@joystyk/identity 0.0.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @joystyk/identity
+
+## 0.2.0
+
+### Patch Changes
+
+- Updated dependencies [bb095c7]
+- Updated dependencies [bb095c7]
+  - @joystyk/contracts@0.2.0
+  - @joystyk/storage@0.2.0
+
+## 0.1.0
+
+### Minor Changes
+
+- Prepare the first compiled library release: ESM and API declarations for every public entry point, runtime assets, and checks against installed npm tarballs. Games and applications remain private.
+
+### Patch Changes
+
+- Updated dependencies
+  - @joystyk/contracts@0.1.0
+  - @joystyk/storage@0.1.0

package/README.md

@@ -1,5 +1,127 @@
 # @joystyk/identity
 
-The first Joystyk library release is not yet available. This placeholder reserves the package name.
+The guest player of v1 (host policy): a stable player id made on the device, a display name that
+passes a strict all-ages filter, and an avatar from a preset set. There is no email, no
+sign-in, no analytics and no fingerprinting (host policy). Everything else the site keeps, from
+saves to streaks, keys on the player id, never on the device, so v2 can attach the id to an
+account and carry the history across (v2-accounts-and-social.md (Joystyk host reference)).
 
-Source: https://github.com/joystyk-games/game-libraries
+## npm package
+
+The first `0.1.0` release is being prepared; it has not been published. Once available:
+
+```sh
+npm install @joystyk/identity
+```
+
+Node consumers require Node 24.15 or later. Browser entry points require a modern
+browser and should be loaded in the browser.
+
+| Import | Format |
+| --- | --- |
+| `@joystyk/identity` | ES module and TypeScript declarations |
+| `@joystyk/identity/browser` | ES module and TypeScript declarations |
+| `@joystyk/identity/names` | ES module and TypeScript declarations |
+
+Only the entries listed above are public API. Installed packages contain compiled ESM,
+type declarations and runtime assets. Repository-relative links describe the Joystyk
+workspace and are not needed to use the npm package.
+
+## Entry points
+
+| Import | Runs in | Contents |
+| --- | --- | --- |
+| `@joystyk/identity` | Anywhere (no DOM) | `createIdentity`, the name filter and generator, avatars, record kinds |
+| `@joystyk/identity/browser` | Browser | `createBrowserIdentity`, which injects `crypto.randomUUID` and `crypto.getRandomValues` |
+| `@joystyk/identity/names` | Anywhere (no DOM, no storage) | `checkDisplayName`, `generateName`, the blocklist and their types; the room server imports only this |
+
+## Use
+
+```ts
+import { openBrowserStorage } from '@joystyk/storage/browser';
+import { createBrowserIdentity } from '@joystyk/identity/browser';
+
+const storage = await openBrowserStorage({ onNotice });
+const identity = createBrowserIdentity(storage);
+
+const profile = await identity.current(); // { id, displayName: 'Pixel Fox 42', nameSource, avatar, createdAt }
+await identity.rename('Ada Byte');         // Result: the normalized name, or why it was refused
+await identity.rollName();                 // a fresh generated name
+await identity.setAvatar('robot');         // preset ids only
+const player = storage.player(profile.id); // saves, stats, streaks, preferences
+```
+
+`current()` never fails. When storage can't keep a new guest (private browsing, blocked site
+data), the guest lasts for this page and storage has already told the player.
+
+Two tabs opened together on a first visit get one guest (bead host integration work). The `device` record
+and the profile are each written with `setIfAbsent`, one IndexedDB transaction that writes
+only when the key is empty, so the tab that loses the race plays as the guest the other
+created. This needs no Web Locks, so it holds in every browser with IndexedDB; storage that
+fell back to memory isn't shared between tabs, so each tab there is its own guest.
+
+The core takes its randomness as arguments (`randomUUID`, `random`), so tests and server
+code pass deterministic ones.
+
+## Records
+
+Both live in the storage package's `identity` object store and decode through Zod schemas.
+
+| Key | Record | Notes |
+| --- | --- | --- |
+| `device` | `{ playerId }` | Which player this device plays as; the only record not keyed on a player id |
+| `player/<id>` | `Profile` | The name is re-checked on every read. A name that a newer blocklist refuses is discarded, and the player gets a fresh generated name under the same id. |
+
+## Display names
+
+`checkDisplayName(input)` normalizes (NFKC, trim, collapse spaces) and then refuses a name
+that:
+
+- has fewer than 3 or more than 20 characters;
+- uses anything but ASCII letters and digits, with single spaces, hyphens or underscores
+  between them (this alone rules out URLs, emails, emoji and look-alike letters from other
+  scripts, which would slip past the blocklist);
+- has no letter, or more than 4 digits (no phone numbers or birthdays);
+- matches the blocklist.
+
+Rejection messages never repeat the word that was blocked. Rooms and anything else that
+shows a name to another player should run the same check; `@joystyk/identity/names` offers it
+without storage or the DOM. The room server replaces a refused name with a generated one and
+tells the player why.
+
+The blocklist (`src/names/blocklist.ts`) has three parts. Matching lowercases the name, undoes
+digit substitutions (`sh1t`, `n4z1`) and matches stretched letters (`fuuuck`):
+
+| List | Matches | Example |
+| --- | --- | --- |
+| `BLOCKED_ANYWHERE` | Anywhere, even across word breaks | `F U C K`, `BigShitFan` |
+| `BLOCKED_WORDS` | Only a whole word, or the whole name with its breaks removed | `Big Ass`, but not `Classic` or `Peacock` |
+| `BLOCKED_NUMBERS` | A number standing alone | `Fox 69` |
+
+The filter is strict on purpose and will sometimes refuse an innocent name ("Cosmic Untamed"
+contains a blocked stem across the space). The player can type another or roll one.
+
+### Blocklist provenance
+
+The list was curated from the English list of
+[List of Dirty, Naughty, Obscene, and Otherwise Bad Words](https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and-Otherwise-Bad-Words)
+(file `en`, commit `5faf2ba42d7b1c0977169ec3611df25a3c08eb13`, SHA-256
+`af851ecef1d5f212caba17339b12ac39cc2fef7d78c74876f67237644fcee8bd`), © Shutterstock, Inc.
+and contributors, licensed under
+[CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Changes: phrases reduced to their
+key word or dropped, words with everyday meanings dropped, stems in place of inflections, and
+a few slurs, hate codes and insults added (marked `// added` in the file). When you change
+the list, keep the attribution and add a test case.
+
+## Generated names
+
+`generateName(random)` returns names like "Pixel Fox 42": an arcade adjective, a friendly
+noun and a number from 10 to 99, skipping blocked numbers. A test runs every combination
+through the filter, so a generated name never needs a second roll. Add words only if they
+are kind, all-ages and free of trademarks (`pnpm check:names` scans this package).
+
+## Avatars
+
+`AVATAR_IDS` lists 16 preset ids (`fox`, `robot`, `joystick`, …). The art will come later
+from `@joystyk/ui`. Ids are stored in profiles, so never rename or remove one; add new ones
+at the end.

package/dist/avatars.d.ts

@@ -0,0 +1,11 @@
+import { type Random } from './names/generator.js';
+/**
+ * The preset avatars. Players choose from these; there are no uploads (D-26: no personal
+ * data, no public profiles). Only ids for now; the `ui` package will draw them. Ids are
+ * stable forever, because profiles store them: add new ones, never rename or remove one.
+ */
+export declare const AVATAR_IDS: readonly ["fox", "panda", "otter", "owl", "penguin", "koala", "tiger", "dragon", "robot", "alien", "rocket", "comet", "planet", "star", "dice", "joystick"];
+export type AvatarId = (typeof AVATAR_IDS)[number];
+export declare const isAvatarId: (value: unknown) => value is AvatarId;
+/** A random preset avatar, for a new guest. */
+export declare const randomAvatar: (random: Random) => AvatarId;

package/dist/avatars.js

@@ -0,0 +1,32 @@
+import { pick } from "./names/generator.js";
+//#region src/avatars.ts
+/**
+* The preset avatars. Players choose from these; there are no uploads (D-26: no personal
+* data, no public profiles). Only ids for now; the `ui` package will draw them. Ids are
+* stable forever, because profiles store them: add new ones, never rename or remove one.
+*/
+var AVATAR_IDS = [
+	"fox",
+	"panda",
+	"otter",
+	"owl",
+	"penguin",
+	"koala",
+	"tiger",
+	"dragon",
+	"robot",
+	"alien",
+	"rocket",
+	"comet",
+	"planet",
+	"star",
+	"dice",
+	"joystick"
+];
+var isAvatarId = (value) => typeof value === "string" && AVATAR_IDS.includes(value);
+/** A random preset avatar, for a new guest. */
+var randomAvatar = (random) => pick(AVATAR_IDS, random);
+//#endregion
+export { AVATAR_IDS, isAvatarId, randomAvatar };
+
+//# sourceMappingURL=avatars.js.map

