@onesub/server 0.17.1 → 0.18.1

package/README.md

@@ -44,7 +44,7 @@ app.use(createOneSubMiddleware({
   store:         new PostgresSubscriptionStore(process.env.DATABASE_URL),
   purchaseStore: new PostgresPurchaseStore(process.env.DATABASE_URL),
   // Optional:
-  adminSecret: process.env.ADMIN_SECRET,   // enables /onesub/purchase/admin/*
+  adminSecret: process.env.ADMIN_SECRET,   // enables admin + metrics routes
   logger: require('pino')(),               // any { info, warn, error } logger
   refundPolicy: 'immediate',               // 'immediate' (default) | 'until_expiry'
 }));
@@ -52,6 +52,33 @@ app.use(createOneSubMiddleware({
 app.listen(4100);
 ```
 
+### Serving multiple apps
+
+Keep the top-level `apple`/`google` fields for a single app. To validate several bundle IDs and
+package names from one process, configure `apps` and send `appId` in validation requests:
+
+```ts
+app.use(createOneSubMiddleware({
+  database: { url: process.env.DATABASE_URL },
+  apps: [
+    { id: 'coffee', apple: { bundleId: 'gg.pryzm.coffee' } },
+    {
+      id: 'penguinrun',
+      apple: { bundleId: 'gg.pryzm.penguinrun' },
+      google: {
+        packageName: 'gg.pryzm.penguinrun',
+        serviceAccountKey: process.env.PENGUINRUN_GOOGLE_SERVICE_ACCOUNT_KEY,
+      },
+    },
+  ],
+  defaultAppId: 'coffee',
+}));
+```
+
+Apple receipts carry their bundle ID and can be resolved automatically. Google purchase tokens do
+not carry a package name, so requests for a non-default Google app must include `appId`. Unknown
+explicit app IDs fail closed and are never validated with another app's credentials.
+
 ## Endpoints
 
 | Route | Purpose |
@@ -65,8 +92,19 @@ app.listen(4100);
 | `DELETE /onesub/purchase/admin/:userId/:productId` | Wipe a non-consumable (requires `adminSecret`) |
 | `POST /onesub/purchase/admin/grant` | Manually grant a purchase (requires `adminSecret`) |
 | `POST /onesub/purchase/admin/transfer` | Reassign a `transactionId` to a new `userId` (requires `adminSecret`) |
+| `GET  /onesub/admin/subscriptions` | Filter and paginate subscriptions (requires `adminSecret`) |
+| `GET  /onesub/admin/subscriptions/:transactionId` | Get subscription detail (requires `adminSecret`) |
+| `GET  /onesub/admin/customers/:userId` | Get a customer profile (requires `adminSecret`) |
+| `POST /onesub/admin/sync-apple/:originalTransactionId` | Refresh a subscription from Apple (requires `adminSecret`) |
 | `GET  /onesub/admin/webhook-deadletters` | List failed webhook jobs in DLQ (requires `adminSecret` + BullMQ) |
 | `POST /onesub/admin/webhook-replay/:id` | Replay a dead-letter job (requires `adminSecret` + BullMQ) |
+| `GET  /onesub/entitlement?userId=&id=` | Evaluate one configured entitlement |
+| `GET  /onesub/entitlements?userId=` | Evaluate all configured entitlements |
+| `GET  /onesub/metrics/active` | Current entitled counts (requires `adminSecret`) |
+| `GET  /onesub/metrics/started` | Subscriptions started in a range (requires `adminSecret`) |
+| `GET  /onesub/metrics/expired` | Subscriptions ended in a range (requires `adminSecret`) |
+| `GET  /onesub/metrics/purchases/started` | Non-consumables started in a range (requires `adminSecret`) |
+| `POST /onesub/apple/offer-signature` | Sign an Apple promotional offer when offer credentials are configured |
 | `GET  /openapi.json` | OpenAPI 3.1 spec (opt-in via `openapiHandler()`) |
 
 ## Lifecycle states (`0.4.0+`)
@@ -111,6 +149,20 @@ const sub = await fetchAppleSubscriptionStatus(originalTxId, config.apple, { san
 // sub: SubscriptionInfo | null  — null on missing creds / 404 / network failure
 ```
 
+### Transaction History API client
+
+`fetchAppleTransactionHistory()` follows Apple's revision pagination and returns verified transaction
+records. It is a low-level recovery/migration primitive; the host decides how to reconcile returned
+records with its stores.
