@nosslabs/iap 7.0.0-next.0 → 7.1.0

package/CHANGELOG.md

@@ -5,6 +5,95 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [7.1.0] — 2026-07-04
+
+### Added
+
+- `iap.getStorefront(): Promise<Storefront | null>` — reads the user's App
+  Store / Google Play storefront (the country their store account is registered
+  to). Returns the new exported `Storefront` type, with `countryCode` normalized
+  to ISO 3166-1 alpha-2 across platforms (iOS reports alpha-3, Android alpha-2);
+  the raw native value is preserved on `countryCodeRaw`, plus the Apple
+  `storefrontId` (iOS only) and `platform`. Resolves `null` on web, when the
+  installed `@capgo/native-purchases` build doesn't register the native
+  `getStorefront` method, or when the storefront is unavailable (e.g. EU
+  alternative distribution). Read it live and treat it as a UX/targeting hint —
+  for compliance/entitlement decisions, trust the server-side signed storefront.
+
+### Changed
+
+- Anchored the `7.x` line to **Capacitor 7**: peer dependencies narrowed to
+  `@capacitor/*: ^7.0.0` and `@capgo/native-purchases: ^7.16.2` (dropping the
+  `^8.0.0` allowances). The `^7.16.2` range admits the Capacitor-7 capgo build
+  that adds native `getStorefront`. Capacitor-8 support will ship in
+  `@nosslabs/iap` v8. (`getStorefront()` itself still degrades gracefully on
+  capgo builds that predate the native method.)
+
+## [7.0.0] — 2026-05-14
+
+**GA of the Capacitor 7+ line.** `@latest` on npm moves from `5.0.0`
+(Cap-5 maintenance) to `7.0.0` (Cap-7+). Cap-5 consumers stay on
+`5.x` — `^5` ranges don't auto-resolve to `7.x`. The `5.x` maintenance
+branch continues to receive patches.
+
+### Changed (BREAKING, vs `5.0.0` — bundled with the Cap-5→Cap-7 swap)
+
+- **EventMap pruning.** Removed two events from the public
+  `EventMap` that were declared but never emitted in any prior
+  release: `'price-stale'` and `'error'`. Subscriptions to either
+  never fired, so no runtime behavior changes — only consumers who
+  had `iap.on('price-stale', …)` or `iap.on('error', …)` in their
+  TypeScript code need to remove those calls. The
+  `'recovery-dropped-permanent'` event (introduced in 0.4 / `5.0.0`)
+  remains.
+- `IAPErrorOptions` is now file-local (was wrongly exported from
+  `src/lib/errors.ts` but never re-exported through `src/index.ts`,
+  so no consumer had access to it). No package-root-exported symbol
+  changes.
+
+### Added
+
+- **`AppUserIdFetcherContext`** is now re-exported from the package
+  root, so a separately-defined async fetcher can be typed
+  explicitly:
+
+  ```ts
+  import type { AppUserIdFetcherContext } from '@nosslabs/iap';
+
+  const fetchUuid = async ({ authHeaders }: AppUserIdFetcherContext) => {
+    const r = await fetch('/api/iap/uuid', { method: 'POST', headers: authHeaders });
+    return (await r.json()).uuid;
+  };
+  ```
+
+### Fixed (since `7.0.0-next.0`)
+
+- **iOS `Cannot find product for id <id>` now maps to
+  `PRODUCT_NOT_FOUND`** (previously fell through to `STORE_ERROR`).
+  The capgo plugin uses two different messages for the same
+  semantic on iOS vs Android; the adapter now handles both.
+- **`refresh()` is safe to detach from the IAP instance.** Internal
+  callbacks no longer reference `this.refresh()`, so
+  `const { refresh } = iap;` works without a strict-mode `this`
+  binding error. Regression test added.
+
+### Notes
+
+- Adapter JSDoc for `getOwnedTransactions()` now documents an iOS
+  quirk worth knowing: `@capgo/native-purchases`'s `getPurchases()`
+  bundles `Transaction.currentEntitlements` *plus* `Transaction.all`
+  (historical + revoked subscriptions). Android-side PENDING
+  purchases are filtered out (`purchaseState !== '1'`); iOS-side
+  historical transactions are not filtered and pass through to the
+  backend's `/restore` endpoint. Attesto evaluates each receipt and
+  returns per-transaction validity, so this is the documented
+  contract.
+- Android user-cancellation reminder (carried from `7.0.0-next.0`):
+  Google Play Billing collapses user-cancel and other billing
+  errors into the same plugin rejection, so an Android cancel
+  surfaces as `status: 'failed'` rather than `'cancelled'`. iOS
+  still distinguishes reliably.
+
 ## [7.0.0-next.0] — 2026-05-14
 
