@chipmobilesdk/rn-payment 0.5.0 → 0.7.0

package/lib/commonjs/engine/purchase.js

@@ -0,0 +1,395 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createPurchaseFlow = createPurchaseFlow;
+var _mutex = require("../core/mutex.js");
+var _timers = require("../core/timers.js");
+var _errors = require("../diagnostics/errors.js");
+var _mapping = require("../entitlements/mapping.js");
+var _sync = require("./sync.js");
+var _receiptValidation = require("./receiptValidation.js");
+var _purchaseFailure = require("./purchaseFailure.js");
+/**
+ * The purchase flow.
+ *
+ * Ordering here is deliberate and load-bearing:
+ *
+ * 1. Refuse early and cheaply — disabled, not ready, already busy, environment
+ *    blocked, unknown product — so nothing reaches the store that should not.
+ * 2. Launch, and map every store outcome onto a typed result (FR-005).
+ * 3. Pending stops here: it is persisted and signalled, but **never granted**
+ *    (FR-037).
+ * 4. Validate with the app's backend, if one is configured, and only for a
+ *    **newly completed** purchase (FR-069a).
+ * 5. Grant the entitlement, then finalize. In that order — the user gets what
+ *    they paid for before the bookkeeping completes, so a finalize failure never
+ *    withholds a paid entitlement. Finalization is still guaranteed, by the
+ *    persisted queue.
+ */
+
+/** The error code each failed purchase kind is reported under (PAY-19). */
+
+function createPurchaseFlow(deps) {
+  const {
+    resolved
+  } = deps;
+  // The backend check and what to do when it cannot answer (receiptValidation).
+  const {
+    askHook,
+    validate
+  } = (0, _receiptValidation.createReceiptValidation)({
+    config: deps.config,
+    platform: deps.platform,
+    resolved,
+    emit: deps.emit
+  });
+  const toRef = record => ({
+    transactionId: record.transactionId,
+    productKey: record.productKey
+  });
+
+  /** Writes or replaces the record for one transaction. */
+  const upsert = record => {
+    const snapshot = deps.snapshot();
+    const others = snapshot.purchases.filter(p => p.transactionId !== record.transactionId);
+    deps.commit({
+      ...snapshot,
+      purchases: [...others, record]
+    });
+  };
+  const recordFor = (purchase, productKey) => (0, _sync.toPersistedRecord)(resolved, purchase, productKey, deps.snapshot().purchases.find(p => p.transactionId === purchase.transactionId));
+
+  /**
+   * Calls the app's hook under `timeouts.validateMs`.
+   *
+   * Unbounded, a hook that never answers held the purchase lock and, through
+   * revalidation, the sync flight for the rest of the session. A timeout rejects,
+   * so callers treat it exactly like a hook that throws: unavailable (FR-072b).
+   */
+  /**
+   * Settlements in progress, by transaction.
+   *
+   * The Play binding delivers a launched purchase twice: to the launch and, at
+   * the same moment, to the session-long update listener. Both paths reach
+   * `settle`, and without this the hook ran twice and the purchase was settled
+   * twice. The second caller joins the first and gets the same result.
+   */
+  const inFlightSettle = new Map();
+  const settleOnce = (purchase, productKey, correlationId) => {
+    const running = inFlightSettle.get(purchase.transactionId);
+    if (running) {
+      return running;
+    }
+    const flight = settle(purchase, productKey, correlationId).finally(() => {
+      inFlightSettle.delete(purchase.transactionId);
+    });
+    inFlightSettle.set(purchase.transactionId, flight);
+    return flight;
+  };
+
+  /** Persists a completed purchase, grants it, then finalizes. */
+  const settle = async (purchase, productKey, correlationId) => {
+    const decision = await validate(purchase, productKey, correlationId);
+    if (decision.outcome === 'rejected') {
+      upsert({
+        ...recordFor(purchase, productKey),
+        validationState: 'rejected',
+        finalizeState: 'queued'
+      });
+      // Still finalized with the store: the money moved, so leaving it
+      // unacknowledged would have Google refund it while our backend has
+      // already decided the user is not entitled. Refunding is the app owner's
+      // call, not a side effect of a bookkeeping omission.
+      await deps.finalizer.enqueue(purchase.transactionId);
+      return {
+        kind: 'validation_rejected',
+        productKey,
+        reason: decision.reason
+      };
+    }
+    upsert({
+      ...recordFor(purchase, productKey),
+      validationState: decision.outcome === 'granted_pending_revalidation' ? 'queued_for_revalidation' : 'approved',
+      finalizeState: 'queued'
+    });
+
+    // Grant is already live at this point: `commit` recomputed entitlements.
+    // Finalize second, so a store hiccup cannot withhold what was paid for.
+    await deps.finalizer.enqueue(purchase.transactionId);
+    const record = deps.snapshot().purchases.find(p => p.transactionId === purchase.transactionId);
+    return {
+      kind: 'success',
+      productKey,
+      transaction: record ? toRef(record) : {
+        transactionId: purchase.transactionId,
+        productKey
+      }
+    };
+  };
+  const handlePending = (purchase, productKey) => {
+    // The same pending transaction arrives from the launch and from the update
+    // listener (see `inFlightSettle`). The signal is about a purchase becoming
+    // pending, so it fires once per transaction, not once per delivery.
+    const alreadyPending = deps.snapshot().purchases.some(p => p.transactionId === purchase.transactionId && p.state === 'pending');
+    upsert(recordFor(purchase, productKey));
+    if (!alreadyPending) {
+      deps.emit({
+        type: 'purchase_pending',
+        productKey
+      });
+    }
+    return {
+      kind: 'pending',
+      productKey,
+      transaction: {
+        transactionId: purchase.transactionId,
+        productKey
+      }
+    };
+  };
+
+  /**
+   * The store returned a purchase in a state it could not name — neither paid
+   * nor pending. Nothing is granted, persisted or acknowledged on it.
+   *
+   * Retrying is the repair path: if the money did move, the store answers
+   * `already_owned`, which re-syncs and grants (FR-033).
