@mpgd/game-services 0.30.5 → 0.31.0

package/dist/commerce-reconciler.js

@@ -54,7 +54,9 @@ function isRetryableBeforeLaunch(record) {
  * finish allow-list of its own (the removed v1 driver paired transactions in
  * `finishGrantedTransaction`), so this is the finish gate for every `client`
  * and `host` owner: the ledger entry id comes from the journal revision the
- * backend grant wrote.
+ * backend grant wrote. The one other finish call is a `finished` consumable a
+ * `client` store reports again, finished with the same journaled ledger entry
+ * (see `finishReportedAgain` in `createCommerceReconciler`).
  */
 export function assertCommerceFinishAllowed(record) {
     if (record.state !== 'granted' && record.state !== 'finishing') {
@@ -258,6 +260,30 @@ export function createCommerceReconciler(input) {
     const trigger = () => {
         triggerPending = true;
     };
+    /** The session check's refusal, if any; a check that throws refuses too. */
+    const sessionRefusal = () => {
+        if (input.sessionCheck === undefined) {
+            return undefined;
+        }
+        try {
+            return input.sessionCheck();
+        }
+        catch (error) {
+            return new CommerceError('ACCOUNT_BINDING_REQUIRED', {
+                retryable: true,
+                message: `The session check failed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+    };
+    /** True (and reported) when the reconciler must not act for its player now. */
+    const sessionBlocked = (idempotencyKey) => {
+        const refusal = sessionRefusal();
+        if (refusal === undefined) {
+            return false;
+        }
+        fail('session', refusal, idempotencyKey);
+        return true;
+    };
     const ownsRecord = (record) => record.playerId === playerId
         && record.target === target
         && record.deploymentTarget === deploymentTarget
@@ -551,6 +577,11 @@ export function createCommerceReconciler(input) {
         if (!capabilitiesNow.lifecycle.availablePurchases) {
             return true;
         }
+        if (sessionBlocked()) {
+            // Another player's store account may be current: nothing is read into
+            // this player's journal, and the next permitted pass reads again.
+            return false;
+        }
         const read = async (withRestore) => {
             const available = await provider.getAvailablePurchases({
                 includePending: capabilitiesNow.lifecycle.pending,
@@ -609,6 +640,83 @@ export function createCommerceReconciler(input) {
             ...(record.origin === 'discovered' ? { intent: 'restore' } : {}),
         };
     };
+    /** Whether a store purchase is bound to another account than this player's (`accountBinding`). */
+    const accountOf = async (purchase) => {
+        const bound = purchase.accountBinding;
+        if (input.accountBinding === undefined || bound?.value === undefined) {
+            return 'own';
+        }
+        let own;
+        try {
+            own = await input.accountBinding();
+        }
+        catch {
+            own = undefined;
+        }
+        if (own?.value === undefined) {
+            // This player's binding cannot be read now: the purchase cannot be shown to be theirs yet.
+            return 'unknown';
+        }
+        if (own.kind !== bound.kind) {
+            return 'own';
+        }
+        const normalize = (value) => bound.kind === 'app-account-token' ? value.toLowerCase() : value;
+        return normalize(own.value) === normalize(bound.value) ? 'own' : 'another';
+    };
+    /** Transactions `finishReportedAgain` already finished again this session. */
+    const finishedAgain = new Set();
+    /**
+     * A client-finish store reports a consumable only while it is unfinished,
+     * so one reported again after its record finished was never finished in
+     * the store: its finish was reported done without a native call (a lost
+     * acknowledgement the store's list could not tell apart from an
+     * unverifiable entry or a list read too early), or the store re-delivered
+     * it. It is finished again with the ledger entry the grant wrote, once per
+     * session (a call that failed in transport is tried again on the next
+     * report); it is never verified or granted again (the ledger replays a key
+     * and refuses the same evidence under another one). Durables, which a
+     * store keeps listing after their finish, and other finish owners are left
+     * alone. It needs the finished record: past the journal's retention the
+     * transaction takes the derived-key path, where the reference backend
+     * answers a `client`-finish consumable with this player's recorded grant
+     * (never a second one), and the record finishes it like any grant.
+     */
+    const finishReportedAgain = async (record, kind) => {
+        const ledgerEntryId = record.ledgerEntryId;
