@mpgd/capacitor-storekit 0.4.2 → 0.4.3

package/README.md

@@ -63,7 +63,8 @@ listed. A `revokedAt` maps to `state: 'revoked'`, and one malformed
 transaction is reported as a `purchaseError` without blocking its siblings);
 `finishTransaction({ transactionId, ledgerEntryId })` resolves the session
 app account token and finishes only a listed, non-revoked transaction bound
-to that token;
+to that token, or a durable of another token a restore shared to this
+player (see Recovery);
 `restorePurchases` over `sync`; `transactionUpdated` as `purchaseUpdated`;
 and an availability probe as `getAvailability`, probing the configured
 SKUs batch by batch until one is sold. Every purchase carries the
@@ -182,12 +183,25 @@ each one on the backend under its original idempotency key or returns the
 existing ledger grant, and calls `finishTransaction` only after a verified
 response with a ledger entry id. The StoreKit SDK and the native plugin both
 refuse to call `transaction.finish()` on a transaction whose app account
-token is missing or does not match that session. A caller who can read the token from the plugin can
+token is missing or does not match the token they are given; the SDK gives the
+session's, except for a durable of another token (below). A caller who can read the token from the plugin can
 still present it with a forged ledger entry id; that remaining hole needs a
 signed server finish capability. A listed, non-revoked durable StoreKit
 already finished (`unfinished: false`) answers `{ finished: true }` without a
 native call whatever its token, so a purchase shared to this guest from an
-earlier guest's restore ends there. Permanently rejected and account-mismatched
+earlier guest's restore ends there. A durable of the configured catalog still
+unfinished under another token (the earlier guest crashed between its grant
+and its finish, then the app was reinstalled; or a native build omits
+`unfinished`) is finished with that transaction's own token, which the native
+token match accepts, so the shared grant's record does not retry forever. The
+reconciler calls it only for this player's ledger grant, and finishing a
+durable takes nothing from the earlier guest: StoreKit keeps it in
+`Transaction.currentEntitlements`, where that guest's own read still lists it
+(`unfinished: false`). The native plugin is unchanged and still filters
+nothing by token on reads. A webview caller can therefore finish another
+token's unfinished durable, which, for the same reason, grants or removes
+nothing. A consumable of another token and a transaction bound to no token
+are never finished. Permanently rejected and account-mismatched
 transactions are not finished: the client cannot prove content delivery for
 them, so persist that terminal result in the game-owned operation journal and
 do not run an automatic retry loop for it. An unknown backend result stays

package/dist/store-sdk.js

@@ -259,11 +259,25 @@ export function createCapacitorStoreKitStoreSdk(input) {
     /**
      * Mirrors the native finish gate: the transaction must be listed, not
      * revoked, and bound to the session app account token. A missing list is
-     * an invalid response, not a quiet "not finished". A listed, non-revoked
-     * durable StoreKit already finished (`unfinished: false`) has nothing left
-     * to finish whatever its token: a restore shared to this player from an
-     * earlier guest's purchase ends there instead of retrying a finish the
-     * native token match refuses.
+     * an invalid response, not a quiet "not finished". Two exceptions for a
+     * listed, non-revoked durable, the only kind the restore read admits from
+     * another token:
+     *
+     * - StoreKit already finished it (`unfinished: false`): nothing is left to
+     *   finish whatever its token, so a restore shared to this player ends
+     *   there without a native call.
+     * - It is unfinished (or the build omits the flag), the catalog declares
+     *   its SKU durable, and it is bound to another token: an earlier guest
+     *   crashed between its grant and its finish, then the app was
+     *   reinstalled. The caller holds this player's ledger grant
+     *   (the reconciler finishes only `granted` or `finishing` records), and a
+     *   durable stays in `Transaction.currentEntitlements` after its finish, so
+     *   finishing it takes nothing from any player: the earlier guest's next
+     *   read still lists it (`unfinished: false`) for its own verification. It
+     *   is finished with its own token, which the native gate matches.
+     *
+     * A consumable of another token, or a transaction bound to no token, is
+     * never finished here.
      */
     const finishPermitted = async (transactionId, appAccountToken) => {
         const response = await sdk.getTransactions();
@@ -272,12 +286,21 @@ export function createCapacitorStoreKitStoreSdk(input) {
         }
         const transaction = response.transactions.find((candidate) => isValidStoreKitTransaction(candidate) && candidate.transactionId === transactionId);
         if (transaction === undefined || transaction.revokedAt !== undefined) {
-            return 'refused';
+            return { verdict: 'refused' };
         }
         if (transaction.type === 'non_consumable' && transaction.unfinished === false) {
-            return 'finished';
+            return { verdict: 'finished' };
         }
-        return transaction.appAccountToken?.toLowerCase() === appAccountToken ? 'finish' : 'refused';
+        const bound = transaction.appAccountToken?.toLowerCase();
+        if (bound === appAccountToken) {
+            return { verdict: 'finish', appAccountToken };
+        }
+        if (bound !== undefined
+            && transaction.type === 'non_consumable'
+            && kinds.get(transaction.productId) === 'durable') {
+            return { verdict: 'finish', appAccountToken: bound };
+        }
+        return { verdict: 'refused' };
     };
     return {
         store: appStoreStoreId,
@@ -371,7 +394,8 @@ export function createCapacitorStoreKitStoreSdk(input) {
         async finishTransaction(request) {
             requireIos();
             // The session token is the binding. A bridge or plugin caller cannot
-            // substitute another account's token on this path.
+            // substitute another account's token on this path: the only other
+            // token used is a durable's own, read from the native list.
             const appAccountToken = await Promise.resolve(resolveAppAccountToken());
             const { transactionId, ledgerEntryId } = request;
             if (typeof transactionId !== 'string' || !transactionPattern.test(transactionId)
@@ -384,15 +408,16 @@ export function createCapacitorStoreKitStoreSdk(input) {
             }
             const promise = (async () => {
                 // Same match the native plugin applies: missing, revoked, unbound, or
-                // another account never reaches `transaction.finish()`.
+                // another account never reaches `transaction.finish()`, except a
+                // durable of another token (see `finishPermitted`).
                 const permitted = await finishPermitted(transactionId, appAccountToken);
-                if (permitted !== 'finish') {
-                    return { finished: permitted === 'finished' };
+                if (permitted.verdict !== 'finish') {
+                    return { finished: permitted.verdict === 'finished' };
                 }
                 const reported = await sdk.finishTransaction({
                     transactionId,
                     ledgerEntryId,
-                    appAccountToken,
+                    appAccountToken: permitted.appAccountToken,
                 });
                 if (!isRecord(reported) || typeof reported.finished !== 'boolean') {
                     throw evidenceInvalid('StoreKit returned an invalid finish result.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/capacitor-storekit",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Opt-in StoreKit 2 one-time purchase collector and commerce v2 provider for mpgd Capacitor games.",
   "license": "MIT",
   "repository": {
@@ -46,10 +46,10 @@
     "@capacitor/core": "8.5.2",
     "ttsc": "0.32.1",
     "typescript": "7.0.2",
-    "@mpgd/adapter-capacitor": "0.16.0",
+    "@mpgd/adapter-capacitor": "0.16.1",
+    "@mpgd/game-services": "0.30.3",
     "@mpgd/bridge": "0.16.4",
-    "@mpgd/platform": "0.32.0",
-    "@mpgd/game-services": "0.30.2"
+    "@mpgd/platform": "0.32.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",