Customer Center

[DreamingInBinary]

Changes in this pull request

Adds the Customer Center: a native, self-service subscription-management screen inside the SDK. One call presents it:

Superwall.shared.presentCustomerCenter()

It shows the customer's subscriptions and purchases and lets them restore purchases, open Apple's manage-subscriptions sheet, request a refund, change plans, contact support, answer an exit survey, and browse purchase history. There's a SwiftUI view (CustomerCenterView), a UIKit view controller (CustomerCenterViewController), an Objective-C surface, a delegate, five SwiftUI callback modifiers, five new analytics events, and strings for all 41 locales.

Everything is configured in code via SuperwallOptions.customerCenter. The configuration model is Codable and deliberately shaped so a future dashboard/backend can serve the same JSON without changing the public API — resolution order is per-call argument → options → .default.

Zero-config gives a working screen: with an active App Store subscription you get the subscription card, Restore, Change plan, Request a refund, Cancel subscription (with a cancellation survey), See all purchases, and Account details. The only row that needs configuration is Contact support, which is hidden unless a support email is set.

Requires iOS 15+. The SDK's deployment target is unchanged at iOS 13 — the Customer Center symbols are @available(iOS 15.0, *), because every StoreKit API it drives is iOS 15+ anyway.

Reviewing this

108 files is a lot, but five files are the whole feature — the rest is SwiftUI, tests, and localization:

1. CustomerCenter/Models/CustomerCenterConfiguration.swift — the entire public surface. Start here.
2. Superwall+CustomerCenter.swift — the entry point (~100 lines).
3. CustomerCenter/ViewModel/CustomerCenterViewModel.swift — state, flows, event emission.
4. CustomerCenter/Logic/CustomerCenterPathResolver.swift — which actions appear when. This is the product logic.
5. CustomerCenter/Logic/PurchasePresentationBuilder.swift — badges, status lines, renewal dedupe.

For 4 and 5, the table-driven tests read like a spec and are the fastest way in. Alternatively the commits are in dependency order, tests first, one concept each: git log --reverse --patch <base>..HEAD -- Sources/SuperwallKit/CustomerCenter.

Changes outside CustomerCenter/ are all small, necessary hooks: SuperwallOptions (+2 lines), LogScope (+1 case), DeviceHelper (+1 internal accessor), DependencyContainer (lazy @MainActor manager), the three analytics files (5 new event cases, purely additive), SuperwallKit.md, and one defaulted parameter on a shared test fixture. TransactionManager gains a presentsFailureAlert flag defaulting to true, so paywall restore behaviour is bit-identical.

Deliberately out of scope

Promotional / win-back retention offers (they need server-side signature generation), remote dashboard configuration, support tickets, virtual currencies, and the Android / Flutter / React Native bridges.

Decisions worth a second opinion

• Version stayed at 4.16.4. develop was already ahead of master (4.16.3), so per CLAUDE.md the CHANGELOG entries went into the existing staged section rather than bumping again. New public API arguably warrants 4.17.0 — reviewer's call; it's a three-file change.
• "Customer Center" is also RevenueCat's product name, chosen for discoverability and migration parity. Verified there are no symbol clashes: our Objective-C classes are SWK-prefixed against their RC-prefixed ones, so no duplicate class registration. One real collision was found and fixed — both SDKs put presentCustomerCenter on SwiftUI's View with everything after isPresented defaulted, and Swift silently resolved the bare call to ours (its solver penalises each defaulted argument it fills; ours fills 2, theirs 13), which would have hijacked an existing RevenueCat customer's screen with no error. Our modifier is now presentSuperwallCustomerCenter. Verified by building a target that imports SuperwallKit, RevenueCat and RevenueCatUI together and demangling the linked symbols.
• Refund stays available on expired subscriptions. Apple permits it, but it's a product call.
• "Cancel subscription", not "Manage subscription". In the default configuration that row carries the cancellation survey and opens Apple's cancel sheet, so the old label overstated it. Each locale uses its subscription-termination verb (German kündigen, French résilier, Japanese 解約) rather than the dialog-dismiss word.
• The 41 locale translations are first-draft with no native-speaker review. Worth routing through localization before release.

Known gaps

• The internal navigation flag was replaced with a visibility count, which closed the embedded-mode dismissal hole. Row ordering is nondeterministic when two products tie on both active-ness and expiry date (contents are deterministic). Support/Appearance/ColorPair override isEqual without hash, matching existing convention in CustomerInfo and friends.
• dismiss(completion:)'s UIKit-driven completion path and the SDK's alert-suppression have no automated coverage: the hostless test target cannot complete modal presentations or present a UIAlertController, so such assertions would pass whether or not the code works. Both were verified manually instead.

Testing

1006 tests across 110 suites, all passing. Every task was reviewed by someone other than its author, with a cross-cutting review over the whole branch.

