@genex-ai/embed-sdk 0.13.0 → 0.15.0

package/dist/{chunk-XGTGIWVQ.js → chunk-DWDBRKRS.js}

@@ -1,12 +1,356 @@
+// src/commerce.ts
+var cfg = null;
+function _initCommerce(c) {
+  cfg = c;
+}
+function must() {
+  if (!cfg) throw new Error("genex commerce: call initEmbed() first");
+  return cfg;
+}
+function authHeaders() {
+  const token = must().getToken();
+  if (!token) throw new Error("genex commerce: no player session");
+  return { Authorization: `Bearer ${token}` };
+}
+async function getShop() {
+  const c = must();
+  if (c.isLocalTest()) return [];
+  const res = await fetch(`${c.apiUrl}/api/coin/catalog`, { headers: authHeaders() });
+  if (!res.ok) throw new Error(`genex shop failed (${res.status})`);
+  return (await res.json()).items;
+}
+async function getEntitlements(opts) {
+  const c = must();
+  if (c.isLocalTest()) return [];
+  const qs = opts?.excludeConsumed ? "?excludeConsumed=true" : "";
+  const res = await fetch(`${c.apiUrl}/api/coin/entitlements${qs}`, { headers: authHeaders() });
+  if (!res.ok) throw new Error(`genex entitlements failed (${res.status})`);
+  return (await res.json()).items;
+}
+async function consumeEntitlement(entitlementId) {
+  const c = must();
+  if (c.isLocalTest()) return { consumed: true, alreadyConsumed: false };
+  const res = await fetch(
+    `${c.apiUrl}/api/coin/entitlements/${encodeURIComponent(entitlementId)}/consume`,
+    { method: "POST", headers: authHeaders() }
+  );
+  if (!res.ok) throw new Error(`genex consume failed (${res.status})`);
+  return await res.json();
+}
+async function awaitOutcome(intentId, timeoutMs) {
+  const c = must();
+  const deadline = Date.now() + timeoutMs;
+  let delay = 400;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, delay));
+    delay = Math.min(delay * 1.4, 2e3);
+    const res = await fetch(`${c.apiUrl}/api/coin/intents/${encodeURIComponent(intentId)}`, {
+      headers: authHeaders()
+    }).catch(() => null);
+    if (!res || !res.ok) continue;
+    const view = await res.json();
+    switch (view.status) {
+      case "succeeded":
+      case "consumed":
+        return { status: "succeeded" };
+      case "canceled":
+        return { status: "canceled" };
+      case "expired":
+        return { status: "expired" };
+      case "failed":
+        return { status: "failed", message: "the purchase could not be completed" };
+      default:
+        break;
+    }
+  }
+  return { status: "expired" };
+}
+function openConfirmSurface(view) {
+  const c = must();
+  const w = typeof window === "undefined" ? null : window;
+  if (!w) return { ok: false, reason: "no_window" };
+  if (c.isNative()) return { ok: false, reason: "native_unsupported" };
+  if (c.isEmbedded() && w.parent) {
+    for (const origin of c.dashboardOrigins) {
+      try {
+        w.parent.postMessage({ type: "genex:commerce:confirm", v: 1, intentId: view.id }, origin);
+      } catch {
+      }
+    }
+    return { ok: true };
+  }
+  const popup = w.open(view.confirmUrl, `genex_confirm_${view.id}`, "popup,width=420,height=640");
+  return popup === null ? { ok: false, reason: "popup_blocked" } : { ok: true };
+}
+async function buy(opts) {
+  const c = must();
+  if (c.isLocalTest()) {
+    return { status: "failed", message: "purchases are unavailable in local test mode" };
+  }
+  const created = await fetch(`${c.apiUrl}/api/coin/intents`, {
+    method: "POST",
+    headers: { ...authHeaders(), "Content-Type": "application/json" },
+    body: JSON.stringify({ skuId: opts.skuId, quantity: opts.quantity ?? 1 })
+  });
+  if (!created.ok) {
+    const body = await created.json().catch(() => ({}));
+    return { status: "failed", message: body.error ?? `intent failed (${created.status})` };
+  }
+  const view = await created.json();