package/dist/avatars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatars.js","names":[],"sources":["../src/avatars.ts"],"sourcesContent":["import { pick, type Random } from './names/generator.ts';\n\n/**\n * The preset avatars. Players choose from these; there are no uploads (D-26: no personal\n * data, no public profiles). Only ids for now; the `ui` package will draw them. Ids are\n * stable forever, because profiles store them: add new ones, never rename or remove one.\n */\nexport const AVATAR_IDS = [\n  'fox',\n  'panda',\n  'otter',\n  'owl',\n  'penguin',\n  'koala',\n  'tiger',\n  'dragon',\n  'robot',\n  'alien',\n  'rocket',\n  'comet',\n  'planet',\n  'star',\n  'dice',\n  'joystick',\n] as const;\n\nexport type AvatarId = (typeof AVATAR_IDS)[number];\n\nexport const isAvatarId = (value: unknown): value is AvatarId =>\n  typeof value === 'string' && (AVATAR_IDS as readonly string[]).includes(value);\n\n/** A random preset avatar, for a new guest. */\nexport const randomAvatar = (random: Random): AvatarId => pick(AVATAR_IDS, random);\n"],"mappings":";;;;;;;AAOA,IAAa,aAAa;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,IAAa,cAAc,UACzB,OAAO,UAAU,YAAa,WAAiC,SAAS,KAAK;;AAG/E,IAAa,gBAAgB,WAA6B,KAAK,YAAY,MAAM"}

package/dist/browser/index.d.ts

@@ -0,0 +1,9 @@
+import type { Storage } from '@joystyk/storage';
+import type { Random } from '../names/generator.js';
+import { type Identity } from '../identity.js';
+/** A uniform float in [0, 1) from `crypto.getRandomValues`. */
+export declare const cryptoRandom: Random;
+/** A new player id from `crypto.randomUUID`. */
+export declare const cryptoRandomUUID: () => string;
+/** The guest identity with the browser's randomness. */
+export declare const createBrowserIdentity: (storage: Storage, now?: () => number) => Identity;

package/dist/browser/index.js

@@ -0,0 +1,17 @@
+import { createIdentity } from "../identity.js";
+//#region src/browser/index.ts
+/** A uniform float in [0, 1) from `crypto.getRandomValues`. */
+var cryptoRandom = () => (crypto.getRandomValues(/* @__PURE__ */ new Uint32Array(1))[0] ?? 0) / 2 ** 32;
+/** A new player id from `crypto.randomUUID`. */
+var cryptoRandomUUID = () => crypto.randomUUID();
+/** The guest identity with the browser's randomness. */
+var createBrowserIdentity = (storage, now) => createIdentity({
+	storage,
+	randomUUID: cryptoRandomUUID,
+	random: cryptoRandom,
+	...now === void 0 ? {} : { now }
+});
+//#endregion
+export { createBrowserIdentity, cryptoRandom, cryptoRandomUUID };
+
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/browser/index.ts"],"sourcesContent":["// @joystyk/identity/browser: the identity's randomness from the Web Crypto API.\nimport type { Storage } from '@joystyk/storage';\nimport type { Random } from '../names/generator.ts';\nimport { createIdentity, type Identity } from '../identity.ts';\n\n/** A uniform float in [0, 1) from `crypto.getRandomValues`. */\nexport const cryptoRandom: Random = () => (crypto.getRandomValues(new Uint32Array(1))[0] ?? 0) / 2 ** 32;\n\n/** A new player id from `crypto.randomUUID`. */\nexport const cryptoRandomUUID = (): string => crypto.randomUUID();\n\n/** The guest identity with the browser's randomness. */\nexport const createBrowserIdentity = (storage: Storage, now?: () => number): Identity =>\n  createIdentity({\n    storage,\n    randomUUID: cryptoRandomUUID,\n    random: cryptoRandom,\n    ...(now === undefined ? {} : { now }),\n  });\n"],"mappings":";;;AAMA,IAAa,sBAA8B,OAAO,gCAAgB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK;;AAGtG,IAAa,yBAAiC,OAAO,WAAW;;AAGhE,IAAa,yBAAyB,SAAkB,QACtD,eAAe;CACb;CACA,YAAY;CACZ,QAAQ;CACR,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI;AACrC,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,65 @@
+import { type Result } from '@joystyk/contracts';
+import { type Storage, type StorageError } from '@joystyk/storage';
+import { type AvatarId } from './avatars.js';
+import { type Random } from './names/generator.js';
+import { type NameRejection } from './names/filter.js';
+/**
+ * A guest player id: a random UUID made on the device the first time the site runs. It
+ * identifies the player, not the device, and is never sent to an ad network or analytics
+ * (there are none). Saves, stats, streaks and preferences all key on it, so v2 can attach it
+ * to an account and carry the history across.
+ */
+export type PlayerId = string & {
+    readonly __brand: 'PlayerId';
+};
+/** True for a lowercase RFC 9562 UUID, the form `crypto.randomUUID` returns. */
+export declare const isPlayerId: (value: unknown) => value is PlayerId;
+/** Everything the site knows about a player. No email, no age, nothing personal (D-26). */
+export type Profile = {
+    readonly id: PlayerId;
+    /** Always passes `checkDisplayName`. */
+    readonly displayName: string;
+    /** `generated` until the player types a name of their own. */
+    readonly nameSource: 'generated' | 'chosen';
+    readonly avatar: AvatarId;
+    /** Epoch milliseconds. */
+    readonly createdAt: number;
+};
+/** Which player this device plays as. The only record not keyed on a player id. */
+export declare const DEVICE_RECORD: import("@joystyk/storage").RecordKind<{
+    readonly playerId: PlayerId;
+}>;
+/**
+ * A player's profile, keyed `player/<id>`. The name is re-checked on every read, so a word
+ * added to the blocklist later retires old names that contain it: the profile is discarded
+ * and the player gets a fresh generated name under the same id.
+ */
+export declare const PROFILE_RECORD: import("@joystyk/storage").RecordKind<Profile>;
+export type IdentityOptions = {
+    readonly storage: Storage;
+    /** Makes a new player id; `crypto.randomUUID` in the browser (see the browser entry). */
+    readonly randomUUID: () => string;
+    /** Picks generated names and avatars. */
+    readonly random: Random;
+    /** Epoch milliseconds. Defaults to `Date.now`. */
+    readonly now?: () => number;
+};
+export type IdentityError = NameRejection | StorageError | {
+    readonly code: 'UnknownAvatar';
+    readonly message: string;
+};
+/** The guest identity on this device. */
+export interface Identity {
+    /**
+     * The current player, created on first use. Never fails: when storage can't keep the new
+     * guest, the guest lives for this page only and storage has already told the player.
+     */
+    current(): Promise<Profile>;
+    /** Sets a name the player typed, after `checkDisplayName`. */
+    rename(name: string): Promise<Result<Profile, IdentityError>>;
+    /** Replaces the name with a fresh generated one. */
+    rollName(): Promise<Result<Profile, IdentityError>>;
+    setAvatar(avatar: string): Promise<Result<Profile, IdentityError>>;
+}
+/** Creates the guest identity over the platform storage. */
+export declare const createIdentity: (options: IdentityOptions) => Identity;

