@genex-ai/embed-sdk 0.5.0 → 0.6.1

package/dist/{chunk-GDJLPL6W.js → chunk-UOC55SJL.js}

@@ -7,11 +7,12 @@ var state = "pending";
 var user = null;
 var localTestMode = false;
 var embedToken;
-var colyseusUrl;
+var colyseusUrls;
 var parentOrigin = null;
 var initialized = false;
 var redeeming = false;
 var requestingGuest = false;
+var identityEpoch = 0;
 var handshakeTimeoutMs = 1e4;
 var refreshDelayMs = 10 * 6e4;
 var refreshRetryMs = 6e4;
@@ -110,6 +111,9 @@ function getEmbedToken() {
 function getColyseusAuth() {
   return embedToken ? { embedToken } : void 0;
 }
+function getColyseusUrls() {
+  return colyseusUrls ?? [];
+}
 function waitForAuth() {
   if (state === "authenticated" && user) return Promise.resolve({ user });
   if (state === "blocked") return Promise.reject(new Error("genex embed auth: blocked"));
@@ -416,6 +420,7 @@ async function fetchDashboardOrigins() {
 async function redeemTicket(ticket) {
   if (!config || localTestMode || redeeming || state !== "pending" && state !== "guest") return;
   const upgradingFromGuest = state === "guest";
+  const epoch = ++identityEpoch;
   redeeming = true;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/session`, {
@@ -423,16 +428,17 @@ async function redeemTicket(ticket) {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ ticket })
     });
+    if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`ticket redemption failed (${res.status})`) });
       if (!upgradingFromGuest) await handleRedeemFailure();
       return;
     }
     const body = await res.json();
+    if (epoch !== identityEpoch) return;
     embedToken = body.embedToken;
     user = body.user;
-    colyseusUrl = body.colyseus?.url;
-    void colyseusUrl;
+    colyseusUrls = body.colyseus?.urls;
     state = "authenticated";
     clearRetryFlag();
     removeOverlay();
@@ -447,6 +453,7 @@ async function redeemTicket(ticket) {
     for (const waiter of playerWaiters.splice(0)) waiter.resolve({ user, guest: false });
     emit("authenticated", ctx);
   } catch (error) {
+    if (epoch !== identityEpoch) return;
     emit("error", { error });
     if (!upgradingFromGuest) await handleRedeemFailure();
   } finally {
@@ -456,6 +463,7 @@ async function redeemTicket(ticket) {
 async function requestGuestSession() {
   if (!config || localTestMode || requestingGuest || redeeming) return;
   if (state !== "pending" && state !== "guest") return;
+  const epoch = ++identityEpoch;
   requestingGuest = true;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/guest-session`, {
@@ -463,17 +471,20 @@ async function requestGuestSession() {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ slug: config.slug })
     });
+    if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`guest session failed (${res.status})`) });
       enterBlocked();
       return;
     }
     const body = await res.json();
+    if (epoch !== identityEpoch) return;
     embedToken = body.embedToken;
     user = body.user;
-    colyseusUrl = body.colyseus?.url;
+    colyseusUrls = body.colyseus?.urls;
     enterGuest();
   } catch (error) {
+    if (epoch !== identityEpoch) return;
     emit("error", { error });
     enterBlocked();
   } finally {
@@ -551,18 +562,22 @@ function scheduleRefresh() {
 }
 async function refreshToken() {
   if (!config || state !== "authenticated" && state !== "guest" || !embedToken) return;
+  const epoch = identityEpoch;
+  const tokenAtStart = embedToken;
   let status;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/session/refresh`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${embedToken}` },
+      headers: { Authorization: `Bearer ${tokenAtStart}` },
       // Best-effort completion if the tab starts unloading mid-refresh; zero
       // security consequence either way (worst case the token just expires).
       keepalive: true
     });
     status = res.status;
+    if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
     if (res.ok) {
       const body = await res.json();
+      if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
       embedToken = body.embedToken;
       scheduleRefresh();
       return;
@@ -570,6 +585,7 @@ async function refreshToken() {
   } catch {
     status = void 0;
   }
+  if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
   if (status === 401) {
     if (state === "guest") {
       void requestGuestSession();
@@ -586,6 +602,7 @@ async function refreshToken() {
 }
 function enterBlocked() {
   if (state === "blocked") return;
+  identityEpoch++;
   state = "blocked";
   user = null;
   embedToken = void 0;
@@ -724,11 +741,12 @@ function __resetForTests(overrides) {
   user = null;
   localTestMode = false;
   embedToken = void 0;
-  colyseusUrl = void 0;
+  colyseusUrls = void 0;
   parentOrigin = null;
   initialized = false;
   redeeming = false;
   requestingGuest = false;
+  identityEpoch++;
   listeners.clear();
   authWaiters = [];
   playerWaiters = [];
@@ -748,6 +766,7 @@ export {
   getUser,
   getEmbedToken,
   getColyseusAuth,
+  getColyseusUrls,
   waitForAuth,
   waitForPlayer,
   on,

