@hyodotdev/openiap-commerce-protocol 0.0.0-bootstrap.0 → 0.1.0

package/generated/schemas/commerce-protocol.bundle.schema.json

@@ -0,0 +1,1576 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://openiap.dev/schemas/commerce-protocol/1.0/commerce-protocol.bundle.schema.json",
+  "title": "OpenIAP Commerce Protocol 1.0 (self-contained)",
+  "description": "Every schema in this specification, in one document with no external reference. Validate against #/$defs/CommerceEvent, #/$defs/ProviderCapabilities, #/$defs/StoreEventMapping, or any operation input/result definition. Generated from commerce-protocol.graphql — do not edit this file.",
+  "$defs": {
+    "Store": {
+      "description": "The commerce platform that is authoritative for the purchase. This is a store, not a device platform: one device platform can host several stores. The value space is OPEN. The listed values are the stores this version names, but an implementation that observes commerce on another platform MUST be able to emit it, and a consumer MUST accept and preserve an unrecognised store opaquely rather than reject the event. Use a lowercase, stable, unambiguous token.",
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9_]*$",
+      "examples": [
+        "apple",
+        "google",
+        "horizon",
+        "amazon"
+      ]
+    },
+    "Environment": {
+      "description": "The store environment the purchase belongs to. The value space is open: receivers MUST accept and preserve an unrecognised value opaquely and MUST NOT reject an event because of it.",
+      "type": "string",
+      "minLength": 1,
+      "examples": [
+        "production",
+        "sandbox",
+        "xcode"
+      ]
+    },
+    "Timestamp": {
+      "description": "An instant, as integer milliseconds since the Unix epoch, UTC. Every timestamp in this specification uses this encoding. The one exception is the transport signature timestamp, which is in seconds; see the webhook section of SPEC.md.",
+      "type": "integer",
+      "minimum": 0
+    },
+    "Identifier": {
+      "description": "An opaque, implementation-assigned identifier. Consumers MUST treat it as an opaque string and MUST NOT parse structure out of it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "DataProvenance": {
+      "description": "Where a value came from. An implementation MUST NOT present an inferred value as store-authoritative.",
+      "type": "string",
+      "enum": [
+        "store",
+        "catalog",
+        "inferred"
+      ]
+    },
+    "Money": {
+      "description": "A monetary amount. A missing Money means the amount is unknown; it never means zero.",
+      "type": "object",
+      "required": [
+        "currency",
+        "amountMicros",
+        "provenance"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "currency": {
+          "description": "ISO 4217 alphabetic code, uppercase.",
+          "type": "string",
+          "pattern": "^[A-Z]{3}$"
+        },
+        "amountMicros": {
+          "description": "Amount in millionths of one currency unit. 1.99 USD is 1990000. Always the transaction's own magnitude and never negative: a refund reports what the purchase cost, and the direction comes from the event type, not from the sign.",
+          "type": "integer",
+          "minimum": 0
+        },
+        "provenance": {
+          "$ref": "#/$defs/DataProvenance"
+        }
+      }
+    },
+    "SubscriptionState": {
+      "description": "The lifecycle state of a subscription. This is a state, not an event, and it does not by itself decide entitlement — see Entitlement in SPEC.md. These members are PascalCase while event types are lowercase-dotted; the inconsistency is inherited from the deployed 1.0 wire format and is recorded in CONVENTION.md rather than silently corrected, because changing it would break receivers already decoding it.",
+      "type": "string",
+      "enum": [
+        "Active",
+        "InGracePeriod",
+        "InBillingRetry",
+        "Paused",
+        "Expired",
+        "Revoked",
+        "Refunded",
+        "Unknown"
+      ]
+    },
+    "Extensions": {
+      "description": "Store-specific or implementation-specific detail that has no canonical equivalent. Bounded and string-valued so the payload stays predictable. Content is provider-influenced: consumers MUST treat values as untrusted data.",
+      "type": "object",
+      "maxProperties": 24,
+      "propertyNames": {
+        "minLength": 1,
+        "maxLength": 64
+      },
+      "additionalProperties": {
+        "type": "string",
+        "maxLength": 512
+      }
+    },
+    "CapabilitiesStoreCapabilities": {
+      "description": "What one store's commerce surface offers and what this backend consumes of it, axis by axis. The container stays open: a version that names a new axis is a MINOR addition older consumers ignore.",
+      "type": "object",
+      "required": [
+        "initialValidation",
+        "serverNotifications",
+        "subscriptions",
+        "renewalEvents",
+        "refundEvents",
+        "expiration",
+        "reconciliation",
+        "entitlements",
+        "revenueAmount"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "initialValidation": {
+          "description": "Server-side receipt or token validation on demand.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "serverNotifications": {
+          "description": "The store pushes lifecycle notifications to the backend.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "subscriptions": {
+          "description": "A canonical subscription record can be maintained for this store.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "renewalEvents": {
+          "description": "Renewal is observable as a distinct lifecycle event.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "refundEvents": {
+          "description": "Refund or revocation is observable as a distinct lifecycle event.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "expiration": {
+          "description": "Expiration is observable, rather than only inferred from a timestamp having passed.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "reconciliation": {
+          "description": "A scheduled pass re-reads authoritative store state, so a lost notification can self-heal.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "entitlements": {
