@series-inc/rundot-syncplay 5.23.0 → 5.24.0-beta.1

package/README.md

@@ -8,18 +8,49 @@ rollback — with no game-specific server logic.
 This package is intentionally standalone. It does not depend on Venus MP,
 Cloud Run, React Three Fiber, Rapier, Firebase, or the SDK bridge.
 
-## Preview Status
-
-This is a headless engine and certification package. It is designed to prove
-deterministic simulation behavior from the CLI before renderer integration is
-added, and to hand deploy-check artifacts to Venus backend upload/room-server
-validation when a room bundle opts in.
-
-Production matchmaking, ticket UX, client connection flows, and R3F renderer
-proof are not part of this package yet. The current production-facing Venus MP
-changes validate uploaded deterministic room proof metadata and pass normalized
-proof into room startup; they do not add new matchmaking or client connection
-semantics.
+## Public and private projections
+
+The deterministic session remains a shared public projection: every client
+applies the same confirmed inputs and authority commands. Optional secret
+systems add a separate authority-owned projection for simultaneous choices,
+cryptographic random draws, decks, bags, and roles. Private values go only to
+their owners; signed public consequences join exactly one confirmed frame and
+therefore survive rollback, replay, reconnect, and match-log verification.
+
+The RUN room authority is trusted and can see secret values. SHA-256
+commitments, hash chains, Merkle proofs, and Ed25519 receipts prevent peers or
+tampered logs from forging outcomes; they do not hide a player's own values
+from that player's browser or make the authority zero-knowledge. Public donated
+snapshots remain secret-free, while server-only secret state restores against a
+cryptographic configuration hash.
+
+## BETA Status
+
+The standalone engine, certification CLI, curated public entrypoints, SDK bridge,
+generic input authority, replay verification, and hosted multiplayer path are in
+active development. Syncplay has not gone live. Package publication, production
+rollout, and 1.0 graduation are separate release decisions; this build remains
+explicitly BETA.
+
+## State Ownership Contract
+
+`step` must not mutate the state object it receives or anything reachable from
+it. Copy every array, map, set, typed array, or object before modifying it.
+Sharing unmodified structure with the prior state is expected, and returning the
+same state unchanged is legal.
+
+Syncplay retains each returned state object in the snapshot ring by reference
+and hands it back on rollback without copying. This makes snapshot and restore
+O(1); violating the contract corrupts rollback history. Run
+`runSyncplaySynctest` in CI: its `aliasing`, `hydration`, and `codec` phases catch
+mutation, normalization-dependent behavior, and lossy codecs.
+
+For large, slowly changing state, keep an incremental running hash in immutable
+state and expose it through `config.checksum`. Recorded checksums can then be
+O(1) and interval-gated. Wire snapshots still serialize and checksum full state
+on demand; never treat `config.checksum` as the late-join checksum. See
+[`docs/syncplay-state-contract.md`](../../docs/syncplay-state-contract.md) for
+the worked pattern and validation-latency tradeoff.
 
 ## Testing
 
@@ -537,6 +568,16 @@ remediation text. Valid suppressions must use
 `// rdm-ignore-next-line <rule-id>: <reason>` and are reported with file, line,
 rule, and reason; invalid suppressions are errors.
 
+`static:determinism` with explicit paths (`--entry`, `--paths`) follows the
+import graph transitively by default (`--no-follow-imports` opts out); the
+JSON artifact records `requestedPaths` (CLI inputs), `checkedPaths` (files
+actually checked, post-traversal), `followImports`, and `unresolvedImports`
+(relative imports that resolve to no file — unchecked holes). Bare package
+specifiers are never followed; if your simulation uses tsconfig path aliases,
+pass `--project tsconfig.json` so aliased imports resolve and get checked —
+without it they are skipped like package imports. Package self-certification
+(no explicit paths) checks its curated source list without following imports.
+
 The checker covers host random/time, timers, async simulation work, I/O,
 unordered object iteration, random sort comparators, render-object mutation,
 uncertified physics stepping, and descriptor-declared state-field access.

package/dist/authority-room.d.ts

@@ -1,5 +1,8 @@
 import { type ConfirmedInputFrame, type EncodedInput } from './input-authority.js';
 import type { SyncplayMatchLog } from './match-log.js';
+import { type SyncplaySecretAuthoritySnapshot } from './secret-authority.js';
+import type { SyncplaySecretAuthorityCrypto } from './secret-crypto.js';
+import type { SyncplaySecretSystemsConfig } from './secret-config.js';
 /**
  * Transport-agnostic, game-agnostic deterministic authority room (§6 M2).
  *
@@ -89,6 +92,10 @@ export interface DeterministicAuthorityRoomConfig {
      * MUST call `resyncSeatedPlayers()` so surviving clients re-seat.
      */
     readonly restoreFrom?: DeterministicAuthorityRoomRestoreState;
+    readonly authorityId?: string;
+    readonly secrets?: SyncplaySecretSystemsConfig;
+    readonly secretCrypto?: SyncplaySecretAuthorityCrypto;
+    readonly secretMsgType?: string;
 }
 export interface DeterministicAuthorityRoomRestoreState {
     readonly now: number;
@@ -98,6 +105,7 @@ export interface DeterministicAuthorityRoomRestoreState {
     readonly tail: readonly ConfirmedInputFrame[];
     readonly snapshotBytes?: string;
     readonly schemaHash?: string;
+    readonly secretState?: SyncplaySecretAuthoritySnapshot;
 }
 export interface AuthorityRoomCatchUpEvent {
     readonly playerId: string;
@@ -178,6 +186,7 @@ export interface DeterministicAuthorityRoom {
     /** Seat a read-only spectator (G11): role 'spectator', no slot, full catch-up + live follow. */
     onSpectatorJoin(playerId: string): boolean;
     onPlayerMessage(playerId: string, envelope: string): void;
+    onPlayerSecretMessage(playerId: string, envelope: string): void;
     onPlayerLeave(playerId: string): void;
     /**
      * A player's transport re-attached inside the host's grace window (socket
@@ -213,5 +222,7 @@ export interface DeterministicAuthorityRoom {
      * `preserveFullHistory`, or the match outlived `historyRetentionTicks`).
      */
     matchLog(): SyncplayMatchLog | undefined;
+    /** Server-only secret state. Never include this value in public snapshots or match logs. */
+    secretSnapshot(): SyncplaySecretAuthoritySnapshot | undefined;
 }
 export declare function createDeterministicAuthorityRoom(transport: AuthorityRoomTransport, config: DeterministicAuthorityRoomConfig): DeterministicAuthorityRoom;

