@onesub/server 0.18.3 → 0.20.0

package/dist/metrics-aggregate.d.ts

@@ -0,0 +1,82 @@
+import type { MetricsActiveResponse, MetricsBucket, MetricsGroupBy, PurchaseInfo, SubscriptionInfo } from '@onesub/shared';
+/**
+ * In-memory reduction of store records into the metrics responses.
+ *
+ * Split out of the route handlers for two reasons. It was duplicated four times
+ * — each range endpoint re-implemented the same window filter, the same
+ * product/platform tallies, and the same zero-filled daily bucketing — and none
+ * of it was reachable by a test without standing up an HTTP server. Both
+ * problems go away when the reduction is a pure function of the records.
+ *
+ * This is deliberately store-agnostic. Aggregating in the application process
+ * still costs one full read per query, which is the remaining scaling limit for
+ * large deployments; pushing the aggregation down into SQL requires per-store
+ * support and is separate work. What lives here is the semantics every store
+ * must agree on, so a pushdown implementation has something to be tested
+ * against.
+ */
+/** Minimum shape the tallies need. Both `SubscriptionInfo` and `PurchaseInfo` satisfy it. */
+interface Countable {
+    productId: string;
+    platform: string;
+}
+/** The count-shaped part of a metrics response; the route adds `from`/`to`. */
+export interface RangeAggregate {
+    total: number;
+    byProduct: Record<string, number>;
+    byPlatform: Record<string, number>;
+    /** Present only when `groupBy: 'day'` was requested. */
+    buckets?: MetricsBucket[];
+}
+export interface RangeAggregateOptions<T> {
+    /** Inclusive window bounds, ms-since-epoch. */
+    fromMs: number;
+    toMs: number;
+    groupBy: MetricsGroupBy;
+    /**
+     * ISO timestamp that places a record in the window and its daily bucket —
+     * `purchasedAt` for "started", `expiresAt` for "expired".
+     */
+    anchor: (record: T) => string;
+    /** Records this rejects are ignored entirely (status / type gates). */
+    include?: (record: T) => boolean;
+}
+/**
+ * UTC `YYYY-MM-DD` for an epoch-ms instant.
+ *
+ * UTC keeps bucket assignment deterministic regardless of server timezone:
+ * Postgres `updated_at` is UTC and `SubscriptionInfo` dates carry explicit zone
+ * offsets, so a local-time key would silently shift every boundary when the
+ * process moved between regions.
+ */
+export declare function utcDateKey(ms: number): string;
+/**
+ * Zero-filled daily series across `[fromMs, toMs]`, inclusive of both boundary
+ * days. Zero-filling is what lets a chart render a flat stretch as flat rather
+ * than as a gap.
+ */
+export declare function emptyDailyBuckets(fromMs: number, toMs: number): MetricsBucket[];
+/**
+ * Tally records whose anchor timestamp falls inside the window.
+ *
+ * Records outside the window, and records rejected by `include`, contribute
+ * nothing — not to `total`, not to the distributions, not to a bucket.
+ */
+export declare function aggregateRange<T extends Countable>(records: readonly T[], opts: RangeAggregateOptions<T>): RangeAggregate;
+/** A subscription counts as currently entitled: allowed status AND not yet expired. */
+export declare function isActiveSubscription(sub: SubscriptionInfo, nowMs: number): boolean;
+/** A subscription counts as ended: the store recorded it expired or canceled. */
+export declare function isEndedSubscription(sub: SubscriptionInfo): boolean;
+/** Non-consumables grant an ongoing right; consumables are a spent resource. */
+export declare function isNonConsumable(purchase: PurchaseInfo): boolean;
+/**
+ * Point-in-time entitlement snapshot.
+ *
+ * `byProduct` is subscriptions-only and `byProductPurchases` is
+ * non-consumables-only, so a dashboard can show "subscription mix" and
+ * "lifetime mix" as separate panels. `byPlatform` deliberately spans both —
+ * it answers "where are my paying users", which is not a per-kind question.
+ */
+export declare function aggregateActive(subs: readonly SubscriptionInfo[], purchases: readonly PurchaseInfo[], nowMs: number): MetricsActiveResponse;
+export {};
+//# sourceMappingURL=metrics-aggregate.d.ts.map