package/dist/index.d.ts

@@ -116,7 +116,7 @@ declare function getUser(): EmbedUser | null;
  */
 declare function getEmbedToken(): string | undefined;
 /**
- * The credential for multiplayer: pass as `connect({ ..., auth: getColyseusAuth() })`
+ * The credential for multiplayer: pass as `connect({ ..., auth: () => getColyseusAuth() })`
  * AFTER `await waitForPlayer()` — the relay rejects tokenless joins, but
  * accepts guest tokens. Read it fresh at every connect() call (tokens rotate
  * ~every 10 minutes). NEVER log this value.
@@ -124,6 +124,9 @@ declare function getEmbedToken(): string | undefined;
 declare function getColyseusAuth(): {
     embedToken: string;
 } | undefined;
+/** The relay URLs for this session (server-owned; a regional list when configured). Pass to
+ *  connect()/matchmake() as `urls` so the SDK joins the lowest-latency one; single-url fallback. */
+declare function getColyseusUrls(): string[];
 /**
  * Resolves with the signed-in ACCOUNT once authenticated; rejects if the
  * session ends up blocked. THE gate for /state saves and any account-bound
@@ -220,4 +223,4 @@ declare function __resetForTests(overrides?: {
     refreshRetryMs?: number;
 }): void;
 
-export { type AuthState, type EmbedConfig, type EmbedEvent, type EmbedUser, type Leaderboard, type LeaderboardEntry, type PlayerStateResult, type SaveStateResult, type SubmitScoreResult, type WorldStateResult, __resetForTests, _stashTicketFromUrl, getAuthState, getColyseusAuth, getEmbedToken, getLeaderboard, getUser, initEmbed, isEmbedded, loadPlayerState, loadWorldState, on, savePlayerState, saveWorldState, submitScore, waitForAuth, waitForPlayer };
+export { type AuthState, type EmbedConfig, type EmbedEvent, type EmbedUser, type Leaderboard, type LeaderboardEntry, type PlayerStateResult, type SaveStateResult, type SubmitScoreResult, type WorldStateResult, __resetForTests, _stashTicketFromUrl, getAuthState, getColyseusAuth, getColyseusUrls, getEmbedToken, getLeaderboard, getUser, initEmbed, isEmbedded, loadPlayerState, loadWorldState, on, savePlayerState, saveWorldState, submitScore, waitForAuth, waitForPlayer };

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   _stashTicketFromUrl,
   getAuthState,
   getColyseusAuth,
+  getColyseusUrls,
   getEmbedToken,
   getLeaderboard,
   getUser,
@@ -16,12 +17,13 @@ import {
   submitScore,
   waitForAuth,
   waitForPlayer
-} from "./chunk-GDJLPL6W.js";
+} from "./chunk-UOC55SJL.js";
 export {
   __resetForTests,
   _stashTicketFromUrl,
   getAuthState,
   getColyseusAuth,
+  getColyseusUrls,
   getEmbedToken,
   getLeaderboard,
   getUser,

package/dist/sentry.js

@@ -2,7 +2,7 @@ import {
   _stashTicketFromUrl,
   getUser,
   on
-} from "./chunk-GDJLPL6W.js";
+} from "./chunk-UOC55SJL.js";
 
 // src/sentry.ts
 import * as Sentry from "@sentry/browser";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/embed-sdk",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Player identity + durable game state for genex games — signed-in or guest play, per-player save slots, shared world state, and soft-trust leaderboards.",
   "type": "module",
   "main": "./dist/index.js",