feat: add claude code parity and fix cross-sdk audit findings

.claude-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "openiap",
+  "owner": {
+    "name": "OpenIAP",
+    "email": "hyo@hyo.dev"
+  },
+  "description": "OpenIAP plugins for AI coding agents.",
+  "plugins": [
+    {
+      "name": "openiap",
+      "source": "./plugins/openiap",
+      "description": "Inspect and implement in-app purchase flows with OpenIAP and IAPKit through the hosted MCP server (iapkit_* tools).",
+      "category": "developer-tools",
+      "homepage": "https://openiap.dev/docs/guides/mcp-server"
+    }
+  ]
+}

.claude/commands/commit.md

@@ -34,8 +34,9 @@ Complete workflow: branch → commit → push → PR
 
 If the staged changes only touch internal agent/workflow files, do not push or
 create a PR unless the user explicitly asked to publish, PR, or merge them.
-Internal workflow files include `.claude/commands/`, `.codex/skills/`,
-`AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, and agent automation notes.
+Internal workflow files include `.claude/commands/`, `.claude/skills/`,
+`.codex/skills/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, and agent
+automation notes.
 
 For those internal-only changes, prefer a local commit or local working-tree
 change and report the files changed. If the user explicitly asks to open or

.claude/guides/09-kit-package.md

@@ -48,6 +48,10 @@ convex/<domain>/
 └── internal.ts   # Internal-only (called from actions)
 ```
 
+Sanctioned exception: an operator-only `internalMutation` may stay in
+`mutation.ts` when relocating it would change its generated function path
+(see `purchases/mutation.ts` — `markReceiptInvalid`). Do not relocate it.
+
 `convex/_generated/*` is regenerated by `bunx convex dev` — never edit. When working on Convex code, **read `convex/_generated/ai/guidelines.md` first**.
 
 ## Pre-commit Gate (Paths-Aware, CI-Equivalent)

.claude/settings.json

@@ -1,7 +1,6 @@
 {
   "permissions": {
     "allow": [
-      "Bash(python3 /tmp/add_kmp_tabs.py)",
       "Bash(awk:*)"
     ]
   }

.claude/skills/generate-doc/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: generate-doc
+description: Use for OpenIAP documentation generation work, especially release-note entries in packages/docs/src/pages/docs/updates/releases.tsx where package releases are assumed to be deployed and links should be written as shipped release links.
+---
+
+# Generate OpenIAP Docs (Claude Code)
+
+The canonical instructions live in `.codex/skills/generate-doc/SKILL.md`.
+Read that file first and follow it fully — required reading, release-note
+mode, version sources, tag formats, editing rules, multi-package release
+trains, and validation are all defined there and apply to any agent.
+
+## Claude Code Notes
+
+- Where the canonical file says to use `openiap-workflows`, use the
+  `.claude/skills/openiap-workflows` skill or the matching
+  `.claude/commands/*.md` slash command instead.
+- Run the same validation commands (`bunx prettier --check`, `bun run build`,
+  `bun run audit:docs`, `git diff --check`) before reporting the docs change
+  as done.

.claude/skills/iapkit-e2e-martie/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: iapkit-e2e-martie
+description: Run IAPKit local receipt-validation E2E with the dev.hyo.martie React Native or Expo examples, the compiled packages/kit server, real Convex, and Apple or Google sandbox purchases. Use when verifying purchase-token or JWS routing, Local (IAPKit) baseUrl behavior, local server logs, receipt validity, transaction finishing, or the Martie purchases view; distinguish safe smoke checks from approval-gated live purchase verticals.
+---
+
+# IAPKit Martie Receipt E2E (Claude Code)
+
+The canonical procedure lives in `.codex/skills/iapkit-e2e-martie/SKILL.md`.
+Read it and follow it exactly — targets, smoke vs live lanes, safety gates,
+preflight, server startup, example configuration, the Martie catalog, the
+approval-gated live vertical, its `LIVE RECEIPT PASS` assertions, and cleanup
+are all agent-agnostic and apply as written.
+
+## Claude Code Notes
+
+- The safety gates are non-negotiable in Claude Code too: never press
+  Purchase/Subscribe or confirm a store sheet without explicit approval in the
+  current run, never rotate or reveal IAPKit API keys, and never mutate the
+  store catalog from this workflow.
+- Report results with the same vocabulary: `SMOKE PASS` / `SMOKE FAIL` for the
+  server smoke lane, `LIVE RECEIPT PASS` only when every live-lane assertion
+  holds, and `BLOCKED` when a device, account, catalog, key, Convex URL, or
