@mpgd/game-services 0.33.0 → 0.34.0

package/dist/admob-ssv.js

@@ -1,4 +1,5 @@
 import { Point, verify as verifySecp256k1 } from '@noble/secp256k1';
+import { decodeBase64, decodeBase64Url } from './base64.js';
 export const admobSsvCustomDataSchema = 'mpgd.admob.ssv.binding.v1';
 /** Maximum field length accepted by the shipped game-services SSV receiver. */
 export const admobSsvMaximumBindingFieldLength = 256;
@@ -60,7 +61,11 @@ export function decodeAdMobSsvCustomData(input) {
 }
 export async function importAdMobSsvPublicKey(base64Spki, subtle = readGlobalSubtleCrypto()) {
     requireNonEmptyString(base64Spki, 'base64Spki');
-    const spki = decodeBase64(base64Spki);
+    // ASCII whitespace is dropped, as atob's forgiving decode always did.
+    const spki = decodeBase64(base64Spki.replace(/[\t\n\f\r ]/gu, ''));
+    if (spki === undefined) {
+        throw new Error('base64Spki must be base64.');
+    }
     const parsed = parseAdMobSsvSubjectPublicKeyInfo(spki);
     if (parsed === undefined) {
         throw new Error('base64Spki must contain a supported EC SubjectPublicKeyInfo key.');
@@ -509,31 +514,6 @@ function readGlobalSubtleCrypto() {
     }
     return subtle;
 }
-function decodeBase64(input) {
-    const decoded = atob(input);
-    const output = new Uint8Array(decoded.length);
-    for (let index = 0; index < decoded.length; index += 1) {
-        output[index] = decoded.charCodeAt(index);
-    }
-    return output;
-}
-function decodeBase64Url(input) {
-    if (!/^[A-Za-z0-9_-]+$/.test(input)) {
-        return undefined;
-    }
-    const remainder = input.length % 4;
-    if (remainder === 1) {
-        return undefined;
-    }
-    const base64 = input.replaceAll('-', '+').replaceAll('_', '/')
-        + '='.repeat((4 - remainder) % 4);
-    try {
-        return decodeBase64(base64);
-    }
-    catch {
-        return undefined;
-    }
-}
 function readParameter(parameters, name) {
     return parameters.get(name) ?? '';
 }

package/dist/app-store-verifier-conformance.d.ts

@@ -1,5 +1,5 @@
 import type { PlatformEvidenceEnvelope } from '@mpgd/platform';
-import { type AppStoreEnvironment, type AppStoreInAppPurchaseType, type AppStoreTransactionPayload } from './app-store-verifier.js';
+import { type AppStoreEnvironment, type AppStoreInAppPurchaseType, type AppStoreRevocationRegistry, type AppStoreTransactionPayload } from './app-store-verifier.js';
 /** The placeholder JWS the signed-transaction evidence fixture carries; never a real signature. */
 export declare const appStoreConformanceSignedTransaction = "conformance.signed-transaction.jws";
 export interface CreateAppStoreSignedTransactionEvidenceFixtureInput {
@@ -42,3 +42,39 @@ export interface CreateAppStoreTransactionConformanceFixtureInput {
 * credentials, authorization tokens, private keys, or live transaction IDs.
 */
 export declare function createAppStoreTransactionConformanceFixture(input?: CreateAppStoreTransactionConformanceFixtureInput): AppStoreTransactionPayload;
+/** The rules `runAppStoreRevocationRegistryConformance` checks, in order. */
+export declare const appStoreRevocationRegistryConformanceChecks: readonly ['an unrecorded grant identity is absent', 'the first record is kept and read back unchanged', 'a redelivery keeps the record it repeats', 'an older revocation arriving late keeps the later one', 'a later revocation replaces the earlier one', 'an unparseable revokedAt replaces a parseable one and is never replaced', 'grant identities are independent', 'environments are independent for the same verification id'];
+/** Checked only when `reopen` is given. */
+export declare const appStoreRevocationRegistryDurabilityCheck = "records survive a new registry instance over the same storage";
+export interface RunAppStoreRevocationRegistryConformanceInput {
+  readonly registry: AppStoreRevocationRegistry;
+  /**
+  * Another registry instance over the same storage, as a new Worker isolate
+  * or process would build it. When given, every rule is also read back
+  * through it, so a registry that only remembers in memory fails.
+  */
+  readonly reopen?: () => AppStoreRevocationRegistry;
+  /**
+  * Keeps this run's grant identities apart from earlier runs on a storage
+  * that persists between them; a random id by default.
+  */
+  readonly runId?: string;
+  readonly signal?: AbortSignal;
+}
+export interface AppStoreRevocationRegistryConformanceReport {
+  readonly checks: readonly string[];
+  readonly passed: true;
+}
+/**
+* Runs the `AppStoreRevocationRegistry` contract against an implementation:
+* the latest `revokedAt` per grant identity wins, a redelivery or an older
+* notification arriving late answers `alreadyRecorded: true` and changes
+* nothing, an unparseable `revokedAt` counts as the latest, and records are
+* read back field for field. `createInMemoryAppStoreRevocationRegistry`
+* passes it; a durable registry should pass it with `reopen` as well. It
+* writes records under fresh grant identities and deletes nothing, so run it
+* on a test database: each run leaves a few rows, two of them with a
+* `revokedAt` that does not parse (never replaced or pruned by age). It
+* throws on the first rule that fails.
+*/
+export declare function runAppStoreRevocationRegistryConformance(input: RunAppStoreRevocationRegistryConformanceInput): Promise<AppStoreRevocationRegistryConformanceReport>;

