@mpgd/capacitor-storekit 0.2.2 → 0.3.0

package/README.md

@@ -2,8 +2,8 @@
 
 Opt-in StoreKit 2 one-time purchase collector for Capacitor 8 on iOS.
 It does not enable native IAP in the base Capacitor shell. Install it only in a
-game-owned iOS project and register `createCapacitorStoreKitProvider(...)` in
-that game's provider list.
+game-owned iOS project and register `createCapacitorStoreKitServiceProvider(...)`
+in that game's provider list.
 
 Map each logical game product to its App Store Connect product ID and provide
 an authenticated, stable UUID `getAppAccountToken()` value. The game backend
@@ -12,14 +12,13 @@ must resolve the same UUID for the player. Product lookup, purchase results,
 entitlements provide **provisional evidence**, never a wallet or entitlement
 grant. A completed native purchase returns no `authoritativeGrant`.
 
-## Commerce v2 provider
+## Commerce provider
 
-Commerce v2 ([RFC](../../docs/specs/commerce/commerce-v2-rfc.md), PR B3)
-adds a second surface next to the v1 provider above. The package exposes the
-native plugin as a `StoreSdk` from `@mpgd/adapter-capacitor` and a
-`CommerceProvider` from `@mpgd/platform/commerce` built on
-`createStoreCommerceProvider`. Register the v2 service provider **or** the v1
-`createCapacitorStoreKitProvider` in a gateway, never both.
+Commerce ([RFC](../../docs/specs/commerce/commerce-v2-rfc.md)) is the only
+surface of this package. It exposes the native plugin as a `StoreSdk` from
+`@mpgd/adapter-capacitor` and a `CommerceProvider` from
+`@mpgd/platform/commerce` built on `createStoreCommerceProvider`, registered
+with the Capacitor gateway as `gateway.commerce`.
 
 ```ts
 import { createCapacitorPlatformGateway } from '@mpgd/adapter-capacitor';
@@ -61,7 +60,7 @@ listed, a `revokedAt` maps to `state: 'revoked'`, and one malformed
 transaction is reported as a `purchaseError` without blocking its siblings);
 `finishTransaction({ transactionId, ledgerEntryId })` over the native finish;
 `restorePurchases` over `sync`; `transactionUpdated` as `purchaseUpdated`;
-and the v1 availability probe as `getAvailability`, probing the configured
+and an availability probe as `getAvailability`, probing the configured
 SKUs batch by batch until one is sold. Every purchase carries the
 StoreKit-verified `signedTransaction` JWS as its `token`, the
 `transactionId`, `originalTransactionId`, `purchasedAt`, `quantity: 1`, and
@@ -107,23 +106,27 @@ from the App Store Server API, so a JWS retained from before a refund never
 grants; see the backend guide for the opt-in offline-only mode. Subscription
 mappings are rejected at construction. `createCapacitorStoreKitServiceProvider`
 wraps the provider as a `CapacitorServiceProvider` (id `apple-storekit` by
-default) so the gateway serves the `commerce.v2.*` and v1 `commerce.*`
-bridge methods from it and exposes it as `gateway.commerceV2`.
-
-Finishing never grants. The v2 SDK finishes any transaction it is given a
-`ledgerEntryId` for: the commerce v2 reconciler
+default, no `features`, no `methods`) so the gateway serves the six
+`commerce.v2.*` bridge methods from it, exposes it as `gateway.commerce`, and
+reports its capability block in `getCapabilities().commerce`.
+`createStoreKitCommerceCapabilities(availability)` (from `src/commerce-profile.ts`,
+which imports types only and no Capacitor code) returns the full
+`CommerceCapabilities` block this provider declares while the store reports
+`availability`, so a validator or server can read the profile without loading
+the plugin; a unit test keeps it equal to `provider.getCapabilities()`.
+
+Finishing never grants. The SDK finishes any transaction it is given a
+`ledgerEntryId` for: the commerce reconciler
 (`createCommerceReconciler` in `@mpgd/game-services`) is the gate, and it
 calls `finishTransaction` only for a journal record in `granted` or
 `finishing` that holds the ledger entry id the backend grant wrote
-(`assertCommerceFinishAllowed`). The v1 `finishGrantedTransaction`
-allow-list guard is not reproduced in the SDK: the journal revision the grant
-wrote is the pairing, and the real control stays server-side, in the verifier
-that checks the JWS before the ledger grant, and in the native plugin never
-granting anything on finish. The v1 recovery helpers
-(`recoverStoreKitPurchases`, `getRecoverableTransactions`,
-`finishGrantedTransaction`) are deprecated in favor of that reconciler (RFC
-C1) and are removed in C4; `src/commerce-reconciler-storekit-smoke.test.ts`
-shows both paths reaching the same outcomes over the fake plugin.
+(`assertCommerceFinishAllowed`). The journal revision the grant wrote is the
+pairing, and the real control stays server-side, in the verifier that checks
+the JWS before the ledger grant, and in the native plugin never granting
+anything on finish. `src/commerce-reconciler-storekit-smoke.test.ts` shows the
+reconciler over the fake plugin: a grant finishes with the ledger entry, a
+rejection and an outage never finish, a failed finish is retried, and another
+account's transaction is never submitted.
 
 The conformance test runs every store vector whose profile the App Store
 supports against a fake plugin, directly and through the gateway bridge path,
@@ -131,87 +134,60 @@ and lists each skipped vector with its reason (host or server finish,
 quantity, server-push, an asynchronous store error event StoreKit never
 emits, and a pending transaction state StoreKit never reports).
 
-## v1 provider and recovery
-
-On startup, account restoration, and after a pending or uncertain checkout,
-call `recoverStoreKitPurchases({ provider, backend, playerId })`. It sends only
-transactions whose `appAccountToken` matches the current authenticated game
-account to the game-owned `backend.recoverPurchase` contract. That backend
-must reuse the original idempotency key from the durable purchase journal, or
-return the existing ledger grant for the same Apple evidence, product and
-player. It must not invent a new key for an already-granted transaction: the
-generic game-services verifier rejects such evidence replay. For new evidence,
-the backend uses the existing App Store Server API/JWS verifier to validate
-bundle, product, environment and account binding before the ledger grant.
-The recovery helper calls native `finishTransaction` only after a
-verified response with a ledger entry ID. If finish fails, it reports
-`finishPending: true`; repeat recovery with the original purchase identity.
