@crowdedkingdoms/crowdyjs 17.1.0-test.1 → 17.2.0-dev.1

package/MIGRATION.md

@@ -1,3 +1,32 @@
+# CrowdyJS v17.2 — publish to Crowdy Games; sign-in under the shell
+
+**Additive.** `17.2.0` (2026-09-14). Tracks ck-api `v2.1.0` (third-party game
+hosting). Nothing existing changes shape; two things are new.
+
+- **`client.hosting`** wraps the hosting surface: `claim({ appId, slug? })`,
+  `beginPublish({ slug, files })`, `completePublish(slug, publishId)`,
+  `abandonPublish`, `setEnabled`, `publishes`, `mine`; public `game(slug)` and
+  `listed()`; operator `all()`, `setListing`, `takeDown`. Every mutation needs an
+  identity session with `manage_apps` (a game's own app token is refused, so a
+  bundle can never publish a replacement for itself). The new subpath
+  `@crowdedkingdoms/crowdyjs/hosting` exports `publishDirectory(client, { dir,
+  slug })` and `manifestForDirectory(dir)` for Node; the root exports
+  `uploadPublishFiles` for a browser tool.
+- **`EmbeddedHost`** (`client.embeddedHost`, `CrowdyClientConfig.embeddedHost`):
+  when a game published to Crowdy Games runs inside the first-party shell's
+  iframe, `portal.signIn` learns the shell's return URL and Studio origin from a
+  `crowdyjs:host-hello`, uses the shell's page as `redirect_uri`, and asks the
+  shell to navigate (`crowdyjs:navigate`) instead of `location.assign`. The PKCE
+  verifier stays in the game origin; `handleSignInCallback` is unchanged because
+  the shell relays `?code=&state=` into the iframe's `src`. Detection is a bounded
+  hello (1.5 s) and falls back to the ordinary flow, so a self-hosted or
+  top-level game behaves exactly as before. `SignInParams.embedded: false` or
+  `createCrowdyClient({ embeddedHost: false })` opts out. `portal.embeddedHostInfo()`
+  tells a game whether it is under a shell.
+
+No removals. Error codes added: `CONTENT_HOSTING_DISABLED`,
+`HOSTED_SLUG_UNAVAILABLE`, `HOSTED_MANIFEST_INVALID`, `HOSTED_PUBLISH_INCOMPLETE`,
+`HOSTED_GAME_TAKEN_DOWN`.
 # CrowdyJS v17.1 — binary-relay sends are bundled
 
 **Nothing removed.** `17.1.0` (2026-09-13). On the binary relay

package/README.md

@@ -98,6 +98,19 @@ sign-in mutations are refused from a non-first-party browser origin with
 customer's domain that collects it is indistinguishable, to the platform and to
 the player, from a phishing page.
 
+**A game published to Crowdy Games takes the first row too, with one twist the SDK
+handles for you** (17.2.0). Such a game is reached at `https://<games host>/<slug>/`,
+which is a first-party *shell* page, and runs inside that page's iframe on its own
+origin, `https://<slug>.<content host>`. The iframe cannot navigate the tab and
+Studio refuses to be framed, so `portal.signIn` asks the shell to navigate
+(`crowdyjs:navigate`; the shell honours exactly the tier's Studio `/authorize`) and
+uses the shell's page as the `redirect_uri` -- the shell then hands the returned
+`?code=&state=` into the iframe, where `portal.handleSignInCallback` runs exactly as
+it does self-hosted. Nothing changes in your code: the bridge (`client.embeddedHost`,
+`EmbeddedHost`) detects the shell with a bounded hello and falls back to the
+top-level flow when nobody answers. Pass `embeddedHost: false` to `createCrowdyClient`
+to never consult a framing page.
+
 **Hosted sign-in** (browser game, own domain) is OAuth2 Authorization Code +
 PKCE; the verifier never leaves your origin and your page never sees a
 credential:
@@ -208,6 +221,7 @@ never told about, so a native refresh without it is a re-placement.
 | `client.users` | `me`, `updateGamertag`, profile reads. |
 | `client.session` | Token store, `restore()`, `getToken()`, manual `setToken()`. |
 | `client.portal` | App-scoped token minting (`mintAppToken`) and the cross-origin PKCE entry flow (`beginEntry` / `handleAuthorizeRequest` / `completeEntry` / `refresh`). |
+| `client.hosting` | Third-party hosting on Crowdy Games (17.2.0): `claim` a slug for an app, `beginPublish` / `completePublish` / `abandonPublish` a built bundle, `setEnabled`; public `game(slug)` / `listed()`; operator `all` / `setListing` / `takeDown`. Mutations need an identity session with `manage_apps`. `@crowdedkingdoms/crowdyjs/hosting` exports `publishDirectory(client, { dir, slug })`, the Node helper that does the whole publish for a `dist/`. |
 | `client.platform` | Public platform configuration (`config()`). |
 | `client.serverStatus` | `gameClientBootstrap(appId)` — per-app version info, UDP status, spatial limits. |
 | `client.chunks`, `client.voxels`, `client.actors`, `client.avatars`, `client.state` | World data reads + writes: terrain/LODs, voxel edit + history/rollback, durable actors, avatars, per-user app state blobs. |
@@ -634,6 +648,38 @@ See the docs guides [Modeling game concepts](https://docs.crowdedkingdoms.com/ga
 (the SDK surface + the simulation-tier / notify-to-pull / timer / hidden-info
 / anti-cheat patterns).
 
