@pylonsync/revenuecat 0.8.3 → 0.9.1

package/package.json

@@ -3,18 +3,36 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.8.3",
+  "version": "0.9.1",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    },
+    "./client": {
+      "types": "./src/client.ts",
+      "default": "./src/client.ts"
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": {
+      "client": [
+        "./src/client.ts"
+      ]
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json --noEmit",
     "check": "tsc -p tsconfig.json --noEmit",
     "test": "bun test"
   },
   "dependencies": {
-    "@pylonsync/sdk": "0.8.3",
-    "@pylonsync/functions": "0.8.3"
+    "@pylonsync/sdk": "0.9.1",
+    "@pylonsync/functions": "0.9.1"
   },
   "peerDependencies": {
     "bun-types": "*"

package/src/client.ts

@@ -0,0 +1,37 @@
+/**
+ * `@pylonsync/revenuecat/client` — the part of the plugin that runs in
+ * app code (browser, React Native). It has no dependency on
+ * `@pylonsync/functions`, so Metro and browser bundlers can import it.
+ * The package root is server-only (handlers, manifest fragment).
+ */
+
+/** One row of the entitlement entity, as the client reads it through sync. */
+export interface RcEntitlementRow {
+	id: string;
+	userId: string;
+	entitlement: string;
+	productId: string;
+	status: "active" | "expired";
+	store: string;
+	environment?: string | null;
+	expiresAt?: string | null;
+	updatedAt: string;
+}
+
+/**
+ * Is `entitlement` active in a list of rows the app read through sync?
+ * Treats a row with a past `expiresAt` as inactive even if the webhook
+ * has not delivered the expiration yet.
+ */
+export function hasEntitlement(
+	rows: ReadonlyArray<{ entitlement: string; status: string; expiresAt?: string | null }>,
+	entitlement: string,
+	now: number = Date.now(),
+): boolean {
+	return rows.some(
+		(r) =>
+			r.entitlement === entitlement &&
+			r.status === "active" &&
+			(r.expiresAt == null || new Date(r.expiresAt).getTime() > now),
+	);
+}

package/src/handlers/sync.ts

@@ -48,11 +48,16 @@ export function entitlementsFromSubscriber(
  * a client can trigger the sync but never assert an entitlement.
  */
 export function syncEntitlementsHandler(cfg: RevenueCatConfig) {
+	// Guests are allowed by default: a guest's purchase is keyed on the
+	// guest id, and the row follows the account on sign-in through
+	// RevenueCat's alias. See `RevenueCatConfig.syncAuth`.
+	const auth: "guest" | "user" = cfg.syncAuth ?? "guest";
 	return action({
 		args: {},
+		auth: auth as "guest",
 		async handler(ctx: HandlerCtx) {
 			const userId = ctx.auth.userId;
-			if (!userId) throw ctx.error("UNAUTHENTICATED", "sign in first");
+			if (!userId) throw ctx.error("UNAUTHENTICATED", "start a guest session or sign in first");
 			const key = resolveApiKey(ctx, cfg);
 			if (!key) throw ctx.error("RC_NOT_CONFIGURED", "no RevenueCat API key on the server");
 

package/src/index.ts

@@ -27,6 +27,11 @@
  *   REVENUECAT_SECRET_KEY     (or REVENUECAT_PUBLIC_KEY) for the subscriber read in syncEntitlements
  *
  * Point the RevenueCat webhook at `POST /api/fn/revenuecatWebhook`.
+ *
+ * App code reads entitlements through sync and gates with
+ * `hasEntitlement` from `@pylonsync/revenuecat/client`. Do not import
+ * this root module from a browser or React Native bundle: it pulls in
+ * `@pylonsync/functions`.
  */
 
 import { buildRevenueCatManifest, type RevenueCatManifestFragment } from "./manifest";
@@ -42,10 +47,10 @@ export type {
 	RevenueCatConfig,
 	RevenueCatHooks,
 	RevenueCatEvent,
-	RcEntitlementRow,
 	EntitlementChange,
 	HandlerCtx,
 } from "./types";
+export type { RcEntitlementRow } from "./client";
 export type { RevenueCatManifestFragment } from "./manifest";
 export { entitlementEntityName } from "./manifest";
 export { statusForEvent, entitlementIdsOf, webhookAuthorized } from "./handlers/webhook";
@@ -73,20 +78,7 @@ export function revenuecat(cfg: RevenueCatConfig): RevenueCatPlugin {
 	};
 }
 
