@base44-preview/sdk 0.8.46-pr.275.68973a5 → 0.8.46-pr.276.702f602

package/dist/actor.d.ts

@@ -6,12 +6,12 @@
  *   export class MyActor extends Actor { ... }
  *
  * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation. This file provides types only.
+ * Cloudflare Durable Object implementation — this file provides types only.
  */
 import type { Base44Client } from "./client";
 /**
  * A single client connection. `Send` is the message type this connection accepts
- * via {@link send}, the actor's *outgoing* (server→client) messages.
+ * via {@link send} — the actor's *outgoing* (server→client) messages.
  */
 export interface Conn<Send = unknown> {
     /** Unique per-connection id (one per socket/tab), the same value the client
@@ -33,9 +33,9 @@ export interface Storage {
  * Base class for an Actor.
  *
  * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`), the schema's `toServer` section.
+ *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
  * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`), the schema's `toClient` section.
+ *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
  *
  * With a generated `schema.jsonc`, wire both from the registry so they can't drift
  * from the client's types:
@@ -51,7 +51,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     abstract handleTick(): void | Promise<void>;
     /**
      * Optional wake hook: runs once when the instance starts, before any
-     * connection is handled. It is safe to load persisted state here.
+     * connection is handled — safe to load persisted state here.
      */
     handleStart(): void | Promise<void>;
     /**
@@ -71,7 +71,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     /**
      * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
      * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-     * and stops (letting the Durable Object hibernate at no compute cost) when it
+     * and stops (letting the Durable Object hibernate — no compute cost) when it
      * returns false. The platform owns scheduling, rescheduling, self-heal, and
      * error-safety.
      *
@@ -85,7 +85,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     protected get instanceId(): string;
     protected get storage(): Storage;
     /**
-     * Anonymous Base44 client scoped to this actor instance, with no user or service
+     * Anonymous Base44 client scoped to this actor instance — no user or service
      * auth, so entity access is RLS-gated (same as a logged-out visitor). Always
      * operates on production data: an actor runs server-side with no per-connection
      * identity, so a Test DB preview selected in the editor does not apply here.

package/dist/actor.js

@@ -6,15 +6,15 @@
  *   export class MyActor extends Actor { ... }
  *
  * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation. This file provides types only.
+ * Cloudflare Durable Object implementation — this file provides types only.
  */
 /**
  * Base class for an Actor.
  *
  * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`), the schema's `toServer` section.
+ *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
  * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`), the schema's `toClient` section.
+ *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
  *
  * With a generated `schema.jsonc`, wire both from the registry so they can't drift
  * from the client's types:
@@ -28,7 +28,7 @@ export class Actor {
         /**
          * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
          * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-         * and stops (letting the Durable Object hibernate at no compute cost) when it
+         * and stops (letting the Durable Object hibernate — no compute cost) when it
          * returns false. The platform owns scheduling, rescheduling, self-heal, and
          * error-safety.
          *
@@ -39,7 +39,7 @@ export class Actor {
     }
     /**
      * Optional wake hook: runs once when the instance starts, before any
-     * connection is handled. It is safe to load persisted state here.
+     * connection is handled — safe to load persisted state here.
      */
     handleStart() { }
     /**
@@ -73,7 +73,7 @@ export class Actor {
         throw new Error("Actor.storage is only available inside a deployed actor");
     }
     /**
-     * Anonymous Base44 client scoped to this actor instance, with no user or service
+     * Anonymous Base44 client scoped to this actor instance — no user or service
      * auth, so entity access is RLS-gated (same as a logged-out visitor). Always
      * operates on production data: an actor runs server-side with no per-connection
      * identity, so a Test DB preview selected in the editor does not apply here.

package/dist/client.js

@@ -113,7 +113,7 @@ export function createClient(config) {
     });
     // Dedicated client for actor connection-token mints: no onError (a legacy
     // actor answers every mint with an expected 409 before the proxy fallback,
-    // which must not reach the app's error handler; the actors module forwards
+    // which must not reach the app's error handler — the actors module forwards
     // genuine failures itself via onMintError) and no constructor token
     // (auth is per-request so a login/logout is picked up on every reconnect).
     const actorsAxiosClient = createAxiosClient({

