@mpgd/game-services 0.26.0 → 0.27.0

package/dist/notifications/service.js

@@ -1,4 +1,4 @@
-import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
+import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, fillNotificationTemplate, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
 import { fcmInstallationIdRefusal, notificationExpiredProviderCode, } from './delivery-provider.js';
 import { notificationHistoryRetentionDays, } from './registry.js';
 import { bestNotificationOutcome, formatNotificationInstant, isNotificationRowAbandoned, isNotificationRowDue, notificationAmbiguousReplayHours, notificationSendOutcome, } from './store.js';
@@ -525,6 +525,8 @@ export function createNotificationService(input) {
         const perProvider = new Map();
         const rows = [];
         const refusals = [];
+        let checked = 0;
+        let hostFailure;
         for (const recipient of recipients) {
             const id = recipient.provider.entry.provider;
             let inputs = perProvider.get(id);
@@ -535,8 +537,23 @@ export function createNotificationService(input) {
             const held = inputs;
             const evaluate = (permission) => decide(request, origin, recipient, consent, held.history, permission, at);
             // One read per provider and send, made only once a recipient needs it.
-            const { decision } = earlyRefusal(recipient.provider, evaluate)
-                ?? evaluate(await (held.permission ??= readServerPermission(recipient.provider, request)));
+            // A host that cannot answer is skipped; the send fails only when no
+            // provider could be checked and none passed.
+            let decision;
+            try {
+                const early = earlyRefusal(recipient.provider, evaluate);
+                decision = early === undefined
+                    ? evaluate(await (held.permission ??= readServerPermission(recipient.provider, request))).decision
+                    : early.decision;
+                checked += 1;
+            }
+            catch (error) {
+                if (error instanceof NotificationError && error.code === 'NOTIFICATIONS_TEMPORARILY_UNAVAILABLE') {
+                    hostFailure ??= error;
+                    continue;
+                }
+                throw error;
+            }
             const row = {
                 key: recipient.rowKey,
                 provider: id,
@@ -562,6 +579,9 @@ export function createNotificationService(input) {
                 refusals.push(decision);
             }
         }
+        if (checked === 0 && rows.length === 0 && hostFailure !== undefined) {
+            throw hostFailure;
+        }
         return { rows, refusals };
     };
     const eligible = (mode, row, at) => {
@@ -630,9 +650,19 @@ export function createNotificationService(input) {
         }
         throw busy(sendKey);
     };
+    /**
+     * True when a reminder send must not reach the provider: its schedule entry
+     * is gone, or names another time or content. Assigned once the reminder
+     * helpers below exist; `runRow` only calls it after this factory returns.
+     * A schedule read that fails counts as stopped, so a cancel is never
+     * outlived by a replay.
+     */
+    let sendWasStopped = async () => false;
     /**
      * Claims one row, runs the gate for it immediately before the provider
      * call, and stores the answer. Answers the row's refusal, if any.
+     * A notice the game recorded since the claim, or a reminder cancelled or
+     * replaced since the claim, is dropped instead of sent.
      */
     const runRow = async (sendKey, provider, rowKey, mode) => {
         let claimed;
@@ -646,15 +676,20 @@ export function createNotificationService(input) {
             if (held.send.origin.kind === 'notice'
                 && !await noticeListed(held.send.request.player, held.send.origin.notice, at)) {
                 // The game gave the notice while the push waited: it is not sent again.
+                // A lost compare-and-set is retried; a row another holder claimed is
+                // left for that holder, which checks again immediately before the call.
                 const rows = rowsWith(held.send, row, { kind: 'remove' });
-                await store.updateSend({
+                const dropped = await store.updateSend({
                     key: sendKey,
                     version: held.version,
                     send: rows.length === 0
                         ? undefined
                         : { ...held.send, rows, changedAt: formatNotificationInstant(at) },
                 });
