palbase 0.6.2 → 0.8.0

package/types/internal/src/modules/purchases.d.ts

@@ -59,6 +59,58 @@ export type AppleAccount = {
     status?: "active" | "refused";
     xcode_certificate?: XcodeCertificate;
 };
+/**
+ * The environment's Google Play purchases.
+ */
+export type GoogleAccount = {
+    /**
+     * What the person has to do next.
+     */
+    action?: string;
+    /**
+     * The registry's id of the Android app purchases are made in.
+     */
+    app_id?: string;
+    /**
+     * Google Play purchases are connected for one of the environment's Android apps.
+     */
+    connected: boolean;
+    connected_at?: string;
+    connected_by?: string;
+    /**
+     * Where Pub/Sub pushes the notifications for this environment.
+     */
+    notification_url?: string;
+    /**
+     * Its package name.
+     */
+    package_name?: string;
+    /**
+     * What Play last let the connection's account reach (the stores module's check).
+     */
+    play_status?: "invited" | "active" | "refused";
+    /**
+     * The project's Play connection's account (the stores module made it; its Play Console invites it): the account purchases are read and acknowledged as. Absent while the project has no Play connection.
+     */
+    service_account?: string;
+    /**
+     * The topic the app's Play Console names for real-time developer notifications (Monetize with Play › Monetization setup), in Palbase's Cloud project: Play's own account may publish to it. Every environment of the project selling in the app reads it.
+     */
+    topic?: string;
+    /**
+     * When a test notification arrived (Play Console's Send test notification): the topic is set.
+     */
+    verified_at?: string;
+};
+/**
+ * The Android app Google Play purchases are made in.
+ */
+export type GoogleConnectRequest = {
+    /**
+     * One of the environment's Android apps (the registry's id).
+     */
+    app_id: string;
+};
 /**
  * What names the customer to the App Store without saying who they are.
  */
@@ -68,6 +120,15 @@ export type AppleAccountToken = {
      */
     app_account_token: string;
 };
+/**
+ * What names the customer to Google Play without saying who they are.
+ */
+export type GoogleAccountID = {
+    /**
+     * The customer's, for the connected app: pass it to the billing flow (BillingFlowParams.Builder.setObfuscatedAccountId). Play's answers carry it back, and the purchase is the customer's before their app reports it.
+     */
+    obfuscated_account_id: string;
+};
 /**
  * What the stores module answered of a plan's App Store part once it was confirmed: absent until it answers.
  */
@@ -124,6 +185,12 @@ export type AppleNotification = {
     signedPayload: string;
     [key: string]: unknown;
 };
+/**
+ * Pub/Sub's push of a Play real-time developer notification, as Pub/Sub sends it: its message's data is the notification (DeveloperNotification, base64), its messageId the push's own.
+ */
+export type GooglePush = {
+    [key: string]: unknown;
+};
 /**
  * Where the App Store reports the app's purchases, and whether it does.
  */
@@ -205,6 +272,47 @@ export type AppleStepResult = {
      */
     store_id: string;
 };
+/**
+ * What the stores module answered of a plan's Google Play part, once it wrote it (pending until then): Play's state, step by step.
+ */
+export type GoogleCatalogResult = {
+    plan_id: string;
+    /**
+     * The app it was written for.
+     */
+    package_name: string;
+    /**
+     * The stores module has not answered yet.
+     */
+    pending?: boolean;
+    /**
+     * Every step was written.
+     */
+    ok: boolean;
+    /**
+     * Why it was not, in Play's words.
+     */
+    error?: string;
+    steps: GoogleStepResult[];
+};
+/**
+ * A step of the Google Play part as Play holds it now.
+ */
+export type GoogleStepResult = {
+    op: string;
+    /**
+     * The product's id at Play.
+     */
+    store_id: string;
+    /**
+     * Its state at Play (a base plan's: ACTIVE, DRAFT; a one-time product's).
+     */
+    state?: string;
+    /**
+     * Why it was not written, in Play's words.
