@onesub/server 0.14.0 → 0.16.0

package/dist/index.js

@@ -3,8 +3,14 @@ import { PURCHASE_TYPE, ROUTES, DEFAULT_PORT, ONESUB_ERROR_CODE, SUBSCRIPTION_ST
 import { z } from 'zod';
 import { decodeJwt, decodeProtectedHeader, importX509, jwtVerify, importPKCS8, SignJWT, createRemoteJWKSet } from 'jose';
 import { X509Certificate, randomUUID, createSign, createHash } from 'crypto';
+import { createRequire } from 'module';
 
-// src/index.ts
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/store.ts
 var InMemorySubscriptionStore = class {
@@ -14,6 +20,14 @@ var InMemorySubscriptionStore = class {
   byUserId = /* @__PURE__ */ new Map();
   byTransactionId = /* @__PURE__ */ new Map();
   async save(sub) {
+    const prev = this.byTransactionId.get(sub.originalTransactionId);
+    if (prev && prev.userId !== sub.userId) {
+      const oldList = (this.byUserId.get(prev.userId) ?? []).filter(
+        (s) => s.originalTransactionId !== sub.originalTransactionId
+      );
+      if (oldList.length) this.byUserId.set(prev.userId, oldList);
+      else this.byUserId.delete(prev.userId);
+    }
     this.byTransactionId.set(sub.originalTransactionId, sub);
     const existing = this.byUserId.get(sub.userId) ?? [];
     const filtered = existing.filter((s) => s.originalTransactionId !== sub.originalTransactionId);
@@ -174,8 +188,10 @@ async function fetchWithTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_M
 }
 
 // src/cache.ts
+var SWEEP_EVERY_N_SETS = 256;
 var InMemoryCacheAdapter = class {
   entries = /* @__PURE__ */ new Map();
+  setsSinceSweep = 0;
   async get(key) {
     const entry = this.entries.get(key);
     if (!entry) return null;
@@ -188,13 +204,29 @@ var InMemoryCacheAdapter = class {
   async set(key, value, ttlSeconds) {
     const expiresAt = ttlSeconds && ttlSeconds > 0 ? Date.now() + ttlSeconds * 1e3 : 0;
     this.entries.set(key, { value, expiresAt });
+    if (++this.setsSinceSweep >= SWEEP_EVERY_N_SETS) {
+      this.sweepExpired();
+    }
   }
   async del(key) {
     this.entries.delete(key);
   }
+  /** Evict every entry whose TTL has elapsed. */
+  sweepExpired() {
+    this.setsSinceSweep = 0;
+    const now = Date.now();
+    for (const [key, entry] of this.entries) {
+      if (entry.expiresAt !== 0 && entry.expiresAt < now) this.entries.delete(key);
+    }
+  }
   /** Test helper — clear everything. Not part of the public CacheAdapter contract. */
   clear() {
     this.entries.clear();
+    this.setsSinceSweep = 0;
+  }
+  /** Test helper — number of entries currently held (including not-yet-swept expired ones). */
+  get size() {
+    return this.entries.size;
   }
 };
 var defaultAdapter = new InMemoryCacheAdapter();
@@ -233,6 +265,7 @@ function mockValidateAppleSubscription(receipt) {
   if (!outcomePasses(outcome, "apple")) return null;
   const now = Date.now();
   const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     userId: "",
     productId: "mock_subscription",
@@ -241,7 +274,8 @@ function mockValidateAppleSubscription(receipt) {
     expiresAt: new Date(expiresAt).toISOString(),
     originalTransactionId: deterministicTransactionId("mock_apple_orig", receipt),
     purchasedAt: new Date(now).toISOString(),
-    willRenew: true
+    willRenew: true,
+    ...tokenMatch ? { boundAccountId: tokenMatch[1] } : {}
   };
 }
 function mockValidateAppleProduct(receipt, expectedProductId) {
@@ -261,15 +295,19 @@ function mockValidateGoogleSubscription(receipt, productId) {
   if (!outcomePasses(outcome, "google")) return null;
   const now = Date.now();
   const expiresAt = outcome.kind === "sandbox" ? now + 1 * HOURS : now + 30 * DAYS;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     userId: "",
     productId,
     platform: "google",
     status: SUBSCRIPTION_STATUS.ACTIVE,
     expiresAt: new Date(expiresAt).toISOString(),
-    originalTransactionId: deterministicTransactionId("mock_google_orig", receipt),
+    // Same keying as production: Google records are keyed by the purchaseToken
+    // (the receipt itself) so mock webhooks can find them by token.
