@vex-chat/spire 2.4.0 → 2.6.0

package/dist/db/schema.d.ts

@@ -4,6 +4,50 @@
  * Commercial licenses available at vex.wtf
  */
 import type { Insertable, Selectable, Updateable } from "kysely";
+export type AccountEntitlementRow = Selectable<AccountEntitlementsTable>;
+export interface AccountEntitlementsTable {
+    expiresAt: null | string;
+    source: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+export type AccountEntitlementUpdate = Updateable<AccountEntitlementsTable>;
+export type BillingStoreSubscriptionRow = Selectable<BillingStoreSubscriptionsTable>;
+export interface BillingStoreSubscriptionsTable {
+    createdAt: string;
+    environment: string;
+    expiresAt: null | string;
+    externalOriginalID: null | string;
+    externalTransactionID: null | string;
+    platform: string;
+    productID: string;
+    purchaseToken: null | string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    status: string;
+    storeProductID: string;
+    subscriptionID: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+export type BillingStoreSubscriptionUpdate = Updateable<BillingStoreSubscriptionsTable>;
+export type BillingStoreTransactionRow = Selectable<BillingStoreTransactionsTable>;
+export interface BillingStoreTransactionsTable {
+    environment: string;
+    eventType: string;
+    externalTransactionID: null | string;
+    platform: string;
+    processedAt: string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    storeProductID: string;
+    subscriptionID: string;
+    transactionID: string;
+    userID: string;
+}
+export type BillingStoreTransactionUpdate = Updateable<BillingStoreTransactionsTable>;
 export type ChannelRow = Selectable<ChannelsTable>;
 export interface ChannelsTable {
     channelID: string;
@@ -68,6 +112,9 @@ export interface MailTable {
     time: string;
 }
 export type MailUpdate = Updateable<MailTable>;
+export type NewAccountEntitlement = Insertable<AccountEntitlementsTable>;
+export type NewBillingStoreSubscription = Insertable<BillingStoreSubscriptionsTable>;
+export type NewBillingStoreTransaction = Insertable<BillingStoreTransactionsTable>;
 export type NewChannel = Insertable<ChannelsTable>;
 export type NewDevice = Insertable<DevicesTable>;
 export type NewDevicePasskeyApproval = Insertable<DevicePasskeyApprovalsTable>;
@@ -141,6 +188,9 @@ export interface PreKeysTable {
 }
 export type PreKeyUpdate = Updateable<PreKeysTable>;
 export interface ServerDatabase {
+    account_entitlements: AccountEntitlementsTable;
+    billing_store_subscriptions: BillingStoreSubscriptionsTable;
+    billing_store_transactions: BillingStoreTransactionsTable;
     channels: ChannelsTable;
     device_passkey_approvals: DevicePasskeyApprovalsTable;
     devices: DevicesTable;

package/dist/migrations/2026-06-24_account-entitlements.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Kysely } from "kysely";
+export declare function down(db: Kysely<unknown>): Promise<void>;
+export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/migrations/2026-06-24_account-entitlements.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+export async function down(db) {
+    await db.schema.dropTable("account_entitlements").ifExists().execute();
+}
+export async function up(db) {
+    await db.schema
+        .createTable("account_entitlements")
+        .ifNotExists()
+        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("tier", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("source", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("expiresAt", "text")
+        .addColumn("updatedAt", "text", (cb) => cb.notNull())
+        .execute();
+}
+//# sourceMappingURL=2026-06-24_account-entitlements.js.map

package/dist/migrations/2026-06-24_account-entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-24_account-entitlements.js","sourceRoot":"","sources":["../../src/migrations/2026-06-24_account-entitlements.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB;IACxC,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,sBAAsB,CAAC;SACnC,WAAW,EAAE;SACb,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;SAC5D,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACtD,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACpD,OAAO,EAAE,CAAC;AACnB,CAAC"}

package/dist/migrations/2026-07-02_store-subscriptions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Kysely } from "kysely";
+export declare function down(db: Kysely<unknown>): Promise<void>;
+export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/migrations/2026-07-02_store-subscriptions.js

