@onesub/server 0.14.0 → 0.16.0

package/dist/__tests__/webhook-refund.test.js

@@ -1,313 +0,0 @@
-/**
- * Refund / voided-purchase webhook tests.
- *
- * Covers:
- *   - Apple webhook REFUND for IAP (Consumable / Non-Consumable) →
- *     PurchaseStore row removed, SubscriptionStore untouched.
- *   - Apple webhook REFUND for subscriptions still updates SubscriptionStore.
- *   - Google voidedPurchaseNotification productType=2 → IAP row removed.
- *   - Google voidedPurchaseNotification productType=1 → subscription canceled.
- *   - decodeGoogleVoidedNotification recognises voided payload, ignores other kinds.
- */
-import { describe, it, expect, beforeEach } from 'vitest';
-import express from 'express';
-import { SUBSCRIPTION_STATUS } from '@onesub/shared';
-import { createWebhookRouter } from '../routes/webhook.js';
-import { InMemorySubscriptionStore, InMemoryPurchaseStore } from '../store.js';
-import { decodeGoogleVoidedNotification } from '../providers/google.js';
-// ── helpers ─────────────────────────────────────────────────────────────────
-function makeJws(payload) {
-    const header = Buffer.from(JSON.stringify({ alg: 'ES256' })).toString('base64url');
-    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    return `${header}.${body}.fakesig`;
-}
-function appleConfig() {
-    return {
-        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
-        database: { url: '' },
-    };
-}
-function googleConfig() {
-    return {
-        google: { packageName: 'com.example.app' },
-        database: { url: '' },
-    };
-}
-function buildServer(config, store, purchaseStore) {
-    const app = express();
-    app.use(express.json());
-    app.use(createWebhookRouter(config, store, purchaseStore));
-    return {
-        async request(path, body) {
-            // Use Node http directly for a lightweight test server.
-            const server = app.listen(0);
-            const address = server.address();
-            const port = typeof address === 'object' && address ? address.port : 0;
-            try {
-                const resp = await fetch(`http://127.0.0.1:${port}${path}`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify(body),
-                });
-                const text = await resp.text();
-                let parsed = text;
-                try {
-                    parsed = JSON.parse(text);
-                }
-                catch { /* keep as text */ }
-                return { status: resp.status, body: parsed };
-            }
-            finally {
-                await new Promise((resolve) => server.close(() => resolve()));
-            }
-        },
-    };
-}
-const samplePurchase = (overrides) => ({
-    userId: 'user_1',
-    productId: 'credits_100',
-    platform: 'apple',
-    type: 'consumable',
-    transactionId: 'txn_apple_consumable_001',
-    purchasedAt: '2026-01-01T00:00:00.000Z',
-    quantity: 1,
-    ...overrides,
-});
-const sampleSub = (overrides) => ({
-    userId: 'user_sub',
-    productId: 'pro_monthly',
-    platform: 'google',
-    status: 'active',
-    expiresAt: '2027-01-01T00:00:00.000Z',
-    originalTransactionId: 'token_google_sub_xyz',
-    purchasedAt: '2026-01-01T00:00:00.000Z',
-    willRenew: true,
-    ...overrides,
-});
-// ── Apple webhook: IAP REFUND ───────────────────────────────────────────────
-describe('Apple webhook — IAP REFUND', () => {
-    let store;
-    let purchaseStore;
-    let server;
-    beforeEach(() => {
-        store = new InMemorySubscriptionStore();
-        purchaseStore = new InMemoryPurchaseStore();
-        server = buildServer(appleConfig(), store, purchaseStore);
-    });
-    it('removes the consumable purchase row on REFUND', async () => {
-        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'txn_consumable_a' }));
-        const signedTransactionInfo = makeJws({
-            bundleId: 'com.example.app',
-            type: 'Consumable',
-            productId: 'credits_100',
-            transactionId: 'txn_consumable_a',
-            originalTransactionId: 'orig_consumable_a',
-            purchaseDate: Date.now(),
-        });
-        const signedRenewalInfo = makeJws({});
-        const signedPayload = makeJws({
-            notificationType: 'REFUND',
-            data: { signedTransactionInfo, signedRenewalInfo },
-        });
-        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
-        expect(resp.status).toBe(200);
-        expect(await purchaseStore.getPurchaseByTransactionId('txn_consumable_a')).toBeNull();
-    });
-    it('removes the non-consumable purchase row on REVOKE', async () => {
-        await purchaseStore.savePurchase(samplePurchase({
-            transactionId: 'txn_nc_a',
-            type: 'non_consumable',
-            productId: 'premium_unlock',
-        }));
-        const signedTransactionInfo = makeJws({
-            bundleId: 'com.example.app',
-            type: 'Non-Consumable',
-            productId: 'premium_unlock',
-            transactionId: 'txn_nc_a',
-            originalTransactionId: 'txn_nc_a',
-            purchaseDate: Date.now(),
-        });
