@spawndotfamily/sdk 0.2.7

package/dist/dev/economy.d.ts

@@ -0,0 +1,29 @@
+export type LocalPlayer = 'alice' | 'bob' | 'empty';
+type Account = LocalPlayer | 'creator' | 'pool' | 'platform';
+export type LocalTransfer = {
+    id: string;
+    kind: 'entry' | 'funding' | 'reward' | 'withdrawal';
+    from: Account;
+    to: Account;
+    amount: number;
+    platformFee: number;
+    netAmount: number;
+    feeBps: number;
+};
+export declare function localPlayer(value: string): asserts value is LocalPlayer;
+/** Launcher-owned fake ledger. Never exposed through the game's MessageChannel. */
+export declare class LocalTestEconomy {
+    private balances;
+    private transfers;
+    readonly feeBps: number;
+    constructor(feeBps?: number);
+    balance(account: string): number;
+    get history(): LocalTransfer[];
+    private transfer;
+    /** Called only after LocalTestState has checked the pending payment quote. */
+    entry(player: string, receiptId: string): LocalTransfer;
+    fund(amount: number): LocalTransfer;
+    withdraw(amount: number): LocalTransfer;
+    reward(player: string, amount: number): LocalTransfer;
+}
+export {};

package/dist/dev/economy.js

@@ -0,0 +1,49 @@
+export function localPlayer(value) {
+    if (!['alice', 'bob', 'empty'].includes(value))
+        throw new Error('Unknown local test player.');
+}
+/** Launcher-owned fake ledger. Never exposed through the game's MessageChannel. */
+export class LocalTestEconomy {
+    balances = { alice: 10000, bob: 10000, empty: 0, creator: 100000, pool: 0, platform: 0 };
+    transfers = [];
+    feeBps;
+    constructor(feeBps = 500) {
+        if (!Number.isSafeInteger(feeBps) || feeBps < 0 || feeBps > 10000)
+            throw new Error("Invalid platform fee rate.");
+        this.feeBps = feeBps;
+    }
+    balance(account) {
+        if (!Object.hasOwn(this.balances, account))
+            throw new Error('Unknown local test account.');
+        return this.balances[account] / 100;
+    }
+    get history() { return structuredClone(this.transfers); }
+    transfer(from, to, amount, kind, id = 'local_' + crypto.randomUUID()) {
+        const minor = Math.round(amount * 100);
+        if (!Number.isFinite(amount) || amount <= 0 || Number(amount.toFixed(2)) !== amount || !Number.isSafeInteger(minor))
+            throw new Error('Use positive TEST amounts with at most two decimal places.');
+        if (this.balances[from] < minor)
+            throw new Error('Insufficient local test balance.');
+        const fee = to === 'pool' ? Number(BigInt(minor) * BigInt(this.feeBps) / 10000n) : 0;
+        if (!Number.isSafeInteger(this.balances[to] + minor - fee) || !Number.isSafeInteger(this.balances.platform + fee))
+            throw new Error('Local test balance limit reached.');
+        const receipt = { id, kind, from, to, amount, platformFee: fee / 100, netAmount: (minor - fee) / 100, feeBps: to === 'pool' ? this.feeBps : 0 };
+        this.balances[from] -= minor;
+        this.balances[to] += minor - fee;
+        this.balances.platform += fee;
+        this.transfers.unshift(receipt);
+        this.transfers.splice(100);
+        return structuredClone(receipt);
+    }
+    /** Called only after LocalTestState has checked the pending payment quote. */
+    entry(player, receiptId) {
+        localPlayer(player);
+        return this.transfer(player, 'pool', 10, 'entry', receiptId);
+    }
+    fund(amount) { return this.transfer('creator', 'pool', amount, 'funding'); }
+    withdraw(amount) { return this.transfer('pool', 'creator', amount, 'withdrawal'); }
+    reward(player, amount) {
+        localPlayer(player);
+        return this.transfer('pool', player, amount, 'reward');
+    }
+}

package/dist/dev/host.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dev/host.js

