@voltro/plugin-economy 0.0.0-stage → 0.88.0

package/dist/iapNotificationProcessor.testFixtures.js

@@ -0,0 +1,63 @@
+import { economyError as e } from "./errors.js";
+import { iapNotificationTables as t } from "./iapNotificationTables.entity.js";
+import { iapCurrentStatePort as n } from "./iapCurrentState.server.js";
+import { dataStoreIapNotificationCustody as r } from "./iapNotificationStore.server.js";
+import { iapNotificationProcessor as i } from "./iapNotificationProcessor.server.js";
+import { iapRefundsFixture as a } from "./iapRefunds.testFixtures.js";
+import { Effect as o } from "effect";
+import { randomBytes as s } from "node:crypto";
+import { ensureTableRegistered as c } from "@voltro/database";
+import { makeFieldCipher as l } from "@voltro/runtime";
+// src/iapNotificationProcessor.testFixtures.ts
+var u = async (u, d = "test.notice.processor") => {
+	t.forEach(c);
+	let f = await a(u, d), p = l(s(32).toString("base64url")), m = f.f.at + 1, h = 0, g = !1, _ = r(u, {
+		namespace: d,
+		deployment: f.n.options,
+		orders: f.f.iap,
+		bodyRetentionMs: 1e3,
+		cipher: { read: () => p },
+		now: () => m
+	}), v = n({
+		...f.n.options,
+		accounts: f.f.accounts,
+		now: () => m
+	}, {
+		initialize: () => o.void,
+		read: (t) => (h++, g ? o.fail(e("unavailable")) : o.succeed({
+			orderId: t.orderId,
+			channel: "ios",
+			state: "revoked",
+			refundNumerator: 1,
+			refundDenominator: 1,
+			observedAt: t.at,
+			revokedAt: null
+		}))
+	}), y = {
+		deployment: f.n.options,
+		notifications: {
+			initialize: () => o.void,
+			verify: (t) => t.body === "authenticated-notice-fixture" ? o.succeed(f.n.evidence) : o.fail(e("forbidden"))
+		},
+		current: v,
+		custody: _,
+		refunds: f.refunds,
+		orders: f.f.iap
+	};
+	return {
+		...f,
+		custody: _,
+		current: v,
+		options: y,
+		processor: i(y),
+		calls: () => h,
+		failProvider: (e) => {
+			g = e;
+		},
+		advance: (e) => {
+			m += e;
+		},
+		body: "authenticated-notice-fixture"
+	};
+};
+export { u as iapNotificationProcessorFixture };

package/dist/iapNotificationProcessorPort.fixture.js

@@ -0,0 +1,55 @@
+import { economyError as e } from "./errors.js";
+import { IapNotificationProcessorPort as t } from "./iapNotificationProcessor.server.js";
+import { iapNotificationProcessorFixture as n } from "./iapNotificationProcessor.testFixtures.js";
+import { Effect as r, Layer as i } from "effect";
+import { InMemoryDataStore as a } from "@voltro/runtime";
+// src/iapNotificationProcessorPort.fixture.ts
+var o = /* @__PURE__ */ new WeakMap(), s = r.tryPromise({
+	try: () => n(new a()),
+	catch: () => e("unavailable")
+}).pipe(r.map((t) => {
+	let n = !1, i = (t) => r.suspend(() => n ? r.fail(e("unavailable")) : t()), a = Object.freeze({
+		initialize: () => i(t.processor.initialize),
+		ingest: (e) => i(() => t.processor.ingest(e)),
+		process: (e) => i(() => t.processor.process(e)),
+		pending: () => i(t.processor.pending),
+		prune: () => i(t.processor.prune),
+		exportSubject: (e) => i(() => t.processor.exportSubject(e)),
+		eraseSubject: (e) => i(() => t.processor.eraseSubject(e))
+	});
+	o.set(a, t);
+	let s = r.sync(() => {
+		n = !0;
+	}).pipe(r.flatMap(() => t.f.accounts.eraseSubject(t.privacy)), r.flatMap(() => t.custody.eraseSubject(t.privacy)));
+	return Object.freeze({