package/dist/client.types.d.ts

@@ -18,14 +18,14 @@ export interface CreateClientOptions {
      * Optional error handler that will be called whenever an API error occurs.
      *
      * Also receives {@link ActorsModule | actors} connection failures. Errors
-     * are usually {@linkcode Base44Error} instances, so check `error.status`.
+     * are usually {@linkcode Base44Error} instances — check `error.status`.
      */
     onError?: (error: Error) => void;
     /**
      * Forces the actors transport. `"auto"` (default) connects directly to the
      * actor and falls back to the platform proxy when the app's actors don't
      * support direct connections; `"proxy"` always uses the platform proxy
-     * (ops rollback, with no connection-token calls); `"direct"` disables the
+     * (ops rollback — no connection-token calls); `"direct"` disables the
      * fallback (validation environments).
      * @internal
      */

package/dist/iap/account-token.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The namespace every Base44 in-app purchase account token is derived under.
+ *
+ * A fixed, arbitrary version-4 UUID. It must never change: the native shell
+ * derives the same value independently, and Apple has already signed the
+ * results into transactions that will keep renewing.
+ */
+export declare const IAP_APP_ACCOUNT_TOKEN_NAMESPACE = "8f2b6a1e-4c5d-4e7a-9b3f-6d1a2c8e5f04";
+/**
+ * Derives the account token for a Base44 user id.
+ *
+ * @throws {TypeError} when the user id is empty.
+ */
+export declare function appAccountTokenFor(base44UserId: string): string;

package/dist/iap/account-token.js

@@ -0,0 +1,43 @@
+/**
+ * Mapping a Base44 user to the UUID Apple signs into their purchases.
+ *
+ * StoreKit accepts a UUID at purchase time (`appAccountToken`) and Apple
+ * returns the same value in every resulting transaction — including renewals
+ * years later. That signed round trip is the entire attribution mechanism: it
+ * is the only way to know whose purchase a transaction is, without trusting
+ * anything the client claims.
+ *
+ * The mapping is a deterministic version-5 UUID of the user id under a fixed
+ * namespace, so it is a pure function. The shell, the web app and the backend
+ * all derive the same UUID from the same user id with no lookup table to keep
+ * in sync, and nothing to migrate.
+ *
+ * Two consequences worth knowing:
+ *
+ * - The namespace is part of the contract. Changing it orphans every purchase
+ *   already attributed under the old one.
+ * - The mapping is one-way in practice. Recovering a user id means deriving
+ *   the UUID for a candidate user and comparing, not inverting the hash.
+ *
+ * @internal
+ */
+import { v5 as uuidv5 } from "uuid";
+/**
+ * The namespace every Base44 in-app purchase account token is derived under.
+ *
+ * A fixed, arbitrary version-4 UUID. It must never change: the native shell
+ * derives the same value independently, and Apple has already signed the
+ * results into transactions that will keep renewing.
+ */
+export const IAP_APP_ACCOUNT_TOKEN_NAMESPACE = "8f2b6a1e-4c5d-4e7a-9b3f-6d1a2c8e5f04";
+/**
+ * Derives the account token for a Base44 user id.
+ *
+ * @throws {TypeError} when the user id is empty.
+ */
+export function appAccountTokenFor(base44UserId) {
+    if (typeof base44UserId !== "string" || base44UserId.length === 0) {
+        throw new TypeError("a Base44 user id is required to derive an account token");
+    }
+    return uuidv5(base44UserId, IAP_APP_ACCOUNT_TOKEN_NAMESPACE);
+}

package/dist/iap/config.d.ts

@@ -0,0 +1,19 @@
+import type { IapConfig, IapProductConfig } from "./iap.types.js";
+import type { IapServerApiConfig } from "./server-api/server-api.types.js";
+/** A validated configuration, with every default filled in. */
+export interface ResolvedIapConfig {
+    readonly bundleId: string;
+    readonly appAppleId: number;
+    readonly products: Readonly<Record<string, IapProductConfig>>;
+    readonly testMode: boolean;
+    readonly allowLocalTesting: boolean;
+    readonly serverApi?: IapServerApiConfig;
+    readonly verifier: "apple" | "builtin";
+}
+/**
+ * Validates a configuration and fills in defaults.
+ *
+ * @throws {IapConfigError} `IAP_INVALID_CONFIG` for anything malformed, or
+ * `IAP_ONLINE_CHECKS_UNSUPPORTED` when online certificate checks are asked for.
+ */
+export declare function resolveConfig(config: IapConfig): ResolvedIapConfig;

