@spawndotfamily/sdk 0.2.9 → 0.2.10

package/AGENTS.md

@@ -14,6 +14,7 @@ Before each editing session, compare the installed version with `npm view @spawn
 - **Only documented, available methods.** Use the installed version's types and integration docs. If a requested method or hosted contract is missing, explain the limitation. Do not invent an endpoint or turn a first-party integration into a generic creator API.
 - **Identity comes from Spawn.** Use the isolated game client and shared startup controller. Wait for trusted identity before account-dependent play; multiplayer also needs verified server admission. Do not forge a player, forward cookies, relax origin checks, replace the isolated iframe or create an anonymous fallback after connection failure. Local fake accounts belong only in spawn-dev, never game code.
 - **TEST is not publication status.** An approved game can use TEST services. `environment: 'sandbox'` must not trigger fake identity or label an approved game as a private preview. No real-money deposits or redeemable payouts are enabled.
+- **One Spawn overlay, supplied by the platform.** Hosted games already get a top-right connection toast (fades after about 3.3 seconds) and a bottom-right Transactions button, matching the first-party launcher. Do not draw a second Spawn connection badge, toolbar, transaction button or payment modal inside the game. Remove old duplicate integration UI when upgrading. Keep useful player identity in your own gameplay UI. Local developer panels are not shipped game UI.
 - **Player confirmation is mandatory.** Ordinary launch is free. Only a deliberate optional action may request the documented TEST entry. Spawn owns Confirm → Processing → Paid → Continue outside the game. Handle cancellation and uncertain results; never automatically repeat a charge. A receipt proves a recorded payment, not fair play.
 - **Warn before automatic rewards:** “Players can fake wins and scores in a browser-only game. Automatically paying those results could drain your entire reward pool. A valid entry payment proves payment, not fair play. Keep automatic payouts off; use manual review or trusted server validation.” Give this warning before implementation. Obfuscation, domain locking and browser gates are not anti-cheat guarantees.
 - **Do not claim untested success.** A structural build check is not a play test or security review. If browser tools are unavailable, report that and request the creator's play test. External security scans require the creator's consent.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.10 — 2026-09-13
+
+### Added
+- Hosted-overlay acceptance checks for creator agents, including toast dismissal and removal of duplicate game-drawn banners.
+
+### Changed
+- Agent instructions define one consistent hosted overlay: a brief top-right connection toast and bottom-right Transactions button, supplied by Spawn.
+- Existing-game guidance removes duplicate Spawn badges/toolbars and distinguishes local developer panels from published UI.
+
+### Upgrade notes
+- Documentation-only release; transport, identity, payment, storage and publishing APIs are unchanged.
+- Spawn’s launcher fix applies to existing integrations without reinstalling. Upgrade the agent guide to 0.2.10 when editing a game, and remove any Spawn banner drawn by the game itself.
+- Verify the hosted preview after updating; the package alone does not deploy the platform launcher.
+
 ## 0.2.9 — 2026-09-13
 
 ### Added

package/README.md

@@ -9,7 +9,7 @@ Published games still use non-redeemable TEST services today. `environment: 'san
 
 Integrate a browser game with Spawn without access to Spawn's private infrastructure. Creators operate their own multiplayer servers. Spawn provides an optional small, player-and-game-scoped save store; it does not provision creator servers or give creators access to its database engine, VPS or administrator services.
 
-Install the published package using `npm install --save-exact @spawndotfamily/sdk@0.2.9 --ignore-scripts`. Read `node_modules/@spawndotfamily/sdk/AGENTS.md` and `node_modules/@spawndotfamily/sdk/docs/creator-checklist.md` before integrating. Bundle browser dependencies with your game; no UI framework or runtime SDK dependency is required. The public GitHub repository remains available for source inspection.
+Install the published package using `npm install --save-exact @spawndotfamily/sdk@0.2.10 --ignore-scripts`. Read `node_modules/@spawndotfamily/sdk/AGENTS.md` and `node_modules/@spawndotfamily/sdk/docs/creator-checklist.md` before integrating. Bundle browser dependencies with your game; no UI framework or runtime SDK dependency is required. The public GitHub repository remains available for source inspection.
 
