@crowdedkingdoms/construct 0.4.0-dev.1 → 0.4.2-dev.1

package/node/security-headers.d.mts

@@ -4,7 +4,7 @@ export interface SecurityHeaderOptions {
   /** Additional exact origins a fork needs in connect-src. No wildcards. */
   extraConnectSrc?: string[];
   /**
-   * Origins that may FRAME this game (the Crowdy Games shell, or a shell of your own).
+   * Origins that may FRAME this game (a shell page of your own).
    * Empty (the default) renders `frame-ancestors 'none'`; the DSH pane always adds
    * `'self'` beside them.
    */

package/node/security-headers.mjs

@@ -79,10 +79,9 @@ export function buildCsp({ apiOrigins = [], extraConnectSrc = [], frameAncestors
     "default-src 'self'",
     "base-uri 'none'",
     "object-src 'none'",
-    // 'none' when self-hosted at the top level. When this game is FRAMED -- by the
-    // Crowdy Games shell (which the platform's content edge sets for you), or by a
-    // shell of your own -- name exactly that origin here (`frameAncestors`); a game
-    // that can be framed anywhere is a clickjacking surface.
+    // 'none' when self-hosted at the top level. When this game is FRAMED by a shell
+    // page of your own, name exactly that origin here (`frameAncestors`); a game that
+    // can be framed anywhere is a clickjacking surface.
     `frame-ancestors ${frameAncestorsSource(frameAncestors)}`,
     // 'wasm-unsafe-eval' lets the SDK instantiate WebAssembly (the Rust
     // language worker and the player-mod runtime). It grants no JS eval.
@@ -127,8 +126,8 @@ export function buildDshCsp({ apiOrigins = [], extraConnectSrc = [], frameAncest
     "base-uri 'none'",
     "object-src 'none'",
     // 'self' (the game page frames the pane) PLUS whoever frames the game: frame-ancestors
-    // is checked against EVERY ancestor, so under the Crowdy Games shell the pane's
-    // ancestors are the game and the shell, and 'self' alone would refuse it.
+    // is checked against EVERY ancestor, so under a shell the pane's ancestors are the
+    // game and the shell, and 'self' alone would refuse it.
     `frame-ancestors 'self'${frameAncestors.length ? ` ${frameAncestorsSource(frameAncestors)}` : ''}`,
     "script-src 'self' 'unsafe-eval' 'unsafe-inline' blob:",
     "style-src 'self' 'unsafe-inline'",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/construct",
-  "version": "0.4.0-dev.1",
+  "version": "0.4.2-dev.1",
   "description": "The Construct framework: the Crowded Kingdoms game platform layer (hosted sign-in, World Stores, voice/webcam/chat, Crowdy Studio dock, app and grid mods, grid programs) and engine loop, shared by the-construct starter and the games built on it. Ships TypeScript source for Vite.",
   "license": "MIT",
   "type": "module",
@@ -49,8 +49,8 @@
     "./grid/*": "./src/grid/*.ts"
   },
   "peerDependencies": {
-    "@crowdedkingdoms/crowdy-dsh": ">=0.4.0-dev.0 <1 || >=0.4.1-dev.0 <1 || >=0.4.2-dev.0 <1 || >=0.4.3-dev.0 <1 || >=0.4.4-dev.0 <1 || >=0.4.5-dev.0 <1 || >=0.5.0-dev.0 <1",
-    "@crowdedkingdoms/crowdyjs": ">=18.23.0-dev.0 <19"
+    "@crowdedkingdoms/crowdy-dsh": ">=0.4.0-dev.0 <1 || >=0.4.1-dev.0 <1 || >=0.4.2-dev.0 <1 || >=0.4.3-dev.0 <1 || >=0.4.4-dev.0 <1 || >=0.4.5-dev.0 <1 || >=0.5.0-dev.0 <1 || >=0.5.1-dev.0 <1",
+    "@crowdedkingdoms/crowdyjs": ">=18.23.0-dev.0 <19 || >=18.23.1-dev.0 <19"
   },
   "peerDependenciesMeta": {
     "@crowdedkingdoms/crowdy-dsh": {

