@nosslabs/iap 5.0.0 → 7.0.0-next.0

package/CHANGELOG.md

@@ -5,22 +5,52 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
-## [5.0.0] — 2026-05-14
+## [7.0.0-next.0] — 2026-05-14
+
+First release of the **Capacitor 7+** line, published on the `@next`
+npm dist-tag. The Capacitor 5 line continues as `5.x` on `@latest`
+(from the `5.x` branch) — see [Migration](https://iap.nossdev.com/migration/).
+
+Numbering: the library's major version tracks the Capacitor major it
+targets (the convention `@capgo/native-purchases` and Ionic plugins
+use). What was framed as `1.0.0-next.0` during development is published
+as `7.0.0-next.0` for the same reason `5.0.0` superseded `0.4.0` on
+the maintenance line — same code, version aligned with the platform.
 
 ### Changed
 
-- **Renumbered the Capacitor 5 line from `0.x` to `5.x`** so the
-  library's major version tracks the Capacitor major it targets
-  (matching the convention `@capgo/native-purchases`, Ionic plugins,
-  and most platform-aligned ecosystems use). **No code changes vs
-  `0.4.0`** — the published tarball is functionally identical.
-  Consumers: bump your dependency `^0.4.0` → `^5.0.0`. Nothing else
-  needs to change.
-
-The Capacitor 7+ line is published on the `@next` dist-tag as `7.x`
-(currently `7.0.0-next.0` prerelease). See [Migration](https://iap.nossdev.com/migration/)
-when you're ready to move to Capacitor 7. The `5.x` line on this
-branch (`5.x`) continues to receive Capacitor-5 patches.
+- **BREAKING: dropped Capacitor 5 support.** The `7.x` line targets
+  **Capacitor 7+** (also runs on Capacitor 8) via
+  [`@capgo/native-purchases`](https://github.com/Cap-go/native-purchases),
+  replacing `cordova-plugin-purchase`. The native adapter now lives at
+  `src/adapters/native/capgo/native-adapter.ts` (`CapgoNativeAdapter`),
+  selected behind the same `NativeAdapter` interface as before.
+- **Peer dependencies** are now `@capacitor/core`, `@capacitor/preferences`,
+  and (optional) `@capacitor/app` at `^7.0.0 || ^8.0.0`, plus
+  `@capgo/native-purchases` at `7.16.x || ^8.0.0`. `cordova-plugin-purchase`
+  is no longer a peer dependency. Migration is a peer-dep swap + `npx cap sync`
+  — no changes to your `createIAP({ ... })` config or any consumer code.
+- **Acknowledgement defers on both platforms.** `@capgo/native-purchases`
+  supports `autoAcknowledgePurchases: false` on iOS and Android, so the
+  "never grant entitlement before the backend confirms" guarantee holds
+  with no iOS-specific finish-before-verify race.
+- **Android user-cancellation surfaces as `status: 'failed'`** (not
+  `'cancelled'`). Google Play Billing — at the level `@capgo/native-purchases`
+  exposes — doesn't distinguish a user-cancelled flow from other purchase
+  failures; iOS still reports `'cancelled'` reliably. Treat `failed` on
+  Android the same as `cancelled` for UX. (The Capacitor 5 line via
+  `cordova-plugin-purchase` could distinguish this.)
+
+### Unchanged
+
+- Public API surface: `createIAP`, the `IAP` interface, all events, all
+  `IAPErrorCode` values, and every public type are identical to `5.0.0`
+  (= `0.4.0` code).
+- The full `0.2`–`0.4` feature set carries forward: the options-object
+  `purchase()` signature, optional `appUserId` pre-attachment, the
+  `INVALID_APP_USER_ID` / `APP_USER_ID_FETCH_FAILED` error codes, the
+  `permanentErrorCodes` config, the `recovery-dropped-permanent` event,
+  and `RecoveryResult.droppedPermanent`.
 
