@mpgd/game-services 0.28.1 → 0.30.0

package/dist/google-play-store-server.js

@@ -0,0 +1,297 @@
+import { createGooglePlayTokenPurchaseKey } from '@mpgd/platform/commerce';
+import { findPurchaseGrantByEvidenceVerificationId, isEntitlementGrantReversed, readPurchaseVerificationId, revokeEntitlementGrant, } from './commerce-ledger.js';
+import { createGooglePlayProductVerificationId, googlePlayProductPurchaseEvidenceSchema, } from './google-play-purchase.js';
+/** Google keeps voided purchases for 30 days. */
+export const googlePlayVoidedPurchasesWindowMs = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Kept off the oldest edge of that window: Google refuses a `startTime` older
+ * than 30 days at the time it receives the request, which is a little after
+ * the caller's clock read.
+ */
+export const googlePlayVoidedPurchasesWindowSlackMs = 60_000;
+/**
+ * Appends the `revoke` entry for one voided purchase. The grant is found by
+ * the purchase token's verification id, so the revocation is keyed by the
+ * token: a purchase seen again by a later sweep (or an RTDN message) answers
+ * the first entry with `alreadyProcessed`.
+ */
+export async function revokeGooglePlayVoidedPurchase(input) {
+    const { voided } = input;
+    if (typeof voided?.purchaseToken !== 'string' || voided.purchaseToken.length === 0) {
+        return { status: 'invalid', reason: 'GOOGLE_PLAY_VOIDED_PURCHASE_TOKEN_MISSING' };
+    }
+    const verificationId = await createGooglePlayProductVerificationId(input.packageName, voided.purchaseToken);
+    const grant = await findPurchaseGrantByEvidenceVerificationId(input.store, verificationId);
+    if (grant === undefined || grant.payload.target !== 'android') {
+        return { status: 'grant_not_found' };
+    }
+    const voidedAt = readMillis(voided.voidedTimeMillis);
+    const voidedReason = readCode(voided.voidedReason);
+    const voidedSource = readCode(voided.voidedSource);
+    const result = await revokeEntitlementGrant(input.store, {
+        playerId: grant.playerId,
+        revokesLedgerEntryId: grant.ledgerEntryId,
+        idempotencyKey: `google-play:voided:${verificationId}`,
+        reason: revocationReasonOf(voidedReason),
+        revokedAt: voidedAt === undefined
+            ? (input.now ?? (() => new Date().toISOString()))()
+            : new Date(voidedAt).toISOString(),
+        evidenceVerificationId: `${verificationId}:revoke`,
+        payload: {
+            target: 'android',
+            store: 'google-play',
+            googlePlayPackageName: input.packageName,
+            ...(voided.orderId === undefined ? {} : { googlePlayOrderId: voided.orderId }),
+            ...(voidedReason === undefined ? {} : { googlePlayVoidedReason: voidedReason }),
+            ...(voidedSource === undefined ? {} : { googlePlayVoidedSource: voidedSource }),
+            ...(voidedAt === undefined ? {} : { googlePlayVoidedTimeMillis: voidedAt }),
+        },
+    });
+    if (result.status === 'revoked') {
+        return {
+            status: 'revoked',
+            ledgerEntryId: result.ledgerEntryId,
+            alreadyProcessed: result.alreadyProcessed,
+        };
+    }
+    if (result.status === 'grant_not_found') {
+        return { status: 'grant_not_found' };
+    }
+    return { status: 'conflict', reason: `GOOGLE_PLAY_VOIDED_${result.status.toUpperCase()}` };
+}
+/**
+ * Reads the voided purchases of one time window and revokes their grants.
+ * The sweep is the reliable path even next to RTDN, because a Pub/Sub push
+ * can be missed: run it on a schedule with a window that overlaps the last
+ * complete one (revocations are idempotent per token). An incomplete sweep
+ * (page budget, `shouldContinue`) must be repeated from the same start.