package/dist/identity.js

@@ -0,0 +1,121 @@
+import { generateName } from "./names/generator.js";
+import { AVATAR_IDS, isAvatarId, randomAvatar } from "./avatars.js";
+import { checkDisplayName, isDisplayName } from "./names/filter.js";
+import { err, ok } from "@joystyk/contracts";
+import { defineRecordKind } from "@joystyk/storage";
+import * as z from "zod/mini";
+//#region src/identity.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+/** True for a lowercase RFC 9562 UUID, the form `crypto.randomUUID` returns. */
+var isPlayerId = (value) => typeof value === "string" && UUID.test(value);
+var playerId = z.custom(isPlayerId, { error: "Expected a player id" });
+/** Which player this device plays as. The only record not keyed on a player id. */
+var DEVICE_RECORD = defineRecordKind({
+	store: "identity",
+	version: 1,
+	schema: z.object({ playerId }),
+	label: "player id"
+});
+/**
+* A player's profile, keyed `player/<id>`. The name is re-checked on every read, so a word
+* added to the blocklist later retires old names that contain it: the profile is discarded
+* and the player gets a fresh generated name under the same id.
+*/
+var PROFILE_RECORD = defineRecordKind({
+	store: "identity",
+	version: 1,
+	schema: z.object({
+		id: playerId,
+		displayName: z.custom(isDisplayName, { error: "Expected an allowed display name" }),
+		nameSource: z.enum(["generated", "chosen"]),
+		avatar: z.enum(AVATAR_IDS),
+		createdAt: z.number().check(z.nonnegative())
+	}),
+	label: "player profile"
+});
+var DEVICE_KEY = "device";
+var profileKey = (id) => `player/${id}`;
+/** Creates the guest identity over the platform storage. */
+var createIdentity = (options) => {
+	const now = options.now ?? Date.now;
+	const device = options.storage.records(DEVICE_RECORD);
+	const profiles = options.storage.records(PROFILE_RECORD);
+	const newId = () => {
+		const id = options.randomUUID();
+		if (!isPlayerId(id)) throw new TypeError(`randomUUID returned "${id}", which is not a lowercase UUID`);
+		return id;
+	};
+	const newProfile = (id) => ({
+		id,
+		displayName: generateName(options.random),
+		nameSource: "generated",
+		avatar: randomAvatar(options.random),
+		createdAt: now()
+	});
+	/**
+	* The player this device plays as. On a first visit two tabs may start at once (gp-d4v),
+	* so the device record and the profile are each written only if absent, in one storage
+	* transaction (`setIfAbsent`): a tab that loses the race plays as the guest the other
+	* created. That needs no Web Locks, so no browser is left without the guard; storage that
+	* fell back to memory isn't shared between tabs, so each tab is its own guest there.
+	*/
+	const load = async () => {
+		const pointer = await device.get(DEVICE_KEY);
+		let id = pointer.ok ? pointer.value?.playerId ?? null : null;
+		if (id === null) {
+			const fresh = newId();
+			const claimed = await device.setIfAbsent(DEVICE_KEY, { playerId: fresh });
+			id = claimed.ok ? claimed.value.playerId : fresh;
+		}
+		const key = profileKey(id);
+		const stored = await profiles.get(key);
+		if (stored.ok && stored.value !== null && stored.value.id === id) return stored.value;
+		const profile = newProfile(id);
+		if (stored.ok && stored.value !== null) {
+			await profiles.set(key, profile);
+			return profile;
+		}
+		const created = await profiles.setIfAbsent(key, profile);
+		return created.ok && created.value.id === id ? created.value : profile;
+	};
+	let cached = null;
+	const current = () => cached ??= load();
+	const update = async (change) => {
+		const next = change(await current());
+		const written = await profiles.set(profileKey(next.id), next);
+		if (!written.ok) return written;
+		cached = Promise.resolve(next);
+		return ok(next);
+	};
+	return {
+		current,
+		rename: async (name) => {
+			const checked = checkDisplayName(name);
+			if (!checked.ok) return checked;
+			return update((profile) => ({
+				...profile,
+				displayName: checked.value,
+				nameSource: "chosen"
+			}));
+		},
+		rollName: () => update((profile) => ({
+			...profile,
+			displayName: generateName(options.random),
+			nameSource: "generated"
+		})),
+		setAvatar: async (avatar) => {
+			if (!isAvatarId(avatar)) return err({
+				code: "UnknownAvatar",
+				message: "That avatar isn't available."
+			});
+			return update((profile) => ({
+				...profile,
+				avatar
+			}));
+		}
+	};
+};
+//#endregion
+export { DEVICE_RECORD, PROFILE_RECORD, createIdentity, isPlayerId };
+
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","names":[],"sources":["../src/identity.ts"],"sourcesContent":["import { err, ok, type Result } from '@joystyk/contracts';\nimport { defineRecordKind, type Storage, type StorageError } from '@joystyk/storage';\nimport * as z from 'zod/mini';\nimport { AVATAR_IDS, isAvatarId, randomAvatar, type AvatarId } from './avatars.ts';\nimport { generateName, type Random } from './names/generator.ts';\nimport { checkDisplayName, isDisplayName, type NameRejection } from './names/filter.ts';\n\n/**\n * A guest player id: a random UUID made on the device the first time the site runs. It\n * identifies the player, not the device, and is never sent to an ad network or analytics\n * (there are none). Saves, stats, streaks and preferences all key on it, so v2 can attach it\n * to an account and carry the history across.\n */\nexport type PlayerId = string & { readonly __brand: 'PlayerId' };\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\n\n/** True for a lowercase RFC 9562 UUID, the form `crypto.randomUUID` returns. */\nexport const isPlayerId = (value: unknown): value is PlayerId => typeof value === 'string' && UUID.test(value);\n\n/** Everything the site knows about a player. No email, no age, nothing personal (D-26). */\nexport type Profile = {\n  readonly id: PlayerId;\n  /** Always passes `checkDisplayName`. */\n  readonly displayName: string;\n  /** `generated` until the player types a name of their own. */\n  readonly nameSource: 'generated' | 'chosen';\n  readonly avatar: AvatarId;\n  /** Epoch milliseconds. */\n  readonly createdAt: number;\n};\n\nconst playerId = z.custom<PlayerId>(isPlayerId, { error: 'Expected a player id' });\n\n/** Which player this device plays as. The only record not keyed on a player id. */\nexport const DEVICE_RECORD = defineRecordKind<{ readonly playerId: PlayerId }>({\n  store: 'identity',\n  version: 1,\n  schema: z.object({ playerId }),\n  label: 'player id',\n});\n\n/**\n * A player's profile, keyed `player/<id>`. The name is re-checked on every read, so a word\n * added to the blocklist later retires old names that contain it: the profile is discarded\n * and the player gets a fresh generated name under the same id.\n */\nexport const PROFILE_RECORD = defineRecordKind<Profile>({\n  store: 'identity',\n  version: 1,\n  schema: z.object({\n    id: playerId,\n    displayName: z.custom<string>(isDisplayName, { error: 'Expected an allowed display name' }),\n    nameSource: z.enum(['generated', 'chosen']),\n    avatar: z.enum(AVATAR_IDS),\n    createdAt: z.number().check(z.nonnegative()),\n  }),\n  label: 'player profile',\n});\n\nconst DEVICE_KEY = 'device';\nconst profileKey = (id: PlayerId): string => `player/${id}`;\n\nexport type IdentityOptions = {\n  readonly storage: Storage;\n  /** Makes a new player id; `crypto.randomUUID` in the browser (see the browser entry). */\n  readonly randomUUID: () => string;\n  /** Picks generated names and avatars. */\n  readonly random: Random;\n  /** Epoch milliseconds. Defaults to `Date.now`. */\n  readonly now?: () => number;\n};\n\nexport type IdentityError = NameRejection | StorageError | { readonly code: 'UnknownAvatar'; readonly message: string };\n\n/** The guest identity on this device. */\nexport interface Identity {\n  /**\n   * The current player, created on first use. Never fails: when storage can't keep the new\n   * guest, the guest lives for this page only and storage has already told the player.