 ## [0.4.0] — 2026-05-08
 

package/README.md

@@ -2,10 +2,10 @@
 
 > Thin Capacitor IAP orchestrator. Server-side validation via [Attesto](https://attesto.nossdev.com).
 
-**Status: `5.x` — the Capacitor 5 maintenance line on the `@latest` dist-tag.** Renumbered from `0.4.x` to track the Capacitor major (same code, new number). The Capacitor 7+ line is `7.x` on the `@next` dist-tag (still prerelease — see [Migration](https://iap.nossdev.com/migration/)). Pin the minor (`^5.0.0`) and watch the [CHANGELOG](./CHANGELOG.md).
+**Status: `7.0.0-next.0` — prerelease on the `@next` dist-tag** (the Capacitor 7+ line, built on `@capgo/native-purchases`). The Capacitor 5 line (`cordova-plugin-purchase`) continues as `5.x` on `@latest` (from the `5.x` branch). API may have breaking changes through the 7.x prerelease line; watch the [CHANGELOG](./CHANGELOG.md).
 
 ```bash
-npm install @nosslabs/iap cordova-plugin-purchase
+npm install @nosslabs/iap@next @capgo/native-purchases
 npx cap sync
 ```
 
@@ -65,9 +65,9 @@ await iap.purchase({
 
 `@nosslabs/iap` does **one thing**: orchestrate the purchase flow on the client. It
 
-- wraps `cordova-plugin-purchase` for native purchase + restore,
+- wraps [`@capgo/native-purchases`](https://github.com/Cap-go/native-purchases) for native purchase + restore,
 - POSTs to **your** backend (which calls Attesto) for receipt validation,
-- acknowledges native transactions only **after** the backend confirms (no phantom grants),
+- acknowledges native transactions only **after** the backend confirms — `autoAcknowledgePurchases: false` defers finishing on **both** iOS and Android, so there's no phantom grant and no iOS finish-before-verify race,
 - caches entitlements locally for instant, reactive UI reads,
 - recovers unfinished transactions across app launches.
 
@@ -77,8 +77,8 @@ It does **not**: talk to Attesto directly, define entitlement business logic, ma
 
 | `@nosslabs/iap` | Capacitor | Native plugin | dist-tag | Status |
 |---|---|---|---|---|
-| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | `@latest` | **Current (this branch)** |
-| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases` | `@next` | Prerelease |
+| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases 7.16.x` (or `^8` on Cap 8) | `@next` | **Current (prerelease)** |
+| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | `@latest` | Maintenance |
 
