@mpgd/game-services 0.31.0 → 0.33.0

package/dist/commerce-reconciler.js

@@ -1,4 +1,5 @@
 import { assertCommercePurchaseTransition, assertRequestPurchaseSupported, CommerceError, commerceErrorInfoOf, createDerivedPurchaseIdempotencyKey, isTerminalCommercePurchaseState, summarizeCommercePurchaseState, } from '@mpgd/platform/commerce';
+import { isStoreAccountMismatchReason, readPurchaseBoundToAnotherAccount, } from './another-account.js';
 import { compareCommerceServiceCapabilities, } from './commerce-evidence-registry.js';
 import { chunkLedgerEntryIds } from './commerce-ledger.js';
 /**
@@ -37,13 +38,65 @@ export function isCommercePurchaseOperationRecord(record) {
         && record !== null
         && record.kind === commercePurchaseOperationKind;
 }
-/** Summary status of a record: the RFC mapping, with `revoked` kept distinct. */
+/**
+ * Summary status of a record: the RFC mapping, with `revoked` kept distinct.
+ * A record parked as another account's purchase is `rejected` for its
+ * player: nothing was granted to it, and nothing will be.
+ */
 export function summarizeCommercePurchaseOperation(record) {
     if (isRetryableBeforeLaunch(record)) {
         return 'failed';
     }
+    if (isParkedForAnotherAccount(record)) {
+        return 'rejected';
+    }
     return summarizeCommercePurchaseState(record.state);
 }
+/** A `verifying` record the backend answered as another account's purchase. */
+export function isParkedForAnotherAccount(record) {
+    return record.state === 'verifying' && record.anotherAccount !== undefined;
+}
+/**
+ * Whether another player's record under a shared key leaves the key to this
+ * player: parked as another account's purchase, or (a journal written before
+ * that answer) `rejected` with a store binding mismatch reason. Either way
+ * the purchase was never its player's, and nothing on the backend holds it.
+ */
+function releasesSharedKey(record) {
+    return isParkedForAnotherAccount(record)
+        || (record.state === 'rejected'
+            && record.response !== undefined
+            && !record.response.verified
+            && isStoreAccountMismatchReason(record.response.reason));
+}
+/**
+ * Backend refusals that answer for a revoked purchase: the App Store verifier
+ * read the refund (`APP_STORE_TRANSACTION_REVOKED`), or the ledger had
+ * already reversed the grant this request names (`LEDGER_GRANT_REVERSED`).
+ */
+export const commerceRevokedRejectionReasons = new Set([
+    'APP_STORE_TRANSACTION_REVOKED',
+    'LEDGER_GRANT_REVERSED',
+]);
+/**
+ * A record the backend answered for a refund with no grant standing: its
+ * grant reversed by the ledger (`revoked`), or the purchase refused as
+ * revoked (`rejected` with a reason in `commerceRevokedRejectionReasons`). A
+ * store transaction of such a record that the store reports revoked may be
+ * finished without a grant (`FinishTransactionInput.revoked`). A refusal for
+ * any other reason keeps the transaction unfinished.
+ */
+function answeredWithoutGrant(record) {
+    if (record.state === 'revoked') {
+        return true;
+    }
+    const response = record.response;
+    return record.state === 'rejected'
+        && response !== undefined
+        && !response.verified
+        && typeof response.reason === 'string'
+        && commerceRevokedRejectionReasons.has(response.reason);
+}
 function isRetryableBeforeLaunch(record) {
     return record.state === 'requested' && record.error?.retryable === true
         && record.purchase === undefined && record.request === undefined;
@@ -483,6 +536,27 @@ export function createCommerceReconciler(input) {
         retryAt.delete(record.idempotencyKey);
         return next;
     };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase, or (`marker` undefined) lets this player's Restore Purchases
+     * send it again. The state stays `verifying`: the record is not ended for
+     * the store transaction, which its account can still recover.
