@spawndotfamily/sdk 0.2.7

package/dist/dev/state.js

@@ -0,0 +1,77 @@
+import { LocalTestEconomy, localPlayer } from "./economy.js";
+/** In-memory fixtures only. This module never calls a platform API. */
+export class LocalTestState {
+    economy = new LocalTestEconomy();
+    submissions = [];
+    get scores() { return structuredClone(this.submissions); }
+    saves = new Map();
+    quotes = new Map();
+    identity(player) {
+        this.player(player);
+        return { id: 'local_test_' + player, handle: 'test_' + player,
+            displayName: (player === 'alice' ? 'Alice' : player === 'bob' ? 'Bob' : 'Empty balance') + ' (local test)', avatarUrl: null, environment: 'sandbox' };
+    }
+    player(value) {
+        localPlayer(value);
+    }
+    recordKey(player, key) {
+        this.player(player);
+        if (!/^[a-zA-Z0-9_-]{1,64}$/.test(key))
+            throw new Error('Invalid record key.');
+        return player + ':' + key;
+    }
+    balance(player) { this.player(player); return this.economy.balance(player); }
+    load(player, key) { return structuredClone(this.saves.get(this.recordKey(player, key)) ?? null); }
+    save(player, key, value, version) {
+        const id = this.recordKey(player, key);
+        if (!Number.isSafeInteger(version) || version < 0 || (this.saves.get(id)?.version ?? 0) !== version)
+            throw new Error('Save changed; reload before saving.');
+        const text = JSON.stringify(value);
+        if (text === undefined || text.length > 16000 || this.saves.size >= 1000 && !this.saves.has(id))
+            throw new Error('Local record limit reached.');
+        const save = { value: JSON.parse(text), version: version + 1, updatedAt: new Date().toISOString() };
+        this.saves.set(id, save);
+        return structuredClone(save);
+    }
+    score(player, score, details) {
+        this.player(player);
+        if (!Number.isFinite(score) || JSON.stringify(details ?? {}).length > 4000)
+            throw new Error('Invalid local score.');
+        const result = { id: 'local_' + crypto.randomUUID(), verification: 'unverified' };
+        this.submissions.unshift({ ...result, player, score, details: JSON.parse(JSON.stringify(details ?? {})) });
+        this.submissions.splice(100);
+        return result;
+    }
+    quote(player, launch, product) {
+        this.player(player);
+        if (product !== 'entry')
+            throw new Error('Only the entry test product is available.');
+        const existing = [...this.quotes.values()].find(q => q.player === player && q.launch === launch && q.status !== 'cancelled');
+        if (existing)
+            return structuredClone(existing);
+        if (this.balance(player) < 10)
+            throw new Error('Insufficient local test balance. Choose Alice or Bob, or reset testing.');
+        if (this.quotes.size >= 1000)
+            throw new Error('Local test limit reached. Reset testing.');
+        const quote = { id: 'local_' + crypto.randomUUID(), player, launch, status: 'pending' };
+        this.quotes.set(quote.id, quote);
+        return structuredClone(quote);
+    }
+    cancel(id) {
+        const quote = this.quotes.get(id);
+        if (quote?.status === 'pending')
+            quote.status = 'cancelled';
+    }
+    confirm(id) {
+        const quote = this.quotes.get(id);
+        if (!quote || quote.status === 'cancelled')
+            throw new Error('Local payment cancelled.');
+        if (quote.receipt)
+            return structuredClone(quote.receipt);