+ */
+export async function sweepGooglePlayVoidedPurchases(input) {
+    const maxPages = input.maxPages ?? 10;
+    if (!Number.isSafeInteger(maxPages) || maxPages < 1) {
+        throw new RangeError('maxPages must be a positive integer.');
+    }
+    const requestedStart = input.startTimeMillis;
+    const endTimeMillis = input.endTimeMillis;
+    const nowMillis = input.now === undefined ? Date.now() : Date.parse(input.now());
+    if (!Number.isSafeInteger(requestedStart) || !Number.isSafeInteger(endTimeMillis)) {
+        throw new RangeError('The voided purchases window must be integer milliseconds.');
+    }
+    if (!Number.isFinite(nowMillis)) {
+        throw new RangeError('now() must return an ISO timestamp.');
+    }
+    const oldest = nowMillis - googlePlayVoidedPurchasesWindowMs + googlePlayVoidedPurchasesWindowSlackMs;
+    const startTimeMillis = Math.max(requestedStart, oldest);
+    if (startTimeMillis > endTimeMillis) {
+        throw new RangeError('The voided purchases window is empty or invalid.');
+    }
+    const clamped = startTimeMillis > requestedStart;
+    const shouldContinue = input.shouldContinue ?? (() => true);
+    const totals = {
+        pages: 0,
+        revoked: 0,
+        alreadyProcessed: 0,
+        notFound: 0,
+        failed: 0,
+        errored: 0,
+    };
+    let pageToken;
+    do {
+        if (totals.pages >= maxPages || !shouldContinue('page')) {
+            return { complete: false, clamped, ...totals };
+        }
+        const page = await input.client.listVoidedPurchases({
+            packageName: input.packageName,
+            startTimeMillis,
+            endTimeMillis,
+            ...(pageToken === undefined ? {} : { pageToken }),
+            signal: input.signal,
+        });
+        totals.pages += 1;
+        totals.failed += page.droppedEntries ?? 0;
+        for (const voided of page.voidedPurchases) {
+            if (!shouldContinue('purchase')) {
+                return { complete: false, clamped, ...totals };
+            }
+            const { purchaseToken: _token, ...loggable } = voided;
+            let outcome;
+            try {
+                outcome = await revokeGooglePlayVoidedPurchase({
+                    store: input.store,
+                    packageName: input.packageName,
+                    voided,
+                    ...(input.now === undefined ? {} : { now: input.now }),
+                });
+            }
+            catch (error) {
+                if (input.signal.aborted) {
+                    throw error;
+                }
+                // One entry's store failure does not hide the rest of the window.
+                totals.errored += 1;
+                input.onOutcome?.(loggable, {
+                    status: 'error',
+                    reason: 'GOOGLE_PLAY_VOIDED_STORE_ERROR',
+                    detail: error instanceof Error
+                        ? `${error.name}: ${error.message}`.slice(0, 200)
+                        : 'unknown error',
+                });
+                continue;
+            }
+            if (outcome.status === 'revoked') {
+                totals[outcome.alreadyProcessed ? 'alreadyProcessed' : 'revoked'] += 1;
+            }
+            else if (outcome.status === 'grant_not_found') {
+                totals.notFound += 1;
+            }
+            else {
+                totals.failed += 1;
+            }
+            input.onOutcome?.(loggable, outcome);
+        }
+        pageToken = page.nextPageToken === undefined || page.nextPageToken.length === 0
+            ? undefined
+            : page.nextPageToken;
+    } while (pageToken !== undefined);
+    return { complete: totals.errored === 0, clamped, ...totals };
+}
+/**
+ * Retries the acknowledge or consume of a durable Play grant from the ledger
+ * entry and the purchase token the Worker kept for it (the ledger itself
+ * stores only the token digest). The finalizer is the same Play boundary the
+ * purchase path uses, so the provider state is re-read before acting and an
+ * already completed purchase answers `completed`. A grant that was reversed
+ * is never finalized: Google is refunding it.
+ */
+export async function retryGooglePlayPurchaseFinalization(input) {
+    const grant = await input.store.getEntitlementTransaction(input.ledgerEntryId);
+    if (grant === undefined || grant.source !== 'purchase' || grant.payload.target !== 'android') {
+        return { status: 'abandoned', reason: 'GOOGLE_PLAY_FINALIZATION_GRANT_NOT_FOUND' };
+    }
+    if (await isEntitlementGrantReversed(input.store, grant.ledgerEntryId)) {
+        return { status: 'abandoned', reason: 'GOOGLE_PLAY_FINALIZATION_GRANT_REVERSED' };
+    }
+    const payload = grant.payload;
+    const productType = readOneTimeProductType(payload.productType);
+    const platformProductId = payload.platformProductId;
+    // An orderless purchase (Google omitted the order id) was recorded without
+    // one; the boundary matches it by token, as the client's token key does.