+    originalTransactionId: receipt,
     purchasedAt: new Date(now).toISOString(),
-    willRenew: true
+    willRenew: true,
+    ...tokenMatch ? { boundAccountId: tokenMatch[1] } : {}
   };
 }
 function mockValidateGoogleProduct(receipt, productId) {
@@ -284,7 +322,6 @@ function mockValidateGoogleProduct(receipt, productId) {
 }
 
 // src/providers/apple.ts
-var MAX_CONSUMABLE_RECEIPT_AGE_MS = 72 * 60 * 60 * 1e3;
 function derBase64ToPem(der) {
   return "-----BEGIN CERTIFICATE-----\n" + (der.match(/.{1,64}/g) ?? []).join("\n") + "\n-----END CERTIFICATE-----";
 }
@@ -387,8 +424,9 @@ async function validateAppleReceipt(receipt, config) {
     expiresAt: new Date(tx.expiresDate).toISOString(),
     originalTransactionId: tx.originalTransactionId,
     purchasedAt: new Date(purchasedAt).toISOString(),
-    willRenew: status === SUBSCRIPTION_STATUS.ACTIVE
+    willRenew: status === SUBSCRIPTION_STATUS.ACTIVE,
     // refined by renewal info in webhook
+    ...tx.appAccountToken ? { boundAccountId: tx.appAccountToken } : {}
   };
 }
 async function validateAppleConsumableReceipt(signedTransaction, config, expectedProductId) {
@@ -431,8 +469,9 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     log.warn("[onesub/apple] Purchase was revoked/refunded");
     return null;
   }
-  if (tx.purchaseDate && Date.now() - tx.purchaseDate > MAX_CONSUMABLE_RECEIPT_AGE_MS) {
-    log.warn("[onesub/apple] Consumable receipt too old (>72h)");
+  const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
+  if (tx.purchaseDate && Date.now() - tx.purchaseDate > maxAgeMs) {
+    log.warn(`[onesub/apple] Consumable receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
     return null;
   }
   const transactionId = tx.transactionId ?? tx.originalTransactionId;
@@ -721,7 +760,6 @@ var GOOGLE_NOTIFICATION_TYPE = {
   SUBSCRIPTION_REVOKED: 12,
   SUBSCRIPTION_EXPIRED: 13
 };
-var MAX_PRODUCT_RECEIPT_AGE_MS = 72 * 60 * 60 * 1e3;
 var refreshPromises = /* @__PURE__ */ new Map();
 function googleTokenCacheKey(serviceAccountKey) {
   let hash = 0;
@@ -948,6 +986,7 @@ async function validateGoogleReceipt(receipt, productId, config) {
   const purchasedAt = purchase.startTime ?? (/* @__PURE__ */ new Date()).toISOString();
   const willRenew = lineItem.autoRenewingPlan?.autoRenewEnabled ?? false;
   const autoResumeTime = status === SUBSCRIPTION_STATUS.PAUSED ? purchase.pausedStateContext?.autoResumeTime : void 0;
+  const boundAccountId = purchase.externalAccountIdentifiers?.obfuscatedExternalAccountId;
   return {
     userId: "",
     // caller fills this in
@@ -955,13 +994,18 @@ async function validateGoogleReceipt(receipt, productId, config) {
     platform: "google",
     status,
     expiresAt,
-    originalTransactionId: purchase.latestOrderId ?? receipt.slice(0, 64),
+    // Keyed by the purchaseToken, NOT latestOrderId: RTDN webhooks and
+    // linkedPurchaseToken chains only carry the token, so records keyed by
+    // order id are invisible to the entire webhook lifecycle (refund/cancel/
+    // renewal would never find them).
