@mpgd/game-services 0.30.4 → 0.31.0

package/dist/runtime.d.ts

@@ -4,7 +4,7 @@ import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
 import type { GameServicesLedgerTarget } from './types.js';
 import type { ClientRewardEvidenceRegistry } from './client-reward-evidence.js';
-import type { CommerceReconcilerProduct } from './commerce-reconciler.js';
+import type { CommerceReconcilerProduct, CreateCommerceReconcilerInput } from './commerce-reconciler.js';
 import { type MonetizationOperationStore, type RecoverableMonetizationClient } from './monetization-recovery.js';
 export type GameServicesAuthorityMode = 'production' | 'non-production';
 export type GameServicesRuntimeMode = 'disabled' | 'local' | 'http' | 'orpc';
@@ -21,7 +21,30 @@ export interface GameServicesRuntime {
   * with the runtime's headers; present with an authoritative `baseUrl`.
   */
   readonly accountDeletion?: AccountDeletionClient;
+  /**
+  * Closes the runtime for good, then waits until a purchase whose store
+  * sheet is open has journaled its answer, a startup or resume recovery
+  * pass (`monetizationRecovery.reconcile()`) has finished, and the commerce
+  * reconciler has stopped (each wait bounded by `gameServicesDisposeWaitMs`); repeated
+  * calls share that wait. Afterwards nothing it holds talks to the backend
+  * or the store for its player: a purchase answers `failed` with the
+  * retryable diagnostic `gameServicesRuntimeDisposedCode` before any store
+  * UI, a rewarded-ad claim answers `unavailable` before any ad, recovery
+  * runs nothing, Restore Purchases and leaderboard submissions reject with
+  * `GameServicesRuntimeClosedError`, and every backend request (account
+  * deletion included) is refused before its headers are resolved. The
+  * journal keeps every record; a runtime created later for the same player
+  * resumes them. A disabled runtime has nothing to close.
+  */
+  dispose(): Promise<void>;
 }
+/**
+* How long `dispose()` waits for a purchase whose store sheet is open to
+* journal its answer, and then for the reconciler to stop: 3 minutes, past
+* Google Play's own wait for a purchase result.
+*/
+export declare const gameServicesDisposeWaitMs: number;
+export { gameServicesPlayerChangedCode, gameServicesRuntimeDisposedCode, GameServicesRuntimeClosedError, gameServicesSessionRequiredCode, type GameServicesRuntimeClosedCode, } from './request-headers.js';
 interface CreateGameServicesRuntimeCommonInput {
   readonly gateway: PlatformGateway;
   readonly playerId: string;
@@ -47,6 +70,52 @@ interface CreateGameServicesRuntimeCommonInput {
   * product catalog's `platformProductIds` for the gateway target.
   */
   readonly commerceProducts?: readonly CommerceReconcilerProduct[];
+  /**
+  * The player the session's credentials belong to right now, read
+  * synchronously: pass it whenever `getHeaders` (or the store account
+  * binding) follows a session that can change player within the run. It is
+  * checked before every backend request and again once its headers are
+  * resolved (no request leaves with another player's credentials), and by
+  * the commerce reconciler before it journals, verifies, restores, or
+  * finishes anything and right before a store UI opens. The store
+  * provider resolves its account binding after that last check, so the
+  * binding resolver must follow this player too (bind nothing for anyone
+  * else) for a purchase never to be journaled here and bound to another
+  * account; a binding refused while the session changed stays retryable.
+  * Another
+  * player closes the runtime for good, as `dispose()` does, with
+  * `gameServicesPlayerChangedCode`; no player refuses with
+  * `gameServicesSessionRequiredCode` and leaves the runtime open. Refusals
+  * are retryable and end no record, so a purchase of this player is never
+  * verified with another player's session (which a backend answers with a
+  * permanent account-mismatch rejection) and is resumed by a runtime for
+  * this player later. A custom `httpTransport` must send only the headers
+  * the runtime resolved for each request.