-`provider.finishGrantedTransaction` accepts only a transaction and ledger
-entry pair that `recoverStoreKitPurchases` recorded from a backend answer in
-the current session. The pair is consumed before the native call, so
-overlapping finishes (for example startup recovery and a `transactionUpdated`
-recovery) share one native call, and a failed native finish restores the pair
-for a retry. Calling it, or the native `finishTransaction` plugin method, with
-any other value is rejected so an unfinished purchase keeps its recovery
-signal. This guard prevents arbitrary or accidental finish calls with
-unverified ledger IDs and binds finishing to the recovery flow; it is **not**
-a trust boundary against code that controls the `backend` object it passes to
-`recoverStoreKitPurchases`. The real control is server-side: the authenticated
-`recoverPurchase` implementation must verify Apple evidence before it grants,
-and finishing a transaction never grants anything by itself.
-An unknown backend result stays pending and never triggers a
-new purchase sheet automatically.
-
-On the game server, `@mpgd/game-services/app-store-recovery` provides
-`createAppStoreRecoveryBackend(...)` for this contract. Construct it only after
-authenticating the game player, and bind `playerId` to that authenticated
-identity. Pass the same durable `GameServicesStore` instance and
-`createGameServicesBackend(...).purchases` used for checkout. Its optional
-`resolveOriginalIdempotencyKey` callback must query the game's durable
-checkout journal for the **original** key associated with this player and
-transaction. The adapter first checks existing App Store ledger evidence and
-rejects cross-player, cross-product, cross-deployment and key collisions. If
-neither a matching grant nor an original journal key exists, it returns
-`pending` without attempting a new grant. Do not use the in-memory store for
-production recovery. The game's HTTP/RPC endpoint must authenticate the
-request; this helper does not expose one or authenticate clients.
-For restored non-consumables whose new transaction ID differs from the
-original, configure `restoredNonConsumables` with the same catalog and official
-App Store evidence verifier, bundle ID and environment used by the game backend.
-When no prior grant exists, also bind `deploymentTarget` on the server-side
-recovery backend. The client-supplied target is not trusted to select a product;
-without a bound target this restore stays pending until the game backend is
-configured for its deployment. An existing grant can supply its recorded target.
-The bundle/environment identify an existing grant for its deployment target
-before product lookup; they must match the verifier configuration. The helper re-verifies
-the **current** Apple transaction and looks up the prior grant by its canonical
-original-transaction verification ID before reusing the original key. Without
-that verifier, this restore remains pending rather than trusting a client-
-reported original ID. A verifier that exceeds its timeout also remains pending.
-The native provider forwards both IDs and product type.
-For production-scale ledgers, implement the store's indexed
-`findEntitlementTransactionByPlatformEvidence` and
-`findEntitlementTransactionByIdempotency` methods, plus
-`findEntitlementTransactionByEvidenceVerificationId` for restored
-non-consumables. Without them, the helper
-uses the same full-ledger scan fallback as the generic game-services server.
-
-An existing grant is returned by the normal backend idempotent-retry path;
-that path relies on the prior verified ledger record rather than fetching
-fresh Apple status. Continue to process App Store revocations separately.
-Permanently rejected and account-mismatched transactions are reported as
-`rejected` and are **not** finished: the helper cannot prove content delivery
-for them. Persist that terminal result in the game-owned operation journal and
-do not run an automatic retry loop for it. A support flow may recheck a
-corrected account or backend decision later. One malformed transaction is
-reported separately and cannot block valid sibling transactions.
-
-The iOS native plugin also emits `transactionUpdated` for delayed StoreKit
-transactions. Call recovery after this event and on app launch because events
-can be missed while the game is closed. `commerce.restore` intentionally
-invokes user-initiated `AppStore.sync()` before returning no local entitlements;
-call recovery afterward. Subscriptions are not supported by this package;
-they require a separate subscription status and renewal flow.
+### Generated games
+
+Games generated by `mpgd game create` (and the kit's private starter) ship
+this wiring in `src/platform/buildGateways/capacitorIos.ts` (commerce v2 PR
+C3): the service provider is registered for every catalog product whose
+`platformProductIds.ios` names an App Store product id (subscriptions are
+skipped), and `getAppAccountToken` is the reference binding in
+`src/platform/commerceAccountBinding.ts`, a UUID (version 5 layout) over the
+SHA-256 of `mpgd-commerce-account:<playerId>` for the authenticated player;
+a guest session throws, so no sheet opens without a binding. The backend's
+`resolveAppAccountToken` must derive the same UUID, or both are replaced
+together.
+
+`mpgd target init capacitor --providers storekit` installs this package into
+the game-owned shell and the game at one exact version and lets `cap add` or
+`cap sync` register its Swift package; on a game that still has the unwired
+gateway of an earlier template it also writes the wiring above. A build
+whose shell lacks the native plugin still runs: the plugin answers
+Capacitor's `UNIMPLEMENTED`, which the SDK reports as
+`configuration-required`, so no purchase sheet opens.
+
+## Recovery
+
+Call the reconciler (`monetizationRecovery.reconcile()` from
+`@mpgd/game-services`) on startup, on resume, and after the iOS plugin emits
+`transactionUpdated` for a delayed transaction (Ask to Buy, an interrupted
+checkout, a transaction finished on another device): the events can be missed
+while the game is closed, so `getAvailablePurchases` (`Transaction.unfinished`)
+is the source of truth. The reconciler sends only transactions whose
+`appAccountToken` matches the current authenticated game account, verifies
+each one on the backend under its original idempotency key or returns the
+existing ledger grant, and calls `finishTransaction` only after a verified
+response with a ledger entry id. Permanently rejected and account-mismatched
+transactions are not finished: the client cannot prove content delivery for
+them, so persist that terminal result in the game-owned operation journal and
+do not run an automatic retry loop for it. An unknown backend result stays
+pending and never opens a new purchase sheet. Process App Store revocations
+separately on the server. `restorePurchases` invokes the user-initiated
+`AppStore.sync()` and then runs a reconciler pass; it returns no local
+entitlements. Subscriptions are not supported by this package; they require a
+separate subscription status and renewal flow.
+
+### Migrating from v1
+
+Commerce v2 PR C4 removed the v1 provider and its recovery driver.
