@livx.cc/appwrap 0.53.0 → 0.55.0

package/runtime/app/shell/handlers-billing.ts

@@ -1,629 +0,0 @@
-import { Application, Utils, isAndroid, isIOS } from '@nativescript/core';
-import { bridge } from './bridge';
-import { appwrapNativeLog } from './native-log';
-import { SHELL_CONFIG } from './config';
-import { selectSubscriptionOffer, type OfferCandidate } from './billing-offer';
-
-// @objc Swift shim (AppwrapManageSubscriptions.swift, billing nativeSrc) — no NS types; bridges
-// StoreKit 2's Swift-async showManageSubscriptions(in:) to a completion the ObjC bridge can call.
-declare const AppwrapManageSubscriptions: { present(completion: (message: string | null) => void): void };
-
-// no NS types for the Play Billing Library (com.android.billingclient.*) — referenced via FFI,
-// lazily, so a non-billing Android build never touches the class (mirrors handlers-reviews.ts).
-declare const com: any;
-
-/**
- * In-app purchases — ONE bridge contract, two native stores.
- *
- * - iOS: StoreKit 1 (SKPaymentQueue). StoreKit 2 (Product/Transaction) is Swift-only and unreachable
- *   via the ObjC bridge, so we use the delegate-based SK1 API every NativeScript/Cordova IAP plugin
- *   uses. Returns a base64 app receipt.
- * - Android: Play Billing Library v7 (BillingClient / queryProductDetailsAsync / launchBillingFlow /
- *   queryPurchasesAsync). Returns a PurchaseReceipt carrying the Play `purchaseToken` (+ productId +
- *   packageName) — the exact shape AGF's server-side PlayStoreTokenValidator consumes.
- *
- * The web layer's validator (server-of-record) turns the returned receipt into entitlements; both
- * platforms register the SAME `billing.*` methods with the SAME return shapes.
- */
-
-const PERIOD_UNIT = ['D', 'W', 'M', 'Y']; // SKProductPeriodUnit: Day/Week/Month/Year
-const STATE = { Purchasing: 0, Purchased: 1, Failed: 2, Restored: 3, Deferred: 4 };
-const SK_ERR_CANCELLED = 2; // SKErrorPaymentCancelled
-
-function iosOnly(): Error {
-  return Object.assign(new Error('iOS only — Android billing not wired'), { code: 'UNSUPPORTED' });
-}
-function err(code: string, message: string): Error {
-  return Object.assign(new Error(message), { code });
-}
-
-/** Base64 of the bundle's App Store receipt — the proof a validator sends to Apple. */
-function appReceipt(): string {
-  const url = NSBundle.mainBundle.appStoreReceiptURL;
-  if (!url) return '';
-  const data = NSData.dataWithContentsOfURL(url);
-  // 0 = NSDataBase64Encoding default (no options); enum-cast for the typed selector.
-  return data ? data.base64EncodedStringWithOptions(0 as unknown as NSDataBase64EncodingOptions) : '';
-}
-
-function mapProduct(p: SKProduct) {
-  const f = NSNumberFormatter.new();
-  f.numberStyle = 2; // CurrencyStyle
-  f.locale = p.priceLocale;
-  const sp = p.subscriptionPeriod;
-  return {
-    id: String(p.productIdentifier),
-    title: String(p.localizedTitle ?? ''),
-    description: String(p.localizedDescription ?? ''),
-    price: p.price ? p.price.doubleValue : 0,
-    // stringFromNumber takes an NSNumber* at runtime; the .d.ts types it as number, so cast the NSDecimalNumber.
-    displayPrice: String(f.stringFromNumber(p.price as unknown as number) ?? ''),
-    currency: String(p.priceLocale?.currencyCode ?? ''),
-    type: sp ? 'autoRenewable' : 'unknown',
-    subscriptionPeriod: sp ? `P${sp.numberOfUnits}${PERIOD_UNIT[sp.unit] ?? 'D'}` : undefined,
-  };
-}
-
-function receiptFor(productId: string, transactionId?: string) {
-  return { platform: 'ios', productId, transactionId, appReceipt: appReceipt(), raw: {} };
-}
-
-// In-flight resolvers, keyed so the single queue observer can route callbacks.