+   */
+  const handleUnspecified = (productKey, correlationId) => {
+    deps.emit({
+      type: 'purchase_failed',
+      productKey,
+      code: 'PAYMENT_STORE_ERROR',
+      retryable: true,
+      correlationId
+    });
+    return {
+      kind: 'store_error',
+      productKey,
+      code: 'PAYMENT_STORE_ERROR'
+    };
+  };
+
+  /** What the store is asked for: the product and, for a plan change, what it replaces. */
+  const launchRequest = (productKey, storeProductId, options) => {
+    const replaceKey = options?.replaceProductKey;
+    return {
+      storeProductId,
+      productType: resolved.entries.get(productKey)?.productType ?? 'one_time_permanent',
+      offerKey: options?.offerKey,
+      obfuscatedAccountId: options?.obfuscatedAccountId,
+      // Present only for a plan change. The store needs the token of the
+      // subscription being replaced so it migrates the existing purchase instead
+      // of creating a second one (FR-065), and its product id to apply the
+      // replacement mode.
+      replacePurchaseToken: replaceKey ? deps.snapshot().purchases.find(p => p.productKey === replaceKey && p.state === 'purchased')?.token : undefined,
+      replaceStoreProductId: replaceKey ? (0, _mapping.storeIdForProductKey)(resolved, replaceKey) : undefined,
+      prorationMode: options?.prorationMode
+    };
+  };
+
+  /**
+   * The launch timeout covers opening the store surface only; time the user
+   * spends inside it is the store's, not ours (FR-035). A provider that reports
+   * nothing until the flow ends gives no "opened" moment to time, so it gets only
+   * `PURCHASE_FLOW_CEILING_MS`: far beyond any real purchase, there so a binding
+   * that never answers cannot hold the purchase lock for the whole session.
+   */
+  const launch = request => {
+    const launched = deps.provider.launchPurchase(request);
+    const includesStoreTime = deps.provider.capabilities().purchaseOutcomeIncludesStoreTime;
+    return (0, _mutex.withTimeout)(launched, includesStoreTime ? _timers.PURCHASE_FLOW_CEILING_MS : resolved.timeouts.purchaseLaunchMs, () => new _errors.PaymentError({
+      code: 'PAYMENT_TIMEOUT',
+      message: 'Opening the purchase surface timed out',
+      operation: 'purchase',
+      retryable: true
+    }));
+  };
+  return {
+    async purchase(productKey, options) {
+      if (!resolved.enabled) {
+        return {
+          kind: 'disabled'
+        };
+      }
+      const status = deps.statusKind();
+      if (status !== 'ready') {
+        return {
+          kind: 'not_ready',
+          status
+        };
+      }
+      const storeProductId = (0, _mapping.storeIdForProductKey)(resolved, productKey);
+      if (!storeProductId) {
+        return {
+          kind: 'unknown_product',
+          productKey
+        };
+      }
+
+      // The block that makes a developer mistake unable to move real money.
+      // Gated on the provider actually being one that would: the fake store
+      // must still be able to complete a purchase in a test (FR-014).
+      if (deps.provider.capabilities().createsRealTransactions && !deps.mayCreateRealTransaction()) {
+        deps.recordBlockedOperation(productKey);
+        return {
+          kind: 'environment_blocked',
+          productKey,
+          environment: deps.config.environment
+        };
+      }
+      const correlationId = deps.nextCorrelationId();
+
+      // Exclusive, not single-flight: a second purchase is refused rather than
+      // joined or queued, so no second store surface opens (FR-031).
+      const attempt = await deps.runExclusive(async () => {
+        deps.emit({
+          type: 'purchase_started',
+          productKey,
+          correlationId
+        });
+        let outcome;
+        try {
+          outcome = await launch(launchRequest(productKey, storeProductId, options));
+        } catch {
+          deps.emit({
+            type: 'purchase_failed',
+            productKey,
+            code: 'PAYMENT_TIMEOUT',
+            retryable: true,
+            correlationId
+          });
+          return {
+            kind: 'timeout',
+            productKey
+          };
+        }
+        if (!outcome.ok) {
+          const mapped = (0, _purchaseFailure.mapFailure)(outcome.reason, productKey, deps.statusKind());
+          if (mapped.kind === 'user_cancelled') {
+            // A normal outcome. Reported on its own channel so it is never
+            // counted as a technical failure (FR-032).
+            deps.emit({
+              type: 'purchase_cancelled',
+              productKey,
+              correlationId
+            });
+            return mapped;
+          }
+          if (mapped.kind === 'already_owned') {
+            // How a reinstall or a new device repairs itself (FR-033).
+            deps.requestSync('already_owned');
+            return mapped;
+          }
+          deps.emit({
+            type: 'purchase_failed',
+            productKey,
+            code: _purchaseFailure.FAILURE_CODES[mapped.kind] ?? 'PAYMENT_STORE_ERROR',
+            retryable: mapped.kind === 'network_error',
+            correlationId
+          });
+          return mapped;
+        }
+        if (outcome.purchase.state === 'pending') {
+          return handlePending(outcome.purchase, productKey);
+        }
+        if (outcome.purchase.state === 'unspecified') {
+          return handleUnspecified(productKey, correlationId);
+        }
+        deps.emit({
+          type: 'purchase_succeeded',
+          productKey,
+          correlationId
+        });
+        return settleOnce(outcome.purchase, productKey, correlationId);
+      });
+      if (!attempt.acquired) {
+        return {
+          kind: 'purchase_in_progress'
+        };
+      }
+      return attempt.value;
+    },
+    /**
+     * A store-pushed update.
+     *
+     * This is how a pending purchase that settled between sessions is granted
+     * without the user buying again (FR-039). It runs outside the exclusive lock
+     * because it is not a user-initiated purchase and must not be refused just
+     * because one is open.
+     */
+    async ingest(purchase) {
+      const productKey = resolved.byStoreId.get(purchase.storeProductId);
+      if (!productKey) {
+        return;
+      }
+      if (purchase.state === 'pending') {
+        handlePending(purchase, productKey);
+        return;
+      }
+      if (purchase.state === 'unspecified') {
+        // No basis to grant or to end anything. The next sync reports what
+        // the store actually holds.
