feat: support common Apple and Android store providers

[hyochan]

Store integrations share one provider contract across Apple and Android. Apple uses a compatible Swift provider linked and selected by each app; one adapter can be reused across the six SDKs. A community Android AAR serves React Native, Expo, Flutter, Godot, KMP and MAUI after each app configures its dependency, provider selection and rebuild. Client Protocol 0.2.0 requires storeId, keeps IapStore frozen and adds a neutral descriptor. Public conformance, fixtures, registry, guides and the release card cover the affected packages. Android renewal stays nullable when unknown; compatibility Boolean hints do not establish cancellation or entitlement. Samsung, Huawei and Xiaomi are illustrative IDs; their adapters and transactions are unverified.

The community Amazon example is educational, with an upstream-derived binding and six official Expo screens labelled COMMUNITY EXAMPLE. Maintained FireOS apps should use the official Amazon integration. The existing Expo app walkthrough keeps the app and purchase APIs, selects exactly one IAP plugin per Play/community build profile, migrates legacy store flags, and covers verification. GitHub Packages installation uses @hyodotdev/openiap-provider-amazon-example 0.0.1. Before compatible releases, it requires pinned public Expo/core inputs; the Play profile uses matching native sources. The community profile uses the installed provider and public core Maven artifacts without native source includes. Other frameworks need compatible native setup; Apple platforms are unsupported by this community package.

Local checks pass: retained native/SDK/conformance suites, eight actual-plugin profile cases, a fresh offline Play/core/Expo/consumer Kotlin compile with all 261 tasks executed, and the 145-page docs build/lint/types/audits. The community provider passes 65 tests with two optional skips and 16 mandatory behaviors; consumer/packaging checks and optimized Android builds pass. Prior community source CI passed at 5340b206; Current source CI passed every step at the single root commit c5398a20, including 178 consumer tests/types and the optimized Android build. GitHub Packages 0.0.1 passed fresh Expo installation, 177 consumer tests/types and R8 factory checks. Its immutable package remains from 71beafcd, with its AAR byte-identical to 0.1.2; current source is not republished.

At the maintainer's request, the existing Martie was switched to App Tester without card entry or real payment. The GitHub Packages-installed 0.1.2 provider (same AAR as 0.0.1) passed fresh consumable/non-consumable and monthly/yearly first Sandbox verification and finish, checkout cancellation without entitlement, and pending approval → restart → restore → verify → finish. All six strict acceptance checks passed. An embedded-configuration bug in the acceptance screen was corrected by reusing the existing readers; its regression failed before the fix and all 178 consumer tests/types and the affected embedded Android build passed afterward. Fresh verification records that App Tester cancellation removed SDK ownership while RVS Sandbox kept the same receipt entitled, and a Yearly transaction returned a 1 Month Sandbox term. Renewal, expiry and server revocation remain unverified; no LAT purchase is claimed. Original APK and 37 internal files were restored byte-exactly before launch, original catalog/tester settings/density restored, and owned test resources removed. Device results retain 31 official builds, 21 Apple/Play/Amazon sandbox purchase/verify/finish passes, Onside build-only and independent Expo/KMP/MAUI checks. Seven Horizon and two Vega purchase rows remain blocked.

Ready for review and unmerged at 56c62e3: 63 checks succeeded, four PR-conditional jobs were skipped, and complete CodeQL and independent source review passed. Six lock graphs pin the published, provenance-verified MIT @dieub/braces-depth-guard@3.0.3-pn.3 derivative; security notes state its source and limits. Local project/patch coverage thresholds from unchanged codecov.yml and LCOV artifacts are mandatory; bounded SHA256/TLS/OIDC Codecov reporting retains visible external-service warnings. MAUI's actual Maven download/deduplication/conflict tests pass with an owned cache and safe repository names. RN/Expo use versioned CocoaPods caches; both Swift builds and CodeQL passed. Tests, builds, security, download limits and the 90-minute CodeQL gate remain enforced. These CI changes need no new publication; PR checks deploy neither dev nor production. Existing Expo development-certificate exceptions expire on 2026-10-09.

Deviations: shared core sources retain their existing generated-sync owner; KMP's neutral variant uses compile-only Play Billing, excluded by external provider runtimes; native conformance does not certify server lifecycle behavior; invalid Godot settings fail dependency resolution because its export hook cannot cancel export.

Preview

common-provider-expo-public.mp4

provider-architecture-amazon-example.mp4

Earlier Fire label preview. Sampled Fire home and package usage guide.

Sampled browser previews: provider setup, nullable renewal, SDK configuration, verification errors, Apple lifecycle/authoring and the existing Expo app installation recipe.

provider-generic-vendors-docs-preview.mp4

provider-errors-and-setup.mp4

apple-provider-review.mp4

expo-community-guide-final.mp4

[codecov]

Codecov Report

❌ Patch coverage is 94.63087% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.42%. Comparing base (64158e8) to head (58c4092).

Files with missing lines	Patch %	Lines
...ries/react-native-iap/src/utils/native-instance.ts	83.87%	5 Missing ⚠️
libraries/expo-iap/src/utils/restorePurchases.ts	75.00%	2 Missing ⚠️
.../react-native-iap/src/utils/available-purchases.ts	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #504      +/-   ##
==========================================
+ Coverage   77.35%   77.42%   +0.07%     
==========================================
  Files         160      162       +2     
  Lines       16836    16872      +36     
  Branches     4845     4859      +14     
==========================================
+ Hits        13023    13063      +40     
+ Misses       3813     3809       -4     

Flag	Coverage Δ
expo-iap	91.11% <92.30%> (-0.07%)	⬇️
flutter-inapp-purchase	90.89% <100.00%> (+0.39%)	⬆️
react-native-iap	93.29% <93.54%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
React Native IAP	93.29% <93.54%> (+0.03%)	⬆️
Expo IAP	91.11% <92.30%> (-0.07%)	⬇️
flutter_inapp_purchase	90.89% <100.00%> (+0.39%)	⬆️
IAPKit Server	92.13% <ø> (ø)
IAPKit Convex	63.59% <ø> (ø)

Files with missing lines	Coverage Δ
libraries/expo-iap/src/index.ts	92.44% <100.00%> (ø)
libraries/expo-iap/src/modules/ios.ts	100.00% <100.00%> (ø)
libraries/expo-iap/src/utils/availablePurchases.ts	88.63% <100.00%> (+1.13%)	⬆️
libraries/expo-iap/src/vega-adapter.ts	87.74% <ø> (ø)
...ter_inapp_purchase/lib/flutter_inapp_purchase.dart	90.20% <100.00%> (+0.60%)	⬆️
libraries/flutter_inapp_purchase/lib/helpers.dart	91.60% <100.00%> (+0.08%)	⬆️
libraries/react-native-iap/src/hooks/useIAP.ts	93.77% <100.00%> (-0.09%)	⬇️
libraries/react-native-iap/src/index.ts	94.67% <100.00%> (+0.38%)	⬆️
...es/react-native-iap/src/utils/restore-purchases.ts	100.00% <100.00%> (ø)
...ibraries/react-native-iap/src/utils/type-bridge.ts	98.33% <100.00%> (+0.01%)	⬆️
... and 4 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.