+
+```ts
+import { fetchAppleTransactionHistory } from '@onesub/server';
+
+const transactions = await fetchAppleTransactionHistory(originalTxId, config.apple, {
+  sandbox: false,
+});
+```
+
 ### CONSUMPTION_REQUEST response hook
 
 When Apple sends a `CONSUMPTION_REQUEST` notification (consumable refund review), without a hook Apple has no usage signal and tends to grant the refund. Provide a hook to PUT consumption info back to `/inApps/v1/transactions/consumption/{txId}`:
@@ -130,6 +182,13 @@ apple: {
 
 Fire-and-forget; failures are logged but don't block the webhook 200.
 
+### Promotional offer signing
+
+Configure the separate subscription-offer key as `apple.offerKeyId` and `apple.offerPrivateKey` to
+mount `POST /onesub/apple/offer-signature`. If `adminSecret` is configured, callers must send the
+same value in `X-Onesub-Offer-Secret`. The endpoint returns StoreKit's `keyId`, `nonce`, `timestamp`,
+and `signature`; never expose the private key to the client.
+
 ## Optional Google hooks (`0.8.0+`)
 
 ```ts

package/dist/__tests__/apps.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=apps.test.d.ts.map

package/dist/__tests__/apps.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/apps.test.ts"],"names":[],"mappings":""}

package/dist/apps.d.ts

@@ -0,0 +1,41 @@
+import type { OneSubAppConfig, OneSubServerConfig } from '@onesub/shared';
+/**
+ * Resolves which app an incoming receipt belongs to, so one onesub instance can
+ * serve N bundles.
+ *
+ * A single-app deployment configures `apple`/`google` at the top level and never
+ * touches `apps` — that config stays the default and nothing here changes its
+ * behaviour.
+ */
+export interface AppRegistry {
+    readonly apps: OneSubAppConfig[];
+    readonly defaultApp: OneSubAppConfig | undefined;
+    /**
+     * Returns the server config with `apple`/`google` swapped to the matched app's
+     * credentials, so downstream providers keep reading `config.apple` /
+     * `config.google` without knowing about multi-app.
+     */
+    configFor(hint: AppHint): OneSubServerConfig;
+}
+export interface AppHint {
+    /** `appId` from the request body, when the client sends one. */
+    appId?: string | null | undefined;
+    /** Bundle id read out of an Apple receipt — the receipt names its own app. */
+    bundleId?: string | null | undefined;
+}
+/**
+ * Registry for this config, built once. Routes and webhook handlers all resolve
+ * through the same instance so the multi-app summary is logged a single time.
+ */
+export declare function getAppRegistry(config: OneSubServerConfig): AppRegistry;
+export declare function buildAppRegistry(config: OneSubServerConfig): AppRegistry;
+/**
+ * Reads the bundleId out of an Apple JWS **without verifying its signature**,
+ * only to decide which app's credentials to validate it with.
+ *
+ * Trusting this to pick the app is safe: the chosen app's validator then verifies
+ * the signature against Apple's roots and re-checks the bundleId, so a forged
+ * payload claiming another app's bundle fails there.
