@mpgd/game-services 0.22.0 → 0.23.0

package/dist/notification-delivery.d.ts

@@ -26,7 +26,15 @@ export declare class NotificationDeliveryNotSentError extends Error {
   readonly name = "NotificationDeliveryNotSentError";
 }
 export interface NotificationDeepLinkPolicy {
-  /** Exact HTTP(S) origins permitted for absolute links. Root-relative links are always allowed. */
+  /**
+  * Exact HTTP(S) origins permitted for absolute links. Root-relative links are
+  * allowed when they stay a path on the game origin, so one that names a host
+  * after a backslash (`/\host`) is rejected. Either kind is rejected when its
+  * path would begin with an empty segment after dot segments collapse
+  * (`/.//host`), or after it is percent-decoded once and parsed again
+  * (`/%2F/host`, `/%5Chost`, `/%09/host`, `/.%2F/host`), or when it is longer
+  * than 2,048 characters after normalization.
+  */
   readonly allowedOrigins?: readonly string[];
 }
 export interface NotificationDeliveryClaimOptions extends NotificationDeepLinkPolicy {

package/dist/notification-delivery.js

@@ -20,6 +20,8 @@ const notificationTopics = new Set([
 const defaultClaimLeaseMs = 5 * 60 * 1_000;
 const maxCompletionAttempts = 3;
 const maxNotificationTemplateDataEntries = 128;
+/** Caps identifiers, including a deep link after normalization so it normalizes to itself. */
+const maxIdentifierLength = 2_048;
 /** Throw only when the provider can prove that no external send was attempted. */
 export class NotificationDeliveryNotSentError extends Error {
     name = 'NotificationDeliveryNotSentError';
@@ -337,11 +339,23 @@ function normalizeDeepLink(input, allowedOrigins) {
     }
     if (deepLink.startsWith('/') && !deepLink.startsWith('//')) {
         const baseUrl = new URL('https://mpgd.invalid');
-        const parsed = new URL(deepLink, baseUrl);
-        if (parsed.origin !== baseUrl.origin) {
+        let parsed;
+        // A backslash after the leading slash parses as an authority (`/\host`),
+        // so the link names a host, not a path on the game origin.
+        if (!deepLink.startsWith('/\\')) {
+            try {
+                parsed = new URL(deepLink, baseUrl);
+            }
+            catch {
+                // Rejected below.
+            }
+        }
+        if (parsed === undefined
+            || parsed.origin !== baseUrl.origin
+            || hasNetworkPathPrefix(parsed.pathname)) {
             throw new Error('deepLink must stay on the configured game origin.');
         }
-        return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        return requireNormalizedDeepLinkLength(`${parsed.pathname}${parsed.search}${parsed.hash}`);
     }
     let parsed;
     try {
@@ -359,7 +373,33 @@ function normalizeDeepLink(input, allowedOrigins) {
     if (!allowedOrigins.has(parsed.origin)) {
         throw new Error('deepLink origin is not allowed.');
     }
-    return parsed.toString();
+    if (hasNetworkPathPrefix(parsed.pathname)) {
+        throw new Error('deepLink path must not begin with an empty segment, even after percent-decoding.');
+    }
+    return requireNormalizedDeepLinkLength(parsed.toString());
+}
+/**
+ * Whether a normalized path could be read as a network-path reference to
+ * another host. Dot segments (also percent-encoded) can collapse `/.//host`
+ * into `//host`. A consumer that percent-decodes the path once and parses it
+ * again can reach the same shape from `/%2F/host`, `/%5Chost`, `/%09/host`,
+ * or `/.%2F/host`: URL parsing drops tabs and newlines, reads a backslash as
+ * a slash, and removes dot segments, so the decoded path is checked after
+ * the same steps.
+ */
+function hasNetworkPathPrefix(pathname) {
+    const decoded = pathname
+        .replace(/%([0-7][0-9a-f])/giu, (_escape, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+        .replace(/[\t\n\r]/gu, '');
+    return /^[/\\]{2}/u.test(decoded)
+        || new URL(decoded, 'https://mpgd.invalid').pathname.startsWith('//');
+}
+/** Normalization can grow a link; keep it within the input cap so it normalizes to itself. */
+function requireNormalizedDeepLinkLength(deepLink) {
+    if (deepLink.length > maxIdentifierLength) {
+        throw new Error(`deepLink must contain at most ${String(maxIdentifierLength)} characters after normalization.`);
+    }
+    return deepLink;
 }
 function normalizeAllowedDeepLinkOrigins(input) {
     const origins = new Set();
@@ -427,7 +467,7 @@ function assertRecord(input, label) {
 function normalizeIdentifier(input, label) {
     if (typeof input !== 'string'
         || input.length === 0
-        || input.length > 2_048
+        || input.length > maxIdentifierLength
         || input.trim() !== input) {
         throw new Error(`${label} must be a non-empty, trimmed string.`);
     }

package/dist/runtime.d.ts

@@ -3,6 +3,7 @@ import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
 import type { GameServicesLedgerTarget } from './types.js';
 import type { ClientRewardEvidenceRegistry } from './client-reward-evidence.js';
+import type { CommerceReconcilerProduct } from './commerce-reconciler.js';
 import { type MonetizationOperationStore, type RecoverableMonetizationClient } from './monetization-recovery.js';
 export type GameServicesAuthorityMode = 'production' | 'non-production';
 export type GameServicesRuntimeMode = 'disabled' | 'local' | 'http' | 'orpc';
@@ -34,6 +35,12 @@ interface CreateGameServicesRuntimeCommonInput {
   /** Durable, compare-and-swap journal for purchase and rewarded-ad recovery. */
   readonly operationStore?: MonetizationOperationStore;
   readonly rewardEvidenceRegistry?: ClientRewardEvidenceRegistry;
+  /**
+  * Catalog kinds and store SKUs the commerce v2 reconciler resolves without a
+  * store read (`CommerceReconcilerProduct`), for example derived from the
+  * product catalog's `platformProductIds` for the gateway target.
+  */
+  readonly commerceProducts?: readonly CommerceReconcilerProduct[];
 }
 export type CreateGameServicesRuntimeInput = CreateGameServicesRuntimeCommonInput & ({
   readonly transport?: 'http';

package/dist/runtime.js

@@ -62,6 +62,7 @@ export function createGameServicesRuntime(input) {
             : { analyticsSessionId: input.analyticsSessionId }),
         ...(input.now === undefined ? {} : { now: input.now }),
         ...(input.rewardEvidenceRegistry === undefined ? {} : { rewardEvidenceRegistry: input.rewardEvidenceRegistry }),
+        ...(input.commerceProducts === undefined ? {} : { commerceProducts: input.commerceProducts }),
     };
     const monetizationRecovery = input.operationStore === undefined
         ? undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/game-services",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Client, contract, server, store, and test helpers for authoritative mpgd game services.",
   "license": "MIT",
   "repository": {
@@ -202,9 +202,9 @@
     "@orpc/client": "2.0.0-beta.14",
     "@orpc/contract": "2.0.0-beta.14",
     "@orpc/server": "2.0.0-beta.14",
+    "@mpgd/platform": "0.22.0",
     "@mpgd/analytics": "0.4.8",
-    "@mpgd/catalog": "0.9.3",
-    "@mpgd/platform": "0.22.0"
+    "@mpgd/catalog": "0.9.3"
   },
   "peerDependencies": {
     "@apple/app-store-server-library": "^3.1.0"