+        const receipt = { id: 'local_' + crypto.randomUUID(), intentId: id, amount: 10, asset: 'TEST', environment: 'sandbox', status: 'paid' };
+        this.economy.entry(quote.player, receipt.id);
+        quote.status = 'paid';
+        quote.receipt = receipt;
+        return structuredClone(quote.receipt);
+    }
+}

package/dist/dev/styles.d.ts

@@ -0,0 +1 @@
+export declare const launcherCss = "\n:root{font:15px/1.5 system-ui;color:#202321;background:#f5f6f3}\n*{box-sizing:border-box}body{margin:0}\nheader{display:flex;flex-wrap:wrap;align-items:center;gap:12px;padding:14px 24px;background:white;border-bottom:1px solid #dadfd7}\nheader>strong{margin-right:auto;letter-spacing:.02em}header strong span{font-size:11px;margin-left:8px;background:#d4ff57;padding:4px 6px;border-radius:3px}\nbutton,input{font:inherit;color:inherit;border:1px solid #cdd3c9;border-radius:6px;background:white}\nbutton{padding:8px 12px;cursor:pointer}button:disabled{opacity:.5;cursor:wait}button:focus-visible,input:focus-visible{outline:3px solid #4d794f;outline-offset:2px}\n.players{display:flex;gap:4px}.players button[aria-pressed=\"true\"]{background:#202321;color:white}\n.notice{padding:10px 24px;background:#ecf0e5;color:#52594e;font-size:13px}\nmain{display:grid;grid-template-columns:minmax(0,1fr) 340px;height:calc(100dvh - 136px);min-height:480px}\n#frame-slot,iframe,#game{height:100%;width:100%;border:0;background:#151a16}\naside{overflow:auto;border-left:1px solid #dadfd7;background:#fff}.panel-section{padding:20px;border-bottom:1px solid #e2e5dd}\nh1,h2{font-size:16px;margin:0 0 12px}h1{font-size:22px;letter-spacing:-.03em}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.06em;color:#67705f;margin:0 0 4px}\np{margin:0 0 10px}.hint,.empty,#status{font-size:13px;color:#67705f}.empty{margin-bottom:0}\n.balances{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:18px}.balances div{padding:10px;background:#f2f5ee;border-radius:6px}.balances span{display:block;font-size:12px;color:#67705f}.balances strong{display:block;font-size:18px}\nlabel{display:block;font-size:13px;margin-bottom:6px}label span{float:right}input{width:100%;padding:8px 10px;margin-bottom:10px}\n.pool-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px}.pool-actions .primary{grid-column:1/-1}.pool-actions button{font-size:13px}\n#transfer-feedback{margin:10px 0 0}#transfer-feedback[data-error=\"true\"]{color:#ac2e24}\nol{padding-left:18px;font-size:13px;margin:0}li{padding-bottom:8px;overflow-wrap:anywhere}\n.transactions{list-style:none;padding:0}.transactions li{padding:10px 0;border-bottom:1px solid #edf0e9}.transactions li:last-child{border:0;padding-bottom:0}.transactions strong,.transactions span{display:block}.transactions span{color:#67705f}.transactions details{font-size:11px;color:#67705f;margin-top:4px}.transactions summary{cursor:pointer}.transactions code{font-size:10px}\ndialog{max-width:410px;width:calc(100% - 32px);padding:28px;border:1px solid #cdd3c9;border-radius:12px;box-shadow:0 16px 70px #0003}dialog::backdrop{background:#101a1266}.actions{display:flex;gap:12px;justify-content:flex-end;margin-top:24px}\n.primary{background:#d4ff57;border-color:#b4df3d;font-weight:650}.paid{color:#23834b}.paid:before{content:'\u2713';display:inline-grid;place-items:center;width:36px;height:36px;background:#e1f3e6;border-radius:50%;margin-right:8px;animation:appear .25s ease-out}\n@keyframes appear{from{transform:scale(.7);opacity:.2}}@media(prefers-reduced-motion:reduce){.paid:before{animation:none}}\n@media(max-width:760px){main{display:block;height:auto}#game{height:60dvh;min-height:260px}aside{border-left:0}header{padding:12px;gap:8px}header>strong{width:100%}header button{font-size:13px;padding:7px 9px}.notice{padding:10px 12px}.panel-section{padding:18px}}\n";

