react-native-iap 15.5.1 → 15.5.3

package/src/kit-api.ts

@@ -40,6 +40,71 @@ export type StatusResponse = {
   subscription: KitSubscription | null;
 };
 
+export type KitProductPlatform = "IOS" | "Android";
+
+export type KitProductClientPayload = {
+  format: "toml" | "json" | "text";
+  body: string;
+  version: number;
+  updatedAt: number;
+};
+
+export type KitProductOffer = {
+  id: string;
+  kind:
+    | "FreeTrial"
+    | "IntroPayUpFront"
+    | "IntroPayAsYouGo"
+    | "PromotionalOffer"
+    | "BasePlan";
+  duration?: string;
+  numberOfPeriods?: number;
+  priceAmountMicros?: number;
+  currency?: string;
+};
+
+export type KitProduct = {
+  productId: string;
+  platform: KitProductPlatform;
+  type: "Subscription" | "NonConsumable" | "Consumable";
+  title: string;
+  description?: string;
+  priceAmountMicros?: number;
+  currency?: string;
+  state: "Draft" | "Ready" | "Active" | "Removed";
+  storeRef?: string;
+  subscriptionGroupId?: string;
+  subscriptionGroupName?: string;
+  billingPeriod?: "P1W" | "P1M" | "P2M" | "P3M" | "P6M" | "P1Y";
+  offers?: KitProductOffer[];
+  updatedAt: number;
+  clientPayload?: KitProductClientPayload;
+};
+
+export type KitProductsOptions = {
+  platform?: KitProductPlatform;
+  /** Include public client payload bodies in a bounded platform page. */
+  includeClientPayload?: boolean;
+  /** Page size for payload-inclusive reads (default 25, maximum 50).
+   * Ignored by the legacy non-payload catalog path. */
+  limit?: number;
+  /** Opaque cursor returned as `nextCursor` by the previous payload page.
+   * Ignored by the legacy non-payload catalog path. */
+  cursor?: string;
+};
+
+export type KitProductsResponse = {
+  products: KitProduct[];
+  /** Present on payload-inclusive catalog pages. */
+  hasMore?: boolean;
+  /** Present when a payload-inclusive catalog page has another page. */
+  nextCursor?: string;
+};
+
+export type KitClientPayloadResponse = {
+  clientPayload: KitProductClientPayload;
+};
+
 const DEFAULT_BASE_URL = "https://kit.openiap.dev";
 
 // Merge caller-supplied headers with kit defaults (`accept`,
@@ -210,6 +275,48 @@ export function kitApi(options: KitApiOptions) {
         `/v1/subscriptions/entitlements/${encodeURIComponent(options.apiKey)}?userId=${encodeURIComponent(userId)}`,
       ),
 
+    /** GET /v1/products — read the store-synced catalog. Client payloads
+     * are excluded unless explicitly requested because they may add up to
+     * 16 KiB per product. */
+    products: (productOptions: KitProductsOptions = {}) => {
+      if (
+        productOptions.includeClientPayload === true &&
+        !productOptions.platform
+      ) {
+        throw new Error(
+          "kitApi.products requires platform when includeClientPayload is true",
+        );
+      }
+      const query = new URLSearchParams();
+      if (productOptions.platform) {
+        query.set("platform", productOptions.platform);
+      }
+      if (productOptions.includeClientPayload !== undefined) {
+        query.set(
+          "includeClientPayload",
+          String(productOptions.includeClientPayload),
+        );
+      }
+      if (productOptions.limit !== undefined) {
+        query.set("limit", String(productOptions.limit));
+      }
+      if (productOptions.cursor !== undefined) {
+        query.set("cursor", productOptions.cursor);
+      }
+      const encodedQuery = query.toString();
+      const suffix = encodedQuery ? `?${encodedQuery}` : "";
+      return call<KitProductsResponse>(
+        `/v1/products/${encodeURIComponent(options.apiKey)}${suffix}`,
+      );
+    },
+
+    /** GET one public client payload by its store-specific natural key.
+     * Payloads are app-facing data; never store secrets in them. */
+    clientPayload: (productId: string, platform: KitProductPlatform) =>
+      call<KitClientPayloadResponse>(
+        `/v1/products/${encodeURIComponent(options.apiKey)}/${encodeURIComponent(productId)}/client-payload?platform=${encodeURIComponent(platform)}`,
+      ),
+
     /** POST /v1/subscriptions/bind-user — call after a successful
      * verifyReceipt so kit knows which userId owns the verified
      * `purchaseToken`. Idempotent. */

package/src/specs/RnIap.nitro.ts

@@ -100,6 +100,8 @@ export type IapkitPurchaseState =
   | 'unknown'
   | 'inauthentic';
 
+export type IapkitClientPayloadFormat = 'toml' | 'json' | 'text';
+
 // Store identifier for purchase origin
 // Defined locally for Nitro codegen (not in GQL schema)
 export type IapStore = 'unknown' | 'apple' | 'google' | 'horizon' | 'amazon';
@@ -473,6 +475,11 @@ export interface NitroVerifyPurchaseWithIapkitProps {
    */
   baseUrl?: string | null;
   google?: NitroVerifyPurchaseWithIapkitGoogleProps | null;
+  /**
+   * Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1.
+   * Include the product's public IAPKit client payload when available.
+   */
+  includeClientPayload?: boolean | null;
 }
 
 export interface NitroVerifyPurchaseWithProviderProps {
@@ -481,11 +488,22 @@ export interface NitroVerifyPurchaseWithProviderProps {
 }
 
 export interface NitroVerifyPurchaseWithIapkitResult {
+  /** Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1. */
+  clientPayload?: NitroIapkitProductClientPayload | null;
   isValid: boolean;
+  /** Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1. */
+  productId?: string | null;
   state: IapkitPurchaseState;
   store: IapStore;
 }
 
