feat: support common Apple and Android store providers

.claude/commands/audit-code.md

@@ -224,7 +224,9 @@ Update the documentation site for users:
   `openiap-versions.json` only for `clientProtocol`, `google`, and `apple`;
   framework versions come from each library's package metadata
 - Derive expected versions from the explicit release plan and stable metadata;
-  release workflows own package-version commits
+  release workflows own package-version commits, except a feature PR may set
+  `specs/client/package.json` when the in-tree code needs the new Client
+  Protocol version
 - Link each package to its expected GitHub Release tag, per "Docs Ship With The
   Change" in `knowledge/internal/05-docs-patterns.md`
 - Document ALL changes: new features, bug fixes, breaking changes

.claude/commands/audit-security.md

@@ -48,9 +48,11 @@ osv-scanner scan source \
 ```
 
 The dependency audit fails on every unaccepted advisory severity, malformed
-audit output, and expired or unused exceptions. An upstream-unpatched,
-build-only exception must be justified and expiring in the owning
-`osv-scanner.toml`. A successful GitHub dependency-submission run is separate
+audit output, and expired or unused exceptions. A temporary exception for
+an advisory the lock does not clear yet (no fixed release, a fix outside
+the dependents' ranges, or a clearing dependency bump that has not been
+tested yet) must be justified and expiring in the owning `osv-scanner.toml`.
+A successful GitHub dependency-submission run is separate
 evidence that the hosted graph matches the exact Bun lock commit:
 
 ```bash

.claude/commands/release.md

@@ -19,10 +19,13 @@ Inspect the complete public payload before publishing it.
 