package/src/platform/onboarding/steps.d.mts

@@ -108,7 +108,7 @@ export function ensureRedirectUris(
   identity: CrowdyClient,
   args: { appId: string; origins: string[] },
   log?: Logger,
-): Promise<{ redirectUris: string[]; added: string[] }>;
+): Promise<{ redirectUris: string[]; added: string[]; launchUrl: string | null }>;
 export function ensureConstructorTier(
   identity: CrowdyClient,
   input: { appId: string; userId: string },

package/src/platform/onboarding/steps.mjs

@@ -127,6 +127,11 @@ export async function ensureApp(identity, { orgId, orgSlug, name, slug, datacent
  * on the return leg and no CORS headers on anything else. Idempotent: existing
  * entries are kept, the given ones added; origin-matched by the server, so the
  * path does not matter but `/` keeps the list readable.
+ *
+ * An app with no launch URL also gets the first origin that is not loopback as
+ * its launch URL. Crowded Kingdoms does not host games, so that origin is where
+ * the game lives, and Crowdy Studio's Live code opens it. A launch URL the app
+ * already has is left alone.
  */
 export async function ensureRedirectUris(identity, { appId, origins }, log = noop) {
   const app = await identity.apps.app(appId);
@@ -134,14 +139,21 @@ export async function ensureRedirectUris(identity, { appId, origins }, log = noo
   const have = new Set(existing.map((u) => originOf(u)).filter(Boolean));
   const wanted = origins.map((o) => originOf(o)).filter(Boolean);
   const missing = [...new Set(wanted)].filter((o) => !have.has(o));
-  if (missing.length === 0) {
+  const launchOrigin = app?.launchUrl ? null : wanted.find((o) => !isLoopback(o));
+  const launchUrl = launchOrigin ? `${launchOrigin}/` : null;
+  if (missing.length === 0 && !launchUrl) {
     log(`Redirect URIs already cover ${wanted.join(', ')}`);
-    return { redirectUris: existing, added: [] };
+    return { redirectUris: existing, added: [], launchUrl: app?.launchUrl ?? null };
   }
   const redirectUris = [...existing, ...missing.map((o) => `${o}/`)];
-  await identity.portal.setAppClientSettings({ appId, redirectUris });
-  log(`Registered redirect origin(s) ${missing.join(', ')}`);
-  return { redirectUris, added: missing };
+  await identity.portal.setAppClientSettings({
+    appId,
+    redirectUris,
+    ...(launchUrl ? { launchUrl } : {}),
+  });
+  if (missing.length) log(`Registered redirect origin(s) ${missing.join(', ')}`);
+  if (launchUrl) log(`Launch URL set to ${launchUrl} (Crowdy Studio's Live code opens it)`);
+  return { redirectUris, added: missing, launchUrl: launchUrl ?? app?.launchUrl ?? null };
 }
 
 function originOf(value) {
@@ -152,6 +164,11 @@ function originOf(value) {
   }
 }
 
+function isLoopback(origin) {
+  const host = new URL(origin).hostname;
+  return host === 'localhost' || host === '[::1]' || host.startsWith('127.');
+}
+
 export async function ensureConstructorTier(identity, { appId, userId }, log = noop) {
   const tiers = await identity.appAccess.tiers(appId);
 
@@ -350,9 +367,25 @@ const AGENT_POLICY_CORE = `
 
 const AGENT_APP_POLICY_QUERY = `query ConstructAgentPolicy($appId: BigInt!) {
   crowdyStudioAgentPolicy(appId: $appId) { ${AGENT_POLICY_CORE} }
-  crowdyStudioAgentEffectivePolicy(appId: $appId) { ${AGENT_POLICY_CORE} }
+  crowdyStudioAgentEffectivePolicy(appId: $appId) {
+    ${AGENT_POLICY_CORE} funding { billingMode payerKind walletDebitEnabled }
+  }
 }`;
 