@@ -0,0 +1,83 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+export async function down(db) {
+    await db.schema
+        .dropTable("billing_store_transactions")
+        .ifExists()
+        .execute();
+    await db.schema
+        .dropTable("billing_store_subscriptions")
+        .ifExists()
+        .execute();
+}
+export async function up(db) {
+    await db.schema
+        .createTable("billing_store_subscriptions")
+        .ifNotExists()
+        .addColumn("subscriptionID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("userID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("platform", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("environment", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("productID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("storeProductID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("tier", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("status", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("expiresAt", "text")
+        .addColumn("externalOriginalID", "varchar(255)")
+        .addColumn("externalTransactionID", "varchar(255)")
+        .addColumn("purchaseToken", "text")
+        .addColumn("purchaseTokenHash", "varchar(128)")
+        .addColumn("rawPayload", "text", (cb) => cb.notNull())
+        .addColumn("createdAt", "text", (cb) => cb.notNull())
+        .addColumn("updatedAt", "text", (cb) => cb.notNull())
+        .execute();
+    await db.schema
+        .createIndex("billing_store_subscriptions_user_idx")
+        .ifNotExists()
+        .on("billing_store_subscriptions")
+        .column("userID")
+        .execute();
+    await db.schema
+        .createIndex("billing_store_subscriptions_original_idx")
+        .ifNotExists()
+        .on("billing_store_subscriptions")
+        .columns(["platform", "environment", "externalOriginalID"])
+        .execute();
+    await db.schema
+        .createIndex("billing_store_subscriptions_token_hash_idx")
+        .ifNotExists()
+        .on("billing_store_subscriptions")
+        .columns(["platform", "environment", "purchaseTokenHash"])
+        .execute();
+    await db.schema
+        .createTable("billing_store_transactions")
+        .ifNotExists()
+        .addColumn("transactionID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("subscriptionID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("userID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("platform", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("environment", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("storeProductID", "varchar(255)", (cb) => cb.notNull())
+        .addColumn("eventType", "varchar(64)", (cb) => cb.notNull())
+        .addColumn("externalTransactionID", "varchar(255)")
+        .addColumn("purchaseTokenHash", "varchar(128)")
+        .addColumn("rawPayload", "text", (cb) => cb.notNull())
+        .addColumn("processedAt", "text", (cb) => cb.notNull())
+        .execute();
+    await db.schema
+        .createIndex("billing_store_transactions_subscription_idx")
+        .ifNotExists()
+        .on("billing_store_transactions")
+        .column("subscriptionID")
+        .execute();
+    await db.schema
+        .createIndex("billing_store_transactions_user_idx")
+        .ifNotExists()
+        .on("billing_store_transactions")
+        .column("userID")
+        .execute();
+}
+//# sourceMappingURL=2026-07-02_store-subscriptions.js.map

package/dist/migrations/2026-07-02_store-subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-07-02_store-subscriptions.js","sourceRoot":"","sources":["../../src/migrations/2026-07-02_store-subscriptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC1C,MAAM,EAAE,CAAC,MAAM;SACV,SAAS,CAAC,4BAA4B,CAAC;SACvC,QAAQ,EAAE;SACV,OAAO,EAAE,CAAC;IACf,MAAM,EAAE,CAAC,MAAM;SACV,SAAS,CAAC,6BAA6B,CAAC;SACxC,QAAQ,EAAE;SACV,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB;IACxC,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,6BAA6B,CAAC;SAC1C,WAAW,EAAE;SACb,SAAS,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;SACpE,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC1D,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC7D,SAAS,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC5D,SAAS,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACjE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACtD,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,SAAS,CAAC,oBAAoB,EAAE,cAAc,CAAC;SAC/C,SAAS,CAAC,uBAAuB,EAAE,cAAc,CAAC;SAClD,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;SAClC,SAAS,CAAC,mBAAmB,EAAE,cAAc,CAAC;SAC9C,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACpD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACpD,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,sCAAsC,CAAC;SACnD,WAAW,EAAE;SACb,EAAE,CAAC,6BAA6B,CAAC;SACjC,MAAM,CAAC,QAAQ,CAAC;SAChB,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,0CAA0C,CAAC;SACvD,WAAW,EAAE;SACb,EAAE,CAAC,6BAA6B,CAAC;SACjC,OAAO,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;SAC1D,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,4CAA4C,CAAC;SACzD,WAAW,EAAE;SACb,EAAE,CAAC,6BAA6B,CAAC;SACjC,OAAO,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;SACzD,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,4BAA4B,CAAC;SACzC,WAAW,EAAE;SACb,SAAS,CAAC,eAAe,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;SACnE,SAAS,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACjE,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC1D,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC7D,SAAS,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACjE,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SAC3D,SAAS,CAAC,uBAAuB,EAAE,cAAc,CAAC;SAClD,SAAS,CAAC,mBAAmB,EAAE,cAAc,CAAC;SAC9C,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;SACtD,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,EAAE;SACb,EAAE,CAAC,4BAA4B,CAAC;SAChC,MAAM,CAAC,gBAAgB,CAAC;SACxB,OAAO,EAAE,CAAC;IAEf,MAAM,EAAE,CAAC,MAAM;SACV,WAAW,CAAC,qCAAqC,CAAC;SAClD,WAAW,EAAE;SACb,EAAE,CAAC,4BAA4B,CAAC;SAChC,MAAM,CAAC,QAAQ,CAAC;SAChB,OAAO,EAAE,CAAC;AACnB,CAAC"}

