@mpgd/game-services 0.30.5 → 0.32.0

package/dist/contract.d.ts

@@ -7,17 +7,17 @@ export interface GameServicesHealthResponse {
   readonly version: string;
 }
 export declare const gameServicesContract: {
-  health: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, object>;
+  health: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<GameServicesHealthResponse, GameServicesHealthResponse>, Record<never, never>>;
   commerce: {
-    verifyPurchase: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, object>;
-    getPurchaseLedgerStatus: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<PurchaseLedgerStatusResponse, PurchaseLedgerStatusResponse>, object>;
-    getCapabilities: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<CommerceServiceCapabilities, CommerceServiceCapabilities>, object>;
+    verifyPurchase: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<VerifyPurchaseRequest, VerifyPurchaseRequest>, import("@orpc/contract").Schema<VerifyPurchaseResponse, VerifyPurchaseResponse>, Record<never, never>>;
+    getPurchaseLedgerStatus: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<PurchaseLedgerStatusRequest, PurchaseLedgerStatusRequest>, import("@orpc/contract").Schema<PurchaseLedgerStatusResponse, PurchaseLedgerStatusResponse>, Record<never, never>>;
+    getCapabilities: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<void, void>, import("@orpc/contract").Schema<CommerceServiceCapabilities, CommerceServiceCapabilities>, Record<never, never>>;
   };
   ads: {
-    claimReward: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, object>;
+    claimReward: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<ClaimAdRewardRequest, ClaimAdRewardRequest>, import("@orpc/contract").Schema<ClaimAdRewardResponse, ClaimAdRewardResponse>, Record<never, never>>;
   };
   leaderboard: {
-    recordScore: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, object>;
+    recordScore: import("@orpc/contract").ProcedureContract<import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, Record<never, never>>;
   };
 };
 export type GameServicesContract = typeof gameServicesContract;

package/dist/evidence-verification.d.ts

@@ -34,8 +34,9 @@ export type EvidenceVerificationDecision = {
   * check passed. The reference verifiers answer it only for a request
   * with `intent: 'restore'` of a non-consumable; the backend then grants
   * the player its own share under its `restoreSharing` policy, or
-  * answers `rejected` with `reason` (the binding mismatch) when the
-  * policy refuses. Fields are those of `verified`.
+  * answers `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` with `reason` (the
+  * binding mismatch) when the policy refuses, as for a `rejected`
+  * decision with `anotherAccount`. Fields are those of `verified`.
   */
   readonly status: 'restorable';
   readonly reason: string;
@@ -49,6 +50,17 @@ export type EvidenceVerificationDecision = {
 } | {
   readonly status: 'rejected';
   readonly reason: string;
+  /**
+  * The store binds the purchase to another account than the requesting
+  * player's (`reason` is the binding mismatch, for example
+  * `GOOGLE_PLAY_ACCOUNT_MISMATCH`), and every other check passed: the
+  * purchase is valid, only not this player's (RFC "Another account's
+  * purchase"). The backend grants nothing, records nothing, and answers
+  * the retryable `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error instead of a
+  * `rejected` receipt, so the purchase stays recoverable by its account.
+  * A caller that reads only `status` still refuses it.
+  */
+  readonly anotherAccount?: true;
 };
 export interface VerifyPurchaseEvidenceInput {
   readonly request: VerifyPurchaseRequest;