+		service: a,
+		body: t.body,
+		privacy: t.privacy,
+		close: s
+	});
+})), c = i.effect(t, r.acquireRelease(s, (e) => e.close.pipe(r.orDie)).pipe(r.map((e) => e.service))), l = Object.freeze({
+	kind: "port",
+	tag: t,
+	fakeLayer: c,
+	probe: {
+		run: () => r.scoped(r.gen(function* () {
+			let n = yield* t, i = o.get(n);
+			if (!i) return yield* r.fail(e("unavailable"));
+			yield* n.initialize();
+			let a = yield* n.ingest({ body: i.body }), s = yield* n.ingest({ body: i.body }), c = yield* n.pending();
+			return {
+				processed: a?.state === "processed",
+				replay: s !== null && s.id === a?.id,
+				pending: c.length,
+				providerCalls: i.calls()
+			};
+		}).pipe(r.provide(c))),
+		expected: {
+			processed: !0,
+			replay: !0,
+			pending: 0,
+			providerCalls: 1
+		}
+	}
+});
+export { c as iapNotificationProcessorFakeLayer, s as iapNotificationProcessorPortFixture, l as iapNotificationProcessorPortSystemFixture };

package/dist/iapNotificationSchedule.server.js

@@ -0,0 +1,69 @@
+import { economyError as e } from "./errors.js";
+import { captureBoundMethods as t, dataObject as n, identifier as r } from "./capture.js";
+import { shopInteger as i } from "./shop.js";
+import { iapChannel as a } from "./iap.js";
+import { captureIapNotificationProcessorService as o } from "./iapNotificationProcessor.server.js";
+import { Effect as s } from "effect";
+import { defineSchedule as c } from "@voltro/runtime";
+// src/iapNotificationSchedule.server.ts
+var l = (t) => {
+	let r = n(t, ["processor", "maxNotices"]), a = o(r.processor), c = i(r.maxNotices ?? 1e3, 1, 1e5);
+	return s.gen(function* () {
+		let t = yield* a.prune(), n = yield* a.pending();
+		if (!Number.isSafeInteger(t) || t < 0 || t > 1e5 || n.length > c) return yield* s.fail(e("limit_exceeded"));
+		if (new Set(n.map((e) => e.id)).size !== n.length || n.some((e) => e.state !== "pending")) return yield* s.fail(e("invalid_record"));
+		for (let t of n) {
+			let n = yield* a.process(t.id);
+			if (n.id !== t.id || n.orderId !== t.orderId || n.state !== "processed") return yield* s.fail(e("invalid_record"));
+		}
+		return Object.freeze({
+			prunedBodies: t,
+			scannedRows: n.length,
+			processedNotices: n.length
+		});
+	}).pipe(s.catchDefect(() => s.fail(e("unavailable"))));
+}, u = (t) => {
+	let a = n(t, [
+		"processor",
+		"maxNotices",
+		"name",
+		"cron",
+		"timezone"
+	]), u = r(a.name), d = a.cron, f = a.timezone ?? "UTC";
+	if (typeof d != "string" || !d.length || d.length > 120 || typeof f != "string" || !f.length || f.length > 120) throw e("invalid_input");
+	let p = o(a.processor), m = i(a.maxNotices ?? 1e3, 1, 1e5);
+	return c({
+		name: u,
+		cron: d,
+		timezone: f,
+		handler: () => l({
+			processor: p,
+			maxNotices: m
+		}).pipe(s.asVoid)
+	});
+}, d = (o) => {
+	let u = n(o, [
+		"system",
+		"channel",
+		"name",
+		"cron",
+		"timezone",
+		"maxNotices"
+	]), d = t(u.system, [
+		"initialize",
+		"processor",
+		"exportSubject",
+		"eraseSubject"
+	]), f = a(u.channel), p = r(u.name), m = u.cron, h = u.timezone ?? "UTC", g = i(u.maxNotices ?? 1e3, 1, 1e5);
+	if (typeof m != "string" || !m.length || m.length > 120 || typeof h != "string" || !h.length || h.length > 120) throw e("invalid_input");
+	return c({
+		name: p,
+		cron: m,
+		timezone: h,