\n   */\n  current(): Promise<Profile>;\n  /** Sets a name the player typed, after `checkDisplayName`. */\n  rename(name: string): Promise<Result<Profile, IdentityError>>;\n  /** Replaces the name with a fresh generated one. */\n  rollName(): Promise<Result<Profile, IdentityError>>;\n  setAvatar(avatar: string): Promise<Result<Profile, IdentityError>>;\n}\n\n/** Creates the guest identity over the platform storage. */\nexport const createIdentity = (options: IdentityOptions): Identity => {\n  const now = options.now ?? Date.now;\n  const device = options.storage.records(DEVICE_RECORD);\n  const profiles = options.storage.records(PROFILE_RECORD);\n\n  const newId = (): PlayerId => {\n    const id = options.randomUUID();\n    if (!isPlayerId(id)) throw new TypeError(`randomUUID returned \"${id}\", which is not a lowercase UUID`);\n    return id;\n  };\n\n  const newProfile = (id: PlayerId): Profile => ({\n    id,\n    displayName: generateName(options.random),\n    nameSource: 'generated',\n    avatar: randomAvatar(options.random),\n    createdAt: now(),\n  });\n\n  /**\n   * The player this device plays as. On a first visit two tabs may start at once (gp-d4v),\n   * so the device record and the profile are each written only if absent, in one storage\n   * transaction (`setIfAbsent`): a tab that loses the race plays as the guest the other\n   * created. That needs no Web Locks, so no browser is left without the guard; storage that\n   * fell back to memory isn't shared between tabs, so each tab is its own guest there.\n   */\n  const load = async (): Promise<Profile> => {\n    const pointer = await device.get(DEVICE_KEY);\n    let id = pointer.ok ? (pointer.value?.playerId ?? null) : null;\n    if (id === null) {\n      const fresh = newId();\n      const claimed = await device.setIfAbsent(DEVICE_KEY, { playerId: fresh });\n      id = claimed.ok ? claimed.value.playerId : fresh;\n    }\n    const key = profileKey(id);\n    const stored = await profiles.get(key);\n    if (stored.ok && stored.value !== null && stored.value.id === id) return stored.value;\n    // A first visit, or a profile that was lost: keep the id.\n    const profile = newProfile(id);\n    if (stored.ok && stored.value !== null) {\n      // A profile for another id sits under this key; replace it.\n      await profiles.set(key, profile);\n      return profile;\n    }\n    const created = await profiles.setIfAbsent(key, profile);\n    return created.ok && created.value.id === id ? created.value : profile;\n  };\n\n  let cached: Promise<Profile> | null = null;\n  const current = (): Promise<Profile> => (cached ??= load());\n\n  const update = async (change: (profile: Profile) => Profile): Promise<Result<Profile, IdentityError>> => {\n    const next = change(await current());\n    const written = await profiles.set(profileKey(next.id), next);\n    if (!written.ok) return written;\n    cached = Promise.resolve(next);\n    return ok(next);\n  };\n\n  return {\n    current,\n    rename: async (name) => {\n      const checked = checkDisplayName(name);\n      if (!checked.ok) return checked;\n      return update((profile) => ({ ...profile, displayName: checked.value, nameSource: 'chosen' }));\n    },\n    rollName: () =>\n      update((profile) => ({ ...profile, displayName: generateName(options.random), nameSource: 'generated' })),\n    setAvatar: async (avatar) => {\n      if (!isAvatarId(avatar)) return err({ code: 'UnknownAvatar', message: \"That avatar isn't available.\" });\n      return update((profile) => ({ ...profile, avatar }));\n    },\n  };\n};\n"],"mappings":";;;;;;;AAeA,IAAM,OAAO;;AAGb,IAAa,cAAc,UAAsC,OAAO,UAAU,YAAY,KAAK,KAAK,KAAK;AAc7G,IAAM,WAAW,EAAE,OAAiB,YAAY,EAAE,OAAO,uBAAuB,CAAC;;AAGjF,IAAa,gBAAgB,iBAAkD;CAC7E,OAAO;CACP,SAAS;CACT,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;CAC7B,OAAO;AACT,CAAC;;;;;;AAOD,IAAa,iBAAiB,iBAA0B;CACtD,OAAO;CACP,SAAS;CACT,QAAQ,EAAE,OAAO;EACf,IAAI;EACJ,aAAa,EAAE,OAAe,eAAe,EAAE,OAAO,mCAAmC,CAAC;EAC1F,YAAY,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;EAC1C,QAAQ,EAAE,KAAK,UAAU;EACzB,WAAW,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;CAC7C,CAAC;CACD,OAAO;AACT,CAAC;AAED,IAAM,aAAa;AACnB,IAAM,cAAc,OAAyB,UAAU;;AA6BvD,IAAa,kBAAkB,YAAuC;CACpE,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,SAAS,QAAQ,QAAQ,QAAQ,aAAa;CACpD,MAAM,WAAW,QAAQ,QAAQ,QAAQ,cAAc;CAEvD,MAAM,cAAwB;EAC5B,MAAM,KAAK,QAAQ,WAAW;EAC9B,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,IAAI,UAAU,wBAAwB,GAAG,iCAAiC;EACrG,OAAO;CACT;CAEA,MAAM,cAAc,QAA2B;EAC7C;EACA,aAAa,aAAa,QAAQ,MAAM;EACxC,YAAY;EACZ,QAAQ,aAAa,QAAQ,MAAM;EACnC,WAAW,IAAI;CACjB;;;;;;;;CASA,MAAM,OAAO,YAA8B;EACzC,MAAM,UAAU,MAAM,OAAO,IAAI,UAAU;EAC3C,IAAI,KAAK,QAAQ,KAAM,QAAQ,OAAO,YAAY,OAAQ;EAC1D,IAAI,OAAO,MAAM;GACf,MAAM,QAAQ,MAAM;GACpB,MAAM,UAAU,MAAM,OAAO,YAAY,YAAY,EAAE,UAAU,MAAM,CAAC;GACxE,KAAK,QAAQ,KAAK,QAAQ,MAAM,WAAW;EAC7C;EACA,MAAM,MAAM,WAAW,EAAE;EACzB,MAAM,SAAS,MAAM,SAAS,IAAI,GAAG;EACrC,IAAI,OAAO,MAAM,OAAO,UAAU,QAAQ,OAAO,MAAM,OAAO,IAAI,OAAO,OAAO;EAEhF,MAAM,UAAU,WAAW,EAAE;EAC7B,IAAI,OAAO,MAAM,OAAO,UAAU,MAAM;GAEtC,MAAM,SAAS,IAAI,KAAK,OAAO;GAC/B,OAAO;EACT;EACA,MAAM,UAAU,MAAM,SAAS,YAAY,KAAK,OAAO;EACvD,OAAO,QAAQ,MAAM,QAAQ,MAAM,OAAO,KAAK,QAAQ,QAAQ;CACjE;CAEA,IAAI,SAAkC;CACtC,MAAM,gBAAmC,WAAW,KAAK;CAEzD,MAAM,SAAS,OAAO,WAAmF;EACvG,MAAM,OAAO,OAAO,MAAM,QAAQ,CAAC;EACnC,MAAM,UAAU,MAAM,SAAS,IAAI,WAAW,KAAK,EAAE,GAAG,IAAI;EAC5D,IAAI,CAAC,QAAQ,IAAI,OAAO;EACxB,SAAS,QAAQ,QAAQ,IAAI;EAC7B,OAAO,GAAG,IAAI;CAChB;CAEA,OAAO;EACL;EACA,QAAQ,OAAO,SAAS;GACtB,MAAM,UAAU,iBAAiB,IAAI;GACrC,IAAI,CAAC,QAAQ,IAAI,OAAO;GACxB,OAAO,QAAQ,aAAa;IAAE,GAAG;IAAS,aAAa,QAAQ;IAAO,YAAY;GAAS,EAAE;EAC/F;EACA,gBACE,QAAQ,aAAa;GAAE,GAAG;GAAS,aAAa,aAAa,QAAQ,MAAM;GAAG,YAAY;EAAY,EAAE;EAC1G,WAAW,OAAO,WAAW;GAC3B,IAAI,CAAC,WAAW,MAAM,GAAG,OAAO,IAAI;IAAE,MAAM;IAAiB,SAAS;GAA+B,CAAC;GACtG,OAAO,QAAQ,aAAa;IAAE,GAAG;IAAS;GAAO,EAAE;EACrD;CACF;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { AVATAR_IDS, isAvatarId, randomAvatar, type AvatarId } from './avatars.js';
+export { generateName, NAME_ADJECTIVES, NAME_NOUNS, NAME_NUMBERS, pick, type Random } from './names/generator.js';
+export { checkDisplayName, isBlocked, isDisplayName, NAME_LIMITS, normalizeDisplayName, type NameRejection, type NameRejectionCode, } from './names/filter.js';
+export { createIdentity, DEVICE_RECORD, isPlayerId, PROFILE_RECORD, type Identity, type IdentityError, type IdentityOptions, type PlayerId, type Profile, } from './identity.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+import { NAME_ADJECTIVES, NAME_NOUNS, NAME_NUMBERS, generateName, pick } from "./names/generator.js";
+import { AVATAR_IDS, isAvatarId, randomAvatar } from "./avatars.js";
+import { NAME_LIMITS, checkDisplayName, isBlocked, isDisplayName, normalizeDisplayName } from "./names/filter.js";
+import { DEVICE_RECORD, PROFILE_RECORD, createIdentity, isPlayerId } from "./identity.js";
+export { AVATAR_IDS, DEVICE_RECORD, NAME_ADJECTIVES, NAME_LIMITS, NAME_NOUNS, NAME_NUMBERS, PROFILE_RECORD, checkDisplayName, createIdentity, generateName, isAvatarId, isBlocked, isDisplayName, isPlayerId, normalizeDisplayName, pick, randomAvatar };

