@onesub/server 0.14.0 → 0.16.0

package/dist/openapi.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAiBxC,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,6GAA6G;KAChH;IACD,OAAO,EAAE;QACP,EAAE,GAAG,EAAE,uBAAuB,EAAE,WAAW,EAAE,6BAA6B,EAAE;KAC7E;IACD,KAAK,EAAE;QACL,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACjB,IAAI,EAAE;gBACJ,OAAO,EAAE,kEAAkE;gBAC3E,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE,EAAE,EAAE;iBAC9F;gBACD,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE,EAAE,EAAE,EAAE;oBAC3K,GAAG,EAAE,EAAE,WAAW,EAAE,oEAAoE,EAAE;iBAC3F;aACF;SACF;QACD,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACf,GAAG,EAAE;gBACH,OAAO,EAAE,sDAAsD;gBAC/D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBACzF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,EAAE;iBACzH;aACF;SACF;QACD,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;YACtB,IAAI,EAAE;gBACJ,OAAO,EAAE,kDAAkD;gBAC3D,WAAW,EACT,mGAAmG;gBACrG,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;oBACrC,GAAG,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;iBAC1D;aACF;SACF;QACD,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,uEAAuE;gBAChF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;oBACrC,GAAG,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE;oBACjE,GAAG,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE;iBAC7E;aACF;SACF;QACD,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YACrB,GAAG,EAAE;gBACH,OAAO,EAAE,mDAAmD;gBAC5D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBACzF,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;iBACpE;aACF;SACF;QACD,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;YAC5B,GAAG,EAAE;gBACH,OAAO,EAAE,gDAAgD;gBACzD,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC3D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;oBACjJ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC9D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE;oBACxF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;oBACrF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;iBACzE;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,kCAAkC,EAAE;YAClC,GAAG,EAAE;gBACH,OAAO,EAAE,4EAA4E;gBACrF,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC3E;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,mCAAmC,EAAE;YACnC,GAAG,EAAE;gBACH,OAAO,EAAE,yEAAyE;gBAClF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClG,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;QACD,mCAAmC,EAAE;YACnC,IAAI,EAAE;gBACJ,OAAO,EAAE,uDAAuD;gBAChE,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpF,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACvE;gBACD,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,EAAE;aACxF;SACF;KACF;IACD,UAAU,EAAE;QACV,OAAO,EAAE;YACP,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC;gBACxD,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAC7E,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE;iBACzF;aACF;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;oBAC/D,QAAQ,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE;iBACxD;aACF;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;iBAChE;aACF;YACD,gBAAgB,EAAE;gBAChB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;oBAChH,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBAClD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBACpD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC/B;aACF;YACD,YAAY,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACvD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE;oBAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;iBACrD;aACF;SACF;QACD,eAAe,EAAE;YACf,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,gBAAgB;aACvB;SACF;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,IAA+B,EAAE,GAA+B,EAAE,EAAE;QAC1E,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/providers/apple-root-ca.js

@@ -1,38 +0,0 @@
-/**
- * Apple Root CA certificates used to verify StoreKit 2 signed transactions.
- *
- * Apple signs JWS transactions with an ECDSA key; the signing certificate
- * chain is embedded in the JWS `x5c` header. To trust the leaf key we must
- * validate the chain all the way up to one of Apple's published root CAs.
- *
- * Source: https://www.apple.com/certificateauthority/
- * These certificates are public and static. Update this list if Apple
- * publishes a new root — existing JWS signed with older roots continue to
- * validate against their original root.
- */
-/**
- * Apple Root CA - G3 (current root for StoreKit 2 / App Store Server API).
