@base44-preview/sdk 0.8.46-pr.276.f98c3b7 → 0.8.46-pr.277.5cc15f3

package/dist/client.js

@@ -5,6 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
+import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -260,6 +261,8 @@ export function createClient(config) {
     // Assemble and return the client
     const client = {
         ...userModules,
+        /** See {@link Base44Client.fetchWithAuth}. */
+        fetchWithAuth: createFetchWithAuth(axiosClient),
         /**
          * Sets a new authentication token for all subsequent requests.
          *

package/dist/client.types.d.ts

@@ -139,6 +139,44 @@ export interface Base44Client {
     integrations: IntegrationsModule;
     /** Cleanup function to disconnect WebSocket connections. Call when you're done with the client. */
     cleanup: () => void;
+    /**
+     * Calls one of your app's own server routes with the signed-in user's access token attached.
+     *
+     * Base44 keeps the user's access token in the browser's local storage, so a plain `fetch()` to your app's server routes arrives without it and the route sees an anonymous caller. `fetchWithAuth()` is the same `fetch()` with the `Authorization: Bearer <token>` header added, which is what lets a server route act on behalf of the signed-in user.
+     *
+     * Requests are restricted to your app's own origin so the token is never sent to a third party: pass a relative path beginning with a single `/`, such as `/api/orders`. An absolute URL, a protocol-relative `//host`, or anything else that a URL parser would read as another origin throws. To call a Base44 backend function, use {@linkcode FunctionsModule.fetch | functions.fetch()}; for another origin, use plain `fetch()`.
+     *
+     * The path is passed to `fetch` unchanged, so this also works in server code, where the runtime's `fetch` decides what a relative path means — a server-side client from {@linkcode createClientFromRequest | createClientFromRequest()} carries the caller's own token. Note that only the `Authorization` header is added: a route that builds its own client from the incoming request also needs the platform's `Base44-App-Id` and `Base44-Api-Url`, which a request you construct yourself does not have.
+     *
+     * When no user is signed in the request is sent without an `Authorization` header, so routes that allow anonymous access keep working.
+     *
+     * @param path - A relative path on your app's own origin, such as `/api/orders`.
+     * @param init - Optional [`RequestInit`](https://developer.mozilla.org/en-US/docs/Web/API/RequestInit) options such as `method`, `headers`, `body`, and `signal`. The auth header is added automatically; an `Authorization` header you set yourself is kept.
+     * @returns Promise resolving to a native [`Response`](https://developer.mozilla.org/en-US/docs/Web/API/Response).
+     * @throws {Error} When `path` is not a relative path on your app's own origin.
+     *
+     * @example
+     * ```typescript
+     * // Call your app's own server route as the signed-in user
+     * const response = await base44.fetchWithAuth('/api/orders');
+     * const orders = await response.json();
+     * ```
+     *
+     * @example
+     * ```typescript
+     * // POST with a JSON body
+     * const response = await base44.fetchWithAuth('/api/orders', {
+     *   method: 'POST',
+     *   headers: { 'Content-Type': 'application/json' },
+     *   body: JSON.stringify({ productId: 'abc', quantity: 2 }),
+     * });
+     *
+     * if (!response.ok) {
+     *   throw new Error(`Request failed: ${response.status}`);
+     * }
+     * ```
+     */
+    fetchWithAuth(path: string, init?: RequestInit): Promise<Response>;
     /**
      * Sets a new authentication token for all subsequent requests.
      *

