@mpgd/game-services 0.23.0 → 0.24.0

package/README.md

@@ -17,22 +17,38 @@ root certificates, the bundle ID, environment, and production App Apple ID,
 and pass the result as `signedTransactionVerifier` to
 `createAppStoreGameServicesEvidenceVerifier`. Backend only: the peer is not
 installed by game clients, and no other subpath imports it. It moved here from
-`@mpgd/adapter-capacitor/app-store-server`, which stays as a deprecated
-re-export for one release.
+`@mpgd/adapter-capacitor/app-store-server`, whose deprecated re-export was
+removed in commerce v2 PR C4.
 
-## Commerce v2 reconciler
+## Commerce reconciler
 
 `createCommerceReconciler` from `@mpgd/game-services/commerce-reconciler` is
-the RFC "Reconciler" over any commerce v2 `CommerceProvider`: it journals every
-purchase as a `commerce-purchase` record of the `MonetizationOperationStore`,
-sends the saved verify request to the backend, finishes a purchase only after
-the ledger grant, and never grants on the client. `createGameServicesClient`
-purchases through it whenever `gateway.commerceV2` exists and exposes it as
-`commerceReconciler`; `createRecoverableMonetizationClient` and
-`createGameServicesRuntime` run it from `monetizationRecovery.reconcile()` and
-`restorePurchases()` over the durable journal. See
+the RFC "Reconciler" over a `CommerceProvider`: it journals every purchase as
+a `commerce-purchase` record of the `MonetizationOperationStore`, sends the
+saved verify request to the backend, finishes a purchase only after the ledger
+grant, and never grants on the client. It is the only purchase path.
+`createGameServicesClient` purchases through it whenever `gateway.commerce`
+exists and exposes it as `commerceReconciler`;
+`createRecoverableMonetizationClient` and `createGameServicesRuntime` run it
+from `monetizationRecovery.reconcile()` and `restorePurchases()` over the
+durable journal. See
 [docs/MONETIZATION_RECOVERY.md](../../docs/MONETIZATION_RECOVERY.md).
 
+A gateway without `gateway.commerce` sells nothing: `purchase()` answers
+`rejected` with a failed platform result and the analytics reason
+`commerce_unavailable`, opens no store UI, and never reaches the backend. The
+v1 purchase path is gone (commerce v2 PR C4): there is no `recoverPurchaseResult`
+(the reconciler learns results from the provider's `getAvailablePurchases` and
+`purchaseUpdated` events), no target-name shortcut for adapter-settled
+purchases, and no `createGooglePlayTokenTransactionId` (use
+`createGooglePlayTokenPurchaseKey` from `@mpgd/platform/commerce`). A leftover
+v1 `purchase` journal record is retired: it stays readable and never reopens the
+store UI or grants locally, but a record that was mid-verification has its saved
+verify request sent to the backend once more by `reconcile()` (the backend's
+answer closes it). Entitlements are not read from the
+gateway: read the backend ledger on the server with
+`listActiveEntitlementTransactions` from `@mpgd/game-services/commerce-ledger`.
+
 ## Commerce evidence registry
 
 `createCommerceEvidenceRegistry` from
@@ -126,7 +142,11 @@ await client.purchase(input, {
 | `completed` | The local invocation returned a normal result; `status` equals that result's status |
 | `exception` | The invocation threw; `at` identifies platform, server, or local processing |
 