package/dist/google-play-purchase.js

@@ -326,6 +326,8 @@ async function inspectGooglePlayPurchase(input) {
         return rejected('GOOGLE_PLAY_PROFILE_INVALID');
     }
     let foreignBinding;
+    /** The purchase carries no id where the player's binding has one (bought outside the app). */
+    let missingBinding;
     if (input.accountBinding.status === 'bound') {
         // Defensive invariant: every bound context must carry at least one
         // identifier, even though the constructors below already enforce it.
@@ -338,13 +340,25 @@ async function inspectGooglePlayPurchase(input) {
         if (input.accountBinding.accountId !== undefined
             && obfuscatedExternalAccountId !== input.accountBinding.accountId) {
             foreignBinding = 'GOOGLE_PLAY_ACCOUNT_MISMATCH';
+            missingBinding = obfuscatedExternalAccountId === undefined
+                ? 'GOOGLE_PLAY_ACCOUNT_ID_MISSING'
+                : undefined;
         }
         else if (input.accountBinding.profileId !== undefined
             && obfuscatedExternalProfileId !== input.accountBinding.profileId) {
             foreignBinding = 'GOOGLE_PLAY_PROFILE_MISMATCH';
+            missingBinding = obfuscatedExternalProfileId === undefined
+                ? 'GOOGLE_PLAY_PROFILE_ID_MISSING'
+                : undefined;
         }
         if (foreignBinding !== undefined && input.reportForeignBinding !== true) {
-            return rejected(foreignBinding);
+            // A purchase with no binding is no account's: refused for every
+            // player. One bound to another account is that account's, which can
+            // still recover it: it is reported, not refused for good (RFC
+            // "Another account's purchase"). Every check before this one passed.
+            return missingBinding === undefined
+                ? { status: 'rejected', reason: foreignBinding, anotherAccount: true }
+                : rejected(missingBinding);
         }
         if (foreignBinding === undefined
             && input.accountBinding.profileId === undefined
@@ -357,15 +371,19 @@ async function inspectGooglePlayPurchase(input) {
             return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_REQUIRED');
         }
     }
-    // The unbound opt-in is safe only when the provider response is also unbound.
+    // The unbound opt-in is safe only when the provider response is also
+    // unbound. This backend binds no player, so no player of it can claim a
+    // bound purchase: refused for every player, never as another account's.
     if (input.accountBinding.status === 'unbound'
         && (obfuscatedExternalAccountId !== undefined
             || obfuscatedExternalProfileId !== undefined)) {
-        return rejected('GOOGLE_PLAY_ACCOUNT_MISMATCH');
+        return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED');
     }
     return {
         status: 'verified',
-        ...(foreignBinding === undefined ? {} : { foreignBinding }),
+        // A restore reports which: another account's binding, or none at all
+        // (the backend refuses the latter for good when no share covers it).
+        ...(foreignBinding === undefined ? {} : { foreignBinding: missingBinding ?? foreignBinding }),
         purchase: {
             purchaseToken: input.purchaseToken,
             purchaseTokenDigest: await digestPurchaseToken(input.packageName, input.purchaseToken),

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/monetization-recovery.js

@@ -29,7 +29,7 @@ export function createRecoverableMonetizationClient(input) {
     const commerceReconciler = commerceClient.commerceReconciler;
     // The per-operation rewarded-ad clients see a gateway without the commerce
     // provider, so they never build a second reconciler over the journal.
-    const { commerceReconciler: _sharedReconciler, operationStore: _journal, onCommerceEvent: _onCommerceEvent, commerceProducts: _commerceProducts, ...legacyClientInput } = input;
+    const { commerceReconciler: _sharedReconciler, operationStore: _journal, onCommerceEvent: _onCommerceEvent, commerceProducts: _commerceProducts, commerceStaleLaunchedAfterMs: _commerceStaleLaunchedAfterMs, ...legacyClientInput } = input;
     const { commerce: _commerce, ...legacyGateway } = input.gateway;
     async function serializeOperation(key, task) {
         const previous = inFlight.get(key) ?? Promise.resolve();