-/**
- * Client-side helper: is `entitlement` active in a list of rows the app
- * read through sync? Treats a row with a past `expiresAt` as inactive even
- * if the webhook has not delivered the expiration yet.
- */
-export function hasEntitlement(
-	rows: ReadonlyArray<{ entitlement: string; status: string; expiresAt?: string | null }>,
-	entitlement: string,
-	now: number = Date.now(),
-): boolean {
-	return rows.some(
-		(r) =>
-			r.entitlement === entitlement &&
-			r.status === "active" &&
-			(r.expiresAt == null || new Date(r.expiresAt).getTime() > now),
-	);
-}
+// `hasEntitlement` also ships from `@pylonsync/revenuecat/client`, which
+// carries no server imports. App code (browser, React Native) must import
+// from there; this root re-export keeps server-side callers working.
+export { hasEntitlement } from "./client";

package/src/types.ts

@@ -27,6 +27,14 @@ export interface RevenueCatConfig {
 	getApiKey?: (ctx: HandlerCtx) => string | undefined;
 	/** Entity name override. Default `RcEntitlement`. */
 	entities?: { entitlement?: string };
+	/**
+	 * Who may call `syncEntitlements`. Default `"guest"`: mobile apps start
+	 * users as guests and a guest can buy before signing in. The action is
+	 * safe for guests because the server reads RevenueCat by the caller's
+	 * own id and never trusts a client-asserted entitlement. Set `"user"`
+	 * when the app has no guest purchases.
+	 */
+	syncAuth?: "guest" | "user";
 	hooks?: RevenueCatHooks;
 }
 
@@ -70,19 +78,6 @@ export interface RevenueCatEvent {
 	id?: string;
 }
 
-/** One row of the entitlement entity. */
-export interface RcEntitlementRow {
-	id: string;
-	userId: string;
-	entitlement: string;
-	productId: string;
-	status: "active" | "expired";
-	store: string;
-	environment?: string | null;
-	expiresAt?: string | null;
-	updatedAt: string;
-}
-
 /** Function context shape the handlers use; structurally compatible with
  *  `@pylonsync/functions`' ctx. */
 export interface HandlerCtx {

package/src/webhook.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
-import { entitlementsFromSubscriber } from "./handlers/sync";
+import { entitlementsFromSubscriber, syncEntitlementsHandler } from "./handlers/sync";
+import { hasEntitlement as hasEntitlementClient } from "./client";
 import { entitlementIdsOf, revenuecatWebhookHandler, statusForEvent, webhookAuthorized } from "./handlers/webhook";
 import { hasEntitlement } from "./index";
 import type { HandlerCtx } from "./types";
@@ -132,3 +133,16 @@ describe("webhook handler", () => {
 		expect(mutations).toHaveLength(0);
 	});
 });
+
+describe("syncEntitlements auth", () => {
+	test("guests may sync by default; apps can restrict to accounts", () => {
+		expect(syncEntitlementsHandler({ entitlements: ["pro"] }).auth).toBe("guest");
+		expect(syncEntitlementsHandler({ entitlements: ["pro"], syncAuth: "user" }).auth).toBe("user");
+	});
+});
+
+describe("client entry", () => {
+	test("the root and the client entry export the same hasEntitlement", () => {
+		expect(hasEntitlementClient).toBe(hasEntitlement);
+	});
+});