+     */
+    error?: string;
+};
 /**
  * What StoreKit gave the customer's app.
  */
@@ -222,6 +330,36 @@ export type AppleTransactionReport = {
      */
     transactions: string[];
 };
+/**
+ * What Play Billing gave the customer's app.
+ */
+export type GooglePurchaseReport = {
+    /**
+     * The purchases: one just made (PurchasesUpdatedListener), or every one queryPurchasesAsync returns on a restore.
+     */
+    purchases: GoogleReported[];
+    /**
+     * The customer asked to restore their purchases: each moves to them from the customer that has it — never an account's by a guest's restore, and one purchase 3 times in 30 days at most; one that stays is answered (403, 409) once the rest is applied. Without it, a purchase another customer has stays theirs.
+     */
+    restore?: boolean;
+};
+/**
+ * A purchase Play Billing gave the app.
+ */
+export type GoogleReported = {
+    /**
+     * Its product (Purchase.getProducts()).
+     */
+    product_id: string;
+    /**
+     * Its token (Purchase.getPurchaseToken()).
+     */
+    purchase_token: string;
+    /**
+     * It is a subscription's (ProductType.SUBS); a one-time product's otherwise.
+     */
+    subscription?: boolean;
+};
 /**
  * What the Stripe account holds of the catalog once a plan was written, read back from Stripe; null maps when the plan failed before reading it.
  */
@@ -295,7 +433,7 @@ export type Catalog = {
     products: Product[];
 };
 /**
- * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store part.
+ * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store or Google Play part.
  */
 export type CatalogAppliedEvent = {
     /**
@@ -313,7 +451,7 @@ export type CatalogAppliedEvent = {
     /**
      * The store written.
      */
-    store: "stripe" | "app_store";
+    store: "stripe" | "app_store" | "play_store";
 };
 /**
  * purchases.catalog.changed: a new revision of the catalog was saved; plans of older ones went stale.
@@ -417,6 +555,7 @@ export type CatalogPlan = {
      */
     error?: string;
     google: StorePlan;
+    google_result?: GoogleCatalogResult;
     /**
      * The plan's id.
      */
@@ -654,7 +793,7 @@ export type ChartDefinition = {
     window: boolean;
 };
 /**
- * What a chart is segmented or filtered by.
+ * What a chart is segmented or filtered by, with the values a filter can name in this project.
  */
 export type ChartDimension = {
     /**
@@ -665,6 +804,10 @@ export type ChartDimension = {
      * The dimension.
      */
     key: "store" | "platform" | "country" | "product" | "plan" | "duration" | "sandbox" | "paywall" | "experiment";
+    /**
+     * What a filter can name, each with what it is called: all of a closed dimension's values (store, platform, sandbox); the current catalog's products, plans and billing periods (with unmapped, one_time and unknown, what a chart gives what matches none); the project's paywalls and its experiments' variants (<experiment_id>:<variant>), with none. A country lists none: it is any ISO 3166-1 alpha-2 code, or unknown.
+     */
+    values?: ChartValue[];
 };
 /**
  * A value a dimension is filtered to.
@@ -846,6 +989,10 @@ export type Checkout = {
      * Where the customer pays.
      */
     url: string;
+    /**
+     * With the app's key alone: the key the success page asks the buyer's redemption link with (POST /purchases/stripe/checkout/redemption). Keep it in the page's own storage, never in a URL: whoever holds it and the session's id is shown the link.
+     */
+    redemption_key?: string;
 };
 /**
  * The error envelope of a refused checkout, with where the customer already has it when that is why (`already_entitled`): buying it again would charge twice for one thing.
@@ -881,7 +1028,7 @@ export type CheckoutConflictError = {
     store?: "app_store" | "play_store" | "stripe";
 };
 /**
- * What the signed-in customer buys on the web.
+ * What is bought on the web, and where it was opened.
  */
 export type CheckoutRequest = {
     /**
@@ -897,9 +1044,10 @@ export type CheckoutRequest = {
      */
     product: string;
     /**
-     * Where Stripe sends the customer back once paid: a registered web app's origin, or a native app's own scheme.