package/dist/names/blocklist.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Stems blocked anywhere in the name, even across word breaks ("f u c k", "BigShitFan").
+ * Only stems that almost never occur inside an innocent word belong here.
+ */
+export declare const BLOCKED_ANYWHERE: readonly string[];
+/**
+ * Words blocked only as a whole word (or as the whole name with its breaks removed), because
+ * they hide inside innocent words: "ass" in "class", "cock" in "peacock", "coon" in
+ * "raccoon". Singular forms; a trailing "s" is stripped before comparing, so plurals in
+ * "es" are listed.
+ */
+export declare const BLOCKED_WORDS: readonly string[];
+/** Numbers blocked as a whole token: sexual references and hate codes (added). */
+export declare const BLOCKED_NUMBERS: readonly string[];

package/dist/names/blocklist.js

@@ -0,0 +1,141 @@
+//#region src/names/blocklist.ts
+/**
+* Stems blocked anywhere in the name, even across word breaks ("f u c k", "BigShitFan").
+* Only stems that almost never occur inside an innocent word belong here.
+*/
+var BLOCKED_ANYWHERE = [
+	"arsehole",
+	"asshole",
+	"bastard",
+	"bitch",
+	"blowjob",
+	"bollock",
+	"bukkake",
+	"clit",
+	"creampie",
+	"cumshot",
+	"cunnil",
+	"cunt",
+	"dildo",
+	"ejaculat",
+	"erotic",
+	"faggot",
+	"fellat",
+	"fuck",
+	"gangbang",
+	"handjob",
+	"hentai",
+	"hitler",
+	"incest",
+	"jailbait",
+	"jigaboo",
+	"jiggaboo",
+	"jizz",
+	"kkk",
+	"masturbat",
+	"milf",
+	"nazi",
+	"nigg",
+	"orgasm",
+	"paedophil",
+	"pedophil",
+	"penis",
+	"piss",
+	"poontang",
+	"porn",
+	"punany",
+	"queef",
+	"raghead",
+	"retard",
+	"rimjob",
+	"schlong",
+	"scrotum",
+	"shemale",
+	"shit",
+	"slut",
+	"smegma",
+	"sodom",
+	"splooge",
+	"swastika",
+	"threesome",
+	"titties",
+	"titty",
+	"towelhead",
+	"twat",
+	"upskirt",
+	"vagina",
+	"voyeur",
+	"wetback",
+	"whore",
+	"xxx"
+];
+/**
+* Words blocked only as a whole word (or as the whole name with its breaks removed), because
+* they hide inside innocent words: "ass" in "class", "cock" in "peacock", "coon" in
+* "raccoon". Singular forms; a trailing "s" is stripped before comparing, so plurals in
+* "es" are listed.
+*/
+var BLOCKED_WORDS = [
+	"anal",
+	"anus",
+	"arse",
+	"ass",
+	"asses",
+	"beaner",
+	"boner",
+	"boob",
+	"butt",
+	"chink",
+	"cock",
+	"coon",
+	"cum",
+	"darkie",
+	"dick",
+	"dyke",
+	"fag",
+	"gook",
+	"homo",
+	"honkey",
+	"horny",
+	"kike",
+	"kinky",
+	"kys",
+	"negro",
+	"nude",
+	"orgy",
+	"paki",
+	"pedo",
+	"poon",
+	"pussy",
+	"quim",
+	"rape",
+	"raped",
+	"raping",
+	"rapist",
+	"scat",
+	"semen",
+	"sex",
+	"sexy",
+	"skeet",
+	"smut",
+	"spic",
+	"spunk",
+	"stfu",
+	"suck",
+	"tit",
+	"tranny",
+	"wank",
+	"wanker",
+	"wtf"
+];
+/** Numbers blocked as a whole token: sexual references and hate codes (added). */
+var BLOCKED_NUMBERS = [
+	"69",
+	"88",
+	"420",
+	"1488"
+];
+//#endregion
+export { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS };
+
+//# sourceMappingURL=blocklist.js.map

package/dist/names/blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.js","names":[],"sources":["../../src/names/blocklist.ts"],"sourcesContent":["/*\n * The display-name blocklist: compact on purpose, because the character rules in filter.ts\n * already shut out most abuse (no URLs, emails, symbols, emoji or non-Latin look-alikes).\n *\n * Source: the English list of \"List of Dirty, Naughty, Obscene, and Otherwise Bad Words\"\n *         https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and-Otherwise-Bad-Words\n *         file `en`, commit 5faf2ba42d7b1c0977169ec3611df25a3c08eb13 (403 entries,\n *         sha256 af851ecef1d5f212caba17339b12ac39cc2fef7d78c74876f67237644fcee8bd).\n * License: Creative Commons Attribution 4.0 International (CC BY 4.0),\n *          https://creativecommons.org/licenses/by/4.0/ . Copyright Shutterstock, Inc. and\n *          the LDNOOBW contributors.\n * Changes: curated, not copied. Multi-word phrases were reduced to the single word that\n *          carries the meaning, or dropped when no single word does; words with innocent\n *          everyday meanings were dropped; stems replace families of inflections; a few\n *          slurs, hate codes and insults the source lacks were added (marked \"added\" below).\n *\n * Matching (see filter.ts) lowercases the name, undoes common digit substitutions\n * (0→o, 1→i or l, 3→e, 4→a, 5→s, 7→t, 8→b, 9→g) and squeezes repeated letters.\n */\n\n/**\n * Stems blocked anywhere in the name, even across word breaks (\"f u c k\", \"BigShitFan\").\n * Only stems that almost never occur inside an innocent word belong here.\n */\nexport const BLOCKED_ANYWHERE: readonly string[] = [\n  'arsehole',\n  'asshole',\n  'bastard',\n  'bitch',\n  'blowjob',\n  'bollock',\n  'bukkake',\n  'clit',\n  'creampie',\n  'cumshot',\n  'cunnil',\n  'cunt',\n  'dildo',\n  'ejaculat',\n  'erotic',\n  'faggot',\n  'fellat',\n  'fuck',\n  'gangbang',\n  'handjob',\n  'hentai',\n  'hitler', // added\n  'incest',\n  'jailbait',\n  'jigaboo',\n  'jiggaboo',\n  'jizz',\n  'kkk', // added\n  'masturbat',\n  'milf',\n  'nazi',\n  'nigg',\n  'orgasm',\n  'paedophil',\n  'pedophil',\n  'penis',\n  'piss',\n  'poontang',\n  'porn',\n  'punany',\n  'queef',\n  'raghead',\n  'retard', // added\n  'rimjob',\n  'schlong',\n  'scrotum', // added\n  'shemale',\n  'shit',\n  'slut',\n  'smegma', // added\n  'sodom',\n  'splooge',\n  'swastika',\n  'threesome',\n  'titties',\n  'titty',\n  'towelhead',\n  'twat',\n  'upskirt',\n  'vagina',\n  'voyeur',\n  'wetback',\n  'whore',\n  'xxx',\n];\n\n/**\n * Words blocked only as a whole word (or as the whole name with its breaks removed), because\n * they hide inside innocent words: \"ass\" in \"class\", \"cock\" in \"peacock\", \"coon\" in\n * \"raccoon\". Singular forms; a trailing \"s\" is stripped before comparing, so plurals in\n * \"es\" are listed.\n */\nexport const BLOCKED_WORDS: readonly string[] = [\n  'anal',\n  'anus',\n  'arse',\n  'ass',\n  'asses',\n  'beaner',\n  'boner',\n  'boob',\n  'butt',\n  'chink', // added\n  'cock',\n  'coon',\n  'cum',\n  'darkie',\n  'dick',\n  'dyke',\n  'fag',\n  'gook', // added\n  'homo', // added\n  'honkey',\n  'horny',\n  'kike',\n  'kinky',\n  'kys', // added: \"kill yourself\"\n  'negro',\n  'nude',\n  'orgy',\n  'paki',\n  'pedo',\n  'poon',\n  'pussy',\n  'quim',\n  'rape',\n  'raped',\n  'raping',\n  'rapist',\n  'scat',\n  'semen',\n  'sex',\n  'sexy',\n  'skeet',\n  'smut',\n  'spic',\n  'spunk',\n  'stfu', // added\n  'suck',\n  'tit',\n  'tranny',\n  'wank',\n  'wanker',\n  'wtf', // added\n];\n\n/** Numbers blocked as a whole token: sexual references and hate codes (added). */\nexport const BLOCKED_NUMBERS: readonly string[] = ['69', '88', '420', '1488'];\n"],"mappings":";;;;;AAwBA,IAAa,mBAAsC;CACjD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;AAQA,IAAa,gBAAmC;CAC9C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,IAAa,kBAAqC;CAAC;CAAM;CAAM;CAAO;AAAM"}