+    originalTransactionId: receipt,
     purchasedAt,
     willRenew,
     // Surface the linked token so host apps (and our webhook userId-continuity
     // logic) can follow upgrade/downgrade chains.
     linkedPurchaseToken: purchase.linkedPurchaseToken,
-    autoResumeTime
+    autoResumeTime,
+    ...boundAccountId ? { boundAccountId } : {}
   };
 }
 async function validateGoogleProductReceipt(purchaseToken, productId, config, type = "non_consumable") {
@@ -992,8 +1036,9 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
   }
   if (purchase.purchaseTimeMillis) {
     const purchaseTime = parseInt(purchase.purchaseTimeMillis, 10);
-    if (Date.now() - purchaseTime > MAX_PRODUCT_RECEIPT_AGE_MS) {
-      log.warn("[onesub/google] Product receipt too old (>72h)");
+    const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
+    if (Date.now() - purchaseTime > maxAgeMs) {
+      log.warn(`[onesub/google] Product receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
       return null;
     }
   }
@@ -1137,6 +1182,22 @@ function createValidateRouter(config, store) {
         sendError(res, 422, ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_SUB);
         return;
       }
+      const boundAccountId = sub.boundAccountId;
+      delete sub.boundAccountId;
+      const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
+      if (bindingMismatch) {
+        log.warn(
+          `[onesub/validate] account binding mismatch for ${sub.originalTransactionId}: receipt token does not match userId ${userId}`
+        );
+        sendError(
+          res,
+          409,
+          ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+          "TRANSACTION_BELONGS_TO_OTHER_USER",
+          NO_SUB
+        );
+        return;
+      }
       sub.userId = userId;
       await store.save(sub);
       if (platform === "google" && config.google) {
@@ -1184,7 +1245,7 @@ function createStatusRouter(store) {
   return router;
 }
 var APPLE_ACTIVE_TYPES = /* @__PURE__ */ new Set(["SUBSCRIBED", "DID_RENEW", "DID_RECOVER", "OFFER_REDEEMED"]);
-var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND", "CONSUMPTION_REQUEST"]);
+var APPLE_CANCELED_TYPES = /* @__PURE__ */ new Set(["REVOKE", "REFUND"]);
 var APPLE_EXPIRED_TYPES = /* @__PURE__ */ new Set(["EXPIRED"]);
 function mapAppleNotificationStatus(notificationType, subtype) {
   if (notificationType === "DID_FAIL_TO_RENEW") {
@@ -1241,6 +1302,11 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   } = decoded;
   const notificationType = payload.notificationType;
   const subtype = payload.subtype;
+  if (config.apple?.bundleId && bundleId && bundleId !== config.apple.bundleId) {
+    log.warn("[onesub/webhook/apple] Bundle ID mismatch:", bundleId, "!==", config.apple.bundleId);
+    sendError(res, 400, ONESUB_ERROR_CODE.BUNDLE_ID_MISMATCH, "Bundle ID mismatch");
+    return;
+  }
   const mapped = mapAppleNotificationStatus(notificationType, subtype);
   const finalStatus = mapped ?? status;
   if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
@@ -1267,6 +1333,10 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   }
   const isOneTimePurchase = type === "Consumable" || type === "Non-Consumable";
   const isRefundOrRevoke = APPLE_CANCELED_TYPES.has(notificationType);
+  if (isOneTimePurchase && notificationType === "CONSUMPTION_REQUEST") {
+    res.status(200).json({ received: true });
+    return;
+  }
   try {
     if (isOneTimePurchase && isRefundOrRevoke) {
       const lookupId = transactionId ?? originalTransactionId;
@@ -1279,7 +1349,7 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     }
     const existing = await store.getByTransactionId(originalTransactionId);
     if (existing) {
-      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase && notificationType !== "CONSUMPTION_REQUEST";
+      const isSubscriptionRefund = isRefundOrRevoke && !isOneTimePurchase;
       const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
       const correctedUserId = appAccountToken && existing.userId === originalTransactionId ? appAccountToken : existing.userId;
       if (correctedUserId !== existing.userId) {
@@ -1319,6 +1389,12 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     res.status(200).json({ received: true });
   } catch (err) {
     log.error("[onesub/webhook/apple] Store update error:", err);
+    if (webhookEventStore?.unmark && typeof payload.notificationUUID === "string") {
+      try {
+        await webhookEventStore.unmark("apple", payload.notificationUUID);
+      } catch {
+      }
+    }
     sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
   }
 }
@@ -1328,13 +1404,23 @@ function getGoogleJwks() {
   if (!googleJwks) googleJwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));
   return googleJwks;
 }
-async function verifyGooglePushToken(req, expectedAudience) {
+async function verifyGooglePushToken(req, expectedAudience, expectedServiceAccountEmail) {
   const authHeader = req.headers["authorization"];
   if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) return false;
   try {
-    await jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
-      audience: expectedAudience
+    const { payload } = await jwtVerify(authHeader.slice("Bearer ".length).trim(), getGoogleJwks(), {
+      audience: expectedAudience,
+      // Any Google Cloud principal can mint an OIDC token with an arbitrary
+      // audience — issuer (and, when configured, the push service-account
+      // email) narrows acceptance to real Pub/Sub push auth tokens. Google
+      // documents both issuer forms, so accept either.