+    const platformTransactionId = typeof payload.platformTransactionId === 'string'
+        && payload.platformTransactionId.length > 0
+        ? payload.platformTransactionId
+        : await createGooglePlayTokenPurchaseKey(input.purchaseToken);
+    const purchasedAt = payload.purchasedAt;
+    // A grant restore sharing wrote is acknowledged as the purchase it records.
+    const evidenceVerificationId = readPurchaseVerificationId(grant);
+    if (productType === undefined
+        || typeof platformProductId !== 'string' || platformProductId.length === 0
+        || typeof purchasedAt !== 'string' || purchasedAt.length === 0
+        || typeof evidenceVerificationId !== 'string'
+        || grant.grant === undefined) {
+        return { status: 'abandoned', reason: 'GOOGLE_PLAY_FINALIZATION_CONTEXT_UNAVAILABLE' };
+    }
+    if (evidenceVerificationId
+        !== await createGooglePlayProductVerificationId(typeof payload.googlePlayPackageName === 'string' ? payload.googlePlayPackageName : '', input.purchaseToken)) {
+        // The kept token is not the one this grant was verified with.
+        return { status: 'abandoned', reason: 'GOOGLE_PLAY_FINALIZATION_EVIDENCE_MISMATCH' };
+    }
+    const deploymentTarget = typeof payload.deploymentTarget === 'string'
+        ? payload.deploymentTarget
+        : undefined;
+    const store = typeof payload.store === 'string' ? payload.store : undefined;
+    const request = {
+        target: 'android',
+        ...(store === undefined ? {} : { store }),
+        ...(deploymentTarget === undefined ? {} : { deploymentTarget }),
+        playerId: grant.playerId,
+        productId: grant.grantId,
+        platformTransactionId,
+        idempotencyKey: grant.idempotencyKey,
+        purchasedAt,
+        evidence: {
+            schema: googlePlayProductPurchaseEvidenceSchema,
+            payload: { purchaseToken: input.purchaseToken },
+        },
+    };
+    const product = {
+        id: grant.grantId,
+        type: productType,
+        grant: grant.grant,
+        platformProductIds: { android: platformProductId },
+    };
+    const finalizationInput = {
+        request,
+        product,
+        platformProductId,
+        evidenceVerificationId,
+        evidencePayload: payload,
+        ledgerEntryId: grant.ledgerEntryId,
+        alreadyProcessed: true,
+        timeoutMs: input.timeoutMs,
+    };
+    if (input.finalizer.supportsPurchaseGrant?.(finalizationInput) === false) {
+        return { status: 'abandoned', reason: 'GOOGLE_PLAY_FINALIZATION_UNSUPPORTED' };
+    }
+    const result = await finalizeWithin(input.finalizer, finalizationInput, input.signal, input.timeoutMs);
+    if (result.status === 'pending' && result.reason === 'GOOGLE_PLAY_FINALIZATION_EVIDENCE_MISMATCH') {
+        // The boundary is configured for another package than the grant: no
+        // retry can succeed.
+        return { status: 'abandoned', reason: result.reason };
+    }
+    return result;
+}
+/**
+ * Runs the finalizer within `timeoutMs` like the purchase path does: the
+ * provider signal is aborted at the deadline and the retry answers pending,
+ * even when a provider call ignores the abort.