+        const transactionId = record.purchase?.transactionId;
+        if ((record.productKind ?? kind) !== 'consumable'
+            || capabilities?.lifecycle.finish !== 'client'
+            || provider.finishTransaction === undefined
+            || ledgerEntryId === undefined
+            || ledgerEntryId.trim() === ''
+            || transactionId === undefined
+            || transactionId.trim() === ''
+            || finishedAgain.has(transactionId)) {
+            return;
+        }
+        if (sessionBlocked(record.idempotencyKey)) {
+            // The session changed while the report was matched: the next report asks again.
+            return;
+        }
+        finishedAgain.add(transactionId);
+        try {
+            const { finished } = await provider.finishTransaction({
+                transactionId,
+                ledgerEntryId,
+                isConsumable: true,
+            });
+            if (!finished) {
+                // The store refused it (for StoreKit: revoked or another token); the
+                // next session asks again. The record stays finished.
+                fail('finish', new Error(`The store did not finish ${transactionId} it reported again.`), record.idempotencyKey);
+            }
+        }
+        catch (error) {
+            // Transport-class failure: the next report of the transaction tries again.
+            finishedAgain.delete(transactionId);
+            fail('finish', error, record.idempotencyKey);
+        }
+    };
     // Reconciler step 2: match a reported purchase to a journal record.
     const ingestPurchase = async (purchase, restoring) => {
         if (purchase.store !== storeId) {
@@ -638,6 +746,22 @@ export function createCommerceReconciler(input) {
                 record = remember(stored);
             }
         }
+        const account = record !== undefined || (restoring && product.kind === 'durable')
+            ? 'own'
+            : await accountOf(purchase);
+        if (account === 'unknown') {
+            // Not decided yet: the report waits for the next pass, which asks again.
+            defer({ type: 'purchaseUpdated', purchase });
+            fail('match', new Error(`Purchase ${purchase.transactionId} waits: this player's store account binding could not be read.`));
+            return;
+        }
+        if (account === 'another') {
+            // Another player's purchase (Play lists unacknowledged purchases of
+            // every app account on the device): neither attached to this player's
+            // open attempt nor journaled under a derived key.
+            fail('match', new Error(`Purchase ${purchase.transactionId} is bound to another store account; it is left for that player.`));
+            return;
+        }
         if (record === undefined) {
             const open = openRecordsFor(product.logicalId);
             if (open.length > 1) {
@@ -697,6 +821,10 @@ export function createCommerceReconciler(input) {
                 return;
             }
         }
+        if (record.state === 'finished' && purchase.state === 'purchased') {
+            await finishReportedAgain(record, product.kind);
+            return;
+        }
         if (purchase.state === 'pending' && record.state === 'launched') {
             await write(record, 'pending', { purchase });
             return;
@@ -761,6 +889,10 @@ export function createCommerceReconciler(input) {
         }
         try {
             for (;;) {
+                if (sessionBlocked(record.idempotencyKey)) {
+                    // The record stays as journaled for this player's next permitted pass.
+                    return;
+                }
                 switch (record.state) {
                     case 'requested':
                         if (isRetryableBeforeLaunch(record)) {
@@ -881,12 +1013,25 @@ export function createCommerceReconciler(input) {
                             retryLater(record.idempotencyKey);
                             return;
                         }
+                        if (sessionBlocked(record.idempotencyKey)) {
+                            return;
+                        }
                         let finished = false;
                         try {
                             finished = (await provider.finishTransaction({
                                 transactionId: finish.transactionId,
                                 ledgerEntryId: finish.ledgerEntryId,
                                 isConsumable: kind === 'consumable',
+                                // A record already `finishing` when this drive began was asked
+                                // to finish before (an earlier attempt or session): a `client`
+                                // store may read a consumable gone from its unfinished list as
+                                // that finish's lost acknowledgement. A first finish never is,
+                                // and a provider that does not declare the field never gets it.