package/dist/authority-room.js

@@ -4,7 +4,9 @@ import { createInputAuthority } from './input-authority.js';
 import { createDeterministicLocalAuthoritySnapshotChunkEnvelope, createDeterministicLocalAuthoritySnapshotCompleteEnvelope, createDeterministicLocalAuthoritySnapshotOfferEnvelope, createDeterministicLocalAuthoritySnapshotRequestEnvelope, decodeDeterministicLocalAuthorityWireEnvelope, } from './local-authority-wire.js';
 import { DEFAULT_SNAPSHOT_CHUNK_SIZE, createSnapshotTransferCollector, createSnapshotTransferFromBytes, decodeDeterministicStateSnapshot, deterministicRoomDescriptorHash, } from './session-snapshot.js';
 import { decodeDeterministicSessionMessage, encodeDeterministicSessionMessage } from './session-wire.js';
+import { createSyncplaySecretAuthority, } from './secret-authority.js';
 const DEFAULT_SESSION_MSG_TYPE = 'rdm';
+const DEFAULT_SECRET_MSG_TYPE = 'rdm-secret';
 /** One hour at 60 Hz — see DeterministicAuthorityRoomConfig.historyRetentionTicks. */
 const DEFAULT_HISTORY_RETENTION_TICKS = 216_000;
 /** Frames per history-replay unicast. Bounds message size during catch-up. */
@@ -48,6 +50,18 @@ export function createDeterministicAuthorityRoom(transport, config) {
     // colliding with a still-present player and orphaning the vacated slot.
     let assignedSlots = 0;
     let now = -1;
+    const secretAuthority = config.secrets === undefined
+        ? undefined
+        : createSyncplaySecretAuthority({
+            authorityId: requireSecretAuthorityId(config.authorityId),
+            playerCount: config.playerCount,
+            config: config.secrets,
+            crypto: requireSecretCrypto(config.secretCrypto),
+            sendPrivate(playerId, encoded) {
+                transport.sendTo(playerId, config.secretMsgType ?? DEFAULT_SECRET_MSG_TYPE, encoded);
+            },
+            ...(config.restoreFrom?.secretState === undefined ? {} : { restoreFrom: config.restoreFrom.secretState }),
+        });
     // M5.5 snapshot acquisition state. The authority stores at most one validated
     // snapshot and runs at most one donor transfer at a time.
     const snapshotCadenceTicks = config.snapshotCadenceTicks ?? DEFAULT_SNAPSHOT_CADENCE_TICKS;
@@ -227,6 +241,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
             const plan = catchUpPlan();
             invariant(plan !== 'unavailable', 'a restored room must have a catch-up plan for seated players', 'authority-room.restore-catchup');
             sendSessionStart(playerId, slot);
+            secretAuthority?.onPlayerReconnected(playerId, slot);
             sendCatchUpTo(playerId, plan, 'resync');
         }
     }
@@ -246,6 +261,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
             }
             slotByPlayer.set(playerId, formerSlot);
             sendSessionStart(playerId, formerSlot);
+            secretAuthority?.onPlayerReconnected(playerId, formerSlot);
             sendCatchUpTo(playerId, rejoinPlan, 'rejoin');
             return { accepted: true, slot: formerSlot, rejoined: true };
         }
@@ -264,6 +280,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
         slotByPlayer.set(playerId, slot);
         everSlotByPlayer.set(playerId, slot);
         sendSessionStart(playerId, slot);
+        secretAuthority?.onPlayerJoined(playerId, slot);
         sendCatchUpTo(playerId, plan, 'join');
         return { accepted: true, slot };
     }
@@ -283,6 +300,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
             return false;
         spectators.add(playerId);
         sendSessionStart(playerId, -1, 'spectator');
+        secretAuthority?.onSpectatorJoined(playerId);
         sendCatchUpTo(playerId, plan, 'join');
         return true;
     }
@@ -309,8 +327,14 @@ export function createDeterministicAuthorityRoom(transport, config) {
         // client that fell behind the snapshot tick, so the stored snapshot rides
         // along — the client applies it only when it is ahead of its own state.
         const reconnectPlan = !historyReachesTickZero() && storedSnapshot !== undefined ? 'snapshot' : 'history';
+        secretAuthority?.onPlayerReconnected(playerId, slot);
         sendCatchUpTo(playerId, reconnectPlan, 'reconnect');
     }
+    function onPlayerSecretMessage(playerId, envelope) {
+        if (secretAuthority === undefined)
+            return;
+        secretAuthority.onPlayerRequest(playerId, slotByPlayer.get(playerId) ?? -1, envelope);
+    }
     function onPlayerMessage(playerId, envelope) {
         // Fail closed: unknown/malformed messages are dropped. Snapshot transfer
         // envelopes are the OTHER frozen wire family (schemaVersion vs v field) —
@@ -571,7 +595,10 @@ export function createDeterministicAuthorityRoom(transport, config) {
         // Fixed roster for v1 (late-join/reconnect is M5). Dropping the mapping stops accepting the
         // departed player's input; their slot stays reserved because `assignedSlots` never decreases,
         // so the authority substitutes for it rather than handing the number to a new joiner.
+        const slot = slotByPlayer.get(playerId);
         slotByPlayer.delete(playerId);
+        if (slot !== undefined)
+            secretAuthority?.onPlayerLeft(playerId, slot);
         if (pendingTransfer?.donorId === playerId) {
             failPendingTransfer('snapshot-donor-left');
         }
@@ -586,6 +613,9 @@ export function createDeterministicAuthorityRoom(transport, config) {
             return;
         }
         now += 1;
+        for (const command of secretAuthority?.onTick(now, [...slotByPlayer.values()]) ?? []) {
+            authority.queueCommand(now, command);
+        }
         authority.advance(now);
         maintainSnapshotAcquisition();
         if (authority.confirmedThrough < 0) {
@@ -636,6 +666,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
         onPlayerJoin,
         onSpectatorJoin,
         onPlayerMessage,
+        onPlayerSecretMessage,
         onPlayerLeave,
         onPlayerReconnected,
         onTick,
@@ -672,6 +703,7 @@ export function createDeterministicAuthorityRoom(transport, config) {
             if (plan === 'unavailable')
                 return false;
             sendSessionStart(playerId, slot);
+            secretAuthority?.onPlayerReconnected(playerId, slot);
             sendCatchUpTo(playerId, plan, 'resync');
             return true;
         },
@@ -697,5 +729,16 @@ export function createDeterministicAuthorityRoom(transport, config) {
                 frames: authority.confirmedFrameRange(0, authority.confirmedThrough),
             };
         },
+        secretSnapshot() {
+            return secretAuthority?.snapshot();
+        },
     };
 }
+function requireSecretAuthorityId(authorityId) {
+    invariant(typeof authorityId === 'string' && authorityId.length > 0, 'secret authorityId is required', 'authority-room.secret-authority-id');
+    return authorityId;
+}
+function requireSecretCrypto(crypto) {
+    invariant(crypto !== undefined, 'secret signing is unavailable', 'authority-room.secret-signing');
+    return crypto;
+}

