@mpgd/game-services 0.31.0 → 0.33.0

package/README.md

@@ -314,9 +314,14 @@ purchases (Google Play's obfuscated account id, StoreKit's app account
 token). The reconciler then leaves a store purchase bound to another account
 alone (reported, never journaled or verified for this player). After a
 restart as another player, Google Play still lists the previous player's
-unacknowledged purchases; sending one with this player's session would be
-rejected for good, and its derived key would then block the other player's
-own recovery. The player's explicit Restore Purchases still takes a durable
+unacknowledged purchases; sending one with this player's session only gets
+the backend's another-account answer (409 `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`),
+which parks the record without a grant. The reconciler parks it whenever the
+backend is reached anyway (no binding input, an older client's record): the
+record stays `verifying`, is never resent automatically, and leaves its
+derived key to the purchase's own account on the install
+([another account's purchase](../../docs/GAME_SERVICES_BACKEND.md#another-accounts-purchase)).
+The player's explicit Restore Purchases still takes a durable
 bound to another account (restore sharing). StoreKit's provider already
 filters transactions by app account token the same way.
 

package/dist/another-account.d.ts

@@ -0,0 +1,65 @@
+/**
+* Another account's purchase (RFC "Another account's purchase"): a verify
+* whose store binding (Google Play `obfuscatedAccountId` /
+* `obfuscatedProfileId`, StoreKit `appAccountToken`) names another account
+* than the requesting player's. It is not granted, nothing is recorded, and
+* the store transaction stays recoverable by the account it is bound to, so
+* the backend answers it as a retryable error instead of a `rejected`
+* receipt: HTTP 409 `{ error: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT', reason }`,
+* or the oRPC error code `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` (status 409,
+* `data.reason`). A client from before this answer treats it as a transport
+* failure and keeps the record open; the commerce reconciler parks it.
+*
+* No schema, DOM, or transport dependencies: the server, the client, and a
+* game server wrapping the reference verifiers share these helpers.
+*/
+/** The error code of the answer, on HTTP (`error`) and oRPC (`code`) alike. */
+export declare const purchaseBoundToAnotherAccountCode: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT';
+/** The HTTP status of the answer: the purchase conflicts with the requesting player's account. */
+export declare const purchaseBoundToAnotherAccountStatus = 409;
+/**
+* The binding mismatch reasons of the reference verifiers. Each one means
+* the purchase carries another account's binding: a purchase without one
+* answers `GOOGLE_PLAY_ACCOUNT_ID_MISSING`, `GOOGLE_PLAY_PROFILE_ID_MISSING`,
+* `GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED`, or `APP_STORE_ACCOUNT_TOKEN_MISSING`
+* instead, which stay `rejected`. A backend from before this answer, or a game
+* server that maps every refusal to `rejected`, still answers these reasons
+* as a `rejected` receipt; the commerce reconciler reads that receipt as this
+* answer too.
+*/
+export declare const storeAccountMismatchReasons: readonly ["GOOGLE_PLAY_ACCOUNT_MISMATCH", "GOOGLE_PLAY_PROFILE_MISMATCH", "APP_STORE_ACCOUNT_TOKEN_MISMATCH"];
+export type StoreAccountMismatchReason = (typeof storeAccountMismatchReasons)[number];
+export declare function isStoreAccountMismatchReason(reason: unknown): reason is StoreAccountMismatchReason;
+/**
+* Thrown by the reference backend's `verifyPurchase` for another account's
+* purchase; the HTTP handler and the oRPC router turn it into the 409
+* answer. A game server that calls `backend.purchases.verifyPurchase` itself
+* answers it the same way (see `docs/GAME_SERVICES_BACKEND.md`). Its
+* `message` starts with the code, so a Workers RPC caller whose runtime
+* keeps only the message still recognizes it.
+*/
+export declare class GameServicesPurchaseBoundToAnotherAccountError extends Error {
+  readonly code: "PURCHASE_BOUND_TO_ANOTHER_ACCOUNT";
+  readonly status = 409;
+  /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+  readonly reason: string;
+  constructor(reason: string);
+}
+/** The body of the HTTP 409 answer. */
+export interface PurchaseBoundToAnotherAccountBody {
+  readonly error: typeof purchaseBoundToAnotherAccountCode;
+  readonly reason: string;
+}
+export declare function createPurchaseBoundToAnotherAccountBody(reason: string): PurchaseBoundToAnotherAccountBody;
+/**
+* The binding mismatch of an error that carries the answer, or undefined for
+* any other error. It reads every shape a client meets: the thrown
+* `GameServicesPurchaseBoundToAnotherAccountError` (an in-process backend),
+* an oRPC error (`code`, `data.reason`), a `GameServicesBackendError` of the
+* HTTP transport (`status` 409 and `body.error`), and an error rebuilt from
+* its message alone (a Workers RPC caller without enhanced error
+* serialization).
+*/
+export declare function readPurchaseBoundToAnotherAccount(error: unknown): {
+  readonly reason: string;
+} | undefined;

