Migration

Keep the current provider authoritative while you prepare a migration. Match canonical app accounts to store transaction chains and provider aliases before changing ownership. A matching active flag alone does not prove that the correct customer owns a purchase.

Keep one transaction owner#

The published iOS SDK 1.1.1 has no supported passive observer mode. Do not initialize it alongside another SDK that purchases, finishes, or restores the same StoreKit transactions. Compare providers from your backend while the existing SDK remains responsible for checkout.

The source candidate adds observerMode, identifyAndWait, logoutAndWait, waitUntilReady, and refreshUserToken. These are unreleased APIs. Observer mode allows entitlement reads but disables purchases, restores, transaction recovery and consumable spending. Wait for a tagged release and test the exact revision on hardware before integrating these APIs into a shipping app.

Audit before changing subscriber ownership#

Use these app-scoped management operations with an authorized workspace credential:

• GET /v1/apps/{app}/share-settings: inspect the current restore policy.
• GET /v1/apps/{app}/migration/chains/{originalTransactionId}?environment=Sandbox: inspect the current owner, subscriptions, shares and renewal/refund history.
• POST /v1/apps/{app}/migration/ownership:dry-run: submit provider evidence for up to 100 chains. Each row requires canonicalUserId, providerOwnerId, aliases, originalTransactionId, store, environment, observedAt and evidenceReference.

Repeat reads separately for Sandbox and Production. The dry run checks available Apple store records, reports conflicting ownership and aliases, and performs no writes. Google store re-verification is not implemented in this audit endpoint; its report marks that evidence unavailable. Reports never certify complete coverage or approve cutover.

Under keep_with_original, a purchase restored on a different app account retains its original owner and verification returns a typed ownership conflict. Account deletion must not imply permission to transfer a purchase. Review deleted-account claims with the app owner and provider evidence. Never grant both accounts access simply to eliminate a mismatch.

Midgame has requested that original owners remain unchanged until its audit is reviewed. The migration import/transfer executor remains an open acceptance item. Do not represent a dry run, receipt replay, or manual entitlement grant as a completed subscriber migration. Existing subscribers must not need to repurchase or install a new binary to retain access.

Verify notification delivery#

Preserve the current provider's notification flow for existing binaries. Before changing store destinations, establish and prove forwarding to that provider. Inspect Apple test request status using its returned token in each environment; an old successful notification cannot prove that a new request arrived.

Update an existing webhook with update_webhook_endpoint to preserve its identity, subscribed events and signing secret. Use inspect_webhook_deliveries to inspect each attempt's time, destination, HTTP/transport outcome and signing-key fingerprint. A queued test id is not delivery evidence. retry_webhook_delivery and replay_webhook_deliveries preserve event ids so receivers can deduplicate retries. Reconcile current store state before replaying old lifecycle events; test duplicate and out-of-order handling against the receiver.

Release gates#

Compare every canonical account and both environments for owner, plan, access, expiry, grace, trial, auto-renew, refund and revocation. Provider errors remain unknown, never inactive. Validate all offered plans with native localized store prices and buyer-specific eligibility; catalog metadata is not a promise of a free trial.

Then test the released SDK on hardware: purchase, cancellation, pending payment, restore, A→B→A account switching, logout during payment, reinstall, interrupted verification, renewal, grace, refund and revocation. Check both app access and protected backend access. Record transaction/event ids, timestamps, SDK revision and receiver logs without secrets.

Keep checkout and global authority disabled until the evidence passes and the app owner approves the migration report and canary. Preserve the old provider and a documented rollback path while observing lifecycle convergence in the canary.