@nosslabs/iap 0.3.0 → 0.3.1

package/dist/index.d.cts

@@ -822,6 +822,24 @@ type EventName<TEntitlement extends EntitlementBase = EntitlementBase> = keyof E
 type EventPayload<K extends EventName<TEntitlement>, TEntitlement extends EntitlementBase = EntitlementBase> = EventMap<TEntitlement>[K];
 type Unsubscribe = () => void;
 
+/**
+ * Convenience context the library passes to a function-form
+ * {@link AppUserId} fetcher. `authHeaders` is the result of awaiting
+ * `backend.getAuthHeaders()` — the same headers the library will use
+ * for its own backend requests. Resolved fresh per purchase so token
+ * refresh keeps working.
+ *
+ * It's a convenience, not a contract: fetchers may legitimately ignore
+ * the parameter. Use it when your UUID-minting endpoint shares auth
+ * with your IAP backend; ignore it (and close over your own auth
+ * state) when it doesn't.
+ *
+ * For consumers using a custom `BackendAdapter` (no `getAuthHeaders`
+ * configured), `authHeaders` is `{}`.
+ */
+interface AppUserIdFetcherContext {
+    authHeaders: Record<string, string>;
+}
 /**
  * Value supplied to `iap.purchase({ appUserId })`. Either a UUID v4
  * string the caller already has (e.g. from local cache / app state) or
@@ -830,9 +848,14 @@ type Unsubscribe = () => void;
  * persists on first call, returns the existing UUID on later calls).
  *
  * The fetcher is invoked **fresh on every purchase** — iap caches
- * nothing. The backend owns the mint-or-lookup idempotency. The
- * fetcher closes over whatever auth state the caller needs (session
- * token, JWT, cookie); iap passes no implicit context.
+ * nothing. The backend owns the mint-or-lookup idempotency.
+ *
+ * Two fetcher shapes are supported:
+ * - `() => Promise<string>` — closes over its own auth state.
+ * - `(ctx) => Promise<string>` — receives `ctx.authHeaders` populated
+ *   from `backend.getAuthHeaders()` so the auth wired up for IAP
+ *   requests can be reused without redefining a helper. See
+ *   {@link AppUserIdFetcherContext}.
  *
  * Either form is validated as UUID v4 before being forwarded to
  * StoreKit's `appAccountToken` (iOS) / Play Billing's
@@ -840,7 +863,7 @@ type Unsubscribe = () => void;
  * `IAPError(INVALID_APP_USER_ID)`. A throwing/rejecting fetcher
  * surfaces as `IAPError(APP_USER_ID_FETCH_FAILED, cause: <original>)`.
  */
-type AppUserId = string | (() => Promise<string>);
+type AppUserId = string | (() => Promise<string>) | ((ctx: AppUserIdFetcherContext) => Promise<string>);
 /**
  * Options accepted by `iap.purchase(...)`. `productId` is required;
  * `appUserId` is optional — when omitted, no `applicationUsername` is

package/dist/index.d.ts

@@ -822,6 +822,24 @@ type EventName<TEntitlement extends EntitlementBase = EntitlementBase> = keyof E
 type EventPayload<K extends EventName<TEntitlement>, TEntitlement extends EntitlementBase = EntitlementBase> = EventMap<TEntitlement>[K];
 type Unsubscribe = () => void;
 