+     * Where Stripe sends the buyer back once paid: a registered web app's origin, or a native app's own scheme. Stripe replaces `{CHECKOUT_SESSION_ID}` in it with the session's id: the page asks the redemption link with it.
      */
     success_url: string;
+    source?: CheckoutSource;
 };
 /**
  * What calling a leader takes — every variant seen by min_viewers subjects, the leader's chance to win min_chance — and what the results still lack, reason by reason: none, they are confident.
@@ -4490,6 +4638,14 @@ export type Settings = {
      * When the settings were last changed; absent while they are the defaults.
      */
     updated_at?: string | null;
+    /**
+     * What the App Store takes of a web purchase bought through a link out of an iOS app in its United States storefront (a checkout whose source is ios, USA), which the charts' proceeds take off: its share in basis points of the price net of tax (0 unless set: it takes nothing today, Guideline 3.1.1(a); a court is deciding what it may), up to 3000.
+     */
+    app_store_link_fee_bps: number;
+    /**
+     * For how many days after the link a purchase owes the App Store its fee (7 unless set), 1 to 90: a subscription's renewals past them owe none.
+     */
+    app_store_link_attribution_days: number;
 };
 /**
  * A change of the settings: the fields given change, the others stay.
@@ -4531,6 +4687,14 @@ export type SettingsUpdate = {
      * Where the quotas' calendar windows (a day, a month) begin: an IANA name such as Europe/Istanbul.
      */
     time_zone?: string;
+    /**
+     * What the App Store takes of a web purchase bought through a link out of an iOS app in its United States storefront (a checkout whose source is ios, USA), which the charts' proceeds take off: its share in basis points of the price net of tax (0 unless set: it takes nothing today, Guideline 3.1.1(a); a court is deciding what it may), up to 3000.
+     */
+    app_store_link_fee_bps?: number;
+    /**
+     * For how many days after the link a purchase owes the App Store its fee (7 unless set), 1 to 90: a subscription's renewals past them owe none.
+     */
+    app_store_link_attribution_days?: number;
 };
 /**
  * What a commit, an extension or a reversal takes; a release takes nothing.
@@ -4619,7 +4783,7 @@ export type SpendReceipt = {
  */
 export type SpendRequest = CreditSpendRequest | QuotaSpendRequest;
 /**
- * purchases.store.changed: the project's Stripe account or In-App Purchase key was connected, disconnected, or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
+ * purchases.store.changed: the project's Stripe account or In-App Purchase key or Google Play purchases were connected, disconnected, verified (a test notification arrived), or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
  */
 export type StoreChangedEvent = {
     /**
@@ -4633,15 +4797,19 @@ export type StoreChangedEvent = {
     /**
      * What happened.
      */
-    change: "connected" | "active" | "refused" | "disconnected";
+    change: "connected" | "active" | "refused" | "disconnected" | "verified";
     /**
      * Whether the key is a live one (Stripe's, connected).
      */
     livemode?: boolean;
+    /**
+     * The Android app Google Play purchases are connected for (Play's).
+     */
+    package_name?: string;
     /**
      * The store.
      */
-    store: "stripe" | "app_store";
+    store: "stripe" | "app_store" | "play_store";
 };
 /**
  * One store's part of a plan.
@@ -4979,10 +5147,100 @@ export type XcodeCertificateRequest = {
      */
     certificate: string;
 };
+/**
+ * A value of a dimension, as a filter names it, and what it is called.
+ */
+export type ChartValue = {
+    /**
+     * The value a filter names (filter=dimension:key).
+     */
+    key: string;
+    /**
+     * What it is called: a store's or a product's name, a paywall's, an experiment's and its variant's.
+     */
+    label: string;
+};
+/**
+ * Where a checkout was opened: an app linking out to buy on the web says its platform and its store's storefront. Kept with the checkout as the record of the link.