-const purchaseWaiters = new Map<string, { resolve: (r: any) => void; reject: (e: any) => void }>();
-let restoreWaiter: { receipts: any[]; resolve: (r: any[]) => void; reject: (e: any) => void } | null = null;
-const productRequests = new Set<{ request: SKProductsRequest; delegate: any }>(); // keep strong refs to in-flight requests + delegates
-let observer: any = null;
-
-// iOS-only StoreKit delegates. Defined lazily inside an isIOS-gated factory (mirrors banner.ts) so the
-// shared module can instantiate on Android — NSObject/SK* are iOS globals, and a top-level
-// `extends NSObject` would evaluate at ES-module load and crash the Android shell.
-// any: module-level holders for runtime-built ObjC subclasses; each class BODY stays fully typed.
-let PaymentObserver: any, ProductsDelegate: any;
-function ensureIosDelegates(): void {
-  if (!isIOS || PaymentObserver) return;
-
-  // SKPaymentQueue transaction observer. State (purchaseWaiters/restoreWaiter) lives at module
-  // scope, so the delegate needs no instance fields.
-  @NativeClass()
-  class PaymentObserverImpl extends NSObject implements SKPaymentTransactionObserver {
-    static ObjCProtocols = [SKPaymentTransactionObserver];
-    static new(): PaymentObserverImpl {
-      return <PaymentObserverImpl>super.new();
-    }
-    paymentQueueUpdatedTransactions(queue: SKPaymentQueue, transactions: NSArray<SKPaymentTransaction>): void {
-      const n = transactions.count;
-      for (let i = 0; i < n; i++) {
-        const t = transactions.objectAtIndex(i);
-        const pid = String(t.payment.productIdentifier);
-        switch (t.transactionState) {
-          case STATE.Purchased: {
-            queue.finishTransaction(t);
-            const r = receiptFor(pid, String(t.transactionIdentifier ?? ''));
-            bridge.emit('billing.transaction', r);
-            purchaseWaiters.get(pid)?.resolve(r);
-            purchaseWaiters.delete(pid);
-            break;
-          }
-          case STATE.Restored: {
-            queue.finishTransaction(t);
-            const r = receiptFor(pid, String(t.transactionIdentifier ?? ''));
-            if (restoreWaiter) restoreWaiter.receipts.push(r);
-            bridge.emit('billing.transaction', r);
-            break;
-          }
-          case STATE.Failed: {
-            queue.finishTransaction(t);
-            // 'DENIED' here means exactly ONE thing: the user dismissed the sheet. Anything the
-            // device refuses outright (payments restricted) is 'UNSUPPORTED' — see billing.purchase.
-            const cancelled = t.error && t.error.code === SK_ERR_CANCELLED;
-            const e = err(cancelled ? 'DENIED' : 'NATIVE_ERROR', t.error?.localizedDescription ?? 'Purchase failed');
-            purchaseWaiters.get(pid)?.reject(e);
-            purchaseWaiters.delete(pid);
-            break;
-          }
-          // Purchasing / Deferred: nothing to do.
-        }
-      }
-    }
-    paymentQueueRestoreCompletedTransactionsFinished(_queue: SKPaymentQueue): void {
-      restoreWaiter?.resolve(restoreWaiter.receipts);
-      restoreWaiter = null;
-    }
-    paymentQueueRestoreCompletedTransactionsFailedWithError(_queue: SKPaymentQueue, error: NSError): void {
-      restoreWaiter?.reject(err('NATIVE_ERROR', error?.localizedDescription ?? 'Restore failed'));
-      restoreWaiter = null;
-    }
-  }
-  PaymentObserver = PaymentObserverImpl;
-
-  // SKProductsRequest delegate. Closure-captured state (resolve/reject + the strong-ref holder)
-  // is held as instance fields, assigned after new().