+        return;
+      }
+      const existing = deps.snapshot().purchases.find(p => p.transactionId === purchase.transactionId);
+
+      // Already settled and validated: nothing to redo, and re-running the hook
+      // here would break FR-069a's "new purchases only" rule.
+      if (existing && existing.state === 'purchased' && existing.validationState !== 'not_required') {
+        await deps.finalizer.enqueue(purchase.transactionId);
+        return;
+      }
+      await settleOnce(purchase, productKey, deps.nextCorrelationId());
+    },
+    async revalidate() {
+      const hook = deps.config.validateTransaction;
+      if (!hook) {
+        return;
+      }
+      const queued = deps.snapshot().purchases.filter(p => p.validationState === 'queued_for_revalidation');
+      for (const record of queued) {
+        const entry = resolved.entries.get(record.productKey);
+        let approved;
+        try {
+          const decision = await askHook(hook, {
+            productKey: record.productKey,
+            productType: entry?.productType ?? 'one_time_permanent',
+            // Re-validation deliberately carries no payload: the original
+            // verification material is not persisted (FR-056), so the backend
+            // re-checks by transaction against its own record of the purchase —
+            // which is why the transaction id has to travel with it.
+            verificationPayload: '',
+            correlationId: deps.nextCorrelationId(),
+            transactionId: record.transactionId,
+            platform: deps.platform
+          });
+          approved = decision.approved;
+        } catch {
+          // Still unreachable. Leave it queued and try again next sync rather
+          // than revoking from a paying user because our backend is down.
+          continue;
+        }
+        const snapshot = deps.snapshot();
+        deps.commit({
+          ...snapshot,
+          purchases: snapshot.purchases.map(p => p.transactionId === record.transactionId ? {
+            ...p,
+            validationState: approved ? 'approved' : 'rejected',
+            // A rejection on recovery revokes, which is the bound on the
+            // exposure `grant_and_queue` accepts (FR-072a).
+            state: approved ? p.state : 'revoked'
+          } : p)
+        });
+        deps.emit({
+          type: 'validation_decided',
+          productKey: record.productKey,
+          decision: approved ? 'approved' : 'rejected'
+        });
+      }
+    }
+  };
+}
+//# sourceMappingURL=purchase.js.map

package/lib/commonjs/engine/purchase.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_mutex","require","_timers","_errors","_mapping","_sync","_receiptValidation","_purchaseFailure","createPurchaseFlow","deps","resolved","askHook","validate","createReceiptValidation","config","platform","emit","toRef","record","transactionId","productKey","upsert","snapshot","others","purchases","filter","p","commit","recordFor","purchase","toPersistedRecord","find","inFlightSettle","Map","settleOnce","correlationId","running","get","flight","settle","finally","delete","set","decision","outcome","validationState","finalizeState","finalizer","enqueue","kind","reason","transaction","handlePending","alreadyPending","some","state","type","handleUnspecified","code","retryable","launchRequest","storeProductId","options","replaceKey","replaceProductKey","productType","entries","offerKey","obfuscatedAccountId","replacePurchaseToken","token","undefined","replaceStoreProductId","storeIdForProductKey","prorationMode","launch","request","launched","provider","launchPurchase","includesStoreTime","capabilities","purchaseOutcomeIncludesStoreTime","withTimeout","PURCHASE_FLOW_CEILING_MS","timeouts","purchaseLaunchMs","PaymentError","message","operation","enabled","status","statusKind","createsRealTransactions","mayCreateRealTransaction","recordBlockedOperation","environment","nextCorrelationId","attempt","runExclusive","ok","mapped","mapFailure","requestSync","FAILURE_CODES","acquired","value","ingest","byStoreId","existing","revalidate","hook","validateTransaction","queued","entry","approved","verificationPayload","map"],"sourceRoot":"../../../src","sources":["engine/purchase.ts"],"mappings":";;;;;;AAmCA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AAGA,IAAAG,QAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AAqBA,IAAAK,kBAAA,GAAAL,OAAA;AACA,IAAAM,gBAAA,GAAAN,OAAA;AAhEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA8CA;;AAwBO,SAASO,kBAAkBA,CAACC,IAAsB,EAAgB;EACxE,MAAM;IAAEC;EAAS,CAAC,GAAGD,IAAI;EACzB;EACA,MAAM;IAAEE,OAAO;IAAEC;EAAS,CAAC,GAAG,IAAAC,0CAAuB,EAAC;IACrDC,MAAM,EAAEL,IAAI,CAACK,MAAM;IACnBC,QAAQ,EAAEN,IAAI,CAACM,QAAQ;IACvBL,QAAQ;IACRM,IAAI,EAAEP,IAAI,CAACO;EACZ,CAAC,CAAC;EAEF,MAAMC,KAAK,GAAIC,MAAyB,KAAsB;IAC7DC,aAAa,EAAED,MAAM,CAACC,aAAa;IACnCC,UAAU,EAAEF,MAAM,CAACE;EACpB,CAAC,CAAC;;EAEF;EACA,MAAMC,MAAM,GAAIH,MAAyB,IAAW;IACnD,MAAMI,QAAQ,GAAGb,IAAI,CAACa,QAAQ,CAAC,CAAC;IAChC,MAAMC,MAAM,GAAGD,QAAQ,CAACE,SAAS,CAACC,MAAM,CAACC,CAAC,IAAIA,CAAC,CAACP,aAAa,KAAKD,MAAM,CAACC,aAAa,CAAC;IACvFV,IAAI,CAACkB,MAAM,CAAC;MAAE,GAAGL,QAAQ;MAAEE,SAAS,EAAE,CAAC,GAAGD,MAAM,EAAEL,MAAM;IAAE,CAAC,CAAC;EAC7D,CAAC;EAED,MAAMU,SAAS,GAAGA,CAACC,QAA0B,EAAET,UAAsB,KACpE,IAAAU,uBAAiB,EAChBpB,QAAQ,EACRmB,QAAQ,EACRT,UAAU,EACVX,IAAI,CAACa,QAAQ,CAAC,CAAC,CAACE,SAAS,CAACO,IAAI,CAACL,CAAC,IAAIA,CAAC,CAACP,aAAa,KAAKU,QAAQ,CAACV,aAAa,CAC/E,CAAC;;EAEF;AACD;AACA;AACA;AACA;AACA;AACA;EACC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;EACC,MAAMa,cAAc,GAAG,IAAIC,GAAG,CAAkC,CAAC;EAEjE,MAAMC,UAAU,GAAGA,CAClBL,QAA0B,EAC1BT,UAAsB,EACtBe,aAAqB,KACQ;IAC7B,MAAMC,OAAO,GAAGJ,cAAc,CAACK,GAAG,CAACR,QAAQ,CAACV,aAAa,CAAC;IAC1D,IAAIiB,OAAO,EAAE;MACZ,OAAOA,OAAO;IACf;IACA,MAAME,MAAM,GAAGC,MAAM,CAACV,QAAQ,EAAET,UAAU,EAAEe,aAAa,CAAC,CAACK,OAAO,CAAC,MAAM;MACxER,cAAc,CAACS,MAAM,CAACZ,QAAQ,CAACV,aAAa,CAAC;IAC9C,CAAC,CAAC;IACFa,cAAc,CAACU,GAAG,CAACb,QAAQ,CAACV,aAAa,EAAEmB,MAAM,CAAC;IAClD,OAAOA,MAAM;EACd,CAAC;;EAED;EACA,MAAMC,MAAM,GAAG,MAAAA,CACdV,QAA0B,EAC1BT,UAAsB,EACtBe,aAAqB,KACQ;IAC7B,MAAMQ,QAAQ,GAAG,MAAM/B,QAAQ,CAACiB,QAAQ,EAAET,UAAU,EAAEe,aAAa,CAAC;IAEpE,IAAIQ,QAAQ,CAACC,OAAO,KAAK,UAAU,EAAE;MACpCvB,MAAM,CAAC;QACN,GAAGO,SAAS,CAACC,QAAQ,EAAET,UAAU,CAAC;QAClCyB,eAAe,EAAE,UAAU;QAC3BC,aAAa,EAAE;MAChB,CAAC,CAAC;MACF;MACA;MACA;MACA;MACA,MAAMrC,IAAI,CAACsC,SAAS,CAACC,OAAO,CAACnB,QAAQ,CAACV,aAAa,CAAC;MACpD,OAAO;QACN8B,IAAI,EAAE,qBAAqB;QAC3B7B,UAAU;QACV8B,MAAM,EAAEP,QAAQ,CAACO;MAClB,CAAC;IACF;IAEA7B,MAAM,CAAC;MACN,GAAGO,SAAS,CAACC,QAAQ,EAAET,UAAU,CAAC;MAClCyB,eAAe,EACdF,QAAQ,CAACC,OAAO,KAAK,8BAA8B,GAChD,yBAAyB,GACzB,UAAU;MACdE,aAAa,EAAE;IAChB,CAAC,CAAC;;IAEF;IACA;IACA,MAAMrC,IAAI,CAACsC,SAAS,CAACC,OAAO,CAACnB,QAAQ,CAACV,aAAa,CAAC;IAEpD,MAAMD,MAAM,GAAGT,IAAI,CAACa,QAAQ,CAAC,CAAC,CAACE,SAAS,CAACO,IAAI,CAACL,CAAC,IAAIA,CAAC,CAACP,aAAa,KAAKU,QAAQ,CAACV,aAAa,CAAC;