package/dist/browser.d.ts

@@ -30,6 +30,7 @@ export { createOfflineSession } from './offline-session.js';
 export { createPauseController } from './pause-resume.js';
 export { circleCastDeterministicPhysics2D, createDeterministicPhysicsWorld2D, nearestDeterministicPhysicsHit2D, queryDeterministicPhysicsAabb2D, queryDeterministicPhysicsShapeOverlap2D, raycastAllDeterministicPhysics2D, raycastDeterministicPhysics2D, stepDeterministicPhysicsWorld2D } from './physics2d.js';
 export { applyDeterministicImpulse3D, applyDeterministicImpulses3D, contactDetailsDeterministicPhysics3D, createDeterministicPhysicsWorld3D, deriveInverseInertia, deterministicPhysicsBodyById3D, deterministicPhysicsCallback3D, overlapDeterministicPhysics3D, raycastDeterministicPhysics3D, raycastDeterministicPhysics3DDetailed, runDeterministicPhysics3DStress, setDeterministicBodyVelocity3D, shapeCastDeterministicPhysics3D, shapeCastDeterministicPhysics3DDetailed, stepDeterministicPhysicsWorld3D } from './physics3d.js';
+export { stepDeterministicVehicle3D } from './physics3d-vehicle.js';
 export { createDeterministicR3fRenderAdapter as createDeterministicR3fAdapter, createDeterministicR3fRenderAdapter, interpolateDeterministicRenderNumber, interpolateDeterministicRenderVec2 } from './r3f-render-adapter.js';
 export { verifyReplayWithDescriptor as verifyDeterministicReplay, verifyReplay } from './replay.js';
 export { createDeterministicReplayBundle, createDeterministicReplayDebugTables, createDeterministicReplayRuntimeManifest, minimizeDeterministicReplayDesync, minimizeDeterministicReplayDesyncBundle, sliceDeterministicReplayBundle, verifyDeterministicFrameRuntimeReplayBundle, verifyDeterministicReplayBundle, verifyDeterministicSelfContainedFrameRuntimeReplayBundle, verifyReplayScoreAgainstTrustedRuntime } from './replay-bundle.js';
@@ -74,7 +75,9 @@ export type { CookedDeterministicNavmesh, DeterministicNavmeshAgent, Determinist
 export type { NetworkedClientTransport, NetworkedSyncplayClient, NetworkedSyncplayClientInputDelayOptions, NetworkedSyncplayClientNetStats, NetworkedSyncplayClientOptions, NetworkedSyncplayClientPacingOptions } from './networked-client.js';
 export type { DeterministicPauseController, DeterministicPauseState, DeterministicPauseStatus, PauseControllerOptions, PauseWrappedState } from './pause-resume.js';
 export type { DeterministicBodyKind, DeterministicContactEvent2D, DeterministicContactEventType, DeterministicPhysicsAabbQuery2D, DeterministicPhysicsActivePair2D, DeterministicPhysicsBody2D, DeterministicPhysicsCircleCastQuery2D, DeterministicPhysicsConstraint2D, DeterministicPhysicsHit2D, DeterministicPhysicsQueryOptions2D, DeterministicPhysicsRaycastQuery2D, DeterministicPhysicsShape2D, DeterministicPhysicsShapeOverlapQuery2D, DeterministicPhysicsStepOptions2D, DeterministicPhysicsStepResult2D, DeterministicPhysicsWorld2D } from './physics2d.js';
-export type { DeterministicContactCacheEntry3D, DeterministicJointCacheEntry3D, DeterministicPhysicsActivePair3D, DeterministicPhysicsAxisLock3D, DeterministicPhysicsBody3D, DeterministicPhysicsCallbackMask3D, DeterministicPhysicsCompoundChild3D, DeterministicPhysicsConstraint3D, DeterministicPhysicsContactDetail3D, DeterministicPhysicsContactEvent3D, DeterministicPhysicsDetailedHit3D, DeterministicPhysicsHit3D, DeterministicPhysicsImpulseApplication3D, DeterministicPhysicsOverlapQuery3D, DeterministicPhysicsPrimitiveShape3D, DeterministicPhysicsQuaternion3D, DeterministicPhysicsQueryOptions3D, DeterministicPhysicsRaycastQuery3D, DeterministicPhysicsScheduledQuery3D, DeterministicPhysicsShape3D, DeterministicPhysicsShapeCastQuery3D, DeterministicPhysicsStepResult3D, DeterministicPhysicsVec3, DeterministicPhysicsWorld3D } from './physics3d.js';
+export type { DeterministicContactCacheEntry3D, DeterministicJointCacheEntry3D, DeterministicPhysicsActivePair3D, DeterministicPhysicsAxisLock3D, DeterministicPhysicsBody3D, DeterministicPhysicsCallbackMask3D, DeterministicPhysicsCompoundChild3D, DeterministicPhysicsCompoundChildShape3D, DeterministicPhysicsConstraint3D, DeterministicPhysicsContactDetail3D, DeterministicPhysicsContactEvent3D, DeterministicPhysicsDetailedHit3D, DeterministicPhysicsHit3D, DeterministicPhysicsHullShape3D, DeterministicPhysicsImpulseApplication3D, DeterministicPhysicsOverlapQuery3D, DeterministicPhysicsPrimitiveShape3D, DeterministicPhysicsQuaternion3D, DeterministicPhysicsQueryOptions3D, DeterministicPhysicsRaycastQuery3D, DeterministicPhysicsScheduledQuery3D, DeterministicPhysicsShape3D, DeterministicPhysicsShapeCastQuery3D, DeterministicPhysicsStepResult3D, DeterministicPhysicsVec3, DeterministicPhysicsWorld3D } from './physics3d.js';
+export type { DeterministicPhysicsJoint3D } from './physics3d-joints.js';
+export type { DeterministicVehicle3D, DeterministicVehicleImpulse3D, DeterministicVehicleInput3D, DeterministicVehicleStepOptions3D, DeterministicVehicleStepResult3D, DeterministicVehicleWheel3D, DeterministicVehicleWheelTelemetry3D } from './physics3d-vehicle.js';
 export type { DeterministicFrameRuntimeReplayBundleOptions, DeterministicFrameRuntimeReplayBundleVerification, DeterministicReplayBundle, DeterministicReplayBundleMismatch, DeterministicReplayBundleVerification, DeterministicReplayDebugTables, DeterministicReplayDesyncMinimization, DeterministicReplayRuntimeBeforeFrameId, DeterministicReplayRuntimeManifest, DeterministicReplayRuntimeManifestSource, DeterministicReplayRuntimeSystemId, DeterministicReplaySemanticModel, DeterministicReplaySemanticOperation, DeterministicReplaySliceOrigin, DeterministicReplaySnapshot, DeterministicReplayVerificationManifest, ReplayScoreVerificationReason, ReplayScoreVerificationResult } from './replay-bundle.js';
 export type { AssetDescriptor, CollectionOrdering, CommandChannelDescriptor, ConfigDescriptor, DeterministicGameDescriptor, EventDescriptor, InputFieldDescriptor, InputFieldPolicy, NumericMode, PrototypeDescriptor, SchemaFieldDescriptor, SchemaFieldKind, StateFieldDescriptor, SystemDescriptor, ValidatedDeterministicGameDescriptor } from './schema.js';
 export type { DeterministicSchemaArtifacts, SchemaFrameDump } from './schema-artifacts.js';
@@ -87,3 +90,10 @@ export type { DeterministicSignal, DeterministicSignalBus, DeterministicSignalBu
 export type { DeterministicSparseSet, DeterministicSparseSetSnapshot } from './sparse-set.js';
 export type { DeterministicLifecycleCounterSummary, DeterministicLifecycleRunner, DeterministicLifecycleSignal, DeterministicLifecycleSnapshot, DeterministicLifecycleSystemContext, DeterministicLifecycleSystemDescriptor, DeterministicLifecycleSystemHooks } from './system-lifecycle.js';
 export type { DeterministicStep, ReplayFile, ReplayVerificationResult } from './types.js';
+export { syncplaySecretConfigHash, syncplaySecretLimits, validateSyncplaySecretSystemsConfig } from './secret-config.js';
+export { decodeSyncplaySecretPrivateMessage, isSyncplaySecretCommand, syncplaySecretProtocol } from './secret-protocol.js';
+export { createBrowserSyncplaySecretCrypto, verifySyncplaySignedReceipt } from './secret-crypto.js';
+export { createSyncplaySecretEventReader, createSyncplaySecretsClient } from './secret-client.js';
+export type { SyncplaySecretSystemDefinition, SyncplaySecretSystemsConfig } from './secret-config.js';
+export type { SyncplayOwnedSecretToken, SyncplaySecretCommand, SyncplaySecretErrorCode, SyncplaySecretPrivateMessage, SyncplaySignedReceipt } from './secret-protocol.js';
+export type { SyncplayChoiceClient, SyncplayChoiceResolvedEvent, SyncplayCollectionClient, SyncplayCollectionRevealedEvent, SyncplayOwnedSecret, SyncplayRandomClient, SyncplayRandomDrawnEvent, SyncplayRoleClient, SyncplayRoleRevealedEvent, SyncplaySecretEventReader, SyncplaySecretsClient } from './secret-client.js';