+  */
+  readonly sessionPlayerId?: () => string | undefined;
+  /**
+  * This player's store account binding, derived from `playerId` the way
+  * the store provider binds the player's new purchases (Google Play's
+  * obfuscated account id, StoreKit's app account token). With it the
+  * commerce reconciler leaves a store purchase bound to another account
+  * alone instead of journaling and verifying it for this player (a backend
+  * rejects that for good as an account mismatch): after a restart as
+  * another player, Google Play still lists the previous player's
+  * unacknowledged purchases. The player's Restore Purchases still takes a
+  * durable bound to another account (restore sharing). Derive it from
+  * `playerId`, not from the live session. Pass it only for a store whose
+  * purchases carry this kind of binding: answering `undefined` leaves every
+  * bound purchase alone, which is meant only while the binding is briefly
+  * unreadable. Omitted, nothing is compared (for example Microsoft Store,
+  * whose purchases carry their own claimed scope).
+  */
+  readonly commerceAccountBinding?: CreateCommerceReconcilerInput['accountBinding'];
+  /**
+  * The reconciler's `staleLaunchedAfterMs`: how long a `launched` purchase
+  * with no store purchase keeps serializing its product before it ends
+  * `failed`. Defaults to 24 hours; `Infinity` never expires it.
+  */
+  readonly commerceStaleLaunchedAfterMs?: number;
 }
 export type CreateGameServicesRuntimeInput = CreateGameServicesRuntimeCommonInput & ({
   readonly transport?: 'http';
@@ -67,4 +136,3 @@ export declare function resolveGameServicesTransport(transport: string | undefin
 * notifications client's starter wiring uses it too.
 */
 export declare function isPublicGameServicesUrl(baseUrl: string): boolean;
-export {};

package/dist/runtime.js

@@ -1,13 +1,24 @@
-import { createAccountDeletionClient } from './account-deletion.js';
-import { createGameServicesClient, createGameServicesFetchBackendTransport, createGameServicesHttpBackendApi, createGameServicesOrpcBackendApi, createGameServicesOrpcClient, resolveGameServicesRequestHeaders, } from './client.js';
+import { AccountDeletionError, createAccountDeletionClient, } from './account-deletion.js';
+import { CommerceError } from '@mpgd/platform/commerce';
+import { assertCommerceStaleLaunchedAfterMs, createGameServicesClient, createGameServicesFetchBackendTransport, createGameServicesHttpBackendApi, createGameServicesOrpcBackendApi, createGameServicesOrpcClient, resolveGameServicesRequestHeaders, } from './client.js';
+import { gameServicesPlayerChangedCode, GameServicesRuntimeClosedError, gameServicesRuntimeDisposedCode, gameServicesSessionRequiredCode, } from './request-headers.js';
 import { createRecoverableMonetizationClient, } from './monetization-recovery.js';
+/**
+ * How long `dispose()` waits for a purchase whose store sheet is open to
+ * journal its answer, and then for the reconciler to stop: 3 minutes, past
+ * Google Play's own wait for a purchase result.
+ */
+export const gameServicesDisposeWaitMs = 3 * 60 * 1000;
+export { gameServicesPlayerChangedCode, gameServicesRuntimeDisposedCode, GameServicesRuntimeClosedError, gameServicesSessionRequiredCode, } from './request-headers.js';
 export function createGameServicesRuntime(input) {
     assertAuthorityMode(input.authorityMode);
     assertTransport(input.transport);
+    assertCommerceStaleLaunchedAfterMs(input.commerceStaleLaunchedAfterMs);
     if (input.transport === 'orpc' && input.httpTransport !== undefined) {
         throw new Error('Game Services httpTransport cannot be used with oRPC.');
     }
     const target = resolveGameServicesLedgerTarget(input.target ?? input.gateway.target);
+    const gate = createRuntimeGate(input.playerId, input.sessionPlayerId);
     if (target === null) {
         return disabledRuntime('unsupported_target');
     }
@@ -30,10 +41,10 @@ export function createGameServicesRuntime(input) {
             ? createGameServicesOrpcBackendApi(createGameServicesOrpcClient({
                 url: baseUrl,
                 ...(input.headers === undefined ? {} : { headers: input.headers }),
-                ...(input.getHeaders === undefined ? {} : { getHeaders: input.getHeaders }),
+                getHeaders: guardHeaders(input.getHeaders, gate),
             }))
             : createGameServicesHttpBackendApi({
-                transport: withRuntimeHeaders(input.httpTransport ?? createGameServicesFetchBackendTransport({ baseUrl }), input),
+                transport: withRuntimeHeaders(input.httpTransport ?? createGameServicesFetchBackendTransport({ baseUrl }), input, gate),
             });
     }
     else {
@@ -49,8 +60,11 @@ export function createGameServicesRuntime(input) {
         mode = 'local';
         backend = input.localBackend;
     }
+    // Every backend call is refused before it starts once the runtime is closed.
