Buyer-only paid-package ownership, and the devices that use it. Ownership is per name and renews through the package's registry: it lapses within 30 days after that registry stops answering or the creator's admission to the platform ends, and a full refund, or a reversal of the payment, ends it. Entitlements are verified on the device.
Start checking whether the signed-in user owns package; value answers it. An entitlement this device already holds is verified on the device; without one, the creator's registry is asked online first. False when signed out. The check fails when the online refresh errors or gets no answer within 30 seconds, and when the account has reached its device limit without this device or had this device removed, with a sentence saying which. Raises at the call when commerce is unavailable (not connected, or still starting).
Start listing every paid package the signed-in user owns on this device. The listing fails when it cannot complete. Raises at the call when commerce is unavailable (not connected, or still starting).
Start listing the devices that use the signed-in account's purchases; value holds them. Asks the platform online, and fails when it gets no answer within 30 seconds. Empty when signed out. Raises at the call when commerce is unavailable (not connected, or still starting).
Buy package for the signed-in user. The workstation asks the buyer to confirm, opens the hosted checkout page in a browser and waits for the payment, then returns the granted Entitlement. Nil when the buyer declines: Cancel at any step, or (web) closing the checkout page unpaid. The charge is non-refundable. Not idempotent: raises while a purchase of package is pending. Also raises when signed out; for 10 seconds after the buyer declines one of this app's purchases; for the rest of the session once they press Block this app, that purchase included; when the account has reached its device limit without this device or had this device removed, before any page opens; when the checkout fails, or its page is rejected or cannot open; and when no payment arrives within 30 minutes.
Example
-- Nil when the buyer cancels.local entitlement = datumhue.commerce.purchase(levels)
if entitlement then
levels:install():ready()
end