package/dist/browser.js

@@ -31,6 +31,7 @@ export { createOfflineSession } from './offline-session.js';
 export { createPauseController } from './pause-resume.js';
 export { circleCastDeterministicPhysics2D, createDeterministicPhysicsWorld2D, nearestDeterministicPhysicsHit2D, queryDeterministicPhysicsAabb2D, queryDeterministicPhysicsShapeOverlap2D, raycastAllDeterministicPhysics2D, raycastDeterministicPhysics2D, stepDeterministicPhysicsWorld2D } from './physics2d.js';
 export { applyDeterministicImpulse3D, applyDeterministicImpulses3D, contactDetailsDeterministicPhysics3D, createDeterministicPhysicsWorld3D, deriveInverseInertia, deterministicPhysicsBodyById3D, deterministicPhysicsCallback3D, overlapDeterministicPhysics3D, raycastDeterministicPhysics3D, raycastDeterministicPhysics3DDetailed, runDeterministicPhysics3DStress, setDeterministicBodyVelocity3D, shapeCastDeterministicPhysics3D, shapeCastDeterministicPhysics3DDetailed, stepDeterministicPhysicsWorld3D } from './physics3d.js';
+export { stepDeterministicVehicle3D } from './physics3d-vehicle.js';
 export { createDeterministicR3fRenderAdapter as createDeterministicR3fAdapter, createDeterministicR3fRenderAdapter, interpolateDeterministicRenderNumber, interpolateDeterministicRenderVec2 } from './r3f-render-adapter.js';
 export { verifyReplayWithDescriptor as verifyDeterministicReplay, verifyReplay } from './replay.js';
 export { createDeterministicReplayBundle, createDeterministicReplayDebugTables, createDeterministicReplayRuntimeManifest, minimizeDeterministicReplayDesync, minimizeDeterministicReplayDesyncBundle, sliceDeterministicReplayBundle, verifyDeterministicFrameRuntimeReplayBundle, verifyDeterministicReplayBundle, verifyDeterministicSelfContainedFrameRuntimeReplayBundle, verifyReplayScoreAgainstTrustedRuntime } from './replay-bundle.js';
@@ -46,3 +47,7 @@ export { decodeDeterministicSessionMessage, deterministicSessionWireVersion, enc
 export { createDeterministicSignalBus } from './signals.js';
 export { createDeterministicSparseSet } from './sparse-set.js';
 export { createDeterministicLifecycleRunner, summarizeDeterministicLifecycleCounters } from './system-lifecycle.js';
+export { syncplaySecretConfigHash, syncplaySecretLimits, validateSyncplaySecretSystemsConfig } from './secret-config.js';
+export { decodeSyncplaySecretPrivateMessage, isSyncplaySecretCommand, syncplaySecretProtocol } from './secret-protocol.js';
+export { createBrowserSyncplaySecretCrypto, verifySyncplaySignedReceipt } from './secret-crypto.js';
+export { createSyncplaySecretEventReader, createSyncplaySecretsClient } from './secret-client.js';

package/dist/checksum-basis.d.ts

@@ -0,0 +1,4 @@
+import type { DeterministicSessionConfig } from './types.js';
+export declare function serializeStateWith<State, Input>(config: DeterministicSessionConfig<State, Input>, state: State): Uint8Array;
+export declare function deserializeStateWith<State, Input>(config: DeterministicSessionConfig<State, Input>, bytes: Uint8Array): State;
+export declare function computeWireStateChecksum<State, Input>(config: DeterministicSessionConfig<State, Input>, state: State): string;