package/dist/names/filter.d.ts

@@ -0,0 +1,25 @@
+import { type GameError, type Result } from '@joystyk/contracts';
+export declare const NAME_LIMITS: {
+    /** Characters, after trimming. */
+    readonly minLength: 3;
+    readonly maxLength: 20;
+    /** At most this many digits, so a name can't carry a phone number or a birth year and day. */
+    readonly maxDigits: 4;
+};
+/** Why a name was refused. */
+export type NameRejectionCode = 'TooShort' | 'TooLong' | 'Characters' | 'NoLetter' | 'TooManyDigits' | 'NotAllowed';
+/** A refused name, worded for the player. It never repeats the word that was blocked. */
+export type NameRejection = GameError & {
+    readonly code: NameRejectionCode;
+};
+/** Unicode-normalizes (NFKC, so full-width letters become ASCII), trims and collapses spaces. */
+export declare const normalizeDisplayName: (input: string) => string;
+/** True when the name contains a blocked word, stem or number in any of its readings. */
+export declare const isBlocked: (name: string) => boolean;
+/**
+ * Checks a display name and returns it normalized, or says why it was refused. Rooms and
+ * every other place that shows a name to someone else should run the same check.
+ */
+export declare const checkDisplayName: (input: string) => Result<string, NameRejection>;
+/** True when `checkDisplayName` accepts the name exactly as given (already normalized). */
+export declare const isDisplayName: (value: unknown) => value is string;

package/dist/names/filter.js

@@ -0,0 +1,92 @@
+import { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS } from "./blocklist.js";
+import { err, ok } from "@joystyk/contracts";
+//#region src/names/filter.ts
+var NAME_LIMITS = {
+	/** Characters, after trimming. */
+	minLength: 3,
+	maxLength: 20,
+	/** At most this many digits, so a name can't carry a phone number or a birth year and day. */
+	maxDigits: 4
+};
+var MESSAGES = {
+	TooShort: `Names need at least ${NAME_LIMITS.minLength} characters.`,
+	TooLong: `Names can have at most ${NAME_LIMITS.maxLength} characters.`,
+	Characters: "Use letters, numbers, and single spaces, hyphens or underscores between them.",
+	NoLetter: "Names need at least one letter.",
+	TooManyDigits: `Names can have at most ${NAME_LIMITS.maxDigits} digits.`,
+	NotAllowed: "That name isn't allowed. Try another, or roll a random one."
+};
+var reject = (code) => err({
+	code,
+	message: MESSAGES[code]
+});
+/**
+* Letters and digits, with single spaces, hyphens or underscores between them. ASCII only:
+* look-alike letters from other scripts would slip past the blocklist.
+*/
+var SHAPE = /^[A-Za-z0-9]+(?:[ _-][A-Za-z0-9]+)*$/;
+/** Unicode-normalizes (NFKC, so full-width letters become ASCII), trims and collapses spaces. */
+var normalizeDisplayName = (input) => input.normalize("NFKC").trim().replace(/\s+/g, " ");
+var pattern = (term, anchored) => {
+	const body = (term.match(/(.)\1*/g) ?? []).map((run) => `${run[0]}{${run.length},}`).join("");
+	return new RegExp(anchored ? `^${body}$` : body);
+};
+var ANYWHERE = BLOCKED_ANYWHERE.map((term) => pattern(term, false));
+var WORDS = BLOCKED_WORDS.map((term) => pattern(term, true));
+var NUMBERS = new Set(BLOCKED_NUMBERS);
+var LEET = {
+	"0": "o",
+	"3": "e",
+	"4": "a",
+	"5": "s",
+	"7": "t",
+	"8": "b",
+	"9": "g"
+};
+/** Both readings of a token's digits: 1 as i and as l. */
+var unleet = (token) => {
+	const mapped = token.replace(/[0345789]/g, (digit) => LEET[digit] ?? digit);
+	return [mapped.replaceAll("1", "i"), mapped.replaceAll("1", "l")];
+};
+/** Splits at spaces, hyphens, underscores and camelCase humps ("BigFoxFan" → big, fox, fan). */
+var tokenize = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[ _-]+/).filter((token) => token !== "").map((token) => token.toLowerCase());
+/**
+* The forms a word is compared in: as written, and without a plural "s". Stripping "es" too
+* would turn "spices" into a slur, so the few "es" plurals that matter are listed instead.
+*/
+var wordForms = (word) => [word, word.replace(/s$/, "")];
+/** True when the name contains a blocked word, stem or number in any of its readings. */
+var isBlocked = (name) => {
+	const tokens = tokenize(name);
+	if (tokens.some((token) => NUMBERS.has(token))) return true;
+	const readings = tokens.filter((token) => /[a-z]/.test(token)).map(unleet);
+	const words = readings.flat().flatMap(wordForms);
+	const joined = [0, 1].map((variant) => readings.map((forms) => forms[variant]).join(""));
+	if (joined.some((text) => ANYWHERE.some((term) => term.test(text)))) return true;
+	return [...words, ...joined.flatMap(wordForms)].some((word) => WORDS.some((term) => term.test(word)));
+};
+/**
+* Checks a display name and returns it normalized, or says why it was refused. Rooms and
+* every other place that shows a name to someone else should run the same check.
+*/
+var checkDisplayName = (input) => {
+	const name = normalizeDisplayName(input);
+	const length = [...name].length;
+	if (length < NAME_LIMITS.minLength) return reject("TooShort");
+	if (length > NAME_LIMITS.maxLength) return reject("TooLong");
+	if (!SHAPE.test(name)) return reject("Characters");
+	if (!/[A-Za-z]/.test(name)) return reject("NoLetter");
+	if ((name.match(/[0-9]/g)?.length ?? 0) > NAME_LIMITS.maxDigits) return reject("TooManyDigits");
+	if (isBlocked(name)) return reject("NotAllowed");
+	return ok(name);
+};
+/** True when `checkDisplayName` accepts the name exactly as given (already normalized). */
+var isDisplayName = (value) => {
+	if (typeof value !== "string") return false;
+	const checked = checkDisplayName(value);
+	return checked.ok && checked.value === value;
+};
+//#endregion
+export { NAME_LIMITS, checkDisplayName, isBlocked, isDisplayName, normalizeDisplayName };
+
+//# sourceMappingURL=filter.js.map