package/dist/orpc-error-compat.d.ts

@@ -0,0 +1,42 @@
+/**
+* oRPC error-body compatibility across the 2.0.0-beta.34 `inferable` removal.
+*
+* oRPC 2.0.0-beta.14 writes RPC error bodies as
+* `{ json: { defined, inferable, code, message, data? } }` and its client rejects a body
+* without a boolean `inferable`. Since 2.0.0-beta.34 (middleapi/orpc#1987) the server
+* omits `inferable` and the client rejects a body that has it. Either way a client on
+* the other version reports a malformed response instead of the error code, so a game
+* built against one kit release and a Worker built against another would lose
+* `BAD_REQUEST` and `NOT_FOUND` (and with it the commerce reconciler's "v1 backend"
+* detection) whenever they are deployed separately.
+*
+* The game-services oRPC transport therefore bridges both directions:
+* - the server adds `inferable: false` to error bodies, so older clients still decode them;
+* - the client removes a boolean `inferable` before oRPC validates, so it still decodes
+*   older servers' errors. Nothing else in the body changes, so a body that is malformed
+*   for any other reason is still rejected by oRPC.
+*
+* Success responses are passed through untouched in both directions.
+*
+* Remove this module when the oldest supported game-services client and every supported
+* Worker come from `@mpgd/game-services` 0.31.0 or later (oRPC 2.0.0-beta.46), that is, once
+* no client or Worker from 0.30.5 or older (oRPC 2.0.0-beta.14) is supported.
+*/
+/**
+* Server side: adds `inferable: false` to an oRPC error body that lacks it.
+* Responses that are not oRPC JSON error bodies are returned unchanged.
+*/
+export declare function addLegacyOrpcErrorFlag(response: Response): Promise<Response>;
+/**
+* Client side: removes a boolean `inferable` from an oRPC error body so a current oRPC
+* client accepts errors from a pre-beta.34 server. Only that key is removed; oRPC still
+* validates the rest of the body as usual.
+*/
+export declare function stripLegacyOrpcErrorFlag(response: Response): Promise<Response>;
+/**
+* Wraps an oRPC link `fetch` so every response passes through
+* {@link stripLegacyOrpcErrorFlag}. Any oRPC 2.0.0-beta.34+ client that talks to a
+* game-services Worker must use it while the Worker writes the legacy flag. Extra arguments
+* oRPC passes (client options, procedure path) are forwarded unchanged.
+*/
+export declare function withLegacyOrpcErrorCompat<Rest extends unknown[]>(fetcher: (url: string, init: RequestInit, ...rest: Rest) => Promise<Response>): (url: string, init: RequestInit, ...rest: Rest) => Promise<Response>;

package/dist/orpc-error-compat.js

@@ -0,0 +1,102 @@
+/**
+ * oRPC error-body compatibility across the 2.0.0-beta.34 `inferable` removal.
+ *
+ * oRPC 2.0.0-beta.14 writes RPC error bodies as
+ * `{ json: { defined, inferable, code, message, data? } }` and its client rejects a body
+ * without a boolean `inferable`. Since 2.0.0-beta.34 (middleapi/orpc#1987) the server
+ * omits `inferable` and the client rejects a body that has it. Either way a client on
+ * the other version reports a malformed response instead of the error code, so a game
+ * built against one kit release and a Worker built against another would lose
+ * `BAD_REQUEST` and `NOT_FOUND` (and with it the commerce reconciler's "v1 backend"
+ * detection) whenever they are deployed separately.
+ *
+ * The game-services oRPC transport therefore bridges both directions:
+ * - the server adds `inferable: false` to error bodies, so older clients still decode them;
+ * - the client removes a boolean `inferable` before oRPC validates, so it still decodes
+ *   older servers' errors. Nothing else in the body changes, so a body that is malformed
+ *   for any other reason is still rejected by oRPC.
+ *
+ * Success responses are passed through untouched in both directions.
+ *
+ * Remove this module when the oldest supported game-services client and every supported
+ * Worker come from `@mpgd/game-services` 0.31.0 or later (oRPC 2.0.0-beta.46), that is, once
+ * no client or Worker from 0.30.5 or older (oRPC 2.0.0-beta.14) is supported.
+ */
+const legacyErrorFlag = 'inferable';
+/**
+ * Server side: adds `inferable: false` to an oRPC error body that lacks it.
+ * Responses that are not oRPC JSON error bodies are returned unchanged.
+ */
+export async function addLegacyOrpcErrorFlag(response) {
+    if (!isJsonErrorResponse(response)) {
+        return response;
+    }
+    const text = await response.text();
+    const envelope = parseErrorEnvelope(text);
+    if (envelope === undefined || Object.hasOwn(envelope.json, legacyErrorFlag)) {
+        return rebuild(response, text);
+    }
+    return rebuild(response, JSON.stringify({ ...envelope.root, json: { ...envelope.json, [legacyErrorFlag]: false } }));
+}
+/**
+ * Client side: removes a boolean `inferable` from an oRPC error body so a current oRPC
+ * client accepts errors from a pre-beta.34 server. Only that key is removed; oRPC still
+ * validates the rest of the body as usual.
+ */
+export async function stripLegacyOrpcErrorFlag(response) {
+    if (!isJsonErrorResponse(response)) {
+        return response;
+    }
+    const text = await response.text();
+    const envelope = parseErrorEnvelope(text);
+    if (envelope === undefined || typeof envelope.json[legacyErrorFlag] !== 'boolean') {
+        return rebuild(response, text);
+    }
+    const { [legacyErrorFlag]: _legacy, ...json } = envelope.json;
+    return rebuild(response, JSON.stringify({ ...envelope.root, json }));
+}
+/**
+ * Wraps an oRPC link `fetch` so every response passes through
+ * {@link stripLegacyOrpcErrorFlag}. Any oRPC 2.0.0-beta.34+ client that talks to a
+ * game-services Worker must use it while the Worker writes the legacy flag. Extra arguments
+ * oRPC passes (client options, procedure path) are forwarded unchanged.
+ */
+export function withLegacyOrpcErrorCompat(fetcher) {
+    return async (url, init, ...rest) => stripLegacyOrpcErrorFlag(await fetcher(url, init, ...rest));
+}
+function isJsonErrorResponse(response) {
+    return (response.status >= 400
+        && response.body !== null
+        && (response.headers.get('content-type') ?? '').toLowerCase().startsWith('application/json'));
+}
+function parseErrorEnvelope(text) {
+    let root;
+    try {
+        root = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isPlainObject(root) || !isPlainObject(root.json)) {
+        return undefined;
+    }
+    return { root, json: root.json };
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function rebuild(response, body) {
+    const headers = new Headers(response.headers);
+    // The body is re-encoded as plain text: any transfer encoding or length no longer applies.
+    headers.delete('content-encoding');
+    headers.delete('content-length');
+    return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}

