callers to force sandbox mode; otherwise infer from the stored record.
-            const existingForEnv = await store.getByTransactionId(originalTransactionId);
-            const isSandbox = req.query['sandbox'] === 'true' ||
-                existingForEnv?.environment === 'Sandbox';
-            const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, { sandbox: isSandbox });
-            if (!fresh) {
-                sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, 'Apple Status API returned no record');
-                return;
-            }
-            const existing = existingForEnv;
-            fresh.userId = existing?.userId ?? originalTransactionId;
-            await store.save(fresh);
-            res.status(200).json({ ok: true, subscription: fresh });
-        }
-        catch (err) {
-            sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? 'sync error');
-        }
-    });
-    // GET /onesub/admin/webhook-deadletters
-    // POST /onesub/admin/webhook-replay/:id
-    // Only mounted when the configured queue supports dead-letter inspection
-    // (the default in-process queue does not — Apple/Google retries are the
-    // durability layer for that mode).
-    if (webhookQueue?.listDeadLetters) {
-        router.get('/onesub/admin/webhook-deadletters', async (_req, res) => {
-            try {
-                const items = await webhookQueue.listDeadLetters();
-                res.status(200).json({ items });
-            }
-            catch (err) {
-                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'list error');
-            }
-        });
-    }
-    if (webhookQueue?.replayDeadLetter) {
-        const replayParamsSchema = z.object({ id: z.string().min(1).max(256) });
-        router.post('/onesub/admin/webhook-replay/:id', async (req, res) => {
-            let params;
-            try {
-                params = replayParamsSchema.parse(req.params);
-            }
-            catch {
-                sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'id required');
-                return;
-            }
-            try {
-                await webhookQueue.replayDeadLetter(params.id);
-                res.status(200).json({ ok: true });
-            }
-            catch (err) {
-                sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, err.message ?? 'replay error');
-            }
-        });
-    }
-    return router;
-}
-//# sourceMappingURL=admin.js.map

package/dist/routes/admin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,aAA4B,EAC5B,KAAwB,EACxB,YAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEvC,wEAAwE;IACxE,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAEvC,mDAAmD;IACnD,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,2CAA2C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,iDAAiD;QACjD,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAiB,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC;QAC5G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChF,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAiB;YAC7B,aAAa;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,gEAAgE;IAChE,qDAAqD;IACrD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,YAAY;YAChC,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,MAAM;YAC1B,mBAAmB,CAAC,OAAO;YAC3B,mBAAmB,CAAC,QAAQ;YAC5B,mBAAmB,CAAC,IAAI;SACwB,CAAC,CAAC,QAAQ,EAAE;QAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAA8B,CAAC,CAAC,QAAQ,EAAE;QAC7E,wEAAwE;QACxE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAA8B;gBAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,4BAA4B;IAC5B,EAAE;IACF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnD,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;gBACnC,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC;aAClD,CAAC,CAAC;YAEH,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,YAA2D,CAAC;YAChE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAA4B;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa;gBACb,SAAS;gBACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,4EAA4E;IAC5E,oFAAoF;IACpF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;QACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACjF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC;YACzC,+EAA+E;YAC/E,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YAC7E,MAAM,SAAS,GACb,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM;gBAC9B,cAA4E,EAAE,WAAW,KAAK,SAAS,CAAC;YAC3G,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9G,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,cAAc,CAAC;YAChC,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,qBAAqB,CAAC;YACzD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAgB,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,EAAE,gBAAgB,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YACpF,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,gBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/apple-offer.js

@@ -1,72 +0,0 @@
-import { Router } from 'express';
-import { z } from 'zod';
-import { ONESUB_ERROR_CODE } from '@onesub/shared';
-import { signApplePromotionalOffer } from '../providers/apple.js';
-import { sendError, sendZodError } from '../errors.js';
-const OFFER_SECRET_HEADER = 'x-onesub-offer-secret';
-const offerBodySchema = z.object({
-    productId: z.string().min(1).max(256),
-    offerId: z.string().min(1).max(256),
-    applicationUsername: z.string().min(1).max(256),
-});
-/**
- * POST /onesub/apple/offer-signature
- *
- * Sign an Apple Promotional Offer payload server-side.
- * Requires config.apple.offerKeyId and config.apple.offerPrivateKey.
- *
- * Authentication: if config.adminSecret is set, the request must carry
- * `X-Onesub-Offer-Secret: <adminSecret>` (same value). Hosts that mount
- * onesub without adminSecret are responsible for securing this endpoint
- * themselves (e.g. behind their own auth middleware).
- *
- * Body: { productId, offerId, applicationUsername }
- * Response: { keyId, nonce, timestamp, signature }
- *
- * The client passes these four values to StoreKit's
- * Product.SubscriptionOffer.Signature to redeem the offer.
- */
-export function createAppleOfferRouter(config) {
-    const apple = config.apple;
-    if (!apple?.offerKeyId || !apple?.offerPrivateKey)
-        return null;
-    const router = Router();
-    router.post('/onesub/apple/offer-signature', async (req, res) => {
-        if (config.adminSecret) {
-            const provided = req.headers[OFFER_SECRET_HEADER];
-            if (typeof provided !== 'string' || provided !== config.adminSecret) {
-                sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, 'Unauthorized');
-                return;
-            }
-        }
-        let body;
-        try {
-            body = offerBodySchema.parse(req.body);
-        }
-        catch (err) {
-            if (err instanceof z.ZodError) {
-                sendZodError(res, err);
-                return;
-            }
-            throw err;
-        }
-        if (!apple.bundleId) {
-            sendError(res, 400, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, 'config.apple.bundleId is required for offer signing');
-            return;
-        }
-        try {
-            const result = await signApplePromotionalOffer({
-                bundleId: apple.bundleId,
-                productId: body.productId,
-                offerId: body.offerId,
-                applicationUsername: body.applicationUsername,
-            }, apple);
-            res.status(200).json(result);
-        }
-        catch (err) {
-            sendError(res, 500, ONESUB_ERROR_CODE.INTERNAL_ERROR, err.message ?? 'Offer signing failed');
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=apple-offer.js.map