+     */
+    const reviseAnotherAccount = async (record, marker, patch = {}) => {
+        const { anotherAccount: _previous, ...rest } = record;
+        const next = {
+            ...rest,
+            ...patch,
+            ...(marker === undefined ? {} : { anotherAccount: marker }),
+            state: record.state,
+            revision: record.revision + 1,
+            updatedAt: now(),
+        };
+        await journal.replace(record.revision, next);
+        remember(next);
+        retryAt.delete(record.idempotencyKey);
+        return next;
+    };
     /**
      * Where this player's record of an idempotency key lives, and what that key
      * holds now. A record is under the shared key, or under this player's
@@ -496,6 +570,11 @@ export function createCommerceReconciler(input) {
      *   the slot holds, and `recordIn` refuses it.
      * - `probeFree`: when the shared key is free, a record under the scoped key
      *   still answers (retention may have dropped the other player's record).
+     *
+     * Another player's record that was answered as another account's purchase
+     * (`releasesSharedKey`) is never this player's to refuse: the scoped key is
+     * the slot for any kind, as with `takeHeld`, so the purchase's own account
+     * recovers it on the same install.
      */
     const resolveSlot = async (idempotencyKey, options = {}) => {
         const sharedKey = createCommercePurchaseOperationKey(target, idempotencyKey);
@@ -503,6 +582,7 @@ export function createCommerceReconciler(input) {
         const heldByAnother = shared !== undefined && heldByAnotherPlayer(shared);
         const probeScoped = heldByAnother
             ? options.takeHeld === true
+                || (isCommercePurchaseOperationRecord(shared) && releasesSharedKey(shared))
             : shared === undefined && options.probeFree === true;
         if (!probeScoped) {
             return { key: sharedKey, found: shared, heldByAnother };
@@ -532,9 +612,15 @@ export function createCommerceReconciler(input) {
      */
     const readRecord = async (idempotencyKey) => recordIn(await resolveSlot(idempotencyKey), idempotencyKey);
     const ownedRecordsOf = (listed) => listed.filter((record) => isCommercePurchaseOperationRecord(record) && ownsRecord(record));
+    /**
+     * The player's open records. One parked as another account's purchase is
+     * kept in memory, so a store report matches it without the journal's
+     * transaction index, but is not the player's to recover.
+     */
     const listRecoverable = async () => ownedRecordsOf(await journal.listRecoverable(playerId))
         .filter((record) => !isTerminalCommercePurchaseState(record.state))
-        .map(remember);
+        .map(remember)
+        .filter((record) => !isParkedForAnotherAccount(record));
     const listGranted = async () => {
         const listed = journal.listGranted === undefined
             ? []
@@ -717,6 +803,252 @@ export function createCommerceReconciler(input) {
             fail('finish', error, record.idempotencyKey);
         }
     };
+    /**
+     * Consumables a `client`-finish store reported revoked this session (the
+     * App Store refunded them while they were unfinished, so StoreKit keeps
+     * them unfinished and redelivers them until `finish()`), by transaction
+     * id, with their record's idempotency key, or `undefined` for one this
+     * player holds no record of. `finishRevokedReported` finishes one, without
+     * any grant, once its record holds the backend's answer (`answeredWithoutGrant`),
+     * or at once without a record. Until then it waits: a grant the ledger
+     * still holds keeps the transaction unfinished, as before.
+     */
+    const revokedReports = new Map();
+    /** Transactions this session already asked the store to finish as revoked. */
+    const revokedFinishAsked = new Set();
+    /**
+     * Notes a store report of a revoked purchase whose record this player
+     * holds. Only a `client`-finish consumable on a provider that declares
+     * `acceptsRevokedFinish` is noted: any other store, kind, or provider keeps
+     * the revoked report as a no-op, and only the ledger moves a record to
+     * `revoked` (step 5).
