@onesub/server 0.24.0 → 0.26.0

package/dist/index.cjs

@@ -449,7 +449,7 @@ function outcomePasses(outcome, tag) {
     throw new Error(`[onesub/mock/${tag}] simulated upstream network error`);
   }
   if (outcome.kind === "valid" || outcome.kind === "sandbox") return true;
-  log.warn(`[onesub/mock/${tag}] receipt rejected`, { outcome: outcome.kind });
+  log.warn("[onesub/mock] receipt rejected", { provider: tag, outcome: outcome.kind });
   return false;
 }
 function deterministicTransactionId(prefix, receipt) {
@@ -624,22 +624,23 @@ async function validateAppleReceipt(receipt, config) {
   } catch (err2) {
     const preview = receipt.slice(0, 60);
     const parts = receipt.split(".").length;
-    log.warn(
-      "[onesub/apple] Failed to decode receipt as JWS:",
-      err2?.message ?? err2,
-      `| preview: "${preview}..." (len=${receipt.length}, parts=${parts})`
-    );
+    log.warn("[onesub/apple] Failed to decode receipt as JWS", {
+      receiptPreview: preview,
+      receiptLength: receipt.length,
+      jwsParts: parts,
+      err: err2
+    });
     return null;
   }
   if (!tx.originalTransactionId || !tx.productId || !tx.expiresDate) {
     return null;
   }
   if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    log.warn("[onesub/apple] Bundle ID mismatch", { bundleId: tx.bundleId, expected: config.bundleId });
     return null;
   }
   if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
-    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    log.warn("[onesub/apple] Sandbox receipt rejected in production", { environment: tx.environment });
     return null;
   }
   const status = deriveStatus(tx, null);
@@ -679,23 +680,25 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     const preview = signedTransaction.slice(0, 60);
     const parts = signedTransaction.split(".").length;
     const looksLikeJws = parts === 3;
-    log.warn(
-      "[onesub/apple] Failed to decode consumable JWS:",
-      err2?.message ?? err2,
-      `| receipt preview: "${preview}..." (len=${signedTransaction.length}, parts=${parts}, looksLikeJws=${looksLikeJws})`
-    );
+    log.warn("[onesub/apple] Failed to decode consumable JWS", {
+      receiptPreview: preview,
+      receiptLength: signedTransaction.length,
+      jwsParts: parts,
+      looksLikeJws,
+      err: err2
+    });
     return null;
   }
   if (!tx.bundleId || tx.bundleId !== config.bundleId) {
-    log.warn("[onesub/apple] Bundle ID mismatch:", tx.bundleId, "!==", config.bundleId);
+    log.warn("[onesub/apple] Bundle ID mismatch", { bundleId: tx.bundleId, expected: config.bundleId });
     return null;
   }
   if (tx.type !== "Consumable" && tx.type !== "Non-Consumable") {
-    log.warn("[onesub/apple] Invalid purchase type for product validation:", tx.type);
+    log.warn("[onesub/apple] Invalid purchase type for product validation", { type: tx.type });
     return null;
   }
   if (process.env["NODE_ENV"] === "production" && tx.environment !== "Production" && process.env["ONESUB_ALLOW_SANDBOX"] !== "true") {
-    log.warn("[onesub/apple] Sandbox receipt rejected in production:", tx.environment);
+    log.warn("[onesub/apple] Sandbox receipt rejected in production", { environment: tx.environment });
     return null;
   }
   if (!tx.productId) {
@@ -703,21 +706,28 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
     return null;
   }
   if (expectedProductId && tx.productId !== expectedProductId) {
-    log.warn("[onesub/apple] Product ID mismatch:", tx.productId, "!==", expectedProductId);
+    log.warn("[onesub/apple] Product ID mismatch", { productId: tx.productId, expected: expectedProductId });
     return null;
   }
   if (tx.revocationDate) {
-    log.warn("[onesub/apple] Purchase was revoked/refunded");
+    log.warn("[onesub/apple] Purchase was revoked/refunded", {
+      productId: tx.productId,
+      transactionId: tx.transactionId
+    });
     return null;
   }
   const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
   if (tx.purchaseDate && Date.now() - tx.purchaseDate > maxAgeMs) {
-    log.warn(`[onesub/apple] Consumable receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
+    log.warn("[onesub/apple] Consumable receipt too old", {
+      productId: tx.productId,
+      maxAgeHours: config.productReceiptMaxAgeHours ?? 72,
+      purchaseDate: new Date(tx.purchaseDate).toISOString()
+    });
     return null;
   }
   const transactionId = tx.transactionId ?? tx.originalTransactionId;
   if (!transactionId) {
-    log.warn("[onesub/apple] No transactionId in consumable transaction");
+    log.warn("[onesub/apple] No transactionId in consumable transaction", { productId: tx.productId });
     return null;
   }
   return {
@@ -796,7 +806,7 @@ async function sendAppleConsumptionResponse(transactionId, body, config, options
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot send consumption response \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot send consumption response \u2014 JWT mint failed", { transactionId, err: err2 });
     return;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -812,10 +822,14 @@ async function sendAppleConsumptionResponse(transactionId, body, config, options
     });
     if (!resp.ok) {
       const text = await resp.text();
-      log.warn(`[onesub/apple] Consumption response API error ${resp.status}: ${text}`);
+      log.warn("[onesub/apple] Consumption response API error", {
+        httpStatus: resp.status,