package/dist/metrics-aggregate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-aggregate.d.ts","sourceRoot":"","sources":["../src/metrics-aggregate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAGxB;;;;;;;;;;;;;;;GAeG;AAEH,6FAA6F;AAC7F,UAAU,SAAS;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,wDAAwD;IACxD,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC;CAClC;AAQD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAM7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAW/E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,SAAS,EAChD,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAC7B,cAAc,CA0BhB;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIlF;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAIlE;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,SAAS,EAAE,SAAS,YAAY,EAAE,EAClC,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAgCvB"}

package/dist/metrics-cache.d.ts

@@ -0,0 +1,20 @@
+import type { CacheAdapter } from './cache.js';
+export interface MetricsCache {
+    /**
+     * Return the value for `keyParts`, computing it via `produce` on a miss.
+     *
+     * `keyParts` must not contain a raw request timestamp — see
+     * `quantizeToWindow`.
+     */
+    resolve<T>(keyParts: readonly (string | number)[], produce: () => Promise<T>): Promise<T>;
+    /** Snap a millisecond timestamp onto the TTL grid, for use in a cache key. */
+    quantizeToWindow(ms: number): number;
+}
+/**
+ * @param ttlSeconds Freshness bound. `0` (or less) disables the cache.
+ * @param storage    Backing store. Defaults to storage private to this
+ *                   instance — see the note above on why this is not the shared
+ *                   adapter. Injectable for tests.
+ */
+export declare function createMetricsCache(ttlSeconds: number, storage?: CacheAdapter): MetricsCache;
+//# sourceMappingURL=metrics-cache.d.ts.map

package/dist/metrics-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-cache.d.ts","sourceRoot":"","sources":["../src/metrics-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAkC/C,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,YAAyC,GACjD,YAAY,CAgDd"}

package/dist/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE;QACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC1C,CAAC;CACH;AA6BD,eAAO,MAAM,cAAc,EAAE,UAigB5B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,KACpB,MAAM,OAAO,SAAS,EAAE,OAAO,EAAE,KAAK,OAAO,SAAS,EAAE,QAAQ,UAGzE"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE;QACV,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC1C,CAAC;CACH;AA6BD,eAAO,MAAM,cAAc,EAAE,UAojB5B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,KACpB,MAAM,OAAO,SAAS,EAAE,OAAO,EAAE,KAAK,OAAO,SAAS,EAAE,QAAQ,UAGzE"}

package/dist/providers/apple.d.ts

@@ -20,6 +20,8 @@ type AppleConfig = NonNullable<OneSubServerConfig['apple']>;
  * Exported for unit testing.
  */
 export declare function assertIssuerCanSign(cert: Pick<X509Certificate, 'ca'>, index: number): void;
+/** Test/diagnostic hook — drop every memoised chain verification. */
+export declare function clearAppleCertCache(): void;
 /**
  * Decode and verify a StoreKit 2 signed transaction JWS.
  *

package/dist/providers/apple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAA0B,MAAM,aAAa,CAAC;AACtE,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAsD5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAM1F;AAqDD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8DlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4FpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAAC,CA6CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC;AAeD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CA+E1C;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAoCpC"}
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAA0B,MAAM,aAAa,CAAC;AACtE,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAYxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAsD5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAM1F;AA2FD,qEAAqE;AACrE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CA4BpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiElC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4FpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAAC,CA6CR;AAmED,0DAA0D;AAC1D,iBAAS,0BAA0B,IAAI,IAAI,CAO1C;AAED,eAAO,MAAM,SAAS;;CAAiC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC;AAeD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAUD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,CA+E1C;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,wBAAwB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAoCpC"}

