@genex-ai/embed-sdk 0.16.0 → 0.21.0

package/dist/{chunk-ALBFRX3L.js → chunk-WJ4KFQLC.js}

@@ -1,3 +1,15 @@
+import {
+  NATIVE_CHANNEL,
+  NATIVE_PROTOCOL_VERSION,
+  NATIVE_RECEIVER,
+  encodeBridgeMessage,
+  hasNativeMarker,
+  isGenerationId,
+  isGenerationTerminal,
+  readBridgeNativeCommand,
+  readNativeEntry
+} from "./chunk-Q476GJHI.js";
+
 // src/commerce.ts
 var cfg = null;
 function _initCommerce(c) {
@@ -105,234 +117,179 @@ async function buy(opts) {
   return awaitOutcome(view.id, opts.timeoutMs ?? 18e4);
 }
 
-// ../embed-protocol/src/constants.ts
-var NATIVE_CHANNEL = "genex-native";
-var NATIVE_PROTOCOL_VERSION = 1;
-var NATIVE_MARKER_PARAM = "genex_native";
-var NATIVE_MARKER_VALUE = "1";
-var NATIVE_PROTOCOL_PARAM = "genex_protocol";
-var NATIVE_ATTEMPT_PARAM = "genex_attempt";
-var NATIVE_NONCE_PARAM = "genex_nonce";
-var NATIVE_RECEIVER = "__genexNative";
-var MAX_BRIDGE_MESSAGE_BYTES = 4096;
-var BRIDGE_ID_RE = /^[0-9a-f]{32}$/;
-var SLUG_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
-function isBridgeId(value) {
-  return typeof value === "string" && BRIDGE_ID_RE.test(value);
-}
-function isBridgeSlug(value) {
-  return typeof value === "string" && SLUG_RE.test(value);
+// src/generation.ts
+var config = null;
+function _initGeneration(value) {
+  config = value;
+}
+function must2() {
+  if (!config) throw new Error("genex generation: call initEmbed() first");
+  return config;
+}
+async function request(path, body) {
+  const c = must2();
+  const token = c.getToken();
+  if (!token) throw new Error("no_player_session");
+  const response = await fetch(`${c.apiUrl}/api/runtime${path}`, {
+    method: body === void 0 ? "GET" : "POST",
+    credentials: "omit",
+    cache: "no-store",
+    headers: { Authorization: `Bearer ${token}`, ...body === void 0 ? {} : { "Content-Type": "application/json" } },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  });
+  const result = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(typeof result.error === "string" ? result.error : "generation_unavailable");
+  return result;
 }
-
-// ../embed-protocol/src/base64url.ts
-var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-var LOOKUP = (() => {
-  const table = new Array(128).fill(-1);
-  for (let i = 0; i < ALPHABET.length; i++) table[ALPHABET.charCodeAt(i)] = i;
-  return table;
-})();
-function utf8Bytes(text) {
-  const out = [];
-  for (let i = 0; i < text.length; i++) {
-    let code = text.charCodeAt(i);
-    if (code >= 55296 && code <= 56319) {
-      const next = i + 1 < text.length ? text.charCodeAt(i + 1) : 0;
-      if (next >= 56320 && next <= 57343) {
-        code = 65536 + (code - 55296 << 10) + (next - 56320);
-        i++;
-      } else {
-        code = 65533;
-      }
-    } else if (code >= 56320 && code <= 57343) {
-      code = 65533;
-    }
-    if (code < 128) out.push(code);
-    else if (code < 2048) out.push(192 | code >> 6, 128 | code & 63);
-    else if (code < 65536) {
-      out.push(224 | code >> 12, 128 | code >> 6 & 63, 128 | code & 63);
-    } else {
-      out.push(
-        240 | code >> 18,
-        128 | code >> 12 & 63,
-        128 | code >> 6 & 63,
-        128 | code & 63
-      );
-    }
-  }
-  return out;
+function validEstimateCoins(value) {
+  return Number.isSafeInteger(value) && value >= 0 && value <= 1e6;
 }
-function utf8Text(bytes) {
-  let out = "";
-  for (let i = 0; i < bytes.length; ) {
-    const b0 = bytes[i];
-    let code;
-    let size;
-    if (b0 < 128) {
-      code = b0;
-      size = 1;
-    } else if ((b0 & 224) === 192) {
-      code = b0 & 31;
-      size = 2;
-    } else if ((b0 & 240) === 224) {
-      code = b0 & 15;
-      size = 3;
-    } else if ((b0 & 248) === 240) {
-      code = b0 & 7;
-      size = 4;
-    } else return null;