-Purchase and rewarded-ad progress are discriminated by `kind` and `phase`.
+Purchase and rewarded-ad progress are discriminated by `kind` and `phase`. A
+purchase goes through the reconciler, which journals a store failure as a
+`failed` result and a backend outage as `pending`, so those end with a
+`completed` event rather than `exception`; `exception` marks a failure of the
+call itself, such as a journal write that rejects before the store opens.
 `sequence` starts at one per invocation and increases for each actual event.
 Events are frozen and calls have independent observers, sequences, and optional
 correlation IDs. Callback invocation order is deterministic; asynchronous callback
@@ -252,3 +272,17 @@ Headless consumers can import operation input/result/progress types and the two-
 `GameServicesOperationClient` port from `@mpgd/game-services/operations`. This entrypoint
 has no runtime implementation and its declarations require no DOM or fetch globals.
 The full client continues to re-export the same operation types for compatibility.
+
+## Apps in Toss anonymous authentication
+
+`createAppsInTossPartnerApiClient({ mtls, timeoutMs })` exposes
+`exchangeAnonymousAuthorizationCode({ code, signal })`, returning
+`{ anonymousKey }` only after `@ait-kit/api-core` authenticates the SDK 3.6
+single-use code through mTLS. The existing response-size limit, timeout, caller
+cancellation, and configured proxy path are preserved. Redirects are rejected.
+
+Create a game-scoped session from the verified key on the server; never accept
+a client-supplied key as the account authority. `verifyAnonymousKey()` remains
+available for existence checks, but does not authenticate the caller. Codes are
+not retried automatically: an indeterminate request needs a fresh SDK code.
+Purchase account binding and ledger idempotency remain the application's job.

package/dist/apps-in-toss-partner-api.d.ts

@@ -59,6 +59,13 @@ export interface AppsInTossIapOrderStatusResult {
   readonly reason?: string;
 }
 export interface AppsInTossPartnerApiClient {
+  /** Authenticate with a fresh SDK 3.6 code; key existence checks are not login. */
+  exchangeAnonymousAuthorizationCode(input: {
+    readonly code: string;
+    readonly signal?: AbortSignal;
+  }): Promise<{
+    readonly anonymousKey: string;
+  }>;
   verifyAnonymousKey(input: {
     readonly anonymousKey: string;
     readonly signal?: AbortSignal;

package/dist/apps-in-toss-partner-api.js

@@ -1,3 +1,4 @@
+import { exchangeAnonAuthCode } from '@ait-kit/api-core';
 export const appsInTossPartnerApiBaseUrl = 'https://apps-in-toss-api.toss.im';
 export const defaultAppsInTossPartnerApiTimeoutMs = 10_000;
 const verifyAnonymousKeyPath = 'api-partner/v1/apps-in-toss/users/anon-key/verify';
@@ -20,6 +21,39 @@ export function createAppsInTossPartnerApiClient(input) {
     const baseUrl = normalizeBaseUrl(input.baseUrl ?? appsInTossPartnerApiBaseUrl);
     const timeoutMs = normalizeTimeout(input.timeoutMs);
     return {
+        async exchangeAnonymousAuthorizationCode(request) {
+            const code = normalizeOpaqueValue(request.code, 'code', 4096);
+            const timeout = createTimeoutSignal(request.signal, timeoutMs);
+            try {
+                const result = await exchangeAnonAuthCode({ code }, {
+                    mode: 'forward',
+                    upstreamBaseUrl: baseUrl.href,
+                    signal: timeout.signal,
+                    mtlsClient: {
+                        async request(url, init) {
+                            // ait-kit endpoints are origin-relative; retain this client's configured proxy prefix.
+                            const upstream = new URL(url);
+                            const target = new URL(upstream.pathname.slice(1) + upstream.search, baseUrl);
+                            // Older workerd rejects redirect: 'error'; manual keeps codes on this origin.
+                            // ait-kit rejects every non-2xx response, including redirects with SUCCESS bodies.
+                            const response = await input.mtls.fetch(target.href, { ...init, redirect: 'manual' });
+                            const text = await readBoundedResponseText(response);
+                            return new Response(text || null, { status: response.status, headers: response.headers });
+                        },
+                    },
+                });
+                if (timeout.signal.aborted) {
+                    throw normalizeTransportError(undefined, request.signal, timeout.signal);
+                }
+                if (!result.ok) {
+                    throw new AppsInTossPartnerApiError('Apps in Toss anonymous authentication failed.', result.upstreamStatus ?? 0, result.error);
+                }
+                return { anonymousKey: result.anonKey };
+            }
+            finally {
+                timeout.cleanup();
+            }
+        },
         async verifyAnonymousKey(request) {
             const anonymousKey = normalizeIdentifier(request.anonymousKey, 'anonymousKey');
             const response = await requestJson({

