@mpgd/cli 0.65.0 → 0.66.0

package/dist/native-build-info.json

@@ -1,5 +1,5 @@
 {
-  "kitGitSha": "69ac3be006da54cbb9dab9a56fe8564536483d85",
+  "kitGitSha": "9a27d7b0b8cc755238b3edab0ef7306d53597627",
   "kitDirty": false,
-  "packageVersion": "0.65.0"
+  "packageVersion": "0.66.0"
 }

package/dist/native-build-target.js

@@ -2623,6 +2623,13 @@ async function assertAssetPackNativeArtifact(report, artifact) {
 import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
 import { isIP } from "node:net";
 import path from "node:path";
+
+// node_modules/.cache/mpgd-native-build/packages/platform/src/routes.js
+function isHostedGameServicesPath(value) {
+  return value === value.trim() && /^\/api(?:\/[A-Za-z0-9_-]+)*\/?$/u.test(value);
+}
+
+// node_modules/.cache/mpgd-native-build/packages/cli/src/production-target-readiness.js
 var wechatStagingAppId = "wx0000000000000000";
 var ownerPathByTarget = {
   ait: "wrapperApp",
@@ -2654,7 +2661,7 @@ function assertProductionTargetReadiness(input) {
   }
   if (ownerPathKey === void 0) {
     if (requiresMonetizationAuthority || targetConfig.authoritativeGameServices !== false) {
-      assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target);
+      assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target, targetConfig.kind === "web" && requiresWebMonetizationAuthority);
     }
     return;
   }
@@ -2761,10 +2768,13 @@ function readCanonicalPathAllowingMissingTail(candidate, label) {
   }
   return path.join(readCanonicalPath(existingPath, label), ...missingSegments);
 }
-function assertAuthoritativeGameServicesUrl(value, target2) {
+function assertAuthoritativeGameServicesUrl(value, target2, allowSameOrigin = false) {
   if (value === void 0 || value.length === 0) {
     throw new Error(`Production target ${target2} requires VITE_MPGD_GAME_SERVICES_URL for an authoritative remote backend.`);
   }
+  if (allowSameOrigin && isHostedGameServicesPath(value)) {
+    return;
+  }
   let url;
   try {
     url = new URL(value);

package/dist/production-target-readiness.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { isIP } from 'node:net';
 import path from 'node:path';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 const wechatStagingAppId = 'wx0000000000000000';
 const ownerPathByTarget = {
     ait: 'wrapperApp',
@@ -48,7 +49,7 @@ export function assertProductionTargetReadiness(input) {
     }
     if (ownerPathKey === undefined) {
         if (requiresMonetizationAuthority || targetConfig.authoritativeGameServices !== false) {
-            assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target);
+            assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target, targetConfig.kind === 'web' && requiresWebMonetizationAuthority);
         }
         return;
     }
@@ -167,11 +168,17 @@ function readCanonicalPathAllowingMissingTail(candidate, label) {
     }
     return path.join(readCanonicalPath(existingPath, label), ...missingSegments);
 }
-function assertAuthoritativeGameServicesUrl(value, target) {
+function assertAuthoritativeGameServicesUrl(value, target, allowSameOrigin = false) {
     if (value === undefined || value.length === 0) {
         throw new Error(`Production target ${target} requires VITE_MPGD_GAME_SERVICES_URL for an `
             + 'authoritative remote backend.');
     }
+    // Hosted web/PWA clients can reach an authoritative service through their
+    // own Pages/edge ingress. Never apply this allowance to third-party/native
+    // hosts, or accept paths that URL normalization can turn into another host.
+    if (allowSameOrigin && isHostedGameServicesPath(value)) {
+        return;
+    }
     let url;
     try {
         url = new URL(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -70,10 +70,10 @@
     "parse5": "7.3.0",
     "postcss": "8.5.28",
     "postcss-value-parser": "4.2.0",
-    "@mpgd/catalog": "0.14.0",
-    "@mpgd/platform": "0.33.0",
-    "@mpgd/target-config": "0.24.4",
-    "@mpgd/phaser-assets": "0.9.1"
+    "@mpgd/catalog": "0.14.1",
+    "@mpgd/phaser-assets": "0.9.1",
+    "@mpgd/platform": "0.34.0",
+    "@mpgd/target-config": "0.24.5"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
@@ -81,19 +81,19 @@
     "@types/yauzl": "3.4.0",
     "ttsc": "0.34.2",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.21.6",
-    "@mpgd/adapter-browser": "0.12.2",
-    "@mpgd/adapter-capacitor": "0.17.0",
-    "@mpgd/analytics": "0.5.6",
-    "@mpgd/adapter-verse8": "0.7.17",
-    "@mpgd/adapter-devvit": "0.14.8",
-    "@mpgd/bridge": "0.17.0",
-    "@mpgd/game-runtime": "0.8.10",
-    "@mpgd/capacitor-storekit": "0.5.0",
-    "@mpgd/capacitor-play-billing": "0.5.0",
-    "@mpgd/game-services": "0.31.0",
+    "@mpgd/adapter-ait": "0.21.7",
+    "@mpgd/adapter-capacitor": "0.18.0",
+    "@mpgd/adapter-browser": "0.12.3",
+    "@mpgd/adapter-devvit": "0.14.9",
+    "@mpgd/adapter-verse8": "0.7.18",
+    "@mpgd/bridge": "0.18.0",
+    "@mpgd/capacitor-play-billing": "0.6.0",
+    "@mpgd/analytics": "0.5.7",
+    "@mpgd/capacitor-storekit": "0.6.0",
+    "@mpgd/game-runtime": "0.9.0",
+    "@mpgd/game-services": "0.32.0",
     "@mpgd/lite-shell": "0.1.0",
-    "@mpgd/i18n": "0.6.27"
+    "@mpgd/i18n": "0.6.28"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/notifications-overlay/common/src/platform/notificationBackend.ts