-    if (i + size > bytes.length) return null;
-    for (let k = 1; k < size; k++) {
-      const b = bytes[i + k];
-      if ((b & 192) !== 128) return null;
-      code = code << 6 | b & 63;
-    }
-    if (size === 2 && code < 128) return null;
-    if (size === 3 && (code < 2048 || code >= 55296 && code <= 57343)) return null;
-    if (size === 4 && (code < 65536 || code > 1114111)) return null;
-    if (code > 65535) {
-      const v = code - 65536;
-      out += String.fromCharCode(55296 + (v >> 10), 56320 + (v & 1023));
-    } else {
-      out += String.fromCharCode(code);
-    }
-    i += size;
-  }
-  return out;
+function getGenerationModels() {
+  return request("/models");
 }
-function utf8ByteLength(text) {
-  return utf8Bytes(text).length;
+function isWorkflowIdentifier(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_.:-]{1,120}$/.test(value) && value !== "." && value !== "..";
 }
-function encodeBase64UrlJson(value) {
-  const bytes = utf8Bytes(JSON.stringify(value));
-  let out = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const b0 = bytes[i];
-    const b1 = bytes[i + 1];
-    const b2 = bytes[i + 2];
-    out += ALPHABET[b0 >> 2];
-    out += ALPHABET[(b0 & 3) << 4 | (b1 ?? 0) >> 4];
-    if (b1 === void 0) break;
-    out += ALPHABET[(b1 & 15) << 2 | (b2 ?? 0) >> 6];
-    if (b2 === void 0) break;
-    out += ALPHABET[b2 & 63];
-  }
-  return out;
+function getWorkflowOfferings(workflowId) {
+  if (!isWorkflowIdentifier(workflowId)) return Promise.reject(new Error("invalid_workflow_id"));
+  return request(`/workflows/${encodeURIComponent(workflowId)}/offerings`);
 }
-function decodeBase64UrlJson(encoded) {
-  if (encoded.length % 4 === 1) return void 0;
-  const bytes = [];
-  let buffer = 0;
-  let bits = 0;
-  for (let i = 0; i < encoded.length; i++) {
-    const code = encoded.charCodeAt(i);
-    const value = code < 128 ? LOOKUP[code] : -1;
-    if (value < 0) return void 0;
-    buffer = buffer << 6 | value;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      bytes.push(buffer >> bits & 255);
-    }
-  }
-  if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return void 0;
-  const text = utf8Text(bytes);
-  if (text === null) return void 0;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return void 0;
-  }
+function getGeneration(generationId) {
+  if (!isGenerationId(generationId)) return Promise.reject(new Error("invalid_generation_id"));
+  return request(`/generations/${encodeURIComponent(generationId)}`);
 }
-
-// ../embed-protocol/src/messages.ts
-var MAX_TICKET_LENGTH = 2048;
-var MAX_EXPIRES_AT_LENGTH = 32;
-var ISO_INSTANT_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasExactKeys(value, keys) {
-  const own = Object.keys(value);
-  if (own.length !== keys.length) return false;
-  for (const key of keys) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) return false;
-  }
-  return true;
-}
-var BASE_KEYS = ["channel", "v", "type", "slug", "attemptId", "nonce"];
-function envelopeBaseIsValid(value) {
-  return value.channel === NATIVE_CHANNEL && value.v === NATIVE_PROTOCOL_VERSION && isBridgeSlug(value.slug) && isBridgeId(value.attemptId) && isBridgeId(value.nonce);
-}
-function parseBridgeNativeCommand(value) {
-  if (!isRecord(value) || !envelopeBaseIsValid(value)) return void 0;
-  switch (value.type) {
-    case "ticket":
-      if (!hasExactKeys(value, [...BASE_KEYS, "ticket", "expiresAt"])) return void 0;
-      if (typeof value.ticket !== "string" || value.ticket.length === 0 || value.ticket.length > MAX_TICKET_LENGTH) {
-        return void 0;
-      }
-      if (typeof value.expiresAt !== "string" || value.expiresAt.length > MAX_EXPIRES_AT_LENGTH || !ISO_INSTANT_RE.test(value.expiresAt)) {
-        return void 0;
-      }
-      return value;
-    case "guest":
-    case "cancel":
