@memizy/protocol 1.0.0-rc.5 → 1.0.0-rc.6

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog of @memizy/protocol
+
+The protocol has its own changelog at the end of [SPEC.md](https://github.com/memizy/memizy/blob/main/packages/protocol/SPEC.md#changelog) (protocol 1.0, 2026-10-14). This file lists the releases of the npm package.
+
+## 1.0.0-rc.6 (2026-10-14)
+
+The contract of protocol 1.0 is final: within MAJOR 1 it changes only additively (SPEC 9).
+
+* SPEC status 1.0; the "RC4" labels are gone.
+* The address `"settings"` (`SETTINGS_ADDRESS`, the plugin's settings screen in the lobby) is defined in SPEC 3.1 and on the `Address` type.
+* `hello` is called once per instance: a second call rejects with `INVALID_ARGUMENT`. Only the first `end(result)` counts; later calls (also from a recreated authority) resolve and are ignored.
+* Guaranteed rates and sizes in SPEC 8.1 and `LIMITS`: `recordAnswer` 10 per second, burst 20 (`answersPerSecond`, `answerBurst`; the authority: per player), `getAsset` 10 per second, burst 20, and 2 MB per asset (`assetsPerSecond`, `assetBurst`, `assetBytes`), `reportError` 5 per second, burst 10, more dropped without an error (`errorReportsPerSecond`, `errorReportBurst`), and `serviceResultBytes` (256 KB, the service result limit that was already in the SPEC).
+* `RELAY_LIMITS.frameBytes` (in `@memizy/protocol/internal`) is 3 MB, so that a 2 MB asset fits a relay frame as base64.
+* Since 1.0.0-rc.5 (details in the SPEC changelog "1.0"): the term *host* (3.1) and `sessionEnded` before a player's instance is removed (`kicked`, `closed`, `host-left`); `exit`, `resize`, `setChanged` and `saveProgress` removed and reserved (SPEC 10); `InitPayload.services` and all `SessionClock` fields always present; the relay type `RoomPlayer`; state patches carry their format (`f`); reserved names `$…`, `data-mz-…`, `mz-…`; the `@memizy/protocol/internal` entry point (not public API); Zod 4 for the 1.x line; the error code `UNKNOWN_METHOD`; the sandbox allows popups that escape it (links in a new tab); `appSpecific.memizy.set`; OQSE 1.0 sets and OQSEM 1.0 manifests.
+
+## 1.0.0-rc.5
+
+Protocol RC4 as a package: handshake, views and authority, messages, learning progress, plugin data, services, pauses, permissions with a content policy, display order and public items, limits and errors.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 memizy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,16 +2,15 @@
 
 Types, Zod schemas and helpers of the **Memizy Plugin Protocol v1** – the contract between Memizy plugins (`@memizy/plugin-sdk`) and hosts (`@memizy/host-sdk`).
 
-* Specification: [SPEC.md](./SPEC.md) (Release Candidate 4)
-* Plugin authors do not use this package directly – see the [AI plugin guide](../../docs/ai-plugin-guide.md).
+* Specification: [SPEC.md](./SPEC.md) (1.0); changes of the package: [CHANGELOG.md](./CHANGELOG.md)
+* Plugin authors do not use this package directly – see the [AI plugin guide](https://github.com/memizy/memizy/blob/main/docs/ai-plugin-guide.md).
 
 ```ts
 import {
   readPluginManifestFromHtml, // validate a plugin's manifest data island without running it
   resolveSettings,            // apply defaults / validate setting values
   negotiateProtocolVersion,   // handshake version negotiation
-  parseHostCall,              // validate plugin → host calls
-  assertJsonWithin, LIMITS,   // size limits
+  LIMITS,                     // size and rate limits (SPEC 8.1)
   ProtocolError, toProtocolError,
   type HostApi, type PluginApi, type InitPayload,
 } from '@memizy/protocol';
@@ -19,3 +18,6 @@ import {
 const result = readPluginManifestFromHtml(html);
 if (result.success) console.log(result.runtime.views); // e.g. ['solo', 'board', 'controller']
 ```
+
+* **Public API** = what `@memizy/protocol` exports (semver within 1.x, SPEC 9). Helpers shared by the Memizy packages – call parsing (`parseHostCall`), size checks (`assertJsonWithin`), rate limiting, content policies of the iframe, relay limits – are in **`@memizy/protocol/internal`** and may change in any release.
+* The exported `*Schema` objects are **Zod 4** schemas; the 1.x line stays on Zod 4.

package/SPEC.md

@@ -1,8 +1,6 @@
 # Memizy Plugin Protocol v1
 
-> Status: **Release Candidate 4** (2026-10-07) · Final `1.0` after the acceptance test with AI-generated plugins (planned 2026-10-19/20).
->
-> RC rules: the design does not change unless the implementation or the acceptance test proves that something does not work. Every change until `1.0` is recorded in the changelog at the end.
+> Status: **1.0** (2026-10-14; protocol version `1.0`, packages `1.0.0`). The contract is frozen: within MAJOR `1` it changes only additively (section 9). Every change is recorded in the changelog at the end.
 
 This document defines the contract between a **Memizy plugin** (an HTML page running in a sandboxed iframe) and a **Memizy host** (the Memizy app, the Plugin Lab, or any other application embedding plugins through `@memizy/host-sdk`).
 
@@ -15,9 +13,9 @@ It covers:
 5. **message routing** for multiplayer,
 6. **limits, errors, security and compatibility rules**.
 
-It does **not** cover the high-level game API (`defineGame`) – that lives in `@memizy/plugin-sdk`, which every plugin bundles (see [the AI plugin guide](../../docs/ai-plugin-guide.md)). It also does not cover the host ↔ multiplayer-server wire protocol, which is internal to `@memizy/host-sdk`.
+It does **not** cover the high-level game API (`defineGame`) – that lives in `@memizy/plugin-sdk`, which every plugin bundles (see [the AI plugin guide](https://github.com/memizy/memizy/blob/main/docs/ai-plugin-guide.md)). It also does not cover the host ↔ multiplayer-server wire protocol, which is internal to `@memizy/host-sdk`.
 
-Data formats (sets, items, progress) are defined by [OQSE](../oqse/oqse.md).
+Data formats (sets, items, progress) are defined by [OQSE](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse.md).
 
 ---
 
@@ -32,7 +30,7 @@ Data formats (sets, items, progress) are defined by [OQSE](../oqse/oqse.md).
 
 ## 2. Plugin Manifest
 
-The manifest is an [OQSEM](../oqse/oqse-manifest.md) document embedded in the plugin HTML as a data island. The host reads it **without executing the plugin** (registry, upload in the Lab).
+The manifest is an [OQSEM](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse-manifest.md) document embedded in the plugin HTML as a data island. The host reads it **without executing the plugin** (registry, upload in the Lab).
 
 ```html
 <script type="application/oqse-manifest+json">
@@ -66,7 +64,7 @@ The manifest is an [OQSEM](../oqse/oqse-manifest.md) document embedded in the pl
 </script>
 ```
 
-The OQSEM part describes **content** (item types, assets, features) and is used for the [OQSE handshake](../oqse/oqse-manifest.md#the-handshake-matching-process) (`checkCompatibility`). The Memizy part (`appSpecific.memizy`) describes the **runtime**:
+The OQSEM part describes **content** (item types, assets, features) and is used for the [OQSE handshake](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse-manifest.md#the-handshake-matching-process) (`checkCompatibility`). The Memizy part (`appSpecific.memizy`) describes the **runtime**:
 
 | Key | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
@@ -80,9 +78,9 @@ The OQSEM part describes **content** (item types, assets, features) and is used
 | `settings` | SettingDefinition[] | No | Settings of the game (see below). Default `[]`. They define types, defaults and limits; the host validates every value against them. Used in both modes (section 3.3). |
 | `settingsScreen` | `{ size }` | No | Multiplayer lobby only. Present = the plugin renders its own settings screen (view `settings`) on the host's device; absent = the host generates a form from `settings`. `size: "compact"` – a panel next to the player list (the user may expand it to full screen); `size: "large"` – opened as a full-screen dialog from a "Game settings" button. |
 | `display.orientation` | `"any"` \| `"portrait"` \| `"landscape"` | No | Preferred orientation of player screens. Default `"any"`. |
-| `permissions.network` | string[] | No | RC4. Origins the plugin talks to with `fetch` / WebSocket, as `"https://host[:port]"` or `"wss://host[:port]"` (no path; max 20). Shown to users and enforced (section 8.4). |
-| `permissions.devices` | (`"camera"` \| `"microphone"` \| `"geolocation"` \| `"serial"` \| `"bluetooth"`)[] | No | RC4. Devices the plugin uses; the host grants only these (section 8.4). |
-| `services` | string[] | No | RC4. Memizy services the plugin calls (section 5.3), e.g. `"chess.puzzles"`: lowercase segments joined by dots. A host that does not offer one can still run the plugin; the call then fails with `SERVICE_UNAVAILABLE`. |
+| `permissions.network` | string[] | No | Origins the plugin talks to with `fetch` / WebSocket, as `"https://host[:port]"` or `"wss://host[:port]"` (no path; max 20). Shown to users and enforced (section 8.4). |
+| `permissions.devices` | (`"camera"` \| `"microphone"` \| `"geolocation"` \| `"serial"` \| `"bluetooth"`)[] | No | Devices the plugin uses; the host grants only these (section 8.4). |
+| `services` | string[] | No | Memizy services the plugin calls (section 5.3), e.g. `"chess.puzzles"`: lowercase segments joined by dots. A host that does not offer one can still run the plugin; the call then fails with `SERVICE_UNAVAILABLE`. |
 
 **SettingDefinition:** `{ id, type, label, default, description?, modes?, ...typeSpecific }`
 
@@ -107,18 +105,19 @@ Reserved for later minor versions: `teams`, editing permissions.
 
 | Term | Meaning |
 | :--- | :--- |
+| **Host** | The application that embeds the plugin on a device and connects it to the session (the Memizy app, the Plugin Lab, on a player's device the player's app). A plugin only ever talks to its host; how a host connects the devices of a session is the host's business. |
 | **Session** | One run of a game, from start to end (e.g., one quiz in a lesson). |
 | **Mode** | `solo` (one person plays alone) or `multiplayer` (several devices together). |
 | **Host role** (`hostAs`) | In multiplayer, the role of the person who created the session: `presenter` (shows a shared board, e.g. a teacher at a projector, and does not play) or `player` (plays like everyone else, no board). A plugin may support both; the host chooses in the lobby. |
 | **Instance** | One running plugin iframe on one device. 30 phones + 1 projector = 31 instances. |
 | **View** | What one instance shows: `solo`, `board` (the presenter's shared screen), `controller` (one player's own screen – a phone, tablet or computer) or `settings` (the plugin's settings screen on the host's device in the multiplayer lobby). Views are derived from the manifest (section 3.2), not declared separately. |
 | **Player** | A person who plays and can score. The presenter is not a player. |
-| **Address** | The "envelope address" of an instance, used to route messages (section 6): the player ID for a player's instance (stable across reconnects), `"board"` for the presenter's board. The address `"server"` is **reserved** for a future server-side authority. Plugin authors never see addresses; the SDK exposes only player IDs. |
+| **Address** | The "envelope address" of an instance, used to route messages (section 6): the player ID for a player's instance (stable across reconnects), `"board"` for the presenter's board, `"settings"` (`SETTINGS_ADDRESS`) for the plugin's settings screen in the lobby. The address `"server"` is **reserved** for a future server-side authority. Plugin authors never see addresses; the SDK exposes only player IDs. |
 | **Authority** | The one place that owns the game state and applies actions: the board (`presenter`), the host's controller (host as `player`) or the only instance (`solo`). Other instances send actions to it and receive the new state. In a future version the authority may be the server (address `"server"`); this is why game logic must be deterministic. |
 | **State** | The whole state of the game: one JSON value owned by the authority; its content is defined by the plugin. |
 | **Action** | An intent of a player or a timer (e.g., "answered B"). Only actions change the state. |
 | **Snapshot** | A saved copy of the authority's state (including pending timers), used to resume the game when the authority instance is recreated (reload, crash). Late joiners and reconnecting players do not use it; they synchronize with the running authority. |
-| **Learning progress** | Per-item learning records of a player in [OQSEP](../oqse/oqse-progress.md) (buckets, review dates). Understood and scheduled by the host. |
+| **Learning progress** | Per-item learning records of a player in [OQSEP](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse-progress.md) (buckets, review dates). Understood and scheduled by the host. |
 | **Plugin data** | Game progress of a player that only the plugin understands (unlocked levels, coins, best scores). Stored by the host, opaque to it (section 5.2). |
 
 | Situation | Instances (views) | Authority |
@@ -144,7 +143,7 @@ A plugin does not declare views. They follow from what it declares, so the two c
 
 **Multiplayer:**
 
-1. **Lobby** (host UI). The host chooses the plugin and the set; players join and may rename themselves. The settings are edited by the host: either in a form generated from `settings`, or – if the manifest declares `settingsScreen` – in the plugin itself running in view `settings` on the host's device (the plugin calls `updateSettings` and receives `playersChanged`). Start is enabled only while the settings are valid.
+1. **Lobby** (host UI). The host chooses the plugin and the set; players join. Player names are display names chosen by the host app – Memizy Play gives every player a random nickname and does not ask for real names (privacy of students); a host may let players change it. Names may change during the game (`playersChanged`). Plugins MUST NOT ask players for their real names or other personal data; a game that needs a name uses `Player.name`. The settings are edited by the host: either in a form generated from `settings`, or – if the manifest declares `settingsScreen` – in the plugin itself running in view `settings` on the host's device (the plugin calls `updateSettings` and receives `playersChanged`). Start is enabled only while the settings are valid.
 2. **Loading.** After Start, the host creates the game instances (board and/or controllers). Each instance connects, receives its `InitPayload` (without game state) and calls `ready()`.
 3. **Countdown.** When all connected instances are ready (or after a host-defined timeout, e.g. 15 s), the host shows a countdown and then calls `start()` on the authority. The authority creates the initial state and the game runs. The barrier exists so that timed games do not start before slower devices have loaded.
 4. **Running.** Late joiners (if `lateJoin`) and reconnecting players get a new instance, which synchronizes with the authority. A recreated authority receives the last `snapshot` and continues without `start()`. While the authority is unreachable, see section 6.1.
@@ -152,6 +151,8 @@ A plugin does not declare views. They follow from what it declares, so the two c
 
 **Solo:** one instance in view `solo`. There is **no plugin settings screen and no countdown**. Before creating the instance, the host MAY show a form generated from the settings that apply to solo (`modes`); otherwise it uses the defaults or values it presets (e.g. a course step "practise this set with 10 questions"). It calls `start()` right after `ready()`. Choices that belong to the game itself (a level, a character) are made inside the game, typically as its first phase.
 