+ */
+export type CheckoutSource = {
+    /**
+     * The app's platform.
+     */
+    platform: "ios" | "android" | "web";
+    /**
+     * The store's storefront the app runs in, ISO 3166-1 alpha-3 (StoreKit's Storefront.countryCode: USA).
+     */
+    storefront?: string;
+};
+/**
+ * A one-time link to redeem a purchase made on the web by a buyer without an account: opened on the phone with the app, it hands the app its token (`<scheme>://palbase/redeem?token=…`), and the app's user redeems it.
+ */
+export type RedemptionLink = {
+    /**
+     * The link's page (/purchases/redeem?token=…).
+     */
+    url: string;
+    /**
+     * When it stops working; opened after, it sends a new one to the buyer's email. An emailed link's hour starts when it is sent.
+     */
+    expires_at: string;
+};
+/**
+ * A redemption link to redeem.
+ */
+export type RedeemRequest = {
+    /**
+     * The link's token: what the app was handed (`token` of `<scheme>://palbase/redeem?token=…`).
+     */
+    token: string;
+};
+/**
+ * The error envelope of an expired redemption link: `resent` says a new one went to the address the buyer gave at checkout.
+ */
+export type RedemptionExpiredError = {
+    /**
+     * Machine-readable error code (snake_case)
+     */
+    error: string;
+    /**
+     * Human-readable explanation
+     */
+    error_description: string;
+    /**
+     * Correlation ID for log/audit lookup
+     */
+    request_id: string;
+    /**
+     * A new link was sent to the buyer's email: with `redemption_expired`.
+     */
+    resent?: boolean;
+    /**
+     * Seconds to wait before retrying; present on a refusal that ends with time.
+     */
+    retry_after?: number;
+    /**
+     * HTTP status code (mirrors the response status)
+     */
+    status: number;
+};
+/**
+ * A checkout's redemption link to show: the checkout's session, and the key its opener was given — the project's secret key asks with none.
+ */
+export type RedemptionRequest = {
+    /**
+     * The Checkout session's id (Stripe's `{CHECKOUT_SESSION_ID}`).
+     */
+    session_id: string;
+    /**
+     * The checkout's `redemption_key`.
+     */
+    key?: string;
+};
 /** The events this module sends the project's webhooks (x-palbase-events), by type: each one's payload, the event's data. */
 export interface Events {
     /**
-     * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store part.
+     * purchases.catalog.applied: a plan's Stripe part was written (applied) or failed; or the stores module answered of its App Store or Google Play part.
      */
     "purchases.catalog.applied": CatalogAppliedEvent;
     /**
@@ -5038,7 +5296,7 @@ export interface Events {
      */
     "purchases.refund.changed": RefundChangedEvent;
     /**
-     * purchases.store.changed: the project's Stripe account or In-App Purchase key was connected, disconnected, or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
+     * purchases.store.changed: the project's Stripe account or In-App Purchase key or Google Play purchases were connected, disconnected, verified (a test notification arrived), or (Stripe) checked and Stripe's answer changed (active, refused). Never the key.
      */
     "purchases.store.changed": StoreChangedEvent;
     /**
@@ -5120,6 +5378,23 @@ export declare function client(t: Transport): {
         body: AppleTransactionReport; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * Get the customer's obfuscated account id
+     *
+     * The signed-in customer's obfuscated account id for the connected app — a guest's too: random, made the first time it is asked for, the same afterwards. The app passes it to Play Billing's billing flow; Play's answers carry it back, so a purchase is the customer's before the app reports it, and nothing personal goes to Google. A guest's goes with it when it merges into an account.