@@ -1,6 +1,7 @@
 import {
   isPublicGameServicesUrl,
   resolveGameServicesAuthorityMode,
+  resolveGameServicesBaseUrl,
   type GameServicesHeaderResolver,
 } from '@mpgd/game-services';
 import {
@@ -82,7 +83,10 @@ export function createStarterWorkerNotificationBackend(
   if (platform.target === 'reddit' || targetsWithoutWorkerBackend.has(platform.configTarget)) {
     return undefined;
   }
-  const baseUrl = input.baseUrl?.trim();
+  const baseUrl = resolveGameServicesBaseUrl(input.baseUrl, {
+    target: platform.target,
+    ...(globalThis.location?.origin === undefined ? {} : { pageOrigin: globalThis.location.origin }),
+  });
   const provider = platform.notificationsV2;
   if (baseUrl === undefined || baseUrl === '' || provider === undefined) {
     return undefined;

package/templates/phaser-game/README.md

@@ -564,8 +564,8 @@ The game services belong to one server player for the run
 its own and lets the player switch accounts within a run gets them closed, not
 moved to the new account: from the moment the session names another player,
 nothing is verified, restored, or finished with the new player's credentials
-for the old player's purchases (a backend rejects those for good as an
-account mismatch), no purchase is journaled under one player and bound to the
+for the old player's purchases (a backend answers those as another account's
+purchase), no purchase is journaled under one player and bound to the
 other's store account, and purchases answer `failed` with the retryable
 diagnostic `GAME_SERVICES_PLAYER_CHANGED` before any store sheet opens.
 `main.ts` stops play at once (`onPlayerChanging`: an execution block and a

package/templates/phaser-game/src/platform/deleteAccount.ts

@@ -1,7 +1,9 @@
 import {
   AccountDeletionError,
   GuestSessionCoordinatorError,
+  isCommercePurchaseOperationRecord,
   isMonetizationOperationRecoverable,
+  isParkedForAnotherAccount,
   type AccountDeletionClient,
   type MonetizationOperationRecord,
 } from '@mpgd/game-services';
@@ -272,7 +274,10 @@ export function createStarterAccountDeletion(input: {
           return false;
         }
         return Object.values(records as Record<string, MonetizationOperationRecord>).some(
-          (record) => record.kind !== 'rewarded-ad' && isMonetizationOperationRecoverable(record),
+          (record) => record.kind !== 'rewarded-ad'
+            && isMonetizationOperationRecoverable(record)
+            // Parked as another account's purchase: nothing of this player is in progress.
+            && !(isCommercePurchaseOperationRecord(record) && isParkedForAnotherAccount(record)),
         );
       } catch {
         return false;