package/dist/names/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","names":[],"sources":["../../src/names/filter.ts"],"sourcesContent":["// Display names (D-11, D-26): shown to other players, so every name passes a strict all-ages\n// filter. The rules are deliberately narrow; a player who trips one can roll a generated name.\nimport { err, ok, type GameError, type Result } from '@joystyk/contracts';\nimport { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS } from './blocklist.ts';\n\nexport const NAME_LIMITS = {\n  /** Characters, after trimming. */\n  minLength: 3,\n  maxLength: 20,\n  /** At most this many digits, so a name can't carry a phone number or a birth year and day. */\n  maxDigits: 4,\n} as const;\n\n/** Why a name was refused. */\nexport type NameRejectionCode = 'TooShort' | 'TooLong' | 'Characters' | 'NoLetter' | 'TooManyDigits' | 'NotAllowed';\n\n/** A refused name, worded for the player. It never repeats the word that was blocked. */\nexport type NameRejection = GameError & { readonly code: NameRejectionCode };\n\nconst MESSAGES = {\n  TooShort: `Names need at least ${NAME_LIMITS.minLength} characters.`,\n  TooLong: `Names can have at most ${NAME_LIMITS.maxLength} characters.`,\n  Characters: 'Use letters, numbers, and single spaces, hyphens or underscores between them.',\n  NoLetter: 'Names need at least one letter.',\n  TooManyDigits: `Names can have at most ${NAME_LIMITS.maxDigits} digits.`,\n  NotAllowed: \"That name isn't allowed. Try another, or roll a random one.\",\n} as const satisfies Record<NameRejectionCode, string>;\n\nconst reject = (code: NameRejectionCode): Result<never, NameRejection> => err({ code, message: MESSAGES[code] });\n\n/**\n * Letters and digits, with single spaces, hyphens or underscores between them. ASCII only:\n * look-alike letters from other scripts would slip past the blocklist.\n */\nconst SHAPE = /^[A-Za-z0-9]+(?:[ _-][A-Za-z0-9]+)*$/;\n\n/** Unicode-normalizes (NFKC, so full-width letters become ASCII), trims and collapses spaces. */\nexport const normalizeDisplayName = (input: string): string => input.normalize('NFKC').trim().replace(/\\s+/g, ' ');\n\n// Matching. A term becomes a pattern in which each run of a letter matches that run or a\n// longer one, so \"fuuuck\" matches \"fuck\" and \"boooob\" matches \"boob\", but \"bob\" doesn't.\nconst pattern = (term: string, anchored: boolean): RegExp => {\n  const runs = term.match(/(.)\\1*/g) ?? [];\n  const body = runs.map((run) => `${run[0]}{${run.length},}`).join('');\n  return new RegExp(anchored ? `^${body}$` : body);\n};\nconst ANYWHERE = BLOCKED_ANYWHERE.map((term) => pattern(term, false));\nconst WORDS = BLOCKED_WORDS.map((term) => pattern(term, true));\nconst NUMBERS = new Set(BLOCKED_NUMBERS);\n\nconst LEET: Readonly<Record<string, string>> = { '0': 'o', '3': 'e', '4': 'a', '5': 's', '7': 't', '8': 'b', '9': 'g' };\n\n/** Both readings of a token's digits: 1 as i and as l. */\nconst unleet = (token: string): readonly string[] => {\n  const mapped = token.replace(/[0345789]/g, (digit) => LEET[digit] ?? digit);\n  return [mapped.replaceAll('1', 'i'), mapped.replaceAll('1', 'l')];\n};\n\n/** Splits at spaces, hyphens, underscores and camelCase humps (\"BigFoxFan\" → big, fox, fan). */\nconst tokenize = (name: string): readonly string[] =>\n  name\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .split(/[ _-]+/)\n    .filter((token) => token !== '')\n    .map((token) => token.toLowerCase());\n\n/**\n * The forms a word is compared in: as written, and without a plural \"s\". Stripping \"es\" too\n * would turn \"spices\" into a slur, so the few \"es\" plurals that matter are listed instead.\n */\nconst wordForms = (word: string): readonly string[] => [word, word.replace(/s$/, '')];\n\n/** True when the name contains a blocked word, stem or number in any of its readings. */\nexport const isBlocked = (name: string): boolean => {\n  const tokens = tokenize(name);\n  if (tokens.some((token) => NUMBERS.has(token))) return true;\n\n  // Pure numbers are left out of the letter readings, so \"Fox 55\" doesn't read as \"foxss\".\n  const lettered = tokens.filter((token) => /[a-z]/.test(token));\n  const readings = lettered.map(unleet);\n  const words = readings.flat().flatMap(wordForms);\n  const joined = [0, 1].map((variant) => readings.map((forms) => forms[variant]).join(''));\n\n  if (joined.some((text) => ANYWHERE.some((term) => term.test(text)))) return true;\n  return [...words, ...joined.flatMap(wordForms)].some((word) => WORDS.some((term) => term.test(word)));\n};\n\n/**\n * Checks a display name and returns it normalized, or says why it was refused. Rooms and\n * every other place that shows a name to someone else should run the same check.\n */\nexport const checkDisplayName = (input: string): Result<string, NameRejection> => {\n  const name = normalizeDisplayName(input);\n  const length = [...name].length;\n  if (length < NAME_LIMITS.minLength) return reject('TooShort');\n  if (length > NAME_LIMITS.maxLength) return reject('TooLong');\n  if (!SHAPE.test(name)) return reject('Characters');\n  if (!/[A-Za-z]/.test(name)) return reject('NoLetter');\n  if ((name.match(/[0-9]/g)?.length ?? 0) > NAME_LIMITS.maxDigits) return reject('TooManyDigits');\n  if (isBlocked(name)) return reject('NotAllowed');\n  return ok(name);\n};\n\n/** True when `checkDisplayName` accepts the name exactly as given (already normalized). */\nexport const isDisplayName = (value: unknown): value is string => {\n  if (typeof value !== 'string') return false;\n  const checked = checkDisplayName(value);\n  return checked.ok && checked.value === value;\n};\n"],"mappings":";;;AAKA,IAAa,cAAc;;CAEzB,WAAW;CACX,WAAW;;CAEX,WAAW;AACb;AAQA,IAAM,WAAW;CACf,UAAU,uBAAuB,YAAY,UAAU;CACvD,SAAS,0BAA0B,YAAY,UAAU;CACzD,YAAY;CACZ,UAAU;CACV,eAAe,0BAA0B,YAAY,UAAU;CAC/D,YAAY;AACd;AAEA,IAAM,UAAU,SAA0D,IAAI;CAAE;CAAM,SAAS,SAAS;AAAM,CAAC;;;;;AAM/G,IAAM,QAAQ;;AAGd,IAAa,wBAAwB,UAA0B,MAAM,UAAU,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG;AAIjH,IAAM,WAAW,MAAc,aAA8B;CAE3D,MAAM,QADO,KAAK,MAAM,SAAS,KAAK,CAAC,EAAA,CACrB,KAAK,QAAQ,GAAG,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE;CACnE,OAAO,IAAI,OAAO,WAAW,IAAI,KAAK,KAAK,IAAI;AACjD;AACA,IAAM,WAAW,iBAAiB,KAAK,SAAS,QAAQ,MAAM,KAAK,CAAC;AACpE,IAAM,QAAQ,cAAc,KAAK,SAAS,QAAQ,MAAM,IAAI,CAAC;AAC7D,IAAM,UAAU,IAAI,IAAI,eAAe;AAEvC,IAAM,OAAyC;CAAE,KAAK;CAAK,KAAK;CAAK,KAAK;CAAK,KAAK;CAAK,KAAK;CAAK,KAAK;CAAK,KAAK;AAAI;;AAGtH,IAAM,UAAU,UAAqC;CACnD,MAAM,SAAS,MAAM,QAAQ,eAAe,UAAU,KAAK,UAAU,KAAK;CAC1E,OAAO,CAAC,OAAO,WAAW,KAAK,GAAG,GAAG,OAAO,WAAW,KAAK,GAAG,CAAC;AAClE;;AAGA,IAAM,YAAY,SAChB,KACG,QAAQ,sBAAsB,OAAO,CAAC,CACtC,MAAM,QAAQ,CAAC,CACf,QAAQ,UAAU,UAAU,EAAE,CAAC,CAC/B,KAAK,UAAU,MAAM,YAAY,CAAC;;;;;AAMvC,IAAM,aAAa,SAAoC,CAAC,MAAM,KAAK,QAAQ,MAAM,EAAE,CAAC;;AAGpF,IAAa,aAAa,SAA0B;CAClD,MAAM,SAAS,SAAS,IAAI;CAC5B,IAAI,OAAO,MAAM,UAAU,QAAQ,IAAI,KAAK,CAAC,GAAG,OAAO;CAIvD,MAAM,WADW,OAAO,QAAQ,UAAU,QAAQ,KAAK,KAAK,CAC3C,CAAA,CAAS,IAAI,MAAM;CACpC,MAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,QAAQ,SAAS;CAC/C,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,SAAS,KAAK,UAAU,MAAM,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;CAEvF,IAAI,OAAO,MAAM,SAAS,SAAS,MAAM,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,OAAO;CAC5E,OAAO,CAAC,GAAG,OAAO,GAAG,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC;AACtG;;;;;AAMA,IAAa,oBAAoB,UAAiD;CAChF,MAAM,OAAO,qBAAqB,KAAK;CACvC,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;CACzB,IAAI,SAAS,YAAY,WAAW,OAAO,OAAO,UAAU;CAC5D,IAAI,SAAS,YAAY,WAAW,OAAO,OAAO,SAAS;CAC3D,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,OAAO,OAAO,YAAY;CACjD,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,OAAO,OAAO,UAAU;CACpD,KAAK,KAAK,MAAM,QAAQ,CAAC,EAAE,UAAU,KAAK,YAAY,WAAW,OAAO,OAAO,eAAe;CAC9F,IAAI,UAAU,IAAI,GAAG,OAAO,OAAO,YAAY;CAC/C,OAAO,GAAG,IAAI;AAChB;;AAGA,IAAa,iBAAiB,UAAoC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,UAAU,iBAAiB,KAAK;CACtC,OAAO,QAAQ,MAAM,QAAQ,UAAU;AACzC"}

package/dist/names/generator.d.ts

@@ -0,0 +1,10 @@
+/** A uniform random number in [0, 1). Injected, so names are reproducible in tests. */
+export type Random = () => number;
+export declare const NAME_ADJECTIVES: readonly string[];
+export declare const NAME_NOUNS: readonly string[];
+/** Numbers 10–99, minus any the blocklist refuses. */
+export declare const NAME_NUMBERS: readonly number[];
+/** A uniformly random item of a non-empty list. */
+export declare const pick: <T>(items: readonly T[], random: Random) => T;
+/** A name like "Pixel Fox 42": adjective, noun, two-digit number. */
+export declare const generateName: (random: Random) => string;

