@onesub/server 0.7.2 → 0.8.0

package/dist/__tests__/webhook-refund.test.js

@@ -0,0 +1,313 @@
+/**
+ * Refund / voided-purchase webhook tests.
+ *
+ * Covers:
+ *   - Apple webhook REFUND for IAP (Consumable / Non-Consumable) →
+ *     PurchaseStore row removed, SubscriptionStore untouched.
+ *   - Apple webhook REFUND for subscriptions still updates SubscriptionStore.
+ *   - Google voidedPurchaseNotification productType=2 → IAP row removed.
+ *   - Google voidedPurchaseNotification productType=1 → subscription canceled.
+ *   - decodeGoogleVoidedNotification recognises voided payload, ignores other kinds.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import express from 'express';
+import { SUBSCRIPTION_STATUS } from '@onesub/shared';
+import { createWebhookRouter } from '../routes/webhook.js';
+import { InMemorySubscriptionStore, InMemoryPurchaseStore } from '../store.js';
+import { decodeGoogleVoidedNotification } from '../providers/google.js';
+// ── helpers ─────────────────────────────────────────────────────────────────
+function makeJws(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256' })).toString('base64url');
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${header}.${body}.fakesig`;
+}
+function appleConfig() {
+    return {
+        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
+        database: { url: '' },
+    };
+}
+function googleConfig() {
+    return {
+        google: { packageName: 'com.example.app' },
+        database: { url: '' },
+    };
+}
+function buildServer(config, store, purchaseStore) {
+    const app = express();
+    app.use(express.json());
+    app.use(createWebhookRouter(config, store, purchaseStore));
+    return {
+        async request(path, body) {
+            // Use Node http directly for a lightweight test server.
+            const server = app.listen(0);
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            try {
+                const resp = await fetch(`http://127.0.0.1:${port}${path}`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(body),
+                });
+                const text = await resp.text();
+                let parsed = text;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch { /* keep as text */ }
+                return { status: resp.status, body: parsed };
+            }
+            finally {
+                await new Promise((resolve) => server.close(() => resolve()));
+            }
+        },
+    };
+}
+const samplePurchase = (overrides) => ({
+    userId: 'user_1',
+    productId: 'credits_100',
+    platform: 'apple',
+    type: 'consumable',
+    transactionId: 'txn_apple_consumable_001',
+    purchasedAt: '2026-01-01T00:00:00.000Z',
+    quantity: 1,
+    ...overrides,
+});
+const sampleSub = (overrides) => ({
+    userId: 'user_sub',
+    productId: 'pro_monthly',
+    platform: 'google',
+    status: 'active',
+    expiresAt: '2027-01-01T00:00:00.000Z',
+    originalTransactionId: 'token_google_sub_xyz',
+    purchasedAt: '2026-01-01T00:00:00.000Z',
+    willRenew: true,
+    ...overrides,
+});
+// ── Apple webhook: IAP REFUND ───────────────────────────────────────────────
+describe('Apple webhook — IAP REFUND', () => {
+    let store;
+    let purchaseStore;
+    let server;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+        purchaseStore = new InMemoryPurchaseStore();
+        server = buildServer(appleConfig(), store, purchaseStore);
+    });
+    it('removes the consumable purchase row on REFUND', async () => {
+        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'txn_consumable_a' }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Consumable',
+            productId: 'credits_100',
+            transactionId: 'txn_consumable_a',
+            originalTransactionId: 'orig_consumable_a',
+            purchaseDate: Date.now(),
+        });
+        const signedRenewalInfo = makeJws({});
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('txn_consumable_a')).toBeNull();
+    });
+    it('removes the non-consumable purchase row on REVOKE', async () => {
+        await purchaseStore.savePurchase(samplePurchase({
+            transactionId: 'txn_nc_a',
+            type: 'non_consumable',
+            productId: 'premium_unlock',
+        }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Non-Consumable',