package/dist/iap/config.js

@@ -0,0 +1,105 @@
+/**
+ * Configuration validation.
+ *
+ * Runs once, when the client is created, and refuses to build a client it
+ * cannot operate correctly. Failing at deploy time is the whole point: the
+ * alternative is discovering a missing `appAppleId` when Apple sends the first
+ * refund notification.
+ *
+ * @internal
+ */
+import { IapConfigError } from "./errors.js";
+const PRODUCT_TYPES = new Set([
+    "consumable",
+    "nonConsumable",
+    "nonRenewingSubscription",
+    "autoRenewableSubscription",
+]);
+function invalid(message) {
+    throw new IapConfigError("IAP_INVALID_CONFIG", message);
+}
+/**
+ * Validates a configuration and fills in defaults.
+ *
+ * @throws {IapConfigError} `IAP_INVALID_CONFIG` for anything malformed, or
+ * `IAP_ONLINE_CHECKS_UNSUPPORTED` when online certificate checks are asked for.
+ */
+export function resolveConfig(config) {
+    var _a, _b;
+    if (!config || typeof config !== "object") {
+        invalid("an in-app purchase configuration object is required");
+    }
+    if (typeof config.bundleId !== "string" || config.bundleId.trim().length === 0) {
+        invalid("'bundleId' is required, e.g. \"com.example.app\"");
+    }
+    // A very common mix-up: passing the bundle id where the numeric id belongs.
+    if (typeof config.appAppleId === "string") {
+        invalid("'appAppleId' must be a number — the numeric App Store id from App Store " +
+            "Connect under App Information, not the bundle id");
+    }
+    if (typeof config.appAppleId !== "number" ||
+        !Number.isInteger(config.appAppleId) ||
+        config.appAppleId <= 0) {
+        invalid("'appAppleId' must be a positive integer, e.g. 1234567890");
+    }
+    if (!config.products || typeof config.products !== "object") {
+        invalid("'products' is required, keyed by product identifier");
+    }
+    for (const [productId, product] of Object.entries(config.products)) {
+        if (!product || typeof product !== "object") {
+            invalid(`product ${JSON.stringify(productId)} must be an object`);
+        }
+        if (!PRODUCT_TYPES.has(product.type)) {
+            invalid(`product ${JSON.stringify(productId)} has type ${JSON.stringify(product.type)}; expected one of ${[...PRODUCT_TYPES].join(", ")}`);
+        }
+        // Apple never expires a non-renewing subscription, so this number is the
+        // only thing that decides when access ends. Missing it would silently
+        // grant the product forever.
+        if (product.type === "nonRenewingSubscription") {
+            const days = product.nonRenewingDurationDays;
+            if (typeof days !== "number" || !Number.isFinite(days) || days <= 0) {
+                invalid(`product ${JSON.stringify(productId)} is a nonRenewingSubscription, so it ` +
+                    "needs 'nonRenewingDurationDays' — Apple does not expire these, so the " +
+                    "app decides how long they last");
+            }
+        }
+    }
+    // `null` is treated as absent, not as invalid: a secret that was never set
+    // arrives that way, and the right answer then is "the API is not configured"
+    // — which the call itself reports clearly — rather than refusing to start.
+    if (config.verifier !== undefined &&
+        config.verifier !== "apple" &&
+        config.verifier !== "builtin") {
+        invalid(`'verifier' must be "apple" or "builtin"; got ${JSON.stringify(config.verifier)}`);
+    }
+    if (config.serverApi !== undefined && config.serverApi !== null) {
+        const api = config.serverApi;
+        if (typeof api !== "object") {
+            invalid("'serverApi' must be an object, or left out entirely");
+        }
+        for (const field of ["keyId", "issuerId", "privateKeyP8"]) {
+            if (typeof api[field] !== "string" || api[field].trim().length === 0) {
+                invalid(`'serverApi.${field}' is required when serverApi is supplied`);
+            }
+        }
+        if (!api.privateKeyP8.includes("PRIVATE KEY")) {
+            invalid("'serverApi.privateKeyP8' does not look like a .p8 file. Pass its whole " +
+                "contents, including the BEGIN and END lines.");
+        }
+    }
+    if (config.onlineChecks === true) {
+        throw new IapConfigError("IAP_ONLINE_CHECKS_UNSUPPORTED", "'onlineChecks' asks for certificate revocation lookups, which this version " +
+            "does not implement. Leave it unset. Certificate validity is evaluated at " +
+            "each payload's own signedDate, which is what Apple's own library does with " +
+            "online checks off.");
+    }
+    return {
+        bundleId: config.bundleId,
+        appAppleId: config.appAppleId,
+        products: { ...config.products },
+        testMode: config.testMode === true,
+        allowLocalTesting: config.allowLocalTesting === true,
+        serverApi: (_a = config.serverApi) !== null && _a !== void 0 ? _a : undefined,
+        verifier: (_b = config.verifier) !== null && _b !== void 0 ? _b : "apple",
+    };
+}