+                                ...(owner === 'client'
+                                    && initial.state === 'finishing'
+                                    && provider.acceptsFinishRetry === true
+                                    ? { retry: true }
+                                    : {}),
                             })).finished;
                         }
                         catch (error) {
@@ -961,6 +1106,10 @@ export function createCommerceReconciler(input) {
     };
     const eventPass = { explicit: false, refreshCapabilities: false };
     const pass = async (options) => {
+        if (sessionBlocked()) {
+            // Queued events wait for a pass the session permits.
+            return;
+        }
         let capabilitiesNow = await readCapabilities(options.refreshCapabilities);
         if (options.refreshCapabilities) {
             await readServiceAlignment();
@@ -978,10 +1127,14 @@ export function createCommerceReconciler(input) {
         // call to journal the store answer: matched then, it is never journaled
         // twice, and a cancel event ends the attempt the call launched.
         const busy = inFlightProducts();
-        for (const event of [
-            ...deferred.splice(0, deferred.length),
-            ...inbox.splice(0, inbox.length),
-        ]) {
+        const queued = [...deferred.splice(0, deferred.length), ...inbox.splice(0, inbox.length)];
+        for (const [index, event] of queued.entries()) {
+            if (sessionBlocked()) {
+                // A purchase reported now may be another player's: it is not
+                // journaled under this one; the rest wait, in order.
+                inbox.unshift(...queued.slice(index));
+                return;
+            }
             try {
                 if (event.type === 'purchaseUpdated') {
                     const product = busy.size === 0 ? undefined : await resolveLogicalId(event.purchase);
@@ -1004,6 +1157,9 @@ export function createCommerceReconciler(input) {
             }
         }
         for (const listed of await listRecoverable()) {
+            if (sessionBlocked()) {
+                return;
+            }
             const record = records.get(listed.idempotencyKey) ?? listed;
             if (options.restoreTrigger !== true && waitsForRestoreTrigger(record)) {
                 // At the holder limit only the player's Restore Purchases asks again;
@@ -1012,6 +1168,9 @@ export function createCommerceReconciler(input) {
             }
             await drive(record, capabilitiesNow, options.explicit);
         }
+        if (sessionBlocked()) {
+            return;
+        }
         await revokeReversed();
     };
     const runUntilIdle = async () => {
@@ -1158,6 +1317,12 @@ export function createCommerceReconciler(input) {
                 })),
             };
         }
+        const lateRefusal = sessionRefusal();
+        if (lateRefusal !== undefined) {
+            // The session changed while the purchase was prepared: nothing is journaled.
+            fail('session', lateRefusal, request.idempotencyKey);
+            return { kind: 'answered', result: failedOutcome(lateRefusal) };
+        }
         const { created, record } = existing === undefined ? await reserve({
             idempotencyKey: request.idempotencyKey,
             store: storeId,
@@ -1263,6 +1428,12 @@ export function createCommerceReconciler(input) {
         // Only the call that reserved the record owns its in-flight entry: a
         // same-key replay must not release it while the store sheet is open.
         let owned = false;
+        const refusal = sessionRefusal();
+        if (refusal !== undefined) {
+            // Nothing is journaled and no store UI opens; the key stays usable.
+            fail('session', refusal, request.idempotencyKey);
+            return failedOutcome(refusal);
+        }
         try {
             const prepared = await withLock(() => prepareRequest(request));
             if (prepared.kind === 'answered') {
@@ -1281,14 +1452,39 @@ export function createCommerceReconciler(input) {
                         notStarted = event.state === 'not-started';
                     }
                 });
-                try {
-                    answer = await provider.requestPurchase(request);
-                }
-                catch (error) {
-                    answer = failedOutcome(error);
-                }
-                finally {
+                // Checked again with nothing awaited before the store call: the
+                // provider binds the purchase to the account current now, which must
+                // still be the player this attempt is journaled under.
+                const lateRefusal = sessionRefusal();
+                if (lateRefusal !== undefined) {
+                    fail('session', lateRefusal, request.idempotencyKey);