+  network route is missing.
+- Also read the `Local (IAPKit) Receipt Vertical` section of
+  `.claude/commands/e2e-tests.md` during preflight, as the canonical file
+  requires.

.claude/skills/iapkit-e2e-petgu/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: iapkit-e2e-petgu
+description: Use for IAPKit product sync E2E testing in packages/kit with the Petgu React Native app, localhost dashboard, App Store Connect, and Google Play Console. Triggers when verifying kit product/entitlement create, update, delete, pull, push, or store sync behavior with Petgu.
+---
+
+# IAPKit Petgu E2E (Claude Code)
+
+The canonical procedure lives in `.codex/skills/iapkit-e2e-petgu/SKILL.md`.
+Read it and follow it exactly — default targets, safety rules, the standard
+workflow, known good Petgu products, expected store behavior, and reporting
+requirements are agent-agnostic and apply as written.
+
+## Claude Code Notes
+
+- Apple product IDs are permanently unusable after deletion; treat the
+  canonical safety rules as hard gates and only ever delete temporary SKUs
+  created for the current verification run.
+- Where the canonical file prefers temporary IDs under `dev.hyo.petgu.codex.*`,
+  IDs under `dev.hyo.petgu.claude.*` are equally acceptable — what matters is
+  that the SKU is clearly temporary and is removed from IAPKit and both stores
+  during cleanup.
+- Where it says to use Chrome for logged-in Play Console / App Store Connect
+  tabs, use Claude's browser tooling (Claude in Chrome) against the user's
+  existing signed-in session; never handle store credentials directly.

.claude/skills/opencollective-steward/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: opencollective-steward
+description: Manage OpenIAP's OpenCollective presence, including profile copy, slug/link migrations, sponsor/backer recognition, update posts, and README/docs sponsor assets. Use when the user asks to draft or publish OpenCollective updates, maintain OpenCollective tiers/profile content, migrate react-native-iap OpenCollective links to openiap, or make supporters feel informed and appreciated.
+---
+
+# OpenCollective Steward (Claude Code)
+
+The canonical instructions live in
+`.codex/skills/opencollective-steward/SKILL.md`. Read that file and follow it
+fully — the core workflow, live edit guardrails, positioning, update post
+pattern, canonical README/asset links, publishing checklist, and example copy
+are agent-agnostic and apply as written.
+
+## Claude Code Notes
+
+- For live OpenCollective writes, use Claude's browser tooling (Claude in
+  Chrome) with the user's signed-in session. If OpenCollective asks for
+  sign-in, hand control back to the user; never infer or extract auth tokens
+  from browser state.
+- The Trix-editor guardrail applies verbatim: verify the hidden form input
+  matches the visible editor content before pressing Save, and abort the save
+  when they disagree.

.claude/skills/openiap-workflows/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: openiap-workflows
+description: Use for OpenIAP monorepo work that should follow the repository's slash-command workflows when the user asks in natural language instead of typing a slash command, including review-pr, audit-code, compile-knowledge, verify-all, e2e-tests, stable or prerelease package releases, resolve-issue, commit/push/PR, generated type sync, package-specific checks, GitHub review threads, and project conventions from AGENTS.md/CLAUDE.md/GEMINI.md.
+---
+
+# OpenIAP Workflows (Claude Code)
+
+The canonical workflow definitions live in `.claude/commands/*.md` and the
+shared operating rules live in `.codex/skills/openiap-workflows/SKILL.md`.
+Follow both; this file only adds the Claude Code specifics.
+
+## Command Mapping
+
+When the user asks in natural language, execute the matching workflow by
+reading the command file (or invoke the slash command directly when available):
+
+- Review PR comments / fix review feedback → `.claude/commands/review-pr.md` (`/review-pr`)
+- Audit code against knowledge rules → `.claude/commands/audit-code.md` (`/audit-code`)
+- Compile knowledge / rebuild AI context → `.claude/commands/compile-knowledge.md` (`/compile-knowledge`)
+- Resolve a GitHub issue → `.claude/commands/resolve-issue.md` (`/resolve-issue`)
+- Verify all / monorepo health check → `.claude/commands/verify-all.md` (`/verify-all`)
+- Device-backed E2E regression → `.claude/commands/e2e-tests.md` (`/e2e-tests`)
+- Stable or RC/next releases → `.claude/commands/release.md` (`/release`)
+- Commit, push, or create PR → `.claude/commands/commit.md` (`/commit`)
+
+## Claude Code Notes