package/dist/client.d.ts

@@ -109,9 +109,11 @@ export declare function resolveGameServicesRequestHeaders(input: {
 export interface GameServicesClient extends GameServicesOperationClient {
   submitLeaderboardScore(input: GameServicesLeaderboardInput): Promise<GameServicesLeaderboardResult>;
   /**
-  * The commerce v2 reconciler behind `purchase` when the gateway exposes
-  * `commerceV2`. Call `start()` at runtime start and `reconcile()` on app
-  * resume; `purchase` starts it on first use.
+  * The commerce reconciler behind `purchase`, present when the gateway
+  * exposes `commerce`. Call `start()` at runtime start and `reconcile()` on
+  * app resume; `purchase` starts it on first use. A gateway without a commerce
+  * provider has none, and `purchase` then answers `rejected` without opening
+  * any store UI.
   */
   readonly commerceReconciler?: CommerceReconciler;
 }
@@ -129,9 +131,9 @@ export interface CreateGameServicesClientInput {
   /** Explicit client decoders only; server verification is configured independently. */
   readonly rewardEvidenceRegistry?: ClientRewardEvidenceRegistry;
   /**
-  * Journal of the commerce v2 reconciler used when `gateway.commerceV2`
-  * exists. Without one the journal lives in memory for this session only:
-  * duplicates are then caught by the backend ledger, not by the client.
+  * Journal of the commerce reconciler used when `gateway.commerce` exists.
+  * Without one the journal lives in memory for this session only: duplicates
+  * are then caught by the backend ledger, not by the client.
   */
   readonly operationStore?: MonetizationOperationStore;
   /** A reconciler shared with another client, for example the recovery client's. */

