@hyodotdev/openiap-commerce-protocol 0.0.0-bootstrap.0 → 0.1.0

package/generated/bindings/graphql-operations.json

@@ -0,0 +1,87 @@
+{
+  "$comment": "Canonical full-selection GraphQL documents for every protocol operation. Generated from commerce-protocol.graphql — do not edit. The conformance runner sends exactly these documents; REST/GraphQL parity is judged on each `selection` tree, this protocol version's contract shape.",
+  "protocolVersion": "1.0",
+  "operations": {
+    "providerCapabilities": {
+      "kind": "query",
+      "document": "query ProviderCapabilities { providerCapabilities { specVersion implementation { name version } eventTypes stores profiles bindings } }",
+      "selection": {
+        "specVersion": true,
+        "implementation": {
+          "name": true,
+          "version": true
+        },
+        "eventTypes": true,
+        "stores": true,
+        "profiles": true,
+        "bindings": true
+      }
+    },
+    "subscriptionStatus": {
+      "kind": "query",
+      "document": "query SubscriptionStatus($input: SubscriptionStatusInput!) { subscriptionStatus(input: $input) { active subscription { productId state active store expiresAt renewsAt willRenew cancellationReason startedAt updatedAt } } }",
+      "selection": {
+        "active": true,
+        "subscription": {
+          "productId": true,
+          "state": true,
+          "active": true,
+          "store": true,
+          "expiresAt": true,
+          "renewsAt": true,
+          "willRenew": true,
+          "cancellationReason": true,
+          "startedAt": true,
+          "updatedAt": true
+        }
+      }
+    },
+    "entitlements": {
+      "kind": "query",
+      "document": "query Entitlements($input: EntitlementsInput!) { entitlements(input: $input) { userId productIds subscriptions { productId state active store expiresAt renewsAt willRenew cancellationReason startedAt updatedAt } } }",
+      "selection": {
+        "userId": true,
+        "productIds": true,
+        "subscriptions": {
+          "productId": true,
+          "state": true,
+          "active": true,
+          "store": true,
+          "expiresAt": true,
+          "renewsAt": true,
+          "willRenew": true,
+          "cancellationReason": true,
+          "startedAt": true,
+          "updatedAt": true
+        }
+      }
+    },
+    "verifyPurchase": {
+      "kind": "mutation",
+      "document": "mutation VerifyPurchase($input: VerifyPurchaseInput!) { verifyPurchase(input: $input) { store isValid state productId environment } }",
+      "selection": {
+        "store": true,
+        "isValid": true,
+        "state": true,
+        "productId": true,
+        "environment": true
+      }
+    },
+    "bindPurchase": {
+      "kind": "mutation",
+      "document": "mutation BindPurchase($input: BindPurchaseInput!) { bindPurchase(input: $input) { bound } }",
+      "selection": {
+        "bound": true
+      }
+    },
+    "eraseUser": {
+      "kind": "mutation",
+      "document": "mutation EraseUser($input: EraseUserInput!) { eraseUser(input: $input) { accepted jobId status } }",
+      "selection": {
+        "accepted": true,
+        "jobId": true,
+        "status": true
+      }
+    }
+  }
+}

package/generated/bindings/http-binding.json

@@ -0,0 +1,143 @@
+{
+  "$comment": "HTTP binding manifest for the OpenIAP Commerce Protocol operation surface. Generated from commerce-protocol.graphql — do not edit. Schema pointers resolve inside commerce-protocol.bundle.schema.json.",
+  "protocolVersion": "1.0",
+  "profiles": {
+    "verification": "1.0",
+    "entitlements": "1.0",
+    "events": "1.0",
+    "accountLifecycle": "1.0"
+  },
+  "bindings": {
+    "rest": "1.0",
+    "graphql": "1.0"
+  },
+  "errorStatus": {
+    "INVALID_REQUEST": 400,
+    "UNAUTHORIZED": 401,
+    "FORBIDDEN": 403,
+    "NOT_FOUND": 404,
+    "PURCHASE_NOT_FOUND": 404,
+    "CONFLICT": 409,
+    "UNSUPPORTED_STORE": 422,
+    "RATE_LIMITED": 429,
+    "INTERNAL_ERROR": 500,
+    "UNSUPPORTED_PROFILE": 501,
+    "VERIFICATION_FAILED": 502
+  },
+  "errorResponse": "#/$defs/ProtocolErrorResponse",
+  "operations": [
+    {