+     */
+    const revokedFinishApplies = (kind, transactionId) => kind === 'consumable'
+        && capabilities?.lifecycle.finish === 'client'
+        && provider.finishTransaction !== undefined
+        && provider.acceptsRevokedFinish === true
+        && !revokedFinishAsked.has(transactionId);
+    const noteRevoked = (record, purchase, kind) => {
+        if (record.purchase === undefined
+            || !samePurchase(record.purchase, purchase)
+            // A `finished` record's transaction was finished: the report is the
+            // store's refund notice of a finished consumable (`Transaction.updates`),
+            // with nothing left unfinished. Step 5 revokes the record if the
+            // ledger reversed it; a later report of a still-unfinished one is
+            // noted then.
+            || record.state === 'finished'
+            || !revokedFinishApplies(record.productKind ?? kind, record.purchase.transactionId)) {
+            return;
+        }
+        revokedReports.set(record.purchase.transactionId, record.idempotencyKey);
+    };
+    /**
+     * Whether a store purchase is bound to this player's own account: the
+     * purchase carries a binding, this player's binding reads, and the two are
+     * the same kind and value. Stricter than `accountOf`, which calls an
+     * unbound purchase or an unread binding this player's.
+     */
+    const boundToThisPlayer = async (purchase) => {
+        const bound = purchase.accountBinding;
+        if (bound?.value === undefined || input.accountBinding === undefined) {
+            return false;
+        }
+        let own;
+        try {
+            own = await input.accountBinding();
+        }
+        catch {
+            return false;
+        }
+        if (own?.value === undefined || own.kind !== bound.kind) {
+            return false;
+        }
+        return bound.kind === 'app-account-token'
+            ? own.value.toLowerCase() === bound.value.toLowerCase()
+            : own.value === bound.value;
+    };
+    /**
+     * A revoked purchase this player holds no record of (the journal dropped
+     * it, it was lost, or the store answer was never journaled). A refunded
+     * consumable gives nobody anything and the backend learns of the refund
+     * from the store (App Store Server Notifications), so it is finished
+     * without a verify, never journaled or granted: verifying it could grant
+     * from a signed transaction saved before the refund. Only a consumable
+     * bound to this player's own account, on a provider that finishes revoked
+     * transactions; a record found under its derived key (a journal without the
+     * transaction index) takes the record's path instead.
+     */
+    const noteUnrecordedRevoked = async (purchase, kind) => {
+        if (!revokedFinishApplies(kind, purchase.transactionId)
+            // Already noted this session (the store redelivers it): no second
+            // derived-key hash and journal read.
+            || revokedReports.has(purchase.transactionId)) {
+            return;
+        }
+        const idempotencyKey = await createDerivedPurchaseIdempotencyKey({
+            store: purchase.store,
+            transactionId: purchase.transactionId,
+            token: purchase.token,
+        });
+        let found;
+        try {
+            found = await readRecord(idempotencyKey);
+        }
+        catch {
+            // Another player's record holds the key: not this player's to finish.
+            return;
+        }
+        if (found !== undefined) {
+            if (found.purchase !== undefined && samePurchase(found.purchase, purchase)) {
+                noteRevoked(found, purchase, kind);
+            }
+            return;
+        }
+        if (!(await boundToThisPlayer(purchase))) {
+            return;
+        }
+        revokedReports.set(purchase.transactionId, undefined);
+    };
+    /**
+     * Finishes the revoked transactions `noteRevoked` kept, once their record
+     * holds the backend's answer, with `revoked: true` and the answer as the
+     * ledger entry id (the reversed grant's entry, or the refused key). Nothing
+     * is granted and the record is not rewritten: it is already terminal. The
+     * store finishes only a transaction it still lists as revoked. Asked once
+     * per session; a transport failure is asked again on a later pass (after
+     * the retry interval, unless the pass is explicit), and a refusal is
+     * reported as a `finish` failure (for StoreKit: a native build from before
+     * the revoked finish; the next launch asks again).