+     */
+    getGoogleAccountId(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, GoogleAccountID>>;
+    /**
+     * Report Play Billing's purchases
+     *
+     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the purchases Play Billing gave it: one just made, or on a restore every one queryPurchasesAsync returns. Nothing of the device's word is taken: each is read from Play by its token, as the project's Play connection account, and applied to the ledger. Whose a purchase is: one nobody has becomes the customer's its obfuscated account id names, or the reporter's; one another customer has stays theirs — unless `restore`, which moves it to the reporter (an account's is never taken by a guest's restore, and one purchase moves 3 times in 30 days at most); one that stays is answered once the rest is applied (403 `restore_account_owned`, 409 `restore_limit`). A purchase the catalog maps is acknowledged — a consumable's consumed — once the ledger has it (Play refunds one not acknowledged in three days); one it does not map gives nothing and is not acknowledged.
+     */
+    reportGooglePurchases(input: {
+        body: GooglePurchaseReport; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
     /**
      * Take Xcode's StoreKit Testing purchases
      *
@@ -5143,6 +5418,37 @@ export declare function client(t: Transport): {
         }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<204, undefined>>;
+    /**
+     * Read the Google Play purchases
+     *
+     * The environment's Google Play purchases: the project's Play connection (the stores module's; its account reads and acknowledges purchases), the Android app they are made in, the topic its Play Console names, and whether a test notification proved it — with what to do next.
+     */
+    getGoogleAccount(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, GoogleAccount>>;
+    /**
+     * Connect Google Play purchases
+     *
+     * Sells in one of the environment's Android apps on Google Play: the app's topic is made in Palbase's Cloud project (Play's own account may publish to it; every environment of the project selling in the app shares it) and this environment's push subscription of it, to its own address, signed. The project's Play connection must exist (the stores module's: palbase stores:google:connect). Connected again for the same app, nothing changes. Then, in Play Console: Monetize with Play › Monetization setup, the topic, Send test notification. Emits `purchases.store.changed` (connected).
+     */
+    connectGoogle(input: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: GoogleConnectRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, GoogleAccount> | Reply<201, GoogleAccount>>;
+    /**
+     * Disconnect Google Play purchases
+     *
+     * Deletes this environment's push subscription and forgets the app: Play's notifications stop reaching it, and the apps' reports are refused. Purchases already made stay in the ledger. The app's topic stays (another environment of the project may read it). Emits `purchases.store.changed` (disconnected).
+     */
+    disconnectGoogle(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
     /**
      * Read the catalog
      *
@@ -5238,7 +5544,7 @@ export declare function client(t: Transport): {
     /**
      * Read the charts' overview
      *
-     * The project's figures at a glance: MRR, active subscriptions and active trials now; revenue (of revenue_type), new customers and active customers over the last 28 days, today included — each as its chart counts it. Money is in the reporting currency (or currency); an amount in a currency the European Central Bank does not publish is left out and named (unconverted). A replica computes two charts (the overview among them) at once and one of a project; another is refused at once as busy (503 `charts_busy`, Retry-After), and so is one that takes longer than 15 seconds. The same request within a minute is answered from the replica's cache (a change of the project's settings drops it there). A replica computes 3 charts of a project in a row, then one each 10 seconds (6 a minute); past that a chart is refused (429 `too_many_charts`, Retry-After) — an answer from the cache is not counted.
+     * The project's figures at a glance: MRR, active subscriptions and active trials now; revenue (of revenue_type), new customers and active customers over the last 28 days, today included — each as its chart counts it. Money is in the reporting currency (or currency); an amount in a currency the European Central Bank does not publish is left out and named (unconverted). A replica computes two charts (the overview among them) at once and one of a project; another is refused at once as busy (503 `charts_busy`, Retry-After), and so is one that takes longer than 15 seconds. The same request within a minute is answered from the replica's cache (a change of the project's settings drops it there). A replica computes 20 charts of a project in a row, then one each 2 seconds (30 a minute); past that a chart is refused (429 `too_many_charts`, Retry-After) — an answer from the cache is not counted.