+      "name": "providerCapabilities",
+      "kind": "query",
+      "profile": "core",
+      "auth": "none",
+      "method": "GET",
+      "path": "/commerce/v1/capabilities",
+      "successStatus": 200,
+      "idempotent": true,
+      "errors": [
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": null,
+      "result": "#/$defs/ProviderCapabilities"
+    },
+    {
+      "name": "subscriptionStatus",
+      "kind": "query",
+      "profile": "entitlements",
+      "auth": "server",
+      "method": "GET",
+      "path": "/commerce/v1/subscriptions/status",
+      "successStatus": 200,
+      "idempotent": true,
+      "errors": [
+        "INVALID_REQUEST",
+        "UNAUTHORIZED",
+        "FORBIDDEN",
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": "#/$defs/SubscriptionStatusInput",
+      "result": "#/$defs/SubscriptionStatusResult"
+    },
+    {
+      "name": "entitlements",
+      "kind": "query",
+      "profile": "entitlements",
+      "auth": "server",
+      "method": "GET",
+      "path": "/commerce/v1/entitlements",
+      "successStatus": 200,
+      "idempotent": true,
+      "errors": [
+        "INVALID_REQUEST",
+        "UNAUTHORIZED",
+        "FORBIDDEN",
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": "#/$defs/EntitlementsInput",
+      "result": "#/$defs/EntitlementsResult"
+    },
+    {
+      "name": "verifyPurchase",
+      "kind": "mutation",
+      "profile": "verification",
+      "auth": "verification",
+      "method": "POST",
+      "path": "/commerce/v1/purchases/verify",
+      "successStatus": 200,
+      "idempotent": true,
+      "errors": [
+        "INVALID_REQUEST",
+        "UNAUTHORIZED",
+        "UNSUPPORTED_STORE",
+        "VERIFICATION_FAILED",
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": "#/$defs/VerifyPurchaseInput",
+      "result": "#/$defs/VerifyPurchaseResult"
+    },
+    {
+      "name": "bindPurchase",
+      "kind": "mutation",
+      "profile": "accountLifecycle",
+      "auth": "server",
+      "method": "POST",
+      "path": "/commerce/v1/purchases/bind",
+      "successStatus": 200,
+      "idempotent": true,
+      "errors": [
+        "INVALID_REQUEST",
+        "UNAUTHORIZED",
+        "FORBIDDEN",
+        "UNSUPPORTED_STORE",
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": "#/$defs/BindPurchaseInput",
+      "result": "#/$defs/BindPurchaseResult"
+    },
+    {
+      "name": "eraseUser",
+      "kind": "mutation",
+      "profile": "accountLifecycle",
+      "auth": "server",
+      "method": "POST",
+      "path": "/commerce/v1/users/erase",
+      "successStatus": 202,
+      "idempotent": true,
+      "errors": [
+        "INVALID_REQUEST",
+        "UNAUTHORIZED",
+        "FORBIDDEN",
+        "RATE_LIMITED",
+        "INTERNAL_ERROR"
+      ],
+      "input": "#/$defs/EraseUserInput",
+      "result": "#/$defs/EraseUserResult"
+    }
+  ]
+}

package/generated/bindings/introspection-signature.json

@@ -0,0 +1,320 @@
+{
+  "$comment": "Structural introspection signature of the executable GraphQL projection. Generated from commerce-protocol.graphql — do not edit. The conformance runner compares a served schema's introspection against this as a subset: everything named here must exist with these exact kinds, types, nullability, arguments, and (for closed enums and objects) exact members. New types and members added to open objects are compatible MINOR extensions.",
+  "protocolVersion": "1.0",
+  "queryType": "Query",
+  "mutationType": "Mutation",
+  "types": {
+    "Store": {
+      "kind": "SCALAR"
+    },
+    "Environment": {
+      "kind": "SCALAR"
+    },
+    "Timestamp": {
+      "kind": "SCALAR"
+    },
+    "Identifier": {
+      "kind": "SCALAR"
+    },
+    "SubscriptionState": {
+      "kind": "ENUM",
+      "values": [
+        "Active",
+        "Expired",
+        "InBillingRetry",
+        "InGracePeriod",
+        "Paused",
+        "Refunded",
+        "Revoked",
+        "Unknown"
+      ]
+    },
+    "StoreCapabilitiesMap": {
+      "kind": "SCALAR"
+    },
+    "ProviderCapabilities": {
+      "kind": "OBJECT",
+      "fields": {
+        "specVersion": {
+          "type": "MajorMinor!"