A full manual pass was also run on device across 20 scenarios — purchase, cancel, refund, expiry, billing retry, empty state, restore, delegate callbacks, code-driven configuration — and it found two real bugs that static review did not:

• Apple's manage-subscriptions sheet never appeared after the cancellation survey. ManageSubscriptionsSheet branched on groupId, which turned non-nil in the same update that flipped isPresented true; SwiftUI tore down the modifier that was about to present. Now branches only on #available.
• Restoring with no purchases showed two stacked alerts — the SDK's paywall-worded failure alert on top of the Customer Center's own.

Also fixed from that pass: disclosure chevrons were removed from action rows (a chevron promises a push, and none of those rows push), and the update banner now animates out instead of blinking.

Checklist

• All unit tests pass. (1006 tests / 110 suites)
• All UI tests pass. — N/A, this repo has no UI test target.
• Demo project builds and runs on iOS. (Basic and Advanced; manually exercised on iPhone 17 simulator)
• Demo project builds and runs on Mac Catalyst. (framework builds for Catalyst; the Customer Center is #if os(iOS) and available on Catalyst 15+)
• Demo project builds and runs on visionOS. — not verified; CI doesn't build visionOS.
• I added/updated tests or detailed why my change isn't tested. (See "Known gaps" for the two paths the hostless test target cannot cover.)
• I added an entry to the CHANGELOG.md for any breaking changes, enhancements, or bug fixes.
• I have run swiftlint in the main directory and fixed any issues. (10 violations, all pre-existing on develop; zero added.)
• I have updated the SDK documentation as well as the online docs. — DocC article added (Documentation.docc/CustomerCenter.md) and linked from SuperwallKit.md. The online docs page still needs writing.
• I have reviewed the contributing guide

cc @yusuftor @jakemor @anglinb

Known limitation: web prices assume USD

/v1/products stamps currency: "usd" unconditionally (products-public.ts); the real per-product currency lives in Product.metadata.__superwall_price_currency and isn't loaded on that path. So a non-USD web subscription renders as dollars here. The V2 products API already resolves it correctly via ProductMapper.normalizeCurrency, so the fix is server-side. Shipping as-is on the assumption app-to-web is US-only today.

[greptile-apps]

PR author is not in the allowed authors list.

[pullfrog]

Pullfrog billing is temporarily unavailable.

model-credential service temporarily unavailable — retry shortly

Usually transient; the next dispatch should succeed. If it persists, check status.pullfrog.com or your console.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Pullfrog billing is temporarily unavailable.

model-credential service temporarily unavailable — retry shortly

Usually transient; the next dispatch should succeed. If it persists, check status.pullfrog.com or your console.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No blocking issues. The Appearance narrowing is clean and settles the last review's scope question outright; the new snapshot scenarios have two fixtures that don't produce the state their caption describes. Suggestions inline.

Reviewed changes — the three commits since the prior pullfrog review at 058dacf: 576f842, 00c2354 and 290e626.

• Cut Appearance down to the one colour that reaches a pixel — background, text, buttonText and buttonBackground are gone from the public class (property, init, isEqual, hash) and from CustomerCenterTheme, with a doc comment recording that removing them from a public Codable ObjC type after release would have been breaking. Nothing in Sources/, Tests/ or Examples/ read them, Appearance() still compiles, and the CHANGELOG and DocC intro now say "accent colour". This answers the previous review's scope question rather than deferring it.
• Made pushedCoverDoesNotFireLateDismissal able to fail — the debounce is now armed explicitly with surfaceDidDisappear() instead of relying on SwiftUI's onDisappear firing in a hostless harness, so the test no longer passes with the veto deleted.
• Removed the two stale sentences from the bar test's doc comment — the pair describing the nav-bar takeover that 1b1d7b3 deleted are gone, leaving only the accurate ones. Thread resolved.
• Added seven design-review scenarios (23-30) — web-only, web with no management URL, mixed App Store + web, two mixed detail screens, two subscription groups, a comped entitlement and a family-shared purchase, plus a web_pro_monthly catalogue entry and a familyShared parameter on the fixture wired through StoreKitTransactionLookupMock.
• Flip-flopped the Advanced example and landed where it started — 576f842 restored testModeBehavior = .never and the cancellation survey, 00c2354 took both back out, so Examples/Advanced/** is byte-identical to 058dacf.

I checked the three fixture behaviours the new scenarios depend on and they hold: 25's duplicate banner does fire (an active .appStore store alongside .stripe is exactly the condition at CustomerCenterViewModel.swift:142-145), 30's family-sharing does gate all three of manage/refund/change-plan (familyShared: ["monthly_pro"] matches subscription()'s default productId), and CustomerCenterConfiguration.default is a computed var, so the per-scenario mutations can't leak between snapshots.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No blocking issues — all four findings from the last review were applied verbatim, and the two fixture corrections do change what gets rendered. One suggestion inline. Not approving only because a dozen older threads are still open.

Reviewed changes — the single commit since the prior pullfrog review at 290e626: f01911b, which corrects the design-review fixtures and moves the snapshot switch onto the scheme. The only Sources/ edit is a comment, so there is no shipped behaviour change in this delta.

