@mpgd/game-services 0.28.1 → 0.30.0

package/dist/account-deletion.js

@@ -0,0 +1,491 @@
+/**
+ * Account deletion (Google Play "account deletion requirements", App Store
+ * Review Guideline 5.1.1(v)): the server erases what game services keep for
+ * a player, keeps only the purchase records the law requires (detached from
+ * the player), and has the identity service end the player's sessions.
+ *
+ * Retention decision (see docs/GAME_SERVICES_BACKEND.md#account-deletion):
+ * - Purchase ledger rows (`source: 'purchase'`), the revocations that reverse
+ *   them and their notes are kept for five years, the period the Korean
+ *   E-Commerce Act's enforcement decree (article 6(1)) sets for payment and
+ *   supply records. They are rewritten so nothing links them to the player:
+ *   a random ledger id and idempotency key, the player id replaced by
+ *   `deleted:<deletionId>`, and a `playerId` payload key removed. What
+ *   identifies the store transaction (store, product, platform transaction
+ *   and order ids, the token digest, the store's own account binding) stays,
+ *   so a dispute can be answered from the store receipt and the same store
+ *   purchase can never be granted again.
+ * - Everything else (rewarded-ad and admin grants, scores, verified
+ *   leaderboard entries, notification endpoints, consent records, notices,
+ *   reminders, sends and their history) is deleted.
+ */
+import { resolveGameServicesRequestHeaders, } from './request-headers.js';
+/** The public route a signed-in player deletes their own account through. */
+export const accountDeletionEndpoint = '/game-services/account/delete';
+/**
+ * The request header carrying the deletion confirmation: a short-lived,
+ * single-use token the identity service issues to the holder of the
+ * session's refresh token after the in-app second step. A bare access
+ * token (15 minutes, sent with every request) is not enough to destroy the
+ * account.
+ */
+export const accountDeletionConfirmationHeader = 'x-mpgd-account-deletion-confirmation';
+/**
+ * The longest confirmation the server accepts (characters); the identity
+ * service issues shorter ones.
+ */
+export const accountDeletionConfirmationMaxLength = 4096;
+/** How long the detached purchase records are kept (Korean E-Commerce Act decree, art. 6(1)). */
+export const retainedPurchaseRecordYears = 5;
+/** The prefix of the player id that replaces a deleted player's on the records kept. */
+export const retainedPlayerIdPrefix = 'deleted:';
+export class AccountDeletionError extends Error {
+    code;
+    retryable;
+    /**
+     * Whether the request may have reached the server. For
+     * `ACCOUNT_DELETION_UNREACHABLE` it was sent and its answer was lost or
+     * unreadable, so the deletion may have completed; for `UNAUTHORIZED` the
+     * server refused the session (`false`: no session on this device).
+     */
+    requestSent;
+    constructor(code, options = {}) {
+        super(`Account deletion failed: ${code}.`, options.cause === undefined ? {} : { cause: options.cause });
+        this.name = 'AccountDeletionError';
+        this.code = code;
+        this.retryable = code === 'ACCOUNT_DELETION_FAILED' || code === 'ACCOUNT_DELETION_UNREACHABLE';
+        this.requestSent = options.requestSent ?? code !== 'ACCOUNT_DELETION_UNREACHABLE';
+    }
+}
+/** An `erasing` erasure older than this (one hour) is discarded by the sweep. */
+export const staleErasingPendingMs = 60 * 60 * 1000;
+/**
+ * The sweep erases an `identity-deleted` erasure once more, and only then
+ * clears it, at its first run at least this long (15 minutes) after the
+ * request: longer than any request that authenticated before the identity
+ * was deleted can still run. Until then the pending entry (with the player
+ * id) is kept, so a deployment must run the sweep (the Worker's cron).