package/dist/dev/styles.js

@@ -0,0 +1,25 @@
+export const launcherCss = `
+:root{font:15px/1.5 system-ui;color:#202321;background:#f5f6f3}
+*{box-sizing:border-box}body{margin:0}
+header{display:flex;flex-wrap:wrap;align-items:center;gap:12px;padding:14px 24px;background:white;border-bottom:1px solid #dadfd7}
+header>strong{margin-right:auto;letter-spacing:.02em}header strong span{font-size:11px;margin-left:8px;background:#d4ff57;padding:4px 6px;border-radius:3px}
+button,input{font:inherit;color:inherit;border:1px solid #cdd3c9;border-radius:6px;background:white}
+button{padding:8px 12px;cursor:pointer}button:disabled{opacity:.5;cursor:wait}button:focus-visible,input:focus-visible{outline:3px solid #4d794f;outline-offset:2px}
+.players{display:flex;gap:4px}.players button[aria-pressed="true"]{background:#202321;color:white}
+.notice{padding:10px 24px;background:#ecf0e5;color:#52594e;font-size:13px}
+main{display:grid;grid-template-columns:minmax(0,1fr) 340px;height:calc(100dvh - 136px);min-height:480px}
+#frame-slot,iframe,#game{height:100%;width:100%;border:0;background:#151a16}
+aside{overflow:auto;border-left:1px solid #dadfd7;background:#fff}.panel-section{padding:20px;border-bottom:1px solid #e2e5dd}
+h1,h2{font-size:16px;margin:0 0 12px}h1{font-size:22px;letter-spacing:-.03em}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.06em;color:#67705f;margin:0 0 4px}
+p{margin:0 0 10px}.hint,.empty,#status{font-size:13px;color:#67705f}.empty{margin-bottom:0}
+.balances{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:18px}.balances div{padding:10px;background:#f2f5ee;border-radius:6px}.balances span{display:block;font-size:12px;color:#67705f}.balances strong{display:block;font-size:18px}
+label{display:block;font-size:13px;margin-bottom:6px}label span{float:right}input{width:100%;padding:8px 10px;margin-bottom:10px}
+.pool-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px}.pool-actions .primary{grid-column:1/-1}.pool-actions button{font-size:13px}
+#transfer-feedback{margin:10px 0 0}#transfer-feedback[data-error="true"]{color:#ac2e24}
+ol{padding-left:18px;font-size:13px;margin:0}li{padding-bottom:8px;overflow-wrap:anywhere}
+.transactions{list-style:none;padding:0}.transactions li{padding:10px 0;border-bottom:1px solid #edf0e9}.transactions li:last-child{border:0;padding-bottom:0}.transactions strong,.transactions span{display:block}.transactions span{color:#67705f}.transactions details{font-size:11px;color:#67705f;margin-top:4px}.transactions summary{cursor:pointer}.transactions code{font-size:10px}
+dialog{max-width:410px;width:calc(100% - 32px);padding:28px;border:1px solid #cdd3c9;border-radius:12px;box-shadow:0 16px 70px #0003}dialog::backdrop{background:#101a1266}.actions{display:flex;gap:12px;justify-content:flex-end;margin-top:24px}
+.primary{background:#d4ff57;border-color:#b4df3d;font-weight:650}.paid{color:#23834b}.paid:before{content:'✓';display:inline-grid;place-items:center;width:36px;height:36px;background:#e1f3e6;border-radius:50%;margin-right:8px;animation:appear .25s ease-out}
+@keyframes appear{from{transform:scale(.7);opacity:.2}}@media(prefers-reduced-motion:reduce){.paid:before{animation:none}}
+@media(max-width:760px){main{display:block;height:auto}#game{height:60dvh;min-height:260px}aside{border-left:0}header{padding:12px;gap:8px}header>strong{width:100%}header button{font-size:13px;padding:7px 9px}.notice{padding:10px 12px}.panel-section{padding:18px}}