+  const opened = openConfirmSurface(view);
+  if (!opened.ok) {
+    const message = opened.reason === "popup_blocked" ? "the confirmation window was blocked \u2014 tap again to confirm" : opened.reason === "native_unsupported" ? "purchases are not available in the app yet" : "the confirmation window could not be opened";
+    return { status: "failed", message };
+  }
+  return awaitOutcome(view.id, opts.timeoutMs ?? 18e4);
+}
+
+// ../embed-protocol/src/constants.ts
+var NATIVE_CHANNEL = "genex-native";
+var NATIVE_PROTOCOL_VERSION = 1;
+var NATIVE_MARKER_PARAM = "genex_native";
+var NATIVE_MARKER_VALUE = "1";
+var NATIVE_PROTOCOL_PARAM = "genex_protocol";
+var NATIVE_ATTEMPT_PARAM = "genex_attempt";
+var NATIVE_NONCE_PARAM = "genex_nonce";
+var NATIVE_RECEIVER = "__genexNative";
+var MAX_BRIDGE_MESSAGE_BYTES = 4096;
+var BRIDGE_ID_RE = /^[0-9a-f]{32}$/;
+var SLUG_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+function isBridgeId(value) {
+  return typeof value === "string" && BRIDGE_ID_RE.test(value);
+}
+function isBridgeSlug(value) {
+  return typeof value === "string" && SLUG_RE.test(value);
+}
+
+// ../embed-protocol/src/base64url.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var LOOKUP = (() => {
+  const table = new Array(128).fill(-1);
+  for (let i = 0; i < ALPHABET.length; i++) table[ALPHABET.charCodeAt(i)] = i;
+  return table;
+})();
+function utf8Bytes(text) {
+  const out = [];
+  for (let i = 0; i < text.length; i++) {
+    let code = text.charCodeAt(i);
+    if (code >= 55296 && code <= 56319) {
+      const next = i + 1 < text.length ? text.charCodeAt(i + 1) : 0;
+      if (next >= 56320 && next <= 57343) {
+        code = 65536 + (code - 55296 << 10) + (next - 56320);
+        i++;
+      } else {
+        code = 65533;
+      }
+    } else if (code >= 56320 && code <= 57343) {
+      code = 65533;
+    }
+    if (code < 128) out.push(code);
+    else if (code < 2048) out.push(192 | code >> 6, 128 | code & 63);
+    else if (code < 65536) {
+      out.push(224 | code >> 12, 128 | code >> 6 & 63, 128 | code & 63);
+    } else {
+      out.push(
+        240 | code >> 18,
+        128 | code >> 12 & 63,
+        128 | code >> 6 & 63,
+        128 | code & 63
+      );
+    }
+  }
+  return out;
+}
+function utf8Text(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; ) {
+    const b0 = bytes[i];
+    let code;
+    let size;
+    if (b0 < 128) {
+      code = b0;
+      size = 1;
+    } else if ((b0 & 224) === 192) {
+      code = b0 & 31;
+      size = 2;
+    } else if ((b0 & 240) === 224) {
+      code = b0 & 15;
+      size = 3;
+    } else if ((b0 & 248) === 240) {
+      code = b0 & 7;
+      size = 4;
+    } else return null;
+    if (i + size > bytes.length) return null;
+    for (let k = 1; k < size; k++) {
+      const b = bytes[i + k];
+      if ((b & 192) !== 128) return null;
+      code = code << 6 | b & 63;
+    }
+    if (size === 2 && code < 128) return null;
+    if (size === 3 && (code < 2048 || code >= 55296 && code <= 57343)) return null;
+    if (size === 4 && (code < 65536 || code > 1114111)) return null;
+    if (code > 65535) {
+      const v = code - 65536;
+      out += String.fromCharCode(55296 + (v >> 10), 56320 + (v & 1023));
+    } else {
+      out += String.fromCharCode(code);
+    }
+    i += size;
+  }
+  return out;
+}
+function utf8ByteLength(text) {
+  return utf8Bytes(text).length;
+}
+function encodeBase64UrlJson(value) {
+  const bytes = utf8Bytes(JSON.stringify(value));
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    out += ALPHABET[b0 >> 2];
+    out += ALPHABET[(b0 & 3) << 4 | (b1 ?? 0) >> 4];
+    if (b1 === void 0) break;
+    out += ALPHABET[(b1 & 15) << 2 | (b2 ?? 0) >> 6];
+    if (b2 === void 0) break;
+    out += ALPHABET[b2 & 63];
+  }