- * SHA-256 fingerprint: 63343ABF B89A6A03 EB994052 C5ADBBF8 A87E2C46 81F6F0FC C8A4DA48 95F0FBBF
- * Valid: 2014-04-30 — 2039-04-30
- */
-export const APPLE_ROOT_CA_G3_PEM = `-----BEGIN CERTIFICATE-----
-MIICQzCCAcmgAwIBAgIILcX8iNLFS5UwCgYIKoZIzj0EAwMwZzEbMBkGA1UEAwwS
-QXBwbGUgUm9vdCBDQSAtIEczMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9u
-IEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwHhcN
-MTQwNDMwMTgxOTA2WhcNMzkwNDMwMTgxOTA2WjBnMRswGQYDVQQDDBJBcHBsZSBS
-b290IENBIC0gRzMxJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5MRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzB2MBAGByqGSM49
-AgEGBSuBBAAiA2IABJjpLz1AcqTtkyJygRMc3RCV8cWjTnHcFBbZDuWmBSp3ZHtf
-TjjTuxxEtX/1H7YyYl3J6YRbTzBPEVoA/VhYDKX1DyxNB0cTddqXl5dvMVztK517
-IDvYuVTZXpmkOlEKMaNCMEAwHQYDVR0OBBYEFLuw3qFYM4iapIqZ3r6966/ayySr
-MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gA
-MGUCMQCD6cHEFl4aXTQY2e3v9GwOAEZLuN+yRhHFD/3meoyhpmvOwgPUnPWTxnS4
-at+qIxUCMG1mihDK1A3UT82NQz60imOlM27jbdoXt2QfyFMm+YhidDkLF1vLUagM
-6BgD56KyKA==
------END CERTIFICATE-----`;
-/**
- * All Apple root CAs accepted for StoreKit 2 JWS validation.
- * Currently only G3; add G4 here when Apple publishes it.
- */
-export const APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
-//# sourceMappingURL=apple-root-ca.js.map

package/dist/providers/apple-root-ca.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"apple-root-ca.js","sourceRoot":"","sources":["../../src/providers/apple-root-ca.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;0BAcV,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/providers/apple.js

@@ -1,630 +0,0 @@
-import { decodeJwt, decodeProtectedHeader, importPKCS8, importX509, jwtVerify, SignJWT } from 'jose';
-import { X509Certificate, createSign, randomUUID } from 'node:crypto';
-import { SUBSCRIPTION_STATUS } from '@onesub/shared';
-import { APPLE_ROOT_CA_PEMS } from './apple-root-ca.js';
-import { log } from '../logger.js';
-import { fetchWithTimeout } from '../http.js';
-import { getDefaultCache } from '../cache.js';
-import { mockValidateAppleSubscription, mockValidateAppleProduct, } from './mock.js';
-/** Maximum age for consumable receipts (72 hours). Older receipts may indicate replay attacks. */
-const MAX_CONSUMABLE_RECEIPT_AGE_MS = 72 * 60 * 60 * 1000;
-function derBase64ToPem(der) {
-    return ('-----BEGIN CERTIFICATE-----\n' +
-        (der.match(/.{1,64}/g) ?? []).join('\n') +
-        '\n-----END CERTIFICATE-----');
-}
-const APPLE_ROOT_CERTS = APPLE_ROOT_CA_PEMS.map((pem) => new X509Certificate(pem));
-/**
- * Validate that the x5c chain from the JWS terminates at one of Apple's
- * bundled root CAs. Each cert in the chain must be signed by the next (or
- * the bundled root), and all certs must currently be within their validity
- * window.
- *
- * Returns the leaf certificate PEM on success. Throws on any failure.
- */
-function verifyAppleCertChain(x5c) {
-    if (x5c.length === 0) {
-        throw new Error('[onesub/apple] empty x5c');
-    }
-    const chain = x5c.map((der) => new X509Certificate(derBase64ToPem(der)));
-    const now = new Date();
-    // Validity window + leaf→intermediate→... signature chain
-    for (let i = 0; i < chain.length; i++) {
-        const cert = chain[i];
-        if (new Date(cert.validFrom) > now || new Date(cert.validTo) < now) {
-            throw new Error(`[onesub/apple] cert[${i}] outside validity window`);
-        }
-        if (i + 1 < chain.length) {
-            if (!cert.checkIssued(chain[i + 1]) || !cert.verify(chain[i + 1].publicKey)) {
-                throw new Error(`[onesub/apple] cert[${i}] not signed by cert[${i + 1}]`);
-            }
-        }
-    }
-    // Final cert in chain (typically intermediate) must be signed by an Apple root.
