@mpgd/game-services 0.18.1 → 0.19.1

package/dist/ad-reward-verifier-registry.js

@@ -72,6 +72,7 @@ const rewardTargets = new Set([
     'ait',
     'reddit',
     'verse8',
+    'oneplay',
 ]);
 function bindingKey(schema, target, deploymentTarget) {
     return JSON.stringify([schema, target, deploymentTarget]);

package/dist/client.js

@@ -399,7 +399,8 @@ function isGameServicesCommerceTarget(target) {
         || target === 'android'
         || target === 'ios'
         || target === 'ait'
-        || target === 'verse8';
+        || target === 'verse8'
+        || target === 'oneplay';
 }
 function isGameServicesLeaderboardTarget(target) {
     return target === 'browser'

package/dist/default-client-reward-evidence.js

@@ -1,7 +1,9 @@
 import { admobClientRewardEvidenceSchema, isAdMobClientRewardEvidence, isVerse8ClientRewardEvidence, verse8ClientRewardEvidenceSchema, } from './admob-client-reward.js';
 import { createClientRewardEvidenceRegistry, } from './client-reward-evidence.js';
+import { onePlayClientRewardEvidenceNormalizer } from './oneplay-client-reward.js';
 /** Registered decoder data. Common claim and recovery code never inspects these provider payloads. */
 export const defaultClientRewardEvidenceNormalizers = Object.freeze([
+    onePlayClientRewardEvidenceNormalizer,
     Object.freeze({
         schema: admobClientRewardEvidenceSchema,
         normalize: (reward) => isAdMobClientRewardEvidence(reward) ? {} : undefined,

package/dist/google-play-publisher-client.js

@@ -15,7 +15,8 @@ export function createGooglePlayPublisherClient(options) {
             response = await requestFetch(`${publisherOrigin}${path}`, {
                 method,
                 headers: { Authorization: `Bearer ${accessToken}` },
-                redirect: 'error',
+                // Workers reject redirect: 'error'; a manual 3xx/opaque redirect is never ok and fails below.
+                redirect: 'manual',
                 signal,
             });
         }
@@ -26,7 +27,8 @@ export function createGooglePlayPublisherClient(options) {
             // Fetch errors can contain the request URL (including the purchase token).
             throw new Error('Google Play Publisher request failed.');
         }
-        if (!response.ok) {
+        // Also reject a redirect followed by an injected fetch that ignores redirect: 'manual'.
+        if (!response.ok || response.redirected) {
             await discardBody(response);
             // Do not forward an error body or URL: both can contain purchase credentials.
             throw new Error(`Google Play Publisher request failed (HTTP ${response.status}).`);

package/dist/oneplay-client-reward.d.ts

@@ -0,0 +1,4 @@
+import type { ClientRewardEvidenceNormalizer } from './client-reward-evidence.js';
+export declare const onePlayClientRewardEvidenceSchema = "oneplay.rewarded-ad.callback.v1";
+/** Correlation only: a matching SDK envelope can request verification, never authorize a grant. */
+export declare const onePlayClientRewardEvidenceNormalizer: ClientRewardEvidenceNormalizer;

package/dist/oneplay-client-reward.js

@@ -0,0 +1,17 @@
+export const onePlayClientRewardEvidenceSchema = 'oneplay.rewarded-ad.callback.v1';
+/** Correlation only: a matching SDK envelope can request verification, never authorize a grant. */
+export const onePlayClientRewardEvidenceNormalizer = Object.freeze({
+    schema: onePlayClientRewardEvidenceSchema,
+    normalize(reward) {
+        const payload = reward.evidence?.payload;
+        if (reward.rewardGranted !== false || reward.ledgerEntryId !== undefined || payload?.rewardGranted !== false
+            || payload.event !== 'rewarded' && payload.event !== 'outcome-unknown'
+            || !identifier(payload.requestId) || !identifier(payload.placementId) || !identifier(payload.platformPlacementId)) {
+            return undefined;
+        }
+        return { platformImpressionId: payload.requestId };
+    },
+});
+function identifier(value) {
+    return typeof value === 'string' && value.trim() === value && value.length > 0 && value.length <= 256;
+}

package/dist/oneplay-pns.d.ts

@@ -0,0 +1,42 @@
+import type { GameServicesBackendApi } from './client.js';
+import type { VerifyPurchaseResponse } from './types.js';
+import { type OnePlayInspectedPurchase, type OnePlayPurchaseBoundary } from './oneplay-purchase.js';
+import { type OnePlayPurchaseClient } from './oneplay-purchase-client.js';
+export interface OnePlayPnsNotification {
+  readonly clientId: string;
+  readonly productId: string;
+  readonly purchaseToken: string;
+  readonly purchaseId: string;
+  readonly developerPayload: string;
+  readonly purchaseState: 'COMPLETED' | 'CANCELED';
+}
+/** RSA SHA512 over compact UTF-8 JSON after removing signature, following the official PNS example. */
+export declare function verifyOnePlayPns(input: {
+  readonly rawBody: Uint8Array<ArrayBuffer>;
+  /** ONEconsole license public key, base64 SPKI or PUBLIC KEY PEM. */
+  readonly publicKey: string;
+  readonly client: Pick<OnePlayPurchaseClient, 'clientId' | 'environment' | 'marketCode'>;
+  readonly subtle?: SubtleCrypto;
+}): Promise<OnePlayPnsNotification | undefined>;
+export type OnePlayPnsResult = {
+  readonly status: 'processed';
+  readonly state: 'completed';
+  readonly grant: VerifyPurchaseResponse;
+} | {
+  readonly status: 'processed';
+  readonly state: 'cancelled';
+  readonly verificationId: string;
+} | {
+  readonly status: 'pending' | 'rejected';
+  readonly reason: string;
+};
+export declare function createOnePlayPnsReceiver(input: {
+  readonly publicKey: string;
+  readonly client: Pick<OnePlayPurchaseClient, 'clientId' | 'environment' | 'marketCode'>;
+  readonly boundary: OnePlayPurchaseBoundary;
+  readonly backend: Pick<GameServicesBackendApi, 'purchases'>;
+  /** Durably fence and revoke by verificationId; the ledger grant transaction must honor that fence atomically. Never revoke by client identity alone. */
+  readonly onCancelled: (purchase: OnePlayInspectedPurchase) => Promise<void>;
+}): {
+  receive(rawBody: Uint8Array<ArrayBuffer>, suppliedSignal?: AbortSignal): Promise<OnePlayPnsResult>;
+};

