@onesub/server 0.8.0 → 0.9.1

package/dist/__tests__/fetch-hardening.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Tests for outbound fetch hardening:
+ *   - Apple Server API JWT cache (re-use within TTL, mint dedup under concurrent calls)
+ *   - fetchWithTimeout: AbortController fires when upstream hangs longer than the budget
+ */
+export {};
+//# sourceMappingURL=fetch-hardening.test.d.ts.map

package/dist/__tests__/fetch-hardening.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-hardening.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/fetch-hardening.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/__tests__/fetch-hardening.test.js

@@ -0,0 +1,192 @@
+/**
+ * Tests for outbound fetch hardening:
+ *   - Apple Server API JWT cache (re-use within TTL, mint dedup under concurrent calls)
+ *   - fetchWithTimeout: AbortController fires when upstream hangs longer than the budget
+ */
+import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest';
+import { generateKeyPairSync } from 'crypto';
+import { fetchAppleSubscriptionStatus, __testing as appleTesting } from '../providers/apple.js';
+import { fetchWithTimeout } from '../http.js';
+import { isLocalhostUrl } from './test-utils.js';
+let testEcKey;
+beforeAll(() => {
+    const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    testEcKey = privateKey.export({ type: 'pkcs8', format: 'pem' });
+});
+beforeEach(() => {
+    vi.restoreAllMocks();
+    appleTesting.clearAppleJwtCacheForTests();
+});
+function appleConfig() {
+    return {
+        bundleId: 'com.example.app',
+        skipJwsVerification: true,
+        keyId: 'KEY1',
+        issuerId: 'iss-uuid',
+        privateKey: testEcKey,
+    };
+}
+function makeJws(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256' })).toString('base64url');
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${header}.${body}.fakesig`;
+}
+function statusResponse(orig) {
+    return {
+        bundleId: 'com.example.app',
+        environment: 'Production',
+        data: [{
+                lastTransactions: [{
+                        originalTransactionId: orig,
+                        status: 1,
+                        signedTransactionInfo: makeJws({
+                            bundleId: 'com.example.app',
+                            productId: 'pro_monthly',
+                            transactionId: 'tx',
+                            originalTransactionId: orig,
+                            purchaseDate: Date.now(),
+                            originalPurchaseDate: Date.now(),
+                            expiresDate: Date.now() + 86400000,
+                        }),
+                        signedRenewalInfo: makeJws({ autoRenewStatus: 1 }),
+                    }],
+            }],
+    };
+}
+// ── Apple JWT cache ─────────────────────────────────────────────────────────
+describe('makeAppleApiJwt cache', () => {
+    it('mints a JWT once per cache window when called sequentially', async () => {
+        const originalFetch = global.fetch;
+        const calls = [];
+        vi.spyOn(global, 'fetch').mockImplementation(async (url, init) => {
+            if (isLocalhostUrl(url))
+                return originalFetch(url, init);
+            const headers = init?.headers;
+            calls.push({ url: String(url), auth: headers?.Authorization });
+            return {
+                ok: true,
+                status: 200,
+                json: async () => statusResponse('orig_a'),
+                text: async () => '',
+            };
+        });
+        await fetchAppleSubscriptionStatus('orig_a', appleConfig());
+        await fetchAppleSubscriptionStatus('orig_a', appleConfig());
+        await fetchAppleSubscriptionStatus('orig_a', appleConfig());
+        // 3 outbound API calls, but the Authorization header (Bearer <jwt>) should
+        // be the same JWT in all of them — cache hit on calls 2 and 3.
+        expect(calls).toHaveLength(3);
+        expect(calls[0].auth).toBeDefined();
+        expect(calls[1].auth).toBe(calls[0].auth);
+        expect(calls[2].auth).toBe(calls[0].auth);
+    });
+    it('dedups concurrent JWT mints (single in-flight Promise under burst)', async () => {
+        // Use a real key pair sign spy through jose? Indirect — just count fetch
+        // Authorization headers across many concurrent calls. With dedup, all
+        // share the same JWT.
+        const originalFetch = global.fetch;
+        const auths = [];
+        vi.spyOn(global, 'fetch').mockImplementation(async (url, init) => {
+            if (isLocalhostUrl(url))
+                return originalFetch(url, init);
+            const headers = init?.headers;
+            auths.push(headers?.Authorization ?? '');
+            return {
+                ok: true,
+                status: 200,
+                json: async () => statusResponse('orig_burst'),