+/**
+ * Who pays for the agent's model use, as the effective policy has it. Metered, a
+ * request the payer's wallet cannot cover is refused, so say so up front.
+ */
+function fundingNote(effective) {
+  const funding = effective?.funding;
+  if (!funding) return 'funding not reported';
+  if (funding.billingMode !== 'METERED' || funding.walletDebitEnabled !== true) {
+    return 'platform-funded';
+  }
+  const payer = funding.payerKind === 'ORG' ? "the app's org wallet" : "each player's own wallet";
+  return `metered: model use is charged to ${payer}, which needs funds before the agent answers`;
+}
+
 const SET_AGENT_APP_POLICY = `mutation ConstructSetAgentPolicy($input: SetCrowdyStudioAgentAppPolicyInput!) {
   setCrowdyStudioAgentPolicy(input: $input) { ${AGENT_POLICY_CORE} }
 }`;
@@ -375,8 +408,8 @@ function catalogVisible(policy) {
  * The dock stays fail-closed until the *app* policy is enabled and the
  * player's Constructor tier holds `use_studio_agent`. The platform catalog is
  * an operator concern — this starter never reads or writes `cp*` fields.
- * Agent tokens are platform-funded; this does not touch a player wallet or an
- * OpenRouter key in the game.
+ * This touches no wallet and no OpenRouter key in the game; who pays for model
+ * use is the effective policy's funding, which the log reports.
  */
 export async function ensureAgentPolicy(identity, { appId }, log = noop) {
   let app;
@@ -400,7 +433,7 @@ export async function ensureAgentPolicy(identity, { appId }, log = noop) {
           'The dock stays closed until an operator publishes it. Studio → your app → Agent.',
       );
     } else {
-      log('Studio Agent app policy already enabled');
+      log(`Studio Agent app policy already enabled (${fundingNote(effective)})`);
     }
     return { enabled: true, skipped: true };
   }
@@ -447,7 +480,7 @@ export async function ensureAgentPolicy(identity, { appId }, log = noop) {
           'Studio → your app → Agent; dock stays closed.',
       );
     } else {
-      log('Studio Agent app policy enabled (platform-funded; no player OpenRouter key)');
+      log(`Studio Agent app policy enabled (${fundingNote(latestEffective)})`);
     }
     return { enabled: true, skipped: false };
   } catch (error) {

