@mpgd/game-services 0.28.1 → 0.30.0

package/dist/index.d.ts

@@ -1,7 +1,9 @@
+export * from './account-deletion.js';
 export * from './admob-ssv.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';
+export * from './app-store-server-notifications.js';
 export * from './apps-in-toss-evidence-verification.js';
 export * from './apps-in-toss-partner-api.js';
 export * from './client.js';
@@ -17,6 +19,7 @@ export * from './evidence-verification.js';
 export * from './guest-session.js';
 export * from './google-play-purchase.js';
 export * from './google-play-publisher-client.js';
+export * from './google-play-store-server.js';
 export * from './microsoft-store-identity.js';
 export * from './microsoft-store-purchase.js';
 export * from './monetization-operation-store.js';
@@ -24,6 +27,7 @@ export * from './monetization-recovery.js';
 export * from './notification-delivery.js';
 export * from './platform-order.js';
 export * from './progress-link.js';
+export * from './purchase-sharing.js';
 export * from './runtime.js';
 export * from './server.js';
 export * from './types.js';

package/dist/index.js

@@ -1,7 +1,9 @@
+export * from './account-deletion.js';
 export * from './admob-ssv.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';
+export * from './app-store-server-notifications.js';
 export * from './apps-in-toss-evidence-verification.js';
 export * from './apps-in-toss-partner-api.js';
 export * from './client.js';
@@ -17,6 +19,7 @@ export * from './evidence-verification.js';
 export * from './guest-session.js';
 export * from './google-play-purchase.js';
 export * from './google-play-publisher-client.js';
+export * from './google-play-store-server.js';
 export * from './microsoft-store-identity.js';
 export * from './microsoft-store-purchase.js';
 export * from './monetization-operation-store.js';
@@ -24,6 +27,7 @@ export * from './monetization-recovery.js';
 export * from './notification-delivery.js';
 export * from './platform-order.js';
 export * from './progress-link.js';
+export * from './purchase-sharing.js';
 export * from './runtime.js';
 export * from './server.js';
 export * from './types.js';

package/dist/notifications/delivery-provider.d.ts

@@ -22,6 +22,13 @@ export interface NotificationDeviceAddress {
   readonly kind: 'fcm-token' | 'fcm-installation';
   readonly value: string;
   readonly environment?: 'production' | 'sandbox';
+  /**
+  * The installation's shell renders advertising pushes itself, with the
+  * opt-out action (an Android shell with the kit's renderer). The backend
+  * keeps it only for a target whose pushes need it, and the FCM provider
+  * then sends advertising as a data message the shell renders.
+  */
+  readonly rendersAdvertising?: boolean;
 }
 /** Who one delivery goes to: a device endpoint, or a resolved platform identity. */
 export type NotificationRemoteRecipient = {

package/dist/notifications/fcm.d.ts

@@ -14,9 +14,11 @@ import type { NotificationProviderRegistration } from './registry.js';
 * Android posts to the mapping's `channelId`, else to `mpgd-service`,
 * `mpgd-requested`, or `mpgd-advertising` by purpose. An advertising send
 * names the iOS category `mpgd-advertising`, whose opt-out action the app
-* registers; an Android FCM notification message cannot carry actions, and
-* the Capacitor shell does not render advertising natively yet. An expiry
-* becomes `android.ttl` and the `apns-expiration` header. A replay of the
+* registers. An Android FCM notification message cannot carry actions, so an
+* advertising send to an endpoint whose registration says its shell renders
+* advertising (`rendersAdvertising`) is a data message the shell renders
+* with the action (`fcmShellRenderedDataKeys`). An expiry becomes
+* `android.ttl` and the `apns-expiration` header. A replay of the
 * same send key sets `android.collapse_key` and `apns-collapse-id` so a
 * crash after HTTP 200, before the ledger write, does not show a second
 * notification.
@@ -35,6 +37,31 @@ export declare const fcmReservedDataKeys: readonly ["topic", "route"];
 /** The iOS notification category of advertising, which carries the opt-out action. */
 export declare const fcmAdvertisingCategory = "mpgd-advertising";
 /**
+* The data keys of an advertising push the Android shell renders itself
+* (RFC "Delivery providers"). An Android FCM notification message cannot
+* carry actions, so such a push has no `notification` block: the app's
+* messaging service receives it in the background too and posts it with the
+* opt-out action. `render` is `fcmShellRenderedAdvertising`; `title` and
+* `body` are the gate's rendered text, `channel` the Android channel,
+* `actionTitle` and `optOutRoute` the opt-out action's title and route (the
+* topic's declared opt-out route) when the content carries the action, and
+* `expiresAt` the expiry in epoch milliseconds, after which the
+* shell does not show it. The send's `topic` and `route` stay in their own
+* keys, as on every push. A send's routing data may not use the `mpgd.`
+* prefix.
+*/
+export declare const fcmShellRenderedDataKeys: Readonly<{
+  readonly render: 'mpgd.render';
+  readonly title: 'mpgd.title';
+  readonly body: 'mpgd.body';
+  readonly channel: 'mpgd.channel';
+  readonly actionTitle: 'mpgd.actionTitle';
+  readonly optOutRoute: 'mpgd.optOutRoute';
+  readonly expiresAt: 'mpgd.expiresAt';
+}>;
+/** The `mpgd.render` value of an advertising push the shell renders. */
+export declare const fcmShellRenderedAdvertising = "advertising";
+/**
 * `android.collapse_key` and `apns-collapse-id` are at most 64 bytes. The
 * id is the SHA-256 of the send key, which is 64 hex characters.
 */