package/dist/index.d.ts

@@ -18,14 +18,3 @@ export { Actor, type Conn } from "./actor.js";
 export type { ConnectorsModule, UserConnectorsModule, ConnectorApiRequest, ConnectorApiResponse, ConnectorApiResponsePhase, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";
-export type { CreateIapClientOptions, IapInternalOptions, } from "./iap/index.js";
-export type { IapConfig, IapConfiguredProductType, IapModule, IapProductConfig, IapSetupReport, } from "./iap/iap.types.js";
-export type { IapEvent, IapEventHandler, IapEventType, IapExpiryReason, IapRenewReason, IapStartReason, } from "./iap/events/events.types.js";
-export type { EntitlementQuery, Entitlements, IapExpirationReason, IapRevocation, IapSubscriptionOffer, IapSubscriptionStatus, OwnedNonConsumable, OwnedNonRenewingSubscription, SubscriptionQuery, SubscriptionState, TransactionQuery, } from "./iap/read/read.types.js";
-export type { HandleNotificationResult } from "./iap/ingest/notifications.js";
-export type { RecordTransactionOptions, RecordTransactionResult, SyncPayload, SyncResult, } from "./iap/ingest/device.types.js";
-export type { IapConsumptionOutcome, IapConsumptionRequestRecord, IapNotificationOutcome, IapNotificationRecord, IapRecordSource, IapSubscriptionRecord, IapTransactionRecord, } from "./iap/store/rows.types.js";
-export type { IapEntityName, IapEntitySchema, IapSchemaField, } from "./iap/store/schemas.js";
-export type { ConsumptionRequestBody, IapDeliveryStatus, IapRefundPreference, IapServerApiConfig, IapServerApiModule, SendAttempt, SendAttemptResult, TestNotificationResult, TestNotificationStatus, } from "./iap/server-api/server-api.types.js";
-export type { IapApiErrorCode, IapConfigErrorCode, IapSetupErrorCode, IapStoreErrorCode, IapVerificationErrorCode, } from "./iap/errors.types.js";
-export type { DecodedNotification, DecodedNotificationData, DecodedNotificationSummary, DecodedRenewalInfo, DecodedTransaction, IapAppleSubscriptionStatus, IapConsumptionRequestReason, IapEnvironment, IapExpirationIntent, IapOfferDiscountType, IapOfferType, IapOwnershipType, IapProductType, IapRevocationType, IapTransactionReason, } from "./iap/verify/verify.types.js";

package/dist/utils/fetch-with-auth.d.ts

@@ -0,0 +1,12 @@
+import type { AxiosInstance } from "axios";
+/**
+ * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
+ * user's access token to a request for the app's own origin.
+ *
+ * @param axios - The user-scoped axios instance. Its `Authorization` default is
+ * the live token: it follows `setToken()` and is deleted on `logout()`, so a
+ * request never carries a token the user no longer has. In a server-side client
+ * from `createClientFromRequest()` it holds the caller's own token.
+ * @internal
+ */
+export declare function createFetchWithAuth(axios: AxiosInstance): (path: string, init?: RequestInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -0,0 +1,49 @@
+/**
+ * Builds the client's `fetchWithAuth`: a `fetch` that attaches the signed-in
+ * user's access token to a request for the app's own origin.
+ *
+ * @param axios - The user-scoped axios instance. Its `Authorization` default is
+ * the live token: it follows `setToken()` and is deleted on `logout()`, so a
+ * request never carries a token the user no longer has. In a server-side client
+ * from `createClientFromRequest()` it holds the caller's own token.
+ * @internal
+ */
+export function createFetchWithAuth(axios) {
+    const currentToken = () => {
+        const header = axios.defaults.headers.common["Authorization"];
+        if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+            return null;
+        }
+        return header.slice("Bearer ".length) || null;
+    };
+    return async function fetchWithAuth(path, init = {}) {
+        assertOwnOriginPath(path);
+        const headers = new Headers(init.headers);
+        const token = currentToken();
+        if (token && !headers.has("Authorization")) {
+            headers.set("Authorization", `Bearer ${token}`);
+        }
+        // Passed through untouched: resolving it here would need a document, and a
+        // root-relative path is already what a runtime that dispatches in-process
+        // (Nitro's `fetch`) expects.
+        return fetch(path, { ...init, headers });
+    };
+}
+function assertOwnOriginPath(path) {
+    if (typeof path !== "string" || path === "") {
+        throw new Error("fetchWithAuth() requires a path, such as '/api/orders'.");
+    }
+    // Check what a URL parser would see, not the raw string: it drops every ASCII
+    // tab/newline anywhere in the input and trims leading C0/space, so
+    // "/<tab>/evil.example" would pass a naive prefix check and then resolve to
+    // another host.
+    const asParsed = path.replace(/[\t\n\r]/g, "").replace(/^[\x00-\x20]+/, "");
+    // One leading slash is the whole rule: it cannot carry a scheme, and it rules
+    // out the two forms that reach another origin — "//host" and, since URL
+    // parsing treats a backslash as a slash, "/\host".
+    if (!asParsed.startsWith("/") ||
+        asParsed.startsWith("//") ||
+        asParsed.startsWith("/\\")) {
+        throw new Error(`fetchWithAuth() only sends requests to your app's own origin, so the access token never reaches a third party. "${path}" is not a path on it — pass a relative path such as '/api/orders'. Use base44.functions.fetch() to call a Base44 backend function, or plain fetch() for another origin.`);
+    }
+}