@@ -0,0 +1,225 @@
+import { LocalTestState } from "./state.js";
+import { createCreatorPanel } from "./panel.js";
+const element = (id) => document.getElementById(id);
+const player = { value: 'alice' };
+const playerButtons = Array.from(document.querySelectorAll('[data-player]'));
+const status = element('status');
+const dialog = element('payment');
+const confirm = element('confirm'), cancel = element('cancel'), next = element('continue');
+let connectedState = false;
+let receiptStatus = 'idle';
+let lastReceipt = null;
+let state = new LocalTestState(), dispose;
+let payment = null;
+const devSnapshot = () => structuredClone({
+    environment: 'local-test', connected: connectedState, player: state.identity(player.value),
+    lastScore: state.scores[0] ?? null, receiptStatus, lastReceipt,
+    balances: { player: state.balance(player.value), pool: state.economy.balance('pool'), platform: state.economy.balance('platform') }
+});
+Object.defineProperty(window, '__SPAWN_DEV_STATE__', { get: devSnapshot });
+const updateDiagnostics = () => { element('spawn-dev-state').textContent = JSON.stringify(devSnapshot()); };
+const panel = createCreatorPanel(() => state, () => player.value, updateDiagnostics);
+function refresh() { panel.refresh(); }
+function closePayment() {
+    if (payment) {
+        if (receiptStatus !== 'paid')
+            receiptStatus = 'cancelled';
+        state.cancel(payment.quote.id);
+        payment.reject(new Error('Local payment cancelled.'));
+    }
+    payment = null;
+    dialog.close();
+    refresh();
+}
+function requestPayment(launch, product) {
+    if (payment)
+        throw new Error('A payment confirmation is already open.');
+    const quote = state.quote(player.value, launch, product);
+    if (quote.receipt)
+        return Promise.resolve(quote.receipt);
+    return new Promise((resolve, reject) => {
+        payment = { quote, resolve, reject };
+        receiptStatus = 'pending';
+        refresh();
+        element('payment-title').textContent = 'Confirm test payment';
+        element('payment-title').className = '';
+        element('payment-copy').textContent = 'Pay 10 TEST? The game pool receives 9.5 TEST; Spawn receives 0.5 TEST (5%, included).';
+        confirm.hidden = cancel.hidden = false;
+        next.hidden = true;
+        confirm.disabled = false;
+        document.exitPointerLock?.();
+        dialog.showModal();
+    });
+}
+cancel.onclick = closePayment;
+dialog.addEventListener('cancel', event => { event.preventDefault(); if (!next.hidden)
+    return; closePayment(); });
+confirm.onclick = () => {
+    if (!payment)
+        return;
+    const current = payment;
+    confirm.disabled = true;
+    element('payment-copy').textContent = 'Processing local test payment…';
+    // Let the processing state paint; there is no remote settlement in this launcher.
+    requestAnimationFrame(() => requestAnimationFrame(() => {
+        if (payment !== current)
+            return;
+        try {
+            lastReceipt = state.confirm(current.quote.id);
+            receiptStatus = 'paid';
+            refresh();
+            element('payment-title').textContent = 'Paid';
+            element('payment-title').className = 'paid';
+            element('payment-copy').textContent = 'Paid 10 TEST: 9.5 to the game pool and 0.5 to Spawn.';
+            confirm.hidden = cancel.hidden = true;
+            next.hidden = false;
+            next.focus();
+        }
+        catch (error) {
+            receiptStatus = 'failed';
+            current.reject(error instanceof Error ? error : new Error('Local payment failed.'));
+            payment = null;
+            dialog.close();
+            refresh();
+        }
+    }));
+};
+next.onclick = () => {
+    if (!payment)
+        return;
+    const current = payment;
+    payment = null;
+    dialog.close();
+    refresh();
+    current.resolve(state.confirm(current.quote.id));
+};
+function openGame() {
+    dispose?.();
+    closePayment();
+    receiptStatus = 'idle';
+    lastReceipt = null;
+    refresh();
+    const token = document.body.dataset.documentToken;
+    const launch = crypto.randomUUID(), identity = player.value;
+    const frame = document.createElement('iframe');
+    frame.title = 'Local test game';
+    frame.sandbox.add('allow-scripts', 'allow-pointer-lock');
+    frame.allow = 'autoplay; fullscreen; gamepad';
+    frame.referrerPolicy = 'no-referrer';
+    let active = true, connected = false, ready = false, loads = 0, nonce = '', requests = 0;
+    let port = null;
+    const queued = [], pending = new Set();
+    let timer;
+    const reset = setInterval(() => { requests = 0; }, 60000);
+    const stop = () => { connectedState = false; active = false; clearTimeout(timer); clearInterval(reset); port?.close(); window.removeEventListener('message', receive); closePayment(); status.textContent = 'Disconnected. Reopen the game to reconnect.'; refresh(); };
+    async function dispatch(raw) {
+        const data = raw;