 ## Optional peer dependency
 
@@ -94,7 +94,7 @@ Or disable the listener with `options.refreshOnResume: false`. See [installation
 ## Development
 
 ```bash
-mise install        # Node 22 + npm 10
+mise install        # Node 22 + npm 11 (pinned in mise.toml)
 npm install
 npm run typecheck   # tsc --noEmit
 npm run lint        # biome check

package/dist/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@capacitor/core');
-require('cordova-plugin-purchase');
+var nativePurchases = require('@capgo/native-purchases');
 var zod = require('zod');
 var preferences = require('@capacitor/preferences');
 
@@ -85,7 +85,7 @@ var init_errors = __esm({
       NOT_INITIALIZED: "Call iap.initialize() before this method, or recreate the instance after destroy().",
       // Native plugin
       PLATFORM_NOT_SUPPORTED: "In-app purchases run on iOS/Android only. Web is no-op by design \u2014 guard your purchase UI behind Capacitor.isNativePlatform().",
-      BILLING_NOT_AVAILABLE: "cordova-plugin-purchase failed to initialize. Confirm the plugin is installed and `npx cap sync` has run; check device sandbox/test account is signed in.",
+      BILLING_NOT_AVAILABLE: "The store billing service is unavailable. Confirm @capgo/native-purchases is installed and `npx cap sync` has run; check the device sandbox/test account is signed in.",
       PRODUCT_NOT_FOUND: "Ensure the productId is registered in App Store Connect / Play Console AND in your createIAP({ products }) config.",
       USER_CANCELLED: "No action needed \u2014 the user dismissed the native purchase sheet.",
       PURCHASE_PENDING: "Android only: payment is awaiting external clearance (e.g. cash payment, bank verification). The backend will receive a Google RTDN webhook when it clears; call iap.refresh() afterward.",
@@ -139,295 +139,170 @@ var init_platform = __esm({
   }
 });
 
-// src/adapters/native/cdv/native-adapter.ts
+// src/adapters/native/capgo/native-adapter.ts
 var native_adapter_exports = {};
 __export(native_adapter_exports, {
-  CdvNativeAdapter: () => CdvNativeAdapter
+  CapgoNativeAdapter: () => CapgoNativeAdapter
 });
-function getCdv() {
-  const candidate = globalThis.CdvPurchase;
-  if (!candidate || !candidate.store) {
-    throw new exports.IAPError({
-      code: exports.IAPErrorCode.BILLING_NOT_AVAILABLE,
-      message: "cordova-plugin-purchase is not available. Ensure the plugin is installed and `npx cap sync` has run."
-    });
-  }
-  return candidate;
-}
-function currentCdvPlatform() {
-  const cdv = getCdv();
-  const platform = getPlatform();
-  if (platform === "android") return cdv.Platform.GOOGLE_PLAY;
-  return cdv.Platform.APPLE_APPSTORE;
-}
-function mapProductType(type) {
-  const cdv = getCdv();
-  switch (type) {
-    case "subscription":
-      return cdv.ProductType.PAID_SUBSCRIPTION;
-    case "consumable":
-      return cdv.ProductType.CONSUMABLE;
-    default:
-      return cdv.ProductType.NON_CONSUMABLE;
-  }
-}
-function inferProductType(tx, configured) {
-  const id = tx.products[0]?.id;
-  if (!id) return "product";
-  const match = configured.find((p) => p.id === id);
-  return match?.type ?? "product";
-}
 function normalizeProduct(p, type) {
-  const offer = p.getOffer();
-  const phase = offer?.pricingPhases?.[0];
-  const priceMicros = phase?.priceMicros?.toString() ?? "0";
-  const priceString = phase?.price ?? "";
-  const currency = phase?.currency ?? "";
+  const priceMicros = Math.round(p.price * 1e6).toString();
   return {
-    id: p.id,
+    id: p.identifier,
     type,
-    title: p.title ?? p.id,
-    description: p.description ?? "",
-    priceString,
+    title: p.title,
+    description: p.description,
+    priceString: p.priceString,
     priceMicros,
-    currency
+    currency: p.currencyCode
   };
 }
-function normalizeTransaction(tx, productType, token) {
-  const platform = tx.platform === "ios-appstore" ? "apple" : "google";
-  const productId = tx.products[0]?.id ?? "";
-  const result = {
+function normalizeTransaction(tx, productType) {
+  const platform = inferPlatform(tx);
+  const token = platform === "google" ? tx.purchaseToken ?? tx.transactionId : tx.transactionId;
+  const native = {
     platform,
-    productId,
+    productId: tx.productIdentifier,
     token,
     productType,
     raw: tx
   };
-  if (platform === "google") {
-    const packageName = googlePackageName(tx);