package/dist/checksum-basis.js

@@ -0,0 +1,17 @@
+import { decodeCanonicalBytes, defaultChecksum, encodeCanonicalBytes, } from './canonical.js';
+export function serializeStateWith(config, state) {
+    // Keep this byte-identical to the engine's egress serializer. Some builders
+    // use canonicalizeState for full state while others use a projection.
+    return config.serializeState?.(state)
+        ?? encodeCanonicalBytes((config.canonicalizeState?.(state) ?? state));
+}
+export function deserializeStateWith(config, bytes) {
+    return config.deserializeState?.(bytes) ?? decodeCanonicalBytes(bytes);
+}
+export function computeWireStateChecksum(config, state) {
+    // The wire basis is always the round-tripped state. It deliberately ignores
+    // config.checksum and never checksums canonicalizeState's output directly:
+    // both may be projections that are valid for recorded desync cadence but
+    // cannot verify the full state a late joiner hydrates.
+    return defaultChecksum(deserializeStateWith(config, serializeStateWith(config, state)));
+}

package/dist/cjs/authority-room.js

@@ -7,7 +7,9 @@ const input_authority_js_1 = require("./input-authority.js");
 const local_authority_wire_js_1 = require("./local-authority-wire.js");
 const session_snapshot_js_1 = require("./session-snapshot.js");
 const session_wire_js_1 = require("./session-wire.js");
+const secret_authority_js_1 = require("./secret-authority.js");
 const DEFAULT_SESSION_MSG_TYPE = 'rdm';
+const DEFAULT_SECRET_MSG_TYPE = 'rdm-secret';
 /** One hour at 60 Hz — see DeterministicAuthorityRoomConfig.historyRetentionTicks. */
 const DEFAULT_HISTORY_RETENTION_TICKS = 216_000;
 /** Frames per history-replay unicast. Bounds message size during catch-up. */
@@ -51,6 +53,18 @@ function createDeterministicAuthorityRoom(transport, config) {
     // colliding with a still-present player and orphaning the vacated slot.
     let assignedSlots = 0;
     let now = -1;
+    const secretAuthority = config.secrets === undefined
+        ? undefined
+        : (0, secret_authority_js_1.createSyncplaySecretAuthority)({
+            authorityId: requireSecretAuthorityId(config.authorityId),
+            playerCount: config.playerCount,
+            config: config.secrets,
+            crypto: requireSecretCrypto(config.secretCrypto),
+            sendPrivate(playerId, encoded) {
+                transport.sendTo(playerId, config.secretMsgType ?? DEFAULT_SECRET_MSG_TYPE, encoded);
+            },
+            ...(config.restoreFrom?.secretState === undefined ? {} : { restoreFrom: config.restoreFrom.secretState }),
+        });
     // M5.5 snapshot acquisition state. The authority stores at most one validated
     // snapshot and runs at most one donor transfer at a time.
     const snapshotCadenceTicks = config.snapshotCadenceTicks ?? DEFAULT_SNAPSHOT_CADENCE_TICKS;
@@ -230,6 +244,7 @@ function createDeterministicAuthorityRoom(transport, config) {
             const plan = catchUpPlan();
             (0, errors_js_1.invariant)(plan !== 'unavailable', 'a restored room must have a catch-up plan for seated players', 'authority-room.restore-catchup');
             sendSessionStart(playerId, slot);
+            secretAuthority?.onPlayerReconnected(playerId, slot);
             sendCatchUpTo(playerId, plan, 'resync');
         }
     }
@@ -249,6 +264,7 @@ function createDeterministicAuthorityRoom(transport, config) {
             }
             slotByPlayer.set(playerId, formerSlot);
             sendSessionStart(playerId, formerSlot);
+            secretAuthority?.onPlayerReconnected(playerId, formerSlot);
             sendCatchUpTo(playerId, rejoinPlan, 'rejoin');
             return { accepted: true, slot: formerSlot, rejoined: true };
         }
@@ -267,6 +283,7 @@ function createDeterministicAuthorityRoom(transport, config) {
         slotByPlayer.set(playerId, slot);
         everSlotByPlayer.set(playerId, slot);
         sendSessionStart(playerId, slot);
+        secretAuthority?.onPlayerJoined(playerId, slot);
         sendCatchUpTo(playerId, plan, 'join');
         return { accepted: true, slot };
     }
@@ -286,6 +303,7 @@ function createDeterministicAuthorityRoom(transport, config) {
             return false;
         spectators.add(playerId);
         sendSessionStart(playerId, -1, 'spectator');
+        secretAuthority?.onSpectatorJoined(playerId);
         sendCatchUpTo(playerId, plan, 'join');
         return true;
     }
@@ -312,8 +330,14 @@ function createDeterministicAuthorityRoom(transport, config) {
         // client that fell behind the snapshot tick, so the stored snapshot rides
         // along — the client applies it only when it is ahead of its own state.
         const reconnectPlan = !historyReachesTickZero() && storedSnapshot !== undefined ? 'snapshot' : 'history';
+        secretAuthority?.onPlayerReconnected(playerId, slot);
         sendCatchUpTo(playerId, reconnectPlan, 'reconnect');
     }
+    function onPlayerSecretMessage(playerId, envelope) {
+        if (secretAuthority === undefined)
+            return;
+        secretAuthority.onPlayerRequest(playerId, slotByPlayer.get(playerId) ?? -1, envelope);
+    }
     function onPlayerMessage(playerId, envelope) {
         // Fail closed: unknown/malformed messages are dropped. Snapshot transfer
         // envelopes are the OTHER frozen wire family (schemaVersion vs v field) —
@@ -574,7 +598,10 @@ function createDeterministicAuthorityRoom(transport, config) {
         // Fixed roster for v1 (late-join/reconnect is M5). Dropping the mapping stops accepting the
         // departed player's input; their slot stays reserved because `assignedSlots` never decreases,
         // so the authority substitutes for it rather than handing the number to a new joiner.
+        const slot = slotByPlayer.get(playerId);
         slotByPlayer.delete(playerId);
+        if (slot !== undefined)
+            secretAuthority?.onPlayerLeft(playerId, slot);
         if (pendingTransfer?.donorId === playerId) {
             failPendingTransfer('snapshot-donor-left');
         }
@@ -589,6 +616,9 @@ function createDeterministicAuthorityRoom(transport, config) {
             return;
         }
         now += 1;
+        for (const command of secretAuthority?.onTick(now, [...slotByPlayer.values()]) ?? []) {
+            authority.queueCommand(now, command);
+        }
         authority.advance(now);
         maintainSnapshotAcquisition();
         if (authority.confirmedThrough < 0) {
@@ -639,6 +669,7 @@ function createDeterministicAuthorityRoom(transport, config) {
         onPlayerJoin,
         onSpectatorJoin,
         onPlayerMessage,
+        onPlayerSecretMessage,
         onPlayerLeave,
         onPlayerReconnected,
         onTick,
@@ -675,6 +706,7 @@ function createDeterministicAuthorityRoom(transport, config) {
             if (plan === 'unavailable')
                 return false;
             sendSessionStart(playerId, slot);
+            secretAuthority?.onPlayerReconnected(playerId, slot);
             sendCatchUpTo(playerId, plan, 'resync');
             return true;
         },
@@ -700,5 +732,16 @@ function createDeterministicAuthorityRoom(transport, config) {
                 frames: authority.confirmedFrameRange(0, authority.confirmedThrough),
             };
         },
+        secretSnapshot() {
+            return secretAuthority?.snapshot();
+        },
     };
 }
+function requireSecretAuthorityId(authorityId) {
+    (0, errors_js_1.invariant)(typeof authorityId === 'string' && authorityId.length > 0, 'secret authorityId is required', 'authority-room.secret-authority-id');
+    return authorityId;
+}
+function requireSecretCrypto(crypto) {
+    (0, errors_js_1.invariant)(crypto !== undefined, 'secret signing is unavailable', 'authority-room.secret-signing');
+    return crypto;
+}