-    // Accept either (a) explicit signature match or (b) the cert itself being one
-    // of our bundled Apple roots (happens when Apple embeds the full chain).
-    const top = chain[chain.length - 1];
-    const topDer = top.raw.toString('base64');
-    const trustsRoot = APPLE_ROOT_CERTS.some((root) => {
-        if (root.raw.toString('base64') === topDer)
-            return true;
-        if (!top.checkIssued(root))
-            return false;
-        try {
-            return top.verify(root.publicKey);
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!trustsRoot) {
-        throw new Error('[onesub/apple] cert chain does not terminate at a trusted Apple root');
-    }
-    return chain[0].toString();
-}
-/**
- * Decode and verify a StoreKit 2 signed transaction JWS.
- *
- * 1. Extract the x5c certificate chain from the JWS header.
- * 2. Validate the chain terminates at a bundled Apple Root CA (G3).
- * 3. Use the leaf certificate's public key to verify the JWS signature.
- *
- * skipVerification=true skips all of the above and just decodes the payload
- * (dev/test only).
- */
-export async function decodeJws(jws, skipVerification = false) {
-    if (skipVerification) {
-        if (process.env['NODE_ENV'] === 'production') {
-            log.warn('[onesub/apple] WARNING: skipJwsVerification is enabled in production. ' +
-                'JWS signatures are NOT being verified. This is a security risk.');
-        }
-        return decodeJwt(jws);
-    }
-    const header = decodeProtectedHeader(jws);
-    const x5c = header.x5c;
-    if (!x5c || x5c.length === 0) {
-        throw new Error('[onesub/apple] JWS header missing x5c certificate chain');
-    }
-    const leafPem = verifyAppleCertChain(x5c);
-    const alg = header.alg ?? 'ES256';
-    const key = await importX509(leafPem, alg);
-    const { payload } = await jwtVerify(jws, key);
-    return payload;
-}
-/**
- * Derive a SubscriptionStatus from the transaction + renewal payloads.
- */
-function deriveStatus(tx, renewal) {
-    if (tx.revocationDate)
-        return SUBSCRIPTION_STATUS.CANCELED;
-    const now = Date.now();
-    const expires = tx.expiresDate ?? 0;
-    if (expires > now)
-        return SUBSCRIPTION_STATUS.ACTIVE;
-    // Expired — check if it was voluntarily canceled
-    if (renewal?.autoRenewStatus === 0)
-        return SUBSCRIPTION_STATUS.CANCELED;
-    return SUBSCRIPTION_STATUS.EXPIRED;
-}
-/**
- * Validate an Apple receipt string.
- *
- * StoreKit 2 receipts are JWS-encoded signed transactions (the `signedTransaction`
- * field from the client). For legacy base64 receipts from StoreKit 1, you would
- * POST to verifyReceipt — that path is left as a stub here because Apple is
- * deprecating it.
- */
-export async function validateAppleReceipt(receipt, config) {
-    if (config.mockMode)
-        return mockValidateAppleSubscription(receipt);
-    let tx;
-    try {
-        tx = await decodeJws(receipt, config.skipJwsVerification);
-    }
-    catch (err) {
-        const preview = receipt.slice(0, 60);
-        const parts = receipt.split('.').length;
-        log.warn('[onesub/apple] Failed to decode receipt as JWS:', err?.message ?? err, `| preview: "${preview}..." (len=${receipt.length}, parts=${parts})`);
-        return null;
-    }
-    if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
-        return null;
-    }
-    // Validate bundle ID — missing or mismatched both rejected
-    if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-        log.warn('[onesub/apple] Bundle ID mismatch:', tx.bundleId, '!==', config.bundleId);
-        return null;
-    }
-    // Reject Sandbox receipts in production unless explicitly allowed.
-    // Set ONESUB_ALLOW_SANDBOX=true to permit TestFlight sandbox receipts on
-    // production servers (useful during QA before App Store release).