 ## Choose an integration
 
@@ -83,4 +83,4 @@ Local creator testing includes the configurable incoming platform fee and a sepa
 
 ## Migrating existing source integrations
 
-The public npm name is `@spawndotfamily/sdk` because the `@spawn` namespace is unavailable. Update imports from `@spawn/sdk` to `@spawndotfamily/sdk`, including subpaths. Alternatively, preserve existing imports with `npm install --save-exact @spawn/sdk@npm:@spawndotfamily/sdk@0.2.9 --ignore-scripts`. Both names expose the same SDK APIs and CLI commands; choose one installation approach.
+The public npm name is `@spawndotfamily/sdk` because the `@spawn` namespace is unavailable. Update imports from `@spawn/sdk` to `@spawndotfamily/sdk`, including subpaths. Alternatively, preserve existing imports with `npm install --save-exact @spawn/sdk@npm:@spawndotfamily/sdk@0.2.10 --ignore-scripts`. Both names expose the same SDK APIs and CLI commands; choose one installation approach.

package/docs/creator-checklist.md

@@ -8,7 +8,7 @@ First read [the feature menu](creator-guide.md) and suggest only relevant featur
 
 Inspect the existing engine, build scripts, dependencies, asset paths, rendering, input and server architecture. Reuse the existing browser export. If a native game requires a substantial port or unsupported features, explain the cost and obtain the creator's decision before starting that port. Keep game rules, rendering, platform integration and server authority separate.
 
-Install the published SDK in the game folder with `npm install --save-exact @spawndotfamily/sdk@0.2.9 --ignore-scripts`, then read the installed `AGENTS.md` and this checklist. Keep the lockfile for registry integrity and reproducible installation. Compiled modules, local testing tools and the publishing CLI are included; no separate SDK build or manual archive download is required. Do not place credentials in the package directory or game build.
+Install the published SDK in the game folder with `npm install --save-exact @spawndotfamily/sdk@0.2.10 --ignore-scripts`, then read the installed `AGENTS.md` and this checklist. Keep the lockfile for registry integrity and reproducible installation. Compiled modules, local testing tools and the publishing CLI are included; no separate SDK build or manual archive download is required. Do not place credentials in the package directory or game build.
 
 The source remains available at https://github.com/spawndotfamily/spawn-sdk for inspection. A GitHub account connection or game repository is not required. Bundle imported browser modules normally. Record the installed package version in the test report.
 

package/docs/creator-guide.md

@@ -23,7 +23,7 @@ These are choices, not a checklist of features to add. Preserve existing gamepla
 ## The one-prompt workflow
 
 1. **Inspect.** Identify the engine, browser export, assets and any server dependency. A native executable alone is not a web build.
-2. **Install.** Run `npm install --save-exact --ignore-scripts @spawndotfamily/sdk@0.2.9`. Read the installed AGENTS.md, docs/creator-checklist.md and only the relevant integration sections. No separate SDK archive, source checkout or GitHub connection is needed.
+2. **Install.** Run `npm install --save-exact --ignore-scripts @spawndotfamily/sdk@0.2.10`. Read the installed AGENTS.md, docs/creator-checklist.md and only the relevant integration sections. No separate SDK archive, source checkout or GitHub connection is needed.
 3. **Connect.** Use the existing browser client and launcher identity. Use the shared startup controller for account-dependent play. Keep secret creator credentials outside source and the browser build. The downloaded file expires after 24 hours; ask for its saved path, never its secret in chat.
 4. **Test.** Build into any folder, then run `npx --no-install spawn-publish check <folder>` and `npx --no-install spawn-dev <folder>`. Play a real start → gameplay → finish/retry loop. Check input, missing assets, console errors, reconnect, saves and any cancel/confirmed TEST payment. Return evidence and clearly state anything you could not test.
 5. **Upload.** Run `npx --no-install spawn-publish publish <folder> --credentials <private-file-path>`. Return the actual preview link and release ID. If it fails, preserve the build and explain the error; GitHub import or Manual upload can send the same build, but are not guaranteed to bypass network problems.
@@ -56,4 +56,4 @@ Spawn owns payment confirmation outside the game. A successful entry receipt is
 