+        if (!active || !ready || !data || data.type !== 'spawn:request' || data.version !== 1 || typeof data.id !== 'string' || data.id.length > 80 || pending.has(data.id))
+            return;
+        const send = (ok, value) => { if (active)
+            port?.postMessage({ type: 'spawn:response', version: 1, id: data.id, ok, ...(ok ? { value } : { error: value }) }); };
+        if (++requests > 100 || pending.size >= 20) {
+            send(false, 'Too many local test requests.');
+            return;
+        }
+        pending.add(data.id);
+        try {
+            const payload = data.payload ?? {};
+            if (!payload || typeof payload !== 'object' || Array.isArray(payload) || JSON.stringify(payload).length > 16000)
+                throw new Error('Invalid request payload.');
+            let value;
+            if (data.method === 'identity') {
+                value = state.identity(identity);
+                status.textContent = `Connected as ${state.identity(identity).displayName}`;
+            }
+            else if (data.method === 'load')
+                value = state.load(identity, String(payload.key));
+            else if (data.method === 'save')
+                value = state.save(identity, String(payload.key), payload.value, payload.expectedVersion);
+            else if (data.method === 'submitScore') {
+                value = state.score(identity, payload.score, payload.details);
+                refresh();
+            }
+            else if (data.method === 'requestPayment')
+                value = await requestPayment(launch, String(payload.productId));
+            else
+                throw new Error('Unsupported Spawn operation.');
+            send(true, value);
+        }
+        catch (error) {
+            send(false, error instanceof Error ? error.message : 'Local test request failed.');
+        }
+        finally {
+            pending.delete(data.id);
+        }
+    }
+    const probe = () => { if (!active || !port || loads !== 1 || nonce || ready)
+        return; nonce = crypto.randomUUID(); port.postMessage({ type: 'spawn:ready', version: 1, nonce }); timer = setTimeout(stop, 10000); };
+    function receive(event) {
+        if (!active || connected || event.source !== frame.contentWindow || event.origin !== 'null' || event.data?.type !== 'spawn:connect' || event.data?.version !== 1 || event.data?.documentToken !== token)
+            return;
+        connected = true;
+        const channel = new MessageChannel();
+        port = channel.port1;
+        port.onmessage = ({ data }) => {
+            if (!active)
+                return;
+            if (data?.type === 'spawn:ready-ack') {
+                if (!ready && nonce && data.nonce === nonce && data.version === 1 && loads === 1) {
+                    ready = true;
+                    connectedState = true;
+                    refresh();
+                    clearTimeout(timer);
+                    for (const request of queued.splice(0))
+                        void dispatch(request);
+                }
+            }
+            else if (ready)
+                void dispatch(data);
+            else if (queued.length < 20)
+                queued.push(data);
+            else
+                stop();
+        };
+        frame.contentWindow?.postMessage({ type: 'spawn:connected', version: 1 }, '*', [channel.port2]);
+        probe();
+    }
+    window.addEventListener('message', receive);
+    frame.onload = () => { if (++loads > 1)
+        stop();
+    else
+        probe(); };
+    frame.src = `/build/${token}/index.html`;
+    status.textContent = 'Waiting for the SDK…';
+    element('frame-slot').replaceChildren(frame);
+    dispose = stop;
+}
+element('reopen').onclick = async () => {
+    const button = element('reopen');
+    button.disabled = true;
+    dispose?.();
+    status.textContent = 'Checking rebuilt files…';
+    try {
+        const response = await fetch('/__spawn/rescan', { method: 'POST' });
+        if (!response.ok)
+            throw new Error('Build not ready. Finish rebuilding and try again.');
+        const value = await response.json();
+        if (!/^[A-Za-z0-9_-]{43}$/.test(value.documentToken ?? ''))
+            throw new Error('Invalid rescan response.');
+        document.body.dataset.documentToken = value.documentToken;
+        openGame();
+    }
+    catch (error) {
+        status.textContent = error instanceof Error ? error.message : 'Unable to rescan the build.';
+    }
+    finally {
+        button.disabled = false;
+    }
+};
+element('disconnect').onclick = () => dispose?.();
+element('reset').onclick = () => { dispose?.(); state = new LocalTestState(); receiptStatus = 'idle'; lastReceipt = null; panel.reset(); openGame(); };
+for (const button of playerButtons)
+    button.onclick = () => { player.value = button.dataset.player; for (const item of playerButtons)
+        item.setAttribute('aria-pressed', String(item === button)); openGame(); };
+window.addEventListener('pagehide', () => dispose?.());
+openGame();