-        const signedPayload = makeJws({
-            notificationType: 'REVOKE',
-            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
-        });
-        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
-        expect(resp.status).toBe(200);
-        expect(await purchaseStore.getPurchaseByTransactionId('txn_nc_a')).toBeNull();
-    });
-    it('does not touch the SubscriptionStore on IAP REFUND', async () => {
-        await store.save(sampleSub({ originalTransactionId: 'orig_sub_untouched' }));
-        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'iap_only' }));
-        const signedTransactionInfo = makeJws({
-            bundleId: 'com.example.app',
-            type: 'Consumable',
-            productId: 'credits_100',
-            transactionId: 'iap_only',
-            originalTransactionId: 'iap_only',
-            purchaseDate: Date.now(),
-        });
-        const signedPayload = makeJws({
-            notificationType: 'REFUND',
-            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
-        });
-        await server.request('/onesub/webhook/apple', { signedPayload });
-        expect(await store.getByTransactionId('orig_sub_untouched')).not.toBeNull();
-    });
-    it('still routes subscription REFUND through the SubscriptionStore', async () => {
-        await store.save(sampleSub({
-            platform: 'apple',
-            originalTransactionId: 'orig_sub_apple',
-            status: 'active',
-        }));
-        const signedTransactionInfo = makeJws({
-            bundleId: 'com.example.app',
-            type: 'Auto-Renewable Subscription',
-            productId: 'pro_monthly',
-            transactionId: 'tx_sub_apple_1',
-            originalTransactionId: 'orig_sub_apple',
-            purchaseDate: Date.now(),
-            expiresDate: Date.now() + 86400000,
-        });
-        const signedPayload = makeJws({
-            notificationType: 'REFUND',
-            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
-        });
-        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
-        expect(resp.status).toBe(200);
-        const updated = await store.getByTransactionId('orig_sub_apple');
-        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
-    });
-});
-// ── Google webhook: voidedPurchaseNotification ──────────────────────────────
-function makeVoidedPushBody(notification) {
-    const json = JSON.stringify({
-        version: '1.0',
-        eventTimeMillis: String(Date.now()),
-        ...notification,
-    });
-    return {
-        message: {
-            data: Buffer.from(json, 'utf-8').toString('base64'),
-            messageId: '1',
-        },
-        subscription: 'projects/x/subscriptions/y',
-    };
-}
-describe('Google webhook — voidedPurchaseNotification', () => {
-    let store;
-    let purchaseStore;
-    let server;
-    beforeEach(() => {
-        store = new InMemorySubscriptionStore();
-        purchaseStore = new InMemoryPurchaseStore();
-        server = buildServer(googleConfig(), store, purchaseStore);
-    });
-    it('removes IAP row when productType=2 (one-time product refund)', async () => {
-        await purchaseStore.savePurchase(samplePurchase({
-            platform: 'google',
-            transactionId: 'GPA.refunded_order',
-        }));
-        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
-            packageName: 'com.example.app',
-            voidedPurchaseNotification: {
-                purchaseToken: 'tok_x',
-                orderId: 'GPA.refunded_order',
-                productType: 2,
-                refundType: 1,
-            },
-        }));
-        expect(resp.status).toBe(200);
-        expect(await purchaseStore.getPurchaseByTransactionId('GPA.refunded_order')).toBeNull();
-    });
-    it('cancels subscription when productType=1', async () => {
-        await store.save(sampleSub({ originalTransactionId: 'tok_sub' }));
-        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
-            packageName: 'com.example.app',
-            voidedPurchaseNotification: {
-                purchaseToken: 'tok_sub',
-                orderId: 'GPA.sub_order',
-                productType: 1,
-                refundType: 1,
-            },
-        }));
-        expect(resp.status).toBe(200);
-        const updated = await store.getByTransactionId('tok_sub');
-        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
-    });
-    it('rejects voided notification when packageName mismatches', async () => {
-        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
-            packageName: 'com.attacker.app',
-            voidedPurchaseNotification: {
-                purchaseToken: 'tok',
-                orderId: 'GPA.x',
-                productType: 2,
-                refundType: 1,
-            },
-        }));
-        expect(resp.status).toBe(400);
-    });
-    it('acknowledges with 200 even when the orderId is unknown', async () => {
-        // Idempotent ack semantics — Google retries until 2xx; we don't want loops
-        // when the row was already removed.