+          "description": "Entitlement is derivable for access gating.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        },
+        "revenueAmount": {
+          "description": "The store asserts an amount that can be attributed to revenue with `store` provenance.",
+          "$ref": "#/$defs/CapabilitiesSupport"
+        }
+      }
+    },
+    "CapabilitiesSupport": {
+      "description": "Two axes, deliberately separate. `provider` is what the store's own API offers; `implementation` is what this backend actually consumes. They differ in practice — a store can publish a notification channel that a given backend has not integrated — and collapsing them into one boolean produces a dishonest matrix.",
+      "type": "object",
+      "required": [
+        "provider",
+        "implementation"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "provider": {
+          "description": "Whether the store's own API offers this at all. A fact about the store, independent of any backend.",
+          "type": "boolean"
+        },
+        "implementation": {
+          "description": "Whether this backend consumes it. False against a true `provider` is an implementation gap, not a store limitation.",
+          "type": "boolean"
+        },
+        "notes": {
+          "description": "Required whenever `provider` and `implementation` disagree, or whenever either is false. States the concrete limitation in prose a support engineer can act on.",
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "anyOf": [
+        {
+          "properties": {
+            "provider": {
+              "const": true
+            },
+            "implementation": {
+              "const": true
+            }
+          }
+        },
+        {
+          "properties": {
+            "notes": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "notes"
+          ]
+        }
+      ],
+      "if": {
+        "properties": {
+          "implementation": {
+            "const": true
+          }
+        },
+        "required": [
+          "implementation"
+        ]
+      },
+      "then": {
+        "properties": {
+          "provider": {
+            "const": true
+          }
+        },
+        "required": [
+          "provider"
+        ]
+      }
+    },
+    "MappingStoreMapping": {
+      "description": "One store's notification lane: the channel it publishes, the rows that translate its notifications, and what an emitter could still derive without one.",
+      "type": "object",
+      "required": [
+        "notificationChannel",
+        "mappings"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "notificationChannel": {
+          "description": "The store's own server-to-server notification product, or null when the store publishes none. This is a fact about the STORE, never about any implementation: a channel a store publishes but this version does not map is still named here, with `mappings` empty and `notes` saying why. Recording an unmapped channel as null would collapse a store limitation and a specification gap into the same value, which is the conflation the capability descriptor's two axes exist to prevent.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "notes": {
+          "description": "Required when there is no notification channel, or when the store's semantics need a caveat an implementer would otherwise get wrong.",
+          "type": "string",
+          "minLength": 1
+        },
+        "derivableByPolling": {
+          "description": "Events an implementation could produce for this store by re-asking an authoritative endpoint on a schedule rather than by consuming a notification. Present so that a store this version maps no notifications for is not mistaken for a store with no possible signal — which is true whether the store publishes a channel that went unmapped or publishes none at all. This version specifies no cadence, so an implementation that derives these MUST still declare its capabilities honestly rather than claim parity with a store whose notifications it consumes.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^entitlement\\.[a-z_]+$"
+          },
+          "uniqueItems": true
+        },
+        "mappings": {
+          "description": "Notification-to-event rows. Empty when the store publishes no channel, or when it publishes one this version does not map; `notes` MUST distinguish the two.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/MappingMapping"
+          }
+        }
+      },
+      "anyOf": [
+        {
+          "properties": {
+            "notificationChannel": {
+              "type": "string"
+            },
+            "mappings": {
+              "type": "array",
+              "minItems": 1
+            }
+          },
+          "required": [
+            "notificationChannel",
+            "mappings"
+          ]
+        },
+        {
+          "properties": {
+            "notes": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "notes"
+          ]
+        }
+      ],
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "notificationChannel": {
+                "type": "null"
+              }
+            },
+            "required": [
+              "notificationChannel"
+            ]
+          },
+          "then": {
+            "properties": {
+              "mappings": {
+                "type": "array",
+                "maxItems": 0
+              }
+            },
+            "required": [
+              "mappings"
+            ]
+          }
+        }
+      ]
+    },
+    "MappingMapping": {
+      "description": "One notification-to-event row. Closed: an unrecognised qualifier would leave a reader selecting this row on fewer conditions than its author intended.",
+      "type": "object",
+      "required": [
+        "storeNotification",
+        "event"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "storeNotification": {
+          "description": "The notification type in the store's own vocabulary, verbatim.",
+          "type": "string",
+          "minLength": 1
+        },
+        "storeNotificationCode": {