+`;

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+export type Save<T> = {
+    value: T;
+    version: number;
+    updatedAt: string;
+};
+/** @deprecated Reviewed first-party same-origin prototype. Creators should use createSpawnGameClient in isolated previews. Never forward its cookies to another origin. */
+export declare function createSpawnClient(gameId: string): {
+    load: <T>(key: string) => Promise<Save<T> | null>;
+    save: <T>(key: string, value: T, expectedVersion: number) => Promise<Save<T>>;
+};
+export type SpawnGameIdentity = {
+    id: string;
+    handle: string;
+    displayName: string;
+    avatarUrl: string | null;
+    environment: 'sandbox';
+};
+export type SpawnScoreSubmission = {
+    id: string;
+    verification: 'unverified';
+};
+export type SpawnTestPayment = {
+    id: string;
+    intentId: string;
+    amount: 10;
+    asset: 'TEST';
+    environment: 'sandbox';
+    status: 'paid';
+};
+export type SpawnGameClient = {
+    identity(): Promise<SpawnGameIdentity>;
+    load<T>(keyOrRequest: string | {
+        key: string;
+    }): Promise<Save<T> | null>;
+    save<T>(keyOrRequest: string | {
+        key: string;
+        value: T;
+        expectedVersion: number;
+    }, value?: T, expectedVersion?: number): Promise<Save<T>>;
+    submitScore(scoreOrRequest: number | {
+        score: number;
+        details?: Record<string, unknown>;
+    }, details?: Record<string, unknown>): Promise<SpawnScoreSubmission>;
+    requestPayment(productOrRequest: 'entry' | {
+        productId: 'entry';
+    }): Promise<SpawnTestPayment>;
+    dispose(): void;
+};
+export declare const MAX_GAME_BRIDGE_OUTSTANDING = 20;
+/** Published and local launchers inject only this public origin, never identity or credentials. */
+export declare function createSpawnGameClient(options?: {
+    platformOrigin?: string;
+}): SpawnGameClient;

package/dist/index.js

@@ -0,0 +1,403 @@
+/** @deprecated Reviewed first-party same-origin prototype. Creators should use createSpawnGameClient in isolated previews. Never forward its cookies to another origin. */
+export function createSpawnClient(gameId) {
+    if (gameId !== 'rob-the-rich')
+        throw new Error('Game is not enabled for this SDK prototype.');
+    async function request(key, init) {
+        if (!/^[a-zA-Z0-9_-]{1,64}$/.test(key))
+            throw new Error('Invalid save key.');
+        const response = await fetch('/api/v1/game-storage/' + gameId + '/' + key, {
+            credentials: 'same-origin',
+            ...init,
+        });
+        const result = await response.json();
+        if (!response.ok) {
+            const message = typeof result === 'object' &&
+                result !== null &&
+                'error' in result &&
+                typeof result.error === 'string'
+                ? result.error
+                : 'Spawn request failed.';
+            throw new Error(message);
+        }
+        return result;
+    }
+    return {
+        load: (key) => request(key),
+        save: (key, value, expectedVersion) => request(key, {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ value, expectedVersion }),
+        }),
+    };
+}
+export const MAX_GAME_BRIDGE_OUTSTANDING = 20;
+const GAME_BRIDGE_VERSION = 1;
+const GAME_BRIDGE_TIMEOUT_MS = 15_000;
+const GAME_BRIDGE_PAYMENT_TIMEOUT_MS = 300_000;
+const PUBLIC_PROFILE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DOCUMENT_TOKEN_PATTERN = /^\/build\/([A-Za-z0-9_-]{43})\//;
+const BRIDGE_NONCE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function validSaveKey(key) {