package/dist/another-account.js

@@ -0,0 +1,107 @@
+/**
+ * Another account's purchase (RFC "Another account's purchase"): a verify
+ * whose store binding (Google Play `obfuscatedAccountId` /
+ * `obfuscatedProfileId`, StoreKit `appAccountToken`) names another account
+ * than the requesting player's. It is not granted, nothing is recorded, and
+ * the store transaction stays recoverable by the account it is bound to, so
+ * the backend answers it as a retryable error instead of a `rejected`
+ * receipt: HTTP 409 `{ error: 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT', reason }`,
+ * or the oRPC error code `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` (status 409,
+ * `data.reason`). A client from before this answer treats it as a transport
+ * failure and keeps the record open; the commerce reconciler parks it.
+ *
+ * No schema, DOM, or transport dependencies: the server, the client, and a
+ * game server wrapping the reference verifiers share these helpers.
+ */
+/** The error code of the answer, on HTTP (`error`) and oRPC (`code`) alike. */
+export const purchaseBoundToAnotherAccountCode = 'PURCHASE_BOUND_TO_ANOTHER_ACCOUNT';
+/** The HTTP status of the answer: the purchase conflicts with the requesting player's account. */
+export const purchaseBoundToAnotherAccountStatus = 409;
+/**
+ * The binding mismatch reasons of the reference verifiers. Each one means
+ * the purchase carries another account's binding: a purchase without one
+ * answers `GOOGLE_PLAY_ACCOUNT_ID_MISSING`, `GOOGLE_PLAY_PROFILE_ID_MISSING`,
+ * `GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED`, or `APP_STORE_ACCOUNT_TOKEN_MISSING`
+ * instead, which stay `rejected`. A backend from before this answer, or a game
+ * server that maps every refusal to `rejected`, still answers these reasons
+ * as a `rejected` receipt; the commerce reconciler reads that receipt as this
+ * answer too.
+ */
+export const storeAccountMismatchReasons = Object.freeze([
+    'GOOGLE_PLAY_ACCOUNT_MISMATCH',
+    'GOOGLE_PLAY_PROFILE_MISMATCH',
+    'APP_STORE_ACCOUNT_TOKEN_MISMATCH',
+]);
+export function isStoreAccountMismatchReason(reason) {
+    return typeof reason === 'string'
+        && storeAccountMismatchReasons.includes(reason);
+}
+const reasonPattern = /^[A-Za-z0-9_.:-]{1,128}$/u;
+function readReason(value) {
+    return typeof value === 'string' && reasonPattern.test(value) ? value : undefined;
+}
+/**
+ * Thrown by the reference backend's `verifyPurchase` for another account's
+ * purchase; the HTTP handler and the oRPC router turn it into the 409
+ * answer. A game server that calls `backend.purchases.verifyPurchase` itself
+ * answers it the same way (see `docs/GAME_SERVICES_BACKEND.md`). Its
+ * `message` starts with the code, so a Workers RPC caller whose runtime
+ * keeps only the message still recognizes it.
+ */
+export class GameServicesPurchaseBoundToAnotherAccountError extends Error {
+    code = purchaseBoundToAnotherAccountCode;
+    status = purchaseBoundToAnotherAccountStatus;
+    /** The store's binding mismatch, for example `GOOGLE_PLAY_ACCOUNT_MISMATCH`. */
+    reason;
+    constructor(reason) {
+        const checked = readReason(reason) ?? purchaseBoundToAnotherAccountCode;
+        super(`${purchaseBoundToAnotherAccountCode}: ${checked}`);
+        this.name = 'GameServicesPurchaseBoundToAnotherAccountError';
+        this.reason = checked;
+    }
+}
+export function createPurchaseBoundToAnotherAccountBody(reason) {
+    return {
+        error: purchaseBoundToAnotherAccountCode,
+        reason: readReason(reason) ?? purchaseBoundToAnotherAccountCode,
+    };
+}
+/**
+ * The binding mismatch of an error that carries the answer, or undefined for
+ * any other error. It reads every shape a client meets: the thrown
+ * `GameServicesPurchaseBoundToAnotherAccountError` (an in-process backend),
+ * an oRPC error (`code`, `data.reason`), a `GameServicesBackendError` of the
+ * HTTP transport (`status` 409 and `body.error`), and an error rebuilt from
+ * its message alone (a Workers RPC caller without enhanced error
+ * serialization).
+ */
+export function readPurchaseBoundToAnotherAccount(error) {
+    if (typeof error !== 'object' || error === null) {
+        return undefined;
+    }
+    const candidate = error;
+    const fallback = { reason: purchaseBoundToAnotherAccountCode };
+    if (candidate.code === purchaseBoundToAnotherAccountCode) {
+        const data = candidate.data;
+        const dataReason = typeof data === 'object' && data !== null
+            ? readReason(data.reason)
+            : undefined;
+        const reason = readReason(candidate.reason) ?? dataReason;
+        return reason === undefined ? fallback : { reason };
+    }
+    const body = candidate.body;
+    if (candidate.status === purchaseBoundToAnotherAccountStatus
+        && typeof body === 'object'
+        && body !== null
+        && body.error === purchaseBoundToAnotherAccountCode) {
+        const reason = readReason(body.reason);
+        return reason === undefined ? fallback : { reason };
+    }
+    const message = candidate.message;
+    const prefix = `${purchaseBoundToAnotherAccountCode}: `;
+    if (typeof message === 'string' && message.startsWith(prefix)) {
+        const reason = readReason(message.slice(prefix.length));
+        return reason === undefined ? fallback : { reason };
+    }
+    return undefined;
+}