 First release of the **Capacitor 7+** line, published on the `@next`

package/README.md

@@ -2,10 +2,10 @@
 
 > Thin Capacitor IAP orchestrator. Server-side validation via [Attesto](https://attesto.nossdev.com).
 
-**Status: `7.0.0-next.0` — prerelease on the `@next` dist-tag** (the Capacitor 7+ line, built on `@capgo/native-purchases`). The Capacitor 5 line (`cordova-plugin-purchase`) continues as `5.x` on `@latest` (from the `5.x` branch). API may have breaking changes through the 7.x prerelease line; watch the [CHANGELOG](./CHANGELOG.md).
+**Status: `7.0.0` — GA on `@latest`** (the Capacitor 7+ line, built on `@capgo/native-purchases`). The Capacitor 5 line (`cordova-plugin-purchase`) continues as `5.x` from the `5.x` branch — `^5` ranges still resolve to `5.x`. See the [CHANGELOG](./CHANGELOG.md) for the GA delta and [Migration](https://iap.nossdev.com/migration/) for upgrading from `5.x`.
 
 ```bash
-npm install @nosslabs/iap@next @capgo/native-purchases
+npm install @nosslabs/iap @capgo/native-purchases
 npx cap sync
 ```
 
@@ -77,8 +77,8 @@ It does **not**: talk to Attesto directly, define entitlement business logic, ma
 
 | `@nosslabs/iap` | Capacitor | Native plugin | dist-tag | Status |
 |---|---|---|---|---|
-| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases 7.16.x` (or `^8` on Cap 8) | `@next` | **Current (prerelease)** |
-| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | `@latest` | Maintenance |
+| 7.x | 7.x (also runs on 8.x) | `@capgo/native-purchases 7.16.x` (or `^8` on Cap 8) | `@latest` | **Current** |
+| 5.x | 5.x | `cordova-plugin-purchase ^13.x` | (pinned via `^5`) | Maintenance |
 
 ## Optional peer dependency
 

package/dist/index.cjs

@@ -139,11 +139,293 @@ var init_platform = __esm({
   }
 });
 
