@mpgd/game-services 0.31.0 → 0.33.0

package/dist/google-play-purchase.js

@@ -326,6 +326,8 @@ async function inspectGooglePlayPurchase(input) {
         return rejected('GOOGLE_PLAY_PROFILE_INVALID');
     }
     let foreignBinding;
+    /** The purchase carries no id where the player's binding has one (bought outside the app). */
+    let missingBinding;
     if (input.accountBinding.status === 'bound') {
         // Defensive invariant: every bound context must carry at least one
         // identifier, even though the constructors below already enforce it.
@@ -338,13 +340,25 @@ async function inspectGooglePlayPurchase(input) {
         if (input.accountBinding.accountId !== undefined
             && obfuscatedExternalAccountId !== input.accountBinding.accountId) {
             foreignBinding = 'GOOGLE_PLAY_ACCOUNT_MISMATCH';
+            missingBinding = obfuscatedExternalAccountId === undefined
+                ? 'GOOGLE_PLAY_ACCOUNT_ID_MISSING'
+                : undefined;
         }
         else if (input.accountBinding.profileId !== undefined
             && obfuscatedExternalProfileId !== input.accountBinding.profileId) {
             foreignBinding = 'GOOGLE_PLAY_PROFILE_MISMATCH';
+            missingBinding = obfuscatedExternalProfileId === undefined
+                ? 'GOOGLE_PLAY_PROFILE_ID_MISSING'
+                : undefined;
         }
         if (foreignBinding !== undefined && input.reportForeignBinding !== true) {
-            return rejected(foreignBinding);
+            // A purchase with no binding is no account's: refused for every
+            // player. One bound to another account is that account's, which can
+            // still recover it: it is reported, not refused for good (RFC
+            // "Another account's purchase"). Every check before this one passed.
+            return missingBinding === undefined
+                ? { status: 'rejected', reason: foreignBinding, anotherAccount: true }
+                : rejected(missingBinding);
         }
         if (foreignBinding === undefined
             && input.accountBinding.profileId === undefined
@@ -357,15 +371,19 @@ async function inspectGooglePlayPurchase(input) {
             return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_REQUIRED');
         }
     }
-    // The unbound opt-in is safe only when the provider response is also unbound.
+    // The unbound opt-in is safe only when the provider response is also
+    // unbound. This backend binds no player, so no player of it can claim a
+    // bound purchase: refused for every player, never as another account's.
     if (input.accountBinding.status === 'unbound'
         && (obfuscatedExternalAccountId !== undefined
             || obfuscatedExternalProfileId !== undefined)) {
-        return rejected('GOOGLE_PLAY_ACCOUNT_MISMATCH');
+        return rejected('GOOGLE_PLAY_ACCOUNT_BINDING_UNEXPECTED');
     }
     return {
         status: 'verified',
-        ...(foreignBinding === undefined ? {} : { foreignBinding }),
+        // A restore reports which: another account's binding, or none at all
+        // (the backend refuses the latter for good when no share covers it).
+        ...(foreignBinding === undefined ? {} : { foreignBinding: missingBinding ?? foreignBinding }),
         purchase: {
             purchaseToken: input.purchaseToken,
             purchaseTokenDigest: await digestPurchaseToken(input.packageName, input.purchaseToken),

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from './account-deletion.js';
 export * from './admob-ssv.js';
+export * from './another-account.js';
 export * from './ad-reward-verifier-registry.js';
 export * from './app-store-verifier.js';
 export * from './app-store-recovery.js';

package/dist/runtime.d.ts

@@ -1,6 +1,7 @@
 import { type AccountDeletionClient } from './account-deletion.js';
 import type { AnalyticsSink } from '@mpgd/analytics';
 import type { PlatformGateway, PlatformTarget } from '@mpgd/platform';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesClient, type GameServicesHeaderResolver } from './client.js';
 import type { GameServicesLedgerTarget } from './types.js';
 import type { ClientRewardEvidenceRegistry } from './client-reward-evidence.js';
@@ -129,6 +130,17 @@ export declare function createGameServicesRuntime(input: CreateGameServicesRunti
 export declare function resolveGameServicesLedgerTarget(target: PlatformTarget | string): GameServicesLedgerTarget | null;
 export declare function resolveGameServicesAuthorityMode(profile: string): GameServicesAuthorityMode;
 export declare function resolveGameServicesTransport(transport: string | undefined): 'http' | 'orpc';
+export { isHostedGameServicesPath };
+/**
+* Resolve a hosted browser's clean /api ingress before constructing absolute-URL
+* clients. No ambient DOM access: composition roots supply the actual page origin
+* and gateway target. Unresolved/invalid inputs remain invalid for the runtime's
+* fail-closed authority check; this helper never supplies a fallback backend.
+*/
+export declare function resolveGameServicesBaseUrl(baseUrl: string | undefined, context: {
+  readonly target: PlatformTarget | string;
+  readonly pageOrigin?: string;
+}): string | undefined;
 /**
 * Whether a game-services URL may carry a session's credentials in a
 * production build: an absolute https URL with no credentials and a public

