@mpgd/cli 0.64.0 → 0.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -63,37 +63,37 @@
     "gunshi": "^0.35.1",
     "semver": "^7.8.5",
     "sharp": "0.35.5",
-    "typia": "13.0.2",
+    "typia": "15.2.1",
     "undici": "^7.29.1",
     "vite": "8.1.3",
     "yauzl": "3.4.0",
     "parse5": "7.3.0",
     "postcss": "8.5.28",
     "postcss-value-parser": "4.2.0",
-    "@mpgd/catalog": "0.13.0",
-    "@mpgd/platform": "0.32.0",
-    "@mpgd/target-config": "0.24.3",
+    "@mpgd/catalog": "0.14.0",
+    "@mpgd/platform": "0.33.0",
+    "@mpgd/target-config": "0.24.4",
     "@mpgd/phaser-assets": "0.9.1"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.21.5",
-    "@mpgd/adapter-browser": "0.12.1",
-    "@mpgd/adapter-capacitor": "0.16.3",
-    "@mpgd/adapter-devvit": "0.14.7",
-    "@mpgd/adapter-verse8": "0.7.16",
-    "@mpgd/bridge": "0.16.4",
-    "@mpgd/analytics": "0.5.5",
-    "@mpgd/game-runtime": "0.8.9",
-    "@mpgd/capacitor-play-billing": "0.4.5",
-    "@mpgd/capacitor-storekit": "0.4.5",
-    "@mpgd/game-services": "0.30.5",
-    "@mpgd/i18n": "0.6.26",
-    "@mpgd/lite-shell": "0.1.0"
+    "@mpgd/adapter-ait": "0.21.6",
+    "@mpgd/adapter-browser": "0.12.2",
+    "@mpgd/adapter-capacitor": "0.17.0",
+    "@mpgd/analytics": "0.5.6",
+    "@mpgd/adapter-verse8": "0.7.17",
+    "@mpgd/adapter-devvit": "0.14.8",
+    "@mpgd/bridge": "0.17.0",
+    "@mpgd/game-runtime": "0.8.10",
+    "@mpgd/capacitor-storekit": "0.5.0",
+    "@mpgd/capacitor-play-billing": "0.5.0",
+    "@mpgd/game-services": "0.31.0",
+    "@mpgd/lite-shell": "0.1.0",
+    "@mpgd/i18n": "0.6.27"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/lite-overlay/README.md

@@ -16,6 +16,10 @@ pnpm accept
 Standalone games install the public `@mpgd/lite-shell` package. Add `--workspace --kit-path <mpgd-kit>` to generate a game linked to a local Kit checkout.
 The CLI supports the canvas renderer; DOM and SVG renderers are planned.
 
+ttsc 0.34 compiles its type-transform plugins with Go 1.27 or later. It uses
+the Go it bundles unless `TTSC_GO_BINARY` names another one; if your mise or
+CI configuration pins Go for ttsc, pin 1.27 or later (the Kit uses 1.27.3).
+
 ## Ownership
 
 - `src/game/state.ts`: deterministic state.

package/templates/lite-overlay/apps/target-devvit/README.md

@@ -41,6 +41,16 @@ replace the `devvit.json` scheduler endpoint and should not use process-local
 memory when delivery must cross instances. The generated target exposes only
 the oRPC bridge route; the former JSON compatibility route is not generated.
 
+The bridge client (game `@mpgd/adapter-devvit`) and the bridge server
+(`src/server`) must ship in the same app build: they share one `@mpgd/bridge`
+and therefore one oRPC version. oRPC error bodies are not compatible across
+oRPC 2.0.0-beta.34 (`@mpgd/bridge` 0.16.4 and older used 2.0.0-beta.14), so a
+client and server from different kit releases would turn every oRPC error into a
+malformed-response failure. Bridge method errors and request-validation
+failures travel inside the bridge response envelope and are unaffected; only
+internal server errors and oRPC transport errors (413, undecodable bodies) use
+the oRPC error body.
+
 The default post entry uses `index.html` for a playable Canvas2D surface.
 Play full screen requests the `game` entrypoint, which loads the full game from
 the separate `game.html` document. Keep heavy imports behind the expanded entry

package/templates/phaser-game/README.md

@@ -16,6 +16,10 @@ pnpm check
 pnpm build
 ```
 
+ttsc 0.34 compiles its type-transform plugins with Go 1.27 or later. It uses
+the Go it bundles unless `TTSC_GO_BINARY` names another one; if your mise or
+CI configuration pins Go for ttsc, pin 1.27 or later (the Kit uses 1.27.3).