+## Hosting a game on Crowdy Games
+
+Since 17.2.0 (ck-api v2.1) a developer can publish a built static bundle to the
+platform instead of hosting it: players reach it at
+`https://<games host>/<slug>/` and it executes on an origin of its own,
+`https://<slug>.<content host>`, behind the same security headers `the-construct`'s
+`docs/HOSTING.md` asks a self-hoster to serve. The API returns both URLs
+(`HostedGame.launchUrl`, `.contentOrigin`); nothing in your code names a host.
+
+From Node, with an identity session (never from a browser page, by design):
+
+```ts
+import { createCrowdyClient } from '@crowdedkingdoms/crowdyjs';
+import { publishDirectory } from '@crowdedkingdoms/crowdyjs/hosting';
+
+const client = createCrowdyClient();
+await client.auth.login({ email, password });               // identity session, Node only
+const game = await client.hosting.claim({ appId, slug: 'my-game' }); // once; idempotent
+const result = await publishDirectory(client, { dir: 'dist', slug: game.slug });
+console.log(result.game.launchUrl);                          // https://.../my-game/
+```
+
+`claim` registers the shell page and the game origin as the app's redirect URIs
+and sets `launch_url`; `publishDirectory` hashes `dist/`, declares the manifest
+(`beginGamePublish` validates it as a whole and returns one presigned PUT per file),
+uploads with the exact signed headers, and `completeGamePublish` verifies every
+object, promotes it and invalidates the CDN. The slug is a DNS label, global on the
+tier, and first-party names are reserved (`HOSTED_SLUG_UNAVAILABLE`); a tier without
+a content CDN answers `CONTENT_HOSTING_DISABLED`. Being *listed* in the lobby is an
+operator decision (`setListing`); publishing is self-serve. `the-construct`'s
+`npm run publish` is this section as a command.
+
 ## Crowdy Studio
 
