{"_id":"@hyodotdev/openiap-commerce-protocol","_rev":"6-11855dbaebac002dcdfcde537e325f5f","name":"@hyodotdev/openiap-commerce-protocol","dist-tags":{"bootstrap":"0.0.0-bootstrap.0","next":"0.1.0-alpha.0","latest":"0.3.1"},"versions":{"0.0.0-bootstrap.0":{"name":"@hyodotdev/openiap-commerce-protocol","version":"0.0.0-bootstrap.0","author":{"name":"hyodotdev"},"license":"MIT","_id":"@hyodotdev/openiap-commerce-protocol@0.0.0-bootstrap.0","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"homepage":"https://openiap.dev","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"7a131b662dedc9a7f12900c2690ae4ee2aa87abd","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.0.0-bootstrap.0.tgz","fileCount":3,"integrity":"sha512-XNgOzJb/CyHt+xn0Lphg58corWgitipuYXPzcIZ61axDG/pV5caKtN/i6qQWDvhQCAyALWKejL5KUTwrpmm+7A==","signatures":[{"sig":"MEQCIC5ZHVhJjyGHRqLeMXfxe5Iq6Y+Uc6/y3h4xcbWcbx1OAiAvvlodNQI6j+QIiP+JFRhA8vV0QHxS41C5hXibvcL+Cw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":2022},"_from":"file:/var/folders/2r/04zpv09x6ns4kzm7bjkbslqr0000gn/T/openiap-npm-bootstrap-_ispnsuy/openiap-commerce-protocol/hyodotdev-openiap-commerce-protocol-0.0.0-bootstrap.0.tgz","_npmUser":{"name":"hyodotdev","email":"hyo@hyo.dev"},"_resolved":"/var/folders/2r/04zpv09x6ns4kzm7bjkbslqr0000gn/T/openiap-npm-bootstrap-_ispnsuy/openiap-commerce-protocol/hyodotdev-openiap-commerce-protocol-0.0.0-bootstrap.0.tgz","_integrity":"sha512-XNgOzJb/CyHt+xn0Lphg58corWgitipuYXPzcIZ61axDG/pV5caKtN/i6qQWDvhQCAyALWKejL5KUTwrpmm+7A==","repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.17.0","description":"Namespace registration for Vendor-neutral server-side commerce contract","directories":{},"_nodeVersion":"22.22.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/openiap-commerce-protocol_0.0.0-bootstrap.0_1789072774108_0.599383673628541","host":"s3://npm-registry-packages-npm-production"}},"0.1.0-alpha.0":{"name":"@hyodotdev/openiap-commerce-protocol","version":"0.1.0-alpha.0","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"author":{"name":"hyodotdev"},"license":"MIT","_id":"@hyodotdev/openiap-commerce-protocol@0.1.0-alpha.0","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"homepage":"https://openiap.dev/commerce-protocol","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"80135913616a028e126b6b1cf78c57dec4491450","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.1.0-alpha.0.tgz","fileCount":43,"integrity":"sha512-BGNqoluYa/kwePGhZVYgpoUWlCk3erx2iO4V9V+0885f2MyQgoubu30TIYldfjD4lrwJ2WKNJousn2HN+IW0NQ==","signatures":[{"sig":"MEUCIQCnsiyr585IxXWJv7Y8HE2W4xDOiLa6IMo9E378+M7GBgIgbTdYdFiaSbqUZTf5A3gPGlSqIGJSAWG7V0cDiTPA/XQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIG8S/2sJMNDSxggi0WTDWmtV/T7/UWGZAuK34Jyhl60RAiAEpvg0nwfHB5qfGpnM8R16oOh1rEhFfIxMUPoLFilQ2Q==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@hyodotdev%2fopeniap-commerce-protocol@0.1.0-alpha.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":692058},"main":"./src/index.mjs","type":"module","types":"./src/index.d.ts","exports":{".":{"types":"./src/index.d.ts","default":"./src/index.mjs"},"./schema/*":"./schema/*","./vectors/*":"./vectors/*","./examples/*":"./examples/*","./conformance":{"types":"./conformance/index.d.ts","default":"./conformance/index.mjs"},"./generated/openapi/*":"./generated/openapi/*","./generated/schemas/*":"./generated/schemas/*","./generated/vectors/*":"./generated/vectors/*","./generated/bindings/*":"./generated/bindings/*","./commerce-protocol.graphql":"./generated/commerce-protocol.graphql"},"gitHead":"ae7050db06f8c16e83bbf5be09612455e45ba4a1","scripts":{"test":"node scripts/assemble-schema.mjs --check && node scripts/build-json-schemas.mjs --check && node scripts/build-bundle.mjs --check && node scripts/build-lifecycle-vectors.mjs --check && node scripts/build-operations.mjs --check && prettier --check \"**/*.