+    backend = guardBackend(backend, gate);
     const clientInput = {
-        gateway: input.gateway,
+        // A rewarded ad queued before the runtime closed is not shown after it.
+        gateway: guardRewardedAds(input.gateway, gate),
         backend,
         playerId: input.playerId,
         target,
@@ -64,6 +78,23 @@ export function createGameServicesRuntime(input) {
         ...(input.now === undefined ? {} : { now: input.now }),
         ...(input.rewardEvidenceRegistry === undefined ? {} : { rewardEvidenceRegistry: input.rewardEvidenceRegistry }),
         ...(input.commerceProducts === undefined ? {} : { commerceProducts: input.commerceProducts }),
+        ...(input.commerceAccountBinding === undefined ? {} : { commerceAccountBinding: input.commerceAccountBinding }),
+        commerceSessionCheck: () => {
+            const refusal = gate.check();
+            return refusal === undefined
+                ? undefined
+                : new CommerceError('ACCOUNT_BINDING_REQUIRED', {
+                    retryable: true,
+                    storeCode: refusal.code,
+                    message: refusal.message,
+                });
+        },
+        // Closed for good, the reconciler starts nothing: a recovery pass that
+        // reaches `start()` after `dispose()` stopped it subscribes nothing.
+        commerceClosed: () => gate.closed,
+        ...(input.commerceStaleLaunchedAfterMs === undefined
+            ? {}
+            : { commerceStaleLaunchedAfterMs: input.commerceStaleLaunchedAfterMs }),
     };
     const monetizationRecovery = input.operationStore === undefined
         ? undefined
@@ -88,34 +119,331 @@ export function createGameServicesRuntime(input) {
                 : { commerceReconciler: monetizationRecovery.commerceReconciler }),
         };
     }
+    const reconciler = routedClient.commerceReconciler;
+    /**
+     * Purchases, rewarded-ad claims, and recovery passes running now:
+     * `dispose()` lets them journal first.
+     */
+    const purchases = new Set();
+    const track = (running) => {
+        purchases.add(running);
+        void running.finally(() => purchases.delete(running)).catch(() => undefined);
+        return running;
+    };
+    const exposedReconciler = reconciler === undefined
+        ? undefined
+        : guardReconciler(reconciler, track);
+    gate.onClose(async () => {
+        // A purchase whose store sheet is open journals the store answer first,
+        // an open rewarded ad its platform result (both stay this player's to
+        // recover), and a recovery pass finishes its start, then the reconciler
+        // stops.
+        await settleWithin(Promise.allSettled([...purchases]), gameServicesDisposeWaitMs);
+        await settleWithin(reconciler?.stop() ?? Promise.resolve(), gameServicesDisposeWaitMs);
+    });
     return {
         mode,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         target,
-        client: routedClient,
-        ...(monetizationRecovery === undefined ? {} : { monetizationRecovery }),
+        client: guardClient(routedClient, gate, track, exposedReconciler),
+        ...(monetizationRecovery === undefined
+            ? {}
+            : { monetizationRecovery: guardRecovery(monetizationRecovery, gate, exposedReconciler, track) }),
         ...(baseUrl === undefined
             ? {}
             : {
-                accountDeletion: createAccountDeletionClient({
+                accountDeletion: guardAccountDeletion(createAccountDeletionClient({
                     // The deletion route is plain HTTP next to the oRPC handler: an
                     // oRPC URL names the handler's `/rpc` prefix, which the route
                     // does not sit under.