      */
     getChartsOverview(input?: {
         query?: {
@@ -5251,7 +5557,7 @@ export declare function client(t: Transport): {
     /**
      * Read a chart
      *
-     * One chart of the project's ledger, period by period (GET /purchases/charts says what each counts). Periods are UTC days, ISO weeks (Monday to Sunday) or calendar months, the first and the last cut to `from` and `to` (both included, at most two years apart; `to` later than today is today). A flow counts what happened in the period, a snapshot is the state at its end (now, for the period now is in), a ratio divides its measures, a cohort follows what began in the period over its ages. The ledger is read whole each time: a refund arriving later, a renewal, a product change, a guest merged into an account and a change of the settings are in the next answer. Money is converted to the reporting currency (or `currency`) at the European Central Bank's reference rate of the day it was paid; what is in a currency it does not publish is left out and named (`unconverted`). A store's test purchases count only with sandbox=true. `segment` splits a segmentable chart by a dimension: the 20 largest values each a segment, the rest together in one keyed `(other)` (the segments' sum is the whole; a subscription changing segment is churned in one and moved in to the other); `filter` (repeated, one dimension:value each) keeps what has one of the values given for each dimension named. The paywall and experiment dimensions attribute a subscription whose first purchase is in the days asked for (by the exposures of those days and the 7 before); an older one is `none`. A cohort chart follows at most 120 cohorts (by day, 120 days). Answered as CSV when the request accepts text/csv first: a row a segment and period (and age, for a cohort), its value, its measures. The ledger is read customer by customer, never held whole. A customer holding more than 20,000 transactions is refused (422 `chart_too_large`). The same request within a minute is answered from the replica's cache (a change of the project's settings drops it there). A replica computes two charts at once and one of a project; another is refused at once as busy (503 `charts_busy`, Retry-After), and so is one whose reading and computing take longer than 15 seconds. A replica computes 3 charts of a project in a row, then one each 10 seconds (6 a minute); past that a chart is refused (429 `too_many_charts`, Retry-After) — an answer from the cache is not counted.
+     * One chart of the project's ledger, period by period (GET /purchases/charts says what each counts). Periods are UTC days, ISO weeks (Monday to Sunday) or calendar months, the first and the last cut to `from` and `to` (both included, at most two years apart; `to` later than today is today). A flow counts what happened in the period, a snapshot is the state at its end (now, for the period now is in), a ratio divides its measures, a cohort follows what began in the period over its ages. The ledger is read whole each time: a refund arriving later, a renewal, a product change, a guest merged into an account and a change of the settings are in the next answer. Money is converted to the reporting currency (or `currency`) at the European Central Bank's reference rate of the day it was paid; what is in a currency it does not publish is left out and named (`unconverted`). A store's test purchases count only with sandbox=true. `segment` splits a segmentable chart by a dimension: the 20 largest values each a segment, the rest together in one keyed `(other)` (the segments' sum is the whole; a subscription changing segment is churned in one and moved in to the other); `filter` (repeated, one dimension:value each) keeps what has one of the values given for each dimension named. The paywall and experiment dimensions attribute each subscription once, when its first purchase is recorded: to the paywall (and the experiment's variant) its owner — or a guest merged into the owner — saw first within the 7 days before that purchase, as the experiments' results count it; one that followed none is `none`, its renewals in any later days included. A cohort chart follows at most 120 cohorts (by day, 120 days). Answered as CSV when the request accepts text/csv first: a row a segment and period (and age, for a cohort), its value, its measures. The ledger is read customer by customer, never held whole. A customer holding more than 20,000 transactions is refused (422 `chart_too_large`). The same request within a minute is answered from the replica's cache (a change of the project's settings drops it there). A replica computes two charts at once and one of a project; another is refused at once as busy (503 `charts_busy`, Retry-After), and so is one whose reading and computing take longer than 15 seconds. A replica computes 20 charts of a project in a row, then one each 2 seconds (30 a minute); past that a chart is refused (429 `too_many_charts`, Retry-After) — an answer from the cache is not counted.