• Gave scenario 23 a management URL the resolver can actually see — EnvironmentMock(webManagementURL:) is now passed alongside support.webManagementURL, so 23 resolves .webManage rather than silently rendering 24's unconfigured screen. Verified: PathResolutionContext.webManagementURL is sourced only from dependencies.environment.webManagementURL (CustomerCenterViewModel.swift:173), and only LiveEnvironment reads the configuration slot (CustomerCenterDependencies.swift:236).
• Split scenario 24 off from 23 by capturing what the tap produces — since both destinations are isWebManagement, PathsListView titles them identically and the two lists really are the same screen; 24 now captures the customer_center_web_manage_unavailable copy instead.
• Made scenario 29 a genuine comped grant — Entitlement(id: "pro", store: nil) reaches the internal memberwise init (Entitlement.swift:175-189) instead of the public convenience one that hardcodes store: .appStore, so the fixture takes the .entitlementOnly arm the caption describes.
• Stopped every screenshot showing a 1969 install date — makeViewModel replaces EnvironmentMock's epoch default with a plausible date before building dependencies, so Account details reads sensibly across all 30 scenarios.
• Moved the snapshot switch onto the scheme — CUSTOMER_CENTER_SNAPSHOT_DIR is declared in project.yml with isEnabled: false and regenerated into all three scheme actions, and the file header now documents the Xcode-scheme route plus the deliberate closing Issue.record. Off by default, so scripts/test.sh is unaffected.
• Repointed the loading cover's comment at the configuration slot and recorded the viewDidDisappear → onDisappear ordering as an assumption — both are the previous review's suggested wordings applied as-is.

I checked the three things this could plausibly have broken and they hold: Entitlement(id:store:) resolves to the internal init under @testable import with every other parameter defaulted, so there is no ambiguity with the public init(id:); EnvironmentMock is a struct with a var originalDownloadDate: Date?, so the local var environment = environment copy-and-mutate compiles and the Date? == Date comparison promotes correctly; and no changed line exceeds the lint length limit or carries trailing whitespace.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No new issues of substance — the manage-setter asymmetry from the last review is closed, and the new binding-level test fails against the old setter. Two nitpicks inline. Not approving only because older threads remain open.

Reviewed changes — the single commit since the prior pullfrog review at f01911b: edb9e48, which stops a covered surface tearing down the visible surface's sheet. Three files, one behavioural line.

• Gated the manage sheet's dismissal write on the sheet actually up — isManagePresented's setter went from an unconditional viewModel.sheet = nil + sheetDidDismiss() to the new CustomerCenterSheetOwnership.dismissalClears(_:_:), so a stale false write can no longer clear someone else's sheet or run a receipt refresh against a sheet that was never showing. refundBinding's setter is byte-equivalent to its old case .refund check, only rerouted through the shared rule.
• Made the rule and the modifier testable — CustomerCenterSheetsModifier and its two boolean bindings went private → internal, with a comment recording why (the gate has been wrong twice, and both times in the binding rather than in the rule).
• Added three tests, one of which reaches the real binding — a 4-row table over dismissalClears, the nil case, and staleDismissalLeavesTheOpenSheetAlone, which constructs the modifier at surfaceDepth: 0 and writes false into isManagePresented while sheet == .refund. That last one fails against the pre-edb9e48 setter, which is what the previous review asked for.
• Gave scenario 24 the container production actually uses — a new captureSheet helper renders the sheet copy with no NavigationView, so the PNG no longer paints a title bar the real page sheet doesn't have.

I checked the thing this guard could plausibly have left open and it holds up: dismissalClears matches on the sheet's case, not on which surface presented it, so in principle a covered surface could still clear a same-case sheet another surface has up. Tracing every production writer of pushDepth (CustomerCenterPushNavigator.push, reachable only from CustomerCenterDrillDown's button, and onRemovedFromParent), changing the depth requires touching a screen that Apple's StoreKit sheet is covering — and no SDK code pops the stack programmatically. CustomerCenterPathResolver also needs a non-nil purchase for both the manage and refund destinations while ManagementScreenView.swift:49 passes nil from the root whenever there is more than one purchase, so in the only shape where two depths coexist the root can't resolve those paths at all. The same argument covers itemSheet's still-ungated setter. The one residual is a host popping its own navigation stack in .pushed mode while a StoreKit sheet is live, which is outside anything the SDK drives.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No new issues. Both nitpicks from the last review were applied essentially verbatim, and the added assertion fails against the setter it guards. Not approving only because thirteen older threads remain open.

Reviewed changes — the single commit since the prior pullfrog review at edb9e48: a9ad11d, which answers both of that review's inline nitpicks. Two files, +13/−4, and no shipped behavioural surface.

• Said which gate applies to which half of the binding — isTopmost's doc comment (CustomerCenterSheets.swift:67-71) went from "Only the getters are gated" to the depth-vs-identity split, which is the distinction the code actually draws. Comment only: isTopmost, both boolean bindings and itemSheet are byte-identical to edb9e48.
• Pinned the manage binding's positive case — staleDismissalLeavesTheOpenSheetAlone now raises pushDepth to 1, puts a manage sheet up, writes false into isManagePresented from the non-topmost surface, and asserts sheet == nil. That is the "the owner may always clear" invariant the earlier depth-gated setter broke, and the assertion fails if depth gating is reintroduced on the setter — so it is real coverage rather than a restatement of the two rule-level tests above it.