package/dist/oneplay-pns.js

@@ -0,0 +1,89 @@
+import { onePlayManagedPurchaseEvidenceSchema, } from './oneplay-purchase.js';
+import { onePlayIsIdentifier, onePlayRecord, } from './oneplay-purchase-client.js';
+/** RSA SHA512 over compact UTF-8 JSON after removing signature, following the official PNS example. */
+export async function verifyOnePlayPns(input) {
+    if (input.rawBody.length > 65_536 || input.publicKey.length > 8192) {
+        return undefined;
+    }
+    try {
+        const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(input.rawBody));
+        if (!onePlayRecord(body) || typeof body.signature !== 'string' || body.signature.length > 2048
+            || body.clientId !== input.client.clientId || body.environment !== input.client.environment || body.marketCode !== input.client.marketCode
+            || body.msgVersion !== (input.client.environment === 'SANDBOX' ? '3.1.0D' : '3.1.0') || body.messageType !== 'SINGLE_PAYMENT_TRANSACTION'
+            || body.purchaseState !== 'COMPLETED' && body.purchaseState !== 'CANCELED'
+            || !onePlayIsIdentifier(body.productId) || !onePlayIsIdentifier(body.purchaseId) || !onePlayIsIdentifier(body.purchaseToken, 4096) || !onePlayIsIdentifier(body.developerPayload, 200)) {
+            return undefined;
+        }
+        const { signature, ...message } = body;
+        const keyBytes = base64(input.publicKey.replace(/-----BEGIN PUBLIC KEY-----|-----END PUBLIC KEY-----|\s/gu, ''));
+        const subtle = input.subtle ?? globalThis.crypto.subtle;
+        const key = await subtle.importKey('spki', keyBytes, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-512' }, false, ['verify']);
+        if (!await subtle.verify('RSASSA-PKCS1-v1_5', key, base64(signature), new TextEncoder().encode(JSON.stringify(message)))) {
+            return undefined;
+        }
+        return {
+            clientId: body.clientId,
+            productId: body.productId,
+            purchaseId: body.purchaseId,
+            purchaseToken: body.purchaseToken,
+            developerPayload: body.developerPayload,
+            purchaseState: body.purchaseState,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createOnePlayPnsReceiver(input) {
+    if (typeof input.onCancelled !== 'function') {
+        throw new TypeError('ONE play PNS requires an authoritative cancellation handler.');
+    }
+    return {
+        async receive(rawBody, suppliedSignal) {
+            const signal = suppliedSignal ?? AbortSignal.timeout(10_000);
+            signal.throwIfAborted();
+            const notification = await verifyOnePlayPns({ rawBody, publicKey: input.publicKey, client: input.client });
+            signal.throwIfAborted();
+            if (notification === undefined) {
+                return { status: 'rejected', reason: 'ONEPLAY_PNS_INVALID' };
+            }
+            let purchase;
+            try {
+                purchase = await input.boundary.inspect({ productId: notification.productId, purchaseToken: notification.purchaseToken, signal });
+            }
+            catch {
+                signal.throwIfAborted();
+                return { status: 'pending', reason: 'ONEPLAY_PURCHASE_API_UNAVAILABLE' };
+            }
+            if (purchase === undefined || purchase.intent.clientId !== input.client.clientId || purchase.intent.environment !== input.client.environment
+                || purchase.intent.marketCode !== input.client.marketCode || purchase.purchaseId !== notification.purchaseId || purchase.intent.developerPayload !== notification.developerPayload) {
+                return { status: 'rejected', reason: 'ONEPLAY_PNS_BINDING_INVALID' };
+            }
+            if ((purchase.purchaseState === 0 ? 'COMPLETED' : 'CANCELED') !== notification.purchaseState) {
+                return { status: 'pending', reason: 'ONEPLAY_PNS_STATE_CHANGED' };
+            }
+            if (purchase.purchaseState === 1) {
+                await input.onCancelled(purchase);
+                signal.throwIfAborted();
+                return { status: 'processed', state: 'cancelled', verificationId: purchase.verificationId };
+            }
+            const intent = purchase.intent;
+            const grant = await input.backend.purchases.verifyPurchase({ target: 'oneplay', ...(intent.deploymentTarget === 'oneplay' ? {} : { deploymentTarget: intent.deploymentTarget }),
+                playerId: intent.playerId, productId: intent.productId, platformTransactionId: purchase.purchaseId, idempotencyKey: intent.idempotencyKey,
+                purchasedAt: new Date(purchase.purchaseTime).toISOString(), evidence: { schema: onePlayManagedPurchaseEvidenceSchema, payload: {
+                        purchaseToken: purchase.purchaseToken, purchaseId: purchase.purchaseId, productId: intent.platformProductId, developerPayload: intent.developerPayload,
+                    } } });
+            signal.throwIfAborted();
+            if (!grant.verified || grant.finalization?.status !== 'completed') {
+                return { status: 'pending', reason: grant.reason ?? grant.finalization?.reason ?? (grant.verified && grant.finalization === undefined ? 'ONEPLAY_FINALIZATION_REQUIRED' : 'ONEPLAY_LEDGER_PENDING') };
+            }
+            return { status: 'processed', state: 'completed', grant };
+        },
+    };
+}
+function base64(value) {
+    if (!value || value.length % 4 !== 0 || !/^[A-Za-z\d+/]+={0,2}$/u.test(value)) {
+        throw new TypeError('Invalid ONE play signature encoding.');
+    }
+    return Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+}

package/dist/oneplay-purchase-client.d.ts

@@ -0,0 +1,31 @@
+/** ONE play / ONE store API V7 transport. Credentials and this client belong on the server. */
+export type OnePlayPurchaseEnvironment = 'SANDBOX' | 'COMMERCIAL';
+export type OnePlayMarketCode = 'MKT_ONE' | 'MKT_GLB';
+export interface OnePlayPurchaseApiInput {
+  readonly productId: string;
+  readonly purchaseToken: string;
+  readonly signal: AbortSignal;
+}
+export interface OnePlayPurchaseClient {
+  readonly clientId: string;
+  readonly environment: OnePlayPurchaseEnvironment;
+  readonly marketCode: OnePlayMarketCode;
+  getPurchaseDetails(input: OnePlayPurchaseApiInput): Promise<unknown>;
+  consumePurchase(input: OnePlayPurchaseApiInput & {
+    readonly developerPayload: string;
+  }): Promise<void>;
+  acknowledgePurchase(input: OnePlayPurchaseApiInput & {
+    readonly developerPayload: string;
+  }): Promise<void>;
+}
+export declare function createOnePlayPurchaseClient(input: {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly environment: OnePlayPurchaseEnvironment;
+  readonly marketCode?: OnePlayMarketCode;
+  readonly fetch?: typeof fetch;
+  readonly now?: () => number;
+}): OnePlayPurchaseClient;
+export declare function onePlayRecord(value: unknown): value is Record<string, unknown>;
+export declare function onePlayIsIdentifier(value: unknown, max?: number): value is string;
+export declare function onePlayIdentifier(value: unknown, max?: number): string;