package/package.json

@@ -1,36 +1,9 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.46-pr.276.f98c3b7",
+  "version": "0.8.46-pr.277.5cc15f3",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./iap": {
-      "types": "./dist/iap/index.d.ts",
-      "default": "./dist/iap/index.js"
-    },
-    "./dist/*.js": {
-      "types": "./dist/*.d.ts",
-      "default": "./dist/*.js"
-    },
-    "./dist/*.d.ts": "./dist/*.d.ts",
-    "./dist/*": {
-      "types": "./dist/*.d.ts",
-      "default": "./dist/*.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "typesVersions": {
-    "*": {
-      "iap": [
-        "dist/iap/index.d.ts"
-      ]
-    }
-  },
   "type": "module",
   "files": [
     "dist"
@@ -53,14 +26,12 @@
     "create-docs:process": "node scripts/mintlify-post-processing/file-processing/file-processing.js"
   },
   "dependencies": {
-    "@apple/app-store-server-library": "^3.1.0",
     "axios": "^1.18.1",
     "partysocket": "^0.0.23",
     "socket.io-client": "^4.8.3",
     "uuid": "^13.0.2"
   },
   "devDependencies": {
-    "@peculiar/x509": "^2.0.0",
     "@types/hast": "^3.0.4",
     "@types/node": "^25.0.1",
     "@types/unist": "^3.0.3",
@@ -72,7 +43,6 @@
     "eslint": "^9.39.2",
     "eslint-plugin-import": "^2.32.0",
     "nock": "^13.4.0",
-    "reflect-metadata": "^0.2.2",
     "typedoc": "^0.28.14",
     "typedoc-plugin-markdown": "^4.9.0",
     "typescript": "^5.3.2",

package/dist/iap/account-token.d.ts

@@ -1,14 +0,0 @@
-/**
- * The namespace every Base44 in-app purchase account token is derived under.
- *
- * A fixed, arbitrary version-4 UUID. It must never change: the native shell
- * derives the same value independently, and Apple has already signed the
- * results into transactions that will keep renewing.
- */
-export declare const IAP_APP_ACCOUNT_TOKEN_NAMESPACE = "8f2b6a1e-4c5d-4e7a-9b3f-6d1a2c8e5f04";
-/**
- * Derives the account token for a Base44 user id.
- *
- * @throws {TypeError} when the user id is empty.
- */
-export declare function appAccountTokenFor(base44UserId: string): string;

package/dist/iap/account-token.js

@@ -1,43 +0,0 @@
-/**
- * Mapping a Base44 user to the UUID Apple signs into their purchases.
- *
- * StoreKit accepts a UUID at purchase time (`appAccountToken`) and Apple
- * returns the same value in every resulting transaction — including renewals
- * years later. That signed round trip is the entire attribution mechanism: it
- * is the only way to know whose purchase a transaction is, without trusting
- * anything the client claims.
- *
- * The mapping is a deterministic version-5 UUID of the user id under a fixed
- * namespace, so it is a pure function. The shell, the web app and the backend
- * all derive the same UUID from the same user id with no lookup table to keep
- * in sync, and nothing to migrate.
- *
- * Two consequences worth knowing:
- *
- * - The namespace is part of the contract. Changing it orphans every purchase
- *   already attributed under the old one.
- * - The mapping is one-way in practice. Recovering a user id means deriving
- *   the UUID for a candidate user and comparing, not inverting the hash.
- *
- * @internal
- */
-import { v5 as uuidv5 } from "uuid";
-/**
- * The namespace every Base44 in-app purchase account token is derived under.
- *
- * A fixed, arbitrary version-4 UUID. It must never change: the native shell
- * derives the same value independently, and Apple has already signed the
- * results into transactions that will keep renewing.
- */
-export const IAP_APP_ACCOUNT_TOKEN_NAMESPACE = "8f2b6a1e-4c5d-4e7a-9b3f-6d1a2c8e5f04";
-/**
- * Derives the account token for a Base44 user id.
- *
- * @throws {TypeError} when the user id is empty.
- */
-export function appAccountTokenFor(base44UserId) {
-    if (typeof base44UserId !== "string" || base44UserId.length === 0) {
-        throw new TypeError("a Base44 user id is required to derive an account token");
-    }
-    return uuidv5(base44UserId, IAP_APP_ACCOUNT_TOKEN_NAMESPACE);
-}