+        transactionId,
+        responseBody: text
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/apple] Consumption response network error:", err2);
+    log.warn("[onesub/apple] Consumption response network error", { transactionId, err: err2 });
   }
 }
 var APPLE_SUBSCRIPTION_STATUS_CODE = {
@@ -846,7 +860,10 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot fetch subscription status \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot fetch subscription status \u2014 JWT mint failed", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -858,24 +875,31 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     });
     if (!resp.ok) {
       const text = await resp.text();
-      log.warn(`[onesub/apple] Status API error ${resp.status}: ${text}`);
+      log.warn("[onesub/apple] Status API error", {
+        httpStatus: resp.status,
+        originalTransactionId,
+        responseBody: text
+      });
       return null;
     }
     body = await resp.json();
   } catch (err2) {
-    log.warn("[onesub/apple] Status API network error:", err2);
+    log.warn("[onesub/apple] Status API network error", { originalTransactionId, err: err2 });
     return null;
   }
   const entry = body.data?.flatMap((g) => g.lastTransactions ?? []).find((t) => t.originalTransactionId === originalTransactionId);
   if (!entry || entry.status == null || !entry.signedTransactionInfo) {
-    log.warn("[onesub/apple] Status API returned no matching transaction for", originalTransactionId);
+    log.warn("[onesub/apple] Status API returned no matching transaction", { originalTransactionId });
     return null;
   }
   let tx;
   try {
     tx = await decodeJws(entry.signedTransactionInfo, config.skipJwsVerification);
   } catch (err2) {
-    log.warn("[onesub/apple] Failed to decode signedTransactionInfo from Status API:", err2);
+    log.warn("[onesub/apple] Failed to decode signedTransactionInfo from Status API", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   let renewal = null;
@@ -886,7 +910,10 @@ async function fetchAppleSubscriptionStatus(originalTransactionId, config, optio
     }
   }
   if (!tx.productId || !tx.expiresDate) {
-    log.warn("[onesub/apple] Status API transaction missing productId or expiresDate");
+    log.warn("[onesub/apple] Status API transaction missing productId or expiresDate", {
+      originalTransactionId,
+      productId: tx.productId
+    });
     return null;
   }
   const status = mapAppleStatusCode(entry.status);
@@ -910,7 +937,10 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
   try {
     jwt = await makeAppleApiJwt(config);
   } catch (err2) {
-    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed:", err2);
+    log.warn("[onesub/apple] Cannot fetch transaction history \u2014 JWT mint failed", {
+      originalTransactionId,
+      err: err2
+    });
     return null;
   }
   const host = options?.sandbox ? "api.storekit-sandbox.itunes.apple.com" : "api.storekit.itunes.apple.com";
@@ -927,12 +957,16 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
       });
       if (!resp.ok) {
         const text = await resp.text();
-        log.warn(`[onesub/apple] Transaction History API error ${resp.status}: ${text}`);
+        log.warn("[onesub/apple] Transaction History API error", {
+          httpStatus: resp.status,
+          originalTransactionId,
+          responseBody: text
+        });
         return null;
       }
       page = await resp.json();
     } catch (err2) {
-      log.warn("[onesub/apple] Transaction History API network error:", err2);
+      log.warn("[onesub/apple] Transaction History API network error", { originalTransactionId, err: err2 });
       return null;
     }
     for (const signed of page.signedTransactions ?? []) {
@@ -957,14 +991,16 @@ async function fetchAppleTransactionHistory(originalTransactionId, config, optio
     if (!page.hasMore) break;
     if (!page.revision || page.revision === revision) {
       log.warn(
-        "[onesub/apple] Transaction History API returned hasMore without a new revision cursor \u2014 stopping pagination (partial history returned)"
+        "[onesub/apple] Transaction History API returned hasMore without a new revision cursor \u2014 stopping pagination (partial history returned)",
+        { originalTransactionId, pageCount }
       );
       break;
     }
     if (pageCount >= MAX_HISTORY_PAGES) {
-      log.warn(
-        `[onesub/apple] Transaction History pagination hit the ${MAX_HISTORY_PAGES}-page cap \u2014 stopping (partial history returned)`
-      );
+      log.warn("[onesub/apple] Transaction History pagination hit the page cap \u2014 stopping (partial history returned)", {
+        originalTransactionId,
+        maxPages: MAX_HISTORY_PAGES
+      });
       break;
     }
     revision = page.revision;
@@ -1114,7 +1150,7 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for subscription ack:", err2);
+    log.warn("[onesub/google] Could not get access token for subscription ack", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/subscriptions/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
@@ -1126,10 +1162,14 @@ async function acknowledgeGoogleSubscription(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Subscription acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Subscription acknowledge API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Subscription acknowledge network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Subscription acknowledge network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
