@chipmobilesdk/rn-payment 0.3.0 → 0.4.0

package/src/adapter/iap-adapter.ts

@@ -6,19 +6,24 @@
  * and lets an iOS adapter be added without changing a consumer call (FR-002,
  * FR-007). ESLint enforces that boundary.
  *
- * ## Verification status
+ * ## Verified against react-native-iap 16.7.3
  *
- * The binding is **not yet installed** — the root `react-native-nitro-modules`
- * bump it requires is held pending approval (see specs/013-rn-payment-sdk/plan.md,
- * Post-Implementation Notes). So the call shapes below are written against
- * `react-native-iap` 16.x as documented, and **every one must be verified against
- * the installed package** before this adapter is trusted on a device. The module
- * is required lazily and the surface it needs is declared explicitly in
- * `IapModule`, so a mismatch surfaces here rather than deep in the engine.
+ * 0.3.0 was written before the binding was installed, from its documentation, and
+ * no purchase could complete on a device. Checked against the installed 16.7.3
+ * source for 0.3.1, two facts shape the purchase path:
  *
- * No test exercises this file: the whole suite runs against the fake store, and
- * the IAP test double throws on every call precisely so that reaching this code in
- * a test fails loudly instead of passing against a stub.
+ * - The request is keyed by store: `google` / `apple`. 0.3.0 sent `android`, which
+ *   the binding rejects (`empty-sku-list`) before Play opens. The request type is
+ *   now the binding's own `RequestPurchaseProps`, so a renamed key fails to
+ *   typecheck here instead of failing on a user's device.
+ * - On Android `requestPurchase` resolves with an **empty list** once the flow
+ *   ends, whatever happened. The outcome (bought, pending, cancelled, failed)
+ *   arrives only through `purchaseUpdatedListener` / `purchaseErrorListener`, so
+ *   `launchPurchase` waits for those events.
+ *
+ * The module is still required lazily, and `IapModule` still names exactly the
+ * surface used. `__tests__/iap-adapter.test.ts` drives this file through a fake
+ * binding that behaves as 16.7.3 does; the rest of the suite uses the fake store.
  *
  * ## Known upstream defect this guards against
  *
@@ -31,6 +36,11 @@
  * shortcut.
  */
 
+import type {
+	RequestPurchaseProps,
+	SubscriptionReplacementModeAndroid,
+} from 'react-native-iap';
+
 import type { ProductType, Unsubscribe } from '../config/types';
 import type {
 	ProviderCapabilities,
@@ -61,7 +71,8 @@ interface IapModule {
 		type: 'in-app' | 'subs';
 	}): Promise<RawProduct[]>;
 	getAvailablePurchases(): Promise<RawPurchase[]>;
-	requestPurchase(params: unknown): Promise<unknown>;
+	/** Typed by the binding itself, so a renamed request key fails to compile. */
+	requestPurchase(params: RequestPurchaseProps): Promise<unknown>;
 	finishTransaction(params: {
 		purchase: unknown;
 		isConsumable?: boolean;
@@ -69,9 +80,9 @@ interface IapModule {
 	purchaseUpdatedListener(
 		listener: (purchase: RawPurchase) => void,
 	): { remove(): void };
-	purchaseErrorListener(
-		listener: (error: { code?: string; message?: string }) => void,
-	): { remove(): void };
+	purchaseErrorListener(listener: (error: RawPurchaseError) => void): {
+		remove(): void;
+	};
 	deepLinkToSubscriptions?(params: { skuAndroid?: string }): Promise<void>;
 }
 