package/dist/providers/verified-key-cache.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Memo for "this certificate chain was verified, and here is the key it
+ * authorises" — the result of an expensive, purely local verification.
+ *
+ * Why this exists: Apple's StoreKit JWS verification re-parses the x5c chain,
+ * re-checks every issuer signature against a bundled Apple root, and re-imports
+ * the leaf public key on EVERY receipt and EVERY webhook. All of it is
+ * synchronous CPU work on the event loop, and Apple's leaf certificates are
+ * stable for weeks — so the same chain is verified over and over with the same
+ * outcome.
+ *
+ * Why this is NOT the pluggable `CacheAdapter`: that adapter exists to share
+ * *rate-limited network* results (Apple API JWTs, Google OAuth tokens) between
+ * cluster nodes, and it serialises values as JSON. An imported key is not
+ * JSON-serialisable — a Redis-backed adapter would silently round-trip it to
+ * `{}` — and what is being avoided here is local CPU, not a network call or a
+ * quota. A Redis round-trip would plausibly cost more than the verification it
+ * replaces. So this cache is deliberately process-local.
+ *
+ * Security invariants, all enforced below and covered by tests:
+ *
+ *   - The entry key covers EVERY input to the verification, including the
+ *     algorithm the key was imported for. A different chain, or the same chain
+ *     claiming a different `alg`, is a different entry — it can never reuse a
+ *     key that was authorised for something else.
+ *   - A failed verification is never stored. A rejected `produce` propagates and
+ *     leaves the cache untouched, so a bad chain is re-verified (and re-rejected)
+ *     every time rather than being remembered either way.
+ *   - No entry outlives the chain that produced it. `notAfter` (the earliest
+ *     expiry in the verified chain) is a hard ceiling on the entry's lifetime,
+ *     so an expired certificate can never be served from cache.
+ */
+/** What a successful verification yields: the key, and when it stops being valid. */
+export interface VerifiedKey<K> {
+    key: K;
+    /**
+     * Earliest `notAfter` across the verified chain, as ms-since-epoch. The cache
+     * entry is dropped at or before this instant, never after it.
+     */
+    notAfter: number;
+}
+export interface VerifiedKeyCacheOptions {
+    /**
+     * Upper bound on entries. Only successfully verified chains are stored, so in
+     * practice this holds a handful (Apple production + sandbox leaves, across a
+     * rotation). The cap is defence in depth against unbounded growth.
+     */
+    maxEntries?: number;
+    /** Upper bound on an entry's lifetime, independent of certificate expiry. */
+    maxTtlMs?: number;
+    /** Injectable clock. Tests drive expiry with it; production uses `Date.now`. */
+    now?: () => number;
+}
+export declare class VerifiedKeyCache<K> {
+    private readonly entries;
+    private readonly maxEntries;
+    private readonly maxTtlMs;
+    private readonly now;
+    constructor(opts?: VerifiedKeyCacheOptions);
+    /**
+     * Return the key for `parts`, verifying via `produce` only on a miss.
+     *
+     * `parts` must contain every input the verification depends on — for Apple
+     * that is the JWS `alg` plus the full x5c chain. Anything left out would let
+     * one input's result be served for a different input.
+     */
+    resolve(parts: readonly string[], produce: () => Promise<VerifiedKey<K>>): Promise<K>;
+    /** Entries currently held, including any not yet pruned. Test/diagnostic use. */
+    get size(): number;
+    /** Drop everything. Test/diagnostic use. */
+    clear(): void;
+    /** Make room: expired entries first, then the oldest insertions. */
+    private prune;
+}
+//# sourceMappingURL=verified-key-cache.d.ts.map

package/dist/providers/verified-key-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-key-cache.d.ts","sourceRoot":"","sources":["../../src/providers/verified-key-cache.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,qFAAqF;AACrF,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC;IACP;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAWD,qBAAa,gBAAgB,CAAC,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,uBAA4B;IAM9C;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA0B3F,iFAAiF;IACjF,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,4CAA4C;IAC5C,KAAK,IAAI,IAAI;IAIb,oEAAoE;IACpE,OAAO,CAAC,KAAK;CAWd"}

package/dist/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CAiTf"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAGV,kBAAkB,EAKnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQxD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,iBAAiB,EACxB,YAAY,CAAC,EAAE,YAAY,GAC1B,MAAM,GAAG,IAAI,CAmWf"}