package/dist/notifications/fcm.js

@@ -1,4 +1,4 @@
-import { referenceNotificationProviders } from '@mpgd/platform/notifications';
+import { notificationAdvertisingOptOutActionId, referenceNotificationProviders, } from '@mpgd/platform/notifications';
 import { fcmInstallationIdRefusal, } from './delivery-provider.js';
 /**
  * The FCM remote delivery provider (notifications v2 RFC, "Delivery
@@ -14,9 +14,11 @@ import { fcmInstallationIdRefusal, } from './delivery-provider.js';
  * Android posts to the mapping's `channelId`, else to `mpgd-service`,
  * `mpgd-requested`, or `mpgd-advertising` by purpose. An advertising send
  * names the iOS category `mpgd-advertising`, whose opt-out action the app
- * registers; an Android FCM notification message cannot carry actions, and
- * the Capacitor shell does not render advertising natively yet. An expiry
- * becomes `android.ttl` and the `apns-expiration` header. A replay of the
+ * registers. An Android FCM notification message cannot carry actions, so an
+ * advertising send to an endpoint whose registration says its shell renders
+ * advertising (`rendersAdvertising`) is a data message the shell renders
+ * with the action (`fcmShellRenderedDataKeys`). An expiry becomes
+ * `android.ttl` and the `apns-expiration` header. A replay of the
  * same send key sets `android.collapse_key` and `apns-collapse-id` so a
  * crash after HTTP 200, before the ledger write, does not show a second
  * notification.
@@ -34,6 +36,31 @@ export const fcmAddressKinds = Object.freeze(['fcm-token']);
 export const fcmReservedDataKeys = Object.freeze(['topic', 'route']);
 /** The iOS notification category of advertising, which carries the opt-out action. */
 export const fcmAdvertisingCategory = 'mpgd-advertising';
+/**
+ * The data keys of an advertising push the Android shell renders itself
+ * (RFC "Delivery providers"). An Android FCM notification message cannot
+ * carry actions, so such a push has no `notification` block: the app's
+ * messaging service receives it in the background too and posts it with the
+ * opt-out action. `render` is `fcmShellRenderedAdvertising`; `title` and
+ * `body` are the gate's rendered text, `channel` the Android channel,
+ * `actionTitle` and `optOutRoute` the opt-out action's title and route (the
+ * topic's declared opt-out route) when the content carries the action, and
+ * `expiresAt` the expiry in epoch milliseconds, after which the
+ * shell does not show it. The send's `topic` and `route` stay in their own
+ * keys, as on every push. A send's routing data may not use the `mpgd.`
+ * prefix.
+ */
+export const fcmShellRenderedDataKeys = Object.freeze({
+    render: 'mpgd.render',
+    title: 'mpgd.title',
+    body: 'mpgd.body',
+    channel: 'mpgd.channel',
+    actionTitle: 'mpgd.actionTitle',
+    optOutRoute: 'mpgd.optOutRoute',
+    expiresAt: 'mpgd.expiresAt',
+});
+/** The `mpgd.render` value of an advertising push the shell renders. */
+export const fcmShellRenderedAdvertising = 'advertising';
 /**
  * FCM's 4,096-byte limit, less room for what FCM and APNs add on the way
  * (the `aps` wrapper and FCM's own keys), so a message this check passes is
@@ -319,9 +346,38 @@ export function buildFcmMessage(request) {
     // instead of showing beside it. Collapse is per token, so two devices of
     // one send do not hide each other.
     const collapseId = fcmCollapseId(request.sendKey);
+    const ttl = expiresAt === undefined ? {} : { ttl: `${Math.floor((expiresAt - at) / 1000)}s` };
+    if (request.topic.purpose === 'advertising' && recipient.address.rendersAdvertising === true) {
+        // A data message without a `notification` block reaches the shell's
+        // messaging service in the background too, which renders it with the