package/dist/iap/errors.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Error classes for the in-app purchase module.
+ *
+ * Each class carries a `code` from `errors.types.ts`. Nothing here imports the
+ * runtime helpers, so the runtime layer can throw these freely.
+ *
+ * @internal
+ */
+import type { IapApiErrorCode, IapConfigErrorCode, IapSetupErrorCode, IapStoreErrorCode, IapVerificationErrorCode } from "./errors.types.js";
+/** Base class, so a caller can catch every error this module raises at once. */
+export declare class IapError extends Error {
+    /** Stable machine-readable code. */
+    readonly code: string;
+    constructor(code: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * A signed Apple token was rejected.
+ *
+ * Deny by default: anything that raises this must be treated as "not
+ * entitled", never as "probably fine".
+ */
+export declare class IapVerificationError extends IapError {
+    readonly code: IapVerificationErrorCode;
+    constructor(code: IapVerificationErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** The module cannot start, or was asked for something its configuration does not allow. */
+export declare class IapConfigError extends IapError {
+    readonly code: IapConfigErrorCode;
+    constructor(code: IapConfigErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The app's Base44 setup is not usable — an entity is missing, or its schema
+ * has drifted from what the SDK writes.
+ *
+ * This is loud on purpose. A silently dropped field means purchase data is
+ * being lost, which is worse than an outage.
+ */
+export declare class IapSetupError extends IapError {
+    readonly code: IapSetupErrorCode;
+    /** The entity the problem was found on. */
+    readonly entityName?: string;
+    /** Fields the entity dropped, when the code is `IAP_ENTITY_SCHEMA_DRIFT`. */
+    readonly missingFields?: string[];
+    constructor(code: IapSetupErrorCode, message: string, details?: {
+        entityName?: string;
+        missingFields?: string[];
+        cause?: unknown;
+    });
+}
+/** A read or write against the app's entities failed. */
+export declare class IapStoreError extends IapError {
+    readonly code: IapStoreErrorCode;
+    /** The entity being read or written. */
+    readonly entityName?: string;
+    constructor(code: IapStoreErrorCode, message: string, details?: {
+        entityName?: string;
+        cause?: unknown;
+    });
+}
+/** An App Store Server API call failed. */
+export declare class IapApiError extends IapError {
+    readonly code: IapApiErrorCode;
+    /** The HTTP status Apple returned. */
+    readonly httpStatus?: number;
+    /** Apple's own numeric error code from the response body, e.g. `4040010`. */
+    readonly appleErrorCode?: number;
+    /** Apple's own error message from the response body. */
+    readonly appleErrorMessage?: string;
+    /**
+     * When rate-limited: the value of Apple's `Retry-After` header.
+     *
+     * Apple sends an **absolute UNIX millisecond timestamp** here, not a delay.
+     * Compare it against `Date.now()`; do not use it as a duration.
+     */
+    readonly retryAfter?: number;
+    constructor(code: IapApiErrorCode, message: string, details?: {
+        httpStatus?: number;
+        appleErrorCode?: number;
+        appleErrorMessage?: string;
+        retryAfter?: number;
+        cause?: unknown;
+    });
+}

