@onesub/server 0.23.3 → 0.25.0

package/dist/index.js

@@ -163,21 +163,131 @@ at+qIxUCMG1mihDK1A3UT82NQz60imOlM27jbdoXt2QfyFMm+YhidDkLF1vLUagM
 -----END CERTIFICATE-----`;
 var APPLE_ROOT_CA_PEMS = [APPLE_ROOT_CA_G3_PEM];
 
+// src/log-format.ts
+var LOG_CONTINUATION = "\n    | ";
+var BARE_VALUE = /^[\w.:/@+-]+$/;
+var LINE_TERMINATORS = /\r\n|\r|\n|\u2028|\u2029/;
+var MAX_CAUSE_DEPTH = 2;
+var MAX_AGGREGATE_ERRORS = 3;
+function esc(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function escQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function renderValue(value) {
+  if (value === void 0) return void 0;
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "number":
+    case "boolean":
+      return String(value);
+    case "bigint":
+      return `${value}n`;
+    case "string":
+      return BARE_VALUE.test(value) ? value : `"${escQuoted(value)}"`;
+    case "object":
+      try {
+        return `"${escQuoted(JSON.stringify(value) ?? "null")}"`;
+      } catch {
+        return '"[unserialisable]"';
+      }
+    default:
+      try {
+        return `"${escQuoted(String(value))}"`;
+      } catch {
+        return '"[unrenderable]"';
+      }
+  }
+}
+function renderFields(fields) {
+  const pairs = [];
+  let err2;
+  for (const key of Object.keys(fields)) {
+    let value;
+    try {
+      value = fields[key];
+    } catch {
+      pairs.push(`${esc(key)}="[threw]"`);
+      continue;
+    }
+    if (key === "err") {
+      err2 = value;
+      continue;
+    }
+    const rendered = renderValue(value);
+    if (rendered !== void 0) pairs.push(`${esc(key)}=${rendered}`);
+  }
+  return { pairs, err: err2 };
+}
+function renderStack(stack) {
+  if (!stack) return "";
+  const lines = stack.split(LINE_TERMINATORS);
+  const firstFrame = lines.findIndex((line) => /^\s+at\s/.test(line));
+  const frames = firstFrame === -1 ? [] : lines.slice(firstFrame);
+  return frames.map((line) => LOG_CONTINUATION + esc(line.trim())).join("");
+}
+function renderError(value, depth = 0) {
+  if (!(value instanceof Error)) {
+    const rendered = renderValue(typeof value === "string" ? value : String(value));
+    return { pairs: [`err.msg=${rendered ?? '"[unrenderable]"'}`], lines: "" };
+  }
+  const pairs = [`err=${renderValue(value.name) ?? "Error"}`];
+  const message = renderValue(value.message);
+  if (message !== void 0) pairs.push(`err.msg=${message}`);
+  let lines = renderStack(value.stack);
+  if (depth < MAX_CAUSE_DEPTH && value.cause !== void 0 && value.cause !== null) {
+    const cause = renderError(value.cause, depth + 1);
+    lines += LOG_CONTINUATION + `cause: ${cause.pairs.join(" ")}` + cause.lines;
+  }
+  if (value instanceof AggregateError && Array.isArray(value.errors)) {
+    for (const inner of value.errors.slice(0, MAX_AGGREGATE_ERRORS)) {
+      const rendered = renderError(inner, MAX_CAUSE_DEPTH);
+      lines += LOG_CONTINUATION + `also: ${rendered.pairs.join(" ")}`;
+    }
+  }
+  return { pairs, lines };
+}
+function formatLogArgs(args) {
+  const words = [];
+  const pairs = [];
+  let errorLines = "";
+  for (const arg of args) {
+    if (typeof arg === "string") {
+      words.push(esc(arg));
+      continue;
+    }
+    if (arg instanceof Error) {
+      const rendered2 = renderError(arg);
+      pairs.push(...rendered2.pairs);
+      errorLines += rendered2.lines;
+      continue;
+    }
+    if (arg !== null && typeof arg === "object" && !Array.isArray(arg)) {
+      const { pairs: fieldPairs, err: err2 } = renderFields(arg);
+      pairs.push(...fieldPairs);
+      if (err2 !== void 0) {
+        const rendered2 = renderError(err2);
+        pairs.push(...rendered2.pairs);
+        errorLines += rendered2.lines;
+      }
+      continue;
+    }
+    const rendered = renderValue(arg);
+    if (rendered !== void 0) words.push(rendered);
+  }
+  return [words.join(" "), ...pairs].filter((part) => part !== "").join(" ") + errorLines;
+}
+
 // src/logger.ts
 var current = console;
 function setLogger(logger) {
   if (logger) current = logger;
 }
-function escapeLineBreaks(value) {
-  return value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-function scrub(args) {
-  return args.map((arg) => typeof arg === "string" ? escapeLineBreaks(arg) : arg);
-}
 var log = {
-  info: (...args) => current.info(...scrub(args)),
-  warn: (...args) => current.warn(...scrub(args)),
-  error: (...args) => current.error(...scrub(args))
+  info: (...args) => current.info(formatLogArgs(args)),
+  warn: (...args) => current.warn(formatLogArgs(args)),
+  error: (...args) => current.error(formatLogArgs(args))
 };
 
 // src/http.ts
@@ -507,22 +617,23 @@ async function validateAppleReceipt(receipt, config) {
   } catch (err2) {
     const preview = receipt.slice(0, 60);
     const parts = receipt.split(".").length;
-    log.warn(
-      "[onesub/apple] Failed to decode receipt as JWS:",
-      err2?.message ?? err2,
-      `| preview: "${preview}..." (len=${receipt.length}, parts=${parts})`
-    );
+    log.warn("[onesub/apple] Failed to decode receipt as JWS", {
+      receiptPreview: preview,
+      receiptLength: receipt.length,
+      jwsParts: parts,
+      err: err2
+    });
     return null;
   }
   if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
     return null;