+ */
+async function finalizeWithin(finalizer, input, signal, timeoutMs) {
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new RangeError('timeoutMs must be a positive integer.');
+    }
+    const controller = new AbortController();
+    const abort = () => controller.abort(signal.reason);
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) {
+        abort();
+    }
+    let timer;
+    try {
+        return await Promise.race([
+            finalizer.finalizePurchaseGrant({ ...input, signal: controller.signal }),
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    resolve({
+                        status: 'pending',
+                        alreadyCompleted: false,
+                        reason: 'GOOGLE_PLAY_FINALIZATION_TIMEOUT',
+                    });
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+        signal.removeEventListener('abort', abort);
+    }
+}
+function readOneTimeProductType(input) {
+    return input === 'consumable' || input === 'non_consumable' ? input : undefined;
+}
+function revocationReasonOf(voidedReason) {
+    return voidedReason === 7 ? 'chargeback' : 'voided';
+}
+function readMillis(input) {
+    const value = typeof input === 'string' && /^[0-9]{1,16}$/u.test(input) ? Number(input) : input;
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0
+        && value <= 8_640_000_000_000_000
+        ? value
+        : undefined;
+}
+function readCode(input) {
+    const value = typeof input === 'string' && /^[0-9]{1,3}$/u.test(input) ? Number(input) : input;
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}

package/dist/guest-session.d.ts

@@ -75,13 +75,50 @@ export interface GuestSessionBackend {
     readonly externalProof: string;
     readonly idempotencyKey: string;
   }): Promise<AccountBindingOutcome>;
+  /**
+  * A short-lived, single-use account deletion confirmation for the refresh
+  * token's player, which the game-services deletion route requires besides
+  * the access token (`accountDeletionConfirmationHeader`). It must
+  * authenticate the refresh token like `refresh`, without rotating it, and
+  * throw `GuestSessionRejectedError` for one refused for good. Optional: a
+  * backend without it cannot delete accounts through the starter.
+  */
+  requestAccountDeletionConfirmation?(input: {
+    readonly refreshToken: string;
+  }): Promise<AccountDeletionConfirmationGrant>;
 }
-export type GuestSessionCoordinatorErrorCode = 'GUEST_SESSION_CLOSED' | 'GUEST_SESSION_NOT_READY' | 'GUEST_SESSION_INVALID_INPUT' | 'GUEST_SESSION_INVALID_RESPONSE' | 'GUEST_SESSION_OWNERSHIP_CONFLICT' | 'GUEST_SESSION_BACKEND_FAILED' | 'GUEST_SESSION_CREDENTIAL_LOAD_FAILED' | 'GUEST_SESSION_CREDENTIAL_SAVE_FAILED' | 'GUEST_SESSION_LOGOUT_UNCERTAIN';
+/** A deletion confirmation, as the identity service answers it. */
+export interface AccountDeletionConfirmationGrant {
+  /** Opaque; sent once, in `accountDeletionConfirmationHeader`. */
+  readonly confirmation: string;
+  /** When it stops being accepted (ISO 8601). */
+  readonly expiresAt: string;
+}
+export type GuestSessionCoordinatorErrorCode = 'GUEST_SESSION_CLOSED' | 'GUEST_SESSION_NOT_READY' | 'GUEST_SESSION_INVALID_INPUT' | 'GUEST_SESSION_INVALID_RESPONSE' | 'GUEST_SESSION_OWNERSHIP_CONFLICT' | 'GUEST_SESSION_BACKEND_FAILED'
+/**
+* The identity service refused the refresh token: revoked (logout,
+* replay), expired after inactivity, or unknown. That session cannot come
+* back: the coordinator stops using it (`current()` is `undefined`, and
+* `start()`, `refresh()` and `getHeaders()` fail with
+* `GUEST_SESSION_NOT_READY` without calling the backend). Log out (which
+* removes the stored token) and start a new coordinator for a new guest.
+*/
+| 'GUEST_SESSION_REJECTED' | 'GUEST_SESSION_CREDENTIAL_LOAD_FAILED' | 'GUEST_SESSION_CREDENTIAL_SAVE_FAILED' | 'GUEST_SESSION_LOGOUT_UNCERTAIN'
+/** The backend has no `requestAccountDeletionConfirmation`. */
+| 'GUEST_SESSION_UNSUPPORTED';
 /** Error messages intentionally contain no token, proof, or installation ID. */
 export declare class GuestSessionCoordinatorError extends Error {
   readonly code: GuestSessionCoordinatorErrorCode;
   constructor(code: GuestSessionCoordinatorErrorCode);
 }
+/**
+* A `GuestSessionBackend` throws this when the identity service refused the
+* refresh token for good (revoked, expired, replayed, or unknown), as
+* opposed to an outage. The coordinator reports it as `GUEST_SESSION_REJECTED`.