+        },
+        "implementation": {
+          "type": "Implementation"
+        },
+        "eventTypes": {
+          "type": "[NamespacedEventType!]!"
+        },
+        "stores": {
+          "type": "StoreCapabilitiesMap!"
+        },
+        "profiles": {
+          "type": "ProfileVersionMap"
+        },
+        "bindings": {
+          "type": "BindingVersionMap"
+        }
+      }
+    },
+    "ProfileVersionMap": {
+      "kind": "SCALAR"
+    },
+    "BindingVersionMap": {
+      "kind": "SCALAR"
+    },
+    "Implementation": {
+      "kind": "OBJECT",
+      "fields": {
+        "name": {
+          "type": "NonEmptyString"
+        },
+        "version": {
+          "type": "NonEmptyString"
+        }
+      }
+    },
+    "PurchaseVerificationState": {
+      "kind": "SCALAR"
+    },
+    "ErasureJobStatus": {
+      "kind": "SCALAR"
+    },
+    "AppleJws": {
+      "kind": "SCALAR"
+    },
+    "GooglePurchaseToken": {
+      "kind": "SCALAR"
+    },
+    "StoreUserIdentity": {
+      "kind": "SCALAR"
+    },
+    "StoreSku": {
+      "kind": "SCALAR"
+    },
+    "StoreReceiptId": {
+      "kind": "SCALAR"
+    },
+    "AppleEvidence": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "jws": "AppleJws!"
+      }
+    },
+    "GoogleEvidence": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "purchaseToken": "GooglePurchaseToken!"
+      }
+    },
+    "HorizonEvidence": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "StoreUserIdentity!",
+        "sku": "StoreSku!"
+      }
+    },
+    "AmazonEvidence": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "StoreUserIdentity!",
+        "receiptId": "StoreReceiptId!",
+        "sandbox": "Boolean"
+      }
+    },
+    "VerifyPurchaseInput": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "store": "Store!",
+        "apple": "AppleEvidence",
+        "google": "GoogleEvidence",
+        "horizon": "HorizonEvidence",
+        "amazon": "AmazonEvidence"
+      }
+    },
+    "VerifyPurchaseResult": {
+      "kind": "OBJECT",
+      "fields": {
+        "store": {
+          "type": "Store!"
+        },
+        "isValid": {
+          "type": "Boolean!"
+        },
+        "state": {
+          "type": "PurchaseVerificationState!"
+        },
+        "productId": {
+          "type": "NonEmptyString"
+        },
+        "environment": {
+          "type": "Environment"
+        }
+      }
+    },
+    "BindPurchaseInput": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "Identifier!",
+        "store": "Store!",
+        "apple": "AppleEvidence",
+        "google": "GoogleEvidence",
+        "horizon": "HorizonEvidence",
+        "amazon": "AmazonEvidence"
+      }
+    },
+    "BindPurchaseResult": {
+      "kind": "OBJECT",
+      "fields": {
+        "bound": {
+          "type": "Boolean!"
+        }
+      }
+    },
+    "SubscriptionStatusInput": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "Identifier!"
