Rocky
231c5040a5
Expose ledger-backed cross-device purchase history while shipping the tested React admin redesign in the same reproducible deployment revision.
61 lines
3.0 KiB
Markdown
61 lines
3.0 KiB
Markdown
# StoreKit credit product
|
||
|
||
The voluntary `ByRockyACoffee` tip remains independent and never grants credits.
|
||
Credit products are separate consumables:
|
||
|
||
- Product ID `500tks`: 500 integer credits at USD 0.99
|
||
- Product ID `1500tks`: 1,500 integer credits at USD 1.99 / CNY 18
|
||
- Product ID `3000tks`: 3,000 integer credits at USD 2.99 / CNY 28
|
||
- Territory prices remain controlled by App Store Connect.
|
||
- Restore Purchases: not offered for this consumable
|
||
|
||
## Cost basis
|
||
|
||
Reviewed on 2026-08-18 against the provider pricing pages:
|
||
|
||
- DeepSeek V4 Flash peak pricing is CNY 3 per million cache-miss input tokens
|
||
and CNY 9 per million output tokens. Off-peak pricing is half.
|
||
<https://api-docs.deepseek.com/zh-cn/quick_start/pricing>
|
||
- Doubao SeedASR 2.0 streaming recognition is CNY 4.5 per hour.
|
||
<https://ai.volcengine.com/model>
|
||
|
||
The V10 immutable rate card charges:
|
||
|
||
- ASR: one credit per started three-second interval. The 3,000-credit pack
|
||
provides up to 150 minutes and has a worst-case provider cost of CNY 11.25.
|
||
- DeepSeek: one credit per 1,000 input tokens plus one credit per 400 output
|
||
tokens, with each dimension rounded upward. At peak pricing, using all 3,000
|
||
credits exclusively on input or output costs at most about CNY 9.00 or
|
||
CNY 10.80 respectively.
|
||
- New signup, inviter and invitee grants are 1,000 credits each. Existing
|
||
immutable balances are adjusted only through explicit admin grants.
|
||
- Existing immutable ledger balances are grandfathered and are not rewritten
|
||
during the denomination change.
|
||
|
||
At a CNY 28 sale price, the ASR-heavy worst case leaves CNY 12.55 after a 15%
|
||
App Store commission, or CNY 8.35 after a 30% commission, before tax and
|
||
infrastructure costs. USD 2.99 territories are tighter at the worst-case ASR
|
||
mix and require ongoing margin monitoring.
|
||
|
||
## Transaction rules
|
||
|
||
- The app supplies the authenticated account UUID as StoreKit `appAccountToken`.
|
||
- The server verifies Apple's JWS signature, certificate chain, bundle ID,
|
||
App Apple ID, environment, consumable type, account token, and product ID.
|
||
- The App Store transaction ID is globally unique and idempotent.
|
||
- Credit balance and append-only purchase/ledger records commit in one database
|
||
transaction. A client retry returns the original grant.
|
||
- The app finishes the StoreKit transaction only after server acknowledgement.
|
||
- Signed transaction bodies and Apple certificate contents are never logged.
|
||
|
||
## Purchase history
|
||
|
||
- `GET /v1/storekit/transactions` requires the existing Bearer access token.
|
||
- The account comes only from the authenticated session; clients never submit it.
|
||
- History is read from the existing purchase audit and immutable credit ledger,
|
||
so purchases credited before the endpoint was deployed are included.
|
||
- Results are ordered by `purchasedAt` and then `transactionId`, both descending,
|
||
with opaque cursor pagination (`limit` defaults to 50 and is bounded to 1–100).
|
||
- Responses omit JWS data, Apple identifiers, account IDs, and internal record IDs.
|
||
- History queries never call the App Store.
|