+ */
+export const finalErasureDelayMs = 15 * 60 * 1000;
+export function createInMemoryPendingAccountErasureStore() {
+    const pending = new Map();
+    const triedAt = (erasure) => erasure.attemptedAt ?? erasure.recordedAt;
+    return {
+        async put(erasure) {
+            pending.set(erasure.deletionId, { ...erasure });
+        },
+        async clear({ deletionId }) {
+            pending.delete(deletionId);
+        },
+        async list({ limit, identityDeletedBefore }) {
+            const rank = (erasure) => erasure.phase === 'identity-deleted' ? 0 : 1;
+            return [...pending.values()]
+                .filter((erasure) => identityDeletedBefore === undefined
+                || erasure.phase !== 'identity-deleted'
+                || Date.parse(erasure.recordedAt) <= Date.parse(identityDeletedBefore))
+                .sort((left, right) => rank(left) - rank(right) || triedAt(left).localeCompare(triedAt(right)))
+                .slice(0, limit);
+        },
+    };
+}
+export function createAccountDeletionService(input) {
+    const now = input.now ?? (() => new Date().toISOString());
+    const createDeletionId = input.createDeletionId ?? (() => crypto.randomUUID());
+    const sleep = input.sleep ?? defaultSleep;
+    return {
+        async deletePlayerAccount({ playerId }) {
+            if (typeof playerId !== 'string' || playerId.length === 0 || isRetainedPlayerId(playerId)) {
+                // A `deleted:` id names kept records, never a player who can sign in.
+                throw new AccountDeletionError('UNAUTHORIZED');
+            }
+            const deletionId = createDeletionId();
+            const requestedAt = now();
+            const erasure = { playerId, retainedPlayerId: `${retainedPlayerIdPrefix}${deletionId}` };
+            const pendingErasure = {
+                ...erasure,
+                deletionId,
+                recordedAt: requestedAt,
+                phase: 'erasing',
+                attempts: 0,
+            };
+            try {
+                await input.pending.put(pendingErasure);
+            }
+            catch (error) {
+                throw new AccountDeletionError('ACCOUNT_DELETION_FAILED', { cause: error });
+            }
+            const identity = input.identity;
+            if (identity !== null) {
+                // Retried here (it is idempotent): a call that committed but whose
+                // answer was lost succeeds the next time, and the player, whose
+                // sessions may already be gone, could not retry it.
+                let lastError;
+                const identityDeleted = await retry(() => identity.deletePlayer({ playerId }), sleep, (error, attempt) => {
+                    lastError = error;
+                    logFailure(`Account deletion identity call failed (attempt ${attempt} of ${retryAttempts}):`, deletionId, playerId, error);
+                });
+                if (identityDeleted === undefined) {
+                    // Nothing is erased yet and the player most likely still exists and
+                    // retries; an `erasing` entry left behind is only discarded when stale.
+                    throw new AccountDeletionError('ACCOUNT_DELETION_FAILED', { cause: lastError });
+                }
+            }
+            // Without an identity service (local development) the player still
+            // exists, so the entry stays `erasing` and no sweep erases it.
+            const marked = input.identity === null
+                || await retry(() => input.pending.put({ ...pendingErasure, phase: 'identity-deleted' }), sleep, (error, attempt) => logFailure(`Account deletion pending entry not marked (attempt ${attempt} of ${retryAttempts}):`, deletionId, playerId, error)) !== undefined;
+            // Each store on its own, so one failing store does not stop the others.
+            let deleted = 0;
+            let retained = 0;
+            let complete = true;
+            for (const eraser of input.erasers) {
+                const result = await retry(() => eraser.erasePlayerData(erasure), sleep, (error, attempt) => logFailure(`Account deletion erasure failed (attempt ${attempt} of ${retryAttempts}):`, deletionId, playerId, error));
+                if (result === undefined) {
+                    complete = false;
+                    continue;
+                }
+                deleted += result.value.deleted;
+                retained += result.value.retained;
+            }
+            if (!complete && (!marked || input.identity === null)) {
+                // No sweep finishes this one (not marked, or no identity service, so
+                // the entry stays `erasing` and is discarded): an operator can only
+                // learn it from this line and the audit entry.
+                console.error('Account deletion erasure incomplete; no sweep will finish it:', deletionId);
+            }
+            if (complete && !marked && input.identity !== null) {
+                // Erased once, but the `identity-deleted` mark failed, so the sweep
+                // never runs this deletion's final pass: a write by a request that
+                // authenticated before the identity was deleted may stay. The audit
+                // entry says complete, so this line is how an operator learns it.
+                console.error('Account deletion final pass skipped (pending entry not marked):', deletionId);
+            }
+            // A marked entry stays for the sweep's final pass (`finalErasureDelayMs`
+            // after the request): a request authenticated before the identity was
+            // deleted may still write, and only a later pass removes it. An
+            // unmarked one gets no sweep, so a complete erasure clears it.