package/dist/request-headers.d.ts

@@ -4,6 +4,28 @@
 * client and the notifications client so a game gives both one resolver.
 */
 export type GameServicesHeaderResolver = () => Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+/** A runtime refused an operation because it was disposed (see `GameServicesRuntime.dispose`). */
+export declare const gameServicesRuntimeDisposedCode = "GAME_SERVICES_RUNTIME_DISPOSED";
+/**
+* A runtime refused an operation because `sessionPlayerId` names another
+* player: it closed itself, as `dispose()` does, and the host creates a
+* runtime for the signed-in player (retryable there).
+*/
+export declare const gameServicesPlayerChangedCode = "GAME_SERVICES_PLAYER_CHANGED";
+/** A runtime refused an operation because `sessionPlayerId` names no player (signed out); it stays open. */
+export declare const gameServicesSessionRequiredCode = "GAME_SERVICES_SESSION_REQUIRED";
+export type GameServicesRuntimeClosedCode = typeof gameServicesRuntimeDisposedCode | typeof gameServicesPlayerChangedCode | typeof gameServicesSessionRequiredCode;
+/**
+* An operation the runtime refused before it reached the backend or the
+* store: it was disposed, its player is no longer the session's, or the
+* session is signed out. Always retryable (with a runtime for the signed-in
+* player); nothing was sent and no record was ended.
+*/
+export declare class GameServicesRuntimeClosedError extends Error {
+  readonly code: GameServicesRuntimeClosedCode;
+  readonly retryable = true;
+  constructor(code: GameServicesRuntimeClosedCode);
+}
 /** Credentials could not be resolved; no backend request was dispatched. */
 export declare class GameServicesHeaderResolutionError extends Error {
   constructor();

