# StoreKit credit product

The voluntary `ByRockyACoffee` tip remains independent and never grants credits.
Credit products are separate consumables:

- Product ID `500tks`: 500 integer credits at USD 0.99
- Product ID `1500tks`: 1,500 integer credits at USD 1.99 / CNY 18
- Product ID `3000tks`: 3,000 integer credits at USD 2.99 / CNY 28
- Territory prices remain controlled by App Store Connect.
- Restore Purchases: not offered for this consumable

## Cost basis

Reviewed on 2026-08-18 against the provider pricing pages:

- DeepSeek V4 Flash peak pricing is CNY 3 per million cache-miss input tokens
  and CNY 9 per million output tokens. Off-peak pricing is half.
  <https://api-docs.deepseek.com/zh-cn/quick_start/pricing>
- Doubao SeedASR 2.0 streaming recognition is CNY 4.5 per hour.
  <https://ai.volcengine.com/model>

The V10 immutable rate card charges:

- ASR: one credit per started three-second interval. The 3,000-credit pack
  provides up to 150 minutes and has a worst-case provider cost of CNY 11.25.
- DeepSeek: one credit per 1,000 input tokens plus one credit per 400 output
  tokens, with each dimension rounded upward. At peak pricing, using all 3,000
  credits exclusively on input or output costs at most about CNY 9.00 or
  CNY 10.80 respectively.
- New signup, inviter and invitee grants are 1,000 credits each. Existing
  immutable balances are adjusted only through explicit admin grants.
- Existing immutable ledger balances are grandfathered and are not rewritten
  during the denomination change.

At a CNY 28 sale price, the ASR-heavy worst case leaves CNY 12.55 after a 15%
App Store commission, or CNY 8.35 after a 30% commission, before tax and
infrastructure costs. USD 2.99 territories are tighter at the worst-case ASR
mix and require ongoing margin monitoring.

## Transaction rules

- The app supplies the authenticated account UUID as StoreKit `appAccountToken`.
- The server verifies Apple's JWS signature, certificate chain, bundle ID,
  App Apple ID, environment, consumable type, account token, and product ID.
- The App Store transaction ID is globally unique and idempotent.
- Credit balance and append-only purchase/ledger records commit in one database
  transaction. A client retry returns the original grant.
- The app finishes the StoreKit transaction only after server acknowledgement.
- Signed transaction bodies and Apple certificate contents are never logged.

## Purchase history

- `GET /v1/storekit/transactions` requires the existing Bearer access token.
- The account comes only from the authenticated session; clients never submit it.
- History is read from the existing purchase audit and immutable credit ledger,
  so purchases credited before the endpoint was deployed are included.
- Results are ordered by `purchasedAt` and then `transactionId`, both descending,
  with opaque cursor pagination (`limit` defaults to 50 and is bounded to 1–100).
- Responses omit JWS data, Apple identifiers, account IDs, and internal record IDs.
- History queries never call the App Store.