+                text: async () => '',
+            };
+        });
+        await Promise.all(Array.from({ length: 10 }, () => fetchAppleSubscriptionStatus('orig_burst', appleConfig())));
+        expect(auths).toHaveLength(10);
+        const unique = new Set(auths);
+        expect(unique.size).toBe(1); // all 10 used the same JWT
+    });
+    it('mints a fresh JWT after the cache is cleared (e.g. credential rotation)', async () => {
+        const originalFetch = global.fetch;
+        const auths = [];
+        vi.spyOn(global, 'fetch').mockImplementation(async (url, init) => {
+            if (isLocalhostUrl(url))
+                return originalFetch(url, init);
+            const headers = init?.headers;
+            auths.push(headers?.Authorization ?? '');
+            return {
+                ok: true,
+                status: 200,
+                json: async () => statusResponse('orig_clear'),
+                text: async () => '',
+            };
+        });
+        await fetchAppleSubscriptionStatus('orig_clear', appleConfig());
+        appleTesting.clearAppleJwtCacheForTests();
+        await fetchAppleSubscriptionStatus('orig_clear', appleConfig());
+        expect(auths).toHaveLength(2);
+        expect(auths[0]).not.toBe(auths[1]); // cache miss → fresh JWT
+    });
+});
+// ── fetchWithTimeout ────────────────────────────────────────────────────────
+describe('fetchWithTimeout', () => {
+    it('returns the response when upstream replies before the timeout', async () => {
+        vi.spyOn(global, 'fetch').mockImplementation(async () => {
+            return { ok: true, status: 200, text: async () => 'hi' };
+        });
+        const resp = await fetchWithTimeout('https://example.com', undefined, 1000);
+        expect(resp.ok).toBe(true);
+    });
+    it('aborts when upstream hangs longer than the timeout', async () => {
+        vi.spyOn(global, 'fetch').mockImplementation((_input, init) => {
+            // Simulate a hung server — never resolves until the AbortController fires
+            return new Promise((_resolve, reject) => {
+                const signal = init?.signal;
+                if (signal) {
+                    signal.addEventListener('abort', () => {
+                        const reason = signal.reason;
+                        reject(reason instanceof Error ? reason : new Error('aborted'));
+                    });
+                }
+            });
+        });
+        const start = Date.now();
+        await expect(fetchWithTimeout('https://hung.example', undefined, 100)).rejects.toThrow(/timed out|aborted/i);
+        const elapsed = Date.now() - start;
+        expect(elapsed).toBeGreaterThanOrEqual(90);
+        expect(elapsed).toBeLessThan(500);
+    });
+    it('respects a caller-provided AbortSignal (composes with timeout)', async () => {
+        vi.spyOn(global, 'fetch').mockImplementation((_input, init) => {
+            return new Promise((_resolve, reject) => {
+                init?.signal?.addEventListener('abort', () => reject(new Error('aborted')));
+            });
+        });
+        const ac = new AbortController();
+        setTimeout(() => ac.abort(new Error('caller cancelled')), 30);
+        await expect(fetchWithTimeout('https://hung.example', { signal: ac.signal }, 5000)).rejects.toThrow();
+    });
+    it('clears its timer on success (no leaked handles)', async () => {
+        vi.spyOn(global, 'fetch').mockImplementation(async () => {
+            return { ok: true, status: 200, text: async () => 'ok' };
+        });
+        // 100s timeout, but resolves immediately. If the timer leaked, vitest
+        // would hold the process open after the test — vitest's `--detectLeaks`
+        // would catch that. Smoke test here is just that the call returns and the
+        // process doesn't hang the test runner.
+        await fetchWithTimeout('https://example.com', undefined, 100_000);
+        // Reaching this line means the timer either fired (it shouldn't) or was
+        // cleared. We can't easily inspect `setTimeout` internals, but the suite
+        // completing in normal time is the implicit assertion.
+        expect(true).toBe(true);
+    });
+    it('uses the default 10s budget when no timeoutMs is passed', async () => {
+        let observedTimeout;
+        vi.spyOn(global, 'fetch').mockImplementation((_input, init) => {
+            // Snapshot any abort behaviour: we can't read the timeout directly,
+            // but we can verify a signal is attached.
+            observedTimeout = init?.signal ? 1 : 0;
+            return Promise.resolve({ ok: true, status: 200, text: async () => '' });
+        });
+        await fetchWithTimeout('https://example.com');
+        expect(observedTimeout).toBe(1); // signal attached → timeout active
+    });
+});
+//# sourceMappingURL=fetch-hardening.test.js.map