+		handler: () => d.processor(f).pipe(s.flatMap((e) => l({
+			processor: e,
+			maxNotices: g
+		})), s.asVoid)
+	});
+};
+export { u as iapNotificationSchedule, d as installedIapNotificationSchedule, l as runIapNotificationWork };

package/dist/iapNotificationStore.server.js

@@ -0,0 +1,352 @@
+import { EconomyError as e, economyError as t } from "./errors.js";
+import { captureBoundMethods as n, dataObject as r, identifier as i } from "./capture.js";
+import { shopInteger as a } from "./shop.js";
+import { iapTimestamp as o } from "./iap.js";
+import { canonicalDataJson as s } from "./canonicalDataJson.js";
+import { issueVerifiedIapNotification as c, readVerifiedIapNotification as l } from "./iapNotifications.server.js";
+import { captureIapNotificationTargetOptions as u, readAcceptedIapNotificationTarget as d } from "./iapNotificationTarget.server.js";
+import { iapNotificationNamespacesTable as f, iapNotificationSubjectsTable as p, iapNotificationsTable as m } from "./iapNotificationTables.entity.js";
+import { readAcceptedIapRefund as h } from "./iapRefunds.server.js";
+import { Context as g, Effect as _, Result as v } from "effect";
+import { Buffer as y } from "node:buffer";
+import { createHash as b } from "node:crypto";
+import { decodeFieldValue as x, encodeFieldValue as ee, eq as S, fieldBinding as C, queryFor as w } from "@voltro/database";
+import { executeSqlMutations as T, prepareSqlMutation as E, prepareSqlMutationGroup as te } from "@voltro/database/sql";
+import { getFieldCipher as ne } from "@voltro/runtime";
+// src/iapNotificationStore.server.ts
+var D = class extends g.Service()("@voltro/IapNotificationCustodyPort") {}, O = (e) => n(e, [
+	"initialize",
+	"retain",
+	"restore",
+	"markProcessed",
+	"pending",
+	"prune",
+	"exportSubject",
+	"eraseSubject"
+]), k = (e) => b("sha256").update(s(e)).digest("hex"), A = (e, ...t) => e + k(t).slice(0, 56), j = (n) => n instanceof e ? n : t("unavailable"), M = (e) => _.tryPromise({
+	try: e,
+	catch: j
+}), N = (e) => {
+	try {
+		return e();
+	} catch (e) {
+		return _.fail(j(e));
+	}
+}, P = async (e) => {
+	let t = await _.runPromise(e.pipe(_.result));
+	if (v.isFailure(t)) throw t.failure;
+	return t.success;
+}, F = (e) => o(e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN), I = (g, v) => {
+	let b = r(v, [
+		"namespace",
+		"deployment",
+		"orders",
+		"bodyRetentionMs",
+		"maxRows",
+		"maxBodyBytes",
+		"now",
+		"cipher"
+	]), D = i(b.namespace), O = u(b.deployment), I = n(b.orders, ["prepareNotification"]), re = a(b.bodyRetentionMs, 1, 31536e6), L = a(b.maxRows ?? 1e4, 1, 1e5), R = a(b.maxBodyBytes ?? 262144, 1024, 1048576), z = b.now ?? Date.now;
+	if (typeof z != "function") throw t("invalid_input");
+	let ie = b.cipher === void 0 ? { read: ne } : n(b.cipher, ["read"]), B = () => {
+		let e = ie.read();
+		if (!e) throw t("unavailable");
+		return n(e, ["encrypt", "decrypt"]);
+	}, V = k(O), H = () => o(z()), U = A("enn_", D), W = (e, t) => A("ens_", D, e, t), G = (e) => "eni_" + e.slice(0, 56), K = (e) => {
+		let n = r(e, [
+			"tenantId",
+			"subjectId",
+			"kind"
+		]);
+		if (n.kind !== "user" && n.kind !== "guest") throw t("invalid_input");
+		return Object.freeze({
+			tenantId: i(n.tenantId),
+			ownerId: i(n.subjectId)
+		});
+	}, q = async (e, t) => {
+		await g.insertIgnore(f.tableName, {
