@voltro/plugin-economy 0.0.0-stage → 0.88.0

package/dist/googleIap.server.js

@@ -0,0 +1,391 @@
+import { EconomyError as e, economyError as t } from "./errors.js";
+import { captureBoundMethods as n, dataList as r, dataObject as i } from "./capture.js";
+import { captureCurrencies as a } from "./currency.js";
+import { shopInteger as o } from "./shop.js";
+import { defineIapCatalog as s, iapEnvironment as c, iapTimestamp as l } from "./iap.js";
+import { canonicalDataJson as u } from "./canonicalDataJson.js";
+import { readVerifiedIapNotification as d } from "./iapNotifications.server.js";
+import { iapCurrentStatePort as f } from "./iapCurrentState.server.js";
+import { captureIapTransactionFacts as p, iapVerificationPort as m } from "./iapVerification.server.js";
+import { iapCompletionPort as h } from "./iapCompletion.server.js";
+import { iapProviderRecord as g, iapProviderText as _, iapProviderTimestamp as v } from "./iapProviderCapture.server.js";
+import { captureGoogleSubscription as y, captureGoogleSubscriptionOrder as b, captureGoogleSubscriptionPlans as x, projectGoogleIapSubscription as S, projectGoogleIapSubscriptionCurrentState as C } from "./googleIapSubscription.server.js";
+import { googleIapNotificationPort as w } from "./googleIapNotifications.server.js";
+import { Effect as T } from "effect";
+import { createHash as E } from "node:crypto";
+// src/googleIap.server.ts
+var D = (e) => {
+	if (e.length > 4096 || !/^[A-Za-z0-9._~+\/-]+={0,2}$/.test(e)) throw t("invalid_input");
+	return e;
+}, O = (e) => {
+	let n = _(e, 8192);
+	if (!/^[A-Za-z0-9._~+\/-]+={0,2}$/.test(n)) throw t("unavailable");
+	return n;
+}, k = (e, n, i, a) => {
+	let s = g(e), c = g(s.purchaseStateContext);
+	if (c.purchaseState !== "PURCHASED" && c.purchaseState !== "CANCELLED" || s.obfuscatedExternalAccountId !== n.accountToken || n.product.kind === "subscription") throw t("forbidden");
+	let l = s.testPurchaseContext === void 0 ? null : g(s.testPurchaseContext);
+	if (a === "sandbox" ? l?.fopType !== "TEST" : l !== null) throw t("forbidden");
+	let u = r(s.productLineItem, 32);
+	if (u.length !== 1) throw t("forbidden");
+	let d = g(u[0]), f = g(d.productOfferDetails);
+	if (d.productId !== n.product.storeProductId || f.rentOfferDetails !== void 0 || f.preorderOfferDetails !== void 0) throw t("forbidden");
+	let m = o(f.quantity, 1, n.product.offer.maxQuantity), h = o(f.refundableQuantity, 0, m);
+	if (f.consumptionState !== "CONSUMPTION_STATE_YET_TO_BE_CONSUMED" && f.consumptionState !== "CONSUMPTION_STATE_CONSUMED") throw t("forbidden");
+	let _ = s.acknowledgementState === "ACKNOWLEDGEMENT_STATE_PENDING" ? "pending" : s.acknowledgementState === "ACKNOWLEDGEMENT_STATE_ACKNOWLEDGED" ? "acknowledged" : null;
+	if (_ === null) throw t("invalid_record");
+	let y = E("sha256").update(D(n.intent.receipt)).digest("hex"), b = p({
+		channel: "android",
+		environment: a,
+		applicationId: i,
+		transactionId: y,
+		originalTransactionId: null,
+		storeProductId: n.product.storeProductId,
+		kind: n.product.kind,
+		quantity: m,
+		purchasedAt: v(s.purchaseCompletionTime),
+		expiresAt: null,
+		paid: null,
+		acknowledgement: _,
+		consumption: f.consumptionState === "CONSUMPTION_STATE_CONSUMED" ? "consumed" : "available"
+	});
+	return Object.freeze({
+		facts: b,
+		purchaseState: c.purchaseState,
+		refundableQuantity: h
+	});
+}, A = (e, n, r, i) => {
+	let a = k(e, n, r, i);
+	if (a.purchaseState !== "PURCHASED" || a.refundableQuantity !== a.facts.quantity) throw t("forbidden");
+	return a.facts;
+}, j = async (e, n) => {