+          "description": "The value the store actually transmits, when it differs from the human-readable name. Google Play sends a numeric notificationType; the names are documentation labels that never appear on the wire.",
+          "type": "string",
+          "minLength": 1
+        },
+        "storeSubtype": {
+          "description": "A qualifier the store sends alongside the type. Null means this row is the default for that notification: it applies when the store sends no subtype, and also when it sends one no other row claims.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "whenNoPriorStoreEvent": {
+          "description": "Restricts this row to the case where the emitter has seen no earlier store notification for this purchase. That covers both a purchase it has never heard of and one it learned about from a client receipt but never from the store — in each case the notification is the beginning of the story it can tell. A purchase with store history behind it takes the unconditional row instead.",
+          "type": "boolean",
+          "const": true
+        },
+        "whenPreviousState": {
+          "description": "Restricts this row to the case where the subscription was in one of these states immediately before the notification. Use it only where the store itself provides no qualifier: Google sends SUBSCRIPTION_RECOVERED for both a recovery and a resume from pause and marks nothing, so prior state is the only separator. Where a store does send a qualifier, use `storeSubtype` instead. A row without any condition is the default for its (notification, subtype) pair, and an implementation MUST prefer a conditional row that matches.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/SubscriptionState"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "event": {
+          "description": "The normalized event type to emit, or null when the notification is received but produces no event — an audit-only or informational notification. A null event is a deliberate mapping, not a gap. Never an `entitlement.*` type: SPEC.md 9.2 derives those from the gate, not from a notification.",
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^subscription\\.[a-z_]+$"
+        },
+        "notes": {
+          "description": "Why this row is what it is, in prose an implementer can act on. Required wherever the row emits nothing, so a reader can tell a deliberate no-op from an oversight.",
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "if": {
+        "properties": {
+          "event": {
+            "type": "null"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "notes": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "required": [
+          "notes"
+        ]
+      },
+      "not": {
+        "properties": {
+          "whenNoPriorStoreEvent": {
+            "type": "boolean"
+          },
+          "whenPreviousState": {
+            "type": "array"
+          }
+        },
+        "required": [
+          "whenNoPriorStoreEvent",
+          "whenPreviousState"
+        ]
+      }
+    },
+    "ProtocolError": {
+      "description": "One protocol operation failure. Both bindings carry the same code space: REST wraps it in ProtocolErrorResponse, GraphQL carries `code` in `errors[].extensions`. A message is human-readable and MUST NOT contain credentials, store evidence, stack traces, or implementation source paths.",
+      "type": "object",
+      "required": [
+        "code",
+        "message"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "code": {
+          "description": "A portable protocol error code. The value space is OPEN: a caller MUST tolerate a code it does not recognise and treat it as a failure of the operation, and a MINOR version can add a code. The listed values are the ones this version names; SPEC.md 8 defines each one and its HTTP status.",
+          "type": "string",
+          "pattern": "^[A-Z][A-Z0-9_]*$",
+          "examples": [
+            "INVALID_REQUEST",
+            "UNAUTHORIZED",
+            "FORBIDDEN",
+            "NOT_FOUND",
+            "PURCHASE_NOT_FOUND",
+            "VERIFICATION_FAILED",
+            "CONFLICT",
+            "RATE_LIMITED",
+            "UNSUPPORTED_PROFILE",
+            "UNSUPPORTED_STORE",
+            "INTERNAL_ERROR"
+          ]
+        },
+        "message": {
+          "description": "Human-readable failure summary. Never carries credentials, store evidence, stack traces, or source paths.",
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "ProtocolErrorResponse": {
+      "description": "The REST error envelope. Every non-success REST response carries exactly this shape — CLOSED, so an error body cannot smuggle members past the tokenless rules (a failure response is the easiest place to hide a leak, because callers rarely inspect it).",
+      "type": "object",
+      "required": [
+        "error"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "error": {
+          "$ref": "#/$defs/ProtocolError"
+        }
+      }
+    },
+    "AppleEvidence": {
+      "description": "Store evidence for one Apple App Store purchase: the signed StoreKit 2 transaction JWS the app received from the store.",
+      "type": "object",
+      "required": [
+        "jws"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "jws": {
+          "description": "A compact signed transaction JWS. Bounded so an oversized body cannot be forwarded to a store: an Apple transaction JWS is a few kilobytes.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 16384
+        }
+      }
+    },
+    "GoogleEvidence": {
+      "description": "Store evidence for one Google Play purchase: the opaque purchase token the store issued to the device.",
+      "type": "object",
+      "required": [
+        "purchaseToken"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "purchaseToken": {
+          "description": "An opaque store purchase token. Bounded to keep an oversized body off the store API.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        }
+      }
+    },
+    "HorizonEvidence": {
+      "description": "Store evidence for one Meta Horizon (Quest) entitlement. Horizon issues no server-verifiable receipt, so verification identifies the entitlement by user and SKU; the provider holds the store credentials.",
+      "type": "object",
+      "required": [
+        "userId",