+
 The starter keeps game code behind `PlatformGateway` and demonstrates:
 
 - target-aware adapter selection through `APP_TARGET`
@@ -515,8 +519,8 @@ session: Google Play's `obfuscatedAccountId` and StoreKit's `appAccountToken`
 are derived from that player's id (`src/platform/commerceAccountBinding.ts`),
 and the backend checks them before it grants. The native shell's local player
 (`android-local-player` / `ios-local-player`) is the same on every install, so
-it binds nothing: Play refuses with `ACCOUNT_BINDING_REQUIRED` and StoreKit
-throws an error naming the missing session.
+it binds nothing: both stores refuse the purchase before the sheet opens with
+a `failed` result whose code is `ACCOUNT_BINDING_REQUIRED`.
 
 Point the game at the kit's reference guest identity Worker
 (`apps/game-identity-worker` in mpgd-kit, deployed per
@@ -553,7 +557,32 @@ be claimed. The scenes' `player` and `identitySession` are the boot values
 for the whole run (the platform's player when the boot sign-in failed) and
 the server player from the next launch on: key game-owned save data by
 something that does not change, such as the platform storage itself, not by
-`player.playerId`. A native shell only reaches `https:` origins, so test on a
+`player.playerId`.
+
+The game services belong to one server player for the run
+(`src/platform/gameServices.ts`). A game that replaces the guest session with
+its own and lets the player switch accounts within a run gets them closed, not
+moved to the new account: from the moment the session names another player,
+nothing is verified, restored, or finished with the new player's credentials
+for the old player's purchases (a backend rejects those for good as an
+account mismatch), no purchase is journaled under one player and bound to the
+other's store account, and purchases answer `failed` with the retryable
+diagnostic `GAME_SERVICES_PLAYER_CHANGED` before any store sheet opens.
+`main.ts` stops play at once (`onPlayerChanging`: an execution block and a
+"Switching player..." screen), and once the old services have stopped (an
+open store sheet first records its answer) it reloads the game
+(`restartForAnotherPlayer`), which boots again for the new player; replace the
+reload with your own restart if it does not suit the target. The old player's
+open purchases stay in the journal and recover when that player signs in
+again; store purchases bound to another player's account are left for that
+player instead of being verified with this one's session. Create the services
+only with the server session's player, never the native shell's local
+placeholder: services created for another player than the session's are
+closed at once (and say so in the console), and services for a second player cannot be
+created while the first player's are still open
+(`StarterCommercePinConflictError`).
+
+A native shell only reaches `https:` origins, so test on a
 device or emulator through an https tunnel to a local Worker. Account linking (Sign in with Apple or Google) is not
 part of the reference Worker yet.
 

package/templates/phaser-game/apps/target-ait/package.json

@@ -21,9 +21,9 @@
   },
   "devDependencies": {
     "@apps-in-toss/cli": "3.9.0",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3"
   }

package/templates/phaser-game/apps/target-cloudflare-pages/package.json

@@ -19,8 +19,8 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260707.1",
-    "@ttsc/unplugin": "0.32.1",
-    "ttsc": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3",
     "wrangler": "^4.107.0"

package/templates/phaser-game/apps/target-devvit/README.md

@@ -41,6 +41,16 @@ replace the `devvit.json` scheduler endpoint and should not use process-local
 memory when delivery must cross instances. The generated target exposes only
 the oRPC bridge route; the former JSON compatibility route is not generated.
 
+The bridge client (game `@mpgd/adapter-devvit`) and the bridge server
+(`src/server`) must ship in the same app build: they share one `@mpgd/bridge`
+and therefore one oRPC version. oRPC error bodies are not compatible across
+oRPC 2.0.0-beta.34 (`@mpgd/bridge` 0.16.4 and older used 2.0.0-beta.14), so a
+client and server from different kit releases would turn every oRPC error into a
+malformed-response failure. Bridge method errors and request-validation
+failures travel inside the bridge response envelope and are unaffected; only
+internal server errors and oRPC transport errors (413, undecodable bodies) use
+the oRPC error body.
+
 The default post entry uses `index.html` for a fixed, non-scrolling preview.
