expo-iap 5.3.0 → 5.3.2

package/src/kit-api.ts

@@ -31,7 +31,15 @@ export type KitSubscription = {
   id: string;
   productId: string;
   platform: "IOS" | "Android";
-  state: string;
+  state:
+    | "Active"
+    | "InGracePeriod"
+    | "InBillingRetry"
+    | "Expired"
+    | "Revoked"
+    | "Refunded"
+    | "Paused"
+    | "Unknown";
   expiresAt?: number;
   renewsAt?: number;
   willRenew?: boolean;
@@ -41,6 +49,7 @@ export type KitSubscription = {
   startedAt: number;
   updatedAt: number;
   purchaseToken: string;
+  originalTransactionId?: string;
   userId?: string;
 };
 
@@ -58,7 +67,8 @@ export type StatusResponse = {
 export type KitProductPlatform = "IOS" | "Android";
 
 export type KitProductClientPayload = {
-  format: "toml" | "json" | "text";
+  /** Current values are toml, json, and text; preserve unknown values. */
+  format: string;
   body: string;
   version: number;
   updatedAt: number;
@@ -84,6 +94,13 @@ export type KitProduct = {
   type: "Subscription" | "NonConsumable" | "Consumable";
   title: string;
   description?: string;
+  baseLocale?: string;
+  localizations?: Array<{
+    locale: string;
+    title: string;
+    description?: string;
+  }>;
+  regions?: "all" | string[];
   priceAmountMicros?: number;
   currency?: string;
   state: "Draft" | "Ready" | "Active" | "Removed";
@@ -113,6 +130,108 @@ export type KitProductsResponse = {
   nextCursor?: string;
 };
 
+export type KitSubscriptionsResponse = {
+  items: KitSubscription[];
+  total: number;
+};
+
+export type KitMrrCurrencyEntry = {
+  currency: string;
+  mrrMicros: number;
+};
+
+export type KitMetricsResponse = {
+  activeSubs: number;
+  inGracePeriod: number;
+  inBillingRetry: number;
+  refunded30d: number;
+  canceled30d: number;
+  mrrMicros: number;
+  currency: string;
+  reportingCurrency: string;
+  mrrByCurrency: KitMrrCurrencyEntry[];
+  excludedMrrByCurrency: KitMrrCurrencyEntry[];
+};
+
+export type KitRevenueMetricsResponse = {
+  days: Array<{
+    day: string;
+    currency: string;
+    productId: string;
+    platform: KitProductPlatform;
+    activeSubs: number;
+    newSubs: number;
+    renewals: number;
+    cancellations: number;
+    refunds: number;
+    revenueMicros: number;
+  }>;
+  currencies: string[];
+  productIds: string[];
+  platforms: KitProductPlatform[];
+  truncated: boolean;
+};
+
+export type KitProductUpsertResponse = { id: string; created: boolean };
+export type KitProductStateResponse = {
+  id: string;
+  state: KitProduct["state"];
+};
+export type KitClientPayloadStateResponse = {
+  expectedVersion: number;
+  clientPayload?: KitProductClientPayload;
+};
+export type KitSetClientPayloadResponse = {
+  id: string;
+  created: boolean;
+  changed: boolean;
+  version: number;
+  updatedAt: number;
+};
+export type KitRemoveClientPayloadResponse = { ok: boolean };
+export type KitProductSyncResponse = { jobId: string; deduped: boolean };
+export type KitProductSyncJobResponse = {
+  _id: string;
+  _creationTime: number;
+  projectId: string;
+  platform: KitProductPlatform;
+  direction: "pull" | "push" | "both" | "purge-local";
+  dryRun: boolean;
+  status: "queued" | "running" | "succeeded" | "failed";
+  progress: {
+    phase: string;
+    current?: number;
+    total?: number;
+    failuresCount?: number;
+  };
+  result?: {
+    pulled: number;
+    pushed: number;
+    deleted?: number;
+    failures: Array<{ productId: string; reason: string }>;
+    failuresTruncated?: boolean;
+    plannedWrites?: Array<{
+      productId: string;
+      step: string;
+      detail?: string;
+    }>;
+    plannedWritesTruncated?: boolean;
+    manualActions?: Array<{
+      productId: string;
+      code: string;
+      message: string;
+    }>;
+    manualActionsTruncated?: boolean;
+  };
+  error?: string;
+  cancelRequested?: boolean;
+  expectedDeadline?: number;
+  createdBy?: string;
+  startedAt?: number;
+  completedAt?: number;
+  createdAt: number;
+};
+
 export type KitClientPayloadResponse = {
   clientPayload: KitProductClientPayload;
 };
@@ -135,7 +254,7 @@ const DEFAULT_BASE_URL = "https://kit.openiap.dev";
 function mergeHeaders(
   callerHeaders: Record<string, string> | undefined,
   hasBody: boolean,
-): HeadersInit {
+): RequestInit["headers"] {
   if (typeof Headers === "function") {
     const merged = new Headers(callerHeaders);
     if (!merged.has("accept")) merged.set("accept", "application/json");
@@ -283,9 +402,11 @@ export function kitApi(options: KitApiOptions) {
       if (!raw) return null;
       const candidate = JSON.parse(raw) as Partial<CachedClientPayload>;
       const payload = candidate.clientPayload;
+      // Only the invariants the cache depends on. `format` is opaque: evicting
+      // on an unknown one would kill ETag revalidation and offline reads.
       if (
         !payload ||
-        !["toml", "json", "text"].includes(payload.format) ||
+        typeof payload.format !== "string" ||
         typeof payload.body !== "string" ||
         !Number.isSafeInteger(payload.version) ||
         payload.version < 1 ||