-    if (packageName) result.packageName = packageName;
+  return native;
+}
+function inferPlatform(tx) {
+  if (tx.purchaseToken !== void 0 || tx.purchaseState !== void 0 || tx.orderId !== void 0) {
+    return "google";
+  }
+  if (tx.receipt !== void 0 || tx.jwsRepresentation !== void 0) {
+    return "apple";
   }
-  return result;
+  return getPlatform() === "android" ? "google" : "apple";
 }
-function googlePackageName(tx) {
-  const googleTx = tx;
-  return googleTx.nativePurchase?.packageName;
+function inferProductType(tx) {
+  if (tx.productType === "subs") return "subscription";
+  return "product";
 }
-function transactionToken(tx) {
-  if (tx.platform === "ios-appstore") {
-    return tx.transactionId || null;
-  }
-  const googleTx = tx;
-  return googleTx.nativePurchase?.purchaseToken ?? googleTx.parentReceipt?.purchaseToken ?? tx.transactionId ?? null;
+function mapToPluginPurchaseType(type) {
+  return type === "subscription" ? nativePurchases.PURCHASE_TYPE.SUBS : nativePurchases.PURCHASE_TYPE.INAPP;
 }
-function mapOrderError(err, productId) {
-  const cdv = getCdv();
-  const cancelled = cdv.ErrorCode?.PAYMENT_CANCELLED;
-  if (cancelled !== void 0 && err.code === cancelled) {
+function mapPurchaseError(error, productId) {
+  if (error instanceof exports.IAPError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  const lower = message.toLowerCase();
+  if (lower.includes("cancel")) {
     return new exports.IAPError({
       code: exports.IAPErrorCode.USER_CANCELLED,
-      message: "User cancelled the native purchase sheet.",
-      cause: err
+      message: `Purchase of "${productId}" was cancelled.`,
+      cause: error
+    });
+  }
+  if (lower.includes("pending")) {
+    return new exports.IAPError({
+      code: exports.IAPErrorCode.PURCHASE_PENDING,
+      message: `Purchase of "${productId}" is pending external clearance.`,
+      cause: error
+    });
+  }
+  if (lower.includes("product not found")) {
+    return new exports.IAPError({
+      code: exports.IAPErrorCode.PRODUCT_NOT_FOUND,
+      message: `Product "${productId}" was not found in the store catalog.`,
+      cause: error
     });
   }
   return new exports.IAPError({
     code: exports.IAPErrorCode.STORE_ERROR,
-    message: err.message ?? `order() failed for ${productId}.`,
-    cause: err
+    message: `Native purchase of "${productId}" failed.`,
+    cause: error
   });
 }
-var CdvNativeAdapter;
+var CapgoNativeAdapter;
 var init_native_adapter = __esm({
-  "src/adapters/native/cdv/native-adapter.ts"() {
+  "src/adapters/native/capgo/native-adapter.ts"() {
     init_errors();
     init_platform();
-    CdvNativeAdapter = class {
-      products;
-      bootstrapped = false;
-      bootstrapping = null;
-      pendingFinish = /* @__PURE__ */ new Map();
-      /** Long-lived bootstrap-time .approved() listener — kept for dispose(). */
-      bootstrapApprovedHandler = null;
-      constructor(opts) {
-        this.products = opts.products;
-      }
+    CapgoNativeAdapter = class {
       async isAvailable() {
         try {
-          await this.bootstrap();
-          return true;
+          const result = await nativePurchases.NativePurchases.isBillingSupported();
+          return result.isBillingSupported;
         } catch {
           return false;
         }
       }
       async getProducts(requests) {
         if (requests.length === 0) return [];
-        const store = await this.ensureStore();
-        await store.update();
-        const out = [];
+        const inappIds = [];
+        const subsIds = [];
+        const requestById = /* @__PURE__ */ new Map();
         for (const req of requests) {
-          const native = store.get(req.id);
-          if (!native) continue;
-          out.push(normalizeProduct(native, req.type));
+          requestById.set(req.id, req.type);
+          if (req.type === "subscription") {
+            subsIds.push(req.id);
+          } else {
+            inappIds.push(req.id);
+          }
         }
-        return out;
+        const [inapp, subs] = await Promise.all([
+          inappIds.length > 0 ? nativePurchases.NativePurchases.getProducts({
+            productIdentifiers: inappIds,
+            productType: nativePurchases.PURCHASE_TYPE.INAPP
+          }) : Promise.resolve({ products: [] }),
+          subsIds.length > 0 ? nativePurchases.NativePurchases.getProducts({