+        // opt-out action. Normal priority, FCM's default for data and
+        // notification messages alike: FCM keeps high priority for urgent,
+        // time-sensitive messages, and advertising is not one. The shell's
+        // renderer checks the expiry again, since arrival decides.
+        const optOut = content.actions
+            ?.find((action) => action.id === notificationAdvertisingOptOutActionId);
+        const rendered = Object.create(null);
+        Object.assign(rendered, data, {
+            [fcmShellRenderedDataKeys.render]: fcmShellRenderedAdvertising,
+            [fcmShellRenderedDataKeys.title]: content.title,
+            [fcmShellRenderedDataKeys.body]: content.body,
+            [fcmShellRenderedDataKeys.channel]: channelId,
+            ...(optOut === undefined
+                ? {}
+                : {
+                    [fcmShellRenderedDataKeys.actionTitle]: optOut.title,
+                    [fcmShellRenderedDataKeys.optOutRoute]: optOut.route,
+                }),
+            ...(expiresAt === undefined ? {} : { [fcmShellRenderedDataKeys.expiresAt]: String(expiresAt) }),
+        });
+        return sizedMessage(recipient.address.value, {
+            data: { ...rendered },
+            android: { collapse_key: collapseId, ...ttl },
+        });
+    }
     const android = {
         collapse_key: collapseId,
-        ...(expiresAt === undefined ? {} : { ttl: `${Math.floor((expiresAt - at) / 1000)}s` }),
+        ...ttl,
         notification: { channel_id: channelId },
     };
     const category = request.topic.purpose === 'advertising' ? fcmAdvertisingCategory : undefined;
@@ -332,12 +388,15 @@ export function buildFcmMessage(request) {
         },
         ...(category === undefined ? {} : { payload: { aps: { category } } }),
     };
-    const payload = {
+    return sizedMessage(recipient.address.value, {
         notification,
         data: { ...data },
         android,
         apns,
-    };
+    });
+}
+/** The message for `token`, unless its payload is over the size this provider sends. */
+function sizedMessage(token, payload) {
     // Everything but the token counts toward the size FCM and APNs carry.
     const payloadBytes = new TextEncoder().encode(JSON.stringify(payload)).length;
     if (payloadBytes > maxPayloadBytes) {
@@ -347,10 +406,7 @@ export function buildFcmMessage(request) {
             code: 'INVALID_MESSAGE',
         };
     }
-    return {
-        status: 'ready',
-        message: { token: recipient.address.value, ...payload },
-    };
+    return { status: 'ready', message: { token, ...payload } };
 }
 /**
  * Maps an FCM error answer to the provider answer kinds (RFC "Delivery
@@ -518,7 +574,7 @@ function isFirebaseProjectId(id) {
         && id.length <= 100
         && new RegExp(`^(?:${label}(?:\\.${label})*:)?${label}$`, 'u').test(id);
 }
-/** FCM's reserved data keys (`from`, `message_type`, and any `google` or `gcm` prefix), `topic` and `route`, and keys a plain object cannot hold. */
+/** FCM's reserved data keys (`from`, `message_type`, and any `google` or `gcm` prefix), `topic` and `route`, the shell renderer's `mpgd.` keys, and keys a plain object cannot hold. */
 function isReservedDataKey(key) {
     const lower = key.toLowerCase();
     return key === ''
@@ -532,7 +588,10 @@ function isReservedDataKey(key) {
         || key === 'aps'
         || key === 'fcm_options'
         || lower.startsWith('google')
-        || lower.startsWith('gcm');
+        || lower.startsWith('gcm')
+        // The shell renderer's keys (`fcmShellRenderedDataKeys`) and the keys it
+        // adds to an open.
+        || lower.startsWith('mpgd.');
 }
 /** The `details` of an FCM error answer. */
 function errorDetailsOf(body) {