+  return out;
+}
+function decodeBase64UrlJson(encoded) {
+  if (encoded.length % 4 === 1) return void 0;
+  const bytes = [];
+  let buffer = 0;
+  let bits = 0;
+  for (let i = 0; i < encoded.length; i++) {
+    const code = encoded.charCodeAt(i);
+    const value = code < 128 ? LOOKUP[code] : -1;
+    if (value < 0) return void 0;
+    buffer = buffer << 6 | value;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(buffer >> bits & 255);
+    }
+  }
+  if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return void 0;
+  const text = utf8Text(bytes);
+  if (text === null) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// ../embed-protocol/src/messages.ts
+var MAX_TICKET_LENGTH = 2048;
+var MAX_EXPIRES_AT_LENGTH = 32;
+var ISO_INSTANT_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const own = Object.keys(value);
+  if (own.length !== keys.length) return false;
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(value, key)) return false;
+  }
+  return true;
+}
+var BASE_KEYS = ["channel", "v", "type", "slug", "attemptId", "nonce"];
+function envelopeBaseIsValid(value) {
+  return value.channel === NATIVE_CHANNEL && value.v === NATIVE_PROTOCOL_VERSION && isBridgeSlug(value.slug) && isBridgeId(value.attemptId) && isBridgeId(value.nonce);
+}
+function parseBridgeNativeCommand(value) {
+  if (!isRecord(value) || !envelopeBaseIsValid(value)) return void 0;
+  switch (value.type) {
+    case "ticket":
+      if (!hasExactKeys(value, [...BASE_KEYS, "ticket", "expiresAt"])) return void 0;
+      if (typeof value.ticket !== "string" || value.ticket.length === 0 || value.ticket.length > MAX_TICKET_LENGTH) {
+        return void 0;
+      }
+      if (typeof value.expiresAt !== "string" || value.expiresAt.length > MAX_EXPIRES_AT_LENGTH || !ISO_INSTANT_RE.test(value.expiresAt)) {
+        return void 0;
+      }
+      return value;
+    case "guest":
+    case "cancel":
+      if (!hasExactKeys(value, BASE_KEYS)) return void 0;
+      return value;
+    case "foreground":
+      if (!hasExactKeys(value, [...BASE_KEYS, "active"])) return void 0;
+      if (typeof value.active !== "boolean") return void 0;
+      return value;
+    case "network":
+      if (!hasExactKeys(value, [...BASE_KEYS, "online"])) return void 0;
+      if (typeof value.online !== "boolean") return void 0;
+      return value;
+    default:
+      return void 0;
+  }
+}
+
+// ../embed-protocol/src/transport.ts
+function read(raw, parse) {
+  if (typeof raw !== "string" || raw.length === 0) return { ok: false, reason: "undecodable" };
+  if (utf8ByteLength(raw) > MAX_BRIDGE_MESSAGE_BYTES) return { ok: false, reason: "too-large" };
+  const decoded = decodeBase64UrlJson(raw);
+  if (decoded === void 0) return { ok: false, reason: "undecodable" };
+  const message = parse(decoded);
+  if (message === void 0) return { ok: false, reason: "invalid" };
+  return { ok: true, message };
+}
+function readBridgeNativeCommand(raw) {
+  return read(raw, parseBridgeNativeCommand);
+}
+function encodeBridgeMessage(message) {
+  const encoded = encodeBase64UrlJson(message);
+  if (encoded.length > MAX_BRIDGE_MESSAGE_BYTES) return void 0;
+  return encoded;
+}
+
+// ../embed-protocol/src/entry-url.ts
+function readParam(search, key) {
+  const query = search.charAt(0) === "?" ? search.slice(1) : search;
+  if (query.length === 0) return null;
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq) === key) return pair.slice(eq + 1);
+  }
+  return null;
+}
+function hasNativeMarker(search) {
+  return readParam(search, NATIVE_MARKER_PARAM) === NATIVE_MARKER_VALUE;
+}
+function readNativeEntry(search) {
+  if (!hasNativeMarker(search)) return null;
+  const attemptId = readParam(search, NATIVE_ATTEMPT_PARAM);
+  const nonce = readParam(search, NATIVE_NONCE_PARAM);