package/dist/app-store-verifier-conformance.js

@@ -1,4 +1,4 @@
-import { createAppStoreSignedTransactionEvidence, } from './app-store-verifier.js';
+import { createAppStoreSignedTransactionEvidence, createAppStoreVerificationId, } from './app-store-verifier.js';
 /** The placeholder JWS the signed-transaction evidence fixture carries; never a real signature. */
 export const appStoreConformanceSignedTransaction = 'conformance.signed-transaction.jws';
 /**
@@ -48,3 +48,201 @@ export function createAppStoreTransactionConformanceFixture(input = {}) {
         ...(input.isUpgraded === undefined ? {} : { isUpgraded: input.isUpgraded }),
     };
 }
+/** The rules `runAppStoreRevocationRegistryConformance` checks, in order. */
+export const appStoreRevocationRegistryConformanceChecks = [
+    'an unrecorded grant identity is absent',
+    'the first record is kept and read back unchanged',
+    'a redelivery keeps the record it repeats',
+    'an older revocation arriving late keeps the later one',
+    'a later revocation replaces the earlier one',
+    'an unparseable revokedAt replaces a parseable one and is never replaced',
+    'grant identities are independent',
+    'environments are independent for the same verification id',
+];
+/** Checked only when `reopen` is given. */
+export const appStoreRevocationRegistryDurabilityCheck = 'records survive a new registry instance over the same storage';
+/**
+ * Runs the `AppStoreRevocationRegistry` contract against an implementation:
+ * the latest `revokedAt` per grant identity wins, a redelivery or an older
+ * notification arriving late answers `alreadyRecorded: true` and changes
+ * nothing, an unparseable `revokedAt` counts as the latest, and records are
+ * read back field for field. `createInMemoryAppStoreRevocationRegistry`
+ * passes it; a durable registry should pass it with `reopen` as well. It
+ * writes records under fresh grant identities and deletes nothing, so run it
+ * on a test database: each run leaves a few rows, two of them with a
+ * `revokedAt` that does not parse (never replaced or pruned by age). It
+ * throws on the first rule that fails.
+ */
+export async function runAppStoreRevocationRegistryConformance(input) {
+    const signal = input.signal ?? new AbortController().signal;
+    const runId = input.runId ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+    const writer = input.registry;
+    const readers = input.reopen === undefined ? [writer] : [writer, input.reopen()];
+    let sequence = 0;
+    const recordFor = (name, overrides = {}) => {
+        const transactionId = `conformance-${runId}-${name}`;
+        return {
+            verificationId: createAppStoreVerificationId({
+                environment: 'Production',
+                bundleId: 'com.example.game',
+                transactionId,
+            }),
+            environment: 'Production',
+            bundleId: 'com.example.game',
+            transactionId,
+            originalTransactionId: transactionId,
+            productId: 'com.example.game.coins100',
+            reason: 'refund',
+            revokedAt: '2026-10-20T00:00:00.000Z',
+            notificationType: 'REFUND',
+            notificationUUID: `conformance-${runId}-${String(++sequence)}`,
+            ...overrides,
+        };
+    };
+    const record = async (value) => (await writer.recordRevocation({ record: value, signal })).alreadyRecorded;
+    const expectKept = async (expected, rule, 
+    /** Where to look when it is not `expected`'s own key (an absent record). */
+    at) => {
+        for (const [index, reader] of readers.entries()) {
+            const kept = await reader.findRevocation({
+                verificationId: at?.verificationId ?? expected?.verificationId ?? recordFor('absent').verificationId,