 Crowdy Studio is the in-game SERVER/CLIENT Rust authoring surface for player

package/dist/crowdy-client.d.ts

@@ -32,6 +32,8 @@ import { GameKitClient, type GameKitOptions } from './kit/index.js';
 import { AuthAPI } from './domains/auth.js';
 import { UsersAPI } from './domains/users.js';
 import { AppsAPI } from './domains/apps.js';
+import { EmbeddedHost } from './domains/embedded-host.js';
+import { HostingAPI } from './domains/hosting.js';
 import { PortalAPI, type AppTokenResponse, type PkceStore } from './domains/portal.js';
 import { PlatformAPI } from './domains/platform.js';
 import { OrganizationsAPI } from './domains/organizations.js';
@@ -99,6 +101,15 @@ export interface CrowdyClientConfig {
      * or tests where sessionStorage is unavailable.
      */
     pkceStore?: PkceStore;
+    /**
+     * The Crowdy Games shell bridge (third-party hosting, 2026-09-13). When a game
+     * published to Crowdy Games runs inside the first-party shell's iframe,
+     * `portal.signIn` must ask the shell to navigate to Studio and must use the shell's
+     * page as the redirect URI; this bridge is how it learns both. Default: detect in a
+     * browser (`new EmbeddedHost()`), nothing in Node. Pass `false` to never consult a
+     * framing page, or your own instance to control timeouts.
+     */
+    embeddedHost?: EmbeddedHost | false;
     /** Realtime (WebSocket) tuning for reconnect backoff and `...AndWait` timeouts. */
     realtime?: {
         /** Max reconnect attempts before giving up (default tuned for browsers). */
@@ -203,6 +214,15 @@ export declare class CrowdyClient {
      * app token.
      */
     readonly portal: PortalAPI;
+    /**
+     * Third-party game hosting on Crowdy Games: claim a slug, publish a bundle, list
+     * hosted games. Mutations need an identity session with manage_apps; the reads a
+     * page needs are public. `@crowdedkingdoms/crowdyjs/hosting` has the Node helper
+     * that publishes a directory.
+     */
+    readonly hosting: HostingAPI;
+    /** The Crowdy Games shell bridge (see `CrowdyClientConfig.embeddedHost`); null in Node or when opted out. */
+    readonly embeddedHost: EmbeddedHost | null;
     /**
      * Where each app lives. Unauthenticated, and meant to be called BEFORE login against
      * the shared origin, so the session and the app token are both written in the app's

package/dist/crowdy-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IAEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;YAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,GAAG,IAAI,CAAC,CAAC;QACV;;;;;;;;;WASG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iEAAiE;QACjE,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAGlC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IAEzD,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IAwM3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;YAczC,2BAA2B;IAezC;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASlD;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,aAAa;IAS3D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAKb,yDAAyD;IACzD,IAAI,eAAe,IAAI,MAAM,CAE5B;CACF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}
+{"version":3,"file":"crowdy-client.d.ts","sourceRoot":"","sources":["../src/crowdy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IAEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE;QACT,4EAA4E;QAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iDAAiD;QACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,+EAA+E;QAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;WAGG;QACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;YAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,GAAG,IAAI,CAAC,CAAC;QACV;;;;;;;;;WASG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iEAAiE;QACjE,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,oBAAoB,CAA0C;IAEtE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAGlC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAGzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IAEzD,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAEnB,MAAM,GAAE,kBAAuB;IA6M3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,0DAA0D;IAC1D,QAAQ,IAAI,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;YAczC,2BAA2B;IAezC;;;;OAIG;IACG,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IASlD;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAIjC;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,aAAa;IAS3D,gEAAgE;IAChE,KAAK,IAAI,IAAI;IAMb,yDAAyD;IACzD,IAAI,eAAe,IAAI,MAAM,CAE5B;CACF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,YAAY,CAEd"}

package/dist/crowdy-client.js

@@ -33,6 +33,8 @@ import { GameKitClient } from './kit/index.js';
 import { AuthAPI } from './domains/auth.js';
 import { UsersAPI } from './domains/users.js';
 import { AppsAPI } from './domains/apps.js';
+import { EmbeddedHost } from './domains/embedded-host.js';
+import { HostingAPI } from './domains/hosting.js';
 import { PortalAPI, } from './domains/portal.js';
 import { PlatformAPI } from './domains/platform.js';
 import { OrganizationsAPI } from './domains/organizations.js';
@@ -184,7 +186,12 @@ export class CrowdyClient {
         this.auth = new AuthAPI(this.graphql, this.session);
         this.users = new UsersAPI(this.graphql);
         this.apps = new AppsAPI(this.graphql);
-        this.portal = new PortalAPI(this.graphql, this.session, config.pkceStore);
+        this.embeddedHost =
+            config.embeddedHost === false
+                ? null
+                : config.embeddedHost ?? (typeof globalThis.window !== 'undefined' ? new EmbeddedHost() : null);
+        this.portal = new PortalAPI(this.graphql, this.session, config.pkceStore, this.embeddedHost);
+        this.hosting = new HostingAPI(this.graphql);
         this.discovery = new DiscoveryDomain(this.graphql);
         this.platform = new PlatformAPI(this.graphql);
         this.organizations = new OrganizationsAPI(this.graphql);
@@ -343,6 +350,7 @@ export class CrowdyClient {
     close() {
         this.realtime.close();
         this.session.setToken(null);
+        this.embeddedHost?.close();
     }
     /** The configured or discovered GraphQL endpoint URL. */
     get graphqlEndpoint() {