package/dist/oneplay-purchase-client.js

@@ -0,0 +1,157 @@
+export function createOnePlayPurchaseClient(input) {
+    const clientId = onePlayIdentifier(input.clientId, 128);
+    const clientSecret = onePlayIdentifier(input.clientSecret, 4096);
+    const environment = input.environment;
+    const marketCode = input.marketCode ?? 'MKT_ONE';
+    if (!['SANDBOX', 'COMMERCIAL'].includes(environment) || !['MKT_ONE', 'MKT_GLB'].includes(marketCode)) {
+        throw new TypeError('ONE play purchase environment is invalid.');
+    }
+    const origin = environment === 'SANDBOX'
+        ? 'https://sbpp.onestore.net'
+        : 'https://iap-apis.onestore.net';
+    const requestFetch = input.fetch ?? globalThis.fetch;
+    const now = input.now ?? Date.now;
+    let cached;
+    async function jsonRequest(path, init, signal) {
+        signal.throwIfAborted();
+        try {
+            const response = await requestFetch(`${origin}${path}`, {
+                ...init,
+                // Workers reject redirect: 'error'; a manual 3xx/opaque redirect is never ok and fails below.
+                redirect: 'manual',
+                signal,
+            });
+            // Also reject a redirect followed by an injected fetch that ignores redirect: 'manual'.
+            if (!response.ok || response.redirected) {
+                if (response.status === 401) {
+                    cached = undefined;
+                }
+                await response.body?.cancel().catch(() => undefined);
+                throw new Error('HTTP failure');
+            }
+            const value = await boundedJson(response);
+            signal.throwIfAborted();
+            return value;
+        }
+        catch {
+            signal.throwIfAborted();
+            // Transport errors and provider responses may contain URL tokens or client secrets.
+            throw new Error('ONE play purchase API request failed.');
+        }
+    }
+    async function token(signal) {
+        if (cached !== undefined && cached.expiresAt > now() + 60_000) {
+            return cached.token;
+        }
+        // Each caller owns its abort signal. Never share an abortable OAuth promise between requests.
+        const raw = await jsonRequest('/v7/oauth/token', {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                'x-market-code': marketCode,
+            },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: clientId,
+                client_secret: clientSecret,
+            }),
+        }, signal);
+        if (!onePlayRecord(raw) || raw.client_id !== clientId || typeof raw.token_type !== 'string' || raw.token_type.toLowerCase() !== 'bearer'
+            || !onePlayIsIdentifier(raw.access_token, 4096) || /\s/u.test(raw.access_token) || typeof raw.expires_in !== 'number' || !Number.isSafeInteger(raw.expires_in) || raw.expires_in <= 0 || raw.expires_in > 86_400) {
+            throw new Error('ONE play OAuth response is invalid.');
+        }
+        cached = { token: raw.access_token, expiresAt: now() + raw.expires_in * 1000 };
+        return cached.token;
+    }
+    async function request(operation, request) {
+        const signal = AbortSignal.any([request.signal, AbortSignal.timeout(10_000)]);
+        const type = operation === 'acknowledge' ? 'all' : 'inapp';
+        const path = `/v7/apps/${pathPart(clientId)}/purchases/${type}/products/${pathPart(request.productId)}/${pathPart(request.purchaseToken)}${operation === 'get' ? '' : `/${operation}`}`;
+        const developerPayload = operation === 'get'
+            ? undefined
+            : onePlayIdentifier(request.developerPayload, 200);
+        if (developerPayload !== undefined && new TextEncoder().encode(developerPayload).length > 200) {
+            throw new TypeError('ONE play developer payload is too long.');
+        }
+        const body = developerPayload === undefined ? undefined : JSON.stringify({ developerPayload });
+        const result = await jsonRequest(path, {
+            method: operation === 'get' ? 'GET' : 'POST',
+            headers: {
+                authorization: `Bearer ${await token(signal)}`,
+                'content-type': 'application/json',
+                'x-market-code': marketCode,
+            },
+            ...(body === undefined ? {} : { body }),
+        }, signal);
+        if (operation !== 'get' && (!onePlayRecord(result) || !onePlayRecord(result.result) || result.result.code !== 'Success')) {
+            throw new Error('ONE play purchase finalization was not confirmed.');
+        }
+        return result;
+    }
+    return {
+        clientId,
+        environment,
+        marketCode,
+        getPurchaseDetails: (requestInput) => request('get', requestInput),
+        async consumePurchase(requestInput) {
+            await request('consume', requestInput);
+        },
+        async acknowledgePurchase(requestInput) {
+            await request('acknowledge', requestInput);
+        },
+    };
+}
+export function onePlayRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function onePlayIsIdentifier(value, max = 256) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max && value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+export function onePlayIdentifier(value, max = 256) {
+    if (!onePlayIsIdentifier(value, max)) {
+        throw new TypeError('ONE play identifier is invalid.');
+    }
+    return value;
+}
+function pathPart(value) {
+    onePlayIdentifier(value, 4096);
+    if (value === '.' || value === '..') {
+        throw new TypeError('ONE play path parameter is invalid.');
+    }
+    return encodeURIComponent(value);
+}
+async function boundedJson(response) {
+    if (response.body === null) {
+        throw new Error('Missing ONE play response.');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) {
+                break;
+            }
+            size += chunk.value.length;
+            if (size > 65_536) {
+                throw new Error('ONE play response exceeds its limit.');
+            }
+            chunks.push(chunk.value);
+        }
+    }
+    catch (error) {
+        await reader.cancel().catch(() => undefined);
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+}