-                return {};
+                if (dropped) {
+                    return {};
+                }
+                continue;
             }
             const token = newToken();
             // The replay window opens at the first claim that may reach the
@@ -746,6 +781,15 @@ export function createNotificationService(input) {
             await complete(sendKey, row, token, { kind: 'remove' }, at);
             return { refusal: decision.status === 'allowed' ? noEndpoint() : decision };
         }
+        if ((send.origin.kind === 'notice'
+            && !await noticeListed(send.request.player, send.origin.notice, nowMs()))
+            || (send.origin.kind === 'reminder' && await sendWasStopped(send))) {
+            // Recorded, cancelled, or replaced while this claim resolved the
+            // recipient. Drop while the claim still holds; a lost compare-and-set
+            // is retried until it wins or the claim is gone.
+            await complete(sendKey, row, token, { kind: 'remove' }, nowMs());
+            return {};
+        }
         const answer = await callProvider(recipient, send.request, topic, decision, at);
         const answeredAt = nowMs();
         switch (answer.status) {
@@ -774,7 +818,9 @@ export function createNotificationService(input) {
                 // The replay window started at the claim that reached the provider (or an earlier one).
                 const firstAttemptedAt = row.firstAttemptedAt ?? formatNotificationInstant(at);
                 if (isNotificationRowAbandoned({ ...row, firstAttemptedAt }, leaseUntil)) {
-                    report(new Error('Ambiguous answers for a day: the delivery stays in flight and is not replayed again.'), 'dispatch.abandoned', { sendKey, provider: row.provider, rowKey: row.key });
+                    report(new Error(answer.providerCode === undefined
+                        ? 'Ambiguous answers for a day: the delivery stays in flight and is not replayed again.'
+                        : `Ambiguous answers for a day (${answer.providerCode}): the delivery stays in flight and is not replayed again.`), 'dispatch.abandoned', { sendKey, provider: row.provider, rowKey: row.key });
                 }
                 await settleAfterCall(sendKey, row, token, {
                     kind: 'set',
@@ -1208,12 +1254,17 @@ export function createNotificationService(input) {
     });
     /**
      * Stops a reminder's send that still waits: the rows not delivered yet
-     * (deferred, queued, or in flight) are dropped, and a send the scheduler
-     * is still making loses its key, so no row of it is ever stored. Only a
-     * send of `fingerprint` (the reminder's own content) is stopped, since the
-     * send key names only the key and time: a send of other content at the key
-     * belongs to the reminder that replaced this one. A send the provider may
-     * already have accepted cannot be recalled. Answers whether anything waited.
+     * (deferred, queued, or in flight with no live claim) are dropped, and a
+     * send the scheduler is still making loses its key, so no row of it is
+     * ever stored. A row whose claim lease is still live is left: its holder
+     * may already have called the provider, and deleting the row makes
+     * `complete` a no-op, which drops the idempotency key and lets the same
+     * key and time send again. The holder drops the row itself if the reminder
+     * was cancelled or replaced before the call. Only a send of `fingerprint`
+     * (the reminder's own content) is stopped, since the send key names only
+     * the key and time: a send of other content at the key belongs to the
+     * reminder that replaced this one. A send the provider may already have
+     * accepted cannot be recalled. Answers whether anything waited.
      */
     const stopReminderSend = async (player, reminder, fingerprint) => {
         let key;
@@ -1224,24 +1275,50 @@ export function createNotificationService(input) {
             return false;
         }
         for (let attempt = 0; attempt < maxLedgerAttempts; attempt += 1) {
+            const at = nowMs();
             const held = await store.getSend(key);
             if (held === undefined || held.send.origin.kind !== 'reminder' || held.send.fingerprint !== fingerprint) {
                 return false;
             }
             const { send } = held;
-            const kept = send.rows.filter((row) => row.state.status === 'delivered');
+            const kept = send.rows.filter((row) => row.state.status === 'delivered' || liveClaim(row, at));
             if (send.rows.length > 0 && kept.length === send.rows.length) {