@@ -1140,7 +1180,7 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for product ack:", err2);
+    log.warn("[onesub/google] Could not get access token for product ack", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:acknowledge`;
@@ -1152,10 +1192,14 @@ async function acknowledgeGoogleProduct(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Product acknowledge API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Product acknowledge API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Product acknowledge network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Product acknowledge network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
@@ -1165,7 +1209,7 @@ async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
   try {
     accessToken = await getCachedAccessToken(config.serviceAccountKey);
   } catch (err2) {
-    log.warn("[onesub/google] Could not get access token for consume:", err2);
+    log.warn("[onesub/google] Could not get access token for consume", { productId, err: err2 });
     return;
   }
   const url = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(config.packageName)}/purchases/products/${encodeURIComponent(productId)}/tokens/${encodeURIComponent(purchaseToken)}:consume`;
@@ -1176,10 +1220,14 @@ async function consumeGoogleProductReceipt(purchaseToken, productId, config) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      log.warn(`[onesub/google] Consume API error ${resp.status}: ${body} \u2014 auto-refund risk`);
+      log.warn("[onesub/google] Consume API error \u2014 auto-refund risk", {
+        httpStatus: resp.status,
+        productId,
+        responseBody: body
+      });
     }
   } catch (err2) {
-    log.warn("[onesub/google] Consume network error \u2014 auto-refund risk:", err2);
+    log.warn("[onesub/google] Consume network error \u2014 auto-refund risk", { productId, err: err2 });
   }
 }
 function deriveStatusV2(state) {
@@ -1205,11 +1253,11 @@ function deriveStatusV2(state) {
 async function validateGoogleReceipt(receipt, productId, config) {
   if (config.mockMode) return mockValidateGoogleSubscription(receipt, productId);
   if (!config.serviceAccountKey) {
-    log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API");
+    log.warn("[onesub/google] No serviceAccountKey provided \u2014 cannot call Play API", { productId });
     return null;
   }
   if (!config.packageName) {
-    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API");
+    log.warn("[onesub/google] No packageName provided \u2014 cannot call Play API", { productId });
     return null;
   }
   let purchase;
@@ -1217,25 +1265,27 @@ async function validateGoogleReceipt(receipt, productId, config) {
     const token = await getCachedAccessToken(config.serviceAccountKey);
     purchase = await fetchSubscriptionPurchaseV2(config.packageName, receipt, token);
   } catch (err2) {
-    log.error("[onesub/google] Receipt validation failed:", err2);
+    log.error("[onesub/google] Receipt validation failed", {
+      productId,
+      packageName: config.packageName,
+      err: err2
+    });
     return null;
   }
   const status = deriveStatusV2(purchase.subscriptionState);
   if (!status) {
-    log.warn(
-      "[onesub/google] Unrecognised or pending subscriptionState \u2014 rejecting:",
-      purchase.subscriptionState
-    );
+    log.warn("[onesub/google] Unrecognised or pending subscriptionState \u2014 rejecting", {
+      productId,
+      subscriptionState: purchase.subscriptionState
+    });
     return null;
   }
   const lineItem = purchase.lineItems?.find((item) => item.productId === productId);
   if (!lineItem) {
-    log.warn(
-      "[onesub/google] productId not found in subscription lineItems:",
+    log.warn("[onesub/google] productId not found in subscription lineItems", {
       productId,
-      "available:",
-      purchase.lineItems?.map((i) => i.productId).join(", ") ?? "(none)"
-    );
+      availableProductIds: purchase.lineItems?.map((i) => i.productId) ?? []
+    });
     return null;
   }
   const expiresAt = lineItem.expiryTime ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -1267,11 +1317,11 @@ async function validateGoogleReceipt(receipt, productId, config) {
 async function validateGoogleProductReceipt(purchaseToken, productId, config, type = "non_consumable") {
   if (config.mockMode) return mockValidateGoogleProduct(purchaseToken, productId);
   if (!config.serviceAccountKey) {
-    log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt");
+    log.warn("[onesub/google] No serviceAccountKey \u2014 cannot validate product receipt", { productId });
     return null;
   }
   if (!config.packageName) {
-    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt");
+    log.warn("[onesub/google] No packageName \u2014 cannot validate product receipt", { productId });
     return null;
   }
   let purchase;
@@ -1279,27 +1329,44 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
     const token = await getCachedAccessToken(config.serviceAccountKey);
     purchase = await fetchProductPurchase(config.packageName, productId, purchaseToken, token);
   } catch (err2) {
-    log.error("[onesub/google] Product receipt validation failed:", err2);
+    log.error("[onesub/google] Product receipt validation failed", {
+      productId,
+      packageName: config.packageName,
+      type,
+      err: err2