package/dist/default-origin.d.ts

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier test` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,14 +10,14 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'test'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export declare const CROWDY_DEFAULT_TIER = "test";
+export declare const CROWDY_DEFAULT_TIER = "dev";
 /** The public CK API origin for that tier. */
-export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HTTP_ORIGIN = "https://ck.dev.crowdedkingdoms.com";
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_WS_ORIGIN = "wss://ck.dev.crowdedkingdoms.com";
 /** The bare hostname, for callers that need to compare rather than dial. */
-export declare const CROWDY_DEFAULT_HOST = "ck.test.crowdedkingdoms.com";
+export declare const CROWDY_DEFAULT_HOST = "ck.dev.crowdedkingdoms.com";
 //# sourceMappingURL=default-origin.d.ts.map

package/dist/default-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,wCAAwC,CAAC;AAEhF,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC"}
+{"version":3,"file":"default-origin.d.ts","sourceRoot":"","sources":["../src/default-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,uCAAuC,CAAC;AAE/E,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAE3E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,+BAA+B,CAAC"}

package/dist/default-origin.js

@@ -1,6 +1,6 @@
 /**
  * GENERATED — do not edit. The operator tooling's
- * `sync-client-origins.mjs --write --tier test` writes this file, and
+ * `sync-client-origins.mjs --write --tier dev` writes this file, and
  * `check-sdk-default-origin.mjs` refuses it when it names the wrong tier or a
  * host that declaration does not carry. Regenerate; never hand-edit.
  *
@@ -10,13 +10,13 @@
  * than no default at all. Every fallback this SDK ever removed named a host that
  * was already dead. A generated file plus a gate is what makes this one different.
  *
- * Source: the operator's per-tier public CK API origin declaration, tier 'test'
+ * Source: the operator's per-tier public CK API origin declaration, tier 'dev'
  */
 /** The tier this build of the SDK is published for. */
-export const CROWDY_DEFAULT_TIER = 'test';
+export const CROWDY_DEFAULT_TIER = 'dev';
 /** The public CK API origin for that tier. */
-export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HTTP_ORIGIN = 'https://ck.dev.crowdedkingdoms.com';
 /** The same host over WebSocket. A scheme is composed; a hostname is looked up. */
-export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_WS_ORIGIN = 'wss://ck.dev.crowdedkingdoms.com';
 /** The bare hostname, for callers that need to compare rather than dial. */
-export const CROWDY_DEFAULT_HOST = 'ck.test.crowdedkingdoms.com';
+export const CROWDY_DEFAULT_HOST = 'ck.dev.crowdedkingdoms.com';

