@rydr/game-sdk 3.8.0 → 3.9.0

package/README.md

@@ -309,9 +309,7 @@ await session.deleteContent("levels", "old");
 
 > **Drafts are your data, not a platform flag.** `saveContent` takes no `draft` argument — a doc's draft/published state is just a field in the content you store (`{ draft: true, … }`). Your editor writes it; your game and lobby read it and hide drafts from non-admins (admins keep seeing them via the same `isAdmin`).
 
-> **Security boundary.** `ADMIN_SECRET` is the platform owner's key — full write to **any** game's shared content. It lives only in the shell, is **never shipped to a game or guest**, and is never entered into editor code. Player-generated content uses the `public` owner-write scope (`saveData(..., { scope: "public" })`), not admin auth.
-
-> **`createAdminContentBackend` is not for games.** The SDK exports a low-level Bearer client (`createAdminContentBackend`) for the **platform owner's own** out-of-band tooling — a first-party admin console on the shell's origin, a seed/migration script — code that legitimately holds the secret. It is **never** bundled into a game or a game's editor. If you're in a game, use the session.
+> **Security boundary.** A game never authenticates admin writes. `shared`-scope writes are authorized by Supabase RLS on the **signed-in admin's** account (`app_metadata.role === 'admin'`); the shell performs them on behalf of the logged-in admin. No credential is ever shipped to a game or guest or entered into editor code. Player-generated content uses the `public` owner-write scope (`saveData(..., { scope: "public" })`), not admin auth.
 
 ### Shared worlds
 

package/dist/client/index.d.ts

@@ -3,5 +3,4 @@ export * from "./HardwareStore.js";
 export * from "./PlatformClient.js";
 export * from "./replayCodec.js";
 export * from "./Room.js";
-export * from "./adminContent.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC"}

package/dist/client/index.js

@@ -3,5 +3,4 @@ export * from "./HardwareStore.js";
 export * from "./PlatformClient.js";
 export * from "./replayCodec.js";
 export * from "./Room.js";
-export * from "./adminContent.js";
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC"}

package/dist/protocol/version.d.ts

@@ -9,5 +9,5 @@
 export declare const RYDR_PROTOCOL_VERSION: 14;
 /** Semver of this SDK build. Sent in the handshake for telemetry/debugging.
  *  (Bumped to 2.0.0 by `npm version major` on release — see CHANGELOG [Unreleased].) */
-export declare const RYDR_SDK_VERSION = "3.8.0";
+export declare const RYDR_SDK_VERSION = "3.9.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/protocol/version.js

@@ -43,5 +43,5 @@
 export const RYDR_PROTOCOL_VERSION = 14;
 /** Semver of this SDK build. Sent in the handshake for telemetry/debugging.
  *  (Bumped to 2.0.0 by `npm version major` on release — see CHANGELOG [Unreleased].) */
-export const RYDR_SDK_VERSION = "3.8.0";
+export const RYDR_SDK_VERSION = "3.9.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rydr/game-sdk",
-  "version": "3.8.0",
+  "version": "3.9.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/bdefrenne/rydr-game-sdk.git"