package/dist/cjs/browser.js

@@ -4,8 +4,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sortAabbsByStableId = exports.segmentsIntersect = exports.segmentSegmentDistance = exports.segmentPointDistance = exports.pointOnSegment = exports.orientation = exports.fixedVec2 = exports.fixedCircle = exports.fixedAabb = exports.closestPointOnSegment = exports.circleIntersectsAabb = exports.circleIntersects = exports.aabbIntersects = exports.aabbContainsPoint = exports.stableSortedKeys = exports.stableEntries = exports.deterministicShuffle = exports.createStableIndexedMap = exports.encodeUtf8 = exports.encodeCanonicalBytes = exports.defaultChecksum = exports.decodeUtf8 = exports.decodeCanonicalValue = exports.decodeCanonicalBytes = exports.cloneCanonical = exports.canonicalStringify = exports.canonicalize = exports.tickDeterministicHfsm = exports.tickDeterministicBehaviorTreeWithMemory = exports.tickDeterministicBehaviorTree = exports.selectDeterministicUtility = exports.runDeterministicBotSimulation = exports.getBlackboardValue = exports.createDeterministicBotBlackboard = exports.cookDeterministicBotAsset = exports.traceDeterministicBotDocument = exports.summarizeDeterministicBotDocumentTraceCoverage = exports.summarizeDeterministicBotDocumentTraceCounterDelta = exports.compileDeterministicBotDocument = exports.createDeterministicAuthorityRoom = exports.validatePrototypeEntitiesAgainstFrameRuntime = exports.stableAssetCookJson = exports.materializePrototypeEntities = exports.materializeDeterministicMapEntities = exports.cookDeterministicAssets = exports.assertAssetManifestMatches = exports.stepDeterministicAnimation = exports.reconstructDeterministicAnimationEvents = exports.createDeterministicAnimationRuntimeState = exports.cookDeterministicAnimation = void 0;
 exports.createDeterministicLocalAuthoritySnapshotOfferEnvelope = exports.createDeterministicLocalAuthoritySnapshotEnvelope = exports.createDeterministicLocalAuthoritySnapshotCompleteEnvelope = exports.createDeterministicLocalAuthoritySnapshotChunkEnvelope = exports.createDeterministicLocalAuthorityInputBundleEnvelope = exports.createDeterministicLocalAuthorityCorrectionEnvelope = exports.createDeterministicLocalAuthorityCommandBundleEnvelope = exports.createDeterministicLocalAuthorityAckEnvelope = exports.applyDeterministicLocalAuthorityInputBundleEnvelope = exports.applyDeterministicLocalAuthorityCommandBundleEnvelope = exports.createDeterministicLocalAuthorityRuntime = exports.validateDeterministicLagCompensatedShot3D = exports.validateDeterministicAuthoritativeLagCompensatedShot3D = exports.rewindDeterministicLagCompensatedTargets3D = exports.createDeterministicLagCompensation3DHistory = exports.buildDeterministicLagCompensatedHitboxProxies3D = exports.runInstantReplay = exports.createInstantReplayRunner = exports.sortDeterministicInputTimelineFlags = exports.evaluateDeterministicInputTimelineResult = exports.accumulateDeterministicInputTimelineState = exports.createInputAuthority = exports.filterDeterministicEventsForPlayer = exports.createDeterministicEventTimeline = exports.validateDeterministicFrameSystemsStateless = exports.runDeterministicFrameRuntimeMutationCorpus = exports.isDeterministicFrameHeapStaleHandleError = exports.generateDeterministicFrameRuntimeSource = exports.createDeterministicSparseSetFrameRuntime = exports.createDeterministicSlotMap = exports.createDeterministicFrameRuntimeAccessors = exports.createDeterministicFrameRuntime = exports.createDeterministicBitset = exports.compileDeterministicDslRuntimeDescriptor = exports.assertDeterministicFrameSystemsStateless = exports.assertDeterministicFrameHeapStaleHandleError = exports.createDeterministicEventEffectsAdapter = exports.verifyDeterministicSessionRuntimeReplay = exports.createDeterministicSessionReplayBundle = exports.createDeterministicSessionCore = exports.verifyDeterministicConfigBundle = exports.summarizeDeterministicConfigBundleFailureReasons = exports.evaluateDeterministicConfigBundleParityResult = exports.cookDeterministicConfigBundle = exports.evaluateDeterministicCommandTimelineMigrationResult = exports.deterministicPayloadMatchesFields = exports.createDeterministicCommandTimelineSnapshot = exports.createDeterministicCommandTimeline = exports.assertDeterministicPayloadFields = exports.translateAabb = void 0;
 exports.stepDeterministicPhysicsWorld2D = exports.raycastDeterministicPhysics2D = exports.raycastAllDeterministicPhysics2D = exports.queryDeterministicPhysicsShapeOverlap2D = exports.queryDeterministicPhysicsAabb2D = exports.nearestDeterministicPhysicsHit2D = exports.createDeterministicPhysicsWorld2D = exports.circleCastDeterministicPhysics2D = exports.createPauseController = exports.createOfflineSession = exports.valueNoise2D = exports.valueNoise1D = exports.hashUint32 = exports.hash2 = exports.fbm2D = exports.createNetworkedSyncplayClient = exports.stepDeterministicNavmeshOffMeshTraversal = exports.stepDeterministicNavmeshAgents = exports.smoothDeterministicNavmeshPath = exports.runDeterministicNavmeshStress = exports.locateDeterministicNavmeshPolygon = exports.findDeterministicNavmeshPointPath = exports.findDeterministicNavmeshPath = exports.cookImportedDeterministicNavmesh = exports.cookDeterministicNavmesh = exports.stepDeterministicNavigationAgents = exports.smoothDeterministicPath = exports.findDeterministicPath = exports.createDeterministicFlowField = exports.cookTilemapNavigationGraph = exports.cookDeterministicNavigationGraph = exports.applyDeterministicReciprocalAvoidance = exports.createSyncplayClient = exports.stepDeterministicKcc3D = exports.stepDeterministicCarry3D = exports.validateDeterministicLagCompensatedHit = exports.stepDeterministicTopDownMover = exports.stepDeterministicKcc2D = exports.stepDeterministicFpsAim = exports.runDeterministicMovementSimulation = exports.runDeterministicMovementCrowdSimulation = exports.rewindDeterministicTargets = exports.createDeterministicMath = exports.encodeDeterministicLocalAuthorityWireEnvelope = exports.deterministicLocalAuthorityWireProtocol = exports.decodeDeterministicLocalAuthorityWireEnvelope = exports.createDeterministicLocalAuthorityWireReceiver = exports.createDeterministicLocalAuthorityWireAuth = exports.createDeterministicLocalAuthoritySnapshotTransfer = exports.createDeterministicLocalAuthoritySnapshotRequestEnvelope = void 0;