package/dist/app-store-server-notifications.d.ts

@@ -1,4 +1,4 @@
-import { type AppStoreEnvironment, type AppStoreTransactionPayload } from './app-store-verifier.js';
+import { type AppStoreEnvironment, type AppStoreRevocationRecorder, type AppStoreTransactionPayload } from './app-store-verifier.js';
 import type { GameServicesStore } from './server.js';
 /**
 * App Store Server Notifications V2 for one-time purchases: the store-side
@@ -70,6 +70,15 @@ export interface HandleAppStoreServerNotificationInput {
   * most `maxUnmatchedRefundRetryMs` (6 hours).
   */
   readonly unmatchedRefundRetryMs?: number;
+  /**
+  * Records every `REFUND` and `REVOKE` of the customer's own one-time
+  * purchase, before the ledger is read, whether or not a grant exists yet.
+  * Required in practice for a verifier in `offline-only` mode, which reads
+  * the same registry: a refund that arrives before the first grant leaves
+  * no grant to reverse, and the client may still hold a JWS signed before
+  * it. A recorder outage (`AppStoreDependencyUnavailableError`) is `retry`.
+  */
+  readonly revocations?: AppStoreRevocationRecorder;
 }
 /** Default of `unmatchedRefundRetryMs`. */
 export declare const defaultUnmatchedRefundRetryMs: number;
@@ -135,6 +144,9 @@ export type AppStoreServerNotificationOutcome =
 export declare const maxAppStoreServerNotificationBytes: number;
 /**
 * Verifies one App Store Server Notification and applies it to the ledger.
+* With `revocations`, every `REFUND` and `REVOKE` of the customer's own
+* one-time purchase is recorded there first, so an offline-only purchase
+* verifier refuses a JWS signed before it even when no grant existed yet.
 * `REFUND` and `REVOKE` for a granted one-time purchase append one `revoke`
 * entry, keyed by the notification's `notificationUUID` so a redelivery
 * answers the first entry. Every other type, a transaction this ledger never
@@ -149,7 +161,8 @@ export declare const maxAppStoreServerNotificationBytes: number;
 * A refund for a grant this ledger does not hold is `retry` while it is
 * recent (`unmatchedRefundRetryMs`, a purchase may be committing a grant it
 * verified before the refund) and `ignored` after; a purchase request that
-* starts after the refund is refused by the verifier's Server API mode.
+* starts after the refund is refused by the verifier's Server API mode, or,
+* in offline-only mode, by the `revocations` record.
 * A thrown error (a store outage, an abort) is not an outcome: the host must
 * answer it with a 5xx so Apple redelivers.
 */

package/dist/app-store-server-notifications.js

@@ -1,5 +1,6 @@
 import { findEntitlementRevocationsChunked, findPurchaseGrantByEvidenceVerificationId, revokeEntitlementGrant, } from './commerce-ledger.js';
-import { AppStoreDependencyUnavailableError, createAppStoreVerificationId, } from './app-store-verifier.js';
+import { createAppStoreGrantVerificationId } from './app-store-verification-id.js';
+import { AppStoreDependencyUnavailableError, } from './app-store-verifier.js';
 /** Default of `unmatchedRefundRetryMs`. */
 export const defaultUnmatchedRefundRetryMs = 60 * 60 * 1000;
 /** Upper bound of `unmatchedRefundRetryMs`. */
@@ -19,6 +20,9 @@ const revocationReasons = {
 };
 /**
  * Verifies one App Store Server Notification and applies it to the ledger.
+ * With `revocations`, every `REFUND` and `REVOKE` of the customer's own
+ * one-time purchase is recorded there first, so an offline-only purchase