package/dist/server/billing.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+export declare function devBillingGrantRoutesEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare const getBillingRouter: (db: Database, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;
+export declare function billingAccountPath(): string;
+export declare function billingAppleTransactionPath(): string;
+export declare function billingDevGrantPath(): string;
+export declare function billingGooglePurchasePath(): string;
+export declare function billingProductsPath(): string;
+export declare function billingUserPath(userID: string): string;

package/dist/server/billing.js

@@ -0,0 +1,234 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { AccountTierSchema, AppleServerNotificationRequestSchema, AppleTransactionVerificationRequestSchema, datetime, GooglePlayDeveloperNotificationRequestSchema, GooglePurchaseVerificationRequestSchema, } from "@vex-chat/types";
+import { z } from "zod/v4";
+import { BillingVerificationError, decodeAppleServerNotificationPayload, decodeGooglePlayPubSubNotificationPayload, getBillingProductCatalog, resolveBillingProduct, verifyAppleTransaction, verifyGooglePurchase, } from "../BillingVerification.js";
+import { devApiKeyMatches } from "./rateLimit.js";
+import { getUser } from "./utils.js";
+import { sendWireResponse } from "./wireResponse.js";
+import { protect } from "./index.js";
+const devGrantPayload = z.object({
+    expiresAt: datetime.nullable().optional(),
+    tier: AccountTierSchema,
+    userID: z.string().min(1),
+});
+export function devBillingGrantRoutesEnabled(env = process.env) {
+    return (env["NODE_ENV"] !== "production" &&
+        env["VEX_ENABLE_DEV_BILLING_GRANTS"] === "1" &&
+        (env["DEV_API_KEY"]?.trim().length ?? 0) > 0);
+}
+export const getBillingRouter = (db, notify) => {
+    const router = express.Router();
+    router.get("/billing/products", protect, (_req, res) => {
+        sendWireResponse(_req, res, getBillingProductCatalog());
+    });
+    router.get("/billing/account", protect, async (req, res) => {
+        const userID = getUser(req).userID;
+        const state = await db.retrieveBillingAccountState(userID);
+        sendWireResponse(req, res, state);
+    });
+    router.post("/billing/apple/transactions", protect, async (req, res) => {
+        const parsed = AppleTransactionVerificationRequestSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid Apple transaction payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        await handleVerifiedPurchase(req, res, {
+            db,
+            eventType: "apple_transaction_verified",
+            notify,
+            purchase: await verifyAppleTransaction(parsed.data),
+            userID: getUser(req).userID,
+        });
+    });
+    router.post("/billing/google/purchases", protect, async (req, res) => {
+        const parsed = GooglePurchaseVerificationRequestSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid Google Play purchase payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        await handleVerifiedPurchase(req, res, {
+            db,
+            eventType: "google_purchase_verified",
+            notify,
+            purchase: await verifyGooglePurchase(parsed.data),
+            userID: getUser(req).userID,
+        });
+    });
+    router.post("/billing/webhooks/apple", async (req, res) => {
+        const parsed = AppleServerNotificationRequestSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid Apple server notification payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const notification = decodeAppleServerNotificationPayload(parsed.data.signedPayload);
+        const signedTransactionInfo = notification.data?.signedTransactionInfo;
+        if (!signedTransactionInfo) {
+            res.sendStatus(202);
+            return;
+        }
+        const purchase = await verifyAppleTransaction({
+            signedTransactionInfo,
+        });
+        const userID = await db.retrieveStoreSubscriptionOwner({
+            environment: purchase.environment,
+            externalOriginalID: purchase.externalOriginalID,
+            platform: purchase.platform,
+        });
+        if (!userID) {
+            res.sendStatus(202);
+            return;
+        }
+        await handleVerifiedPurchase(req, res, {
+            db,
+            eventType: `apple_webhook_${notification.notificationType ?? "unknown"}`,
+            notify,
+            purchase,
+            userID,
+        });
+    });
+    router.post("/billing/webhooks/google", async (req, res) => {