                 return false;
             }
             const next = kept.length === 0
                 ? undefined
-                : { ...send, rows: kept, changedAt: formatNotificationInstant(nowMs()) };
+                : { ...send, rows: kept, changedAt: formatNotificationInstant(at) };
             if (await store.updateSend({ key, version: held.version, send: next })) {
                 return true;
             }
         }
         throw busy(key);
     };
+    sendWasStopped = async (send) => {
+        if (send.origin.kind !== 'reminder') {
+            return false;
+        }
+        try {
+            const held = await store.getScheduleEntry({
+                player: send.request.player,
+                id: reminderEntryId(send.origin.key),
+            });
+            const item = held?.entry.item;
+            if (item?.kind !== 'reminder') {
+                return true;
+            }
+            const sameTime = createNotificationReminderIdempotencyKey({
+                player: send.request.player,
+                key: send.origin.key,
+                fireAt: item.fireAt,
+            }) === send.key;
+            return !sameTime || reminderFingerprint(send.request.player, item) !== send.fingerprint;
+        }
+        catch (error) {
+            report(error, 'scheduler.reread', send.key);
+            return true;
+        }
+    };
     /** Moves an entry's due time later after a failure, so a broken item does not fill every run. */
     const deferEntry = async (held, at) => {
         try {
@@ -1319,11 +1396,17 @@ export function createNotificationService(input) {
             await stopReminderSend(player, reminder, made.existing.fingerprint);
             made = await createItemSend(request, { kind: 'reminder', key: reminder.key }, at);
             if (made !== 'busy' && 'existing' in made && made.existing.fingerprint !== fingerprint) {
-                // A row of it was delivered, so the key keeps that send: this
-                // reminder cannot have its own under the same key and time.
-                report(new Error("A delivered send of another reminder holds this reminder's key and time; it is not sent."), 'scheduler.reminder', key);
-                await markFired();
-                return undefined;
+                // A delivered row keeps the key: this reminder cannot have its own
+                // under the same key and time. A merely live claim does not. The
+                // holder drops that row if the reminder was replaced before the
+                // provider call, and marking this one fired would spend it with no
+                // delivery. It stays pending until the claim settles or is dropped.
+                if (made.existing.rows.some((row) => row.state.status === 'delivered')) {
+                    report(new Error("A delivered send of another reminder holds this reminder's key and time; it is not sent."), 'scheduler.reminder', key);
+                    await markFired();
+                    return undefined;
+                }
+                return 'busy';
             }
         }
         if (made === 'busy') {
@@ -1729,8 +1812,9 @@ export function createNotificationService(input) {
                 else {
                     const result = await fireReminder(held, item);
                     if (result === 'busy') {
-                        // Another run holds its send: it waits a minute, so the next
-                        // round does not list it again, and it is not progress. The run
+                        // Another run holds its send, or a live claim of other content
+                        // still occupies the key: it waits a minute, so the next round
+                        // does not list it again, and it is not progress. The run
                         // holding the send then loses its mark to this version, re-reads
                         // the same reminder, and keeps its rows; the next run marks it.
                         await deferEntry(held, nowMs());
@@ -2081,12 +2165,26 @@ export function createNotificationService(input) {
             if (reminder.templateData !== undefined && hostTemplate) {
                 throw invalidInput('A host-template provider keeps template context on the server; a reminder takes no templateData.');
             }
+            // An uncompilable link rule is the deployment's. Every provider that
+            // would deliver the topic is checked, not only until the first
+            // candidate passes: registry order, or a player not reached on that