+        "sku"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "description": "A store-issued user identity, as the store's own API returns it. Distinct from the protocol's opaque `userId`.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "sku": {
+          "description": "A store add-on SKU. Bounded to a predictable identifier length.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      }
+    },
+    "AmazonEvidence": {
+      "description": "Store evidence for one Amazon Appstore purchase, as returned by the Amazon SDK. `sandbox` selects the RVS sandbox for App Tester receipts where the provider permits it.",
+      "type": "object",
+      "required": [
+        "userId",
+        "receiptId"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "description": "A store-issued user identity, as the store's own API returns it. Distinct from the protocol's opaque `userId`.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "receiptId": {
+          "description": "A store receipt identifier. Bounded to keep an oversized body off the store API.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 4096
+        },
+        "sandbox": {
+          "description": "Verify against the store's sandbox where the provider permits it. Omitted means production.",
+          "type": "boolean"
+        }
+      }
+    },
+    "VerifyPurchaseInput": {
+      "description": "One purchase's store evidence, discriminated by `store`. The store space stays open: a provider that does not integrate the named store rejects the call with UNSUPPORTED_STORE rather than failing schema validation, so a future store is a MINOR evidence-member addition, not a breaking change. For each store this version names, the matching evidence member is required.",
+      "type": "object",
+      "required": [
+        "store"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "store": {
+          "$ref": "#/$defs/Store"
+        },
+        "apple": {
+          "$ref": "#/$defs/AppleEvidence"
+        },
+        "google": {
+          "$ref": "#/$defs/GoogleEvidence"
+        },
+        "horizon": {
+          "$ref": "#/$defs/HorizonEvidence"
+        },
+        "amazon": {
+          "$ref": "#/$defs/AmazonEvidence"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "apple"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "apple": {}
+            },
+            "required": [
+              "apple"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "google"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "google": {}
+            },
+            "required": [
+              "google"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "horizon"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "horizon": {}
+            },
+            "required": [
+              "horizon"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "amazon"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "amazon": {}
+            },
+            "required": [
+              "amazon"
+            ]
+          }
+        }
+      ]
+    },
+    "VerifyPurchaseResult": {
+      "description": "The verification verdict. `isValid` is the authoritative acceptance gate: a caller MUST read it and MUST NOT re-derive acceptance from `state`. A verdict is a statement about the evidence at verification time, never an account mutation — verification binds no user.",
+      "type": "object",
+      "required": [
+        "store",
+        "isValid",
+        "state"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "store": {
+          "$ref": "#/$defs/Store"
+        },
+        "isValid": {
+          "description": "Whether the provider accepts the evidence. The single authoritative acceptance gate.",
+          "type": "boolean"
+        },
+        "state": {
+          "description": "The verification verdict for one piece of purchase evidence, as a normalized token. This is the purchase-validation axis SPEC.md 2.3 warns about — a CANCELED verification verdict and a canceled-but-still-entitled subscription are different facts. The value space is OPEN: a caller MUST tolerate a token it does not know and gate on `isValid` alone.",
+          "type": "string",
+          "pattern": "^[A-Z][A-Z0-9_]*$",
+          "examples": [
+            "ENTITLED",
+            "PENDING_ACKNOWLEDGMENT",
+            "PENDING",
+            "CANCELED",
+            "EXPIRED",
+            "READY_TO_CONSUME",
+            "CONSUMED",
+            "UNKNOWN",
+            "INAUTHENTIC"
+          ]
+        },
+        "productId": {
+          "description": "The product the store verified, when its response exposes one. Never the caller's claim.",
+          "type": "string",
+          "minLength": 1
+        },
+        "environment": {
+          "description": "The store environment the provider verified against, using the same open value space as the event envelope.",
+          "$ref": "#/$defs/Environment"
+        }
+      }
+    },
+    "BindPurchaseInput": {
+      "description": "Connects verified store evidence to the adopter's own opaque user identity. Binding is a server-side account mutation: only the server role may call it, and possession of a purchase token is deliberately not proof of ownership — a provider MUST refuse to move an existing binding through this operation.",
+      "type": "object",
+      "required": [
+        "userId",
+        "store"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "$ref": "#/$defs/Identifier"
+        },
+        "store": {
+          "$ref": "#/$defs/Store"
+        },
+        "apple": {
+          "$ref": "#/$defs/AppleEvidence"
+        },
+        "google": {
+          "$ref": "#/$defs/GoogleEvidence"
+        },
+        "horizon": {
+          "$ref": "#/$defs/HorizonEvidence"
+        },
+        "amazon": {
+          "$ref": "#/$defs/AmazonEvidence"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "apple"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "apple": {}
+            },
+            "required": [
+              "apple"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "google"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "google": {}
+            },
+            "required": [