package/dist/dev/panel.d.ts

@@ -0,0 +1,6 @@
+import type { LocalTestState } from './state.ts';
+/** Operator controls belong to the launcher, not to the untrusted game frame. */
+export declare function createCreatorPanel(getState: () => LocalTestState, getPlayer: () => string, onRefresh?: () => void): {
+    refresh: () => void;
+    reset: () => void;
+};

package/dist/dev/panel.js

@@ -0,0 +1,63 @@
+const element = (id) => document.getElementById(id);
+const names = { alice: 'Alice', bob: 'Bob', empty: 'Empty balance', creator: 'Creator wallet', pool: 'Game pool', platform: 'Spawn platform' };
+/** Operator controls belong to the launcher, not to the untrusted game frame. */
+export function createCreatorPanel(getState, getPlayer, onRefresh = () => { }) {
+    const amount = element('transfer-amount');
+    const feedback = element('transfer-feedback');
+    function refresh() {
+        const state = getState(), player = getPlayer();
+        element('balance').textContent = `${names[player]} · ${state.balance(player)} TEST`;
+        element('platform-balance').textContent = `${state.economy.balance('platform')} TEST`;
+        element('pool-balance').textContent = `${state.economy.balance('pool')} TEST`;
+        element('creator-balance').textContent = `${state.economy.balance('creator')} TEST`;
+        element('reward-player').textContent = `Reward ${names[player]}`;
+        const history = element('history');
+        history.replaceChildren();
+        for (const item of state.economy.history.slice(0, 12)) {
+            const row = document.createElement('li');
+            const title = document.createElement('strong');
+            title.textContent = `${item.amount} TEST · ${item.kind}`;
+            const route = document.createElement('span');
+            route.textContent = `${names[item.from]} → ${names[item.to]} · ${item.netAmount} TEST received · ${item.platformFee} TEST Spawn fee`;
+            const details = document.createElement('details'), summary = document.createElement('summary'), id = document.createElement('code');
+            summary.textContent = 'Local receipt';
+            id.textContent = item.id;
+            details.append(summary, id);
+            row.append(title, route, details);
+            history.append(row);
+        }
+        element('no-transactions').hidden = state.economy.history.length !== 0;
+        const scores = element('scores');
+        scores.replaceChildren();
+        for (const item of state.scores.slice(0, 5)) {
+            const row = document.createElement('li');
+            row.textContent = `${names[item.player]} · ${item.score} · unverified`;
+            scores.append(row);
+        }
+        element('no-scores').hidden = state.scores.length !== 0;
+        onRefresh();
+    }
+    function transfer(kind) {
+        try {
+            const state = getState(), quantity = amount.valueAsNumber;
+            const receipt = kind === 'reward' ? state.economy.reward(getPlayer(), quantity) : state.economy[kind](quantity);
+            feedback.textContent = `${receipt.amount} TEST paid; ${receipt.netAmount} to ${names[receipt.to]}, ${receipt.platformFee} Spawn fee.`;
+            feedback.dataset.error = 'false';
+            refresh();
+        }
+        catch (error) {
+            feedback.textContent = error instanceof Error ? error.message : 'Local transfer failed.';
+            feedback.dataset.error = 'true';
+        }
+    }
+    element('fund-pool').onclick = () => transfer('fund');
+    element('withdraw-pool').onclick = () => transfer('withdraw');
+    element('reward-player').onclick = () => transfer('reward');
+    function reset() {
+        amount.value = '10';
+        feedback.textContent = 'Rewards go to the selected test player.';
+        feedback.dataset.error = 'false';
+        refresh();
+    }
+    return { refresh, reset };
+}