+                environment: at?.environment ?? expected?.environment ?? 'Production',
+                bundleId: expected?.bundleId ?? 'com.example.game',
+                transactionId: expected?.transactionId ?? `conformance-${runId}-absent`,
+                originalTransactionId: expected?.originalTransactionId ?? `conformance-${runId}-absent`,
+                signal,
+            });
+            assertRevocationConformance(sameRevocationRecord(kept, expected), `${rule}${index === 0 ? '' : ' (read through reopen)'}: expected ${describeRecord(expected)}, `
+                + `read ${describeRecord(kept)}`);
+        }
+    };
+    const [absentRule, firstRule, redeliveryRule, olderRule, laterRule, unparseableRule, independentRule, environmentRule,] = appStoreRevocationRegistryConformanceChecks;
+    await expectKept(undefined, absentRule);
+    const first = recordFor('first', {
+        originalTransactionId: `conformance-${runId}-first-original`,
+        productId: 'com.example.game.remove_ads',
+        reason: 'voided',
+        revokedAt: '2026-10-20T01:02:03.456Z',
+        notificationType: 'REVOKE',
+    });
+    assertRevocationConformance(!(await record(first)), `${firstRule}: alreadyRecorded was true`);
+    await expectKept(first, firstRule);
+    const redelivered = { ...first, notificationUUID: `${first.notificationUUID}-redelivered` };
+    // The same instant written another way is the same revocation.
+    const sameInstant = {
+        ...first,
+        revokedAt: '2026-10-20T10:02:03.456+09:00',
+        notificationUUID: `${first.notificationUUID}-same-instant`,
+    };
+    assertRevocationConformance(await record(first), `${redeliveryRule}: the same record answered false`);
+    assertRevocationConformance(await record(redelivered), `${redeliveryRule}: an equal revokedAt answered false`);
+    assertRevocationConformance(await record(sameInstant), `${redeliveryRule}: the same instant in another offset answered false`);
+    await expectKept(first, redeliveryRule);
+    const later = recordFor('order', { revokedAt: '2026-10-20T02:00:00.000Z' });
+    assertRevocationConformance(!(await record(later)), `${olderRule}: the first record answered true`);
+    const older = { ...later, revokedAt: '2026-10-20T01:00:00.000Z', notificationUUID: 'older' };
+    assertRevocationConformance(await record(older), `${olderRule}: answered false`);
+    await expectKept(later, olderRule);
+    // Refunded, reversed (nothing recorded), and revoked again.
+    const again = {
+        ...later,
+        reason: 'voided',
+        revokedAt: '2026-10-21T00:00:00.000Z',
+        notificationType: 'REVOKE',
+        notificationUUID: 'revoked-again',
+    };
+    assertRevocationConformance(!(await record(again)), `${laterRule}: answered true`);
+    await expectKept(again, laterRule);
+    // Compared as instants, not as text.
+    const offsetLater = {
+        ...again,
+        revokedAt: '2026-10-21T09:30:00+09:00',
+        notificationUUID: 'offset',
+    };
+    assertRevocationConformance(!(await record(offsetLater)), `${laterRule}: a later offset time answered true`);
+    await expectKept(offsetLater, laterRule);
+    const lexicallyLater = {
+        ...again,
+        revokedAt: '2026-10-21T10:00:00+11:00',
+        notificationUUID: 'lexically-later',
+    };
+    assertRevocationConformance(await record(lexicallyLater), `${laterRule}: an earlier instant that sorts later as text answered false`);
+    await expectKept(offsetLater, laterRule);
+    const parseable = recordFor('unparseable', { revokedAt: '2026-10-20T00:00:00.000Z' });
+    assertRevocationConformance(!(await record(parseable)), `${unparseableRule}: the first record answered true`);
+    const unparseable = { ...parseable, revokedAt: 'unparseable', notificationUUID: 'unparseable' };