+    return /^[a-zA-Z0-9_-]{1,64}$/.test(key);
+}
+function normalizePlatformOrigin(platformOrigin) {
+    if (typeof platformOrigin !== 'string' || platformOrigin.trim() === '') {
+        throw new Error('platformOrigin is required for the embedded Spawn game client.');
+    }
+    let parsed;
+    try {
+        parsed = new URL(platformOrigin);
+    }
+    catch {
+        throw new Error('platformOrigin must be an absolute HTTP or HTTPS origin.');
+    }
+    const schemeEnd = platformOrigin.indexOf('://');
+    const authorityAndRemainder = schemeEnd < 0 ? platformOrigin : platformOrigin.slice(schemeEnd + 3);
+    const remainderStart = authorityAndRemainder.search(/[/?#\\]/);
+    const remainder = remainderStart < 0 ? '' : authorityAndRemainder.slice(remainderStart);
+    const authority = remainderStart < 0 ? authorityAndRemainder : authorityAndRemainder.slice(0, remainderStart);
+    const isLiteralLoopback = !authority.includes('@') && (authority.toLowerCase() === 'localhost' ||
+        authority.toLowerCase().startsWith('localhost:') && /^localhost:\d+$/i.test(authority) ||
+        authority === '127.0.0.1' ||
+        /^127\.0\.0\.1:\d+$/.test(authority) ||
+        authority === '[::1]' ||
+        /^\[::1\]:\d+$/.test(authority));
+    if (!['http:', 'https:'].includes(parsed.protocol) || platformOrigin !== platformOrigin.trim() || (remainder !== '' && remainder !== '/') || parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash || platformOrigin.includes('?') || platformOrigin.includes('#') || parsed.protocol === 'http:' && !isLiteralLoopback) {
+        throw new Error('platformOrigin must be an absolute HTTP or HTTPS origin without a path, credentials, query or fragment.');
+    }
+    return parsed.origin;
+}
+function embeddedWindow() {
+    const currentWindow = globalThis.window;
+    if (!currentWindow || currentWindow.parent === currentWindow) {
+        throw new Error('createSpawnGameClient requires an embedded game iframe.');
+    }
+    return currentWindow;
+}
+function launchedDocumentToken(gameWindow) {
+    const pathname = gameWindow.location?.pathname;
+    const match = typeof pathname === 'string' ? DOCUMENT_TOKEN_PATTERN.exec(pathname) : null;
+    if (!match) {
+        throw new Error('createSpawnGameClient requires a launched /build/<document-token>/ game document.');
+    }
+    return match[1];
+}
+function bridgeRequestId() {
+    const cryptoValue = globalThis.crypto;
+    if (!cryptoValue || typeof cryptoValue.randomUUID !== 'function') {
+        throw new Error('The embedded Spawn game client requires crypto.randomUUID.');
+    }
+    return cryptoValue.randomUUID();
+}
+function safePayment(value) {
+    return isObject(value) &&
+        exactObjectKeys(value, ['id', 'intentId', 'amount', 'asset', 'environment', 'status']) &&
+        typeof value.id === 'string' &&
+        typeof value.intentId === 'string' &&
+        value.amount === 10 &&
+        value.asset === 'TEST' &&
+        value.environment === 'sandbox' &&
+        value.status === 'paid';
+}
+function exactObjectKeys(value, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    const keys = Object.keys(value);
+    return required.every((key) => key in value) && keys.every((key) => allowed.has(key));
+}
+function validAvatarUrl(value, targetOrigin) {
+    if (typeof value !== 'string' || value.trim() === '' || value !== value.trim())
+        return false;
+    try {
+        const parsed = new URL(value);
+        const avatarPathPrefix = '/api/v1/avatars/';