-      if (!hasExactKeys(value, BASE_KEYS)) return void 0;
-      return value;
-    case "foreground":
-      if (!hasExactKeys(value, [...BASE_KEYS, "active"])) return void 0;
-      if (typeof value.active !== "boolean") return void 0;
-      return value;
-    case "network":
-      if (!hasExactKeys(value, [...BASE_KEYS, "online"])) return void 0;
-      if (typeof value.online !== "boolean") return void 0;
-      return value;
-    default:
-      return void 0;
-  }
+function outcome(view) {
+  if (!isGenerationTerminal(view.status)) return void 0;
+  return {
+    status: view.status,
+    generationId: view.id,
+    ...billingReceipt(view),
+    ...view.status === "succeeded" ? {
+      output: view.output,
+      source: view.source,
+      ...view.modelProvenance ? { modelProvenance: view.modelProvenance } : {}
+    } : {},
+    ...view.error ? { error: view.error } : {}
+  };
 }
-
-// ../embed-protocol/src/transport.ts
-function read(raw, parse) {
-  if (typeof raw !== "string" || raw.length === 0) return { ok: false, reason: "undecodable" };
-  if (utf8ByteLength(raw) > MAX_BRIDGE_MESSAGE_BYTES) return { ok: false, reason: "too-large" };
-  const decoded = decodeBase64UrlJson(raw);
-  if (decoded === void 0) return { ok: false, reason: "undecodable" };
-  const message = parse(decoded);
-  if (message === void 0) return { ok: false, reason: "invalid" };
-  return { ok: true, message };
-}
-function readBridgeNativeCommand(raw) {
-  return read(raw, parseBridgeNativeCommand);
-}
-function encodeBridgeMessage(message) {
-  const encoded = encodeBase64UrlJson(message);
-  if (encoded.length > MAX_BRIDGE_MESSAGE_BYTES) return void 0;
-  return encoded;
+function billingReceipt(view) {
+  return {
+    ...view.billingStatus !== void 0 ? { billingStatus: view.billingStatus } : {},
+    ...view.reservedCoins !== void 0 ? { reservedCoins: view.reservedCoins } : {},
+    ...view.reservedDisplayUsdCents !== void 0 ? { reservedDisplayUsdCents: view.reservedDisplayUsdCents } : {},
+    ...view.chargedCoins !== void 0 ? { chargedCoins: view.chargedCoins } : {},
+    ...view.chargedDisplayUsdCents !== void 0 ? { chargedDisplayUsdCents: view.chargedDisplayUsdCents } : {}
+  };
 }
-
-// ../embed-protocol/src/entry-url.ts
-function readParam(search, key) {
-  const query = search.charAt(0) === "?" ? search.slice(1) : search;
-  if (query.length === 0) return null;
-  for (const pair of query.split("&")) {
-    const eq = pair.indexOf("=");
-    if (eq === -1) continue;
-    if (pair.slice(0, eq) === key) return pair.slice(eq + 1);
+function authorizationOutcome(view) {
+  if (["queued", "dispatching", "awaiting_external", "succeeded"].includes(view.status)) {
+    return { status: "authorized", generationId: view.id, ...billingReceipt(view), ...view.funding ? { funding: view.funding } : {} };
   }
-  return null;
+  if (!isGenerationTerminal(view.status)) return void 0;
+  return {
+    status: view.status === "canceled" || view.status === "expired" ? view.status : "failed",
+    generationId: view.id,
+    ...billingReceipt(view),
+    ...view.error ? { error: view.error } : view.status === "unknown" ? { error: "unknown_execution" } : {}
+  };
 }
-function hasNativeMarker(search) {
-  return readParam(search, NATIVE_MARKER_PARAM) === NATIVE_MARKER_VALUE;
+async function poll(generationId, timeoutMs, readOutcome, popup) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const view = await getGeneration(generationId);
+      const result = readOutcome(view);
+      if (result) return result;
+      if (popup?.closed && view.status === "requires_confirmation") {
+        const canceled = await request(`/generations/${generationId}/cancel`, {});
+        const cancelResult = readOutcome(canceled);
+        if (cancelResult) return cancelResult;
+      }
+    } catch {
+    }