 Play full screen requests the `game` entrypoint, which loads Phaser from the
 separate `game.html` document. Keep preview UI free of game runtime imports so

package/templates/phaser-game/apps/target-devvit/package.json

@@ -27,10 +27,10 @@
   },
   "devDependencies": {
     "@devvit/start": "0.15.0",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
     "devvit": "0.15.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "7.3.6"
   }

package/templates/phaser-game/package.json

@@ -81,9 +81,9 @@
     "@ait-co/console-cli": "^0.1.49",
     "@cloudflare/workers-types": "^5.20260707.1",
     "@mpgd/cli": "__MPGD_DEPENDENCY_VERSION_CLI__",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3",
     "wrangler": "^4.107.0"

package/templates/phaser-game/src/i18n/messages.ts

@@ -28,6 +28,7 @@ export type GameMessageKey =
   | 'restoreNeedsSession'
   | 'restoreNeedsConnection'
   | 'restoreFailed'
+  | 'switchingPlayer'
   | 'deleteAccount'
   | 'deleteAccountConfirm'
   | 'deleteAccountPendingPurchase'
@@ -72,6 +73,7 @@ const messages = {
     restoreNeedsSession: 'Restoring purchases needs a game server session',
     restoreNeedsConnection: 'Could not reach the game server. Tap to try again.',
     restoreFailed: 'Could not restore purchases. Try again later.',
+    switchingPlayer: 'Switching player...',
     deleteAccount: 'Delete account',
     deleteAccountConfirm:
       'Delete your account? Your progress, scores, and notification settings are erased and you are signed out. '
@@ -120,6 +122,7 @@ const messages = {
     restoreNeedsSession: '구매를 복원하려면 게임 서버 세션이 필요합니다',
     restoreNeedsConnection: '게임 서버에 연결하지 못했습니다. 다시 시도하려면 누르세요.',
     restoreFailed: '구매를 복원하지 못했습니다. 나중에 다시 시도하세요.',
+    switchingPlayer: '플레이어를 전환하는 중...',
     deleteAccount: '계정 삭제',
     deleteAccountConfirm:
       '계정을 삭제할까요? 진행 상황, 점수, 알림 설정이 지워지고 로그아웃됩니다. '

package/templates/phaser-game/src/main.ts

@@ -27,6 +27,9 @@ import { setStarterServerSession } from './platform/serverSession';
 import { installPlatform } from './platform/installPlatform';
 import { installMicrosoftStorePwa } from './platform/microsoftStorePwa';
 
+/** Set by the first restart for another player (before bootstrap, which may call it). */
+let restartingForAnotherPlayer = false;
+
 await bootstrap();
 
 /** Install target services, analytics, and viewport state before starting the game. */
@@ -150,6 +153,17 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
           ...(options.monetization === undefined ? {} : { operationStore: options.monetization.operationStore }),
           analytics: analyticsSink,
           analyticsSessionId,
+          // The services are one player's for the run: another player signing in closes them
+          // (purchases fail closed, retryably). Play stops at once; the game boots again for
+          // that player once the old services have stopped.
+          onPlayerChanging: () => {
+            gameRuntime?.execution.acquireBlock({
+              reason: 'game-services:player-change',
+              channels: ['simulation', 'gameplay-input', 'audio'],
+            });
+            renderPlayerSwitch(locale);
+          },
+          onPlayerChanged: restartForAnotherPlayer,
         };
         // Configured but not signed in yet: the services wait for the server player, never
         // binding purchases or the journal to the platform's local placeholder.
@@ -216,6 +230,34 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
   }
 }
 
+/**
+ * Another player signed in to the server session within the run (a game's own
+ * account switch; the reference guest never changes player). The game
+ * services already closed for the boot player; the scenes, the action
+ * coordinator, and the notifications still hold it, so the game boots again
+ * and builds them all for the new player. Replace the reload with your own
+ * restart (back to the title, then `bootstrap()`) if a reload does not suit
+ * the target.
+ */
+function restartForAnotherPlayer(): void {
+  if (!restartingForAnotherPlayer) {
+    restartingForAnotherPlayer = true;
+    globalThis.location?.reload();
+  }
+}
+
+/** Cover the game while it restarts for another player (taps never reach it meanwhile). */
+function renderPlayerSwitch(locale: Locale): void {
+  if (document.querySelector('.player-switch') !== null) {
+    return;
+  }
+  const overlay = document.createElement('div');
+  overlay.className = 'player-switch';
+  overlay.setAttribute('role', 'status');
+  overlay.textContent = t(locale, 'switchingPlayer');
+  document.body.append(overlay);
+}
+
 /** Resolve a verified platform session or fall back to a local guest. */
 async function resolveIdentitySession(
   platform: PlatformGateway,

package/templates/phaser-game/src/platform/buildGateways/capacitorAndroid.ts

@@ -51,6 +51,11 @@ function createStoreProviders(
   return [
     createCapacitorPlayBillingServiceProvider({
       products,
+      // Sales switch (none by default): to refuse NEW purchases without
+      // touching recovery, add `purchaseGate: async () => ({ allowed })`,
+      // `allowed` read from the game's own server flag. A refusal answers
+      // ITEM_UNAVAILABLE / PURCHASES_PAUSED before the store opens; paid
+      // purchases keep reconciling. See the adapter-capacitor README.
