@nosslabs/iap 7.0.0-next.0 → 7.0.0

package/CHANGELOG.md

@@ -5,6 +5,71 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [7.0.0] — 2026-05-14
+
+**GA of the Capacitor 7+ line.** `@latest` on npm moves from `5.0.0`
+(Cap-5 maintenance) to `7.0.0` (Cap-7+). Cap-5 consumers stay on
+`5.x` — `^5` ranges don't auto-resolve to `7.x`. The `5.x` maintenance
+branch continues to receive patches.
+
+### Changed (BREAKING, vs `5.0.0` — bundled with the Cap-5→Cap-7 swap)
+
+- **EventMap pruning.** Removed two events from the public
+  `EventMap` that were declared but never emitted in any prior
+  release: `'price-stale'` and `'error'`. Subscriptions to either
+  never fired, so no runtime behavior changes — only consumers who
+  had `iap.on('price-stale', …)` or `iap.on('error', …)` in their
+  TypeScript code need to remove those calls. The
+  `'recovery-dropped-permanent'` event (introduced in 0.4 / `5.0.0`)
+  remains.
+- `IAPErrorOptions` is now file-local (was wrongly exported from
+  `src/lib/errors.ts` but never re-exported through `src/index.ts`,
+  so no consumer had access to it). No package-root-exported symbol
+  changes.
+
+### Added
+
+- **`AppUserIdFetcherContext`** is now re-exported from the package
+  root, so a separately-defined async fetcher can be typed
+  explicitly:
+
+  ```ts
+  import type { AppUserIdFetcherContext } from '@nosslabs/iap';
+
+  const fetchUuid = async ({ authHeaders }: AppUserIdFetcherContext) => {
+    const r = await fetch('/api/iap/uuid', { method: 'POST', headers: authHeaders });
+    return (await r.json()).uuid;
+  };
+  ```
+
+### Fixed (since `7.0.0-next.0`)
+
+- **iOS `Cannot find product for id <id>` now maps to
+  `PRODUCT_NOT_FOUND`** (previously fell through to `STORE_ERROR`).
+  The capgo plugin uses two different messages for the same
+  semantic on iOS vs Android; the adapter now handles both.
+- **`refresh()` is safe to detach from the IAP instance.** Internal
+  callbacks no longer reference `this.refresh()`, so
+  `const { refresh } = iap;` works without a strict-mode `this`
+  binding error. Regression test added.
+
+### Notes
+
+- Adapter JSDoc for `getOwnedTransactions()` now documents an iOS
+  quirk worth knowing: `@capgo/native-purchases`'s `getPurchases()`
+  bundles `Transaction.currentEntitlements` *plus* `Transaction.all`
+  (historical + revoked subscriptions). Android-side PENDING
+  purchases are filtered out (`purchaseState !== '1'`); iOS-side
+  historical transactions are not filtered and pass through to the
+  backend's `/restore` endpoint. Attesto evaluates each receipt and
+  returns per-transaction validity, so this is the documented
+  contract.
+- Android user-cancellation reminder (carried from `7.0.0-next.0`):
+  Google Play Billing collapses user-cancel and other billing
+  errors into the same plugin rejection, so an Android cancel
+  surfaces as `status: 'failed'` rather than `'cancelled'`. iOS
+  still distinguishes reliably.
+
 ## [7.0.0-next.0] — 2026-05-14
 
 First release of the **Capacitor 7+** line, published on the `@next`

package/README.md

@@ -2,10 +2,10 @@
 
 > Thin Capacitor IAP orchestrator. Server-side validation via [Attesto](https://attesto.nossdev.com).
 