package/dist/client/adminContent.d.ts

@@ -1,66 +0,0 @@
-/**
- * Admin content backend — a low-level Bearer client for `shared` gamedata,
- * intended for the **platform owner's own** out-of-band tooling: a first-party
- * admin console on the shell's origin, a seed/migration script, CI. Code that
- * legitimately holds the `ADMIN_SECRET`.
- *
- * NOT for games or their editors. A game — and a game's editor, which is just
- * another guest the shell loads — never holds the secret. An editor is opened
- * inside the shell, gates on `session.identity.isAdmin`, and authors through
- * the session (`saveContent` / `deleteContent` / `getUploadUrl`); the shell
- * relays the authenticated write. See the "Build an in-game editor" guide in
- * the README. If you reach for this from inside a game you've broken the
- * security boundary — use the session instead.
- *
- * This factory wraps the generic gamedata party's HTTP contract for one
- * `gameId` so owner tooling doesn't hand-roll `fetch` + headers:
- *
- *   - read  (public):   `GET    {host}/parties/gamedata/{gameId}/shared/{collection}[/{id}]`
- *   - write (Bearer):   `PUT    …/shared/{collection}/{id}`   body `{ data, draft? }`
- *   - delete(Bearer):   `DELETE …/shared/{collection}/{id}`
- *   - asset (Bearer):   `POST   …/{gameId}/asset/upload-url` → presigned R2 PUT
- *
- * SECURITY: `ADMIN_SECRET` is the platform owner's key (full write to any
- * game's shared content). Authoring-time only, entered at runtime, never
- * shipped to players and never bundled into a game or guest. Player-generated
- * content uses the SDK's public owner-write scope instead, not this backend.
- */
-import type { GameDoc } from "../protocol/gamedata.js";
-/** Bytes accepted by {@link AdminContentBackend.uploadAsset}. */
-export type AssetBody = Blob | ArrayBuffer | ArrayBufferView;
-export interface AdminContentBackend {
-    /** List all docs in a shared collection (includes drafts — Bearer is sent). */
-    list(collection: string): Promise<GameDoc[]>;
-    /** Fetch one shared doc, or `null` if it doesn't exist. */
-    get(collection: string, id: string): Promise<GameDoc | null>;
-    /** Create/overwrite a shared doc. `draft: true` hides it from the public (player) read until published. */
-    save(collection: string, id: string, value: unknown, opts?: {
-        draft?: boolean;
-    }): Promise<void>;
-    /** Delete a shared doc. */
-    remove(collection: string, id: string): Promise<void>;
-    /** Upload a binary asset to R2 and return its public URL (store it in a doc via {@link save}). */
-    uploadAsset(opts: {
-        collection: string;
-        filename: string;
-        contentType?: string;
-        body: AssetBody;
-    }): Promise<{
-        url: string;
-    }>;
-}
-export interface AdminContentOptions {
-    /** Platform origin (no trailing slash), e.g. `https://my-game.partykit.dev` or `http://localhost:1999`. */
-    host: string;
-    /** The game's stable id (slug), matching its platform manifest. */
-    gameId: string;
-    /** Returns the `ADMIN_SECRET` at call time (e.g. from `sessionStorage`). Read per-request so a re-entered secret takes effect. */
-    getSecret: () => string;
-}
-/**
- * Build an {@link AdminContentBackend} for one game. Pure factory — no network
- * until a method is called. Every request carries the Bearer secret so the
- * editor can see drafts and perform writes.
- */
-export declare function createAdminContentBackend(opts: AdminContentOptions): AdminContentBackend;
-//# sourceMappingURL=adminContent.d.ts.map

package/dist/client/adminContent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adminContent.d.ts","sourceRoot":"","sources":["../../src/client/adminContent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,iEAAiE;AACjE,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,eAAe,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,2DAA2D;IAC3D,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC7D,2GAA2G;IAC3G,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,2BAA2B;IAC3B,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,kGAAkG;IAClG,WAAW,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9H;AAED,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,kIAAkI;IAClI,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,CAkDxF"}