+    });
     return null;
   }
   if (purchase.purchaseState !== 0) {
-    log.warn("[onesub/google] Purchase not completed, state:", purchase.purchaseState);
+    log.warn("[onesub/google] Purchase not completed", {
+      productId,
+      purchaseState: purchase.purchaseState,
+      orderId: purchase.orderId
+    });
     return null;
   }
   if (type === "consumable" && purchase.consumptionState === 1) {
-    log.warn("[onesub/google] Consumable already consumed \u2014 possible replay attack");
+    log.warn("[onesub/google] Consumable already consumed \u2014 possible replay attack", {
+      productId,
+      orderId: purchase.orderId
+    });
     return null;
   }
   if (purchase.purchaseTimeMillis) {
     const purchaseTime = parseInt(purchase.purchaseTimeMillis, 10);
     const maxAgeMs = (config.productReceiptMaxAgeHours ?? 72) * 60 * 60 * 1e3;
     if (Date.now() - purchaseTime > maxAgeMs) {
-      log.warn(`[onesub/google] Product receipt too old (>${config.productReceiptMaxAgeHours ?? 72}h)`);
+      log.warn("[onesub/google] Product receipt too old", {
+        productId,
+        orderId: purchase.orderId,
+        maxAgeHours: config.productReceiptMaxAgeHours ?? 72,
+        purchaseDate: new Date(purchaseTime).toISOString()
+      });
       return null;
     }
   }
   if (!purchase.orderId) {
-    log.warn("[onesub/google] No orderId in product purchase");
+    log.warn("[onesub/google] No orderId in product purchase", { productId });
     return null;
   }
   return {
@@ -1356,7 +1423,11 @@ function decodeGoogleOneTimeProductNotification(payload) {
   if (!notification.oneTimeProductNotification) return null;
   const { notificationType, purchaseToken, sku } = notification.oneTimeProductNotification;
   if (notificationType !== 1 && notificationType !== 2) {
-    log.warn("[onesub/google] Unknown oneTimeProductNotification type:", notificationType);
+    log.warn("[onesub/google] Unknown oneTimeProductNotification type", {
+      notificationType,
+      productId: sku,
+      packageName: notification.packageName
+    });
     return null;
   }
   return { notificationType, purchaseToken, sku, packageName: notification.packageName };
@@ -1430,7 +1501,10 @@ function buildAppRegistry(config) {
   // that would validate one app's receipt against another's credentials.
   (config.apple || config.google || apps.length === 1 ? apps[0] : void 0);
   if (apps.length > 1) {
-    log.info("[onesub] Multi-app mode:", apps.map(appName).join(", "), "| default:", defaultApp ? appName(defaultApp) : "(none)");
+    log.info("[onesub] Multi-app mode", {
+      appIds: apps.map(appName),
+      defaultAppId: defaultApp ? appName(defaultApp) : null
+    });
   }
   function match(hint) {
     if (hint.appId) {
@@ -1438,13 +1512,13 @@ function buildAppRegistry(config) {
         (a) => a.id === hint.appId || a.apple?.bundleId === hint.appId || a.google?.packageName === hint.appId
       );
       if (byId) return byId;
-      log.warn("[onesub] Unknown appId:", hint.appId);
+      log.warn("[onesub] Unknown appId", { appId: hint.appId });
       return void 0;
     }
     if (hint.bundleId) {
       const byBundle = apps.find((a) => a.apple?.bundleId === hint.bundleId);
       if (byBundle) return byBundle;
-      log.warn("[onesub] No app configured for bundleId:", hint.bundleId);
+      log.warn("[onesub] No app configured for bundleId", { bundleId: hint.bundleId });
       return void 0;
     }
     return defaultApp;
@@ -1532,9 +1606,10 @@ function createValidateRouter(config, store) {
       delete sub.boundAccountId;
       const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
       if (bindingMismatch) {
-        log.warn(
-          `[onesub/validate] account binding mismatch for ${sub.originalTransactionId}: receipt token does not match userId ${userId}`
-        );
+        log.warn("[onesub/validate] account binding mismatch \u2014 receipt token does not match userId", {
+          originalTransactionId: sub.originalTransactionId,
+          userId
+        });
         sendError(
           res,
           409,
@@ -1547,7 +1622,7 @@ function createValidateRouter(config, store) {
       const isSandbox = sub.sandbox === true;
       delete sub.sandbox;
       if (isSandbox && getTestOverride(userId) === false) {
-        log.warn(`[onesub/validate] sandbox test override active for ${userId}: forcing not-entitled`);
+        log.warn("[onesub/validate] sandbox test override active \u2014 forcing not-entitled", { userId });
         sub.status = shared.SUBSCRIPTION_STATUS.EXPIRED;
         sub.willRenew = false;
       }
@@ -1559,7 +1634,7 @@ function createValidateRouter(config, store) {
       const response = { valid: true, subscription: sub };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/validate] Unexpected error:", err2);
+      log.error("[onesub/validate] Unexpected error", { userId, productId, platform, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error during receipt validation", NO_SUB);
     }
   });
@@ -1591,7 +1666,7 @@ function createStatusRouter(store) {
       const response = { active, subscription: sub };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/status] Store error:", err2);
+      log.error("[onesub/status] Store error", { userId, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", NO_SUB2);
     }
   });
@@ -1699,7 +1774,7 @@ async function processAppleNotification(work, config, store, purchaseStore) {