+	if (!(e.headers.get("content-type") ?? "").toLowerCase().startsWith("application/json") || e.body === null) throw t("invalid_record");
+	let r = e.body.getReader(), i = new TextDecoder("utf-8", { fatal: !0 }), a = 0, o = "";
+	try {
+		for (;;) {
+			let e = await r.read();
+			if (e.done) break;
+			if (a += e.value.byteLength, a > n) throw t("limit_exceeded");
+			o += i.decode(e.value, { stream: !0 });
+		}
+		return o += i.decode(), JSON.parse(o);
+	} finally {
+		await r.cancel().catch(() => void 0), r.releaseLock();
+	}
+}, M = (e) => {
+	if (typeof e.applicationId != "string" || !/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/.test(e.applicationId)) throw t("invalid_input");
+	let r = n(e.accessTokens, ["read"]), i = o(e.timeoutMs ?? 1e4, 1, 6e4), a = o(e.maxResponseBytes ?? 65536, 1024, 1048576);
+	return Object.freeze({
+		tokens: r,
+		timeoutMs: i,
+		maximum: a
+	});
+}, N = (e) => {
+	let n = i(e, [
+		"realMoney",
+		"environment",
+		"applicationId",
+		"products",
+		"currencies",
+		"accounts",
+		"now",
+		"accessTokens",
+		"timeoutMs",
+		"maxResponseBytes",
+		"subscriptionPlans"
+	]);
+	if (n.realMoney !== !0) throw t(n.realMoney === !1 ? "real_money_disabled" : "invalid_input");
+	let { tokens: r, timeoutMs: o, maximum: c } = M(n), l = {
+		realMoney: n.realMoney,
+		channel: "android",
+		environment: n.environment,
+		applicationId: n.applicationId,
+		products: n.products,
+		currencies: n.currencies,
+		accounts: n.accounts,
+		...n.now === void 0 ? {} : { now: n.now }
+	}, u = x(n.subscriptionPlans), d = s(l.products, a(l.currencies), !0);
+	if (d.some((e) => e.kind === "subscription" && !u.some((t) => t.offerId === e.offer.id && t.offerVersion === e.offer.version)) || u.some((e) => !d.some((t) => t.kind === "subscription" && t.offer.id === e.offerId && t.offer.version === e.offerVersion))) throw t("invalid_input");
+	return Object.freeze({
+		common: l,
+		tokens: r,
+		timeoutMs: o,
+		maximum: c,
+		subscriptionPlans: u
+	});
+}, P = (e) => e.read().pipe(T.flatMap((e) => T.try({
+	try: () => {
+		O(e);
+	},
+	catch: () => t("unavailable")
+}))), F = (e, t) => AbortSignal.any([t, AbortSignal.timeout(e)]), I = async (e, n, r, i, a, o) => {
+	let s = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(e)}/${n}`, c = await fetch(s, {
+		method: "GET",
+		headers: {
+			authorization: `Bearer ${r}`,
+			accept: "application/json"
+		},
+		redirect: "error",
+		signal: F(i, o)
+	});
+	if (!c.ok) throw await c.body?.cancel(), t(c.status === 404 || c.status === 410 ? "not_found" : "unavailable");
+	return j(c, a);
+}, L = (e, t, n, r, i, a) => I(e, `purchases/productsv2/tokens/${encodeURIComponent(t)}`, n, r, i, a), R = async (e, t, n, r, i, a, o, s, c) => {
+	let l = await I(t, `purchases/subscriptionsv2/tokens/${encodeURIComponent(e.intent.receipt)}`, r, i, a, o), u = y(l, e, n, s);
+	return {
+		subscription: l,
+		order: await I(t, `orders/${encodeURIComponent(c ?? u.orderId)}`, r, i, a, o),
+		admitted: u
+	};
+}, z = (n) => {
+	let { common: r, tokens: i, timeoutMs: a, maximum: o, subscriptionPlans: s } = N(n);
+	return m(r, {
+		initialize: () => P(i),
+		verify: (n) => T.try({
+			try: () => D(n.intent.receipt),
+			catch: () => t("invalid_input")
+		}).pipe(T.flatMap((c) => i.read().pipe(T.flatMap((i) => T.tryPromise({
+			try: async (e) => {
+				let t = O(i);
+				if (n.product.kind === "subscription") {
+					let i = await R(n, r.applicationId, r.environment, t, a, o, e, s);
+					return S(i.subscription, i.order, n, r.applicationId, r.environment, s);
+				}
+				return A(await L(r.applicationId, c, t, a, o, e), n, r.applicationId, r.environment);
+			},