+            if (complete && (!marked || input.identity === null)) {
+                try {
+                    await input.pending.clear({ deletionId });
+                }
+                catch (error) {
+                    logFailure('Account deletion pending entry not cleared:', deletionId, playerId, error);
+                }
+            }
+            const completedAt = now();
+            const entry = {
+                deletionId,
+                requestedAt,
+                completedAt,
+                identity: input.identity === null ? 'not-configured' : 'deleted',
+                complete,
+                deleted,
+                retained,
+            };
+            await recordAudit(input.audit, entry, playerId);
+            return {
+                status: 'deleted',
+                deletionId,
+                completedAt,
+                retainedPurchaseRecords: retained,
+            };
+        },
+    };
+}
+/**
+ * Finishes erasures a deletion left pending: an `identity-deleted` one is
+ * erased again `finalErasureDelayMs` after the request (every deletion
+ * gets this final pass, which removes what a request authenticated before
+ * the identity was deleted wrote later) and cleared once every store
+ * completed it, with an audit entry that marks the deletion complete; an
+ * `erasing` one older than
+ * `staleErasingPendingMs` is discarded without erasing. Run it from a
+ * scheduled job. A failing erasure is tried again later, least recently
+ * tried first, so one that keeps failing does not block the others.
+ */
+export async function finishPendingAccountErasures(input) {
+    const now = input.now ?? (() => new Date().toISOString());
+    let finished = 0;
+    let failed = 0;
+    let discarded = 0;
+    const identityDeletedBefore = new Date(Date.parse(now()) - finalErasureDelayMs).toISOString();
+    for (const erasure of await input.pending.list({
+        limit: input.limit ?? 25,
+        identityDeletedBefore,
+    })) {
+        const at = now();
+        if (erasure.phase !== 'identity-deleted') {
+            if (Date.parse(at) - Date.parse(erasure.recordedAt) >= staleErasingPendingMs) {
+                try {
+                    await input.pending.clear({ deletionId: erasure.deletionId });
+                    discarded += 1;
+                    console.error('Stale pending account erasure discarded:', erasure.deletionId);
+                }
+                catch (error) {
+                    failed += 1;
+                    logFailure('Stale pending account erasure not discarded:', erasure.deletionId, erasure.playerId, error);
+                }
+            }
+            continue;
+        }
+        if (Date.parse(at) - Date.parse(erasure.recordedAt) < finalErasureDelayMs) {
+            // Too early for the final pass: requests that authenticated before the
+            // identity was deleted may still be writing.
+            continue;
+        }
+        // Every store on its own, as in the inline erasure.
+        let deleted = 0;
+        let retained = 0;
+        let erased = true;
+        for (const eraser of input.erasers) {
+            try {
+                const result = await eraser.erasePlayerData(erasure);
+                deleted += result.deleted;
+                retained += result.retained;
+            }
+            catch (error) {
+                erased = false;
+                logFailure('Pending account erasure not finished:', erasure.deletionId, erasure.playerId, error);
+            }
+        }
+        if (!erased) {
+            failed += 1;
+            if (erasure.attempts + 1 >= pendingErasureAlertAttempts) {
+                console.error('Pending account erasure keeps failing; it needs an operator:', erasure.deletionId, `${erasure.attempts + 1} sweep attempts`);
+            }
+            try {
+                await input.pending.put({ ...erasure, attempts: erasure.attempts + 1, attemptedAt: at });
+            }
+            catch (error) {
+                logFailure('Pending account erasure attempt not recorded:', erasure.deletionId, erasure.playerId, error);
+            }
+            continue;
+        }
+        try {
+            await input.pending.clear({ deletionId: erasure.deletionId });
+        }
+        catch (error) {
+            // Erased; the next sweep repeats the (now empty) erasure and clears it.
+            logFailure('Pending account erasure not cleared:', erasure.deletionId, erasure.playerId, error);
+        }
+        finished += 1;
+        // Under the same deletion id as the request's own entry; a store keyed
+        // by it adds these counts to that entry's (the Worker's D1 table does).