+      issuer: ["https://accounts.google.com", "accounts.google.com"]
     });
+    if (expectedServiceAccountEmail) {
+      if (payload["email"] !== expectedServiceAccountEmail || payload["email_verified"] !== true) {
+        return false;
+      }
+    }
     return true;
   } catch {
     return false;
@@ -1342,7 +1428,11 @@ async function verifyGooglePushToken(req, expectedAudience) {
 }
 async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore) {
   if (config.google?.pushAudience) {
-    const authenticated = await verifyGooglePushToken(req, config.google.pushAudience);
+    const authenticated = await verifyGooglePushToken(
+      req,
+      config.google.pushAudience,
+      config.google.pushServiceAccountEmail
+    );
     if (!authenticated) {
       sendError(res, 401, ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
       return;
@@ -1353,6 +1443,14 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     sendError(res, 400, ONESUB_ERROR_CODE.MISSING_MESSAGE_DATA, "Missing message.data");
     return;
   }
+  const unmarkEvent = async () => {
+    if (webhookEventStore?.unmark && typeof body.message?.messageId === "string") {
+      try {
+        await webhookEventStore.unmark("google", body.message.messageId);
+      } catch {
+      }
+    }
+  };
   if (webhookEventStore && typeof body.message.messageId === "string") {
     const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
     if (!fresh) {
@@ -1386,6 +1484,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       res.status(200).json({ received: true });
     } catch (err) {
       log.error("[onesub/webhook/google] voided notification error:", err);
+      await unmarkEvent();
       sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process voided notification");
     }
     return;
@@ -1412,6 +1511,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       res.status(200).json({ received: true });
     } catch (err) {
       log.error("[onesub/webhook/google] oneTimeProduct error:", err);
+      await unmarkEvent();
       sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process oneTimeProduct notification");
     }
     return;
@@ -1445,7 +1545,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     } else if (isGoogleExpiredNotification(notificationType)) {
       finalStatus = SUBSCRIPTION_STATUS.EXPIRED;
     } else {
-      finalStatus = SUBSCRIPTION_STATUS.ACTIVE;
+      finalStatus = existing?.status ?? SUBSCRIPTION_STATUS.ACTIVE;
     }
     if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
       const hook = config.google.onPriceChangeConfirmed;
@@ -1456,7 +1556,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       if (config.google?.serviceAccountKey) {
         const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
         if (fresh) {
-          const preserveNotificationStatus = finalStatus === SUBSCRIPTION_STATUS.GRACE_PERIOD || finalStatus === SUBSCRIPTION_STATUS.ON_HOLD;
+          const preserveNotificationStatus = isGoogleGracePeriodNotification(notificationType) || isGoogleOnHoldNotification(notificationType);
           updated = {
             ...existing,
             status: preserveNotificationStatus ? finalStatus : fresh.status,
@@ -1472,14 +1572,16 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       if (config.google?.serviceAccountKey) {
         const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
         if (fresh) {
+          const boundAccountId = fresh.boundAccountId;
+          delete fresh.boundAccountId;
           if (fresh.linkedPurchaseToken) {
             const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
-            fresh.userId = previous ? previous.userId : purchaseToken;
+            fresh.userId = previous ? previous.userId : boundAccountId ?? purchaseToken;
             if (previous) {
               log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
             }
           } else {
-            fresh.userId = purchaseToken;
