@onesub/server 0.12.1 → 0.13.0

package/dist/__tests__/admin-customer-detail.test.js

@@ -0,0 +1,146 @@
+/**
+ * GET /onesub/admin/customers/:userId — per-user profile bundle.
+ *
+ * Backs the dashboard's customer detail page. Returns subscriptions +
+ * purchases + entitlements (when configured) for one userId in a single
+ * round-trip. Always 200 — unknown userIds yield empty arrays rather than
+ * 404, since "no records yet" is a normal CS scenario.
+ */
+import { describe, it, expect } from 'vitest';
+import express from 'express';
+import { createOneSubMiddleware, InMemorySubscriptionStore, InMemoryPurchaseStore } from '../index.js';
+function sub(overrides) {
+    return {
+        userId: 'u',
+        productId: 'pro_monthly',
+        platform: 'apple',
+        status: 'active',
+        expiresAt: '2099-01-01T00:00:00.000Z',
+        purchasedAt: '2026-04-01T00:00:00.000Z',
+        originalTransactionId: `orig_${Math.random()}`,
+        willRenew: true,
+        ...overrides,
+    };
+}
+function purchase(overrides) {
+    return {
+        userId: 'u',
+        productId: 'lifetime_pass',
+        platform: 'apple',
+        type: 'non_consumable',
+        transactionId: `tx_${Math.random()}`,
+        purchasedAt: '2026-04-01T00:00:00.000Z',
+        quantity: 1,
+        ...overrides,
+    };
+}
+function spinUp(handler) {
+    return {
+        async get(path, headers) {
+            const httpServer = handler.listen(0);
+            const port = httpServer.address().port;
+            try {
+                const resp = await fetch(`http://127.0.0.1:${port}${path}`, { headers });
+                const text = await resp.text();
+                let parsed = text;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch { /* keep as text */ }
+                return { status: resp.status, body: parsed };
+            }
+            finally {
+                await new Promise((r) => httpServer.close(() => r()));
+            }
+        },
+    };
+}
+function buildServer(opts) {
+    const store = new InMemorySubscriptionStore();
+    const purchaseStore = new InMemoryPurchaseStore();
+    const config = {
+        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
+        database: { url: '' },
+        adminSecret: opts.adminSecret,
+        ...(opts.entitlements ? { entitlements: opts.entitlements } : {}),
+    };
+    const app = express();
+    app.use(createOneSubMiddleware({ ...config, store, purchaseStore }));
+    return { store, purchaseStore, server: spinUp(app) };
+}
+const SECRET = 's3cr3t';
+const AUTH = { 'x-admin-secret': SECRET };
+describe('GET /onesub/admin/customers/:userId auth', () => {
+    it('returns 404 when adminSecret is unset (router not mounted)', async () => {
+        const { server } = buildServer({});
+        const resp = await server.get('/onesub/admin/customers/u_x');
+        expect(resp.status).toBe(404);
+    });
+    it('returns 401 INVALID_ADMIN_SECRET when header is missing or wrong', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const noHeader = await server.get('/onesub/admin/customers/u_x');
+        expect(noHeader.status).toBe(401);
+        expect(noHeader.body.errorCode).toBe('INVALID_ADMIN_SECRET');
+    });
+});
+describe('GET /onesub/admin/customers/:userId basics', () => {
+    it('returns empty profile (200) for unknown userId', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/customers/u_unknown', AUTH);
+        expect(resp.status).toBe(200);
+        expect(resp.body.userId).toBe('u_unknown');
+        expect(resp.body.subscriptions).toEqual([]);
+        expect(resp.body.purchases).toEqual([]);
+        expect(resp.body.entitlements).toBeUndefined();
+    });
+    it('combines subscriptions and purchases for the user', async () => {
+        const { store, purchaseStore, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'alice', productId: 'pro_monthly', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'alice', productId: 'pro_yearly', originalTransactionId: 't2' }));
+        // unrelated user — must NOT leak
+        await store.save(sub({ userId: 'bob', originalTransactionId: 't_bob' }));
+        await purchaseStore.savePurchase(purchase({ userId: 'alice', productId: 'lifetime', transactionId: 'p1' }));
+        const resp = await server.get('/onesub/admin/customers/alice', AUTH);
+        expect(resp.status).toBe(200);
+        expect(resp.body.subscriptions).toHaveLength(2);
+        expect(resp.body.subscriptions.every((s) => s.userId === 'alice')).toBe(true);
+        expect(resp.body.purchases).toHaveLength(1);