-    if (process.env['NODE_ENV'] === 'production' &&
-        tx.environment !== 'Production' &&
-        process.env['ONESUB_ALLOW_SANDBOX'] !== 'true') {
-        log.warn('[onesub/apple] Sandbox receipt rejected in production:', tx.environment);
-        return null;
-    }
-    const status = deriveStatus(tx, null);
-    const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
-    return {
-        userId: '', // caller fills this in from the request body
-        productId: tx.productId,
-        platform: 'apple',
-        status,
-        expiresAt: new Date(tx.expiresDate).toISOString(),
-        originalTransactionId: tx.originalTransactionId,
-        purchasedAt: new Date(purchasedAt).toISOString(),
-        willRenew: status === SUBSCRIPTION_STATUS.ACTIVE, // refined by renewal info in webhook
-    };
-}
-/**
- * Validate an Apple StoreKit 2 JWS signedTransaction for a consumable or
- * non-consumable product.
- *
- * Differences from validateAppleReceipt (subscriptions):
- * - Checks tx.type is 'Consumable' or 'Non-Consumable' (not a subscription)
- * - Uses tx.transactionId (per-purchase unique) instead of originalTransactionId
- * - Enforces a 72-hour receipt age limit to block replay attacks
- * - Does NOT check expiresDate (one-time purchases don't expire)
- */
-export async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
-    if (config.mockMode)
-        return mockValidateAppleProduct(signedTransaction, expectedProductId);
-    let tx;
-    try {
-        tx = await decodeJws(signedTransaction, config.skipJwsVerification);
-    }
-    catch (err) {
-        const preview = signedTransaction.slice(0, 60);
-        const parts = signedTransaction.split('.').length;
-        const looksLikeJws = parts === 3;
-        log.warn('[onesub/apple] Failed to decode consumable JWS:', err?.message ?? err, `| receipt preview: "${preview}..." (len=${signedTransaction.length}, parts=${parts}, looksLikeJws=${looksLikeJws})`);
-        return null;
-    }
-    // bundleId must be present and match
-    if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-        log.warn('[onesub/apple] Bundle ID mismatch:', tx.bundleId, '!==', config.bundleId);
-        return null;
-    }
-    // Must be a one-time purchase type (not a subscription)
-    if (tx.type !== 'Consumable' && tx.type !== 'Non-Consumable') {
-        log.warn('[onesub/apple] Invalid purchase type for product validation:', tx.type);
-        return null;
-    }
-    // Reject Sandbox receipts in production unless explicitly allowed.
-    // Set ONESUB_ALLOW_SANDBOX=true to permit TestFlight sandbox receipts on
-    // production servers (useful during QA before App Store release).
-    if (process.env['NODE_ENV'] === 'production' &&
-        tx.environment !== 'Production' &&
-        process.env['ONESUB_ALLOW_SANDBOX'] !== 'true') {
-        log.warn('[onesub/apple] Sandbox receipt rejected in production:', tx.environment);
-        return null;
-    }
-    if (!tx.productId) {
-        log.warn('[onesub/apple] No productId in transaction');
-        return null;
-    }
-    if (expectedProductId && tx.productId !== expectedProductId) {
-        log.warn('[onesub/apple] Product ID mismatch:', tx.productId, '!==', expectedProductId);
-        return null;
-    }
-    // Reject refunded purchases
-    if (tx.revocationDate) {
-        log.warn('[onesub/apple] Purchase was revoked/refunded');
-        return null;
-    }
-    // Reject receipts older than 72 hours (replay attack prevention)
-    if (tx.purchaseDate && Date.now() - tx.purchaseDate > MAX_CONSUMABLE_RECEIPT_AGE_MS) {
-        log.warn('[onesub/apple] Consumable receipt too old (>72h)');
-        return null;
-    }
-    // For consumables, transactionId is per-purchase unique.
-    // originalTransactionId is shared across re-purchases, so it must not be used
-    // as the deduplication key for consumables.