       // The backend's resolveObfuscatedAccountId must derive the same value; see commerceAccountBinding.ts.
       accountBinding: async () => {
         const gateway = resolveGateway();

package/templates/phaser-game/src/platform/buildGateways/capacitorIos.ts

@@ -48,6 +48,11 @@ function createStoreProviders(
   return [
     createCapacitorStoreKitServiceProvider({
       products,
+      // Sales switch (none by default): to refuse NEW purchases without
+      // touching recovery, add `purchaseGate: async () => ({ allowed })`,
+      // `allowed` read from the game's own server flag. A refusal answers
+      // ITEM_UNAVAILABLE / PURCHASES_PAUSED before the store opens; paid
+      // purchases keep reconciling. See the adapter-capacitor README.
       // The backend's resolveAppAccountToken must derive the same value; see commerceAccountBinding.ts.
       getAppAccountToken: async () => {
         const gateway = resolveGateway();

package/templates/phaser-game/src/platform/commerceAccountBinding.ts

@@ -30,6 +30,37 @@ export function setStarterCommerceServerPlayer(source: (() => string | undefined
   serverPlayer = source;
 }
 
+/** The open pins: one per game services instance, all for the same player. */
+const pins = new Set<{ readonly playerId: string }>();
+
+/** Another player's game services are still open; dispose them before creating these. */
+export class StarterCommercePinConflictError extends Error {
+  constructor() {
+    super("Another player's game services are still open; dispose them before creating these.");
+    this.name = 'StarterCommercePinConflictError';
+  }
+}
+
+/**
+ * Pins purchases to the player a game services instance was created for
+ * (`createStarterGameServices` does, and releases it once those services
+ * were disposed): while the session names anyone else, a purchase binds
+ * nothing and is refused before any store sheet, so no purchase is
+ * journaled under one player and bound to another's store account. Returns
+ * the release (idempotent). Throws `StarterCommercePinConflictError` while
+ * an earlier instance for another player is still open.
+ */
+export function pinStarterCommercePlayer(playerId: string): () => void {
+  if ([...pins].some((pin) => pin.playerId !== playerId)) {
+    throw new StarterCommercePinConflictError();
+  }
+  const pin = { playerId };
+  pins.add(pin);
+  return () => {
+    pins.delete(pin);
+  };
+}
+
 /**
  * The player id a purchase is bound to: the server session's player when
  * the game set one (`setStarterCommerceServerPlayer`), else an
@@ -37,10 +68,20 @@ export function setStarterCommerceServerPlayer(source: (() => string | undefined
  * platform-anonymous session (the native shell's `android-local-player` /
  * `ios-local-player`) or a locally asserted id would give every install the
  * same binding, so it binds nothing; the backend binds the purchase to the
- * player its ingress authentication resolved anyway.
+ * player its ingress authentication resolved anyway. While game services
+ * are pinned to a player (`pinStarterCommercePlayer`), any other player
+ * binds nothing too.
  */
 export async function resolveStarterCommercePlayerId(
   gateway: Pick<PlatformGateway, 'identity'>,
+): Promise<string | undefined> {
+  const playerId = await resolveSessionPlayerId(gateway);
+  // Another player than the services' (an account switch): bind nothing.
+  return [...pins].some((pin) => pin.playerId !== playerId) ? undefined : playerId;
+}
+
+async function resolveSessionPlayerId(
+  gateway: Pick<PlatformGateway, 'identity'>,
 ): Promise<string | undefined> {
   if (serverPlayer !== undefined) {
     const playerId = serverPlayer()?.trim();
@@ -89,6 +130,45 @@ export async function resolveStoreKitAppAccountToken(
   return toUuid(await digestPlayerId(playerId));
 }
 
+/**
+ * The store account binding the native providers above give `playerId`'s
+ * purchases on `target` (`android`: Google Play's obfuscated account id,
+ * `ios`: StoreKit's app account token), derived from the player id alone;
+ * `undefined` on other targets. The game services runtime compares store
+ * purchases with it (`commerceAccountBinding`) so another player's purchase
+ * is never verified for this one.