package/dist/oneplay-purchase.d.ts

@@ -0,0 +1,71 @@
+import { type ProductCatalog } from '@mpgd/catalog';
+import type { EvidenceVerificationDecision, GameServicesPurchaseGrantFinalizer, VerifyPurchaseEvidenceInput } from './evidence-verification.js';
+import { type OnePlayMarketCode, type OnePlayPurchaseClient, type OnePlayPurchaseEnvironment } from './oneplay-purchase-client.js';
+export declare const onePlayManagedPurchaseEvidenceSchema = "oneplay.managed-purchase.v1";
+export interface OnePlayCheckoutIntent {
+  readonly clientId: string;
+  readonly environment: OnePlayPurchaseEnvironment;
+  readonly marketCode: OnePlayMarketCode;
+  readonly deploymentTarget: string;
+  readonly playerId: string;
+  readonly productId: string;
+  readonly platformProductId: string;
+  readonly productType: 'consumable' | 'non_consumable';
+  readonly idempotencyKey: string;
+  readonly developerPayload: string;
+  readonly issuedAt: number;
+  readonly expiresAt: number;
+}
+/** Durable atomic uniqueness for claim identity and payload; keep records for purchases, PNS and refunds. */
+export interface OnePlayCheckoutIntentStore {
+  /** Insert or return the row for client/environment/market/deployment/player/idempotency. */
+  issue(intent: OnePlayCheckoutIntent): Promise<OnePlayCheckoutIntent>;
+  findByPayload(input: {
+    readonly clientId: string;
+    readonly environment: OnePlayPurchaseEnvironment;
+    readonly marketCode: OnePlayMarketCode;
+    readonly developerPayload: string;
+  }): Promise<OnePlayCheckoutIntent | undefined>;
+}
+export declare function createOnePlayCheckoutIntentIssuer(input: {
+  readonly client: Pick<OnePlayPurchaseClient, 'clientId' | 'environment' | 'marketCode'>;
+  readonly catalog: ProductCatalog;
+  readonly store: OnePlayCheckoutIntentStore;
+  readonly deploymentTarget?: string;
+  readonly now?: () => number;
+  readonly createPayload?: () => string;
+}): {
+  /** Derive playerId from authenticated server context, never SDK identity or request body. */
+  issue(request: {
+    readonly playerId: string;
+    readonly productId: string;
+    readonly idempotencyKey: string;
+  }): Promise<{
+    readonly developerPayload: string;
+  }>;
+};
+export interface OnePlayInspectedPurchase {
+  readonly intent: OnePlayCheckoutIntent;
+  readonly purchaseId: string;
+  readonly purchaseToken: string;
+  readonly purchaseTime: number;
+  readonly purchaseState: 0 | 1;
+  readonly consumptionState: 0 | 1;
+  readonly acknowledgeState: 0 | 1;
+  readonly verificationId: string;
+}
+export interface OnePlayPurchaseBoundary extends GameServicesPurchaseGrantFinalizer {
+  verifyPurchase(input: VerifyPurchaseEvidenceInput): Promise<EvidenceVerificationDecision>;
+  /** Independent API lookup for PNS / scheduled reconciliation. No notification can grant by itself. */
+  inspect(input: {
+    readonly productId: string;
+    readonly purchaseToken: string;
+    readonly signal: AbortSignal;
+  }): Promise<OnePlayInspectedPurchase | undefined>;
+}
+export declare function createOnePlayPurchaseBoundary(input: {
+  readonly client: OnePlayPurchaseClient;
+  readonly store: OnePlayCheckoutIntentStore;
+  readonly deploymentTarget?: string;
+  readonly now?: () => number;
+}): OnePlayPurchaseBoundary;