-**Status: `7.0.0-next.0` — prerelease on the `@next` dist-tag** (the Capacitor 7+ line, built on `@capgo/native-purchases`). The Capacitor 5 line (`cordova-plugin-purchase`) continues as `5.x` on `@latest` (from the `5.x` branch). API may have breaking changes through the 7.x prerelease line; watch the [CHANGELOG](./CHANGELOG.md).
+**Status: `7.0.0` — GA on `@latest`** (the Capacitor 7+ line, built on `@capgo/native-purchases`). The Capacitor 5 line (`cordova-plugin-purchase`) continues as `5.x` from the `5.x` branch — `^5` ranges still resolve to `5.x`. See the [CHANGELOG](./CHANGELOG.md) for the GA delta and [Migration](https://iap.nossdev.com/migration/) for upgrading from `5.x`.
 
 ```bash
-npm install @nosslabs/iap@next @capgo/native-purchases
+npm install @nosslabs/iap @capgo/native-purchases
 npx cap sync
 ```
 
@@ -77,8 +77,8 @@ It does **not**: talk to Attesto directly, define entitlement business logic, ma
 
 | `@nosslabs/iap` | Capacitor | Native plugin | dist-tag | Status |
 |---|---|---|---|---|
-| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases 7.16.x` (or `^8` on Cap 8) | `@next` | **Current (prerelease)** |
-| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | `@latest` | Maintenance |
+| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases 7.16.x` (or `^8` on Cap 8) | `@latest` | **Current** |
+| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | (pinned via `^5`) | Maintenance |
 
 ## Optional peer dependency
 

package/dist/index.cjs

@@ -202,7 +202,7 @@ function mapPurchaseError(error, productId) {
       cause: error
     });
   }
-  if (lower.includes("product not found")) {
+  if (lower.includes("product not found") || lower.includes("cannot find product")) {
     return new exports.IAPError({
       code: exports.IAPErrorCode.PRODUCT_NOT_FOUND,
       message: `Product "${productId}" was not found in the store catalog.`,
@@ -1737,6 +1737,24 @@ function createIAP(input) {
     cachedAt: null,
     products: Object.freeze([...config.products ?? []])
   };
+  async function refreshEntitlements() {
+    requireInitialized(state);
+    const previous = state.entitlements;
+    const fetched = await state.backend.getEntitlements();
+    const next = freezeAll(fetched);
+    try {
+      state.cachedAt = await state.cache.save(next);
+    } catch (error) {
+      state.logger.warn(
+        "Failed to persist refreshed entitlements; in-memory state still updated.",
+        error
+      );
+    }
+    state.entitlements = next;
+    if (!entitlementsEqual(previous, next)) {
+      state.emitter.emit("entitlements-changed", { entitlements: next, previous });
+    }
+  }
   return {
     async initialize() {
       if (state.destroyed) {
@@ -1838,7 +1856,7 @@ function createIAP(input) {
           logger: state.logger,
           onResume: async () => {
             try {
-              await this.refresh();
+              await refreshEntitlements();
             } catch (error) {
               state.logger.warn("refreshOnResume: refresh() failed.", error);
             }
@@ -1849,7 +1867,7 @@ function createIAP(input) {
         state.logger.debug("Cache exceeds TTL; scheduling background refresh.");
         queueMicrotask(() => {
           if (!state.initialized || state.destroyed) return;
-          this.refresh().catch((error) => {
+          refreshEntitlements().catch((error) => {
             state.logger.warn("TTL background refresh failed.", error);
           });
         });
@@ -1857,24 +1875,7 @@ function createIAP(input) {
       state.initialized = true;
       state.emitter.emit("ready", void 0);
     },
-    async refresh() {
-      requireInitialized(state);
-      const previous = state.entitlements;
-      const fetched = await state.backend.getEntitlements();
-      const next = freezeAll(fetched);
-      try {
-        state.cachedAt = await state.cache.save(next);
-      } catch (error) {
-        state.logger.warn(
-          "Failed to persist refreshed entitlements; in-memory state still updated.",
-          error
-        );
-      }
-      state.entitlements = next;
-      if (!entitlementsEqual(previous, next)) {
-        state.emitter.emit("entitlements-changed", { entitlements: next, previous });
-      }
-    },
+    refresh: refreshEntitlements,
     async destroy() {
       if (state.destroyed) return;
       state.destroyed = true;