+*/
+export declare class GuestSessionRejectedError extends Error {
+  constructor();
+}
 export interface GuestSessionCoordinator {
   start(): Promise<ServerGuestSessionView>;
   /** The active session's view, or `undefined` before `start()` settles, after a failure, and after logout. */
@@ -103,6 +140,18 @@ export interface GuestSessionCoordinator {
     readonly status: 'bound' | 'already-bound' | 'conflict';
   }>;
   getHeaders(): Readonly<Record<'authorization', string>>;
+  /**
+  * Asks the backend for an account deletion confirmation with the active
+  * session's refresh token (queued with refreshes, so it never presents a
+  * token a rotation in flight replaces). Fails with
+  * `GUEST_SESSION_REJECTED` when the service refused the session for good,
+  * now or in an earlier refresh (as `refresh` does, the coordinator then
+  * stops using it), `GUEST_SESSION_NOT_READY` without an active session for
+  * any other reason (not started, a failed credential save),
+  * `GUEST_SESSION_CLOSED` after logout, and `GUEST_SESSION_UNSUPPORTED`
+  * when the backend cannot issue one.
+  */
+  requestAccountDeletionConfirmation(): Promise<string>;
   logout(): Promise<void>;
 }
 /**
@@ -165,7 +214,7 @@ export interface GuestServerSession {
   /**
   * The `Authorization` header. An expired access token is refreshed first,
   * and a failed refresh throws its error (`GUEST_SESSION_BACKEND_FAILED`,
-  * `GUEST_SESSION_OWNERSHIP_CONFLICT`, ...). A token that expires within
+  * `GUEST_SESSION_REJECTED`, `GUEST_SESSION_OWNERSHIP_CONFLICT`, ...). A token that expires within
   * `refreshAheadMs` is answered at once while a refresh runs in the
   * background: once per token, and at most once per
   * `guestServerSessionRefreshAheadIntervalMs`, so a backend whose tokens
@@ -173,6 +222,13 @@ export interface GuestServerSession {
   * background refresh is retried when the token has expired.
   */
   getHeaders(): Promise<Readonly<Record<'authorization', string>>>;
+  /**
+  * An account deletion confirmation for the current session
+  * (`GuestSessionCoordinator.requestAccountDeletionConfirmation`), which the
+  * game-services deletion route requires. Optional, so another session
+  * holder (a development session) may leave it out.
+  */
+  requestAccountDeletionConfirmation?(): Promise<string>;
 }
 /** How long before its access token expires `createGuestServerSession` refreshes a session: one minute. */
 export declare const defaultGuestServerSessionRefreshAheadMs = 60000;
@@ -190,3 +246,57 @@ export declare function createGuestServerSession(coordinator: GuestSessionCoordi
   readonly refreshAheadMs?: number;
   readonly now?: () => number;
 }): GuestServerSession;
+/**
+* The HTTP routes of a guest identity service, relative to its base URL:
+* the contract between `createGuestSessionHttpBackend` and the reference
+* identity Worker (`apps/game-identity-worker`). Every route takes a JSON
+* `POST` body. `issueGuest` and `refresh` answer `200` with
+* `ServerGuestSessionCredentials`; `revoke` answers `200` with `{}`, also for
+* a token it does not know (RFC 7009 section 2.2); a refusal answers
+* `{ error: GuestIdentityHttpErrorCode }`. `bindAccount` answers `200` with
+* an `AccountBindingOutcome` (a `conflict` too), or a refusal; the reference
+* Worker binds nothing yet and answers `ACCOUNT_BINDING_UNSUPPORTED`.
+* `requestAccountDeletionConfirmation` takes `{ refreshToken }` and answers
+* `200` with an `AccountDeletionConfirmationGrant`. A refresh token any
+* route refuses for good is `GUEST_SESSION_REJECTED`.