+  const protocol = Number(readParam(search, NATIVE_PROTOCOL_PARAM));
+  if (!isBridgeId(attemptId) || !isBridgeId(nonce)) return null;
+  if (protocol !== NATIVE_PROTOCOL_VERSION) return null;
+  return { attemptId, nonce, protocol };
+}
+
 // src/index.ts
 var PROTOCOL_VERSION = 1;
 var RETRY_FLAG = "genex:embed:retry";
 var POPOVER_DISMISSED_FLAG = "genex:guest:popover-dismissed";
+var LOCAL_AUTH_FLAG = "genex:embed:local-auth";
 var PLAYER_ID_KEY = "genex:player";
+var SDK_VERSION = "0.15.0";
 var config = null;
 var state = "pending";
 var user = null;
 var localTestMode = false;
+var nativeEntry = null;
+var nativeReauthPending = false;
+var nativeReauthTimer;
+var heartbeatTimer;
+var nativeBootAt = 0;
 var embedToken;
 var colyseusUrls;
 var parentOrigin = null;
@@ -18,6 +362,8 @@ var handshakeTimeoutMs = 1e4;
 var refreshDelayMs = 10 * 6e4;
 var refreshRetryMs = 6e4;
 var overlayTextDelayMs = 500;
+var nativeReauthTimeoutMs = 3e4;
+var heartbeatIntervalMs = 3e4;
 var handshakeTimer;
 var refreshTimer;
 var messageHandler;
@@ -58,6 +404,19 @@ function clearRetryFlag() {
   } catch {
   }
 }
+function readLocalAuthFlag() {
+  try {
+    return win()?.sessionStorage?.getItem(LOCAL_AUTH_FLAG) === "1";
+  } catch {
+    return false;
+  }
+}
+function writeLocalAuthFlag() {
+  try {
+    win()?.sessionStorage?.setItem(LOCAL_AUTH_FLAG, "1");
+  } catch {
+  }
+}
 function readPopoverDismissed() {
   try {
     return win()?.sessionStorage?.getItem(POPOVER_DISMISSED_FLAG) === "1";
@@ -85,22 +444,35 @@ function playerId() {
     return "no-storage";
   }
 }
-function initEmbed(cfg) {
+function initEmbed(cfg2) {
   const w = win();
   if (!w) return;
   if (initialized) return;
   initialized = true;
   config = {
-    slug: cfg.slug,
-    apiUrl: cfg.apiUrl.replace(/\/$/, ""),
-    dashboardOrigins: [...cfg.dashboardOrigins]
+    slug: cfg2.slug,
+    apiUrl: cfg2.apiUrl.replace(/\/$/, ""),
+    dashboardOrigins: [...cfg2.dashboardOrigins]
   };
   state = "pending";
-  if (wantsLocalTest(w)) {
+  _initCommerce({
+    apiUrl: config.apiUrl,
+    dashboardOrigins: config.dashboardOrigins,
+    getToken: () => embedToken,
+    isEmbedded,
+    isNative: inNativeMode,
+    isLocalTest: () => localTestMode
+  });
+  if (wantsLocalTestMode(w)) {
     enterLocalTestMode(w);
     return;
   }
   showOverlay("connecting");
+  const entry = detectNativeEntry(w);
+  if (entry) {
+    startNativeHandshake(w, entry);
+    return;
+  }
   if (isEmbedded()) {
     startEmbeddedHandshake(w);
   } else {
@@ -344,6 +716,120 @@ async function handleParentMessage(event) {
   }
   await redeemTicket(data.ticket);
 }
+function nativeBridge(w) {
+  const candidate = w.ReactNativeWebView;
+  if (!candidate || typeof candidate !== "object") return null;
+  const post = candidate.postMessage;
+  return typeof post === "function" ? candidate : null;
+}
+function detectNativeEntry(w) {
+  if (isEmbedded()) return null;
+  let search;
+  try {
+    search = w.location.search ?? "";
+  } catch {
+    return null;
+  }
+  if (!hasNativeMarker(search)) return null;
+  if (!nativeBridge(w)) return null;
+  return readNativeEntry(search);
+}
+function inNativeMode() {
+  return nativeEntry !== null;
+}
+function postToNative(message) {
+  const w = win();
+  if (!w || !config || !nativeEntry) return;
+  const bridge = nativeBridge(w);
+  if (!bridge) return;
+  const encoded = encodeBridgeMessage({
+    channel: NATIVE_CHANNEL,
+    v: NATIVE_PROTOCOL_VERSION,
+    slug: config.slug,
+    attemptId: nativeEntry.attemptId,
+    nonce: nativeEntry.nonce,
+    ...message
+  });
+  if (!encoded) return;
+  try {
+    bridge.postMessage(encoded);
+  } catch {
+  }
+}
+function postNativeError(code) {
+  if (inNativeMode()) postToNative({ type: "error", code });
+}