+            // provider yet, must not schedule a reminder the deployment cannot take.
+            if (reminder.link !== undefined) {
+                for (const provider of declaring) {
+                    const configuration = reminderLinkRuleConfigurationIssue(provider);
+                    if (configuration !== undefined) {
+                        throw invalidInput(`Invalid reminder: ${configuration}`);
+                    }
+                }
+            }
             // Gate steps 3 to 5 at set time: one candidate that passes is enough.
             const consent = await store.listConsent(player);
             const permissions = new Map();
             let refusal;
             let passed = false;
             let mapped = false;
+            let evaluated = false;
+            let hostFailure;
             let linkRefusal;
             for (const recipient of candidates) {
                 const topic = topicFor(recipient.provider, recipient.target, reminder.topic, origin);
@@ -2096,9 +2194,14 @@ export function createNotificationService(input) {
                 mapped = true;
                 // The gate's link step, at set time: a provider whose sends need a
                 // link takes the reminder's (by its mapping rule) or the mapping's.
+                // A link rule that does not compile is the deployment's, and fails
+                // the set even when another provider would pass.
                 const linkIssue = reminderLinkIssue(recipient.provider, topic, reminder.link);
                 if (linkIssue !== undefined) {
-                    linkRefusal ??= linkIssue;
+                    if (linkIssue.configuration) {
+                        throw invalidInput(`Invalid reminder: ${linkIssue.message}`);
+                    }
+                    linkRefusal ??= linkIssue.message;
                     continue;
                 }
                 const id = recipient.provider.entry.provider;
@@ -2107,7 +2210,18 @@ export function createNotificationService(input) {
                     permission = readServerPermission(recipient.provider, request);
                     permissions.set(id, permission);
                 }
-                const serverPermission = await permission;
+                let serverPermission;
+                try {
+                    serverPermission = await permission;
+                    evaluated = true;
+                }
+                catch (error) {
+                    if (error instanceof NotificationError && error.code === 'NOTIFICATIONS_TEMPORARILY_UNAVAILABLE') {
+                        hostFailure ??= error;
+                        continue;
+                    }
+                    throw error;
+                }
                 const refused = evaluateNotificationReminderConsent({
                     entry: recipient.provider.entry,
                     topic,
@@ -2131,9 +2245,15 @@ export function createNotificationService(input) {
                 if (linkRefusal !== undefined) {
                     throw invalidInput(`Invalid reminder: ${linkRefusal}`);
                 }
+                if (!evaluated && hostFailure !== undefined) {
+                    throw hostFailure;
+                }
                 // Mapped for none of the player's targets (or none reached): nothing could deliver it.
                 return { status: mapped ? 'permission-required' : 'unavailable' };
             }
+            // A placeholder the fire would throw on is refused now, before the
+            // previous reminder's send is stopped or this one is written.
+            assertReminderCopyFills(declaring, reminder.topic, reminder.templateData, catalog);
             // One reminder per key: setting it replaces the previous one and, before
             // the write, stops the previous one's send that waits; a scheduler run
             // that fires the previous one meanwhile then fails to mark it and stops
@@ -2268,36 +2388,98 @@ export function createNotificationService(input) {
         },
     };
 }
+/**
+ * Fills every locale copy a free-form provider would send, and a target
+ * mapping's own title and body, with the reminder's template data. A
+ * host-template provider skips catalog copy (the host renders that) but not
+ * a mapping that supplies its own title and body: that text is what the
+ * send renders, ahead of the host template. A placeholder without a value
+ * is `NOTIFICATIONS_INVALID_INPUT` now, not a reminder that is stored and
+ * then dropped when it fires.
+ */
+function assertReminderCopyFills(providers, topicId, templateData, catalog) {
+    const data = templateData ?? {};
+    for (const provider of providers) {