+        await recordAudit(input.audit, {
+            deletionId: erasure.deletionId,
+            requestedAt: erasure.recordedAt,
+            completedAt: at,
+            identity: 'deleted',
+            complete: true,
+            deleted,
+            retained,
+        }, erasure.playerId);
+    }
+    return { finished, failed, discarded };
+}
+const retryAttempts = 3;
+/** Sweep attempts after which a failing pending erasure is logged as needing an operator. */
+const pendingErasureAlertAttempts = 10;
+const retryBackoffMs = [100, 400];
+/** Runs `operation` up to three times with a short backoff; `undefined` when all failed. */
+async function retry(operation, sleep, onFailure) {
+    for (let attempt = 0; attempt < retryAttempts; attempt += 1) {
+        try {
+            if (attempt > 0) {
+                await sleep(retryBackoffMs[Math.min(attempt, retryBackoffMs.length) - 1] ?? 0);
+            }
+            return { value: await operation() };
+        }
+        catch (error) {
+            onFailure(error, attempt + 1);
+        }
+    }
+    return undefined;
+}
+async function recordAudit(audit, entry, playerId) {
+    try {
+        await audit?.(entry);
+    }
+    catch (error) {
+        // The deletion itself is done; failing here would make the player retry
+        // with a session that no longer exists.
+        logFailure('Account deletion audit entry not recorded:', entry.deletionId, playerId, error);
+    }
+}
+/**
+ * Logs a failure by deletion id with the error's name and message, cut
+ * short and with the player id scrubbed, so no log line names the player.
+ */
+function logFailure(message, deletionId, playerId, error) {
+    const described = error instanceof Error ? `${error.name}: ${error.message}` : 'unknown error';
+    console.error(message, deletionId, described.split(playerId).join('[player]').slice(0, 200));
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/** The player id stored on a deleted player's kept purchase records. */
+export function isRetainedPlayerId(playerId) {
+    return playerId.startsWith(retainedPlayerIdPrefix);
+}
+/** Refuses an erasure input whose ids could re-erase another deletion's kept records. */
+export function assertPlayerDataErasureInput(input) {
+    if (typeof input.playerId !== 'string'
+        || input.playerId.length === 0
+        || isRetainedPlayerId(input.playerId)
+        || typeof input.retainedPlayerId !== 'string'
+        || !isRetainedPlayerId(input.retainedPlayerId)
+        || input.retainedPlayerId.length <= retainedPlayerIdPrefix.length) {
+        throw new Error('Player data erasure needs a player id and a deleted:<id> retained player id.');
+    }
+    return input;
+}
+/** A fresh id for a kept ledger row; it carries nothing of the player's ids. */
+export function createRetainedLedgerEntryId() {
+    return `retained_${crypto.randomUUID()}`;
+}
+/** The kept row's payload: the store transaction stays, the player id goes. */
+export function detachRetainedLedgerPayload(payload) {
+    const { playerId: _playerId, ...rest } = payload;
+    void _playerId;
+    return rest;
+}
+/** How long `deleteAccount()` waits for the session and the server by default. */
+export const defaultAccountDeletionTimeoutMs = 30_000;
+export function createAccountDeletionClient(input) {
+    const url = `${input.baseUrl.replace(/\/+$/gu, '')}${accountDeletionEndpoint}`;
+    // setTimeout fires at once for a delay that is not a positive 32-bit count.
+    const timeoutMs = typeof input.timeoutMs === 'number' && Number.isFinite(input.timeoutMs)
+        && input.timeoutMs > 0
+        ? Math.min(input.timeoutMs, 2_147_483_647)
+        : defaultAccountDeletionTimeoutMs;
+    return {
+        async deleteAccount(request = {}) {
+            const confirmationHeader = request.confirmation === undefined
+                ? {}
+                : { [accountDeletionConfirmationHeader]: request.confirmation };
+            const fetcher = input.fetch
+                ?? globalThis.fetch;
+            if (fetcher === undefined) {
+                throw new AccountDeletionError('ACCOUNT_DELETION_UNREACHABLE');
+            }
+            const controller = new AbortController();
+            let timer;
+            let sent = false;
+            const deadline = new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    reject(new AccountDeletionError('ACCOUNT_DELETION_UNREACHABLE', { requestSent: sent }));
+                }, timeoutMs);
+            });
+            try {
+                let headers;
+                try {
+                    headers = await Promise.race([
+                        resolveGameServicesRequestHeaders({
+                            headers: input.headers,
+                            getHeaders: input.getHeaders,
+                        }),
+                        deadline,
+                    ]);
+                }
+                catch (error) {
+                    // A resolver that failed (a refresh that could not reach the
+                    // identity service) sent nothing: retrying may work. A signed-out
+                    // session resolves without a header and is caught below.
+                    throw error instanceof AccountDeletionError
+                        ? error
+                        : new AccountDeletionError('ACCOUNT_DELETION_UNREACHABLE', { cause: error });
+                }
+                if (!Object.keys(headers).includes('authorization')) {
+                    // Signed out on this device: nothing was sent.