+
+| Removed | Replacement |
+| --- | --- |
+| `createCapacitorStoreKitProvider`, `StoreKitProviderOptions`, `StoreKitProductMapping`, `CapacitorStoreKitProvider` | `createCapacitorStoreKitServiceProvider` (registry entry) or `createCapacitorStoreKitCommerceProvider`; rename `id`/`storeId`/`type` to `logicalId`/`storeSku`/`kind` (`non_consumable` becomes `durable`); `getAppAccountToken` keeps its meaning |
+| `recoverStoreKitPurchases`, `StoreKitRecoveryBackend`, `RecoveredStoreKitPurchase`, `StoreKitPurchaseVerification`, `StoreKitRecoverySnapshot`, `RecoverableStoreKitTransaction`, `InvalidStoreKitTransaction` | the reconciler in `@mpgd/game-services` (`createCommerceReconciler`, behind `createGameServicesClient` and `monetizationRecovery.reconcile()`), driven by `getAvailablePurchases` and `purchaseUpdated` |
+| `getRecoverableTransactions`, `finishGrantedTransaction` | `getAvailablePurchases` and `finishTransaction`, called by the reconciler after the ledger grant (`assertCommerceFinishAllowed`) |
+| `getAppAccountToken()` on the provider object | the `accountBinding` of the commerce provider resolves the same token |
+| `gateway.commerceV2`, the v1 `commerce.*` bridge methods | `gateway.commerce` and the `commerce.v2.*` methods |
+| `features: ['nativeIap']` on the registry entry | none: the entry declares no `features` and its readiness is `getCapabilities().commerce` |
 
 The Kit tests use mocked StoreKit responses and a syntax-only local Swift
 parse. The macOS CI job compiles the optional Swift package against an iOS

package/dist/commerce-profile.d.ts

@@ -0,0 +1,24 @@
+import type { StoreSdkCapabilities } from '@mpgd/adapter-capacitor';
+import type { CommerceAuthorityCapabilities, CommerceCapabilities, PlatformProviderAvailability } from '@mpgd/platform';
+/** The store id of the StoreKit `StoreSdk` and its commerce provider (RFC "Capabilities", `app-store`). */
+export declare const appStoreStoreId: 'app-store';
+/**
+* Evidence schema of a commerce v2 App Store purchase. The payload carries
+* the StoreKit-verified JWS so `@mpgd/game-services/app-store-verifier`
+* verifies it offline and falls back to the Server API only without it.
+*/
+export declare const appStoreSignedTransactionEvidenceSchema = "app-store.signed-transaction.v1";
+/** The App Store profile from the RFC "Capabilities" table. */
+export declare const storeKitStoreSdkCapabilities: StoreSdkCapabilities;
+/** RFC "Capabilities" profile row for `app-store`: the signed transaction is the proof, bound to an app account token. */
+export declare const storeKitCommerceAuthority: CommerceAuthorityCapabilities;
+/**
+* The `CommerceCapabilities` block `createCapacitorStoreKitCommerceProvider`
+* declares while the store reports `availability`: composed from
+* `storeKitStoreSdkCapabilities` and `storeKitCommerceAuthority` exactly as
+* `createStoreCommerceProvider` composes it (the provider has no capability
+* overrides, and the StoreKit SDK implements `restorePurchases` through
+* `AppStore.sync()`). Returns a fresh object on every call and has no side
+* effects.
+*/
+export declare function createStoreKitCommerceCapabilities(availability: PlatformProviderAvailability): CommerceCapabilities;

package/dist/commerce-profile.js

@@ -0,0 +1,51 @@
+/** The store id of the StoreKit `StoreSdk` and its commerce provider (RFC "Capabilities", `app-store`). */
+export const appStoreStoreId = 'app-store';
+/**
+ * Evidence schema of a commerce v2 App Store purchase. The payload carries
+ * the StoreKit-verified JWS so `@mpgd/game-services/app-store-verifier`
+ * verifies it offline and falls back to the Server API only without it.
+ */
+export const appStoreSignedTransactionEvidenceSchema = 'app-store.signed-transaction.v1';
+/** The App Store profile from the RFC "Capabilities" table. */
+export const storeKitStoreSdkCapabilities = Object.freeze({
+    purchase: Object.freeze({
+        consumable: true,
+        durable: true,
+        subscription: false,
+        quantity: false,
+    }),
+    offers: false,
+    pending: true,
+    restore: true,
+    finish: 'client',
+});
+/** RFC "Capabilities" profile row for `app-store`: the signed transaction is the proof, bound to an app account token. */
+export const storeKitCommerceAuthority = Object.freeze({
+    evidence: 'client-token',
+    accountBinding: 'required',
+});
+/**
+ * The `CommerceCapabilities` block `createCapacitorStoreKitCommerceProvider`
+ * declares while the store reports `availability`: composed from
+ * `storeKitStoreSdkCapabilities` and `storeKitCommerceAuthority` exactly as
+ * `createStoreCommerceProvider` composes it (the provider has no capability
+ * overrides, and the StoreKit SDK implements `restorePurchases` through
+ * `AppStore.sync()`). Returns a fresh object on every call and has no side
+ * effects.
+ */
+export function createStoreKitCommerceCapabilities(availability) {
+    const sdk = storeKitStoreSdkCapabilities;
+    return {
+        purchase: { ...sdk.purchase },
+        catalog: { products: true, offers: sdk.offers ?? false, localizedPrice: true },
+        lifecycle: {
+            availablePurchases: true,
+            pending: sdk.pending,
+            restore: sdk.restore,
+            events: true,
+            finish: sdk.finish,
+        },
+        authority: { ...storeKitCommerceAuthority },
+        availability,
+    };
+}

package/dist/commerce-provider.d.ts

@@ -1,11 +1,7 @@
 import { type CapacitorCommerceServiceProvider, type StoreCommerceProductMapping, type StoreCommerceProvider, type StoreSdkErrorCodeMap } from '@mpgd/adapter-capacitor';
+import { appStoreSignedTransactionEvidenceSchema } from './commerce-profile.js';
 import { type CapacitorStoreKitDiagnostic, type CapacitorStoreKitStoreSdkPlugin } from './store-sdk.js';
-/**
-* Evidence schema of a commerce v2 App Store purchase. The payload carries
-* the StoreKit-verified JWS so `@mpgd/game-services/app-store-verifier`
-* verifies it offline and falls back to the Server API only without it.