                     unsubscribePresentation?.();
+                    // The store never opened: the reserved attempt stays retryable.
+                    answer = failedOutcome(lateRefusal);
+                    notStarted = true;
+                }
+                else {
+                    try {
+                        answer = await provider.requestPurchase(request);
+                    }
+                    catch (error) {
+                        answer = failedOutcome(error);
+                    }
+                    finally {
+                        unsubscribePresentation?.();
+                    }
+                    // The provider refuses a missing or foreign account binding before
+                    // its store UI opens. Refused because the session changed meanwhile,
+                    // the attempt stays retryable instead of ending.
+                    const bindingRefusal = answer.outcome === 'failed'
+                        && answer.error.code === 'ACCOUNT_BINDING_REQUIRED'
+                        ? sessionRefusal()
+                        : undefined;
+                    if (bindingRefusal !== undefined) {
+                        fail('session', bindingRefusal, request.idempotencyKey);
+                        answer = failedOutcome(bindingRefusal);
+                        notStarted = true;
+                    }
                 }
                 result = await withLock(() => recordAnswer(request, prepared.record, prepared.product, answer, notStarted));
             }
@@ -1330,13 +1526,27 @@ export function createCommerceReconciler(input) {
             if (started) {
                 return;
             }
+            if (input.closed?.() === true) {
+                // Closed for good: nothing subscribes, and nothing awaits before this
+                // check, so a start under way already set `starting` for `stop()`.
+                return;
+            }
             if (starting !== undefined) {
                 return starting;
             }
             starting = (async () => {
                 try {
-                    await withLock(async () => {
+                    const subscribed = await withLock(async () => {
                         await loadRecords();
+                        // The owner closed while this start waited for the lock or the
+                        // journal (its `stop()` may have stopped waiting already): leave
+                        // as a refused start does, with nothing subscribed or started and
+                        // no error. The records read stay cached, as after a `reconcile()`
+                        // before any start. Nothing awaits between this check and the
+                        // subscription.
+                        if (input.closed?.() === true) {
+                            return false;
+                        }
                         // Subscribe first, then read: an event delivered before the listener is found either way.
                         unsubscribe = provider.subscribe(listener);
                         started = true;
@@ -1347,8 +1557,11 @@ export function createCommerceReconciler(input) {
                         initialScanPending = capabilitiesNow === undefined
                             || (capabilitiesNow.lifecycle.events && !(await readAvailable(capabilitiesNow)));
                         await pass({ explicit: true, refreshCapabilities: false });
+                        return true;
                     });
-                    await runUntilIdle();
+                    if (subscribed) {
+                        await runUntilIdle();
+                    }
                 }
                 catch (error) {
                     // A failed start is retryable: nothing stays subscribed or started.
@@ -1410,6 +1623,13 @@ export function createCommerceReconciler(input) {
         },
         runUntilIdle,
         async restorePurchases() {
+            const refusal = sessionRefusal();
+            if (refusal !== undefined) {
+                // A store restore (StoreKit's sync, an account sign-in) would run for
+                // the account current now, not this reconciler's player.
+                fail('session', refusal);
+                throw refusal;
+            }
             if (provider.restorePurchases !== undefined) {
                 try {
                     await provider.restorePurchases();
@@ -1442,6 +1662,12 @@ export function createCommerceReconciler(input) {
                 });
             });
             await runUntilIdle();
+            const lateRefusal = sessionRefusal();
+            if (lateRefusal !== undefined) {
+                // The session changed during the restore: the passes stopped early,
+                // so it did not finish for this player.
+                throw lateRefusal;
+            }
         },
         requestPurchase,
         async fetchProducts(request = {}) {