+                    throw new AccountDeletionError('UNAUTHORIZED', { requestSent: false });
+                }
+                let response;
+                let text;
+                try {
+                    sent = true;
+                    const answer = async () => {
+                        const received = await fetcher(url, {
+                            method: 'POST',
+                            headers: { ...headers, ...confirmationHeader, 'content-type': 'application/json' },
+                            body: '{}',
+                            signal: controller.signal,
+                        });
+                        return [received, await received.text()];
+                    };
+                    [response, text] = await Promise.race([answer(), deadline]);
+                }
+                catch (error) {
+                    throw error instanceof AccountDeletionError
+                        ? error
+                        : new AccountDeletionError('ACCOUNT_DELETION_UNREACHABLE', {
+                            cause: error,
+                            requestSent: true,
+                        });
+                }
+                return readAnswer(response, text);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+function readAnswer(response, text) {
+    const body = parseJsonObject(text);
+    if (response.status === 200) {
+        const receipt = readReceipt(body);
+        if (receipt === undefined) {
+            throw new AccountDeletionError('ACCOUNT_DELETION_UNREACHABLE', { requestSent: true });
+        }
+        return receipt;
+    }
+    const code = body?.error;
+    if (response.status === 401) {
+        throw new AccountDeletionError('UNAUTHORIZED');
+    }
+    if (response.status === 403 && code === 'PLAYER_ID_MISMATCH') {
+        throw new AccountDeletionError('PLAYER_ID_MISMATCH');
+    }
+    if (response.status === 403 && code === 'ACCOUNT_DELETION_CONFIRMATION_REQUIRED') {
+        throw new AccountDeletionError('ACCOUNT_DELETION_CONFIRMATION_REQUIRED');
+    }
+    if (code === 'ACCOUNT_DELETION_NOT_CONFIGURED' || response.status === 404) {
+        // 404: a server from before this route.
+        throw new AccountDeletionError('ACCOUNT_DELETION_NOT_CONFIGURED');
+    }
+    throw new AccountDeletionError(response.status >= 500 || retryableClientStatuses.has(response.status)
+        ? 'ACCOUNT_DELETION_FAILED'
+        : 'ACCOUNT_DELETION_REJECTED');
+}
+/** Request Timeout, Too Early, Too Many Requests: worth another try. */
+const retryableClientStatuses = new Set([408, 425, 429]);
+function parseJsonObject(text) {
+    try {
+        const value = JSON.parse(text);
+        return typeof value === 'object' && value !== null && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readReceipt(body) {
+    if (body?.status !== 'deleted'
+        || typeof body.deletionId !== 'string'
+        || typeof body.completedAt !== 'string'
+        || typeof body.retainedPurchaseRecords !== 'number'
+        || !Number.isInteger(body.retainedPurchaseRecords)
+        || body.retainedPurchaseRecords < 0) {
+        return undefined;
+    }
+    return {
+        status: 'deleted',
+        deletionId: body.deletionId,
+        completedAt: body.completedAt,
+        retainedPurchaseRecords: body.retainedPurchaseRecords,
+    };
+}

package/dist/app-store-recovery.d.ts

@@ -23,6 +23,12 @@ export interface CreateAppStoreRecoveryBackendOptions {
     readonly evidenceVerifier: GameServicesEvidenceVerifier;
     readonly bundleId: string;
     readonly environment: AppStoreEnvironment;
+    /**
+    * Set on a Production deployment whose evidence verifier grants sandbox
+    * purchases (`sandboxPurchases: { mode: 'grant' }`), so a restore during
+    * App Review or TestFlight re-verifies its sandbox grant too.
+    */
+    readonly acceptsSandboxTransactions?: boolean;
     readonly timeoutMs?: number;
   };
   /** Look up the original, durable checkout key; never derive one from the transaction ID. */

package/dist/app-store-recovery.js

@@ -1,5 +1,6 @@
 import { resolveProductPlatformId } from '@mpgd/catalog';
 import { createAppStoreVerificationId, isAppStoreVerificationId, } from './app-store-verifier.js';
+import { findPurchaseGrantByEvidenceVerificationId } from './commerce-ledger.js';
 /**
  * Connect StoreKit recovery to the existing authoritative purchase ledger.
  * This is a server-side helper, not an authentication or Apple verifier.