 - `main` contains stable package metadata only. Run stable package releases and
   production docs deployment from `main`.
-- `clientProtocol` mirrors `specs/client/package.json`. Never edit it directly
-  in a feature PR, release command, or docs deployment. A Client Protocol
-  release bumps the publishing manifest; `scripts/sync-versions.sh` writes the
-  mirror, and the audits reject a committed mismatch.
+- `clientProtocol` mirrors `specs/client/package.json`. Never edit the mirror
+  directly; the audits reject a committed mismatch. A feature PR may set the
+  manifest, run `bun install --lockfile-only --ignore-scripts` and then
+  `scripts/sync-release-generated.sh`, and commit `bun.lock` with the staged
+  files, when the in-tree code needs the new Client Protocol version; the
+  release then dispatches with `version=current`, which publishes that version
+  without bumping again.
 - `next` is an on-demand prerelease integration branch. Run `-rc.*` and npm
   `next` releases from `next` only.
 - `next` may be absent between prerelease trains. Create it from current `main`
@@ -48,10 +51,9 @@ node --test scripts/release-branch-policy.test.mjs
 ```
 
 Every release lane's version-bump commit also runs
-`scripts/sync-release-generated.sh`, which regenerates and stages the files
-derived from version metadata (`packages/docs/src/generated/version-metadata.json`,
-`packages/docs/public/llms.txt`, `packages/docs/public/llms-full.txt`,
-`knowledge/_agent-context/context.md`). Expect these paths in bump commits;
+`scripts/sync-release-generated.sh`, which regenerates and stages every file
+that embeds release version metadata (see its `git add` list). Expect those
+paths in bump commits;
 they are not worktree drift. Skipping this regeneration leaves `main` stale and
 fails the `Audit SDK Parity` / `Test Agent Scripts` clean-worktree checks on
 every subsequent PR.
@@ -127,8 +129,9 @@ For a multi-package release train, use this order when affected:
 8. `release-maui.yml`
 9. `release-openiap.yml` — select one affected package per run:
    - `client-protocol`: `@hyodotdev/openiap-client-protocol`. Its package
-     version *is* the Client Protocol version; a release moves `clientProtocol`
-     in `openiap-versions.json` through sync.
+     version *is* the Client Protocol version; a release with patch, minor,
+     major, rc-bump or exact moves `clientProtocol` through sync, while
+     `current` publishes the in-tree version.
    - `commerce-protocol`: `@hyodotdev/openiap-commerce-protocol`; independent
      package version, released when its contract, runner, or artifacts change.
    - `cli`: `@hyodotdev/openiap`; independent package version.
@@ -199,8 +202,10 @@ Train rules (mistake guards):
   versions and links against the
   published releases and correct any that differ; if that needs an edit,
   commit it directly to `main` together with any release-process doc updates,
-  and do not open a PR for that post-release docs-only commit. Run the docs
-  deployment; to deploy before publication, use the explicit flag in
+  and do not open a PR for that post-release docs-only commit. Card edits that
+  change wording come with the matching `scripts/audit-release-notes.test.mjs`
+  needles. Run the docs deployment; to deploy before publication, use the
+  explicit flag in
   `knowledge/internal/06-git-deployment.md#deploying-documentation`.
   If a train will not resume, trim its card to what published. CI's release
   note audit (`bun run audit:release-notes`) fails a PR into `main` that

.codex/skills/ship-release/SKILL.md

@@ -41,7 +41,9 @@ paths. Never mutate production Convex data.
    a user-visible or contract-relevant change; do not bump unaffected packages
    for symmetry.
 5. Select stable SemVer bumps from the actual compatibility impact and run all
-   preflight audits required by `.claude/commands/release.md`.
+   preflight audits required by `.claude/commands/release.md`. The in-tree
+   `specs/client/package.json` version is released with `version=current` when
+   a feature PR already set it.
 
 ## 2. Publish packages sequentially
 

.github/actions/coverage-report/action.yml

@@ -0,0 +1,60 @@
+name: Preserve and report coverage
+description: Archive required local coverage and report to Codecov without blocking verified builds on service outages.
+inputs:
+  package-path:
+    description: Workspace-relative package directory
+    required: true
+  flag:
+    description: Canonical Codecov upload flag
+    required: true
+  use-oidc:
+    description: Whether the caller can request an OIDC token
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Preserve verified coverage
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: coverage-${{ inputs.flag }}
+        path: ${{ github.workspace }}/${{ inputs.package-path }}/coverage/lcov.info
+        if-no-files-found: error
+        retention-days: 14
+
+    - name: Install verified Codecov CLI
+      id: codecov-cli
+      continue-on-error: true
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: |
+        timeout 120s scripts/install-security-tool.sh codecov "$RUNNER_TEMP/codecov-cli"
+        cat > "$RUNNER_TEMP/codecov" <<'EOF'
+        #!/usr/bin/env bash
+        exec timeout 120s "${BASH_SOURCE[0]}-cli" "$@"
+        EOF
+        chmod 755 "$RUNNER_TEMP/codecov"
+
+    - name: Report coverage to Codecov
+      id: codecov-upload
+      if: steps.codecov-cli.outcome == 'success'
+      continue-on-error: true
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
+      with:
+        binary: ${{ runner.temp }}/codecov
+        use_oidc: ${{ inputs.use-oidc }}
+        fail_ci_if_error: true
+        disable_search: true
+        files: coverage/lcov.info
+        flags: ${{ inputs.flag }}
+        name: ${{ inputs.flag }}
+        network_prefix: ${{ inputs.package-path }}/
+        working-directory: ${{ inputs.package-path }}
+
+    - name: Report Codecov service failure
+      if: ${{ !cancelled() && (steps.codecov-cli.outcome == 'failure' || steps.codecov-upload.outcome == 'failure') }}
+      shell: bash
+      run: |
+        echo "::warning::Codecov reporting failed. Required local project and patch coverage passed; the LCOV artifact is available in this run."
+        printf '%s\n' '### Coverage reporting' '' \
+          'Required local project and patch coverage passed. Codecov reporting failed; use the archived LCOV report in this run.' \
+          >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ci-expo-iap.yml

@@ -12,7 +12,11 @@ on:
       - "packages/google/gradle/openiap-store.gradle"