package/dist/client.js

@@ -1,7 +1,6 @@
 import { createORPCClient } from '@orpc/client';
 import { RPCLink } from '@orpc/client/fetch';
 import { createAnalyticsReporter } from '@mpgd/analytics';
-import { findAdapterSettledGrant } from './authoritative-purchase.js';
 import { resolveClientRewardClaim, } from './client-reward-evidence.js';
 import { createCommerceReconciler, toGameServicesPurchaseResult, } from './commerce-reconciler.js';
 import { createDefaultClientRewardEvidenceRegistry } from './default-client-reward-evidence.js';
@@ -70,11 +69,11 @@ export function createGameServicesClient(input) {
         now,
         ...(input.analytics === undefined ? {} : { sink: input.analytics }),
     });
-    const commerceProvider = input.gateway.commerceV2;
+    const commerceProvider = input.gateway.commerce;
     let commerceReconciler;
     if (commerceProvider !== undefined) {
         if (input.commerceReconciler === undefined && input.operationStore === undefined) {
-            (input.warn ?? console.warn)('@mpgd/game-services: the commerce v2 reconciler is journaling in memory for this session '
+            (input.warn ?? console.warn)('@mpgd/game-services: the commerce reconciler is journaling in memory for this session '
                 + 'because no operationStore was given; purchases are not recoverable across restarts and '
                 + 'the backend ledger is the only duplicate backstop. Pass a durable MonetizationOperationStore.');
         }
@@ -254,121 +253,26 @@ export function createGameServicesClient(input) {
                     }
                 });
             }
-            return observeGameServicesOperation('purchase', options, async (progress) => {
-                const target = input.target;
-                if (!isGameServicesCommerceTarget(target)) {
-                    const purchase = {
-                        status: 'failed',
-                        entitlementIds: [],
-                    };
-                    await analytics.track({
-                        name: 'purchase_rejected',
-                        properties: {
-                            productId: purchaseInput.productId,
-                            status: purchase.status,
-                            reason: 'unsupported_target',
-                        },
-                    });
-                    return {
-                        status: 'rejected',
-                        purchase,
-                    };
-                }
-                progress.platformRequested();
-                const purchase = await input.gateway.commerce.purchase(purchaseInput);
-                progress.platformResult(purchase.status);
-                if (target === 'verse8') {
-                    const status = purchase.status === 'completed' ? 'rejected' : purchase.status;
-                    await analytics.track({
-                        name: purchase.status === 'pending' ? 'purchase_pending' : 'purchase_rejected',
-                        properties: {
-                            productId: purchaseInput.productId,
-                            status,
-                            reason: purchase.status === 'completed'
-                                ? 'verse8_grants_require_agent8_purchase_event'
-                                : purchase.status === 'pending'
-                                    ? 'agent8_purchase_event_pending'
-                                    : undefined,
-                        },
-                    });
-                    return {
-                        status,
-                        purchase,
-                    };
-                }
-                // A provider that declares adapter settlement already wrote the ledger
-                // grant before returning; the target-name rule remains only for
-                // gateways without a commerce v2 provider (removed in C4).
-                const settledGrant = await findAdapterSettledGrant({
-                    gateway: input.gateway,
-                    target,
-                    purchase,
-                });
-                if (settledGrant !== undefined) {
-                    const result = {
-                        status: 'granted',
-                        purchase,
-                        ledgerEntryId: settledGrant.ledgerEntryId,
-                    };
-                    await analytics.track({
-                        name: 'purchase_granted',
-                        properties: {
-                            productId: purchaseInput.productId,
-                            status: result.status,
-                            ledgerEntryId: settledGrant.ledgerEntryId,
-                            alreadyProcessed: settledGrant.alreadyProcessed,
-                        },
-                    });
-                    return result;
-                }
-                if (purchase.status !== 'completed' || purchase.transactionId === undefined) {
-                    await analytics.track({
-                        name: purchase.status === 'pending' ? 'purchase_pending' : 'purchase_rejected',
-                        properties: {
-                            productId: purchaseInput.productId,
-                            status: purchase.status,
-                            reason: purchaseRejectionReason(purchase),
-                        },
-                    });
-                    return {
-                        status: purchase.status === 'completed' ? 'rejected' : purchase.status,
-                        purchase,
-                    };
-                }
-                const verificationRequest = {
-                    target,
-                    ...(input.deploymentTarget === undefined || input.deploymentTarget === target
-                        ? {}
-                        : { deploymentTarget: input.deploymentTarget }),
-                    playerId: input.playerId,
-                    productId: purchaseInput.productId,
-                    platformTransactionId: purchase.transactionId,
-                    idempotencyKey: purchaseInput.idempotencyKey,
-                    purchasedAt: requestNow(),
-                    ...(purchase.evidence === undefined ? {} : { evidence: purchase.evidence }),
-                };
-                progress.serverRequested();
-                const verification = await input.backend.purchases.verifyPurchase(verificationRequest);
-                progress.serverResult(verification.verified);
-                const result = {
-                    status: verification.verified ? 'granted' : (verification.disposition ?? 'rejected'),
-                    purchase,
-                    verification,
-                    ...(verification.ledgerEntryId === undefined
-                        ? {}
-                        : { ledgerEntryId: verification.ledgerEntryId }),
+            // No commerce provider: the target sells nothing through this gateway.
+            // The reconciler is the only purchase path, so there is no fallback that
+            // could grant from a platform callback; fail closed without store UI.
+            return observeGameServicesOperation('purchase', options, async () => {
+                const purchase = {
+                    status: 'failed',
+                    entitlementIds: [],
                 };
                 await analytics.track({
-                    name: verification.verified ? 'purchase_granted' : verification.disposition === 'pending' ? 'purchase_pending' : 'purchase_rejected',
+                    name: 'purchase_rejected',
                     properties: {
                         productId: purchaseInput.productId,
-                        status: result.status,
-                        ledgerEntryId: verification.ledgerEntryId,
-                        alreadyProcessed: verification.alreadyProcessed,
-                        reason: verification.reason,
+                        status: purchase.status,
+                        reason: 'commerce_unavailable',
                     },
                 });
-                return result;
+                return {
+                    status: 'rejected',
+                    purchase,
+                };
             });
         },
         async claimRewardedAd(rewardInput, options) {
@@ -591,23 +495,6 @@ export function createGameServicesIdempotencyKey(input) {
 function normalizeSegment(value) {
     return value.replaceAll(/[^a-zA-Z0-9_-]+/g, '-').replaceAll(/^-|-$/g, '').slice(0, 64);
 }
-function purchaseRejectionReason(purchase) {
-    if (purchase.status === 'completed' && purchase.transactionId === undefined) {
-        return 'missing_transaction_id';
-    }
-    if (purchase.status === 'pending') {
-        return 'purchase_pending';
-    }
-    return undefined;
-}
-function isGameServicesCommerceTarget(target) {
-    return target === 'microsoft-store'
-        || target === 'android'
-        || target === 'ios'
-        || target === 'ait'
-        || target === 'verse8'
-        || target === 'oneplay';
-}
 function isGameServicesLeaderboardTarget(target) {
     return target === 'browser'
         || target === 'microsoft-store'