package/src/platform/onboarding/steps.test.ts

@@ -494,3 +494,126 @@ describe('onboarding steps', () => {
     expect(resConnected.repo).toBe('modder/my-mod');
   });
 });
+
+describe('ensureRedirectUris', () => {
+  function clientFor(app: Any): Any {
+    return {
+      apps: { app: vi.fn(async () => app) },
+      portal: { setAppClientSettings: vi.fn(async () => ({})) },
+    };
+  }
+
+  it('adds the missing origins and makes the first public one the launch URL when there is none', async () => {
+    const client = clientFor({ redirectUris: ['http://localhost:5175/'], launchUrl: null });
+    const result = await steps.ensureRedirectUris(client, {
+      appId: '7',
+      origins: ['http://localhost:5175', 'https://play.example.com'],
+    });
+    expect(client.portal.setAppClientSettings).toHaveBeenCalledWith({
+      appId: '7',
+      redirectUris: ['http://localhost:5175/', 'https://play.example.com/'],
+      launchUrl: 'https://play.example.com/',
+    });
+    expect(result).toEqual({
+      redirectUris: ['http://localhost:5175/', 'https://play.example.com/'],
+      added: ['https://play.example.com'],
+      launchUrl: 'https://play.example.com/',
+    });
+  });
+
+  it('sets the launch URL even when the origin is already registered', async () => {
+    const client = clientFor({ redirectUris: ['https://play.example.com/'], launchUrl: null });
+    await steps.ensureRedirectUris(client, { appId: '7', origins: ['https://play.example.com'] });
+    expect(client.portal.setAppClientSettings).toHaveBeenCalledWith({
+      appId: '7',
+      redirectUris: ['https://play.example.com/'],
+      launchUrl: 'https://play.example.com/',
+    });
+  });
+
+  it('leaves a launch URL the app already has, and never makes loopback the launch URL', async () => {
+    const kept = clientFor({ redirectUris: [], launchUrl: 'https://mine.example/' });
+    await steps.ensureRedirectUris(kept, { appId: '7', origins: ['https://play.example.com'] });
+    expect(kept.portal.setAppClientSettings).toHaveBeenCalledWith({
+      appId: '7',
+      redirectUris: ['https://play.example.com/'],
+    });
+
+    const local = clientFor({ redirectUris: [], launchUrl: null });
+    const result = await steps.ensureRedirectUris(local, {
+      appId: '7',
+      origins: ['http://localhost:5175', 'http://127.0.0.1:4173'],
+    });
+    expect(local.portal.setAppClientSettings).toHaveBeenCalledWith({
+      appId: '7',
+      redirectUris: ['http://localhost:5175/', 'http://127.0.0.1:4173/'],
+    });
+    expect(result.launchUrl).toBeNull();
+  });
+
+  it('writes nothing when every origin is registered and the launch URL is set', async () => {
+    const client = clientFor({
+      redirectUris: ['https://play.example.com/'],
+      launchUrl: 'https://play.example.com/',
+    });
+    const result = await steps.ensureRedirectUris(client, {
+      appId: '7',
+      origins: ['https://play.example.com'],
+    });
+    expect(client.portal.setAppClientSettings).not.toHaveBeenCalled();
+    expect(result.added).toEqual([]);
+  });
+});
+
+describe('ensureAgentPolicy funding note', () => {
+  const ready = (funding: Any) => ({
+    enabled: true,
+    killSwitch: false,
+    allowedModelIds: [steps.STUDIO_AGENT_MODEL],
+    allowedModes: [...steps.STUDIO_AGENT_MODES],
+    funding,
+  });
+
+  it('says who pays when the tier meters model use', async () => {
+    const lines: string[] = [];
+    const policy = ready({ billingMode: 'METERED', payerKind: 'PLAYER', walletDebitEnabled: true });
+    const query = vi.fn(async () => ({
+      crowdyStudioAgentPolicy: policy,
+      crowdyStudioAgentEffectivePolicy: policy,
+    }));
+    await steps.ensureAgentPolicy({ graphql: { query } } as never, { appId: '77' }, (line) =>
+      lines.push(line),
+    );
+    expect(lines.join('\n')).toMatch(/metered: model use is charged to each player's own wallet/);
+
+    const orgLines: string[] = [];
+    const orgPolicy = ready({ billingMode: 'METERED', payerKind: 'ORG', walletDebitEnabled: true });
+    const orgQuery = vi.fn(async () => ({
+      crowdyStudioAgentPolicy: orgPolicy,
+      crowdyStudioAgentEffectivePolicy: orgPolicy,
+    }));
+    await steps.ensureAgentPolicy(
+      { graphql: { query: orgQuery } } as never,
+      { appId: '77' },
+      (line) => orgLines.push(line),
+    );
+    expect(orgLines.join('\n')).toMatch(/the app's org wallet/);
+  });
+
+  it('says platform-funded only when the tier does not meter', async () => {
+    const lines: string[] = [];
+    const policy = ready({
+      billingMode: 'PLATFORM_FUNDED',
+      payerKind: 'PLATFORM',
+      walletDebitEnabled: false,
+    });
+    const query = vi.fn(async () => ({
+      crowdyStudioAgentPolicy: policy,
+      crowdyStudioAgentEffectivePolicy: policy,
+    }));
+    await steps.ensureAgentPolicy({ graphql: { query } } as never, { appId: '77' }, (line) =>
+      lines.push(line),
+    );
+    expect(lines.join('\n')).toMatch(/already enabled \(platform-funded\)/);
+  });
+});