+        const parsed = GooglePlayDeveloperNotificationRequestSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid Google Play notification payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const notification = decodeGooglePlayPubSubNotificationPayload(req.body);
+        const purchaseToken = notification.subscriptionNotification?.purchaseToken;
+        if (!purchaseToken) {
+            res.sendStatus(202);
+            return;
+        }
+        const purchase = await verifyGooglePurchase({
+            packageName: notification.packageName,
+            productID: notification.subscriptionNotification?.subscriptionId,
+            purchaseToken,
+        });
+        const userID = await db.retrieveStoreSubscriptionOwner({
+            environment: purchase.environment,
+            platform: purchase.platform,
+            purchaseToken,
+        });
+        if (!userID) {
+            res.sendStatus(202);
+            return;
+        }
+        await handleVerifiedPurchase(req, res, {
+            db,
+            eventType: "google_webhook_subscription",
+            notify,
+            purchase,
+            userID,
+        });
+    });
+    if (devBillingGrantRoutesEnabled()) {
+        router.post("/__dev/billing/grants", async (req, res) => {
+            if (!devBillingGrantRoutesEnabled()) {
+                res.sendStatus(404);
+                return;
+            }
+            if (!devApiKeyMatches(req)) {
+                res.sendStatus(403);
+                return;
+            }
+            const parsed = devGrantPayload.safeParse(req.body);
+            if (!parsed.success) {
+                res.status(400).json({
+                    error: "Invalid dev billing grant payload",
+                    issues: parsed.error.issues,
+                });
+                return;
+            }
+            const entitlements = await db.setAccountEntitlementTier(parsed.data.userID, parsed.data.tier, {
+                expiresAt: parsed.data.expiresAt ?? null,
+                source: "store",
+            });
+            notify(parsed.data.userID, "accountEntitlementsChanged", crypto.randomUUID(), { tier: entitlements.tier });
+            sendWireResponse(req, res, entitlements);
+        });
+    }
+    router.use((err, _req, res, next) => {
+        if (err instanceof BillingVerificationError) {
+            res.status(err.status).json({ error: err.message });
+            return;
+        }
+        next(err);
+    });
+    return router;
+};
+export function billingAccountPath() {
+    return "/billing/account";
+}
+export function billingAppleTransactionPath() {
+    return "/billing/apple/transactions";
+}
+export function billingDevGrantPath() {
+    return "/__dev/billing/grants";
+}
+export function billingGooglePurchasePath() {
+    return "/billing/google/purchases";
+}
+export function billingProductsPath() {
+    return "/billing/products";
+}
+export function billingUserPath(userID) {
+    return `/user/${encodeURIComponent(userID)}/billing`;
+}
+async function handleVerifiedPurchase(req, res, args) {
+    const product = resolveBillingProduct(args.purchase);
+    const subscription = await persistVerifiedPurchase(args.db, {
+        product,
+        purchase: args.purchase,
+        userID: args.userID,
+    });
+    await args.db.recordStoreTransaction({
+        eventType: args.eventType,
+        externalTransactionID: args.purchase.externalTransactionID,
+        rawPayload: args.purchase.rawPayload,
+        subscriptionID: subscription.subscriptionID,
+        userID: args.userID,
+    });
+    const entitlements = await args.db.recalculateStoreEntitlements(args.userID);
+    args.notify(args.userID, "accountEntitlementsChanged", crypto.randomUUID(), {
+        tier: entitlements.tier,
+    });
+    const state = {
+        entitlements,
+        subscriptions: await args.db.retrieveBillingSubscriptions(args.userID),
+    };
+    sendWireResponse(req, res, state);
+}
+async function persistVerifiedPurchase(db, args) {
+    const input = {
+        environment: args.purchase.environment,
+        expiresAt: args.purchase.expiresAt,
+        externalOriginalID: args.purchase.externalOriginalID,
+        externalTransactionID: args.purchase.externalTransactionID,
+        platform: args.purchase.platform,
+        productID: args.product.productID,
+        purchaseToken: args.purchase.purchaseToken,
+        rawPayload: args.purchase.rawPayload,
+        status: args.purchase.status,
+        storeProductID: args.product.storeProductID,
+        tier: args.product.tier,
+        userID: args.userID,
+    };
+    return db.upsertStoreSubscription(input);
+}
+//# sourceMappingURL=billing.js.map