+**Continuing a saved game** (a host feature; nothing changes for plugins). A host may save a game that has not ended – the authority's last snapshot, the settings, the display-order seed (4.4) and the players – and continue it later, in multiplayer also in a new room with other devices. The continued session keeps the same session ID and the same player IDs, so the game state stays valid: the authority is recreated from the snapshot (`InitPayload.snapshot`, no `start()`), the session starts paused (`SessionClock`, so the time between the lessons does not count), and each device takes the place of one earlier player (the host decides how; Memizy Play lets the player pick the earlier nickname and the teacher change it). A place without a device is a disconnected player (6). A game that ended with `end(result)` cannot be continued (its snapshot is discarded, 5).
+
 ---
 
 ## 4. Handshake
@@ -203,18 +204,18 @@ interface InitPayload {
   settings: Record<string, unknown>;    // current values for every declared setting (defaults applied)
   config: { locale: string; theme: 'light' | 'dark' };
   clock: SessionClock;                  // session clock and pauses (below)
-  services?: string[];                  // RC4: services declared by the plugin AND offered by this host
+  services: string[];                   // services declared by the plugin AND offered by this host
   progress: Record<string, ProgressRecord>;  // learning progress of `self` (empty for board/settings)
   data: { plugin: unknown; set: unknown };   // plugin data of `self` (null when nothing saved; null for board/settings)
   snapshot: unknown | null;             // last saved snapshot, only for the authority (resume)
 }
 
-type Address = string;                  // player ID, "board"; "server" is reserved
+type Address = string;                  // player ID, "board", "settings"; "server" is reserved
 
 interface SessionClock {
   offsetMs: number;                     // Date.now() + offsetMs = session time
-  pausedMs?: number;                    // RC4: total of finished pauses
-  pausedAt?: number | null;             // RC4: session time when the current pause began (null = running)
+  pausedMs: number;                     // total of finished pauses
+  pausedAt: number | null;              // session time when the current pause began (null = running)
 }
 // Game time = (pausedAt ?? session time) - pausedMs. The SDK uses game time for ctx.now,
 // timers and countdowns, so a pause stops them everywhere and nothing jumps afterwards.
@@ -234,15 +235,15 @@ interface Player {
 * A host supports a set of protocol versions, one per MAJOR version (e.g. `1.4` and `2.1`). The plugin's MAJOR version must be one of them. Otherwise the host rejects with `ProtocolError { code: 'UNSUPPORTED_PROTOCOL' }` and shows the user a clear message ("this plugin needs a newer Memizy" or "this plugin is too old").
 * The negotiated version has the plugin's MAJOR and the lower of both MINOR versions. Neither side uses a method, field or feature introduced in a higher minor than the negotiated one.
 * A plugin that uses a field, value, method or setting type introduced in protocol 1.*x* declares `protocol: "1.x"` in its manifest (the minimum version it needs). A host that supports only an older minor version then rejects it before loading, instead of misreading what it does not know.
-* `manifest.appSpecific.memizy.protocol` is checked **before** loading the iframe (the host does not offer plugins it cannot run). The manifest itself (`version`, the OQSEM format) follows the [OQSE version rules](../oqse/oqse.md#versioning-and-compatibility): the host reads the OQSEM MAJOR versions it supports.
+* `manifest.appSpecific.memizy.protocol` is checked **before** loading the iframe (the host does not offer plugins it cannot run). The manifest itself (`version`, the OQSEM format) follows the [OQSE version rules](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse.md#versioning-and-compatibility): the host reads the OQSEM MAJOR versions it supports.
 * A host SHOULD keep supporting older MAJOR versions as long as practical (e.g. an adapter in `@memizy/host-sdk`), so older plugins keep working.
 
 ### 4.4 Display order and hidden answers
 
 The host prepares the set once per session (`prepareDisplaySet` in `@memizy/protocol`; a future server authority does the same):
 
-1. **Display order.** With a seed (normally the session id), the host shuffles `options` (mcq, unless `shuffle: false`), the options of `fill-in-select` blanks (unless `shuffle: false`), `items` of `sort-items` (never left in the correct order), `prompts` and `matches` of `match-pairs`, the sides of `match-complex`, `events` of `timeline` (unless `shuffle: false`; never left in chronological order), the entries of `categorize` and the `labels` of `diagram-label` (unless `requireTyping`). OQSE answers refer to choice IDs, so shuffling never changes an answer. Every instance sees the same order.
-2. **Public items.** In multiplayer, every instance except the authority gets the items without the fields that give the answer away and with `answerHidden: true`: `explanation`, `incorrectFeedback`, the `explanation` of every choice, `correctId`, `correctIds`, `correctAnswer(s)`, `alternativeAnswers`, `correctOrder`, `pairs`, `connections`, `correctCells`, `correctCategoryId`, zone `correctLabelId` (and the labels when `requireTyping`), the accepted texts of `fill-in-blanks`, the `correctId` of select blanks, event `date`s, `hotspots` of pin items, `back` of a flashcard, `hiddenContent` of a note, `sampleAnswer`, `rubric` and the `quote` of every source (`sources[].quote`, which often states the answer). Custom `x-` types lose `solution` (OQSE puts everything that gives their answer away there), `explanation` and `incorrectFeedback`, and also get `answerHidden: true`. `hints` stay public: a game may show them on any device while the player answers. In relay multiplayer the bundle on the server holds only public items.
+1. **Display order.** With a seed (normally the session id), the host shuffles `options` (mcq, unless `shuffle: false`), the options of `fill-in-select` blanks (unless `shuffle: false`), `items` of `sort-items` (never left in the correct order), `prompts` and `matches` of `match-pairs` and `match-complex`, `events` of `timeline` (unless `shuffle: false`; never left in chronological order), the entries of `categorize` and the `labels` of `diagram-label` (unless `requireTyping`). OQSE answers refer to choice IDs, so shuffling never changes an answer. Every instance sees the same order.
+2. **Public items.** In multiplayer, every instance except the authority gets the items without the fields that give the answer away and with `answerHidden: true`: `explanation`, `incorrectFeedback`, the `explanation` of every choice, `correctId`, `correctIds`, `correctAnswer(s)`, `correctOrder`, `pairs`, `connections`, `correctCells`, `correctCategoryId`, zone `correctLabelId` (and the labels when `requireTyping`), the accepted texts of `fill-in-blanks`, the `correctId` of select blanks, event `date`s, `hotspots` of pin items, `back` of a flashcard, `hiddenContent` of a note, `sampleAnswer`, `rubric` and the `quote` of every source (`sources[].quote`, which often states the answer). Custom `x-` types lose `solution` (OQSE puts everything that gives their answer away there), `explanation` and `incorrectFeedback`, and also get `answerHidden: true`. `hints` stay public: a game may show them on any device while the player answers. A host that sends the game to other devices sends only public items.
 3. **Revealing.** The authority sends full items to the other instances in its own messages (the plugin SDK's `ctx.reveal`); the host does not take part.
 
 Solo instances and the authority get the full items in display order.
@@ -255,20 +256,17 @@ All methods return Promises and reject with a `ProtocolError` (section 8.2). Met
 