+      }
+    },
+    "SubscriptionStatusSnapshot": {
+      "kind": "OBJECT",
+      "fields": {
+        "productId": {
+          "type": "NonEmptyString!"
+        },
+        "state": {
+          "type": "SubscriptionState!"
+        },
+        "active": {
+          "type": "Boolean!"
+        },
+        "store": {
+          "type": "Store"
+        },
+        "expiresAt": {
+          "type": "Timestamp"
+        },
+        "renewsAt": {
+          "type": "Timestamp"
+        },
+        "willRenew": {
+          "type": "Boolean"
+        },
+        "cancellationReason": {
+          "type": "NonEmptyString"
+        },
+        "startedAt": {
+          "type": "Timestamp"
+        },
+        "updatedAt": {
+          "type": "Timestamp"
+        }
+      },
+      "closed": true
+    },
+    "SubscriptionStatusResult": {
+      "kind": "OBJECT",
+      "fields": {
+        "active": {
+          "type": "Boolean!"
+        },
+        "subscription": {
+          "type": "SubscriptionStatusSnapshot"
+        }
+      },
+      "closed": true
+    },
+    "EntitlementsInput": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "Identifier!"
+      }
+    },
+    "EntitlementsResult": {
+      "kind": "OBJECT",
+      "fields": {
+        "userId": {
+          "type": "Identifier!"
+        },
+        "productIds": {
+          "type": "[NonEmptyString!]!"
+        },
+        "subscriptions": {
+          "type": "[SubscriptionStatusSnapshot!]!"
+        }
+      },
+      "closed": true
+    },
+    "EraseUserInput": {
+      "kind": "INPUT_OBJECT",
+      "inputFields": {
+        "userId": "Identifier!"
+      }
+    },
+    "EraseUserResult": {
+      "kind": "OBJECT",
+      "fields": {
+        "accepted": {
+          "type": "Boolean!"
+        },
+        "jobId": {
+          "type": "Identifier"
+        },
+        "status": {
+          "type": "ErasureJobStatus"
+        }
+      }
+    },
+    "MajorMinor": {
+      "kind": "SCALAR"
+    },
+    "NonEmptyString": {
+      "kind": "SCALAR"
+    },
+    "NamespacedEventType": {
+      "kind": "SCALAR"
+    },
+    "Query": {
+      "kind": "OBJECT",
+      "fields": {
+        "providerCapabilities": {
+          "type": "ProviderCapabilities!"
+        },
+        "subscriptionStatus": {
+          "type": "SubscriptionStatusResult!",
+          "args": {
+            "input": "SubscriptionStatusInput!"
+          }
+        },
+        "entitlements": {
+          "type": "EntitlementsResult!",
+          "args": {
+            "input": "EntitlementsInput!"
+          }
+        }
+      }
+    },
+    "Mutation": {
+      "kind": "OBJECT",
+      "fields": {
+        "verifyPurchase": {
+          "type": "VerifyPurchaseResult!",
+          "args": {
+            "input": "VerifyPurchaseInput!"
+          }
+        },
+        "bindPurchase": {
+          "type": "BindPurchaseResult!",
+          "args": {
+            "input": "BindPurchaseInput!"
+          }
+        },
+        "eraseUser": {
+          "type": "EraseUserResult!",
+          "args": {
+            "input": "EraseUserInput!"