           });
         }
       } catch (err2) {
-        log.warn("[onesub/webhook/apple] consumptionInfoProvider failed:", err2);
+        log.warn("[onesub/webhook/apple] consumptionInfoProvider failed", { transactionId, err: err2 });
       }
     })();
   }
@@ -1712,7 +1787,7 @@ async function processAppleNotification(work, config, store, purchaseStore) {
     const lookupId = transactionId ?? originalTransactionId;
     const removed = await purchaseStore.deletePurchaseByTransactionId(lookupId);
     if (!removed) {
-      log.warn("[onesub/webhook/apple] IAP refund for unknown transaction:", lookupId);
+      log.warn("[onesub/webhook/apple] IAP refund for unknown transaction", { transactionId: lookupId });
     }
     return;
   }
@@ -1722,7 +1797,10 @@ async function processAppleNotification(work, config, store, purchaseStore) {
     const keepEntitlement = isSubscriptionRefund && config.refundPolicy === "until_expiry";
     const correctedUserId = appAccountToken && existing.userId === originalTransactionId ? appAccountToken : existing.userId;
     if (correctedUserId !== existing.userId) {
-      log.info("[onesub/webhook/apple] correcting userId from originalTransactionId to appAccountToken:", correctedUserId);
+      log.info("[onesub/webhook/apple] correcting userId from originalTransactionId to appAccountToken", {
+        originalTransactionId,
+        userId: correctedUserId
+      });
     }
     const updated = keepEntitlement ? { ...existing, userId: correctedUserId, willRenew: false } : {
       ...existing,
@@ -1740,20 +1818,22 @@ async function processAppleNotification(work, config, store, purchaseStore) {
       fresh.userId = appAccountToken ?? originalTransactionId;
       if (inAppOwnershipType === "FAMILY_SHARED") {
         const source = appAccountToken ? "appAccountToken" : "originalTransactionId (fallback)";
-        log.info(`[onesub/webhook/apple] FAMILY_SHARED \u2014 userId: ${fresh.userId} (source: ${source})`);
+        log.info("[onesub/webhook/apple] FAMILY_SHARED", {
+          originalTransactionId,
+          userId: fresh.userId,
+          userIdSource: source
+        });
       }
       await store.save(fresh);
     } else {
-      log.warn(
-        "[onesub/webhook/apple] Unknown transaction and Status API returned no record:",
+      log.warn("[onesub/webhook/apple] Unknown transaction and Status API returned no record", {
         originalTransactionId
-      );
+      });
     }
   } else {
-    log.warn(
-      "[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover):",
+    log.warn("[onesub/webhook/apple] Received notification for unknown transaction (no API creds to recover)", {
       originalTransactionId
-    );
+    });
   }
 }
 async function handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue) {
@@ -1769,7 +1849,7 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
       config.apple?.skipJwsVerification
     );
   } catch (err2) {
-    log.error("[onesub/webhook/apple] Failed to decode signedPayload:", err2);
+    log.error("[onesub/webhook/apple] Failed to decode signedPayload", { err: err2 });
     sendError(res, 400, shared.ONESUB_ERROR_CODE.INVALID_SIGNED_PAYLOAD, "Invalid signedPayload");
     return;
   }
@@ -1777,7 +1857,9 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   if (webhookEventStore && typeof payload.notificationUUID === "string") {
     const fresh = await webhookEventStore.markIfNew("apple", payload.notificationUUID);
     if (!fresh) {
-      log.info("[onesub/webhook/apple] dedupe: already processed", payload.notificationUUID);
+      log.info("[onesub/webhook/apple] dedupe: already processed", {
+        notificationUUID: payload.notificationUUID
+      });
       res.status(200).json({ received: true, deduped: true });
       return;
     }
@@ -1790,7 +1872,7 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
   }
   const notifiedApp = getAppRegistry(config).configFor({ bundleId: decoded.bundleId });
   if (decoded.bundleId && !notifiedApp.apple) {
-    log.warn("[onesub/webhook/apple] No app configured for bundleId:", decoded.bundleId);
+    log.warn("[onesub/webhook/apple] No app configured for bundleId", { bundleId: decoded.bundleId });
     sendError(res, 400, shared.ONESUB_ERROR_CODE.BUNDLE_ID_MISMATCH, "Bundle ID mismatch");
     return;
   }
@@ -1810,7 +1892,10 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
       });
       res.status(200).json({ received: true, queued: true });
     } catch (err2) {
-      log.error("[onesub/webhook/apple] Failed to enqueue webhook job:", err2);
+      log.error("[onesub/webhook/apple] Failed to enqueue webhook job", {
+        notificationUUID: payload.notificationUUID,
+        err: err2
+      });
       await unmarkWebhookEvent(webhookEventStore, "apple", markedEventId);
       sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
     }
@@ -1820,7 +1905,10 @@ async function handleAppleWebhook(req, res, config, store, purchaseStore, webhoo
     await processAppleNotification(work, config, store, purchaseStore);
     res.status(200).json({ received: true });
   } catch (err2) {
-    log.error("[onesub/webhook/apple] Store update error:", err2);
+    log.error("[onesub/webhook/apple] Store update error", {
+      notificationUUID: payload.notificationUUID,
+      err: err2
+    });
     await unmarkWebhookEvent(webhookEventStore, "apple", markedEventId);
     sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, "Failed to update subscription");