 | Method | Description |
 | :--- | :--- |
-| `hello(handshake): InitPayload` | Handshake (section 4). Called exactly once. |
+| `hello(handshake): InitPayload` | Handshake (section 4). Called exactly once per instance; a second call rejects with `INVALID_ARGUMENT`. |
 | `ready(): void` | The plugin is rendered and interactive. |
 | `send(message: OutgoingMessage): void` | Sends a game message to other instances (section 6). |
-| `saveSnapshot(snapshot: unknown): void` | *authority.* Stores the latest resumable game state (overwrites the previous one). Returned as `InitPayload.snapshot` when the authority instance is recreated (reload, crash, reconnect). |
+| `saveSnapshot(snapshot: unknown): void` | *authority.* Stores the latest resumable game state (overwrites the previous one). Returned as `InitPayload.snapshot` when the authority instance is recreated (reload, crash, reconnect). After `end(result)` the host discards the snapshot: a finished game is not resumed. |
 | `recordAnswer(answer: AnswerRecord): void` | Records a learning result. The host applies its learning algorithm and stores the result in the learning progress of the given player (routing it to that player's device in multiplayer). |
-| `saveProgress(records: Record<string, ProgressRecord>): void` | *views `solo`, `controller`.* Overwrites learning progress records of `self` directly (plugins with their own rating, e.g. "traffic light" self-rating). |
 | `saveData(scope: 'plugin' \| 'set', value: unknown): void` | *views `solo`, `controller`.* Replaces the plugin data of `self` in the given scope (section 5.2). |
 | `updateSettings(update: { values: Record<string, unknown>; valid: boolean; message?: string }): void` | *view `settings`.* Replaces the settings values. The host validates them against the manifest schema; `valid: false` disables Start and shows `message`. |
 | `getAsset(key: string, itemId?: string): Blob` | Raw data of an asset (resolution: item assets, then set assets). |
-| `end(result: SessionResult): void` | *authority.* The game is over. The host shows/stores the result; instances stay open until the host closes them. |
-| `resize(request: { height: number \| 'auto' }): void` | Requests a different iframe height (embedded layouts). |
-| `reportError(error: { code: string; message: string; context?: object }): void` | Non-fatal error for logs and the Lab test report. |
-| `exit(): void` | The user wants to leave (e.g. a "Close" button inside the plugin). |
-| `service(name: string, payload: unknown): unknown` | RC4. Calls a Memizy service (section 5.3). Rejects with `SERVICE_UNAVAILABLE` unless the plugin declares it and `InitPayload.services` lists it. |
+| `end(result: SessionResult): void` | *authority.* The game is over. The host shows/stores the result; instances stay open until the host closes them. Only the first call counts: later calls (also from a recreated authority) resolve and are ignored. |
+| `reportError(error: { code: string; message: string; context?: object }): void` | Non-fatal error for logs and the Lab test report. Reports beyond the rate in section 8.1 are dropped without an error. |
+| `service(name: string, payload: unknown): unknown` | Calls a Memizy service (section 5.3). Rejects with `SERVICE_UNAVAILABLE` unless the plugin declares it and `InitPayload.services` lists it. |
 
 ```ts
 interface AnswerRecord {
@@ -279,8 +277,8 @@ interface AnswerRecord {
   timeSpentMs?: number;
   hintsUsed?: number;
   isSkipped?: boolean;
-  answer?: unknown;           // RC4: what the player answered (checkAnswer format, choice IDs; max 4 KB)
-  item?: { id: string; type: string; [key: string]: unknown };  // RC4: required for an item that is not in the set
+  answer?: unknown;           // what the player answered (checkAnswer format, choice IDs; max 4 KB)
+  item?: { id: string; type: string; [key: string]: unknown };  // required for an item that is not in the set
 }
 
 interface SessionResult {
@@ -291,14 +289,11 @@ interface SessionResult {
 
 ### 5.1 Learning progress
 
-Two ways to write it:
-
-* **`recordAnswer`** – the plugin reports what happened ("player X answered item Y correctly"). The host decides the new bucket and review date with its own algorithm. This is what most plugins use, in solo and in multiplayer.
-* **`saveProgress`** – the plugin writes records of its own player directly (e.g., self-rating sets bucket 3). Only for `self`, never for other players.
+Plugins write it with **`recordAnswer`**: the plugin reports what happened ("player X answered item Y correctly"); the host decides the new bucket and review date with its own algorithm. A self-rating (a flashcard) is an answer too (OQSE Answer Formats). Writing progress records directly is reserved (`saveProgress`, section 10).
 
-RC4 additions to `recordAnswer`:
+What `recordAnswer` carries besides the result:
 
-* `answer` – what the player answered, in the format of the item type defined in [OQSE Answer Formats](../oqse/oqse.md#answer-formats) (the format `checkAnswer` takes: choice IDs, text, numbers; a flashcard's self-rating 1–4). Teachers see which wrong answers were chosen; because answers use IDs, the statistics survive edits of the set.
+* `answer` – what the player answered, in the format of the item type defined in [OQSE Answer Formats](https://github.com/memizy/memizy/blob/main/packages/oqse/oqse.md#answer-formats) (the format `checkAnswer` takes: choice IDs, text, numbers; a flashcard's self-rating 1–4). Teachers see which wrong answers were chosen; because answers use IDs, the statistics survive edits of the set.
 * **Generated items** (from a service or a generator in the plugin) are not in the set. The plugin attaches the item (`item`, at least `id` and `type`; answer fields may be left out; max 32 KB). The host counts such answers in statistics (per `skills` and `tags`) but not in the repetition schedule, because the item never comes back.
 * Progress for teachers is aggregated per OQSE `skills` (and their parents, `chess.tactics` for `chess.tactics.fork`), which come from the content, never from the plugin. A game's own model of the player (rating, level, unlocked chapters) belongs to plugin data (section 5.2).
 
@@ -354,7 +349,7 @@ If the authority instance loses its connection or is being recreated (e.g., the
 
 * The host calls `authorityChanged({ connected: false })` on all other instances and shows them a "Waiting for the host…" overlay. Messages sent `to: 'authority'` meanwhile are rejected with `AUTHORITY_UNAVAILABLE` (the SDK does not queue them).
 * When the authority is back (resumed from its snapshot), the host calls `authorityChanged({ connected: true })`; the other instances re-synchronize with it.
-* If the authority does not come back within a host-defined time, the host ends the session (`sessionEnded('host_left')`). Handing the game over to another player is a future feature (section 10).
+* If the authority does not come back within a host-defined time, the host ends the session (`sessionEnded('host-left')`). Handing the game over to another player is a future feature (section 10).
 
 ---
 
@@ -366,10 +361,9 @@ If the authority instance loses its connection or is being recreated (e.g., the
 | `deliver(message: IncomingMessage): void` | A game message from another instance. |
 | `playersChanged(players: Player[]): void` | The roster changed (join, leave, rename, connection status). Always the full list. |
 | `authorityChanged(status: { connected: boolean }): void` | The authority became unreachable / reachable again (section 6.1). Not called on the authority itself. |
-| `setChanged(set: { meta, items }): void` | The set was edited in the host while the plugin runs (solo only). |
 | `configChanged(config: { locale, theme }): void` | Locale or theme changed. |
-| `clockChanged(clock: SessionClock): void` | Clock synchronization updated, or (RC4) the host paused / resumed the game. While `pausedAt` is set the SDK stops game time and timers, ignores actions and covers the game with a "paused" curtain. |
-| `sessionEnded(reason: 'finished' \| 'host_left' \| 'kicked' \| 'closed' \| 'error'): void` | The host is closing this instance. |
+| `clockChanged(clock: SessionClock): void` | Clock synchronization updated, or the host paused / resumed the game. While `pausedAt` is set the SDK stops game time and timers, ignores actions and covers the game with a "paused" curtain. |
+| `sessionEnded(reason: 'finished' \| 'host-left' \| 'kicked' \| 'closed' \| 'error'): void` | The host is closing this instance. |
 
 ---
 
@@ -382,13 +376,17 @@ The values are **guaranteed minimums**: a host MUST accept at least this much an
 | Limit | Guaranteed minimum | When exceeded |
 | :--- | :--- | :--- |
 | `send` message size (serialized JSON) | 64 KB | `MESSAGE_TOO_LARGE` |
-| `send` rate per instance | 30 messages/s (burst 60); the authority: 30 messages/s **per other instance** (RC4: it sends each device its own view) | `RATE_LIMITED` |
+| `send` rate per instance | 30 messages/s (burst 60); the authority: 30 messages/s **per other instance** (it sends each device its own view) | `RATE_LIMITED` |
 | `saveSnapshot` size | 1 MB | `SNAPSHOT_TOO_LARGE` |
 | `saveSnapshot` rate | 2 per second (the host keeps the latest) | coalesced, no error |
 | `saveData` size per scope | 256 KB | `DATA_TOO_LARGE` |
 | `saveData` rate | 1 per second per scope (the host keeps the latest) | coalesced, no error |
 | `hello` deadline | 10 s after iframe load | the host shows an error |
 | `recordAnswer` answer / generated item | 4 KB / 32 KB | `DATA_TOO_LARGE` |
+| `recordAnswer` rate per instance | 10 per second (burst 20); the authority: 10 per second **per player** (it records for everyone) | `RATE_LIMITED` |
+| `getAsset` size | 2 MB per asset | `DATA_TOO_LARGE` |
+| `getAsset` rate per instance | 10 per second (burst 20) | `RATE_LIMITED` |
+| `reportError` rate per instance | 5 per second (burst 10) | dropped, no error |
 | `service` request / result | 64 KB / 256 KB | `MESSAGE_TOO_LARGE` |
 | `service` rate per instance | 30 calls/min | `RATE_LIMITED` |
 
@@ -415,7 +413,8 @@ interface ProtocolError {
 | `ASSET_NOT_FOUND` | `getAsset` with an unknown key. |
 | `SESSION_ENDED` | A call after `sessionEnded`. |
 | `INTERNAL_ERROR` | A host-side failure; the plugin may retry. |
-| `SERVICE_UNAVAILABLE` | RC4. The service is not declared by the plugin or not offered by this host. |
+| `SERVICE_UNAVAILABLE` | The service is not declared by the plugin or not offered by this host. |
+| `UNKNOWN_METHOD` | The other side does not have the method (an older or newer version). Methods added in 1.x are guarded by a feature (9), so a plugin sees this only by mistake. |
 
 New codes may be added in minor versions; plugins MUST treat unknown codes like `INTERNAL_ERROR`.
 
@@ -425,12 +424,12 @@ New codes may be added in minor versions; plugins MUST treat unknown codes like
 
 ### 8.4 Security
 
-* The iframe is sandboxed with `allow-scripts allow-forms allow-modals allow-pointer-lock` – **never** `allow-same-origin`. As a consequence, browser storage (`localStorage`, IndexedDB) is not available to plugins; they use plugin data (section 5.2).
+* The iframe is sandboxed with `allow-scripts allow-forms allow-modals allow-pointer-lock allow-popups allow-popups-to-escape-sandbox` – **never** `allow-same-origin` and never `allow-top-navigation`. Popups are allowed so that links open in a new tab (the plugin SDK opens every external link there; inside the iframe a link would replace the game). As a consequence, browser storage (`localStorage`, IndexedDB) is not available to plugins; they use plugin data (section 5.2).
 * The host validates every incoming call against the schemas in `@memizy/protocol` and the limits above.
 * The host never passes credentials, user e-mail or other private data. `Player.name` is the display name chosen for the session.
 * Answers are known only to the authority (section 4.4). Everything else a plugin puts in the game state or in messages is visible to every instance: do not put secrets there.
-* **Network (RC4).** The host puts a Content Security Policy into the plugin document (`pluginContentPolicy` in `@memizy/protocol`): scripts only inline, from the library CDNs (`cdn.jsdelivr.net`, `unpkg.com`, `cdnjs.cloudflare.com`, `esm.sh`) and from the host; `fetch`, WebSocket and similar only to these and to the origins in `permissions.network`. Images and media may come from any `https:` URL (sets link them), so the policy blocks data channels but not every possible leak; hosts show the declared origins to users ("this game talks to lichess.org").
-* **Devices (RC4).** The iframe `allow` attribute grants only `permissions.devices`; the browser still asks the user.
+* **Network.** The host puts a Content Security Policy into the plugin document (`pluginContentPolicy` in `@memizy/protocol`): scripts only inline, from the library CDNs (`cdn.jsdelivr.net`, `unpkg.com`, `cdnjs.cloudflare.com`, `esm.sh`) and from the host; `fetch`, WebSocket and similar only to these and to the origins in `permissions.network`. Images and media may come from any `https:` URL (sets link them), so the policy blocks data channels but not every possible leak; hosts show the declared origins to users ("this game talks to lichess.org").