+          }
+        }
+      }
+    }
+  }
+}

package/generated/bindings/operations-sdl.json

@@ -0,0 +1,4 @@
+{
+  "$comment": "The executable GraphQL projection from bindings/operations.graphql, wrapped as JSON for bundlers. Generated from commerce-protocol.graphql — do not edit.",
+  "sdl": "# Executable GraphQL projection of the OpenIAP Commerce Protocol 1.0\n# operation surface. Generated from commerce-protocol.graphql — do not edit.\n# A conforming GraphQL binding defines everything this projection\n# defines, exactly as defined; a compatible MINOR may extend it\n# additively. Introspection, where enabled, must agree with the schema\n# served.\n\n\"\"\"\nThe commerce platform that is authoritative for the purchase. This is a store, not a device platform: one device platform can host several stores. The value space is OPEN. The listed values are the stores this version names, but an implementation that observes commerce on another platform MUST be able to emit it, and a consumer MUST accept and preserve an unrecognised store opaquely rather than reject the event. Use a lowercase, stable, unambiguous token.\n\"\"\"\nscalar Store\n\n\"\"\"\nThe store environment the purchase belongs to. The value space is open: receivers MUST accept and preserve an unrecognised value opaquely and MUST NOT reject an event because of it.\n\"\"\"\nscalar Environment\n\n\"\"\"\nAn instant, as integer milliseconds since the Unix epoch, UTC. Every timestamp in this specification uses this encoding. The one exception is the transport signature timestamp, which is in seconds; see the webhook section of SPEC.md.\n\"\"\"\nscalar Timestamp\n\n\"\"\"\nAn opaque, implementation-assigned identifier. Consumers MUST treat it as an opaque string and MUST NOT parse structure out of it.\n\"\"\"\nscalar Identifier\n\n\"\"\"\nThe lifecycle state of a subscription. This is a state, not an event, and it does not by itself decide entitlement — see Entitlement in SPEC.md. These members are PascalCase while event types are lowercase-dotted; the inconsistency is inherited from the deployed 1.0 wire format and is recorded in CONVENTION.md rather than silently corrected, because changing it would break receivers already decoding it.\n\"\"\"\nenum SubscriptionState {\n  Active\n  InGracePeriod\n  InBillingRetry\n  Paused\n  Expired\n  Revoked\n  Refunded\n  Unknown\n}\n\nscalar StoreCapabilitiesMap\n\n\"\"\"\nWhat an implementation supports: the specification version it speaks, the event types it can emit, and what it can actually observe per store. This is the document a consumer, an operator, or a tool reads to determine compatibility without guessing and without reading prose. It contains no commerce data.\n\"\"\"\ntype ProviderCapabilities {\n  \"\"\"\n  OpenIAP Commerce Protocol version this declaration was written against, as MAJOR.MINOR.\n  \"\"\"\n  specVersion: MajorMinor!\n  \"\"\"\n  Free-form name and version of the backend making this declaration. Present so an operator can tell two backends apart; it carries no normative meaning.\n  \"\"\"\n  implementation: Implementation\n  \"\"\"\n  Event types this implementation can emit. A consumer uses it to know which lifecycle signals to expect; absence of a type here means this implementation never produces it, which is different from a type that simply has not occurred yet.\n  \"\"\"\n  eventTypes: [NamespacedEventType!]!\n  \"\"\"\n  Keyed by store, using the same open value space as the event envelope. An implementation declares only the stores it actually integrates.\n  \"\"\"\n  stores: StoreCapabilitiesMap!\n  \"\"\"\n  Operation profiles this implementation serves, keyed by profile name with the profile version as the value. This version names `verification`, `entitlements`, `events`, and `accountLifecycle`; the key space is open, so a consumer MUST ignore a profile it does not recognise. An implementation MUST declare only profiles it implements and passes conformance for, and MUST NOT declare a profile it partially implements. Absent on a descriptor from an events-only emitter that predates the operation surface.