+    await new Promise((resolve) => setTimeout(resolve, 750));
+  }
+  return { status: "pending", generationId, error: "wait_timeout" };
+}
+function waitForGeneration(generationId, timeoutMs = 6e5) {
+  if (!isGenerationId(generationId)) return Promise.resolve({ status: "failed", error: "invalid_generation_id" });
+  return poll(generationId, timeoutMs, outcome);
+}
+async function generate(options) {
+  if (!validEstimateCoins(options.estimateCoins)) return { status: "failed", error: "invalid_estimate_coins" };
+  const { timeoutMs, idempotencyKey, ...input } = options;
+  return startGeneration(
+    "/generations",
+    { ...input, idempotencyKey },
+    timeoutMs ?? 6e5,
+    outcome
+  );
 }
-function readNativeEntry(search) {
-  if (!hasNativeMarker(search)) return null;
-  const attemptId = readParam(search, NATIVE_ATTEMPT_PARAM);
-  const nonce = readParam(search, NATIVE_NONCE_PARAM);
-  const protocol = Number(readParam(search, NATIVE_PROTOCOL_PARAM));
-  if (!isBridgeId(attemptId) || !isBridgeId(nonce)) return null;
-  if (protocol !== NATIVE_PROTOCOL_VERSION) return null;
-  return { attemptId, nonce, protocol };
+async function requestWorkflow(options) {
+  if (!validEstimateCoins(options.estimateCoins)) return { status: "failed", error: "invalid_estimate_coins" };
+  if (!isWorkflowIdentifier(options.workflowId)) return { status: "failed", error: "invalid_workflow_id" };
+  if (!isWorkflowIdentifier(options.offeringId)) return { status: "failed", error: "invalid_offering_id" };
+  return startGeneration(`/workflows/${encodeURIComponent(options.workflowId)}/requests`, {
+    offeringId: options.offeringId,
+    input: options.input,
+    estimateCoins: options.estimateCoins,
+    ...options.allowExternal !== void 0 ? { allowExternal: options.allowExternal } : {},
+    idempotencyKey: options.idempotencyKey
+  }, options.timeoutMs ?? 6e5, authorizationOutcome, options);
+}
+async function resumeWorkflow(generationId, options = {}) {
+  if (!isGenerationId(generationId)) return { status: "failed", error: "invalid_generation_id" };
+  return startGeneration("", {}, options.timeoutMs ?? 6e5, authorizationOutcome, void 0, generationId);
+}
+async function startGeneration(path, body, timeoutMs, readOutcome, workflow, resumeId) {
+  const c = must2();
+  if (c.isLocalTest()) return { status: "failed", error: "local_test_unsupported" };
+  if (c.isNative()) return { status: "failed", error: "native_unsupported" };
+  if (typeof window === "undefined") return { status: "failed", error: "no_window" };
+  if (!c.getToken()) return { status: "failed", error: "no_player_session" };
+  const parentOrigin2 = c.getParentOrigin();
+  if (c.isEmbedded() && (!parentOrigin2 || !c.dashboardOrigins.includes(parentOrigin2))) {
+    return { status: "failed", error: "untrusted_parent" };
+  }
+  let popup = null;
+  let dashboard;
+  if (!c.isEmbedded()) {
+    try {
+      dashboard = new URL(c.dashboardOrigins[0]);
+      if (dashboard.protocol !== "https:" && !(dashboard.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(dashboard.hostname))) throw new Error();
+    } catch {
+      return { status: "failed", error: "invalid_dashboard_origin" };
+    }
+    popup = window.open(`${dashboard.origin}/play/generate`, "_blank", "popup,width=480,height=760");
+    if (!popup) return { status: "failed", error: "popup_blocked" };
+    try {
+      popup.opener = null;
+    } catch {
+    }
+  }
+  try {
+    const view = resumeId ? await getGeneration(resumeId) : await request(path, { ...body, idempotencyKey: body.idempotencyKey ?? crypto.randomUUID() });
+    if (resumeId && (view.id !== resumeId || view.kind !== "workflow")) throw new Error("invalid_generation_response");
+    if (!isGenerationId(view.id) || workflow && (view.kind !== "workflow" || view.workflow?.id !== workflow.workflowId || view.workflow.offeringId !== workflow.offeringId)) {