@@ -129,6 +140,75 @@ interface RawPurchase {
 	dataAndroid?: string;
 }
 
+/** What `purchaseErrorListener` delivers. */
+interface RawPurchaseError {
+	code?: string;
+	message?: string;
+	productId?: string | null;
+}
+
+/**
+ * How long to wait for the outcome event after `requestPurchase` has resolved.
+ * The binding emits the event before or as it resolves, so this only bounds the
+ * case where none ever comes; it never runs while the user is in Play's UI.
+ */
+const RESULT_EVENT_GRACE_MS = 2_000;
+
+/** Play's replacement modes, by the codes the engine passes (`engine/subscriptions.ts`). */
+const REPLACEMENT_MODES: Record<string, SubscriptionReplacementModeAndroid> = {
+	WITH_TIME_PRORATION: 'with-time-proration',
+	CHARGE_FULL_PRICE: 'charge-full-price',
+	CHARGE_PRORATED_PRICE: 'charge-prorated-price',
+	DEFERRED: 'deferred',
+};
+
+/** The request in the binding's 16.7 shape: keyed `google`, not `android`. */
+export function toRequestProps(request: ProviderPurchaseRequest): RequestPurchaseProps {
+	const google = {
+		skus: [request.storeProductId],
+		...(request.obfuscatedAccountId
+			? { obfuscatedAccountId: request.obfuscatedAccountId }
+			: {}),
+	};
+	if (request.productType !== 'subscription') {
+		return { request: { google }, type: 'in-app' };
+	}
+
+	const replacementMode = request.prorationMode
+		? REPLACEMENT_MODES[request.prorationMode]
+		: undefined;
+	return {
+		request: {
+			google: {
+				...google,
+				...(request.offerKey
+					? {
+							subscriptionOffers: [
+								{ sku: request.storeProductId, offerToken: request.offerKey },
+							],
+						}
+					: {}),
+				// A plan change: the token of the purchase being replaced, and — for
+				// the replacement mode to apply — its product id (Billing 8.1+).
+				...(request.replacePurchaseToken
+					? { purchaseToken: request.replacePurchaseToken }
+					: {}),
+				...(request.replacePurchaseToken &&
+				request.replaceStoreProductId &&
+				replacementMode
+					? {
+							subscriptionProductReplacementParams: {
+								oldProductId: request.replaceStoreProductId,
+								replacementMode,
+							},
+						}
+					: {}),
+			},
+		},
+		type: 'subs',
+	};
+}
+
 /** Play's `PurchaseState`: 0 unspecified, 1 purchased, 2 pending. */
 const PLAY_STATE_PURCHASED = 1;
 const PLAY_STATE_PENDING = 2;
@@ -272,10 +352,12 @@ function mapErrorCode(code: string | undefined): ProviderFailureReason {
 		case 'user-cancelled':
 			return 'user_cancelled';
 		case 'E_ALREADY_OWNED':
+		case 'already-owned':
 		case 'item-already-owned':
 			return 'already_owned';
 		case 'E_ITEM_UNAVAILABLE':
 		case 'item-unavailable':
+		case 'sku-not-found':
 			return 'unknown_product';
 		case 'E_NOT_PREPARED':
 		case 'not-prepared':
@@ -309,6 +391,8 @@ const ANDROID_CAPABILITIES: ProviderCapabilities = {
 	supportsExternalTransactions: false,
 	/** This one really does move money, which is what arms the environment guard. */
 	createsRealTransactions: true,
+	/** The outcome event comes only when the user leaves Play's purchase UI. */
+	purchaseOutcomeIncludesStoreTime: true,
 };
 
 export interface IapAdapterOptions {
@@ -326,6 +410,8 @@ export function createIapAdapter(options: IapAdapterOptions = {}): ProviderPort
 		(connected: boolean, reason?: string) => void
 	>();
 	const purchaseListeners = new Set<(purchase: ProviderPurchase) => void>();
+	/** Only an in-flight `launchPurchase` listens here; see there. */
+	const purchaseErrorListeners = new Set<(error: RawPurchaseError) => void>();
 	let updateSub: { remove(): void } | undefined;
 	let errorSub: { remove(): void } | undefined;
 
@@ -347,6 +433,10 @@ export function createIapAdapter(options: IapAdapterOptions = {}): ProviderPort
 	};
 
 	const attachListeners = (): void => {
+		// Every connect attaches, so whatever an earlier connect left must go first.
+		// Overwriting the handles orphaned the old native listeners, which kept
+		// firing — every purchase update reached the engine once per connect.
+		detachListeners();
 		const mod = module();
 		updateSub = mod.purchaseUpdatedListener(raw => {
 			const purchase = normalizePurchase(raw);
@@ -361,6 +451,9 @@ export function createIapAdapter(options: IapAdapterOptions = {}): ProviderPort
 			if (mapErrorCode(error.code) === 'not_ready') {
 				notifyConnection(false, 'not_prepared');
 			}
+			for (const listener of purchaseErrorListeners) {
+				listener(error);
+			}
 		});
 	};
 
@@ -450,49 +543,69 @@ export function createIapAdapter(options: IapAdapterOptions = {}): ProviderPort
 			return raw.map(normalizePurchase);
 		},
 