+    assertRevocationConformance(!(await record(unparseable)), `${unparseableRule}: answered true`);
+    await expectKept(unparseable, unparseableRule);
+    for (const revokedAt of ['2099-01-01T00:00:00.000Z', 'also-unparseable']) {
+        assertRevocationConformance(await record({ ...parseable, revokedAt, notificationUUID: revokedAt }), `${unparseableRule}: ${revokedAt} replaced an unparseable record`);
+    }
+    await expectKept(unparseable, unparseableRule);
+    const unparseableFirst = recordFor('unparseable-first', { revokedAt: 'unparseable' });
+    assertRevocationConformance(!(await record(unparseableFirst)), `${unparseableRule}: a first unparseable record answered true`);
+    assertRevocationConformance(await record({ ...unparseableFirst, revokedAt: '2099-01-01T00:00:00.000Z', notificationUUID: 'later' }), `${unparseableRule}: a parseable record replaced a first unparseable one`);
+    await expectKept(unparseableFirst, unparseableRule);
+    const sandbox = recordFor('first', {
+        environment: 'Sandbox',
+        verificationId: createAppStoreVerificationId({
+            environment: 'Sandbox',
+            bundleId: 'com.example.game',
+            transactionId: first.transactionId,
+        }),
+        revokedAt: '2026-10-19T00:00:00.000Z',
+    });
+    assertRevocationConformance(!(await record(sandbox)), `${independentRule}: another identity answered alreadyRecorded`);
+    await expectKept(sandbox, independentRule);
+    await expectKept(first, independentRule);
+    // The same verification id string in both environments: two records. The
+    // Sandbox one is earlier, so a registry keyed by the id alone keeps the
+    // Production record and answers it for a Sandbox lookup.
+    const production = recordFor('environment', { revokedAt: '2026-10-20T12:00:00.000Z' });
+    const sandboxTwin = {
+        ...production,
+        environment: 'Sandbox',
+        revokedAt: '2026-10-20T06:00:00.000Z',
+        notificationUUID: `${production.notificationUUID}-sandbox`,
+    };
+    const productionOnly = recordFor('production-only');
+    assertRevocationConformance(!(await record(production)), `${environmentRule}: Production answered true`);
+    await expectKept(undefined, environmentRule, { ...production, environment: 'Sandbox' });
+    assertRevocationConformance(!(await record(sandboxTwin)), `${environmentRule}: a Sandbox record answered alreadyRecorded for a Production one`);
+    await expectKept(sandboxTwin, environmentRule);
+    await expectKept(production, environmentRule);
+    assertRevocationConformance(!(await record(productionOnly)), `${environmentRule}: answered true`);
+    await expectKept(undefined, environmentRule, { ...productionOnly, environment: 'Sandbox' });
+    return {
+        checks: input.reopen === undefined
+            ? [...appStoreRevocationRegistryConformanceChecks]
+            : [...appStoreRevocationRegistryConformanceChecks, appStoreRevocationRegistryDurabilityCheck],
+        passed: true,
+    };
+}
+const revocationRecordKeys = [
+    'verificationId',
+    'environment',
+    'bundleId',
+    'transactionId',
+    'originalTransactionId',
+    'productId',
+    'reason',
+    'revokedAt',
+    'notificationType',
+    'notificationUUID',
+];
+function sameRevocationRecord(actual, expected) {
+    if (actual === undefined || expected === undefined) {
+        return actual === expected;
+    }
+    return revocationRecordKeys.every((key) => actual[key] === expected[key]);
+}
+function describeRecord(record) {
+    return record === undefined
+        ? 'none'
+        : `${record.revokedAt} (${record.notificationType} ${record.notificationUUID})`;
+}
+function assertRevocationConformance(condition, message) {
+    if (!condition) {
+        throw new Error(`App Store revocation registry conformance failed: ${message}.`);
+    }
+}