+function startNativeHandshake(w, entry) {
+  nativeEntry = entry;
+  nativeBootAt = Date.now();
+  w[NATIVE_RECEIVER] = (payload) => {
+    void handleNativeCommand(payload);
+  };
+  const capabilities = ["native-ticket", "native-guest", "heartbeat"];
+  postToNative({ type: "ready", sdkVersion: SDK_VERSION, capabilities });
+  handshakeTimer = setTimeout(() => {
+    void requestGuestSession();
+  }, handshakeTimeoutMs);
+}
+async function handleNativeCommand(payload) {
+  if (!config || !nativeEntry) return;
+  const read2 = readBridgeNativeCommand(payload);
+  if (!read2.ok) return;
+  const command = read2.message;
+  if (command.slug !== config.slug || command.attemptId !== nativeEntry.attemptId || command.nonce !== nativeEntry.nonce) {
+    return;
+  }
+  switch (command.type) {
+    case "ticket":
+      if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+      await redeemTicket(command.ticket);
+      return;
+    case "guest":
+      if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+      await requestGuestSession();
+      return;
+    case "cancel":
+      stopNativeTimers();
+      return;
+    case "foreground":
+    case "network":
+      return;
+  }
+}
+function stopNativeTimers() {
+  if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+  handshakeTimer = void 0;
+  if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+  refreshTimer = void 0;
+  if (nativeReauthTimer !== void 0) clearTimeout(nativeReauthTimer);
+  nativeReauthTimer = void 0;
+  if (heartbeatTimer !== void 0) clearInterval(heartbeatTimer);
+  heartbeatTimer = void 0;
+}
+function startHeartbeat() {
+  if (!inNativeMode() || heartbeatTimer !== void 0) return;
+  heartbeatTimer = setInterval(() => {
+    postToNative({ type: "heartbeat", uptimeMs: Math.max(0, Date.now() - nativeBootAt) });
+  }, heartbeatIntervalMs);
+  heartbeatTimer.unref?.();
+}
+function requestNativeReauth() {
+  if (!inNativeMode() || nativeReauthPending) return;
+  nativeReauthPending = true;
+  postToNative({ type: "reauth-required" });
+  nativeReauthTimer = setTimeout(() => {
+    nativeReauthTimer = void 0;
+    if (!nativeReauthPending) return;
+    nativeReauthPending = false;
+    emit("error", { error: new Error("embed session expired") });
+    enterBlocked("session-expired");
+  }, nativeReauthTimeoutMs);
+}
+function clearNativeReauth() {
+  nativeReauthPending = false;
+  if (nativeReauthTimer !== void 0) clearTimeout(nativeReauthTimer);
+  nativeReauthTimer = void 0;
+}
 function postToParent(message, targetOrigin) {
   const w = win();
   if (!w || !isEmbedded()) return;
@@ -411,6 +897,7 @@ function readFragment(w) {
 }
 async function redirectToAuthorize(w, opts) {
   if (!config || localTestMode) return;
+  if (inNativeMode()) return;
   const origin = opts?.guestOk ? config.dashboardOrigins[0] ?? (await fetchDashboardOrigins())[0] : (await fetchDashboardOrigins())[0] ?? config.dashboardOrigins[0];
   if (!origin) {
     enterBlocked();
@@ -435,7 +922,9 @@ async function fetchDashboardOrigins() {
   return config.dashboardOrigins;
 }
 async function redeemTicket(ticket) {
-  if (!config || localTestMode || redeeming || state !== "pending" && state !== "guest") return;
+  if (!config || localTestMode || redeeming) return;
+  const reauthing = nativeReauthPending && state === "authenticated";
+  if (state !== "pending" && state !== "guest" && !reauthing) return;
   const upgradingFromGuest = state === "guest";
   const epoch = ++identityEpoch;
   redeeming = true;
@@ -464,6 +953,11 @@ async function redeemTicket(ticket) {
     if (isEmbedded() && parentOrigin) {
       postToParent({ type: "genex:embed:authenticated", v: PROTOCOL_VERSION }, parentOrigin);
     }
+    if (inNativeMode()) {
+      clearNativeReauth();