package/src/types.ts

@@ -885,11 +885,11 @@ export interface Mutation {
    */
   syncIOS: Promise<boolean>;
   /**
-   * Verify a purchase against your own backend. Returns a platform-specific
-   * variant of VerifyPurchaseResult — VerifyPurchaseResultIOS exposes isValid
-   * + receipt/JWS metadata, VerifyPurchaseResultAndroid carries Play Store
-   * receipt fields (no isValid), and VerifyPurchaseResultHorizon uses success.
-   * Inspect the concrete variant before reading fields.
+   * Verify a purchase against your own backend. Every VerifyPurchaseResult
+   * variant exposes isValid, so entitlement can be gated without inspecting the
+   * concrete type. Variants add their own metadata on top: IOS carries
+   * receipt/JWS fields, Android carries Play Store receipt fields, and Horizon
+   * carries grantTime.
    * See: https://openiap.dev/docs/features/validation#verify-purchase
    */
   verifyPurchase: Promise<VerifyPurchaseResult>;
@@ -1857,6 +1857,12 @@ export interface RequestVerifyPurchaseWithIapkitResult {
    * Available in OpenIAP Spec 3.2.0 / openiap-apple 3.2.0 / openiap-google 3.3.0.
    * Amazon RVS environment selected by IAPKit. Present as `Sandbox` or
    * `Production` on handled Amazon verification results.
+   *
+   * Deliberately String, not an enum: the value space belongs to IAPKit and the
+   * stores behind it, and Apple's App Store Server alone also names `Xcode` and
+   * `LocalTesting`. SDKs must forward this value opaquely. Never reject a
+   * verification because the environment is unrecognised — that fails a purchase
+   * the store already confirmed.
    */
   environment?: (string | null);
   /**
@@ -2187,7 +2193,7 @@ export interface VerifyPurchaseProps {
 
 export type VerifyPurchaseResult = VerifyPurchaseResultAndroid | VerifyPurchaseResultHorizon | VerifyPurchaseResultIOS;
 
-export interface VerifyPurchaseResultAndroid {
+export interface VerifyPurchaseResultAndroid extends VerifyPurchaseResultCommon {
   autoRenewing: boolean;
   betaProduct: boolean;
   cancelDate?: (number | null);
@@ -2196,6 +2202,11 @@ export interface VerifyPurchaseResultAndroid {
   deferredSku?: (string | null);
   freeTrialEndDate: number;
   gracePeriodEndDate: number;
+  /**
+   * Whether the purchase is valid. Uniform across every VerifyPurchaseResult
+   * variant so callers can gate entitlement without inspecting the concrete type.
+   */
+  isValid: boolean;
   parentProductId: string;
   productId: string;
   productType: string;
@@ -2208,18 +2219,32 @@ export interface VerifyPurchaseResultAndroid {
   testTransaction: boolean;
 }
 