   }
@@ -1855,15 +1943,15 @@ async function verifyGooglePushToken(req, expectedAudience, expectedServiceAccou
 }
 var GOOGLE_FAILURE_MESSAGES = {
   voided: {
-    logPrefix: "[onesub/webhook/google] voided notification error:",
+    logPrefix: "[onesub/webhook/google] voided notification error",
     message: "Failed to process voided notification"
   },
   oneTimeProduct: {
-    logPrefix: "[onesub/webhook/google] oneTimeProduct error:",
+    logPrefix: "[onesub/webhook/google] oneTimeProduct error",
     message: "Failed to process oneTimeProduct notification"
   },
   subscription: {
-    logPrefix: "[onesub/webhook/google] Error handling notification:",
+    logPrefix: "[onesub/webhook/google] Error handling notification",
     message: "Failed to process notification"
   }
 };
@@ -1905,12 +1993,14 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
         const updated = config.refundPolicy === "until_expiry" ? { ...existing2, willRenew: false } : { ...existing2, status: shared.SUBSCRIPTION_STATUS.CANCELED };
         await store.save(updated);
       } else {
-        log.warn("[onesub/webhook/google] voided subscription for unknown purchaseToken:", voided.purchaseToken);
+        log.warn("[onesub/webhook/google] voided subscription for unknown purchaseToken", {
+          purchaseToken: voided.purchaseToken
+        });
       }
     } else {
       const removed = await purchaseStore.deletePurchaseByTransactionId(voided.orderId);
       if (!removed) {
-        log.warn("[onesub/webhook/google] voided IAP for unknown orderId:", voided.orderId);
+        log.warn("[onesub/webhook/google] voided IAP for unknown orderId", { orderId: voided.orderId });
       }
     }
     return;
@@ -1918,15 +2008,18 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
   if (work.kind === "oneTimeProduct") {
     const { notificationType: notificationType2, purchaseToken: purchaseToken2, sku } = work.oneTimeProduct;
     if (notificationType2 === 1) {
-      log.info("[onesub/webhook/google] oneTimeProduct PURCHASED:", sku);
+      log.info("[onesub/webhook/google] oneTimeProduct PURCHASED", { productId: sku });
       const googleCfg = googleFor(work.oneTimeProduct.packageName);
       if (googleCfg?.serviceAccountKey && googleCfg.packageName) {
         void acknowledgeGoogleProduct(purchaseToken2, sku, googleCfg).catch(
-          (err2) => log.warn(`[onesub/webhook/google] oneTimeProduct ack failed for SKU ${sku} \u2014 3-day auto-refund risk:`, err2)
+          (err2) => log.warn("[onesub/webhook/google] oneTimeProduct ack failed \u2014 3-day auto-refund risk", {
+            productId: sku,
+            err: err2
+          })
         );
       }
     } else {
-      log.info("[onesub/webhook/google] oneTimeProduct CANCELED (pre-completion):", sku);
+      log.info("[onesub/webhook/google] oneTimeProduct CANCELED (pre-completion)", { productId: sku });
     }
     return;
   }
@@ -1953,7 +2046,7 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
   const subGoogleCfg = googleFor(packageName);
   if (isGooglePriceChangeConfirmedNotification(notificationType) && subGoogleCfg?.onPriceChangeConfirmed) {
     const hook = subGoogleCfg.onPriceChangeConfirmed;
-    void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err2) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed:", err2));
+    void Promise.resolve().then(() => hook({ purchaseToken, subscriptionId, packageName })).catch((err2) => log.warn("[onesub/webhook/google] onPriceChangeConfirmed hook failed", { err: err2 }));
   }
   if (existing) {
     let updated = { ...existing, status: finalStatus };
@@ -1982,7 +2075,11 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
           const previous = await store.getByTransactionId(fresh.linkedPurchaseToken);
           fresh.userId = previous ? previous.userId : boundAccountId ?? purchaseToken;
           if (previous) {
-            log.info(`[onesub/webhook/google] inherited userId ${previous.userId} from linkedPurchaseToken ${fresh.linkedPurchaseToken} \u2192 new token ${purchaseToken}`);
+            log.info("[onesub/webhook/google] inherited userId from linkedPurchaseToken", {
+              userId: previous.userId,
+              linkedPurchaseToken: fresh.linkedPurchaseToken,
+              purchaseToken
+            });
           }
         } else {
           fresh.userId = boundAccountId ?? purchaseToken;
@@ -1990,7 +2087,9 @@ async function processGoogleNotification(work, config, store, purchaseStore) {
         await store.save(fresh);
       }
     } else {
-      log.warn("[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch:", purchaseToken);
+      log.warn("[onesub/webhook/google] Unknown purchase token and no serviceAccountKey to re-fetch", {
+        purchaseToken
+      });
     }
   }
 }
@@ -2018,7 +2117,9 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
   if (webhookEventStore && typeof body.message.messageId === "string") {
     const fresh = await webhookEventStore.markIfNew("google", body.message.messageId);
     if (!fresh) {
-      log.info("[onesub/webhook/google] dedupe: already processed", body.message.messageId);
+      log.info("[onesub/webhook/google] dedupe: already processed", {
+        messageId: body.message.messageId
+      });
       res.status(200).json({ received: true, deduped: true });
       return;
     }
@@ -2029,7 +2130,9 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