\n  \"\"\"\n  profiles: ProfileVersionMap\n  \"\"\"\n  Transport bindings this implementation serves for the declared profiles, keyed by binding name with the binding version as the value. This version names `rest` and `graphql`; the key space is open. Declaring a binding means every declared profile operation is reachable over it. An implementation MAY serve one binding only. Absent on a descriptor from an events-only emitter.\n  \"\"\"\n  bindings: BindingVersionMap\n}\n\nscalar ProfileVersionMap\n\nscalar BindingVersionMap\n\n\"\"\"\nFree-form name and version of the backend making this declaration. Present so an operator can tell two backends apart; it carries no normative meaning.\n\"\"\"\ntype Implementation {\n  \"\"\"\n  Name of the backend making this declaration, for an operator reading a descriptor without knowing where it came from.\n  \"\"\"\n  name: NonEmptyString\n  \"\"\"\n  Version of that backend, when it publishes one. Not a specification version — that is `specVersion`.\n  \"\"\"\n  version: NonEmptyString\n}\n\n\"\"\"\nThe verification verdict for one piece of purchase evidence, as a normalized token. This is the purchase-validation axis SPEC.md 2.3 warns about — a CANCELED verification verdict and a canceled-but-still-entitled subscription are different facts. The value space is OPEN: a caller MUST tolerate a token it does not know and gate on `isValid` alone.\n\"\"\"\nscalar PurchaseVerificationState\n\n\"\"\"\nThe lifecycle state of a user-erasure job. The value space is open; `completed` is the only terminal token this version names.\n\"\"\"\nscalar ErasureJobStatus\n\n\"\"\"\nA compact signed transaction JWS. Bounded so an oversized body cannot be forwarded to a store: an Apple transaction JWS is a few kilobytes.\n\"\"\"\nscalar AppleJws\n\n\"\"\"\nAn opaque store purchase token. Bounded to keep an oversized body off the store API.\n\"\"\"\nscalar GooglePurchaseToken\n\n\"\"\"\nA store-issued user identity, as the store's own API returns it. Distinct from the protocol's opaque `userId`.\n\"\"\"\nscalar StoreUserIdentity\n\n\"\"\"\nA store add-on SKU. Bounded to a predictable identifier length.\n\"\"\"\nscalar StoreSku\n\n\"\"\"\nA store receipt identifier. Bounded to keep an oversized body off the store API.\n\"\"\"\nscalar StoreReceiptId\n\n\"\"\"\nStore evidence for one Apple App Store purchase: the signed StoreKit 2 transaction JWS the app received from the store.\n\"\"\"\ninput AppleEvidence {\n  \"\"\"\n  The compact signed transaction JWS, verbatim as the store handed it to the app.\n  \"\"\"\n  jws: AppleJws!\n}\n\n\"\"\"\nStore evidence for one Google Play purchase: the opaque purchase token the store issued to the device.\n\"\"\"\ninput GoogleEvidence {\n  \"\"\"\n  The opaque purchase token, verbatim as the store issued it to the device.\n  \"\"\"\n  purchaseToken: GooglePurchaseToken!\n}\n\n\"\"\"\nStore evidence for one Meta Horizon (Quest) entitlement. Horizon issues no server-verifiable receipt, so verification identifies the entitlement by user and SKU; the provider holds the store credentials.\n\"\"\"\ninput HorizonEvidence {\n  \"\"\"\n  The store's own user identity for the entitlement holder — not the protocol's opaque `userId`.\n  \"\"\"\n  userId: StoreUserIdentity!\n  \"\"\"\n  The add-on SKU as configured in the store's developer dashboard.\n  \"\"\"\n  sku: StoreSku!\n}\n\n\"\"\"\nStore evidence for one Amazon Appstore purchase, as returned by the Amazon SDK. `sandbox` selects the RVS sandbox for App Tester receipts where the provider permits it.\n\"\"\"\ninput AmazonEvidence {\n  \"\"\"\n  The store's own user identity from the purchase response — not the protocol's opaque `userId`.\n  \"\"\"\n  userId: StoreUserIdentity!\n  \"\"\"\n  The receipt identifier from the purchase or purchase-updates response.\n  \"\"\"\n  receiptId: StoreReceiptId!\n  \"\"\"\n  Verify against the store's sandbox where the provider permits it. Omitted means production.