package/dist/notifications/service.js

@@ -1,4 +1,4 @@
-import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, fillNotificationTemplate, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
+import { assertNotificationConsentRecord, assertNotificationDeployment, assertNotificationEndpointRegistration, assertRecordNotificationNoticeInput, createNotificationNoticeIdempotencyKey, createNotificationReminderIdempotencyKey, evaluateNotificationDelivery, evaluateNotificationReminderConsent, fillNotificationTemplate, isNotificationTimestamp, isSameNotificationNotice, isValidNotificationTimeZone, latestNotificationConsent, listNotificationNotices, normalizeNotificationTimestamp, NotificationError, notificationKeyIssue, notificationNoticeCopyIssues, notificationNoticeSendFrom, notificationNoticeTopic, notificationProviderCarriesNotices, notificationReservedKeyPrefix, notificationSendFingerprint, notificationShellRenderedAdvertisingTargets, notificationTemplateDataIssue, toSeoulCalendarDate, } from '@mpgd/platform/notifications';
 import { fcmInstallationIdRefusal, notificationExpiredProviderCode, } from './delivery-provider.js';
 import { notificationHistoryRetentionDays, } from './registry.js';
 import { bestNotificationOutcome, formatNotificationInstant, isNotificationRowAbandoned, isNotificationRowDue, notificationAmbiguousReplayHours, notificationSendOutcome, } from './store.js';
@@ -179,12 +179,15 @@ export function createNotificationService(input) {
         }
     };
     // Topics.
+    /**
+     * The catalog targets from which a recipient's topic is read: the target
+     * its registration named while the provider still serves it, else every
+     * target the provider serves, in order.
+     */
+    const candidateTargetsOf = (provider, target) => target !== undefined && provider.targets.includes(target) ? [target] : provider.targets;
     /** The topic as declared for the recipient's target, else for the provider's first target that declares it. */
     const topicFor = (provider, target, topicId, origin) => {
-        const targets = target !== undefined && provider.targets.includes(target)
-            ? [target]
-            : provider.targets;
-        for (const candidate of targets) {
+        for (const candidate of candidateTargetsOf(provider, target)) {
             const topic = catalog.topicsFor(candidate).find((declared) => declared.id === topicId);
             if (topic !== undefined) {
                 // A notice says only its variant of notices.copy.
@@ -206,6 +209,24 @@ export function createNotificationService(input) {
         : [];
     const noticeListed = async (player, notice, at) => (await noticesOf(player, at)).some((listed) => isSameNotificationNotice(listed, notice));
     // Recipients (gate step 2).
+    /**
+     * Whether an endpoint's topic may be read from a target whose pushes need
+     * the shell to render advertising (Android), as `topicFor` picks it: the
+     * named target while the provider serves it, else any target it serves.
+     */
+    const mayNeedShellRendering = (provider, target) => candidateTargetsOf(provider, target)
+        .some((candidate) => notificationShellRenderedAdvertisingTargets.includes(candidate));
+    /**
+     * Whether a device endpoint shows the actions a push carries: where its
+     * topic may come from a target that needs the shell to render advertising
+     * (Android), only when its latest registration said the shell does;
+     * elsewhere (iOS's category) always. Gate step 1 refuses advertising
+     * under `kr` to an endpoint without `true`.
+     */
+    const endpointActionsOf = (provider, endpoint) => ({
+        endpointShowsActions: !mayNeedShellRendering(provider, endpoint.target)
+            || endpoint.address.rendersAdvertising === true,
+    });
     const usable = (endpoint, at) => endpoint.status === 'valid'
         && at - Date.parse(endpoint.lastRegisteredAt) < endpointStaleMs
         && (endpoint.sessionExpiresAt === undefined || Date.parse(endpoint.sessionExpiresAt) > at);
@@ -409,6 +430,7 @@ export function createNotificationService(input) {
                     consent,
                     ...(serverPermission === undefined ? {} : { serverPermission }),
                     ...(recipient.endpoint === undefined ? {} : { endpointPermission: recipient.endpoint.permission }),
+                    ...(recipient.endpoint === undefined ? {} : endpointActionsOf(recipient.provider, recipient.endpoint)),
                     history,
                     at: formatNotificationInstant(at),
                     ...(recipient.timeZone === undefined ? {} : { timeZone: recipient.timeZone }),
@@ -1980,6 +2002,11 @@ export function createNotificationService(input) {
             if (request.target !== undefined && !provider.targets.includes(request.target)) {
                 throw invalidInput(`Provider ${provider.entry.provider} does not serve target ${String(request.target)}.`);
             }
+            // Only a target whose pushes need the shell to render advertising keeps
+            // the claim, so the FCM provider never sends another device (iOS) a
+            // data message it would not show.
+            const rendersAdvertising = address.rendersAdvertising === true
+                && mayNeedShellRendering(provider, request.target);
             await store.putEndpoint({
                 provider: provider.entry.provider,
                 installationId: current.installationId,
@@ -1988,6 +2015,7 @@ export function createNotificationService(input) {
                     kind: address.kind,
                     value: address.value,
                     ...(address.environment === undefined ? {} : { environment: address.environment }),
+                    ...(rendersAdvertising ? { rendersAdvertising: true } : {}),
                 },
                 permission: address.permission,
                 ...(registration.locale === undefined ? {} : { locale: registration.locale }),