-    const transactionId = tx.transactionId ?? tx.originalTransactionId;
-    if (!transactionId) {
-        log.warn('[onesub/apple] No transactionId in consumable transaction');
-        return null;
-    }
-    return {
-        transactionId,
-        productId: tx.productId,
-        purchasedAt: tx.purchaseDate
-            ? new Date(tx.purchaseDate).toISOString()
-            : new Date().toISOString(),
-    };
-}
-/**
- * Decode an Apple Server Notification V2 payload.
- * Returns the derived subscription update to be merged into the store.
- */
-export async function decodeAppleNotification(payload, skipJwsVerification = false) {
-    const { signedTransactionInfo, signedRenewalInfo } = payload.data;
-    let tx;
-    let renewal = null;
-    try {
-        tx = await decodeJws(signedTransactionInfo, skipJwsVerification);
-    }
-    catch {
-        return null;
-    }
-    try {
-        renewal = await decodeJws(signedRenewalInfo, skipJwsVerification);
-    }
-    catch {
-        // renewal info is optional for some notification types
-    }
-    // expiresDate is only required for subscription notifications.
-    // Consumable / non-consumable refund notifications (REFUND for IAP) have no expiry.
-    if (!tx.originalTransactionId)
-        return null;
-    const status = deriveStatus(tx, renewal);
-    const willRenew = renewal?.autoRenewStatus === 1;
-    // environment is on the notification data envelope but Apple also includes
-    // it inside the signed transaction payload. Prefer the JWS-protected one.
-    const txEnv = tx.environment;
-    const dataEnv = payload.data.environment;
-    const environment = txEnv === 'Sandbox' || dataEnv === 'Sandbox' ? 'Sandbox' : 'Production';
-    return {
-        originalTransactionId: tx.originalTransactionId,
-        transactionId: tx.transactionId ?? null,
-        type: tx.type ?? null,
-        productId: tx.productId ?? null,
-        bundleId: tx.bundleId ?? payload.data.bundleId ?? null,
-        environment,
-        status,
-        willRenew,
-        expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
-        appAccountToken: tx.appAccountToken ?? null,
-        inAppOwnershipType: tx.inAppOwnershipType ?? null,
-    };
-}
-// ───────────────────────────────────────────────────────────────────────────
-// App Store Server API — outbound calls (consumption response, etc.)
-// ───────────────────────────────────────────────────────────────────────────
-/**
- * JWT cache for the App Store Server API. Apple caps token TTL at 20 minutes;
- * we mint with that TTL and re-use until 60 seconds before expiry (so
- * long-running webhook bursts don't pay the ECDSA-sign cost on every request).
- *
- * Cache backend: `getDefaultCache()` (in-memory by default, swappable with
- * Redis / Memcached via `setDefaultCache()`). When the cache is shared across
- * cluster nodes only one node mints per TTL window.
- *
- * Keyed by `${issuerId}|${keyId}` since rotating either invalidates the JWT.
- * Concurrent mints inside a single process are deduped via `appleJwtMintPromises`.
- */
-const appleJwtMintPromises = new Map();
-const APPLE_JWT_TTL_MS = 20 * 60 * 1000;
-const APPLE_JWT_REFRESH_BEFORE_MS = 60 * 1000;
-/**
- * Mint a JWT for the App Store Server API (audience `appstoreconnect-v1`).
- * Requires keyId, issuerId, and privateKey (PKCS8 ES256 from App Store Connect).
- * Token TTL is capped at 20 minutes per Apple's spec.