   }
   if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    log.warn("[onesub/apple] Bundle ID mismatch", { bundleId: tx.bundleId, expected: config.bundleId });
     return null;
   }
   if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
-    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    log.warn("[onesub/apple] Sandbox receipt rejected in production", { environment: tx.environment });
     return null;
   }
   const status = deriveStatus(tx, null);
@@ -562,23 +673,25 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     const preview = signedTransaction.slice(0, 60);
     const parts = signedTransaction.split(".").length;
     const looksLikeJws = parts === 3;
-    log.warn(
-      "[onesub/apple] Failed to decode consumable JWS:",
-      err2?.message ?? err2,
-      `| receipt preview: "${preview}..." (len=${signedTransaction.length}, parts=${parts}, looksLikeJws=${looksLikeJws})`
-    );
+    log.warn("[onesub/apple] Failed to decode consumable JWS", {
+      receiptPreview: preview,
+      receiptLength: signedTransaction.length,
+      jwsParts: parts,
+      looksLikeJws,
+      err: err2
+    });
     return null;
   }
   if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    log.warn("[onesub/apple] Bundle ID mismatch", { bundleId: tx.bundleId, expected: config.bundleId });
     return null;
   }
   if (tx.type !== "Consumable" && tx.type !== "Non-Consumable") {
-    log.warn("[onesub/apple] Invalid purchase type for product validation:", tx.type);
+    log.warn("[onesub/apple] Invalid purchase type for product validation", { type: tx.type });
     return null;
   }
   if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
-    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    log.warn("[onesub/apple] Sandbox receipt rejected in production", { environment: tx.environment });
     return null;
   }
   if (!tx.productId) {
@@ -586,21 +699,28 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     return null;
   }
   if (expectedProductId && tx.productId !== expectedProductId) {
-    log.warn("[onesub/apple] Product ID mismatch:", tx.productId, "!==", expectedProductId);
+    log.warn("[onesub/apple] Product ID mismatch", { productId: tx.productId, expected: expectedProductId });
     return null;
   }
   if (tx.revocationDate) {
-    log.warn("[onesub/apple] Purchase was revoked/refunded");
+    log.warn("[onesub/apple] Purchase was revoked/refunded", {
+      productId: tx.productId,
+      transactionId: tx.transactionId
+    });
     return null;
   }
   const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
   if (tx.purchaseDate && Date.now() - tx.purchaseDate > maxAgeMs) {
-    log.warn(`[onesub/apple] Consumable receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
+    log.warn("[onesub/apple] Consumable receipt too old", {
+      productId: tx.productId,
+      maxAgeHours: config.productReceiptMaxAgeHours ?? 72,
+      purchaseDate: new Date(tx.purchaseDate).toISOString()
+    });
     return null;
   }
   const transactionId = tx.transactionId ?? tx.originalTransactionId;
   if (!transactionId) {
-    log.warn("[onesub/apple] No transactionId in consumable transaction");
+    log.warn("[onesub/apple] No transactionId in consumable transaction", { productId: tx.productId });
     return null;
   }
   return {
@@ -679,7 +799,7 @@ async function sendAppleConsumptionResponse(transactionId, body, config, options
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot send consumption response \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot send consumption response \u2014 JWT mint failed", { transactionId, err: err2 });
     return;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -695,10 +815,14 @@ async function sendAppleConsumptionResponse(transactionId, body, config, options
     });
     if (!resp.ok) {
       const text = await resp.text();
-      log.warn(`[onesub/apple] Consumption response API error ${resp.status}: ${text}`);
+      log.warn("[onesub/apple] Consumption response API error", {
+        httpStatus: resp.status,
+        transactionId,
+        responseBody: text
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/apple] Consumption response network error:", err2);
+    log.warn("[onesub/apple] Consumption response network error", { transactionId, err: err2 });
   }
 }
 var APPLE_SUBSCRIPTION_STATUS_CODE = {
@@ -729,7 +853,10 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot fetch subscription status \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot fetch subscription status \u2014 JWT mint failed", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -741,24 +868,31 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     });
     if (!resp.ok) {
       const text = await resp.text();
-      log.warn(`[onesub/apple] Status API error ${resp.status}: ${text}`);
+      log.warn("[onesub/apple] Status API error", {
+        httpStatus: resp.status,
+        originalTransactionId,
+        responseBody: text
+      });
       return null;
     }
     body = await resp.json();
   } catch (err2) {
-    log.warn("[onesub/apple] Status API network error:", err2);
+    log.warn("[onesub/apple] Status API network error", { originalTransactionId, err: err2 });
     return null;
   }