package/dist/commerce-reconciler.d.ts

@@ -44,11 +44,14 @@ export interface CommercePurchaseOperationRecord {
   readonly updatedAt: string;
   /** The game's purchase input; absent for a purchase discovered from the store. */
   readonly input?: GameServicesPurchaseInput;
+  /** Full checkout identity, including an optional offer or quantity, bound before launch. */
+  readonly checkoutInput?: RequestPurchaseInput;
   readonly purchase?: StorePurchase;
   /** Saved before the first send and resent unchanged on later passes. */
   readonly request?: VerifyPurchaseRequest;
   readonly response?: VerifyPurchaseResponse;
   readonly ledgerEntryId?: string;
+  /** A retryable error on `requested` means the provider proved checkout never started. */
   readonly error?: CommerceErrorInfo;
   readonly revokedBy?: string;
 }
@@ -59,10 +62,11 @@ export declare function isCommercePurchaseOperationRecord(record: unknown): reco
 export declare function summarizeCommercePurchaseOperation(record: CommercePurchaseOperationRecord): CommercePurchaseSummaryStatus;
 /**
 * Only `granted` and `finishing` records that hold the backend's ledger entry
-* id and a store transaction may be finished. The StoreKit v2 SDK keeps no
-* finish allow-list of its own (the v1 driver's `finishGrantedTransaction`
-* pairing), so this is the finish gate for every `client` and `host` owner:
-* the ledger entry id comes from the journal revision the backend grant wrote.
+* id and a store transaction may be finished. The StoreKit SDK keeps no
+* finish allow-list of its own (the removed v1 driver paired transactions in
+* `finishGrantedTransaction`), so this is the finish gate for every `client`
+* and `host` owner: the ledger entry id comes from the journal revision the
+* backend grant wrote.
 */
 export declare function assertCommerceFinishAllowed(record: CommercePurchaseOperationRecord): {
   readonly transactionId: string;
@@ -99,7 +103,7 @@ export interface CreateCommerceReconcilerInput {
   readonly provider: CommerceProvider;
   /** The game backend; `getPurchaseLedgerStatus` enables the revocation pass once the server exposes it (C2). */
   readonly backend: PurchaseVerificationApi;
-  /** Durable, compare-and-swap journal shared with the v1 recovery client. */
+  /** Durable, compare-and-swap journal shared with the recoverable monetization client's rewarded-ad records. */
   readonly store: MonetizationOperationStore;
   readonly playerId: string;
   /** Ledger target sent as `VerifyPurchaseRequest.target`. */