                     baseUrl: input.transport === 'orpc' ? baseUrl.replace(/\/rpc\/?$/u, '') : baseUrl,
                     ...(input.headers === undefined ? {} : { headers: input.headers }),
-                    ...(input.getHeaders === undefined ? {} : { getHeaders: input.getHeaders }),
+                    getHeaders: guardHeaders(input.getHeaders, gate),
+                }), gate),
+            }),
+        dispose: () => gate.close(gameServicesRuntimeDisposedCode),
+    };
+}
+function createRuntimeGate(playerId, sessionPlayerId) {
+    let closed;
+    let closing;
+    const teardowns = [];
+    const gate = {
+        check() {
+            if (closed !== undefined) {
+                return closed;
+            }
+            if (sessionPlayerId === undefined) {
+                return undefined;
+            }
+            let current;
+            try {
+                current = sessionPlayerId()?.trim();
+            }
+            catch {
+                current = undefined;
+            }
+            if (current === undefined || current === '') {
+                return new GameServicesRuntimeClosedError(gameServicesSessionRequiredCode);
+            }
+            if (current !== playerId.trim()) {
+                void gate.close(gameServicesPlayerChangedCode);
+                return closed;
+            }
+            return undefined;
+        },
+        get closed() {
+            return closed !== undefined;
+        },
+        assert() {
+            const refusal = gate.check();
+            if (refusal !== undefined) {
+                throw refusal;
+            }
+        },
+        close(code) {
+            closed ??= new GameServicesRuntimeClosedError(code);
+            closing ??= (async () => {
+                for (const teardown of teardowns) {
+                    try {
+                        await teardown();
+                    }
+                    catch {
+                        // Closed regardless: every operation is refused from now on.
+                    }
+                }
+            })();
+            return closing;
+        },
+        onClose(teardown) {
+            teardowns.push(teardown);
+        },
+    };
+    return gate;
+}
+/**
+ * Account deletion refused before anything resolves or is sent: signed out
+ * answers `UNAUTHORIZED` (no session on this device), a closed runtime the
+ * retryable `ACCOUNT_DELETION_UNREACHABLE`. Static headers never stand in
+ * for a session the runtime refuses.
+ */
+function guardAccountDeletion(deletion, gate) {
+    return {
+        ...deletion,
+        async deleteAccount(request) {
+            const refusal = gate.check();
+            if (refusal !== undefined) {
+                throw new AccountDeletionError(refusal.code === gameServicesSessionRequiredCode
+                    ? 'UNAUTHORIZED'
+                    : 'ACCOUNT_DELETION_UNREACHABLE', { requestSent: false, cause: refusal });
+            }
+            return deletion.deleteAccount(request);
+        },
+    };
+}
+function guardHeaders(getHeaders, gate) {
+    return async () => {
+        gate.assert();
+        const headers = (await getHeaders?.()) ?? {};
+        // A session that changed player while its headers were resolved: they
+        // may be the new player's, so they are never sent for this one.
+        gate.assert();
+        return headers;
+    };
+}
+function guardBackend(backend, gate) {
+    const { purchases, adRewards, leaderboard } = backend;
+    const ledgerStatus = purchases.getPurchaseLedgerStatus;
+    const capabilities = purchases.getCommerceCapabilities;
+    return {
+        ...(backend.version === undefined ? {} : { version: backend.version }),
+        purchases: {
+            async verifyPurchase(request) {
+                gate.assert();
+                return purchases.verifyPurchase(request);
+            },
+            ...(ledgerStatus === undefined
+                ? {}
+                : {
+                    async getPurchaseLedgerStatus(request) {
+                        gate.assert();
+                        return ledgerStatus.call(purchases, request);
+                    },
+                }),
+            ...(capabilities === undefined
+                ? {}
+                : {
+                    async getCommerceCapabilities() {
+                        gate.assert();
+                        return capabilities.call(purchases);
+                    },
                 }),
+        },
+        adRewards: {
+            async claimAdReward(request) {
+                gate.assert();
+                return adRewards.claimAdReward(request);
+            },
+        },
+        leaderboard: {
+            async recordScore(request) {
+                gate.assert();
+                return leaderboard.recordScore(request);
+            },
+        },
+    };
+}
+/** Resolves when `work` settles or after `ms`, whichever is first; never rejects. */
+async function settleWithin(work, ms) {
+    let timer;
+    try {
+        await Promise.race([
+            work.then(() => undefined, () => undefined),
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, ms);
             }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The gateway with a rewarded-ad dispatch that throws the refusal once the
+ * runtime refuses, so no ad opens. It is not an ad outcome: a journaled
+ * operation stays unstarted (not ended), and `claimRewardedAd` answers
+ * `unavailable`.