-		async launchPurchase(
-			request: ProviderPurchaseRequest,
-		): Promise<ProviderPurchaseOutcome> {
-			try {
-				const isSubscription = request.productType === 'subscription';
-				const result = await module().requestPurchase({
-					request: {
-						android: {
-							skus: [request.storeProductId],
-							obfuscatedAccountIdAndroid: request.obfuscatedAccountId,
-							...(isSubscription && request.offerKey
-								? {
-										subscriptionOffers: [
-											{
-												sku: request.storeProductId,
-												offerToken: request.offerKey,
-											},
-										],
-									}
-								: {}),
-							...(request.replaceStoreProductId
-								? {
-										purchaseTokenAndroid: request.replaceStoreProductId,
-										replacementModeAndroid: request.prorationMode,
-									}
-								: {}),
-						},
-					},
-					type: isSubscription ? 'subs' : 'in-app',
-				});
-
-				// The binding may resolve with the purchase, or resolve empty and deliver
-				// it through the update listener. Both are handled: the engine also
-				// ingests listener-delivered purchases, so neither path loses one.
-				const raw = Array.isArray(result) ? result[0] : result;
-				if (!raw) {
-					return { ok: false, reason: 'store_error', detail: 'no purchase returned' };
+		/**
+		 * Settles on the first outcome event for this product: a purchase update
+		 * (bought or pending) or a purchase error (cancelled, already owned, …).
+		 *
+		 * The binding's promise is not the outcome: on Android it resolves with an
+		 * empty list when the flow ends, whatever happened. Its listeners also feed
+		 * `observePurchases`, so the engine sees a bought purchase twice — here and
+		 * as a store update — and grants it once (FR-044).
+		 */
+		launchPurchase(request: ProviderPurchaseRequest): Promise<ProviderPurchaseOutcome> {
+			const sku = request.storeProductId;
+			return new Promise<ProviderPurchaseOutcome>(resolve => {
+				let settled = false;
+				let grace: ReturnType<typeof setTimeout> | undefined;
+
+				const onPurchase = (purchase: ProviderPurchase): void => {
+					if (purchase.storeProductId === sku) {
+						finish({ ok: true, purchase });
+					}
+				};
+				const onError = (error: RawPurchaseError): void => {
+					if (error.productId && error.productId !== sku) {
+						return;
+					}
+					finish({ ok: false, reason: mapErrorCode(error.code), detail: error.code });
+				};
+				const fail = (error: unknown): void => {
+					const code = (error as { code?: string } | undefined)?.code;
+					finish({ ok: false, reason: mapErrorCode(code), detail: code });
+				};
+				function finish(outcome: ProviderPurchaseOutcome): void {
+					if (settled) {
+						return;
+					}
+					settled = true;
+					clearTimeout(grace);
+					purchaseListeners.delete(onPurchase);
+					purchaseErrorListeners.delete(onError);
+					resolve(outcome);
 				}
-				return { ok: true, purchase: normalizePurchase(raw as RawPurchase) };
-			} catch (error) {
-				const code = (error as { code?: string }).code;
-				return { ok: false, reason: mapErrorCode(code), detail: code };
-			}
+
+				purchaseListeners.add(onPurchase);
+				purchaseErrorListeners.add(onError);
+				try {
+					module()
+						.requestPurchase(toRequestProps(request))
+						.then(() => {
+							if (!settled) {
+								grace = setTimeout(
+									() =>
+										finish({
+											ok: false,
+											reason: 'store_error',
+											detail: 'no purchase event',
+										}),
+									RESULT_EVENT_GRACE_MS,
+								);
+							}
+						}, fail);
+				} catch (error) {
+					fail(error);
+				}
+			});
 		},
 