+            productId: 'premium_unlock',
+            transactionId: 'txn_nc_a',
+            originalTransactionId: 'txn_nc_a',
+            purchaseDate: Date.now(),
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REVOKE',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('txn_nc_a')).toBeNull();
+    });
+    it('does not touch the SubscriptionStore on IAP REFUND', async () => {
+        await store.save(sampleSub({ originalTransactionId: 'orig_sub_untouched' }));
+        await purchaseStore.savePurchase(samplePurchase({ transactionId: 'iap_only' }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Consumable',
+            productId: 'credits_100',
+            transactionId: 'iap_only',
+            originalTransactionId: 'iap_only',
+            purchaseDate: Date.now(),
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(await store.getByTransactionId('orig_sub_untouched')).not.toBeNull();
+    });
+    it('still routes subscription REFUND through the SubscriptionStore', async () => {
+        await store.save(sampleSub({
+            platform: 'apple',
+            originalTransactionId: 'orig_sub_apple',
+            status: 'active',
+        }));
+        const signedTransactionInfo = makeJws({
+            bundleId: 'com.example.app',
+            type: 'Auto-Renewable Subscription',
+            productId: 'pro_monthly',
+            transactionId: 'tx_sub_apple_1',
+            originalTransactionId: 'orig_sub_apple',
+            purchaseDate: Date.now(),
+            expiresDate: Date.now() + 86400000,
+        });
+        const signedPayload = makeJws({
+            notificationType: 'REFUND',
+            data: { signedTransactionInfo, signedRenewalInfo: makeJws({}) },
+        });
+        const resp = await server.request('/onesub/webhook/apple', { signedPayload });
+        expect(resp.status).toBe(200);
+        const updated = await store.getByTransactionId('orig_sub_apple');
+        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
+    });
+});
+// ── Google webhook: voidedPurchaseNotification ──────────────────────────────
+function makeVoidedPushBody(notification) {
+    const json = JSON.stringify({
+        version: '1.0',
+        eventTimeMillis: String(Date.now()),
+        ...notification,
+    });
+    return {
+        message: {
+            data: Buffer.from(json, 'utf-8').toString('base64'),
+            messageId: '1',
+        },
+        subscription: 'projects/x/subscriptions/y',
+    };
+}
+describe('Google webhook — voidedPurchaseNotification', () => {
+    let store;
+    let purchaseStore;
+    let server;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+        purchaseStore = new InMemoryPurchaseStore();
+        server = buildServer(googleConfig(), store, purchaseStore);
+    });
+    it('removes IAP row when productType=2 (one-time product refund)', async () => {
+        await purchaseStore.savePurchase(samplePurchase({
+            platform: 'google',
+            transactionId: 'GPA.refunded_order',
+        }));
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok_x',
+                orderId: 'GPA.refunded_order',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+        expect(await purchaseStore.getPurchaseByTransactionId('GPA.refunded_order')).toBeNull();
+    });
+    it('cancels subscription when productType=1', async () => {
+        await store.save(sampleSub({ originalTransactionId: 'tok_sub' }));
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok_sub',
+                orderId: 'GPA.sub_order',
+                productType: 1,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+        const updated = await store.getByTransactionId('tok_sub');
+        expect(updated?.status).toBe(SUBSCRIPTION_STATUS.CANCELED);
+    });
+    it('rejects voided notification when packageName mismatches', async () => {
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.attacker.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok',
+                orderId: 'GPA.x',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(400);
+    });
+    it('acknowledges with 200 even when the orderId is unknown', async () => {
+        // Idempotent ack semantics — Google retries until 2xx; we don't want loops
+        // when the row was already removed.