I checked the one thing worth checking on a test that fires an unstructured task. The setter's Task { await viewModel.sheetDidDismiss() } outlives the test body, but dependencies.customerInfo is CustomerInfoProviderMock, lastPresentedSheet was never set so it takes the cached fetchCustomerInfo() arm rather than a receipt refresh, and the view model is test-local — nothing escapes into the rest of the .serialized suite. The assertion itself deliberately stops at sheet == nil; asserting the task ran would be near-tautological, since the nil write always precedes it on that path.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

The new AppStoreVersionLookup tests share URLProtocol statics across a suite that has no .serialized trait, so they can stomp each other's stubbed response and race on an unsynchronised Array. One line to fix, and it's the only new finding.

Reviewed changes — the single commit since the prior pullfrog review at a9ad11d: be729b8, which answers three long-open threads. Two are now retired, two are partial and stay open.

• Walked the whole parent chain when a pushed drill-down disappears — the chain walk was lifted out of CustomerCenterViewController.isLeavingHierarchy into an internal UIViewController.isLeavingHierarchyOrAContainerIs, and CustomerCenterPushedHostingController.viewDidDisappear now uses it instead of testing self alone. A host dismissing a container that holds a pushed Customer Center while the user is on a drill-down no longer vetoes the debounce, so the dismissal is actually delivered. The root controller's behaviour is byte-for-byte unchanged.
• Narrowed the comped-grant exclusion from the purchase kind to a nil entitlement store — .entitlementOnly alone was taking the management row away from web purchases that arrive as a bare entitlement, which is the shape the backend produces whenever it sends no matching transaction. Keying on entitlement.store == nil keeps the row for paying Stripe/Paddle customers and drops it only for grants with nothing behind them.
• Guarded the deprecated region read and named the region in the failure log — regionCode's default moved to a new deviceRegionCode that makes the same #available(iOS 16, *) split as DeviceHelper.regionCode, the doc comment stopped calling the value a storefront, and the "no App Store listing" warning now says which region it asked about.
• Exercised AppStoreVersionLookup end to end — a URLProtocol stub, per-test UserDefaults(suiteName:) and an injected clock now cover the bundleId/country query items, the empty-region omission, non-2xx responses and both sides of the 24-hour cache.
• Pinned both halves of the web-entitlement rule — makeEntitlementOnlyViewModel(store:) was extracted, the comped case now asserts it actually reaches the web branch, and a new parameterised test over [.stripe, .paddle] fails if the rule is keyed on the kind again.

Three things I checked that came back clean. The chain walk has no demonstrated false positive: a nav controller at the window root terminates the walk, a UITabBarController tab switch sets neither flag because children stay in viewControllers, and presentation is orthogonal to parent — only a custom container that "covers" by literally calling removeFromParent() could trip it, and nothing here does that. The veto side is still pinned by the pre-existing coveringADrillDownDoesNotDismiss (CustomerCenterSheetOwnershipTests.swift:207-233), which fails if the walk is replaced with a constant true. And deviceRegionCode's claim that it matches DeviceHelper.regionCode holds line for line.

ℹ️ Nitpicks

• Tests/SuperwallKitTests/CustomerCenter/Logic/AppStoreUpdateCheckTests.swift:218-221 — makeDefaults() never calls removePersistentDomain(forName:), so each run leaves eight UUID-named preference plists behind in the test host's container.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in these two commits — they close five open threads and each fix comes with a test that fails against the old code. One access-level nitpick below. Not approving because the .serialized finding from the previous review and five older threads are still open.

Reviewed changes — the two commits since the review at be729b8: 7841bc13 (the veto's ordering race) and c473247 (the catalogue cache).

• Made the cover veto independent of when SwiftUI delivers onDisappear — a new isDismissalSuppressed flag replaces the one-shot cancelPendingDismissal() at both veto sites. surfaceDidDisappear now refuses to arm the debounce while it's set, and surfaceDidAppear clears it, so a covered .pushed Customer Center stays quiet whether SwiftUI reports the disappearance before or after viewDidDisappear returns. pushedCoverSurvivesALateDisappearance pins the ordering the old code lost, and also asserts the genuine teardown still lands afterwards.
• Corrected three comments that overclaimed — the two copies of the date-locale note now name DeviceHelper.preferredLocaleIdentifier instead of SuperwallOptions.localeIdentifier, and load()'s "close before open" claim was narrowed to the lookup, since closing while apply's StoreKit round trip is up can still emit close first.
• Dropped the four Customer Center entries from the CHANGELOG's ### Fixes — only the two that predate this branch remain under ## 4.17.0, so nothing reads as a fix to a feature nobody has shipped against.
• Cached the Superwall catalogue for five minutes — a new CatalogueCache actor wraps the /v1/products call, so a web-store customer no longer pays for it again on every restore and every sheet dismissal. A throwing fetch is deliberately not cached, and all three cases are tested against an injected clock.
• Extracted the gap-fill into a testable static — LiveProductsProvider.fillingGaps(in:requested:from:) is now pure, and five new cases pin that StoreKit always wins, that an App Store product is never priced from the dashboard catalogue, and that the catalogue's name reaches the card. Each fails if its rule is removed.