package/dist/commerce-reconciler.js

@@ -27,14 +27,22 @@ export function isCommercePurchaseOperationRecord(record) {
 }
 /** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
 export function summarizeCommercePurchaseOperation(record) {
+    if (isRetryableBeforeLaunch(record)) {
+        return 'failed';
+    }
     return summarizeCommercePurchaseState(record.state);
 }
+function isRetryableBeforeLaunch(record) {
+    return record.state === 'requested' && record.error?.retryable === true
+        && record.purchase === undefined && record.request === undefined;
+}
 /**
  * Only `granted` and `finishing` records that hold the backend's ledger entry
- * id and a store transaction may be finished. The StoreKit v2 SDK keeps no
- * finish allow-list of its own (the v1 driver's `finishGrantedTransaction`
- * pairing), so this is the finish gate for every `client` and `host` owner:
- * the ledger entry id comes from the journal revision the backend grant wrote.
+ * id and a store transaction may be finished. The StoreKit SDK keeps no
+ * finish allow-list of its own (the removed v1 driver paired transactions in
+ * `finishGrantedTransaction`), so this is the finish gate for every `client`
+ * and `host` owner: the ledger entry id comes from the journal revision the
+ * backend grant wrote.
  */
 export function assertCommerceFinishAllowed(record) {
     if (record.state !== 'granted' && record.state !== 'finishing') {
@@ -62,9 +70,9 @@ export function toGameServicesPurchaseResult(record) {
 }
 function toPurchaseResult(record) {
     const purchase = record.purchase;
-    if (record.state === 'cancelled' || record.state === 'failed') {
+    if (record.state === 'cancelled' || record.state === 'failed' || isRetryableBeforeLaunch(record)) {
         return {
-            status: record.state,
+            status: record.state === 'cancelled' ? 'cancelled' : 'failed',
             entitlementIds: [],
             ...(record.error === undefined ? {} : { diagnostic: toDiagnostic(record.error) }),
         };
@@ -233,7 +241,7 @@ export function createCommerceReconciler(input) {
     };
     /**
      * The provider's capability block. Event-triggered passes use the last read;
-     * an explicit trigger (`start`, `reconcile`, `restorePurchases`) reads it
+     * an explicit trigger (`start`, `reconcile`, `restorePurchases`, a new purchase) reads it
      * again, since availability can change at runtime. A failed read keeps the
      * last block.
      */
@@ -394,6 +402,21 @@ export function createCommerceReconciler(input) {
         }
         return { created: reserved.created, record: reserved.record };
     };
+    // Revising a refused pre-launch attempt does not change its lifecycle state.
+    // Keep the identity durable, and clear the refusal before a deliberate retry.
+    const reviseRequestedError = async (record, error) => {
+        const { error: _previousError, ...rest } = record;
+        const next = {
+            ...rest,
+            ...(error === undefined ? {} : { error }),
+            revision: record.revision + 1,
+            updatedAt: now(),
+        };
+        await journal.replace(record.revision, next);
+        remember(next);
+        retryAt.delete(record.idempotencyKey);
+        return next;
+    };
     const readRecord = async (idempotencyKey) => {
         const found = await journal.read(createCommercePurchaseOperationKey(target, idempotencyKey));
         if (found === undefined) {
@@ -616,6 +639,11 @@ export function createCommerceReconciler(input) {
             for (;;) {
                 switch (record.state) {
                     case 'requested':
+                        if (isRetryableBeforeLaunch(record)) {
+                            // Only an explicit same-key purchase retries a proven unopened
+                            // checkout; recovery must never open a payment surface itself.
+                            return;
+                        }
                         if (isInFlight(record.idempotencyKey)) {
                             return;
                         }
@@ -895,6 +923,9 @@ export function createCommerceReconciler(input) {
         });
     }
     const journaled = (record) => {
+        if (isRetryableBeforeLaunch(record) && record.error !== undefined) {
+            return { outcome: 'failed', error: record.error };
+        }
         if ((record.state === 'cancelled' || record.state === 'failed') && record.error !== undefined) {
             return { outcome: record.state, error: record.error };
         }
@@ -923,26 +954,45 @@ export function createCommerceReconciler(input) {
         const existing = await readRecord(request.idempotencyKey);
         if (existing !== undefined) {
             if (existing.logicalId !== request.logicalId
-                || (existing.input !== undefined && existing.input.source !== request.source)) {
+                || (existing.input !== undefined && existing.input.source !== request.source)
+                || (existing.checkoutInput !== undefined
+                    && (existing.checkoutInput.offerId !== request.offerId
+                        || existing.checkoutInput.quantity !== request.quantity))) {
                 throw new Error('Purchase idempotency key is bound to another product or source.');
             }
-            return { kind: 'answered', result: journaled(existing) };
+            if (!isRetryableBeforeLaunch(existing) || isInFlight(request.idempotencyKey)) {
+                return { kind: 'answered', result: journaled(existing) };
+            }
         }
-        const product = await resolveProduct({ logicalId: request.logicalId });
-        if (product === undefined) {