-  @NativeClass()
-  class ProductsDelegateImpl extends NSObject implements SKProductsRequestDelegate {
-    static ObjCProtocols = [SKProductsRequestDelegate];
-    onResolve?: (products: SKProduct[]) => void;
-    onReject?: (e: Error) => void;
-    holder?: { request: SKProductsRequest; delegate: any };
-    static new(): ProductsDelegateImpl {
-      return <ProductsDelegateImpl>super.new();
-    }
-    productsRequestDidReceiveResponse(_request: SKProductsRequest, response: SKProductsResponse): void {
-      const out: SKProduct[] = [];
-      const products = response.products;
-      for (let i = 0; i < products.count; i++) out.push(products.objectAtIndex(i));
-      if (this.holder) productRequests.delete(this.holder);
-      this.onResolve?.(out);
-    }
-    requestDidFailWithError(_request: SKRequest, error: NSError): void {
-      if (this.holder) productRequests.delete(this.holder);
-      this.onReject?.(err('NATIVE_ERROR', error?.localizedDescription ?? 'Products request failed'));
-    }
-  }
-  ProductsDelegate = ProductsDelegateImpl;
-}
-
-function buildObserver(): any {
-  return PaymentObserver.new();
-}
-
-/** One SKProductsRequest → resolves the raw SKProduct objects (used by both products + purchase). */
-function requestSKProducts(ids: string[]): Promise<SKProduct[]> {
-  return new Promise((resolve, reject) => {
-    const set = NSSet.setWithArray<string>(ids);
-    const request = SKProductsRequest.alloc().initWithProductIdentifiers(set);
-    const delegate = ProductsDelegate.new();
-    const holder = { request, delegate };
-    delegate.onResolve = resolve;
-    delegate.onReject = reject;
-    delegate.holder = holder;
-    productRequests.add(holder); // strong ref until the callback fires
-    request.delegate = delegate;
-    request.start();
-  });
-}
-
-export function registerBillingHandlers(): void {
-  if (isIOS) registerIosBilling();
-  else if (isAndroid) registerAndroidBilling();
-}
-
-function registerIosBilling(): void {
-  ensureIosDelegates();
-  observer = buildObserver();
-  SKPaymentQueue.defaultQueue().addTransactionObserver(observer);
-
-  bridge.register('billing.products', async ({ ids = [] }: { ids: string[] }) => {
-    if (!ids.length) return [];
-    return (await requestSKProducts(ids)).map(mapProduct);
-  });
-
-  bridge.register('billing.purchase', async ({ productId }: { productId: string }) => {
-    // 'UNSUPPORTED', not 'DENIED': this device CANNOT pay at all (Screen Time / parental controls
-    // / MDM restriction) — a standing condition retrying will never clear. 'DENIED' is reserved for
-    // the user dismissing the StoreKit sheet (SKErrorPaymentCancelled, below), which is a per-attempt
-    // choice. Conflating them made consumers silently swallow this as a cancel and strand the user.
-    if (!SKPaymentQueue.canMakePayments()) throw err('UNSUPPORTED', 'Purchases are disabled on this device');
-    const sk = (await requestSKProducts([productId]))[0];
-    if (!sk) throw err('NATIVE_ERROR', `Unknown product: ${productId}`);
-    return new Promise((resolve, reject) => {
-      purchaseWaiters.set(productId, { resolve, reject });
-      SKPaymentQueue.defaultQueue().addPayment(SKPayment.paymentWithProduct(sk));
-    });
-  });
-
-  bridge.register('billing.restore', () => restoreTransactions());
-
-  // The bundle's App Store receipt, read straight from disk — NO Apple-ID prompt and no
-  // store round-trip (unlike restore). For an in-place app update it already holds the
-  // user's active/grandfathered subscriptions, so a server validator can confirm
-  // entitlements silently. This is the zero-user-action path for migrating existing
-  // subscribers into a new build of the SAME bundle id. Empty string if absent (e.g. a
-  // dev build with no receipt) — the caller falls back to restore().
-  bridge.register('billing.appReceipt', async () => ({ platform: 'ios', appReceipt: appReceipt() }));
-
-  // Client-trusted entitlements: StoreKit 1 has no on-device entitlement list, so we
-  // derive non-consumed/active products from a restore. Real apps plug in a server
-  // validator (see kit.billing.configure) instead of trusting this.