+     */
+    const finishRevokedReported = async (explicit) => {
+        const finishTransaction = provider.finishTransaction;
+        for (const [transactionId, idempotencyKey] of [...revokedReports]) {
+            const record = idempotencyKey === undefined ? undefined : records.get(idempotencyKey);
+            if (idempotencyKey !== undefined) {
+                if (record === undefined || record.purchase?.transactionId !== transactionId) {
+                    revokedReports.delete(transactionId);
+                    continue;
+                }
+                if (!answeredWithoutGrant(record)) {
+                    if (isTerminalCommercePurchaseState(record.state) && record.state !== 'finished') {
+                        // Refused for another reason (or ended otherwise): it stays unfinished.
+                        revokedReports.delete(transactionId);
+                    }
+                    // Otherwise still verifying, granted, finishing, or finished: the
+                    // backend has not answered for the refund yet (step 3 or 5 will).
+                    continue;
+                }
+            }
+            const retryKey = idempotencyKey ?? transactionId;
+            const waitUntil = retryAt.get(retryKey);
+            if (!explicit && waitUntil !== undefined && nowMs() < waitUntil) {
+                continue;
+            }
+            if (finishTransaction === undefined || sessionBlocked(idempotencyKey)) {
+                return;
+            }
+            revokedReports.delete(transactionId);
+            revokedFinishAsked.add(transactionId);
+            try {
+                const { finished } = await finishTransaction.call(provider, {
+                    transactionId,
+                    ...(record?.ledgerEntryId === undefined ? {} : { ledgerEntryId: record.ledgerEntryId }),
+                    isConsumable: true,
+                    revoked: true,
+                });
+                emit({
+                    type: 'revoked-finish',
+                    transactionId,
+                    ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+                    finished,
+                });
+                if (!finished) {
+                    // Not counted as asked: the store could not finish it now (a native
+                    // build from before the revoked finish, or a list that does not
+                    // carry it yet). The next report of the transaction asks again.
+                    revokedFinishAsked.delete(transactionId);
+                    fail('finish', new Error(`The store did not finish the revoked transaction ${transactionId}.`), idempotencyKey);
+                }
+            }
+            catch (error) {
+                // Transport-class failure: a later pass asks again.
+                revokedFinishAsked.delete(transactionId);
+                revokedReports.set(transactionId, idempotencyKey);
+                retryLater(retryKey);
+                fail('finish', error, idempotencyKey);
+            }
+        }
+    };
+    /**
+     * A store report of a record the backend answered as another account's
+     * purchase. Only this player's Restore Purchases asks again (a restore
+     * sharing policy or a binding may have changed since), with the evidence
+     * the store reports now, so a stale saved request (an expired signed
+     * transaction) is not resent, and as a restore, which the player asked
+     * for (restore sharing may cover a durable the game started, too); other
+     * reports leave it parked. It stays parked until the backend answers
+     * something else: a transport failure (an offline Restore) changes
+     * nothing, so the record never becomes an open attempt that serializes the
+     * player's purchases or holds the shared key against the purchase's
+     * account. Another answer unparks it and settles it as a verify does; a
+     * grant is finished by the pass's recoverable records.
+     *
+     * Returns false when the journal dropped the record before Restore could
+     * rewrite it (another context's save applied the journal's retention after
+     * `rereadParked` read it): the record is forgotten and the caller matches
+     * the report as a purchase the journal does not know.