-        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
-            packageName: 'com.example.app',
-            voidedPurchaseNotification: {
-                purchaseToken: 'tok',
-                orderId: 'GPA.unknown',
-                productType: 2,
-                refundType: 1,
-            },
-        }));
-        expect(resp.status).toBe(200);
-    });
-});
-// ── decodeGoogleVoidedNotification unit ─────────────────────────────────────
-describe('decodeGoogleVoidedNotification', () => {
-    it('returns null for subscription notifications', () => {
-        const json = JSON.stringify({
-            packageName: 'com.example.app',
-            eventTimeMillis: '0',
-            subscriptionNotification: {
-                version: '1.0',
-                notificationType: 4,
-                purchaseToken: 't',
-                subscriptionId: 'p',
-            },
-        });
-        const result = decodeGoogleVoidedNotification({
-            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
-            subscription: 's',
-        });
-        expect(result).toBeNull();
-    });
-    it('extracts voided payload fields', () => {
-        const json = JSON.stringify({
-            packageName: 'com.example.app',
-            eventTimeMillis: '0',
-            voidedPurchaseNotification: {
-                purchaseToken: 'tok123',
-                orderId: 'GPA.xyz',
-                productType: 2,
-                refundType: 1,
-            },
-        });
-        const result = decodeGoogleVoidedNotification({
-            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
-            subscription: 's',
-        });
-        expect(result).toEqual({
-            purchaseToken: 'tok123',
-            orderId: 'GPA.xyz',
-            productType: 2,
-            refundType: 1,
-            packageName: 'com.example.app',
-        });
-    });
-    it('returns null for malformed base64', () => {
-        expect(decodeGoogleVoidedNotification({
-            message: { data: '!!!not-base64!!!', messageId: '1' },
-            subscription: 's',
-        })).toBeNull();
-    });
-});
-//# sourceMappingURL=webhook-refund.test.js.map

package/dist/__tests__/webhook-refund.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhook-refund.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-refund.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,+EAA+E;AAE/E,SAAS,OAAO,CAAC,OAAgC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC1C,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAMD,SAAS,WAAW,CAClB,MAA0B,EAC1B,KAAgC,EAChC,aAAoC;IAEpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,wDAAwD;YACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC/C,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,SAAiC,EAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,0BAA0B;IACzC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,CAAC;IACX,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,SAAqC,EAAoB,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,0BAA0B;IACrC,qBAAqB,EAAE,sBAAsB;IAC7C,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,IAAI;IACf,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAExF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,kBAAkB;YACjC,qBAAqB,EAAE,mBAAmB;YAC1C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAEhF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,OAAO;YACjB,qBAAqB,EAAE,gBAAgB;YACvC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,gBAAgB;YAC/B,qBAAqB,EAAE,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,YAQ3B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,SAAS,EAAE,GAAG;SACf;QACD,YAAY,EAAE,4BAA4B;KAC3C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,kBAAkB;YAC/B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,wBAAwB,EAAE;gBACxB,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,CAAC;gBACnB,aAAa,EAAE,GAAG;gBAClB,cAAc,EAAE,GAAG;aACpB;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,QAAQ;gBACvB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,aAAa,EAAE,QAAQ;YACvB,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,8BAA8B,CAAC;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE;YACrD,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cache.js

@@ -1,39 +0,0 @@
-/**
- * Process-local in-memory cache. Default for single-instance deployments.