-*/
-export declare const appStoreSignedTransactionEvidenceSchema = "app-store.signed-transaction.v1";
+export { appStoreSignedTransactionEvidenceSchema };
 /** Payload of an `app-store.signed-transaction.v1` envelope. */
 export interface AppStoreSignedTransactionEvidencePayload {
   readonly signedTransaction: string;
@@ -45,14 +41,13 @@ export interface CreateCapacitorStoreKitCommerceProviderInput {
 */
 export declare function createCapacitorStoreKitCommerceProvider(input: CreateCapacitorStoreKitCommerceProviderInput): StoreCommerceProvider;
 export interface CreateCapacitorStoreKitServiceProviderInput extends CreateCapacitorStoreKitCommerceProviderInput {
-  /** Registry id. Defaults to `apple-storekit`, the v1 provider id. */
+  /** Registry id. Defaults to `apple-storekit`. */
   readonly id?: string;
 }
 /**
-* The commerce v2 provider wrapped as a `CapacitorServiceProvider` for
-* `createCapacitorPlatformGateway({ providers })`: the registry serves the
-* `commerce.v2.*` and v1 `commerce.*` bridge methods from it and exposes it
-* as `gateway.commerceV2`. Register either this or the v1
-* `createCapacitorStoreKitProvider`, never both.
+* The commerce provider wrapped as a `CapacitorServiceProvider` for
+* `createCapacitorPlatformGateway({ providers })`: the registry serves the six
+* `commerce.v2.*` bridge methods from it, exposes it as `gateway.commerce`, and
+* reports its capability block in `getCapabilities()`.
 */
 export declare function createCapacitorStoreKitServiceProvider(input: CreateCapacitorStoreKitServiceProviderInput): CapacitorCommerceServiceProvider;

package/dist/commerce-provider.js

@@ -1,12 +1,10 @@
 import { createCommerceServiceProvider, createStoreCommerceProvider, } from '@mpgd/adapter-capacitor';
 import { CommerceError } from '@mpgd/platform/commerce';
+import { appStoreSignedTransactionEvidenceSchema, appStoreStoreId, storeKitCommerceAuthority, } from './commerce-profile.js';
 import { capacitorStoreKitErrorCodeMap, createCapacitorStoreKitStoreSdk, readAppAccountToken, } from './store-sdk.js';
-/**
- * Evidence schema of a commerce v2 App Store purchase. The payload carries
- * the StoreKit-verified JWS so `@mpgd/game-services/app-store-verifier`
- * verifies it offline and falls back to the Server API only without it.
- */
-export const appStoreSignedTransactionEvidenceSchema = 'app-store.signed-transaction.v1';
+// The profile constants live in the SDK-free `commerce-profile.ts` so a tools
+// project can read them without loading Capacitor; they stay exported here.
+export { appStoreSignedTransactionEvidenceSchema };
 /**
  * Commerce v2 `CommerceProvider` for the App Store: `createStoreCommerceProvider`
  * over `createCapacitorStoreKitStoreSdk` with the App Store profile,
@@ -45,7 +43,7 @@ export function createCapacitorStoreKitCommerceProvider(input) {
     });
     return createStoreCommerceProvider({
         sdk,
-        store: 'app-store',
+        store: appStoreStoreId,
         products: input.products,
         evidenceSchema: appStoreSignedTransactionEvidenceSchema,
         evidencePayload: (purchase) => {
@@ -88,16 +86,15 @@ export function createCapacitorStoreKitCommerceProvider(input) {
                 });
             }
         },
-        authority: { evidence: 'client-token', accountBinding: 'required' },
+        authority: storeKitCommerceAuthority,
         mapError: { ...capacitorStoreKitErrorCodeMap, ...input.mapError },
     });
 }
 /**
- * The commerce v2 provider wrapped as a `CapacitorServiceProvider` for
- * `createCapacitorPlatformGateway({ providers })`: the registry serves the
- * `commerce.v2.*` and v1 `commerce.*` bridge methods from it and exposes it
- * as `gateway.commerceV2`. Register either this or the v1
- * `createCapacitorStoreKitProvider`, never both.
+ * The commerce provider wrapped as a `CapacitorServiceProvider` for
+ * `createCapacitorPlatformGateway({ providers })`: the registry serves the six
+ * `commerce.v2.*` bridge methods from it, exposes it as `gateway.commerce`, and
+ * reports its capability block in `getCapabilities()`.
  */
 export function createCapacitorStoreKitServiceProvider(input) {
     const { id, ...providerInput } = input;

package/dist/definitions.d.ts

@@ -52,12 +52,12 @@ export interface CapacitorStoreKitPlugin {
   /**
   * Call only after the authenticated backend confirms the ledger grant.
   * Native validation is intentionally shallow and finishing never grants
-  * anything. The TypeScript provider's finishGrantedTransaction binds this
-  * call to the recoverStoreKitPurchases flow so games cannot finish a
-  * purchase accidentally or with an arbitrary ledger ID; games must not call
-  * this plugin method directly. That binding is not a trust boundary against
-  * code that controls the recovery backend object: the authenticated
-  * server-side recoverPurchase verification is the real control.
+  * anything. The commerce provider's `finishTransaction` is the only caller:
+  * the reconciler in `@mpgd/game-services` reaches it through
+  * `assertCommerceFinishAllowed` after the ledger grant, so games must not
+  * call this plugin method directly. That gate is not a trust boundary
+  * against code that controls the backend object given to the reconciler:
+  * the authenticated server-side verification is the real control.
   */
   finishTransaction(input: {
     readonly transactionId: string;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
+export { appStoreStoreId, createStoreKitCommerceCapabilities, storeKitCommerceAuthority, } from './commerce-profile.js';
 export * from './commerce-provider.js';
 export * from './definitions.js';
 export * from './plugin.js';
-export * from './provider.js';
 export * from './store-sdk.js';

package/dist/index.js

@@ -1,5 +1,5 @@
+export { appStoreStoreId, createStoreKitCommerceCapabilities, storeKitCommerceAuthority, } from './commerce-profile.js';
 export * from './commerce-provider.js';
 export * from './definitions.js';
 export * from './plugin.js';
-export * from './provider.js';
 export * from './store-sdk.js';

package/dist/store-sdk.d.ts

@@ -1,6 +1,7 @@
-import { type StoreSdk, type StoreSdkCapabilities, type StoreSdkErrorCodeMap, type StoreSdkPurchase } from '@mpgd/adapter-capacitor';
+import { type StoreSdk, type StoreSdkErrorCodeMap, type StoreSdkPurchase } from '@mpgd/adapter-capacitor';
 import type { StorePurchaseAccountBinding } from '@mpgd/platform/commerce';
 import type { CapacitorStoreKitPlugin, StoreKitTransaction } from './definitions.js';
+import { storeKitStoreSdkCapabilities } from './commerce-profile.js';
 /** The plugin surface the commerce v2 SDK drives; `CapacitorStoreKit` by default. */
 export type CapacitorStoreKitStoreSdkPlugin = Pick<CapacitorStoreKitPlugin, 'getProducts' | 'purchase' | 'getTransactions' | 'sync' | 'finishTransaction' | 'addListener'>;
 /** One-time kinds the App Store sells; `durable` is a StoreKit non-consumable. */
@@ -62,8 +63,7 @@ export interface CreateCapacitorStoreKitStoreSdkInput {
 * to another player.