   const entry = body.data?.flatMap((g) => g.lastTransactions ?? []).find((t) => t.originalTransactionId === originalTransactionId);
   if (!entry || entry.status == null || !entry.signedTransactionInfo) {
-    log.warn("[onesub/apple] Status API returned no matching transaction for", originalTransactionId);
+    log.warn("[onesub/apple] Status API returned no matching transaction", { originalTransactionId });
     return null;
   }
   let tx;
   try {
     tx = await decodeJws(entry.signedTransactionInfo, config.skipJwsVerification);
   } catch (err2) {
-    log.warn("[onesub/apple] Failed to decode signedTransactionInfo from Status API:", err2);
+    log.warn("[onesub/apple] Failed to decode signedTransactionInfo from Status API", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   let renewal = null;
@@ -769,7 +903,10 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     }
   }
   if (!tx.productId || !tx.expiresDate) {
-    log.warn("[onesub/apple] Status API transaction missing productId or expiresDate");
+    log.warn("[onesub/apple] Status API transaction missing productId or expiresDate", {
+      originalTransactionId,
+      productId: tx.productId
+    });
     return null;
   }
   const status = mapAppleStatusCode(entry.status);
@@ -793,7 +930,10 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -810,12 +950,16 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
       });
       if (!resp.ok) {
         const text = await resp.text();
-        log.warn(`[onesub/apple] Transaction History API error ${resp.status}: ${text}`);
+        log.warn("[onesub/apple] Transaction History API error", {
+          httpStatus: resp.status,
+          originalTransactionId,
+          responseBody: text
+        });
         return null;
       }
       page = await resp.json();
     } catch (err2) {
-      log.warn("[onesub/apple] Transaction History API network error:", err2);
+      log.warn("[onesub/apple] Transaction History API network error", { originalTransactionId, err: err2 });
       return null;
     }
     for (const signed of page.signedTransactions ?? []) {
@@ -840,14 +984,16 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
     if (!page.hasMore) break;
     if (!page.revision || page.revision === revision) {
       log.warn(
-        "[onesub/apple] Transaction History API returned hasMore without a new revision cursor \u2014 stopping pagination (partial history returned)"
+        "[onesub/apple] Transaction History API returned hasMore without a new revision cursor \u2014 stopping pagination (partial history returned)",
+        { originalTransactionId, pageCount }
       );
       break;
     }
     if (pageCount >= MAX_HISTORY_PAGES) {
-      log.warn(
-        `[onesub/apple] Transaction History pagination hit the ${MAX_HISTORY_PAGES}-page cap \u2014 stopping (partial history returned)`
-      );
+      log.warn("[onesub/apple] Transaction History pagination hit the page cap \u2014 stopping (partial history returned)", {
+        originalTransactionId,
+        maxPages: MAX_HISTORY_PAGES
+      });
       break;
     }
     revision = page.revision;
@@ -997,7 +1143,7 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for subscription ack:", err2);
+    log.warn("[onesub/google] Could not get access token for subscription ack", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/subscriptions/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
@@ -1009,10 +1155,14 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Subscription acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Subscription acknowledge API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Subscription acknowledge network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Subscription acknowledge network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
@@ -1023,7 +1173,7 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for product ack:", err2);
+    log.warn("[onesub/google] Could not get access token for product ack", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
@@ -1035,10 +1185,14 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Product acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Product acknowledge API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Product acknowledge network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Product acknowledge network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
@@ -1048,7 +1202,7 @@ async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for consume:", err2);
+    log.warn("[onesub/google] Could not get access token for consume", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:consume`;
@@ -1059,10 +1213,14 @@ async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Consume API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Consume API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Consume network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Consume network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 function deriveStatusV2(state) {
@@ -1088,11 +1246,11 @@ function deriveStatusV2(state) {
 async function validateGoogleReceipt(receipt, productId, config) {
   if (config.mockMode) return mockValidateGoogleSubscription(receipt, productId);
   if (!config.serviceAccountKey) {