       - "libraries-versions.jsonc"
       - "codecov.yml"
+      - "scripts/install-security-tool.sh"
+      - "scripts/assert-lcov-coverage.mjs"
+      - ".github/actions/coverage-report/**"
       - "scripts/test-ios-log-sanitizers.sh"
+      - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-expo-iap.yml"
       - "!**/*.md"
   push:
@@ -26,7 +30,11 @@ on:
       - "packages/google/gradle/openiap-store.gradle"
       - "libraries-versions.jsonc"
       - "codecov.yml"
+      - "scripts/install-security-tool.sh"
+      - "scripts/assert-lcov-coverage.mjs"
+      - ".github/actions/coverage-report/**"
       - "scripts/test-ios-log-sanitizers.sh"
+      - "scripts/ci/retry-gradle.sh"
       - ".github/workflows/ci-expo-iap.yml"
       - "!**/*.md"
 
@@ -100,27 +108,73 @@ jobs:
       - name: Test
         run: bun run test:coverage
 
-      - name: Enforce line coverage
-        run: node ../../scripts/assert-lcov-coverage.mjs coverage/lcov.info 90
-
-      - name: Upload coverage
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
-        with:
-          use_oidc: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          fail_ci_if_error: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          disable_search: true
-          files: coverage/lcov.info
-          flags: expo-iap
-          name: expo-iap
-          network_prefix: libraries/expo-iap/
-          working-directory: libraries/expo-iap
+      - name: Enforce project and patch coverage
+        env:
+          COVERAGE_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}
+        run: node ../../scripts/assert-lcov-coverage.mjs coverage/lcov.info --component expo-iap
 
       - name: Test plugin
         run: bun run test:plugin
 
       - name: Consumer install smoke test
         run: bun run verify:consumer-install
 
+      - name: Preserve and report coverage
+        uses: ./.github/actions/coverage-report
+        with:
+          package-path: libraries/expo-iap
+          flag: expo-iap
+          use-oidc: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+
+  android-unit:
+    name: Android unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 20
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.13
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('libraries/expo-iap/bun.lock', 'libraries/expo-iap/example/bun.lock') }}
+          restore-keys: ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Install example dependencies
+        working-directory: libraries/expo-iap/example
+        run: bun install --frozen-lockfile
+
+      - name: Build config plugin
+        run: bun run build:plugin
+
+      - name: Generate Android project
+        working-directory: libraries/expo-iap/example
+        run: npx expo prebuild --platform android --no-install --clean
+
+      - name: Install JDK
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: Run Android unit tests
+        working-directory: libraries/expo-iap/example/android
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew :expo-iap:testDebugUnitTest --stacktrace
+
   ios-xcode-27:
     name: iOS example (Xcode 27)
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
@@ -155,7 +209,11 @@ jobs:
 
       - name: Generate scene-based iOS project
         working-directory: libraries/expo-iap/example
-        run: npx expo prebuild --platform ios --clean
+        run: |
+          CP_CACHE_DIR="$RUNNER_TOOL_CACHE/cocoapods/$(pod --version)"
+          export CP_CACHE_DIR
+          printf 'CP_CACHE_DIR=%s\n' "$CP_CACHE_DIR" >> "$GITHUB_ENV"
+          npx expo prebuild --platform ios --clean
 
       - name: Install CocoaPods dependencies
         working-directory: libraries/expo-iap/example/ios

.github/workflows/ci-flutter-inapp-purchase.yml

@@ -12,6 +12,9 @@ on:
       - "packages/google/gradle/openiap-store.gradle"
       - "libraries-versions.jsonc"
       - "codecov.yml"
+      - "scripts/install-security-tool.sh"
+      - "scripts/assert-lcov-coverage.mjs"
+      - ".github/actions/coverage-report/**"
       - ".github/workflows/ci-flutter-inapp-purchase.yml"
       - ".github/workflows/release-flutter.yml"
       - "scripts/ci/retry-gradle.sh"
@@ -27,6 +30,9 @@ on:
       - "packages/google/gradle/openiap-store.gradle"
       - "libraries-versions.jsonc"
       - "codecov.yml"
+      - "scripts/install-security-tool.sh"
+      - "scripts/assert-lcov-coverage.mjs"
+      - ".github/actions/coverage-report/**"
       - ".github/workflows/ci-flutter-inapp-purchase.yml"
       - ".github/workflows/release-flutter.yml"
       - "scripts/ci/retry-gradle.sh"
@@ -80,20 +86,10 @@ jobs:
       - name: Filter generated coverage
         run: dart run tool/filter_coverage.dart
 
-      - name: Enforce line coverage
-        run: node ../../scripts/assert-lcov-coverage.mjs coverage/lcov.info 90
-
-      - name: Upload coverage
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
-        with:
-          use_oidc: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          fail_ci_if_error: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          disable_search: true
-          files: coverage/lcov.info
-          flags: flutter-inapp-purchase
-          name: flutter-inapp-purchase
-          network_prefix: libraries/flutter_inapp_purchase/
-          working-directory: libraries/flutter_inapp_purchase
+      - name: Enforce project and patch coverage
+        env:
+          COVERAGE_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}
+        run: node ../../scripts/assert-lcov-coverage.mjs coverage/lcov.info --component flutter-inapp-purchase
 
       - name: Android consumer build smoke test
         run: |
@@ -124,6 +120,13 @@ jobs:
               flutter build apk --release --target-platform android-arm64
           done
 
+      - name: Preserve and report coverage
+        uses: ./.github/actions/coverage-report
+        with:
+          package-path: libraries/flutter_inapp_purchase
+          flag: flutter-inapp-purchase
+          use-oidc: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+
   apple-xcode-27:
     name: Apple examples (Flutter 3.44 + Xcode 27)
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository

.github/workflows/ci-maui-iap.yml

@@ -117,6 +117,7 @@ jobs:
         working-directory: packages/google
         run: |
           "$GITHUB_WORKSPACE/scripts/ci/retry-gradle.sh" ./gradlew \
+            :openiap-core:assembleRelease \
             :openiap:assemblePlayRelease \
             :openiap:assembleAmazonRelease \
             :openiap:assembleHorizonRelease