 		observePurchases(listener): Unsubscribe {

package/src/adapter/port.ts

@@ -102,7 +102,12 @@ export interface ProviderPurchaseRequest {
 	offerKey?: string;
 	/** App-supplied, passed straight through. Never generated or stored (FR-034). */
 	obfuscatedAccountId?: string;
-	/** Plan change: the currently-active subscription being replaced. */
+	/**
+	 * Plan change: the token of the active subscription being replaced. The store
+	 * migrates *that* purchase rather than creating a second one (FR-065).
+	 */
+	replacePurchaseToken?: ProviderToken;
+	/** Plan change: the store product id of the subscription being replaced. */
 	replaceStoreProductId?: StoreProductId;
 	prorationMode?: string;
 }
@@ -138,6 +143,18 @@ export interface ProviderCapabilities {
 	 * a development build.
 	 */
 	createsRealTransactions: boolean;
+	/**
+	 * Whether `launchPurchase` settles only once the user has left the store's
+	 * purchase surface.
+	 *
+	 * `true` for the Play adapter: the binding gives no "surface opened" signal and
+	 * reports the outcome only when the flow ends, so the time the user spends in
+	 * Play is inside the call. The engine then does not apply its launch timeout,
+	 * which would otherwise cancel a user still choosing a payment method (FR-035).
+	 * The binding always ends the flow with a result or an error, so the call
+	 * cannot hang. `false` for the fake store, whose launch returns at once.
+	 */
+	purchaseOutcomeIncludesStoreTime: boolean;
 }
 
 export interface ProviderPort {

package/src/config/types.ts

@@ -63,7 +63,14 @@ export interface TimeoutConfig {
 	syncMs?: number;
 	/** Covers opening the store surface only. Time the user spends in it is not counted (FR-035). */
 	purchaseLaunchMs?: number;
+	/** Bounds each acknowledge or consume call; a timed-out attempt is retried. */
 	finalizeAttemptMs?: number;
+	/**
+	 * Bounds the app's `validateTransaction` hook. A hook that does not answer in
+	 * time is treated as unavailable, exactly like one that throws (FR-072b).
+	 * Added in 0.3.2.
+	 */
+	validateMs?: number;
 }
 
 export interface RetryConfig {
@@ -88,6 +95,14 @@ export interface ValidationCandidate {
 	verificationPayload: string;
 	/** Ties this decision to one purchase cycle in the event stream (FR-076). */
 	correlationId: string;
+	/**
+	 * The store's identifier for this transaction (Play's order id). Not a secret,
+	 * and the only handle a backend has on re-validation, where
+	 * `verificationPayload` is empty because it is never persisted. Added in 0.3.2.
+	 */
+	transactionId: string;
+	/** Which store issued the transaction, so a backend picks the right API. Added in 0.3.2. */
+	platform: 'android' | 'ios';
 }
 
 export interface ValidationDecision {

package/src/core/timers.ts

@@ -34,6 +34,16 @@ export const DEFAULT_SYNC_TIMEOUT_MS = 20_000;
 export const DEFAULT_PURCHASE_LAUNCH_TIMEOUT_MS = 30_000;
 /** Per finalize attempt, not per transaction — the queue owns overall persistence. */
 export const DEFAULT_FINALIZE_ATTEMPT_TIMEOUT_MS = 15_000;
+/** The app's backend hook. A user is waiting on a purchase result behind it. */
+export const DEFAULT_VALIDATE_TIMEOUT_MS = 15_000;
+/**
+ * The ceiling on a purchase flow whose outcome includes the user's own time in
+ * the store UI, so is otherwise untimed (FR-035). Not a timeout on the user: it
+ * exists only so a binding that never answers cannot hold the purchase lock for
+ * the rest of the session. A purchase that completes later still arrives through
+ * the store update channel and is granted then.
+ */
+export const PURCHASE_FLOW_CEILING_MS = 10 * 60_000;
 
 export const CONNECT_TIMEOUT_BOUNDS = { min: 3_000, max: 60_000 } as const;
 export const PRODUCT_QUERY_TIMEOUT_BOUNDS = { min: 3_000, max: 60_000 } as const;
@@ -46,6 +56,7 @@ export const FINALIZE_ATTEMPT_TIMEOUT_BOUNDS = {
 	min: 3_000,
 	max: 60_000,
 } as const;
+export const VALIDATE_TIMEOUT_BOUNDS = { min: 3_000, max: 120_000 } as const;
 