package/dist/oneplay-purchase.js

@@ -0,0 +1,163 @@
+import { resolveProductPlatformId } from '@mpgd/catalog';
+import { onePlayIdentifier, onePlayIsIdentifier, onePlayRecord, } from './oneplay-purchase-client.js';
+export const onePlayManagedPurchaseEvidenceSchema = 'oneplay.managed-purchase.v1';
+export function createOnePlayCheckoutIntentIssuer(input) {
+    const deploymentTarget = onePlayIdentifier(input.deploymentTarget ?? 'oneplay');
+    return {
+        /** Derive playerId from authenticated server context, never SDK identity or request body. */
+        async issue(request) {
+            const product = input.catalog.products.find((candidate) => candidate.id === request.productId);
+            const platformProductId = product === undefined ? undefined : resolveProductPlatformId(product, deploymentTarget);
+            if (product === undefined || product.type === 'subscription' || platformProductId === undefined) {
+                throw new TypeError('ONE play managed product is not configured.');
+            }
+            const issuedAt = (input.now ?? Date.now)();
+            if (!Number.isSafeInteger(issuedAt) || issuedAt < 0 || issuedAt > 8_639_999_913_600_000) {
+                throw new TypeError('ONE play checkout time is invalid.');
+            }
+            const intent = { clientId: onePlayIdentifier(input.client.clientId, 128), environment: input.client.environment, marketCode: input.client.marketCode,
+                deploymentTarget, playerId: onePlayIdentifier(request.playerId), productId: product.id, platformProductId, productType: product.type,
+                idempotencyKey: onePlayIdentifier(request.idempotencyKey), developerPayload: payload((input.createPayload ?? (() => globalThis.crypto.randomUUID()))()), issuedAt, expiresAt: issuedAt + 86_400_000 };
+            const stored = await input.store.issue(intent);
+            if (!validIntent(stored) || !sameIdentity(stored, intent) || stored.productId !== intent.productId || stored.platformProductId !== intent.platformProductId
+                || stored.productType !== intent.productType || stored.expiresAt < issuedAt) {
+                throw new Error('ONE play checkout intent conflict.');
+            }
+            return { developerPayload: stored.developerPayload };
+        },
+    };
+}
+export function createOnePlayPurchaseBoundary(input) {
+    const { client, store } = input;
+    const deploymentTarget = onePlayIdentifier(input.deploymentTarget ?? 'oneplay');
+    const now = input.now ?? Date.now;
+    // Provider and application clocks may differ within the five-minute verification tolerance.
+    async function inspect(request) {
+        request.signal.throwIfAborted();
+        const purchaseToken = onePlayIdentifier(request.purchaseToken, 4096);
+        const raw = await client.getPurchaseDetails({ ...request, purchaseToken });
+        request.signal.throwIfAborted();
+        if (!onePlayRecord(raw) || !onePlayIsIdentifier(raw.purchaseId) || !onePlayIsIdentifier(raw.developerPayload, 200)
+            || raw.quantity !== 1 || raw.purchaseState !== 0 && raw.purchaseState !== 1
+            || raw.consumptionState !== 0 && raw.consumptionState !== 1 || raw.acknowledgeState !== 0 && raw.acknowledgeState !== 1
+            || typeof raw.purchaseTime !== 'number' || !Number.isSafeInteger(raw.purchaseTime) || raw.purchaseTime < 0 || raw.purchaseTime > now() + 300_000) {
+            return undefined;
+        }
+        const intent = await store.findByPayload({
+            clientId: client.clientId,
+            environment: client.environment,
+            marketCode: client.marketCode,
+            developerPayload: raw.developerPayload,
+        });
+        request.signal.throwIfAborted();
+        if (intent === undefined || !validIntent(intent) || intent.clientId !== client.clientId || intent.environment !== client.environment || intent.marketCode !== client.marketCode
+            || intent.deploymentTarget !== deploymentTarget || intent.platformProductId !== request.productId || intent.developerPayload !== raw.developerPayload
+            || raw.purchaseTime < intent.issuedAt - 300_000 || raw.purchaseTime > intent.expiresAt + 300_000) {
+            return undefined;
+        }
+        const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(JSON.stringify([client.clientId, client.environment, client.marketCode, purchaseToken]))));
+        request.signal.throwIfAborted();
+        const verificationId = `oneplay:purchase:${[...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`;
+        return {
+            intent,
+            purchaseId: raw.purchaseId,
+            purchaseTime: raw.purchaseTime,
+            purchaseState: raw.purchaseState,
+            consumptionState: raw.consumptionState,
+            acknowledgeState: raw.acknowledgeState,
+            purchaseToken,
+            verificationId,
+        };
+    }
+    async function inspectClaim(request, allowCanonicalTransaction = false) {
+        const envelope = request.request.evidence;
+        if (request.request.target !== 'oneplay' || (request.request.deploymentTarget ?? request.request.target) !== deploymentTarget || request.product.type === 'subscription'
+            || envelope?.schema !== onePlayManagedPurchaseEvidenceSchema || !onePlayIsIdentifier(envelope.payload.purchaseToken, 4096)) {
+            return undefined;
+        }
+        const purchase = await inspect({
+            productId: request.platformProductId,
+            purchaseToken: envelope.payload.purchaseToken,
+            signal: request.signal,
+        });
+        if (purchase === undefined || purchase.intent.playerId !== request.request.playerId || purchase.intent.productId !== request.request.productId
+            || purchase.intent.idempotencyKey !== request.request.idempotencyKey || purchase.intent.productType !== request.product.type
+            || purchase.purchaseId !== request.request.platformTransactionId && (!allowCanonicalTransaction || purchase.verificationId !== request.request.platformTransactionId) || envelope.payload.purchaseId !== purchase.purchaseId
+            || envelope.payload.productId !== request.platformProductId || envelope.payload.developerPayload !== purchase.intent.developerPayload) {
+            return undefined;
+        }
+        return purchase;
+    }
+    return {
+        inspect,
+        supportsPurchaseGrant: (request) => request.request.target === 'oneplay' && request.product.type !== 'subscription' && request.request.evidence?.schema === onePlayManagedPurchaseEvidenceSchema,
+        async verifyPurchase(request) {
+            try {
+                const purchase = await inspectClaim(request);
+                if (purchase === undefined) {
+                    return { status: 'rejected', reason: 'ONEPLAY_PURCHASE_BINDING_INVALID' };
+                }
+                if (purchase.purchaseState !== 0) {
+                    return { status: 'rejected', reason: 'ONEPLAY_PURCHASE_CANCELLED' };
+                }
+                if (purchase.consumptionState !== 0) {
+                    return { status: 'rejected', reason: 'ONEPLAY_PURCHASE_ALREADY_CONSUMED' };
+                }
+                return { status: 'verified', verificationId: purchase.verificationId, platformEvidenceId: purchase.verificationId, verifiedAt: new Date(now()).toISOString(), payload: {
+                        onePlayPurchaseId: purchase.purchaseId, onePlayDeveloperPayload: purchase.intent.developerPayload, onePlayVerificationId: purchase.verificationId,
+                        onePlayClientId: client.clientId, onePlayEnvironment: client.environment, onePlayMarketCode: client.marketCode,
+                    } };
+            }
+            catch {
+                request.signal.throwIfAborted();
+                return { status: 'pending', reason: 'ONEPLAY_PURCHASE_API_UNAVAILABLE' };
+            }
+        },
+        async finalizePurchaseGrant(request) {
+            const action = request.product.type === 'consumable' ? 'consume' : 'acknowledge';
+            try {
+                const purchase = await inspectClaim(request, true);
+                if (purchase === undefined || purchase.purchaseState !== 0 || purchase.verificationId !== request.evidenceVerificationId
+                    || request.evidencePayload?.onePlayVerificationId !== purchase.verificationId || request.evidencePayload.onePlayClientId !== client.clientId
+                    || request.evidencePayload.onePlayEnvironment !== client.environment || request.evidencePayload.onePlayMarketCode !== client.marketCode
+                    || request.evidencePayload.onePlayPurchaseId !== purchase.purchaseId || request.evidencePayload.onePlayDeveloperPayload !== purchase.intent.developerPayload) {
+                    return { status: 'pending', action, alreadyCompleted: false, reason: 'ONEPLAY_FINALIZATION_BINDING_INVALID' };
+                }
+                if (action === 'consume' && purchase.consumptionState === 1 || action === 'acknowledge' && purchase.acknowledgeState === 1) {
+                    return { status: 'completed', action, alreadyCompleted: true };
+                }
+                const operation = { productId: request.platformProductId, purchaseToken: purchase.purchaseToken, developerPayload: purchase.intent.developerPayload, signal: request.signal };
+                if (action === 'consume') {
+                    await client.consumePurchase(operation);
+                }
+                else {
+                    await client.acknowledgePurchase(operation);
+                }
+                request.signal.throwIfAborted();
+                return { status: 'completed', action, alreadyCompleted: false };
+            }
+            catch {
+                request.signal.throwIfAborted();
+                return { status: 'pending', action, alreadyCompleted: false, reason: 'ONEPLAY_FINALIZATION_API_UNAVAILABLE' };
+            }
+        },
+    };
+}
+function payload(value) {
+    const text = onePlayIdentifier(value, 200);
+    if (new TextEncoder().encode(text).length > 200) {
+        throw new TypeError('ONE play developer payload is too long.');
+    }
+    return text;
+}
+function validIntent(intent) {
+    return [intent.clientId, intent.deploymentTarget, intent.playerId, intent.productId, intent.platformProductId, intent.idempotencyKey].every((value) => onePlayIsIdentifier(value))
+        && onePlayIsIdentifier(intent.developerPayload, 200) && new TextEncoder().encode(intent.developerPayload).length <= 200
+        && ['SANDBOX', 'COMMERCIAL'].includes(intent.environment) && ['MKT_ONE', 'MKT_GLB'].includes(intent.marketCode)
+        && ['consumable', 'non_consumable'].includes(intent.productType) && Number.isSafeInteger(intent.issuedAt) && Number.isSafeInteger(intent.expiresAt)
+        && intent.issuedAt >= 0 && intent.expiresAt >= intent.issuedAt;
+}
+function sameIdentity(left, right) {
+    return left.clientId === right.clientId && left.environment === right.environment && left.marketCode === right.marketCode
+        && left.deploymentTarget === right.deploymentTarget && left.playerId === right.playerId && left.idempotencyKey === right.idempotencyKey;
+}