+              "google"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "horizon"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "horizon": {}
+            },
+            "required": [
+              "horizon"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "store": {
+                "const": "amazon"
+              }
+            },
+            "required": [
+              "store"
+            ]
+          },
+          "then": {
+            "properties": {
+              "amazon": {}
+            },
+            "required": [
+              "amazon"
+            ]
+          }
+        }
+      ]
+    },
+    "BindPurchaseResult": {
+      "description": "Whether a binding now exists between this user and the evidenced purchase. `bound: false` covers every non-binding outcome — unknown evidence, evidence bound to a different user, or a store the provider cannot bind — without distinguishing them, so the operation cannot be used to probe whether someone else's purchase exists. Re-binding the same user to the same evidence is idempotent and reports `bound: true`.",
+      "type": "object",
+      "required": [
+        "bound"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "bound": {
+          "description": "True when a binding between this user and the evidenced purchase now exists.",
+          "type": "boolean"
+        }
+      }
+    },
+    "SubscriptionStatusInput": {
+      "description": "Selects the user whose subscription standing the caller's backend reads.",
+      "type": "object",
+      "required": [
+        "userId"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "description": "The opaque app-scoped user identity the caller's backend selected, in the identity space shared by provider and caller.",
+          "$ref": "#/$defs/Identifier"
+        }
+      }
+    },
+    "SubscriptionStatusSnapshot": {
+      "description": "One subscription as the provider currently records it, shaped for a server-side read. It is tokenless by construction: this object is CLOSED, so the schema itself rejects any member beyond those listed — no purchase token, store transaction identity, signed receipt, or provider-internal record identifier can appear, and the response is safe to hold in a developer backend.",
+      "type": "object",
+      "required": [
+        "productId",
+        "state",
+        "active"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "productId": {
+          "description": "Store product identifier of the subscription.",
+          "type": "string",
+          "minLength": 1
+        },
+        "state": {
+          "$ref": "#/$defs/SubscriptionState"
+        },
+        "active": {
+          "description": "The entitlement gate for this subscription, evaluated with the predicate in SPEC.md 2.3 at the provider's read time. A caller gates access on this member, never on `state`.",
+          "type": "boolean"
+        },
+        "store": {
+          "$ref": "#/$defs/Store"
+        },
+        "expiresAt": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "renewsAt": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "willRenew": {
+          "description": "Whether the store will attempt another billing period, when the provider records it.",
+          "type": "boolean"
+        },
+        "cancellationReason": {
+          "description": "Why the subscription stopped renewing, as the same open normalized token space the event envelope uses. Advisory, never a billing fact.",
+          "type": "string",
+          "minLength": 1
+        },
+        "startedAt": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "updatedAt": {
+          "$ref": "#/$defs/Timestamp"
+        }
+      }
+    },
+    "SubscriptionStatusResult": {
+      "description": "The user's current subscription standing. `active` answers the gate for the user as a whole; `subscription` is the most relevant record — the current entitling subscription when one exists, otherwise the provider's most recent record as context. It is omitted when the provider has no record for this user. A provider that cannot enumerate the user's records completely MUST fail the operation instead of answering from a partial read.",
+      "type": "object",
+      "required": [
+        "active"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "active": {
+          "description": "Whether the user is entitled to anything right now. The gate for simple access checks.",
+          "type": "boolean"
+        },
+        "subscription": {
+          "$ref": "#/$defs/SubscriptionStatusSnapshot"
+        }
+      }
+    },
+    "EntitlementsInput": {
+      "description": "Selects the user whose access decision the caller's backend reads.",
+      "type": "object",
+      "required": [
+        "userId"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "description": "The opaque app-scoped user identity the caller's backend selected, in the identity space shared by provider and caller.",
+          "$ref": "#/$defs/Identifier"
+        }
+      }
+    },
+    "EntitlementsResult": {
+      "description": "Every product the user may access right now, with the entitling subscription records. Unknown, expired, and ambiguous records contribute nothing: a product appears only when its gate is open at the provider's read time. A provider that cannot enumerate the user's records completely MUST fail the operation instead of answering from a partial read.",
+      "type": "object",
+      "required": [
+        "userId",
+        "productIds",
+        "subscriptions"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "userId": {
+          "$ref": "#/$defs/Identifier"
+        },
+        "productIds": {
+          "description": "Every product the user may access right now, deduplicated.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "subscriptions": {
+          "description": "The subscription records whose open gates produced `productIds`.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/SubscriptionStatusSnapshot"
+          }
+        }
+      }
+    },
+    "EraseUserInput": {
+      "description": "Selects the user identity to erase from the provider's records.",
+      "type": "object",
+      "required": [
+        "userId"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "userId": {