   const voided = decodeGoogleVoidedNotification(body);
   if (voided) {
     if (!servesPackage(voided.packageName)) {
-      log.warn("[onesub/webhook/google] voided package name not served:", voided.packageName);
+      log.warn("[onesub/webhook/google] voided package name not served", {
+        packageName: voided.packageName
+      });
       sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
       return;
     }
@@ -2038,7 +2141,9 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     const oneTimeProduct = decodeGoogleOneTimeProductNotification(body);
     if (oneTimeProduct) {
       if (!servesPackage(oneTimeProduct.packageName)) {
-        log.warn("[onesub/webhook/google] oneTimeProduct package name not served:", oneTimeProduct.packageName);
+        log.warn("[onesub/webhook/google] oneTimeProduct package name not served", {
+          packageName: oneTimeProduct.packageName
+        });
         sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
         return;
       }
@@ -2050,7 +2155,9 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
         return;
       }
       if (!servesPackage(notification.packageName)) {
-        log.warn("[onesub/webhook/google] Package name not served:", notification.packageName);
+        log.warn("[onesub/webhook/google] Package name not served", {
+          packageName: notification.packageName
+        });
         sendError(res, 400, shared.ONESUB_ERROR_CODE.PACKAGE_NAME_MISMATCH, "Package name mismatch");
         return;
       }
@@ -2068,7 +2175,11 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
       });
       res.status(200).json({ received: true, queued: true });
     } catch (err2) {
-      log.error("[onesub/webhook/google] Failed to enqueue webhook job:", err2);
+      log.error("[onesub/webhook/google] Failed to enqueue webhook job", {
+        kind: work.kind,
+        messageId: body.message.messageId,
+        err: err2
+      });
       await unmarkWebhookEvent(webhookEventStore, "google", markedEventId);
       sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, GOOGLE_FAILURE_MESSAGES[work.kind].message);
     }
@@ -2079,7 +2190,7 @@ async function handleGoogleWebhook(req, res, config, store, purchaseStore, webho
     res.status(200).json({ received: true });
   } catch (err2) {
     const { logPrefix, message } = GOOGLE_FAILURE_MESSAGES[work.kind];
-    log.error(logPrefix, err2);
+    log.error(logPrefix, { kind: work.kind, err: err2 });
     await unmarkWebhookEvent(webhookEventStore, "google", markedEventId);
     sendError(res, 500, shared.ONESUB_ERROR_CODE.WEBHOOK_PROCESSING_FAILED, message);
   }
@@ -2191,9 +2302,10 @@ function createPurchaseRouter(config, purchaseStore) {
       }
       const bindingMismatch = platform === "apple" ? boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase() : boundAccountId && boundAccountId !== userId;
       if (bindingMismatch) {
-        log.warn(
-          `[onesub/purchase] account binding mismatch for transaction ${transactionId}: token does not match userId ${userId}`
-        );
+        log.warn("[onesub/purchase] account binding mismatch \u2014 token does not match userId", {
+          transactionId,
+          userId
+        });
         sendError(
           res,
           409,
@@ -2210,9 +2322,11 @@ function createPurchaseRouter(config, purchaseStore) {
         if (existing.userId !== userId) {
           if (type === shared.PURCHASE_TYPE.NON_CONSUMABLE) {
             await purchaseStore.reassignPurchase(transactionId, userId);
-            log.info(
-              `[onesub/purchase] reassigned transaction ${transactionId} from ${existing.userId} to ${userId}`
-            );
+            log.info("[onesub/purchase] reassigned transaction to a new user", {
+              transactionId,
+              fromUserId: existing.userId,
+              userId
+            });
           } else {
             sendError(
               res,
@@ -2256,7 +2370,7 @@ function createPurchaseRouter(config, purchaseStore) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/purchase/validate] Unexpected error:", err2);
+      log.error("[onesub/purchase/validate] Unexpected error", { userId, productId, platform, type, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error during purchase validation", NO_PURCHASE);
     }
   });
@@ -2271,7 +2385,7 @@ function createPurchaseRouter(config, purchaseStore) {
       const response = { purchases };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/purchase/status] Store error:", err2);
+      log.error("[onesub/purchase/status] Store error", { userId, productId, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", { purchases: [] });
     }
   });
@@ -2336,7 +2450,7 @@ function createEntitlementRouter(config, store, purchaseStore) {
       const response = { id, ...status };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/entitlement] evaluation error:", err2);
+      log.error("[onesub/entitlement] evaluation error", { userId, entitlement: id, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
@@ -2360,7 +2474,7 @@ function createEntitlementRouter(config, store, purchaseStore) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/entitlements] evaluation error:", err2);
+      log.error("[onesub/entitlements] evaluation error", { userId, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error", { entitlements: {} });
     }
   });