+        const capabilitiesNow = await readCapabilities(true);
+        if (capabilitiesNow === undefined) {
             return {
                 kind: 'answered',
-                result: failedOutcome(new CommerceError('ITEM_UNAVAILABLE', {
-                    message: `Store ${storeId} does not sell ${request.logicalId}.`,
+                result: failedOutcome(new CommerceError('NOT_PREPARED', {
+                    message: `The ${storeId} provider capabilities could not be read.`,
                 })),
             };
         }
-        const capabilitiesNow = await readCapabilities();
-        if (capabilitiesNow === undefined) {
+        if (capabilitiesNow.availability !== 'available') {
+            const code = capabilitiesNow.availability === 'configuration-required'
+                ? 'CONFIGURATION_REQUIRED'
+                : capabilitiesNow.availability === 'action-required'
+                    ? 'ACTION_REQUIRED'
+                    : 'STORE_UNAVAILABLE';
             return {
                 kind: 'answered',
-                result: failedOutcome(new CommerceError('NOT_PREPARED', {
-                    message: `The ${storeId} provider capabilities could not be read.`,
+                result: failedOutcome(new CommerceError(code, {
+                    message: `Store ${storeId} is ${capabilitiesNow.availability}.`,
+                    retryable: capabilitiesNow.availability === 'temporarily-unavailable',
+                })),
+            };
+        }
+        const product = await resolveProduct({ logicalId: request.logicalId });
+        if (product === undefined) {
+            return {
+                kind: 'answered',
+                result: failedOutcome(new CommerceError('ITEM_UNAVAILABLE', {
+                    message: `Store ${storeId} does not sell ${request.logicalId}.`,
                 })),
             };
         }
@@ -977,19 +1027,20 @@ export function createCommerceReconciler(input) {
                 })),
             };
         }
-        const { created, record } = await reserve({
+        const { created, record } = existing === undefined ? await reserve({
             idempotencyKey: request.idempotencyKey,
             store: storeId,
             logicalId: product.logicalId,
             productKind: product.kind,
             origin: 'game',
             state: 'requested',
+            checkoutInput: { ...request },
             input: {
                 productId: product.logicalId,
                 source: request.source,
                 idempotencyKey: request.idempotencyKey,
             },
-        });
+        }) : { created: true, record: await reviseRequestedError(existing, undefined) };
         if (!created) {
             return { kind: 'answered', result: journaled(record) };
         }
@@ -1012,16 +1063,16 @@ export function createCommerceReconciler(input) {
      * fails here (a stale attempt another pass ended after a very long sheet)
      * is reported; the store answer is still returned to the caller.
      */
-    const recordAnswer = async (request, record, product, result) => {
+    const recordAnswer = async (request, record, product, result, notStarted) => {
         try {
-            return await journalAnswer(request, record, product, result);
+            return await journalAnswer(request, record, product, result, notStarted);
         }
         catch (error) {
             fail('journal', error, record.idempotencyKey);
             return result;
         }
     };
-    const journalAnswer = async (request, reserved, product, result) => {
+    const journalAnswer = async (request, reserved, product, result, notStarted) => {
         // A sheet open past inFlightTimeoutMs may have been ended by a pass as a
         // stale attempt; the journal's answer stands, and a purchase the store
         // reported meanwhile is journaled under its own record.
@@ -1068,6 +1119,9 @@ export function createCommerceReconciler(input) {
                 await write(launched, 'purchased', { purchase });
             }
         }
+        else if (result.outcome === 'failed' && result.error.retryable && notStarted) {
+            await reviseRequestedError(record, result.error);
+        }
         else {
             await write(record, result.outcome, { error: result.error });
         }
@@ -1088,13 +1142,24 @@ export function createCommerceReconciler(input) {
                 // The store call runs outside the lock: the sheet may stay open for
                 // minutes, and events arriving meanwhile are reconciled right away.
                 let answer;
+                let notStarted = false;
+                let presentationSequence = 0;
+                const unsubscribePresentation = provider.presentation?.subscribe((event) => {
+                    if (event.idempotencyKey === request.idempotencyKey && event.sequence > presentationSequence) {
+                        presentationSequence = event.sequence;
+                        notStarted = event.state === 'not-started';
+                    }
+                });
                 try {
                     answer = await provider.requestPurchase(request);
                 }
                 catch (error) {
                     answer = failedOutcome(error);
                 }
-                result = await withLock(() => recordAnswer(request, prepared.record, prepared.product, answer));
+                finally {
+                    unsubscribePresentation?.();
+                }
+                result = await withLock(() => recordAnswer(request, prepared.record, prepared.product, answer, notStarted));
             }
         }
         finally {