package/dist/runtime.js

@@ -1,5 +1,6 @@
 import { AccountDeletionError, createAccountDeletionClient, } from './account-deletion.js';
 import { CommerceError } from '@mpgd/platform/commerce';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 import { assertCommerceStaleLaunchedAfterMs, createGameServicesClient, createGameServicesFetchBackendTransport, createGameServicesHttpBackendApi, createGameServicesOrpcBackendApi, createGameServicesOrpcClient, resolveGameServicesRequestHeaders, } from './client.js';
 import { gameServicesPlayerChangedCode, GameServicesRuntimeClosedError, gameServicesRuntimeDisposedCode, gameServicesSessionRequiredCode, } from './request-headers.js';
 import { createRecoverableMonetizationClient, } from './monetization-recovery.js';
@@ -492,6 +493,28 @@ function normalizeBaseUrl(baseUrl) {
     const normalized = baseUrl?.trim();
     return normalized === undefined || normalized.length === 0 ? undefined : normalized;
 }
+export { isHostedGameServicesPath };
+/**
+ * Resolve a hosted browser's clean /api ingress before constructing absolute-URL
+ * clients. No ambient DOM access: composition roots supply the actual page origin
+ * and gateway target. Unresolved/invalid inputs remain invalid for the runtime's
+ * fail-closed authority check; this helper never supplies a fallback backend.
+ */
+export function resolveGameServicesBaseUrl(baseUrl, context) {
+    const value = normalizeBaseUrl(baseUrl);
+    if (value === undefined || (context.target !== 'browser' && context.target !== 'microsoft-store')
+        || value !== baseUrl || !isHostedGameServicesPath(value)) {
+        return value;
+    }
+    const origin = context.pageOrigin === undefined
+        ? undefined
+        : parseAbsoluteUrl(context.pageOrigin);
+    if (origin === undefined || origin.origin !== context.pageOrigin
+        || (origin.protocol !== 'https:' && origin.protocol !== 'http:')) {
+        return value;
+    }
+    return new URL(value, origin).href;
+}
 /**
  * Whether a game-services URL may carry a session's credentials in a
  * production build: an absolute https URL with no credentials and a public

