# Snow Crash · API 1 Snow Crash owns game content and the player app. It consumes the shared Game Engine over HTTPS; no second engine, database, renderer or pathfinder exists here. Creative Studio owns all proposals and storyboards. ## Identity Private AuthReturn app `snow-crash`. GET /api/config returns authApp, engine origin and release. GET /api/me and /api/content require this app's ID JWT, verified against exact issuer/audience/RS256/expiry/token_use with five-second config/JWKS deadlines. Public GET /api/health and /api/version report the app revision. Dedicated tests use snow-crash-test-agent@fairystack.com and snow-crash-peer-test-agent@fairystack.com, never operator gameplay state. Their passwords come from FairyStack's canonical customer-agent resolver using allocations snow-crash-test and snow-crash-peer-test, slug snow-crash. ## Engine integration GET https://game-engine.jessald.fairystack.com/agent-guide.md is authoritative. POST /api/access/exchange on that origin with {app:"snow-crash",token:} returns an engine capability scoped to release prefix `snow-crash@`, never workshop owner authority. The browser stores no engine credentials in URLs. The public /sdk/v1/game-player.js browser module supplies mountGame; it imports the engine's Renderer, Connection, player controller and validated content contract. CORS permits this app's exact public origin. SDK startup has a 12-second deadline; world loading has a 120-second overall deadline. Session creation takes at most 15 seconds. Gameplay recovery is bounded to 30 seconds; Retry retains pending IDs. Each call carries its own timeout. Logout/navigation disposes owned work. The app remembers the latest session per verified identity. A session URL is not an access grant. New session starts a new pinned game after Start session; refresh resumes the saved one and may require explicit Take control. ## Authoring content/snow-crash.json is the game-owned immutable initial release source. content/imported-layout.json is the original eleven-scene export retained as provenance. Only three locations are included in the current district. No storyboard hierarchy or linear story is a required game structure. GET /api/content exports the authored pack to members; other writes are 405. Use scripts/publish.mjs with an engine-owner identity file for authoring-time validation, asset integrity, draft and publish APIs. Never edit engine storage. The current release is snow-crash@0.1.0. Assets are content-addressed, published through the engine workshop. Files under content/ are not static HTTP routes. ## Multiplayer Use the scoped engine capability for POST /api/sessions//invite {} and pass its single-use code to another authenticated player via POST /api/sessions/join {id,code}. Expiry is one hour; maximum eight members. Invite/join is agent-driven. Never place invitation codes or authentication credentials in URLs. ## Resource links - https://snow-crash.jessald.fairystack.com/ — authenticated game, latest session or ready-to-start district. Local sign-in is this app's own registration. - /?session= — pinned saved session, members only; unknown/unowned IDs fail. - /architecture.html — explanatory ownership, actual implementation and recovery. - https://creative-studio.jessald.fairystack.com/?project=snow-crash — project concepts. - https://creative-studio.jessald.fairystack.com/?view=storyboard&project=snow-crash — retained design references, not required gameplay structure. - https://game-engine.jessald.fairystack.com/architecture.html — engine contract. ## Verification npm test covers content structure and authenticated app boundaries. The engine suite covers physics, state, isolation, generic SDK recovery and immutability. node tests/live.mjs exercises real app JWTs, scoped engine exchange, two-player presence, movement, travel, reload/control, mobile and analytics over public HTTPS. Provider login UI is stubbed to deliver dedicated test JWTs; backend verification and every gameplay call use the actual deployed services.