+      throw new Error("invalid_generation_response");
+    }
+    const result = readOutcome(view);
+    const needsReceipt = view.billingStatus === "pending" || view.quote?.billingPolicy !== void 0 && (view.chargedCoins ?? 0) > 0;
+    if (result && result.status !== "authorized" && !needsReceipt) {
+      popup?.close();
+      return result;
+    }
+    if (popup && dashboard) {
+      if (!popup.closed) popup.location.href = `${dashboard.origin}/play/generate/${encodeURIComponent(view.id)}`;
+    } else if (parentOrigin2) {
+      window.parent.postMessage({ type: "genex:generation:confirm", v: 1, generationId: view.id }, parentOrigin2);
+    }
+    if (result) return result;
+    return poll(view.id, timeoutMs, readOutcome, popup);
+  } catch (error) {
+    popup?.close();
+    return { status: "failed", error: error instanceof Error ? error.message : "generation_unavailable" };
+  }
 }
 
 // src/index.ts
@@ -341,8 +298,8 @@ var RETRY_FLAG = "genex:embed:retry";
 var POPOVER_DISMISSED_FLAG = "genex:guest:popover-dismissed";
 var LOCAL_AUTH_FLAG = "genex:embed:local-auth";
 var PLAYER_ID_KEY = "genex:player";
-var SDK_VERSION = "0.16.0";
-var config = null;
+var SDK_VERSION = "0.21.0";
+var config2 = null;
 var state = "pending";
 var user = null;
 var localTestMode = false;
@@ -366,6 +323,8 @@ var nativeReauthTimeoutMs = 3e4;
 var heartbeatIntervalMs = 3e4;
 var handshakeTimer;
 var refreshTimer;
+var unattendedWaiterTimer;
+var earlyWaiterWarned = false;
 var messageHandler;
 var listeners = /* @__PURE__ */ new Map();
 var authWaiters = [];
@@ -382,8 +341,16 @@ function win() {
 function doc() {
   return globalThis.document;
 }
-function doFetch(input, init) {
-  return globalThis.fetch(input, init);
+function doFetch(input, init, timeoutMs) {
+  let signal;
+  if (timeoutMs !== void 0) {
+    try {
+      const ctor = globalThis.AbortSignal;
+      if (ctor && typeof ctor.timeout === "function") signal = ctor.timeout(timeoutMs);
+    } catch {
+    }
+  }
+  return globalThis.fetch(input, signal ? { ...init, signal } : init);
 }
 function readRetryFlag() {
   try {
@@ -449,16 +416,29 @@ function initEmbed(cfg2) {
   if (!w) return;
   if (initialized) return;
   initialized = true;
-  config = {
+  if (unattendedWaiterTimer !== void 0) {
+    clearTimeout(unattendedWaiterTimer);
+    unattendedWaiterTimer = void 0;
+  }
+  config2 = {
     slug: cfg2.slug,
     apiUrl: cfg2.apiUrl.replace(/\/$/, ""),
     dashboardOrigins: [...cfg2.dashboardOrigins]
   };
   state = "pending";
   _initCommerce({
-    apiUrl: config.apiUrl,
-    dashboardOrigins: config.dashboardOrigins,
+    apiUrl: config2.apiUrl,
+    dashboardOrigins: config2.dashboardOrigins,
+    getToken: () => embedToken,
+    isEmbedded,
+    isNative: inNativeMode,
+    isLocalTest: () => localTestMode
+  });
+  _initGeneration({
+    apiUrl: config2.apiUrl,
+    dashboardOrigins: config2.dashboardOrigins,
     getToken: () => embedToken,
+    getParentOrigin: () => parentOrigin,
     isEmbedded,
     isNative: inNativeMode,
     isLocalTest: () => localTestMode
@@ -506,6 +486,7 @@ function getColyseusUrls() {
 function waitForAuth() {
   if (state === "authenticated" && user) return Promise.resolve({ user });
   if (state === "blocked") return Promise.reject(new Error("genex embed auth: blocked"));
+  noteWaiterBeforeInit("waitForAuth");
   return new Promise((resolve, reject) => {
     authWaiters.push({ resolve, reject });
   });
@@ -515,10 +496,29 @@ function waitForPlayer() {
     return Promise.resolve({ user, guest: state === "guest" });
   }
   if (state === "blocked") return Promise.reject(new Error("genex embed auth: blocked"));
+  noteWaiterBeforeInit("waitForPlayer");
   return new Promise((resolve, reject) => {