package/dist/domains/embedded-host.d.ts

@@ -0,0 +1,126 @@
+/**
+ * The embedded-host bridge: how a game framed by the Crowdy Games SHELL signs in.
+ *
+ * A game published to Crowdy Games (`client.hosting`, the-construct's `npm run
+ * publish`) is reached at `https://<games host>/<slug>/`, which is a first-party
+ * shell page, and executes inside that page's iframe on its own origin,
+ * `https://<slug>.<content host>`. Two things about that arrangement change hosted
+ * sign-in, and this module is the whole of the change:
+ *
+ *   1. The game cannot navigate the tab. Its iframe has no `allow-top-navigation`
+ *      (a game that could send the player to a lookalike sign-in page would have the
+ *      phishing surface the shell exists to remove), and Studio refuses to be framed.
+ *      So `portal.signIn` asks the SHELL to navigate -- `crowdyjs:navigate` -- and
+ *      the shell honours exactly one destination: the tier's Studio `/authorize`.
+ *
+ *   2. The redirect URI is the SHELL's page, not the iframe's. Studio sends the code
+ *      back to `https://<games host>/<slug>/` (the app's registered redirect URI, which
+ *      `claimGameHosting` registered); the shell moves `?code=&state=` onto the iframe's
+ *      `src` and strips it from its own address bar; the game's
+ *      `handleSignInCallback()` then reads its own `location.search` exactly as it does
+ *      when self-hosted. The shell tells the game which return URL to use in
+ *      `crowdyjs:host-hello`.
+ *
+ * WHAT DOES NOT CHANGE. The PKCE pair is generated here, in the game's origin, and the
+ * verifier stays in the game origin's sessionStorage. The shell relays a code it cannot
+ * spend. The app token is exchanged and stored by the game as before.
+ *
+ * WHY TRUSTING THE PARENT IS SAFE. The bridge accepts `crowdyjs:host-hello` only from
+ * `window.parent`. When the game is served by the Crowdy Games content edge, its
+ * `frame-ancestors` names the tier's games host and nothing else, so the parent IS the
+ * shell. A self-hosted game framed by a hostile page could be told a hostile
+ * `returnUrl` -- and Studio would refuse it, because it is not one of the app's
+ * registered redirect URIs; and even a code delivered to a registered-but-wrong page
+ * is useless without the verifier in this origin. The bridge also refuses a
+ * `returnUrl` whose origin is not https (or the parent's own origin, for a local dev
+ * shell), so the failure is loud rather than a silent detour.
+ *
+ * The message shapes mirror Crowdy-Games `shell/src/protocol.ts` (version 1).
+ */
+export declare const EMBEDDED_HOST_PROTOCOL_VERSION = 1;
+export interface HostHelloMessage {
+    type: 'crowdyjs:host-hello';
+    version: number;
+    /** The URL hosted sign-in must return to: the shell's page for this game. */
+    returnUrl: string;
+    /** The Studio origin the shell will navigate to for `/authorize`. */
+    authorizeOrigin: string;
+    /** The slug the shell is showing. */
+    slug: string;
+}
+export interface HostHelloRequestMessage {
+    type: 'crowdyjs:host-hello-request';
+    version: number;
+}
+export interface NavigateMessage {
+    type: 'crowdyjs:navigate';
+    version: number;
+    url: string;
+}
+/** What the game learned from the shell. */
+export interface EmbeddedHostInfo {
+    /** The shell's origin (`event.origin` of the hello) -- the only target navigate posts to. */
+    hostOrigin: string;
+    returnUrl: string;
+    authorizeOrigin: string;
+    slug: string;
+}
+/** The DOM surface the bridge needs, narrow so tests can hand it a fake. */
+export interface EmbeddedWindow {
+    parent: unknown;
+    addEventListener(type: 'message', listener: (event: EmbeddedMessageEvent) => void): void;
+    removeEventListener(type: 'message', listener: (event: EmbeddedMessageEvent) => void): void;
+    location?: {
+        origin?: string;
+    };
+}
+export interface EmbeddedMessageEvent {
+    data: unknown;
+    origin: string;
+    source: unknown;
+}
+export interface ParentWindow {
+    postMessage(message: unknown, targetOrigin: string): void;
+}
+export interface EmbeddedHostOptions {
+    /** How long `hello()` waits for the shell before deciding the game is not framed by one. */
+    helloTimeoutMs?: number;
+}
+/**
+ * Detects and talks to a Crowdy Games shell framing this page. Constructed once by
+ * `createCrowdyClient` (see `CrowdyClientConfig.embeddedHost`); `portal.signIn`
+ * consults it.
+ */
+export declare class EmbeddedHost {
+    private readonly win;
+    private info;
+    private pending;
+    private readonly listener;
+    private readonly helloTimeoutMs;
+    constructor(win?: EmbeddedWindow | null, options?: EmbeddedHostOptions);
+    /** True when this page is inside another (any) frame. Not the same as "framed by a shell". */
+    isFramed(): boolean;
+    /** The shell's facts, once a hello has arrived; null before that or when not framed. */
+    current(): EmbeddedHostInfo | null;
+    /**
+     * Ask the parent to identify itself and wait (bounded) for a hello. Resolves null
+     * when this page is not framed, or the parent never answers -- which is how a game
+     * that is simply embedded in somebody's blog behaves like a top-level page.
+     */
+    hello(timeoutMs?: number): Promise<EmbeddedHostInfo | null>;
+    /**
+     * Ask the shell to take the tab to `url`. The shell honours only its tier's Studio
+     * `/authorize` with a redirect_uri of its own page; anything else is dropped there.
+     */
+    navigate(url: string): void;
+    close(): void;
+    private onHello;
+    private onMessage;
+    /**
+     * The return URL must be a page ON THE SHELL'S OWN ORIGIN: the shell is the page
+     * that will receive the code, so a hello naming anywhere else is malformed (or
+     * hostile) and is ignored rather than acted on.
+     */
+    private acceptableReturnUrl;
+}
+//# sourceMappingURL=embedded-host.d.ts.map