-exports.createSnapshotTransferCollector = exports.bytesToBase64 = exports.base64ToBytes = exports.exportPromotionSnapshot = exports.createSessionFromPromotionSnapshot = exports.createSyncplaySession = exports.createSyncplayOfflineRuntime = exports.createSyncplayGameRuntime = exports.stableDeterministicDslSchemaJson = exports.parseDeterministicSchemaDsl = exports.deterministicDslMaxPlayers = exports.createDeterministicBinarySerializer = exports.proveSchemaBinaryRoundTrip = exports.generateSchemaTypes = exports.generateSchemaBinarySource = exports.createDeterministicDescriptorBinarySchema = exports.createSchemaArtifacts = exports.stableDescriptorId = exports.defineSyncplayGame = exports.verifyReplayScoreAgainstTrustedRuntime = exports.verifyDeterministicSelfContainedFrameRuntimeReplayBundle = exports.verifyDeterministicReplayBundle = exports.verifyDeterministicFrameRuntimeReplayBundle = exports.sliceDeterministicReplayBundle = exports.minimizeDeterministicReplayDesyncBundle = exports.minimizeDeterministicReplayDesync = exports.createDeterministicReplayRuntimeManifest = exports.createDeterministicReplayDebugTables = exports.createDeterministicReplayBundle = exports.verifyReplay = exports.verifyDeterministicReplay = exports.interpolateDeterministicRenderVec2 = exports.interpolateDeterministicRenderNumber = exports.createDeterministicR3fRenderAdapter = exports.createDeterministicR3fAdapter = exports.stepDeterministicPhysicsWorld3D = exports.shapeCastDeterministicPhysics3DDetailed = exports.shapeCastDeterministicPhysics3D = exports.setDeterministicBodyVelocity3D = exports.runDeterministicPhysics3DStress = exports.raycastDeterministicPhysics3DDetailed = exports.raycastDeterministicPhysics3D = exports.overlapDeterministicPhysics3D = exports.deterministicPhysicsCallback3D = exports.deterministicPhysicsBodyById3D = exports.deriveInverseInertia = exports.createDeterministicPhysicsWorld3D = exports.contactDetailsDeterministicPhysics3D = exports.applyDeterministicImpulses3D = exports.applyDeterministicImpulse3D = void 0;
-exports.summarizeDeterministicLifecycleCounters = exports.createDeterministicLifecycleRunner = exports.createDeterministicSparseSet = exports.createDeterministicSignalBus = exports.encodeDeterministicSessionMessage = exports.deterministicSessionWireVersion = exports.decodeDeterministicSessionMessage = exports.encodeDeterministicStateSnapshot = exports.deterministicRoomDescriptorHash = exports.DEFAULT_SNAPSHOT_CHUNK_SIZE = exports.DEFAULT_MAX_SNAPSHOT_BYTES = exports.decodeDeterministicStateSnapshot = exports.createSnapshotTransferFromBytes = void 0;
+exports.bytesToBase64 = exports.base64ToBytes = exports.exportPromotionSnapshot = exports.createSessionFromPromotionSnapshot = exports.createSyncplaySession = exports.createSyncplayOfflineRuntime = exports.createSyncplayGameRuntime = exports.stableDeterministicDslSchemaJson = exports.parseDeterministicSchemaDsl = exports.deterministicDslMaxPlayers = exports.createDeterministicBinarySerializer = exports.proveSchemaBinaryRoundTrip = exports.generateSchemaTypes = exports.generateSchemaBinarySource = exports.createDeterministicDescriptorBinarySchema = exports.createSchemaArtifacts = exports.stableDescriptorId = exports.defineSyncplayGame = exports.verifyReplayScoreAgainstTrustedRuntime = exports.verifyDeterministicSelfContainedFrameRuntimeReplayBundle = exports.verifyDeterministicReplayBundle = exports.verifyDeterministicFrameRuntimeReplayBundle = exports.sliceDeterministicReplayBundle = exports.minimizeDeterministicReplayDesyncBundle = exports.minimizeDeterministicReplayDesync = exports.createDeterministicReplayRuntimeManifest = exports.createDeterministicReplayDebugTables = exports.createDeterministicReplayBundle = exports.verifyReplay = exports.verifyDeterministicReplay = exports.interpolateDeterministicRenderVec2 = exports.interpolateDeterministicRenderNumber = exports.createDeterministicR3fRenderAdapter = exports.createDeterministicR3fAdapter = exports.stepDeterministicVehicle3D = exports.stepDeterministicPhysicsWorld3D = exports.shapeCastDeterministicPhysics3DDetailed = exports.shapeCastDeterministicPhysics3D = exports.setDeterministicBodyVelocity3D = exports.runDeterministicPhysics3DStress = exports.raycastDeterministicPhysics3DDetailed = exports.raycastDeterministicPhysics3D = exports.overlapDeterministicPhysics3D = exports.deterministicPhysicsCallback3D = exports.deterministicPhysicsBodyById3D = exports.deriveInverseInertia = exports.createDeterministicPhysicsWorld3D = exports.contactDetailsDeterministicPhysics3D = exports.applyDeterministicImpulses3D = exports.applyDeterministicImpulse3D = void 0;
+exports.createSyncplaySecretsClient = exports.createSyncplaySecretEventReader = exports.verifySyncplaySignedReceipt = exports.createBrowserSyncplaySecretCrypto = exports.syncplaySecretProtocol = exports.isSyncplaySecretCommand = exports.decodeSyncplaySecretPrivateMessage = exports.validateSyncplaySecretSystemsConfig = exports.syncplaySecretLimits = exports.syncplaySecretConfigHash = exports.summarizeDeterministicLifecycleCounters = exports.createDeterministicLifecycleRunner = exports.createDeterministicSparseSet = exports.createDeterministicSignalBus = exports.encodeDeterministicSessionMessage = exports.deterministicSessionWireVersion = exports.decodeDeterministicSessionMessage = exports.encodeDeterministicStateSnapshot = exports.deterministicRoomDescriptorHash = exports.DEFAULT_SNAPSHOT_CHUNK_SIZE = exports.DEFAULT_MAX_SNAPSHOT_BYTES = exports.decodeDeterministicStateSnapshot = exports.createSnapshotTransferFromBytes = exports.createSnapshotTransferCollector = void 0;