package/templates/phaser-game/src/platform/gameServices.ts

@@ -4,6 +4,7 @@ import productCatalogJson from '@mpgd/catalog/catalog.json';
 import {
   createGameServicesRuntime,
   resolveGameServicesAuthorityMode,
+  resolveGameServicesBaseUrl,
   resolveGameServicesTransport,
   type GameServicesRuntime,
   type GameServicesRuntimeMode,
@@ -163,6 +164,10 @@ function createRuntime(
   input: StarterGameServicesInput,
   session: ReturnType<typeof resolveStarterServerSession>,
 ): GameServicesRuntime {
+  const baseUrl = resolveGameServicesBaseUrl(import.meta.env.VITE_MPGD_GAME_SERVICES_URL, {
+    target: input.gateway.target,
+    ...(globalThis.location?.origin === undefined ? {} : { pageOrigin: globalThis.location.origin }),
+  });
   return createGameServicesRuntime({
     gateway: input.gateway,
     playerId: input.playerId,
@@ -176,9 +181,7 @@ function createRuntime(
     authorityMode: resolveGameServicesAuthorityMode(import.meta.env.MODE),
     target: import.meta.env.VITE_MPGD_GAME_SERVICES_TARGET ?? input.gateway.target,
     deploymentTarget: input.configTarget,
-    ...(import.meta.env.VITE_MPGD_GAME_SERVICES_URL === undefined
-      ? {}
-      : { baseUrl: import.meta.env.VITE_MPGD_GAME_SERVICES_URL }),
+    ...(baseUrl === undefined ? {} : { baseUrl }),
     transport: resolveGameServicesTransport(import.meta.env.VITE_MPGD_GAME_SERVICES_TRANSPORT),
     // A store purchase bound to another player's account is left for that player.
     // Only where the template binds purchases: elsewhere (Microsoft Store) nothing is compared.

package/templates/phaser-game/src/platform/monetizationJournal.ts

@@ -1,6 +1,8 @@
 import {
+  isCommercePurchaseOperationRecord,
   isMonetizationOperationGranted,
   isMonetizationOperationRecoverable,
+  isParkedForAnotherAccount,
   type MonetizationOperationRecord,
   type MonetizationOperationStore,
 } from '@mpgd/game-services';
@@ -21,17 +23,55 @@ export const defaultMonetizationJournalRetentionMs = 30 * 24 * 60 * 60 * 1000;
  * age, or by the byte budget (`defaultMonetizationJournalMaxDocumentBytes`)
  * when the document would not fit, so the revocation pass and
  * `findByTransaction` keep them for the window whenever storage allows.
+ * Records parked as another account's purchase are the one kind of open
+ * record that leaves (`defaultMonetizationJournalParkedRetentionMs`).
  */
 export const defaultMonetizationJournalMaxTerminalRecords = 100;
+/**
+ * Records parked as another account's purchase (RFC "Another account's
+ * purchase") leave this long after their last write (30 days): the parking,
+ * or the player's last Restore Purchases resend. They are open records, but
+ * nothing of their player is in progress: the backend's answer granted and
+ * recorded nothing, and the store still holds the purchase for the account it
+ * is bound to, which recovers it under its own key. Dropping one cannot lose
+ * a grant: the backend ledger decides every grant, and a later verify of the
+ * same purchase finds a grant whose answer was lost. It costs one more verify
+ * that parks it again, if the store still lists the purchase and the client
+ * cannot tell its binding is another account's.
+ */
+export const defaultMonetizationJournalParkedRetentionMs = 30 * 24 * 60 * 60 * 1000;
+/**
+ * At most this many parked records are kept across every player of the
+ * install, the most recently written first. A purchase dropped by this bound
+ * that the store keeps listing is verified again by the next pass that meets
+ * it, as an older client resends every such purchase. The byte budget may
+ * drop parked records before granted purchases. Neither drops a record in
+ * the in-flight window (`parkedInFlightMs`).
+ */
+export const defaultMonetizationJournalMaxParkedRecords = 20;
+/**
+ * The default in-flight window (10 minutes, the reconciler's
+ * `defaultInFlightTimeoutMs`): a parked record written this recently, or
+ * later than now (a clock moved back), is kept through every bound. A
+ * Restore Purchases resend rewrites its record before it is sent, in this
+ * context or another tab's, and the record must still be there when the
+ * backend answers. The parked record this journal wrote last is kept too. A
+ * parked record without a readable time is never in flight.
+ */
+export const defaultMonetizationJournalParkedInFlightMs = 10 * 60 * 1000;
 /**
  * Upper bound of the serialized document (192 KiB, below the Devvit bridge's
  * 256 KiB per value). When the records in the window would exceed it, the
  * oldest terminal records leave first: ungranted ones without a store
- * transaction, then ungranted ones that still name a store transaction, then
- * granted purchases. Open records are never dropped.
+ * transaction, then ungranted ones that still name a store transaction and
+ * parked records (except one that may be in flight), then granted purchases.
+ * Other open records are never dropped.
  */
 export const defaultMonetizationJournalMaxDocumentBytes = 192 * 1024;
 