+      postToNative({ type: "authenticated", guest: false });
+      startHeartbeat();
+    }
     if (upgradingFromGuest) await flushGuestQueue();
     const ctx = { user };
     for (const waiter of authWaiters.splice(0)) waiter.resolve(ctx);
@@ -494,7 +988,8 @@ async function requestGuestSession() {
     if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`guest session failed (${res.status})`) });
-      enterBlocked();
+      postNativeError("guest-failed");
+      enterBlocked(res.status === 404 ? "not-available" : "no-identity");
       return;
     }
     const body = await res.json();
@@ -522,6 +1017,9 @@ function enterGuest() {
       { type: "genex:embed:authenticated", v: PROTOCOL_VERSION, guest: true },
       parentOrigin ?? "*"
     );
+  } else if (inNativeMode()) {
+    postToNative({ type: "authenticated", guest: true });
+    startHeartbeat();
   } else if (firstEntry && !readPopoverDismissed()) {
     showGuestPopover();
   }
@@ -539,14 +1037,26 @@ function isLoopbackLocation(w) {
     return false;
   }
 }
-function wantsLocalTest(w) {
+function wantsLocalTestMode(w) {
   if (isEmbedded()) return false;
+  if (detectNativeEntry(w)) return false;
   if (!isLoopbackLocation(w)) return false;
+  let params = null;
   try {
-    return new URLSearchParams(w.location.search).get("genex_local_test") === "1";
+    params = new URLSearchParams(w.location.search);
   } catch {
+  }
+  if (params?.get("genex_local_test") === "1") return true;
+  if (params?.get("genex_auth") === "1") {
+    writeLocalAuthFlag();
     return false;
   }
+  if (readLocalAuthFlag()) return false;
+  return !hasGenexFragment(w);
+}
+function hasGenexFragment(w) {
+  const hash = stashedTicketHash ?? w.location.hash;
+  return !!hash && hash.includes("genex_");
 }
 function enterLocalTestMode(w) {
   localTestMode = true;
@@ -566,6 +1076,12 @@ function enterLocalTestMode(w) {
 }
 async function handleRedeemFailure() {
   const w = win();
+  if (inNativeMode()) {
+    clearNativeReauth();
+    postNativeError("ticket-rejected");
+    enterBlocked();
+    return;
+  }
   if (w && !isEmbedded() && !readRetryFlag()) {
     writeRetryFlag();
     showOverlay("redirecting");
@@ -611,8 +1127,12 @@ async function refreshToken() {
       void requestGuestSession();
       return;
     }
+    if (inNativeMode()) {
+      requestNativeReauth();
+      return;
+    }
     emit("error", { error: new Error("embed session expired") });
-    enterBlocked();
+    enterBlocked("session-expired");
     return;
   }
   if (refreshTimer !== void 0) clearTimeout(refreshTimer);
@@ -620,7 +1140,7 @@ async function refreshToken() {
     void refreshToken();
   }, refreshRetryMs);
 }
-function enterBlocked() {
+function enterBlocked(reason = "no-identity") {
   if (state === "blocked") return;
   identityEpoch++;
   state = "blocked";
@@ -629,7 +1149,14 @@ function enterBlocked() {
   if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
   if (refreshTimer !== void 0) clearTimeout(refreshTimer);
   removeGuestPopover();
-  showOverlay(isEmbedded() ? "blocked-embedded" : "blocked-standalone");
+  if (inNativeMode()) {
+    stopNativeTimers();
+    clearNativeReauth();
+    removeOverlay();
+    postToNative({ type: "blocked", reason });
+  } else {
+    showOverlay(isEmbedded() ? "blocked-embedded" : "blocked-standalone");
+  }
   if (isEmbedded()) {
     postToParent({ type: "genex:embed:blocked", v: PROTOCOL_VERSION }, parentOrigin ?? "*");
   }
@@ -944,6 +1471,11 @@ function __resetForTests(overrides) {
   if (refreshTimer !== void 0) clearTimeout(refreshTimer);
   handshakeTimer = void 0;
   refreshTimer = void 0;
+  stopNativeTimers();
+  if (w) delete w[NATIVE_RECEIVER];
+  nativeEntry = null;
+  nativeReauthPending = false;
+  nativeBootAt = 0;
   removeOverlay(true);