 */
 export declare function createCapacitorStoreKitStoreSdk(input: CreateCapacitorStoreKitStoreSdkInput): StoreSdk;
-/** The App Store profile from the RFC "Capabilities" table. */
-export declare const storeKitStoreSdkCapabilities: StoreSdkCapabilities;
+export { storeKitStoreSdkCapabilities };
 /**
 * StoreKit plugin codes merged over `defaultStoreSdkErrorCodeMap`. Codes the
 * default table already carries (`STOREKIT_PURCHASE_UNCERTAIN`,

package/dist/store-sdk.js

@@ -1,5 +1,6 @@
 import { Capacitor } from '@capacitor/core';
 import { defaultStoreSdkErrorCodeMap, } from '@mpgd/adapter-capacitor';
+import { appStoreStoreId, storeKitStoreSdkCapabilities } from './commerce-profile.js';
 import { CapacitorStoreKit } from './plugin.js';
 /**
  * Capacitor StoreKit `StoreSdk`: the commerce v2 surface over the native
@@ -244,7 +245,7 @@ export function createCapacitorStoreKitStoreSdk(input) {
     // native call; the v2 reconciler is the gate that authorizes the call.
     const inFlightFinishes = new Map();
     return {
-        store: 'app-store',
+        store: appStoreStoreId,
         capabilities: storeKitStoreSdkCapabilities,
         async fetchProducts(request) {
             requireIos();
@@ -396,26 +397,20 @@ export function createCapacitorStoreKitStoreSdk(input) {
             }
             catch (error) {
                 const code = isRecord(error) ? error.code : undefined;
-                return code === 'STOREKIT_INVALID_PRODUCTS' || code === 'STOREKIT_PRODUCT_UNAVAILABLE'
+                // Capacitor's `UNIMPLEMENTED` means the native plugin is not installed in the shell.
+                return code === 'STOREKIT_INVALID_PRODUCTS'
+                    || code === 'STOREKIT_PRODUCT_UNAVAILABLE'
+                    || code === 'UNIMPLEMENTED'
                     ? 'configuration-required'
                     : 'temporarily-unavailable';
             }
         },
     };
 }
-/** The App Store profile from the RFC "Capabilities" table. */
-export const storeKitStoreSdkCapabilities = Object.freeze({
-    purchase: Object.freeze({
-        consumable: true,
-        durable: true,
-        subscription: false,
-        quantity: false,
-    }),
-    offers: false,
-    pending: true,
-    restore: true,
-    finish: 'client',
-});
+// The App Store profile (RFC "Capabilities") lives in the SDK-free
+// `commerce-profile.ts` so a tools project can read it without loading
+// Capacitor; it stays exported here.
+export { storeKitStoreSdkCapabilities };
 /**
  * StoreKit plugin codes merged over `defaultStoreSdkErrorCodeMap`. Codes the
  * default table already carries (`STOREKIT_PURCHASE_UNCERTAIN`,

package/ios/Sources/CapacitorStoreKit/CapacitorStoreKitPlugin.swift

@@ -120,8 +120,8 @@ public class CapacitorStoreKitPlugin: CAPPlugin, CAPBridgedPlugin {
                     byId[id] = payload
                 }
             }
-            // Current non-consumable entitlements are listed for the v1 restore
-            // flow; `unfinished: false` lets the commerce v2 SDK exclude them.
+            // Current non-consumable entitlements are listed too;
+            // `unfinished: false` lets the commerce SDK exclude them.
             for await result in Transaction.currentEntitlements {
                 if var payload = Self.verifiedPayload(result),
                    payload["type"] as? String == "non_consumable",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/capacitor-storekit",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Opt-in StoreKit 2 one-time purchase collector and commerce v2 provider for mpgd Capacitor games.",
   "license": "MIT",
   "repository": {
@@ -38,18 +38,18 @@
   ],
   "peerDependencies": {
     "@capacitor/core": "^8.5.1",
-    "@mpgd/adapter-capacitor": "^0.9.2",
-    "@mpgd/bridge": "^0.12.3",
-    "@mpgd/platform": "^0.22.0"
+    "@mpgd/adapter-capacitor": "^0.10.0",
+    "@mpgd/bridge": "^0.13.0",
+    "@mpgd/platform": "^0.23.0"
   },
   "devDependencies": {
     "@capacitor/core": "8.5.2",
     "ttsc": "0.30.4",
     "typescript": "7.0.2",
-    "@mpgd/adapter-capacitor": "0.9.2",
-    "@mpgd/bridge": "0.12.3",
-    "@mpgd/platform": "0.22.0",
-    "@mpgd/game-services": "0.22.0"
+    "@mpgd/adapter-capacitor": "0.10.0",
+    "@mpgd/bridge": "0.13.0",
+    "@mpgd/game-services": "0.24.0",
+    "@mpgd/platform": "0.23.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -59,6 +59,6 @@
   "scripts": {
     "check": "ttsc --noEmit",
     "lint": "ttsc --noEmit",
-    "test": "cd ../.. && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/provider.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/store-sdk.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-provider.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-provider.conformance.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-reconciler-storekit-smoke.test.ts"
+    "test": "cd ../.. && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/store-sdk.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-profile.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-provider.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-provider.conformance.test.ts && node tools/run-ttsx.mjs --project native-plugins/capacitor-storekit/tsconfig.json native-plugins/capacitor-storekit/src/commerce-reconciler-storekit-smoke.test.ts"
   }
 }

package/dist/provider.d.ts

@@ -1,121 +0,0 @@
-import type { BridgeRequest, BridgeResponse } from '@mpgd/bridge';
-import type { PurchaseResult } from '@mpgd/platform';
-import type { CapacitorStoreKitPlugin } from './definitions.js';
-export interface StoreKitProductMapping {
-  readonly id: string;
-  readonly storeId: string;
-  readonly type: 'consumable' | 'non_consumable';
-}
-export interface StoreKitProviderOptions {
-  readonly products: readonly StoreKitProductMapping[];