-  bridge.register('billing.entitlements', async () => {
-    const receipts = await restoreTransactions();
-    const seen = new Set<string>();
-    const ents: any[] = [];
-    for (const r of receipts) {
-      if (seen.has(r.productId)) continue;
-      seen.add(r.productId);
-      ents.push({ productId: r.productId, active: true });
-    }
-    return ents;
-  });
-
-  bridge.register('billing.manageSubscriptions', () => {
-    // DEFAULT: StoreKit 1 deep-link — correct for production, but leaves the app and doesn't show
-    // sandbox/TestFlight subs. The in-app sheet is the opt-in `billing.manageSubscriptionsSheet` below.
-    Utils.openUrl('itms-apps://apps.apple.com/account/subscriptions');
-  });
-
-  // OPT-IN (iOS 15+): StoreKit 2's in-app management sheet via the AppwrapManageSubscriptions Swift
-  // shim — shows the user's subs (incl. sandbox/TestFlight) and lets them cancel without leaving the
-  // app. Reached only when the app calls kit.billing.showManageSubscriptionsSheet(), so the default
-  // deep-link path above is untouched. Rejects on iOS <15, no scene, or a StoreKit error.
-  bridge.register('billing.manageSubscriptionsSheet', () => {
-    return new Promise<void>((resolve, reject) => {
-      AppwrapManageSubscriptions.present((message: string | null) => {
-        if (SHELL_CONFIG.debug) appwrapNativeLog(`[native:lifecycle] manageSubscriptionsSheet done err=${message ?? 'none'}`);
-        // The sheet dismisses WITHOUT the app scene leaving foregroundActive → no resumeEvent, and it
-        // orphans a touch-stealing window above ours. Recover from this completion (the only callback
-        // that fires). Shared across all native surfaces; see CustomWebView.recoverAfterNativeSurface.
-        // NOTE: redundant with the global UIWindowDidBecomeHidden observer (armNativeSurfaceRecovery in
-        // main-page.ts) — kept as the proven baseline; remove the per-handler calls once that observer
-        // is device-verified to fire on this dismiss. Double-recovery is safe (coalesced + no-op clean).
-        bridge.getWebView()?.recoverAfterNativeSurface();
-        if (message) reject(err('NATIVE_ERROR', message));
-        else resolve();
-      });
-    });
-  });
-}
-
-function restoreTransactions(): Promise<any[]> {
-  if (restoreWaiter) return Promise.reject(err('NOT_READY', 'A restore is already in progress'));
-  return new Promise((resolve, reject) => {
-    restoreWaiter = { receipts: [], resolve, reject };
-    SKPaymentQueue.defaultQueue().restoreCompletedTransactions();
-  });
-}
-
-// ─────────────────────────── Android — Google Play Billing ───────────────────────────
-// Play Billing Library v7. All com.android.billingclient.* access is lazy (inside handler bodies)
-// so the shared module loads on iOS and a non-billing Android build never links the class.
-//
-// ACKNOWLEDGEMENT DECISION (money-critical): Play auto-refunds any purchase not acknowledged within
-// 3 days. We acknowledge CLIENT-SIDE here (BillingClient.acknowledgePurchase) immediately after a
-// PURCHASED update and on restore — the simplest correct choice, since this handler owns the
-// BillingClient. The AGF server validator (PlayStoreTokenValidator) MAY also acknowledge via the
-// Play Developer API; a second acknowledge is a harmless no-op on Google's side (idempotent), so
-// the two can coexist. Tradeoff: we ack before the server confirms the grant, so a failed server
-// validation still consumes the purchase (no auto-refund) — acceptable because the server is the
-// source-of-record and re-validates the token on demand. If the server takes over acknowledgement
-// exclusively, delete acknowledgeAndroidPurchase() calls here.
-
-// BillingResponseCode (com.android.billingclient.api.BillingClient.BillingResponseCode).
-const PLAY_RESP = {
-  OK: 0, USER_CANCELED: 1, SERVICE_UNAVAILABLE: 2, BILLING_UNAVAILABLE: 3, ITEM_UNAVAILABLE: 4,
-  DEVELOPER_ERROR: 5, ERROR: 6, ITEM_ALREADY_OWNED: 7, FEATURE_NOT_SUPPORTED: -2, SERVICE_DISCONNECTED: -1,
-};
-const PURCHASE_STATE_PURCHASED = 1; // com.android.billingclient.api.Purchase.PurchaseState.PURCHASED
-
-let billingClient: any = null; // com.android.billingclient.api.BillingClient
-let clientConnecting: Promise<any> | null = null;
-// Purchases arrive asynchronously via the single PurchasesUpdatedListener; route them to the
-// in-flight purchase() caller by product id (module scope, like the iOS purchaseWaiters).