package/dist/contract.d.ts

@@ -7,17 +7,17 @@ export interface GameServicesHealthResponse {
   readonly version: string;
 }
 export declare const gameServicesContract: {
-  health: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, object>;
+  health: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, Record<never, never>>;
   commerce: {
-    verifyPurchase: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, object>;
-    getPurchaseLedgerStatus: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<PurchaseLedgerStatusResponse, PurchaseLedgerStatusResponse>, object>;
-    getCapabilities: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<CommerceServiceCapabilities, CommerceServiceCapabilities>, object>;
+    verifyPurchase: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, Record<never, never>>;
+    getPurchaseLedgerStatus: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<PurchaseLedgerStatusResponse, PurchaseLedgerStatusResponse>, Record<never, never>>;
+    getCapabilities: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<CommerceServiceCapabilities, CommerceServiceCapabilities>, Record<never, never>>;
   };
   ads: {
-    claimReward: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, object>;
+    claimReward: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, Record<never, never>>;
   };
   leaderboard: {
-    recordScore: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, object>;
+    recordScore: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, Record<never, never>>;
   };
 };
 export type GameServicesContract = typeof gameServicesContract;

package/dist/monetization-recovery.js

@@ -29,7 +29,7 @@ export function createRecoverableMonetizationClient(input) {
     const commerceReconciler = commerceClient.commerceReconciler;
     // The per-operation rewarded-ad clients see a gateway without the commerce
     // provider, so they never build a second reconciler over the journal.
-    const { commerceReconciler: _sharedReconciler, operationStore: _journal, onCommerceEvent: _onCommerceEvent, commerceProducts: _commerceProducts, ...legacyClientInput } = input;
+    const { commerceReconciler: _sharedReconciler, operationStore: _journal, onCommerceEvent: _onCommerceEvent, commerceProducts: _commerceProducts, commerceStaleLaunchedAfterMs: _commerceStaleLaunchedAfterMs, ...legacyClientInput } = input;
     const { commerce: _commerce, ...legacyGateway } = input.gateway;
     async function serializeOperation(key, task) {
         const previous = inFlight.get(key) ?? Promise.resolve();

package/dist/orpc-error-compat.d.ts

@@ -0,0 +1,42 @@
+/**
+* oRPC error-body compatibility across the 2.0.0-beta.34 `inferable` removal.
+*
+* oRPC 2.0.0-beta.14 writes RPC error bodies as
+* `{ json: { defined, inferable, code, message, data? } }` and its client rejects a body
+* without a boolean `inferable`. Since 2.0.0-beta.34 (middleapi/orpc#1987) the server
+* omits `inferable` and the client rejects a body that has it. Either way a client on
+* the other version reports a malformed response instead of the error code, so a game
+* built against one kit release and a Worker built against another would lose
+* `BAD_REQUEST` and `NOT_FOUND` (and with it the commerce reconciler's "v1 backend"
+* detection) whenever they are deployed separately.
+*
+* The game-services oRPC transport therefore bridges both directions:
+* - the server adds `inferable: false` to error bodies, so older clients still decode them;
+* - the client removes a boolean `inferable` before oRPC validates, so it still decodes
+*   older servers' errors. Nothing else in the body changes, so a body that is malformed
+*   for any other reason is still rejected by oRPC.
+*
+* Success responses are passed through untouched in both directions.
+*
+* Remove this module when the oldest supported game-services client and every supported
+* Worker come from `@mpgd/game-services` 0.31.0 or later (oRPC 2.0.0-beta.46), that is, once
+* no client or Worker from 0.30.5 or older (oRPC 2.0.0-beta.14) is supported.
+*/
+/**
+* Server side: adds `inferable: false` to an oRPC error body that lacks it.
+* Responses that are not oRPC JSON error bodies are returned unchanged.
+*/
+export declare function addLegacyOrpcErrorFlag(response: Response): Promise<Response>;
+/**
+* Client side: removes a boolean `inferable` from an oRPC error body so a current oRPC
+* client accepts errors from a pre-beta.34 server. Only that key is removed; oRPC still
+* validates the rest of the body as usual.
+*/
+export declare function stripLegacyOrpcErrorFlag(response: Response): Promise<Response>;
+/**
+* Wraps an oRPC link `fetch` so every response passes through
+* {@link stripLegacyOrpcErrorFlag}. Any oRPC 2.0.0-beta.34+ client that talks to a
+* game-services Worker must use it while the Worker writes the legacy flag. Extra arguments
+* oRPC passes (client options, procedure path) are forwarded unchanged.
+*/
+export declare function withLegacyOrpcErrorCompat<Rest extends unknown[]>(fetcher: (url: string, init: RequestInit, ...rest: Rest) => Promise<Response>): (url: string, init: RequestInit, ...rest: Rest) => Promise<Response>;