+/** The time of a parked record without a readable one: newest in sort order, never in flight. */
+const unreadableParkedTime = Number.MAX_SAFE_INTEGER;
+
 export interface CreateStorageMonetizationOperationStoreInput {
   /** The platform storage adapter (`gateway.storage`); the host owns its durability. */
   readonly storage: StorageAdapter;
@@ -43,6 +83,18 @@ export interface CreateStorageMonetizationOperationStoreInput {
   readonly maxTerminalRecords?: number;
   /** Defaults to 192 KiB of serialized JSON; see `defaultMonetizationJournalMaxDocumentBytes`. */
   readonly maxDocumentBytes?: number;
+  /** Defaults to 30 days; see `defaultMonetizationJournalParkedRetentionMs`. */
+  readonly parkedRetentionMs?: number;
+  /** Defaults to 20 parked records; see `defaultMonetizationJournalMaxParkedRecords`. */
+  readonly maxParkedRecords?: number;
+  /**
+   * Defaults to 10 minutes; see `defaultMonetizationJournalParkedInFlightMs`.
+   * A game that changes the reconciler's `inFlightTimeoutMs`
+   * (`createCommerceReconciler`) passes the same value here, so a parked
+   * record stays in the journal for as long as its Restore Purchases answer
+   * may be awaited.
+   */
+  readonly parkedInFlightMs?: number;
   readonly now?: () => number;
   /**
    * Cross-context lock for the read-modify-write of the document; defaults to
@@ -67,7 +119,8 @@ interface JournalDocument {
  * The reference durable `MonetizationOperationStore` of the starter: one JSON
  * document in the platform storage adapter, rewritten whole on every change
  * so a record and its index can never disagree, terminal records bounded by
- * age (and, without a ledger grant, by count; open records are always kept),
+ * age (and, without a ledger grant, by count; open records are kept, except
+ * records parked as another account's purchase, bounded by age and count),
  * with every operation
  * serialized through one promise chain so the compare-and-swap of `replace`
  * holds inside the WebView. It is crash recovery, not grant authority: the
@@ -87,10 +140,26 @@ export function createStorageMonetizationOperationStore(
   const maxTerminalRecords = input.maxTerminalRecords
     ?? defaultMonetizationJournalMaxTerminalRecords;
   const maxDocumentBytes = input.maxDocumentBytes ?? defaultMonetizationJournalMaxDocumentBytes;
+  const parkedRetentionMs = input.parkedRetentionMs ?? defaultMonetizationJournalParkedRetentionMs;
+  const parkedLimit = input.maxParkedRecords ?? defaultMonetizationJournalMaxParkedRecords;
+  const maxParkedRecords = parkedLimit >= 0 ? parkedLimit : 0;
+  const parkedInFlightMs = input.parkedInFlightMs ?? defaultMonetizationJournalParkedInFlightMs;
   const now = input.now ?? (() => Date.now());
   const locks = input.locks === undefined ? readHostLockManager() : (input.locks ?? undefined);
   const lockName = `mpgd-monetization-journal:${key}`;
   let chain: Promise<unknown> = Promise.resolve();
+  /**
+   * The parked record this journal wrote last: a Restore Purchases resend
+   * rewrites its record before it is sent, so this is the one whose answer
+   * may be awaited. No bound drops it, whatever its time says.
+   */
+  let lastWrittenParked: string | undefined;
+  const noteWrite = (record: MonetizationOperationRecord): void => {
+    const writtenAt = parkedWrittenAt(record);
+    if (writtenAt !== undefined && writtenAt !== unreadableParkedTime) {
+      lastWrittenParked = record.key;
+    }
+  };
 
   const serialize = <T>(operation: () => Promise<T>): Promise<T> => {
     const run = locks === undefined ? operation : () => locks.request(lockName, () => operation());
@@ -113,11 +182,34 @@ export function createStorageMonetizationOperationStore(
 