-const androidPurchaseWaiters = new Map<string, { resolve: (r: any) => void; reject: (e: any) => void }>();
-// Single-purchase gate: with only one in-flight purchase, "reject all on error" (which lacks product
-// context) can never reject a DIFFERENT caller's promise. Set synchronously in billing.purchase.
-let androidPurchaseInFlight = false;
-
-function billingApi(): any {
-  return com.android.billingclient.api;
-}
-
-function packageName(): string {
-  return String(Utils.android.getApplicationContext().getPackageName());
-}
-
-/** Java List<T> from a JS array (Play Billing builders take java.util.List, not a marshaled JS array). */
-function toJavaList(items: any[]): any {
-  const list = new java.util.ArrayList();
-  for (const it of items) list.add(it);
-  return list;
-}
-
-/** Map a Play BillingResult to a bridge error, mirroring the iOS cancel/unsupported semantics. */
-function mapBillingErr(result: any): Error {
-  const code = result?.getResponseCode?.();
-  const msg = String(result?.getDebugMessage?.() ?? 'Play Billing error');
-  if (code === PLAY_RESP.USER_CANCELED) return err('DENIED', 'Purchase cancelled');
-  if (code === PLAY_RESP.BILLING_UNAVAILABLE || code === PLAY_RESP.FEATURE_NOT_SUPPORTED)
-    return err('UNSUPPORTED', msg || 'Billing unavailable on this device');
-  return err('NATIVE_ERROR', `${msg} (code ${code})`);
-}
-
-/** Lazily build + connect the BillingClient. Resolves when the service is READY. */
-function ensureAndroidClient(): Promise<any> {
-  if (billingClient && billingClient.isReady()) return Promise.resolve(billingClient);
-  if (clientConnecting) return clientConnecting;
-
-  clientConnecting = new Promise((resolve, reject) => {
-    const api = billingApi();
-    const ctx = Utils.android.getApplicationContext();
-    // v7 requires PendingPurchasesParams; enableOneTimeProducts() is harmless for a subs-only app
-    // (pending purchases are always enabled for subscriptions).
-    const pending = api.PendingPurchasesParams.newBuilder().enableOneTimeProducts().build();
-    const listener = new api.PurchasesUpdatedListener({
-      onPurchasesUpdated(result: any, purchases: any) {
-        onAndroidPurchasesUpdated(result, purchases);
-      },
-    });
-    billingClient = api.BillingClient.newBuilder(ctx)
-      .setListener(listener)
-      .enablePendingPurchases(pending)
-      .build();
-    billingClient.startConnection(new api.BillingClientStateListener({
-      onBillingSetupFinished(result: any) {
-        if (result.getResponseCode() === PLAY_RESP.OK) resolve(billingClient);
-        else reject(mapBillingErr(result));
-      },
-      onBillingServiceDisconnected() {
-        // Force a fresh connection on the next call (Google recommends reconnect-on-demand).