+ */
+export declare function peekAppleBundleId(jws: string): string | undefined;
+//# sourceMappingURL=apps.d.ts.map

package/dist/apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAAC;CAC9C;AAED,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAMtE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CA8DxE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUjE"}

package/dist/index.cjs

@@ -1173,23 +1173,95 @@ function sendZodError(res, err2, extra = {}) {
   );
 }
 
+// src/apps.ts
+function appName(app) {
+  return app.id || app.apple?.bundleId || app.google?.packageName || "default";
+}
+var registryCache = /* @__PURE__ */ new WeakMap();
+function getAppRegistry(config) {
+  const cached = registryCache.get(config);
+  if (cached) return cached;
+  const registry = buildAppRegistry(config);
+  registryCache.set(config, registry);
+  return registry;
+}
+function buildAppRegistry(config) {
+  const apps = [...config.apps ?? []];
+  if (config.apple || config.google) {
+    const id = config.defaultAppId || config.apple?.bundleId || config.google?.packageName || "default";
+    if (!apps.some((a) => a.id === id)) {
+      apps.unshift({ id, apple: config.apple, google: config.google });
+    }
+  }
+  const defaultApp = apps.find((a) => a.id === config.defaultAppId) ?? // No explicit default: fall back to the top-level config, which unshifted to
+  // the front above. Never silently pick an arbitrary app when several exist —
+  // that would validate one app's receipt against another's credentials.
+  (config.apple || config.google || apps.length === 1 ? apps[0] : void 0);
+  if (apps.length > 1) {
+    log.info("[onesub] Multi-app mode:", apps.map(appName).join(", "), "| default:", defaultApp ? appName(defaultApp) : "(none)");
+  }
+  function match(hint) {
+    if (hint.appId) {
+      const byId = apps.find(
+        (a) => a.id === hint.appId || a.apple?.bundleId === hint.appId || a.google?.packageName === hint.appId
+      );
+      if (byId) return byId;
+      log.warn("[onesub] Unknown appId:", hint.appId);
+      return void 0;
+    }
+    if (hint.bundleId) {
+      const byBundle = apps.find((a) => a.apple?.bundleId === hint.bundleId);
+      if (byBundle) return byBundle;
+      log.warn("[onesub] No app configured for bundleId:", hint.bundleId);
+      return void 0;
+    }
+    return defaultApp;
+  }
+  return {
+    apps,
+    defaultApp,
+    configFor(hint) {
+      const app = match(hint);
+      if (!app) {
+        return { ...config, apple: void 0, google: void 0 };
+      }
+      return { ...config, apple: app.apple, google: app.google };
+    }
+  };
+}
+function peekAppleBundleId(jws) {
+  try {
+    const payload = jws.split(".")[1];
+    if (!payload) return void 0;
+    const json = Buffer.from(payload, "base64url").toString("utf-8");
+    const claims = JSON.parse(json);
+    return typeof claims.bundleId === "string" ? claims.bundleId : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/routes/validate.ts
 var NO_SUB = { valid: false, subscription: null };
 var validateSchema = zod.z.object({
   platform: zod.z.enum(["apple", "google"]),
   receipt: zod.z.string().min(1).max(1e4),
   userId: zod.z.string().min(1).max(256),
-  productId: zod.z.string().min(1).max(256)
+  productId: zod.z.string().min(1).max(256),
+  /** Which app this receipt belongs to. Optional — see OneSubServerConfig.apps. */
+  appId: zod.z.string().min(1).max(256).optional()
 });
 function createValidateRouter(config, store) {
   const router = express.Router();
+  const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE, async (req, res) => {
     let platform;
     let receipt;
     let userId;
     let productId;
+    let appId;
     try {
-      ({ platform, receipt, userId, productId } = validateSchema.parse(req.body));
+      ({ platform, receipt, userId, productId, appId } = validateSchema.parse(req.body));
     } catch (err2) {
       if (err2 instanceof zod.z.ZodError) {
         sendZodError(res, err2, NO_SUB);
@@ -1199,18 +1271,22 @@ function createValidateRouter(config, store) {
     }
     try {
       let sub = null;
+      const appConfig = registry.configFor({
+        appId,
+        bundleId: platform === "apple" ? peekAppleBundleId(receipt) : void 0
+      });
       if (platform === "apple") {
-        if (!config.apple) {