Two things I traced and found clean. The dismissal state machine holds under the new flag across the four shapes that matter — drill-down popped normally, whole stack popped at once (the root's didMove(toParent: nil) reaches dismiss() directly, bypassing suppression, which the new test's second assertion pins), host push then pop, and a page sheet over the modal style, which produces no viewDidDisappear at all and so never sets the flag. And the catalogue's guard !missing.isEmpty early return is still before the fetch, so an App-Store-only customer still issues no request.

ℹ️ Nitpicks

• Sources/SuperwallKit/CustomerCenter/ViewModel/CustomerCenterDependencies.swift:184 and :233 — withCatalogueTimeout lost its private and CatalogueCache.isFresh never had one, but each has exactly one caller in the same file (:136 and :225). On an actor, a non-private isFresh also invites an await from outside that nothing needs.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No critical issues in this delta — the URL title change is complete and the two partial fixes both land. One minor suggestion inline. Not approving only because two prior threads are still legitimately open (AppStoreVersionLookup's country= source, and the catalogue fetch on the first-paint path).

Reviewed changes — the single commit since the prior pullfrog review at c473247: 92a2c20, which gives a URL path its own row name and closes two findings that were previously only half-answered.

• Made a URL row name itself — PathType.url gained a required title associated value, and PathsListView.title reads it instead of url.host, so FAQ, terms and privacy on one host no longer render as three identical rows. Every Swift, Objective-C, DocC, example and test call site was updated; nothing constructs .url without a title.
• Made the title rule directly testable — PathsListView.title(for:strings:) is now static, with a new PathTitleTests suite covering the same-host case, the built-in localized fallbacks, explicit-title precedence, and the manage row's App-Store-versus-web wording.
• Keyed the App Store version cache on the region it was fetched for — a third UserDefaults key compared in cachedVersion(), plus lookupDoesNotServeAnotherRegionsAnswer, which fetches in GB then JP at the same instant and fails without the key.
• Gated the web management row on the purchase's kind and state — the branch now returns nil for a .nonSubscription purchase and for a revoked or inactive subscription, pinned by nothingToManageMeansNoRow and oneOffWebPurchaseHasNoRow. I checked the states this could have over-narrowed: grace period, billing retry and cancelled-but-live all carry isActive == true in this model (badge(for:) reaches .billingIssue only when isActive is true), and build() pre-filters entitlements on isActive, so no .entitlementOnly presentation can arrive inactive. No paying customer loses their route to the billing portal.
• Serialised AppStoreUpdateCheckTests — the suite's shared StubURLProtocol statics are no longer read and written by concurrently-scheduled cases.

ℹ️ title is now the one key a dashboard-served path payload can't omit

PathType is Codable and the stated intent is that a future dashboard serves this same JSON. Support has a hand-written init(from:) precisely so a payload written before a key existed still decodes; url's title is a required associated value with no equivalent tolerance, and Screen.paths decodes as a whole array, so one path missing title would throw the entire configuration away rather than degrade. Nothing decodes this from the wire today, so this is a decision to record rather than a bug to fix.

Technical details

# Decide whether a dashboard-served `url` path may omit `title`

## Affected sites
- `Sources/SuperwallKit/CustomerCenter/Models/CustomerCenterConfiguration.swift:190` —
  `case url(URL, title: String, openMethod: OpenMethod)`. The SE-0295 synthesised decoder
  requires the `title` key and throws `keyNotFound` without it.
- `Sources/SuperwallKit/CustomerCenter/Models/CustomerCenterConfiguration.swift:118` —
  `public var paths: [Path]` decodes with the synthesised array decoder, so a single
  undecodable path fails the whole `Screen`, and therefore the whole
  `CustomerCenterConfiguration`.
- `Sources/SuperwallKit/CustomerCenter/Models/CustomerCenterConfiguration.swift` (`Support`'s
  hand-written `init(from:)`) — the in-file precedent, whose doc comment states the contract:
  "Everything the dashboard will eventually serve has to survive being decoded from JSON
  written before the key existed."

## Required outcome
- A recorded answer to whether the eventual backend contract makes `title` mandatory for a
  `url` path, or whether the client must tolerate its absence. Either is fine; the risk is
  only that the asymmetry with `Support` is unintentional.

## Open questions for the human
- If the dashboard will always send `title`, is that enforced server-side, or would a
  hand-rolled `PathType` decoder that falls back to the URL host on a missing `title` be
  cheaper insurance than a configuration that fails closed?

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

Making every subscription a drill-down moved the per-purchase actions off the root screen, but entitlement-only purchases never get a drill-down — so the web management row the last few commits built is now unreachable for them. Three earlier threads also remain open (AppStoreVersionLookup.swift, CustomerCenterDependencies.swift, CustomerCenterConfiguration+ObjC.swift), untouched by this commit.