package/dist/domains/embedded-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedded-host.d.ts","sourceRoot":"","sources":["../../src/domains/embedded-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,IAAI,CAAC;IACzF,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC5F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAeD;;;;GAIG;AACH,qBAAa,YAAY;IAOrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,IAAI,CAAiC;IAC7C,OAAO,CAAC,OAAO,CAAiD;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAGrB,GAAG,GAAE,cAAc,GAAG,IAAsB,EAC7D,OAAO,GAAE,mBAAwB;IASnC,8FAA8F;IAC9F,QAAQ,IAAI,OAAO;IAUnB,wFAAwF;IACxF,OAAO,IAAI,gBAAgB,GAAG,IAAI;IAIlC;;;;OAIG;IACH,KAAK,CAAC,SAAS,SAAsB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA2BxE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAU3B,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,OAAO,CAA6B;IAE5C,OAAO,CAAC,SAAS;IAmBjB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAQ5B"}

package/dist/domains/embedded-host.js

@@ -0,0 +1,175 @@
+/**
+ * The embedded-host bridge: how a game framed by the Crowdy Games SHELL signs in.
+ *
+ * A game published to Crowdy Games (`client.hosting`, the-construct's `npm run
+ * publish`) is reached at `https://<games host>/<slug>/`, which is a first-party
+ * shell page, and executes inside that page's iframe on its own origin,
+ * `https://<slug>.<content host>`. Two things about that arrangement change hosted
+ * sign-in, and this module is the whole of the change:
+ *
+ *   1. The game cannot navigate the tab. Its iframe has no `allow-top-navigation`
+ *      (a game that could send the player to a lookalike sign-in page would have the
+ *      phishing surface the shell exists to remove), and Studio refuses to be framed.
+ *      So `portal.signIn` asks the SHELL to navigate -- `crowdyjs:navigate` -- and
+ *      the shell honours exactly one destination: the tier's Studio `/authorize`.
+ *
+ *   2. The redirect URI is the SHELL's page, not the iframe's. Studio sends the code
+ *      back to `https://<games host>/<slug>/` (the app's registered redirect URI, which
+ *      `claimGameHosting` registered); the shell moves `?code=&state=` onto the iframe's
+ *      `src` and strips it from its own address bar; the game's
+ *      `handleSignInCallback()` then reads its own `location.search` exactly as it does
+ *      when self-hosted. The shell tells the game which return URL to use in
+ *      `crowdyjs:host-hello`.
+ *
+ * WHAT DOES NOT CHANGE. The PKCE pair is generated here, in the game's origin, and the
+ * verifier stays in the game origin's sessionStorage. The shell relays a code it cannot
+ * spend. The app token is exchanged and stored by the game as before.
+ *
+ * WHY TRUSTING THE PARENT IS SAFE. The bridge accepts `crowdyjs:host-hello` only from
+ * `window.parent`. When the game is served by the Crowdy Games content edge, its
+ * `frame-ancestors` names the tier's games host and nothing else, so the parent IS the
+ * shell. A self-hosted game framed by a hostile page could be told a hostile
+ * `returnUrl` -- and Studio would refuse it, because it is not one of the app's
+ * registered redirect URIs; and even a code delivered to a registered-but-wrong page
+ * is useless without the verifier in this origin. The bridge also refuses a
+ * `returnUrl` whose origin is not https (or the parent's own origin, for a local dev
+ * shell), so the failure is loud rather than a silent detour.
+ *
+ * The message shapes mirror Crowdy-Games `shell/src/protocol.ts` (version 1).
+ */
+export const EMBEDDED_HOST_PROTOCOL_VERSION = 1;
+const DEFAULT_HELLO_TIMEOUT_MS = 1500;
+function isHostHello(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const d = data;
+    return (d.type === 'crowdyjs:host-hello' &&
+        typeof d.returnUrl === 'string' &&
+        typeof d.authorizeOrigin === 'string' &&
+        typeof d.slug === 'string');
+}
+/**
+ * Detects and talks to a Crowdy Games shell framing this page. Constructed once by
+ * `createCrowdyClient` (see `CrowdyClientConfig.embeddedHost`); `portal.signIn`
+ * consults it.
+ */
+export class EmbeddedHost {