package/dist/dev/run.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/dev/run.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { startLocalLauncher } from "./server.js";
+const runtime = globalThis.process;
+const args = runtime.argv.slice(2);
+if (!args.length || args.includes('--help')) {
+    console.log('Usage: spawn-dev <prebuilt-browser-directory> [--port 4174]\nLocal fake accounts only. No credentials or platform connection required.');
+}
+else {
+    try {
+        if (args.length !== 1 && !(args.length === 3 && args[1] === '--port' && /^\d+$/.test(args[2])))
+            throw new Error('Use spawn-dev <directory> [--port <number>].');
+        const { origin } = await startLocalLauncher(args[0], args[2] ? Number(args[2]) : 4174);
+        console.log(`Spawn LOCAL TESTING: ${origin}\nFake accounts and TEST balances. No platform data is accessed. Stop with Ctrl+C.`);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : 'Local launcher failed.');
+        runtime.exitCode = 1;
+    }
+}

package/dist/dev/server.d.ts

@@ -0,0 +1,5 @@
+export declare function startLocalLauncher(directory: string, port?: number): Promise<{
+    server: any;
+    origin: string;
+    files: number;
+}>;

package/dist/dev/server.js

@@ -0,0 +1,188 @@
+// @ts-ignore Node built-ins are provided by the CLI runtime.
+import { createServer } from 'node:http';
+// @ts-ignore Node built-ins are provided by the CLI runtime.
+import { randomBytes } from 'node:crypto';
+// @ts-ignore Node built-ins are provided by the CLI runtime.
+import { readFile } from 'node:fs/promises';
+// @ts-ignore Node built-ins are provided by the CLI runtime.
+import { createReadStream } from 'node:fs';
+import { inspectBrowserBuildForLocal, openValidatedBuildFile } from "../cli/upload-client.js";
+import { launcherHtml } from "./shell.js";
+import { launcherCss } from "./styles.js";
+const MIME = { html: 'text/html; charset=utf-8', js: 'text/javascript', mjs: 'text/javascript', css: 'text/css', json: 'application/json', wasm: 'application/wasm', svg: 'image/svg+xml', png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif', ico: 'image/x-icon', avif: 'image/avif', mp3: 'audio/mpeg', ogg: 'audio/ogg', wav: 'audio/wav', mp4: 'video/mp4', webm: 'video/webm', woff: 'font/woff', woff2: 'font/woff2', ttf: 'font/ttf', otf: 'font/otf' };
+async function readValidatedEntry(handle, bytes) {
+    const buffer = new Uint8Array(bytes);
+    let offset = 0;
+    while (offset < bytes) {
+        const result = await handle.read(buffer, offset, bytes - offset, offset);
+        if (result.bytesRead <= 0)
+            throw new Error('The inspected entry file ended while it was being served.');
+        offset += result.bytesRead;
+    }
+    return new TextDecoder().decode(buffer);
+}
+export async function startLocalLauncher(directory, port = 4174) {
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        throw new Error('Invalid local launcher port.');
+    let prepared = await inspectBrowserBuildForLocal(directory);
+    let token = randomBytes(32).toString('base64url');
+    let files = new Map(prepared.preparedFiles.map(file => [file.path, file]));
+    const validationCache = new Map();
+    const modules = new Map();
+    for (const name of ['host', 'state', 'economy', 'panel']) {
+        modules.set('/__spawn/' + name + '.js', await readFile(new URL('./' + name + '.js', import.meta.url), 'utf8'));
+    }
+    let origin = '';
+    let rescanning = false;
+    const handleRequest = async (request, response) => {
+        response.setHeader('Cache-Control', 'no-store');
+        response.setHeader('X-Content-Type-Options', 'nosniff');
+        response.setHeader('Referrer-Policy', 'no-referrer');
+        if (origin && request.headers.host === new URL(origin).host && request.url === '/__spawn/rescan' && request.method === 'POST') {
+            if (request.headers.origin !== origin) {
+                response.writeHead(403).end();
+                return;
+            }
+            if (rescanning) {
+                response.writeHead(409).end('A rescan is already running.');
+                return;
+            }
+            rescanning = true;
+            try {
+                const next = await inspectBrowserBuildForLocal(directory);
+                prepared = next;
+                files = new Map(next.preparedFiles.map(file => [file.path, file]));
+                validationCache.clear();
+                token = randomBytes(32).toString('base64url');
+                response.setHeader('Content-Type', 'application/json');
+                response.writeHead(200).end(JSON.stringify({ documentToken: token }));
+            }
+            catch {
+                response.writeHead(422).end('Build not ready. Finish rebuilding, then retry Rebuild / reload.');
+            }
+            finally {
+                rescanning = false;
+            }
+            return;
+        }
+        if (!origin || request.headers.host !== new URL(origin).host || !['GET', 'HEAD'].includes(request.method)) {
+            response.writeHead(404).end();
+            return;
+        }
+        const path = request.url.split('?')[0];
+        let body, type = 'text/html; charset=utf-8';