-        clientConnecting = null;
-      },
-    }));
-  }).catch((e) => {
-    clientConnecting = null;
-    throw e;
-  });
-  return clientConnecting;
-}
-
-/** Query one product's ProductDetails (SUBS). */
-function queryAndroidProductDetails(ids: string[]): Promise<any[]> {
-  return ensureAndroidClient().then((client) => new Promise<any[]>((resolve, reject) => {
-    const api = billingApi();
-    const products = ids.map((id) =>
-      api.QueryProductDetailsParams.Product.newBuilder()
-        .setProductId(id)
-        .setProductType(api.BillingClient.ProductType.SUBS)
-        .build());
-    const params = api.QueryProductDetailsParams.newBuilder().setProductList(toJavaList(products)).build();
-    client.queryProductDetailsAsync(params, new api.ProductDetailsResponseListener({
-      onProductDetailsResponse(result: any, list: any) {
-        if (result.getResponseCode() !== PLAY_RESP.OK) return reject(mapBillingErr(result));
-        const out: any[] = [];
-        const n = list ? list.size() : 0;
-        for (let i = 0; i < n; i++) out.push(list.get(i));
-        resolve(out);
-      },
-    }));
-  }));
-}
-
-/** Flatten a ProductDetails' SubscriptionOfferDetails into pure {offerId, phases} + a ref to the
- *  native offer (so the caller can read its token / native phases after selection). */
-function androidOfferCandidates(pd: any): Array<OfferCandidate & { native: any }> {
-  const offers = pd.getSubscriptionOfferDetails();
-  const out: Array<OfferCandidate & { native: any }> = [];
-  const n = offers ? offers.size() : 0;
-  for (let i = 0; i < n; i++) {
-    const o = offers.get(i);
-    const list = o.getPricingPhases().getPricingPhaseList();
-    const phases = [];
-    for (let j = 0; j < list.size(); j++) {
-      const ph = list.get(j);
-      phases.push({
-        priceAmountMicros: Number(ph.getPriceAmountMicros()),
-        billingPeriod: String(ph.getBillingPeriod() ?? ''),
-      });
-    }
-    const id = o.getOfferId ? o.getOfferId() : null;
-    out.push({ offerId: id != null ? String(id) : null, phases, native: o });
-  }
-  return out;
-}
-
-/** First native pricing phase whose micros satisfy `pred`. */
-function pickNativePhase(list: any, pred: (micros: number) => boolean): any {
-  for (let i = 0; i < list.size(); i++) {
-    const p = list.get(i);
-    if (pred(Number(p.getPriceAmountMicros()))) return p;
-  }
-  return null;
-}
-
-/** ProductDetails → the platform-neutral Product shape, from the SELECTED offer (trial-aware). */
-function mapAndroidProduct(pd: any): any {
-  const selected = selectSubscriptionOffer(androidOfferCandidates(pd));
-  if (!selected) return null; // not a subscription / no offer
-  const list = selected.native.getPricingPhases().getPricingPhaseList();
-  // Recurring (paid) phase for the display price; fall back to the last phase.
-  const phase = pickNativePhase(list, (m) => m > 0) ?? list.get(list.size() - 1);
-  const period = String(phase.getBillingPeriod() ?? '');
-  const product: any = {
-    id: String(pd.getProductId()),
-    title: String(pd.getTitle() ?? pd.getName() ?? ''),
-    description: String(pd.getDescription() ?? ''),
-    price: Number(phase.getPriceAmountMicros()) / 1_000_000,
-    displayPrice: String(phase.getFormattedPrice() ?? ''),
-    currency: String(phase.getPriceCurrencyCode() ?? ''),
-    type: 'autoRenewable',
-    subscriptionPeriod: period || undefined,
-  };
-  // Surface the free-trial / intro phase so the UI can show trial terms (Play also shows them in its
-  // own sheet). Populated only when the selected offer carries a zero-price phase (trial-eligible).
-  const intro = pickNativePhase(list, (m) => m === 0);
-  if (intro) {
-    const introPeriod = String(intro.getBillingPeriod() ?? '');
-    product.introOffer = {
-      price: Number(intro.getPriceAmountMicros()) / 1_000_000,
-      displayPrice: String(intro.getFormattedPrice() ?? ''),
-      period: introPeriod || undefined,
-      isFreeTrial: Number(intro.getPriceAmountMicros()) === 0,
-    };
-  }
-  return product;
-}
-
-/** Play Purchase → PurchaseReceipt (the token is the critical field the server validator consumes). */
-function androidReceiptFor(purchase: any, productId: string): any {
-  return {
-    platform: 'android',
-    productId,
-    transactionId: String(purchase.getOrderId?.() ?? ''),
-    purchaseToken: String(purchase.getPurchaseToken()),
-    packageName: String(purchase.getPackageName?.() ?? packageName()),
-    raw: {
-      originalJson: String(purchase.getOriginalJson?.() ?? ''),
-      signature: String(purchase.getSignature?.() ?? ''),
-    },
-  };
-}
-
-/** Client-side acknowledge (see ACKNOWLEDGEMENT DECISION above). Fire-and-forget; logs on failure. */
-function acknowledgeAndroidPurchase(purchase: any): void {
-  try {
-    if (purchase.isAcknowledged()) return;
-    const api = billingApi();
-    const params = api.AcknowledgePurchaseParams.newBuilder()
-      .setPurchaseToken(purchase.getPurchaseToken())
-      .build();
-    billingClient.acknowledgePurchase(params, new api.AcknowledgePurchaseResponseListener({
-      onAcknowledgePurchaseResponse(result: any) {
-        if (result.getResponseCode() !== PLAY_RESP.OK) {
-          console.warn('AppWrap: billing acknowledge failed', result.getResponseCode(), String(result.getDebugMessage?.() ?? ''));
-        }
-      },
-    }));
-  } catch (e) {
-    console.warn('AppWrap: billing acknowledge threw', e);
-  }
-}
-
-/** The single PurchasesUpdatedListener callback — routes results to the purchase() waiter(s). */
-function onAndroidPurchasesUpdated(result: any, purchases: any): void {
-  const code = result.getResponseCode();
-  if (code !== PLAY_RESP.OK || !purchases) {
-    // No product context here (Play doesn't say which flow) → reject all in-flight purchases with the
-    // mapped error (USER_CANCELED → DENIED, mirroring iOS' cancel semantics).