IAC9F,OAAO;MACN8B,IAAI,EAAE,SAAS;MACf7B,UAAU;MACV+B,WAAW,EAAEjC,MAAM,GAAGD,KAAK,CAACC,MAAM,CAAC,GAAG;QAAEC,aAAa,EAAEU,QAAQ,CAACV,aAAa;QAAEC;MAAW;IAC3F,CAAC;EACF,CAAC;EAED,MAAMgC,aAAa,GAAGA,CAACvB,QAA0B,EAAET,UAAsB,KAAqB;IAC7F;IACA;IACA;IACA,MAAMiC,cAAc,GAAG5C,IAAI,CACzBa,QAAQ,CAAC,CAAC,CACVE,SAAS,CAAC8B,IAAI,CAAC5B,CAAC,IAAIA,CAAC,CAACP,aAAa,KAAKU,QAAQ,CAACV,aAAa,IAAIO,CAAC,CAAC6B,KAAK,KAAK,SAAS,CAAC;IAC1FlC,MAAM,CAACO,SAAS,CAACC,QAAQ,EAAET,UAAU,CAAC,CAAC;IACvC,IAAI,CAACiC,cAAc,EAAE;MACpB5C,IAAI,CAACO,IAAI,CAAC;QAAEwC,IAAI,EAAE,kBAAkB;QAAEpC;MAAW,CAAC,CAAC;IACpD;IACA,OAAO;MACN6B,IAAI,EAAE,SAAS;MACf7B,UAAU;MACV+B,WAAW,EAAE;QAAEhC,aAAa,EAAEU,QAAQ,CAACV,aAAa;QAAEC;MAAW;IAClE,CAAC;EACF,CAAC;;EAED;AACD;AACA;AACA;AACA;AACA;AACA;EACC,MAAMqC,iBAAiB,GAAGA,CAACrC,UAAsB,EAAEe,aAAqB,KAAqB;IAC5F1B,IAAI,CAACO,IAAI,CAAC;MACTwC,IAAI,EAAE,iBAAiB;MACvBpC,UAAU;MACVsC,IAAI,EAAE,qBAAqB;MAC3BC,SAAS,EAAE,IAAI;MACfxB;IACD,CAAC,CAAC;IACF,OAAO;MAAEc,IAAI,EAAE,aAAa;MAAE7B,UAAU;MAAEsC,IAAI,EAAE;IAAsB,CAAC;EACxE,CAAC;;EAED;EACA,MAAME,aAAa,GAAGA,CACrBxC,UAAsB,EACtByC,cAA8B,EAC9BC,OAAiC,KACJ;IAC7B,MAAMC,UAAU,GAAGD,OAAO,EAAEE,iBAAiB;IAC7C,OAAO;MACNH,cAAc;MACdI,WAAW,EAAEvD,QAAQ,CAACwD,OAAO,CAAC7B,GAAG,CAACjB,UAAU,CAAC,EAAE6C,WAAW,IAAI,oBAAoB;MAClFE,QAAQ,EAAEL,OAAO,EAAEK,QAAQ;MAC3BC,mBAAmB,EAAEN,OAAO,EAAEM,mBAAmB;MACjD;MACA;MACA;MACA;MACAC,oBAAoB,EAAEN,UAAU,GAC7BtD,IAAI,CACHa,QAAQ,CAAC,CAAC,CACVE,SAAS,CAACO,IAAI,CAACL,CAAC,IAAIA,CAAC,CAACN,UAAU,KAAK2C,UAAU,IAAIrC,CAAC,CAAC6B,KAAK,KAAK,WAAW,CAAC,EAAEe,KAAK,GACnFC,SAAS;MACZC,qBAAqB,EAAET,UAAU,GAAG,IAAAU,6BAAoB,EAAC/D,QAAQ,EAAEqD,UAAU,CAAC,GAAGQ,SAAS;MAC1FG,aAAa,EAAEZ,OAAO,EAAEY;IACzB,CAAC;EACF,CAAC;;EAED;AACD;AACA;AACA;AACA;AACA;AACA;EACC,MAAMC,MAAM,GAAIC,OAAgC,IAAuC;IACtF,MAAMC,QAAQ,GAAGpE,IAAI,CAACqE,QAAQ,CAACC,cAAc,CAACH,OAAO,CAAC;IACtD,MAAMI,iBAAiB,GAAGvE,IAAI,CAACqE,QAAQ,CAACG,YAAY,CAAC,CAAC,CAACC,gCAAgC;IACvF,OAAO,IAAAC,kBAAW,EACjBN,QAAQ,EACRG,iBAAiB,GAAGI,gCAAwB,GAAG1E,QAAQ,CAAC2E,QAAQ,CAACC,gBAAgB,EACjF,MACC,IAAIC,oBAAY,CAAC;MAChB7B,IAAI,EAAE,iBAAiB;MACvB8B,OAAO,EAAE,wCAAwC;MACjDC,SAAS,EAAE,UAAU;MACrB9B,SAAS,EAAE;IACZ,CAAC,CACH,CAAC;EACF,CAAC;EAED,OAAO;IACN,MAAM9B,QAAQA,CACbT,UAAsB,EACtB0C,OAAiC,EACP;MAC1B,IAAI,CAACpD,QAAQ,CAACgF,OAAO,EAAE;QACtB,OAAO;UAAEzC,IAAI,EAAE;QAAW,CAAC;MAC5B;MAEA,MAAM0C,MAAM,GAAGlF,IAAI,CAACmF,UAAU,CAAC,CAAC;MAChC,IAAID,MAAM,KAAK,OAAO,EAAE;QACvB,OAAO;UAAE1C,IAAI,EAAE,WAAW;UAAE0C;QAAO,CAAC;MACrC;MAEA,MAAM9B,cAAc,GAAG,IAAAY,6BAAoB,EAAC/D,QAAQ,EAAEU,UAAU,CAAC;MACjE,IAAI,CAACyC,cAAc,EAAE;QACpB,OAAO;UAAEZ,IAAI,EAAE,iBAAiB;UAAE7B;QAAW,CAAC;MAC/C;;MAEA;MACA;MACA;MACA,IACCX,IAAI,CAACqE,QAAQ,CAACG,YAAY,CAAC,CAAC,CAACY,uBAAuB,IACpD,CAACpF,IAAI,CAACqF,wBAAwB,CAAC,CAAC,EAC/B;QACDrF,IAAI,CAACsF,sBAAsB,CAAC3E,UAAU,CAAC;QACvC,OAAO;UACN6B,IAAI,EAAE,qBAAqB;UAC3B7B,UAAU;UACV4E,WAAW,EAAEvF,IAAI,CAACK,MAAM,CAACkF;QAC1B,CAAC;MACF;MAEA,MAAM7D,aAAa,GAAG1B,IAAI,CAACwF,iBAAiB,CAAC,CAAC;;MAE9C;MACA;MACA,MAAMC,OAAO,GAAG,MAAMzF,IAAI,CAAC0F,YAAY,CAAC,YAAY;QACnD1F,IAAI,CAACO,IAAI,CAAC;UAAEwC,IAAI,EAAE,kBAAkB;UAAEpC,UAAU;UAAEe;QAAc,CAAC,CAAC;QAElE,IAAIS,OAAO;QACX,IAAI;UACHA,OAAO,GAAG,MAAM+B,MAAM,CAACf,aAAa,CAACxC,UAAU,EAAEyC,cAAc,EAAEC,OAAO,CAAC,CAAC;QAC3E,CAAC,CAAC,MAAM;UACPrD,IAAI,CAACO,IAAI,CAAC;YACTwC,IAAI,EAAE,iBAAiB;YACvBpC,UAAU;YACVsC,IAAI,EAAE,iBAAiB;YACvBC,SAAS,EAAE,IAAI;YACfxB;UACD,CAAC,CAAC;UACF,OAAO;YAAEc,IAAI,EAAE,SAAS;YAAE7B;UAAW,CAAC;QACvC;QAEA,IAAI,CAACwB,OAAO,CAACwD,EAAE,EAAE;UAChB,MAAMC,MAAM,GAAG,IAAAC,2BAAU,EAAC1D,OAAO,CAACM,MAAM,EAAE9B,UAAU,EAAEX,IAAI,CAACmF,UAAU,CAAC,CAAC,CAAC;UAExE,IAAIS,MAAM,CAACpD,IAAI,KAAK,gBAAgB,EAAE;YACrC;YACA;YACAxC,IAAI,CAACO,IAAI,CAAC;cAAEwC,IAAI,EAAE,oBAAoB;cAAEpC,UAAU;cAAEe;YAAc,CAAC,CAAC;YACpE,OAAOkE,MAAM;UACd;UAEA,IAAIA,MAAM,CAACpD,IAAI,KAAK,eAAe,EAAE;YACpC;YACAxC,IAAI,CAAC8F,WAAW,CAAC,eAAe,CAAC;YACjC,OAAOF,MAAM;UACd;UAEA5F,IAAI,CAACO,IAAI,CAAC;YACTwC,IAAI,EAAE,iBAAiB;YACvBpC,UAAU;YACVsC,IAAI,EAAE8C,8BAAa,CAACH,MAAM,CAACpD,IAAI,CAAC,IAAI,qBAAqB;YACzDU,SAAS,EAAE0C,MAAM,CAACpD,IAAI,KAAK,eAAe;YAC1Cd;UACD,CAAC,CAAC;UACF,OAAOkE,MAAM;QACd;QAEA,IAAIzD,OAAO,CAACf,QAAQ,CAAC0B,KAAK,KAAK,SAAS,EAAE;UACzC,OAAOH,aAAa,CAACR,OAAO,CAACf,QAAQ,EAAET,UAAU,CAAC;QACnD;QAEA,IAAIwB,OAAO,CAACf,QAAQ,CAAC0B,KAAK,KAAK,aAAa,EAAE;UAC7C,OAAOE,iBAAiB,CAACrC,UAAU,EAAEe,aAAa,CAAC;QACpD;QAEA1B,IAAI,CAACO,IAAI,CAAC;UAAEwC,IAAI,EAAE,oBAAoB;UAAEpC,UAAU;UAAEe;QAAc,CAAC,CAAC;QACpE,OAAOD,UAAU,CAACU,OAAO,CAACf,QAAQ,EAAET,UAAU,EAAEe,aAAa,CAAC;MAC/D,CAAC,CAAC;MAEF,IAAI,CAAC+D,OAAO,CAACO,QAAQ,EAAE;QACtB,OAAO;UAAExD,IAAI,EAAE;QAAuB,CAAC;MACxC;MACA,OAAOiD,OAAO,CAACQ,KAAK;IACrB,CAAC;IAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;IACE,MAAMC,MAAMA,CAAC9E,QAA0B,EAAiB;MACvD,MAAMT,UAAU,GAAGV,QAAQ,CAACkG,SAAS,CAACvE,GAAG,CAACR,QAAQ,CAACgC,cAAc,CAAC;MAClE,IAAI,CAACzC,UAAU,EAAE;QAChB;MACD;MAEA,IAAIS,QAAQ,CAAC0B,KAAK,KAAK,SAAS,EAAE;QACjCH,aAAa,CAACvB,QAAQ,EAAET,UAAU,CAAC;QACnC;MACD;MAEA,IAAIS,QAAQ,CAAC0B,KAAK,KAAK,aAAa,EAAE;QACrC;QACA;QACA;MACD;MAEA,MAAMsD,QAAQ,GAAGpG,IAAI,CACnBa,QAAQ,CAAC,CAAC,CACVE,SAAS,CAACO,IAAI,CAACL,CAAC,IAAIA,CAAC,CAACP,aAAa,KAAKU,QAAQ,CAACV,aAAa,CAAC;;MAEjE;MACA;MACA,IACC0F,QAAQ,IACRA,QAAQ,CAACtD,KAAK,KAAK,WAAW,IAC9BsD,QAAQ,CAAChE,eAAe,KAAK,cAAc,EAC1C;QACD,MAAMpC,IAAI,CAACsC,SAAS,CAACC,OAAO,CAACnB,QAAQ,CAACV,aAAa,CAAC;QACpD;MACD;MAEA,MAAMe,UAAU,CAACL,QAAQ,EAAET,UAAU,EAAEX,IAAI,CAACwF,iBAAiB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAMa,UAAUA,CAAA,EAAkB;MACjC,MAAMC,IAAI,GAAGtG,IAAI,CAACK,MAAM,CAACkG,mBAAmB;MAC5C,IAAI,CAACD,IAAI,EAAE;QACV;MACD;MAEA,MAAME,MAAM,GAAGxG,IAAI,CACjBa,QAAQ,CAAC,CAAC,CACVE,SAAS,CAACC,MAAM,CAACC,CAAC,IAAIA,CAAC,CAACmB,eAAe,KAAK,yBAAyB,CAAC;MAExE,KAAK,MAAM3B,MAAM,IAAI+F,MAAM,EAAE;QAC5B,MAAMC,KAAK,GAAGxG,QAAQ,CAACwD,OAAO,CAAC7B,GAAG,CAACnB,MAAM,CAACE,UAAU,CAAC;QACrD,IAAI+F,QAAiB;QACrB,IAAI;UACH,MAAMxE,QAAQ,GAAG,MAAMhC,OAAO,CAACoG,IAAI,EAAE;YACpC3F,UAAU,EAAEF,MAAM,CAACE,UAAU;YAC7B6C,WAAW,EAAEiD,KAAK,EAAEjD,WAAW,IAAI,oBAAoB;YACvD;YACA;YACA;YACA;YACAmD,mBAAmB,EAAE,EAAE;YACvBjF,aAAa,EAAE1B,IAAI,CAACwF,iBAAiB,CAAC,CAAC;YACvC9E,aAAa,EAAED,MAAM,CAACC,aAAa;YACnCJ,QAAQ,EAAEN,IAAI,CAACM;UAChB,CAAC,CAAC;UACFoG,QAAQ,GAAGxE,QAAQ,CAACwE,QAAQ;QAC7B,CAAC,CAAC,MAAM;UACP;UACA;UACA;QACD;QAEA,MAAM7F,QAAQ,GAAGb,IAAI,CAACa,QAAQ,CAAC,CAAC;QAChCb,IAAI,CAACkB,MAAM,CAAC;UACX,GAAGL,QAAQ;UACXE,SAAS,EAAEF,QAAQ,CAACE,SAAS,CAAC6F,GAAG,CAAC3F,CAAC,IAClCA,CAAC,CAACP,aAAa,KAAKD,MAAM,CAACC,aAAa,GACrC;YACA,GAAGO,CAAC;YACJmB,eAAe,EAAEsE,QAAQ,GAAG,UAAU,GAAG,UAAU;YACnD;YACA;YACA5D,KAAK,EAAE4D,QAAQ,GAAGzF,CAAC,CAAC6B,KAAK,GAAG;UAC7B,CAAC,GACA7B,CACJ;QACD,CAAC,CAAC;QAEFjB,IAAI,CAACO,IAAI,CAAC;UACTwC,IAAI,EAAE,oBAAoB;UAC1BpC,UAAU,EAAEF,MAAM,CAACE,UAAU;UAC7BuB,QAAQ,EAAEwE,QAAQ,GAAG,UAAU,GAAG;QACnC,CAAC,CAAC;MACH;IACD;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/engine/purchaseFailure.js

@@ -0,0 +1,77 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.FAILURE_CODES = void 0;
+exports.mapFailure = mapFailure;
+/**
+ * What a refused purchase means to the app (PAY-19).