package/dist/server.d.ts

@@ -3,6 +3,7 @@ import { type AdPlacements, type ProductCatalog } from '@mpgd/catalog';
 import { type GameServicesBackendApi, type GameServicesBackendTransport, type GameServicesBackendTransportRequest, type GameServicesBackendTransportResponse } from './client.js';
 import { type CommerceEvidenceRegistry } from './commerce-evidence-registry.js';
 import { type PlayerDataErasureInput, type PlayerDataErasureResult } from './account-deletion.js';
+import { purchaseBoundToAnotherAccountCode } from './another-account.js';
 import { type GameServicesHealthResponse } from './contract.js';
 import { type GameServicesEvidenceVerifier, type GameServicesPurchaseGrantFinalizer } from './evidence-verification.js';
 import { type ClaimAdRewardRequest, type ClaimAdRewardResponse, type EntitlementLedgerGrant, type EntitlementLedgerNote, type EntitlementLedgerResult, type EntitlementLedgerRevocation, type EntitlementRevocationTransaction, type GameServicesAdRewardTarget, type GameServicesStoreTarget, type LeaderboardScoreTransaction, type ProductGrantTransaction, type PurchaseLedgerStatusRequest, type RecordLeaderboardScoreRequest, type RecordLeaderboardScoreResponse, type VerifyPurchaseRequest, type VerifyPurchaseResponse } from './types.js';
@@ -58,11 +59,15 @@ export interface GameServicesBackendApiHandler {
   handle(request: GameServicesBackendTransportRequest): Promise<GameServicesBackendTransportResponse>;
 }
 /** Stable error codes emitted by the backend API handler and the HTTP fetch handler. */
-export type GameServicesBackendErrorCode = 'INVALID_REQUEST' | 'INVALID_JSON' | 'PAYLOAD_TOO_LARGE' | 'METHOD_NOT_ALLOWED' | 'UNKNOWN_ENDPOINT' | 'INTERNAL_ERROR';
+export type GameServicesBackendErrorCode = 'INVALID_REQUEST' | 'INVALID_JSON' | 'PAYLOAD_TOO_LARGE' | 'METHOD_NOT_ALLOWED' | 'UNKNOWN_ENDPOINT' | 'INTERNAL_ERROR'
+/** 409: the store binds the purchase to another account (RFC "Another account's purchase"). */
+| typeof purchaseBoundToAnotherAccountCode;
 export interface GameServicesBackendErrorResponse {
   readonly error: GameServicesBackendErrorCode;
   /** Present only for `INVALID_REQUEST`; never carries internal failure details. */
   readonly message?: string;
+  /** Present only for `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT`: the store's binding mismatch. */
+  readonly reason?: string;
 }
 export interface GameServicesStore {
   recordEntitlementGrant(input: EntitlementLedgerGrant): Promise<EntitlementLedgerResult>;
@@ -239,6 +244,16 @@ export declare function createGameServicesRouter(backend: GameServicesBackendApi
     recordScore: import("@orpc/server").ImplementedProcedure<GameServicesOrpcContext & object, object, import("@orpc/contract").Schema<RecordLeaderboardScoreRequest, RecordLeaderboardScoreRequest>, import("@orpc/contract").Schema<RecordLeaderboardScoreResponse, RecordLeaderboardScoreResponse>, Record<never, never>>;
   };
 };
+/**
+* The RPC handler's error status map: oRPC's common codes and
+* `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` at 409. oRPC 2.0.0-beta.46 derives the
+* HTTP status of an error from its code through this map (an `ORPCError`
+* carries no status of its own), so a host that mounts
+* `createGameServicesRouter` in its own `RPCHandler` passes it as
+* `errorStatusMap` to answer 409 too; without it the code still reaches the
+* client, with status 500.
+*/
+export declare const gameServicesRpcErrorStatusMap: Readonly<Record<string, number>>;
 export declare function createGameServicesRpcFetchHandler(router: ReturnType<typeof createGameServicesRouter>, options?: CreateGameServicesRpcFetchHandlerOptions): (request: Request) => Promise<Response>;
 export declare function createGameServicesHttpFetchHandler(handler: GameServicesBackendApiHandler, options?: CreateGameServicesFetchHandlerOptions): (request: Request) => Promise<Response>;
 export * from './notification-delivery.js';

