@crowdedkingdoms/crowdy-dsh 0.5.0-dev.1 → 0.5.1-test.1

package/README.md

@@ -73,9 +73,19 @@ cached files. Both sides drop frames without the boot nonce: a
 implements the page side in `src/crowdy-dsh/`; it also confirms a live deploy
 with the player on the page before running it.
 
+The game's own host serves the page and `/dsh/`. Crowded Kingdoms does not
+host games: the developer deploys both to the game's origin, on any static
+host that can set response headers.
+[Host your game](https://docs.crowdedkingdoms.com/build-a-game/host-your-game)
+and the Construct's
+[hosting guide](https://github.com/CrowdedKingdoms/the-construct/blob/prod/docs/HOSTING.md)
+have the full header set and recipes for common hosts.
+
 Headers the host must send (verified with `crossOriginIsolated === true`):
-game page CSP unchanged except `frame-src 'self'`; every `/dsh/*` response
-carries `script-src 'self' 'unsafe-eval' 'unsafe-inline' blob:`,
+the cross-origin isolation headers (COOP `same-origin` and a COEP) on every
+response, `/dsh/*` included; game page CSP unchanged except `frame-src 'self'`;
+every `/dsh/*` response carries
+`script-src 'self' 'unsafe-eval' 'unsafe-inline' blob:`,
 `connect-src 'self' blob:`, `worker-src 'self' blob:`, `frame-ancestors 'self'`
 (the worker compiles pre-lowered module bodies with `new Function`; the harness
 document runs its own client module system). The API and model endpoints must
@@ -92,11 +102,12 @@ a `persistScope` of its own (sessions of the two editors never mix) and
 older worker says so instead of running the mod editor on a game.
 
 - **The draft is the page's.** CrowdyJS keeps it (a `DraftStore`: an overlay
-  over the repository at a base commit, in the browser for a hosted game, on
-  the dev server's checkout locally). The worker's filesystem is a view of it:
-  `draft.tree` once, then every change through `page.draftChanged`; text by
-  `draft.read` in batches, cached by blob id. Versions are git blob SHA-1s, so
-  listing, `stat` and `read_file` agree with what the page shows.
+  over the repository at a base commit, in the browser when the game runs from
+  its own deployed origin, on the dev server's checkout locally). The worker's
+  filesystem is a view of it: `draft.tree` once, then every change through
+  `page.draftChanged`; text by `draft.read` in batches, cached by blob id.
+  Versions are git blob SHA-1s, so listing, `stat` and `read_file` agree with
+  what the page shows.
 - **Writes are guarded the harness's way.** A write carries the tool's intent
   (`createIfAbsent`, or `replaceIfVersion` as `ifHash`); a file the player
   changed since the model read it is a stale write (`FS_STALE_VERSION`), never
@@ -141,7 +152,10 @@ Once the pin publishes, the hint is inert; drop it with the next SDK bump.
 `vfs-image.tar.gz`, ~7 MB), `BUILD.json` (package version, this repo's commit,
 upstream tag and commit, the CrowdyJS the worker bundles, sha256 of every file),
 `LICENSE.deepseek-harness` and `THIRD_PARTY_NOTICES.md`. Serve it under
-`/dsh/` of the game origin.
+`/dsh/` of the game's own origin, with the headers above.
+`preview/vfs-image.tar.gz` must reach the browser with no `Content-Encoding`
+header, because the worker decompresses it itself; a host that adds
+`Content-Encoding: gzip` to `.gz` files needs an exception for that file.
 