package/dist/iap/errors.js

@@ -0,0 +1,66 @@
+/** Base class, so a caller can catch every error this module raises at once. */
+export class IapError extends Error {
+    constructor(code, message, options) {
+        super(message);
+        this.name = "IapError";
+        this.code = code;
+        // `cause` is set by hand rather than passed to super: the emit target is
+        // es2018, whose Error constructor takes no options bag.
+        if (options && "cause" in options) {
+            this.cause = options.cause;
+        }
+    }
+}
+/**
+ * A signed Apple token was rejected.
+ *
+ * Deny by default: anything that raises this must be treated as "not
+ * entitled", never as "probably fine".
+ */
+export class IapVerificationError extends IapError {
+    constructor(code, message, options) {
+        super(code, message, options);
+        this.name = "IapVerificationError";
+    }
+}
+/** The module cannot start, or was asked for something its configuration does not allow. */
+export class IapConfigError extends IapError {
+    constructor(code, message, options) {
+        super(code, message, options);
+        this.name = "IapConfigError";
+    }
+}
+/**
+ * The app's Base44 setup is not usable — an entity is missing, or its schema
+ * has drifted from what the SDK writes.
+ *
+ * This is loud on purpose. A silently dropped field means purchase data is
+ * being lost, which is worse than an outage.
+ */
+export class IapSetupError extends IapError {
+    constructor(code, message, details) {
+        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
+        this.name = "IapSetupError";
+        this.entityName = details === null || details === void 0 ? void 0 : details.entityName;
+        this.missingFields = details === null || details === void 0 ? void 0 : details.missingFields;
+    }
+}
+/** A read or write against the app's entities failed. */
+export class IapStoreError extends IapError {
+    constructor(code, message, details) {
+        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
+        this.name = "IapStoreError";
+        this.entityName = details === null || details === void 0 ? void 0 : details.entityName;
+    }
+}
+/** An App Store Server API call failed. */
+export class IapApiError extends IapError {
+    constructor(code, message, details) {
+        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
+        this.name = "IapApiError";
+        this.httpStatus = details === null || details === void 0 ? void 0 : details.httpStatus;
+        this.appleErrorCode = details === null || details === void 0 ? void 0 : details.appleErrorCode;
+        this.appleErrorMessage = details === null || details === void 0 ? void 0 : details.appleErrorMessage;
+        this.retryAfter = details === null || details === void 0 ? void 0 : details.retryAfter;
+    }
+}

package/dist/iap/errors.types.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Error codes the in-app purchase module can raise.
+ *
+ * Every code is a stable string. Generated code and support tooling branch on
+ * these, so a code is never renamed — a new situation gets a new code.
+ */
+/**
+ * Why a signed Apple token was rejected.
+ *
+ * The first eight come straight from the verification algorithm Apple
+ * describes; the last two are this SDK's own.
+ */
+export type IapVerificationErrorCode = 
+/** The token is not three base64url segments separated by dots. */
+"INVALID_JWS_FORMAT"
+/** The JWS header named an algorithm other than `ES256`. */
+ | "UNSUPPORTED_ALG"
+/** The `x5c` header did not carry exactly three certificates. */
+ | "INVALID_CHAIN_LENGTH"
+/** A certificate failed to parse, was outside its validity window, or lacked a required marker. */
+ | "INVALID_CERTIFICATE"
+/** A certificate was revoked. Only reachable with online checks, which v1 does not support. */
+ | "CERTIFICATE_REVOKED"
+/** The signature did not verify against the leaf certificate's public key. */
+ | "INVALID_SIGNATURE"
+/** The payload's `bundleId`, or its `appAppleId` in production, did not match the configuration. */
+ | "INVALID_APP_IDENTIFIER"
+/** The payload's `environment` was not one this app accepts. */
+ | "INVALID_ENVIRONMENT"
+/** A transient failure. Retrying may succeed. */
+ | "RETRYABLE_VERIFICATION_FAILURE"
+/**
+ * The chain anchored at a root this SDK cannot verify against — an RSA root.
+ *
+ * Current App Store tokens chain to Apple Root CA - G3, which is ECDSA
+ * P-384. Apple Root CA - G2 and Apple Inc. Root are RSA and are pinned for
+ * completeness, but v1 verifies ECDSA signatures only. This is never
+ * downgraded to a pass.
+ */
+ | "UNSUPPORTED_CERT_ALGORITHM";
+/** Why the module refused to start, or could not use its configuration. */
+export type IapConfigErrorCode = 
+/** A required configuration field was missing or malformed. */
+"IAP_INVALID_CONFIG"
+/** `onlineChecks: true` was requested. Certificate revocation lookups are not implemented in v1. */
+ | "IAP_ONLINE_CHECKS_UNSUPPORTED"
+/** The runtime has no WebCrypto. Needs Deno, Node 18 or later, or a secure browser context. */
+ | "IAP_WEBCRYPTO_UNAVAILABLE"
+/** The runtime has no `fetch`. Needs Deno, Node 18 or later, or a browser. */
+ | "IAP_FETCH_UNAVAILABLE"
+/** An App Store Server API call was made without `serverApi` credentials configured. */
+ | "IAP_SERVER_API_NOT_CONFIGURED";
+/** Why the app's own Base44 setup is not usable for in-app purchases. */
+export type IapSetupErrorCode = 
+/** One of the four required entities does not exist in this app. */
+"IAP_ENTITY_MISSING"
+/** An entity exists but silently dropped a field the SDK wrote. Its schema has drifted. */
+ | "IAP_ENTITY_SCHEMA_DRIFT"
+/** The client was created without service-role credentials, so it cannot write. */
+ | "IAP_SERVICE_ROLE_REQUIRED";
+/** Why a read or write against the app's entities failed. */
+export type IapStoreErrorCode = 
+/** The write did not land. Callers must not report success to Apple or finish a transaction. */
+"IAP_WRITE_FAILED"
+/** The read did not complete. */
+ | "IAP_READ_FAILED";
+/** Why an App Store Server API call failed. */
+export type IapApiErrorCode = 
+/** Apple answered with an error status. Inspect `appleErrorCode` for which. */
+"IAP_API_ERROR"
+/** Apple rate-limited the call. `retryAfter` carries the absolute timestamp to retry after. */
+ | "IAP_API_RATE_LIMITED"
+/** The transaction id exists in neither the production nor the sandbox environment. */
+ | "IAP_API_TRANSACTION_NOT_FOUND";