- */
-export class InMemoryCacheAdapter {
-    entries = new Map();
-    async get(key) {
-        const entry = this.entries.get(key);
-        if (!entry)
-            return null;
-        if (entry.expiresAt !== 0 && entry.expiresAt < Date.now()) {
-            this.entries.delete(key);
-            return null;
-        }
-        return entry.value;
-    }
-    async set(key, value, ttlSeconds) {
-        const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1000 : 0;
-        this.entries.set(key, { value, expiresAt });
-    }
-    async del(key) {
-        this.entries.delete(key);
-    }
-    /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
-    clear() {
-        this.entries.clear();
-    }
-}
-/**
- * Module-level singleton used by providers when no per-call adapter is
- * supplied. Keeps the existing single-instance behavior with zero config.
- */
-let defaultAdapter = new InMemoryCacheAdapter();
-export function getDefaultCache() {
-    return defaultAdapter;
-}
-export function setDefaultCache(adapter) {
-    defaultAdapter = adapter;
-}
-//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,UAAmB;QACrD,MAAM,SAAS,GAAG,UAAU,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,IAAI,cAAc,GAAiB,IAAI,oBAAoB,EAAE,CAAC;AAE9D,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,cAAc,GAAG,OAAO,CAAC;AAC3B,CAAC"}

package/dist/errors.js

@@ -1,19 +0,0 @@
-import { ONESUB_ERROR_CODE } from '@onesub/shared';
-/**
- * Send a structured error response. Every onesub HTTP endpoint uses this
- * so consumers can rely on `errorCode` being present on every 4xx/5xx body.
- *
- * `extra` lets callers inject route-specific defaults (e.g. `purchase: null`
- * for ValidatePurchaseResponse shape compatibility).
- */
-export function sendError(res, status, code, error, extra = {}) {
-    res.status(status).json({ ...extra, error, errorCode: code });
-}
-/**
- * 400 response for a failed zod parse. The ZodError's per-issue messages
- * are joined for the human-readable `error` field.
- */
-export function sendZodError(res, err, extra = {}) {
-    sendError(res, 400, ONESUB_ERROR_CODE.INVALID_INPUT, err.issues.map((e) => e.message).join(', '), extra);
-}
-//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,GAAa,EACb,MAAc,EACd,IAAqB,EACrB,KAAa,EACb,QAAiC,EAAE;IAEnC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAa,EACb,GAAe,EACf,QAAiC,EAAE;IAEnC,SAAS,CACP,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC,aAAa,EAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAChE,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/http.js

@@ -1,36 +0,0 @@
-/**
- * Outbound HTTP helpers shared by Apple/Google providers.
- *
- * Why timeouts: Node's global fetch has no default timeout. If the upstream
- * (Apple App Store Server API, Google Play Developer API, Google OAuth) hangs,
- * webhook handlers and validate routes hang with it — Apple/Google retry on
- * their side, so a hung outbound call cascades into request pile-up here.
- */
-/** Default timeout for outbound API calls (10s). */
-export const DEFAULT_FETCH_TIMEOUT_MS = 10_000;
-/**
- * fetch with an `AbortController`-based timeout. Throws an `AbortError`-like
- * Error when the timer fires. Caller is expected to catch and decide
- * (return null, log, propagate as 5xx, etc.).
- */
-export async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
-    const controller = new AbortController();
-    // Allow caller-provided signal to compose with our timeout.
-    const callerSignal = init?.signal;
-    if (callerSignal) {
-        if (callerSignal.aborted)
-            controller.abort(callerSignal.reason);
-        else
-            callerSignal.addEventListener('abort', () => controller.abort(callerSignal.reason), { once: true });
-    }
-    const timer = setTimeout(() => {
-        controller.abort(new Error(`[onesub] fetch timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-    try {
-        return await fetch(input, { ...init, signal: controller.signal });
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAwB,EACxB,IAAkB,EAClB,SAAS,GAAG,wBAAwB;IAEpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,4DAA4D;IAC5D,MAAM,YAAY,GAAG,IAAI,EAAE,MAAM,CAAC;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;;YAC3D,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC,EAAE,SAAS,CAAC,CAAC;IAEd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/logger.js

@@ -1,20 +0,0 @@
-/**
- * Process-wide logger used by @onesub/server's providers and routes.
- *
- * Defaults to `console`. `createOneSubMiddleware()` calls `setLogger()` once
- * during setup if `config.logger` is provided. All internal call sites should
- * import `log` from this module instead of calling `console.*` directly so
- * operators can redirect logs (pino / winston / bunyan) with a single config
- * setting.