-  /** Must agree with the authenticated backend's resolveAppAccountToken. */
-  readonly getAppAccountToken: () => string | Promise<string>;
-  readonly sdk?: Pick<CapacitorStoreKitPlugin, 'getProducts' | 'purchase' | 'getTransactions' | 'sync' | 'finishTransaction'>;
-  readonly isIos?: () => boolean;
-}
-export interface RecoverableStoreKitTransaction {
-  readonly productId: string;
-  readonly originalTransactionId: string;
-  readonly type: 'consumable' | 'non_consumable';
-  readonly appAccountToken?: string;
-  readonly purchasedAt: string;
-  readonly result: PurchaseResult;
-}
-export interface InvalidStoreKitTransaction {
-  readonly productId: string;
-  readonly transactionId?: string;
-  readonly reason: 'invalid-evidence' | 'revoked';
-}
-export interface StoreKitRecoverySnapshot {
-  readonly transactions: readonly RecoverableStoreKitTransaction[];
-  readonly invalid: readonly InvalidStoreKitTransaction[];
-}
-export interface CapacitorStoreKitProvider {
-  readonly id: 'apple-storekit';
-  readonly features: readonly ['nativeIap'];
-  readonly methods: readonly [
-    'commerce.getProducts',
-    'commerce.purchase',
-    'commerce.restore',
-    'commerce.getEntitlements'
-  ];
-  readonly bridge: {
-    request(input: BridgeRequest): Promise<BridgeResponse>;
-  };
-  getAvailability(): Promise<Readonly<{
-    nativeIap: 'available' | 'configuration-required' | 'temporarily-unavailable' | 'unsupported';
-  }>>;
-  getAppAccountToken(): Promise<string>;
-  /**
-  * @deprecated v1 recovery driver. Commerce v2 lists unfinished transactions
-  * through `createCapacitorStoreKitCommerceProvider().getAvailablePurchases`
-  * and the single reconciler (RFC C1) resolves them; removed in C4.
-  */
-  getRecoverableTransactions(): Promise<StoreKitRecoverySnapshot>;
-  /**
-  * @deprecated v1 recovery driver. Commerce v2 finishes through
-  * `CommerceProvider.finishTransaction` after the ledger grant, driven by
-  * the single reconciler (RFC C1); removed in C4.
-  *
-  * Finish a transaction the backend already granted. The provider accepts
-  * only a transaction and ledger entry pair that recoverStoreKitPurchases
-  * recorded from a backend answer in this session, and consumes the pair
-  * before the native call so overlapping finishes share one native call;
-  * any other pair is rejected so an unfinished purchase keeps its recovery
-  * signal. A failed native finish restores the pair for a retry.
-  *
-  * The guard prevents arbitrary or accidental finish calls with unverified
-  * ledger IDs. It is not a trust boundary against code that controls the
-  * backend object given to recoverStoreKitPurchases; the authenticated
-  * server-side recoverPurchase implementation is the real control.
-  */
-  finishGrantedTransaction(input: {
-    readonly transactionId: string;
-    readonly ledgerEntryId: string;
-  }): Promise<boolean>;
-}
-export interface StoreKitPurchaseVerification {
-  readonly verified: boolean;
-  readonly disposition?: 'pending' | 'rejected';
-  readonly alreadyProcessed: boolean;
-  readonly ledgerEntryId?: string;
-  readonly reason?: string;
-}
-export interface StoreKitRecoveryBackend {
-  /**
-  * Resolve a journaled checkout with its ORIGINAL idempotency key, or return
-  * the already-recorded grant for matching App Store evidence and owner.
-  * The backend must verify Apple data before returning verified=true.
-  */
-  recoverPurchase(input: {
-    readonly target: 'ios';
-    readonly deploymentTarget?: string;
-    readonly playerId: string;
-    readonly productId: string;
-    readonly platformTransactionId: string;
-    readonly originalTransactionId: string;
-    readonly productType: 'consumable' | 'non_consumable';
-    readonly purchasedAt: string;
-  }): Promise<StoreKitPurchaseVerification>;
-}
-export interface RecoveredStoreKitPurchase {
-  readonly productId: string;
-  readonly transactionId?: string;
-  readonly status: 'granted' | 'pending' | 'rejected';
-  readonly reason?: 'invalid-evidence' | 'revoked' | 'account-mismatch';
-  readonly finishPending?: boolean;
-  readonly verification?: StoreKitPurchaseVerification;
-}
-/**
-* Submit unfinished purchases to the backend before asking StoreKit to finish.
-*
-* @deprecated v1 recovery driver. The commerce v2 reconciler (RFC C1) over
-* `createCapacitorStoreKitCommerceProvider` replaces it; removed in C4.
-*/
-export declare function recoverStoreKitPurchases(input: {
-  readonly provider: CapacitorStoreKitProvider;
-  readonly backend: StoreKitRecoveryBackend;
-  readonly playerId: string;
-  readonly deploymentTarget?: string;
-}): Promise<readonly RecoveredStoreKitPurchase[]>;
-export declare function createCapacitorStoreKitProvider(options: StoreKitProviderOptions): CapacitorStoreKitProvider;

package/dist/provider.js

@@ -1,354 +0,0 @@
-import { Capacitor } from '@capacitor/core';
-import { CapacitorStoreKit } from './plugin.js';
-const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-const productPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
-const transactionPattern = /^[1-9][0-9]{0,19}$/u;
-/**
- * Grants recorded by recoverStoreKitPurchases per provider instance:
- * transaction ID to the ledger entry ID the recovery backend returned. The map
- * binds finishGrantedTransaction to that recovery flow so a game cannot finish
- * an unfinished purchase by accident, or with an arbitrary ledger string, and
- * so each recorded pair reaches the native finish call at most once.
- *
- * This is not a trust boundary against a caller who controls the backend
- * object passed to recoverStoreKitPurchases: such a caller can record any
- * pair. The real control stays server-side, in the authenticated
- * recoverPurchase implementation that verifies Apple evidence before it
- * grants, and in the native plugin never granting anything on finish.