+          "description": "The opaque app-scoped user identity to remove from the provider's subscription records and protocol event identity.",
+          "$ref": "#/$defs/Identifier"
+        }
+      }
+    },
+    "EraseUserResult": {
+      "description": "Acknowledgement of an erasure request. Erasure removes the user identity from the provider's own records and event store; it is asynchronous where the provider processes it as a job, and re-requesting the same user is idempotent — it reports the current job rather than failing. A provider CANNOT unsend events: copies already delivered to the caller's own systems are the caller's responsibility to erase.",
+      "type": "object",
+      "required": [
+        "accepted"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "accepted": {
+          "description": "Whether the provider accepted the erasure request.",
+          "type": "boolean"
+        },
+        "jobId": {
+          "$ref": "#/$defs/Identifier"
+        },
+        "status": {
+          "description": "The lifecycle state of a user-erasure job. The value space is open; `completed` is the only terminal token this version names.",
+          "type": "string",
+          "pattern": "^[a-z][a-z_]*$",
+          "examples": [
+            "queued",
+            "running",
+            "completed"
+          ]
+        }
+      }
+    },
+    "CommerceEvent": {
+      "title": "OpenIAP Commerce Protocol event",
+      "description": "One normalized commerce lifecycle fact. A consumer reads this without knowing which store produced it and without parsing any store-native payload.",
+      "type": "object",
+      "required": [
+        "eventId",
+        "eventType",
+        "eventVersion",
+        "occurredAt",
+        "processedAt",
+        "store",
+        "environment",
+        "projectId"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "eventId": {
+          "description": "Unique identity of this event, assigned by the emitter. It is the receiver's deduplication key. An emitter MUST NOT reuse an eventId and MUST NOT change the eventId of an event it has already delivered.",
+          "$ref": "#/$defs/Identifier"
+        },
+        "eventType": {
+          "description": "What happened. See the taxonomy in SPEC.md. The value space is OPEN: §12 adds an event type in a MINOR version, so a consumer pinned on the major MUST tolerate a type it does not recognise and MUST NOT act on it. The listed values are the ones this version names.",
+          "type": "string",
+          "pattern": "^[a-z]+\\.[a-z_]+$",
+          "examples": [
+            "subscription.started",
+            "subscription.renewed",
+            "subscription.recovered",
+            "subscription.entered_grace_period",
+            "subscription.entered_billing_retry",
+            "subscription.expired",
+            "subscription.canceled",
+            "subscription.uncanceled",
+            "subscription.revoked",
+            "subscription.refunded",
+            "subscription.product_changed",
+            "subscription.price_changed",
+            "subscription.deferred",
+            "subscription.paused",
+            "subscription.resumed",
+            "entitlement.granted",
+            "entitlement.revoked"
+          ]
+        },
+        "eventVersion": {
+          "description": "Schema version of this body, as MAJOR.MINOR. Consumers pin on the major.",
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+        },
+        "occurredAt": {
+          "description": "The best authoritative time for the commerce fact. Use the store-asserted transition time when one exists. When polling only reveals that a value changed since the last observation, use the time the emitter observed the new value and do not invent a more precise instant.",
+          "$ref": "#/$defs/Timestamp"
+        },
+        "processedAt": {
+          "description": "When the emitter derived this event. Always greater than or equal to occurredAt in practice, but not guaranteed by this specification.",
+          "$ref": "#/$defs/Timestamp"
+        },
+        "store": {
+          "$ref": "#/$defs/Store"
+        },
+        "environment": {
+          "$ref": "#/$defs/Environment"
+        },
+        "projectId": {
+          "description": "The emitter-side scope this event belongs to, opaque to the consumer. A scope is whatever boundary the emitter organises commerce by — a tenant, a project, an application, or a single constant when the emitter serves exactly one. It is NOT an identifier issued by any central registry, and an implementation MUST NOT be required to obtain one from a third party. The member name is inherited from the deployed 1.0 wire format.",
+          "$ref": "#/$defs/Identifier"
+        },
+        "applicationId": {
+          "description": "A finer-grained scope within `projectId`, when the emitter models one. Opaque to the consumer.",
+          "$ref": "#/$defs/Identifier"
+        },
+        "userId": {
+          "description": "The app user this purchase is bound to, expressed in the identity space shared by the emitter and its consumer. It is an opaque correlation handle: there is no global user directory, and no central identity resolution is implied or required. Absent when no binding exists; required on every entitlement event.",
+          "$ref": "#/$defs/Identifier"
+        },
+        "productId": {
+          "description": "Store product identifier this event concerns. Required on every entitlement event so a consumer knows which access decision to apply.",
+          "type": "string",
+          "minLength": 1
+        },
+        "previousProductId": {
+          "description": "The product that was canonical before this event, when the event applies a product switch.",
+          "type": "string",
+          "minLength": 1
+        },
+        "transactionId": {
+          "description": "Store transaction identity for this specific economic event, where the store exposes one.",
+          "type": "string",
+          "minLength": 1
+        },
+        "originalTransactionId": {
+          "description": "Store identity of the first transaction in this subscription chain, where the store exposes one.",
+          "type": "string",
+          "minLength": 1
+        },
+        "subscription": {