+        expect(resp.body.purchases[0]?.userId).toBe('alice');
+    });
+});
+describe('GET /onesub/admin/customers/:userId entitlements', () => {
+    it('omits entitlements when config.entitlements is unset', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'alice', originalTransactionId: 't1' }));
+        const resp = await server.get('/onesub/admin/customers/alice', AUTH);
+        expect(resp.body.entitlements).toBeUndefined();
+    });
+    it('evaluates each configured entitlement when entitlements are set', async () => {
+        const { store, purchaseStore, server } = buildServer({
+            adminSecret: SECRET,
+            entitlements: {
+                premium: { productIds: ['pro_monthly', 'pro_yearly'] },
+                lifetime: { productIds: ['lifetime_pass'] },
+            },
+        });
+        // Active sub matches "premium"
+        await store.save(sub({ userId: 'alice', productId: 'pro_monthly', status: 'active', originalTransactionId: 't1' }));
+        // Non-consumable matches "lifetime"
+        await purchaseStore.savePurchase(purchase({ userId: 'alice', productId: 'lifetime_pass', transactionId: 'p1' }));
+        const resp = await server.get('/onesub/admin/customers/alice', AUTH);
+        expect(resp.body.entitlements?.premium?.active).toBe(true);
+        expect(resp.body.entitlements?.premium?.source).toBe('subscription');
+        expect(resp.body.entitlements?.lifetime?.active).toBe(true);
+        expect(resp.body.entitlements?.lifetime?.source).toBe('purchase');
+    });
+    it('reports inactive entitlements when nothing matches', async () => {
+        const { server } = buildServer({
+            adminSecret: SECRET,
+            entitlements: { premium: { productIds: ['pro_monthly'] } },
+        });
+        const resp = await server.get('/onesub/admin/customers/u_empty', AUTH);
+        expect(resp.body.entitlements?.premium?.active).toBe(false);
+        expect(resp.body.entitlements?.premium?.source).toBeNull();
+    });
+});
+//# sourceMappingURL=admin-customer-detail.test.js.map

package/dist/__tests__/admin-customer-detail.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-customer-detail.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-customer-detail.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,OAAO,MAAM,SAAS,CAAC;AAQ9B,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvG,SAAS,GAAG,CAAC,SAAqC;IAChD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,0BAA0B;QACrC,WAAW,EAAE,0BAA0B;QACvC,qBAAqB,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;QAC9C,SAAS,EAAE,IAAI;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiC;IACjD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,gBAAgB;QACtB,aAAa,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;QACpC,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,CAAC;QACX,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAMD,SAAS,MAAM,CAAC,OAAwB;IACtC,OAAO;QACL,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAgC;YACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAI,UAAU,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAiE;IACpF,MAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAuB;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,IAAI,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AAE1C,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwB,6BAA6B,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,mCAAmC,EAAE,IAAI,CAAC,CAAC;QAElG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAG,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,iCAAiC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE5G,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,+BAA+B,EAAE,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,+BAA+B,EAAE,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;YACnD,WAAW,EAAE,MAAM;YACnB,YAAY,EAAE;gBACZ,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;gBACtD,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE;aAC5C;SACF,CAAC,CAAC;QACH,+BAA+B;QAC/B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpH,oCAAoC;QACpC,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEjH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,+BAA+B,EAAE,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;YAC7B,WAAW,EAAE,MAAM;YACnB,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE;SAC3D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA0B,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAEhG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/admin-list-subscriptions.test.js

@@ -0,0 +1,192 @@
+/**
+ * GET /onesub/admin/subscriptions — filtered/paginated list endpoint.