package/dist/routes/entitlements.d.ts

@@ -2,7 +2,12 @@ import { Router } from 'express';
 import type { Entitlement, EntitlementStatus, OneSubServerConfig, PurchaseInfo, SubscriptionInfo } from '@onesub/shared';
 import type { PurchaseStore, SubscriptionStore } from '../store.js';
 /**
- * Evaluate a single entitlement for a user.
+ * Evaluate one entitlement against records the caller already holds.
+ *
+ * This is the whole decision, with no store access — so a caller evaluating N
+ * entitlements for one user reads that user's records ONCE and calls this N
+ * times, instead of paying 2N store round-trips. `evaluateEntitlement` below
+ * is the convenience wrapper for the single-entitlement case.
  *
  * A user is entitled when EITHER condition holds for any productId in
  * `entitlement.productIds`:
@@ -16,6 +21,18 @@ import type { PurchaseStore, SubscriptionStore } from '../store.js';
  * Subscription is preferred over purchase when both match (subs carry an
  * expiry; non-consumables are forever) so the source field skews toward the
  * more "interesting" signal for ops/analytics.
+ *
+ * `now` is injected so a batch evaluation scores every entitlement against one
+ * consistent instant rather than drifting across awaits.
+ */
+export declare function evaluateEntitlementFrom(subs: readonly SubscriptionInfo[], purchases: readonly PurchaseInfo[], entitlement: Entitlement, now?: number): EntitlementStatus;
+/**
+ * Evaluate a single entitlement for a user, reading the records it needs.
+ *
+ * Thin wrapper over `evaluateEntitlementFrom` — see there for the entitlement
+ * rules. Evaluating several entitlements for the same user through this
+ * function costs 2 store reads each; prefer reading once and calling
+ * `evaluateEntitlementFrom` directly in that case.
  */
 export declare function evaluateEntitlement(userId: string, entitlement: Entitlement, store: SubscriptionStore, purchaseStore: PurchaseStore): Promise<EntitlementStatus>;
 export declare function createEntitlementRouter(config: OneSubServerConfig, store: SubscriptionStore, purchaseStore: PurchaseStore): Router | null;

package/dist/routes/entitlements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/routes/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EACV,WAAW,EAEX,iBAAiB,EAGjB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAKD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,IAAI,CA0Ef;AAID,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/routes/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EACV,WAAW,EAEX,iBAAiB,EAGjB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,SAAS,EAAE,SAAS,YAAY,EAAE,EAClC,WAAW,EAAE,WAAW,EACxB,GAAG,GAAE,MAAmB,GACvB,iBAAiB,CA+BnB;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAKD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,IAAI,CAgFf;AAID,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/routes/metrics.d.ts

@@ -1,6 +1,8 @@
 import { Router } from 'express';
 import type { OneSubServerConfig, PurchaseInfo, SubscriptionInfo } from '@onesub/shared';
 import type { PurchaseStore, SubscriptionStore } from '../store.js';
+/** Freshness bound when the host does not configure one. */
+export declare const DEFAULT_METRICS_CACHE_TTL_SECONDS = 30;
 /**
  * Read-only aggregate metrics endpoints — gated behind `config.adminSecret`.
  * Returns count-based metrics only (active count, started count, expired count).
@@ -9,9 +11,12 @@ import type { PurchaseStore, SubscriptionStore } from '../store.js';
  * server doesn't currently track; deferred to a follow-up release that adds
  * `config.products: { 'pro_monthly': { price: 9.99, currency: 'USD' } }`.
  *
- * Aggregation strategy: pulls every record via `store.listAll()` and reduces
- * in memory. Fine up to ~100k records; large deployments should optimise the
- * Postgres path with SQL aggregates (separate PR).
+ * Aggregation strategy: reads every record via `store.listAll()` and reduces in
+ * memory (see `metrics-aggregate.ts` for the reduction, which is where the
+ * semantics are tested). That is one full read per computed response, so
+ * responses are cached for `config.metricsCacheTtlSeconds` to bound how often
+ * it happens — see `metrics-cache.ts`. Removing the per-response scan entirely
+ * needs SQL-side aggregation, which is per-store work and still pending.
  */
 export declare function createMetricsRouter(config: OneSubServerConfig, store: SubscriptionStore, purchaseStore: PurchaseStore): Router | null;
 export type { PurchaseInfo, SubscriptionInfo };