      */
     getChart(input: {
         path: {
@@ -6001,12 +6307,41 @@ export declare function client(t: Transport): {
     /**
      * Buy on the web
      *
-     * Opens a Stripe Checkout session for the signed-in customer to buy one of the catalog's products sold on the web, at the plan's price on the project's Stripe account: send the customer to `url`. Stripe sends them back to `success_url` or `cancel_url`, which go back to one of the project's registered apps — a web app's origin, or a native app's own scheme — and nowhere else. What is bought on the web is the account's on every device: a guest is refused. A customer who already has the product, or a subscription of its group, from any store is refused (409 `already_entitled`, naming the store to manage it in): nothing is charged twice. Credits can always be bought again. A free trial is given once per customer, across every channel. The purchase is the customer's once Stripe reports it (POST /purchases/webhooks/stripe).
+     * Opens a Stripe Checkout session to buy one of the catalog's products sold on the web, at the plan's price on the project's Stripe account: send the buyer to `url`. Stripe sends them back to `success_url` or `cancel_url`, which go back to one of the project's registered apps — a web app's origin, or a native app's own scheme — and nowhere else. With a customer's session — a guest's as well: what a guest buys is theirs, and goes with them to the account they sign in to — the purchase is that customer's; a customer who already has the product, or a subscription of its group, from any store is refused (409 `already_entitled`, naming the store to manage it in): nothing is charged twice. Credits can always be bought again. A free trial is given once per customer, across every channel, and not to a guest: a new one is free to make. With the app's key alone (no session) the buyer is no one yet: Checkout asks their email, no free trial is given, and what they buy waits for the app user who redeems it — its link is shown on the success page to the holder of `redemption_key` (POST /purchases/stripe/checkout/redemption) and sent to that email. Checkouts are limited per address and per project with the app's key alone, per customer and per address with a session (429 `too_many_checkouts`). `source` records where the checkout was opened: an app linking out to buy on the web (the App Store's United States storefront allows it, Guideline 3.1.1(a)) says its platform and storefront, and the charts take the App Store's link fee (settings) off what it brings. The checkout is kept as the record of it. The purchase is applied once Stripe reports it (POST /purchases/webhooks/stripe).
      */
     createCheckout(input: {
         body: CheckoutRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<201, Checkout>>;
+    /**
+     * A web purchase's redemption link
+     *
+     * The link a checkout's success page shows its buyer, who has no account (a checkout opened with the app's key alone): to the holder of the key the checkout's opener was given (`redemption_key`), a new one each time asked, ten at most, within an hour of the payment — past it the link is the email's alone. A session Stripe has not reported yet is read from Stripe. The project's secret key — its support, for a buyer whose email went astray — is shown one at any time, with no key. Limited per address and per project with the app's key alone, per customer and per address with a session. Closed to an environment's token (403 `token_out_of_scope`): the link hands a purchase to whoever opens it.
+     */
+    createCheckoutRedemption(input: {
+        body: RedemptionRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, RedemptionLink>>;
+    /**
+     * Redeem a web purchase
+     *
+     * Redeems a link to a purchase made on the web by a buyer without an account: the purchase becomes the session's customer's — a guest's goes with them to the account they sign in to, as all a guest has. A link works once, for an hour; once one of a purchase's links is redeemed, all of them are spent. An expired link sends a new one to the address the buyer gave at checkout (410 `redemption_expired`, `resent`), once. Limited per customer and per address. Answers what the customer has now.
+     */
+    redeemPurchase(input: {
+        body: RedeemRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, CustomerInfo>>;
+    /**
+     * The redemption page
+     *
+     * The page a redemption link opens: a button per app of the project's that hands the app the link (`<scheme>://palbase/redeem?token=…`), and the link as a QR code to scan with the phone when it is opened elsewhere. It reads nothing of the link: the app redeems it (POST /purchases/redemptions/redeem). No credential: the link is the authorization; its token is a query's, which no request log keeps.