+        const profileId = parsed.pathname.startsWith(avatarPathPrefix)
+            ? parsed.pathname.slice(avatarPathPrefix.length)
+            : '';
+        return ['http:', 'https:'].includes(parsed.protocol) &&
+            parsed.origin === targetOrigin &&
+            !parsed.username &&
+            !parsed.password &&
+            !parsed.hash &&
+            PUBLIC_PROFILE_ID_PATTERN.test(profileId) &&
+            (parsed.search === '' || /^\?v=[0-9a-f]{16}$/.test(parsed.search));
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeIdentity(value, targetOrigin) {
+    if (!isObject(value) || !exactObjectKeys(value, ['id', 'handle', 'displayName', 'environment'], ['avatarUrl'])) {
+        throw new Error('Spawn bridge returned an invalid identity.');
+    }
+    if (typeof value.id !== 'string' ||
+        typeof value.handle !== 'string' ||
+        typeof value.displayName !== 'string' ||
+        value.environment !== 'sandbox') {
+        throw new Error('Spawn bridge returned an invalid identity.');
+    }
+    if (value.avatarUrl !== undefined && value.avatarUrl !== null && !validAvatarUrl(value.avatarUrl, targetOrigin)) {
+        throw new Error('Spawn bridge returned an invalid avatar URL.');
+    }
+    return {
+        id: value.id,
+        handle: value.handle,
+        displayName: value.displayName,
+        avatarUrl: value.avatarUrl ?? null,
+        environment: 'sandbox',
+    };
+}
+function isMessagePort(value) {
+    return isObject(value) &&
+        typeof value.postMessage === 'function' &&
+        typeof value.addEventListener === 'function' &&
+        typeof value.removeEventListener === 'function' &&
+        typeof value.close === 'function';
+}
+function closeMessagePort(port) {
+    if (!port)
+        return;
+    try {
+        port.close();
+    }
+    catch {
+        // A disconnected MessagePort is already unusable.
+    }
+}
+/** Published and local launchers inject only this public origin, never identity or credentials. */
+export function createSpawnGameClient(options = {}) {
+    const injected = globalThis.__SPAWN_LAUNCH__;
+    const platformOrigin = options.platformOrigin ?? (typeof injected?.platformOrigin === 'string' ? injected.platformOrigin : '');
+    const targetOrigin = normalizePlatformOrigin(platformOrigin);
+    const gameWindow = embeddedWindow();
+    const documentToken = launchedDocumentToken(gameWindow);
+    let disposed = false;
+    let handshakeAccepted = false;
+    let connectedPort;
+    const pending = new Map();
+    const removePending = (id) => {
+        const request = pending.get(id);
+        if (!request)
+            return undefined;
+        pending.delete(id);
+        if (request.timer !== undefined)
+            clearTimeout(request.timer);
+        return request;
+    };
+    const onPortMessage = (event) => {
+        const data = event.data;
+        if (isObject(data) && data.type === 'spawn:ready') {
+            if (connectedPort &&
+                data.version === GAME_BRIDGE_VERSION &&
+                exactObjectKeys(data, ['type', 'version', 'nonce']) &&
+                typeof data.nonce === 'string' &&
+                BRIDGE_NONCE_PATTERN.test(data.nonce)) {
+                try {
+                    connectedPort.postMessage({
+                        type: 'spawn:ready-ack',
+                        version: GAME_BRIDGE_VERSION,
+                        nonce: data.nonce,
+                    });
+                }
+                catch {
+                    // The parent may have invalidated this port during navigation.