+ *
+ * Backs the dashboard's subscriptions page; gated behind adminSecret like
+ * the other /onesub/admin/* and /onesub/metrics/* endpoints.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import express from 'express';
+import { createOneSubMiddleware, InMemorySubscriptionStore, InMemoryPurchaseStore } from '../index.js';
+// ── helpers ─────────────────────────────────────────────────────────────────
+function sub(overrides) {
+    return {
+        userId: 'u',
+        productId: 'pro_monthly',
+        platform: 'apple',
+        status: 'active',
+        expiresAt: '2099-01-01T00:00:00.000Z',
+        purchasedAt: '2026-04-01T00:00:00.000Z',
+        originalTransactionId: `orig_${Math.random()}`,
+        willRenew: true,
+        ...overrides,
+    };
+}
+function spinUp(handler) {
+    return {
+        async get(path, headers) {
+            const httpServer = handler.listen(0);
+            const port = httpServer.address().port;
+            try {
+                const resp = await fetch(`http://127.0.0.1:${port}${path}`, { headers });
+                const text = await resp.text();
+                let parsed = text;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch { /* keep as text */ }
+                return { status: resp.status, body: parsed };
+            }
+            finally {
+                await new Promise((r) => httpServer.close(() => r()));
+            }
+        },
+    };
+}
+function buildServer(opts) {
+    const store = new InMemorySubscriptionStore();
+    const purchaseStore = new InMemoryPurchaseStore();
+    const config = {
+        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
+        database: { url: '' },
+        adminSecret: opts.adminSecret,
+    };
+    const app = express();
+    app.use(createOneSubMiddleware({ ...config, store, purchaseStore }));
+    return { store, server: spinUp(app) };
+}
+const SECRET = 's3cr3t';
+const AUTH = { 'x-admin-secret': SECRET };
+// ── auth ────────────────────────────────────────────────────────────────────
+describe('GET /onesub/admin/subscriptions auth', () => {
+    it('returns 404 when adminSecret is unset (router not mounted)', async () => {
+        const { server } = buildServer({});
+        const resp = await server.get('/onesub/admin/subscriptions');
+        expect(resp.status).toBe(404);
+    });
+    it('returns 401 INVALID_ADMIN_SECRET when header is missing or wrong', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const noHeader = await server.get('/onesub/admin/subscriptions');
+        expect(noHeader.status).toBe(401);
+        expect(noHeader.body.errorCode).toBe('INVALID_ADMIN_SECRET');
+        const wrongHeader = await server.get('/onesub/admin/subscriptions', { 'x-admin-secret': 'wrong' });
+        expect(wrongHeader.status).toBe(401);
+    });
+});
+// ── basic listing ───────────────────────────────────────────────────────────
+describe('GET /onesub/admin/subscriptions basics', () => {
+    it('returns empty list with total=0 for an empty store', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions', AUTH);
+        expect(resp.status).toBe(200);
+        expect(resp.body.items).toEqual([]);
+        expect(resp.body.total).toBe(0);
+        expect(resp.body.limit).toBe(50);
+        expect(resp.body.offset).toBe(0);
+    });
+    it('returns all subs when no filter is passed', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'a', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'b', originalTransactionId: 't2' }));
+        await store.save(sub({ userId: 'c', originalTransactionId: 't3' }));
+        const resp = await server.get('/onesub/admin/subscriptions', AUTH);
+        expect(resp.body.total).toBe(3);
+        expect(resp.body.items).toHaveLength(3);
+    });
+});
+// ── filters ─────────────────────────────────────────────────────────────────
+describe('GET /onesub/admin/subscriptions filters', () => {
+    it('filters by userId', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'a', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'b', originalTransactionId: 't2' }));
+        await store.save(sub({ userId: 'a', originalTransactionId: 't3' }));
+        const resp = await server.get('/onesub/admin/subscriptions?userId=a', AUTH);
+        expect(resp.body.total).toBe(2);
+        expect(resp.body.items.every((s) => s.userId === 'a')).toBe(true);
+    });
+    it('filters by status', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'a', status: 'active', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'b', status: 'expired', originalTransactionId: 't2' }));
+        await store.save(sub({ userId: 'c', status: 'active', originalTransactionId: 't3' }));
+        await store.save(sub({ userId: 'd', status: 'paused', originalTransactionId: 't4' }));
+        const active = await server.get('/onesub/admin/subscriptions?status=active', AUTH);
+        expect(active.body.total).toBe(2);
+        const paused = await server.get('/onesub/admin/subscriptions?status=paused', AUTH);
+        expect(paused.body.total).toBe(1);
+    });
+    it('filters by productId + platform combined (AND)', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'a', productId: 'pro_monthly', platform: 'apple', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'b', productId: 'pro_yearly', platform: 'apple', originalTransactionId: 't2' }));
+        await store.save(sub({ userId: 'c', productId: 'pro_monthly', platform: 'google', originalTransactionId: 't3' }));
+        const resp = await server.get('/onesub/admin/subscriptions?productId=pro_monthly&platform=apple', AUTH);