+* **Devices.** The iframe `allow` attribute grants only `permissions.devices`; the browser still asks the user.
 
 ---
 
@@ -446,7 +445,9 @@ From `1.0` on, the following MUST NOT change in a backward-incompatible way with
 
 Allowed in `1.x`: new optional fields, new methods guarded by a feature, new setting types, new enum values only where the receiver is required to ignore unknown values (`sessionEnded` reasons, error codes, `Player` fields).
 
-* The plugin SDK sends its own game messages inside `send` / `deliver` (actions, state and state patches, reveals). Their format is part of the SDK's contract: within SDK 1.x it only changes additively, because the devices of one game may run different 1.x versions (a cached copy). Receivers ignore message types and fields they do not know.
+* The plugin SDK sends its own game messages inside `send` / `deliver` (actions, state and state patches, reveals). Their format is part of the SDK's contract: within SDK 1.x it only changes additively, because the devices of one game may run different 1.x versions (a cached copy). Receivers ignore message types and fields they do not know. State patches carry the version of their format (`f`, today `1`: the patches of mutative 2); a receiver that does not know the format asks for the full state instead of applying them, so the patch format can change within 1.x.
+* **Reserved names** (so that a game never collides with a later SDK): action names and timer keys starting with `$` (the SDK rejects them in a game); HTML attributes starting with `data-mz-` (new SDK attributes use this prefix; the existing `data-act`, `data-local`, `data-payload`, `data-setting`, `data-keep`, `data-key` stay); CSS classes starting with `mz-`. Fields the SDK keeps in the game state exist only on request: today `phase`, `phaseSeq` and `phaseEndsAt`, only in games with `phases`. Any later field of the SDK will also be opt-in (a new option of the game definition), never added to the state of an existing game.
+* The public API of `@memizy/protocol` is what its entry point exports; `@memizy/protocol/internal` (helpers shared by the Memizy packages) is not covered by these rules. Exported Zod schemas are Zod 4 schemas: the 1.x packages stay on Zod 4.
 * Libraries inside the SDK and the host SDK (sanitizer, Markdown parser…) may be updated in any 1.x release, including security fixes; only the wire formats above are fixed.
 * Plugins load the SDK as `https://cdn.jsdelivr.net/npm/@memizy/plugin-sdk@1` (the self-contained bundle of the package): every 1.x release reaches them without a change of the plugin.
 
@@ -479,12 +480,17 @@ What was decided and why, and what is **reserved** (name and intent fixed, not i
 | Feature `teams` | Teams managed by the host (today every game handles teams itself). |
 | Hot-seat | Several players sharing one device; v1 assumes one player per instance. |
 | Host migration | Moving the authority to another device when its device is gone for good; v1 resumes the same authority from the snapshot. |
+| Host method `exit` | Leaving the game from inside it: a "back to the menu" button of a full-screen game; the host closes the game or returns to its menu. |
+| Host method `resize` | Auto height for games embedded in articles and course pages: the game reports the height of its content, the host sizes the frame (switched on in the manifest; the SDK measures it). |
+| Plugin method `setChanged` | Live set editing: the host updates the set of a running game, e.g. when the author edits it in the Lab. |
+| Host method `saveProgress` | Writing learning progress directly, e.g. a placement test ("these items are known"); the host may refuse or limit it. |
+| Feature `replay` | Recording a game and replaying it: the host keeps the session's inputs (the `InitPayload` with the seed and the display order, every action with its sender and game time, pauses) and replays the game by running the same plugin version on them. This works because the rules are deterministic (`ctx.random`, `ctx.now`, no `Math.random` / `Date.now` in actions); keep that rule. |
 
 ---
 
 ## Changelog
 
-* **1.0 (unreleased):** the transport (Penpal 8), the SDK message format and the protocol declaration of plugins using 1.x additions are fixed rules (4, 4.3, 9); plugins load the SDK from `…/plugin-sdk@1`. `appSpecific.memizy.set` (`required` / `optional` / `none`): games without questions; OQSEM `capabilities` and `actions` may be omitted. Public items (4.4) also lose `sources[].quote`; custom `x-` items lose `solution`, `explanation` and `incorrectFeedback` and get `answerHidden: true` (they were passed unchanged); `hints` stay public. `recordAnswer.answer` follows OQSE Answer Formats (a flashcard answer is a self-rating 1–4; `ui.question` offers four ratings). OQSE 1.0 sets and OQSEM 1.0 manifests (`"version": "1.0"`; other MAJOR versions are not read as 1.x). A host may support several protocol MAJOR versions at once (4.3); supporting older ones is a SHOULD instead of a MUST.
+* **1.0 (2026-10-14):** the term *host* (3.1): the application that embeds the plugin on a device, also on a player's device; the host ends a player's instance with `sessionEnded` (also `kicked`, `host-left`) before removing it. Removed before 1.0 and reserved (10): `exit`, `resize`, `setChanged`, `saveProgress` (a self-rating is an answer). `InitPayload.services` and the pause fields of `SessionClock` are always present; `sessionEnded` reason `host-left` (was `host_left`); `SETTINGS_ADDRESS` is defined here; the relay type of a room player is `RoomPlayer`. State patches carry their format (`f`); reserved names `$…`, `data-mz-…`, `mz-…` and opt-in state fields; `@memizy/protocol/internal`; Zod 4 (9). Renamed before 1.0: `ui.renderNote` → `ui.note` (SDK), the type `Theme` → `HostConfig`. Player names and personal data: plugins MUST NOT ask for real names or other personal data (3.3); `setChanged` is optional for hosts (7); `replay` reserved (10). The sandbox allows popups that escape it, links open in a new tab (8.4). Error code `UNKNOWN_METHOD` (8.2). Continuing a saved game is described (3.3; host feature, no protocol change). After `end(result)` the host discards the snapshot (5). The transport (Penpal 8), the SDK message format (actions carry the `phaseSeq` the player saw and the tap time `actedAt`; devices of one game may run different SDK 1.x versions) and the protocol declaration of plugins using 1.x additions are fixed rules (4, 4.3, 9); plugins load the SDK from `…/plugin-sdk@1`. `appSpecific.memizy.set` (`required` / `optional` / `none`): games without questions; OQSEM `capabilities` and `actions` may be omitted. Public items (4.4) also lose `sources[].quote`; custom `x-` items lose `solution`, `explanation` and `incorrectFeedback` and get `answerHidden: true` (they were passed unchanged); `hints` stay public. `recordAnswer.answer` follows OQSE Answer Formats (a flashcard answer is a self-rating 1–4; `ui.question` offers four ratings). OQSE 1.0 sets and OQSEM 1.0 manifests (`"version": "1.0"`; other MAJOR versions are not read as 1.x). A host may support several protocol MAJOR versions at once (4.3); supporting older ones is a SHOULD instead of a MUST. Final rules: a second `hello` of an instance rejects with `INVALID_ARGUMENT`, only the first `end(result)` counts (5); guaranteed rates of `recordAnswer` (per player for the authority), `getAsset` and `reportError` (dropped beyond it) and an asset size of 2 MB (8.1); the address `"settings"` (3.1).
 * **RC1 (2026-10-04):** first release candidate.
 * **RC2 (2026-10-06):** `SettingDefinition.modes`; the host may show solo settings before the start (section 3.3). Additive: RC1 plugins and hosts keep working.
 * **RC4 (2026-10-07):** OQSE 0.3 sets (choices with IDs; the RC3 `correctOrder` / `correctMatches` display fields are gone because answers refer to IDs); `recordAnswer.answer` and generated items (5.1); services (5.3, `service`, `InitPayload.services`, `SERVICE_UNAVAILABLE`); pauses (`SessionClock`); `permissions` with a Content Security Policy and device grants (8.4); decisions and reservations (section 10). Additive for the protocol except the OQSE version: plugins must read choices (`option.text`, `option.id`).

package/dist/errors.cjs

@@ -1 +1 @@
-var e=[`UNSUPPORTED_PROTOCOL`,`INVALID_ARGUMENT`,`NOT_AUTHORITY`,`NOT_ALLOWED_IN_VIEW`,`AUTHORITY_UNAVAILABLE`,`MESSAGE_TOO_LARGE`,`SNAPSHOT_TOO_LARGE`,`DATA_TOO_LARGE`,`RATE_LIMITED`,`ASSET_NOT_FOUND`,`SESSION_ENDED`,`INTERNAL_ERROR`,`SERVICE_UNAVAILABLE`],t=/^\[([A-Z_]+)\]\s?/,n=class extends Error{code;constructor(e,t){super(`[${e}] ${t}`),this.name=`ProtocolError`,this.code=e}get detail(){return this.message.replace(t,``)}};function r(t){return typeof t==`string`&&e.includes(t)}function i(e){if(e instanceof n)return e;let i=e instanceof Error?e.message:String(e),a=t.exec(i);return new n(a&&r(a[1])?a[1]:`INTERNAL_ERROR`,a?i.slice(a[0].length):i)}exports.PROTOCOL_ERROR_CODES=e,exports.ProtocolError=n,exports.isProtocolErrorCode=r,exports.toProtocolError=i;
+var e=[`UNSUPPORTED_PROTOCOL`,`INVALID_ARGUMENT`,`NOT_AUTHORITY`,`NOT_ALLOWED_IN_VIEW`,`AUTHORITY_UNAVAILABLE`,`MESSAGE_TOO_LARGE`,`SNAPSHOT_TOO_LARGE`,`DATA_TOO_LARGE`,`RATE_LIMITED`,`ASSET_NOT_FOUND`,`SESSION_ENDED`,`INTERNAL_ERROR`,`SERVICE_UNAVAILABLE`,`UNKNOWN_METHOD`],t=/^\[([A-Z_]+)\]\s?/,n=class extends Error{code;constructor(e,t){super(`[${e}] ${t}`),this.name=`ProtocolError`,this.code=e}get detail(){return this.message.replace(t,``)}};function r(t){return typeof t==`string`&&e.includes(t)}function i(e){if(e instanceof n)return e;let i=e instanceof Error?e.message:String(e);if(e?.code===`METHOD_NOT_FOUND`)return new n(`UNKNOWN_METHOD`,i);let a=t.exec(i);return new n(a&&r(a[1])?a[1]:`INTERNAL_ERROR`,a?i.slice(a[0].length):i)}exports.PROTOCOL_ERROR_CODES=e,exports.ProtocolError=n,exports.isProtocolErrorCode=r,exports.toProtocolError=i;

package/dist/errors.js

@@ -12,7 +12,8 @@ var e = [
 	"ASSET_NOT_FOUND",
 	"SESSION_ENDED",
 	"INTERNAL_ERROR",
-	"SERVICE_UNAVAILABLE"
+	"SERVICE_UNAVAILABLE",
+	"UNKNOWN_METHOD"
 ], t = /^\[([A-Z_]+)\]\s?/, n = class extends Error {
 	code;
 	constructor(e, t) {
@@ -27,7 +28,9 @@ function r(t) {
 }
 function i(e) {
 	if (e instanceof n) return e;
-	let i = e instanceof Error ? e.message : String(e), a = t.exec(i);
+	let i = e instanceof Error ? e.message : String(e);
+	if (e?.code === "METHOD_NOT_FOUND") return new n("UNKNOWN_METHOD", i);
+	let a = t.exec(i);
 	return new n(a && r(a[1]) ? a[1] : "INTERNAL_ERROR", a ? i.slice(a[0].length) : i);
 }
 //#endregion

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./version.cjs"),t=require("./errors.cjs"),n=require("./limits.cjs"),r=require("./settingsSchema.cjs"),i=require("./settings.cjs"),a=require("./pluginRuntime.cjs"),o=require("./manifestSchema.cjs"),s=require("./types.cjs"),c=require("./schemas.cjs"),l=require("./relay.cjs"),u=require("./items.cjs"),d=require("./security.cjs"),f=require("./polyfills.cjs");exports.AddressSchema=c.AddressSchema,exports.AnswerRecordSchema=c.AnswerRecordSchema,exports.BOARD_ADDRESS=s.BOARD_ADDRESS,exports.DataScopeSchema=c.DataScopeSchema,exports.ErrorReportSchema=c.ErrorReportSchema,exports.HOST_API_ARGS=c.HOST_API_ARGS,exports.HOST_API_METHODS=s.HOST_API_METHODS,exports.HandshakeSchema=c.HandshakeSchema,exports.HostAsSchema=o.HostAsSchema,exports.LIBRARY_ORIGINS=d.LIBRARY_ORIGINS,exports.LIMITS=n.LIMITS,exports.LocalizedTextSchema=r.LocalizedTextSchema,exports.MemizyRuntimeSchema=o.MemizyRuntimeSchema,exports.MultiplayerModeSchema=o.MultiplayerModeSchema,exports.OutgoingMessageSchema=c.OutgoingMessageSchema,exports.PLUGIN_API_METHODS=s.PLUGIN_API_METHODS,exports.PLUGIN_DEVICES=d.PLUGIN_DEVICES,exports.PROTOCOL_ERROR_CODES=t.PROTOCOL_ERROR_CODES,exports.PROTOCOL_VERSION=e.PROTOCOL_VERSION,exports.PluginManifestError=o.PluginManifestError,exports.PluginPermissionsSchema=o.PluginPermissionsSchema,exports.ProgressRecordsSchema=c.ProgressRecordsSchema,exports.ProtocolError=t.ProtocolError,exports.RELAY_LIMITS=l.RELAY_LIMITS,exports.RELAY_PROTOCOL=l.RELAY_PROTOCOL,exports.RateLimiter=n.RateLimiter,exports.ResizeRequestSchema=c.ResizeRequestSchema,exports.SERVER_ADDRESS=s.SERVER_ADDRESS,exports.ServiceNameSchema=o.ServiceNameSchema,exports.SessionResultSchema=c.SessionResultSchema,exports.SettingDefinitionSchema=r.SettingDefinitionSchema,exports.SettingsUpdateSchema=c.SettingsUpdateSchema,exports.assertJsonWithin=n.assertJsonWithin,exports.compareProtocolVersions=e.compareProtocolVersions,exports.displayItem=u.displayItem,exports.ensureConnectionPolyfills=f.ensureConnectionPolyfills,exports.extractManifestFromHtml=a.extractManifestFromHtml,exports.findNonJson=n.findNonJson,exports.injectContentPolicy=d.injectContentPolicy,exports.isPin=l.isPin,exports.isProtocolErrorCode=t.isProtocolErrorCode,exports.isProtocolSupported=e.isProtocolSupported,exports.jsonByteSize=n.jsonByteSize,exports.localize=i.localize,exports.negotiateProtocolVersion=e.negotiateProtocolVersion,exports.normalizePlayerName=l.normalizePlayerName,exports.parseHostCall=c.parseHostCall,exports.parsePluginManifest=o.parsePluginManifest,exports.parseProtocolVersion=e.parseProtocolVersion,exports.pluginAllowAttribute=d.pluginAllowAttribute,exports.pluginContentPolicy=d.pluginContentPolicy,exports.prepareDisplaySet=u.prepareDisplaySet,exports.publicItem=u.publicItem,exports.readPluginManifestFromHtml=o.readPluginManifestFromHtml,exports.resolveSettings=i.resolveSettings,exports.safeParsePluginManifest=o.safeParsePluginManifest,exports.seededRandom=u.seededRandom,exports.settingsForMode=i.settingsForMode,exports.toProtocolError=t.toProtocolError,exports.toRuntime=a.toRuntime,exports.validateSettingValue=i.validateSettingValue;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./version.cjs"),t=require("./errors.cjs"),n=require("./limits.cjs"),r=require("./settingsSchema.cjs"),i=require("./settings.cjs"),a=require("./pluginRuntime.cjs"),o=require("./manifestSchema.cjs"),s=require("./types.cjs"),c=require("./schemas.cjs"),l=require("./relay.cjs"),u=require("./items.cjs"),d=require("./security.cjs");exports.AddressSchema=c.AddressSchema,exports.AnswerRecordSchema=c.AnswerRecordSchema,exports.BOARD_ADDRESS=s.BOARD_ADDRESS,exports.DataScopeSchema=c.DataScopeSchema,exports.ErrorReportSchema=c.ErrorReportSchema,exports.HOST_API_METHODS=s.HOST_API_METHODS,exports.HandshakeSchema=c.HandshakeSchema,exports.HostAsSchema=o.HostAsSchema,exports.LIMITS=n.LIMITS,exports.LocalizedTextSchema=r.LocalizedTextSchema,exports.MemizyRuntimeSchema=o.MemizyRuntimeSchema,exports.MultiplayerModeSchema=o.MultiplayerModeSchema,exports.OutgoingMessageSchema=c.OutgoingMessageSchema,exports.PLUGIN_API_METHODS=s.PLUGIN_API_METHODS,exports.PLUGIN_DEVICES=d.PLUGIN_DEVICES,exports.PROTOCOL_ERROR_CODES=t.PROTOCOL_ERROR_CODES,exports.PROTOCOL_VERSION=e.PROTOCOL_VERSION,exports.PluginManifestError=o.PluginManifestError,exports.PluginPermissionsSchema=o.PluginPermissionsSchema,exports.ProtocolError=t.ProtocolError,exports.RELAY_PROTOCOL=l.RELAY_PROTOCOL,exports.SERVER_ADDRESS=s.SERVER_ADDRESS,exports.SETTINGS_ADDRESS=s.SETTINGS_ADDRESS,exports.ServiceNameSchema=o.ServiceNameSchema,exports.SessionResultSchema=c.SessionResultSchema,exports.SettingDefinitionSchema=r.SettingDefinitionSchema,exports.SettingsUpdateSchema=c.SettingsUpdateSchema,exports.compareProtocolVersions=e.compareProtocolVersions,exports.extractManifestFromHtml=a.extractManifestFromHtml,exports.isProtocolErrorCode=t.isProtocolErrorCode,exports.isProtocolSupported=e.isProtocolSupported,exports.localize=i.localize,exports.negotiateProtocolVersion=e.negotiateProtocolVersion,exports.parsePluginManifest=o.parsePluginManifest,exports.parseProtocolVersion=e.parseProtocolVersion,exports.prepareDisplaySet=u.prepareDisplaySet,exports.readPluginManifestFromHtml=o.readPluginManifestFromHtml,exports.resolveSettings=i.resolveSettings,exports.safeParsePluginManifest=o.safeParsePluginManifest,exports.settingsForMode=i.settingsForMode,exports.toProtocolError=t.toProtocolError,exports.validateSettingValue=i.validateSettingValue;

package/dist/index.js

@@ -1,14 +1,13 @@
 import { PROTOCOL_VERSION as e, compareProtocolVersions as t, isProtocolSupported as n, negotiateProtocolVersion as r, parseProtocolVersion as i } from "./version.js";
 import { PROTOCOL_ERROR_CODES as a, ProtocolError as o, isProtocolErrorCode as s, toProtocolError as c } from "./errors.js";
-import { LIMITS as l, RateLimiter as u, assertJsonWithin as d, findNonJson as f, jsonByteSize as p } from "./limits.js";
-import { LocalizedTextSchema as m, SettingDefinitionSchema as h } from "./settingsSchema.js";
-import { localize as g, resolveSettings as _, settingsForMode as v, validateSettingValue as y } from "./settings.js";
-import { extractManifestFromHtml as b, toRuntime as x } from "./pluginRuntime.js";
-import { HostAsSchema as S, MemizyRuntimeSchema as C, MultiplayerModeSchema as w, PluginManifestError as T, PluginPermissionsSchema as E, ServiceNameSchema as D, parsePluginManifest as O, readPluginManifestFromHtml as k, safeParsePluginManifest as A } from "./manifestSchema.js";
-import { BOARD_ADDRESS as j, HOST_API_METHODS as M, PLUGIN_API_METHODS as N, SERVER_ADDRESS as P } from "./types.js";
-import { AddressSchema as F, AnswerRecordSchema as I, DataScopeSchema as L, ErrorReportSchema as R, HOST_API_ARGS as z, HandshakeSchema as B, OutgoingMessageSchema as V, ProgressRecordsSchema as H, ResizeRequestSchema as U, SessionResultSchema as W, SettingsUpdateSchema as G, parseHostCall as K } from "./schemas.js";
-import { RELAY_LIMITS as q, RELAY_PROTOCOL as J, isPin as Y, normalizePlayerName as X } from "./relay.js";
-import { displayItem as Z, prepareDisplaySet as Q, publicItem as $, seededRandom as ee } from "./items.js";
-import { LIBRARY_ORIGINS as te, PLUGIN_DEVICES as ne, injectContentPolicy as re, pluginAllowAttribute as ie, pluginContentPolicy as ae } from "./security.js";
-import { ensureConnectionPolyfills as oe } from "./polyfills.js";
-export { F as AddressSchema, I as AnswerRecordSchema, j as BOARD_ADDRESS, L as DataScopeSchema, R as ErrorReportSchema, z as HOST_API_ARGS, M as HOST_API_METHODS, B as HandshakeSchema, S as HostAsSchema, te as LIBRARY_ORIGINS, l as LIMITS, m as LocalizedTextSchema, C as MemizyRuntimeSchema, w as MultiplayerModeSchema, V as OutgoingMessageSchema, N as PLUGIN_API_METHODS, ne as PLUGIN_DEVICES, a as PROTOCOL_ERROR_CODES, e as PROTOCOL_VERSION, T as PluginManifestError, E as PluginPermissionsSchema, H as ProgressRecordsSchema, o as ProtocolError, q as RELAY_LIMITS, J as RELAY_PROTOCOL, u as RateLimiter, U as ResizeRequestSchema, P as SERVER_ADDRESS, D as ServiceNameSchema, W as SessionResultSchema, h as SettingDefinitionSchema, G as SettingsUpdateSchema, d as assertJsonWithin, t as compareProtocolVersions, Z as displayItem, oe as ensureConnectionPolyfills, b as extractManifestFromHtml, f as findNonJson, re as injectContentPolicy, Y as isPin, s as isProtocolErrorCode, n as isProtocolSupported, p as jsonByteSize, g as localize, r as negotiateProtocolVersion, X as normalizePlayerName, K as parseHostCall, O as parsePluginManifest, i as parseProtocolVersion, ie as pluginAllowAttribute, ae as pluginContentPolicy, Q as prepareDisplaySet, $ as publicItem, k as readPluginManifestFromHtml, _ as resolveSettings, A as safeParsePluginManifest, ee as seededRandom, v as settingsForMode, c as toProtocolError, x as toRuntime, y as validateSettingValue };
+import { LIMITS as l } from "./limits.js";
+import { LocalizedTextSchema as u, SettingDefinitionSchema as d } from "./settingsSchema.js";
+import { localize as f, resolveSettings as p, settingsForMode as m, validateSettingValue as h } from "./settings.js";
+import { extractManifestFromHtml as g } from "./pluginRuntime.js";
+import { HostAsSchema as _, MemizyRuntimeSchema as v, MultiplayerModeSchema as y, PluginManifestError as b, PluginPermissionsSchema as x, ServiceNameSchema as S, parsePluginManifest as C, readPluginManifestFromHtml as w, safeParsePluginManifest as T } from "./manifestSchema.js";
+import { BOARD_ADDRESS as E, HOST_API_METHODS as D, PLUGIN_API_METHODS as O, SERVER_ADDRESS as k, SETTINGS_ADDRESS as A } from "./types.js";
+import { AddressSchema as j, AnswerRecordSchema as M, DataScopeSchema as N, ErrorReportSchema as P, HandshakeSchema as F, OutgoingMessageSchema as I, SessionResultSchema as L, SettingsUpdateSchema as R } from "./schemas.js";
+import { RELAY_PROTOCOL as z } from "./relay.js";
+import { prepareDisplaySet as B } from "./items.js";
+import { PLUGIN_DEVICES as V } from "./security.js";
+export { j as AddressSchema, M as AnswerRecordSchema, E as BOARD_ADDRESS, N as DataScopeSchema, P as ErrorReportSchema, D as HOST_API_METHODS, F as HandshakeSchema, _ as HostAsSchema, l as LIMITS, u as LocalizedTextSchema, v as MemizyRuntimeSchema, y as MultiplayerModeSchema, I as OutgoingMessageSchema, O as PLUGIN_API_METHODS, V as PLUGIN_DEVICES, a as PROTOCOL_ERROR_CODES, e as PROTOCOL_VERSION, b as PluginManifestError, x as PluginPermissionsSchema, o as ProtocolError, z as RELAY_PROTOCOL, k as SERVER_ADDRESS, A as SETTINGS_ADDRESS, S as ServiceNameSchema, L as SessionResultSchema, d as SettingDefinitionSchema, R as SettingsUpdateSchema, t as compareProtocolVersions, g as extractManifestFromHtml, s as isProtocolErrorCode, n as isProtocolSupported, f as localize, r as negotiateProtocolVersion, C as parsePluginManifest, i as parseProtocolVersion, B as prepareDisplaySet, w as readPluginManifestFromHtml, p as resolveSettings, T as safeParsePluginManifest, m as settingsForMode, c as toProtocolError, h as validateSettingValue };

package/dist/internal.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./limits.cjs"),t=require("./pluginRuntime.cjs"),n=require("./schemas.cjs"),r=require("./relay.cjs"),i=require("./items.cjs"),a=require("./security.cjs"),o=require("./polyfills.cjs");exports.HOST_API_ARGS=n.HOST_API_ARGS,exports.LIBRARY_ORIGINS=a.LIBRARY_ORIGINS,exports.RELAY_LIMITS=r.RELAY_LIMITS,exports.RateLimiter=e.RateLimiter,exports.assertJsonWithin=e.assertJsonWithin,exports.displayItem=i.displayItem,exports.ensureConnectionPolyfills=o.ensureConnectionPolyfills,exports.findNonJson=e.findNonJson,exports.injectContentPolicy=a.injectContentPolicy,exports.isPin=r.isPin,exports.jsonByteSize=e.jsonByteSize,exports.normalizePlayerName=r.normalizePlayerName,exports.parseHostCall=n.parseHostCall,exports.pluginAllowAttribute=a.pluginAllowAttribute,exports.pluginContentPolicy=a.pluginContentPolicy,exports.publicItem=i.publicItem,exports.seededRandom=i.seededRandom,exports.toRuntime=t.toRuntime;

package/dist/internal.js

@@ -0,0 +1,8 @@
+import { RateLimiter as e, assertJsonWithin as t, findNonJson as n, jsonByteSize as r } from "./limits.js";
+import { toRuntime as i } from "./pluginRuntime.js";
+import { HOST_API_ARGS as a, parseHostCall as o } from "./schemas.js";
+import { RELAY_LIMITS as s, isPin as c, normalizePlayerName as l } from "./relay.js";
+import { displayItem as u, publicItem as d, seededRandom as f } from "./items.js";
+import { LIBRARY_ORIGINS as p, injectContentPolicy as m, pluginAllowAttribute as h, pluginContentPolicy as g } from "./security.js";
+import { ensureConnectionPolyfills as _ } from "./polyfills.js";
+export { a as HOST_API_ARGS, p as LIBRARY_ORIGINS, s as RELAY_LIMITS, e as RateLimiter, t as assertJsonWithin, u as displayItem, _ as ensureConnectionPolyfills, n as findNonJson, m as injectContentPolicy, c as isPin, r as jsonByteSize, l as normalizePlayerName, o as parseHostCall, h as pluginAllowAttribute, g as pluginContentPolicy, d as publicItem, f as seededRandom, i as toRuntime };

package/dist/items.cjs

@@ -1 +1 @@
-let e=require("@memizy/oqse");function t(e){let t=2166136261;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),16777619);let n=t>>>0;return()=>{n=n+1831565813>>>0;let e=n;return e=Math.imul(e^e>>>15,e|1),e^=e+Math.imul(e^e>>>7,e|61),((e^e>>>14)>>>0)/4294967296}}function n(e,t,n){for(let r=0;r<6;r++){let r=[...e];for(let e=r.length-1;e>0;e--){let n=Math.floor(t()*(e+1));[r[e],r[n]]=[r[n],r[e]]}if(!n||r.length<2||!n(r))return r}return[...e.slice(1),e[0]]}var r=e=>t=>t.every((t,n)=>t.id===e[n]);function i(t,i){let a=structuredClone(t);switch(a.type){case`mcq-single`:case`mcq-multi`:return a.shuffle!==!1&&(a.options=n(a.options,i)),a;case`fill-in-select`:for(let e of Object.values(a.blanks??{}))e.shuffle!==!1&&(e.options=n(e.options,i));return a;case`sort-items`:return a.items=n(a.items,i,r(a.correctOrder)),a;case`match-pairs`:return a.prompts=n(a.prompts,i),a.matches=n(a.matches,i),a;case`match-complex`:return a.leftItems=n(a.leftItems,i),a.rightItems=n(a.rightItems,i),a;case`timeline`:return a.shuffle!==!1&&(a.events=n(a.events,i,t=>(0,e.isTimelineOrderCorrect)(t))),a;case`categorize`:return a.items=n(a.items,i),a;case`diagram-label`:return a.requireTyping||(a.labels=n(a.labels,i)),a;default:return a}}var a=[`explanation`,`incorrectFeedback`],o={note:[`hiddenContent`],flashcard:[`back`],"true-false":[`correctAnswer`],"mcq-single":[`correctId`],"mcq-multi":[`correctIds`],"short-answer":[`correctAnswers`],"sort-items":[`correctOrder`],"match-pairs":[`pairs`],"match-complex":[`connections`],slider:[`correctAnswer`],"numeric-input":[`correctAnswer`],"math-input":[`correctAnswer`,`alternativeAnswers`],matrix:[`correctCells`],"open-ended":[`sampleAnswer`,`rubric`],"chess-puzzle":[`correctAnswers`]},s=[`options`,`items`,`prompts`,`matches`,`leftItems`,`rightItems`,`categories`,`rows`,`columns`,`labels`];function c(e){let t=e.type,n=structuredClone(e);for(let e of a)delete n[e];if(Array.isArray(n.sources))for(let e of n.sources)e&&typeof e==`object`&&delete e.quote;if(t.startsWith(`x-`))return delete n.solution,n.answerHidden=!0,n;for(let e of o[t]??[])delete n[e];for(let e of s)if(Array.isArray(n[e]))for(let t of n[e])t&&typeof t==`object`&&delete t.explanation;switch(t){case`fill-in-blanks`:n.blanks=Object.fromEntries(Object.keys(n.blanks??{}).map(e=>[e,[]]));break;case`fill-in-select`:for(let e of Object.values(n.blanks??{})){delete e.correctId;for(let t of e.options??[])delete t.explanation}break;case`categorize`:for(let e of n.items??[])delete e.correctCategoryId;break;case`timeline`:for(let e of n.events??[])delete e.date,delete e.precision;break;case`diagram-label`:for(let e of n.zones??[])delete e.correctLabelId;n.requireTyping&&(n.labels=[]);break;case`pin-on-image`:case`pin-on-model`:n.hotspots=[]}return n.answerHidden=!0,n}function l(e,n){let r=n===void 0?null:t(n),a=e.items.map(e=>r?i(e,r):structuredClone(e));return{set:{meta:e.meta,items:a},publicSet:{meta:e.meta,items:a.map(c)}}}exports.displayItem=i,exports.prepareDisplaySet=l,exports.publicItem=c,exports.seededRandom=t;