+     */
+    getRedemptionPage(input: {
+        query: {
+            token: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, Response>>;
     /**
      * Grant a key's connection
      *
@@ -6036,6 +6371,15 @@ export declare function client(t: Transport): {
         body: AppleNotification; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<200, undefined>>;
+    /**
+     * Receive a Google Play notification
+     *
+     * Where Pub/Sub pushes the connected app's real-time developer notifications — no key: the push carries an OIDC token Google minted for Palbase's push account, for this environment's own address, and anything else is refused. A notification only says something changed: what it is, is read from Play by its token as the project's Play connection account and applied to the ledger; a voided purchase's, by reading the app's voided purchases. Each push is kept once, sealed, by its message id: one pushed again is answered and not applied twice. A test notification proves the topic (`verified_at`). Another app's notification is taken and ignored. Pub/Sub hears 204 once that is written; a 503 (Google unreachable), and it pushes it again.
+     */
+    receiveGoogleNotification(input: {
+        body: GooglePush; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
     /**
      * Take Stripe's notification
      *

package/types/internal/src/modules/realtime.d.ts

@@ -56,6 +56,14 @@ export type ChannelRule = {
      * A public channel's subscribers may write its state.
      */
     state_write?: boolean;
+    /**
+     * The channel keeps its broadcasts, numbered, and a member that was away is given what it missed, in order and once, when it rejoins after the number it had (phx_join config.log.after; the join's reply says the number it starts after, log_seq). A broadcast's number (seq) is its channel's own — the time it was written, in microseconds, rising in the channel — and says nothing of other channels. Kept a day unless log_keep_seconds says how long. What a project's durable channels write is held to a budget an hour, each message weighed by the hours it is kept: past it a durable broadcast is refused (log_budget) until the next hour.
+     */
+    durable?: boolean;
+    /**
+     * How long a durable channel keeps its broadcasts, in seconds: 1 to 604800 (a week). Naming it makes the channel durable.
+     */
+    log_keep_seconds?: number;
 };
 export type ChannelSubscribers = {
     /**
@@ -160,6 +168,33 @@ export type RealtimeStats = {
      */
     window_seconds: number;
 };
+/**
+ * The memberships to decide again: a topic, or a pattern and the values of some of its captures.
+ */
+export type Revalidation = {
+    /**
+     * With a topic and no user: the channel is over — every member dropped unasked, its log forgotten.
+     */
+    end?: boolean;
+    /**
+     * Values of the pattern's captures: a capture not named is any value.
+     */
+    params?: {
+        [key: string]: string;
+    };
+    /**
+     * A gateway's pattern, as chat:{chatId}:user:{userId}.
+     */
+    pattern?: string;
+    /**
+     * One channel of the project's.
+     */
+    topic?: string;
+    /**
+     * Only this user's memberships.
+     */
+    user?: string;
+};
 export type StateApplied = {
     /**
      * The operations applied.
@@ -255,7 +290,7 @@ export declare function client(t: Transport): {
     /**
      * Broadcast as the server
      *
-     * Publishes events on the project's channels, to every subscriber on every replica, as the project's server (1 to 100 events). Delivered at most once, like every broadcast.
+     * Publishes events on the project's channels, to every subscriber on every replica, as the project's server (1 to 100 events). Delivered at most once, like every broadcast — but on a durable channel, kept and given to its members in order and once. A durable channel's event past the project's hourly budget is refused with 429 log_budget and when to try again (Retry-After); the events before it were published.
      */
     broadcast(input: {
         body: BroadcastBatch; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -295,6 +330,15 @@ export declare function client(t: Transport): {
         body: RealtimeLimitsWrite; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<200, RealtimeLimits>>;
+    /**
+     * Decide a channel's members again
+     *
+     * Decides again, on every replica, who may be on the project's channels it names, and drops the members no longer allowed: the project's server says a decision its machine made may no longer hold — a member taken out of a chat, a team changed. A channel (topic), or every channel of a gateway's pattern whose named captures have the values given (pattern, params); only one user's memberships (user); or, with a topic, the channel's end (end): every member dropped unasked, and its log forgotten. A dropped member's client is told the channel closed, and its rejoin is decided on the merits.
+     */
+    revalidate(input: {
+        body: Revalidation; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<202, undefined>>;
     /**
      * Write state as the server
      *