+ */
+function guardRewardedAds(gateway, gate) {
+    const ads = gateway.ads;
+    return {
+        ...gateway,
+        ads: {
+            ...ads,
+            async showRewarded(request) {
+                gate.assert();
+                return ads.showRewarded(request);
+            },
+        },
+    };
+}
+/** A reward claim through an open runtime; a dispatch the runtime refused answers `unavailable`. */
+async function guardedReward(gate, track, run) {
+    if (gate.check() !== undefined) {
+        return refusedReward();
+    }
+    try {
+        return await track(run());
+    }
+    catch (error) {
+        if (error instanceof GameServicesRuntimeClosedError) {
+            return refusedReward();
+        }
+        throw error;
+    }
+}
+function refusedPurchase(refusal) {
+    return {
+        status: 'failed',
+        purchase: {
+            status: 'failed',
+            entitlementIds: [],
+            diagnostic: { code: refusal.code, retryable: true },
+        },
+    };
+}
+function refusedReward() {
+    return { status: 'unavailable', reward: { status: 'unavailable', rewardGranted: false } };
+}
+/**
+ * A purchase through an open runtime. A refusal the reconciler gave because
+ * the runtime closed meanwhile answers the runtime's diagnostic, as a
+ * refusal at the entry does.
+ */
+async function guardedPurchase(gate, track, run) {
+    const refusal = gate.check();
+    if (refusal !== undefined) {
+        return refusedPurchase(refusal);
+    }
+    const result = await track(run());
+    const late = result.status === 'failed'
+        && result.purchase.diagnostic?.code === 'ACCOUNT_BINDING_REQUIRED'
+        ? gate.check()
+        : undefined;
+    return late === undefined ? result : refusedPurchase(late);
+}
+/**
+ * The reconciler a runtime exposes. Once the runtime closed for good its
+ * `start()` subscribes nothing (the reconciler's `closed`); while only signed
+ * out it starts as usual and its work waits for the session (its
+ * `sessionCheck`). Its purchases are tracked like the client's, so
+ * `dispose()` waits for an open store sheet's answer.
+ */
+function guardReconciler(reconciler, track) {
+    // The reconciler's getters and methods are closures: the prototype chain serves them.
+    return Object.create(reconciler, {
+        requestPurchase: {
+            value: (request) => track(reconciler.requestPurchase(request)),
+        },
+    });
+}
+/** The client of an open runtime; refusals answer before any store UI or ad opens. */
+function guardClient(client, gate, track, reconciler) {
+    return {
+        ...client,
+        ...(reconciler === undefined ? {} : { commerceReconciler: reconciler }),
+        purchase: (purchase, options) => guardedPurchase(gate, track, () => client.purchase(purchase, options)),
+        claimRewardedAd: (reward, options) => guardedReward(gate, track, () => client.claimRewardedAd(reward, options)),
+        async submitLeaderboardScore(score) {
+            gate.assert();
+            return client.submitLeaderboardScore(score);
+        },
+    };
+}
+function guardRecovery(recovery, gate, reconciler, track) {
+    return {
+        ...recovery,
+        ...(reconciler === undefined ? {} : { commerceReconciler: reconciler }),
+        purchase: (purchase, options) => guardedPurchase(gate, track, () => recovery.purchase(purchase, options)),
+        claimRewardedAd: (reward, options) => guardedReward(gate, track, () => recovery.claimRewardedAd(reward, options)),
+        // A late ad callback is journaled; its claim is refused until a runtime
+        // for the player resends it, so it stays pending, never ended.
+        recoverRewardResult: (idempotencyKey, platform) => recovery.recoverRewardResult(idempotencyKey, platform),
+        async reconcile() {
+            // Startup and resume recovery wait for a runtime the session permits.
+            // `dispose()` waits for a pass under way, so the reconciler it starts
+            // is stopped after it, not before.
+            return gate.check() === undefined ? track(recovery.reconcile()) : [];
+        },
+        async restorePurchases() {
+            gate.assert();
+            let restored;
+            try {
+                restored = await recovery.restorePurchases();
+            }
+            catch (error) {
+                // Closed during the restore: the runtime's refusal says why.