package/dist/oneplay-reward.d.ts

@@ -0,0 +1,105 @@
+import { type AdPlacements } from '@mpgd/catalog';
+import type { AdRewardVerifierRegistration } from './ad-reward-verifier-registry.js';
+import type { GameServicesBackendApi } from './client.js';
+import type { ClaimAdRewardResponse } from './types.js';
+export interface OnePlayRewardBinding {
+  readonly applicationId: string;
+  readonly deploymentTarget: string;
+  readonly requestId: string;
+  readonly playerId: string;
+  readonly placementId: string;
+  readonly platformPlacementId: string;
+  readonly idempotencyKey: string;
+  readonly issuedAt: number;
+  readonly expiresAt: number;
+}
+export interface OnePlayRewardClaimIdentity {
+  readonly applicationId: string;
+  readonly deploymentTarget: string;
+  readonly playerId: string;
+  readonly idempotencyKey: string;
+}
+export interface OnePlaySsvReceipt {
+  /** Original bytes. Never reserialize the body used for HMAC verification. */
+  readonly rawBody: Uint8Array<ArrayBuffer>;
+  readonly timestamp: string;
+  readonly signature: string;
+  /** Trusted receiver time, not a client-supplied backdated timestamp. */
+  readonly receivedAt: number;
+}
+/** Production implementations must durably enforce unique claim and request IDs, and immutable callbacks. */
+export interface OnePlayRewardStore {
+  /** Atomically insert or return the row for application/deployment/player/idempotency. */
+  issue(binding: OnePlayRewardBinding): Promise<OnePlayRewardBinding>;
+  findByClaim(input: OnePlayRewardClaimIdentity): Promise<OnePlayRewardBinding | undefined>;
+  findByRequest(input: {
+    readonly applicationId: string;
+    readonly requestId: string;
+  }): Promise<OnePlayRewardBinding | undefined>;
+  recordReceipt(input: {
+    readonly applicationId: string;
+    readonly requestId: string;
+    readonly receipt: OnePlaySsvReceipt;
+  }): Promise<void>;
+  findReceipt(input: {
+    readonly applicationId: string;
+    readonly requestId: string;
+  }): Promise<OnePlaySsvReceipt | undefined>;
+}
+export interface OnePlaySsvInput {
+  readonly rawBody: Uint8Array<ArrayBuffer>;
+  readonly apiKey: string;
+  readonly timestamp: string;
+  readonly signature: string;
+}
+export type OnePlaySsvVerification = {
+  readonly status: 'verified';
+  readonly requestId: string;
+  readonly grant?: ClaimAdRewardResponse;
+} | {
+  readonly status: 'rejected';
+  readonly reason: string;
+};
+export declare function createOnePlayRewardRequestIssuer(input: {
+  readonly applicationId: string;
+  readonly deploymentTarget?: string;
+  readonly placements: AdPlacements;
+  readonly store: OnePlayRewardStore;
+  readonly now?: () => number;
+  readonly createRequestId?: () => string;
+}): {
+  /** playerId MUST come from authenticated server context, not SDK identity or the request body. */
+  issue(request: {
+    readonly playerId: string;
+    readonly placementId: string;
+    readonly idempotencyKey: string;
+  }): Promise<{
+    readonly requestId: string;
+  }>;
+};
+/** Authenticate the sender, timestamp and exact raw bytes before trusting requestId. */
+export declare function verifyOnePlaySsv(input: OnePlaySsvInput, options: {
+  readonly apiKey: string;
+  readonly now?: () => number;
+  readonly subtle?: SubtleCrypto;
+}): Promise<OnePlaySsvVerification>;
+/** Receive once, persist first, then let the normal backend claim / recovery pipeline grant. */
+export declare function createOnePlaySsvReceiver(input: {
+  readonly applicationId: string;
+  readonly apiKey: string;
+  readonly store: OnePlayRewardStore;
+  readonly now?: () => number;
+  readonly subtle?: SubtleCrypto;
+  /** Optional immediate grant through the same configured verifier and backend ledger used by client claims. */
+  readonly backend?: Pick<GameServicesBackendApi, 'adRewards'>;
+}): {
+  receive(callback: OnePlaySsvInput): Promise<OnePlaySsvVerification>;
+};
+export declare function createOnePlayAdRewardVerifier(input: {
+  readonly applicationId: string;
+  readonly deploymentTarget?: string;
+  readonly apiKey: string;
+  readonly store: OnePlayRewardStore;
+  readonly now?: () => number;
+  readonly subtle?: SubtleCrypto;
+}): AdRewardVerifierRegistration;