+        const resp = await server.request('/onesub/webhook/google', makeVoidedPushBody({
+            packageName: 'com.example.app',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok',
+                orderId: 'GPA.unknown',
+                productType: 2,
+                refundType: 1,
+            },
+        }));
+        expect(resp.status).toBe(200);
+    });
+});
+// ── decodeGoogleVoidedNotification unit ─────────────────────────────────────
+describe('decodeGoogleVoidedNotification', () => {
+    it('returns null for subscription notifications', () => {
+        const json = JSON.stringify({
+            packageName: 'com.example.app',
+            eventTimeMillis: '0',
+            subscriptionNotification: {
+                version: '1.0',
+                notificationType: 4,
+                purchaseToken: 't',
+                subscriptionId: 'p',
+            },
+        });
+        const result = decodeGoogleVoidedNotification({
+            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
+            subscription: 's',
+        });
+        expect(result).toBeNull();
+    });
+    it('extracts voided payload fields', () => {
+        const json = JSON.stringify({
+            packageName: 'com.example.app',
+            eventTimeMillis: '0',
+            voidedPurchaseNotification: {
+                purchaseToken: 'tok123',
+                orderId: 'GPA.xyz',
+                productType: 2,
+                refundType: 1,
+            },
+        });
+        const result = decodeGoogleVoidedNotification({
+            message: { data: Buffer.from(json).toString('base64'), messageId: '1' },
+            subscription: 's',
+        });
+        expect(result).toEqual({
+            purchaseToken: 'tok123',
+            orderId: 'GPA.xyz',
+            productType: 2,
+            refundType: 1,
+            packageName: 'com.example.app',
+        });
+    });
+    it('returns null for malformed base64', () => {
+        expect(decodeGoogleVoidedNotification({
+            message: { data: '!!!not-base64!!!', messageId: '1' },
+            subscription: 's',
+        })).toBeNull();
+    });
+});
+//# sourceMappingURL=webhook-refund.test.js.map

package/dist/__tests__/webhook-refund.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-refund.test.js","sourceRoot":"","sources":["../../src/__tests__/webhook-refund.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,+EAA+E;AAE/E,SAAS,OAAO,CAAC,OAAgC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC1C,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC;AAMD,SAAS,WAAW,CAClB,MAA0B,EAC1B,KAAgC,EAChC,aAAoC;IAEpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YACtB,wDAAwD;YACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC/C,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,SAAiC,EAAgB,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,0BAA0B;IACzC,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,CAAC;IACX,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,SAAqC,EAAoB,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,0BAA0B;IACrC,qBAAqB,EAAE,sBAAsB;IAC7C,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,IAAI;IACf,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAExF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,kBAAkB;YACjC,qBAAqB,EAAE,mBAAmB;YAC1C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAEhF,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,UAAU;YACzB,qBAAqB,EAAE,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,OAAO;YACjB,qBAAqB,EAAE,gBAAgB;YACvC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC,CAAC;QAEJ,MAAM,qBAAqB,GAAG,OAAO,CAAC;YACpC,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,gBAAgB;YAC/B,qBAAqB,EAAE,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC;YAC5B,gBAAgB,EAAE,QAAQ;YAC1B,IAAI,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;SAChE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,YAQ3B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,SAAS,EAAE,GAAG;SACf;QACD,YAAY,EAAE,4BAA4B;KAC3C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,KAAgC,CAAC;IACrC,IAAI,aAAoC,CAAC;IACzC,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACxC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC;YAC9C,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,OAAO;gBACtB,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,aAAa,CAAC,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,kBAAkB;YAC/B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,wBAAwB,EACxB,kBAAkB,CAAC;YACjB,WAAW,EAAE,iBAAiB;YAC9B,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,wBAAwB,EAAE;gBACxB,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,CAAC;gBACnB,aAAa,EAAE,GAAG;gBAClB,cAAc,EAAE,GAAG;aACpB;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,iBAAiB;YAC9B,eAAe,EAAE,GAAG;YACpB,0BAA0B,EAAE;gBAC1B,aAAa,EAAE,QAAQ;gBACvB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACvE,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,aAAa,EAAE,QAAQ;YACvB,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,8BAA8B,CAAC;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE;YACrD,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -47,7 +47,7 @@ export declare function createOneSubServer(config: OneSubMiddlewareConfig): Retu
 export { InMemorySubscriptionStore, InMemoryPurchaseStore } from './store.js';
 export type { SubscriptionStore, PurchaseStore } from './store.js';
 export { PostgresSubscriptionStore, PostgresPurchaseStore } from './stores/postgres.js';
-export { validateAppleReceipt } from './providers/apple.js';
+export { validateAppleReceipt, fetchAppleSubscriptionStatus } from './providers/apple.js';
 export { validateGoogleReceipt } from './providers/google.js';
 export { setLogger, log } from './logger.js';