+     */
+    const reportParked = async (record, purchase, restoring) => {
+        if (!restoring || purchase.state !== 'purchased') {
+            return true;
+        }
+        const request = {
+            ...buildRequest({ ...record, purchase }),
+            intent: 'restore',
+        };
+        let refreshed;
+        try {
+            refreshed = await reviseAnotherAccount(record, record.anotherAccount, {
+                purchase,
+                request,
+            });
+        }
+        catch (error) {
+            if (await rereadParked(record) === undefined) {
+                return false;
+            }
+            throw error;
+        }
+        const answer = await sendVerify(refreshed, request);
+        if (answer === undefined) {
+            return true;
+        }
+        if (answer.kind === 'another-account') {
+            await parkForAnotherAccount(refreshed, request, answer);
+            return true;
+        }
+        await settleVerify(await reviseAnotherAccount(refreshed, undefined), request, answer.response);
+        return true;
+    };
+    /**
+     * The journal's current record of a parked record this session holds, or
+     * undefined (and forgotten) when the journal no longer holds it for this
+     * player: dropped, or the key reserved again for another purchase of the
+     * player, which this purchase's report must never be written onto.
+     */
+    const rereadParked = async (record) => {
+        const current = await journal.read(record.key);
+        if (current !== undefined
+            && isCommercePurchaseOperationRecord(current)
+            && ownsRecord(current)
+            && current.purchase !== undefined
+            && record.purchase !== undefined
+            && samePurchase(current.purchase, record.purchase)) {
+            return remember(current);
+        }
+        records.delete(record.idempotencyKey);
+        return undefined;
+    };
     // Reconciler step 2: match a reported purchase to a journal record.
     const ingestPurchase = async (purchase, restoring) => {
         if (purchase.store !== storeId) {
@@ -746,6 +1078,38 @@ export function createCommerceReconciler(input) {
                 record = remember(stored);
             }
         }
+        if (record !== undefined && isParkedForAnotherAccount(record) && restoring) {
+            // Restore Purchases writes the record, so it must still be the journal's:
+            // a journal's retention may have dropped a parked record this session
+            // still holds (RFC "Another account's purchase"). Then the report is a
+            // purchase the journal does not know, and is matched as one.
+            record = await rereadParked(record);
+        }
+        if (record !== undefined && isParkedForAnotherAccount(record)) {
+            if (await reportParked(record, purchase, restoring)) {
+                return;
+            }
+            record = undefined;
+        }
+        if (purchase.state === 'revoked') {
+            // A revoked store state never revokes or verifies anything on its own:
+            // only the ledger revokes (step 5). It is matched only to this
+            // player's record of the same transaction, for a finish without a
+            // grant once the backend has answered for it. It is never attached to
+            // the player's open (`launched`) attempt for the product: the store
+            // reported no purchase for that attempt, and the open attempt may be
+            // another purchase still in flight (an Ask to Buy waiting for approval),
+            // which this refund must not end. Finishing the refunded transaction
+            // as unrecorded grants nothing, and the attempt keeps waiting for its
+            // own purchase report or its expiry, as before.
+            if (record !== undefined) {
+                noteRevoked(record, purchase, product.kind);
+            }
+            else {
+                await noteUnrecordedRevoked(purchase, product.kind);
+            }
+            return;
+        }
         const account = record !== undefined || (restoring && product.kind === 'durable')
             ? 'own'
             : await accountOf(purchase);
@@ -776,10 +1140,6 @@ export function createCommerceReconciler(input) {
             }
         }
         if (record === undefined) {
-            if (purchase.state === 'revoked') {
-                // Revoked store states never revoke on their own: only the ledger does (step 5).
-                return;
-            }
             const idempotencyKey = await createDerivedPurchaseIdempotencyKey({
                 store: purchase.store,
                 transactionId: purchase.transactionId,
@@ -800,6 +1160,16 @@ export function createCommerceReconciler(input) {
                 probeFree: durable,
             });
             record = recordIn(slot, idempotencyKey);
+            if (record !== undefined
+                && isParkedForAnotherAccount(record)
+                && record.logicalId === product.logicalId
+                && record.purchase !== undefined
+                && samePurchase(record.purchase, purchase)) {
+                // Found under its derived key only (a journal without the
+                // transaction index): the same rule as a transaction match.