-    log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API");
+    log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API", { productId });
     return null;
   }
   if (!config.packageName) {
-    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API");
+    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API", { productId });
     return null;
   }
   let purchase;
@@ -1100,25 +1258,27 @@ async function validateGoogleReceipt(receipt, productId, config) {
     const token = await getCachedAccessToken(config.serviceAccountKey);
     purchase = await fetchSubscriptionPurchaseV2(config.packageName, receipt, token);
   } catch (err2) {
-    log.error("[onesub/google] Receipt validation failed:", err2);
+    log.error("[onesub/google] Receipt validation failed", {
+      productId,
+      packageName: config.packageName,
+      err: err2
+    });
     return null;
   }
   const status = deriveStatusV2(purchase.subscriptionState);
   if (!status) {
-    log.warn(
-      "[onesub/google] Unrecognised or pending subscriptionState \u2014 rejecting:",
-      purchase.subscriptionState
-    );
+    log.warn("[onesub/google] Unrecognised or pending subscriptionState \u2014 rejecting", {
+      productId,
+      subscriptionState: purchase.subscriptionState
+    });
     return null;
   }
   const lineItem = purchase.lineItems?.find((item) => item.productId === productId);
   if (!lineItem) {
-    log.warn(
-      "[onesub/google] productId not found in subscription lineItems:",
+    log.warn("[onesub/google] productId not found in subscription lineItems", {
       productId,
-      "available:",
-      purchase.lineItems?.map((i) => i.productId).join(", ") ?? "(none)"
-    );
+      availableProductIds: purchase.lineItems?.map((i) => i.productId) ?? []
+    });
     return null;
   }
   const expiresAt = lineItem.expiryTime ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -1150,11 +1310,11 @@ async function validateGoogleReceipt(receipt, productId, config) {
 async function validateGoogleProductReceipt(purchaseToken, productId, config, type = "non_consumable") {
   if (config.mockMode) return mockValidateGoogleProduct(purchaseToken, productId);
   if (!config.serviceAccountKey) {
-    log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt");
+    log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt", { productId });
     return null;
   }
   if (!config.packageName) {
-    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt");
+    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt", { productId });
     return null;
   }
   let purchase;
@@ -1162,27 +1322,44 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
     const token = await getCachedAccessToken(config.serviceAccountKey);
     purchase = await fetchProductPurchase(config.packageName, productId, purchaseToken, token);
   } catch (err2) {
-    log.error("[onesub/google] Product receipt validation failed:", err2);
+    log.error("[onesub/google] Product receipt validation failed", {
+      productId,
+      packageName: config.packageName,
+      type,
+      err: err2
+    });
     return null;
   }
   if (purchase.purchaseState !== 0) {
-    log.warn("[onesub/google] Purchase not completed, state:", purchase.purchaseState);
+    log.warn("[onesub/google] Purchase not completed", {
+      productId,
+      purchaseState: purchase.purchaseState,
+      orderId: purchase.orderId
+    });
     return null;
   }
   if (type === "consumable" && purchase.consumptionState === 1) {
-    log.warn("[onesub/google] Consumable already consumed \u2014 possible replay attack");
+    log.warn("[onesub/google] Consumable already consumed \u2014 possible replay attack", {
+      productId,
+      orderId: purchase.orderId
+    });
     return null;
   }
   if (purchase.purchaseTimeMillis) {
     const purchaseTime = parseInt(purchase.purchaseTimeMillis, 10);
     const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
     if (Date.now() - purchaseTime > maxAgeMs) {
-      log.warn(`[onesub/google] Product receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
+      log.warn("[onesub/google] Product receipt too old", {
+        productId,
+        orderId: purchase.orderId,
+        maxAgeHours: config.productReceiptMaxAgeHours ?? 72,
+        purchaseDate: new Date(purchaseTime).toISOString()
+      });
       return null;
     }
   }
   if (!purchase.orderId) {
-    log.warn("[onesub/google] No orderId in product purchase");
+    log.warn("[onesub/google] No orderId in product purchase", { productId });
     return null;
   }
   return {
@@ -1239,7 +1416,11 @@ function decodeGoogleOneTimeProductNotification(payload) {
   if (!notification.oneTimeProductNotification) return null;
   const { notificationType, purchaseToken, sku } = notification.oneTimeProductNotification;
   if (notificationType !== 1 && notificationType !== 2) {
-    log.warn("[onesub/google] Unknown oneTimeProductNotification type:", notificationType);
+    log.warn("[onesub/google] Unknown oneTimeProductNotification type", {
+      notificationType,
+      productId: sku,
+      packageName: notification.packageName
+    });
     return null;
   }
   return { notificationType, purchaseToken, sku, packageName: notification.packageName };