- */
-async function makeAppleApiJwt(config) {
-    const { issuerId, keyId, privateKey, bundleId } = config;
-    if (!issuerId || !keyId || !privateKey) {
-        throw new Error('[onesub/apple] App Store Server API requires issuerId, keyId, and privateKey');
-    }
-    const cache = getDefaultCache();
-    const cacheKey = `apple:jwt:${issuerId}|${keyId}`;
-    const now = Date.now();
-    const cached = await cache.get(cacheKey);
-    if (cached && cached.expiresAt - now > APPLE_JWT_REFRESH_BEFORE_MS) {
-        return cached.token;
-    }
-    const inflight = appleJwtMintPromises.get(cacheKey);
-    if (inflight)
-        return inflight;
-    const promise = (async () => {
-        const key = await importPKCS8(privateKey, 'ES256');
-        const issuedAt = Math.floor(Date.now() / 1000);
-        const token = await new SignJWT({ bid: bundleId })
-            .setProtectedHeader({ alg: 'ES256', kid: keyId, typ: 'JWT' })
-            .setIssuer(issuerId)
-            .setAudience('appstoreconnect-v1')
-            .setIssuedAt(issuedAt)
-            .setExpirationTime(issuedAt + Math.floor(APPLE_JWT_TTL_MS / 1000))
-            .sign(key);
-        const expiresAt = Date.now() + APPLE_JWT_TTL_MS;
-        // TTL slightly under the 20m spec so cache eviction matches token expiry.
-        await cache.set(cacheKey, { token, expiresAt }, 19 * 60);
-        return token;
-    })().finally(() => {
-        appleJwtMintPromises.delete(cacheKey);
-    });
-    appleJwtMintPromises.set(cacheKey, promise);
-    return promise;
-}
-/** Test-only: clear the Apple JWT cache. Not exported. */
-function clearAppleJwtCacheForTests() {
-    const cache = getDefaultCache();
-    // Best-effort wipe — tests use the in-memory adapter, which exposes clear().
-    if ('clear' in cache && typeof cache.clear === 'function') {
-        cache.clear();
-    }
-    appleJwtMintPromises.clear();
-}
-// Expose for the test suite without polluting the public API surface.
-export const __testing = { clearAppleJwtCacheForTests };
-/**
- * PUT a ConsumptionRequest to Apple's
- * /inApps/v1/transactions/consumption/{transactionId} endpoint.
- *
- * Apple sends CONSUMPTION_REQUEST notifications when a customer asks for a
- * refund on a consumable. Without a response Apple has no usage signal and
- * tends to grant the refund. This call provides the data Apple uses to weigh
- * the refund decision.
- *
- * Fire-and-forget: failures are logged, never thrown — the webhook should
- * still 200 to Apple even if our outbound call fails.
- */
-export async function sendAppleConsumptionResponse(transactionId, body, config, options) {
-    if (config.mockMode)
-        return;
-    let jwt;
-    try {
-        jwt = await makeAppleApiJwt(config);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Cannot send consumption response — JWT mint failed:', err);
-        return;
-    }
-    const host = options?.sandbox
-        ? 'api.storekit-sandbox.itunes.apple.com'
-        : 'api.storekit.itunes.apple.com';
-    const url = `https://${host}/inApps/v1/transactions/consumption/${encodeURIComponent(transactionId)}`;
-    try {
-        const resp = await fetchWithTimeout(url, {
-            method: 'PUT',
-            headers: {
-                Authorization: `Bearer ${jwt}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(body),
-        });
-        if (!resp.ok) {
-            const text = await resp.text();
-            log.warn(`[onesub/apple] Consumption response API error ${resp.status}: ${text}`);
-        }
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Consumption response network error:', err);
-    }
-}
-/**
- * Apple's status code in the GET /inApps/v1/subscriptions/{originalTxId} response.
- * https://developer.apple.com/documentation/appstoreserverapi/status
- */
-const APPLE_SUBSCRIPTION_STATUS_CODE = {
-    ACTIVE: 1,
-    EXPIRED: 2,
-    BILLING_RETRY: 3,
-    GRACE_PERIOD: 4,
-    REVOKED: 5,
-};
-function mapAppleStatusCode(code) {
-    switch (code) {
-        case APPLE_SUBSCRIPTION_STATUS_CODE.ACTIVE:
-            return SUBSCRIPTION_STATUS.ACTIVE;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.GRACE_PERIOD:
-            return SUBSCRIPTION_STATUS.GRACE_PERIOD;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.BILLING_RETRY:
-            return SUBSCRIPTION_STATUS.ON_HOLD;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.REVOKED:
-            return SUBSCRIPTION_STATUS.CANCELED;
-        case APPLE_SUBSCRIPTION_STATUS_CODE.EXPIRED:
-        default:
-            return SUBSCRIPTION_STATUS.EXPIRED;
-    }
-}
-/**
- * Fetch the current state of a subscription directly from Apple's App Store
- * Server API — the canonical source of truth when webhooks have been missed,
- * delivered out of order, or the local store has no record at all.