+                }
+            }
+            return;
+        }
+        if (!isObject(data) || data.type !== 'spawn:response' || data.version !== GAME_BRIDGE_VERSION || typeof data.id !== 'string')
+            return;
+        const request = pending.get(data.id);
+        if (!request)
+            return;
+        if (data.ok !== true && data.ok !== false)
+            return;
+        if (data.ok === true) {
+            if (!exactObjectKeys(data, ['type', 'version', 'id', 'ok', 'value']))
+                return;
+        }
+        else if (!exactObjectKeys(data, ['type', 'version', 'id', 'ok', 'error']) || typeof data.error !== 'string') {
+            return;
+        }
+        const completed = removePending(data.id);
+        if (!completed)
+            return;
+        if (data.ok === true)
+            completed.resolve(data.value);
+        else if (typeof data.error === 'string')
+            completed.reject(new Error(data.error));
+        else
+            completed.reject(new Error('Spawn bridge returned an invalid error.'));
+    };
+    const sendPending = (id, request) => {
+        if (!connectedPort || pending.get(id) !== request)
+            return;
+        try {
+            connectedPort.postMessage(request.message);
+        }
+        catch (error) {
+            const failed = removePending(id);
+            if (failed)
+                failed.reject(error instanceof Error ? error : new Error('Spawn bridge request failed.'));
+        }
+    };
+    const flushQueued = () => {
+        if (!connectedPort)
+            return;
+        for (const [id, request] of pending)
+            sendPending(id, request);
+    };
+    const onWindowMessage = (event) => {
+        if (event.source !== gameWindow.parent || event.origin !== targetOrigin)
+            return;
+        const data = event.data;
+        if (!isObject(data) || data.type !== 'spawn:connected' || data.version !== GAME_BRIDGE_VERSION || !exactObjectKeys(data, ['type', 'version']))
+            return;
+        if (handshakeAccepted) {
+            const candidate = event.ports?.length === 1 && isMessagePort(event.ports[0])
+                ? event.ports[0]
+                : undefined;
+            if (candidate && candidate !== connectedPort)
+                closeMessagePort(candidate);
+            return;
+        }
+        if (event.ports?.length !== 1 || !isMessagePort(event.ports[0]))
+            return;
+        const port = event.ports[0];
+        handshakeAccepted = true;
+        connectedPort = port;
+        try {
+            port.addEventListener('message', onPortMessage);
+            port.start?.();
+        }
+        catch (error) {
+            connectedPort = undefined;
+            closeMessagePort(port);
+            for (const id of pending.keys()) {
+                const failed = removePending(id);
+                if (failed)
+                    failed.reject(error instanceof Error ? error : new Error('Spawn bridge connection failed.'));
+            }
+            return;
+        }
+        flushQueued();
+    };
+    gameWindow.addEventListener('message', onWindowMessage);
+    try {
+        gameWindow.parent.postMessage({ type: 'spawn:connect', version: GAME_BRIDGE_VERSION, documentToken }, targetOrigin);
+    }
+    catch (error) {
+        gameWindow.removeEventListener('message', onWindowMessage);
+        throw error instanceof Error ? error : new Error('Spawn bridge connection failed.');
+    }
+    function request(method, payload, timeoutMs) {
+        if (disposed)
+            return Promise.reject(new Error('Spawn game client is disposed.'));
+        if (pending.size >= MAX_GAME_BRIDGE_OUTSTANDING) {
+            return Promise.reject(new Error(`Spawn game client allows at most ${MAX_GAME_BRIDGE_OUTSTANDING} outstanding requests.`));
+        }
+        const id = bridgeRequestId();
+        const requestState = {
+            message: {
+                type: 'spawn:request',
+                version: GAME_BRIDGE_VERSION,
+                id,
+                method,
+                payload,
+            },
+            resolve: () => undefined,
+            reject: () => undefined,
+        };
+        const promise = new Promise((resolve, reject) => {
+            requestState.resolve = resolve;
+            requestState.reject = reject;
+        });
+        pending.set(id, requestState);
+        requestState.timer = setTimeout(() => {
+            const current = pending.get(id);
+            if (!current)
+                return;
+            pending.delete(id);
+            if (current.timer !== undefined)
+                clearTimeout(current.timer);
+            current.reject(new Error('Spawn bridge request timed out.'));
+        }, timeoutMs);
+        sendPending(id, requestState);
+        return promise;
+    }