+            fresh.userId = boundAccountId ?? purchaseToken;
           }
           await store.save(fresh);
         }
@@ -1490,6 +1592,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     res.status(200).json({ received: true });
   } catch (err) {
     log.error("[onesub/webhook/google] Error handling notification:", err);
+    await unmarkEvent();
     sendError(res, 500, ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to process notification");
   }
 }
@@ -1583,7 +1686,8 @@ function createPurchaseRouter(config, purchaseStore) {
         sendError(res, 422, ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_PURCHASE);
         return;
       }
-      if (boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase()) {
+      const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
+      if (bindingMismatch) {
         log.warn(
           `[onesub/purchase] account binding mismatch for transaction ${transactionId}: token does not match userId ${userId}`
         );
@@ -1817,9 +1921,12 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
       return;
     }
-    await purchaseStore.deletePurchases(existing.userId, existing.productId);
+    const moved = await purchaseStore.reassignPurchase(body.transactionId, body.newUserId);
+    if (!moved) {
+      sendError(res, 404, ONESUB_ERROR_CODE.TRANSACTION_NOT_FOUND, "TRANSACTION_NOT_FOUND");
+      return;
+    }
     const migrated = { ...existing, userId: body.newUserId };
-    await purchaseStore.savePurchase(migrated);
     res.json({ ok: true, purchase: migrated });
   });
   const grantSchema = z.object({
@@ -2351,7 +2458,11 @@ var PostgresSubscriptionStore = class {
           );
         });
         const Pool = pg.default?.Pool ?? pg.Pool;
-        return new Pool({ connectionString: this.connectionString, max: 10 });
+        const pool = new Pool({ connectionString: this.connectionString, max: 10 });
+        pool.on("error", (err) => {
+          log.error("[onesub] PostgresSubscriptionStore pool error (idle client):", err);
+        });
+        return pool;
       })();
     }
     return this.poolPromise;
@@ -2523,7 +2634,11 @@ var PostgresPurchaseStore = class {
           );
         });
         const Pool = pg.default?.Pool ?? pg.Pool;
-        return new Pool({ connectionString: this.connectionString, max: 10 });
+        const pool = new Pool({ connectionString: this.connectionString, max: 10 });
+        pool.on("error", (err) => {
+          log.error("[onesub] PostgresPurchaseStore pool error (idle client):", err);
+        });
+        return pool;
       })();
     }
     return this.poolPromise;
@@ -2538,23 +2653,12 @@ var PostgresPurchaseStore = class {
   }
   async savePurchase(purchase) {
     const pool = await this.getPool();
-    const existing = await pool.query(
-      `SELECT user_id FROM onesub_purchases WHERE transaction_id = $1`,
-      [purchase.transactionId]
-    );
-    if (existing.rows.length > 0) {
-      const owner = existing.rows[0].user_id;
-      if (owner !== purchase.userId) {
-        const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
-        err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
-        throw err;
-      }
-      return;
-    }
-    await pool.query(
+    const inserted = await pool.query(
       `INSERT INTO onesub_purchases
          (transaction_id, user_id, product_id, platform, type, quantity, purchased_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (transaction_id) DO NOTHING
+       RETURNING transaction_id`,
       [
         purchase.transactionId,
         purchase.userId,
@@ -2565,6 +2669,17 @@ var PostgresPurchaseStore = class {
         purchase.purchasedAt
       ]
     );
+    if (inserted.rows.length > 0) return;
+    const existing = await pool.query(
+      `SELECT user_id FROM onesub_purchases WHERE transaction_id = $1`,
+      [purchase.transactionId]
+    );
+    const owner = existing.rows[0]?.user_id;
+    if (owner !== void 0 && owner !== purchase.userId) {
+      const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