+/**
+ * Convenience context the library passes to a function-form
+ * {@link AppUserId} fetcher. `authHeaders` is the result of awaiting
+ * `backend.getAuthHeaders()` — the same headers the library will use
+ * for its own backend requests. Resolved fresh per purchase so token
+ * refresh keeps working.
+ *
+ * It's a convenience, not a contract: fetchers may legitimately ignore
+ * the parameter. Use it when your UUID-minting endpoint shares auth
+ * with your IAP backend; ignore it (and close over your own auth
+ * state) when it doesn't.
+ *
+ * For consumers using a custom `BackendAdapter` (no `getAuthHeaders`
+ * configured), `authHeaders` is `{}`.
+ */
+interface AppUserIdFetcherContext {
+    authHeaders: Record<string, string>;
+}
 /**
  * Value supplied to `iap.purchase({ appUserId })`. Either a UUID v4
  * string the caller already has (e.g. from local cache / app state) or
@@ -830,9 +848,14 @@ type Unsubscribe = () => void;
  * persists on first call, returns the existing UUID on later calls).
  *
  * The fetcher is invoked **fresh on every purchase** — iap caches
- * nothing. The backend owns the mint-or-lookup idempotency. The
- * fetcher closes over whatever auth state the caller needs (session
- * token, JWT, cookie); iap passes no implicit context.
+ * nothing. The backend owns the mint-or-lookup idempotency.
+ *
+ * Two fetcher shapes are supported:
+ * - `() => Promise<string>` — closes over its own auth state.
+ * - `(ctx) => Promise<string>` — receives `ctx.authHeaders` populated
+ *   from `backend.getAuthHeaders()` so the auth wired up for IAP
+ *   requests can be reused without redefining a helper. See
+ *   {@link AppUserIdFetcherContext}.
  *
  * Either form is validated as UUID v4 before being forwarded to
  * StoreKit's `appAccountToken` (iOS) / Play Billing's
@@ -840,7 +863,7 @@ type Unsubscribe = () => void;
  * `IAPError(INVALID_APP_USER_ID)`. A throwing/rejecting fetcher
  * surfaces as `IAPError(APP_USER_ID_FETCH_FAILED, cause: <original>)`.
  */
-type AppUserId = string | (() => Promise<string>);
+type AppUserId = string | (() => Promise<string>) | ((ctx: AppUserIdFetcherContext) => Promise<string>);
 /**
  * Options accepted by `iap.purchase(...)`. `productId` is required;
  * `appUserId` is optional — when omitted, no `applicationUsername` is

package/dist/index.js

@@ -1230,7 +1230,11 @@ var PurchaseOrchestrator = class {
         message: `Product "${productId}" is not in the configured catalog.`
       });
     }
-    const resolvedAppUserId = appUserId !== void 0 ? await resolveAppUserId(appUserId) : void 0;
+    let resolvedAppUserId;
+    if (appUserId !== void 0) {
+      const ctx = typeof appUserId === "function" ? { authHeaders: await this.deps.getAuthHeaders() } : { authHeaders: {} };
+      resolvedAppUserId = await resolveAppUserId(appUserId, ctx);
+    }
     this.inFlight.add(productId);
     this.deps.emitter.emit("purchase-started", { productId });
     try {
@@ -1347,11 +1351,11 @@ var PurchaseOrchestrator = class {
     return { status: "verification_failed", productId, error: iapError };
   }
 };
-async function resolveAppUserId(supply) {
+async function resolveAppUserId(supply, ctx) {
   let resolved;
   if (typeof supply === "function") {
     try {
-      resolved = await supply();
+      resolved = await supply(ctx);
     } catch (cause) {
       throw new IAPError({
         code: IAPErrorCode.APP_USER_ID_FETCH_FAILED,
@@ -1849,6 +1853,8 @@ function createIAP(input) {
         state.logger.debug(`Resolved ${validated.data.length} product(s) from backend manifest.`);
       }
       state.adapter = await selectNativeAdapter({ products: state.products });
+      const configGetAuthHeaders = state.config.backend.getAuthHeaders;
+      const getAuthHeaders = configGetAuthHeaders ? async () => configGetAuthHeaders() : async () => ({});
       const sharedDeps = {
         nativeAdapter: state.adapter,
         backend: state.backend,
@@ -1862,7 +1868,8 @@ function createIAP(input) {
         },
         setCachePersisted: (cachedAt) => {
           state.cachedAt = cachedAt;
-        }
+        },
+        getAuthHeaders
       };
       state.orchestrator = new PurchaseOrchestrator({
         ...sharedDeps,