+ */
+export async function resolveStarterStoreAccountBindingFor(
+  target: string,
+  playerId: string,
+): Promise<StorePurchaseAccountBinding | undefined> {
+  const kind = starterStoreAccountBindingKind(target);
+  if (kind === undefined) {
+    return undefined;
+  }
+  const digest = await digestPlayerId(playerId);
+  return kind === 'obfuscated-account-id'
+    ? { kind, value: toHex(digest) }
+    : { kind, value: toUuid(digest) };
+}
+
+/**
+ * The kind of store account binding this module derives for `target`'s
+ * purchases, or `undefined` where it binds none (every target but the
+ * native stores: Microsoft Store purchases, for one, carry their own
+ * claimed scope). Pass `commerceAccountBinding` only where this answers a
+ * kind: a runtime given a binding source that never answers would leave every
+ * bound purchase alone.
+ */
+export function starterStoreAccountBindingKind(
+  target: string,
+): 'obfuscated-account-id' | 'app-account-token' | undefined {
+  if (target === 'android') {
+    return 'obfuscated-account-id';
+  }
+  return target === 'ios' ? 'app-account-token' : undefined;
+}
+
 async function digestPlayerId(playerId: string): Promise<Uint8Array> {
   const bytes = new TextEncoder().encode(`${starterAccountBindingDigestPrefix}${playerId}`);
   return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));

package/templates/phaser-game/src/platform/gameServices.ts

@@ -13,11 +13,17 @@ import type { PlatformGateway } from '@mpgd/platform';
 import type { GameActionReconciliationPort } from '@mpgd/game-runtime/actions';
 import type { PurchasePresentationEvent } from '@mpgd/game-runtime/ads';
 
+import {
+  pinStarterCommercePlayer,
+  resolveStarterStoreAccountBindingFor,
+  starterStoreAccountBindingKind,
+} from './commerceAccountBinding';
 import { resolveStarterCommerceProducts } from './commerceProducts';
 import type { StarterGuestSignIn } from './guestIdentity';
 import { createStorageMonetizationOperationStore } from './monetizationJournal';
 import { resolveStarterServerSession } from './serverSession';
 import {
+  bindStarterServicesToPlayer,
   createSessionGatedGameServices,
   type StarterSessionGatedServices,
 } from './sessionGatedServices';
@@ -52,6 +58,20 @@ interface StarterGameServicesInput {
   readonly operationStore?: MonetizationOperationStore;
   readonly analytics?: AnalyticsSink;
   readonly analyticsSessionId?: string;
+  /**
+   * Called at once when the server session names another player than the
+   * services' (an account switch within the run): the services refuse
+   * everything from now on; block input or show a switching screen
+   * (`main.ts` does both). `onPlayerChanged` follows.
+   */
+  readonly onPlayerChanging?: (playerId: string) => void;
+  /**
+   * Called once after `onPlayerChanging`, when the closed services have
+   * stopped (an open store sheet first journals its answer, up to
+   * `gameServicesDisposeWaitMs`): restart the game so it boots for that
+   * player (`main.ts` reloads).
+   */
+  readonly onPlayerChanged?: (playerId: string) => void;
 }
 
 /**
@@ -60,9 +80,42 @@ interface StarterGameServicesInput {
  * over the platform storage adapter unless the game supplies its own) and
  * verified through the backend ledger, with the catalog's kinds and SKUs for
  * the gateway target resolved without a store read.
+ *
+ * With a server session (`setStarterServerSession`), the services belong to
+ * `playerId` for their whole life and fail closed for anyone else: while the
+ * session names no player, purchases and backend requests are refused
+ * (retryable); once it names another player (an account switch), the
+ * services close for good before that player's headers or store account
+ * binding reach this player's journal (purchases answer `failed` with the
+ * retryable diagnostic `GAME_SERVICES_PLAYER_CHANGED`), `onPlayerChanging`
+ * tells the host at once, and `onPlayerChanged` asks it to boot again for
+ * the new player once they have stopped. Pass the
+ * session's player as `playerId`, never the platform's local placeholder:
+ * services created for another player than the session's stay closed.
  */
 export function createStarterGameServices(input: StarterGameServicesInput): StarterGameServices {
-  return createRuntime(input, resolveStarterServerSession({ once: true }));
+  const session = resolveStarterServerSession({ once: true });
+  if (session === undefined) {
+    return createRuntime(input, session);
+  }
+  // The store account binding follows the same player as the journal, until
+  // these services were disposed; throws while another player's are open.