package/dist/server.js

@@ -1,3 +1,4 @@
+import { COMMON_ERROR_STATUS_MAP } from '@orpc/client';
 import { implement, ORPCError } from '@orpc/server';
 import { RPCHandler } from '@orpc/server/fetch';
 import { RequestLimitHandlerPlugin } from '@orpc/server/plugins';
@@ -7,6 +8,7 @@ import { gameServicesBackendEndpoints, } from './client.js';
 import { resolveCommerceStoreId, } from './commerce-evidence-registry.js';
 import { createPurchaseHolderEvidenceVerificationId, findEntitlementRevocationsChunked, findPurchaseWideRevocation, holderRevocationEvidenceId, isEntitlementGrantReversed, isRestoredAcrossPlayers, listPurchaseHolders, readPurchaseLedgerStatuses, readPurchaseVerificationId, RevocationKeyConflictError, revokeEntitlementGrant, } from './commerce-ledger.js';
 import { assertPlayerDataErasureInput, createRetainedLedgerEntryId, detachRetainedLedgerPayload, isRetainedPlayerId, } from './account-deletion.js';
+import { createPurchaseBoundToAnotherAccountBody, GameServicesPurchaseBoundToAnotherAccountError, isStoreAccountMismatchReason, purchaseBoundToAnotherAccountCode, purchaseBoundToAnotherAccountStatus, } from './another-account.js';
 import { gameServicesContract } from './contract.js';
 import { addLegacyOrpcErrorFlag } from './orpc-error-compat.js';
 import { createRejectingGameServicesEvidenceVerifier, } from './evidence-verification.js';
@@ -407,6 +409,23 @@ export function createGameServicesBackend(input) {
                         : { purchaseGrantFinalizer }),
                     ...(registry === undefined ? {} : { registry }),
                 }, async (verification) => {
+                    if (verification instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                        // Refused for this player, not decided for its account: tracked
+                        // as a refusal with the mark, never as a pending purchase.
+                        await analytics.track({
+                            name: 'purchase_rejected',
+                            properties: {
+                                target: request.target,
+                                store: resolveCommerceStoreId(request),
+                                playerId: request.playerId,
+                                productId: request.productId,
+                                alreadyProcessed: false,
+                                reason: verification.code,
+                                boundToAnotherAccount: verification.reason,
+                            },
+                        });
+                        return;
+                    }
                     await analytics.track({
                         name: verification.verified ? 'purchase_granted'
                             : verification.disposition === 'pending' ? 'purchase_pending' : 'purchase_rejected',
@@ -521,6 +540,12 @@ export function createGameServicesBackendApiHandler(input) {
                 if (error instanceof GameServicesRequestValidationError) {
                     return errorResponse(400, 'INVALID_REQUEST', error.message);
                 }
+                if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                    return {
+                        status: purchaseBoundToAnotherAccountStatus,
+                        body: createPurchaseBoundToAnotherAccountBody(error.reason),
+                    };
+                }
                 reportInternalError(input.onInternalError, error);
                 return errorResponse(500, 'INTERNAL_ERROR');
             }
@@ -573,6 +598,15 @@ export function createGameServicesRouter(backend, options = {}) {
             if (error instanceof GameServicesRequestValidationError) {
                 throw new ORPCError('BAD_REQUEST', { message: error.message });
             }
+            if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                // A retryable answer, not an internal error: the code and reason reach the client.
+                // oRPC beta.46 errors carry no status: `gameServicesRpcErrorStatusMap`
+                // (used by `createGameServicesRpcFetchHandler`) maps the code to 409.
+                throw new ORPCError(purchaseBoundToAnotherAccountCode, {
+                    message: error.message,
+                    data: { reason: error.reason },
+                });
+            }
             reportInternalError(options.onInternalError, error);
             throw error;
         }
@@ -612,8 +646,22 @@ export function createGameServicesRouter(backend, options = {}) {
         }),
     });
 }
+/**
+ * The RPC handler's error status map: oRPC's common codes and
+ * `PURCHASE_BOUND_TO_ANOTHER_ACCOUNT` at 409. oRPC 2.0.0-beta.46 derives the
+ * HTTP status of an error from its code through this map (an `ORPCError`
+ * carries no status of its own), so a host that mounts
+ * `createGameServicesRouter` in its own `RPCHandler` passes it as
+ * `errorStatusMap` to answer 409 too; without it the code still reaches the
+ * client, with status 500.
+ */
+export const gameServicesRpcErrorStatusMap = Object.freeze({
+    ...COMMON_ERROR_STATUS_MAP,
+    [purchaseBoundToAnotherAccountCode]: purchaseBoundToAnotherAccountStatus,
+});
 export function createGameServicesRpcFetchHandler(router, options = {}) {
     const rpcHandler = new RPCHandler(router, {
+        errorStatusMap: { ...gameServicesRpcErrorStatusMap },
         plugins: [
             new RequestLimitHandlerPlugin({
                 maxBodySize: resolveMaxBodyBytes(options.maxBodyBytes),
@@ -787,7 +835,21 @@ async function verifyPurchaseWithStore(input, context, onDecision) {
             : { deploymentTarget: request.deploymentTarget }),
     };
     return withEntitlementRetryLock(retryIdentity, async () => {