package/dist/notifications/store-conformance.js

@@ -65,9 +65,15 @@ export async function runNotificationStoreConformance(createStore) {
         timeZone: 'Asia/Seoul',
         target: 'android',
         sessionExpiresAt: at(86_400_000),
-        address: { kind: 'fcm-token', value: 'tok-1', environment: 'production' },
+        address: {
+            kind: 'fcm-token',
+            value: 'tok-1',
+            environment: 'production',
+            rendersAdvertising: true,
+        },
     }));
     equal(stored.status, 'valid', 'endpoints: a new endpoint is valid');
+    deepEqual((await store.getEndpoint({ provider: 'fcm', installationId: 'i-1' }))?.address, { kind: 'fcm-token', value: 'tok-1', environment: 'production', rendersAdvertising: true }, 'endpoints: the address round-trips, with the shell-rendered advertising claim');
     deepEqual(await store.getEndpoint({ provider: 'fcm', installationId: 'i-1' }), stored, 'endpoints: read back as written');
     // The same address on another installation moves there.
     await store.putEndpoint(endpoint('i-2', 'tok-1'));

package/dist/notifications/store.d.ts

@@ -1,3 +1,4 @@
+import { type PlayerDataErasureInput, type PlayerDataErasureResult } from '../account-deletion.js';
 import { type NotificationConsentRecord, type NotificationDeferralReason, type NotificationDeliveryOutcome, type NotificationNoticeIdentity, type NotificationNoticeVariant, type NotificationPermissionState, type NotificationTemplateData } from '@mpgd/platform/notifications';
 import type { NotificationDeviceAddress } from './delivery-provider.js';
 /**
@@ -417,6 +418,14 @@ export interface InMemoryNotificationStoreState {
 export interface InMemoryNotificationStore extends NotificationStore {
   /** A deep copy of every row, read synchronously. */
   inspect(): InMemoryNotificationStoreState;
+  /**
+  * Account deletion (a `PlayerDataEraser`): removes every row of the player
+  * (consent records, endpoints, platform registrations, notices given,
+  * sends, delivery history, and schedule entries). Nothing is kept: no
+  * notification data is under a legal retention period. The Worker's D1
+  * deployment erases these tables in its own batch.
+  */
+  erasePlayerData(input: PlayerDataErasureInput): Promise<PlayerDataErasureResult>;
 }
 /**
 * A process-local store for tests, conformance runs, and local development.