+            productIdentifiers: subsIds,
+            productType: nativePurchases.PURCHASE_TYPE.SUBS
+          }) : Promise.resolve({ products: [] })
+        ]);
+        const all = [...inapp.products, ...subs.products];
+        return all.map((p) => normalizeProduct(p, requestById.get(p.identifier) ?? "product"));
       }
       async purchaseProduct(opts) {
-        const store = await this.ensureStore();
-        const native = store.get(opts.productId);
-        if (!native) {
-          throw new exports.IAPError({
-            code: exports.IAPErrorCode.PRODUCT_NOT_FOUND,
-            message: `Product "${opts.productId}" not registered or not available from the store.`
-          });
-        }
-        const offer = opts.androidPlanId ? native.getOffer(opts.androidPlanId) ?? native.getOffer() : native.getOffer();
-        if (!offer) {
-          throw new exports.IAPError({
-            code: exports.IAPErrorCode.PRODUCT_NOT_FOUND,
-            message: `Product "${opts.productId}" has no purchasable offer${opts.androidPlanId ? ` (planId="${opts.androidPlanId}")` : ""}.`
+        const purchaseType = mapToPluginPurchaseType(opts.productType);
+        const isConsumable = opts.productType === "consumable";
+        let tx;
+        try {
+          tx = await nativePurchases.NativePurchases.purchaseProduct({
+            productIdentifier: opts.productId,
+            productType: purchaseType,
+            planIdentifier: opts.androidPlanId,
+            appAccountToken: opts.appAccountToken,
+            isConsumable,
+            autoAcknowledgePurchases: false
           });
+        } catch (error) {
+          throw mapPurchaseError(error, opts.productId);
         }
-        return new Promise((resolve, reject) => {
-          let settled = false;
-          const cleanup = () => {
-            store.off(handleApproved);
-          };
-          const handleApproved = (tx) => {
-            if (settled) return;
-            if (!tx.products.some((p) => p.id === opts.productId)) return;
-            const token = transactionToken(tx);
-            if (!token) {
-              settled = true;
-              cleanup();
-              reject(
-                new exports.IAPError({
-                  code: exports.IAPErrorCode.STORE_ERROR,
-                  message: `Approved transaction for "${opts.productId}" has no token; cannot verify.`
-                })
-              );
-              return;
-            }
-            settled = true;
-            cleanup();
-            const normalized = normalizeTransaction(tx, opts.productType, token);
-            this.pendingFinish.set(token, tx);
-            resolve(normalized);
-          };
-          store.when().approved(handleApproved);
-          const additionalData = opts.appAccountToken ? { applicationUsername: opts.appAccountToken } : void 0;
-          void Promise.resolve(offer.order(additionalData)).then((err) => {
-            if (settled) return;
-            if (!err) return;
-            settled = true;
-            cleanup();
-            reject(mapOrderError(err, opts.productId));
-          }).catch((cause) => {
-            if (settled) return;
-            settled = true;
-            cleanup();
-            reject(
-              new exports.IAPError({
-                code: exports.IAPErrorCode.STORE_ERROR,
-                message: `order() rejected for ${opts.productId}.`,
-                cause
-              })
-            );
-          });
-        });
+        return normalizeTransaction(tx, opts.productType);
       }
       async getOwnedTransactions() {
-        const store = await this.ensureStore();
-        await store.restorePurchases();
-        const out = [];
-        for (const tx of store.localTransactions) {
-          if (tx.state !== getCdv().TransactionState.APPROVED) continue;
-          const token = transactionToken(tx);
-          if (!token) continue;
-          const normalized = normalizeTransaction(tx, inferProductType(tx, this.products), token);
-          this.pendingFinish.set(token, tx);
-          out.push(normalized);
-        }
-        return out;
+        const result = await nativePurchases.NativePurchases.getPurchases();
+        return result.purchases.filter((tx) => tx.purchaseState === void 0 || tx.purchaseState === "1").map((tx) => normalizeTransaction(tx, inferProductType(tx)));