+			id: U,
+			namespace: D,
+			configurationDigest: V,
+			admission: 0,
+			rowsCount: 0
+		}, { conflictColumns: ["id"] }), await g.insertIgnore(p.tableName, {
+			id: W(e, t),
+			namespace: D,
+			tenantId: e,
+			ownerId: t,
+			erased: !1,
+			admission: 0,
+			rowsCount: 0
+		}, { conflictColumns: ["id"] });
+	}, J = async (e, n, r, i = !1) => {
+		let o = (await e.query(w(p).where(S("id", W(n, r))).limit(1).descriptor))[0];
+		if (o) {
+			if (o.namespace !== D || o.tenantId !== n || o.admission !== 0 || o.erased !== !0 && o.erased !== !1 || (o.erased ? o.ownerId !== null : o.ownerId !== r)) throw t("invalid_record");
+			if (a(o.rowsCount, 0, L), o.erased && !i) throw t("erased");
+			return o;
+		}
+	}, Y = async (e, n, r, i = !1) => {
+		if (await e.updateMany(f.tableName, { admission: 0 }, { where: S("id", U) }) !== 1 || await e.updateMany(p.tableName, { admission: 0 }, { where: S("id", W(n, r)) }) !== 1) throw t("unavailable");
+		let o = (await e.query(w(f).where(S("id", U)).limit(1).descriptor))[0], s = await J(e, n, r, i);
+		if (!o || o.namespace !== D || o.admission !== 0 || !s) throw t("invalid_record");
+		if (!i && o.configurationDigest !== V) throw t("forbidden");
+		return a(o.rowsCount, 0, L), {
+			header: o,
+			person: s
+		};
+	}, X = (e, n = !1) => {
+		if (e.namespace !== D || typeof e.identity != "string" || !/^[a-f0-9]{64}$/.test(e.identity) || e.id !== G(e.identity) || typeof e.fingerprint != "string" || !/^[a-f0-9]{64}$/.test(e.fingerprint) || typeof e.ownerKey != "string" || !/^ens_[a-f0-9]{56}$/.test(e.ownerKey) || ![
+			"pending",
+			"processed",
+			"expired",
+			"erased"
+		].includes(String(e.state))) throw t("invalid_record");
+		let r = F(e.createdAt), a = F(e.expiresAt);
+		if (!n && typeof e.sealedBody == "string" && e.sealedBody.length > R * 4 + 512) throw t("limit_exceeded");
+		if (a <= r || !n && (e.state === "pending" ? typeof e.sealedBody != "string" || !e.sealedBody.startsWith("enc:v2:r:") : e.state === "processed" ? e.sealedBody !== null && (typeof e.sealedBody != "string" || !e.sealedBody.startsWith("enc:v2:r:")) : e.sealedBody !== null) || (i(e.tenantId), e.state !== "erased" && e.ownerKey !== W(i(e.tenantId), i(e.ownerId))) || e.state === "erased" && e.ownerId !== null) throw t("invalid_record");
+		return Object.freeze({
+			id: i(e.id),
+			orderId: i(e.orderId),
+			state: e.state
+		});
+	}, Z = async (e, n = !1) => {
+		let r = (await e.query(w(f).where(S("id", U)).limit(1).descriptor))[0];
+		if (r && (r.namespace !== D || r.admission !== 0 || typeof r.configurationDigest != "string" || !/^[a-f0-9]{64}$/.test(r.configurationDigest))) throw t("invalid_record");
+		if (r && !n && r.configurationDigest !== V) throw t("forbidden");
+		let i = await e.query(w(m).where(S("namespace", D)).limit(L + 1).descriptor);
+		if (i.length > L) throw t("limit_exceeded");
+		if (i.length !== (r ? a(r.rowsCount, 0, L) : 0)) throw t("invalid_record");
+		return i.forEach((e) => X(e, n)), i;
+	}, Q = (e) => {
+		if (X(e), e.state === "erased") throw t("erased");
+		if (e.state !== "pending" || typeof e.sealedBody != "string") throw t("unavailable");
+		let n = x(B(), e.sealedBody, void 0, C(m.tableName, "sealedBody", e.id));
+		if (typeof n != "string") throw t("invalid_record");