+        const hostTemplate = provider.entry.content === 'host-template';
+        for (const target of provider.targets) {
+            const topic = catalog.topicsFor(target).find((declared) => declared.id === topicId && declared.channels.includes('remote'));
+            if (topic === undefined) {
+                continue;
+            }
+            const mappedTitle = topic.mapping?.['title'];
+            const mappedBody = topic.mapping?.['body'];
+            const mapped = typeof mappedTitle === 'string' && typeof mappedBody === 'string';
+            if (hostTemplate && !mapped) {
+                continue;
+            }
+            const texts = mapped
+                ? [mappedTitle, mappedBody]
+                : topic.copy === undefined
+                    ? []
+                    : Object.values(topic.copy).flatMap((localeCopy) => [localeCopy.title, localeCopy.body]);
+            for (const text of texts) {
+                try {
+                    fillNotificationTemplate(text, data);
+                }
+                catch (error) {
+                    throw invalidInput(`Invalid reminder: ${describe(error)}`, error);
+                }
+            }
+        }
+    }
+}
+/** A holder still owns the row: its claim lease has not ended. */
+function liveClaim(row, at) {
+    return row.state.status === 'in-flight'
+        && row.state.claim !== undefined
+        && Date.parse(row.state.leaseUntil) > at;
+}
 /**
  * Why a reminder's `link` cannot reach the player through `provider`, or
  * `undefined`. A provider whose entry needs a link (Devvit) needs the
  * reminder's or the topic mapping's, as the gate does at send time
  * (`link-missing`), and a given link must match the provider's mapping rule
  * for `link`, so a bad one is refused when it is set rather than spent when
- * it fires.
+ * it fires. A rule that does not compile is a configuration error, not a
+ * pass: an uncompilable pattern must not fail open.
  */
 function reminderLinkIssue(provider, topic, link) {
     if (link !== undefined) {
+        const configuration = reminderLinkRuleConfigurationIssue(provider);
+        if (configuration !== undefined) {
+            return { configuration: true, message: configuration };
+        }
         const pattern = provider.validation.mapping['link']?.pattern;
-        if (pattern !== undefined) {
-            let rule;
-            try {
-                rule = new RegExp(pattern, 'u');
-            }
-            catch {
-                return undefined;
-            }
-            if (!rule.test(link)) {
-                return `link does not match provider ${provider.entry.provider}'s link rule.`;
-            }
+        if (pattern !== undefined && !new RegExp(pattern, 'u').test(link)) {
+            return {
+                configuration: false,
+                message: `link does not match provider ${provider.entry.provider}'s link rule.`,
+            };
         }
         return undefined;
     }
     if (provider.entry.link && typeof topic.mapping?.['link'] !== 'string') {
-        return `provider ${provider.entry.provider} sends need a link, and neither the reminder nor the topic mapping has one.`;
+        return {
+            configuration: false,
+            message: `provider ${provider.entry.provider} sends need a link, and neither the reminder nor the topic mapping has one.`,
+        };
     }
     return undefined;
 }
+/** An uncompilable link rule, or `undefined`. The pattern is the deployment's. */
+function reminderLinkRuleConfigurationIssue(provider) {
+    const pattern = provider.validation.mapping['link']?.pattern;
+    if (pattern === undefined) {
+        return undefined;
+    }
+    try {
+        new RegExp(pattern, 'u');
+        return undefined;
+    }
+    catch (error) {
+        return `provider ${provider.entry.provider}'s link rule does not compile (${describe(error)}).`;
+    }
+}
 /** A scheduler batch: clamped to 1 to 1000; anything that is not a number is the default, 100. */
 function batchLimit(limit) {
     const asked = typeof limit === 'number' && Number.isFinite(limit) ? Math.floor(limit) : 100;
@@ -2602,7 +2784,9 @@ function deliveryAnswerOf(answer) {
                 }
                 : { status: 'rejected', reason: answer.reason };
         case 'ambiguous':
-            return { status: 'ambiguous' };
+            return typeof answer.providerCode === 'string'
+                ? { status: 'ambiguous', providerCode: answer.providerCode.slice(0, 64) }
+                : { status: 'ambiguous' };
         default:
             return undefined;
     }