package/dist/server/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/server/billing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACH,iBAAiB,EACjB,oCAAoC,EACpC,yCAAyC,EACzC,QAAQ,EACR,4CAA4C,EAC5C,uCAAuC,GAC1C,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EACH,wBAAwB,EACxB,oCAAoC,EACpC,yCAAyC,EACzC,wBAAwB,EACxB,qBAAqB,EAErB,sBAAsB,EACtB,oBAAoB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,CACH,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChC,GAAG,CAAC,+BAA+B,CAAC,KAAK,GAAG;QAC5C,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC/C,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC5B,EAAY,EACZ,MAMS,EACX,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC3D,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAC9D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,mCAAmC;gBAC1C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YACnC,EAAE;YACF,SAAS,EAAE,4BAA4B;YACvC,MAAM;YACN,QAAQ,EAAE,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC;YACnD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,uCAAuC,CAAC,SAAS,CAC5D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,sCAAsC;gBAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YACnC,EAAE;YACF,SAAS,EAAE,0BAA0B;YACrC,MAAM;YACN,QAAQ,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;YACjD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;gBAClD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,YAAY,GAAG,oCAAoC,CACrD,MAAM,CAAC,IAAI,CAAC,aAAa,CAC5B,CAAC;QACF,MAAM,qBAAqB,GAAG,YAAY,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACvE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;YAC1C,qBAAqB;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,8BAA8B,CAAC;YACnD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YACnC,EAAE;YACF,SAAS,EAAE,iBAAiB,YAAY,CAAC,gBAAgB,IAAI,SAAS,EAAE;YACxE,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,4CAA4C,CAAC,SAAS,CACjE,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,0CAA0C;gBACjD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,YAAY,GAAG,yCAAyC,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,MAAM,aAAa,GACf,YAAY,CAAC,wBAAwB,EAAE,aAAa,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YACxC,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,SAAS,EAAE,YAAY,CAAC,wBAAwB,EAAE,cAAc;YAChE,aAAa;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,8BAA8B,CAAC;YACnD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,aAAa;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YACnC,EAAE;YACF,SAAS,EAAE,6BAA6B;YACxC,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAI,4BAA4B,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACpD,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;gBAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACjB,KAAK,EAAE,mCAAmC;oBAC1C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC9B,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,yBAAyB,CACnD,MAAM,CAAC,IAAI,CAAC,MAAM,EAClB,MAAM,CAAC,IAAI,CAAC,IAAI,EAChB;gBACI,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;gBACxC,MAAM,EAAE,OAAO;aAClB,CACJ,CAAC;YACF,MAAM,CACF,MAAM,CAAC,IAAI,CAAC,MAAM,EAClB,4BAA4B,EAC5B,MAAM,CAAC,UAAU,EAAE,EACnB,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAC9B,CAAC;YACF,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACP,CAAC;IAED,MAAM,CAAC,GAAG,CACN,CACI,GAAY,EACZ,IAAqB,EACrB,GAAqB,EACrB,IAA0B,EAC5B,EAAE;QACA,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB;IAC9B,OAAO,kBAAkB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,2BAA2B;IACvC,OAAO,6BAA6B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,OAAO,uBAAuB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,yBAAyB;IACrC,OAAO,2BAA2B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC1C,OAAO,SAAS,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACjC,GAAoB,EACpB,GAAqB,EACrB,IAYC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE;QACxD,OAAO;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB;QAC1D,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAC3D,IAAI,CAAC,MAAM,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CACP,IAAI,CAAC,MAAM,EACX,4BAA4B,EAC5B,MAAM,CAAC,UAAU,EAAE,EACnB;QACI,IAAI,EAAE,YAAY,CAAC,IAAI;KAC1B,CACJ,CAAC;IAEF,MAAM,KAAK,GAAwB;QAC/B,YAAY;QACZ,aAAa,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;KACzE,CAAC;IACF,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAClC,EAAY,EACZ,IAIC;IAED,MAAM,KAAK,GAAiC;QACxC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;QACtC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;QACpD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB;QAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;QACjC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;QAC1C,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;QAC3C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACtB,CAAC;IACF,OAAO,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC"}