   removeGuestPopover();
   overlayFontRequested = false;
@@ -969,9 +1501,15 @@ function __resetForTests(overrides) {
   refreshDelayMs = overrides?.refreshDelayMs ?? 10 * 6e4;
   refreshRetryMs = overrides?.refreshRetryMs ?? 6e4;
   overlayTextDelayMs = overrides?.overlayTextDelayMs ?? 500;
+  nativeReauthTimeoutMs = overrides?.nativeReauthTimeoutMs ?? 3e4;
+  heartbeatIntervalMs = overrides?.heartbeatIntervalMs ?? 3e4;
 }
 
 export {
+  getShop,
+  getEntitlements,
+  consumeEntitlement,
+  buy,
   initEmbed,
   isEmbedded,
   getAuthState,

package/dist/index.d.ts

@@ -1,3 +1,110 @@
+/** A thing the game sells. Resolved server-side; the game never sets a price. */
+interface ShopItem {
+    id: string;
+    /** 'consumable' — spent on use. 'durable' — owned permanently. */
+    type: string;
+    name: string;
+    iconUrl: string | null;
+    priceCoins: number;
+    /**
+     * The real-money equivalent, in USD cents, from the server.
+     *
+     * Show it next to the coin price. It is not decoration: a currency price
+     * without its real-world value is the practice consumer regulators single
+     * out first, and the platform sends this so a game never has to compute it —
+     * or be tempted to omit it.
+     */
+    priceDisplayUsdCents: number;
+}
+interface Entitlement {
+    id: string;
+    skuId: string;
+    name: string;
+    type: string;
+    quantity: number;
+    consumed: boolean;
+    createdAt: string;
+}
+type PurchaseStatus = 
+/** Settled. The item is owned; consume it, then apply the effect. */
+'succeeded'
+/** The player closed or declined the confirmation. Not an error — say nothing. */
+ | 'canceled'
+/** The confirmation was never completed in time. */
+ | 'expired'
+/** The player does not have enough coin. */
+ | 'insufficient_balance'
+/** Something went wrong. `message` says what, for a log — not for the player. */
+ | 'failed';
+interface PurchaseResult {
+    status: PurchaseStatus;
+    /** Present only on 'succeeded'. */
+    entitlementId?: string;
+    message?: string;
+}
+/**
+ * The items this game sells.
+ *
+ * Render `name`, `iconUrl`, `priceCoins` AND `priceDisplayUsdCents` from here.
+ * Do not hardcode a price in the game: the server charges what its own catalog
+ * says, so a hardcoded one is a number that can silently disagree with what the
+ * player is actually charged.
+ */
+declare function getShop(): Promise<ShopItem[]>;
+/**
+ * Everything this player owns in this game.
+ *
+ * Call it on EVERY boot with `{ excludeConsumed: true }` and deliver whatever
+ * comes back. That is not an optimisation — it is how a purchase survives a
+ * crash between paying and receiving.
+ */
+declare function getEntitlements(opts?: {
+    excludeConsumed?: boolean;
+}): Promise<Entitlement[]>;
+/**
+ * Mark an entitlement used, then apply its effect.
+ *
+ * That order matters and is worth stating plainly: consume FIRST, apply SECOND.
+ * If the game dies in between, the player loses one item — a support ticket. If
+ * you apply first and die before consuming, every boot re-delivers it forever —
+ * an exploit.
+ *
+ * Idempotent. `alreadyConsumed: true` means someone else got there first and
+ * you must NOT apply the effect again.
+ */
+declare function consumeEntitlement(entitlementId: string): Promise<{
+    consumed: boolean;
+    alreadyConsumed: boolean;
+}>;
+/**
+ * Buy something.
+ *
+ * **Call this synchronously from a real click or tap handler.** On a game's own
+ * origin the confirmation is a popup, and browsers only allow one while a user
+ * gesture is live — an `await` before this call loses that gesture and the
+ * purchase cannot open.
+ *
+ * Resolves once the SERVER says what happened. A closed window proves nothing:
+ * this waits for the ledger, not for the UI.