package/dist/notifications/store-conformance.js

@@ -110,6 +110,8 @@ export async function runNotificationStoreConformance(createStore) {
     equal(Date.parse((await store.getEndpoint({ provider: 'fcm', installationId: 'i-7' }))?.sessionExpiresAt ?? ''), Date.parse(at(60_000)), 'endpoints: only the named session moves');
     equal(await store.extendSessionEndpoints({ sessionId: 'extended' }), 1, 'endpoints: a session that no longer ends clears the end');
     equal((await store.getEndpoint({ provider: 'fcm', installationId: 'i-5' }))?.sessionExpiresAt, undefined, 'endpoints: the cleared end reads back');
+    equal(await store.extendSessionEndpoints({ sessionId: 'extended', expiresAt: at(180_000) }), 0, 'endpoints: a cleared end stays cleared when a later end is reported');
+    equal((await store.getEndpoint({ provider: 'fcm', installationId: 'i-5' }))?.sessionExpiresAt, undefined, 'endpoints: extending a cleared session does not restore an end');
     await store.removeSessionEndpoints({ sessionId: 'extended' });
     await store.removeSessionEndpoints({ sessionId: 'other' });
     equal(await store.removeSessionEndpoints({ sessionId: 'shared' }), 2, 'endpoints: the session end unbinds what it registered');
@@ -203,6 +205,23 @@ export async function runNotificationStoreConformance(createStore) {
         });
     }
     deepEqual(await store.listDueSends({ at: at(100), limit: 2 }), ['k-2', 'k-4'], 'sends: due earliest first, limited');
+    for (const key of ['k-tie-b', 'k-tie-a']) {
+        await store.createSend({
+            ...send,
+            key,
+            request: { ...send.request, idempotencyKey: key },
+            rows: [{
+                    ...send.rows[0],
+                    key: `${key}:i-1`,
+                    state: { status: 'deferred', reason: 'quiet-hours', until: at(5) },
+                }],
+        });
+    }
+    deepEqual(await store.listDueSends({ at: at(5), limit: 10 }), ['k-tie-a', 'k-tie-b'], 'sends: the same due time is ordered by key');
+    for (const key of ['k-tie-a', 'k-tie-b']) {
+        const held = await store.getSend(key);
+        ok(await store.updateSend({ key, version: held?.version ?? '', send: undefined }), 'sends: the tie-break fixtures are removed before purge');
+    }
     // History: one entry per send and provider, read from a time on.
     await store.addHistory({
         sendKey: 'h-1',

package/dist/notifications/store.d.ts

@@ -306,7 +306,11 @@ export interface NotificationStore {
   }): Promise<boolean>;
   /** The player's sends with at least one `in-flight` row. */
   listInFlightSends(player: string): Promise<readonly NotificationStoredSend[]>;
-  /** Up to `limit` send keys with a row due at `at` (`notificationSendDueAt`), earliest first. */
+  /**
+  * Up to `limit` send keys with a row due at `at` (`notificationSendDueAt`),
+  * earliest first, then by key. Equal due times use the same order as the
+  * D1 store (`due_at_ms, send_key`) and a Redis sorted set's score ties.
+  */
   listDueSends(input: {
     readonly at: string;
     readonly limit: number;

package/dist/notifications/store.js

@@ -340,7 +340,7 @@ export function createInMemoryNotificationStore() {
                 const due = notificationSendDueAt(send);
                 return due !== undefined && Date.parse(due) <= now ? [{ key: send.key, due: Date.parse(due) }] : [];
             })
-                .sort((left, right) => left.due - right.due)
+                .sort((left, right) => left.due - right.due || compareCodePoints(left.key, right.key))
                 .slice(0, Math.max(0, limit))
                 .map((entry) => entry.key);
         },

