@arcadible/sdk 0.3.0 → 0.3.1

package/dist/bus/client.js

@@ -2,11 +2,11 @@
 // alone when no page answers, running the page's end itself, in its own
 // page, so the rules are the same.
 // [import]
-import { ArcadibleError, BUS_VERSION, Codes, HANDSHAKE_TIMEOUT, HOST_ORIGINS, isMessage, isWelcome, REQUEST_TIMEOUT, } from "./protocol.js";
+import { ArcadibleError, BUS_VERSION, Codes, HANDSHAKE_TIMEOUT, isHostOrigin, isMessage, isWelcome, REQUEST_TIMEOUT, } from "./protocol.js";
 // [function]
 export function openBus(options) {
     const win = options.window ?? (typeof window === "undefined" ? undefined : window);
-    const origins = options.origins ?? HOST_ORIGINS;
+    const origins = options.origins;
     const requestTimeout = options.requestTimeout ?? REQUEST_TIMEOUT;
     let state = "waiting";
     let port = null;
@@ -79,7 +79,7 @@ export function openBus(options) {
         if (state !== "waiting" ||
             !win ||
             event.source !== win.parent ||
-            !origins.includes(event.origin) ||
+            !isHostOrigin(event.origin, origins) ||
             !isWelcome(event.data) ||
             !event.ports[0]) {
             return;

package/dist/bus/protocol.d.ts

@@ -2,6 +2,8 @@ export declare const BUS_VERSION = 1;
 export declare const HANDSHAKE_TIMEOUT = 1000;
 export declare const REQUEST_TIMEOUT = 10000;
 export declare const HOST_ORIGINS: readonly string[];
+export declare const LOCAL_ORIGIN: RegExp;
+export declare function isHostOrigin(origin: string, origins: readonly string[] | undefined): boolean;
 export declare const MAX_IN_FLIGHT = 64;
 export declare const MAX_MESSAGE: number;
 export declare const Codes: {

package/dist/bus/protocol.js

@@ -9,11 +9,23 @@ export const BUS_VERSION = 1;
 export const HANDSHAKE_TIMEOUT = 1000;
 // How long a request waits for its response.
 export const REQUEST_TIMEOUT = 10_000;
-// The play pages a game accepts a welcome from: production's only. A
-// development page (play.arcadible.test, `arc preview`) is passed with
-// `createClient({ origins })`, never trusted by what games ship, since a
-// hostile network could pose as an http one.
+// The play pages a game accepts a welcome from: production's, and `arc
+// serve`'s on this machine. Another development page (play.arcadible.test)
+// is passed with `createClient({ origins })`, never trusted by what games
+// ship, since a hostile network could pose as an http one.
 export const HOST_ORIGINS = ["https://play.arcadible.com"];
+// `arc serve`'s play page, on any port. The network can't pose as loopback,
+// and on Arcadible a build's `frame-ancestors` lets only the play page frame
+// it, so no local page can reach a player's saves there.
+export const LOCAL_ORIGIN = /^http:\/\/localhost:\d+$/u;
+// [function]
+// Whether a game accepts a welcome from `origin`: one of `origins` when it
+// was given, or else production's or `arc serve`'s.
+export function isHostOrigin(origin, origins) {
+    return origins
+        ? origins.includes(origin)
+        : HOST_ORIGINS.includes(origin) || LOCAL_ORIGIN.test(origin);
+}
 // The most requests one game can have waiting on the page; past it, a
 // request fails with `busy`.
 export const MAX_IN_FLIGHT = 64;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.3.0";
+export declare const VERSION = "0.3.1";

package/dist/version.js

@@ -1,3 +1,3 @@
 // The client's version, sent in its hello and shown as `arcadible.version`,
 // for bug reports. It matches package.json (test/unit/protocol.test.ts).
-export const VERSION = "0.3.0";
+export const VERSION = "0.3.1";

package/package.json

@@ -43,5 +43,5 @@
   ],
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "0.3.0"
+  "version": "0.3.1"
 }