\n  \"\"\"\n  sandbox: Boolean\n}\n\n\"\"\"\nOne purchase's store evidence, discriminated by `store`. The store space stays open: a provider that does not integrate the named store rejects the call with UNSUPPORTED_STORE rather than failing schema validation, so a future store is a MINOR evidence-member addition, not a breaking change. For each store this version names, the matching evidence member is required.\n\"\"\"\ninput VerifyPurchaseInput {\n  store: Store!\n  apple: AppleEvidence\n  google: GoogleEvidence\n  horizon: HorizonEvidence\n  amazon: AmazonEvidence\n}\n\n\"\"\"\nThe verification verdict. `isValid` is the authoritative acceptance gate: a caller MUST read it and MUST NOT re-derive acceptance from `state`. A verdict is a statement about the evidence at verification time, never an account mutation — verification binds no user.\n\"\"\"\ntype VerifyPurchaseResult {\n  store: Store!\n  \"\"\"\n  Whether the provider accepts the evidence. The single authoritative acceptance gate.\n  \"\"\"\n  isValid: Boolean!\n  state: PurchaseVerificationState!\n  \"\"\"\n  The product the store verified, when its response exposes one. Never the caller's claim.\n  \"\"\"\n  productId: NonEmptyString\n  \"\"\"\n  The store environment the provider verified against, using the same open value space as the event envelope.\n  \"\"\"\n  environment: Environment\n}\n\n\"\"\"\nConnects verified store evidence to the adopter's own opaque user identity. Binding is a server-side account mutation: only the server role may call it, and possession of a purchase token is deliberately not proof of ownership — a provider MUST refuse to move an existing binding through this operation.\n\"\"\"\ninput BindPurchaseInput {\n  userId: Identifier!\n  store: Store!\n  apple: AppleEvidence\n  google: GoogleEvidence\n  horizon: HorizonEvidence\n  amazon: AmazonEvidence\n}\n\n\"\"\"\nWhether a binding now exists between this user and the evidenced purchase. `bound: false` covers every non-binding outcome — unknown evidence, evidence bound to a different user, or a store the provider cannot bind — without distinguishing them, so the operation cannot be used to probe whether someone else's purchase exists. Re-binding the same user to the same evidence is idempotent and reports `bound: true`.\n\"\"\"\ntype BindPurchaseResult {\n  \"\"\"\n  True when a binding between this user and the evidenced purchase now exists.\n  \"\"\"\n  bound: Boolean!\n}\n\n\"\"\"\nSelects the user whose subscription standing the caller's backend reads.\n\"\"\"\ninput SubscriptionStatusInput {\n  \"\"\"\n  The opaque app-scoped user identity the caller's backend selected, in the identity space shared by provider and caller.\n  \"\"\"\n  userId: Identifier!\n}\n\n\"\"\"\nOne subscription as the provider currently records it, shaped for a server-side read. It is tokenless by construction: this object is CLOSED, so the schema itself rejects any member beyond those listed — no purchase token, store transaction identity, signed receipt, or provider-internal record identifier can appear, and the response is safe to hold in a developer backend.\n\"\"\"\ntype SubscriptionStatusSnapshot {\n  \"\"\"\n  Store product identifier of the subscription.\n  \"\"\"\n  productId: NonEmptyString!\n  state: SubscriptionState!\n  \"\"\"\n  The entitlement gate for this subscription, evaluated with the predicate in SPEC.md 2.3 at the provider's read time. A caller gates access on this member, never on `state`.\n  \"\"\"\n  active: Boolean!\n  store: Store\n  expiresAt: Timestamp\n  renewsAt: Timestamp\n  \"\"\"\n  Whether the store will attempt another billing period, when the provider records it.\n  \"\"\"\n  willRenew: Boolean\n  \"\"\"\n  Why the subscription stopped renewing, as the same open normalized token space the event envelope uses. Advisory, never a billing fact.\n  \"\"\"\n  cancellationReason: NonEmptyString\n  startedAt: Timestamp\n  updatedAt: Timestamp\n}\n\n\"\"\"\nThe user's current subscription standing. `active` answers the gate for the user as a whole; `subscription` is the most relevant record — the current entitling subscription when one exists, otherwise the provider's most recent record as context. It is omitted when the provider has no record for this user. A provider that cannot enumerate the user's records completely MUST fail the operation instead of answering from a partial read.