+        if (path === '/')
+            body = launcherHtml(token);
+        else if (modules.has(path)) {
+            body = modules.get(path);
+            type = 'text/javascript';
+        }
+        else if (path === '/__spawn/style.css') {
+            body = launcherCss;
+            type = 'text/css';
+        }
+        else if (path.startsWith('/build/' + token + '/')) {
+            let name = '';
+            try {
+                name = decodeURIComponent(path.slice(token.length + 8));
+            }
+            catch { /* Invalid path stays unavailable. */ }
+            response.setHeader('Access-Control-Allow-Origin', '*');
+            response.setHeader('Content-Security-Policy', `sandbox allow-scripts allow-pointer-lock; default-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; frame-ancestors ${origin}`);
+            const file = files.get(name);
+            if (!file) {
+                response.writeHead(404).end('File unavailable.');
+                return;
+            }
+            type = MIME[name.split('.').at(-1).toLowerCase()] ?? 'application/octet-stream';
+            const cache = validationCache.get(name) ?? {};
+            validationCache.set(name, cache);
+            const handle = await openValidatedBuildFile(prepared, file, cache);
+            response.setHeader('Content-Type', type);
+            if (request.method === 'HEAD') {
+                await handle.close();
+                response.writeHead(200).end();
+                return;
+            }
+            if (name === 'index.html') {
+                try {
+                    const html = await readValidatedEntry(handle, file.bytes);
+                    const doctype = html.match(/^\s*<!doctype[^>]*>/i)?.[0] ?? '';
+                    const config = `<script>Object.defineProperty(globalThis,"__SPAWN_LAUNCH__",{value:Object.freeze({platformOrigin:${JSON.stringify(origin)}})});</script>`;
+                    await handle.close();
+                    response.writeHead(200).end(doctype + config + html.slice(doctype.length));
+                    return;
+                }
+                catch (error) {
+                    await handle.close().catch(() => undefined);
+                    throw error;
+                }
+            }
+            try {
+                if (file.bytes === 0) {
+                    await handle.close();
+                    response.setHeader('Content-Length', '0');
+                    response.writeHead(200).end();
+                    return;
+                }
+                const stream = createReadStream(null, { fd: handle.fd, start: 0, end: file.bytes - 1, autoClose: false });
+                response.setHeader('Content-Length', String(file.bytes));
+                let closed = false;
+                const closeHandle = () => {
+                    if (closed)
+                        return;
+                    closed = true;
+                    void handle.close().catch(() => undefined);
+                };
+                const abortStream = () => {
+                    closeHandle();
+                    try {
+                        stream.destroy();
+                    }
+                    catch { /* stream already closed */ }
+                };
+                stream.on('end', closeHandle);
+                stream.on('close', closeHandle);
+                response.on('close', abortStream);
+                response.on('error', abortStream);
+                response.writeHead(200);
+                stream.on('error', () => { closeHandle(); try {
+                    response.end();
+                }
+                catch { /* response already closed */ } });
+                stream.pipe(response);
+            }
+            catch (error) {
+                await handle.close().catch(() => undefined);
+                throw error;
+            }
+            return;
+        }
+        if (body === undefined && !path.startsWith('/build/')) {
+            response.writeHead(404).end('File unavailable.');
+            return;
+        }
+        if (body === undefined) {
+            response.writeHead(404).end('File unavailable.');
+            return;
+        }
+        if (!path.startsWith('/build/'))
+            response.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self'; style-src 'self'; frame-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'");
+        response.setHeader('Content-Type', type);
+        response.writeHead(200).end(request.method === 'HEAD' ? undefined : body);
+    };
+    const server = createServer({ maxHeaderSize: 8192 }, (request, response) => {
+        void handleRequest(request, response).catch(() => {
+            try {
+                response.writeHead(409).end('Build changed. Finish rebuilding, then use Rebuild / reload in the Spawn launcher.');
+            }
+            catch { /* response already closed */ }
+        });
+    });
+    server.maxConnections = 32;
+    server.requestTimeout = 10000;
+    server.headersTimeout = 10000;
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+    origin = 'http://127.0.0.1:' + server.address().port;
+    return { server, origin, files: prepared.files.length };
+}