+ *
+ * The store answers with a reason of its own; this turns it into the result the
+ * app sees, under the code it can branch on, so no store vocabulary leaks out.
+ * Split from the flow next door, which is about the sequence of calls.
+ */
+
+const FAILURE_CODES = exports.FAILURE_CODES = {
+  network_error: 'PAYMENT_NETWORK_ERROR',
+  unknown_product: 'PAYMENT_UNKNOWN_PRODUCT',
+  ineligible: 'PAYMENT_INELIGIBLE',
+  product_unavailable_in_region: 'PAYMENT_PRODUCT_UNAVAILABLE_IN_REGION'
+};
+
+/** Maps a provider failure onto the public vocabulary, so no store code leaks out. */
+function mapFailure(reason, productKey, status) {
+  switch (reason) {
+    case 'user_cancelled':
+      return {
+        kind: 'user_cancelled',
+        productKey
+      };
+    case 'already_owned':
+      return {
+        kind: 'already_owned',
+        productKey
+      };
+    case 'ineligible':
+      return {
+        kind: 'ineligible',
+        productKey
+      };
+    case 'unknown_product':
+      return {
+        kind: 'unknown_product',
+        productKey
+      };
+    case 'product_unavailable_in_region':
+      return {
+        kind: 'product_unavailable_in_region',
+        productKey
+      };
+    case 'not_ready':
+      // The engine's real status, not a guess (PAY-19).
+      return {
+        kind: 'not_ready',
+        status
+      };
+    case 'network_error':
+      return {
+        kind: 'network_error',
+        productKey
+      };
+    case 'timeout':
+      return {
+        kind: 'timeout',
+        productKey
+      };
+    case 'store_error':
+      return {
+        kind: 'store_error',
+        productKey,
+        code: 'PAYMENT_STORE_ERROR'
+      };
+  }
+}
+
+/** Plan-change parameters, which only `subscriptions.ts` supplies. */
+//# sourceMappingURL=purchaseFailure.js.map

package/lib/commonjs/engine/purchaseFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["FAILURE_CODES","exports","network_error","unknown_product","ineligible","product_unavailable_in_region","mapFailure","reason","productKey","status","kind","code"],"sourceRoot":"../../../src","sources":["engine/purchaseFailure.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKO,MAAMA,aAAwE,GAAAC,OAAA,CAAAD,aAAA,GAAG;EACvFE,aAAa,EAAE,uBAAuB;EACtCC,eAAe,EAAE,yBAAyB;EAC1CC,UAAU,EAAE,oBAAoB;EAChCC,6BAA6B,EAAE;AAChC,CAAC;;AAED;AACO,SAASC,UAAUA,CACzBC,MAA6B,EAC7BC,UAAsB,EACtBC,MAAyB,EACR;EACjB,QAAQF,MAAM;IACb,KAAK,gBAAgB;MACpB,OAAO;QAAEG,IAAI,EAAE,gBAAgB;QAAEF;MAAW,CAAC;IAC9C,KAAK,eAAe;MACnB,OAAO;QAAEE,IAAI,EAAE,eAAe;QAAEF;MAAW,CAAC;IAC7C,KAAK,YAAY;MAChB,OAAO;QAAEE,IAAI,EAAE,YAAY;QAAEF;MAAW,CAAC;IAC1C,KAAK,iBAAiB;MACrB,OAAO;QAAEE,IAAI,EAAE,iBAAiB;QAAEF;MAAW,CAAC;IAC/C,KAAK,+BAA+B;MACnC,OAAO;QAAEE,IAAI,EAAE,+BAA+B;QAAEF;MAAW,CAAC;IAC7D,KAAK,WAAW;MACf;MACA,OAAO;QAAEE,IAAI,EAAE,WAAW;QAAED;MAAO,CAAC;IACrC,KAAK,eAAe;MACnB,OAAO;QAAEC,IAAI,EAAE,eAAe;QAAEF;MAAW,CAAC;IAC7C,KAAK,SAAS;MACb,OAAO;QAAEE,IAAI,EAAE,SAAS;QAAEF;MAAW,CAAC;IACvC,KAAK,aAAa;MACjB,OAAO;QAAEE,IAAI,EAAE,aAAa;QAAEF,UAAU;QAAEG,IAAI,EAAE;MAAsB,CAAC;EACzE;AACD;;AAEA","ignoreList":[]}

package/lib/commonjs/engine/receiptValidation.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createReceiptValidation = createReceiptValidation;
+var _mutex = require("../core/mutex.js");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Asking the app's backend whether a purchase is real (FR-069a, FR-072b).
+ *
+ * The hook is optional and bounded by a timeout, and its answer decides whether
+ * an entitlement is granted — so what happens when it throws, times out, or is
+ * absent is the whole point of this module. Split from the flow next door,
+ * which is about the sequence of store calls.
+ *
+ * A hook that could not answer is never an implicit approval: the configured
+ * `onValidationUnavailable` decides, and the default refuses.