+        expect(resp.body.total).toBe(1);
+        expect(resp.body.items[0].userId).toBe('a');
+    });
+    it('rejects unknown status with 400', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions?status=zombie', AUTH);
+        expect(resp.status).toBe(400);
+    });
+    it('rejects unknown platform with 400', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions?platform=amazon', AUTH);
+        expect(resp.status).toBe(400);
+    });
+});
+// ── pagination ──────────────────────────────────────────────────────────────
+describe('GET /onesub/admin/subscriptions pagination', () => {
+    it('respects limit and offset', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        for (let i = 0; i < 7; i++) {
+            await store.save(sub({ userId: `u${i}`, originalTransactionId: `t${i}` }));
+        }
+        const page1 = await server.get('/onesub/admin/subscriptions?limit=3&offset=0', AUTH);
+        expect(page1.body.items).toHaveLength(3);
+        expect(page1.body.total).toBe(7);
+        expect(page1.body.limit).toBe(3);
+        const page2 = await server.get('/onesub/admin/subscriptions?limit=3&offset=3', AUTH);
+        expect(page2.body.items).toHaveLength(3);
+        expect(page2.body.offset).toBe(3);
+        const page3 = await server.get('/onesub/admin/subscriptions?limit=3&offset=6', AUTH);
+        expect(page3.body.items).toHaveLength(1);
+    });
+    it('caps limit at 200 (zod refuses larger values)', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions?limit=999', AUTH);
+        expect(resp.status).toBe(400);
+    });
+    it('rejects negative offset', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions?offset=-1', AUTH);
+        expect(resp.status).toBe(400);
+    });
+});
+// ── store.listFiltered direct (bypass HTTP) ─────────────────────────────────
+describe('InMemorySubscriptionStore.listFiltered', () => {
+    let store;
+    beforeEach(() => {
+        store = new InMemorySubscriptionStore();
+    });
+    it('combines all four filters with AND semantics', async () => {
+        await store.save(sub({ userId: 'a', productId: 'pro', platform: 'apple', status: 'active', originalTransactionId: 't1' }));
+        await store.save(sub({ userId: 'a', productId: 'pro', platform: 'google', status: 'active', originalTransactionId: 't2' }));
+        await store.save(sub({ userId: 'a', productId: 'pro', platform: 'apple', status: 'expired', originalTransactionId: 't3' }));
+        const result = await store.listFiltered({
+            userId: 'a',
+            productId: 'pro',
+            platform: 'apple',
+            status: 'active',
+        });
+        expect(result.total).toBe(1);
+        expect(result.items[0].originalTransactionId).toBe('t1');
+    });
+    it('defaults to limit=50, offset=0', async () => {
+        await store.save(sub());
+        const result = await store.listFiltered({});
+        expect(result.limit).toBe(50);
+        expect(result.offset).toBe(0);
+    });
+});
+//# sourceMappingURL=admin-list-subscriptions.test.js.map

package/dist/__tests__/admin-list-subscriptions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-list-subscriptions.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-list-subscriptions.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvG,+EAA+E;AAE/E,SAAS,GAAG,CAAC,SAAqC;IAChD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,0BAA0B;QACrC,WAAW,EAAE,0BAA0B;QACvC,qBAAqB,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE;QAC9C,SAAS,EAAE,IAAI;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAMD,SAAS,MAAM,CAAC,OAAwB;IACtC,OAAO;QACL,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAgC;YACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAI,UAAU,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAyD;IAC5E,MAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAuB;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,IAAI,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AAE1C,+EAA+E;AAE/E,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,6BAA6B,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwB,6BAA6B,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,CAClC,6BAA6B,EAC7B,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAC9B,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA4B,6BAA6B,EAAE,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAA4B,6BAA6B,EAAE,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,sCAAsC,EACtC,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEtF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,2CAA2C,EAC3C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,2CAA2C,EAC3C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAElH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,kEAAkE,EAClE,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,2CAA2C,EAC3C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,6CAA6C,EAC7C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,8CAA8C,EAC9C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,8CAA8C,EAC9C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,8CAA8C,EAC9C,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,uCAAuC,EACvC,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,uCAAuC,EACvC,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,IAAI,KAAgC,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3H,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE5H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/admin-subscription-detail.test.js

@@ -0,0 +1,112 @@
+/**
+ * GET /onesub/admin/subscriptions/:transactionId — single-record detail.