Reviewed changes — the delta since the prior pullfrog review at 92a2c20, a single commit (d0be8f8) across 10 files.

• Hid purchases whose product resolved without a display name. New ProductDisplayInfo.hasDisplayName (set from whether SK1/SK2/catalogue supplied a name) and PurchasePresentationBuilder.isNameable, applied via compactMap in both subscriptionPresentations and nonSubscriptionPresentations. A product that didn't resolve at all keeps its identifier fallback; entitlement-only rows are exempt.
• Deleted the purchase-history screen. PurchaseHistoryView.swift, PurchaseDetailRows, CustomerCenterViewModel.historySections(), ManagementScreenView.visibleOthers/inlineOthersLimit, the public CustomerCenterConfiguration.showsPurchaseHistory (property, init parameter, isEqual, hash), ManagementScreenViewTests, and five string keys across all 41 locales. Grep-verified: no dangling references.
• Made every subscription a drill-down row. ManagementScreenView dropped the isSingle single-purchase layout; the root action list now always resolves with purchase: nil, and per-subscription actions live on PurchaseDetailScreenView.
• Reworked the web-pricing tests. cardShowsPrice split into unnamedWebProductIsHidden (no name, no card) and a named variant asserting card.title == "Pro"; three new PurchasePresentationBuilderTests cases pin the hide rule per card. All are falsifiable against a deleted filter.
• Updated the CHANGELOG, DocC article and design-review fixtures to describe the new shape, including a new "no display name isn't shown" limitation.

⚠️ Two of this release's CHANGELOG bullets now contradict each other

Bullet 5 still promises that the web management row "stays visible when no management URL is configured, explaining that the link is in the customer's emailed receipt, instead of disappearing and leaving them with no action at all". Bullet 4, added by this commit, says a web purchase with no catalogue display name "isn't shown at all" — and the catalogue doesn't return names yet. Taken together, on today's backend a paying web subscriber whose purchase arrives with a transaction sees an empty management screen (state is still .management, because hasAnyPurchases reads raw CustomerInfo rather than the filtered presentations), and the one whose purchase arrives as a bare entitlement sees an inert card with no action. Neither can reach .webManage or .webManageUnavailable.

Technical details

# The web management row is unreachable on today's backend

## Affected sites
- `CHANGELOG.md:12` — bullet 4 ("isn't shown at all") and `CHANGELOG.md:13` — bullet 5 ("it stays visible … instead of disappearing and leaving them with no action at all") describe mutually exclusive behaviour in the same release section.
- `Sources/SuperwallKit/Documentation.docc/CustomerCenter.md:232-234` — the limitation is documented accurately, but it is documented as a temporary catalogue gap rather than as "web subscription management is not shipping in this release".
- `Sources/SuperwallKit/CustomerCenter/ViewModel/CustomerCenterViewModel.swift:150` — `state = hasAnyPurchases(customerInfo) ? .management : .noPurchases` is computed from raw `CustomerInfo`, not from the filtered `purchases`, so a customer whose only purchase was hidden lands on the management screen with nothing on it rather than on the no-purchases screen.

## Required outcome
- The release's user-facing notes describe one behaviour, not two. Either bullet 5's promise is qualified, or the hide rule exempts purchases that have a reachable management action.
- A customer whose every purchase was hidden is not shown an empty "Manage subscriptions" screen.

## Open questions for the human
- Is the catalogue `name` field landing before this SDK release? If yes, this is a sequencing note and the bullets just need reconciling. If no, shipping bullet 5 as written describes a row no customer can see.
- Should `hasAnyPurchases` be computed from the filtered presentations so the no-purchases screen (which at least offers Restore and Contact support with an explanation) is shown instead of a blank management screen?

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

opensDetail decides whether to push a detail screen from the purchase's kind, but the screen it pushes contains nothing except the paths that resolve for that purchase — and under the shipped zero-config default, several realistic shapes resolve none. Details inline on PurchasePresentation.swift:61.

Reviewed changes — the two commits since the prior pullfrog review at d0be8f8: d6dfcdb (a nameless purchase loses its title, not its card) and 95baa1c (entitlement-only purchases get their detail screen back, plus three review threads closed).

• Reverted the hide-when-unnamed rule — ProductDisplayInfo.title and PurchasePresentation.title are both String? now, hasDisplayName and PurchasePresentationBuilder.isNameable are deleted, and subscriptionPresentations/nonSubscriptionPresentations went back from compactMap to map. Nothing is filtered out of the screen any more.
• Added an entitlement fallback for the card heading — new PurchasePresentationBuilder.entitlementTitle(_:) takes the lowest entitlement id from CustomerInfo.entitlementsByProductId, so the chain is product display name → entitlement id → nothing, and the product identifier never appears. PurchaseCardView moved the badge beside the text column so a titleless card has no empty first line.
• Gave entitlement-only purchases a drill-down — new PurchasePresentation.opensDetail, false only for .nonSubscription, replaces ManagementScreenView's subscription != nil filter. This is the fix for the prior review's ManagementScreenView.swift:48 finding.
• Coalesced overlapping catalogue fetches — CatalogueCache gained an inFlight: Task<…>? handoff so two callers arriving on a cold cache share one request, with a test for the overlap.
• Populated Path.title from the Objective-C url factory, so an ObjC caller can read a URL row's label back through the @objcMembers property rather than only through the @nonobjc enum.
• Pruned seven orphaned localization keys (purchase_date, expiration_date, transaction_id, product_id, store, sandbox, offer) from English and all 41 locale files, along with the stale no-chevron comment and the DocC limitation note.