+                gate.assert();
+                throw error;
+            }
+            // Closed during the restore: its passes stopped early for this player.
+            gate.assert();
+            return restored;
+        },
     };
 }
-function withRuntimeHeaders(transport, input) {
+function withRuntimeHeaders(transport, input, gate) {
     return {
         async send(request) {
+            gate.assert();
             const headers = await resolveGameServicesRequestHeaders({
                 headers: input.headers,
                 getHeaders: input.getHeaders,
                 requestHeaders: request.headers,
             });
+            // A session that changed player while its headers were resolved: they
+            // may be the new player's, so they are never sent for this one.
+            gate.assert();
             return transport.send({
                 ...request,
                 headers,
@@ -156,6 +484,8 @@ function disabledRuntime(reason, target) {
         mode: 'disabled',
         reason,
         ...(target === undefined ? {} : { target }),
+        // Nothing to close: a disabled runtime holds no client.
+        dispose: async () => undefined,
     };
 }
 function normalizeBaseUrl(baseUrl) {

package/dist/server.d.ts

@@ -152,6 +152,15 @@ export interface CreateGameServicesRouterOptions {
 }
 export interface CreateGameServicesRpcFetchHandlerOptions extends CreateGameServicesFetchHandlerOptions {
   readonly prefix?: string;
+  /**
+  * Writes the pre-beta.34 `inferable: false` flag into oRPC error bodies so game clients
+  * from `@mpgd/game-services` 0.30.5 or older (oRPC 2.0.0-beta.14) still decode error
+  * codes. A plain oRPC 2.0.0-beta.34+ client rejects that flag: such clients must wrap their
+  * fetch with `withLegacyOrpcErrorCompat`, as `createGameServicesOrpcClient` from 0.31.0 or
+  * later does. Set this to false once every supported game client comes from 0.31.0 or
+  * later. Defaults to true.
+  */
+  readonly legacyOrpcErrorFlag?: boolean;
 }
 export interface GameServicesOrpcContext {
   readonly request?: Request;
@@ -217,17 +226,17 @@ export declare function createGameServicesBackend(input: CreateGameServicesBacke
 export declare function createGameServicesBackendApiHandler(input: CreateGameServicesBackendInput): GameServicesBackendApiHandler;
 export declare function createInProcessGameServicesBackendTransport(handler: GameServicesBackendApiHandler): GameServicesBackendTransport;
 export declare function createGameServicesRouter(backend: GameServicesBackendApi, options?: CreateGameServicesRouterOptions): {
-  health: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, object>;
+  health: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, Record<never, never>>;
   commerce: {
-    verifyPurchase: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, object>;
-    getPurchaseLedgerStatus: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<import("./operation-results.js").PurchaseLedgerStatusResponse, import("./operation-results.js").PurchaseLedgerStatusResponse>, object>;
-    getCapabilities: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<import("@mpgd/platform/commerce").CommerceServiceCapabilities, import("@mpgd/platform/commerce").CommerceServiceCapabilities>, object>;
+    verifyPurchase: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, Record<never, never>>;
+    getPurchaseLedgerStatus: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<import("./operation-results.js").PurchaseLedgerStatusResponse, import("./operation-results.js").PurchaseLedgerStatusResponse>, Record<never, never>>;
+    getCapabilities: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<import("@mpgd/platform/commerce").CommerceServiceCapabilities, import("@mpgd/platform/commerce").CommerceServiceCapabilities>, Record<never, never>>;
   };
   ads: {
-    claimReward: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, object>;
+    claimReward: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, Record<never, never>>;
   };
   leaderboard: {
-    recordScore: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, object>;
+    recordScore: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, Record<never, never>>;
   };
 };
 export declare function createGameServicesRpcFetchHandler(router: ReturnType<typeof createGameServicesRouter>, options?: CreateGameServicesRpcFetchHandlerOptions): (request: Request) => Promise<Response>;

package/dist/server.js

@@ -1,5 +1,6 @@