package/dist/oneplay-reward.js

@@ -0,0 +1,185 @@
+import { resolveAdPlacementPlatformId } from '@mpgd/catalog';
+import { onePlayClientRewardEvidenceSchema } from './oneplay-client-reward.js';
+export function createOnePlayRewardRequestIssuer(input) {
+    const applicationId = identifier(input.applicationId);
+    const deploymentTarget = identifier(input.deploymentTarget ?? 'oneplay');
+    const now = input.now ?? Date.now;
+    return {
+        /** playerId MUST come from authenticated server context, not SDK identity or the request body. */
+        async issue(request) {
+            const playerId = identifier(request.playerId);
+            const idempotencyKey = identifier(request.idempotencyKey);
+            const placement = input.placements.placements.find((entry) => entry.id === request.placementId);
+            const platformPlacementId = placement === undefined ? undefined : resolveAdPlacementPlatformId(placement, deploymentTarget);
+            if (placement?.type !== 'rewarded' || platformPlacementId === undefined) {
+                throw new TypeError('ONE play rewarded placement is not configured.');
+            }
+            const issuedAt = timestamp(now());
+            const candidate = { applicationId, deploymentTarget, playerId, idempotencyKey, placementId: placement.id,
+                platformPlacementId, requestId: identifier((input.createRequestId ?? (() => globalThis.crypto.randomUUID()))()), issuedAt, expiresAt: issuedAt + 86_400_000 };
+            const stored = await input.store.issue(candidate);
+            if (!matchesClaim(stored, candidate) || stored.placementId !== candidate.placementId || stored.platformPlacementId !== platformPlacementId
+                || !validBinding(stored) || stored.expiresAt < issuedAt) {
+                throw new Error('ONE play reward request binding conflict.');
+            }
+            return { requestId: stored.requestId };
+        },
+    };
+}
+/** Authenticate the sender, timestamp and exact raw bytes before trusting requestId. */
+export async function verifyOnePlaySsv(input, options) {
+    const key = apiKey(options.apiKey);
+    const at = (options.now ?? Date.now)();
+    if (input.rawBody.byteLength > 8192 || !constantTimeEqual(input.apiKey, key) || !/^\d{1,16}$/u.test(input.timestamp)
+        || !Number.isSafeInteger(at) || Math.abs(Number(input.timestamp) - at) > 300_000 || !/^[a-f\d]{64}$/iu.test(input.signature)) {
+        return { status: 'rejected', reason: 'ONEPLAY_SSV_INVALID' };
+    }
+    try {
+        const subtle = options.subtle ?? globalThis.crypto.subtle;
+        const signingKey = await subtle.importKey('raw', new TextEncoder().encode(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+        const prefix = new TextEncoder().encode(`${input.timestamp}\n`);
+        const bytes = new Uint8Array(prefix.length + input.rawBody.length);
+        bytes.set(prefix);
+        bytes.set(input.rawBody, prefix.length);
+        const signature = Uint8Array.from(input.signature.match(/../gu) ?? [], (pair) => Number.parseInt(pair, 16));
+        if (!await subtle.verify('HMAC', signingKey, signature, bytes)) {
+            return {
+                status: 'rejected',
+                reason: 'ONEPLAY_SSV_INVALID',
+            };
+        }
+        const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(input.rawBody));
+        if (!record(body) || body.status !== 'SUCCESS' || body.reason !== '' || !isIdentifier(body.requestId)) {
+            return {
+                status: 'rejected',
+                reason: 'ONEPLAY_SSV_INVALID',
+            };
+        }
+        return { status: 'verified', requestId: body.requestId };
+    }
+    catch {
+        return { status: 'rejected', reason: 'ONEPLAY_SSV_INVALID' };
+    }
+}
+/** Receive once, persist first, then let the normal backend claim / recovery pipeline grant. */
+export function createOnePlaySsvReceiver(input) {
+    const applicationId = identifier(input.applicationId);
+    apiKey(input.apiKey);
+    const now = input.now ?? Date.now;
+    return {
+        async receive(callback) {
+            const receivedAt = timestamp(now());
+            const decision = await verifyOnePlaySsv(callback, { apiKey: input.apiKey, now: () => receivedAt, ...(input.subtle === undefined ? {} : { subtle: input.subtle }) });
+            if (decision.status !== 'verified') {
+                return decision;
+            }
+            const binding = await input.store.findByRequest({ applicationId, requestId: decision.requestId });
+            if (binding === undefined || !validBinding(binding) || binding.applicationId !== applicationId || binding.requestId !== decision.requestId
+                || receivedAt < binding.issuedAt - 300_000 || receivedAt > binding.expiresAt + 300_000) {
+                return { status: 'rejected', reason: 'ONEPLAY_SSV_BINDING_INVALID' };
+            }
+            await input.store.recordReceipt({ applicationId, requestId: decision.requestId, receipt: {
+                    rawBody: new Uint8Array(callback.rawBody), timestamp: callback.timestamp, signature: callback.signature, receivedAt,
+                } });
+            if (input.backend === undefined) {
+                return decision;
+            }
+            const grant = await input.backend.adRewards.claimAdReward({
+                target: 'oneplay', providerId: 'oneplay-ads',
+                ...(binding.deploymentTarget === 'oneplay' ? {} : { deploymentTarget: binding.deploymentTarget }),
+                playerId: binding.playerId, placementId: binding.placementId, platformImpressionId: binding.requestId,
+                idempotencyKey: binding.idempotencyKey, completedAt: new Date(receivedAt).toISOString(),
+            });
+            return { ...decision, grant };
+        },
+    };
+}
+export function createOnePlayAdRewardVerifier(input) {
+    const applicationId = identifier(input.applicationId);
+    const deploymentTarget = identifier(input.deploymentTarget ?? 'oneplay');
+    apiKey(input.apiKey);
+    const now = input.now ?? Date.now;
+    return {
+        providerId: 'oneplay-ads', schema: onePlayClientRewardEvidenceSchema,
+        bindings: [{ target: 'oneplay', deploymentTarget }], acceptsMissingEvidence: true,
+        async verify({ request, platformPlacementId, signal }) {
+            signal.throwIfAborted();
+            if (request.target !== 'oneplay' || (request.deploymentTarget ?? request.target) !== deploymentTarget
+                || platformPlacementId === undefined || request.providerId !== undefined && request.providerId !== 'oneplay-ads') {
+                return { status: 'rejected', reason: 'ONEPLAY_REWARD_BINDING_INVALID' };
+            }
+            const identity = { applicationId, deploymentTarget, playerId: request.playerId, idempotencyKey: request.idempotencyKey };
+            const binding = await input.store.findByClaim(identity);
+            signal.throwIfAborted();
+            if (binding === undefined || !validBinding(binding) || !matchesClaim(binding, identity) || binding.placementId !== request.placementId
+                || binding.platformPlacementId !== platformPlacementId || request.platformImpressionId !== undefined && request.platformImpressionId !== binding.requestId) {
+                return { status: 'rejected', reason: 'ONEPLAY_REWARD_BINDING_INVALID' };
+            }
+            const envelope = request.evidence;
+            if (envelope !== undefined && (envelope.schema !== onePlayClientRewardEvidenceSchema || envelope.payload.requestId !== binding.requestId
+                || envelope.payload.placementId !== binding.placementId || envelope.payload.platformPlacementId !== platformPlacementId || envelope.payload.rewardGranted !== false)) {
+                return { status: 'rejected', reason: 'ONEPLAY_REWARD_BINDING_INVALID' };
+            }
+            const receipt = await input.store.findReceipt({ applicationId, requestId: binding.requestId });
+            signal.throwIfAborted();
+            if (receipt === undefined) {
+                return { status: 'pending', reason: 'ONEPLAY_SSV_PENDING' };
+            }
+            if (!Number.isSafeInteger(receipt.receivedAt) || receipt.receivedAt < binding.issuedAt - 300_000 || receipt.receivedAt > binding.expiresAt + 300_000 || receipt.receivedAt > now() + 300_000) {
+                return { status: 'rejected', reason: 'ONEPLAY_SSV_BINDING_INVALID' };
+            }
+            const verified = await verifyOnePlaySsv({ ...receipt, apiKey: input.apiKey }, {
+                apiKey: input.apiKey, now: () => receipt.receivedAt, ...(input.subtle === undefined ? {} : { subtle: input.subtle }),
+            });
+            signal.throwIfAborted();
+            if (verified.status !== 'verified' || verified.requestId !== binding.requestId) {
+                return { status: 'rejected', reason: 'ONEPLAY_SSV_INVALID' };
+            }
+            const proofId = `${encodeURIComponent(applicationId)}:${encodeURIComponent(binding.requestId)}`;
+            return { status: 'verified', verificationId: `oneplay:ssv:${proofId}`, platformEvidenceId: proofId,
+                verifiedAt: new Date(receipt.receivedAt).toISOString(), payload: { onePlayRequestId: binding.requestId, onePlayApplicationId: applicationId } };
+        },
+    };
+}
+function validBinding(binding) {
+    return [binding.applicationId, binding.deploymentTarget, binding.playerId, binding.idempotencyKey, binding.requestId, binding.placementId, binding.platformPlacementId].every(isIdentifier)
+        && Number.isSafeInteger(binding.issuedAt) && Number.isSafeInteger(binding.expiresAt) && binding.issuedAt >= 0 && binding.expiresAt >= binding.issuedAt;
+}
+function matchesClaim(binding, request) {
+    return binding.applicationId === request.applicationId && binding.deploymentTarget === request.deploymentTarget
+        && binding.playerId === request.playerId && binding.idempotencyKey === request.idempotencyKey;
+}
+function isIdentifier(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function identifier(value) {
+    if (!isIdentifier(value)) {
+        throw new TypeError('ONE play identifier is invalid.');
+    }
+    return value;
+}
+function timestamp(value) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 8_639_999_913_600_000) {
+        throw new TypeError('ONE play timestamp is invalid.');
+    }
+    return value;
+}
+function apiKey(value) {
+    if (!/^[A-Za-z\d_-]{5,64}$/u.test(value)) {
+        throw new TypeError('ONE play SSV API key is invalid.');
+    }
+    return value;
+}
+function constantTimeEqual(left, right) {
+    if (typeof left !== 'string' || left.length !== right.length) {
+        return false;
+    }
+    let difference = 0;
+    for (let index = 0; index < right.length; index += 1) {
+        difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    }
+    return difference === 0;
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/runtime.js