package/dist/iap/config.d.ts

@@ -1,19 +0,0 @@
-import type { IapConfig, IapProductConfig } from "./iap.types.js";
-import type { IapServerApiConfig } from "./server-api/server-api.types.js";
-/** A validated configuration, with every default filled in. */
-export interface ResolvedIapConfig {
-    readonly bundleId: string;
-    readonly appAppleId: number;
-    readonly products: Readonly<Record<string, IapProductConfig>>;
-    readonly testMode: boolean;
-    readonly allowLocalTesting: boolean;
-    readonly serverApi?: IapServerApiConfig;
-    readonly verifier: "apple" | "builtin";
-}
-/**
- * Validates a configuration and fills in defaults.
- *
- * @throws {IapConfigError} `IAP_INVALID_CONFIG` for anything malformed, or
- * `IAP_ONLINE_CHECKS_UNSUPPORTED` when online certificate checks are asked for.
- */
-export declare function resolveConfig(config: IapConfig): ResolvedIapConfig;

package/dist/iap/config.js

@@ -1,105 +0,0 @@
-/**
- * Configuration validation.
- *
- * Runs once, when the client is created, and refuses to build a client it
- * cannot operate correctly. Failing at deploy time is the whole point: the
- * alternative is discovering a missing `appAppleId` when Apple sends the first
- * refund notification.
- *
- * @internal
- */
-import { IapConfigError } from "./errors.js";
-const PRODUCT_TYPES = new Set([
-    "consumable",
-    "nonConsumable",
-    "nonRenewingSubscription",
-    "autoRenewableSubscription",
-]);
-function invalid(message) {
-    throw new IapConfigError("IAP_INVALID_CONFIG", message);
-}
-/**
- * Validates a configuration and fills in defaults.
- *
- * @throws {IapConfigError} `IAP_INVALID_CONFIG` for anything malformed, or
- * `IAP_ONLINE_CHECKS_UNSUPPORTED` when online certificate checks are asked for.
- */
-export function resolveConfig(config) {
-    var _a, _b;
-    if (!config || typeof config !== "object") {
-        invalid("an in-app purchase configuration object is required");
-    }
-    if (typeof config.bundleId !== "string" || config.bundleId.trim().length === 0) {
-        invalid("'bundleId' is required, e.g. \"com.example.app\"");
-    }
-    // A very common mix-up: passing the bundle id where the numeric id belongs.
-    if (typeof config.appAppleId === "string") {
-        invalid("'appAppleId' must be a number — the numeric App Store id from App Store " +
-            "Connect under App Information, not the bundle id");
-    }
-    if (typeof config.appAppleId !== "number" ||
-        !Number.isInteger(config.appAppleId) ||
-        config.appAppleId <= 0) {
-        invalid("'appAppleId' must be a positive integer, e.g. 1234567890");
-    }
-    if (!config.products || typeof config.products !== "object") {
-        invalid("'products' is required, keyed by product identifier");
-    }
-    for (const [productId, product] of Object.entries(config.products)) {
-        if (!product || typeof product !== "object") {
-            invalid(`product ${JSON.stringify(productId)} must be an object`);
-        }
-        if (!PRODUCT_TYPES.has(product.type)) {
-            invalid(`product ${JSON.stringify(productId)} has type ${JSON.stringify(product.type)}; expected one of ${[...PRODUCT_TYPES].join(", ")}`);
-        }
-        // Apple never expires a non-renewing subscription, so this number is the
-        // only thing that decides when access ends. Missing it would silently
-        // grant the product forever.
-        if (product.type === "nonRenewingSubscription") {
-            const days = product.nonRenewingDurationDays;
-            if (typeof days !== "number" || !Number.isFinite(days) || days <= 0) {
-                invalid(`product ${JSON.stringify(productId)} is a nonRenewingSubscription, so it ` +
-                    "needs 'nonRenewingDurationDays' — Apple does not expire these, so the " +
-                    "app decides how long they last");
-            }
-        }
-    }
-    // `null` is treated as absent, not as invalid: a secret that was never set
-    // arrives that way, and the right answer then is "the API is not configured"
-    // — which the call itself reports clearly — rather than refusing to start.
-    if (config.verifier !== undefined &&
-        config.verifier !== "apple" &&
-        config.verifier !== "builtin") {
-        invalid(`'verifier' must be "apple" or "builtin"; got ${JSON.stringify(config.verifier)}`);
-    }
-    if (config.serverApi !== undefined && config.serverApi !== null) {
-        const api = config.serverApi;
-        if (typeof api !== "object") {
-            invalid("'serverApi' must be an object, or left out entirely");
-        }
-        for (const field of ["keyId", "issuerId", "privateKeyP8"]) {
-            if (typeof api[field] !== "string" || api[field].trim().length === 0) {
-                invalid(`'serverApi.${field}' is required when serverApi is supplied`);
-            }
-        }
-        if (!api.privateKeyP8.includes("PRIVATE KEY")) {
-            invalid("'serverApi.privateKeyP8' does not look like a .p8 file. Pass its whole " +
-                "contents, including the BEGIN and END lines.");
-        }
-    }
-    if (config.onlineChecks === true) {
-        throw new IapConfigError("IAP_ONLINE_CHECKS_UNSUPPORTED", "'onlineChecks' asks for certificate revocation lookups, which this version " +
-            "does not implement. Leave it unset. Certificate validity is evaluated at " +
-            "each payload's own signedDate, which is what Apple's own library does with " +
-            "online checks off.");
-    }
-    return {
-        bundleId: config.bundleId,
-        appAppleId: config.appAppleId,
-        products: { ...config.products },
-        testMode: config.testMode === true,
-        allowLocalTesting: config.allowLocalTesting === true,
-        serverApi: (_a = config.serverApi) !== null && _a !== void 0 ? _a : undefined,
-        verifier: (_b = config.verifier) !== null && _b !== void 0 ? _b : "apple",
-    };
-}