+    constructor(win = defaultWindow(), options = {}) {
+        this.win = win;
+        this.info = null;
+        this.pending = null;
+        this.onHello = null;
+        this.helloTimeoutMs = options.helloTimeoutMs ?? DEFAULT_HELLO_TIMEOUT_MS;
+        this.listener = (event) => this.onMessage(event);
+        if (this.isFramed()) {
+            this.win.addEventListener('message', this.listener);
+        }
+    }
+    /** True when this page is inside another (any) frame. Not the same as "framed by a shell". */
+    isFramed() {
+        const w = this.win;
+        if (!w)
+            return false;
+        try {
+            return w.parent !== null && w.parent !== undefined && w.parent !== w;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** The shell's facts, once a hello has arrived; null before that or when not framed. */
+    current() {
+        return this.info;
+    }
+    /**
+     * Ask the parent to identify itself and wait (bounded) for a hello. Resolves null
+     * when this page is not framed, or the parent never answers -- which is how a game
+     * that is simply embedded in somebody's blog behaves like a top-level page.
+     */
+    hello(timeoutMs = this.helloTimeoutMs) {
+        if (!this.isFramed())
+            return Promise.resolve(null);
+        if (this.info)
+            return Promise.resolve(this.info);
+        if (this.pending)
+            return this.pending;
+        this.pending = new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.pending = null;
+                resolve(this.info);
+            }, timeoutMs);
+            const check = () => {
+                if (this.info) {
+                    clearTimeout(timer);
+                    this.pending = null;
+                    resolve(this.info);
+                }
+            };
+            this.onHello = check;
+            const request = {
+                type: 'crowdyjs:host-hello-request',
+                version: EMBEDDED_HOST_PROTOCOL_VERSION,
+            };
+            // '*': the request carries nothing and the parent's origin is not yet known.
+            this.win.parent.postMessage(request, '*');
+        });
+        return this.pending;
+    }
+    /**
+     * Ask the shell to take the tab to `url`. The shell honours only its tier's Studio
+     * `/authorize` with a redirect_uri of its own page; anything else is dropped there.
+     */
+    navigate(url) {
+        if (!this.info)
+            throw new Error('embedded host: no shell has said hello; call hello() first');
+        const message = {
+            type: 'crowdyjs:navigate',
+            version: EMBEDDED_HOST_PROTOCOL_VERSION,
+            url,
+        };
+        this.win.parent.postMessage(message, this.info.hostOrigin);
+    }
+    close() {
+        this.win?.removeEventListener('message', this.listener);
+    }
+    onMessage(event) {
+        if (!this.win || event.source !== this.win.parent)
+            return;
+        if (!isHostHello(event.data))
+            return;
+        if (!this.acceptableReturnUrl(event.data.returnUrl, event.origin))
+            return;
+        let authorizeOrigin;
+        try {
+            authorizeOrigin = new URL(event.data.authorizeOrigin).origin;
+        }
+        catch {
+            return;
+        }
+        this.info = {
+            hostOrigin: event.origin,
+            returnUrl: event.data.returnUrl,
+            authorizeOrigin,
+            slug: event.data.slug,
+        };
+        this.onHello?.();
+    }
+    /**
+     * The return URL must be a page ON THE SHELL'S OWN ORIGIN: the shell is the page
+     * that will receive the code, so a hello naming anywhere else is malformed (or
+     * hostile) and is ignored rather than acted on.
+     */
+    acceptableReturnUrl(returnUrl, hostOrigin) {
+        try {
+            const u = new URL(returnUrl);
+            return u.origin === hostOrigin && (u.protocol === 'https:' || u.hostname === 'localhost' || u.hostname === '127.0.0.1');
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function defaultWindow() {
+    const g = globalThis;
+    return g.window ?? null;
+}