 Current public accounting is at https://spawn.family/transparency. It separates aggregate TEST accounting from unavailable real reserves. Matching totals are useful checks, not proof that every transaction is authorized. Read the installed security documentation; never invent missing methods or weaken the iframe, origin, credential or approval boundaries to make an integration pass.
 
-Before each editing session, check npm for updates and ask before upgrading. See [the update policy](game-data.md#before-each-editing-session). Spawn owns a compact connection/transactions overlay; do not add a duplicate full-width Spawn toolbar to the game.
+Before each editing session, check npm for updates and ask before upgrading. See [the update policy](game-data.md#before-each-editing-session). Spawn owns the shared hosted overlay: a top-right connection toast that disappears after about 3.3 seconds and a bottom-right Transactions button. Connecting/disconnected states remain visible. Do not add duplicate connection badges, toolbars, transaction buttons or payment dialogs inside the game. Remove old integration banners when updating an existing game. The platform launcher change applies to existing compatible SDK integrations without a rebuild; game-drawn banners require editing the game.

package/docs/publishing.md

@@ -6,7 +6,7 @@ Before integrating a game, read [AGENTS.md](../AGENTS.md), [security guidance](s
 
 ## Install the SDK from npm
 
-Run `npm install --save-exact @spawndotfamily/sdk@0.2.9 --ignore-scripts` in your game folder, then read the installed package's `AGENTS.md` and `docs/creator-checklist.md`. The package contains compiled browser modules, the local testing launcher and the publishing CLI. Keep the lockfile to retain npm integrity checks. No manual SDK archive or GitHub connection is required. The public source remains available at https://github.com/spawndotfamily/spawn-sdk.
+Run `npm install --save-exact @spawndotfamily/sdk@0.2.10 --ignore-scripts` in your game folder, then read the installed package's `AGENTS.md` and `docs/creator-checklist.md`. The package contains compiled browser modules, the local testing launcher and the publishing CLI. Keep the lockfile to retain npm integrity checks. No manual SDK archive or GitHub connection is required. The public source remains available at https://github.com/spawndotfamily/spawn-sdk.
 
 Read `platformOrigin` and `projectId` privately from the creator credentials. Keep the file outside the game repository and browser output. Stop and report unsupported endpoints or contract mismatches rather than guessing an API or weakening validation.
 

package/docs/testing.md

@@ -90,3 +90,7 @@ Agents may read `window.__SPAWN_DEV_STATE__` **on the launcher page**. Browser t
 For a clean regression: open the game, verify connected identity, submit a score and inspect `lastScore`; test payment cancellation and confirmation if used; rebuild, click Rebuild / reload and repeat. Upload only after these checks pass, then return the private preview for human approval.
 
 The creator test panel also controls leaderboard sharing, best/latest/every-run policy and score order. Test Alice/Bob, duplicate submission IDs, nested inventory saves, version conflicts and intentional removal. See [game data](game-data.md). These methods need SDK 0.2.9.
+
+## Hosted overlay acceptance
+
+After upload, open the private preview from Spawn: verify the connection toast appears at top-right, disappears after about 3.3 seconds, and Transactions stays at bottom-right. Verify reconnect notifications and payment confirmation still work. The launcher owns this UI; local test panels do not dictate the published layout. Remove any old game-drawn Spawn badge/toolbar rather than layering another over it. Do not remove your game controls or useful player-name display.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spawndotfamily/sdk",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "type": "module",
   "description": "Browser game SDK, isolated local testing, and private-preview publishing tools for Spawn.",
   "license": "MIT",