package/dist/iap/errors.d.ts

@@ -1,89 +0,0 @@
-/**
- * Error classes for the in-app purchase module.
- *
- * Each class carries a `code` from `errors.types.ts`. Nothing here imports the
- * runtime helpers, so the runtime layer can throw these freely.
- *
- * @internal
- */
-import type { IapApiErrorCode, IapConfigErrorCode, IapSetupErrorCode, IapStoreErrorCode, IapVerificationErrorCode } from "./errors.types.js";
-/** Base class, so a caller can catch every error this module raises at once. */
-export declare class IapError extends Error {
-    /** Stable machine-readable code. */
-    readonly code: string;
-    constructor(code: string, message: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * A signed Apple token was rejected.
- *
- * Deny by default: anything that raises this must be treated as "not
- * entitled", never as "probably fine".
- */
-export declare class IapVerificationError extends IapError {
-    readonly code: IapVerificationErrorCode;
-    constructor(code: IapVerificationErrorCode, message: string, options?: {
-        cause?: unknown;
-    });
-}
-/** The module cannot start, or was asked for something its configuration does not allow. */
-export declare class IapConfigError extends IapError {
-    readonly code: IapConfigErrorCode;
-    constructor(code: IapConfigErrorCode, message: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * The app's Base44 setup is not usable — an entity is missing, or its schema
- * has drifted from what the SDK writes.
- *
- * This is loud on purpose. A silently dropped field means purchase data is
- * being lost, which is worse than an outage.
- */
-export declare class IapSetupError extends IapError {
-    readonly code: IapSetupErrorCode;
-    /** The entity the problem was found on. */
-    readonly entityName?: string;
-    /** Fields the entity dropped, when the code is `IAP_ENTITY_SCHEMA_DRIFT`. */
-    readonly missingFields?: string[];
-    constructor(code: IapSetupErrorCode, message: string, details?: {
-        entityName?: string;
-        missingFields?: string[];
-        cause?: unknown;
-    });
-}
-/** A read or write against the app's entities failed. */
-export declare class IapStoreError extends IapError {
-    readonly code: IapStoreErrorCode;
-    /** The entity being read or written. */
-    readonly entityName?: string;
-    constructor(code: IapStoreErrorCode, message: string, details?: {
-        entityName?: string;
-        cause?: unknown;
-    });
-}
-/** An App Store Server API call failed. */
-export declare class IapApiError extends IapError {
-    readonly code: IapApiErrorCode;
-    /** The HTTP status Apple returned. */
-    readonly httpStatus?: number;
-    /** Apple's own numeric error code from the response body, e.g. `4040010`. */
-    readonly appleErrorCode?: number;
-    /** Apple's own error message from the response body. */
-    readonly appleErrorMessage?: string;
-    /**
-     * When rate-limited: the value of Apple's `Retry-After` header.
-     *
-     * Apple sends an **absolute UNIX millisecond timestamp** here, not a delay.
-     * Compare it against `Date.now()`; do not use it as a duration.
-     */
-    readonly retryAfter?: number;
-    constructor(code: IapApiErrorCode, message: string, details?: {
-        httpStatus?: number;
-        appleErrorCode?: number;
-        appleErrorMessage?: string;
-        retryAfter?: number;
-        cause?: unknown;
-    });
-}