   const save = async (records: Map<string, MonetizationOperationRecord>): Promise<void> => {
     const cutoff = now() - retentionMs;
+    const parkedCutoff = now() - parkedRetentionMs;
     const terminal: [string, number][] = [];
+    const parked: [string, number][] = [];
     const kept: Record<string, MonetizationOperationRecord> = {};
-    /** Terminal records the byte budget may drop, with their drop tier (lower leaves first). */
+    /** Records the byte budget may drop, with their drop tier (lower leaves first). */
     const droppable: [string, number, number][] = [];
+    const inFlightSince = now() - parkedInFlightMs;
+    let inFlight = 0;
     for (const [recordKey, record] of records) {
+      const parkedAt = parkedWrittenAt(record);
+      if (
+        parkedAt !== undefined
+        && parkedAt !== unreadableParkedTime
+        && (recordKey === lastWrittenParked || parkedAt >= inFlightSince)
+      ) {
+        // Possibly awaiting a Restore Purchases answer: no bound drops it.
+        kept[recordKey] = record;
+        inFlight += 1;
+        continue;
+      }
+      if (parkedAt !== undefined) {
+        // Another account's purchase: nothing of this player is in progress,
+        // and the purchase's own account recovers it under its own key.
+        if (parkedAt >= parkedCutoff) {
+          parked.push([recordKey, parkedAt]);
+        }
+        continue;
+      }
       const settledAt = terminalSettledAt(record);
       if (settledAt === undefined) {
         kept[recordKey] = record;
@@ -135,6 +227,18 @@ export function createStorageMonetizationOperationStore(
         terminal.push([recordKey, settledAt]);
       }
     }
+    // Newest first; the records kept as in flight count against the bound.
+    parked.sort((left, right) => right[1] - left[1]);
+    for (const [recordKey, writtenAt] of parked.slice(
+      0,
+      Math.max(0, maxParkedRecords - inFlight),
+    )) {
+      const record = records.get(recordKey);
+      if (record !== undefined) {
+        kept[recordKey] = record;
+        droppable.push([recordKey, writtenAt, 1]);
+      }
+    }
     // Newest first; the oldest terminal records beyond the bound are dropped.
     terminal.sort((left, right) => right[1] - left[1]);
     for (const [recordKey, settledAt] of terminal.slice(0, Math.max(0, maxTerminalRecords))) {
@@ -146,7 +250,7 @@ export function createStorageMonetizationOperationStore(
     }
     // The document must fit the host's per-value limit, or every later write
     // fails and monetization stops: the oldest record of the lowest tier leaves
-    // until it fits. Open records are never dropped.
+    // until it fits. Open records other than parked ones are never dropped.
     droppable.sort((left, right) => left[2] - right[2] || left[1] - right[1]);
     let size = documentBytes(kept);
     for (const [recordKey] of droppable) {
@@ -169,6 +273,7 @@ export function createStorageMonetizationOperationStore(
           return { created: false, record: clone(existing) };
         }
         records.set(record.key, clone(record));
+        noteWrite(record);
         await save(records);
         return { created: true, record: clone(record) };
       });
@@ -195,6 +300,7 @@ export function createStorageMonetizationOperationStore(
           throw new Error('Stale or conflicting monetization journal write.');
         }
         records.set(record.key, clone(record));
+        noteWrite(record);
         await save(records);
       });
     },
@@ -245,6 +351,22 @@ function terminalSettledAt(record: MonetizationOperationRecord): number | undefi
   return Number.isFinite(time) ? time : Number.MAX_SAFE_INTEGER;
 }
 
+/**
+ * When a record parked as another account's purchase was last written (its
+ * parking, or a Restore Purchases resend), or `undefined` for any other
+ * record. A parked record without a readable time is never in flight and
+ * sorts as the newest: only the count bound and the byte budget drop it.
+ */
+function parkedWrittenAt(record: MonetizationOperationRecord): number | undefined {
+  if (!isCommercePurchaseOperationRecord(record) || !isParkedForAnotherAccount(record)) {
+    return undefined;
+  }
+  const times = [record.updatedAt, record.anotherAccount?.reportedAt]
+    .map((time) => (time === undefined ? Number.NaN : Date.parse(time)))
+    .filter((time) => Number.isFinite(time));
+  return times.length === 0 ? unreadableParkedTime : Math.max(...times);
+}
+
 /** A commerce purchase record that names a store transaction (the store may still list it). */
 function holdsStoreTransaction(record: MonetizationOperationRecord): boolean {
   return record.kind === 'commerce-purchase' && record.purchase?.transactionId !== undefined;