package/dist/names/generator.js

@@ -0,0 +1,104 @@
+import { BLOCKED_NUMBERS } from "./blocklist.js";
+//#region src/names/generator.ts
+var NAME_ADJECTIVES = [
+	"Arcade",
+	"Atomic",
+	"Bonus",
+	"Bouncy",
+	"Brave",
+	"Chrome",
+	"Clever",
+	"Combo",
+	"Cosmic",
+	"Crystal",
+	"Dizzy",
+	"Golden",
+	"Hyper",
+	"Jolly",
+	"Laser",
+	"Lucky",
+	"Mega",
+	"Mighty",
+	"Neon",
+	"Nimble",
+	"Pixel",
+	"Plucky",
+	"Quantum",
+	"Rapid",
+	"Retro",
+	"Rocket",
+	"Royal",
+	"Silver",
+	"Snappy",
+	"Sparky",
+	"Speedy",
+	"Starry",
+	"Stellar",
+	"Sunny",
+	"Super",
+	"Swift",
+	"Turbo",
+	"Zippy"
+];
+var NAME_NOUNS = [
+	"Badger",
+	"Beetle",
+	"Bunny",
+	"Cactus",
+	"Captain",
+	"Champ",
+	"Comet",
+	"Corgi",
+	"Dolphin",
+	"Dragon",
+	"Falcon",
+	"Fox",
+	"Gecko",
+	"Griffin",
+	"Hamster",
+	"Hero",
+	"Kitten",
+	"Koala",
+	"Llama",
+	"Lynx",
+	"Mango",
+	"Meteor",
+	"Muffin",
+	"Narwhal",
+	"Noodle",
+	"Nova",
+	"Otter",
+	"Owl",
+	"Panda",
+	"Pebble",
+	"Penguin",
+	"Phoenix",
+	"Pickle",
+	"Pilot",
+	"Puffin",
+	"Quasar",
+	"Ranger",
+	"Robot",
+	"Sprite",
+	"Taco",
+	"Tiger",
+	"Unicorn",
+	"Waffle",
+	"Whale",
+	"Wizard",
+	"Yeti"
+];
+/** Numbers 10–99, minus any the blocklist refuses. */
+var NAME_NUMBERS = Array.from({ length: 90 }, (_, i) => i + 10).filter((n) => !BLOCKED_NUMBERS.includes(String(n)));
+/** A uniformly random item of a non-empty list. */
+var pick = (items, random) => {
+	const item = items[Math.min(items.length - 1, Math.floor(random() * items.length))];
+	if (item === void 0) throw new RangeError("Cannot pick from an empty list");
+	return item;
+};
+/** A name like "Pixel Fox 42": adjective, noun, two-digit number. */
+var generateName = (random) => `${pick(NAME_ADJECTIVES, random)} ${pick(NAME_NOUNS, random)} ${pick(NAME_NUMBERS, random)}`;
+//#endregion
+export { NAME_ADJECTIVES, NAME_NOUNS, NAME_NUMBERS, generateName, pick };
+
+//# sourceMappingURL=generator.js.map

package/dist/names/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","names":[],"sources":["../../src/names/generator.ts"],"sourcesContent":["// The default display name: arcade-flavored, friendly, and safe by construction. Every\n// combination passes checkDisplayName (a test proves it), so a generated name never needs\n// a second roll.\nimport { BLOCKED_NUMBERS } from './blocklist.ts';\n\n/** A uniform random number in [0, 1). Injected, so names are reproducible in tests. */\nexport type Random = () => number;\n\nexport const NAME_ADJECTIVES: readonly string[] = [\n  'Arcade',\n  'Atomic',\n  'Bonus',\n  'Bouncy',\n  'Brave',\n  'Chrome',\n  'Clever',\n  'Combo',\n  'Cosmic',\n  'Crystal',\n  'Dizzy',\n  'Golden',\n  'Hyper',\n  'Jolly',\n  'Laser',\n  'Lucky',\n  'Mega',\n  'Mighty',\n  'Neon',\n  'Nimble',\n  'Pixel',\n  'Plucky',\n  'Quantum',\n  'Rapid',\n  'Retro',\n  'Rocket',\n  'Royal',\n  'Silver',\n  'Snappy',\n  'Sparky',\n  'Speedy',\n  'Starry',\n  'Stellar',\n  'Sunny',\n  'Super',\n  'Swift',\n  'Turbo',\n  'Zippy',\n];\n\nexport const NAME_NOUNS: readonly string[] = [\n  'Badger',\n  'Beetle',\n  'Bunny',\n  'Cactus',\n  'Captain',\n  'Champ',\n  'Comet',\n  'Corgi',\n  'Dolphin',\n  'Dragon',\n  'Falcon',\n  'Fox',\n  'Gecko',\n  'Griffin',\n  'Hamster',\n  'Hero',\n  'Kitten',\n  'Koala',\n  'Llama',\n  'Lynx',\n  'Mango',\n  'Meteor',\n  'Muffin',\n  'Narwhal',\n  'Noodle',\n  'Nova',\n  'Otter',\n  'Owl',\n  'Panda',\n  'Pebble',\n  'Penguin',\n  'Phoenix',\n  'Pickle',\n  'Pilot',\n  'Puffin',\n  'Quasar',\n  'Ranger',\n  'Robot',\n  'Sprite',\n  'Taco',\n  'Tiger',\n  'Unicorn',\n  'Waffle',\n  'Whale',\n  'Wizard',\n  'Yeti',\n];\n\n/** Numbers 10–99, minus any the blocklist refuses. */\nexport const NAME_NUMBERS: readonly number[] = Array.from({ length: 90 }, (_, i) => i + 10).filter(\n  (n) => !BLOCKED_NUMBERS.includes(String(n)),\n);\n\n/** A uniformly random item of a non-empty list. */\nexport const pick = <T>(items: readonly T[], random: Random): T => {\n  const item = items[Math.min(items.length - 1, Math.floor(random() * items.length))];\n  if (item === undefined) throw new RangeError('Cannot pick from an empty list');\n  return item;\n};\n\n/** A name like \"Pixel Fox 42\": adjective, noun, two-digit number. */\nexport const generateName = (random: Random): string =>\n  `${pick(NAME_ADJECTIVES, random)} ${pick(NAME_NOUNS, random)} ${pick(NAME_NUMBERS, random)}`;\n"],"mappings":";;AAQA,IAAa,kBAAqC;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,IAAa,aAAgC;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,IAAa,eAAkC,MAAM,KAAK,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,QACzF,MAAM,CAAC,gBAAgB,SAAS,OAAO,CAAC,CAAC,CAC5C;;AAGA,IAAa,QAAW,OAAqB,WAAsB;CACjE,MAAM,OAAO,MAAM,KAAK,IAAI,MAAM,SAAS,GAAG,KAAK,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;CACjF,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,WAAW,gCAAgC;CAC7E,OAAO;AACT;;AAGA,IAAa,gBAAgB,WAC3B,GAAG,KAAK,iBAAiB,MAAM,EAAE,GAAG,KAAK,YAAY,MAAM,EAAE,GAAG,KAAK,cAAc,MAAM"}

package/dist/names/index.d.ts

@@ -0,0 +1,3 @@
+export { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS } from './blocklist.js';
+export { checkDisplayName, isBlocked, isDisplayName, NAME_LIMITS, normalizeDisplayName, type NameRejection, type NameRejectionCode, } from './filter.js';
+export { generateName, NAME_ADJECTIVES, NAME_NOUNS, NAME_NUMBERS, pick, type Random } from './generator.js';

package/dist/names/index.js

@@ -0,0 +1,4 @@
+import { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS } from "./blocklist.js";
+import { NAME_ADJECTIVES, NAME_NOUNS, NAME_NUMBERS, generateName, pick } from "./generator.js";
+import { NAME_LIMITS, checkDisplayName, isBlocked, isDisplayName, normalizeDisplayName } from "./filter.js";
+export { BLOCKED_ANYWHERE, BLOCKED_NUMBERS, BLOCKED_WORDS, NAME_ADJECTIVES, NAME_LIMITS, NAME_NOUNS, NAME_NUMBERS, checkDisplayName, generateName, isBlocked, isDisplayName, normalizeDisplayName, pick };

package/package.json

@@ -1,20 +1,59 @@
 {
   "name": "@joystyk/identity",
-  "version": "0.0.0",
-  "description": "Reserved for the first Joystyk library release.",
+  "version": "0.2.0",
+  "description": "Guest player identity: a stable on-device player id, a filtered display name and a preset avatar.",
+  "private": false,
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser/index.d.ts",
+      "default": "./dist/browser/index.js"
+    },
+    "./names": {
+      "types": "./dist/names/index.d.ts",
+      "default": "./dist/names/index.js"
+    }
+  },
+  "dependencies": {
+    "zod": "4.6.5",
+    "@joystyk/contracts": "0.2.0",
+    "@joystyk/storage": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "vite": "8.3.3",
+    "vitest": "4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=24.15.0"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/joystyk-games/game-libraries.git",
     "directory": "packages/identity"
   },
-  "homepage": "https://github.com/joystyk-games/game-libraries",
-  "files": [
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ],
-  "publishConfig": {
-    "access": "public"
+  "homepage": "https://github.com/joystyk-games/game-libraries/tree/main/packages/identity#readme",
+  "bugs": {
+    "url": "https://github.com/joystyk-games/game-libraries/issues"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.core.json",
+    "build": "node ../../scripts/build-package.ts"
   }
-}
+}