+let e=require("@memizy/oqse");function t(e){let t=2166136261;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),16777619);let n=t>>>0;return()=>{n=n+1831565813>>>0;let e=n;return e=Math.imul(e^e>>>15,e|1),e^=e+Math.imul(e^e>>>7,e|61),((e^e>>>14)>>>0)/4294967296}}function n(e,t,n){for(let r=0;r<6;r++){let r=[...e];for(let e=r.length-1;e>0;e--){let n=Math.floor(t()*(e+1));[r[e],r[n]]=[r[n],r[e]]}if(!n||r.length<2||!n(r))return r}return[...e.slice(1),e[0]]}var r=e=>t=>t.every((t,n)=>t.id===e[n]);function i(t,i){let a=structuredClone(t);switch(a.type){case`mcq-single`:case`mcq-multi`:return a.shuffle!==!1&&(a.options=n(a.options,i)),a;case`fill-in-select`:for(let e of Object.values(a.blanks??{}))e.shuffle!==!1&&(e.options=n(e.options,i));return a;case`sort-items`:return a.items=n(a.items,i,r(a.correctOrder)),a;case`match-pairs`:return a.prompts=n(a.prompts,i),a.matches=n(a.matches,i),a;case`match-complex`:return a.prompts=n(a.prompts,i),a.matches=n(a.matches,i),a;case`timeline`:return a.shuffle!==!1&&(a.events=n(a.events,i,t=>(0,e.isTimelineOrderCorrect)(t))),a;case`categorize`:return a.items=n(a.items,i),a;case`diagram-label`:return a.requireTyping||(a.labels=n(a.labels,i)),a;default:return a}}var a=[`explanation`,`incorrectFeedback`],o={note:[`hiddenContent`],flashcard:[`back`],"true-false":[`correctAnswer`],"mcq-single":[`correctId`],"mcq-multi":[`correctIds`],"short-answer":[`correctAnswers`],"sort-items":[`correctOrder`],"match-pairs":[`pairs`],"match-complex":[`connections`],slider:[`correctAnswer`],"numeric-input":[`correctAnswer`],"math-input":[`correctAnswers`],matrix:[`correctCells`],"open-ended":[`sampleAnswer`,`rubric`],"chess-puzzle":[`correctAnswers`]},s=[`options`,`items`,`prompts`,`matches`,`categories`,`rows`,`columns`,`labels`];function c(e){let t=e.type,n=structuredClone(e);for(let e of a)delete n[e];if(Array.isArray(n.sources))for(let e of n.sources)e&&typeof e==`object`&&delete e.quote;if(t.startsWith(`x-`))return delete n.solution,n.answerHidden=!0,n;for(let e of o[t]??[])delete n[e];for(let e of s)if(Array.isArray(n[e]))for(let t of n[e])t&&typeof t==`object`&&delete t.explanation;switch(t){case`fill-in-blanks`:n.blanks=Object.fromEntries(Object.keys(n.blanks??{}).map(e=>[e,[]]));break;case`fill-in-select`:for(let e of Object.values(n.blanks??{})){delete e.correctId;for(let t of e.options??[])delete t.explanation}break;case`categorize`:for(let e of n.items??[])delete e.correctCategoryId;break;case`timeline`:for(let e of n.events??[])delete e.date,delete e.precision;break;case`diagram-label`:for(let e of n.zones??[])delete e.correctLabelId;n.requireTyping&&(n.labels=[]);break;case`pin-on-image`:case`pin-on-model`:n.hotspots=[]}return n.answerHidden=!0,n}function l(e,n){let r=n===void 0?null:t(n),a=e.items.map(e=>r?i(e,r):structuredClone(e));return{set:{meta:e.meta,items:a},publicSet:{meta:e.meta,items:a.map(c)}}}exports.displayItem=i,exports.prepareDisplaySet=l,exports.publicItem=c,exports.seededRandom=t;

package/dist/items.js

@@ -32,7 +32,7 @@ function i(t, i) {
 			return a;
 		case "sort-items": return a.items = n(a.items, i, r(a.correctOrder)), a;
 		case "match-pairs": return a.prompts = n(a.prompts, i), a.matches = n(a.matches, i), a;
-		case "match-complex": return a.leftItems = n(a.leftItems, i), a.rightItems = n(a.rightItems, i), a;
+		case "match-complex": return a.prompts = n(a.prompts, i), a.matches = n(a.matches, i), a;
 		case "timeline": return a.shuffle !== !1 && (a.events = n(a.events, i, (t) => e(t))), a;
 		case "categorize": return a.items = n(a.items, i), a;
 		case "diagram-label": return a.requireTyping || (a.labels = n(a.labels, i)), a;
@@ -51,7 +51,7 @@ var a = ["explanation", "incorrectFeedback"], o = {
 	"match-complex": ["connections"],
 	slider: ["correctAnswer"],
 	"numeric-input": ["correctAnswer"],
-	"math-input": ["correctAnswer", "alternativeAnswers"],
+	"math-input": ["correctAnswers"],
 	matrix: ["correctCells"],
 	"open-ended": ["sampleAnswer", "rubric"],
 	"chess-puzzle": ["correctAnswers"]
@@ -60,8 +60,6 @@ var a = ["explanation", "incorrectFeedback"], o = {
 	"items",
 	"prompts",
 	"matches",
-	"leftItems",
-	"rightItems",
 	"categories",
 	"rows",
 	"columns",

package/dist/limits.cjs

@@ -1 +1 @@
-const e=require("./errors.cjs");var t={messageBytes:65536,messagesPerSecond:30,messageBurst:60,snapshotBytes:1048576,snapshotsPerSecond:2,dataBytes:262144,dataWritesPerSecond:1,helloTimeoutMs:1e4,answerBytes:4096,generatedItemBytes:32768,serviceBytes:65536,servicesPerMinute:30},n=64;function r(e,t=`$`,i=0,a=new Set){if(e===null||typeof e==`string`||typeof e==`boolean`)return null;if(typeof e==`number`)return Number.isFinite(e)?null:`${t} is not a finite number`;if(typeof e!=`object`)return`${t} is a ${typeof e}`;if(i>=n)return`${t} is nested deeper than ${n} levels`;if(a.has(e))return`${t} contains a circular reference`;if(Array.isArray(e)){a.add(e);for(let n=0;n<e.length;n++){let o=r(e[n],`${t}[${n}]`,i+1,a);if(o)return o}return a.delete(e),null}let o=Object.getPrototypeOf(e);if(o!==Object.prototype&&o!==null)return`${t} is not a plain object`;a.add(e);for(let[n,o]of Object.entries(e)){let e=r(o,`${t}.${n}`,i+1,a);if(e)return e}return a.delete(e),null}function i(e){return new TextEncoder().encode(JSON.stringify(e)).length}function a(t,n,a,o){let s=r(t);if(s)throw new e.ProtocolError(`INVALID_ARGUMENT`,`${o} must be plain JSON: ${s}.`);let c=i(t);if(c>n)throw new e.ProtocolError(a,`${o} is ${c} bytes; the limit is ${n} bytes.`);return c}var o=class{rate;burst;now;tokens;last;constructor(e,t,n=()=>Date.now()){this.rate=e,this.burst=t,this.now=n,this.tokens=t,this.last=n()}tryTake(e=1){let t=this.now();return this.tokens=Math.min(this.burst,this.tokens+(t-this.last)/1e3*this.rate),this.last=t,this.tokens<e?!1:(this.tokens-=e,!0)}};exports.LIMITS=t,exports.RateLimiter=o,exports.assertJsonWithin=a,exports.findNonJson=r,exports.jsonByteSize=i;
+const e=require("./errors.cjs");var t={messageBytes:65536,messagesPerSecond:30,messageBurst:60,snapshotBytes:1048576,snapshotsPerSecond:2,dataBytes:262144,dataWritesPerSecond:1,helloTimeoutMs:1e4,answerBytes:4096,generatedItemBytes:32768,answersPerSecond:10,answerBurst:20,serviceBytes:65536,serviceResultBytes:262144,servicesPerMinute:30,assetsPerSecond:10,assetBurst:20,assetBytes:2097152,errorReportsPerSecond:5,errorReportBurst:10},n=64;function r(e,t=`$`,i=0,a=new Set){if(e===null||typeof e==`string`||typeof e==`boolean`)return null;if(typeof e==`number`)return Number.isFinite(e)?null:`${t} is not a finite number`;if(typeof e!=`object`)return`${t} is a ${typeof e}`;if(i>=n)return`${t} is nested deeper than ${n} levels`;if(a.has(e))return`${t} contains a circular reference`;if(Array.isArray(e)){a.add(e);for(let n=0;n<e.length;n++){let o=r(e[n],`${t}[${n}]`,i+1,a);if(o)return o}return a.delete(e),null}let o=Object.getPrototypeOf(e);if(o!==Object.prototype&&o!==null)return`${t} is not a plain object`;a.add(e);for(let[n,o]of Object.entries(e)){let e=r(o,`${t}.${n}`,i+1,a);if(e)return e}return a.delete(e),null}function i(e){return new TextEncoder().encode(JSON.stringify(e)).length}function a(t,n,a,o){let s=r(t);if(s)throw new e.ProtocolError(`INVALID_ARGUMENT`,`${o} must be plain JSON: ${s}.`);let c=i(t);if(c>n)throw new e.ProtocolError(a,`${o} is ${c} bytes; the limit is ${n} bytes.`);return c}var o=class{rate;burst;now;tokens;last;constructor(e,t,n=()=>Date.now()){this.rate=e,this.burst=t,this.now=n,this.tokens=t,this.last=n()}tryTake(e=1){let t=this.now();return this.tokens=Math.min(this.burst,this.tokens+(t-this.last)/1e3*this.rate),this.last=t,this.tokens<e?!1:(this.tokens-=e,!0)}};exports.LIMITS=t,exports.RateLimiter=o,exports.assertJsonWithin=a,exports.findNonJson=r,exports.jsonByteSize=i;

package/dist/limits.js

@@ -11,8 +11,16 @@ var t = {
 	helloTimeoutMs: 1e4,
 	answerBytes: 4096,
 	generatedItemBytes: 32768,
+	answersPerSecond: 10,
+	answerBurst: 20,
 	serviceBytes: 65536,
-	servicesPerMinute: 30
+	serviceResultBytes: 262144,
+	servicesPerMinute: 30,
+	assetsPerSecond: 10,
+	assetBurst: 20,
+	assetBytes: 2097152,
+	errorReportsPerSecond: 5,
+	errorReportBurst: 10
 }, n = 64;
 function r(e, t = "$", i = 0, a = /* @__PURE__ */ new Set()) {
 	if (e === null || typeof e == "string" || typeof e == "boolean") return null;

package/dist/relay.cjs

@@ -1 +1 @@
-var e=1,t={frameBytes:2097152,bundleBytes:8388608,playersPerRoom:100,playerFramesPerSecond:60,playerFrameBurst:120,hostFramesPerSecond:3e3,hostFrameBurst:6e3,nameLength:32,hostAwayMs:6e5,roomTtlMs:216e5};function n(e){return typeof e==`string`?e.replace(/\s+/g,` `).trim().slice(0,t.nameLength):``}function r(e){return typeof e==`string`&&/^\d{6}$/.test(e)}exports.RELAY_LIMITS=t,exports.RELAY_PROTOCOL=e,exports.isPin=r,exports.normalizePlayerName=n;
+var e=1,t={frameBytes:3145728,bundleBytes:8388608,playersPerRoom:100,playerFramesPerSecond:60,playerFrameBurst:120,hostFramesPerSecond:3e3,hostFrameBurst:6e3,nameLength:32,authLength:4096,hostAwayMs:6e5,roomTtlMs:216e5};function n(e){return typeof e==`string`?e.replace(/\s+/g,` `).trim().slice(0,t.nameLength):``}function r(e){return typeof e==`string`&&/^\d{6}$/.test(e)}exports.RELAY_LIMITS=t,exports.RELAY_PROTOCOL=e,exports.isPin=r,exports.normalizePlayerName=n;

package/dist/relay.js

@@ -1,6 +1,6 @@
 //#region src/relay.ts
 var e = 1, t = {
-	frameBytes: 2097152,
+	frameBytes: 3145728,
 	bundleBytes: 8388608,
 	playersPerRoom: 100,
 	playerFramesPerSecond: 60,
@@ -8,6 +8,7 @@ var e = 1, t = {
 	hostFramesPerSecond: 3e3,
 	hostFrameBurst: 6e3,
 	nameLength: 32,
+	authLength: 4096,
 	hostAwayMs: 6e5,
 	roomTtlMs: 216e5
 };

package/dist/schemas.cjs

@@ -1 +1 @@
-const e=require("./errors.cjs");let t=require("zod"),n=require("@memizy/oqse");var r=e=>t.z.string().min(1).max(e),i=t.z.string().min(1).max(128),a=t.z.looseObject({protocol:t.z.string().regex(/^\d+\.\d+$/,`protocol must be in MAJOR.MINOR format`),sdk:t.z.looseObject({name:r(200),version:r(100)}),plugin:t.z.looseObject({id:r(500),version:r(100)}),features:t.z.array(r(100)).max(100)}),o=t.z.looseObject({to:t.z.union([t.z.literal(`authority`),t.z.literal(`all`),t.z.array(i).min(1).max(500)]),data:t.z.unknown()}),s=t.z.looseObject({playerId:i.optional(),itemId:r(128),isCorrect:t.z.boolean(),confidence:t.z.union([t.z.literal(1),t.z.literal(2),t.z.literal(3),t.z.literal(4)]).optional(),timeSpentMs:t.z.number().int().nonnegative().optional(),hintsUsed:t.z.number().int().nonnegative().optional(),isSkipped:t.z.boolean().optional(),answer:t.z.unknown().optional(),item:t.z.looseObject({id:r(128),type:r(64)}).optional()}).refine(e=>!e.item||e.item.id===e.itemId,{message:`item.id must equal itemId`,path:[`item`,`id`]}),c=t.z.record(r(128),n.ProgressRecordSchema),l=t.z.enum([`plugin`,`set`]),u=t.z.looseObject({values:t.z.record(t.z.string(),t.z.unknown()),valid:t.z.boolean(),message:t.z.string().max(500).optional()}),d=t.z.looseObject({scores:t.z.record(i,t.z.number().finite()).optional(),summary:t.z.string().max(1e3).optional()}),f=t.z.looseObject({height:t.z.union([t.z.number().positive().max(1e5),t.z.literal(`auto`)])}),p=t.z.looseObject({code:r(100),message:t.z.string().max(2e3),context:t.z.record(t.z.string(),t.z.unknown()).optional()}),m={hello:t.z.tuple([a]),ready:t.z.tuple([]),send:t.z.tuple([o]),saveSnapshot:t.z.tuple([t.z.unknown()]),recordAnswer:t.z.tuple([s]),saveProgress:t.z.tuple([c]),saveData:t.z.tuple([l,t.z.unknown()]),updateSettings:t.z.tuple([u]),getAsset:t.z.tuple([r(200),r(128).optional()]),end:t.z.tuple([d]),resize:t.z.tuple([f]),reportError:t.z.tuple([p]),exit:t.z.tuple([]),service:t.z.tuple([r(100),t.z.unknown()])};function h(t,r){let i=m[t].safeParse(r);if(!i.success)throw new e.ProtocolError(`INVALID_ARGUMENT`,`${t}: ${(0,n.formatOQSEErrors)(i.error).join(`; `)}`);return i.data}exports.AddressSchema=i,exports.AnswerRecordSchema=s,exports.DataScopeSchema=l,exports.ErrorReportSchema=p,exports.HOST_API_ARGS=m,exports.HandshakeSchema=a,exports.OutgoingMessageSchema=o,exports.ProgressRecordsSchema=c,exports.ResizeRequestSchema=f,exports.SessionResultSchema=d,exports.SettingsUpdateSchema=u,exports.parseHostCall=h;
+const e=require("./errors.cjs");let t=require("zod"),n=require("@memizy/oqse");var r=e=>t.z.string().min(1).max(e),i=t.z.string().min(1).max(128),a=t.z.looseObject({protocol:t.z.string().regex(/^\d+\.\d+$/,`protocol must be in MAJOR.MINOR format`),sdk:t.z.looseObject({name:r(200),version:r(100)}),plugin:t.z.looseObject({id:r(500),version:r(100)}),features:t.z.array(r(100)).max(100)}),o=t.z.looseObject({to:t.z.union([t.z.literal(`authority`),t.z.literal(`all`),t.z.array(i).min(1).max(500)]),data:t.z.unknown()}),s=t.z.looseObject({playerId:i.optional(),itemId:r(128),isCorrect:t.z.boolean(),confidence:t.z.union([t.z.literal(1),t.z.literal(2),t.z.literal(3),t.z.literal(4)]).optional(),timeSpentMs:t.z.number().int().nonnegative().optional(),hintsUsed:t.z.number().int().nonnegative().optional(),isSkipped:t.z.boolean().optional(),answer:t.z.unknown().optional(),item:t.z.looseObject({id:r(128),type:r(64)}).optional()}).refine(e=>!e.item||e.item.id===e.itemId,{message:`item.id must equal itemId`,path:[`item`,`id`]}),c=t.z.enum([`plugin`,`set`]),l=t.z.looseObject({values:t.z.record(t.z.string(),t.z.unknown()),valid:t.z.boolean(),message:t.z.string().max(500).optional()}),u=t.z.looseObject({scores:t.z.record(i,t.z.number().finite()).optional(),summary:t.z.string().max(1e3).optional()}),d=t.z.looseObject({code:r(100),message:t.z.string().max(2e3),context:t.z.record(t.z.string(),t.z.unknown()).optional()}),f={hello:t.z.tuple([a]),ready:t.z.tuple([]),send:t.z.tuple([o]),saveSnapshot:t.z.tuple([t.z.unknown()]),recordAnswer:t.z.tuple([s]),saveData:t.z.tuple([c,t.z.unknown()]),updateSettings:t.z.tuple([l]),getAsset:t.z.tuple([r(200),r(128).optional()]),end:t.z.tuple([u]),reportError:t.z.tuple([d]),service:t.z.tuple([r(100),t.z.unknown()])};function p(t,r){let i=f[t].safeParse(r);if(!i.success)throw new e.ProtocolError(`INVALID_ARGUMENT`,`${t}: ${(0,n.formatOQSEErrors)(i.error).join(`; `)}`);return i.data}exports.AddressSchema=i,exports.AnswerRecordSchema=s,exports.DataScopeSchema=c,exports.ErrorReportSchema=d,exports.HOST_API_ARGS=f,exports.HandshakeSchema=a,exports.OutgoingMessageSchema=o,exports.SessionResultSchema=u,exports.SettingsUpdateSchema=l,exports.parseHostCall=p;