@@ -105,7 +105,8 @@ export function resolveGameServicesLedgerTarget(target) {
         || target === 'ios'
         || target === 'ait'
         || target === 'reddit'
-        || target === 'verse8') {
+        || target === 'verse8'
+        || target === 'oneplay') {
         return target;
     }
     return null;

package/dist/server.js

@@ -400,6 +400,7 @@ const gameServicesDeploymentTargetPlatforms = new Set([
     'ios',
     'ait',
     'verse8',
+    'oneplay',
     'reddit',
 ]);
 function resolveDeploymentTargetBindings(input) {

package/dist/types.d.ts

@@ -3,10 +3,10 @@ import type { LeaderboardScoreInput, LogicalAdPlacementId, LogicalProductId, Pla
 import type { ClaimAdRewardResponse, PurchaseGrantFinalization, VerifyPurchaseResponse } from './operation-results.js';
 export type { ClaimAdRewardResponse, PurchaseGrantFinalization, PurchaseGrantFinalizationAction, VerifyPurchaseResponse, } from './operation-results.js';
 export type { PlatformEvidenceEnvelope } from '@mpgd/platform';
-export type GameServicesStoreTarget = Extract<PlatformTarget, 'microsoft-store' | 'android' | 'ios' | 'ait'>;
+export type GameServicesStoreTarget = Extract<PlatformTarget, 'microsoft-store' | 'android' | 'ios' | 'ait' | 'oneplay'>;
 export type GameServicesAdRewardTarget = GameServicesLedgerTarget;
 export type GameServicesLeaderboardTarget = Extract<PlatformTarget, 'browser' | 'microsoft-store' | 'android' | 'ios' | 'ait' | 'reddit'>;
-export type GameServicesLedgerTarget = Extract<PlatformTarget, 'browser' | 'microsoft-store' | 'android' | 'ios' | 'ait' | 'reddit' | 'verse8'>;
+export type GameServicesLedgerTarget = Extract<PlatformTarget, 'browser' | 'microsoft-store' | 'android' | 'ios' | 'ait' | 'reddit' | 'verse8' | 'oneplay'>;
 export type PurchaseIdempotencyKey = string;
 export type AdRewardIdempotencyKey = string;
 export type EntitlementIdempotencyKey = PurchaseIdempotencyKey | AdRewardIdempotencyKey;

package/dist/types.js

@@ -154,13 +154,14 @@ function assertStoreTarget(input) {
     if (input !== 'microsoft-store'
         && input !== 'android'
         && input !== 'ios'
-        && input !== 'ait') {
-        throw new Error('target must be microsoft-store, android, ios, or ait.');
+        && input !== 'ait'
+        && input !== 'oneplay') {
+        throw new Error('target must be microsoft-store, android, ios, ait, or oneplay.');
     }
 }
 function assertAdRewardTarget(input) {
     if (input !== 'browser' && input !== 'microsoft-store' && input !== 'android'
-        && input !== 'ios' && input !== 'ait' && input !== 'reddit' && input !== 'verse8') {
+        && input !== 'ios' && input !== 'ait' && input !== 'reddit' && input !== 'verse8' && input !== 'oneplay') {
         throw new Error('target must be a supported platform target.');
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/game-services",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Client, contract, server, store, and test helpers for authoritative mpgd game services.",
   "license": "MIT",
   "repository": {
@@ -156,6 +156,26 @@
     "./ad-reward-verifier-registry": {
       "types": "./dist/ad-reward-verifier-registry.d.ts",
       "default": "./dist/ad-reward-verifier-registry.js"
+    },
+    "./oneplay-client-reward": {
+      "types": "./dist/oneplay-client-reward.d.ts",
+      "default": "./dist/oneplay-client-reward.js"
+    },
+    "./oneplay-reward": {
+      "types": "./dist/oneplay-reward.d.ts",
+      "default": "./dist/oneplay-reward.js"
+    },
+    "./oneplay-purchase-client": {
+      "types": "./dist/oneplay-purchase-client.d.ts",
+      "default": "./dist/oneplay-purchase-client.js"
+    },
+    "./oneplay-purchase": {
+      "types": "./dist/oneplay-purchase.d.ts",
+      "default": "./dist/oneplay-purchase.js"
+    },
+    "./oneplay-pns": {
+      "types": "./dist/oneplay-pns.d.ts",
+      "default": "./dist/oneplay-pns.js"
     }
   },
   "files": [
@@ -166,9 +186,9 @@
     "@orpc/client": "2.0.0-beta.14",
     "@orpc/contract": "2.0.0-beta.14",
     "@orpc/server": "2.0.0-beta.14",
-    "@mpgd/analytics": "0.4.2",
-    "@mpgd/platform": "0.16.0",
-    "@mpgd/catalog": "0.7.8"
+    "@mpgd/analytics": "0.4.4",
+    "@mpgd/catalog": "0.8.1",
+    "@mpgd/platform": "0.18.0"
   },
   "devDependencies": {
     "@opentelemetry/api": "1.9.0",
@@ -187,7 +207,7 @@
     "fix": "ttsc fix",
     "build": "cd ../.. && node tools/run-ttsx.mjs tools/package/build-packages.ts @mpgd/game-services",
     "test:packed-transport": "pnpm build && node test/runtime-transport-package-import.mjs && node test/reward-evidence-import.mjs",
-    "test:unit": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-progress.test.ts && node tools/run-ttsx.mjs packages/game-services/src/runtime.test.ts && node tools/run-ttsx.mjs packages/game-services/src/types.test.ts && node tools/run-ttsx.mjs packages/game-services/src/server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-publisher-client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-identity.test.ts && node tools/run-ttsx.mjs packages/game-services/src/platform-order.test.ts && node tools/run-ttsx.mjs packages/game-services/src/progress-link.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notification-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/admob-ssv.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-verifier.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-evidence-verification-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-partner-api.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-durability-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-transport.test.ts && node tools/run-ttsx.mjs packages/game-services/src/guest-session.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-reward-evidence.test.ts && node tools/run-ttsx.mjs packages/game-services/src/ad-reward-verifier-registry.test.ts",
+    "test:unit": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-progress.test.ts && node tools/run-ttsx.mjs packages/game-services/src/runtime.test.ts && node tools/run-ttsx.mjs packages/game-services/src/types.test.ts && node tools/run-ttsx.mjs packages/game-services/src/server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-publisher-client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-identity.test.ts && node tools/run-ttsx.mjs packages/game-services/src/platform-order.test.ts && node tools/run-ttsx.mjs packages/game-services/src/progress-link.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notification-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/admob-ssv.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-verifier.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-evidence-verification-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-partner-api.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-durability-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-transport.test.ts && node tools/run-ttsx.mjs packages/game-services/src/guest-session.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-reward-evidence.test.ts && node tools/run-ttsx.mjs packages/game-services/src/ad-reward-verifier-registry.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-reward.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-purchase.test.ts",
     "test:recovery": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/monetization-recovery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-recovery.test.ts",
     "test": "pnpm test:unit && pnpm test:recovery && pnpm test:packed-transport"
   }