+*/
+export declare const guestIdentityHttpRoutes: Readonly<{
+  readonly issueGuest: '/identity/v1/guest';
+  readonly refresh: '/identity/v1/refresh';
+  readonly revoke: '/identity/v1/revoke';
+  readonly bindAccount: '/identity/v1/bind-account';
+  readonly requestAccountDeletionConfirmation: '/identity/v1/account-deletion-confirmation';
+}>;
+/**
+* - `INVALID_REQUEST` (400): a body the route does not take.
+* - `GUEST_SESSION_REJECTED` (401): the refresh token is revoked, expired,
+*   replayed, or unknown; the session cannot come back.
+* - `RATE_LIMITED` (429): too many guests for this installation or address.
+* - `ACCOUNT_BINDING_UNSUPPORTED` (501): the service binds no external account.
+* - `UNAVAILABLE` (503): the service could not answer; retry later.
+*/
+export type GuestIdentityHttpErrorCode = 'INVALID_REQUEST' | 'GUEST_SESSION_REJECTED' | 'RATE_LIMITED' | 'ACCOUNT_BINDING_UNSUPPORTED' | 'UNAVAILABLE';
+/** A failed identity request. The message names the route and the code, never a token. */
+export declare class GuestSessionHttpError extends Error {
+  readonly status: number;
+  readonly code: string;
+  constructor(route: string, status: number, code: string);
+}
+/** How long one identity request may take by default: 15 seconds. */
+export declare const defaultGuestSessionHttpTimeoutMs = 15000;
+/**
+* A `GuestSessionBackend` over a guest identity service's HTTP routes
+* (`guestIdentityHttpRoutes`). A `refresh` the service refuses with
+* `GUEST_SESSION_REJECTED` throws `GuestSessionRejectedError` (the
+* coordinator's `GUEST_SESSION_REJECTED`); any other failure throws
+* `GuestSessionHttpError` or the fetch error, which the coordinator reports
+* as `GUEST_SESSION_BACKEND_FAILED`. `baseUrl` must be `https:`, except on a
+* local development host (`localhost`, `*.localhost`, `127.0.0.1`, `[::1]`,
+* `10.0.2.2`). Requests never follow a redirect, so a token is only ever sent
+* to `baseUrl`'s origin.
+*/
+export declare function createGuestSessionHttpBackend(input: {
+  readonly baseUrl: string;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly timeoutMs?: number;
+}): GuestSessionBackend;

package/dist/guest-session.js

@@ -7,6 +7,17 @@ export class GuestSessionCoordinatorError extends Error {
         this.code = code;
     }
 }
+/**
+ * A `GuestSessionBackend` throws this when the identity service refused the
+ * refresh token for good (revoked, expired, replayed, or unknown), as
+ * opposed to an outage. The coordinator reports it as `GUEST_SESSION_REJECTED`.
+ */
+export class GuestSessionRejectedError extends Error {
+    constructor() {
+        super('The identity service rejected the guest session.');
+        this.name = 'GuestSessionRejectedError';
+    }
+}
 const defaultCredentialKey = 'mpgd.guest.refresh';
 /**
  * Serializes token mutation and closes synchronously on logout. Native secure
@@ -49,6 +60,8 @@ export function createGuestSessionCoordinator(input) {
     let savedFamily;
     const listeners = new Set();
     let status = 'idle';
+    /** The identity service refused the session for good (as opposed to a failed save). */
+    let rejected = false;
     let tail = Promise.resolve();
     let startInFlight;
     let refreshInFlight;
@@ -85,7 +98,16 @@ export function createGuestSessionCoordinator(input) {
         try {
             return await operation();
         }
-        catch {
+        catch (error) {
+            if (error instanceof GuestSessionRejectedError) {
+                // The session can never come back: stop using it (current() is
+                // undefined, start() and getHeaders() fail fast) until logout.