+          "description": "The subscription as it stood immediately after this event. Absent for stores that keep no canonical subscription record.",
+          "type": "object",
+          "required": [
+            "state",
+            "productId",
+            "active"
+          ],
+          "additionalProperties": true,
+          "properties": {
+            "state": {
+              "$ref": "#/$defs/SubscriptionState"
+            },
+            "productId": {
+              "description": "The product the subscription is on after this event. Not always the event's top-level `productId`: where a store defers a product change to the next period — Apple's scheduled downgrades do, Google's item changes do not — the top level names the incoming product while this stays on the outgoing one until it renews. A consumer gating access reads this member; one reporting on what the notification announced reads the top level.",
+              "type": "string",
+              "minLength": 1
+            },
+            "expiresAt": {
+              "description": "When access ends. This is the boundary the entitlement predicate compares against, and the comparison is exclusive — at this instant the subscription is no longer entitled. During a grace period it is the end of the grace window, not of the period that failed to renew; an emitter that reports the failed period here revokes access at the moment grace begins.",
+              "$ref": "#/$defs/Timestamp"
+            },
+            "renewsAt": {
+              "description": "When the store will next attempt to bill, when it reports one. Distinct from `expiresAt`, which is when access ends: they coincide on a healthy subscription and diverge while a grace period extends access past the billing date. Absent once renewal is no longer expected.",
+              "$ref": "#/$defs/Timestamp"
+            },
+            "willRenew": {
+              "description": "Whether the store will attempt another billing period. False after a cancellation, while access may still be live.",
+              "type": "boolean"
+            },
+            "cancellationReason": {
+              "description": "Why the subscription stopped renewing, as a normalized token — not the store's own wording, which the emitter translates from whatever shape that store uses. This version names `UserCanceled`, `BillingError`, `PriceIncreaseDeclined`, `ProductUnavailable`, `Refunded` and `Other`; the space is open, so a consumer MUST tolerate a token it does not know, and no store yields every token. An emitter that has no store-asserted reason omits this member. Unlike `price`, it has no provenance marker, so treat a present value as advisory rather than as a fact to bill or report on.",
+              "type": "string",
+              "minLength": 1
+            },
+            "active": {
+              "description": "The entitlement gate after this event. Where this member is present it is the field to read for access — never a re-derivation from `state`. A store that keeps no canonical subscription record omits the whole `subscription` member; there an `entitlement.granted` or `entitlement.revoked` event carries the decision in its type, while a `subscription.*` event carries none.",
+              "type": "boolean"
+            }
+          }
+        },
+        "price": {
+          "description": "Amount associated with the transaction this event concerns, carried at whatever provenance it has — only `store` means the store asserted it. Always the transaction's own magnitude and never negative. It is context rather than a charge record: stores repeat the same figure across successive notifications about one subscription, so a consumer MUST NOT sum every priced event. See SPEC.md 9.3. Absent means the amount is unknown, never zero.",
+          "$ref": "#/$defs/Money"
+        },
+        "sourceStoreEventId": {
+          "description": "The store's own notification identifier this event was derived from, for support triage against the store console. Absent when the event did not originate from a store notification.",
+          "type": "string",
+          "minLength": 1
+        },
+        "extensions": {
+          "$ref": "#/$defs/Extensions"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "entitlement.granted",
+                  "entitlement.revoked"
+                ]
+              }
+            },
+            "required": [
+              "eventType"
+            ]
+          },
+          "then": {
+            "properties": {
+              "userId": {},
+              "productId": {}
+            },
+            "required": [
+              "userId",
+              "productId"
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "entitlement.granted"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "active": {
+                    "const": true
+                  }
+                },
+                "required": [
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "entitlement.revoked"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.started",
+                  "subscription.renewed",
+                  "subscription.recovered",
+                  "subscription.resumed"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "Active"
+                  }
+                },
+                "required": [
+                  "state"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.entered_grace_period"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "InGracePeriod"
+                  }
+                },
+                "required": [
+                  "state"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.entered_billing_retry"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "InBillingRetry"
+                  },
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "state",
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.expired"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "Expired"
+                  },
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "state",
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.revoked"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "Revoked"
+                  },
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "state",