+		if (y.byteLength(n, "utf8") > R) throw t("limit_exceeded");
+		let a = r(JSON.parse(n), [
+			"namespace",
+			"deployment",
+			"scope",
+			"orderId",
+			"notice",
+			"material",
+			"fingerprint",
+			"createdAt",
+			"expiresAt"
+		], "invalid_record"), o = r(a.scope, ["tenantId", "ownerId"], "invalid_record");
+		if (a.namespace !== D || s(a.deployment) !== s(O) || o.tenantId !== e.tenantId || o.ownerId !== e.ownerId || e.ownerKey !== W(i(o.tenantId), i(o.ownerId)) || a.orderId !== e.orderId || a.fingerprint !== e.fingerprint || a.createdAt !== F(e.createdAt) || a.expiresAt !== F(e.expiresAt)) throw t("invalid_record");
+		let u = c(a.notice, r(a.material, Object.keys(a.material), "invalid_record")), d = l(u);
+		if (d.fingerprint !== e.fingerprint || e.identity !== k([
+			O.channel,
+			O.environment,
+			O.applicationId,
+			d.notice.noticeId
+		])) throw t("invalid_record");
+		return {
+			evidence: u,
+			owner: {
+				tenantId: i(o.tenantId),
+				ownerId: i(o.ownerId)
+			}
+		};
+	}, ae = (n) => N(() => {
+		let r = l(n);
+		return M(async () => {
+			let i = await P(I.prepareNotification(O, n)), a = await P(d(i)), c = H(), l = o(c + re);
+			if (a.fingerprint !== r.fingerprint) throw t("forbidden");
+			let u = k([
+				O.channel,
+				O.environment,
+				O.applicationId,
+				r.notice.noticeId
+			]), h = G(u), _ = a.scope, v = s({
+				namespace: D,
+				deployment: O,
+				scope: _,
+				orderId: a.orderId,
+				notice: r.notice,
+				material: r.material,
+				fingerprint: r.fingerprint,
+				createdAt: c,
+				expiresAt: l
+			});
+			if (y.byteLength(v, "utf8") > R) throw t("limit_exceeded");
+			let b = ee(B(), v, C(m.tableName, "sealedBody", h));
+			if (!b.startsWith("enc:v2:r:")) throw t("unavailable");
+			await q(_.tenantId, _.ownerId);
+			let x = await g.transactional(async (e) => {
+				let { header: n, person: i } = await Y(e, _.tenantId, _.ownerId), o = await Z(e), s = o.filter((e) => e.ownerKey === W(_.tenantId, _.ownerId));
+				if (o.length !== n.rowsCount || s.length !== i.rowsCount) throw t("invalid_record");
+				let d = o.find((e) => e.id === h);
+				if (d) {
+					if (d.identity !== u || d.fingerprint !== r.fingerprint || d.tenantId !== _.tenantId || d.ownerKey !== W(_.tenantId, _.ownerId) || d.orderId !== a.orderId) throw t("conflict");
+					return d.state === "pending" && Q(d), X(d);
+				}
+				if (o.length >= L) throw t("limit_exceeded");
+				let g = {
+					id: h,
+					namespace: D,
+					tenantId: _.tenantId,
+					ownerId: _.ownerId,
+					ownerKey: W(_.tenantId, _.ownerId),
+					orderId: a.orderId,
+					identity: u,
+					fingerprint: r.fingerprint,
+					state: "pending",
+					sealedBody: b,
+					createdAt: new Date(c),
+					expiresAt: new Date(l)
+				};
+				return await e.insert(m.tableName, g), await e.update(f.tableName, U, { rowsCount: o.length + 1 }), await e.update(p.tableName, W(_.tenantId, _.ownerId), { rowsCount: s.length + 1 }), X(g);
+			});
+			try {
+				return await P(d(i)), await g.transactional(async (e) => {
+					if (!await J(e, _.tenantId, _.ownerId)) throw t("invalid_record");
+					let n = (await e.query(w(m).where(S("id", x.id)).limit(1).descriptor))[0];
+					if (!n) throw t("invalid_record");
+					return X(n);
+				});
+			} catch (t) {
+				throw t instanceof e && t.code === "erased" && await P($({