 /**
  * Prices and offer eligibility are shown at the moment of purchase, so a short
@@ -138,6 +149,7 @@ export interface ResolvedTimeouts {
 	syncMs: number;
 	purchaseLaunchMs: number;
 	finalizeAttemptMs: number;
+	validateMs: number;
 }
 
 export function resolveTimeouts(config?: TimeoutConfig): ResolvedTimeouts {
@@ -172,6 +184,12 @@ export function resolveTimeouts(config?: TimeoutConfig): ResolvedTimeouts {
 			DEFAULT_FINALIZE_ATTEMPT_TIMEOUT_MS,
 			FINALIZE_ATTEMPT_TIMEOUT_BOUNDS,
 		),
+		validateMs: requireInBounds(
+			'timeouts.validateMs',
+			config?.validateMs,
+			DEFAULT_VALIDATE_TIMEOUT_MS,
+			VALIDATE_TIMEOUT_BOUNDS,
+		),
 	};
 }
 

package/src/diagnostics/errors.ts

@@ -29,6 +29,8 @@ export const PAYMENT_ERROR_CODES = [
 	'PAYMENT_VALIDATION_REJECTED',
 	'PAYMENT_VALIDATION_UNAVAILABLE',
 	'PAYMENT_STORAGE_UNAVAILABLE',
+	/** `consume` on a transaction that is not a consumable, added in 0.3.2. */
+	'PAYMENT_NOT_CONSUMABLE',
 ] as const;
 
 export type PaymentErrorCode = (typeof PAYMENT_ERROR_CODES)[number];
@@ -98,13 +100,18 @@ export class PaymentConfigError extends PaymentError {
  *
  * Applied at the boundary rather than trusted to call sites: a single forgotten
  * interpolation is how receipts end up in logs (NFR-006).
+ *
+ * Identifier-only: what survives is what code defined, never what data carried.
+ * A `PaymentError` keeps its code and an `Error` its class name; every message
+ * and every string is dropped, because a store or consumer message can embed a
+ * purchase token or an account id and nothing here can tell which.
  */
 export function redact(value: unknown): string {
-	if (value instanceof Error) {
-		return value.message;
+	if (value instanceof PaymentError) {
+		return value.code;
 	}
-	if (typeof value === 'string') {
-		return value;
+	if (value instanceof Error) {
+		return value.name;
 	}
 	return '[redacted]';
 }

package/src/engine/engine.ts

@@ -186,7 +186,8 @@ export function createEngine(
 	// Both run before anything connects: a bad catalog or an unsafe environment
 	// must fail at configuration time, not when a user taps Buy.
 	assertEnvironmentSafe(config);
-	const resolved = validateConfig(config, deps.platform ?? 'android');
+	const platform = deps.platform ?? 'android';
+	const resolved = validateConfig(config, platform);
 
 	const now = deps.now ?? (() => Date.now());
 	const provider = deps.provider;
@@ -204,6 +205,8 @@ export function createEngine(
 
 	const initFlight = createSingleFlight<InitOutcome>();
 	const syncFlight = createSingleFlight<SyncOutcome>();
+	/** Finalize drain and revalidation, joined the same way but outside the sync flight. */
+	const settleFlight = createSingleFlight<void>();
 	const foregroundLimiter = createRateLimiter(
 		resolved.foregroundSyncMinIntervalMs,
 		now,
@@ -227,6 +230,12 @@ export function createEngine(
 	let purchaseSub: Unsubscribe | undefined;
 	let reconnectTimer: ReturnType<typeof setTimeout> | undefined;
 	let reconnectAttempts = 0;
+	/**
+	 * Set once a connection has succeeded and the watchers are attached. Recovery
+	 * after an exhausted reconnect budget is only meaningful from there; a first
+	 * connection that failed is the app's to retry through `initialize`.
+	 */
+	let everConnected = false;
 	// Exclusive rather than single-flight: a second purchase must be refused, not
 	// joined onto the first, and never queued (FR-031).
 	const purchaseLock = createExclusive();
@@ -425,7 +434,14 @@ export function createEngine(
 	};
 