     playerWaiters.push({ resolve, reject });
   });
 }
+function noteWaiterBeforeInit(fn) {
+  if (initialized) return;
+  if (!earlyWaiterWarned) {
+    earlyWaiterWarned = true;
+    try {
+      console.error(
+        `[genex] ${fn}() called before initEmbed() \u2014 identity can never resolve and the game will sit black. Call initEmbed({ slug, apiUrl, dashboardOrigins }) first (genex-threejs-embed-auth), and draw a frame before you await identity.`
+      );
+    } catch {
+    }
+  }
+  if (unattendedWaiterTimer === void 0) {
+    unattendedWaiterTimer = setTimeout(() => {
+      unattendedWaiterTimer = void 0;
+      if (!initialized) enterBlocked("no-identity");
+    }, handshakeTimeoutMs);
+  }
+}
 function on(event, cb) {
   let set = listeners.get(event);
   if (!set) {
@@ -532,7 +532,7 @@ function on(event, cb) {
 }
 var KEEPALIVE_MAX_BYTES = 32 * 1024;
 async function ensurePlayer() {
-  if (!config) throw new Error("genex embed: call initEmbed() first");
+  if (!config2) throw new Error("genex embed: call initEmbed() first");
   if (state === "pending") await waitForPlayer();
   if (state === "blocked") throw new Error("genex embed auth: blocked");
 }
@@ -541,7 +541,7 @@ function stateFetch(path, init = {}) {
   const headers = { Authorization: `Bearer ${embedToken}` };
   if (init.body !== void 0) headers["Content-Type"] = "application/json";
   if (init.ifVersion !== void 0) headers["If-Match"] = String(init.ifVersion);
-  return doFetch(`${config.apiUrl}/api/projects/${encodeURIComponent(config.slug)}${path}`, {
+  return doFetch(`${config2.apiUrl}/api/projects/${encodeURIComponent(config2.slug)}${path}`, {
     method: init.method ?? "GET",
     headers,
     body: init.body,
@@ -631,7 +631,7 @@ async function submitScore(score, opts) {
   return { submitted: true, best: body.best, improved: body.improved };
 }
 async function getLeaderboard(opts) {
-  if (!config) throw new Error("genex embed: call initEmbed() first");
+  if (!config2) throw new Error("genex embed: call initEmbed() first");
   if (localTestMode) return { items: [], me: null };
   if (state === "pending") {
     try {
@@ -647,7 +647,7 @@ async function getLeaderboard(opts) {
   const headers = {};
   if (embedToken) headers.Authorization = `Bearer ${embedToken}`;
   const res = await doFetch(
-    `${config.apiUrl}/api/projects/${encodeURIComponent(config.slug)}/leaderboard${qs ? `?${qs}` : ""}`,
+    `${config2.apiUrl}/api/projects/${encodeURIComponent(config2.slug)}/leaderboard${qs ? `?${qs}` : ""}`,
     { headers }
   );
   if (!res.ok) throw new Error(`genex leaderboard failed (${res.status})`);
@@ -694,7 +694,7 @@ function acceptsTicket() {
   return (state === "pending" || state === "guest") && !redeeming;
 }
 async function handleParentMessage(event) {
-  if (!config) return;
+  if (!config2) return;
   const data = event.data;
   if (!data || data.v !== PROTOCOL_VERSION) return;
   const isTicket = data.type === "genex:embed:ticket";
@@ -702,7 +702,7 @@ async function handleParentMessage(event) {
   if (!isTicket && !isGuest) return;
   if (isTicket && (!acceptsTicket() || typeof data.ticket !== "string" || !data.ticket)) return;
   if (isGuest && (state !== "pending" || redeeming || requestingGuest)) return;
-  if (!config.dashboardOrigins.includes(event.origin)) {
+  if (!config2.dashboardOrigins.includes(event.origin)) {
     const fresh = await fetchDashboardOrigins();
     if (isTicket && !acceptsTicket()) return;
     if (isGuest && (state !== "pending" || redeeming || requestingGuest)) return;
@@ -739,13 +739,13 @@ function inNativeMode() {
 }
 function postToNative(message) {
   const w = win();
-  if (!w || !config || !nativeEntry) return;
+  if (!w || !config2 || !nativeEntry) return;
   const bridge = nativeBridge(w);
   if (!bridge) return;