+					tenantId: _.tenantId,
+					subjectId: _.ownerId,
+					kind: "user"
+				})), t;
+			}
+		});
+	}), oe = (n) => N(() => {
+		let r = i(n);
+		return M(async () => {
+			let n = H(), a = await g.transactional(async (e) => {
+				let a = (await e.query(w(m).where(S("id", r)).limit(1).descriptor))[0];
+				if (!a) throw t("not_found");
+				if (a.namespace !== D) throw t("forbidden");
+				let o = Q(a);
+				if (F(a.expiresAt) <= n) throw t("unavailable");
+				if (!await J(e, o.owner.tenantId, o.owner.ownerId)) throw t("invalid_record");
+				return {
+					...o,
+					orderId: i(a.orderId),
+					expiresAt: F(a.expiresAt)
+				};
+			});
+			try {
+				let e = await P(I.prepareNotification(O, a.evidence)), n = await P(d(e));
+				if (n.orderId !== a.orderId || s(n.scope) !== s(a.owner)) throw t("conflict");
+				await g.transactional(async (e) => {
+					if (!await J(e, a.owner.tenantId, a.owner.ownerId)) throw t("invalid_record");
+					if (H() >= a.expiresAt) throw t("unavailable");
+				});
+				let i = l(a.evidence);
+				return c(i.notice, i.material, () => M(() => g.transactional(async (e) => {
+					let n = (await e.query(w(m).where(S("id", r)).limit(1).descriptor))[0];
+					if (!n || n.namespace !== D) throw t("not_found");
+					let o = Q(n);
+					if (n.fingerprint !== i.fingerprint || n.orderId !== a.orderId || s(o.owner) !== s(a.owner)) throw t("conflict");
+					if (!await J(e, o.owner.tenantId, o.owner.ownerId)) throw t("invalid_record");
+					if (H() >= F(n.expiresAt)) throw t("unavailable");
+				})), () => _.succeed(E(g, async (e) => {
+					await Y(e, a.owner.tenantId, a.owner.ownerId);
+					let n = (await e.query(w(m).where(S("id", r)).limit(1).descriptor))[0];
+					if (!n) throw t("not_found");
+					let o = Q(n);
+					if (n.fingerprint !== i.fingerprint || n.orderId !== a.orderId || s(o.owner) !== s(a.owner)) throw t("conflict");
+					if (H() >= F(n.expiresAt)) throw t("unavailable");
+					return null;
+				})));
+			} catch (t) {
+				throw t instanceof e && t.code === "erased" && await P($({
+					tenantId: a.owner.tenantId,
+					subjectId: a.owner.ownerId,
+					kind: "user"
+				})), t;
+			}
+		});
+	}), se = (e, n) => N(() => {
+		let r = i(e), a = h(n);
+		return M(async () => {
+			let e = await g.transactional(async (e) => {
+				let n = (await e.query(w(m).where(S("id", r)).limit(1).descriptor))[0];
+				if (!n || n.namespace !== D || n.orderId !== a.orderId || n.fingerprint !== a.fingerprint || n.ownerKey !== W(a.scope.tenantId, a.scope.ownerId)) throw t("forbidden");
+				if (!await J(e, a.scope.tenantId, a.scope.ownerId)) throw t("invalid_record");
+				return n.state === "processed" ? X(n) : null;
+			});
+			if (e) return e;
+			let n = await P(a.prepare()), i = E(g, async (e) => {
+				await Y(e, a.scope.tenantId, a.scope.ownerId);
+				let n = (await e.query(w(m).where(S("id", r)).limit(1).descriptor))[0];
+				if (!n) throw t("not_found");
+				if (n.state === "processed") return X(n);
+				let i = Q(n), o = l(i.evidence);
+				if (n.orderId !== a.orderId || o.fingerprint !== a.fingerprint || o.notice.noticeId !== a.noticeId || s(i.owner) !== s(a.scope)) throw t("conflict");
+				if (H() >= F(n.expiresAt)) throw t("unavailable");
+				return await e.update(m.tableName, r, { state: "processed" }), X({