Things I checked that need no attention: key parity is exact after the prune (65 English keys, identical sets in all 41 .lproj files); hasDisplayName/isNameable have zero remaining references; only PurchaseCardView and PurchaseDetailScreenView's navigationTitle read purchase.title, and both handle nil; .refund and .changePlan both require a SubscriptionTransaction, so opensDetail == false for one-off purchases is correct; the catalogue fetch is parameterless, so sharing the first caller's closure can't serve one caller another's request; and CatalogueCache has no suspension point between the freshness check and inFlight = task, so two callers genuinely cannot both fetch and inFlight is never left stale or poisoned by a throwing fetch.

ℹ️ An internal entitlement identifier is now a customer-facing card heading

The fallback chain replaces one raw identifier with another. Entitlement ids are developer-chosen strings — pro, premium, tier_1 — that a customer has never seen, and they render verbatim: unlocalized, uncapitalized, exactly as typed into the dashboard. The PR's own test asserts the card reads "pro". Before d6dfcdb this only affected entitlement-only rows, which have no product to be named by; now any purchase whose product the catalogue hasn't named can be headed this way, which today is every web purchase.

This is a product call rather than a defect — entitlementPresentation has always used entitlement.id, and the CHANGELOG and DocC both describe the new behaviour — so it's raised only because the commit widened who sees it.

Technical details

# Decide whether an entitlement id is a customer-facing string

## Affected sites
- `Sources/SuperwallKit/CustomerCenter/Logic/PurchasePresentationBuilder.swift:63-65` —
  `entitlementTitle(_:)` returns `entitlements.map(\.id).sorted().first` untransformed.
- `Sources/SuperwallKit/CustomerCenter/Logic/PurchasePresentationBuilder.swift:125,179` — the two
  call sites that put it on a card.
- `Sources/SuperwallKit/CustomerCenter/Logic/PurchasePresentationBuilder.swift:206` —
  `entitlementPresentation` already did this for entitlement-only rows.
- `Tests/SuperwallKitTests/CustomerCenter/Logic/PurchasePresentationBuilderTests.swift` —
  `unnamedProductFallsBackToEntitlement` pins `title == "pro"`, lowercase.

## Required outcome
- A recorded decision on whether a dashboard-side entitlement identifier is acceptable as a card
  heading, or whether a nameless purchase should show no title at all until the catalogue names it.
- If it stays, a note in `Documentation.docc/CustomerCenter.md` telling integrators their
  entitlement ids can reach customers, so they name them accordingly.

## Open questions for the human
- `CustomerInfo.entitlementsByProductId` (`CustomerInfo.swift:25`) includes inactive entitlements,
  so a lapsed subscription with an unnamed product can be headed by an entitlement the customer no
  longer holds. Intended, or should the fallback filter on `isActive`?

ℹ️ Nitpicks

• Sources/SuperwallKit/CustomerCenter/ViewModel/CustomerCenterDependencies.swift:237 — Task { try await fetch() } is unstructured, so it no longer inherits the caller's cancellation the way the plain try await fetch() it replaced did. A Customer Center dismissed mid-fetch keeps the request alive until withCatalogueTimeout's 5s fires instead of unwinding at once. Bounded, so not a hang, but it's a behaviour change the comment above doesn't mention.
• Tests/SuperwallKitTests/CustomerCenter/Logic/CatalogueCacheTests.swift:72 — overlappingCallersShareOneFetch depends on the first async let child reaching the actor before the second. Nothing guarantees that dispatch order, and in the reverse interleaving the second closure (no sleep) completes and caches before the first arrives, so the assertion holds against the un-coalesced implementation too. Sequencing the two explicitly — let the first signal from inside its closure that it is in flight, then start the second — would make the test discriminate in every interleaving.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

Important

The new "nothing to manage" line is reachable for a subscription the customer is currently being billed for: a live Play Store (or .other/.custom) subscription drills into a screen whose card reads "Active — Renews on …" and whose body says there is nothing to manage. Details inline on ManagementScreenView.swift:86.

Reviewed changes — the single commit since the prior pullfrog review at 95baa1c: 207663b, which answers that review's opensDetail finding by giving the detail screen something to say instead of narrowing which rows push.