+// src/lib/iso-country.ts
+function toAlpha2(code) {
+  if (!code) return null;
+  const normalized = code.trim().toUpperCase();
+  if (normalized.length === 2) return normalized;
+  if (normalized.length === 3) return ALPHA3_TO_ALPHA2[normalized] ?? null;
+  return null;
+}
+var ALPHA3_TO_ALPHA2;
+var init_iso_country = __esm({
+  "src/lib/iso-country.ts"() {
+    ALPHA3_TO_ALPHA2 = {
+      ABW: "AW",
+      AFG: "AF",
+      AGO: "AO",
+      AIA: "AI",
+      ALA: "AX",
+      ALB: "AL",
+      AND: "AD",
+      ARE: "AE",
+      ARG: "AR",
+      ARM: "AM",
+      ASM: "AS",
+      ATA: "AQ",
+      ATF: "TF",
+      ATG: "AG",
+      AUS: "AU",
+      AUT: "AT",
+      AZE: "AZ",
+      BDI: "BI",
+      BEL: "BE",
+      BEN: "BJ",
+      BES: "BQ",
+      BFA: "BF",
+      BGD: "BD",
+      BGR: "BG",
+      BHR: "BH",
+      BHS: "BS",
+      BIH: "BA",
+      BLM: "BL",
+      BLR: "BY",
+      BLZ: "BZ",
+      BMU: "BM",
+      BOL: "BO",
+      BRA: "BR",
+      BRB: "BB",
+      BRN: "BN",
+      BTN: "BT",
+      BVT: "BV",
+      BWA: "BW",
+      CAF: "CF",
+      CAN: "CA",
+      CCK: "CC",
+      CHE: "CH",
+      CHL: "CL",
+      CHN: "CN",
+      CIV: "CI",
+      CMR: "CM",
+      COD: "CD",
+      COG: "CG",
+      COK: "CK",
+      COL: "CO",
+      COM: "KM",
+      CPV: "CV",
+      CRI: "CR",
+      CUB: "CU",
+      CUW: "CW",
+      CXR: "CX",
+      CYM: "KY",
+      CYP: "CY",
+      CZE: "CZ",
+      DEU: "DE",
+      DJI: "DJ",
+      DMA: "DM",
+      DNK: "DK",
+      DOM: "DO",
+      DZA: "DZ",
+      ECU: "EC",
+      EGY: "EG",
+      ERI: "ER",
+      ESH: "EH",
+      ESP: "ES",
+      EST: "EE",
+      ETH: "ET",
+      FIN: "FI",
+      FJI: "FJ",
+      FLK: "FK",
+      FRA: "FR",
+      FRO: "FO",
+      FSM: "FM",
+      GAB: "GA",
+      GBR: "GB",
+      GEO: "GE",
+      GGY: "GG",
+      GHA: "GH",
+      GIB: "GI",
+      GIN: "GN",
+      GLP: "GP",
+      GMB: "GM",
+      GNB: "GW",
+      GNQ: "GQ",
+      GRC: "GR",
+      GRD: "GD",
+      GRL: "GL",
+      GTM: "GT",
+      GUF: "GF",
+      GUM: "GU",
+      GUY: "GY",
+      HKG: "HK",
+      HMD: "HM",
+      HND: "HN",
+      HRV: "HR",
+      HTI: "HT",
+      HUN: "HU",
+      IDN: "ID",
+      IMN: "IM",
+      IND: "IN",
+      IOT: "IO",
+      IRL: "IE",
+      IRN: "IR",
+      IRQ: "IQ",
+      ISL: "IS",
+      ISR: "IL",
+      ITA: "IT",
+      JAM: "JM",
+      JEY: "JE",
+      JOR: "JO",
+      JPN: "JP",
+      KAZ: "KZ",
+      KEN: "KE",
+      KGZ: "KG",
+      KHM: "KH",
+      KIR: "KI",
+      KNA: "KN",
+      KOR: "KR",
+      KWT: "KW",
+      LAO: "LA",
+      LBN: "LB",
+      LBR: "LR",
+      LBY: "LY",
+      LCA: "LC",
+      LIE: "LI",
+      LKA: "LK",
+      LSO: "LS",
+      LTU: "LT",
+      LUX: "LU",
+      LVA: "LV",
+      MAC: "MO",
+      MAF: "MF",
+      MAR: "MA",
+      MCO: "MC",
+      MDA: "MD",
+      MDG: "MG",
+      MDV: "MV",
+      MEX: "MX",
+      MHL: "MH",
+      MKD: "MK",
+      MLI: "ML",
+      MLT: "MT",
+      MMR: "MM",
+      MNE: "ME",
+      MNG: "MN",
+      MNP: "MP",
+      MOZ: "MZ",
+      MRT: "MR",
+      MSR: "MS",
+      MTQ: "MQ",
+      MUS: "MU",
+      MWI: "MW",
+      MYS: "MY",
+      MYT: "YT",
+      NAM: "NA",
+      NCL: "NC",
+      NER: "NE",
+      NFK: "NF",
+      NGA: "NG",
+      NIC: "NI",
+      NIU: "NU",
+      NLD: "NL",
+      NOR: "NO",
+      NPL: "NP",
+      NRU: "NR",
+      NZL: "NZ",
+      OMN: "OM",
+      PAK: "PK",
+      PAN: "PA",
+      PCN: "PN",
+      PER: "PE",
+      PHL: "PH",
+      PLW: "PW",
+      PNG: "PG",
+      POL: "PL",
+      PRI: "PR",
+      PRK: "KP",
+      PRT: "PT",
+      PRY: "PY",
+      PSE: "PS",
+      PYF: "PF",
+      QAT: "QA",
+      REU: "RE",
+      ROU: "RO",
+      RUS: "RU",
+      RWA: "RW",
+      SAU: "SA",