+ *
+ * Backs the dashboard's subscription detail page. Same auth contract as the
+ * other /onesub/admin/* endpoints (X-Admin-Secret header).
+ */
+import { describe, it, expect } from 'vitest';
+import express from 'express';
+import { createOneSubMiddleware, InMemorySubscriptionStore, InMemoryPurchaseStore } from '../index.js';
+function sub(overrides) {
+    return {
+        userId: 'u',
+        productId: 'pro_monthly',
+        platform: 'apple',
+        status: 'active',
+        expiresAt: '2099-01-01T00:00:00.000Z',
+        purchasedAt: '2026-04-01T00:00:00.000Z',
+        originalTransactionId: 'orig_default',
+        willRenew: true,
+        ...overrides,
+    };
+}
+function spinUp(handler) {
+    return {
+        async get(path, headers) {
+            const httpServer = handler.listen(0);
+            const port = httpServer.address().port;
+            try {
+                const resp = await fetch(`http://127.0.0.1:${port}${path}`, { headers });
+                const text = await resp.text();
+                let parsed = text;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch { /* keep as text */ }
+                return { status: resp.status, body: parsed };
+            }
+            finally {
+                await new Promise((r) => httpServer.close(() => r()));
+            }
+        },
+    };
+}
+function buildServer(opts) {
+    const store = new InMemorySubscriptionStore();
+    const purchaseStore = new InMemoryPurchaseStore();
+    const config = {
+        apple: { bundleId: 'com.example.app', skipJwsVerification: true },
+        database: { url: '' },
+        adminSecret: opts.adminSecret,
+    };
+    const app = express();
+    app.use(createOneSubMiddleware({ ...config, store, purchaseStore }));
+    return { store, server: spinUp(app) };
+}
+const SECRET = 's3cr3t';
+const AUTH = { 'x-admin-secret': SECRET };
+describe('GET /onesub/admin/subscriptions/:transactionId auth', () => {
+    it('returns 404 when adminSecret is unset (router not mounted)', async () => {
+        const { server } = buildServer({});
+        const resp = await server.get('/onesub/admin/subscriptions/orig_xyz');
+        expect(resp.status).toBe(404);
+    });
+    it('returns 401 INVALID_ADMIN_SECRET when header is missing or wrong', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const noHeader = await server.get('/onesub/admin/subscriptions/orig_xyz');
+        expect(noHeader.status).toBe(401);
+        expect(noHeader.body.errorCode).toBe('INVALID_ADMIN_SECRET');
+        const wrongHeader = await server.get('/onesub/admin/subscriptions/orig_xyz', { 'x-admin-secret': 'wrong' });
+        expect(wrongHeader.status).toBe(401);
+    });
+});
+describe('GET /onesub/admin/subscriptions/:transactionId basics', () => {
+    it('returns the matching subscription', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        const target = sub({ userId: 'alice', originalTransactionId: 'orig_42' });
+        await store.save(target);
+        await store.save(sub({ userId: 'bob', originalTransactionId: 'orig_other' }));
+        const resp = await server.get('/onesub/admin/subscriptions/orig_42', AUTH);
+        expect(resp.status).toBe(200);
+        expect(resp.body.originalTransactionId).toBe('orig_42');
+        expect(resp.body.userId).toBe('alice');
+    });
+    it('returns 404 TRANSACTION_NOT_FOUND when the id is unknown', async () => {
+        const { server } = buildServer({ adminSecret: SECRET });
+        const resp = await server.get('/onesub/admin/subscriptions/orig_does_not_exist', AUTH);
+        expect(resp.status).toBe(404);
+        expect(resp.body.errorCode).toBe('TRANSACTION_NOT_FOUND');
+    });
+    it('does not collide with the list endpoint (no :transactionId)', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({ userId: 'a', originalTransactionId: 'orig_1' }));
+        const list = await server.get('/onesub/admin/subscriptions', AUTH);
+        expect(list.status).toBe(200);
+        expect(list.body.items).toHaveLength(1);
+    });
+    it('preserves Google-only fields (linkedPurchaseToken, autoResumeTime)', async () => {
+        const { store, server } = buildServer({ adminSecret: SECRET });
+        await store.save(sub({
+            platform: 'google',
+            status: 'paused',