+ * verifier refuses a JWS signed before it even when no grant existed yet.
  * `REFUND` and `REVOKE` for a granted one-time purchase append one `revoke`
  * entry, keyed by the notification's `notificationUUID` so a redelivery
  * answers the first entry. Every other type, a transaction this ledger never
@@ -33,7 +37,8 @@ const revocationReasons = {
  * A refund for a grant this ledger does not hold is `retry` while it is
  * recent (`unmatchedRefundRetryMs`, a purchase may be committing a grant it
  * verified before the refund) and `ignored` after; a purchase request that
- * starts after the refund is refused by the verifier's Server API mode.
+ * starts after the refund is refused by the verifier's Server API mode, or,
+ * in offline-only mode, by the `revocations` record.
  * A thrown error (a store outage, an abort) is not an outcome: the host must
  * answer it with a 5xx so Apple redelivers.
  */
@@ -102,14 +107,43 @@ export async function handleAppStoreServerNotification(input) {
     }
     // The grant's identity is the one the purchase verifier recorded:
     // non-consumables by their original transaction, consumables by their own.
-    const grantVerificationId = createAppStoreVerificationId({
-        environment: transaction.environment,
-        bundleId: transaction.bundleId,
-        transactionId: transaction.type === 'Non-Consumable'
-            ? transaction.originalTransactionId
-            : transaction.transactionId,
-    });
+    const grantVerificationId = createAppStoreGrantVerificationId(transaction);
     const now = input.now ?? (() => new Date().toISOString());
+    if (reason !== undefined && input.revocations !== undefined) {
+        // Recorded before the ledger is read, so a grant that does not exist
+        // yet is refused by an offline-only verifier instead of only retried.
+        try {
+            await input.revocations.recordRevocation({
+                record: {
+                    verificationId: grantVerificationId,
+                    environment: transaction.environment,
+                    bundleId: transaction.bundleId,
+                    transactionId: transaction.transactionId,
+                    originalTransactionId: transaction.originalTransactionId,
+                    productId: transaction.productId,
+                    reason,
+                    // Apple's signed dates, never the handling time: a redelivery of
+                    // an undated refund must not move the cutoff past a reversal. An
+                    // unrepresentable date is kept unparseable, which refuses every JWS.
+                    revokedAt: readTimestamp(transaction.revocationDate ?? notification.signedDate)
+                        ?? 'unparseable',
+                    notificationType: notification.notificationType,
+                    notificationUUID,
+                },
+                signal: input.signal,
+            });
+        }
+        catch (error) {
+            if (error instanceof AppStoreDependencyUnavailableError) {
+                return {
+                    status: 'retry',
+                    reason: 'APP_STORE_REVOCATION_REGISTRY_UNAVAILABLE',
+                    notificationUUID,
+                };
+            }
+            throw error;
+        }
+    }
     const grant = await findPurchaseGrantByEvidenceVerificationId(input.store, grantVerificationId);
     if (grant === undefined || grant.payload.target !== 'ios') {
         if (grant === undefined