package/dist/notifications/store.js

@@ -1,3 +1,4 @@
+import { assertPlayerDataErasureInput, } from '../account-deletion.js';
 import { normalizeNotificationTimestamp, } from '@mpgd/platform/notifications';
 export function notificationRowOutcome(row) {
     switch (row.state.status) {
@@ -163,6 +164,46 @@ export function createInMemoryNotificationStore() {
         notice.dueBy,
     ]);
     return {
+        async erasePlayerData(input) {
+            const player = assertPlayerDataErasureInput(input).playerId;
+            let removed = 0;
+            const keep = (rows, belongs) => {
+                let kept = 0;
+                for (const row of rows) {
+                    if (belongs(row)) {
+                        removed += 1;
+                    }
+                    else {
+                        rows[kept] = row;
+                        kept += 1;
+                    }
+                }
+                rows.length = kept;
+            };
+            keep(consent, (row) => row.player === player);
+            keep(endpoints, (endpoint) => endpoint.player === player);
+            keep(noticesGiven, (notice) => notice.player === player);
+            keep(history, (entry) => entry.player === player);
+            for (const [key, registration] of [...platformRegistrations]) {
+                if (registration.player === player) {
+                    platformRegistrations.delete(key);
+                    removed += 1;
+                }
+            }
+            for (const [key, held] of [...sends]) {
+                if (held.send.request.player === player) {
+                    sends.delete(key);
+                    removed += 1;
+                }
+            }
+            for (const [key, held] of [...schedule]) {
+                if (held.entry.player === player) {
+                    schedule.delete(key);
+                    removed += 1;
+                }
+            }
+            return { deleted: removed, retained: 0 };
+        },
         inspect() {
             return copy({
                 consent: consent.map((row) => ({ ...row.record, player: row.player })),

package/dist/operation-results.d.ts

@@ -7,6 +7,13 @@ export interface VerifyPurchaseResponse {
   readonly alreadyProcessed: boolean;
   readonly reason?: string;
   readonly finalization?: PurchaseGrantFinalization;
+  /**
+  * This player's grant comes from a verified restore of a purchase the
+  * store binds to another player (a reinstall or another device): the game
+  * can say the purchase was restored to this device. Present only on a
+  * verified response.
+  */
+  readonly restoredAcrossPlayers?: true;
 }
 export type PurchaseGrantFinalizationAction = 'acknowledge' | 'consume' | 'finish' | 'complete';
 export interface PurchaseGrantFinalization {

package/dist/purchase-sharing.d.ts

@@ -0,0 +1,41 @@
+/**
+* Restore sharing (RFC "Restore sharing"): a guest lives in the device's
+* secure store, so a reinstall, a new device, or a second device on the same
+* store account is a new guest while the store keeps returning the
+* purchase's non-consumable with the buyer's account binding (Google Play
+* `obfuscatedAccountId`, StoreKit `appAccountToken`). Under the `share`
+* policy the backend accepts the store's own verification of a restored
+* non-consumable as the proof of ownership and grants the restoring player
+* its own entitlement, linked to the purchase. Earlier holders keep theirs,
+* up to `maxHolders` players per purchase; a refund or revocation of the
+* purchase revokes every holder. Consumables and subscriptions are never
+* shared.
+*/
+/** How the backend answers a restored non-consumable the store binds to another player. */
+export interface PurchaseRestoreSharingPolicy {
+  /**
+  * `share` grants the restoring player its own entitlement; `refuse`
+  * answers the store's binding mismatch (`GOOGLE_PLAY_ACCOUNT_MISMATCH`,
+  * `APP_STORE_ACCOUNT_TOKEN_MISMATCH`) as before.
+  */
+  readonly mode: 'share' | 'refuse';
+  /**
+  * At most this many players hold one purchase at the same time (the first
+  * grant included; a deleted player's retained record and reversed grants
+  * do not count). A restore past it answers `pending` with
+  * `PURCHASE_HOLDER_LIMIT_REACHED`; no holder is evicted. Defaults to 5.
+  */
+  readonly maxHolders?: number;
+}
+export declare const defaultPurchaseRestoreMaxHolders = 5;
+/** The policy `createGameServicesBackend` uses when none is passed: restores across players are refused. */
+export declare const refusePurchaseRestoreSharing: PurchaseRestoreSharingPolicy;
+/** The reference stack's policy: share, up to the default number of holders. */
+export declare const sharePurchaseRestores: PurchaseRestoreSharingPolicy;
+/** The largest `maxHolders` a policy accepts; a purchase's holders are read one by one. */
+export declare const maxPurchaseRestoreHolders = 100;
+export interface ResolvedPurchaseRestoreSharingPolicy {
+  readonly mode: 'share' | 'refuse';
+  readonly maxHolders: number;
+}
+export declare function resolvePurchaseRestoreSharingPolicy(input: PurchaseRestoreSharingPolicy | undefined): ResolvedPurchaseRestoreSharingPolicy;