+
+- Read the "Source Of Truth", "Internal Workflow Change Guard",
+  "Non-Negotiables", and "GitHub Review Threads" sections of
+  `.codex/skills/openiap-workflows/SKILL.md` and apply them as written; they
+  are agent-agnostic rules, not Codex-only rules.
+- Where that file says to use the Codex Chrome Extension, use Claude's browser
+  tooling (Claude in Chrome / Playwright) instead.
+- Where that file mentions `$skill` syntax, the equivalent in Claude Code is
+  the matching skill in `.claude/skills/` or the slash command in
+  `.claude/commands/`.

.claude/skills/review-self/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: review-self
+description: Independently review and improve the agent's current implementation, working-tree changes, or pull request; fix actionable in-scope gaps; rerun relevant verification; and recheck at five-minute intervals until the work is stable or genuinely blocked. Use when the user says "review-self", asks Claude to review its own changes, requests a self-review loop, or wants current work monitored for new issues after implementation.
+---
+
+# Review Self (Claude Code)
+
+The canonical loop definition lives in `.codex/skills/review-self/SKILL.md`.
+Read it and follow every section — authority and scope preservation, target
+establishment, the review round, related OpenIAP workflows, the five-minute
+recheck contract, safe stopping conditions, and per-round communication are
+agent-agnostic and apply as written.
+
+## Claude Code Notes
+
+- Where the canonical file routes through `$openiap-workflows`, read the
+  matching `.claude/commands/*.md` file directly (or use the
+  `.claude/skills/openiap-workflows` skill).
+- For the five-minute recheck, use Claude's real wake-up mechanism for the
+  current surface (for example a scheduled reminder / wake-up tool in Cowork
+  or the Agent SDK). If no such mechanism is available in the current session,
+  complete the current round and report that automatic re-entry could not be
+  scheduled — never emulate the loop with `sleep 300`, `while true`, or an
+  abandoned background process.
+- Use read-only subagents (Task/Agent tool with an Explore-style agent) for
+  independent review lenses on large or cross-cutting diffs.

.codex/skills/openiap-workflows/SKILL.md

@@ -53,9 +53,9 @@ platform rows, connected-device rows, and explicit blocked/unsupported rows.
 ## Internal Workflow Change Guard
 
 Internal agent/workflow-only changes include `.claude/commands/`,
-`.codex/skills/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, and agent automation
-notes. Do not create a branch, push, or open a PR for those changes unless the
-user explicitly asks to publish, PR, or merge them.
+`.claude/skills/`, `.codex/skills/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`,
+and agent automation notes. Do not create a branch, push, or open a PR for
+those changes unless the user explicitly asks to publish, PR, or merge them.
 
 If a user asks to update an internal workflow and does not explicitly ask for a
 PR, keep the change local and report the changed files. If a PR is already open

.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "openiap": {
+      "type": "http",
+      "url": "https://kit.openiap.dev/mcp",
+      "headers": {
+        "Authorization": "Bearer ${IAPKIT_API_KEY:-}"
+      }
+    }
+  }
+}

.vscode/settings.json

@@ -45,5 +45,6 @@
     "editor.insertSpaces": true
   },
   "java.configuration.updateBuildConfiguration": "automatic",
-  "gradle.nestedProjects": false
+  "gradle.nestedProjects": false,
+  "eslint.workingDirectories": [{ "mode": "auto" }]
 }

AGENTS.md

@@ -26,7 +26,10 @@ openiap/
 │   ├── gql/           # GraphQL schema & type generation
 │   ├── google/        # Android library
 │   ├── apple/         # iOS/macOS library
-│   └── kit/           # Hosted receipt-validation SaaS (Fly.io app)
+│   ├── kit/           # Hosted receipt-validation SaaS (Fly.io app)
+│   └── mcp-server/    # IAPKit MCP server (hosted at kit.openiap.dev/mcp)
+├── plugins/
+│   └── openiap/       # Codex + Claude Code plugin (skills + MCP config)
 ├── libraries/         # Framework SDK implementations
 │   ├── react-native-iap/  # React Native (npm)
 │   ├── expo-iap/          # Expo (npm)
@@ -170,7 +173,8 @@ Codex-compatible local skills in `.codex/skills/`, including
 for repeated self-review of current work.
 
 Codex discovers `review-self` from this repository. Install the globally unique
-OpenIAP workflow skills into your local Codex home when needed:
+skills (`openiap-workflows` and `generate-doc`) into your local Codex home when
+needed:
 