+            originalTransactionId: 'orig_google',
+            linkedPurchaseToken: 'prev_token',
+            autoResumeTime: '2026-05-01T00:00:00.000Z',
+        }));
+        const resp = await server.get('/onesub/admin/subscriptions/orig_google', AUTH);
+        expect(resp.status).toBe(200);
+        expect(resp.body.linkedPurchaseToken).toBe('prev_token');
+        expect(resp.body.autoResumeTime).toBe('2026-05-01T00:00:00.000Z');
+    });
+});
+//# sourceMappingURL=admin-subscription-detail.test.js.map

package/dist/__tests__/admin-subscription-detail.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-subscription-detail.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-subscription-detail.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvG,SAAS,GAAG,CAAC,SAAqC;IAChD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,0BAA0B;QACrC,WAAW,EAAE,0BAA0B;QACvC,qBAAqB,EAAE,cAAc;QACrC,SAAS,EAAE,IAAI;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAMD,SAAS,MAAM,CAAC,OAAwB;IACtC,OAAO;QACL,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,OAAgC;YACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAI,UAAU,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAY,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAA8B;IACjD,MAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAuB;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE;QACjE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,IAAI,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AAE1C,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwB,sCAAsC,CAAC,CAAC;QACjG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,CAClC,sCAAsC,EACtC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAC9B,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,qCAAqC,EACrC,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,iDAAiD,EACjD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,6BAA6B,EAC7B,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,qBAAqB,EAAE,aAAa;YACpC,mBAAmB,EAAE,YAAY;YACjC,cAAc,EAAE,0BAA0B;SAC3C,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,yCAAyC,EACzC,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/apple-root-ca.test.js

@@ -0,0 +1,41 @@
+import { X509Certificate } from 'node:crypto';
+import { describe, it, expect } from 'vitest';
+import { APPLE_ROOT_CA_G3_PEM, APPLE_ROOT_CA_PEMS, } from '../providers/apple-root-ca.js';
+/**
+ * Protects against accidental deletion when Apple publishes Root CA G4 and
+ * someone "replaces" G3 instead of appending. StoreKit 2 receipts signed
+ * under the older root must keep validating after G4 ships.
+ */
+describe('Apple Root CA bundle', () => {
+    it('includes at least one root', () => {
+        expect(APPLE_ROOT_CA_PEMS.length).toBeGreaterThan(0);
+    });
+    it('includes G3 verbatim (retained even after G4 is added)', () => {
+        expect(APPLE_ROOT_CA_PEMS).toContain(APPLE_ROOT_CA_G3_PEM);
+    });
+    it('every bundled root is a parseable X.509 certificate', () => {
+        for (const pem of APPLE_ROOT_CA_PEMS) {
+            expect(() => new X509Certificate(pem)).not.toThrow();
+        }
+    });
+    it('every bundled root is currently within its validity window', () => {
+        const now = Date.now();
+        for (const pem of APPLE_ROOT_CA_PEMS) {
+            const cert = new X509Certificate(pem);
+            const notBefore = Date.parse(cert.validFrom);
+            const notAfter = Date.parse(cert.validTo);
+            expect(notBefore).toBeLessThanOrEqual(now);
+            expect(notAfter).toBeGreaterThan(now);
+        }
+    });
+    it('G3 is self-signed by Apple (issuer matches subject)', () => {
+        const cert = new X509Certificate(APPLE_ROOT_CA_G3_PEM);
+        expect(cert.issuer).toBe(cert.subject);
+        expect(cert.subject).toContain('Apple Root CA - G3');
+    });
+    it('no duplicate PEMs in the bundle', () => {
+        const set = new Set(APPLE_ROOT_CA_PEMS);
+        expect(set.size).toBe(APPLE_ROOT_CA_PEMS.length);
+    });
+});
+//# sourceMappingURL=apple-root-ca.test.js.map

package/dist/__tests__/apple-root-ca.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-root-ca.test.js","sourceRoot":"","sources":["../../src/__tests__/apple-root-ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC;;;;GAIG;AACH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}