package/dist/request-headers.js

@@ -3,6 +3,35 @@
  * for rotating credentials, then per-request headers. Shared by the commerce
  * client and the notifications client so a game gives both one resolver.
  */
+/** A runtime refused an operation because it was disposed (see `GameServicesRuntime.dispose`). */
+export const gameServicesRuntimeDisposedCode = 'GAME_SERVICES_RUNTIME_DISPOSED';
+/**
+ * A runtime refused an operation because `sessionPlayerId` names another
+ * player: it closed itself, as `dispose()` does, and the host creates a
+ * runtime for the signed-in player (retryable there).
+ */
+export const gameServicesPlayerChangedCode = 'GAME_SERVICES_PLAYER_CHANGED';
+/** A runtime refused an operation because `sessionPlayerId` names no player (signed out); it stays open. */
+export const gameServicesSessionRequiredCode = 'GAME_SERVICES_SESSION_REQUIRED';
+/**
+ * An operation the runtime refused before it reached the backend or the
+ * store: it was disposed, its player is no longer the session's, or the
+ * session is signed out. Always retryable (with a runtime for the signed-in
+ * player); nothing was sent and no record was ended.
+ */
+export class GameServicesRuntimeClosedError extends Error {
+    code;
+    retryable = true;
+    constructor(code) {
+        super(code === gameServicesPlayerChangedCode
+            ? 'The session now names another player; this game services runtime is closed.'
+            : code === gameServicesSessionRequiredCode
+                ? 'The session names no player; sign in before using game services.'
+                : 'This game services runtime was disposed.');
+        this.name = 'GameServicesRuntimeClosedError';
+        this.code = code;
+    }
+}
 /** Credentials could not be resolved; no backend request was dispatched. */
 export class GameServicesHeaderResolutionError extends Error {
     constructor() {
@@ -16,7 +45,11 @@ export async function resolveGameServicesRequestHeaders(input) {
     try {
         dynamicHeaders = await input.getHeaders?.();
     }
-    catch {
+    catch (error) {
+        if (error instanceof GameServicesRuntimeClosedError) {
+            // The runtime's own refusal carries no credentials; its code says why.
+            throw error;
+        }
         // Resolver exceptions can contain credentials; expose a stable outcome.
         throw new GameServicesHeaderResolutionError();
     }