package/dist/app-store-verification-id.d.ts

@@ -0,0 +1,25 @@
+/**
+* The App Store grant identity, shared by the purchase verifier (the
+* verification id its grants record) and the server notification handler
+* (the grant it reverses and the revocation it records): both must derive
+* the same key from a transaction. Internal: the public names are
+* re-exported from `app-store-verifier`.
+*/
+export declare function createAppStoreVerificationId(input: {
+  readonly environment: 'Production' | 'Sandbox';
+  readonly bundleId: string;
+  readonly transactionId: string;
+}): string;
+/**
+* The verification id of the grant a transaction makes: a non-consumable by
+* its original transaction (restores and re-downloads share one grant), any
+* other type by its own transaction.
+*/
+export declare function createAppStoreGrantVerificationId(transaction: {
+  readonly environment: 'Production' | 'Sandbox';
+  readonly bundleId: string;
+  readonly type: string;
+  readonly transactionId: string;
+  readonly originalTransactionId: string;
+}): string;
+export declare function encodeVerificationIdSegment(value: string): string;

package/dist/app-store-verification-id.js

@@ -0,0 +1,32 @@
+/**
+ * The App Store grant identity, shared by the purchase verifier (the
+ * verification id its grants record) and the server notification handler
+ * (the grant it reverses and the revocation it records): both must derive
+ * the same key from a transaction. Internal: the public names are
+ * re-exported from `app-store-verifier`.
+ */
+export function createAppStoreVerificationId(input) {
+    return [
+        'app-store',
+        input.environment,
+        input.bundleId,
+        input.transactionId,
+    ].map(encodeVerificationIdSegment).join(':');
+}
+/**
+ * The verification id of the grant a transaction makes: a non-consumable by
+ * its original transaction (restores and re-downloads share one grant), any
+ * other type by its own transaction.
+ */
+export function createAppStoreGrantVerificationId(transaction) {
+    return createAppStoreVerificationId({
+        environment: transaction.environment,
+        bundleId: transaction.bundleId,
+        transactionId: transaction.type === 'Non-Consumable'
+            ? transaction.originalTransactionId
+            : transaction.transactionId,
+    });
+}
+export function encodeVerificationIdSegment(value) {
+    return `${value.length}:${encodeURIComponent(value)}`;
+}