+  const releasePin = pinStarterCommercePlayer(input.playerId);
+  let services: GameServicesRuntime;
+  try {
+    services = createRuntime(input, session);
+  } catch (error) {
+    releasePin();
+    throw error;
+  }
+  return bindStarterServicesToPlayer({
+    services,
+    playerId: input.playerId,
+    session,
+    onDisposed: releasePin,
+    ...(input.onPlayerChanging === undefined ? {} : { onPlayerChanging: input.onPlayerChanging }),
+    ...(input.onPlayerChanged === undefined ? {} : { onPlayerChanged: input.onPlayerChanged }),
+  });
 }
 
 /**
@@ -79,14 +132,30 @@ export function createStarterSessionGatedGameServices(
     readonly onActivated?: () => void;
   },
 ): StarterGameServices {
-  const { signIn, onActivated, ...rest } = input;
+  const { signIn, onActivated, onPlayerChanging, onPlayerChanged, ...rest } = input;
+  // The inner services (a session switch) and the gate (a later sign-in) may
+  // both see the same change; the host hears each step once.
+  const once = (callback: (playerId: string) => void): ((playerId: string) => void) => {
+    let called = false;
+    return (playerId) => {
+      if (!called) {
+        called = true;
+        callback(playerId);
+      }
+    };
+  };
+  const hooks = {
+    ...(onPlayerChanging === undefined ? {} : { onPlayerChanging: once(onPlayerChanging) }),
+    ...(onPlayerChanged === undefined ? {} : { onPlayerChanged: once(onPlayerChanged) }),
+  };
   return createSessionGatedGameServices({
     // Configuration only (mode, target, whether a client exists); never sends a request.
     probe: createRuntime({ ...rest, playerId: 'session-pending' }, undefined),
     ensurePlayer: async () => (await signIn.ensure())?.playerId,
     onPlayer: (listener) => signIn.onSignedIn((signedIn) => listener(signedIn.playerId)),
-    create: (playerId) => createStarterGameServices({ ...rest, playerId }),
+    create: (playerId) => createStarterGameServices({ ...rest, playerId, ...hooks }),
     ...(onActivated === undefined ? {} : { onActivated }),
+    ...hooks,
   });
 }
 
@@ -111,6 +180,21 @@ function createRuntime(
       ? {}
       : { baseUrl: import.meta.env.VITE_MPGD_GAME_SERVICES_URL }),
     transport: resolveGameServicesTransport(import.meta.env.VITE_MPGD_GAME_SERVICES_TRANSPORT),
-    ...(session === undefined ? {} : { getHeaders: () => session.getHeaders() }),
+    // A store purchase bound to another player's account is left for that player.
+    // Only where the template binds purchases: elsewhere (Microsoft Store) nothing is compared.
+    ...(starterStoreAccountBindingKind(input.gateway.target) === undefined
+      ? {}
+      : {
+          commerceAccountBinding: () =>
+            resolveStarterStoreAccountBindingFor(input.gateway.target, input.playerId),
+        }),
+    ...(session === undefined
+      ? {}
+      : {
+          getHeaders: () => session.getHeaders(),
+          // Requests, the store account binding, and the journal follow this
+          // session's player; the services refuse while it is not theirs.
+          sessionPlayerId: () => session.current()?.playerId,
+        }),
   });
 }

package/templates/phaser-game/src/platform/guestIdentity.ts

@@ -59,9 +59,10 @@ export type StarterGuestIdentity =
  * place: that session cannot come back, and without a linked account its
  * player cannot either. Any other failure (offline, an outage) leaves the
  * stored token alone for the next attempt (`createStarterGuestSignIn`
- * retries), and until one succeeds purchases are refused with the reason
- * (`ACCOUNT_BINDING_REQUIRED` on Google Play, a StoreKit error naming the
- * missing session). One attempt: the game calls it through
+ * retries), and until one succeeds purchases are refused before the store
+ * opens with a `failed` result (`ACCOUNT_BINDING_REQUIRED`, store code
+ * `PLAY_BILLING_ACCOUNT_LOOKUP_FAILED` or `STOREKIT_ACCOUNT_LOOKUP_FAILED`
+ * when the lookup throws). One attempt: the game calls it through
  * `createStarterGuestSignIn`.
  */
 export async function startStarterGuestIdentity(input: {