   const encoded = encodeBridgeMessage({
     channel: NATIVE_CHANNEL,
     v: NATIVE_PROTOCOL_VERSION,
-    slug: config.slug,
+    slug: config2.slug,
     attemptId: nativeEntry.attemptId,
     nonce: nativeEntry.nonce,
     ...message
@@ -772,11 +772,11 @@ function startNativeHandshake(w, entry) {
   }, handshakeTimeoutMs);
 }
 async function handleNativeCommand(payload) {
-  if (!config || !nativeEntry) return;
-  const read2 = readBridgeNativeCommand(payload);
-  if (!read2.ok) return;
-  const command = read2.message;
-  if (command.slug !== config.slug || command.attemptId !== nativeEntry.attemptId || command.nonce !== nativeEntry.nonce) {
+  if (!config2 || !nativeEntry) return;
+  const read = readBridgeNativeCommand(payload);
+  if (!read.ok) return;
+  const command = read.message;
+  if (command.slug !== config2.slug || command.attemptId !== nativeEntry.attemptId || command.nonce !== nativeEntry.nonce) {
     return;
   }
   switch (command.type) {
@@ -841,16 +841,25 @@ function postToParent(message, targetOrigin) {
 async function startStandaloneFlow(w) {
   const frag = readFragment(w);
   if (frag.ticket) {
+    armStandaloneWatchdog();
     await redeemTicket(frag.ticket);
     return;
   }
   if (frag.guest) {
+    armStandaloneWatchdog();
     await requestGuestSession();
     return;
   }
   showOverlay("redirecting");
   await redirectToAuthorize(w, { guestOk: true });
 }
+function armStandaloneWatchdog() {
+  if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+  handshakeTimer = setTimeout(() => {
+    handshakeTimer = void 0;
+    if (state === "pending") enterBlocked("no-identity");
+  }, handshakeTimeoutMs);
+}
 var stashedTicketHash = null;
 function _stashTicketFromUrl() {
   const w = win();
@@ -896,44 +905,48 @@ function readFragment(w) {
   return { ticket, guest };
 }
 async function redirectToAuthorize(w, opts) {
-  if (!config || localTestMode) return;
+  if (!config2 || localTestMode) return;
   if (inNativeMode()) return;
-  const origin = opts?.guestOk ? config.dashboardOrigins[0] ?? (await fetchDashboardOrigins())[0] : (await fetchDashboardOrigins())[0] ?? config.dashboardOrigins[0];
+  const origin = opts?.guestOk ? config2.dashboardOrigins[0] ?? (await fetchDashboardOrigins())[0] : (await fetchDashboardOrigins())[0] ?? config2.dashboardOrigins[0];
   if (!origin) {
     enterBlocked();
     return;
   }
   const returnTo = w.location.origin + w.location.pathname;
   const guestParam = opts?.guestOk ? "&guest=ok" : "";
-  const url = `${origin}/play/authorize?returnTo=${encodeURIComponent(returnTo)}&slug=${encodeURIComponent(config.slug)}${guestParam}`;
+  const url = `${origin}/play/authorize?returnTo=${encodeURIComponent(returnTo)}&slug=${encodeURIComponent(config2.slug)}${guestParam}`;
   w.location.replace(url);
 }
 async function fetchDashboardOrigins() {
-  if (!config) return [];
+  if (!config2) return [];
   try {
-    const res = await doFetch(`${config.apiUrl}/api/embed/dashboard-origins`);
-    if (!res.ok) return config.dashboardOrigins;
+    const res = await doFetch(`${config2.apiUrl}/api/embed/dashboard-origins`);
+    if (!res.ok) return config2.dashboardOrigins;
     const body = await res.json();
     if (Array.isArray(body.origins) && body.origins.every((o) => typeof o === "string")) {
       return body.origins;
     }
   } catch {
   }
-  return config.dashboardOrigins;
+  return config2.dashboardOrigins;
 }
 async function redeemTicket(ticket) {
-  if (!config || localTestMode || redeeming) return;
+  if (!config2 || localTestMode || redeeming) return;
   const reauthing = nativeReauthPending && state === "authenticated";
   if (state !== "pending" && state !== "guest" && !reauthing) return;
   const upgradingFromGuest = state === "guest";
   const epoch = ++identityEpoch;
   redeeming = true;
   try {