+        if (!appConfig.apple) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_SUB);
           return;
         }
-        sub = await validateAppleReceipt(receipt, config.apple);
+        sub = await validateAppleReceipt(receipt, appConfig.apple);
       } else {
-        if (!config.google) {
+        if (!appConfig.google) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.GOOGLE_CONFIG_MISSING, "Google configuration not provided", NO_SUB);
           return;
         }
-        sub = await validateGoogleReceipt(receipt, productId, config.google);
+        sub = await validateGoogleReceipt(receipt, productId, appConfig.google);
       }
       if (!sub) {
         sendError(res, 422, shared.ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_SUB);
@@ -1234,8 +1310,8 @@ function createValidateRouter(config, store) {
       }
       sub.userId = userId;
       await store.save(sub);
-      if (platform === "google" && config.google) {
-        void acknowledgeGoogleSubscription(receipt, productId, config.google);
+      if (platform === "google" && appConfig.google) {
+        void acknowledgeGoogleSubscription(receipt, productId, appConfig.google);
       }
       const response = { valid: true, subscription: sub };
       res.status(200).json(response);
@@ -1359,11 +1435,12 @@ async function processAppleNotification(work, config, store, purchaseStore) {
     appAccountToken,
     inAppOwnershipType
   } = work.decoded;
+  const appleConfigForApp = getAppRegistry(config).configFor({ bundleId }).apple;
   const mapped = mapAppleNotificationStatus(notificationType, subtype);
   const finalStatus = mapped ?? status;
-  if (notificationType === "CONSUMPTION_REQUEST" && config.apple?.consumptionInfoProvider && transactionId && productId) {
-    const provider = config.apple.consumptionInfoProvider;
-    const appleConfig = config.apple;
+  if (notificationType === "CONSUMPTION_REQUEST" && appleConfigForApp?.consumptionInfoProvider && transactionId && productId) {
+    const provider = appleConfigForApp.consumptionInfoProvider;
+    const appleConfig = appleConfigForApp;
     void (async () => {
       try {
         const info = await provider({
@@ -1412,8 +1489,8 @@ async function processAppleNotification(work, config, store, purchaseStore) {
       expiresAt: expiresAt ?? existing.expiresAt
     };
     await store.save(updated);
-  } else if (config.apple?.issuerId && config.apple?.keyId && config.apple?.privateKey) {
-    const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, config.apple, {
+  } else if (appleConfigForApp?.issuerId && appleConfigForApp?.keyId && appleConfigForApp?.privateKey) {
+    const fresh = await fetchAppleSubscriptionStatus(originalTransactionId, appleConfigForApp, {
       sandbox: environment === "Sandbox"
     });
     if (fresh) {
@@ -1468,8 +1545,9 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     res.status(200).json({ received: true });
     return;
   }
-  if (config.apple?.bundleId && decoded.bundleId && decoded.bundleId !== config.apple.bundleId) {
-    log.warn("[onesub/webhook/apple] Bundle ID mismatch:", decoded.bundleId, "!==", config.apple.bundleId);
+  const notifiedApp = getAppRegistry(config).configFor({ bundleId: decoded.bundleId });
+  if (decoded.bundleId && !notifiedApp.apple) {
+    log.warn("[onesub/webhook/apple] No app configured for bundleId:", decoded.bundleId);
     sendError(res, 400, shared.ONESUB_ERROR_CODE.BUNDLE_ID_MISMATCH, "Bundle ID mismatch");
     return;
   }
@@ -1546,7 +1624,17 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function googleResolver(config) {
+  const registry = getAppRegistry(config);
+  const restricted = registry.apps.some((app) => !!app.google?.packageName);
+  return {
+    registry,
+    serves: (packageName) => !restricted || !!registry.configFor({ appId: packageName }).google,
+    googleFor: (packageName) => restricted ? registry.configFor({ appId: packageName }).google : registry.defaultApp?.google ?? config.google
+  };
+}
 async function processGoogleNotification(work, config, store, purchaseStore) {
+  const { googleFor } = googleResolver(config);
   if (work.kind === "voided") {
     const { voided } = work;
     if (voided.productType === 1) {
@@ -1569,8 +1657,9 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