+export interface NitroIapkitProductClientPayload {
+  body: string;
+  format: IapkitClientPayloadFormat;
+  updatedAt: number;
+  version: number;
+}
+
 export interface NitroVerifyPurchaseWithProviderError {
   code?: string | null;
   message: string;

package/src/types.ts

@@ -617,6 +617,20 @@ export type IapPlatform = 'ios' | 'android';
 
 export type IapStore = 'unknown' | 'apple' | 'google' | 'horizon' | 'amazon';
 
+/** Serialization format of a public IAPKit product client payload. */
+export type IapkitClientPayloadFormat = 'toml' | 'json' | 'text';
+
+/**
+ * Public app-facing data attached to one store product in IAPKit.
+ * Never place credentials, signing keys, or server-authoritative rules here.
+ */
+export interface IapkitProductClientPayload {
+  body: string;
+  format: IapkitClientPayloadFormat;
+  updatedAt: number;
+  version: number;
+}
+
 /** Unified purchase states from IAPKit verification response. */
 export type IapkitPurchaseState = 'entitled' | 'pending-acknowledgment' | 'pending' | 'canceled' | 'expired' | 'ready-to-consume' | 'consumed' | 'unknown' | 'inauthentic';
 
@@ -1987,11 +2001,34 @@ export interface RequestVerifyPurchaseWithIapkitProps {
   baseUrl?: (string | null);
   /** Google Play Store verification parameters. */
   google?: (RequestVerifyPurchaseWithIapkitGoogleProps | null);
+  /**
+   * Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1.
+   * Include the product's public IAPKit client payload in a valid Apple or
+   * Google verification response. Defaults to false so existing response
+   * shapes and bandwidth remain unchanged.
+   */
+  includeClientPayload?: (boolean | null);
 }
 
 export interface RequestVerifyPurchaseWithIapkitResult {
-  /** Whether the purchase is valid (not falsified). */
+  /**
+   * Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1.
+   * Public product payload when includeClientPayload was requested, the
+   * Apple or Google receipt is valid, and a payload exists for that product.
+   */
+  clientPayload?: (IapkitProductClientPayload | null);
+  /**
+   * True when the purchase is valid and actionable.
+   * Only entitled, pending-acknowledgment, or ready-to-consume return true.
+   * Callers must still match productId and use the platform plus app-owned product
+   * type to choose the fulfillment path.
+   */
   isValid: boolean;
+  /**
+   * Available in OpenIAP Spec 2.4.0 / openiap-apple 2.4.1 / openiap-google 2.4.1.
+   * Store-verified product identifier when the provider returns one.
+   */
+  productId?: (string | null);
   /** The current state of the purchase. */
   state: IapkitPurchaseState;
   store: IapStore;

package/src/vega-adapter.ts

@@ -4,6 +4,7 @@ import type {
   NitroProduct,
   NitroPurchase,
   NitroPurchaseResult,
+  NitroVerifyPurchaseWithIapkitResult,
   NitroVerifyPurchaseWithProviderProps,
   NitroVerifyPurchaseWithProviderResult,
   RnIap,
@@ -155,8 +156,7 @@ function isValidIpv4Address(address: string): boolean {
   return (
     octets.length === 4 &&
     octets.every(
-      (octet) =>
-        /^(?:0|[1-9]\d{0,2})$/.test(octet) && Number(octet) <= 255,
+      (octet) => /^(?:0|[1-9]\d{0,2})$/.test(octet) && Number(octet) <= 255,
     )
   );
 }
@@ -1236,10 +1236,7 @@ export function createVegaIapModule(service: VegaPurchasingService): RnIap {
     function readIapkitResult(
       json: Record<string, unknown>,
       status: number,
-    ): {
-      isValid: boolean;
-      state: IapkitPurchaseState;
-    } {
+    ): NitroVerifyPurchaseWithIapkitResult {
       if (
         typeof json.isValid !== 'boolean' ||
         typeof json.state !== 'string' ||
@@ -1251,9 +1248,19 @@ export function createVegaIapModule(service: VegaPurchasingService): RnIap {
         );
       }
 
+      const productId = json.productId;
+      if (productId != null && typeof productId !== 'string') {
+        throw createVegaError(
+          ErrorCode.ReceiptFailed,
+          `IAPKit returned malformed response (HTTP ${status}).`,
+        );
+      }
+
       return {
         isValid: json.isValid,
+        ...(productId == null ? {} : {productId}),
         state: normalizeIapkitState(json.state),
+        store: 'amazon',
       };
     }
 
@@ -1374,11 +1381,7 @@ export function createVegaIapModule(service: VegaPurchasingService): RnIap {
     const result = readIapkitResult(json, response.status);
     return {
       provider: 'iapkit',
-      iapkit: {
-        isValid: result.isValid,
-        state: result.state,
-        store: 'amazon',
-      },
+      iapkit: result,
     };
   };