+      SDN: "SD",
+      SEN: "SN",
+      SGP: "SG",
+      SGS: "GS",
+      SHN: "SH",
+      SJM: "SJ",
+      SLB: "SB",
+      SLE: "SL",
+      SLV: "SV",
+      SMR: "SM",
+      SOM: "SO",
+      SPM: "PM",
+      SRB: "RS",
+      SSD: "SS",
+      STP: "ST",
+      SUR: "SR",
+      SVK: "SK",
+      SVN: "SI",
+      SWE: "SE",
+      SWZ: "SZ",
+      SXM: "SX",
+      SYC: "SC",
+      SYR: "SY",
+      TCA: "TC",
+      TCD: "TD",
+      TGO: "TG",
+      THA: "TH",
+      TJK: "TJ",
+      TKL: "TK",
+      TKM: "TM",
+      TLS: "TL",
+      TON: "TO",
+      TTO: "TT",
+      TUN: "TN",
+      TUR: "TR",
+      TUV: "TV",
+      TWN: "TW",
+      TZA: "TZ",
+      UGA: "UG",
+      UKR: "UA",
+      UMI: "UM",
+      URY: "UY",
+      USA: "US",
+      UZB: "UZ",
+      VAT: "VA",
+      VCT: "VC",
+      VEN: "VE",
+      VGB: "VG",
+      VIR: "VI",
+      VNM: "VN",
+      VUT: "VU",
+      WLF: "WF",
+      WSM: "WS",
+      YEM: "YE",
+      ZAF: "ZA",
+      ZMB: "ZM",
+      ZWE: "ZW"
+    };
+  }
+});
+
 // src/adapters/native/capgo/native-adapter.ts
 var native_adapter_exports = {};
 __export(native_adapter_exports, {
   CapgoNativeAdapter: () => CapgoNativeAdapter
 });
+function nativeStorefrontRegistered() {
+  const headers = core.Capacitor.PluginHeaders;
+  return headers?.find((h) => h.name === "NativePurchases")?.methods?.some((m) => m.name === "getStorefront") ?? false;
+}
+function normalizeStorefront(raw) {
+  const code = raw?.countryCode?.trim();
+  if (!code) return null;
+  const platform = getPlatform() === "android" ? "google" : "apple";
+  return {
+    // alpha-2 when recognized; otherwise the uppercased raw code as a
+    // best-effort fallback (see `Storefront.countryCode`).
+    countryCode: toAlpha2(code) ?? code.toUpperCase(),
+    countryCodeRaw: code,
+    storefrontId: raw.storefrontId,
+    platform
+  };
+}
 function normalizeProduct(p, type) {
   const priceMicros = Math.round(p.price * 1e6).toString();
   return {
@@ -202,7 +484,7 @@ function mapPurchaseError(error, productId) {
       cause: error
     });
   }
-  if (lower.includes("product not found")) {
+  if (lower.includes("product not found") || lower.includes("cannot find product")) {
     return new exports.IAPError({
       code: exports.IAPErrorCode.PRODUCT_NOT_FOUND,
       message: `Product "${productId}" was not found in the store catalog.`,
@@ -219,6 +501,7 @@ var CapgoNativeAdapter;
 var init_native_adapter = __esm({
   "src/adapters/native/capgo/native-adapter.ts"() {
     init_errors();
+    init_iso_country();
     init_platform();
     CapgoNativeAdapter = class {
       async isAvailable() {
@@ -302,6 +585,24 @@ var init_native_adapter = __esm({
           });
         }
       }
+      /**
+       * Read the current storefront from the native plugin — which is expected to
+       * source it from StoreKit 2 `Storefront.current` on iOS (alpha-3) and
+       * `getBillingConfigAsync()` on Android (alpha-2) — normalizing `countryCode`
+       * to alpha-2. Silent like {@link CapgoNativeAdapter.isAvailable}: any
+       * unavailability — older plugin (no native method registered), native
+       * rejection, or empty country — resolves to `null` rather than throwing.
+       */
+      async getStorefront() {
+        if (!nativeStorefrontRegistered()) return null;
+        const np = nativePurchases.NativePurchases;
+        try {
+          const raw = await np.getStorefront?.();
+          return raw ? normalizeStorefront(raw) : null;
+        } catch {
+          return null;
+        }
+      }
       async dispose() {
       }
     };
@@ -832,6 +1133,9 @@ var WebStubAdapter = class {
       message: "Subscription management is not supported on the web platform."
     });
   }
+  async getStorefront() {
+    return null;
+  }
 };
 