 ```bash
 ./.codex/scripts/install-skills.sh
@@ -184,6 +188,35 @@ Keep `$review-self` repo-local. Other repositories provide project-specific
 skills with the same name, so globally linking it would make the most recently
 installed project overwrite the others.
 
+## Claude Code Compatibility
+
+Claude Code gets the same workflow surface without any install step:
+
+- **Slash commands**: `.claude/commands/*.md` load automatically as
+  `/review-pr`, `/verify-all`, and so on.
+- **Skills**: `.claude/skills/<name>/SKILL.md` are Claude Code adapters for
+  the `.codex/skills/<name>/SKILL.md` bodies. The Codex file stays the
+  canonical procedure; the Claude adapter points at it and adds only
+  Claude-specific notes (browser tooling, wake-up mechanism, subagents).
+  When you change a skill under `.codex/skills/`, check whether the matching
+  `.claude/skills/` adapter needs the same update.
+- **MCP server**: the root `.mcp.json` registers the hosted IAPKit MCP
+  endpoint (`https://kit.openiap.dev/mcp`) as a project-scoped server.
+  Export `IAPKIT_API_KEY` before launching Claude Code to authenticate.
+
+For consumers outside this repo, `.claude-plugin/marketplace.json` publishes
+the `plugins/openiap` plugin as a Claude Code marketplace:
+
+```bash
+claude plugin marketplace add hyodotdev/openiap
+claude plugin install openiap@openiap
+```
+
+`plugins/openiap` is dual-manifest: `.codex-plugin/plugin.json` (Codex, MCP
+config at `.codex-plugin/mcp.json`) and `.claude-plugin/plugin.json` (Claude
+Code, inline MCP config). The `skills/` folder is shared by both agents, so
+keep its wording agent-neutral.
+
 ## Available Skills (Slash Commands / Codex Workflows)
 
 | Skill                | Description                                        | Usage                                 |

knowledge/_claude-context/context.md

@@ -1,7 +1,7 @@
 # OpenIAP Project Context
 
 > **Auto-generated for Claude Code**
-> Last updated: 2026-07-16T23:03:55.935Z
+> Last updated: 2026-07-20T00:25:18.244Z
 >
 > Usage: `claude --context knowledge/_claude-context/context.md`
 