+					...n,
+					state: "processed"
+				});
+			}), o = te(g, [n, i], async (e, t) => t[1]);
+			return (await T(g, [o]))[0];
+		});
+	}), ce = () => M(() => g.transactional(async (e) => {
+		let t = H(), n = await Z(e);
+		return Object.freeze(n.filter((e) => e.state === "pending" && F(e.expiresAt) > t).map((e) => X(e)));
+	})), le = () => M(async () => {
+		let e = H();
+		return g.transactional(async (n) => {
+			if (await n.updateMany(f.tableName, { admission: 0 }, { where: S("id", U) }) !== 1) return 0;
+			let r = (await n.query(w(f).where(S("id", U)).limit(1).descriptor))[0], i = await Z(n);
+			if (!r || r.namespace !== D || r.admission !== 0 || i.length !== r.rowsCount) throw t("invalid_record");
+			let a = 0;
+			for (let t of i) (t.state === "pending" || t.state === "processed") && t.sealedBody !== null && F(t.expiresAt) <= e && (await n.update(m.tableName, String(t.id), {
+				state: t.state === "processed" ? "processed" : "expired",
+				sealedBody: null
+			}), a++);
+			return a;
+		});
+	}), ue = (e) => N(() => {
+		let n = K(e);
+		return M(() => g.transactional(async (e) => {
+			let r = await J(e, n.tenantId, n.ownerId, !0), i = (await Z(e, !0)).filter((e) => e.tenantId === n.tenantId && e.ownerKey === W(n.tenantId, n.ownerId));
+			if (i.length !== (r ? r.rowsCount : 0)) throw t("invalid_record");
+			return { notifications: r?.erased ? [] : i.map((e) => ({
+				...X(e),
+				createdAt: F(e.createdAt),
+				expiresAt: F(e.expiresAt)
+			})) };
+		}));
+	}), $ = (e) => N(() => {
+		let n = K(e);
+		return M(async () => {
+			await q(n.tenantId, n.ownerId), await g.transactional(async (e) => {
+				let { header: r, person: i } = await Y(e, n.tenantId, n.ownerId, !0), a = await Z(e, !0), o = a.filter((e) => e.tenantId === n.tenantId && e.ownerKey === W(n.tenantId, n.ownerId));
+				if (a.length !== r.rowsCount || o.length !== i.rowsCount) throw t("invalid_record");
+				for (let t of o) await e.update(m.tableName, String(t.id), {
+					ownerId: null,
+					sealedBody: null,
+					state: "erased"
+				});
+				await e.update(p.tableName, W(n.tenantId, n.ownerId), {
+					ownerId: null,
+					erased: !0
+				});
+			});
+		});
+	});
+	return Object.freeze({
+		initialize: () => _.try({
+			try: () => {
+				B();
+			},
+			catch: j
+		}),
+		retain: ae,
+		restore: oe,
+		markProcessed: se,
+		pending: ce,
+		prune: le,
+		exportSubject: ue,
+		eraseSubject: $
+	});
+};
+export { D as IapNotificationCustodyPort, O as captureIapNotificationCustodyService, I as dataStoreIapNotificationCustody };

package/dist/iapNotificationStore.testFixtures.js

@@ -0,0 +1,31 @@
+import { iapNotificationTables as e } from "./iapNotificationTables.entity.js";
+import { dataStoreIapNotificationCustody as t } from "./iapNotificationStore.server.js";
+import { iapStoreFixture as n } from "./iapStore.testFixtures.js";
+import { iapSqlNoticeFixture as r } from "./iapNotificationTarget.testFixtures.js";
+import { Effect as i } from "effect";
+import { ensureTableRegistered as a } from "@voltro/database";
+// src/iapNotificationStore.testFixtures.ts
+var o = async (o, s = "test.tenant", c = {}) => {
+	e.forEach(a);
+	let l = await n(o, s), u = await i.runPromise(l.iap.redeem(l.user(), l.intent)), d = r(l), f = {
+		namespace: s,
+		deployment: d.options,