{graphql,json,md,mjs,ts}\" && vitest run test && node scripts/quickstart.mjs","build":"node scripts/assemble-schema.mjs && node scripts/build-json-schemas.mjs && node scripts/build-bundle.mjs && node scripts/build-lifecycle-vectors.mjs && node scripts/build-operations.mjs","quickstart":"node scripts/quickstart.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7e478e35-87ac-496a-b560-a5e08d8ac5c6"}},"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.19.0","description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","directories":{},"_nodeVersion":"24.20.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"packageManager":"bun@1.3.13","readmeFilename":"README.md","devDependencies":{"ajv":"^8.17.1","vitest":"^4.1.11","graphql":"^16.11.0","prettier":"^3.6.2"},"_npmOperationalInternal":{"tmp":"tmp/openiap-commerce-protocol_0.1.0-alpha.0_1789093101662_0.9476943528049573","host":"s3://npm-registry-packages-npm-production"}},"0.1.0":{"name":"@hyodotdev/openiap-commerce-protocol","version":"0.1.0","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"author":{"name":"hyodotdev"},"license":"MIT","_id":"@hyodotdev/openiap-commerce-protocol@0.1.0","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"homepage":"https://openiap.dev/commerce-protocol","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"888a136e943b5df8c02f942151ee08db9de8abea","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.1.0.tgz","fileCount":43,"integrity":"sha512-BZLfQ9/Ng2W7Iz2z9uOGIf8dGBoSobyoGJAbzHm1eEi1h5ybBqmu5McuNMm86VL83hCCsmE5okUuKfncttvjMg==","signatures":[{"sig":"MEUCIAjvWmQt6NbpApQ4X5F+/Dmv3yWWW9IRvT593CaAHw5PAiEA2JKSe8pvpzvsxtLK0cqpwlxfSqShfpXhBSvzUmWsggs=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCUyHafXB/7e+i4DBrfo5PRNsr3dzU1NpSv52UAA/fugAIhAKuW+gA2Y4F+u8W4dGp5U7lE98+9QfhXdjIwK6xKGFTP","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@hyodotdev%2fopeniap-commerce-protocol@0.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":692050},"main":"./src/index.mjs","type":"module","types":"./src/index.d.ts","exports":{".":{"types":"./src/index.d.ts","default":"./src/index.mjs"},"./schema/*":"./schema/*","./vectors/*":"./vectors/*","./examples/*":"./examples/*","./conformance":{"types":"./conformance/index.d.ts","default":"./conformance/index.mjs"},"./generated/openapi/*":"./generated/openapi/*","./generated/schemas/*":"./generated/schemas/*","./generated/vectors/*":"./generated/vectors/*","./generated/bindings/*":"./generated/bindings/*","./commerce-protocol.graphql":"./generated/commerce-protocol.graphql"},"gitHead":"668e813eebc9e04ab31cde6c9755c2ebff30fcb3","scripts":{"test":"node scripts/assemble-schema.mjs --check && node scripts/build-json-schemas.mjs --check && node scripts/build-bundle.mjs --check && node scripts/build-lifecycle-vectors.mjs --check && node scripts/build-operations.mjs --check && prettier --check \"**/*.{graphql,json,md,mjs,ts}\" && vitest run test && node scripts/quickstart.mjs","build":"node scripts/assemble-schema.mjs && node scripts/build-json-schemas.mjs && node scripts/build-bundle.mjs && node scripts/build-lifecycle-vectors.mjs && node scripts/build-operations.mjs","quickstart":"node scripts/quickstart.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7e478e35-87ac-496a-b560-a5e08d8ac5c6"}},"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.19.0","description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","directories":{},"_nodeVersion":"24.20.