     const { notificationType: notificationType2, purchaseToken: purchaseToken2, sku } = work.oneTimeProduct;
     if (notificationType2 === 1) {
       log.info("[onesub/webhook/google] oneTimeProduct PURCHASED:", sku);
-      if (config.google?.serviceAccountKey && config.google.packageName) {
-        void acknowledgeGoogleProduct(purchaseToken2, sku, config.google).catch(
+      const googleCfg = googleFor(work.oneTimeProduct.packageName);
+      if (googleCfg?.serviceAccountKey && googleCfg.packageName) {
+        void acknowledgeGoogleProduct(purchaseToken2, sku, googleCfg).catch(
           (err2) => log.warn(`[onesub/webhook/google] oneTimeProduct ack failed for SKU ${sku} \u2014 3-day auto-refund risk:`, err2)
         );
       }
@@ -1599,14 +1688,15 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
   } else {
     finalStatus = existing?.status ?? shared.SUBSCRIPTION_STATUS.ACTIVE;
   }
-  if (isGooglePriceChangeConfirmedNotification(notificationType) && config.google?.onPriceChangeConfirmed) {
-    const hook = config.google.onPriceChangeConfirmed;
+  const subGoogleCfg = googleFor(packageName);
+  if (isGooglePriceChangeConfirmedNotification(notificationType) && subGoogleCfg?.onPriceChangeConfirmed) {
+    const hook = subGoogleCfg.onPriceChangeConfirmed;
     void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err2) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err2));
   }
   if (existing) {
     let updated = { ...existing, status: finalStatus };
-    if (config.google?.serviceAccountKey) {
-      const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+    if (subGoogleCfg?.serviceAccountKey) {
+      const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, subGoogleCfg);
       if (fresh) {
         const preserveNotificationStatus = isGoogleGracePeriodNotification(notificationType) || isGoogleOnHoldNotification(notificationType);
         updated = {
@@ -1621,8 +1711,8 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
     }
     await store.save(updated);
   } else {
-    if (config.google?.serviceAccountKey) {
-      const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, config.google);
+    if (subGoogleCfg?.serviceAccountKey) {
+      const fresh = await validateGoogleReceipt(purchaseToken, subscriptionId, subGoogleCfg);
       if (fresh) {
         const boundAccountId = fresh.boundAccountId;
         delete fresh.boundAccountId;
@@ -1643,12 +1733,15 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
   }
 }
 async function handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue) {
-  if (config.google?.pushAudience) {
-    const authenticated = await verifyGooglePushToken(
-      req,
-      config.google.pushAudience,
-      config.google.pushServiceAccountEmail
-    );
+  const pushIdentities = getAppRegistry(config).apps.map((app) => app.google).filter((g) => !!g?.pushAudience);
+  if (pushIdentities.length > 0) {
+    let authenticated = false;
+    for (const google of pushIdentities) {
+      if (await verifyGooglePushToken(req, google.pushAudience, google.pushServiceAccountEmail)) {
+        authenticated = true;
+        break;
+      }
+    }
     if (!authenticated) {
       sendError(res, 401, shared.ONESUB_ERROR_CODE.UNAUTHORIZED, "Unauthorized");
       return;
@@ -1670,10 +1763,11 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     markedEventId = body.message.messageId;
   }
   let work;
+  const { serves: servesPackage } = googleResolver(config);
   const voided = decodeGoogleVoidedNotification(body);
   if (voided) {
-    if (config.google?.packageName && voided.packageName !== config.google.packageName) {
-      log.warn("[onesub/webhook/google] voided package name mismatch:", voided.packageName, "!==", config.google.packageName);
+    if (!servesPackage(voided.packageName)) {
+      log.warn("[onesub/webhook/google] voided package name not served:", voided.packageName);
       sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
       return;
     }
@@ -1681,8 +1775,8 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
   } else {
     const oneTimeProduct = decodeGoogleOneTimeProductNotification(body);
     if (oneTimeProduct) {
-      if (config.google?.packageName && oneTimeProduct.packageName !== config.google.packageName) {