package/dist/google-play-purchase.d.ts

@@ -38,12 +38,3 @@ export interface GooglePlayProductPurchaseBoundary extends GameServicesPurchaseG
   verifyPurchase(input: VerifyPurchaseEvidenceInput): ReturnType<GameServicesEvidenceVerifier['verifyPurchase']>;
 }
 export declare function createGooglePlayProductPurchaseBoundary(input: CreateGooglePlayProductPurchaseBoundaryInput): GooglePlayProductPurchaseBoundary;
-/**
-* A non-secret transaction ID for purchases whose Google order ID is absent or
-* delayed: `play-token-sha256:<hex>` of the purchase token.
-*
-* @deprecated Use `createGooglePlayTokenPurchaseKey` from `@mpgd/platform/commerce`;
-* this alias is byte-for-byte the same helper (same key, same `TypeError` for
-* an invalid token) and will be removed in the next major version.
-*/
-export declare const createGooglePlayTokenTransactionId: (purchaseToken: string) => Promise<string>;

package/dist/google-play-purchase.js

@@ -381,15 +381,6 @@ function createGooglePlayObservedOrderMatch(observedTransactionId, tokenTransact
         ? { mode: 'token-only' }
         : { mode: 'if-present', orderId: observedTransactionId };
 }
-/**
- * A non-secret transaction ID for purchases whose Google order ID is absent or
- * delayed: `play-token-sha256:<hex>` of the purchase token.
- *
- * @deprecated Use `createGooglePlayTokenPurchaseKey` from `@mpgd/platform/commerce`;
- * this alias is byte-for-byte the same helper (same key, same `TypeError` for
- * an invalid token) and will be removed in the next major version.
- */
-export const createGooglePlayTokenTransactionId = createGooglePlayTokenPurchaseKey;
 function readGooglePlayVerifiedContext(payload, packageName, productId, purchaseTokenDigest) {
     if (payload?.googlePlayPackageName !== packageName
         || payload.googlePlayProductId !== productId