+ */
+
+/** What the backend decided about one purchase. */
+
+function createReceiptValidation(deps) {
+  const {
+    resolved
+  } = deps;
+  const askHook = (hook, candidate) => (0, _mutex.withTimeout)(hook(candidate), resolved.timeouts.validateMs, () => new _errors.PaymentError({
+    code: 'PAYMENT_VALIDATION_UNAVAILABLE',
+    message: 'The validation hook did not answer in time',
+    operation: 'validate',
+    retryable: true
+  }));
+
+  /**
+   * Runs the app's backend check, if configured.
+   *
+   * Called for newly completed purchases only (FR-069a) — sync and restore trust
+   * a decision already made, which is what keeps restore working while the
+   * backend is unreachable.
+   */
+  const validate = async (purchase, productKey, correlationId) => {
+    const hook = deps.config.validateTransaction;
+    if (!hook) {
+      return {
+        outcome: 'approved'
+      };
+    }
+    const entry = resolved.entries.get(productKey);
+    try {
+      const decision = await askHook(hook, {
+        productKey,
+        productType: entry?.productType ?? 'one_time_permanent',
+        verificationPayload: purchase.verificationPayload ?? '',
+        correlationId,
+        transactionId: purchase.transactionId,
+        platform: deps.platform
+      });
+      deps.emit({
+        type: 'validation_decided',
+        productKey,
+        decision: decision.approved ? 'approved' : 'rejected'
+      });
+      return decision.approved ? {
+        outcome: 'approved'
+      } : {
+        outcome: 'rejected',
+        reason: decision.reason
+      };
+    } catch {
+      // A hook that throws is unavailable, never an implicit approval (FR-072b).
+      const fallback = resolved.onValidationUnavailable;
+      deps.emit({
+        type: 'validation_unavailable',
+        productKey,
+        fallback
+      });
+      return fallback === 'grant_and_queue' ? {
+        outcome: 'granted_pending_revalidation'
+      } : {
+        outcome: 'rejected',
+        reason: 'validation_unavailable'
+      };
+    }
+  };
+  return {
+    askHook,
+    validate
+  };
+}
+//# sourceMappingURL=receiptValidation.js.map

package/lib/commonjs/engine/receiptValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_mutex","require","_errors","createReceiptValidation","deps","resolved","askHook","hook","candidate","withTimeout","timeouts","validateMs","PaymentError","code","message","operation","retryable","validate","purchase","productKey","correlationId","config","validateTransaction","outcome","entry","entries","get","decision","productType","verificationPayload","transactionId","platform","emit","type","approved","reason","fallback","onValidationUnavailable"],"sourceRoot":"../../../src","sources":["engine/receiptValidation.ts"],"mappings":";;;;;;AAeA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAeA;;AAMO,SAASE,uBAAuBA,CAACC,IAA2B,EAAE;EACpE,MAAM;IAAEC;EAAS,CAAC,GAAGD,IAAI;EAEzB,MAAME,OAAO,GAAGA,CACfC,IAAuD,EACvDC,SAA2E,KAE3E,IAAAC,kBAAW,EACVF,IAAI,CAACC,SAAS,CAAC,EACfH,QAAQ,CAACK,QAAQ,CAACC,UAAU,EAC5B,MACC,IAAIC,oBAAY,CAAC;IAChBC,IAAI,EAAE,gCAAgC;IACtCC,OAAO,EAAE,4CAA4C;IACrDC,SAAS,EAAE,UAAU;IACrBC,SAAS,EAAE;EACZ,CAAC,CACH,CAAC;;EAEF;AACD;AACA;AACA;AACA;AACA;AACA;EACC,MAAMC,QAAQ,GAAG,MAAAA,CAChBC,QAA0B,EAC1BC,UAAsB,EACtBC,aAAqB,KAKjB;IACJ,MAAMb,IAAI,GAAGH,IAAI,CAACiB,MAAM,CAACC,mBAAmB;IAC5C,IAAI,CAACf,IAAI,EAAE;MACV,OAAO;QAAEgB,OAAO,EAAE;MAAW,CAAC;IAC/B;IAEA,MAAMC,KAAK,GAAGnB,QAAQ,CAACoB,OAAO,CAACC,GAAG,CAACP,UAAU,CAAC;IAC9C,IAAI;MACH,MAAMQ,QAAQ,GAAG,MAAMrB,OAAO,CAACC,IAAI,EAAE;QACpCY,UAAU;QACVS,WAAW,EAAEJ,KAAK,EAAEI,WAAW,IAAI,oBAAoB;QACvDC,mBAAmB,EAAEX,QAAQ,CAACW,mBAAmB,IAAI,EAAE;QACvDT,aAAa;QACbU,aAAa,EAAEZ,QAAQ,CAACY,aAAa;QACrCC,QAAQ,EAAE3B,IAAI,CAAC2B;MAChB,CAAC,CAAC;MACF3B,IAAI,CAAC4B,IAAI,CAAC;QACTC,IAAI,EAAE,oBAAoB;QAC1Bd,UAAU;QACVQ,QAAQ,EAAEA,QAAQ,CAACO,QAAQ,GAAG,UAAU,GAAG;MAC5C,CAAC,CAAC;MACF,OAAOP,QAAQ,CAACO,QAAQ,GACrB;QAAEX,OAAO,EAAE;MAAW,CAAC,GACvB;QAAEA,OAAO,EAAE,UAAU;QAAEY,MAAM,EAAER,QAAQ,CAACQ;MAAO,CAAC;IACpD,CAAC,CAAC,MAAM;MACP;MACA,MAAMC,QAAQ,GAAG/B,QAAQ,CAACgC,uBAAuB;MACjDjC,IAAI,CAAC4B,IAAI,CAAC;QAAEC,IAAI,EAAE,wBAAwB;QAAEd,UAAU;QAAEiB;MAAS,CAAC,CAAC;MACnE,OAAOA,QAAQ,KAAK,iBAAiB,GAClC;QAAEb,OAAO,EAAE;MAA+B,CAAC,GAC3C;QAAEA,OAAO,EAAE,UAAU;QAAEY,MAAM,EAAE;MAAyB,CAAC;IAC7D;EACD,CAAC;EAED,OAAO;IAAE7B,OAAO;IAAEW;EAAS,CAAC;AAC7B","ignoreList":[]}