+      err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
+      throw err;
+    }
   }
   async getPurchasesByUserId(userId) {
     const pool = await this.getPool();
@@ -2665,7 +2780,6 @@ function rowToPurchaseInfo(row) {
 // src/stores/redis.ts
 var SUB_TX_PREFIX = "onesub:sub:tx:";
 var SUB_USER_PREFIX = "onesub:sub:user:";
-var SUB_ALL = "onesub:sub:all";
 var SUB_ALL_SORTED = "onesub:sub:all:sorted";
 var PUR_TX_PREFIX = "onesub:purchase:tx:";
 var PUR_USER_PREFIX = "onesub:purchase:user:";
@@ -2680,10 +2794,14 @@ var RedisSubscriptionStore = class {
     const score = Date.now();
     const txKey = SUB_TX_PREFIX + sub.originalTransactionId;
     const userKey = SUB_USER_PREFIX + sub.userId;
+    const prevRaw = await this.redis.get(txKey);
+    const prevUserId = prevRaw ? JSON.parse(prevRaw).userId : null;
     const pipeline = this.redis.multi();
     pipeline.set(txKey, JSON.stringify(sub));
+    if (prevUserId !== null && prevUserId !== sub.userId) {
+      pipeline.zrem(SUB_USER_PREFIX + prevUserId, sub.originalTransactionId);
+    }
     pipeline.zadd(userKey, score, sub.originalTransactionId);
-    pipeline.sadd(SUB_ALL, sub.originalTransactionId);
     pipeline.zadd(SUB_ALL_SORTED, score, sub.originalTransactionId);
     await pipeline.exec();
   }
@@ -2755,19 +2873,18 @@ var RedisPurchaseStore = class {
   redis;
   async savePurchase(purchase) {
     const txKey = PUR_TX_PREFIX + purchase.transactionId;
-    const existing = await this.redis.get(txKey);
-    if (existing) {
-      const owner = JSON.parse(existing).userId;
-      if (owner !== purchase.userId) {
+    const claimed = await this.redis.set(txKey, JSON.stringify(purchase), "NX");
+    if (claimed !== "OK") {
+      const existing = await this.redis.get(txKey);
+      const owner = existing ? JSON.parse(existing).userId : null;
+      if (owner !== null && owner !== purchase.userId) {
         const err = new Error("TRANSACTION_BELONGS_TO_OTHER_USER");
         err.code = "TRANSACTION_BELONGS_TO_OTHER_USER";
         throw err;
       }
-      return;
     }
     const score = Date.parse(purchase.purchasedAt) || Date.now();
     const pipeline = this.redis.multi();
-    pipeline.set(txKey, JSON.stringify(purchase));
     pipeline.zadd(PUR_USER_PREFIX + purchase.userId, score, purchase.transactionId);
     pipeline.sadd(PUR_USER_PRODUCT_PREFIX + purchase.userId + ":" + purchase.productId, purchase.transactionId);
     pipeline.sadd(PUR_ALL, purchase.transactionId);
@@ -2878,6 +2995,9 @@ var RedisWebhookEventStore = class {
     const result = await this.redis.set(key, "1", "EX", this.ttlSeconds, "NX");
     return result === "OK";
   }
+  async unmark(provider, eventId) {
+    await this.redis.del(WEBHOOK_EVENT_PREFIX + provider + ":" + eventId);
+  }
 };
 
 // src/webhook-events.ts
@@ -2895,6 +3015,9 @@ var InMemoryWebhookEventStore = class {
     this.seen.set(key, Date.now() + this.ttlSeconds * 1e3);
     return true;
   }
+  async unmark(provider, eventId) {
+    this.seen.delete(`${provider}:${eventId}`);
+  }
   evictExpired() {
     const now = Date.now();
     for (const [key, expiresAt] of this.seen) {
@@ -2916,6 +3039,9 @@ var CacheWebhookEventStore = class {
     await this.cache.set(key, "1", this.ttlSeconds);
     return true;
   }
+  async unmark(provider, eventId) {
+    await this.cache.del(`webhook:event:${provider}:${eventId}`);
+  }
 };
 
 // src/webhook-queue.ts
@@ -3193,8 +3319,6 @@ function openapiHandler() {
     res.json(ONESUB_OPENAPI);
   };
 }
-
-// src/tracing.ts
 var NOOP_SPAN = {
   setAttribute: () => {
   },
@@ -3211,8 +3335,7 @@ function getTracer() {
   if (resolved) return cachedTracer;
   resolved = true;
   try {
-    const req = globalThis.require;
-    if (!req) return null;
+    const req = typeof __require === "function" ? __require : createRequire(import.meta.url);
     const otel = req("@opentelemetry/api");
     cachedTracer = otel.trace.getTracer("@onesub/server", "1.0.0");
     return cachedTracer;