package/dist/iap/errors.js

@@ -1,66 +0,0 @@
-/** Base class, so a caller can catch every error this module raises at once. */
-export class IapError extends Error {
-    constructor(code, message, options) {
-        super(message);
-        this.name = "IapError";
-        this.code = code;
-        // `cause` is set by hand rather than passed to super: the emit target is
-        // es2018, whose Error constructor takes no options bag.
-        if (options && "cause" in options) {
-            this.cause = options.cause;
-        }
-    }
-}
-/**
- * A signed Apple token was rejected.
- *
- * Deny by default: anything that raises this must be treated as "not
- * entitled", never as "probably fine".
- */
-export class IapVerificationError extends IapError {
-    constructor(code, message, options) {
-        super(code, message, options);
-        this.name = "IapVerificationError";
-    }
-}
-/** The module cannot start, or was asked for something its configuration does not allow. */
-export class IapConfigError extends IapError {
-    constructor(code, message, options) {
-        super(code, message, options);
-        this.name = "IapConfigError";
-    }
-}
-/**
- * The app's Base44 setup is not usable — an entity is missing, or its schema
- * has drifted from what the SDK writes.
- *
- * This is loud on purpose. A silently dropped field means purchase data is
- * being lost, which is worse than an outage.
- */
-export class IapSetupError extends IapError {
-    constructor(code, message, details) {
-        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
-        this.name = "IapSetupError";
-        this.entityName = details === null || details === void 0 ? void 0 : details.entityName;
-        this.missingFields = details === null || details === void 0 ? void 0 : details.missingFields;
-    }
-}
-/** A read or write against the app's entities failed. */
-export class IapStoreError extends IapError {
-    constructor(code, message, details) {
-        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
-        this.name = "IapStoreError";
-        this.entityName = details === null || details === void 0 ? void 0 : details.entityName;
-    }
-}
-/** An App Store Server API call failed. */
-export class IapApiError extends IapError {
-    constructor(code, message, details) {
-        super(code, message, { cause: details === null || details === void 0 ? void 0 : details.cause });
-        this.name = "IapApiError";
-        this.httpStatus = details === null || details === void 0 ? void 0 : details.httpStatus;
-        this.appleErrorCode = details === null || details === void 0 ? void 0 : details.appleErrorCode;
-        this.appleErrorMessage = details === null || details === void 0 ? void 0 : details.appleErrorMessage;
-        this.retryAfter = details === null || details === void 0 ? void 0 : details.retryAfter;
-    }
-}