@@ -2474,7 +2588,7 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/admin/subscriptions] list error:", err2);
+      log.error("[onesub/admin/subscriptions] list error", { err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
@@ -2494,7 +2608,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       }
       res.status(200).json(sub);
     } catch (err2) {
-      log.error("[onesub/admin/subscriptions/:transactionId] detail error:", err2);
+      log.error("[onesub/admin/subscriptions/:transactionId] detail error", {
+        transactionId: params.transactionId,
+        err: err2
+      });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
@@ -2527,7 +2644,7 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       };
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/admin/customers/:userId] error:", err2);
+      log.error("[onesub/admin/customers/:userId] error", { userId: params.userId, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
@@ -2557,7 +2674,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
       await store.save(fresh);
       res.status(200).json({ ok: true, subscription: fresh });
     } catch (err2) {
-      log.error("[onesub/admin/sync-apple] error:", err2);
+      log.error("[onesub/admin/sync-apple] error", {
+        originalTransactionId: params.originalTransactionId,
+        err: err2
+      });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Internal server error");
     }
   });
@@ -2572,9 +2692,10 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
     const body = parseOrSend(res, overrideBodySchema, req.body);
     if (!body) return;
     setTestOverride(params.userId, body.entitled);
-    log.warn(
-      `[onesub/admin] sandbox test override set for ${params.userId}: entitled=${body.entitled}`
-    );
+    log.warn("[onesub/admin] sandbox test override set", {
+      userId: params.userId,
+      entitled: body.entitled
+    });
     res.json({ ok: true, userId: params.userId, entitled: body.entitled, sandboxOnly: true });
   });
   router.delete(shared.ROUTES.ADMIN_TEST_OVERRIDE, (req, res) => {
@@ -2591,7 +2712,7 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
         const items = await webhookQueue.listDeadLetters();
         res.status(200).json({ items });
       } catch (err2) {
-        log.error("[onesub/admin/webhook-deadletters] error:", err2);
+        log.error("[onesub/admin/webhook-deadletters] error", { err: err2 });
         sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
@@ -2605,7 +2726,7 @@ function createAdminRouter(config, purchaseStore, store, webhookQueue) {
         await webhookQueue.replayDeadLetter(params.id);
         res.status(200).json({ ok: true });
       } catch (err2) {
-        log.error("[onesub/admin/webhook-replay] error:", err2);
+        log.error("[onesub/admin/webhook-replay] error", { deadLetterId: params.id, err: err2 });
         sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     });
@@ -2775,7 +2896,7 @@ function createMetricsRouter(config, store, purchaseStore) {
       );
       res.status(200).json(response);
     } catch (err2) {
-      log.error("[onesub/metrics/active] error:", err2);
+      log.error("[onesub/metrics/active] error", { err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
     }
   });
@@ -2842,7 +2963,7 @@ function createMetricsRouter(config, store, purchaseStore) {
         };
         res.status(200).json(response);
       } catch (err2) {
-        log.error(`[onesub/metrics/${name}] error:`, err2);
+        log.error("[onesub/metrics] error", { route: name, err: err2 });
         sendError(res, 500, shared.ONESUB_ERROR_CODE.STORE_ERROR, "Internal server error");
       }
     };
@@ -2914,7 +3035,7 @@ function createAppleOfferRouter(config) {
       );
       res.status(200).json(result);
     } catch (err2) {
-      log.error("[onesub/apple/offer] signing error:", err2);
+      log.error("[onesub/apple/offer] signing error", { productId: body.productId, err: err2 });
       sendError(res, 500, shared.ONESUB_ERROR_CODE.INTERNAL_ERROR, "Offer signing failed");
     }
   });
@@ -2986,7 +3107,7 @@ async function createPgPool(connectionString, label) {
   const Pool = pg.default?.Pool ?? pg.Pool;
   const pool = new Pool({ connectionString, max: 10 });
   pool.on("error", (err2) => {
-    log.error(`[onesub] ${label} pool error (idle client):`, err2);
+    log.error("[onesub] Postgres pool error (idle client)", { store: label, err: err2 });
   });
   return pool;
 }
@@ -3727,7 +3848,7 @@ var BullMQWebhookQueue = class {
         const { Queue } = await this.getBullMQ();
         const queue = new Queue(this.queueName, { connection: this.connection });
         queue.on?.("error", (err2) => {
-          log.error("[onesub] BullMQ queue error:", err2);
+          log.error("[onesub] BullMQ queue error", { err: err2 });
         });
         return queue;
       })();
@@ -3751,13 +3872,13 @@ var BullMQWebhookQueue = class {
           }
         );
         worker.on?.("error", (err2) => {
-          log.error("[onesub] BullMQ worker error:", err2);
+          log.error("[onesub] BullMQ worker error", { err: err2 });
         });
         return worker;
       })();
       this.workerPromise.catch((err2) => {
         this.workerStartupError = err2 instanceof Error ? err2 : new Error(String(err2));
-        log.error("[onesub] BullMQ worker failed to start:", err2);
+        log.error("[onesub] BullMQ worker failed to start", { err: err2 });
       });
     }
   }