package/dist/runtime.d.ts

@@ -1,10 +1,11 @@
 import { type AccountDeletionClient } from './account-deletion.js';
 import type { AnalyticsSink } from '@mpgd/analytics';
 import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
 import type { GameServicesLedgerTarget } from './types.js';
 import type { ClientRewardEvidenceRegistry } from './client-reward-evidence.js';
-import type { CommerceReconcilerProduct } from './commerce-reconciler.js';
+import type { CommerceReconcilerProduct, CreateCommerceReconcilerInput } from './commerce-reconciler.js';
 import { type MonetizationOperationStore, type RecoverableMonetizationClient } from './monetization-recovery.js';
 export type GameServicesAuthorityMode = 'production' | 'non-production';
 export type GameServicesRuntimeMode = 'disabled' | 'local' | 'http' | 'orpc';
@@ -21,7 +22,30 @@ export interface GameServicesRuntime {
   * with the runtime's headers; present with an authoritative `baseUrl`.
   */
   readonly accountDeletion?: AccountDeletionClient;
+  /**
+  * Closes the runtime for good, then waits until a purchase whose store
+  * sheet is open has journaled its answer, a startup or resume recovery
+  * pass (`monetizationRecovery.reconcile()`) has finished, and the commerce
+  * reconciler has stopped (each wait bounded by `gameServicesDisposeWaitMs`); repeated
+  * calls share that wait. Afterwards nothing it holds talks to the backend
+  * or the store for its player: a purchase answers `failed` with the
+  * retryable diagnostic `gameServicesRuntimeDisposedCode` before any store
+  * UI, a rewarded-ad claim answers `unavailable` before any ad, recovery
+  * runs nothing, Restore Purchases and leaderboard submissions reject with
+  * `GameServicesRuntimeClosedError`, and every backend request (account
+  * deletion included) is refused before its headers are resolved. The
+  * journal keeps every record; a runtime created later for the same player
+  * resumes them. A disabled runtime has nothing to close.
+  */
+  dispose(): Promise<void>;
 }
+/**
+* How long `dispose()` waits for a purchase whose store sheet is open to
+* journal its answer, and then for the reconciler to stop: 3 minutes, past
+* Google Play's own wait for a purchase result.
+*/
+export declare const gameServicesDisposeWaitMs: number;
+export { gameServicesPlayerChangedCode, gameServicesRuntimeDisposedCode, GameServicesRuntimeClosedError, gameServicesSessionRequiredCode, type GameServicesRuntimeClosedCode, } from './request-headers.js';
 interface CreateGameServicesRuntimeCommonInput {
   readonly gateway: PlatformGateway;
   readonly playerId: string;
@@ -47,6 +71,52 @@ interface CreateGameServicesRuntimeCommonInput {
   * product catalog's `platformProductIds` for the gateway target.
   */
   readonly commerceProducts?: readonly CommerceReconcilerProduct[];
+  /**
+  * The player the session's credentials belong to right now, read
+  * synchronously: pass it whenever `getHeaders` (or the store account
+  * binding) follows a session that can change player within the run. It is
+  * checked before every backend request and again once its headers are
+  * resolved (no request leaves with another player's credentials), and by
+  * the commerce reconciler before it journals, verifies, restores, or
+  * finishes anything and right before a store UI opens. The store
+  * provider resolves its account binding after that last check, so the
+  * binding resolver must follow this player too (bind nothing for anyone
+  * else) for a purchase never to be journaled here and bound to another
+  * account; a binding refused while the session changed stays retryable.
+  * Another
+  * player closes the runtime for good, as `dispose()` does, with
+  * `gameServicesPlayerChangedCode`; no player refuses with
+  * `gameServicesSessionRequiredCode` and leaves the runtime open. Refusals
+  * are retryable and end no record, so a purchase of this player is never
+  * verified with another player's session (which a backend answers with a
+  * permanent account-mismatch rejection) and is resumed by a runtime for
+  * this player later. A custom `httpTransport` must send only the headers
+  * the runtime resolved for each request.
+  */
+  readonly sessionPlayerId?: () => string | undefined;
+  /**
+  * This player's store account binding, derived from `playerId` the way
+  * the store provider binds the player's new purchases (Google Play's
+  * obfuscated account id, StoreKit's app account token). With it the
+  * commerce reconciler leaves a store purchase bound to another account
+  * alone instead of journaling and verifying it for this player (a backend
+  * rejects that for good as an account mismatch): after a restart as
+  * another player, Google Play still lists the previous player's
+  * unacknowledged purchases. The player's Restore Purchases still takes a
+  * durable bound to another account (restore sharing). Derive it from
+  * `playerId`, not from the live session. Pass it only for a store whose
+  * purchases carry this kind of binding: answering `undefined` leaves every
+  * bound purchase alone, which is meant only while the binding is briefly
+  * unreadable. Omitted, nothing is compared (for example Microsoft Store,
+  * whose purchases carry their own claimed scope).
+  */
+  readonly commerceAccountBinding?: CreateCommerceReconcilerInput['accountBinding'];
+  /**
+  * The reconciler's `staleLaunchedAfterMs`: how long a `launched` purchase
+  * with no store purchase keeps serializing its product before it ends
+  * `failed`. Defaults to 24 hours; `Infinity` never expires it.
+  */
+  readonly commerceStaleLaunchedAfterMs?: number;
 }
 export type CreateGameServicesRuntimeInput = CreateGameServicesRuntimeCommonInput & ({
   readonly transport?: 'http';
@@ -60,6 +130,17 @@ export declare function createGameServicesRuntime(input: CreateGameServicesRunti
 export declare function resolveGameServicesLedgerTarget(target: PlatformTarget | string): GameServicesLedgerTarget | null;
 export declare function resolveGameServicesAuthorityMode(profile: string): GameServicesAuthorityMode;
 export declare function resolveGameServicesTransport(transport: string | undefined): 'http' | 'orpc';
+export { isHostedGameServicesPath };
+/**
+* Resolve a hosted browser's clean /api ingress before constructing absolute-URL
+* clients. No ambient DOM access: composition roots supply the actual page origin
+* and gateway target. Unresolved/invalid inputs remain invalid for the runtime's
+* fail-closed authority check; this helper never supplies a fallback backend.
+*/
+export declare function resolveGameServicesBaseUrl(baseUrl: string | undefined, context: {
+  readonly target: PlatformTarget | string;
+  readonly pageOrigin?: string;
+}): string | undefined;
 /**
 * Whether a game-services URL may carry a session's credentials in a
 * production build: an absolute https URL with no credentials and a public
@@ -67,4 +148,3 @@ export declare function resolveGameServicesTransport(transport: string | undefin
 * notifications client's starter wiring uses it too.
 */
 export declare function isPublicGameServicesUrl(baseUrl: string): boolean;
-export {};