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"packageManager":"bun@1.3.13","devDependencies":{"ajv":"^8.17.1","vitest":"^4.1.11","graphql":"^16.11.0","prettier":"^3.6.2"},"_npmOperationalInternal":{"tmp":"tmp/openiap-commerce-protocol_0.1.0_1789133346401_0.5479454523057212","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@hyodotdev/openiap-commerce-protocol","version":"0.2.0","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"author":{"name":"hyodotdev"},"license":"MIT","_id":"@hyodotdev/openiap-commerce-protocol@0.2.0","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"homepage":"https://openiap.dev/commerce-protocol","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"e1f4890684cb0de4928a93e4d0b783abcc745faf","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.2.0.tgz","fileCount":46,"integrity":"sha512-F93UYiysSJylevdNIRt7m63v7uPCiFBu211+RDtEkZPMDb/pB9JXwDzTqtlz+ewYhC1WcHetDX+K48KYeXXGrg==","signatures":[{"sig":"MEUCIQCg5xSNeXCUYAXMn3t5tz3pEt54Z1fbwiAnbDjMW9NwPAIgGspcCLmAzYa0LYjj0DhV7cM/2E4wqsj1gvz5fkj+E84=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCGLdb2jnFkrtMNb+ny2W2zR9Jt/+WaHeWo54CF5ZlpIQIhALZWCRjyNvJJndIhKAXyYEhQQ3DeputsFm9UTpG5HrrM","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@hyodotdev%2fopeniap-commerce-protocol@0.2.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":733022},"main":"./src/index.mjs","type":"module","types":"./src/index.d.ts","exports":{".":{"types":"./src/index.d.ts","default":"./src/index.mjs"},"./schema/*":"./schema/*","./vectors/*":"./vectors/*","./examples/*":"./examples/*","./conformance":{"types":"./conformance/index.d.ts","default":"./conformance/index.mjs"},"./generated/openapi/*":"./generated/openapi/*","./generated/schemas/*":"./generated/schemas/*","./generated/vectors/*":"./generated/vectors/*","./generated/bindings/*":"./generated/bindings/*","./commerce-protocol.graphql":"./generated/commerce-protocol.graphql"},"gitHead":"44b329ea7921042d225d9c7824d898c716c0ed92","scripts":{"test":"node scripts/assemble-schema.mjs --check && node scripts/build-json-schemas.mjs --check && node scripts/build-bundle.mjs --check && node scripts/build-lifecycle-vectors.mjs --check && node scripts/build-operations.mjs --check && prettier --check \"**/*.{graphql,json,md,mjs,ts}\" && vitest run test && node scripts/quickstart.mjs","build":"node scripts/assemble-schema.mjs && node scripts/build-json-schemas.mjs && node scripts/build-bundle.mjs && node scripts/build-lifecycle-vectors.mjs && node scripts/build-operations.mjs","quickstart":"node scripts/quickstart.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7e478e35-87ac-496a-b560-a5e08d8ac5c6"}},"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.19.0","description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","directories":{},"_nodeVersion":"24.20.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"packageManager":"bun@1.3.13","devDependencies":{"ajv":"^8.17.1","vitest":"^4.1.11","graphql":"^16.11.0","prettier":"^3.6.2"},"_npmOperationalInternal":{"tmp":"tmp/openiap-commerce-protocol_0.2.0_1789406094178_0.319715623698009","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@hyodotdev/openiap-commerce-protocol","version":"0.3.0","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"author":{"name":"hyodotdev"},"license":"MIT","_id":"@hyodotdev/openiap-commerce-protocol@0.3.0","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"homepage":"https://openiap.dev/commerce-protocol","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"d1c797163caa30780976e16bb308c14c943e3b40","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.3.0.tgz","fileCount":46,"integrity":"sha512-IHm1uewLOrIIyud8wG2YQFd6YplUQIMMCAV68BmNOOVRKQBgRjr/HANLXZAChyK33MHgn0LKVoLxO6ukJQi+Ig==","signatures":[{"sig":"MEQCIDEqcpXBnXnpWyfusFD4GfYqgrMC31r/ZgeK7EYUSLObAiBxEgISI5804u1qE4fQCtPq/lfcwDvs4Gd584Q0Rv85Sg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIFWZrta0udcS0tkhXlaZKB3axlaLniGDYSU0prmbGjdCAiEAppD+4ZO7nNdd4zUhcHoFB8SZkzUBbCtjzIvdtJ4npJw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@hyodotdev%2fopeniap-commerce-protocol@0.3.