package/dist/iap/errors.types.js

@@ -0,0 +1,7 @@
+/**
+ * Error codes the in-app purchase module can raise.
+ *
+ * Every code is a stable string. Generated code and support tooling branch on
+ * these, so a code is never renamed — a new situation gets a new code.
+ */
+export {};

package/dist/iap/events/emitter.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Delivering events to the app's handlers.
+ *
+ * Two rules, both about not letting an app's own code break Apple's contract:
+ *
+ * 1. **A handler runs after the write, never before.** An event means the data
+ *    behind it is already stored.
+ * 2. **A handler can never change the outcome.** If one throws, the throw is
+ *    swallowed and reported; the HTTP response Apple sees is unaffected.
+ *
+ * Events are dispatched *synchronously* before the response is returned, not
+ * after it. A Base44 backend function has no way to run work once it has
+ * answered — there is no `waitUntil` — so anything deferred until after the
+ * response is simply lost when the isolate stops.
+ *
+ * @internal
+ */
+import type { IapEvent, IapEventHandler } from "./events.types.js";
+/** Reports a handler that threw. Defaults to a single console line. */
+export type IapHandlerFailureReporter = (event: IapEvent, error: unknown) => void;
+/** The event bus for one client. */
+export interface IapEmitter {
+    /** Registers a handler. Returns a function that removes it. */
+    onEvent(handler: IapEventHandler): () => void;
+    /** Delivers events to every handler, swallowing their failures. */
+    emit(events: readonly IapEvent[]): Promise<void>;
+}
+export declare function createEmitter(reportFailure?: IapHandlerFailureReporter): IapEmitter;

package/dist/iap/events/emitter.js

@@ -0,0 +1,33 @@
+function defaultReporter(event, error) {
+    // Deliberately one line and not re-thrown. A broken handler must not take
+    // the webhook down with it, and it must not be silent either.
+    console.error(`[base44 iap] an onEvent handler failed for ${event.type}:`, error instanceof Error ? error.message : error);
+}
+export function createEmitter(reportFailure = defaultReporter) {
+    const handlers = new Set();
+    return {
+        onEvent(handler) {
+            handlers.add(handler);
+            return () => {
+                handlers.delete(handler);
+            };
+        },
+        async emit(events) {
+            if (handlers.size === 0 || events.length === 0)
+                return;
+            // A snapshot, so a handler that registers another one during dispatch
+            // does not change what this round delivers.
+            const current = [...handlers];
+            for (const event of events) {
+                for (const handler of current) {
+                    try {
+                        await handler(event);
+                    }
+                    catch (error) {
+                        reportFailure(event, error);
+                    }
+                }
+            }
+        },
+    };
+}