+			catch: (n) => n instanceof e ? n : t("unavailable")
+		})))))
+	});
+}, B = (e, t) => JSON.stringify({
+	...e,
+	acknowledgement: "none",
+	consumption: "none"
+}) === JSON.stringify({
+	...t,
+	acknowledgement: "none",
+	consumption: "none"
+}), V = (e, n) => {
+	if (!B(e.facts, n)) throw t("conflict");
+	if (e.product.kind === "consumable") return n.consumption === "consumed";
+	if (e.product.kind !== "non-consumable" && e.product.kind !== "subscription" || n.consumption === "consumed") throw t("forbidden");
+	return n.acknowledgement === "acknowledged";
+}, H = (n) => {
+	let { common: i, tokens: a, timeoutMs: o, maximum: s, subscriptionPlans: c } = N(n);
+	return h(i, {
+		initialize: () => P(a),
+		complete: (n) => T.try({
+			try: () => D(n.intent.receipt),
+			catch: () => t("invalid_input")
+		}).pipe(T.flatMap((u) => a.read().pipe(T.flatMap((a) => T.tryPromise({
+			try: async (e) => {
+				let d = O(a), f = async () => {
+					if (n.product.kind !== "subscription") return A(await L(i.applicationId, u, d, o, s, e), n, i.applicationId, i.environment);
+					if (E("sha256").update(u).digest("hex") !== n.facts.originalTransactionId) throw t("forbidden");
+					let a = await R(n, i.applicationId, i.environment, d, o, s, e, c, n.facts.transactionId), l = b(a.order, n, a.admitted, i.applicationId, i.environment, c, n.facts.transactionId);
+					if (l.orderState !== "PROCESSED" || l.history.refundEvent !== void 0 || r(l.history.partialRefundEvents ?? [], 1e3, "invalid_record").length !== 0) throw t("forbidden");
+					return l.facts;
+				}, p = n.product.kind === "consumable" ? "consume" : "acknowledge";
+				if (!V(n, await f())) {
+					let r = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(i.applicationId)}/purchases/${n.product.kind === "subscription" ? "subscriptions" : "products"}/${encodeURIComponent(n.product.storeProductId)}/tokens/${encodeURIComponent(u)}:${p}`;
+					try {
+						await (await fetch(r, {
+							method: "POST",
+							headers: {
+								authorization: `Bearer ${d}`,
+								accept: "application/json",
+								...p === "acknowledge" ? { "content-type": "application/json" } : {}
+							},
+							...p === "acknowledge" ? { body: "{}" } : {},
+							redirect: "error",
+							signal: F(o, e)
+						})).body?.cancel();
+					} catch {
+						if (e.aborted) throw t("unavailable");
+					}
+					if (!V(n, await f())) throw t("unavailable");
+				}
+				return Object.freeze({
+					orderId: n.orderId,
+					channel: "android",
+					operation: p,
+					observedAt: l((i.now ?? Date.now)())
+				});
+			},
+			catch: (n) => n instanceof e ? n : t("unavailable")
+		})))))
+	});
+}, U = (e) => {
+	let r = i(e, [
+		"environment",
+		"applicationId",
+		"accessTokens",
+		"timeoutMs",
+		"maxResponseBytes",
+		"subscriptionPlans",
+		"notifications"
+	]), a = c(r.environment);
+	if (typeof r.applicationId != "string" || !/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/.test(r.applicationId)) throw t("invalid_input");
+	let s = x(r.subscriptionPlans), l = r.applicationId, u = n(r.accessTokens, ["read"]), d = o(r.timeoutMs ?? 1e4, 1, 6e4), f = o(r.maxResponseBytes ?? 65536, 1024, 1048576), p = r.notifications === void 0 ? void 0 : i(r.notifications, [
+		"audience",
+		"serviceAccountEmail",
+		"subscription",
+		"maxBodyBytes"
+	]), m = (e) => {
+		let { channel: n, ...r } = e;
+		if (n !== "android" || r.realMoney !== !0 || r.applicationId !== l || r.environment !== a) throw t("forbidden");
+		return {
+			...r,
+			accessTokens: u,
+			timeoutMs: d,
+			maxResponseBytes: f,
+			subscriptionPlans: s
+		};
+	};