package/dist/routes/apple-offer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"apple-offer.js","sourceRoot":"","sources":["../../src/routes/apple-offer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAsG,CAAC;IAC5H,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,IAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;gBACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,EACD,KAAK,CACN,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,cAAc,EAAG,GAAa,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/entitlements.js

@@ -1,130 +0,0 @@
-import { Router } from 'express';
-import { z } from 'zod';
-import { ROUTES, SUBSCRIPTION_STATUS, ONESUB_ERROR_CODE, PURCHASE_TYPE } from '@onesub/shared';
-import { log } from '../logger.js';
-import { sendError } from '../errors.js';
-/**
- * Evaluate a single entitlement for a user.
- *
- * A user is entitled when EITHER condition holds for any productId in
- * `entitlement.productIds`:
- *   1. an active subscription (status === active|grace_period AND
- *      expiresAt > now) for that productId exists
- *   2. a non-consumable purchase for that productId exists
- *
- * Consumables are intentionally excluded — they grant a one-time resource,
- * not an ongoing right.
- *
- * Subscription is preferred over purchase when both match (subs carry an
- * expiry; non-consumables are forever) so the source field skews toward the
- * more "interesting" signal for ops/analytics.
- */
-export async function evaluateEntitlement(userId, entitlement, store, purchaseStore) {
-    const productIdSet = new Set(entitlement.productIds);
-    const now = Date.now();
-    // 1. Check subscriptions first (richer signal — has expiry).
-    const subs = await store.getAllByUserId(userId);
-    for (const sub of subs) {
-        if (!productIdSet.has(sub.productId))
-            continue;
-        const statusAllows = sub.status === SUBSCRIPTION_STATUS.ACTIVE ||
-            sub.status === SUBSCRIPTION_STATUS.GRACE_PERIOD;
-        if (!statusAllows)
-            continue;
-        if (new Date(sub.expiresAt).getTime() <= now)
-            continue;
-        return {
-            active: true,
-            source: 'subscription',
-            productId: sub.productId,
-            expiresAt: sub.expiresAt,
-        };
-    }
-    // 2. Check non-consumable purchases.
-    const purchases = await purchaseStore.getPurchasesByUserId(userId);
-    for (const p of purchases) {
-        if (p.type !== PURCHASE_TYPE.NON_CONSUMABLE)
-            continue;
-        if (!productIdSet.has(p.productId))
-            continue;
-        return {
-            active: true,
-            source: 'purchase',
-            productId: p.productId,
-        };
-    }
-    return { active: false, source: null };
-}
-const userIdSchema = z.string().min(1).max(256);
-const entitlementIdSchema = z.string().min(1).max(128);
-export function createEntitlementRouter(config, store, purchaseStore) {
-    // Only mount when entitlements are configured. Without this guard, the
-    // routes would always 503 — better to make the absence loud (404 from
-    // express) so misconfiguration is obvious during dev.
-    if (!config.entitlements || Object.keys(config.entitlements).length === 0) {
-        return null;
-    }
-    const entitlements = config.entitlements;
-    const router = Router();
-    /**
-     * GET /onesub/entitlement?userId=&id=premium
-     * Single entitlement check.
-     */
-    router.get(ROUTES.ENTITLEMENT, async (req, res) => {
-        let userId;
-        let id;
-        try {
-            userId = userIdSchema.parse(req.query['userId']);
-            id = entitlementIdSchema.parse(req.query['id']);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId and id are required');
-            return;
-        }
-        const entitlement = entitlements[id];
-        if (!entitlement) {
-            sendError(res, 404, ONESUB_ERROR_CODE.ENTITLEMENT_NOT_FOUND, `Unknown entitlement: ${id}`);
-            return;
-        }
-        try {
-            const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
-            const response = { id, ...status };
-            res.status(200).json(response);
-        }
-        catch (err) {
-            log.error('[onesub/entitlement] evaluation error:', err);
-            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, 'Internal server error');
-        }
-    });
-    /**
-     * GET /onesub/entitlements?userId=
-     * Evaluate every configured entitlement in one round-trip — useful on
-     * app launch / login when the host wants the full entitlement map.
-     */
-    router.get(ROUTES.ENTITLEMENTS, async (req, res) => {
-        let userId;
-        try {
-            userId = userIdSchema.parse(req.query['userId']);
-        }
-        catch {
-            sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, 'userId is required');
-            return;
-        }
-        try {
-            const entries = await Promise.all(Object.entries(entitlements).map(async ([id, entitlement]) => {
-                const status = await evaluateEntitlement(userId, entitlement, store, purchaseStore);
-                return [id, status];
-            }));
-            const response = {
-                entitlements: Object.fromEntries(entries),
-            };
-            res.status(200).json(response);
-        }
-        catch (err) {
-            log.error('[onesub/entitlements] evaluation error:', err);
-            sendError(res, 500, ONESUB_ERROR_CODE.STORE_ERROR, 'Internal server error', { entitlements: {} });
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=entitlements.js.map