-        log.warn("[onesub/webhook/google] oneTimeProduct package name mismatch:", oneTimeProduct.packageName, "!==", config.google.packageName);
+      if (!servesPackage(oneTimeProduct.packageName)) {
+        log.warn("[onesub/webhook/google] oneTimeProduct package name not served:", oneTimeProduct.packageName);
         sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
         return;
       }
@@ -1693,8 +1787,8 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
         res.status(200).json({ received: true });
         return;
       }
-      if (config.google?.packageName && notification.packageName !== config.google.packageName) {
-        log.warn("[onesub/webhook/google] Package name mismatch:", notification.packageName, "!==", config.google.packageName);
+      if (!servesPackage(notification.packageName)) {
+        log.warn("[onesub/webhook/google] Package name not served:", notification.packageName);
         sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
         return;
       }
@@ -1757,7 +1851,9 @@ var validatePurchaseSchema = zod.z.object({
   receipt: zod.z.string().min(1).max(1e4),
   userId: zod.z.string().min(1).max(256),
   productId: zod.z.string().min(1).max(256),
-  type: zod.z.enum([shared.PURCHASE_TYPE.CONSUMABLE, shared.PURCHASE_TYPE.NON_CONSUMABLE])
+  type: zod.z.enum([shared.PURCHASE_TYPE.CONSUMABLE, shared.PURCHASE_TYPE.NON_CONSUMABLE]),
+  /** Which app this receipt belongs to. Optional — see OneSubServerConfig.apps. */
+  appId: zod.z.string().min(1).max(256).optional()
 });
 var purchaseStatusQuerySchema = zod.z.object({
   userId: zod.z.string().min(1).max(256),
@@ -1765,6 +1861,7 @@ var purchaseStatusQuerySchema = zod.z.object({
 });
 function createPurchaseRouter(config, purchaseStore) {
   const router = express.Router();
+  const registry = getAppRegistry(config);
   router.post(shared.ROUTES.VALIDATE_PURCHASE, async (req, res) => {
     let body;
     try {
@@ -1776,7 +1873,11 @@ function createPurchaseRouter(config, purchaseStore) {
       }
       throw err2;
     }
-    const { platform, receipt, userId, productId, type } = body;
+    const { platform, receipt, userId, productId, type, appId } = body;
+    const appConfig = registry.configFor({
+      appId,
+      bundleId: platform === "apple" ? peekAppleBundleId(receipt) : void 0
+    });
     try {
       if (type === shared.PURCHASE_TYPE.NON_CONSUMABLE) {
         const owned = (await purchaseStore.getPurchasesByUserId(userId)).find(
@@ -1796,25 +1897,25 @@ function createPurchaseRouter(config, purchaseStore) {
       let purchasedAt = (/* @__PURE__ */ new Date()).toISOString();
       let boundAccountId = null;
       if (platform === "apple") {
-        if (!config.apple) {
+        if (!appConfig.apple) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_PURCHASE);
           return;
         }
-        const result = await validateAppleConsumableReceipt(receipt, config.apple, productId);
+        const result = await validateAppleConsumableReceipt(receipt, appConfig.apple, productId);
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
           boundAccountId = result.appAccountToken ?? null;
         }
       } else {
-        if (!config.google) {
+        if (!appConfig.google) {
           sendError(res, 500, shared.ONESUB_ERROR_CODE.GOOGLE_CONFIG_MISSING, "Google configuration not provided", NO_PURCHASE);
           return;
         }
         const result = await validateGoogleProductReceipt(
           receipt,
           productId,
-          config.google,
+          appConfig.google,
           type === shared.PURCHASE_TYPE.CONSUMABLE ? "consumable" : "non_consumable"
         );
         if (result) {
@@ -1880,11 +1981,11 @@ function createPurchaseRouter(config, purchaseStore) {
         quantity: 1
       };
       await purchaseStore.savePurchase(purchase);
-      if (platform === "google" && config.google) {
+      if (platform === "google" && appConfig.google) {
         if (type === shared.PURCHASE_TYPE.CONSUMABLE) {
-          void consumeGoogleProductReceipt(receipt, productId, config.google);
+          void consumeGoogleProductReceipt(receipt, productId, appConfig.google);
         } else {
-          void acknowledgeGoogleProduct(receipt, productId, config.google);
+          void acknowledgeGoogleProduct(receipt, productId, appConfig.google);
         }
       }
       const response = {