package/dist/schemas.js

@@ -1,28 +1,28 @@
 import { ProtocolError as e } from "./errors.js";
 import { z as t } from "zod";
-import { ProgressRecordSchema as n, formatOQSEErrors as r } from "@memizy/oqse";
+import { formatOQSEErrors as n } from "@memizy/oqse";
 //#region src/schemas.ts
-var i = (e) => t.string().min(1).max(e), a = t.string().min(1).max(128), o = t.looseObject({
+var r = (e) => t.string().min(1).max(e), i = t.string().min(1).max(128), a = t.looseObject({
 	protocol: t.string().regex(/^\d+\.\d+$/, "protocol must be in MAJOR.MINOR format"),
 	sdk: t.looseObject({
-		name: i(200),
-		version: i(100)
+		name: r(200),
+		version: r(100)
 	}),
 	plugin: t.looseObject({
-		id: i(500),
-		version: i(100)
+		id: r(500),
+		version: r(100)
 	}),
-	features: t.array(i(100)).max(100)
-}), s = t.looseObject({
+	features: t.array(r(100)).max(100)
+}), o = t.looseObject({
 	to: t.union([
 		t.literal("authority"),
 		t.literal("all"),
-		t.array(a).min(1).max(500)
+		t.array(i).min(1).max(500)
 	]),
 	data: t.unknown()
-}), c = t.looseObject({
-	playerId: a.optional(),
-	itemId: i(128),
+}), s = t.looseObject({
+	playerId: i.optional(),
+	itemId: r(128),
 	isCorrect: t.boolean(),
 	confidence: t.union([
 		t.literal(1),
@@ -35,43 +35,40 @@ var i = (e) => t.string().min(1).max(e), a = t.string().min(1).max(128), o = t.l
 	isSkipped: t.boolean().optional(),
 	answer: t.unknown().optional(),
 	item: t.looseObject({
-		id: i(128),
-		type: i(64)
+		id: r(128),
+		type: r(64)
 	}).optional()
 }).refine((e) => !e.item || e.item.id === e.itemId, {
 	message: "item.id must equal itemId",
 	path: ["item", "id"]
-}), l = t.record(i(128), n), u = t.enum(["plugin", "set"]), d = t.looseObject({
+}), c = t.enum(["plugin", "set"]), l = t.looseObject({
 	values: t.record(t.string(), t.unknown()),
 	valid: t.boolean(),
 	message: t.string().max(500).optional()
-}), f = t.looseObject({
-	scores: t.record(a, t.number().finite()).optional(),
+}), u = t.looseObject({
+	scores: t.record(i, t.number().finite()).optional(),
 	summary: t.string().max(1e3).optional()
-}), p = t.looseObject({ height: t.union([t.number().positive().max(1e5), t.literal("auto")]) }), m = t.looseObject({
-	code: i(100),
+}), d = t.looseObject({
+	code: r(100),
 	message: t.string().max(2e3),
 	context: t.record(t.string(), t.unknown()).optional()
-}), h = {
-	hello: t.tuple([o]),
+}), f = {
+	hello: t.tuple([a]),
 	ready: t.tuple([]),
-	send: t.tuple([s]),
+	send: t.tuple([o]),
 	saveSnapshot: t.tuple([t.unknown()]),
-	recordAnswer: t.tuple([c]),
-	saveProgress: t.tuple([l]),
-	saveData: t.tuple([u, t.unknown()]),
-	updateSettings: t.tuple([d]),
-	getAsset: t.tuple([i(200), i(128).optional()]),
-	end: t.tuple([f]),
-	resize: t.tuple([p]),
-	reportError: t.tuple([m]),
-	exit: t.tuple([]),
-	service: t.tuple([i(100), t.unknown()])
+	recordAnswer: t.tuple([s]),
+	saveData: t.tuple([c, t.unknown()]),
+	updateSettings: t.tuple([l]),
+	getAsset: t.tuple([r(200), r(128).optional()]),
+	end: t.tuple([u]),
+	reportError: t.tuple([d]),
+	service: t.tuple([r(100), t.unknown()])
 };
-function g(t, n) {
-	let i = h[t].safeParse(n);
-	if (!i.success) throw new e("INVALID_ARGUMENT", `${t}: ${r(i.error).join("; ")}`);
+function p(t, r) {
+	let i = f[t].safeParse(r);
+	if (!i.success) throw new e("INVALID_ARGUMENT", `${t}: ${n(i.error).join("; ")}`);
 	return i.data;
 }
 //#endregion
-export { a as AddressSchema, c as AnswerRecordSchema, u as DataScopeSchema, m as ErrorReportSchema, h as HOST_API_ARGS, o as HandshakeSchema, s as OutgoingMessageSchema, l as ProgressRecordsSchema, p as ResizeRequestSchema, f as SessionResultSchema, d as SettingsUpdateSchema, g as parseHostCall };
+export { i as AddressSchema, s as AnswerRecordSchema, c as DataScopeSchema, d as ErrorReportSchema, f as HOST_API_ARGS, a as HandshakeSchema, o as OutgoingMessageSchema, u as SessionResultSchema, l as SettingsUpdateSchema, p as parseHostCall };

package/dist/src/errors.d.ts

@@ -5,7 +5,7 @@
  * error `name` and `message`. The code is therefore also encoded in the
  * message as `[CODE] text`, and {@link toProtocolError} restores it.
  */
-export declare const PROTOCOL_ERROR_CODES: readonly ["UNSUPPORTED_PROTOCOL", "INVALID_ARGUMENT", "NOT_AUTHORITY", "NOT_ALLOWED_IN_VIEW", "AUTHORITY_UNAVAILABLE", "MESSAGE_TOO_LARGE", "SNAPSHOT_TOO_LARGE", "DATA_TOO_LARGE", "RATE_LIMITED", "ASSET_NOT_FOUND", "SESSION_ENDED", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE"];
+export declare const PROTOCOL_ERROR_CODES: readonly ["UNSUPPORTED_PROTOCOL", "INVALID_ARGUMENT", "NOT_AUTHORITY", "NOT_ALLOWED_IN_VIEW", "AUTHORITY_UNAVAILABLE", "MESSAGE_TOO_LARGE", "SNAPSHOT_TOO_LARGE", "DATA_TOO_LARGE", "RATE_LIMITED", "ASSET_NOT_FOUND", "SESSION_ENDED", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "UNKNOWN_METHOD"];
 export type ProtocolErrorCode = (typeof PROTOCOL_ERROR_CODES)[number];
 export declare class ProtocolError extends Error {
     readonly code: ProtocolErrorCode;

package/dist/src/index.d.ts

@@ -1,17 +1,20 @@
 /**
  * @memizy/protocol – Memizy Plugin Protocol v1.
  * The normative specification is SPEC.md in this package.
+ *
+ * The public API is listed explicitly: it follows semver within 1.x. Helpers shared by the
+ * Memizy packages (rate limiting, call parsing, content policies…) are in
+ * `@memizy/protocol/internal` and may change in any release.
  */
-export * from './version';
-export * from './errors';
-export * from './limits';
-export * from './settingsSchema';
-export * from './settings';
-export * from './manifestSchema';
-export * from './pluginRuntime';
-export * from './types';
-export * from './schemas';
-export * from './relay';
-export * from './items';
-export * from './security';
-export * from './polyfills';
+export { PROTOCOL_VERSION, parseProtocolVersion, compareProtocolVersions, negotiateProtocolVersion, isProtocolSupported, type ProtocolVersion, type HostProtocolVersions, } from './version.js';
+export { PROTOCOL_ERROR_CODES, ProtocolError, isProtocolErrorCode, toProtocolError, type ProtocolErrorCode } from './errors.js';
+export { LIMITS, type Limits } from './limits.js';
+export { LocalizedTextSchema, SettingDefinitionSchema, type LocalizedText, type SettingDefinition } from './settingsSchema.js';
+export { validateSettingValue, resolveSettings, settingsForMode, localize, type SettingValue } from './settings.js';
+export { HostAsSchema, MultiplayerModeSchema, ServiceNameSchema, PluginPermissionsSchema, MemizyRuntimeSchema, PluginManifestError, safeParsePluginManifest, parsePluginManifest, readPluginManifestFromHtml, type MemizyRuntimeManifest, type PluginManifest, type PluginManifestResult, } from './manifestSchema.js';
+export { extractManifestFromHtml, type HostAs, type PluginView, type PluginRuntime } from './pluginRuntime.js';
+export * from './types.js';
+export { AddressSchema, HandshakeSchema, OutgoingMessageSchema, AnswerRecordSchema, DataScopeSchema, SettingsUpdateSchema, SessionResultSchema, ErrorReportSchema, } from './schemas.js';
+export { RELAY_PROTOCOL, type RelayBundle, type CreateRoomResponse, type RoomInfo, type RoomPlayer, type RelayClientMessage, type RelayErrorCode, type RelayServerMessage, } from './relay.js';
+export { prepareDisplaySet, type DisplaySet, type PublicItemMark } from './items.js';
+export { PLUGIN_DEVICES, type PluginDevice } from './security.js';

package/dist/src/internal.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @memizy/protocol/internal – helpers shared by the Memizy packages (host-sdk, plugin-sdk,
+ * the relay server, Memizy Play). Not part of the public API: they may change in any
+ * release. Use `@memizy/protocol` instead.
+ */
+export { findNonJson, jsonByteSize, assertJsonWithin, RateLimiter } from './limits.js';
+export { toRuntime } from './pluginRuntime.js';
+export { HOST_API_ARGS, parseHostCall } from './schemas.js';
+export { RELAY_LIMITS, normalizePlayerName, isPin } from './relay.js';
+export { seededRandom, displayItem, publicItem } from './items.js';
+export { LIBRARY_ORIGINS, pluginContentPolicy, pluginAllowAttribute, injectContentPolicy } from './security.js';
+export { ensureConnectionPolyfills } from './polyfills.js';

package/dist/src/limits.d.ts

@@ -25,10 +25,26 @@ export declare const LIMITS: {
     readonly answerBytes: number;
     /** Max serialized size of a generated item attached to `recordAnswer`. */
     readonly generatedItemBytes: number;
-    /** Max serialized size of a service request (its result may be up to `messageBytes * 4`). */
+    /** `recordAnswer` calls per second and instance (sustained); the authority: per player. */
+    readonly answersPerSecond: 10;
+    /** Burst size of the `recordAnswer` rate limiter. */
+    readonly answerBurst: 20;
+    /** Max serialized size of a service request. */
     readonly serviceBytes: number;
+    /** Max serialized size of a service result. */
+    readonly serviceResultBytes: number;
     /** Service calls per minute and instance (sustained). */
     readonly servicesPerMinute: 30;
+    /** `getAsset` calls per second and instance (sustained). */
+    readonly assetsPerSecond: 10;
+    /** Burst size of the `getAsset` rate limiter. */
+    readonly assetBurst: 20;
+    /** Size of one asset every host can deliver through `getAsset`. */
+    readonly assetBytes: number;
+    /** `reportError` calls per second and instance the host keeps (more are dropped). */
+    readonly errorReportsPerSecond: 5;
+    /** Burst size of the `reportError` limiter. */
+    readonly errorReportBurst: 10;
 };
 export type Limits = {
     [K in keyof typeof LIMITS]: number;

package/dist/src/manifestSchema.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { OQSEManifest } from '@memizy/oqse';
-import { PluginRuntime } from './pluginRuntime';
+import { PluginRuntime } from './pluginRuntime.js';
 export declare const HostAsSchema: z.ZodEnum<{
     presenter: "presenter";
     player: "player";

package/dist/src/pluginRuntime.d.ts

@@ -1,5 +1,5 @@
-import { MemizyRuntimeManifest } from './manifestSchema';
-import { SettingDefinition } from './settingsSchema';
+import { MemizyRuntimeManifest } from './manifestSchema.js';
+import { SettingDefinition } from './settingsSchema.js';
 export type HostAs = 'presenter' | 'player';
 export type PluginView = 'solo' | 'board' | 'controller' | 'settings';
 /** The runtime part with all defaults applied – what hosts work with. */

package/dist/src/relay.d.ts

@@ -16,9 +16,15 @@
  * - `GET  /api/health`
  * WebSocket: `/ws`.
  */
+/**
+ * Version of the relay wire protocol (client <-> server). Within version 1 messages only
+ * change additively: receivers ignore unknown fields; the server answers an unknown `t`
+ * with a non-fatal `NOT_ALLOWED` error. The messages between the host app and the player
+ * apps (inside `data`) have their own version (`RELAY_APP_VERSION` in @memizy/host-sdk).
+ */
 export declare const RELAY_PROTOCOL = 1;
 export declare const RELAY_LIMITS: {
-    /** Max size of one WebSocket frame (UTF-8 JSON). */
+    /** Max size of one WebSocket frame (UTF-8 JSON); fits an asset of `LIMITS.assetBytes` as base64. */
     readonly frameBytes: number;
     /** Max size of an uploaded bundle (plugin + set). */
     readonly bundleBytes: number;
@@ -32,6 +38,8 @@ export declare const RELAY_LIMITS: {
     readonly hostFrameBurst: 6000;
     /** Max player name length. */
     readonly nameLength: 32;
+    /** Max length of the `auth` a player sends when joining. */
+    readonly authLength: 4096;
     /** A room is closed when its host has been away this long. */
     readonly hostAwayMs: number;
     /** A room is closed after this time in any case. */
@@ -55,10 +63,15 @@ export interface RoomInfo {
     appName: string | null;
     players: number;
 }
-export interface RelayPlayer {
+export interface RoomPlayer {
     id: string;
     name: string;
     connected: boolean;
+    /**
+     * What the player's app sent as `auth` when joining (e.g. a signed token of a signed-in
+     * student). Only the host gets it; the server does not check it – the host app does.
+     */
+    auth?: string;
 }
 export type RelayClientMessage = 
 /** The host attaches to its room (also after a reconnect). */
@@ -68,13 +81,18 @@ export type RelayClientMessage =
     pin: string;
     hostToken: string;
 }
-/** A player joins (with `token`: rejoins as the same player). */
+/**