package/dist/request-headers.d.ts

@@ -0,0 +1,16 @@
+/**
+* Request headers for game-services calls: static headers, then a resolver
+* for rotating credentials, then per-request headers. Shared by the commerce
+* client and the notifications client so a game gives both one resolver.
+*/
+export type GameServicesHeaderResolver = () => Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+/** Credentials could not be resolved; no backend request was dispatched. */
+export declare class GameServicesHeaderResolutionError extends Error {
+  constructor();
+}
+/** Resolve rotating credentials once and preserve static → dynamic → request precedence. */
+export declare function resolveGameServicesRequestHeaders(input: {
+  readonly headers?: Readonly<Record<string, string>> | undefined;
+  readonly getHeaders?: GameServicesHeaderResolver | undefined;
+  readonly requestHeaders?: Readonly<Record<string, string>> | undefined;
+}): Promise<Readonly<Record<string, string>>>;

package/dist/request-headers.js

@@ -0,0 +1,30 @@
+/**
+ * Request headers for game-services calls: static headers, then a resolver
+ * for rotating credentials, then per-request headers. Shared by the commerce
+ * client and the notifications client so a game gives both one resolver.
+ */
+/** Credentials could not be resolved; no backend request was dispatched. */
+export class GameServicesHeaderResolutionError extends Error {
+    constructor() {
+        super('Game Services request headers could not be resolved before dispatch.');
+        this.name = 'GameServicesHeaderResolutionError';
+    }
+}
+/** Resolve rotating credentials once and preserve static → dynamic → request precedence. */
+export async function resolveGameServicesRequestHeaders(input) {
+    let dynamicHeaders;
+    try {
+        dynamicHeaders = await input.getHeaders?.();
+    }
+    catch {
+        // Resolver exceptions can contain credentials; expose a stable outcome.
+        throw new GameServicesHeaderResolutionError();
+    }
+    const merged = new Map();
+    for (const layer of [input.headers, dynamicHeaders, input.requestHeaders]) {
+        for (const [name, value] of Object.entries(layer ?? {})) {
+            merged.set(name.toLowerCase(), value);
+        }
+    }
+    return Object.fromEntries(merged);
+}

package/dist/runtime.d.ts

@@ -54,4 +54,11 @@ export declare function createGameServicesRuntime(input: CreateGameServicesRunti
 export declare function resolveGameServicesLedgerTarget(target: PlatformTarget | string): GameServicesLedgerTarget | null;
 export declare function resolveGameServicesAuthorityMode(profile: string): GameServicesAuthorityMode;
 export declare function resolveGameServicesTransport(transport: string | undefined): 'http' | 'orpc';
+/**
+* Whether a game-services URL may carry a session's credentials in a
+* production build: an absolute https URL with no credentials and a public
+* host, the rule the authoritative commerce backend follows. The
+* notifications client's starter wiring uses it too.
+*/
+export declare function isPublicGameServicesUrl(baseUrl: string): boolean;
 export {};