+		orders: l.iap,
+		bodyRetentionMs: 1e3,
+		now: () => l.at,
+		...c
+	};
+	return {
+		f: l,
+		n: d,
+		original: u,
+		options: f,
+		custody: t(o, f),
+		privacy: {
+			tenantId: s,
+			subjectId: l.scope.ownerId,
+			kind: "guest"
+		}
+	};
+};
+export { o as iapNotificationStoreFixture };

package/dist/iapNotificationTables.entity.js

@@ -0,0 +1,48 @@
+import { boolean as e, id as t, integer as n, table as r, text as i, timestamp as a } from "@voltro/database";
+// src/iapNotificationTables.entity.ts
+var o = () => i().maxLength(120).serverOnly(), s = () => i().maxLength(120).externalId().sensitive("pii"), c = r("_voltro_eco_iap_notice_namespaces", {
+	id: t({ prefix: "enn" }),
+	namespace: o(),
+	configurationDigest: i().maxLength(64).serverOnly(),
+	admission: n().serverOnly(),
+	rowsCount: n().serverOnly()
+}), l = r("_voltro_eco_iap_notice_subjects", {
+	id: t({ prefix: "ens" }),
+	namespace: o(),
+	tenantId: s(),
+	ownerId: i().maxLength(120).nullable().externalId().sensitive("pii"),
+	erased: e().serverOnly(),
+	admission: n().serverOnly(),
+	rowsCount: n().serverOnly()
+}).index([
+	"namespace",
+	"tenantId",
+	"ownerId"
+]), u = r("_voltro_eco_iap_notices", {
+	id: t({ prefix: "eni" }),
+	namespace: o(),
+	tenantId: s(),
+	ownerId: i().maxLength(120).nullable().externalId().sensitive("pii"),
+	ownerKey: i().maxLength(64).serverOnly(),
+	orderId: i().maxLength(64).serverOnly(),
+	identity: i().maxLength(64).serverOnly(),
+	fingerprint: i().maxLength(64).serverOnly(),
+	state: i().maxLength(16).oneOf([
+		"pending",
+		"processed",
+		"expired",
+		"erased"
+	]).serverOnly(),
+	sealedBody: i().nullable().serverOnly(),
+	createdAt: a().serverOnly(),
+	expiresAt: a().serverOnly()
+}).index(["namespace"]).index([
+	"namespace",
+	"tenantId",
+	"ownerKey"
+]), d = [
+	c,
+	l,
+	u
+];
+export { c as iapNotificationNamespacesTable, l as iapNotificationSubjectsTable, d as iapNotificationTables, u as iapNotificationsTable };

package/dist/iapNotificationTarget.server.js

@@ -0,0 +1,36 @@
+import { economyError as e } from "./errors.js";
+import { dataObject as t, identifier as n } from "./capture.js";
+import { iapEnvironment as r } from "./iap.js";
+import { isIapRefundChannel as i } from "./iapNotifications.server.js";
+import { Effect as a } from "effect";
+// src/iapNotificationTarget.server.ts
+var o = /* @__PURE__ */ new WeakMap(), s = (e, t, r) => {
+	let i = Object.freeze({
+		orderId: n(e),
+		noticeId: t
+	});
+	return o.set(i, r), i;
+}, c = (t) => {
+	let n = typeof t == "object" && t ? o.get(t) : void 0;
+	return n ? a.suspend(n) : a.fail(e("forbidden"));
+}, l = (e) => c(e).pipe(a.map((e) => Object.freeze({
+	orderId: e.orderId,
+	notice: e.notice,
+	receipt: e.receipt
+}))), u = (a) => {
+	let o = t(a, [
+		"realMoney",
+		"channel",
+		"applicationId",
+		"environment"
+	]);
+	if (o.realMoney !== !0) throw e(o.realMoney === !1 ? "real_money_disabled" : "invalid_input");
+	if (!i(o.channel)) throw e("invalid_input");
+	return Object.freeze({
+		realMoney: !0,
+		channel: o.channel,
+		applicationId: n(o.applicationId),
+		environment: r(o.environment)
+	});
+};
+export { u as captureIapNotificationTargetOptions, s as issueAcceptedIapNotificationTarget, l as observeAcceptedIapNotificationTarget, c as readAcceptedIapNotificationTarget };