-    const e = mapBillingErr(result);
-    for (const w of androidPurchaseWaiters.values()) w.reject(e);
-    androidPurchaseWaiters.clear();
-    return;
-  }
-  const n = purchases.size();
-  for (let i = 0; i < n; i++) {
-    const purchase = purchases.get(i);
-    // PENDING (cash/bank/parental-approval) → don't resolve/ack/grant now. This NATIVE waiter has NO
-    // timeout; the JS `invoke` rejects at 120s, so by the time Play flips PENDING→PURCHASED (hours/
-    // days later) the purchase() promise is long gone. The completion is recoverable ONLY via the
-    // billing.transaction event emitted below when this listener fires again with PURCHASED — NOT via
-    // the original purchase() promise. Do NOT ack or grant a PENDING purchase.
-    if (purchase.getPurchaseState() !== PURCHASE_STATE_PURCHASED) continue;
-    acknowledgeAndroidPurchase(purchase);
-    const prods = purchase.getProducts();
-    const pid = prods && prods.size() > 0 ? String(prods.get(0)) : '';
-    const receipt = androidReceiptFor(purchase, pid);
-    bridge.emit('billing.transaction', receipt);
-    const w = androidPurchaseWaiters.get(pid);
-    if (w) { w.resolve(receipt); androidPurchaseWaiters.delete(pid); }
-  }
-}
-
-/** queryPurchasesAsync(SUBS) → active PurchaseReceipts (used by restore / appReceipt / entitlements). */
-function androidActivePurchases(): Promise<any[]> {
-  return ensureAndroidClient().then((client) => new Promise<any[]>((resolve, reject) => {
-    const api = billingApi();
-    const params = api.QueryPurchasesParams.newBuilder().setProductType(api.BillingClient.ProductType.SUBS).build();
-    client.queryPurchasesAsync(params, new api.PurchasesResponseListener({
-      onQueryPurchasesResponse(result: any, list: any) {
-        if (result.getResponseCode() !== PLAY_RESP.OK) return reject(mapBillingErr(result));
-        const receipts: any[] = [];
-        const n = list ? list.size() : 0;
-        for (let i = 0; i < n; i++) {
-          const p = list.get(i);
-          if (p.getPurchaseState() !== PURCHASE_STATE_PURCHASED) continue;
-          acknowledgeAndroidPurchase(p); // ack any not-yet-acked active sub (in-place migration safety)
-          const prods = p.getProducts();
-          const pid = prods && prods.size() > 0 ? String(prods.get(0)) : '';
-          receipts.push(androidReceiptFor(p, pid));
-        }
-        resolve(receipts);
-      },
-    }));
-  }));
-}
-
-function registerAndroidBilling(): void {
-  bridge.register('billing.products', async ({ ids = [] }: { ids: string[] }) => {
-    if (!ids.length) return [];
-    return (await queryAndroidProductDetails(ids)).map(mapAndroidProduct).filter(Boolean);
-  });
-
-  bridge.register('billing.purchase', async ({ productId }: { productId: string }) => {
-    // SERIALIZE: Play's PurchasesUpdatedListener gives NO product context on error, so a single
-    // in-flight purchase is the only way "reject all on error" can't cross-talk between callers.