package/dist/iap/errors.types.d.ts

@@ -1,74 +0,0 @@
-/**
- * Error codes the in-app purchase module can raise.
- *
- * Every code is a stable string. Generated code and support tooling branch on
- * these, so a code is never renamed — a new situation gets a new code.
- */
-/**
- * Why a signed Apple token was rejected.
- *
- * The first eight come straight from the verification algorithm Apple
- * describes; the last two are this SDK's own.
- */
-export type IapVerificationErrorCode = 
-/** The token is not three base64url segments separated by dots. */
-"INVALID_JWS_FORMAT"
-/** The JWS header named an algorithm other than `ES256`. */
- | "UNSUPPORTED_ALG"
-/** The `x5c` header did not carry exactly three certificates. */
- | "INVALID_CHAIN_LENGTH"
-/** A certificate failed to parse, was outside its validity window, or lacked a required marker. */
- | "INVALID_CERTIFICATE"
-/** A certificate was revoked. Only reachable with online checks, which v1 does not support. */
- | "CERTIFICATE_REVOKED"
-/** The signature did not verify against the leaf certificate's public key. */
- | "INVALID_SIGNATURE"
-/** The payload's `bundleId`, or its `appAppleId` in production, did not match the configuration. */
- | "INVALID_APP_IDENTIFIER"
-/** The payload's `environment` was not one this app accepts. */
- | "INVALID_ENVIRONMENT"
-/** A transient failure. Retrying may succeed. */
- | "RETRYABLE_VERIFICATION_FAILURE"
-/**
- * The chain anchored at a root this SDK cannot verify against — an RSA root.
- *
- * Current App Store tokens chain to Apple Root CA - G3, which is ECDSA
- * P-384. Apple Root CA - G2 and Apple Inc. Root are RSA and are pinned for
- * completeness, but v1 verifies ECDSA signatures only. This is never
- * downgraded to a pass.
- */
- | "UNSUPPORTED_CERT_ALGORITHM";
-/** Why the module refused to start, or could not use its configuration. */
-export type IapConfigErrorCode = 
-/** A required configuration field was missing or malformed. */
-"IAP_INVALID_CONFIG"
-/** `onlineChecks: true` was requested. Certificate revocation lookups are not implemented in v1. */
- | "IAP_ONLINE_CHECKS_UNSUPPORTED"
-/** The runtime has no WebCrypto. Needs Deno, Node 18 or later, or a secure browser context. */
- | "IAP_WEBCRYPTO_UNAVAILABLE"
-/** The runtime has no `fetch`. Needs Deno, Node 18 or later, or a browser. */
- | "IAP_FETCH_UNAVAILABLE"
-/** An App Store Server API call was made without `serverApi` credentials configured. */
- | "IAP_SERVER_API_NOT_CONFIGURED";
-/** Why the app's own Base44 setup is not usable for in-app purchases. */
-export type IapSetupErrorCode = 
-/** One of the four required entities does not exist in this app. */
-"IAP_ENTITY_MISSING"
-/** An entity exists but silently dropped a field the SDK wrote. Its schema has drifted. */
- | "IAP_ENTITY_SCHEMA_DRIFT"
-/** The client was created without service-role credentials, so it cannot write. */
- | "IAP_SERVICE_ROLE_REQUIRED";
-/** Why a read or write against the app's entities failed. */
-export type IapStoreErrorCode = 
-/** The write did not land. Callers must not report success to Apple or finish a transaction. */
-"IAP_WRITE_FAILED"
-/** The read did not complete. */
- | "IAP_READ_FAILED";
-/** Why an App Store Server API call failed. */
-export type IapApiErrorCode = 
-/** Apple answered with an error status. Inspect `appleErrorCode` for which. */
-"IAP_API_ERROR"
-/** Apple rate-limited the call. `retryAfter` carries the absolute timestamp to retry after. */
- | "IAP_API_RATE_LIMITED"
-/** The transaction id exists in neither the production nor the sandbox environment. */
- | "IAP_API_TRANSACTION_NOT_FOUND";

package/dist/iap/errors.types.js

@@ -1,7 +0,0 @@
-/**
- * Error codes the in-app purchase module can raise.
- *
- * Every code is a stable string. Generated code and support tooling branch on
- * these, so a code is never renamed — a new situation gets a new code.
- */
-export {};

package/dist/iap/events/emitter.d.ts

@@ -1,28 +0,0 @@
-/**
- * Delivering events to the app's handlers.
- *
- * Two rules, both about not letting an app's own code break Apple's contract:
- *
- * 1. **A handler runs after the write, never before.** An event means the data
- *    behind it is already stored.
- * 2. **A handler can never change the outcome.** If one throws, the throw is
- *    swallowed and reported; the HTTP response Apple sees is unaffected.
- *
- * Events are dispatched *synchronously* before the response is returned, not
- * after it. A Base44 backend function has no way to run work once it has
- * answered — there is no `waitUntil` — so anything deferred until after the
- * response is simply lost when the isolate stops.
- *
- * @internal
- */
-import type { IapEvent, IapEventHandler } from "./events.types.js";
-/** Reports a handler that threw. Defaults to a single console line. */
-export type IapHandlerFailureReporter = (event: IapEvent, error: unknown) => void;
-/** The event bus for one client. */
-export interface IapEmitter {
-    /** Registers a handler. Returns a function that removes it. */
-    onEvent(handler: IapEventHandler): () => void;
-    /** Delivers events to every handler, swallowing their failures. */
-    emit(events: readonly IapEvent[]): Promise<void>;
-}
-export declare function createEmitter(reportFailure?: IapHandlerFailureReporter): IapEmitter;