@genex-ai/embed-sdk 0.6.0 → 0.6.1

package/dist/{chunk-5VYRFOFN.js → chunk-UOC55SJL.js}

@@ -12,6 +12,7 @@ var parentOrigin = null;
 var initialized = false;
 var redeeming = false;
 var requestingGuest = false;
+var identityEpoch = 0;
 var handshakeTimeoutMs = 1e4;
 var refreshDelayMs = 10 * 6e4;
 var refreshRetryMs = 6e4;
@@ -419,6 +420,7 @@ async function fetchDashboardOrigins() {
 async function redeemTicket(ticket) {
   if (!config || localTestMode || redeeming || state !== "pending" && state !== "guest") return;
   const upgradingFromGuest = state === "guest";
+  const epoch = ++identityEpoch;
   redeeming = true;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/session`, {
@@ -426,12 +428,14 @@ async function redeemTicket(ticket) {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ ticket })
     });
+    if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`ticket redemption failed (${res.status})`) });
       if (!upgradingFromGuest) await handleRedeemFailure();
       return;
     }
     const body = await res.json();
+    if (epoch !== identityEpoch) return;
     embedToken = body.embedToken;
     user = body.user;
     colyseusUrls = body.colyseus?.urls;
@@ -449,6 +453,7 @@ async function redeemTicket(ticket) {
     for (const waiter of playerWaiters.splice(0)) waiter.resolve({ user, guest: false });
     emit("authenticated", ctx);
   } catch (error) {
+    if (epoch !== identityEpoch) return;
     emit("error", { error });
     if (!upgradingFromGuest) await handleRedeemFailure();
   } finally {
@@ -458,6 +463,7 @@ async function redeemTicket(ticket) {
 async function requestGuestSession() {
   if (!config || localTestMode || requestingGuest || redeeming) return;
   if (state !== "pending" && state !== "guest") return;
+  const epoch = ++identityEpoch;
   requestingGuest = true;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/guest-session`, {
@@ -465,17 +471,20 @@ async function requestGuestSession() {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ slug: config.slug })
     });
+    if (epoch !== identityEpoch) return;
     if (!res.ok) {
       emit("error", { error: new Error(`guest session failed (${res.status})`) });
       enterBlocked();
       return;
     }
     const body = await res.json();
+    if (epoch !== identityEpoch) return;
     embedToken = body.embedToken;
     user = body.user;
     colyseusUrls = body.colyseus?.urls;
     enterGuest();
   } catch (error) {
+    if (epoch !== identityEpoch) return;
     emit("error", { error });
     enterBlocked();
   } finally {
@@ -553,18 +562,22 @@ function scheduleRefresh() {
 }
 async function refreshToken() {
   if (!config || state !== "authenticated" && state !== "guest" || !embedToken) return;
+  const epoch = identityEpoch;
+  const tokenAtStart = embedToken;
   let status;
   try {
     const res = await doFetch(`${config.apiUrl}/api/embed/session/refresh`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${embedToken}` },
+      headers: { Authorization: `Bearer ${tokenAtStart}` },
       // Best-effort completion if the tab starts unloading mid-refresh; zero
       // security consequence either way (worst case the token just expires).
       keepalive: true
     });
     status = res.status;
+    if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
     if (res.ok) {
       const body = await res.json();
+      if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
       embedToken = body.embedToken;
       scheduleRefresh();
       return;
@@ -572,6 +585,7 @@ async function refreshToken() {
   } catch {
     status = void 0;
   }
+  if (epoch !== identityEpoch || embedToken !== tokenAtStart) return;
   if (status === 401) {
     if (state === "guest") {
       void requestGuestSession();
@@ -588,6 +602,7 @@ async function refreshToken() {
 }
 function enterBlocked() {
   if (state === "blocked") return;
+  identityEpoch++;
   state = "blocked";
   user = null;
   embedToken = void 0;
@@ -731,6 +746,7 @@ function __resetForTests(overrides) {
   initialized = false;
   redeeming = false;
   requestingGuest = false;
+  identityEpoch++;
   listeners.clear();
   authWaiters = [];
   playerWaiters = [];

package/dist/index.d.ts

@@ -116,7 +116,7 @@ declare function getUser(): EmbedUser | null;
  */
 declare function getEmbedToken(): string | undefined;
 /**
- * The credential for multiplayer: pass as `connect({ ..., auth: getColyseusAuth() })`
+ * The credential for multiplayer: pass as `connect({ ..., auth: () => getColyseusAuth() })`
  * AFTER `await waitForPlayer()` — the relay rejects tokenless joins, but
  * accepts guest tokens. Read it fresh at every connect() call (tokens rotate
  * ~every 10 minutes). NEVER log this value.

package/dist/index.js

@@ -17,7 +17,7 @@ import {
   submitScore,
   waitForAuth,
   waitForPlayer
-} from "./chunk-5VYRFOFN.js";
+} from "./chunk-UOC55SJL.js";
 export {
   __resetForTests,
   _stashTicketFromUrl,

package/dist/sentry.js

@@ -2,7 +2,7 @@ import {
   _stashTicketFromUrl,
   getUser,
   on
-} from "./chunk-5VYRFOFN.js";
+} from "./chunk-UOC55SJL.js";
 
 // src/sentry.ts
 import * as Sentry from "@sentry/browser";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/embed-sdk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Player identity + durable game state for genex games — signed-in or guest play, per-player save slots, shared world state, and soft-trust leaderboards.",
   "type": "module",
   "main": "./dist/index.js",