package/dist/app-store-verifier.d.ts

@@ -183,7 +183,8 @@ export interface AppStoreRevocationRecord {
 }
 /**
 * Reads recorded revocations for the offline-only verifier. Answer the record
-* for `verificationId`, or `undefined` when none is recorded. Throw
+* for `environment` and `verificationId`, or `undefined` when none is
+* recorded: a record of the other environment never answers. Throw
 * `AppStoreDependencyUnavailableError` only for a transient storage outage
 * (the purchase stays `pending`); any other error propagates.
 */
@@ -198,8 +199,13 @@ export interface AppStoreRevocationLookup {
   }): Promise<AppStoreRevocationRecord | undefined>;
 }
 /**
-* Durably records a revocation, keeping per `verificationId` the record with
-* the latest `revokedAt`: a purchase can be refunded, reversed, and revoked
+* Durably records a revocation, keeping per `environment` and
+* `verificationId` the record with the latest `revokedAt` (a Production
+* deployment that grants sandbox purchases records both environments, and
+* Apple documents a transaction id as unique without scoping it to one
+* environment, so the environment is part of the key;
+* https://developer.apple.com/documentation/appstoreserverapi/transactionid):
+* a purchase can be refunded, reversed, and revoked
 * again, and the lookup must refuse every JWS signed before the latest
 * revocation. A record whose `revokedAt` does not parse counts as the
 * latest. A record no later than the kept one (a redelivery, or an older
@@ -221,9 +227,56 @@ export interface AppStoreRevocationRegistry extends AppStoreRevocationLookup, Ap
 * A process-local `AppStoreRevocationRegistry` for tests and single-process
 * hosts. It forgets everything on restart and is not shared between
 * instances (a Worker isolate is one), so a deployment that verifies
-* purchases offline needs a durable registry of its own.
+* purchases offline needs a durable registry of its own: the reference
+* game-services Worker keeps one in D1, and
+* `runAppStoreRevocationRegistryConformance` (in
+* `@mpgd/game-services/app-store-verifier-conformance`) checks another
+* implementation against the same rules.
 */
 export declare function createInMemoryAppStoreRevocationRegistry(): AppStoreRevocationRegistry;
+/** What `findRevocation` asks, without the `AbortSignal` (it does not cross a Worker service binding). */
+export type AppStoreRevocationLookupRequest = Omit<Parameters<AppStoreRevocationLookup['findRevocation']>[0], 'signal'>;
+/**
+* A revocation lookup's answer as data, for a lookup served by another
+* process: errors lose their class across a Worker service binding, so an
+* outage is `{ status: 'unavailable' }` rather than a thrown
+* `AppStoreDependencyUnavailableError`.
+*/
+export type AppStoreRevocationLookupAnswer = {
+  readonly status: 'found';
+  readonly record: AppStoreRevocationRecord;
+} | {
+  readonly status: 'absent';
+} | {
+  readonly status: 'unavailable';
+};
+/**
+* The registry of another Worker, reached through a service binding: the
+* reference game-services Worker serves it from D1 on its
+* `GameServicesAppStoreRevocations` entrypoint, next to the App Store Server
+* Notifications route that fills it.
+*/
+export interface AppStoreRevocationLookupBinding {
+  findAppStoreRevocation(input: AppStoreRevocationLookupRequest): Promise<AppStoreRevocationLookupAnswer>;
+}
+/**
+* Answers one lookup as data (`AppStoreRevocationLookupAnswer`): the serving
+* side of `createAppStoreRevocationLookupOverBinding`. An
+* `AppStoreDependencyUnavailableError` becomes `unavailable`; any other
+* error propagates.
+*/
+export declare function answerAppStoreRevocationLookup(lookup: AppStoreRevocationLookup, input: AppStoreRevocationLookupRequest, signal?: AbortSignal): Promise<AppStoreRevocationLookupAnswer>;
+/**
+* An `AppStoreRevocationLookup` over another Worker's registry
+* (`AppStoreRevocationLookupBinding`), for an `offline-only` purchase
+* verifier that runs apart from the notification route recording the
+* revocations. It fails closed: an `unavailable` answer, a binding that
+* throws, an answer of another shape or for another grant identity or environment, and an
+* abort of the verification are all `AppStoreDependencyUnavailableError`, so
+* the purchase stays `pending` (`APP_STORE_REVOCATION_LOOKUP_UNAVAILABLE`)
+* instead of granting without the check.
+*/
+export declare function createAppStoreRevocationLookupOverBinding(binding: AppStoreRevocationLookupBinding): AppStoreRevocationLookup;
 /**
 * Evidence schema of a commerce v2 App Store purchase (RFC B3): the payload's
 * `signedTransaction` is the StoreKit-verified JWS the client received. The