 import { implement, ORPCError } from '@orpc/server';
-import { BodyLimitHandlerPlugin, RPCHandler } from '@orpc/server/fetch';
+import { RPCHandler } from '@orpc/server/fetch';
+import { RequestLimitHandlerPlugin } from '@orpc/server/plugins';
 import { createAnalyticsReporter } from '@mpgd/analytics';
 import { resolveAdPlacementPlatformId, resolveCatalogCurrencies, resolveProductPlatformId, } from '@mpgd/catalog';
 import { gameServicesBackendEndpoints, } from './client.js';
@@ -7,6 +8,7 @@ import { resolveCommerceStoreId, } from './commerce-evidence-registry.js';
 import { createPurchaseHolderEvidenceVerificationId, findEntitlementRevocationsChunked, findPurchaseWideRevocation, holderRevocationEvidenceId, isEntitlementGrantReversed, isRestoredAcrossPlayers, listPurchaseHolders, readPurchaseLedgerStatuses, readPurchaseVerificationId, RevocationKeyConflictError, revokeEntitlementGrant, } from './commerce-ledger.js';
 import { assertPlayerDataErasureInput, createRetainedLedgerEntryId, detachRetainedLedgerPayload, isRetainedPlayerId, } from './account-deletion.js';
 import { gameServicesContract } from './contract.js';
+import { addLegacyOrpcErrorFlag } from './orpc-error-compat.js';
 import { createRejectingGameServicesEvidenceVerifier, } from './evidence-verification.js';
 import { assertClaimAdRewardRequest, assertClaimAdRewardResponse, assertEntitlementLedgerGrant, assertEntitlementLedgerNote, assertEntitlementLedgerResult, assertEntitlementLedgerRevocation, assertEntitlementRevocationTransaction, assertGameServicesDeploymentTarget, assertLeaderboardScoreTransaction, assertProductGrantTransaction, assertPurchaseGrantFinalization, assertRecordLeaderboardScoreRequest, assertRecordLeaderboardScoreResponse, assertVerifyPurchaseRequest, assertVerifyPurchaseResponse, } from './types.js';
 import { resolvePurchaseRestoreSharingPolicy, } from './purchase-sharing.js';
@@ -613,13 +615,14 @@ export function createGameServicesRouter(backend, options = {}) {
 export function createGameServicesRpcFetchHandler(router, options = {}) {
     const rpcHandler = new RPCHandler(router, {
         plugins: [
-            new BodyLimitHandlerPlugin({
+            new RequestLimitHandlerPlugin({
                 maxBodySize: resolveMaxBodyBytes(options.maxBodyBytes),
             }),
         ],
     });
     const prefix = options.prefix ?? '/rpc';
     const healthPath = options.healthPath ?? '/health';
+    const legacyOrpcErrorFlag = options.legacyOrpcErrorFlag ?? true;
     return async (request) => {
         const requestUrl = new URL(request.url);
         if (requestUrl.pathname === healthPath) {
@@ -637,7 +640,11 @@ export function createGameServicesRpcFetchHandler(router, options = {}) {
         if (!result.matched) {
             return textResponse('Not Found', 404, options.corsHeaders);
         }
-        return withCors(result.response, options.corsHeaders);
+        // Error bodies keep the pre-beta.34 `inferable` flag so older game clients decode them.
+        const response = legacyOrpcErrorFlag
+            ? await addLegacyOrpcErrorFlag(result.response)
+            : result.response;
+        return withCors(response, options.corsHeaders);
     };
 }
 export function createGameServicesHttpFetchHandler(handler, options = {}) {
@@ -985,6 +992,22 @@ async function verifyPurchaseForRetry(request, retryIdentity, context) {
                     finalization,
                 });
             }
+            if (product.type === 'consumable'
+                && routedEntry?.status === 'routed'
+                && routedEntry.entry.finish === 'client') {
+                // This player's own grant of a consumable the client finishes
+                // (StoreKit): the store still lists the transaction, so its finish
+                // never happened or never reached the client's journal, and the
+                // client's record of it is gone (journal retention), so it asks
+                // under the derived key. The recorded grant is reported, never a
+                // second one, so the client can finish the transaction instead of
+                // the store re-delivering it on every launch.
+                return assertVerifyPurchaseResponse({
+                    verified: true,
+                    ledgerEntryId: existingEvidence.ledgerEntryId,
+                    alreadyProcessed: true,
+                });
+            }
         }
         return assertVerifyPurchaseResponse({
             verified: false,