+	return Object.freeze({
+		channel: "android",
+		environment: a,
+		applicationId: l,
+		create: (e) => z(m(e)),
+		createCompletion: (e) => H(m(e)),
+		createCurrentState: (e) => {
+			let { products: t, currencies: n, ...r } = m(e);
+			return G({
+				...r,
+				accounts: e.accounts
+			});
+		},
+		...p === void 0 ? {} : {
+			createNotifications: (e) => (m(e), w({
+				realMoney: !0,
+				applicationId: l,
+				...p,
+				now: e.now
+			})),
+			createDeliveries: (e) => K({
+				notifications: {
+					realMoney: !0,
+					applicationId: l,
+					...p,
+					now: e.now
+				},
+				verification: m(e)
+			})
+		}
+	});
+}, W = (e, n, r, i, a) => {
+	let o = g(n.material.detail), s = D(_(o.purchaseToken, 4096));
+	if (E("sha256").update(s).digest("hex") !== n.facts.transactionId) throw t("forbidden");
+	let c = {
+		channel: "android",
+		offerId: n.product.offer.id,
+		offerVersion: n.product.offer.version,
+		requestId: n.orderId,
+		receipt: s
+	}, d = k(e, {
+		scope: n.scope,
+		product: n.product,
+		intent: c,
+		accountToken: n.accountToken,
+		at: n.at
+	}, r, i), f = (e) => u({
+		...e,
+		acknowledgement: "none",
+		consumption: "none"
+	});
+	if (f(d.facts) !== f(n.facts)) throw t("conflict");
+	let p = d.facts.quantity - d.refundableQuantity, m = d.facts.quantity;
+	if (d.purchaseState === "CANCELLED" && p !== m) throw t("unavailable");
+	return Object.freeze({
+		orderId: n.orderId,
+		channel: "android",
+		state: p === 0 ? "active" : p === m ? "revoked" : "partially-refunded",
+		refundNumerator: p,
+		refundDenominator: m,
+		observedAt: l(a),
+		revokedAt: null
+	});
+}, G = (n) => {
+	let r = i(n, [
+		"realMoney",
+		"environment",
+		"applicationId",
+		"accounts",
+		"maxAgeMs",
+		"now",
+		"accessTokens",
+		"timeoutMs",
+		"maxResponseBytes",
+		"subscriptionPlans"
+	]);
+	if (r.realMoney !== !0) throw t(r.realMoney === !1 ? "real_money_disabled" : "invalid_input");
+	let { tokens: a, timeoutMs: o, maximum: s } = M(r), u = x(r.subscriptionPlans), d = r.applicationId, p = c(r.environment), m = r.now ?? Date.now;
+	if (typeof m != "function") throw t("invalid_input");
+	let h = {
+		realMoney: !0,
+		channel: "android",
+		applicationId: d,
+		environment: p,
+		accounts: r.accounts,
+		...r.maxAgeMs === void 0 ? {} : { maxAgeMs: r.maxAgeMs },
+		now: m
+	};
+	return f(h, {
+		initialize: () => P(a),
+		read: (n) => T.try({
+			try: () => {
+				let e = g(n.material.detail), r = D(_(e.purchaseToken, 4096));
+				if (E("sha256").update(r).digest("hex") !== (n.product.kind === "subscription" ? n.facts.originalTransactionId : n.facts.transactionId)) throw t("forbidden");
+				return r;
+			},
+			catch: (n) => n instanceof e ? n : t("invalid_record")
+		}).pipe(T.flatMap((r) => a.read().pipe(T.flatMap((i) => T.tryPromise({
+			try: async (e) => {
+				let t = O(i);
+				if (n.product.kind === "subscription") {
+					let i = await R({
+						scope: n.scope,
+						product: n.product,
+						accountToken: n.accountToken,
+						at: n.at,
+						intent: {
+							channel: "android",
+							offerId: n.product.offer.id,
+							offerVersion: n.product.offer.version,
+							requestId: n.orderId,
+							receipt: r
+						}
+					}, d, p, t, o, s, e, u, n.facts.transactionId);
+					return C(i.subscription, i.order, n, d, p, l(m()), u);
+				}
+				return W(await L(d, r, t, o, s, e), n, d, p, l(m()));
+			},
+			catch: (n) => n instanceof e ? n : t("unavailable")
+		})))))
+	});
+}, K = (n) => {
+	let i = w(n.notifications), { common: o, tokens: c, timeoutMs: l, maximum: u, subscriptionPlans: f } = N(n.verification), p = s(o.products, a(o.currencies), !0);