+                if (status !== 'closed') {
+                    status = 'failed';
+                }
+                rejected = true;
+                throw new GuestSessionCoordinatorError('GUEST_SESSION_REJECTED');
+            }
             // Backend exceptions can contain URLs, proofs, or tokens. The public
             // coordinator surface intentionally exposes only a stable error code.
             throw new GuestSessionCoordinatorError('GUEST_SESSION_BACKEND_FAILED');
@@ -247,6 +269,30 @@ export function createGuestSessionCoordinator(input) {
                 return { status: result.status };
             });
         },
+        async requestAccountDeletionConfirmation() {
+            assertOpen();
+            const request = input.backend.requestAccountDeletionConfirmation?.bind(input.backend);
+            if (request === undefined) {
+                throw new GuestSessionCoordinatorError('GUEST_SESSION_UNSUPPORTED');
+            }
+            return enqueue(async () => {
+                assertOpen();
+                // Refused earlier (a refresh): say so, not merely "not ready", so the
+                // caller can tell a session that ended on the server from a failed save.
+                if (rejected) {
+                    throw new GuestSessionCoordinatorError('GUEST_SESSION_REJECTED');
+                }
+                const active = requireCurrent();
+                const grant = await fromBackend(() => request({ refreshToken: active.refreshToken }));
+                // Logged out meanwhile: no confirmation for a closed session.
+                assertOpen();
+                if (!isRecord(grant) || typeof grant.confirmation !== 'string' || grant.confirmation.trim() === ''
+                    || typeof grant.expiresAt !== 'string' || !Number.isFinite(Date.parse(grant.expiresAt))) {
+                    throw new GuestSessionCoordinatorError('GUEST_SESSION_INVALID_RESPONSE');
+                }
+                return grant.confirmation;
+            });
+        },
         current() {
             return status === 'active' && current !== undefined ? view(current) : undefined;
         },
@@ -396,6 +442,7 @@ export function createGuestServerSession(coordinator, options = {}) {
                 listener(next);
             });
         },
+        requestAccountDeletionConfirmation: () => coordinator.requestAccountDeletionConfirmation(),
         async getHeaders() {
             const active = coordinator.current();
             if (active !== undefined) {
@@ -421,3 +468,151 @@ export function createGuestServerSession(coordinator, options = {}) {
         },
     };
 }
+/**
+ * The HTTP routes of a guest identity service, relative to its base URL:
+ * the contract between `createGuestSessionHttpBackend` and the reference
+ * identity Worker (`apps/game-identity-worker`). Every route takes a JSON
+ * `POST` body. `issueGuest` and `refresh` answer `200` with
+ * `ServerGuestSessionCredentials`; `revoke` answers `200` with `{}`, also for
+ * a token it does not know (RFC 7009 section 2.2); a refusal answers
+ * `{ error: GuestIdentityHttpErrorCode }`. `bindAccount` answers `200` with
+ * an `AccountBindingOutcome` (a `conflict` too), or a refusal; the reference
+ * Worker binds nothing yet and answers `ACCOUNT_BINDING_UNSUPPORTED`.
+ * `requestAccountDeletionConfirmation` takes `{ refreshToken }` and answers
+ * `200` with an `AccountDeletionConfirmationGrant`. A refresh token any
+ * route refuses for good is `GUEST_SESSION_REJECTED`.
+ */
+export const guestIdentityHttpRoutes = Object.freeze({
+    issueGuest: '/identity/v1/guest',
+    refresh: '/identity/v1/refresh',
+    revoke: '/identity/v1/revoke',
+    bindAccount: '/identity/v1/bind-account',
+    requestAccountDeletionConfirmation: '/identity/v1/account-deletion-confirmation',
+});
+/** A failed identity request. The message names the route and the code, never a token. */
+export class GuestSessionHttpError extends Error {
+    status;
+    code;
+    constructor(route, status, code) {
+        super(`Guest identity request ${route} failed: ${status} ${code}.`);
+        this.name = 'GuestSessionHttpError';
+        this.status = status;
+        this.code = code;
+    }
+}
+/** How long one identity request may take by default: 15 seconds. */
+export const defaultGuestSessionHttpTimeoutMs = 15_000;
+/**
+ * A `GuestSessionBackend` over a guest identity service's HTTP routes
+ * (`guestIdentityHttpRoutes`). A `refresh` the service refuses with
+ * `GUEST_SESSION_REJECTED` throws `GuestSessionRejectedError` (the
+ * coordinator's `GUEST_SESSION_REJECTED`); any other failure throws
+ * `GuestSessionHttpError` or the fetch error, which the coordinator reports
+ * as `GUEST_SESSION_BACKEND_FAILED`. `baseUrl` must be `https:`, except on a
+ * local development host (`localhost`, `*.localhost`, `127.0.0.1`, `[::1]`,
+ * `10.0.2.2`). Requests never follow a redirect, so a token is only ever sent
+ * to `baseUrl`'s origin.