- *
- * GET /inApps/v1/subscriptions/{originalTransactionId}
- * https://developer.apple.com/documentation/appstoreserverapi/get_all_subscription_statuses
- *
- * Returns null on:
- *   - Missing API credentials (issuerId/keyId/privateKey)
- *   - Network or auth failure
- *   - Empty response (transaction not found)
- *
- * Hosts can call this directly (e.g. from a reconciliation cron) or it runs
- * automatically as the unknown-transaction fallback inside the Apple webhook.
- */
-export async function fetchAppleSubscriptionStatus(originalTransactionId, config, options) {
-    if (config.mockMode)
-        return null;
-    let jwt;
-    try {
-        jwt = await makeAppleApiJwt(config);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Cannot fetch subscription status — JWT mint failed:', err);
-        return null;
-    }
-    const host = options?.sandbox
-        ? 'api.storekit-sandbox.itunes.apple.com'
-        : 'api.storekit.itunes.apple.com';
-    const url = `https://${host}/inApps/v1/subscriptions/${encodeURIComponent(originalTransactionId)}`;
-    let body;
-    try {
-        const resp = await fetchWithTimeout(url, {
-            headers: { Authorization: `Bearer ${jwt}` },
-        });
-        if (!resp.ok) {
-            const text = await resp.text();
-            log.warn(`[onesub/apple] Status API error ${resp.status}: ${text}`);
-            return null;
-        }
-        body = (await resp.json());
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Status API network error:', err);
-        return null;
-    }
-    // Find the lastTransactions entry matching the requested originalTransactionId.
-    // Apple groups by subscriptionGroupIdentifier; one originalTxId is in exactly one group.
-    const entry = body.data
-        ?.flatMap((g) => g.lastTransactions ?? [])
-        .find((t) => t.originalTransactionId === originalTransactionId);
-    if (!entry || entry.status == null || !entry.signedTransactionInfo) {
-        log.warn('[onesub/apple] Status API returned no matching transaction for', originalTransactionId);
-        return null;
-    }
-    let tx;
-    try {
-        tx = await decodeJws(entry.signedTransactionInfo, config.skipJwsVerification);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Failed to decode signedTransactionInfo from Status API:', err);
-        return null;
-    }
-    let renewal = null;
-    if (entry.signedRenewalInfo) {
-        try {
-            renewal = await decodeJws(entry.signedRenewalInfo, config.skipJwsVerification);
-        }
-        catch {
-            // renewal info is optional
-        }
-    }
-    if (!tx.productId || !tx.expiresDate) {
-        log.warn('[onesub/apple] Status API transaction missing productId or expiresDate');
-        return null;
-    }
-    const status = mapAppleStatusCode(entry.status);
-    const purchasedAt = tx.originalPurchaseDate ?? tx.purchaseDate ?? Date.now();
-    return {
-        userId: '', // caller fills this in
-        productId: tx.productId,
-        platform: 'apple',
-        status,
-        expiresAt: new Date(tx.expiresDate).toISOString(),
-        originalTransactionId,
-        purchasedAt: new Date(purchasedAt).toISOString(),
-        willRenew: renewal?.autoRenewStatus === 1,
-    };
-}
-/**
- * Fetch all transactions for an originalTransactionId from the App Store
- * Transaction History API (GET /inApps/v2/history/{originalTransactionId}).
- *
- * Paginates automatically until `hasMore` is false. Returns all decoded
- * transaction records, oldest-first (Apple's default sort).
- *
- * Returns null when API credentials are missing or the call fails.