- */
-const verifiedGrants = new WeakMap();
-/**
- * Submit unfinished purchases to the backend before asking StoreKit to finish.
- *
- * @deprecated v1 recovery driver. The commerce v2 reconciler (RFC C1) over
- * `createCapacitorStoreKitCommerceProvider` replaces it; removed in C4.
- */
-export async function recoverStoreKitPurchases(input) {
-    if (input.playerId.trim() === '') {
-        throw new TypeError('StoreKit recovery requires an authenticated player ID.');
-    }
-    const token = await input.provider.getAppAccountToken();
-    const snapshot = await input.provider.getRecoverableTransactions();
-    const recovered = await Promise.all(snapshot.transactions.map(async (item) => {
-        const transactionId = item.result.transactionId;
-        if (transactionId === undefined) {
-            return { productId: item.productId, status: 'rejected', reason: 'invalid-evidence' };
-        }
-        if (item.appAccountToken?.toLowerCase() !== token) {
-            // Shared Apple IDs can expose a transaction owned by another game user.
-            return {
-                productId: item.productId, transactionId, status: 'rejected', reason: 'account-mismatch',
-            };
-        }
-        try {
-            const verification = await input.backend.recoverPurchase({
-                target: 'ios',
-                ...(input.deploymentTarget === undefined ? {} : { deploymentTarget: input.deploymentTarget }),
-                playerId: input.playerId,
-                productId: item.productId,
-                platformTransactionId: transactionId,
-                originalTransactionId: item.originalTransactionId,
-                productType: item.type,
-                purchasedAt: item.purchasedAt,
-            });
-            if (!verification.verified) {
-                return {
-                    productId: item.productId,
-                    transactionId,
-                    status: verification.disposition ?? 'pending',
-                    verification,
-                };
-            }
-            if (verification.ledgerEntryId === undefined || verification.ledgerEntryId.trim() === '') {
-                return { productId: item.productId, transactionId, status: 'pending', verification };
-            }
-            verifiedGrants.get(input.provider)?.set(transactionId, verification.ledgerEntryId);
-            try {
-                const finished = await input.provider.finishGrantedTransaction({
-                    transactionId,
-                    ledgerEntryId: verification.ledgerEntryId,
-                });
-                return {
-                    productId: item.productId,
-                    transactionId,
-                    status: 'granted',
-                    finishPending: !finished,
-                    verification,
-                };
-            }
-            catch {
-                return {
-                    productId: item.productId,
-                    transactionId,
-                    status: 'granted',
-                    finishPending: true,
-                    verification,
-                };
-            }
-        }
-        catch {
-            return { productId: item.productId, transactionId, status: 'pending' };
-        }
-    }));
-    return [
-        ...recovered,
-        ...snapshot.invalid.map((item) => ({ ...item, status: 'rejected' })),
-    ];
-}
-export function createCapacitorStoreKitProvider(options) {
-    const sdk = options.sdk ?? CapacitorStoreKit;
-    const isIos = options.isIos ?? (() => Capacitor.getPlatform() === 'ios');
-    const byLogicalId = new Map();
-    const byStoreId = new Map();
-    for (const product of options.products) {
-        if (!productPattern.test(product.id)
-            || !productPattern.test(product.storeId)
-            || byLogicalId.has(product.id)
-            || byStoreId.has(product.storeId)) {
-            throw new TypeError('StoreKit product mappings must be unique and valid.');
-        }
-        byLogicalId.set(product.id, product);
-        byStoreId.set(product.storeId, product);
-    }
-    if (byLogicalId.size === 0 || byLogicalId.size > 100) {
-        throw new TypeError('StoreKit requires 1-100 one-time product mappings.');
-    }
-    async function getAppAccountToken() {
-        const token = (await options.getAppAccountToken()).toLowerCase();
-        if (!uuidPattern.test(token)) {
-            throw new TypeError('StoreKit requires a UUID app account token.');
-        }
-        return token;
-    }
-    async function getRecoverableTransactions() {
-        if (!isIos()) {
-            throw new Error('StoreKit is only available on iOS.');
-        }
-        const response = await sdk.getTransactions();
-        const owned = [];
-        const invalid = [];
-        const seen = new Set();
-        for (const transaction of response.transactions) {
-            const mapping = byStoreId.get(transaction.productId);
-            if (mapping === undefined) {
-                continue;
-            }
-            if (mapping.type !== transaction.type || !validTransaction(transaction)) {
-                invalid.push({
-                    productId: mapping.id,
-                    transactionId: transaction.transactionId,
-                    reason: 'invalid-evidence',
-                });
-                continue;
-            }
-            if (transaction.revokedAt !== undefined) {
-                invalid.push({
-                    productId: mapping.id,
-                    transactionId: transaction.transactionId,
-                    reason: 'revoked',
-                });
-                continue;
-            }
-            if (seen.has(transaction.transactionId)) {
-                continue;
-            }
-            seen.add(transaction.transactionId);
-            owned.push({
-                productId: mapping.id,
-                originalTransactionId: transaction.originalTransactionId,
-                type: transaction.type,
-                ...(transaction.appAccountToken === undefined
-                    ? {} : { appAccountToken: transaction.appAccountToken }),
-                purchasedAt: transaction.purchasedAt,
-                result: toPurchaseResult(transaction),
-            });
-        }
-        return { transactions: owned, invalid };
-    }
-    async function request(input) {
-        if (!isIos()) {
-            return failure(input.id, 'STOREKIT_IOS_REQUIRED');
-        }
-        try {
-            switch (input.method) {
-                case 'commerce.getProducts': {
-                    const response = await sdk.getProducts({ productIds: [...byStoreId.keys()] });
-                    const products = [];
-                    for (const item of response.products) {
-                        const mapping = byStoreId.get(item.productId);
-                        if (mapping === undefined || mapping.type !== item.type) {
-                            continue;
-                        }
-                        products.push({
-                            id: mapping.id,
-                            type: mapping.type,
-                            title: item.title,
-                            description: item.description,
-                            price: { formatted: item.formattedPrice, currencyCode: item.currencyCode },
-                        });
-                    }
-                    return success(input.id, products);