- */
-let current = console;
-export function setLogger(logger) {
-    if (logger)
-        current = logger;
-}
-export const log = {
-    info: (...args) => current.info(...args),
-    warn: (...args) => current.warn(...args),
-    error: (...args) => current.error(...args),
-};
-//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,IAAI,OAAO,GAAiB,OAAO,CAAC;AAEpC,MAAM,UAAU,SAAS,CAAC,MAAgC;IACxD,IAAI,MAAM;QAAE,OAAO,GAAG,MAAM,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAiB;IAC/B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAC3C,CAAC"}

package/dist/openapi.js

@@ -1,196 +0,0 @@
-/**
- * OpenAPI 3.1 spec for the onesub HTTP surface.
- *
- * Hand-maintained — kept in sync with the routes by a parity test (see
- * __tests__/openapi.test.ts) that asserts every mounted path is described
- * here. Generated clients live downstream:
- *
- *   - swagger-typescript-api → typed fetch client
- *   - openapi-generator-cli  → Kotlin/Swift/etc. clients
- *
- * Why hand-maintained instead of zod-to-openapi: the routes use zod for
- * input validation but the request/response shapes the public docs need are
- * a thin slice of those internal types. Hand-writing keeps the doc readable
- * without coupling client output to internal validation strictness changes.
- */
-import { ROUTES } from '@onesub/shared';
-export const ONESUB_OPENAPI = {
-    openapi: '3.1.0',
-    info: {
-        title: 'onesub HTTP API',
-        version: '1.0.0',
-        description: 'Receipt validation, subscription status, webhooks, and admin endpoints exposed by `createOneSubMiddleware`.',
-    },
-    servers: [
-        { url: 'http://localhost:4100', description: 'Local dev (examples/server)' },
-    ],
-    paths: {
-        [ROUTES.VALIDATE]: {
-            post: {
-                summary: 'Validate an Apple/Google receipt and persist subscription state.',
-                requestBody: {
-                    required: true,
-                    content: { 'application/json': { schema: { $ref: '#/components/schemas/ValidateRequest' } } },
-                },
-                responses: {
-                    200: { description: 'Validation succeeded; subscription state persisted.', content: { 'application/json': { schema: { $ref: '#/components/schemas/ValidateResponse' } } } },
-                    400: { description: 'Bad request — missing fields, malformed receipt, package mismatch.' },
-                },
-            },
-        },
-        [ROUTES.STATUS]: {
-            get: {
-                summary: 'Fetch the most recent subscription state for a user.',
-                parameters: [{ in: 'query', name: 'userId', required: true, schema: { type: 'string' } }],
-                responses: {
-                    200: { description: 'OK', content: { 'application/json': { schema: { $ref: '#/components/schemas/StatusResponse' } } } },
-                },
-            },
-        },
-        [ROUTES.WEBHOOK_APPLE]: {
-            post: {
-                summary: 'Apple App Store Server Notification V2 receiver.',
-                description: 'Apple POSTs `{ signedPayload }`. JWS-verified, idempotent when `webhookEventStore` is configured.',
-                responses: {
-                    200: { description: 'Acknowledged.' },
-                    400: { description: 'Missing or invalid signedPayload.' },
-                },
-            },
-        },
-        [ROUTES.WEBHOOK_GOOGLE]: {
-            post: {
-                summary: 'Google Play Real-Time Developer Notification (Pub/Sub push) receiver.',
-                responses: {
-                    200: { description: 'Acknowledged.' },
-                    400: { description: 'Missing message.data or package mismatch.' },
-                    401: { description: 'pushAudience configured and JWT verification failed.' },
-                },
-            },
-        },
-        [ROUTES.ENTITLEMENTS]: {
-            get: {
-                summary: 'Evaluate every configured entitlement for a user.',
-                parameters: [{ in: 'query', name: 'userId', required: true, schema: { type: 'string' } }],
-                responses: {
-                    200: { description: 'Map of entitlementId → { granted, source }.' },
-                },
-            },
-        },
-        [ROUTES.ADMIN_SUBSCRIPTIONS]: {
-            get: {
-                summary: 'Filtered, paginated subscription list (admin).',
-                parameters: [
-                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
-                    { in: 'query', name: 'userId', schema: { type: 'string' } },
-                    { in: 'query', name: 'status', schema: { type: 'string', enum: ['active', 'grace_period', 'on_hold', 'paused', 'expired', 'canceled', 'none'] } },
-                    { in: 'query', name: 'productId', schema: { type: 'string' } },