package/dist/app-store-verifier.d.ts

@@ -1,5 +1,6 @@
 import type { PlatformEvidenceEnvelope } from '@mpgd/platform';
 import type { GameServicesEvidenceVerifier } from './evidence-verification.js';
+import { createAppStoreVerificationId } from './app-store-verification-id.js';
 export type AppStoreEnvironment = 'Production' | 'Sandbox';
 export declare const appStoreServerApiBaseUrls: Readonly<{
   readonly Production: 'https://api.storekit.apple.com';
@@ -85,10 +86,17 @@ export interface CreateAppStoreEvidenceVerifierOptions {
   * establish authenticity and bind the transaction id, and the grant decision
   * is then taken on the transaction's current status fetched from the App
   * Store Server API (`Get Transaction Info`), so a refund that happened after
-  * the client cached its JWS is seen. `{ mode: 'offline-only', maxSignedAgeMs }`
-  * decides on the client JWS alone and is only for deployments without Server
-  * API access: a JWS is a snapshot, so a transaction refunded after it was
-  * signed is accepted until `signedDate` falls out of the window. `{ mode:
+  * the client cached its JWS is seen. `{ mode: 'offline-only', maxSignedAgeMs,
+  * revocations }` decides on the client JWS and is only for deployments
+  * without Server API access: a JWS is a snapshot, so a transaction refunded
+  * after it was signed still reads as purchased. Before a grant it therefore
+  * asks `revocations`, the store of refunds and revocations App Store Server
+  * Notifications recorded (`handleAppStoreServerNotification({ revocations })`),
+  * and refuses a JWS signed at or before a revocation found there (plus
+  * `clockSkewMs`) with `APP_STORE_TRANSACTION_REVOKED`; a JWS signed later
+  * without a `revocationDate` shows a refund Apple reversed and passes. A
+  * refund Apple has not notified yet is still accepted until `signedDate`
+  * falls out of the window; the notification then reverses the grant. `{ mode:
   * 'ignore' }` fetches by id for every request.
   */
   readonly signedTransactionEvidence?: AppStoreSignedTransactionEvidencePolicy;
@@ -129,7 +137,93 @@ export type AppStoreSignedTransactionEvidencePolicy = {
   readonly mode: 'offline-only';
   /** Maximum age of the JWS `signedDate` at verification time; older evidence is rejected. */
   readonly maxSignedAgeMs: number;
+  /**
+  * Required. The revocations this backend learned from App Store Server
+  * Notifications, read before every offline-only grant: a client can keep
+  * a JWS signed before a refund, and a refund that reached the backend
+  * before the first grant has no ledger grant to reverse. A record
+  * refuses only a JWS signed at or before its `revokedAt` plus
+  * `clockSkewMs`, so a refund Apple later reversed grants again from a
+  * fresh JWS. It must read
+  * the durable store the notification handler's `revocations` recorder
+  * writes, across every instance that verifies purchases.
+  */
+  readonly revocations: AppStoreRevocationLookup;
 };
+/** Why Apple ended a one-time purchase: `REFUND` is `refund`, `REVOKE` is `voided`. */
+export type AppStoreRevocationReason = 'refund' | 'voided';
+/**
+* A refund or revocation of a one-time purchase, recorded from a verified App
+* Store Server Notification whether or not the ledger holds a grant for it.
+*/
+export interface AppStoreRevocationRecord {
+  /**
+  * The grant identity the purchase verifier records
+  * (`createAppStoreVerificationId`): the original transaction id of a
+  * non-consumable, the transaction id of a consumable. The lookup key.
+  */
+  readonly verificationId: string;
+  readonly environment: AppStoreEnvironment;
+  readonly bundleId: string;
+  readonly transactionId: string;