       }
       async acknowledge(transaction) {
-        const cdvTx = this.pendingFinish.get(transaction.token);
-        if (!cdvTx) {
-          return;
-        }
         try {
-          await cdvTx.finish();
-        } catch (cause) {
+          await nativePurchases.NativePurchases.acknowledgePurchase({
+            purchaseToken: transaction.token
+          });
+        } catch (error) {
           throw new exports.IAPError({
             code: exports.IAPErrorCode.STORE_ERROR,
-            message: `Failed to finish transaction for ${transaction.productId}.`,
-            cause,
+            message: `Failed to acknowledge transaction for ${transaction.productId}.`,
+            cause: error,
             recoverable: true
           });
         }
-        this.pendingFinish.delete(transaction.token);
       }
       async manageSubscriptions() {
-        const store = await this.ensureStore();
-        const err = await store.manageSubscriptions();
-        if (err) {
+        try {
+          await nativePurchases.NativePurchases.manageSubscriptions();
+        } catch (error) {
           throw new exports.IAPError({
             code: exports.IAPErrorCode.STORE_ERROR,
-            message: err.message ?? "Failed to open subscription management."
+            message: "Failed to open the native subscription management UI.",
+            cause: error
           });
         }
       }
       async dispose() {
-        if (this.bootstrapApprovedHandler) {
-          try {
-            const cdv = globalThis.CdvPurchase;
-            cdv?.store?.off(this.bootstrapApprovedHandler);
-          } catch {
-          }
-          this.bootstrapApprovedHandler = null;
-        }
-        this.pendingFinish.clear();
-        this.bootstrapped = false;
-        this.bootstrapping = null;
-      }
-      // ----- internals -----
-      async ensureStore() {
-        await this.bootstrap();
-        return getCdv().store;
-      }
-      bootstrap() {
-        if (this.bootstrapped) return Promise.resolve();
-        if (this.bootstrapping) return this.bootstrapping;
-        this.bootstrapping = (async () => {
-          const cdv = getCdv();
-          const platform = currentCdvPlatform();
-          cdv.store.register(
-            this.products.map((p) => ({
-              id: p.id,
-              type: mapProductType(p.type),
-              platform
-            }))
-          );
-          const errors = await cdv.store.initialize([platform]);
-          if (errors && errors.length > 0) {
-            const first = errors[0];
-            throw new exports.IAPError({
-              code: exports.IAPErrorCode.BILLING_NOT_AVAILABLE,
-              message: first?.message ?? "cordova-plugin-purchase initialize() reported errors."
-            });
-          }
-          const handler = (tx) => {
-            const token = transactionToken(tx);
-            if (!token) return;
-            if (!this.pendingFinish.has(token)) {
-              this.pendingFinish.set(token, tx);
-            }
-          };
-          this.bootstrapApprovedHandler = handler;
-          cdv.store.when().approved(handler);
-          await cdv.store.update();
-          this.bootstrapped = true;
-        })();
-        return this.bootstrapping;
       }
     };
   }
@@ -960,11 +835,11 @@ var WebStubAdapter = class {
 };
 
 // src/adapters/native/index.ts
-async function selectNativeAdapter(options) {
+async function selectNativeAdapter() {
   const platform = getPlatform();
   if (platform === "ios" || platform === "android") {
     const mod = await Promise.resolve().then(() => (init_native_adapter(), native_adapter_exports));
-    return new mod.CdvNativeAdapter({ products: options.products });
+    return new mod.CapgoNativeAdapter();
   }
   return new WebStubAdapter();
 }
@@ -1902,7 +1777,7 @@ function createIAP(input) {
         state.products = Object.freeze([...validated.data]);
         state.logger.debug(`Resolved ${validated.data.length} product(s) from backend manifest.`);
       }
-      state.adapter = await selectNativeAdapter({ products: state.products });
+      state.adapter = await selectNativeAdapter();
       const configGetAuthHeaders = state.config.backend.getAuthHeaders;
       const getAuthHeaders = configGetAuthHeaders ? async () => configGetAuthHeaders() : async () => ({});
       const sharedDeps = {