-    // The app is single-product; a concurrent second purchase() is rejected outright, guaranteeing
-    // there is only ever ONE entry in androidPurchaseWaiters. Guard is set SYNCHRONOUSLY (before any
-    // await) so two near-simultaneous calls can't both pass it.
-    if (androidPurchaseInFlight) throw err('NATIVE_ERROR', 'A purchase is already in progress');
-    androidPurchaseInFlight = true;
-    try {
-      const client = await ensureAndroidClient();
-      const pd = (await queryAndroidProductDetails([productId]))[0];
-      if (!pd) throw err('NATIVE_ERROR', `Unknown product: ${productId}`);
-      const selected = selectSubscriptionOffer(androidOfferCandidates(pd));
-      if (!selected) throw err('NATIVE_ERROR', `No subscription offer for ${productId}`);
-      // Trial-aware: the SELECTED offer's token carries the free trial when the user is eligible.
-      const offerToken = selected.native.getOfferToken();
-      const api = billingApi();
-      const pdParams = api.BillingFlowParams.ProductDetailsParams.newBuilder()
-        .setProductDetails(pd)
-        .setOfferToken(offerToken)
-        .build();
-      const flowParams = api.BillingFlowParams.newBuilder()
-        .setProductDetailsParamsList(toJavaList([pdParams]))
-        .build();
-      return await new Promise((resolve, reject) => {
-        androidPurchaseWaiters.set(productId, { resolve, reject });
-        Utils.dispatchToMainThread(() => {
-          const activity = Application.android.foregroundActivity ?? Application.android.startActivity;
-          if (!activity) {
-            androidPurchaseWaiters.delete(productId);
-            reject(err('NOT_READY', 'no foreground activity'));
-            return;
-          }
-          // launchBillingFlow's synchronous result reports only launch failures; the purchase itself
-          // resolves later via onAndroidPurchasesUpdated → the waiter above.
-          const launch = client.launchBillingFlow(activity, flowParams);
-          if (launch.getResponseCode() !== PLAY_RESP.OK) {
-            androidPurchaseWaiters.delete(productId);
-            reject(mapBillingErr(launch));
-          }
-        });
-      });
-    } finally {
-      // Runs when the purchase settles (resolve/reject) or on any setup throw — re-opening the gate.
-      androidPurchaseInFlight = false;
-    }
-  });
-
-  bridge.register('billing.restore', () => androidActivePurchases());
-
-  // Android has no StoreKit-1-style on-disk app receipt; the analog is the most recent active sub's
-  // purchaseToken (empty when none). Mirrors iOS' { platform:'ios', appReceipt }.
-  bridge.register('billing.appReceipt', async () => {
-    const receipts = await androidActivePurchases();
-    return { platform: 'android', purchaseToken: receipts[0]?.purchaseToken };
-  });
-
-  // Thin, device-derived entitlements (server is the source-of-record — same posture as iOS).
-  bridge.register('billing.entitlements', async () => {
-    const receipts = await androidActivePurchases();
-    const seen = new Set<string>();
-    const ents: any[] = [];
-    for (const r of receipts) {
-      if (!r.productId || seen.has(r.productId)) continue;
-      seen.add(r.productId);
-      ents.push({ productId: r.productId, active: true });
-    }
-    return ents;
-  });
-
-  // Android has no in-app management sheet; the Play subscriptions deep link is the analog for BOTH
-  // manageSubscriptions() and showManageSubscriptionsSheet() (the JS layer dispatches the sheet call
-  // here now that the capability is 'native' on Android).
-  const openManage = ({ productId }: { productId?: string } = {}) => {
-    const base = 'https://play.google.com/store/account/subscriptions';
-    const url = productId ? `${base}?sku=${encodeURIComponent(productId)}&package=${packageName()}` : base;
-    Utils.openUrl(url);
-  };
-  bridge.register('billing.manageSubscriptions', (p: { productId?: string } = {}) => openManage(p));
-  bridge.register('billing.manageSubscriptionsSheet', (p: { productId?: string } = {}) => openManage(p));
-}