package/dist/dev/shell.d.ts

@@ -0,0 +1 @@
+export declare function launcherHtml(token: string): string;

package/dist/dev/shell.js

@@ -0,0 +1,18 @@
+export function launcherHtml(token) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Spawn · Local testing</title><link rel="stylesheet" href="/__spawn/style.css"></head>
+<body data-document-token="${token}">
+<header><strong>SPAWN <span>LOCAL TESTING</span></strong><div class="players" aria-label="Test player"><button data-player="alice" aria-pressed="true">Alice</button><button data-player="bob" aria-pressed="false">Bob</button><button data-player="empty" aria-pressed="false">Empty balance</button></div><button id="reopen">Rebuild / reload</button><button id="disconnect">Disconnect</button><button id="reset">Reset testing</button></header>
+<div class="notice">Fake accounts, fake tokens. Nothing is sent to Spawn. Reloading clears this session. Test your private Spawn preview before publishing.</div>
+<output id="spawn-dev-state" hidden aria-hidden="true"></output>
+<main><section id="game" aria-label="Game preview"><div id="frame-slot"></div></section><aside>
+<section class="panel-section"><p class="eyebrow">Player</p><h1 id="balance"></h1><p id="status" role="status">Waiting for the SDK…</p></section>
+<section class="panel-section"><h2>Creator test panel</h2><div class="balances"><div><span>Game pool</span><strong id="pool-balance"></strong></div><div><span>Creator wallet</span><strong id="creator-balance"></strong></div><div><span>Spawn fees</span><strong id="platform-balance"></strong></div></div>
+<label for="transfer-amount">Amount <span class="hint">TEST tokens</span></label><input id="transfer-amount" type="number" min="1" step="1" value="10" inputmode="numeric">
+<div class="pool-actions"><button id="fund-pool">Top up pool</button><button id="withdraw-pool">Withdraw</button><button id="reward-player" class="primary">Reward Alice</button></div>
+<p id="transfer-feedback" class="hint" role="status" aria-live="polite">Rewards go to the selected test player.</p></section>
+<section class="panel-section"><h2>Submitted scores</h2><p class="hint">Unverified game results. Review manually; submitting a score never pays a reward.</p><p id="no-scores" class="empty">No scores yet.</p><ol id="scores"></ol></section>
+<section class="panel-section"><h2>Transactions <span class="hint">Latest 12</span></h2><p id="no-transactions" class="empty">Confirm a payment in your game or try a pool transfer.</p><ol id="history" class="transactions"></ol></section>
+</aside></main>
+<dialog id="payment"><h2 id="payment-title">Confirm test payment</h2><p id="payment-copy">Pay 10 TEST to this local test game?</p><p class="hint">This is a simulation. No real tokens move.</p><div class="actions"><button id="cancel">Cancel</button><button id="confirm" class="primary">Confirm 10 TEST</button><button id="continue" class="primary" hidden>Continue to game</button></div></dialog>
+<script type="module" src="/__spawn/host.js"></script></body></html>`;
+}

package/dist/dev/state.d.ts

@@ -0,0 +1,33 @@
+import type { Save, SpawnGameIdentity, SpawnScoreSubmission, SpawnTestPayment } from '../index.ts';
+import { LocalTestEconomy, type LocalPlayer as Player } from './economy.ts';
+type LocalScore = SpawnScoreSubmission & {
+    player: Player;
+    score: number;
+    details: unknown;
+};
+export type LocalQuote = {
+    id: string;
+    player: Player;
+    launch: string;
+    status: 'pending' | 'paid' | 'cancelled';
+    receipt?: SpawnTestPayment;
+};
+/** In-memory fixtures only. This module never calls a platform API. */
+export declare class LocalTestState {
+    readonly economy: LocalTestEconomy;
+    private submissions;
+    get scores(): LocalScore[];
+    private saves;
+    private quotes;
+    identity(player: string): SpawnGameIdentity;
+    private player;
+    private recordKey;
+    balance(player: string): number;
+    load(player: string, key: string): Save<unknown> | null;
+    save(player: string, key: string, value: unknown, version: number): Save<unknown>;
+    score(player: string, score: number, details: unknown): SpawnScoreSubmission;
+    quote(player: string, launch: string, product: string): LocalQuote;
+    cancel(id: string): void;
+    confirm(id: string): SpawnTestPayment;
+}
+export {};