 The build refuses an artifact that names the builder's home directory or the
 upstream checkout path (`//#region` markers and `patched by` comments are

package/dist/dsh-web/BUILD.json

@@ -1,10 +1,10 @@
 {
   "package": "@crowdedkingdoms/crowdy-dsh",
-  "version": "0.5.0",
-  "builtAt": "2026-10-29T18:46:30.824Z",
+  "version": "0.5.1",
+  "builtAt": "2026-10-30T01:16:21.091Z",
   "source": {
     "repository": "CrowdedKingdoms/crowdy-dsh",
-    "commit": "c92aba4652a01e190173d08d38cb8cc3aa72feaa",
+    "commit": "7c091864b480fae82820bf324c4dfa5a3a962718",
     "dirty": false
   },
   "upstream": {
@@ -15,7 +15,7 @@
   },
   "crowdyjs": {
     "name": "@crowdedkingdoms/crowdyjs",
-    "version": "18.23.0-dev.1",
+    "version": "18.23.1-test.1",
     "source": "node_modules"
   },
   "files": {
@@ -112,7 +112,7 @@
     "manifest.webmanifest": "sha256:9b54d57eea00f2fdd1affe6e7999a4209a515755f12ac1a3299da2d55e178d4c",
     "preview/bootstrap-CYECZNXt.js": "sha256:9f303a0485c0badfdd19fad0c357ef050c5b9a343744ab5bf0c70015e7d95092",
     "preview/crowdy-boot-Cklh1qNl.js": "sha256:b21e8eb126e1cd8a52159d2d577e610df6c8af36a436f9ed5028cfabd11a85ff",
-    "preview/vfs-image.tar.gz": "sha256:4a0db11a886375b333ab3ce340d363a7ae49d6b69aa76e8595842a9cf98c94d0",
+    "preview/vfs-image.tar.gz": "sha256:2418544db16aaa805f7db5020ab2aca95d16505b0bbc0771f5c4d2ba964a7c6e",
     "preview/worker-C8-_ANaz.js": "sha256:81099e5732dfe0c32bacd5897316b7956c5a0a22da01b4a0c6e21d0a3b9d9aa1"
   }
 }

package/lib/vendor/crowdyjs-sdk.version.json

@@ -1,5 +1,5 @@
 {
   "name": "@crowdedkingdoms/crowdyjs",
-  "version": "18.23.0-dev.1",
+  "version": "18.23.1-test.1",
   "source": "node_modules"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/crowdy-dsh",
-  "version": "0.5.0-dev.1",
+  "version": "0.5.1-test.1",
   "private": false,
   "license": "MIT",
   "repository": {
@@ -110,11 +110,11 @@
   "crowdyDsh": {
     "build": {
       "package": "@crowdedkingdoms/crowdy-dsh",
-      "version": "0.5.0",
-      "builtAt": "2026-10-29T18:46:30.824Z",
+      "version": "0.5.1",
+      "builtAt": "2026-10-30T01:16:21.091Z",
       "source": {
         "repository": "CrowdedKingdoms/crowdy-dsh",
-        "commit": "c92aba4652a01e190173d08d38cb8cc3aa72feaa",
+        "commit": "7c091864b480fae82820bf324c4dfa5a3a962718",
         "dirty": false
       },
       "upstream": {
@@ -125,7 +125,7 @@
       },
       "crowdyjs": {
         "name": "@crowdedkingdoms/crowdyjs",
-        "version": "18.23.0-dev.1",
+        "version": "18.23.1-test.1",
         "source": "node_modules"
       },
       "files": {
@@ -222,7 +222,7 @@
         "manifest.webmanifest": "sha256:9b54d57eea00f2fdd1affe6e7999a4209a515755f12ac1a3299da2d55e178d4c",
         "preview/bootstrap-CYECZNXt.js": "sha256:9f303a0485c0badfdd19fad0c357ef050c5b9a343744ab5bf0c70015e7d95092",
         "preview/crowdy-boot-Cklh1qNl.js": "sha256:b21e8eb126e1cd8a52159d2d577e610df6c8af36a436f9ed5028cfabd11a85ff",
-        "preview/vfs-image.tar.gz": "sha256:4a0db11a886375b333ab3ce340d363a7ae49d6b69aa76e8595842a9cf98c94d0",
+        "preview/vfs-image.tar.gz": "sha256:2418544db16aaa805f7db5020ab2aca95d16505b0bbc0771f5c4d2ba964a7c6e",
         "preview/worker-C8-_ANaz.js": "sha256:81099e5732dfe0c32bacd5897316b7956c5a0a22da01b4a0c6e21d0a3b9d9aa1"
       }
     }