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":734999},"main":"./src/index.mjs","type":"module","types":"./src/index.d.ts","exports":{".":{"types":"./src/index.d.ts","default":"./src/index.mjs"},"./schema/*":"./schema/*","./vectors/*":"./vectors/*","./examples/*":"./examples/*","./conformance":{"types":"./conformance/index.d.ts","default":"./conformance/index.mjs"},"./generated/openapi/*":"./generated/openapi/*","./generated/schemas/*":"./generated/schemas/*","./generated/vectors/*":"./generated/vectors/*","./generated/bindings/*":"./generated/bindings/*","./commerce-protocol.graphql":"./generated/commerce-protocol.graphql"},"gitHead":"01e6b0dcd82bd5fc8e98553070d4a2e8eba23750","scripts":{"test":"node scripts/assemble-schema.mjs --check && node scripts/build-json-schemas.mjs --check && node scripts/build-bundle.mjs --check && node scripts/build-lifecycle-vectors.mjs --check && node scripts/build-operations.mjs --check && prettier --check \"**/*.{graphql,json,md,mjs,ts}\" && vitest run test && node scripts/quickstart.mjs","build":"node scripts/assemble-schema.mjs && node scripts/build-json-schemas.mjs && node scripts/build-bundle.mjs && node scripts/build-lifecycle-vectors.mjs && node scripts/build-operations.mjs","quickstart":"node scripts/quickstart.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7e478e35-87ac-496a-b560-a5e08d8ac5c6"}},"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.19.0","description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","directories":{},"_nodeVersion":"24.20.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"packageManager":"bun@1.3.13","devDependencies":{"ajv":"^8.17.1","vitest":"^4.1.11","graphql":"^16.11.0","prettier":"^3.6.2"},"_npmOperationalInternal":{"tmp":"tmp/openiap-commerce-protocol_0.3.0_1789513684706_0.041291714615275144","host":"s3://npm-registry-packages-npm-production"}},"0.3.1":{"_id":"@hyodotdev/openiap-commerce-protocol@0.3.1","bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"dist":{"shasum":"c9df3ee4a878e5c54341b0b1cf265332ee80696f","tarball":"https://registry.npmjs.org/@hyodotdev/openiap-commerce-protocol/-/openiap-commerce-protocol-0.3.1.tgz","fileCount":46,"integrity":"sha512-GQ7MxsTcOm1iSpH5rIPQNxWl4iVIorPU4ztG4Qsdla43dAY/J4rzi4A1CFShxCoUqfrnjFjRkO/AH1QQzL94xQ==","signatures":[{"sig":"MEUCIQDfUkIKI10MFMy590+JzgQ1ugUOkL6vlDtDwA6/s8hyuwIgQ/xrn30R8+AMnQbWIif58XqD0abRR8x/EGCSbgqsUGg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDCmymSIKPIP99pUkSY/H/cqCQzTvOSNfkhXv1CqxgM+gIhAN0caAg13kept2WeizeUriUnfb4XJyEF/sdUHKvZNQn+"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@hyodotdev%2fopeniap-commerce-protocol@0.3.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":747698},"main":"./src/index.mjs","name":"@hyodotdev/openiap-commerce-protocol","type":"module","types":"./src/index.d.ts","author":{"name":"hyodotdev"},"exports":{".":{"types":"./src/index.d.ts","default":"./src/index.mjs"},"./schema/*":"./schema/*","./vectors/*":"./vectors/*","./examples/*":"./examples/*","./conformance":{"types":"./conformance/index.d.ts","default":"./conformance/index.mjs"},"./generated/openapi/*":"./generated/openapi/*","./generated/schemas/*":"./generated/schemas/*","./generated/vectors/*":"./generated/vectors/*","./generated/bindings/*":"./generated/bindings/*","./commerce-protocol.graphql":"./generated/commerce-protocol.graphql"},"gitHead":"2245cefa4183a6a489cfb1cbd9540c6ee964361d","license":"MIT","scripts":{"test":"node scripts/assemble-schema.mjs --check && node scripts/build-json-schemas.mjs --check && node scripts/build-bundle.mjs --check && node scripts/build-lifecycle-vectors.mjs --check && node scripts/build-operations.mjs --check && prettier --check \"**/*.{graphql,json,md,mjs,ts}\" && vitest run test && node scripts/quickstart.mjs","build":"node scripts/assemble-schema.mjs && node scripts/build-json-schemas.mjs && node scripts/build-bundle.mjs && node scripts/build-lifecycle-vectors.mjs && node scripts/build-operations.mjs","quickstart":"node scripts/quickstart.mjs"},"version":"0.3.1","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"7e478e35-87ac-496a-b560-a5e08d8ac5c6"}},"homepage":"https://openiap.dev/commerce-protocol","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"_npmVersion":"11.19.0","description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","directories":{},"maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"_nodeVersion":"24.21.