+                await reportParked(record, purchase, restoring);
+                return;
+            }
             if (record !== undefined
                 && (record.logicalId !== product.logicalId
                     || (record.purchase !== undefined && !samePurchase(record.purchase, purchase)))) {
@@ -863,18 +1233,71 @@ export function createCommerceReconciler(input) {
         retryable: false,
         message,
     });
+    /**
+     * The backend's answer: a response, another account's purchase (the
+     * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error, or a `rejected` receipt with a
+     * store binding mismatch reason from a backend before it), or undefined
+     * for a transport failure.
+     */
     const sendVerify = async (record, request) => {
         emit({ type: 'verify-requested', record });
+        let response;
         try {
-            const response = await backend.verifyPurchase(request);
-            emit({ type: 'verify-result', record, response });
-            return response;
+            response = await backend.verifyPurchase(request);
         }
         catch (error) {
+            const anotherAccount = readPurchaseBoundToAnotherAccount(error);
+            if (anotherAccount !== undefined) {
+                // An answer, not a failure: the caller parks the record and reports it.
+                return { kind: 'another-account', reason: anotherAccount.reason };
+            }
             // Transport failure: the state is kept and the next pass resends the saved request.
             fail('verify', error, record.idempotencyKey);
             return undefined;
         }
+        emit({ type: 'verify-result', record, response });
+        if (!response.verified
+            && response.disposition !== 'pending'
+            && isStoreAccountMismatchReason(response.reason)) {
+            return { kind: 'another-account', reason: response.reason, response };
+        }
+        return { kind: 'response', response };
+    };
+    /**
+     * Parks a `verifying` record the backend answered as another account's
+     * purchase and reports it with an `another-account` event (not a failure).
+     */
+    const parkForAnotherAccount = async (record, request, answer) => {
+        const parked = await reviseAnotherAccount(record, { reason: answer.reason, reportedAt: now() }, { request, ...(answer.response === undefined ? {} : { response: answer.response }) });
+        emit({
+            type: 'another-account',
+            record: parked,
+            reason: answer.reason,
+            ...(answer.response === undefined ? {} : { response: answer.response }),
+        });
+    };
+    /**
+     * Journals the backend's answer to a `verifying` record: `pending` or
+     * `rejected`, or `granted` (returned) for a grant that carries its ledger
+     * entry; a malformed grant is reported and the record kept.
+     */
+    const settleVerify = async (record, request, response) => {
+        if (!response.verified) {
+            if (response.disposition === 'pending') {
+                await write(record, 'pending', { request, response });
+                retryLater(record.idempotencyKey);
+            }
+            else {
+                await write(record, 'rejected', { request, response });
+            }
+            return undefined;
+        }
+        const ledgerEntryId = response.ledgerEntryId;
+        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
+            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+            return undefined;
+        }
+        return write(record, 'granted', { request, response, ledgerEntryId });
     };
     // Reconciler steps 3 and 4: drive one record as far as the backend and the store allow.
     const drive = async (initial, capabilitiesNow, explicit) => {
@@ -936,29 +1359,30 @@ export function createCommerceReconciler(input) {
                         record = await write(record, 'verifying');
                         continue;
                     case 'verifying': {
+                        if (isParkedForAnotherAccount(record)) {
+                            // Another account's purchase: only this player's Restore
+                            // Purchases sends it again (`ingestPurchase`).
+                            return;
+                        }
                         const request = record.request ?? buildRequest(record);
-                        const response = await sendVerify(record, request);
-                        if (response === undefined) {
+                        const answer = await sendVerify(record, request);
+                        if (answer === undefined) {
                             retryLater(record.idempotencyKey);
                             return;
                         }
-                        if (!response.verified) {
-                            if (response.disposition === 'pending') {
-                                await write(record, 'pending', { request, response });
-                                retryLater(record.idempotencyKey);
-                            }
-                            else {
-                                await write(record, 'rejected', { request, response });
-                            }
+                        if (answer.kind === 'another-account') {
+                            // Not this player's, and not ended for the store transaction:
+                            // never sent again on its own, and the shared key is left to
+                            // the purchase's account (RFC "Another account's purchase").