+ */
+export function createGuestSessionHttpBackend(input) {
+    const base = parseGuestIdentityBaseUrl(input.baseUrl);
+    const timeoutMs = input.timeoutMs ?? defaultGuestSessionHttpTimeoutMs;
+    // setTimeout fires at once past a signed 32-bit delay.
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647) {
+        throw new GuestSessionCoordinatorError('GUEST_SESSION_INVALID_INPUT');
+    }
+    const fetchImpl = input.fetch ?? ((request) => globalThis.fetch(request));
+    async function post(route, body) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await fetchImpl(new Request(new URL(route.slice(1), base), {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', accept: 'application/json' },
+                body: JSON.stringify(body),
+                redirect: 'manual',
+                signal: controller.signal,
+            }));
+            // A fetch that followed a redirect anyway (some polyfills ignore
+            // `manual`) answered from another origin: never trust that answer.
+            if (response.redirected) {
+                throw new GuestSessionHttpError(route, response.status, 'REDIRECTED');
+            }
+            let payload;
+            try {
+                payload = await response.json();
+            }
+            catch {
+                payload = undefined;
+            }
+            if (response.status !== 200) {
+                const code = isRecord(payload) && typeof payload.error === 'string' && /^[A-Z_]{1,64}$/u.test(payload.error)
+                    ? payload.error
+                    : 'UNKNOWN';
+                throw new GuestSessionHttpError(route, response.status, code);
+            }
+            // A 200 that is not a JSON object (a captive portal's page, a body cut
+            // off by the timeout) is a failure, so a revoke is never assumed done.
+            if (!isRecord(payload)) {
+                throw new GuestSessionHttpError(route, response.status, 'INVALID_BODY');
+            }
+            return payload;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    return {
+        async issueGuest({ installationId }) {
+            return await post(guestIdentityHttpRoutes.issueGuest, { installationId });
+        },
+        async refresh({ refreshToken }) {
+            return await withRejection(post(guestIdentityHttpRoutes.refresh, { refreshToken }));
+        },
+        async revoke({ refreshToken }) {
+            await post(guestIdentityHttpRoutes.revoke, { refreshToken });
+        },
+        async bindAccount({ refreshToken, externalProof, idempotencyKey }) {
+            return await withRejection(post(guestIdentityHttpRoutes.bindAccount, {
+                refreshToken,
+                externalProof,
+                idempotencyKey,
+            }));
+        },
+        async requestAccountDeletionConfirmation({ refreshToken }) {
+            return await withRejection(post(guestIdentityHttpRoutes.requestAccountDeletionConfirmation, { refreshToken }));
+        },
+    };
+}
+/** The service's `401 GUEST_SESSION_REJECTED` as `GuestSessionRejectedError`; other failures unchanged. */
+async function withRejection(request) {
+    try {
+        return await request;
+    }
+    catch (error) {
+        if (error instanceof GuestSessionHttpError && error.status === 401 && error.code === 'GUEST_SESSION_REJECTED') {
+            throw new GuestSessionRejectedError();
+        }
+        throw error;
+    }
+}
+function parseGuestIdentityBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new GuestSessionCoordinatorError('GUEST_SESSION_INVALID_INPUT');
+    }
+    const host = url.hostname.toLowerCase();
+    const local = host === 'localhost' || host.endsWith('.localhost') || host === '127.0.0.1'
+        || host === '[::1]' || host === '10.0.2.2';
+    if (!(url.protocol === 'https:' || (url.protocol === 'http:' && local))
+        || url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {
+        throw new GuestSessionCoordinatorError('GUEST_SESSION_INVALID_INPUT');
+    }
+    // Routes resolve under the base path, so `https://host/api` serves `/api/identity/v1/...`.
+    if (!url.pathname.endsWith('/')) {
+        url.pathname = `${url.pathname}/`;
+    }
+    return url;
+}