+ * A player joins (with `token`: rejoins as the same player). `auth` (optional, at most
+ * `RELAY_LIMITS.authLength` characters) is passed to the host only, for apps with
+ * signed-in players; a rejoin with `auth` replaces the earlier one.
+ */
  | {
     t: 'join';
     protocol: number;
     pin: string;
     name: string;
     token?: string;
+    auth?: string;
 }
 /** Host → one player. */
  | {
@@ -114,7 +132,7 @@ export type RelayServerMessage =
 {
     t: 'hosting';
     pin: string;
-    players: RelayPlayer[];
+    players: RoomPlayer[];
 }
 /** To a player after `join`. Keep `token` to rejoin as the same player. */
  | {
@@ -128,7 +146,7 @@ export type RelayServerMessage =
 /** To the host: a player joined, reconnected, disconnected or was renamed. */
  | {
     t: 'presence';
-    player: RelayPlayer;
+    player: RoomPlayer;
     event: 'join' | 'connect' | 'disconnect' | 'rename' | 'leave';
 }
 /** To players: the host connection state. */

package/dist/src/schemas.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { HostApi } from './types';
+import { HostApi } from './types.js';
 export declare const AddressSchema: z.ZodString;
 export declare const HandshakeSchema: z.ZodObject<{
     protocol: z.ZodString;
@@ -31,7 +31,6 @@ export declare const AnswerRecordSchema: z.ZodObject<{
         type: z.ZodString;
     }, z.core.$loose>>;
 }, z.core.$loose>;
-export declare const ProgressRecordsSchema: z.ZodRecord<z.ZodString, z.ZodType<import('@memizy/oqse').ProgressRecord, unknown, z.core.$ZodTypeInternals<import('@memizy/oqse').ProgressRecord, unknown>>>;
 export declare const DataScopeSchema: z.ZodEnum<{
     set: "set";
     plugin: "plugin";
@@ -45,9 +44,6 @@ export declare const SessionResultSchema: z.ZodObject<{
     scores: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     summary: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
-export declare const ResizeRequestSchema: z.ZodObject<{
-    height: z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<"auto">]>;
-}, z.core.$loose>;
 export declare const ErrorReportSchema: z.ZodObject<{
     code: z.ZodString;
     message: z.ZodString;
@@ -87,7 +83,6 @@ export declare const HOST_API_ARGS: {
             type: z.ZodString;
         }, z.core.$loose>>;
     }, z.core.$loose>], null>;
-    saveProgress: z.ZodTuple<[z.ZodRecord<z.ZodString, z.ZodType<import('@memizy/oqse').ProgressRecord, unknown, z.core.$ZodTypeInternals<import('@memizy/oqse').ProgressRecord, unknown>>>], null>;
     saveData: z.ZodTuple<[z.ZodEnum<{
         set: "set";
         plugin: "plugin";
@@ -102,15 +97,11 @@ export declare const HOST_API_ARGS: {
         scores: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
         summary: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>], null>;
-    resize: z.ZodTuple<[z.ZodObject<{
-        height: z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<"auto">]>;
-    }, z.core.$loose>], null>;
     reportError: z.ZodTuple<[z.ZodObject<{
         code: z.ZodString;
         message: z.ZodString;
         context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$loose>], null>;
-    exit: z.ZodTuple<[], null>;
     service: z.ZodTuple<[z.ZodString, z.ZodUnknown], null>;
 };
 /**

package/dist/src/security.d.ts

@@ -1,4 +1,4 @@
-import { PluginRuntime } from './pluginRuntime';
+import { PluginRuntime } from './pluginRuntime.js';
 /** CDNs plugins load libraries from (scripts, styles, fonts, data files). */
 export declare const LIBRARY_ORIGINS: string[];
 /** Device permissions a plugin may declare, and their iframe `allow` names. */

package/dist/src/settings.d.ts

@@ -1,4 +1,4 @@
-import { LocalizedText, SettingDefinition } from './settingsSchema';
+import { LocalizedText, SettingDefinition } from './settingsSchema.js';
 export type SettingValue = string | number | boolean;
 /** Returns an error description if `value` is not valid for `def`, otherwise `null`. */
 export declare function validateSettingValue(def: SettingDefinition, value: unknown): string | null;

package/dist/src/types.d.ts

@@ -1,11 +1,13 @@
 import { OQSEAnyItem, OQSEMeta, ProgressRecord } from '@memizy/oqse';
-import { HostAs, PluginView } from './pluginRuntime';
-/** Address of an instance: a player ID, `"board"`; `"server"` is reserved. */
+import { HostAs, PluginView } from './pluginRuntime.js';
+/** Address of an instance: a player ID, `"board"`, `"settings"` (`SETTINGS_ADDRESS`); `"server"` is reserved. */
 export type Address = string;
 /** Address of the presenter's board. */
 export declare const BOARD_ADDRESS = "board";
 /** Reserved for a future server-side authority (SPEC 3.1). */
 export declare const SERVER_ADDRESS = "server";
+/** Address of the plugin's own settings screen in the lobby (view `settings`). */
+export declare const SETTINGS_ADDRESS = "settings";
 export type SessionMode = 'solo' | 'multiplayer';
 export interface Player {
     id: string;
@@ -39,7 +41,8 @@ export interface Handshake {
     };
     features: string[];
 }
-export interface Theme {
+/** Language and theme of the app (`InitPayload.config`, `configChanged`). */
+export interface HostConfig {
     locale: string;
     theme: 'light' | 'dark';
 }
@@ -68,14 +71,11 @@ export interface InitPayload {
     };
     /** Values for every declared setting (defaults applied). */
     settings: Record<string, unknown>;
-    config: Theme;
+    config: HostConfig;
     /** The session clock and its pauses (see {@link SessionClock}). */
     clock: SessionClock;
-    /**
-     * RC4: Memizy services this host offers to the plugin (declared in its manifest and
-     * available here); call them with `service()`. Absent on older hosts.
-     */
-    services?: string[];
+    /** Memizy services this host offers to the plugin (declared in its manifest and available here); call them with `service()`. */
+    services: string[];
     /** Learning progress of `self` (empty for board/settings). */
     progress: Record<string, ProgressRecord>;
     /** Plugin data of `self` (`null` values for board/settings). */
@@ -84,15 +84,17 @@ export interface InitPayload {
     snapshot: unknown | null;
 }
 /**
- * The session clock. `Date.now() + offsetMs` is the session time. RC4 adds pauses: the
+ * The session clock. `Date.now() + offsetMs` is the session time. Pauses: the
  * game time is `(pausedAt ?? sessionTime) - pausedMs` – it stands still while the host
  * has paused the game (`pausedAt` = session time of the pause) and continues afterwards
  * without the paused time (`pausedMs` = total of finished pauses).
  */
 export interface SessionClock {
     offsetMs: number;
-    pausedMs?: number;
-    pausedAt?: number | null;
+    /** Total length of finished pauses (ms). */
+    pausedMs: number;
+    /** Session time when the current pause started, or `null` while the game runs. */
+    pausedAt: number | null;
 }
 export interface AnswerRecord {
     /** Default: self. The authority may record for any player. */
@@ -104,12 +106,12 @@ export interface AnswerRecord {
     hintsUsed?: number;
     isSkipped?: boolean;
     /**
-     * RC4: what the player answered, in the `checkAnswer` format of the item type
+     * What the player answered, in the `checkAnswer` format of the item type
      * (choice IDs, text, numbers…). Lets teachers see which wrong answers were chosen.
      */
     answer?: unknown;
     /**
-     * RC4: the item itself, required when `itemId` is not in the set (a generated item, e.g.
+     * The item itself, required when `itemId` is not in the set (a generated item, e.g.
      * from a service). It needs at least `id` (= `itemId`) and `type`; the answer fields may
      * be left out. Such answers count for statistics (`skills`, `tags`), not for repetition.
      */
@@ -130,9 +132,6 @@ export interface SettingsUpdate {
     valid: boolean;
     message?: string;
 }
-export interface ResizeRequest {
-    height: number | 'auto';
-}
 export interface ErrorReport {
     code: string;
     message: string;
@@ -150,7 +149,7 @@ export interface IncomingMessage {
     /** Session clock (ms). */
     sentAt: number;
 }
-export type SessionEndReason = 'finished' | 'host_left' | 'kicked' | 'closed' | 'error';
+export type SessionEndReason = 'finished' | 'host-left' | 'kicked' | 'closed' | 'error';
 /** Methods the host exposes to the plugin (plugin → host). SPEC section 5. */
 export interface HostApi {
     hello(handshake: Handshake): Promise<InitPayload>;
@@ -158,15 +157,12 @@ export interface HostApi {
     send(message: OutgoingMessage): Promise<void>;
     saveSnapshot(snapshot: unknown): Promise<void>;
     recordAnswer(answer: AnswerRecord): Promise<void>;
-    saveProgress(records: Record<string, ProgressRecord>): Promise<void>;
     saveData(scope: DataScope, value: unknown): Promise<void>;
     updateSettings(update: SettingsUpdate): Promise<void>;
     getAsset(key: string, itemId?: string): Promise<Blob>;
     end(result: SessionResult): Promise<void>;
-    resize(request: ResizeRequest): Promise<void>;
     reportError(error: ErrorReport): Promise<void>;
-    exit(): Promise<void>;
-    /** RC4: calls a Memizy service (one of `InitPayload.services`); returns its JSON result. */
+    /** Calls a Memizy service (one of `InitPayload.services`); returns its JSON result. */
     service(name: string, payload: unknown): Promise<unknown>;
 }
 /** Methods the plugin exposes to the host (host → plugin). SPEC section 7. */
@@ -177,14 +173,10 @@ export interface PluginApi {
     authorityChanged(status: {
         connected: boolean;
     }): Promise<void>;
-    setChanged(set: {
-        meta: OQSEMeta;
-        items: OQSEAnyItem[];
-    }): Promise<void>;
-    configChanged(config: Theme): Promise<void>;
-    /** The clock was corrected, or the game was paused / resumed (RC4). */
+    configChanged(config: HostConfig): Promise<void>;
+    /** The clock was corrected, or the game was paused / resumed. */
     clockChanged(clock: SessionClock): Promise<void>;
     sessionEnded(reason: SessionEndReason): Promise<void>;
 }
-export declare const HOST_API_METHODS: readonly ["hello", "ready", "send", "saveSnapshot", "recordAnswer", "saveProgress", "saveData", "updateSettings", "getAsset", "end", "resize", "reportError", "exit", "service"];
-export declare const PLUGIN_API_METHODS: readonly ["start", "deliver", "playersChanged", "authorityChanged", "setChanged", "configChanged", "clockChanged", "sessionEnded"];
+export declare const HOST_API_METHODS: readonly ["hello", "ready", "send", "saveSnapshot", "recordAnswer", "saveData", "updateSettings", "getAsset", "end", "reportError", "service"];
+export declare const PLUGIN_API_METHODS: readonly ["start", "deliver", "playersChanged", "authorityChanged", "configChanged", "clockChanged", "sessionEnded"];

package/dist/types.cjs

@@ -1 +1 @@
-var e=`board`,t=`server`,n=[`hello`,`ready`,`send`,`saveSnapshot`,`recordAnswer`,`saveProgress`,`saveData`,`updateSettings`,`getAsset`,`end`,`resize`,`reportError`,`exit`,`service`],r=[`start`,`deliver`,`playersChanged`,`authorityChanged`,`setChanged`,`configChanged`,`clockChanged`,`sessionEnded`];exports.BOARD_ADDRESS=e,exports.HOST_API_METHODS=n,exports.PLUGIN_API_METHODS=r,exports.SERVER_ADDRESS=t;
+var e=`board`,t=`server`,n=`settings`,r=[`hello`,`ready`,`send`,`saveSnapshot`,`recordAnswer`,`saveData`,`updateSettings`,`getAsset`,`end`,`reportError`,`service`],i=[`start`,`deliver`,`playersChanged`,`authorityChanged`,`configChanged`,`clockChanged`,`sessionEnded`];exports.BOARD_ADDRESS=e,exports.HOST_API_METHODS=r,exports.PLUGIN_API_METHODS=i,exports.SERVER_ADDRESS=t,exports.SETTINGS_ADDRESS=n;

package/dist/types.js

@@ -1,28 +1,24 @@
 //#region src/types.ts
-var e = "board", t = "server", n = [
+var e = "board", t = "server", n = "settings", r = [
 	"hello",
 	"ready",
 	"send",
 	"saveSnapshot",
 	"recordAnswer",
-	"saveProgress",
 	"saveData",
 	"updateSettings",
 	"getAsset",
 	"end",
-	"resize",
 	"reportError",
-	"exit",
 	"service"
-], r = [
+], i = [
 	"start",
 	"deliver",
 	"playersChanged",
 	"authorityChanged",
-	"setChanged",
 	"configChanged",
 	"clockChanged",
 	"sessionEnded"
 ];
 //#endregion
-export { e as BOARD_ADDRESS, n as HOST_API_METHODS, r as PLUGIN_API_METHODS, t as SERVER_ADDRESS };
+export { e as BOARD_ADDRESS, r as HOST_API_METHODS, i as PLUGIN_API_METHODS, t as SERVER_ADDRESS, n as SETTINGS_ADDRESS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memizy/protocol",
-  "version": "1.0.0-rc.5",
+  "version": "1.0.0-rc.6",
   "description": "Memizy Plugin Protocol: types, Zod schemas and helpers shared by @memizy/plugin-sdk and @memizy/host-sdk.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -12,21 +12,29 @@
       "types": "./dist/src/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./internal": {
+      "types": "./dist/src/internal.d.ts",
+      "import": "./dist/internal.js",
+      "require": "./dist/internal.cjs"
     }
   },
   "files": [
     "dist",
     "SPEC.md",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "scripts": {
-    "build": "tsc --noEmit && vite build",
+    "build": "tsc --noEmit && vite build && node ../../scripts/dts-extensions.mjs dist",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@memizy/oqse": "^1.0.0-rc.5",
+    "@memizy/oqse": "^1.0.0-rc.6",
     "zod": "^4.3.6"
   },
   "devDependencies": {