• Gave the purchase detail screen an empty state — PurchaseDetailScreenView now renders the "Actions" section only when something resolves, and otherwise a secondary-styled explanation carrying accessibilityIdentifier("customer_center.detail.nothing_to_manage"). The purchase card above it is unchanged, so the screen is never blank.
• Added CustomerCenterViewModel.hasActions(for:) — !paths(for: purchase, isScreenLevel: false).isEmpty, the same call with the same arguments that PathsListView makes one line below, so the gate and the list cannot disagree. paths is pure and allocation-cheap, so evaluating it twice per body pass is free.
• Added customer_center_detail_nothing_to_manage — to englishStrings and to all 41 .lproj bundles, keeping CustomerCenterStringsTests.allLocalesComplete green.
• Added PurchaseDetailActionsTests — six @MainActor cases driven off the shipped .default configuration: four shapes that resolve to nothing (revoked App Store, lapsed web, .playStore/.other, comped grant with no management page) and two that don't (active App Store, active web with no management URL, which still gets the receipt-link row). Each #requires the row exists first, so a shape that stopped reaching a card would fail rather than silently pass.

ℹ️ Nitpicks

• Tests/SuperwallKitTests/CustomerCenter/Views/DesignReviewSnapshots.swift:465,630,655 — the design-review fixtures render PurchaseDetailScreenView for the multi-subscription, mixed-store and two-group shapes, but none for a purchase with no resolvable actions. This commit adds a new customer-visible screen state that the PNG set a designer looks at won't contain.
• Sources/SuperwallKit/Resources/Localizations/*/Localizable.strings — the new key is appended below each file's /* Customer Center – support */ comment block, though it belongs to the detail screen rather than support. Harmless at runtime; it just makes the next key that genuinely is a support string land in the wrong place.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ Both [!IMPORTANT] threads from the last review are closed cleanly — one small copy accuracy point inline.

Reviewed changes — one new commit since the 207663b review, c3424db, which replaces the detail screen's single empty-state sentence with a reason-aware one and translates the three keys involved.

• Empty state branches on the purchase, not on emptiness — new CustomerCenterViewModel+PurchaseDetail.swift carries hasActions(for:) (moved out of CustomerCenterViewModel.swift) plus DetailEmptyState and detailEmptyState(for:); a live, non-revoked purchase from a store the SDK can't drive is now told where to manage it instead of that there is nothing to manage.
• Store naming split — .playStore fills customer_center_detail_managed_through with its localized label; .other and .custom fall to customer_center_detail_managed_where_bought rather than reading "through Other".
• PurchaseDetailScreenView renders the reason — ManagementScreenView.swift:103-113 maps the three cases onto their strings, with the actions section now on the else branch.
• Localization completed — the two new keys plus the previously-English customer_center_detail_nothing_to_manage now carry translated values in all 41 bundles.
• Tests assert the reason, not emptiness — PurchaseDetailActionsTests compares against exact DetailEmptyState values across eight shapes, including the live-vs-lapsed Play Store pair that distinguishes the two sentences.

Verified independently: ProductStore has exactly seven cases and isDrivable splits them exhaustively; the only live drivable purchase that resolves to no actions is a comped grant with no management page (CustomerCenterPathResolver.swift:100), for which "nothing to manage" is true, while a live web-store entitlement still gets .webManageUnavailable (resolver:103). Locale checks were mechanical: key sets identical to en in all 41 bundles, exactly one %@ in every _managed_through value, and no English sentence surviving outside en*.

ℹ️ Nitpicks

• ManagementScreenView.swift:88 — accessibilityIdentifier("customer_center.detail.nothing_to_manage") now labels the .managedElsewhere text too, so the screen's one UI-test hook names the wrong state for two of the three sentences. Nothing reads it yet, so renaming it is free.
• badge != .revoked is the only term of the new predicate no test exercises: it changes the answer solely for a revoked-and-active non-drivable subscription, and isRevoked/isActive are independently decoded (SubscriptionTransaction.swift:139-140), so the shape is representable. One more argument in the existing parameterized style would pin it.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

ℹ️ No new issues. The lifetime-grant thread from the last review is closed cleanly; approval is held only by the two older threads that are still open.

Reviewed changes — the single commit since the prior pullfrog review at c3424db: 80b1535, two files, 17 added / 1 removed.

• Excluded a lifetime badge from isLive — detailEmptyState(for:) (CustomerCenterViewModel+PurchaseDetail.swift:40) now routes an active, non-revoked lifetime grant from a store the SDK can't drive to .nothingToDo instead of .managedElsewhere, mirroring the purchase?.badge != .lifetime guard the resolver already applies to change-plan.
• Pinned the shape with lifetimePlayStoreGrant — the new case asserts purchase.badge == .lifetime before asserting the empty state, so it cannot pass on a fixture that never reaches the branch, and it fails against the old two-term predicate.

I traced the blast radius rather than taking the one-line change on faith. PurchaseBadge.lifetime is produced only by entitlementPresentation (PurchasePresentationBuilder.swift:209) — badge(for:) has no lifetime case — so the new term touches entitlement-only rows and nothing else. For a drivable store the !isDrivable guard already returned .nothingToDo, and a live .stripe/.paddle/.superwall entitlement carrying a store resolves .webManageUnavailable (CustomerCenterPathResolver.swift:103) so hasActions short-circuits before the predicate runs. The entire behaviour delta is the .playStore/.other/.custom lifetime case the thread described, and .playStore genuinely resolves no paths (CustomerCenterPathResolver.swift:82), so the row does reach the empty state.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}