-        const verification = await verifyPurchaseForRetry(request, retryIdentity, context);
+        let verification;
+        try {
+            verification = await verifyPurchaseForRetry(request, retryIdentity, context);
+        }
+        catch (error) {
+            if (error instanceof GameServicesPurchaseBoundToAnotherAccountError) {
+                try {
+                    await onDecision(error);
+                }
+                catch {
+                    // Analytics is best-effort: a failed report never replaces the answer.
+                }
+            }
+            throw error;
+        }
         await onDecision(verification);
         return verification;
     });
@@ -862,18 +924,27 @@ async function verifyPurchaseForRetry(request, retryIdentity, context) {
         ? routedEntry.entry.store
         : resolveCommerceStoreId(request);
     if (verification.status === 'restorable') {
-        // A verified restore of a purchase the store binds to another player.
+        // A verified restore of a purchase the store binds to another player, or to none.
         return shareRestoredPurchase(request, {
             product,
             platformProductId,
             verification,
             verifiedStore,
-            refusal: assertVerifyPurchaseResponse({
-                verified: false,
-                alreadyProcessed: false,
-                disposition: 'rejected',
-                reason: verification.reason,
-            }),
+            refusal: () => {
+                if (isStoreAccountMismatchReason(verification.reason)) {
+                    // No share for this player: the purchase stays its account's,
+                    // which can still restore it (RFC "Another account's purchase").
+                    throw new GameServicesPurchaseBoundToAnotherAccountError(verification.reason);
+                }
+                // Bound to no account (`*_MISSING`) or a custom verifier's reason:
+                // no account can claim it, so the refusal is final.
+                return assertVerifyPurchaseResponse({
+                    verified: false,
+                    alreadyProcessed: false,
+                    disposition: 'rejected',
+                    reason: verification.reason,
+                });
+            },
         }, context);
     }
     if (verification.status !== 'verified') {
@@ -883,6 +954,12 @@ async function verifyPurchaseForRetry(request, retryIdentity, context) {
         if (racedExisting !== undefined) {
             return completeExistingRetry(racedExisting);
         }
+        if (verification.status === 'rejected' && verification.anotherAccount === true) {
+            // Another account's valid purchase: nothing is granted or recorded, and
+            // the answer is a retryable error, never a `rejected` receipt that would
+            // end the client's record and block its account's recovery.
+            throw new GameServicesPurchaseBoundToAnotherAccountError(verification.reason);
+        }
         return assertVerifyPurchaseResponse({
             verified: false,
             alreadyProcessed: false,
@@ -1111,6 +1188,15 @@ function createPurchaseGrantPayload(request, input) {
         evidenceVerifiedAt: input.verification.verifiedAt,
     };
 }
+/**
+ * Whether the `share` policy applies: a non-consumable, asked as a restore
+ * unless the store binds it to this player.
+ */
+function sharesRestoredPurchase(request, product, context, bindingMatches = false) {
+    return context.restoreSharing.mode === 'share'
+        && (request.intent === 'restore' || bindingMatches)
+        && product.type === 'non_consumable';
+}
 /**
  * A verified restore of a non-consumable the store binds to another player
  * (RFC "Restore sharing"). Under the `share` policy, for a request with
@@ -1125,10 +1211,8 @@ function createPurchaseGrantPayload(request, input) {
 async function shareRestoredPurchase(request, input, context) {
     const { store, restoreSharing: policy } = context;
     const { product, verification } = input;
-    if (policy.mode !== 'share'
-        || (request.intent !== 'restore' && input.bindingMatches !== true)
-        || product.type !== 'non_consumable') {
-        return input.refusal;
+    if (!sharesRestoredPurchase(request, product, context, input.bindingMatches === true)) {
+        return typeof input.refusal === 'function' ? input.refusal() : input.refusal;
     }
     const purchaseVerificationId = verification.verificationId;
     const notGranted = (disposition, reason) => ({
@@ -1740,6 +1824,9 @@ function assertEvidenceVerificationDecision(decision) {
     }
     if (decision.status === 'rejected') {
         assertNonEmptyDecisionString(decision.reason, 'reason');
+        if (decision.anotherAccount !== undefined && decision.anotherAccount !== true) {
+            throw new Error('Evidence verification anotherAccount must be true when present.');
+        }
         return decision;
     }
     throw new Error('Unknown evidence verification status.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/game-services",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "Client, contract, server, store, and test helpers for authoritative mpgd game services.",
   "license": "MIT",
   "repository": {
@@ -231,9 +231,9 @@
     "@orpc/client": "2.0.0-beta.46",
     "@orpc/contract": "2.0.0-beta.46",
     "@orpc/server": "2.0.0-beta.46",
-    "@mpgd/analytics": "0.5.6",
-    "@mpgd/catalog": "0.14.0",
-    "@mpgd/platform": "0.33.0"
+    "@mpgd/analytics": "0.5.8",
+    "@mpgd/catalog": "0.14.2",
+    "@mpgd/platform": "0.35.0"
   },
   "peerDependencies": {
     "@apple/app-store-server-library": "^3.1.0"