package/dist/orpc-error-compat.js

@@ -0,0 +1,102 @@
+/**
+ * oRPC error-body compatibility across the 2.0.0-beta.34 `inferable` removal.
+ *
+ * oRPC 2.0.0-beta.14 writes RPC error bodies as
+ * `{ json: { defined, inferable, code, message, data? } }` and its client rejects a body
+ * without a boolean `inferable`. Since 2.0.0-beta.34 (middleapi/orpc#1987) the server
+ * omits `inferable` and the client rejects a body that has it. Either way a client on
+ * the other version reports a malformed response instead of the error code, so a game
+ * built against one kit release and a Worker built against another would lose
+ * `BAD_REQUEST` and `NOT_FOUND` (and with it the commerce reconciler's "v1 backend"
+ * detection) whenever they are deployed separately.
+ *
+ * The game-services oRPC transport therefore bridges both directions:
+ * - the server adds `inferable: false` to error bodies, so older clients still decode them;
+ * - the client removes a boolean `inferable` before oRPC validates, so it still decodes
+ *   older servers' errors. Nothing else in the body changes, so a body that is malformed
+ *   for any other reason is still rejected by oRPC.
+ *
+ * Success responses are passed through untouched in both directions.
+ *
+ * Remove this module when the oldest supported game-services client and every supported
+ * Worker come from `@mpgd/game-services` 0.31.0 or later (oRPC 2.0.0-beta.46), that is, once
+ * no client or Worker from 0.30.5 or older (oRPC 2.0.0-beta.14) is supported.
+ */
+const legacyErrorFlag = 'inferable';
+/**
+ * Server side: adds `inferable: false` to an oRPC error body that lacks it.
+ * Responses that are not oRPC JSON error bodies are returned unchanged.
+ */
+export async function addLegacyOrpcErrorFlag(response) {
+    if (!isJsonErrorResponse(response)) {
+        return response;
+    }
+    const text = await response.text();
+    const envelope = parseErrorEnvelope(text);
+    if (envelope === undefined || Object.hasOwn(envelope.json, legacyErrorFlag)) {
+        return rebuild(response, text);
+    }
+    return rebuild(response, JSON.stringify({ ...envelope.root, json: { ...envelope.json, [legacyErrorFlag]: false } }));
+}
+/**
+ * Client side: removes a boolean `inferable` from an oRPC error body so a current oRPC
+ * client accepts errors from a pre-beta.34 server. Only that key is removed; oRPC still
+ * validates the rest of the body as usual.
+ */
+export async function stripLegacyOrpcErrorFlag(response) {
+    if (!isJsonErrorResponse(response)) {
+        return response;
+    }
+    const text = await response.text();
+    const envelope = parseErrorEnvelope(text);
+    if (envelope === undefined || typeof envelope.json[legacyErrorFlag] !== 'boolean') {
+        return rebuild(response, text);
+    }
+    const { [legacyErrorFlag]: _legacy, ...json } = envelope.json;
+    return rebuild(response, JSON.stringify({ ...envelope.root, json }));
+}
+/**
+ * Wraps an oRPC link `fetch` so every response passes through
+ * {@link stripLegacyOrpcErrorFlag}. Any oRPC 2.0.0-beta.34+ client that talks to a
+ * game-services Worker must use it while the Worker writes the legacy flag. Extra arguments
+ * oRPC passes (client options, procedure path) are forwarded unchanged.
+ */
+export function withLegacyOrpcErrorCompat(fetcher) {
+    return async (url, init, ...rest) => stripLegacyOrpcErrorFlag(await fetcher(url, init, ...rest));
+}
+function isJsonErrorResponse(response) {
+    return (response.status >= 400
+        && response.body !== null
+        && (response.headers.get('content-type') ?? '').toLowerCase().startsWith('application/json'));
+}
+function parseErrorEnvelope(text) {
+    let root;
+    try {
+        root = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isPlainObject(root) || !isPlainObject(root.json)) {
+        return undefined;
+    }
+    return { root, json: root.json };
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function rebuild(response, body) {
+    const headers = new Headers(response.headers);
+    // The body is re-encoded as plain text: any transfer encoding or length no longer applies.
+    headers.delete('content-encoding');
+    headers.delete('content-length');
+    return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}