package/dist/__tests__/fetch-hardening.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-hardening.test.js","sourceRoot":"","sources":["../../src/__tests__/fetch-hardening.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,4BAA4B,EAAE,SAAS,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAW,MAAM,iBAAiB,CAAC;AAE1D,IAAI,SAAiB,CAAC;AAEtB,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,eAAe,EAAE,CAAC;IACrB,YAAY,CAAC,0BAA0B,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,SAAS,WAAW;IAClB,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,mBAAmB,EAAE,IAAI;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,OAAgC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,CAAC;gBACL,gBAAgB,EAAE,CAAC;wBACjB,qBAAqB,EAAE,IAAI;wBAC3B,MAAM,EAAE,CAAC;wBACT,qBAAqB,EAAE,OAAO,CAAC;4BAC7B,QAAQ,EAAE,iBAAiB;4BAC3B,SAAS,EAAE,aAAa;4BACxB,aAAa,EAAE,IAAI;4BACnB,qBAAqB,EAAE,IAAI;4BAC3B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;4BACxB,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE;4BAChC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;yBACnC,CAAC;wBACF,iBAAiB,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;qBACnD,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QACnC,MAAM,KAAK,GAAqC,EAAE,CAAC;QACnD,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC/D,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,EAAE,OAA6C,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/D,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAC1C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;aACT,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5D,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,yEAAyE;QACzE,sEAAsE;QACtE,sBAAsB;QACtB,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC/D,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,EAAE,OAA6C,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC;gBAC9C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;aACT,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,4BAA4B,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAC5F,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,2BAA2B;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC/D,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,EAAE,OAA6C,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC;gBAC9C,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;aACT,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,4BAA4B,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,YAAY,CAAC,0BAA0B,EAAE,CAAC;QAC1C,MAAM,4BAA4B,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAEhE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,yBAAyB;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAc,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5D,0EAA0E;YAC1E,OAAO,IAAI,OAAO,CAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAChD,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;wBACpC,MAAM,MAAM,GAAI,MAA6C,CAAC,MAAM,CAAC;wBACrE,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAClE,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5D,OAAO,IAAI,OAAO,CAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAChD,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,gBAAgB,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CACtE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAc,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,IAAI,eAAmC,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5D,oEAAoE;YACpE,0CAA0C;YAC1C,eAAe,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAc,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QAC9C,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,mCAAmC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/lifecycle-scenarios.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * End-to-end lifecycle scenarios — exercise multi-notification sequences against
+ * the real webhook router + status route + stores, the way Apple/Google would
+ * deliver them in production.
+ *
+ * Single-notification correctness is covered by the per-feature unit tests; this
+ * file catches issues that only show up when notifications arrive in a sequence:
+ * stale state bleeding across transitions, idempotency under replay, recovery
+ * paths after a missed webhook, etc.
+ *
+ * Why scenarios instead of more unit tests:
+ *   - The webhook handler has many branches (per-notification mapping, fresh
+ *     re-fetch, refundPolicy gating, hooks). Each is unit-tested in isolation,
+ *     but a transition like SUBSCRIBED → DID_FAIL_TO_RENEW(GRACE) → DID_RENEW
+ *     touches three of those branches in turn — a regression in any one only
+ *     surfaces when run together.
+ *   - These scenarios mirror the runbook for sandbox verification, so the
+ *     mock results here can be cross-checked against real sandbox behaviour.
+ */
+export {};
+//# sourceMappingURL=lifecycle-scenarios.test.d.ts.map

package/dist/__tests__/lifecycle-scenarios.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-scenarios.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/lifecycle-scenarios.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}