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"packageManager":"bun@1.3.13","devDependencies":{"ajv":"^8.17.1","vitest":"^4.1.11","graphql":"^16.11.0","prettier":"^3.6.2"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/openiap-commerce-protocol_0.3.1_1790763966446_0.7185505447274061"}}},"time":{"created":"2026-09-10T20:39:33.939Z","modified":"2026-09-30T10:26:06.935Z","0.0.0-bootstrap.0":"2026-09-10T20:39:34.259Z","0.1.0-alpha.0":"2026-09-11T02:18:21.826Z","0.1.0":"2026-09-11T13:29:06.491Z","0.2.0":"2026-09-14T17:14:54.327Z","0.3.0":"2026-09-15T23:08:04.810Z","0.3.1":"2026-09-30T10:26:06.573Z"},"bugs":{"url":"https://github.com/hyodotdev/openiap/issues"},"author":{"name":"hyodotdev"},"license":"MIT","homepage":"https://openiap.dev/commerce-protocol","keywords":["openiap","iap","in-app-purchase","commerce","webhook","specification"],"repository":{"url":"git+https://github.com/hyodotdev/openiap.git","type":"git","directory":"specs/commerce-protocol"},"description":"OpenIAP Commerce Protocol: a vendor-neutral server-side contract for purchase verification, entitlements, lifecycle events, and REST and GraphQL bindings","maintainers":[{"name":"hyodotdev","email":"hyo@hyo.dev"}],"readme":"# OpenIAP Commerce Protocol\n\n[![npm](https://img.shields.io/npm/v/@hyodotdev/openiap-commerce-protocol/latest)](https://www.npmjs.com/package/@hyodotdev/openiap-commerce-protocol)\n\nA vendor-neutral specification for the **server side** of in-app purchases.\n\nOpenIAP normalizes the client-side purchase API across stores. This normalizes\nthe server side: one commerce vocabulary, one portable operation surface with\nREST and GraphQL bindings, one event envelope, one webhook contract — so a\nbackend or an analytics pipeline can verify purchases, read entitlements, and\nhandle renewals, refunds, and entitlement changes from Apple, Google, Meta\nHorizon, and Amazon without parsing any store-native payload, and can replace\nthe provider behind those calls without rewriting the integration.\n\nNothing in this contract routes through infrastructure the OpenIAP project\noperates. Two parties exchange events directly, using a secret they share\nbetween themselves, and validate offline. The project distributes the contract;\nit does not sit in the path of anyone's commerce.\n\n**[Read the specification →](./SPEC.md)**\n\n## Choose your role\n\nA paywall specialist can supply the experience, a commerce service the purchase\nand access decisions, and an analytics platform the event processing. An\nintegrated platform can supply several roles. Explore the [role map](https://openiap.dev/commerce-protocol#architecture)\nand [AI integration brief](https://openiap.dev/commerce-example/integration-brief.md)\nto connect your product to apps using OpenIAP. These product roles do not add\nprotocol profiles or a universal paywall API.\n\n## Start implementing\n\n```sh\nnpm install @hyodotdev/openiap-commerce-protocol\n```\n\nOr use `pnpm add`, `yarn add`, or `bun add` with the same package name.\n\nGive your AI the installed package's `SPEC.md`, `DESIGN.md`, and `generated/`\nartifacts. The package supplies the contract; your AI implements the backend.\n\n- **See what AI built:** the [recorded walkthrough](https://openiap.dev/commerce-protocol#build-walkthrough)\n shows a real local HTTP + SQLite backend in seven milestones, with captured\n responses. The [IAPKit comparison](https://openiap.dev/commerce-protocol/ecosystem#composition-proof) explains what was tested. Give the\n [build brief](https://openiap.dev/commerce-example/build-brief.md)\n to your AI to build the same flow in your own stack.\n- **Integrate your backend:** [Use a provider](https://openiap.dev/commerce-protocol/getting-started)\n walks through discovery, verification, account binding, and entitlement reads.