+/** Validity shared by every store-specific purchase verification result. */
+export interface VerifyPurchaseResultCommon {
+  /** Whether the purchase is valid, without inspecting the concrete result variant. */
+  isValid: boolean;
+}
+
 /**
  * Result from Meta Horizon verify_entitlement API.
  * Returns verification status and grant time for the entitlement.
  */
-export interface VerifyPurchaseResultHorizon {
+export interface VerifyPurchaseResultHorizon extends VerifyPurchaseResultCommon {
   /** Unix timestamp (seconds) when the entitlement was granted. */
   grantTime?: (number | null);
-  /** Whether the entitlement verification succeeded. */
+  /**
+   * Whether the purchase is valid. Uniform across every VerifyPurchaseResult
+   * variant so callers can gate entitlement without inspecting the concrete type.
+   */
+  isValid: boolean;
+  /**
+   * Whether the entitlement verification succeeded.
+   * @deprecated Renamed to isValid so every VerifyPurchaseResult variant answers validity the same way. Scheduled for removal in OpenIAP 4.0.
+   */
   success: boolean;
 }
 
-export interface VerifyPurchaseResultIOS {
+export interface VerifyPurchaseResultIOS extends VerifyPurchaseResultCommon {
   /** Whether the receipt is valid */
   isValid: boolean;
   /** JWS representation */

package/src/vega-adapter.ts

@@ -1177,17 +1177,12 @@ export function createExpoIapVegaModule(
           `IAPKit returned malformed response (HTTP ${status}).`,
         );
       }
-      const environment = json.environment;
-      if (
-        environment != null &&
-        (typeof environment !== 'string' ||
-          (environment !== 'Sandbox' && environment !== 'Production'))
-      ) {
-        throw createVegaError(
-          ErrorCode.PurchaseVerificationFailed,
-          `IAPKit returned malformed response (HTTP ${status}).`,
-        );
-      }
+      // Forwarded opaquely: `environment` is String in the spec.
+      const rawEnvironment = json.environment;
+      const environment =
+        typeof rawEnvironment === 'string' && rawEnvironment.length > 0
+          ? rawEnvironment
+          : undefined;
 
       return {
         ...(environment == null ? {} : {environment}),

package/tests/ios/ExpoIapLogTests.swift

@@ -0,0 +1,37 @@
+import XCTest
+
+final class ExpoIapLogTests: XCTestCase {
+    override func tearDown() {
+        ExpoIapLog.setHandler(nil)
+        super.tearDown()
+    }
+
+    @objc func testNullSensitiveValuesAreOmittedAndPresentValuesAreMasked() {
+        var output = ""
+        ExpoIapLog.setEnabled(true)
+        ExpoIapLog.setHandler { _, message in output = message }
+
+        let payload: [String: Any?] = [
+            "purchaseToken": nil,
+            "userIdAmazon": NSNull(),
+            "apiKey": "known-api-key",
+        ]
+        ExpoIapLog.payload("requestPurchase", payload: payload)
+
+        XCTAssertFalse(output.contains("purchaseToken"))
+        XCTAssertFalse(output.contains("userIdAmazon"))
+        XCTAssertTrue(output.contains("\"apiKey\":\"hidden\""))
+        XCTAssertFalse(output.contains("known-api-key"))
+    }
+}
+
+@main
+private enum ExpoIapLogTestRunner {
+    static func main() {
+        let test = ExpoIapLogTests(
+            selector: #selector(ExpoIapLogTests.testNullSensitiveValuesAreOmittedAndPresentValuesAreMasked)
+        )
+        test.run()
+        precondition(test.testRun?.hasSucceeded == true)
+    }
+}