package/dist/purchase-sharing.js

@@ -0,0 +1,37 @@
+/**
+ * Restore sharing (RFC "Restore sharing"): a guest lives in the device's
+ * secure store, so a reinstall, a new device, or a second device on the same
+ * store account is a new guest while the store keeps returning the
+ * purchase's non-consumable with the buyer's account binding (Google Play
+ * `obfuscatedAccountId`, StoreKit `appAccountToken`). Under the `share`
+ * policy the backend accepts the store's own verification of a restored
+ * non-consumable as the proof of ownership and grants the restoring player
+ * its own entitlement, linked to the purchase. Earlier holders keep theirs,
+ * up to `maxHolders` players per purchase; a refund or revocation of the
+ * purchase revokes every holder. Consumables and subscriptions are never
+ * shared.
+ */
+export const defaultPurchaseRestoreMaxHolders = 5;
+/** The policy `createGameServicesBackend` uses when none is passed: restores across players are refused. */
+export const refusePurchaseRestoreSharing = Object.freeze({
+    mode: 'refuse',
+});
+/** The reference stack's policy: share, up to the default number of holders. */
+export const sharePurchaseRestores = Object.freeze({
+    mode: 'share',
+});
+/** The largest `maxHolders` a policy accepts; a purchase's holders are read one by one. */
+export const maxPurchaseRestoreHolders = 100;
+export function resolvePurchaseRestoreSharingPolicy(input) {
+    const policy = input ?? refusePurchaseRestoreSharing;
+    if (policy.mode !== 'share' && policy.mode !== 'refuse') {
+        throw new Error('restoreSharing.mode must be share or refuse.');
+    }
+    const maxHolders = policy.maxHolders ?? defaultPurchaseRestoreMaxHolders;
+    if (!Number.isSafeInteger(maxHolders)
+        || maxHolders < 1
+        || maxHolders > maxPurchaseRestoreHolders) {
+        throw new Error(`restoreSharing.maxHolders must be an integer from 1 to ${String(maxPurchaseRestoreHolders)}.`);
+    }
+    return { mode: policy.mode, maxHolders };
+}

package/dist/runtime.d.ts

@@ -1,3 +1,4 @@
+import { type AccountDeletionClient } from './account-deletion.js';
 import type { AnalyticsSink } from '@mpgd/analytics';
 import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
@@ -15,6 +16,11 @@ export interface GameServicesRuntime {
   readonly target?: GameServicesLedgerTarget;
   readonly client?: GameServicesClient;
   readonly monetizationRecovery?: RecoverableMonetizationClient;
+  /**
+  * The signed-in player's account deletion (`POST /game-services/account/delete`)
+  * with the runtime's headers; present with an authoritative `baseUrl`.
+  */
+  readonly accountDeletion?: AccountDeletionClient;
 }
 interface CreateGameServicesRuntimeCommonInput {
   readonly gateway: PlatformGateway;

package/dist/runtime.js

@@ -1,3 +1,4 @@
+import { createAccountDeletionClient } from './account-deletion.js';
 import { createGameServicesClient, createGameServicesFetchBackendTransport, createGameServicesHttpBackendApi, createGameServicesOrpcBackendApi, createGameServicesOrpcClient, resolveGameServicesRequestHeaders, } from './client.js';
 import { createRecoverableMonetizationClient, } from './monetization-recovery.js';
 export function createGameServicesRuntime(input) {
@@ -93,6 +94,18 @@ export function createGameServicesRuntime(input) {
         target,
         client: routedClient,
         ...(monetizationRecovery === undefined ? {} : { monetizationRecovery }),
+        ...(baseUrl === undefined
+            ? {}
+            : {
+                accountDeletion: createAccountDeletionClient({
+                    // The deletion route is plain HTTP next to the oRPC handler: an
+                    // oRPC URL names the handler's `/rpc` prefix, which the route
+                    // does not sit under.
+                    baseUrl: input.transport === 'orpc' ? baseUrl.replace(/\/rpc\/?$/u, '') : baseUrl,
+                    ...(input.headers === undefined ? {} : { headers: input.headers }),
+                    ...(input.getHeaders === undefined ? {} : { getHeaders: input.getHeaders }),
+                }),
+            }),
     };
 }
 function withRuntimeHeaders(transport, input) {