 	const scheduleReconnect = (): void => {
-		if (disposed || reconnectAttempts >= resolved.retry.reconnect.maxAttempts) {
+		if (disposed) {
+			return;
+		}
+		if (reconnectAttempts >= resolved.retry.reconnect.maxAttempts) {
+			// Out of budget for now, not for good. Reported as a retryable failure
+			// rather than left at `connecting`, which promised a reconnect nobody
+			// was going to make; `handleForeground` starts a fresh budget.
+			setStatus({ kind: 'failed', retryable: true, reconnectAttempts });
 			return;
 		}
 		const attempt = reconnectAttempts + 1;
@@ -468,6 +484,7 @@ export function createEngine(
 	const finalizer = createFinalizer({
 		provider,
 		retry: resolved.retry,
+		attemptTimeoutMs: resolved.timeouts.finalizeAttemptMs,
 		snapshot: () => currentSnapshot,
 		commit,
 		emit,
@@ -486,6 +503,7 @@ export function createEngine(
 		config,
 		resolved,
 		provider,
+		platform,
 		finalizer,
 		snapshot: () => currentSnapshot,
 		commit,
@@ -521,6 +539,8 @@ export function createEngine(
 	 * purchase is open.
 	 */
 	const watchPurchases = (): void => {
+		// Replaced, never stacked: a second subscription would ingest every update twice.
+		purchaseSub?.();
 		purchaseSub = provider.observePurchases(purchase => {
 			if (disposed) {
 				return;
@@ -530,6 +550,7 @@ export function createEngine(
 	};
 
 	const watchConnection = (): void => {
+		connectionSub?.();
 		connectionSub = provider.observeConnection((connected, reason) => {
 			if (disposed) {
 				return;
@@ -567,6 +588,13 @@ export function createEngine(
 				};
 			}
 
+			// Already up: answered without reconnecting. `initFlight` only joins
+			// concurrent callers, so a later sequential call used to run the whole
+			// connection again and leave a second set of native listeners behind.
+			if (status.kind === 'ready') {
+				return { ok: true };
+			}
+
 			return initFlight.run(async () => {
 				if (disposed) {
 					return {
@@ -639,6 +667,7 @@ export function createEngine(
 
 				watchConnection();
 				watchPurchases();
+				everConnected = true;
 				setStatus({ kind: 'ready', reconnectAttempts: 0 });
 				await engine.sync('initialize');
 				// Drain after syncing, so a transaction the store still reports as owned
@@ -753,7 +782,7 @@ export function createEngine(
 
 			// Concurrent callers join one flight, so repeated syncs make exactly one
 			// store request (FR-063).
-			return syncFlight.run(async () => {
+			const outcome = await syncFlight.run(async () => {
 				try {
 					const owned = await withTimeout(
 						provider.queryOwned(),
@@ -806,17 +835,6 @@ export function createEngine(
 						trigger,
 					});
 
-					// Every sync is also a chance to settle what a previous session left
-					// owed. A pending purchase that completed while the app was closed
-					// arrives here, and so does a transaction whose acknowledgement failed
-					// last time (FR-039, FR-042).
-					await finalizer.drain();
-
-					// And a chance to settle a backend decision we had to defer. Done on
-					// sync rather than on a timer of ours, so recovery follows the app's
-					// own rhythm (FR-072a).
-					await purchaseFlow.revalidate();
-
 					return { ok: true as const, restoredCount, revokedCount };
 				} catch (error) {
 					const paymentError =
@@ -838,6 +856,23 @@ export function createEngine(
 					return { ok: false as const, error: paymentError };
 				}
 			});
+
+			if (outcome.ok) {
+				// Every sync is also a chance to settle what a previous session left
+				// owed — a pending purchase that completed while the app was closed, a
+				// transaction whose acknowledgement failed last time (FR-039, FR-042) —
+				// and a backend decision we had to defer, on the app's own rhythm
+				// rather than a timer of ours (FR-072a).
+				//
+				// Outside the sync flight on purpose. Inside it, one store call or hook
+				// that never answered held the flight, and every later sync joined that
+				// same stuck promise for the rest of the session.
+				await settleFlight.run(async () => {
+					await finalizer.drain();
+					await purchaseFlow.revalidate();
+				});
+			}
+			return outcome;
 		},
 
 		async restore(): Promise<RestoreOutcome> {
@@ -922,6 +957,19 @@ export function createEngine(
 		},
 
 		async handleForeground(): Promise<void> {
+			// A foreground return is the natural moment to try again after the
+			// reconnect budget ran out: the network the app lost while backgrounded
+			// is usually back. A fresh budget, and one immediate attempt.
+			if (
+				everConnected &&
+				!disposed &&
+				status.kind === 'failed' &&
+				reconnectTimer === undefined
+			) {
+				reconnectAttempts = 0;
+				setStatus({ kind: 'connecting', reconnectAttempts: 0 });
+				await reconnectOnce().catch(() => undefined);
+			}
 			// Rate-limited inside sync, so an app that calls this on every incidental
 			// foreground transition still produces at most one request per interval.
 			await engine.sync('foreground');