package/dist/server/entitlements.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+export declare function devEntitlementRoutesEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare const getEntitlementRouter: (db: Database, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;

package/dist/server/entitlements.js

@@ -0,0 +1,71 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { AccountTierSchema, datetime } from "@vex-chat/types";
+import { z } from "zod/v4";
+import { devApiKeyMatches } from "./rateLimit.js";
+import { getParam, getUser } from "./utils.js";
+import { sendWireResponse } from "./wireResponse.js";
+import { protect } from "./index.js";
+const devEntitlementPatchPayload = z.object({
+    expiresAt: datetime.nullable().optional(),
+    tier: AccountTierSchema,
+});
+export function devEntitlementRoutesEnabled(env = process.env) {
+    return (env["NODE_ENV"] !== "production" &&
+        env["VEX_ENABLE_DEV_ENTITLEMENTS"] === "1" &&
+        (env["DEV_API_KEY"]?.trim().length ?? 0) > 0);
+}
+export const getEntitlementRouter = (db, notify) => {
+    const router = express.Router();
+    router.get("/user/:id/entitlements", protect, async (req, res) => {
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        const entitlements = await db.retrieveAccountEntitlements(userID);
+        sendWireResponse(req, res, entitlements);
+    });
+    if (!devEntitlementRoutesEnabled()) {
+        return router;
+    }
+    router.patch("/__dev/user/:id/entitlements", protect, async (req, res) => {
+        if (!devEntitlementRoutesEnabled()) {
+            res.sendStatus(404);
+            return;
+        }
+        const userDetails = getUser(req);
+        const userID = getParam(req, "id");
+        if (userDetails.userID !== userID) {
+            res.sendStatus(401);
+            return;
+        }
+        if (!devApiKeyMatches(req)) {
+            res.sendStatus(403);
+            return;
+        }
+        const parsed = devEntitlementPatchPayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid entitlement payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const entitlements = await db.setAccountEntitlementTier(userID, parsed.data.tier, {
+            expiresAt: parsed.data.expiresAt ?? null,
+            source: "dev_override",
+        });
+        notify(userID, "accountEntitlementsChanged", crypto.randomUUID(), {
+            tier: entitlements.tier,
+        });
+        sendWireResponse(req, res, entitlements);
+    });
+    return router;
+};
+//# sourceMappingURL=entitlements.js.map

package/dist/server/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../src/server/entitlements.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,CACH,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChC,GAAG,CAAC,6BAA6B,CAAC,KAAK,GAAG;QAC1C,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC/C,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAChC,EAAY,EACZ,MAMS,EACX,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAClE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrE,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;YACjC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B;gBACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,yBAAyB,CACnD,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,IAAI,EAChB;YACI,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;YACxC,MAAM,EAAE,cAAc;SACzB,CACJ,CAAC;QACF,MAAM,CAAC,MAAM,EAAE,4BAA4B,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE;YAC9D,IAAI,EAAE,YAAY,CAAC,IAAI;SAC1B,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/index.js

@@ -23,7 +23,9 @@ import { msgpack } from "../utils/msgpack.js";
 import { verifyPreKeyWsSignature } from "../utils/preKeySignature.js";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.js";
 import { getAvatarRouter } from "./avatar.js";
+import { getBillingRouter } from "./billing.js";
 import { getCliPasskeyPageRouter } from "./cliPasskeyPage.js";
+import { getEntitlementRouter } from "./entitlements.js";
 import { errorHandler } from "./errors.js";
 import { getFileRouter } from "./file.js";
 import { getInviteRouter } from "./invite.js";
@@ -198,6 +200,8 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     const userRouter = getUserRouter(db, tokenValidator, notify);
     const fileRouter = getFileRouter(db);
     const avatarRouter = getAvatarRouter();
+    const billingRouter = getBillingRouter(db, notify);
+    const entitlementRouter = getEntitlementRouter(db, notify);
     const inviteRouter = getInviteRouter(db, tokenValidator, notify);
     const passkeyRouter = getPasskeyRouter(db);
     const passkeyDeviceRouter = getPasskeyDeviceRouter(db, notify, disconnectDevices);
@@ -776,6 +780,8 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     // an authenticated device) and `/auth/passkey/...` (public
     // sign-in). The router itself defines the full path on each
     // route handler.
+    api.use(billingRouter);
+    api.use(entitlementRouter);
     api.use(passkeyRouter);
     api.use(passkeyDeviceRouter);
     api.use("/user", userRouter);