- */
-export async function fetchAppleTransactionHistory(originalTransactionId, config, options) {
-    if (config.mockMode)
-        return null;
-    let jwt;
-    try {
-        jwt = await makeAppleApiJwt(config);
-    }
-    catch (err) {
-        log.warn('[onesub/apple] Cannot fetch transaction history — JWT mint failed:', err);
-        return null;
-    }
-    const host = options?.sandbox
-        ? 'api.storekit-sandbox.itunes.apple.com'
-        : 'api.storekit.itunes.apple.com';
-    const results = [];
-    let revision;
-    for (;;) {
-        const url = new URL(`https://${host}/inApps/v2/history/${encodeURIComponent(originalTransactionId)}`);
-        if (revision)
-            url.searchParams.set('revision', revision);
-        let page;
-        try {
-            const resp = await fetchWithTimeout(url.toString(), {
-                headers: { Authorization: `Bearer ${jwt}` },
-            });
-            if (!resp.ok) {
-                const text = await resp.text();
-                log.warn(`[onesub/apple] Transaction History API error ${resp.status}: ${text}`);
-                return null;
-            }
-            page = (await resp.json());
-        }
-        catch (err) {
-            log.warn('[onesub/apple] Transaction History API network error:', err);
-            return null;
-        }
-        for (const signed of page.signedTransactions ?? []) {
-            try {
-                const tx = await decodeJws(signed, config.skipJwsVerification);
-                if (!tx.originalTransactionId || !tx.transactionId || !tx.productId)
-                    continue;
-                results.push({
-                    originalTransactionId: tx.originalTransactionId,
-                    transactionId: tx.transactionId,
-                    productId: tx.productId,
-                    type: tx.type ?? 'Unknown',
-                    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : new Date().toISOString(),
-                    expiresAt: tx.expiresDate ? new Date(tx.expiresDate).toISOString() : null,
-                    appAccountToken: tx.appAccountToken ?? null,
-                    inAppOwnershipType: tx.inAppOwnershipType ?? null,
-                    revocationDate: tx.revocationDate ? new Date(tx.revocationDate).toISOString() : null,
-                });
-            }
-            catch {
-                // skip malformed JWS entries
-            }
-        }
-        if (!page.hasMore)
-            break;
-        revision = page.revision;
-    }
-    return results;
-}
-/**
- * Sign an Apple Promotional Offer payload with ES256 (ECDSA P-256).
- *
- * The message to sign is:
- *   appBundleId + '⁣' + keyIdentifier + '⁣' + productIdentifier + '⁣'
- *   + offerIdentifier + '⁣' + applicationUsername + '⁣'
- *   + nonce (lowercase) + '⁣' + timestamp (ms, string)
- *
- * Requires `config.offerKeyId` and `config.offerPrivateKey` (PEM ES256 key from
- * App Store Connect → Subscriptions → Promotional Offers → Keys).
- *
- * Throws if the required keys are not configured.
- */
-export async function signApplePromotionalOffer(input, config) {
-    const { offerKeyId, offerPrivateKey } = config;
-    if (!offerKeyId || !offerPrivateKey) {
-        throw new Error('[onesub/apple] Promotional Offer signing requires config.apple.offerKeyId and config.apple.offerPrivateKey');
-    }
-    const nonce = randomUUID().toLowerCase();
-    const timestamp = Date.now();
-    const separator = '⁣';
-    const message = [
-        input.bundleId,
-        offerKeyId,
-        input.productId,
-        input.offerId,
-        input.applicationUsername,
-        nonce,
-        String(timestamp),
-    ].join(separator);
-    if (!offerPrivateKey.includes('BEGIN') || !offerPrivateKey.includes('END')) {
-        throw new Error('[onesub/apple] offerPrivateKey does not appear to be PEM-encoded');
-    }
-    let signatureBuffer;
-    try {
-        const sign = createSign('SHA256');
-        sign.update(message);
-        sign.end();
-        signatureBuffer = sign.sign(offerPrivateKey);
-    }
-    catch (err) {
-        throw new Error(`[onesub/apple] Failed to sign promotional offer — check that offerPrivateKey is a valid ES256 PEM key: ${err.message}`);
-    }
-    const signature = signatureBuffer.toString('base64');
-    return { keyId: offerKeyId, nonce, timestamp, signature };
-}
-//# sourceMappingURL=apple.js.map