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.refunded"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "Refunded"
+                  },
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "state",
+                  "active"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "eventType": {
+                "enum": [
+                  "subscription.paused"
+                ]
+              },
+              "subscription": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "eventType",
+              "subscription"
+            ]
+          },
+          "then": {
+            "properties": {
+              "subscription": {
+                "type": "object",
+                "properties": {
+                  "state": {
+                    "const": "Paused"
+                  },
+                  "active": {
+                    "const": false
+                  }
+                },
+                "required": [
+                  "state",
+                  "active"
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "ProviderCapabilities": {
+      "title": "OpenIAP Commerce Protocol implementation descriptor",
+      "description": "What an implementation supports: the specification version it speaks, the event types it can emit, and what it can actually observe per store. This is the document a consumer, an operator, or a tool reads to determine compatibility without guessing and without reading prose. It contains no commerce data.",
+      "type": "object",
+      "required": [
+        "specVersion",
+        "eventTypes",
+        "stores"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "specVersion": {
+          "description": "OpenIAP Commerce Protocol version this declaration was written against, as MAJOR.MINOR.",
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+        },
+        "implementation": {
+          "description": "Free-form name and version of the backend making this declaration. Present so an operator can tell two backends apart; it carries no normative meaning.",
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "name": {
+              "description": "Name of the backend making this declaration, for an operator reading a descriptor without knowing where it came from.",
+              "type": "string",
+              "minLength": 1
+            },
+            "version": {
+              "description": "Version of that backend, when it publishes one. Not a specification version — that is `specVersion`.",
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        "eventTypes": {
+          "description": "Event types this implementation can emit. A consumer uses it to know which lifecycle signals to expect; absence of a type here means this implementation never produces it, which is different from a type that simply has not occurred yet.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z]+\\.[a-z_]+$"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "stores": {
+          "description": "Keyed by store, using the same open value space as the event envelope. An implementation declares only the stores it actually integrates.",
+          "type": "object",
+          "minProperties": 1,
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9_]*$"
+          },
+          "additionalProperties": {
+            "$ref": "#/$defs/CapabilitiesStoreCapabilities"
+          }
+        },
+        "profiles": {
+          "description": "Operation profiles this implementation serves, keyed by profile name with the profile version as the value. This version names `verification`, `entitlements`, `events`, and `accountLifecycle`; the key space is open, so a consumer MUST ignore a profile it does not recognise. An implementation MUST declare only profiles it implements and passes conformance for, and MUST NOT declare a profile it partially implements. Absent on a descriptor from an events-only emitter that predates the operation surface.",
+          "type": "object",
+          "minProperties": 1,
+          "propertyNames": {
+            "pattern": "^[a-z][a-zA-Z0-9]*$"
+          },
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+          }
+        },
+        "bindings": {
+          "description": "Transport bindings this implementation serves for the declared profiles, keyed by binding name with the binding version as the value. This version names `rest` and `graphql`; the key space is open. Declaring a binding means every declared profile operation is reachable over it. An implementation MAY serve one binding only. Absent on a descriptor from an events-only emitter.",
+          "type": "object",
+          "minProperties": 1,
+          "propertyNames": {
+            "pattern": "^[a-z][a-zA-Z0-9]*$"
+          },
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+          }
+        }
+      }
+    },
+    "StoreEventMapping": {
+      "title": "OpenIAP Commerce Protocol store event mapping",
+      "description": "How each store's own notification vocabulary maps onto the normalized event types. This is the reference an implementer follows to normalize a store notification without reverse-engineering an existing backend, and the reference a consumer reads to understand why a given store produces the events it does. A row states what a notification means, not that an emitter can always act on it: one that lacks the state to interpret a notification — a redelivery it already applied, a purchase whose product it cannot resolve, a token the store has superseded — emits nothing, and that is conformant.",
+      "type": "object",
+      "required": [
+        "specVersion",
+        "stores"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "specVersion": {
+          "description": "OpenIAP Commerce Protocol version this table was written against, as MAJOR.MINOR.",
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"
+        },
+        "stores": {
+          "description": "Keyed by store, using the same open value space as the event envelope. A table lists only the stores it has mappings for.",
+          "type": "object",
+          "minProperties": 1,
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9_]*$"
+          },
+          "additionalProperties": {
+            "$ref": "#/$defs/MappingStoreMapping"
+          }
+        }
+      }
+    }
+  }
+}