-                    { in: 'query', name: 'platform', schema: { type: 'string', enum: ['apple', 'google'] } },
-                    { in: 'query', name: 'limit', schema: { type: 'integer', minimum: 1, maximum: 200 } },
-                    { in: 'query', name: 'offset', schema: { type: 'integer', minimum: 0 } },
-                ],
-                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
-            },
-        },
-        '/onesub/admin/customers/{userId}': {
-            get: {
-                summary: 'Customer profile bundle: subscriptions + purchases + entitlements (admin).',
-                parameters: [
-                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
-                    { in: 'path', name: 'userId', required: true, schema: { type: 'string' } },
-                ],
-                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
-            },
-        },
-        '/onesub/admin/webhook-deadletters': {
-            get: {
-                summary: 'List failed webhook jobs (when a queue with DLQ support is configured).',
-                parameters: [{ in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } }],
-                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
-            },
-        },
-        '/onesub/admin/webhook-replay/{id}': {
-            post: {
-                summary: 'Replay a dead-letter job through the webhook handler.',
-                parameters: [
-                    { in: 'header', name: 'X-Admin-Secret', required: true, schema: { type: 'string' } },
-                    { in: 'path', name: 'id', required: true, schema: { type: 'string' } },
-                ],
-                responses: { 200: { description: 'OK' }, 401: { description: 'Invalid admin secret' } },
-            },
-        },
-    },
-    components: {
-        schemas: {
-            ValidateRequest: {
-                type: 'object',
-                required: ['userId', 'platform', 'productId', 'receipt'],
-                properties: {
-                    userId: { type: 'string' },
-                    platform: { type: 'string', enum: ['apple', 'google'] },
-                    productId: { type: 'string' },
-                    receipt: { type: 'string', description: 'Apple JWS or Google purchaseToken' },
-                    purchaseType: { type: 'string', enum: ['subscription', 'consumable', 'non_consumable'] },
-                },
-            },
-            ValidateResponse: {
-                type: 'object',
-                properties: {
-                    valid: { type: 'boolean' },
-                    subscription: { $ref: '#/components/schemas/SubscriptionInfo' },
-                    purchase: { $ref: '#/components/schemas/PurchaseInfo' },
-                },
-            },
-            StatusResponse: {
-                type: 'object',
-                properties: {
-                    active: { type: 'boolean' },
-                    subscription: { $ref: '#/components/schemas/SubscriptionInfo' },
-                },
-            },
-            SubscriptionInfo: {
-                type: 'object',
-                properties: {
-                    originalTransactionId: { type: 'string' },
-                    userId: { type: 'string' },
-                    productId: { type: 'string' },
-                    platform: { type: 'string', enum: ['apple', 'google'] },
-                    status: { type: 'string', enum: ['active', 'grace_period', 'on_hold', 'paused', 'expired', 'canceled', 'none'] },
-                    expiresAt: { type: 'string', format: 'date-time' },
-                    purchasedAt: { type: 'string', format: 'date-time' },
-                    willRenew: { type: 'boolean' },
-                },
-            },
-            PurchaseInfo: {
-                type: 'object',
-                properties: {
-                    transactionId: { type: 'string' },
-                    userId: { type: 'string' },
-                    productId: { type: 'string' },
-                    platform: { type: 'string', enum: ['apple', 'google'] },
-                    type: { type: 'string', enum: ['consumable', 'non_consumable'] },
-                    quantity: { type: 'integer' },
-                    purchasedAt: { type: 'string', format: 'date-time' },
-                },
-            },
-        },
-        securitySchemes: {
-            AdminSecret: {
-                type: 'apiKey',
-                in: 'header',
-                name: 'X-Admin-Secret',
-            },
-        },
-    },
-};
-/**
- * Mount a route that serves the OpenAPI document. Useful for hosts that want
- * to expose `/openapi.json` to API explorers / SDK generators.
- *
- *   app.use('/openapi.json', openapiHandler());
- */
-export function openapiHandler() {
-    return (_req, res) => {
-        res.json(ONESUB_OPENAPI);
-    };
-}
-//# sourceMappingURL=openapi.js.map