+    function dispose() {
+        if (disposed)
+            return;
+        disposed = true;
+        gameWindow.removeEventListener('message', onWindowMessage);
+        if (connectedPort) {
+            connectedPort.removeEventListener('message', onPortMessage);
+            closeMessagePort(connectedPort);
+            connectedPort = undefined;
+        }
+        for (const request of pending.values()) {
+            if (request.timer !== undefined)
+                clearTimeout(request.timer);
+            request.reject(new Error('Spawn game client is disposed.'));
+        }
+        pending.clear();
+    }
+    return {
+        identity: () => request('identity', {}, GAME_BRIDGE_TIMEOUT_MS).then((value) => normalizeIdentity(value, targetOrigin)),
+        load: (keyOrRequest) => {
+            const key = typeof keyOrRequest === 'string'
+                ? keyOrRequest
+                : isObject(keyOrRequest) && typeof keyOrRequest.key === 'string' && exactObjectKeys(keyOrRequest, ['key'])
+                    ? keyOrRequest.key
+                    : '';
+            if (!validSaveKey(key))
+                return Promise.reject(new Error('Invalid save key.'));
+            return request('load', { key }, GAME_BRIDGE_TIMEOUT_MS);
+        },
+        save: (keyOrRequest, value, expectedVersion) => {
+            const requestObject = isObject(keyOrRequest) && exactObjectKeys(keyOrRequest, ['key', 'value', 'expectedVersion'])
+                ? keyOrRequest
+                : undefined;
+            const key = typeof keyOrRequest === 'string' ? keyOrRequest : requestObject?.key ?? '';
+            const actualValue = typeof keyOrRequest === 'string' ? value : requestObject?.value;
+            const actualVersion = typeof keyOrRequest === 'string' ? expectedVersion : requestObject?.expectedVersion;
+            if (!validSaveKey(key))
+                return Promise.reject(new Error('Invalid save key.'));
+            if (typeof actualVersion !== 'number' || !Number.isInteger(actualVersion) || actualVersion < 0) {
+                return Promise.reject(new Error('Invalid save version.'));
+            }
+            return request('save', { key, value: actualValue, expectedVersion: actualVersion }, GAME_BRIDGE_TIMEOUT_MS);
+        },
+        submitScore: (scoreOrRequest, details) => {
+            const requestObject = isObject(scoreOrRequest) && exactObjectKeys(scoreOrRequest, ['score'], ['details'])
+                ? scoreOrRequest
+                : undefined;
+            const score = typeof scoreOrRequest === 'number' ? scoreOrRequest : requestObject?.score;
+            const actualDetails = typeof scoreOrRequest === 'number' ? details : requestObject?.details;
+            if (typeof score !== 'number' || !Number.isFinite(score)) {
+                return Promise.reject(new Error('Score must be a finite number.'));
+            }
+            if (actualDetails !== undefined && (!isObject(actualDetails) || Array.isArray(actualDetails))) {
+                return Promise.reject(new Error('Score details must be an object.'));
+            }
+            const payload = actualDetails === undefined ? { score } : { score, details: actualDetails };
+            return request('submitScore', payload, GAME_BRIDGE_TIMEOUT_MS);
+        },
+        requestPayment: (productOrRequest) => {
+            const productId = productOrRequest === 'entry' ||
+                (isObject(productOrRequest) && productOrRequest.productId === 'entry' && exactObjectKeys(productOrRequest, ['productId']))
+                ? 'entry'
+                : undefined;
+            if (!productId)
+                return Promise.reject(new Error('Only the entry test product is available.'));
+            return request('requestPayment', { productId }, GAME_BRIDGE_PAYMENT_TIMEOUT_MS).then((value) => {
+                if (!safePayment(value))
+                    throw new Error('Spawn bridge returned an invalid test payment.');
+                return value;
+            });
+        },
+        dispose,
+    };
+}

package/dist/multiplayer.d.ts

@@ -0,0 +1,17 @@
+/** Browser-only admission transport. Account proof is verified on the creator's server. */
+export type SpawnMultiplayerOptions = {
+    platformOrigin: string;
+    serverOrigin: string;
+    /** Trusted same-server resource routing refresh; never player or payment proof. */
+    onResourcePath?: (path: string) => void;
+};
+export type SpawnMultiplayerClient = {
+    ready(): Promise<void>;
+    requestGrant(): Promise<{
+        ticket: string;
+    }>;
+    /** Presentation only. Never authorizes a player, action or reward. */
+    reportConnection(state: 'connecting' | 'ready' | 'disconnected'): boolean;
+    dispose(): void;
+};
+export declare function createSpawnMultiplayerClient(options: SpawnMultiplayerOptions): SpawnMultiplayerClient;