\n\"\"\"\ntype SubscriptionStatusResult {\n  \"\"\"\n  Whether the user is entitled to anything right now. The gate for simple access checks.\n  \"\"\"\n  active: Boolean!\n  subscription: SubscriptionStatusSnapshot\n}\n\n\"\"\"\nSelects the user whose access decision the caller's backend reads.\n\"\"\"\ninput EntitlementsInput {\n  \"\"\"\n  The opaque app-scoped user identity the caller's backend selected, in the identity space shared by provider and caller.\n  \"\"\"\n  userId: Identifier!\n}\n\n\"\"\"\nEvery product the user may access right now, with the entitling subscription records. Unknown, expired, and ambiguous records contribute nothing: a product appears only when its gate is open at the provider's read time. A provider that cannot enumerate the user's records completely MUST fail the operation instead of answering from a partial read.\n\"\"\"\ntype EntitlementsResult {\n  userId: Identifier!\n  \"\"\"\n  Every product the user may access right now, deduplicated.\n  \"\"\"\n  productIds: [NonEmptyString!]!\n  \"\"\"\n  The subscription records whose open gates produced `productIds`.\n  \"\"\"\n  subscriptions: [SubscriptionStatusSnapshot!]!\n}\n\n\"\"\"\nSelects the user identity to erase from the provider's records.\n\"\"\"\ninput EraseUserInput {\n  \"\"\"\n  The opaque app-scoped user identity to remove from the provider's subscription records and protocol event identity.\n  \"\"\"\n  userId: Identifier!\n}\n\n\"\"\"\nAcknowledgement of an erasure request. Erasure removes the user identity from the provider's own records and event store; it is asynchronous where the provider processes it as a job, and re-requesting the same user is idempotent — it reports the current job rather than failing. A provider CANNOT unsend events: copies already delivered to the caller's own systems are the caller's responsibility to erase.\n\"\"\"\ntype EraseUserResult {\n  \"\"\"\n  Whether the provider accepted the erasure request.\n  \"\"\"\n  accepted: Boolean!\n  jobId: Identifier\n  status: ErasureJobStatus\n}\n\nscalar MajorMinor\n\nscalar NonEmptyString\n\nscalar NamespacedEventType\n\ntype Query {\n  \"\"\"\n  What this provider implements: protocol version, profiles, bindings, and per-store capability. Public and free of commerce data, so a consumer or a conformance runner reads it without credentials and without any central registry.\n  \"\"\"\n  providerCapabilities: ProviderCapabilities!\n\n  \"\"\"\n  A developer backend reads one authenticated user's subscription standing. Server role only: a shipped app must not be able to walk arbitrary user identities, which is why the verification role is refused here.\n  \"\"\"\n  subscriptionStatus(input: SubscriptionStatusInput!): SubscriptionStatusResult!\n\n  \"\"\"\n  A developer backend reads one authenticated user's access decision. Server role only, and fail-close: anything the provider cannot classify as currently entitled is absent from the answer.\n  \"\"\"\n  entitlements(input: EntitlementsInput!): EntitlementsResult!\n}\n\ntype Mutation {\n  \"\"\"\n  Verifies store evidence and returns the verdict. The verification role suffices: this operation binds no user, reads no account, and repeating it with the same evidence is safe. VERIFICATION_FAILED means the provider could not obtain a verdict — it never stands in for the store rejecting the evidence, which is a successful result with `isValid: false`.\n  \"\"\"\n  verifyPurchase(input: VerifyPurchaseInput!): VerifyPurchaseResult!\n\n  \"\"\"\n  Binds a verified purchase to the adopter's opaque user identity. Server role only; retrying is idempotent.\n  \"\"\"\n  bindPurchase(input: BindPurchaseInput!): BindPurchaseResult!\n\n  \"\"\"\n  Removes a user identity from the provider's subscription records and protocol event identity. Server role only; re-requesting the same user is idempotent and reports the current job.\n  \"\"\"\n  eraseUser(input: EraseUserInput!): EraseUserResult!\n}\n"
+}