package/dist/client/adminContent.js

@@ -1,79 +0,0 @@
-/**
- * Admin content backend — a low-level Bearer client for `shared` gamedata,
- * intended for the **platform owner's own** out-of-band tooling: a first-party
- * admin console on the shell's origin, a seed/migration script, CI. Code that
- * legitimately holds the `ADMIN_SECRET`.
- *
- * NOT for games or their editors. A game — and a game's editor, which is just
- * another guest the shell loads — never holds the secret. An editor is opened
- * inside the shell, gates on `session.identity.isAdmin`, and authors through
- * the session (`saveContent` / `deleteContent` / `getUploadUrl`); the shell
- * relays the authenticated write. See the "Build an in-game editor" guide in
- * the README. If you reach for this from inside a game you've broken the
- * security boundary — use the session instead.
- *
- * This factory wraps the generic gamedata party's HTTP contract for one
- * `gameId` so owner tooling doesn't hand-roll `fetch` + headers:
- *
- *   - read  (public):   `GET    {host}/parties/gamedata/{gameId}/shared/{collection}[/{id}]`
- *   - write (Bearer):   `PUT    …/shared/{collection}/{id}`   body `{ data, draft? }`
- *   - delete(Bearer):   `DELETE …/shared/{collection}/{id}`
- *   - asset (Bearer):   `POST   …/{gameId}/asset/upload-url` → presigned R2 PUT
- *
- * SECURITY: `ADMIN_SECRET` is the platform owner's key (full write to any
- * game's shared content). Authoring-time only, entered at runtime, never
- * shipped to players and never bundled into a game or guest. Player-generated
- * content uses the SDK's public owner-write scope instead, not this backend.
- */
-/**
- * Build an {@link AdminContentBackend} for one game. Pure factory — no network
- * until a method is called. Every request carries the Bearer secret so the
- * editor can see drafts and perform writes.
- */
-export function createAdminContentBackend(opts) {
-    const base = `${opts.host.replace(/\/$/, "")}/parties/gamedata/${opts.gameId}`;
-    // Encode collection + id path segments so reserved chars (`:` `/` `@` …) survive
-    // the round-trip; the gamedata party decodes them. Mirrors the shell's GameDataService.
-    const enc = encodeURIComponent;
-    const authHeaders = () => ({ Authorization: `Bearer ${opts.getSecret()}` });
-    async function req(method, url, body) {
-        const res = await fetch(url, {
-            method,
-            headers: { ...authHeaders(), ...(body !== undefined ? { "Content-Type": "application/json" } : {}) },
-            body: body !== undefined ? JSON.stringify(body) : undefined,
-        });
-        if (!res.ok) {
-            const detail = await res.text().catch(() => "");
-            throw new Error(`[rydr-admin] ${method} ${url} → ${res.status} ${detail}`);
-        }
-        return (await res.json());
-    }
-    return {
-        async list(collection) {
-            const r = await req("GET", `${base}/shared/${enc(collection)}`);
-            return r.docs ?? [];
-        },
-        async get(collection, id) {
-            const r = await req("GET", `${base}/shared/${enc(collection)}/${enc(id)}`);
-            return r.doc ?? null;
-        },
-        async save(collection, id, value, saveOpts) {
-            await req("PUT", `${base}/shared/${enc(collection)}/${enc(id)}`, { data: value, draft: saveOpts?.draft });
-        },
-        async remove(collection, id) {
-            await req("DELETE", `${base}/shared/${enc(collection)}/${enc(id)}`);
-        },
-        async uploadAsset({ collection, filename, contentType, body }) {
-            const { uploadUrl, url } = await req("POST", `${base}/asset/upload-url`, { collection, filename });
-            const put = await fetch(uploadUrl, {
-                method: "PUT",
-                headers: contentType ? { "Content-Type": contentType } : {},
-                body: body,
-            });
-            if (!put.ok)
-                throw new Error(`[rydr-admin] asset PUT → ${put.status}`);
-            return { url };
-        },
-    };
-}
-//# sourceMappingURL=adminContent.js.map

package/dist/client/adminContent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adminContent.js","sourceRoot":"","sources":["../../src/client/adminContent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA6BH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,iFAAiF;IACjF,wFAAwF;IACxF,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC/B,MAAM,WAAW,GAAG,GAA2B,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEpG,KAAK,UAAU,GAAG,CAAI,MAAc,EAAE,GAAW,EAAE,IAAc;QAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpG,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAuB,KAAK,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,MAAM,GAAG,CAA2B,KAAK,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ;YACxC,MAAM,GAAG,CAAe,KAAK,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE;YACzB,MAAM,GAAG,CAAe,QAAQ,EAAE,GAAG,IAAI,WAAW,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;YAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAClC,MAAM,EACN,GAAG,IAAI,mBAAmB,EAC1B,EAAE,UAAU,EAAE,QAAQ,EAAE,CACzB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBACjC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC3D,IAAI,EAAE,IAAgB;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}