 export default createOneSubMiddleware;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAQnE;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE;;;OAGG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAqB7E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAW7F;AAGD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAG7C,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAQnE;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE;;;OAGG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CA+B7E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAW7F;AAGD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAG7C,eAAe,sBAAsB,CAAC"}

package/dist/index.js

@@ -26,6 +26,13 @@ import { setLogger } from './logger.js';
  */
 export function createOneSubMiddleware(config) {
     setLogger(config.logger);
+    // Hard guard — mockMode accepts ANY receipt as valid. Letting this run on
+    // a production server would be a fraud disaster. `skipJwsVerification` has
+    // a similar shape but only degrades Apple signature checking; this one is
+    // strictly worse, so the check is an error, not a warning.
+    if ((config.apple?.mockMode || config.google?.mockMode) && process.env['NODE_ENV'] === 'production') {
+        throw new Error('[onesub] apple.mockMode / google.mockMode cannot be enabled when NODE_ENV=production — these modes accept any receipt as valid.');
+    }
     const store = config.store ?? new InMemorySubscriptionStore();
     const purchaseStore = config.purchaseStore ?? new InMemoryPurchaseStore();
     const router = Router();
@@ -33,7 +40,7 @@ export function createOneSubMiddleware(config) {
     router.use(express.json({ limit: '50kb' }));
     router.use(createValidateRouter(config, store));
     router.use(createStatusRouter(store));
-    router.use(createWebhookRouter(config, store));
+    router.use(createWebhookRouter(config, store, purchaseStore));
     router.use(createPurchaseRouter(config, purchaseStore));
     // Admin routes — only mounted when config.adminSecret is set
     const adminRouter = createAdminRouter(config, purchaseStore);
@@ -62,7 +69,7 @@ export function createOneSubServer(config) {
 export { InMemorySubscriptionStore, InMemoryPurchaseStore } from './store.js';
 export { PostgresSubscriptionStore, PostgresPurchaseStore } from './stores/postgres.js';
 // Provider functions for direct (non-HTTP) usage
-export { validateAppleReceipt } from './providers/apple.js';
+export { validateAppleReceipt, fetchAppleSubscriptionStatus } from './providers/apple.js';
 export { validateGoogleReceipt } from './providers/google.js';
 // Logger plumbing — expose so non-middleware callers (direct provider use)
 // can still redirect logs.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBxC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzB,MAAM,KAAK,GAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACjF,MAAM,aAAa,GAAkB,MAAM,CAAC,aAAa,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAEzF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAExD,6DAA6D;IAC7D,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,WAAW;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAExF,iDAAiD;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,2EAA2E;AAC3E,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7C,yCAAyC;AACzC,eAAe,sBAAsB,CAAC;AAEtC,6CAA6C;AAC7C,mEAAmE;AACnE,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;IACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACnC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;aAC7C;YACH,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACxC,CAAC,CAAC;gBACE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAC/C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;aAC7D;YACH,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACvC;QACD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC7C,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEpF,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBxC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzB,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2DAA2D;IAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CACb,iIAAiI,CAClI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACjF,MAAM,aAAa,GAAkB,MAAM,CAAC,aAAa,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAEzF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAExD,6DAA6D;IAC7D,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,WAAW;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAExF,iDAAiD;AACjD,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,2EAA2E;AAC3E,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7C,yCAAyC;AACzC,eAAe,sBAAsB,CAAC;AAEtC,6CAA6C;AAC7C,mEAAmE;AACnE,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;IACvB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACnC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;aAC7C;YACH,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACxC,CAAC,CAAC;gBACE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBAC/C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;aAC7D;YACH,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE;YACR,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;SACvC;QACD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;KAC7C,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEpF,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/providers/apple.d.ts

@@ -1,4 +1,4 @@
-import type { SubscriptionInfo, AppleNotificationPayload, OneSubServerConfig } from '@onesub/shared';
+import type { SubscriptionInfo, AppleNotificationPayload, AppleConsumptionRequest, OneSubServerConfig } from '@onesub/shared';
 type AppleConfig = NonNullable<OneSubServerConfig['apple']>;
 /**
  * Decode and verify a StoreKit 2 signed transaction JWS.