+                            await parkForAnotherAccount(record, request, answer);
                             return;
                         }
-                        const ledgerEntryId = response.ledgerEntryId;
-                        if (typeof ledgerEntryId !== 'string' || ledgerEntryId.trim() === '') {
-                            fail('verify', new Error(`A verified response for ${record.idempotencyKey} must carry a ledgerEntryId.`), record.idempotencyKey);
+                        const granted = await settleVerify(record, request, answer.response);
+                        if (granted === undefined) {
                             return;
                         }
-                        finalization = response.finalization?.status;
-                        record = await write(record, 'granted', { request, response, ledgerEntryId });
+                        finalization = answer.response.finalization?.status;
+                        record = granted;
                         continue;
                     }
                     case 'granted':
@@ -985,7 +1409,8 @@ export function createCommerceReconciler(input) {
                             if (finalization === undefined) {
                                 // A pass that did not grant resends the saved request to read
                                 // finalization; the backend replays the grant, never a second one.
-                                reread = await sendVerify(record, record.request ?? buildRequest(record));
+                                const answer = await sendVerify(record, record.request ?? buildRequest(record));
+                                reread = answer?.kind === 'response' ? answer.response : undefined;
                                 finalization = reread?.verified === true
                                     ? reread.finalization?.status
                                     : undefined;
@@ -1172,6 +1597,10 @@ export function createCommerceReconciler(input) {
             return;
         }
         await revokeReversed();
+        if (sessionBlocked()) {
+            return;
+        }
+        await finishRevokedReported(options.explicit);
     };
     const runUntilIdle = async () => {
         if (running !== undefined) {
@@ -1574,6 +2003,7 @@ export function createCommerceReconciler(input) {
                     deferred.length = 0;
                     records.clear();
                     retryAt.clear();
+                    revokedReports.clear();
                     throw error;
                 }
                 finally {
@@ -1611,6 +2041,7 @@ export function createCommerceReconciler(input) {
             deferred.length = 0;
             records.clear();
             retryAt.clear();
+            revokedReports.clear();
         },
         async reconcile() {
             await withLock(async () => {

package/dist/evidence-verification.d.ts

@@ -34,8 +34,9 @@ export type EvidenceVerificationDecision = {
   * check passed. The reference verifiers answer it only for a request
   * with `intent: 'restore'` of a non-consumable; the backend then grants
   * the player its own share under its `restoreSharing` policy, or
-  * answers `rejected` with `reason` (the binding mismatch) when the
-  * policy refuses. Fields are those of `verified`.
+  * answers `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` with `reason` (the
+  * binding mismatch) when the policy refuses, as for a `rejected`
+  * decision with `anotherAccount`. Fields are those of `verified`.
   */
   readonly status: 'restorable';
   readonly reason: string;
@@ -49,6 +50,17 @@ export type EvidenceVerificationDecision = {
 } | {
   readonly status: 'rejected';
   readonly reason: string;
+  /**
+  * The store binds the purchase to another account than the requesting
+  * player's (`reason` is the binding mismatch, for example
+  * `GOOGLE_PLAY_ACCOUNT_MISMATCH`), and every other check passed: the
+  * purchase is valid, only not this player's (RFC "Another account's
+  * purchase"). The backend grants nothing, records nothing, and answers
+  * the retryable `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` error instead of a
+  * `rejected` receipt, so the purchase stays recoverable by its account.
+  * A caller that reads only `status` still refuses it.
+  */
+  readonly anotherAccount?: true;
 };
 export interface VerifyPurchaseEvidenceInput {
   readonly request: VerifyPurchaseRequest;