 // src/adapters/native/index.ts
@@ -1737,6 +2041,24 @@ function createIAP(input) {
     cachedAt: null,
     products: Object.freeze([...config.products ?? []])
   };
+  async function refreshEntitlements() {
+    requireInitialized(state);
+    const previous = state.entitlements;
+    const fetched = await state.backend.getEntitlements();
+    const next = freezeAll(fetched);
+    try {
+      state.cachedAt = await state.cache.save(next);
+    } catch (error) {
+      state.logger.warn(
+        "Failed to persist refreshed entitlements; in-memory state still updated.",
+        error
+      );
+    }
+    state.entitlements = next;
+    if (!entitlementsEqual(previous, next)) {
+      state.emitter.emit("entitlements-changed", { entitlements: next, previous });
+    }
+  }
   return {
     async initialize() {
       if (state.destroyed) {
@@ -1838,7 +2160,7 @@ function createIAP(input) {
           logger: state.logger,
           onResume: async () => {
             try {
-              await this.refresh();
+              await refreshEntitlements();
             } catch (error) {
               state.logger.warn("refreshOnResume: refresh() failed.", error);
             }
@@ -1849,7 +2171,7 @@ function createIAP(input) {
         state.logger.debug("Cache exceeds TTL; scheduling background refresh.");
         queueMicrotask(() => {
           if (!state.initialized || state.destroyed) return;
-          this.refresh().catch((error) => {
+          refreshEntitlements().catch((error) => {
             state.logger.warn("TTL background refresh failed.", error);
           });
         });
@@ -1857,24 +2179,7 @@ function createIAP(input) {
       state.initialized = true;
       state.emitter.emit("ready", void 0);
     },
-    async refresh() {
-      requireInitialized(state);
-      const previous = state.entitlements;
-      const fetched = await state.backend.getEntitlements();
-      const next = freezeAll(fetched);
-      try {
-        state.cachedAt = await state.cache.save(next);
-      } catch (error) {
-        state.logger.warn(
-          "Failed to persist refreshed entitlements; in-memory state still updated.",
-          error
-        );
-      }
-      state.entitlements = next;
-      if (!entitlementsEqual(previous, next)) {
-        state.emitter.emit("entitlements-changed", { entitlements: next, previous });
-      }
-    },
+    refresh: refreshEntitlements,
     async destroy() {
       if (state.destroyed) return;
       state.destroyed = true;
@@ -1932,6 +2237,10 @@ function createIAP(input) {
       }
       return state.adapter.getProducts(state.products.map((p) => ({ id: p.id, type: p.type })));
     },
+    async getStorefront() {
+      requireInitialized(state);
+      return state.adapter?.getStorefront?.() ?? null;
+    },
     hasEntitlement(key) {
       return state.entitlements.some((e) => e.key === key);
     },