package/dist/domains/hosting.d.ts

@@ -0,0 +1,75 @@
+import type { GraphQLClient } from '../client.js';
+import { type BeginGamePublishMutation, type CompleteGamePublishMutation, type HostedGameFieldsFragment, type HostedGamePublishFieldsFragment, type PublishFileInput } from '../generated/graphql.js';
+export type HostedGame = HostedGameFieldsFragment;
+export type HostedGamePublish = HostedGamePublishFieldsFragment;
+export type BeginGamePublishResult = BeginGamePublishMutation['beginGamePublish'];
+export type HostedGameUpload = BeginGamePublishResult['uploads'][number];
+export type CompleteGamePublishResult = CompleteGamePublishMutation['completeGamePublish'];
+export type { PublishFileInput };
+/**
+ * Third-party game hosting on Crowdy Games (ck-api v2.1, 2026-09-13).
+ *
+ * A developer publishes a built static bundle to the platform; players reach it at
+ * `https://<games host>/<slug>/` (a first-party shell page) while it executes on
+ * `https://<slug>.<content host>`, an origin of its own. The API returns both URLs
+ * (`launchUrl`, `contentOrigin`); nothing here spells a hostname.
+ *
+ * WHICH TOKEN. Every mutation here needs an IDENTITY SESSION (`client.auth.login`
+ * from Node, or a Studio session) with `manage_apps` on the app -- never an app
+ * token. A game's own bundle can therefore never publish a replacement for itself.
+ * The two reads a page needs (`game`, `listed`) are public.
+ *
+ * THE FLOW: `claim` once per app -> build -> `beginPublish` with the manifest ->
+ * PUT every file to its presigned URL with exactly the returned headers ->
+ * `completePublish`. `@crowdedkingdoms/crowdyjs/hosting`'s `publishDirectory` does
+ * the last three steps for a `dist/` directory in Node.
+ */
+export declare class HostingAPI {
+    private readonly api;
+    constructor(api: GraphQLClient);
+    /** Public: a hosted game by slug, or null. The shell's question. */
+    game(slug: string): Promise<HostedGame | null>;
+    /** Public: the LIVE, LISTED hosted games -- the lobby's list. */
+    listed(): Promise<HostedGame[]>;
+    /** Operator: every hosted game on the tier. */
+    all(): Promise<HostedGame[]>;
+    /** The hosted games the caller can manage. Session token. */
+    mine(): Promise<HostedGame[]>;
+    /** Publish history for a game, newest first. Session token + manage_apps. */
+    publishes(slug: string, limit?: number): Promise<HostedGamePublish[]>;
+    /**
+     * Claim (or re-assert) the hosting slug for an app. Idempotent; a different slug
+     * MOVES the game. Registers the shell page and the game origin as redirect URIs
+     * and sets `launch_url`. Refuses reserved, taken or malformed slugs
+     * (`HOSTED_SLUG_UNAVAILABLE`) and a tier without hosting (`CONTENT_HOSTING_DISABLED`).
+     */
+    claim(params: {
+        appId: string;
+        slug?: string;
+    }): Promise<HostedGame>;
+    /** Declare a publish; returns one presigned PUT per file. */
+    beginPublish(params: {
+        slug: string;
+        files: PublishFileInput[];
+    }): Promise<BeginGamePublishResult>;
+    /** Verify, promote, record LIVE, invalidate. */
+    completePublish(slug: string, publishId: string): Promise<CompleteGamePublishResult>;
+    abandonPublish(slug: string, publishId: string): Promise<HostedGamePublish>;
+    /** Developer switch: off (DISABLED) or on (LIVE). */
+    setEnabled(slug: string, enabled: boolean): Promise<HostedGame>;
+    /** Operator: list or unlist in the lobby and the management UI. */
+    setListing(slug: string, listed: boolean): Promise<HostedGame>;
+    /** Operator: take down (or restore with `false`). */
+    takeDown(slug: string, takenDown?: boolean): Promise<HostedGame>;
+}
+/**
+ * Upload every file of a publish to its presigned URL, with bounded concurrency and
+ * a retry per file. Works in Node 20+ and in a browser (`fetch`, `Blob`/`Uint8Array`
+ * bodies). `read(path)` returns the bytes for a manifest path.
+ */
+export declare function uploadPublishFiles(uploads: HostedGameUpload[], read: (path: string) => Promise<Uint8Array | Blob>, options?: {
+    concurrency?: number;
+    retries?: number;
+    onFile?: (path: string, ok: boolean) => void;
+}): Promise<void>;
+//# sourceMappingURL=hosting.d.ts.map