@@ -274,7 +274,11 @@ openiap/
 │   ├── docs/          # Documentation (React/Vite/Vercel)
 │   ├── gql/           # GraphQL schema & type generation
 │   ├── google/        # Android library (Kotlin)
-│   └── apple/         # iOS/macOS library (Swift)
+│   ├── apple/         # iOS/macOS library (Swift)
+│   ├── kit/           # Hosted receipt-validation SaaS (Fly.io app)
+│   └── mcp-server/    # IAPKit MCP server (hosted at kit.openiap.dev/mcp)
+├── plugins/
+│   └── openiap/       # Codex + Claude Code plugin (skills + MCP config)
 ├── libraries/         # Framework SDK implementations
 │   ├── react-native-iap/  # React Native (npm, Yarn 3, Nitro Modules)
 │   ├── expo-iap/          # Expo (npm, Bun, Expo Modules)
@@ -926,6 +930,10 @@ and fails when:
   examples and native Apple/Google examples
 - a GraphQL Query/Mutation/Subscription operation is added or removed without
   updating the operation parity registry
+- an Android-relevant registry operation is not wired in every
+  `packages/google` flavor handler bundle (play / horizon / amazon
+  `OpenIapModule.kt`) — the generated resolver interfaces stay green on their
+  own because new bundle fields default to `null`
 - generated types or shared TS runtime helpers drift from `packages/gql`
 - framework/package version metadata or Godot Android GDAP dependencies drift
   from the package/version SSOTs

knowledge/internal/02-architecture.md

@@ -11,7 +11,11 @@ openiap/
 │   ├── docs/          # Documentation (React/Vite/Vercel)
 │   ├── gql/           # GraphQL schema & type generation
 │   ├── google/        # Android library (Kotlin)
-│   └── apple/         # iOS/macOS library (Swift)
+│   ├── apple/         # iOS/macOS library (Swift)
+│   ├── kit/           # Hosted receipt-validation SaaS (Fly.io app)
+│   └── mcp-server/    # IAPKit MCP server (hosted at kit.openiap.dev/mcp)
+├── plugins/
+│   └── openiap/       # Codex + Claude Code plugin (skills + MCP config)
 ├── libraries/         # Framework SDK implementations
 │   ├── react-native-iap/  # React Native (npm, Yarn 3, Nitro Modules)
 │   ├── expo-iap/          # Expo (npm, Bun, Expo Modules)

knowledge/internal/04-platform-packages.md

@@ -146,6 +146,10 @@ and fails when:
   examples and native Apple/Google examples
 - a GraphQL Query/Mutation/Subscription operation is added or removed without
   updating the operation parity registry
+- an Android-relevant registry operation is not wired in every
+  `packages/google` flavor handler bundle (play / horizon / amazon
+  `OpenIapModule.kt`) — the generated resolver interfaces stay green on their
+  own because new bundle fields default to `null`
 - generated types or shared TS runtime helpers drift from `packages/gql`
 - framework/package version metadata or Godot Android GDAP dependencies drift
   from the package/version SSOTs

libraries/expo-iap/plugin/src/__tests__/tsconfig.json

@@ -0,0 +1,13 @@
+// Editor-only project for the Jest specs in this directory. The package
+// tsconfig excludes __tests__ so expo-module-scripts never emits test files
+// into build/, but that leaves VS Code without a project for them and every
+// jest global errors with ts(2708). This config re-attaches the directory to
+// the package compiler options; ts-jest still type-checks specs at test time.
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["./**/*"],
+  "exclude": []
+}

libraries/expo-iap/src/__tests__/tsconfig.json

@@ -0,0 +1,13 @@
+// Editor-only project for the Jest specs in this directory. The package
+// tsconfig excludes __tests__ so expo-module-scripts never emits test files
+// into build/, but that leaves VS Code without a project for them and every
+// jest global errors with ts(2708). This config re-attaches the directory to
+// the package compiler options; ts-jest still type-checks specs at test time.
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["./**/*"],
+  "exclude": []
+}