package/dist/request-headers.d.ts

@@ -4,6 +4,28 @@
 * client and the notifications client so a game gives both one resolver.
 */
 export type GameServicesHeaderResolver = () => Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+/** A runtime refused an operation because it was disposed (see `GameServicesRuntime.dispose`). */
+export declare const gameServicesRuntimeDisposedCode = "GAME_SERVICES_RUNTIME_DISPOSED";
+/**
+* A runtime refused an operation because `sessionPlayerId` names another
+* player: it closed itself, as `dispose()` does, and the host creates a
+* runtime for the signed-in player (retryable there).
+*/
+export declare const gameServicesPlayerChangedCode = "GAME_SERVICES_PLAYER_CHANGED";
+/** A runtime refused an operation because `sessionPlayerId` names no player (signed out); it stays open. */
+export declare const gameServicesSessionRequiredCode = "GAME_SERVICES_SESSION_REQUIRED";
+export type GameServicesRuntimeClosedCode = typeof gameServicesRuntimeDisposedCode | typeof gameServicesPlayerChangedCode | typeof gameServicesSessionRequiredCode;
+/**
+* An operation the runtime refused before it reached the backend or the
+* store: it was disposed, its player is no longer the session's, or the
+* session is signed out. Always retryable (with a runtime for the signed-in
+* player); nothing was sent and no record was ended.
+*/
+export declare class GameServicesRuntimeClosedError extends Error {
+  readonly code: GameServicesRuntimeClosedCode;
+  readonly retryable = true;
+  constructor(code: GameServicesRuntimeClosedCode);
+}
 /** Credentials could not be resolved; no backend request was dispatched. */
 export declare class GameServicesHeaderResolutionError extends Error {
   constructor();

package/dist/request-headers.js

@@ -3,6 +3,35 @@
  * for rotating credentials, then per-request headers. Shared by the commerce
  * client and the notifications client so a game gives both one resolver.
  */
+/** A runtime refused an operation because it was disposed (see `GameServicesRuntime.dispose`). */
+export const gameServicesRuntimeDisposedCode = 'GAME_SERVICES_RUNTIME_DISPOSED';
+/**
+ * A runtime refused an operation because `sessionPlayerId` names another
+ * player: it closed itself, as `dispose()` does, and the host creates a
+ * runtime for the signed-in player (retryable there).
+ */
+export const gameServicesPlayerChangedCode = 'GAME_SERVICES_PLAYER_CHANGED';
+/** A runtime refused an operation because `sessionPlayerId` names no player (signed out); it stays open. */
+export const gameServicesSessionRequiredCode = 'GAME_SERVICES_SESSION_REQUIRED';
+/**
+ * An operation the runtime refused before it reached the backend or the
+ * store: it was disposed, its player is no longer the session's, or the
+ * session is signed out. Always retryable (with a runtime for the signed-in
+ * player); nothing was sent and no record was ended.
+ */
+export class GameServicesRuntimeClosedError extends Error {
+    code;
+    retryable = true;
+    constructor(code) {
+        super(code === gameServicesPlayerChangedCode
+            ? 'The session now names another player; this game services runtime is closed.'
+            : code === gameServicesSessionRequiredCode
+                ? 'The session names no player; sign in before using game services.'
+                : 'This game services runtime was disposed.');
+        this.name = 'GameServicesRuntimeClosedError';
+        this.code = code;
+    }
+}
 /** Credentials could not be resolved; no backend request was dispatched. */
 export class GameServicesHeaderResolutionError extends Error {
     constructor() {
@@ -16,7 +45,11 @@ export async function resolveGameServicesRequestHeaders(input) {
     try {
         dynamicHeaders = await input.getHeaders?.();
     }
-    catch {
+    catch (error) {
+        if (error instanceof GameServicesRuntimeClosedError) {
+            // The runtime's own refusal carries no credentials; its code says why.
+            throw error;
+        }
         // Resolver exceptions can contain credentials; expose a stable outcome.
         throw new GameServicesHeaderResolutionError();
     }