 var animation_js_1 = require("./animation.js");
 Object.defineProperty(exports, "cookDeterministicAnimation", { enumerable: true, get: function () { return animation_js_1.cookDeterministicAnimation; } });
 Object.defineProperty(exports, "createDeterministicAnimationRuntimeState", { enumerable: true, get: function () { return animation_js_1.createDeterministicAnimationRuntimeState; } });
@@ -203,6 +203,8 @@ Object.defineProperty(exports, "setDeterministicBodyVelocity3D", { enumerable: t
 Object.defineProperty(exports, "shapeCastDeterministicPhysics3D", { enumerable: true, get: function () { return physics3d_js_1.shapeCastDeterministicPhysics3D; } });
 Object.defineProperty(exports, "shapeCastDeterministicPhysics3DDetailed", { enumerable: true, get: function () { return physics3d_js_1.shapeCastDeterministicPhysics3DDetailed; } });
 Object.defineProperty(exports, "stepDeterministicPhysicsWorld3D", { enumerable: true, get: function () { return physics3d_js_1.stepDeterministicPhysicsWorld3D; } });
+var physics3d_vehicle_js_1 = require("./physics3d-vehicle.js");
+Object.defineProperty(exports, "stepDeterministicVehicle3D", { enumerable: true, get: function () { return physics3d_vehicle_js_1.stepDeterministicVehicle3D; } });
 var r3f_render_adapter_js_1 = require("./r3f-render-adapter.js");
 Object.defineProperty(exports, "createDeterministicR3fAdapter", { enumerable: true, get: function () { return r3f_render_adapter_js_1.createDeterministicR3fRenderAdapter; } });
 Object.defineProperty(exports, "createDeterministicR3fRenderAdapter", { enumerable: true, get: function () { return r3f_render_adapter_js_1.createDeterministicR3fRenderAdapter; } });
@@ -266,3 +268,17 @@ Object.defineProperty(exports, "createDeterministicSparseSet", { enumerable: tru
 var system_lifecycle_js_1 = require("./system-lifecycle.js");
 Object.defineProperty(exports, "createDeterministicLifecycleRunner", { enumerable: true, get: function () { return system_lifecycle_js_1.createDeterministicLifecycleRunner; } });
 Object.defineProperty(exports, "summarizeDeterministicLifecycleCounters", { enumerable: true, get: function () { return system_lifecycle_js_1.summarizeDeterministicLifecycleCounters; } });
+var secret_config_js_1 = require("./secret-config.js");
+Object.defineProperty(exports, "syncplaySecretConfigHash", { enumerable: true, get: function () { return secret_config_js_1.syncplaySecretConfigHash; } });
+Object.defineProperty(exports, "syncplaySecretLimits", { enumerable: true, get: function () { return secret_config_js_1.syncplaySecretLimits; } });
+Object.defineProperty(exports, "validateSyncplaySecretSystemsConfig", { enumerable: true, get: function () { return secret_config_js_1.validateSyncplaySecretSystemsConfig; } });
+var secret_protocol_js_1 = require("./secret-protocol.js");
+Object.defineProperty(exports, "decodeSyncplaySecretPrivateMessage", { enumerable: true, get: function () { return secret_protocol_js_1.decodeSyncplaySecretPrivateMessage; } });
+Object.defineProperty(exports, "isSyncplaySecretCommand", { enumerable: true, get: function () { return secret_protocol_js_1.isSyncplaySecretCommand; } });
+Object.defineProperty(exports, "syncplaySecretProtocol", { enumerable: true, get: function () { return secret_protocol_js_1.syncplaySecretProtocol; } });
+var secret_crypto_js_1 = require("./secret-crypto.js");
+Object.defineProperty(exports, "createBrowserSyncplaySecretCrypto", { enumerable: true, get: function () { return secret_crypto_js_1.createBrowserSyncplaySecretCrypto; } });
+Object.defineProperty(exports, "verifySyncplaySignedReceipt", { enumerable: true, get: function () { return secret_crypto_js_1.verifySyncplaySignedReceipt; } });
+var secret_client_js_1 = require("./secret-client.js");
+Object.defineProperty(exports, "createSyncplaySecretEventReader", { enumerable: true, get: function () { return secret_client_js_1.createSyncplaySecretEventReader; } });
+Object.defineProperty(exports, "createSyncplaySecretsClient", { enumerable: true, get: function () { return secret_client_js_1.createSyncplaySecretsClient; } });

package/dist/cjs/checksum-basis.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeStateWith = serializeStateWith;
+exports.deserializeStateWith = deserializeStateWith;
+exports.computeWireStateChecksum = computeWireStateChecksum;
+const canonical_js_1 = require("./canonical.js");
+function serializeStateWith(config, state) {
+    // Keep this byte-identical to the engine's egress serializer. Some builders
+    // use canonicalizeState for full state while others use a projection.
+    return config.serializeState?.(state)
+        ?? (0, canonical_js_1.encodeCanonicalBytes)((config.canonicalizeState?.(state) ?? state));
+}
+function deserializeStateWith(config, bytes) {
+    return config.deserializeState?.(bytes) ?? (0, canonical_js_1.decodeCanonicalBytes)(bytes);
+}
+function computeWireStateChecksum(config, state) {
+    // The wire basis is always the round-tripped state. It deliberately ignores
+    // config.checksum and never checksums canonicalizeState's output directly:
+    // both may be projections that are valid for recorded desync cadence but
+    // cannot verify the full state a late joiner hydrates.
+    return (0, canonical_js_1.defaultChecksum)(deserializeStateWith(config, serializeStateWith(config, state)));
+}