@@ -46,9 +46,52 @@ export declare function validateAppleConsumableReceipt(signedTransaction: string
  */
 export declare function decodeAppleNotification(payload: AppleNotificationPayload, skipJwsVerification?: boolean): Promise<{
     originalTransactionId: string;
+    /** Per-transaction id (different from originalTransactionId for consumables / re-purchases). */
+    transactionId: string | null;
+    /** 'Auto-Renewable Subscription' | 'Consumable' | 'Non-Consumable' | 'Non-Renewing Subscription' */
+    type: string | null;
+    productId: string | null;
+    bundleId: string | null;
+    /** 'Production' | 'Sandbox' — drives which Apple API host to call back. */
+    environment: 'Production' | 'Sandbox';
     status: SubscriptionInfo['status'];
     willRenew: boolean;
-    expiresAt: string;
+    /** May be null for non-subscription notifications (consumable refund). */
+    expiresAt: string | null;
 } | null>;
+/**
+ * PUT a ConsumptionRequest to Apple's
+ * /inApps/v1/transactions/consumption/{transactionId} endpoint.
+ *
+ * Apple sends CONSUMPTION_REQUEST notifications when a customer asks for a
+ * refund on a consumable. Without a response Apple has no usage signal and
+ * tends to grant the refund. This call provides the data Apple uses to weigh
+ * the refund decision.
+ *
+ * Fire-and-forget: failures are logged, never thrown — the webhook should
+ * still 200 to Apple even if our outbound call fails.
+ */
+export declare function sendAppleConsumptionResponse(transactionId: string, body: AppleConsumptionRequest, config: AppleConfig, options?: {
+    sandbox?: boolean;
+}): Promise<void>;
+/**
+ * Fetch the current state of a subscription directly from Apple's App Store
+ * Server API — the canonical source of truth when webhooks have been missed,
+ * delivered out of order, or the local store has no record at all.
+ *
+ * GET /inApps/v1/subscriptions/{originalTransactionId}
+ * https://developer.apple.com/documentation/appstoreserverapi/get_all_subscription_statuses
+ *
+ * Returns null on:
+ *   - Missing API credentials (issuerId/keyId/privateKey)
+ *   - Network or auth failure
+ *   - Empty response (transaction not found)
+ *
+ * Hosts can call this directly (e.g. from a reconciliation cron) or it runs
+ * automatically as the unknown-transaction fallback inside the Apple webhook.
+ */
+export declare function fetchAppleSubscriptionStatus(originalTransactionId: string, config: AppleConfig, options?: {
+    sandbox?: boolean;
+}): Promise<SubscriptionInfo | null>;
 export {};
 //# sourceMappingURL=apple.d.ts.map

package/dist/providers/apple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAKrG,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA2F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA+EpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA6B9H"}
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../src/providers/apple.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AASxB,KAAK,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AA2F5D;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBpF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoDlC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,WAAW,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgFpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,EACjC,mBAAmB,UAAQ,GAC1B,OAAO,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,IAAI,CAAC,CA2CR;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgCf;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAChD,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8ElC"}