-    const res = await doFetch(`${config.apiUrl}/api/embed/session`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ ticket })
-    });
+    const res = await doFetch(
+      `${config2.apiUrl}/api/embed/session`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ ticket })
+      },
+      handshakeTimeoutMs
+    );
     if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`ticket redemption failed (${res.status})`) });
@@ -946,6 +959,8 @@ async function redeemTicket(ticket) {
     user = body.user;
     colyseusUrls = body.colyseus?.urls;
     state = "authenticated";
+    if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+    handshakeTimer = void 0;
     clearRetryFlag();
     removeOverlay();
     removeGuestPopover();
@@ -972,19 +987,19 @@ async function redeemTicket(ticket) {
   }
 }
 async function requestGuestSession() {
-  if (!config || localTestMode || requestingGuest || redeeming) return;
+  if (!config2 || localTestMode || requestingGuest || redeeming) return;
   if (state !== "pending" && state !== "guest") return;
   const epoch = ++identityEpoch;
   requestingGuest = true;
   try {
-    const res = await doFetch(`${config.apiUrl}/api/embed/guest-session`, {
+    const res = await doFetch(`${config2.apiUrl}/api/embed/guest-session`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       // playerId is analytics-only: the SERVER still mints the session's own
       // guest id and the token is unchanged — this just lets the play event
       // key on something that survives the tab.
-      body: JSON.stringify({ slug: config.slug, playerId: playerId() })
-    });
+      body: JSON.stringify({ slug: config2.slug, playerId: playerId() })
+    }, handshakeTimeoutMs);
     if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`guest session failed (${res.status})`) });
@@ -1076,6 +1091,8 @@ function enterLocalTestMode(w) {
 }
 async function handleRedeemFailure() {
   const w = win();
+  if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
+  handshakeTimer = void 0;
   if (inNativeMode()) {
     clearNativeReauth();
     postNativeError("ticket-rejected");
@@ -1097,12 +1114,12 @@ function scheduleRefresh() {
   }, refreshDelayMs);
 }
 async function refreshToken() {
-  if (!config || state !== "authenticated" && state !== "guest" || !embedToken) return;
+  if (!config2 || state !== "authenticated" && state !== "guest" || !embedToken) return;
   const epoch = identityEpoch;
   const tokenAtStart = embedToken;
   let status;
   try {
-    const res = await doFetch(`${config.apiUrl}/api/embed/session/refresh`, {
+    const res = await doFetch(`${config2.apiUrl}/api/embed/session/refresh`, {
       method: "POST",
       headers: { Authorization: `Bearer ${tokenAtStart}` },
       // Best-effort completion if the tab starts unloading mid-refresh; zero
@@ -1469,8 +1486,11 @@ function __resetForTests(overrides) {
   messageHandler = void 0;
   if (handshakeTimer !== void 0) clearTimeout(handshakeTimer);
   if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+  if (unattendedWaiterTimer !== void 0) clearTimeout(unattendedWaiterTimer);
   handshakeTimer = void 0;
   refreshTimer = void 0;
+  unattendedWaiterTimer = void 0;
+  earlyWaiterWarned = false;
   stopNativeTimers();
   if (w) delete w[NATIVE_RECEIVER];
   nativeEntry = null;
@@ -1479,7 +1499,7 @@ function __resetForTests(overrides) {
   removeOverlay(true);
   removeGuestPopover();
   overlayFontRequested = false;
-  config = null;
+  config2 = null;
   state = "pending";
   user = null;
   localTestMode = false;
@@ -1510,6 +1530,13 @@ export {
   getEntitlements,
   consumeEntitlement,
   buy,
+  getGenerationModels,
+  getWorkflowOfferings,
+  getGeneration,
+  waitForGeneration,
+  generate,
+  requestWorkflow,
+  resumeWorkflow,
   initEmbed,
   isEmbedded,
   getAuthState,