@flayerlabs/gamemode-cli 0.7.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -38,7 +38,8 @@ If the SDK interface cannot represent the game safely, stop and describe the mis
|
|
|
38
38
|
6. Keep action acceptance separate from awards when an early balance change would leak a result.
|
|
39
39
|
7. Calculate `rewardBounds` from the rules, including the best possible play.
|
|
40
40
|
8. Build the browser around `Room` capabilities. Keep scoring, wallets, keys and calldata out of creator client code.
|
|
41
|
-
9.
|
|
41
|
+
9. Open external links (site, Discord, X) in a new tab from a click handler; the frame cannot navigate the embedding page.
|
|
42
|
+
10. Prove the loop with the mock room before adding a project-specific live harness.
|
|
42
43
|
|
|
43
44
|
## Verify the result
|
|
44
45
|
|
|
@@ -20,7 +20,7 @@ itself. Work through the sections in order; each ends with a check you can run.
|
|
|
20
20
|
2. Your gate: one process you deploy (`createGameServerGate()` from `@flayerlabs/gamemode-gate`).
|
|
21
21
|
It owns wallet sessions, the points ledger, spend authorisations and settlement. One process
|
|
22
22
|
serves one chain.
|
|
23
|
-
3. Your game server(s): your realtime processes, up to
|
|
23
|
+
3. Your game server(s): your realtime processes, up to twenty public HTTPS origins. Gameplay,
|
|
24
24
|
scoring decisions and anti-abuse are yours; points move only through the gate's award route.
|
|
25
25
|
|
|
26
26
|
## Declare the same origins in all three places
|
|
@@ -36,7 +36,7 @@ The reviewed game-server origins must match exactly — same scheme, same host,
|
|
|
36
36
|
|
|
37
37
|
A mismatch fails at a different layer each time: missing from (1) and the fetch dies on CSP with
|
|
38
38
|
"Refused to connect"; missing from (2) and the fetch succeeds but the ticket does not verify;
|
|
39
|
-
wrong in (3) and verification rejects every player. At most
|
|
39
|
+
wrong in (3) and verification rejects every player. At most twenty origins, exact HTTPS only —
|
|
40
40
|
wildcards, paths and plain HTTP are refused. Rotating regions? Put them behind stable hostnames;
|
|
41
41
|
the list is not meant to churn.
|
|
42
42
|
|