package/dist/app-store-verifier.js

@@ -21,21 +21,28 @@ class AppStoreResponseTooLargeError extends Error {
  * A process-local `AppStoreRevocationRegistry` for tests and single-process
  * hosts. It forgets everything on restart and is not shared between
  * instances (a Worker isolate is one), so a deployment that verifies
- * purchases offline needs a durable registry of its own.
+ * purchases offline needs a durable registry of its own: the reference
+ * game-services Worker keeps one in D1, and
+ * `runAppStoreRevocationRegistryConformance` (in
+ * `@mpgd/game-services/app-store-verifier-conformance`) checks another
+ * implementation against the same rules.
  */
 export function createInMemoryAppStoreRevocationRegistry() {
     const records = new Map();
+    // An environment is one of two fixed words, so the separator cannot collide.
+    const keyOf = (environment, verificationId) => `${environment}:${verificationId}`;
     return {
         async findRevocation(input) {
-            return records.get(input.verificationId);
+            return records.get(keyOf(input.environment, input.verificationId));
         },
         async recordRevocation(input) {
             assertNonEmptyString(input.record.verificationId, 'record.verificationId');
-            const kept = records.get(input.record.verificationId);
+            const key = keyOf(input.record.environment, input.record.verificationId);
+            const kept = records.get(key);
             if (kept !== undefined && !isLaterRevocation(input.record, kept)) {
                 return { alreadyRecorded: true };
             }
-            records.set(input.record.verificationId, { ...input.record });
+            records.set(key, { ...input.record });
             return { alreadyRecorded: false };
         },
     };
@@ -53,6 +60,101 @@ function isLaterRevocation(record, kept) {
     }
     return !Number.isFinite(recordMs) || recordMs > keptMs;
 }
+/**
+ * Answers one lookup as data (`AppStoreRevocationLookupAnswer`): the serving
+ * side of `createAppStoreRevocationLookupOverBinding`. An
+ * `AppStoreDependencyUnavailableError` becomes `unavailable`; any other
+ * error propagates.
+ */
+export async function answerAppStoreRevocationLookup(lookup, input, signal = new AbortController().signal) {
+    assertRecord(input, 'input');
+    assertNonEmptyString(input.verificationId, 'input.verificationId');
+    try {
+        const record = await lookup.findRevocation({
+            verificationId: input.verificationId,
+            environment: input.environment,
+            bundleId: input.bundleId,
+            transactionId: input.transactionId,
+            originalTransactionId: input.originalTransactionId,
+            signal,
+        });
+        return record === undefined ? { status: 'absent' } : { status: 'found', record };
+    }
+    catch (error) {
+        if (error instanceof AppStoreDependencyUnavailableError) {
+            return { status: 'unavailable' };
+        }
+        throw error;
+    }
+}
+/**
+ * An `AppStoreRevocationLookup` over another Worker's registry
+ * (`AppStoreRevocationLookupBinding`), for an `offline-only` purchase
+ * verifier that runs apart from the notification route recording the
+ * revocations. It fails closed: an `unavailable` answer, a binding that
+ * throws, an answer of another shape or for another grant identity or environment, and an
+ * abort of the verification are all `AppStoreDependencyUnavailableError`, so
+ * the purchase stays `pending` (`APP_STORE_REVOCATION_LOOKUP_UNAVAILABLE`)
+ * instead of granting without the check.
+ */
+export function createAppStoreRevocationLookupOverBinding(binding) {
+    assertRecord(binding, 'binding');
+    if (typeof binding.findAppStoreRevocation !== 'function') {
+        throw new Error('binding must implement findAppStoreRevocation.');
+    }
+    return {
+        async findRevocation({ signal, ...request }) {
+            if (signal.aborted) {
+                // Never call the binding for a verification already given up on.
+                throw new AppStoreDependencyUnavailableError('The App Store revocation lookup was aborted.', signal.reason);
+            }
+            const answer = await raceAbort(Promise.resolve().then(() => binding.findAppStoreRevocation({
+                verificationId: request.verificationId,
+                environment: request.environment,
+                bundleId: request.bundleId,
+                transactionId: request.transactionId,
+                originalTransactionId: request.originalTransactionId,
+            })), signal).catch((error) => {
+                throw new AppStoreDependencyUnavailableError('The App Store revocation registry binding did not answer.', error);
+            });
+            if (typeof answer === 'object' && answer !== null && !Array.isArray(answer)) {
+                if (answer.status === 'absent') {
+                    return undefined;
+                }
+                if (answer.status === 'found'
+                    && typeof answer.record === 'object'
+                    && answer.record !== null
+                    && answer.record.verificationId === request.verificationId
+                    && answer.record.environment === request.environment
+                    && typeof answer.record.revokedAt === 'string') {
+                    return answer.record;
+                }
+            }
+            throw new AppStoreDependencyUnavailableError('The App Store revocation registry is unavailable.');
+        },
+    };
+}
+/**
+ * `promise`, or a rejection once `signal` aborts (the binding itself cannot
+ * be cancelled). `promise` keeps its handlers either way, so its own later
+ * rejection is never unhandled.
+ */
+function raceAbort(promise, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason);
+        }
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+    });
+}
 /**
  * Evidence schema of a commerce v2 App Store purchase (RFC B3): the payload's
  * `signedTransaction` is the StoreKit-verified JWS the client received. The