+ *
+ * ```ts
+ * button.addEventListener('click', async () => {
+ *   const result = await buy({ skuId: 'sku_potion' });
+ *   if (result.status !== 'succeeded') return;         // canceled is normal
+ *   for (const e of await getEntitlements({ excludeConsumed: true })) {
+ *     const { alreadyConsumed } = await consumeEntitlement(e.id);
+ *     if (!alreadyConsumed) grantPotion();             // consume, THEN apply
+ *   }
+ * });
+ * ```
+ */
+declare function buy(opts: {
+    skuId: string;
+    quantity?: number;
+    /** How long to wait for the player to decide. Default 3 minutes. */
+    timeoutMs?: number;
+}): Promise<PurchaseResult>;
+
 interface EmbedConfig {
     /** This game's own slug (GENEX.slug) — identifies the project to /play/authorize. */
     slug: string;
@@ -228,6 +335,8 @@ declare function __resetForTests(overrides?: {
     refreshDelayMs?: number;
     refreshRetryMs?: number;
     overlayTextDelayMs?: number;
+    nativeReauthTimeoutMs?: number;
+    heartbeatIntervalMs?: number;
 }): void;
 
-export { type AuthState, type EmbedConfig, type EmbedEvent, type EmbedUser, type Leaderboard, type LeaderboardEntry, type PlayerStateResult, type SaveStateResult, type SubmitScoreResult, type WorldStateResult, __resetForTests, _stashTicketFromUrl, getAuthState, getColyseusAuth, getColyseusUrls, getEmbedToken, getLeaderboard, getUser, initEmbed, isEmbedded, loadPlayerState, loadWorldState, on, savePlayerState, saveWorldState, submitScore, waitForAuth, waitForPlayer };
+export { type AuthState, type EmbedConfig, type EmbedEvent, type EmbedUser, type Entitlement, type Leaderboard, type LeaderboardEntry, type PlayerStateResult, type PurchaseResult, type PurchaseStatus, type SaveStateResult, type ShopItem, type SubmitScoreResult, type WorldStateResult, __resetForTests, _stashTicketFromUrl, buy, consumeEntitlement, getAuthState, getColyseusAuth, getColyseusUrls, getEmbedToken, getEntitlements, getLeaderboard, getShop, getUser, initEmbed, isEmbedded, loadPlayerState, loadWorldState, on, savePlayerState, saveWorldState, submitScore, waitForAuth, waitForPlayer };

package/dist/index.js

@@ -1,11 +1,15 @@
 import {
   __resetForTests,
   _stashTicketFromUrl,
+  buy,
+  consumeEntitlement,
   getAuthState,
   getColyseusAuth,
   getColyseusUrls,
   getEmbedToken,
+  getEntitlements,
   getLeaderboard,
+  getShop,
   getUser,
   initEmbed,
   isEmbedded,
@@ -17,15 +21,19 @@ import {
   submitScore,
   waitForAuth,
   waitForPlayer
-} from "./chunk-XGTGIWVQ.js";
+} from "./chunk-DWDBRKRS.js";
 export {
   __resetForTests,
   _stashTicketFromUrl,
+  buy,
+  consumeEntitlement,
   getAuthState,
   getColyseusAuth,
   getColyseusUrls,
   getEmbedToken,
+  getEntitlements,
   getLeaderboard,
+  getShop,
   getUser,
   initEmbed,
   isEmbedded,

package/dist/sentry.js

@@ -2,7 +2,7 @@ import {
   _stashTicketFromUrl,
   getUser,
   on
-} from "./chunk-XGTGIWVQ.js";
+} from "./chunk-DWDBRKRS.js";
 
 // src/sentry.ts
 import * as Sentry from "@sentry/browser";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/embed-sdk",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Player identity + durable game state for genex games \u2014 signed-in or guest play, per-player save slots, shared world state, and soft-trust leaderboards.",
   "type": "module",
   "main": "./dist/index.js",
@@ -40,9 +40,11 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.0",
+    "@genex/embed-protocol": "workspace:*",
     "@sentry/browser": "^10.63.0",
     "publint": "^0.3.0",
-    "tsup": "^8.0.0"
+    "tsup": "^8.0.0",
+    "typescript": "^5.8.0"
   },
   "repository": {
     "type": "git",