package/dist/runtime.js

@@ -149,6 +149,15 @@ function normalizeBaseUrl(baseUrl) {
     const normalized = baseUrl?.trim();
     return normalized === undefined || normalized.length === 0 ? undefined : normalized;
 }
+/**
+ * Whether a game-services URL may carry a session's credentials in a
+ * production build: an absolute https URL with no credentials and a public
+ * host, the rule the authoritative commerce backend follows. The
+ * notifications client's starter wiring uses it too.
+ */
+export function isPublicGameServicesUrl(baseUrl) {
+    return isPublicHttpsUrl(parseAbsoluteUrl(baseUrl.trim()));
+}
 function isPublicHttpsUrl(url) {
     return url !== undefined
         && url.protocol === 'https:'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/game-services",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Client, contract, server, store, and test helpers for authoritative mpgd game services.",
   "license": "MIT",
   "repository": {
@@ -133,6 +133,10 @@
       "types": "./dist/notifications/index.d.ts",
       "default": "./dist/notifications/index.js"
     },
+    "./notifications/client": {
+      "types": "./dist/notifications/client.d.ts",
+      "default": "./dist/notifications/client.js"
+    },
     "./notifications/store-conformance": {
       "types": "./dist/notifications/store-conformance.d.ts",
       "default": "./dist/notifications/store-conformance.js"
@@ -215,9 +219,9 @@
     "@orpc/client": "2.0.0-beta.14",
     "@orpc/contract": "2.0.0-beta.14",
     "@orpc/server": "2.0.0-beta.14",
-    "@mpgd/analytics": "0.4.13",
-    "@mpgd/catalog": "0.10.4",
-    "@mpgd/platform": "0.26.0"
+    "@mpgd/analytics": "0.4.14",
+    "@mpgd/catalog": "0.10.5",
+    "@mpgd/platform": "0.27.0"
   },
   "peerDependencies": {
     "@apple/app-store-server-library": "^3.1.0"
@@ -246,7 +250,7 @@
     "fix": "ttsc fix",
     "build": "cd ../.. && node tools/run-ttsx.mjs tools/package/build-packages.ts @mpgd/game-services",
     "test:packed-transport": "pnpm build && node test/runtime-transport-package-import.mjs && node test/reward-evidence-import.mjs",
-    "test:unit": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-progress.test.ts && node tools/run-ttsx.mjs packages/game-services/src/runtime.test.ts && node tools/run-ttsx.mjs packages/game-services/src/types.test.ts && node tools/run-ttsx.mjs packages/game-services/src/server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-publisher-client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-identity.test.ts && node tools/run-ttsx.mjs packages/game-services/src/platform-order.test.ts && node tools/run-ttsx.mjs packages/game-services/src/progress-link.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notification-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/service.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/service-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/scheduler.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/fcm.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/store-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/ait-functional-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/admob-ssv.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-verifier.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-evidence-verification-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-partner-api.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-durability-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-transport.test.ts && node tools/run-ttsx.mjs packages/game-services/src/guest-session.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-reward-evidence.test.ts && node tools/run-ttsx.mjs packages/game-services/src/ad-reward-verifier-registry.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-reward.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-registry-routing.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-registry-server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-ledger-revocation.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-anonymous-auth.test.ts",
+    "test:unit": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-progress.test.ts && node tools/run-ttsx.mjs packages/game-services/src/runtime.test.ts && node tools/run-ttsx.mjs packages/game-services/src/types.test.ts && node tools/run-ttsx.mjs packages/game-services/src/server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/google-play-publisher-client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/microsoft-store-identity.test.ts && node tools/run-ttsx.mjs packages/game-services/src/platform-order.test.ts && node tools/run-ttsx.mjs packages/game-services/src/progress-link.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notification-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/service.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/service-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/client.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/client-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/scheduler.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/fcm.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/store-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/notifications/ait-functional-delivery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/admob-ssv.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-verifier.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-evidence-verification-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-partner-api.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-durability-conformance.test.ts && node tools/run-ttsx.mjs packages/game-services/src/verified-leaderboard-transport.test.ts && node tools/run-ttsx.mjs packages/game-services/src/guest-session.test.ts && node tools/run-ttsx.mjs packages/game-services/src/client-reward-evidence.test.ts && node tools/run-ttsx.mjs packages/game-services/src/ad-reward-verifier-registry.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-reward.test.ts && node tools/run-ttsx.mjs packages/game-services/src/oneplay-purchase.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-registry-routing.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-registry-server.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-ledger-revocation.test.ts && node tools/run-ttsx.mjs packages/game-services/src/apps-in-toss-anonymous-auth.test.ts",
     "test:recovery": "cd ../.. && node tools/run-ttsx.mjs packages/game-services/src/monetization-recovery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/app-store-recovery.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-reconciler.test.ts && node tools/run-ttsx.mjs packages/game-services/src/commerce-reconciler-conformance.test.ts",
     "test": "pnpm test:unit && pnpm test:app-store-server && pnpm test:recovery && pnpm test:packed-transport",
     "test:app-store-server": "vitest run"