\n- **Build a provider:** [Build with AI](https://openiap.dev/commerce-protocol/implementation)\n provides the brief, runnable example, and next implementation steps.\n [DESIGN.md §5](./DESIGN.md#5-implementation-blueprint) contains the architecture\n blueprint, storage keys, transaction boundaries, and recovery design.\n- **Try the contract locally:** from the repository root, run `bun install`,\n then `cd specs/commerce-protocol && bun run quickstart`. The\n [development walkthrough](https://github.com/hyodotdev/openiap/blob/main/specs/commerce-protocol/scripts/quickstart.mjs) uses the in-memory mock,\n checks authorization and binding behavior, and runs REST/GraphQL conformance.\n It uses fixture evidence, opens no HTTP server, and does not validate real\n store purchases. Its Ajv and GraphQL dependencies come from this package's\n development setup.\n\n[DESIGN.md](./DESIGN.md) explains why the boundaries sit where they do. It is\nbackground, not normative: where the two disagree, `SPEC.md` is right. It is\nalso published as a PDF at\n.\n\nThe contract sits between the stores and everything downstream of a backend:\n\n```mermaid\nflowchart TB\n stores[\"Apple / Google
/ Meta / Amazon
the stores\"]\n backend[\"A backend that
implements this spec
IAPKit, another
provider, or the
adopter's own
— in any language

verify → normalize
→ lifecycle → entitle\"]\n app[\"shipped application
verification role (§5)\"]\n server[\"the adopter's backend
server role (§5)\"]\n consumers[\"any consumer
data pipeline
/ CRM / analytics\"]\n\n stores -->|\" store-native 
 notifications and APIs \"| backend\n app -->|\" verifyPurchase, 
 providerCapabilities 
 (§4.1, §4.6) 
 over REST (§6) or 
 GraphQL (§7) \"| backend\n server -->|\" those, plus 
 subscriptionStatus, 
 entitlements, 
 bindPurchase, 
 eraseUser (§4.2–§4.5) 
 server role only 
 — never a shipped app \"| backend\n backend -->|\" OpenIAP Commerce 
 Protocol events (§9) \"| consumers\n```\n\n## Reviewing a change\n\nReview only the authored surfaces, in this order:\n\n1. [`SPEC.md`](./SPEC.md) — behavior, operations, bindings, lifecycle,\n transport, and compatibility.\n2. [`schema/`](./schema/) — the authored contract layers: wire structure, the\n operation surface, and validation directives.\n [`generated/commerce-protocol.graphql`](./generated/commerce-protocol.graphql)\n is their generated single-file assembly (also exported at the package path\n `@hyodotdev/openiap-commerce-protocol/commerce-protocol.graphql`).\n3. [`examples/`](./examples/) — representative documents and store mappings.\n4. [`vectors/signatures.json`](./vectors/signatures.json) — hand-authored\n cryptographic truth cases.\n5. [`conformance/`](./conformance/) — the portable runner and its independent\n mock provider.\n\nIgnore `generated/` during a human review. It is compiler output, kept only for\nvalidators and drift checks.\n\n## What ships here\n\n| Path | Contents |\n| ------------------------- | --------------------------------------------------------------------------- |\n| `schema/` | Authored type, operation, and validation contract layers — edit these |\n| `SPEC.md` | Normative meaning, operations, bindings, transport, and compatibility rules |\n| `DESIGN.md` | Why the boundaries sit where they do — background, never normative |\n| `generated/` | Compiler output: schemas, binding manifests, OpenAPI, and vectors |\n| `examples/` | Canonical documents that must validate |\n| `vectors/signatures.json` | Signature vectors every implementation must reproduce |\n| `conformance/` | Portable conformance runner plus an IAPKit-free mock provider |\n| `src/index.mjs` | Runtime access to the generated schemas and their derived constants |\n\nThe `schema/` layers govern wire structure. Their custom directives retain\npatterns, bounds, maps, open objects, and conditional rules that standard SDL\ncannot express. `bun run build` compiles that source into the JSON Schemas a Go,\nPython, or other backend executes against incoming webhook bodies. `SPEC.md`\ngoverns meaning and transport.