@@ -13,6 +14,10 @@ export function createAppStoreRecoveryBackend(options) {
         && (!Number.isSafeInteger(restoreTimeoutMs) || restoreTimeoutMs <= 0)) {
         throw new TypeError('Restored App Store verification timeout must be positive.');
     }
+    const acceptsSandbox = options.restoredNonConsumables?.acceptsSandboxTransactions;
+    if (acceptsSandbox !== undefined && typeof acceptsSandbox !== 'boolean') {
+        throw new TypeError('acceptsSandboxTransactions must be a boolean.');
+    }
     return {
         async recoverPurchase(input) {
             if (input?.target !== 'ios' || input.playerId !== options.playerId
@@ -37,12 +42,17 @@ export function createAppStoreRecoveryBackend(options) {
                     && input.originalTransactionId !== undefined
                     && input.originalTransactionId !== input.platformTransactionId
                     && restoreConfig !== undefined) {
-                    const candidateId = createAppStoreVerificationId({
-                        environment: restoreConfig.environment,
+                    const originalTransactionId = input.originalTransactionId;
+                    const candidateIn = (environment) => findByVerificationId(options.store, createAppStoreVerificationId({
+                        environment,
                         bundleId: restoreConfig.bundleId,
-                        transactionId: input.originalTransactionId,
-                    });
-                    const candidate = await findByVerificationId(options.store, candidateId);
+                        transactionId: originalTransactionId,
+                    }));
+                    let candidate = await candidateIn(restoreConfig.environment);
+                    if (candidate === undefined && acceptsSandboxRestores(restoreConfig)) {
+                        // An App Review or TestFlight grant on this production ledger.
+                        candidate = await candidateIn('Sandbox');
+                    }
                     if (candidate !== undefined) {
                         if (candidate.source !== 'purchase'
                             || candidate.playerId !== request.playerId
@@ -174,7 +184,10 @@ async function verifyRestoredNonConsumable(input, request, options) {
     if (decision.status === 'pending') {
         return pending(decision.reason ?? 'APP_STORE_RESTORE_VERIFICATION_PENDING');
     }
-    if (decision.status === 'rejected') {
+    if (decision.status === 'rejected' || decision.status === 'restorable') {
+        // This recovery path never grants across players; restore sharing
+        // belongs to the commerce v2 verify path (RFC "Restore sharing"), so a
+        // purchase bound to another account stays refused here.
         return rejected(decision.reason);
     }
     if (decision.status === 'settled') {
@@ -188,7 +201,8 @@ async function verifyRestoredNonConsumable(input, request, options) {
     if (decision.payload?.appStoreTransactionType !== 'Non-Consumable'
         || originalTransactionId !== input.originalTransactionId
         || (environment !== 'Production' && environment !== 'Sandbox')
-        || environment !== config.environment
+        || (environment !== config.environment
+            && !(environment === 'Sandbox' && acceptsSandboxRestores(config)))
         || bundleId !== config.bundleId
         || decision.verificationId !== createAppStoreVerificationId({
             environment,
@@ -199,6 +213,10 @@ async function verifyRestoredNonConsumable(input, request, options) {
     }
     return decision.verificationId;
 }
+/** A production deployment whose evidence verifier also grants App Review sandbox purchases. */
+function acceptsSandboxRestores(config) {
+    return config.environment === 'Production' && config.acceptsSandboxTransactions === true;
+}
 async function findByPlatformEvidence(store, platformTransactionId) {
     const identity = {
         source: 'purchase',
@@ -226,15 +244,7 @@ async function findByIdempotency(store, playerId, idempotencyKey) {
     });
 }
 async function findByVerificationId(store, evidenceVerificationId) {
-    const identity = { source: 'purchase', evidenceVerificationId };
-    if (store.findEntitlementTransactionByEvidenceVerificationId !== undefined) {
-        return store.findEntitlementTransactionByEvidenceVerificationId(identity);
-    }
-    return (await store.listEntitlementTransactions()).find((transaction) => {
-        return transaction.source === identity.source
-            && (transaction.evidenceVerificationId
-                ?? transaction.payload.evidenceVerificationId) === identity.evidenceVerificationId;
-    });
+    return findPurchaseGrantByEvidenceVerificationId(store, evidenceVerificationId);
 }
 function matchesRecovery(transaction, request, restoredVerificationId = '') {
     const verificationId = transaction.evidenceVerificationId