+  readonly originalTransactionId: string;
+  readonly productId: string;
+  readonly reason: AppStoreRevocationReason;
+  /**
+  * When Apple revoked it: the transaction's `revocationDate`, else the
+  * notification's `signedDate`. Both are Apple's signed values, so a
+  * redelivery of the same notification records the same time. A
+  * record may be dropped once `revokedAt` is older than the verifier's
+  * `maxSignedAgeMs` plus `clockSkewMs`: every JWS the record refuses
+  * (signed at or before `revokedAt` plus `clockSkewMs`) is then stale.
+  */
+  readonly revokedAt: string;
+  readonly notificationType: string;
+  readonly notificationUUID: string;
+}
+/**
+* Reads recorded revocations for the offline-only verifier. Answer the record
+* for `verificationId`, or `undefined` when none is recorded. Throw
+* `AppStoreDependencyUnavailableError` only for a transient storage outage
+* (the purchase stays `pending`); any other error propagates.
+*/
+export interface AppStoreRevocationLookup {
+  findRevocation(input: {
+    readonly verificationId: string;
+    readonly environment: AppStoreEnvironment;
+    readonly bundleId: string;
+    readonly transactionId: string;
+    readonly originalTransactionId: string;
+    readonly signal: AbortSignal;
+  }): Promise<AppStoreRevocationRecord | undefined>;
+}
+/**
+* Durably records a revocation, keeping per `verificationId` the record with
+* the latest `revokedAt`: a purchase can be refunded, reversed, and revoked
+* again, and the lookup must refuse every JWS signed before the latest
+* revocation. A record whose `revokedAt` does not parse counts as the
+* latest. A record no later than the kept one (a redelivery, or an older
+* notification arriving late) keeps it and answers `alreadyRecorded: true`.
+* Throw `AppStoreDependencyUnavailableError` only for a transient storage
+* outage (the notification is answered `retry`, so Apple redelivers).
+*/
+export interface AppStoreRevocationRecorder {
+  recordRevocation(input: {
+    readonly record: AppStoreRevocationRecord;
+    readonly signal: AbortSignal;
+  }): Promise<{
+    readonly alreadyRecorded: boolean;
+  }>;
+}
+export interface AppStoreRevocationRegistry extends AppStoreRevocationLookup, AppStoreRevocationRecorder {
+}
+/**
+* A process-local `AppStoreRevocationRegistry` for tests and single-process
+* hosts. It forgets everything on restart and is not shared between
+* instances (a Worker isolate is one), so a deployment that verifies
+* purchases offline needs a durable registry of its own.
+*/
+export declare function createInMemoryAppStoreRevocationRegistry(): AppStoreRevocationRegistry;
 /**
 * Evidence schema of a commerce v2 App Store purchase (RFC B3): the payload's
 * `signedTransaction` is the StoreKit-verified JWS the client received. The
@@ -156,11 +250,7 @@ export type AppStoreFetch = (url: string, init: {
 }) => Promise<AppStoreFetchResponse>;
 export declare function createAppStoreServerApiClient(options: CreateAppStoreServerApiClientOptions): AppStoreServerApiClient;
 export declare function createAppStoreGameServicesEvidenceVerifier(options: CreateAppStoreEvidenceVerifierOptions): GameServicesEvidenceVerifier;
-export declare function createAppStoreVerificationId(input: {
-  readonly environment: AppStoreEnvironment;
-  readonly bundleId: string;
-  readonly transactionId: string;
-}): string;
+export { createAppStoreVerificationId };
 /** Identify IDs emitted by this verifier without duplicating its encoding format. */
 export declare function isAppStoreVerificationId(verificationId: string): boolean;
 export declare function assertAppStoreTransactionPayload(input: unknown): AppStoreTransactionPayload;