\n\nDo not add this SDL to `specs/client/schema-files.mjs`. `specs/client` owns the\nclient purchase API and the SDK types compiled from it; this file independently\nowns the server-to-server commerce contract. Its Query and Mutation types are\nthe portable server operation surface — compiled into the REST and GraphQL\nbindings, never into client SDK types — and it defines no Subscription root:\nthe operation surface is bounded request/response by rule.\n\n## Receiving events\n\nAn endpoint you register receives one JSON event per request. Verify the\nsignature — `SPEC.md` §9.4.2 states the rule and `vectors/signatures.json` pins\nit — then handle the event; `SPEC.md` §9.5 walks a consumer end to end.\n\nThree rules that are easy to get wrong, all specified in detail in `SPEC.md`:\n\n- **Sign the bytes you received.** Re-serializing the JSON before verifying\n changes key order and whitespace, and the signature will not match.\n- **Read `subscription.active`, not `state`.** A canceled subscription keeps\n access until its paid period ends — `subscription.canceled` means auto-renew\n was turned off, not that access was revoked.\n- **A missing amount means unknown.** It never means zero.\n\n## Calling a provider\n\nStart with the provider's capability descriptor. Every conforming provider\nsupports discovery; its declared profiles determine which purchase, status,\nentitlement, binding, and erasure operations it supports. Check those profiles\nbefore calling an operation. REST and GraphQL bindings share one error-code\nspace. `SPEC.md` §4–§8 define the surface and authorization rules.\n\n## Certifying a provider\n\nPoint the portable runner in `conformance/` at a test instance of your\nprovider; [`SPEC.md` §11.2](./SPEC.md#112-the-portable-runner) has the script.\nThe runner is offline, needs no hosted service, and imports no implementation;\nsupply the Ajv 2020 class yourself, since the published runtime carries zero\ndependencies. It certifies the transport contract — never real store receipt\nvalidity (`SPEC.md` §11.3). A provider that declares the `events` profile must\nalso pass an `eventsAdapter` covering the full `EventsAdapter` surface\n(`conformance/index.d.ts`); a signing-only adapter fails.\n\n## Validating\n\nFrom a repository clone (the npm package does not ship `scripts/` or `test/`):\n\n```bash\nbun install # at the repository root\ncd specs/commerce-protocol && bun run test\n```\n\nThe suite recompiles every schema and binding artifact, validates every\nexample, checks that each rejection case is actually rejected, reproduces\nevery signature vector using an implementation written only from `SPEC.md`,\nand certifies an independent mock provider on both bindings.\n\n## Relationship to the rest of OpenIAP\n\n```\n OpenIAP Commerce Protocol ← this package: the server-side contract\n │\n ┌──────────────┼──────────────┐\n │ │ │\n IAPKit vendor backend custom backend\n (reference)\n │ │ │\n └──────────────┼──────────────┘\n ↓\n normalized commerce events\n ↓\n ┌──────────────┼──────────────┐\n │ │ │\n SaaS analytics enterprise\n```\n\nNo box in that diagram is required to be operated by the OpenIAP project. An\nadopter may self-host IAPKit, use a hosted conforming provider, or implement the\ncontract in the backend they already have — and a consumer supports _the\nspecification_, so any of the three can feed it.\n\n## Status\n\nImplements protocol version 1.0. The event vocabulary,\nenvelope, webhook contract, operation surface, REST and GraphQL bindings, and\nportable conformance runner are implemented and tested. `SPEC.md` §14 lists\nwhat is deliberately not in this version.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}