-                }
-                case 'commerce.purchase': {
-                    const payload = input.payload;
-                    const productId = isRecord(payload) ? payload.productId : undefined;
-                    const mapping = typeof productId === 'string' ? byLogicalId.get(productId) : undefined;
-                    if (mapping === undefined) {
-                        return failure(input.id, 'STOREKIT_PRODUCT_UNKNOWN');
-                    }
-                    const appAccountToken = await getAppAccountToken();
-                    const outcome = await sdk.purchase({
-                        productId: mapping.storeId,
-                        appAccountToken,
-                    });
-                    return success(input.id, convertOutcome(outcome, mapping, appAccountToken));
-                }
-                case 'commerce.restore':
-                    await sdk.sync();
-                    return success(input.id, { restoredEntitlements: [] });
-                case 'commerce.getEntitlements':
-                    return success(input.id, []);
-                default:
-                    return failure(input.id, 'STOREKIT_METHOD_UNSUPPORTED');
-            }
-        }
-        catch (error) {
-            const code = isRecord(error) ? error.code : undefined;
-            if (input.method === 'commerce.purchase' && code === 'STOREKIT_PURCHASE_UNCERTAIN') {
-                return success(input.id, { status: 'pending', entitlementIds: [] });
-            }
-            if (typeof code === 'string' && /^STOREKIT_[A-Z_]+$/u.test(code)) {
-                const retryable = code === 'STOREKIT_UNAVAILABLE'
-                    || code === 'STOREKIT_PRODUCT_LOOKUP_FAILED'
-                    || code === 'STOREKIT_SYNC_FAILED';
-                return failure(input.id, code, retryable);
-            }
-            if (error instanceof TypeError) {
-                return failure(input.id, 'STOREKIT_CONFIGURATION_ERROR');
-            }
-            return failure(input.id, 'STOREKIT_UNAVAILABLE', true);
-        }
-    }
-    const grants = new Map();
-    const inFlight = new Map();
-    async function finishReserved(transactionId, ledgerEntryId) {
-        let finished = false;
-        try {
-            finished = (await sdk.finishTransaction({ transactionId, ledgerEntryId })).finished;
-        }
-        finally {
-            // Restore the pair after a rejected or failed native finish so recovery
-            // can retry it, unless a newer recovery recorded the transaction again.
-            if (!finished && !grants.has(transactionId)) {
-                grants.set(transactionId, ledgerEntryId);
-            }
-        }
-        return finished;
-    }
-    const provider = {
-        id: 'apple-storekit',
-        features: ['nativeIap'],
-        methods: [
-            'commerce.getProducts',
-            'commerce.purchase',
-            'commerce.restore',
-            'commerce.getEntitlements',
-        ],
-        bridge: { request },
-        async getAvailability() {
-            if (!isIos()) {
-                return { nativeIap: 'unsupported' };
-            }
-            try {
-                await getAppAccountToken();
-                const response = await sdk.getProducts({ productIds: [...byStoreId.keys()] });
-                const available = response.products.some((item) => {
-                    const mapping = byStoreId.get(item.productId);
-                    return mapping !== undefined && mapping.type === item.type;
-                });
-                return { nativeIap: available ? 'available' : 'configuration-required' };
-            }
-            catch (error) {
-                const code = isRecord(error) ? error.code : undefined;
-                return { nativeIap: code === 'STOREKIT_INVALID_PRODUCTS'
-                        || code === 'STOREKIT_PRODUCT_UNAVAILABLE'
-                        || error instanceof TypeError
-                        ? 'configuration-required' : 'temporarily-unavailable' };
-            }
-        },
-        getAppAccountToken,
-        getRecoverableTransactions,
-        async finishGrantedTransaction(input) {
-            if (!isIos() || !transactionPattern.test(input.transactionId)
-                || input.ledgerEntryId.trim() === '') {
-                throw new TypeError('StoreKit finish requires a verified grant and transaction ID.');
-            }
-            const { transactionId, ledgerEntryId } = input;
-            const active = inFlight.get(transactionId);
-            if (active !== undefined && active.ledgerEntryId === ledgerEntryId) {
-                return active.promise;
-            }
-            if (grants.get(transactionId) !== ledgerEntryId) {
-                throw new TypeError('StoreKit finish requires the ledger entry the backend returned for this transaction via recoverStoreKitPurchases.');
-            }
-            // Consume the pair synchronously, before the first await, so an
-            // overlapping finish for the same transaction cannot reach native twice.
-            grants.delete(transactionId);
-            const promise = finishReserved(transactionId, ledgerEntryId);
-            inFlight.set(transactionId, { ledgerEntryId, promise });
-            try {
-                return await promise;
-            }
-            finally {
-                if (inFlight.get(transactionId)?.promise === promise) {
-                    inFlight.delete(transactionId);
-                }
-            }
-        },
-    };
-    verifiedGrants.set(provider, grants);
-    return provider;
-}
-function convertOutcome(outcome, mapping, expectedAccountToken) {
-    if (outcome.status !== 'purchased') {
-        return { status: outcome.status, entitlementIds: [] };
-    }
-    if (outcome.transaction.productId !== mapping.storeId
-        || outcome.transaction.type !== mapping.type
-        || outcome.transaction.appAccountToken?.toLowerCase() !== expectedAccountToken
-        || !validTransaction(outcome.transaction)) {
-        throw Object.assign(new Error('StoreKit purchase evidence is invalid.'), {
-            code: 'STOREKIT_EVIDENCE_INVALID',
-        });
-    }
-    return toPurchaseResult(outcome.transaction);
-}
-function toPurchaseResult(transaction) {
-    return {
-        status: 'completed',
-        transactionId: transaction.transactionId,
-        entitlementIds: [],
-    };
-}
-function validTransaction(value) {
-    return transactionPattern.test(value.transactionId)
-        && /^[0-9]{1,20}$/u.test(value.originalTransactionId)
-        && productPattern.test(value.productId)
-        && (value.type === 'consumable' || value.type === 'non_consumable')
-        && Number.isFinite(Date.parse(value.purchasedAt))
-        && typeof value.signedTransaction === 'string'
-        && value.signedTransaction.length > 0
-        && value.signedTransaction.length <= 128 * 1024
-        && value.signedTransaction.split('.').length === 3
-        && (value.revokedAt === undefined || Number.isFinite(Date.parse(value.revokedAt)))
-        && (value.appAccountToken === undefined || uuidPattern.test(value.appAccountToken));
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function success(id, data) {
-    return { id, ok: true, data };
-}
-function failure(id, code, retryable = false) {
-    return { id, ok: false, error: { code, message: code, retryable } };
-}