+	return Object.freeze({
+		initialize: () => i.initialize().pipe(T.flatMap(() => P(c))),
+		read: (n) => i.verify(n).pipe(T.flatMap((n) => {
+			let { notice: i, material: a } = d(n);
+			if (i.sourceType !== "android.subscription.2" && i.sourceType !== "android.subscription.1") return T.succeed(null);
+			let s = D(_(g(a.detail).purchaseToken, 4096));
+			return c.read().pipe(T.flatMap((n) => T.tryPromise({
+				try: async (e) => {
+					let t = g(await I(o.applicationId, `purchases/subscriptionsv2/tokens/${encodeURIComponent(s)}`, O(n), l, u, e)), i = t.externalAccountIdentifiers === void 0 ? {} : g(t.externalAccountIdentifiers), a = r(t.lineItems, 32, "invalid_record");
+					if (a.length !== 1 || typeof i.obfuscatedExternalAccountId != "string") return null;
+					let c = g(a[0]), d = c.offerDetails === void 0 ? {} : g(c.offerDetails), m = p.find((e) => e.channel === "android" && e.kind === "subscription" && e.storeProductId === c.productId && f.some((t) => t.offerId === e.offer.id && t.offerVersion === e.offer.version && t.basePlanId === d.basePlanId && t.storeOfferId === (d.offerId ?? null)));
+					return !m || typeof c.latestSuccessfulOrderId != "string" ? null : {
+						accountToken: i.obfuscatedExternalAccountId,
+						offerId: m.offer.id,
+						offerVersion: m.offer.version,
+						requestId: "renew.android." + _(c.latestSuccessfulOrderId, 100),
+						receipt: s
+					};
+				},
+				catch: (n) => n instanceof e ? n : t("unavailable")
+			})));
+		}), T.catchDefect(() => T.fail(t("unavailable"))))
+	});
+};
+export { H as googleIapCompletionPort, G as googleIapCurrentStatePort, K as googleIapDeliveryPort, U as googleIapProvider, z as googleIapVerificationPort, W as projectGoogleIapCurrentState, A as projectGoogleIapProduct };

package/dist/googleIapNotifications.server.js

@@ -0,0 +1,130 @@
+import { EconomyError as e, economyError as t } from "./errors.js";
+import { dataObject as n, identifier as r } from "./capture.js";
+import { shopInteger as i } from "./shop.js";
+import { iapTimestamp as a } from "./iap.js";
+import { captureNotificationInput as o, issueVerifiedIapNotification as s, notificationTime as c } from "./iapNotifications.server.js";
+import { iapProviderRecord as l, iapProviderText as u } from "./iapProviderCapture.server.js";
+import { Effect as d } from "effect";
+import { Buffer as f } from "node:buffer";
+import { createHash as p } from "node:crypto";
+import { JwtVerifyError as m, verifyJwt as h } from "@voltro/protocol/jwt";
+// src/googleIapNotifications.server.ts
+var g = (e, n, a, o) => {
+	let s = l(e), d = l(s.message);
+	if (s.subscription !== a) throw t("forbidden");
+	let m = u(d.messageId, 128), h = u(d.data, 1048576);
+	if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(h)) throw t("invalid_record");
+	let g = f.from(h, "base64");
+	if (g.toString("base64") !== h) throw t("invalid_record");
+	let _ = l(JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(g)));
+	if (_.packageName !== n || _.version !== "1.0" || typeof _.eventTimeMillis != "string" || !/^(0|[1-9][0-9]{0,15})$/.test(_.eventTimeMillis)) throw t("forbidden");
+	let v = c(Number(_.eventTimeMillis), o), y = [
+		"oneTimeProductNotification",
+		"subscriptionNotification",
+		"voidedPurchaseNotification",
+		"pendingRefundReviewNotification",
+		"testNotification"
+	].filter((e) => _[e] !== void 0);
+	if (y.length !== 1) throw t("invalid_record");
+	let b = y[0], x = l(_[b]), S, C, w = null, T = null, E = null;
+	if (b === "testNotification") {
+		if (x.version !== "1.0") throw t("invalid_record");
+		S = "test", C = "android.test";