package/dist/base64.d.ts

@@ -0,0 +1,10 @@
+/**
+* Strict base64 decoders shared inside the package (not exported). Both
+* answer undefined instead of throwing for anything that is not canonical
+* input: no whitespace, no characters outside the alphabet, no impossible
+* length, and at most two trailing `=` (standard alphabet only).
+*/
+/** Standard base64 (`+`, `/`), padding optional. Undefined when empty or invalid. */
+export declare function decodeBase64(input: string): Uint8Array<ArrayBuffer> | undefined;
+/** Unpadded base64url (`-`, `_`), as JWS segments use it. Undefined when empty or invalid. */
+export declare function decodeBase64Url(input: string): Uint8Array<ArrayBuffer> | undefined;

package/dist/base64.js

@@ -0,0 +1,35 @@
+/**
+ * Strict base64 decoders shared inside the package (not exported). Both
+ * answer undefined instead of throwing for anything that is not canonical
+ * input: no whitespace, no characters outside the alphabet, no impossible
+ * length, and at most two trailing `=` (standard alphabet only).
+ */
+/** Standard base64 (`+`, `/`), padding optional. Undefined when empty or invalid. */
+export function decodeBase64(input) {
+    const unpadded = /^([A-Za-z0-9+/]+)={0,2}$/u.exec(input)?.[1];
+    if (unpadded === undefined || unpadded.length % 4 === 1) {
+        return undefined;
+    }
+    return decodeUnpadded(unpadded);
+}
+/** Unpadded base64url (`-`, `_`), as JWS segments use it. Undefined when empty or invalid. */
+export function decodeBase64Url(input) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(input) || input.length % 4 === 1) {
+        return undefined;
+    }
+    return decodeUnpadded(input.replaceAll('-', '+').replaceAll('_', '/'));
+}
+function decodeUnpadded(base64) {
+    let binary;
+    try {
+        binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));
+    }
+    catch {
+        return undefined;
+    }
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}

package/dist/google-play-publisher-client.js

@@ -6,7 +6,9 @@ const publisherOrigin = 'https://androidpublisher.googleapis.com';
 export function createGooglePlayPublisherClient(options) {
     const requestFetch = options.fetch ?? fetch;
     async function request(method, path, signal) {
-        const accessToken = await options.getAccessToken(signal);
+        // A token source that ignores the signal (a service binding) is still
+        // bounded by it: the request fails when the caller gives up.
+        const accessToken = await untilAborted(Promise.resolve().then(() => options.getAccessToken(signal)), signal);
         if (accessToken.length === 0 || /[\s\x00-\x1f\x7f]/u.test(accessToken)) {
             throw new TypeError('Google Play Publisher access token is invalid.');
         }
@@ -193,3 +195,24 @@ async function readBoundedJson(response) {
     }
     return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
 }
+/** The promise, or an AbortError as soon as the signal aborts, whichever comes first. */
+function untilAborted(promise, signal) {
+    if (signal.aborted) {
+        void promise.catch(() => undefined);
+        return Promise.reject(new DOMException('Google Play Publisher request was cancelled.', 'AbortError'));
+    }
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            void promise.catch(() => undefined);
+            reject(new DOMException('Google Play Publisher request was cancelled.', 'AbortError'));
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', abort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', abort);
+            reject(error);
+        });
+    });
+}