package/dist/routes/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/routes/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAIV,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAOpE;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,IAAI,CA0Sf;AAED,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/routes/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAIV,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAepE,4DAA4D;AAC5D,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,IAAI,CAuKf;AAED,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/routes/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/routes/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAA2B,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAElF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAkBrD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,GACvB,MAAM,CAgGR"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/routes/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAA2B,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAElF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAmBrD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,GACvB,MAAM,CA6GR"}

package/dist/store.d.ts

@@ -54,8 +54,9 @@ export interface SubscriptionStore {
      * see all of a user's active subscriptions to decide whether any of them
      * grants the requested entitlement.
      *
-     * Implementations: in-memory currently coalesces by userId so this returns
-     * at most one row; Postgres returns the full history.
+     * All three built-in implementations return the user's full set, one record
+     * per `originalTransactionId`. "Most-recent-first" is last-written-first for
+     * the in-memory store and `updated_at DESC` for Postgres/Redis.
      */
     getAllByUserId(userId: string): Promise<SubscriptionInfo[]>;
 }

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEnG,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IAIjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEjE,IAAI,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK7D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAI3D,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAIlE,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAItC,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAwB3E;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACvE,+EAA+E;IAC/E,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,4EAA4E;IAC5E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;;;;;OAOG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAExD,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI7D,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAItE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMjE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB5E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlC,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAW7E"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEnG,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnE;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrE;;;;;;;;;OASG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IAIjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEjE,IAAI,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK7D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAI3D,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAIlE,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAItC,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAwB3E;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9D,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACvE,+EAA+E;IAC/E,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,4EAA4E;IAC5E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;;;;;OAOG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAExD,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI7D,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAItE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMjE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB5E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnE,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlC,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAW7E"}

package/dist/test-overrides.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Sandbox-only entitlement overrides for manual testing.
+ *
+ * Why this exists: Apple provides no way to cancel a sandbox subscription that
+ * was bought with a real Apple Account through TestFlight. "Clear Purchase
+ * History" in App Store Connect only covers sandbox *tester* accounts, and the
+ * store expires an accelerated subscription on its own schedule. A developer
+ * who subscribes once to check the paywall is therefore stuck as an entitled
+ * user, and cannot re-run the purchase flow — the exact situation that hid a
+ * paywall entry point from App Review (PenguinRun 2.0.6, Guideline 2.1(b)).
+ *
+ * Deleting server records does not help: `/onesub/validate` re-derives
+ * entitlement from Apple on every call, so any local edit is overwritten the
+ * next time the app launches. The override has to sit in front of that verdict.
+ *
+ * Safety model — an override can never affect a paying customer:
+ *   - it is keyed by userId, so it touches exactly one account;
+ *   - it is honoured ONLY when the receipt Apple just validated came from
+ *     Sandbox (`SubscriptionInfo.sandbox`), so a Production receipt ignores it
+ *     even if an override for that userId exists;
+ *   - it lives behind the admin secret, like every other admin route;
+ *   - it is process-local and non-persistent, so it cannot outlive a deploy or
+ *     silently linger in a database. Multi-instance deployments must set it on
+ *     the instance under test (or run one instance) — deliberate, so this stays
+ *     a debugging aid rather than a product feature.
+ */
+export declare function setTestOverride(userId: string, entitled: boolean): void;
+export declare function clearTestOverride(userId: string): boolean;
+export declare function getTestOverride(userId: string): boolean | undefined;
+export declare function listTestOverrides(): Array<{
+    userId: string;
+    entitled: boolean;
+}>;
+/** Test seam — resets state between suites. */
+export declare function clearAllTestOverrides(): void;
+//# sourceMappingURL=test-overrides.d.ts.map

package/dist/test-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-overrides.d.ts","sourceRoot":"","sources":["../src/test-overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEnE;AAED,wBAAgB,iBAAiB,IAAI,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAEhF;AAED,+CAA+C;AAC/C,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesub/server",
-  "version": "0.18.3",
+  "version": "0.20.0",
   "description": "Server-side receipt validation middleware for react-native-iap. Apple StoreKit 2 + Google Play Billing. One line.",
   "main": "dist/index.cjs",
   "module": "dist/index.js",
@@ -55,7 +55,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@onesub/shared": "0.13.0",
+    "@onesub/shared": "0.15.0",
     "jose": "^6.2.3",
     "zod": "^4.4.3"
   },