+	} else if (b === "pendingRefundReviewNotification") {
+		if (x.version !== "1.0" || x.refundReason !== 7) throw t("invalid_record");
+		u(x.pendingRefundToken, 4096), u(x.orderId, 128), S = "review", C = "android.pending-refund-review";
+	} else {
+		let e = u(x.purchaseToken, 4096);
+		if (!/^[A-Za-z0-9._~+\/-]+={0,2}$/.test(e)) throw t("invalid_record");
+		if (w = p("sha256").update(e).digest("hex"), b === "voidedPurchaseNotification") i(x.productType, 1, 2), i(x.refundType, 1, 2), u(x.orderId, 128), x.productType === 1 && (T = w, w = u(x.orderId, 128)), S = "voided", C = "android.voided." + x.productType + "." + x.refundType;
+		else {
+			if (x.version !== "1.0") throw t("invalid_record");
+			if (b === "oneTimeProductNotification") S = "one-time", C = "android.one-time." + i(x.notificationType, 1, 2), E = r(x.sku);
+			else {
+				let e = i(x.notificationType, 1, 22);
+				if (![
+					1,
+					2,
+					3,
+					4,
+					5,
+					6,
+					7,
+					8,
+					9,
+					10,
+					11,
+					12,
+					13,
+					17,
+					18,
+					19,
+					20,
+					22
+				].includes(e)) throw t("invalid_record");
+				T = w, w = null, S = "subscription", C = "android.subscription." + e;
+			}
+		}
+	}
+	return Object.freeze({
+		notice: Object.freeze({
+			channel: "android",
+			applicationId: n,
+			environment: null,
+			noticeId: m,
+			sourceType: C,
+			kind: S,
+			occurredAt: v,
+			transactionId: w,
+			originalTransactionId: T,
+			storeProductId: E
+		}),
+		material: Object.freeze({ detail: structuredClone(x) })
+	});
+}, _ = (c) => {
+	let l = n(c, [
+		"realMoney",
+		"applicationId",
+		"audience",
+		"serviceAccountEmail",
+		"subscription",
+		"maxBodyBytes",
+		"now"
+	]);
+	if (l.realMoney !== !0) throw t(l.realMoney === !1 ? "real_money_disabled" : "invalid_input");
+	let f = r(l.applicationId), p = u(l.audience, 2048), _ = u(l.serviceAccountEmail, 254), v = u(l.subscription, 512);
+	if (!/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/.test(f) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*@[A-Za-z0-9.-]+\.gserviceaccount\.com$/.test(_) || !/^projects\/[A-Za-z0-9._-]+\/subscriptions\/[A-Za-z0-9._~-]+$/.test(v)) throw t("invalid_input");
+	let y = new URL(p);
+	if (y.protocol !== "https:" || y.username || y.password || y.search || y.hash) throw t("invalid_input");
+	let b = i(l.maxBodyBytes ?? 65536, 1024, 1048576), x = l.now ?? Date.now;
+	if (typeof x != "function") throw t("invalid_input");
+	return Object.freeze({
+		initialize: () => d.void,
+		verify: (n) => {
+			let r, i;
+			try {
+				r = o(n, b);
+				let e = r.authorization?.match(/^Bearer ([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/);
+				if (!e) throw t("forbidden");
+				i = e[1];
+			} catch (n) {
+				return d.fail(n instanceof e ? n : t("invalid_input"));
+			}
+			return d.tryPromise({
+				try: async () => {
+					let e = await h(i, "https://www.googleapis.com/oauth2/v3/certs", {
+						issuer: ["https://accounts.google.com", "accounts.google.com"],
+						audience: p,
+						algorithms: ["RS256"],
+						clockToleranceS: 60
+					});
+					if (e.email !== _ || e.email_verified !== !0 || typeof e.sub != "string" || !/^[0-9]{1,128}$/.test(e.sub)) throw t("forbidden");
+					let n = g(JSON.parse(r.body), f, v, a(x()));
+					return s(n.notice, n.material);
+				},
+				catch: (n) => n instanceof e ? n : n instanceof m ? t(n.code === "jwks_unreachable" ? "unavailable" : "forbidden") : t("invalid_record")
+			}).pipe(d.catchDefect(() => d.fail(t("unavailable"))));
+		}
+	});
+};
+export { _ as googleIapNotificationPort, g as projectGoogleIapNotification };