FOR DEVELOPERS / NATIVE API
Public API, in full.
Every public GameReader header is available here. Platform adapter headers are included in their matching platform build. Reading these docs needs no license; using the binaries follows the SDK terms, and implementation source requires a separate paid agreement.
C++ header reference Public documentation
All declarations below can be read without a license or member key. The corresponding prebuilt SDK is free for commercial use below EUR 1 trillion annual revenue; at or above that threshold, an enterprise license is required. Binary SDK license at threshold
| Header | Interface | Documentation |
|---|---|---|
| Game.hpp | Catalogue, item, experiment, parameter, and validation types. | Public |
| Json.hpp | Bounded JSON value and field access. | Public |
| Reader.hpp | HTTP, crypto, media, and output host interfaces; index and download operations. | Public |
| CallbackHttp.hpp | Bounded caller supplied HTTP host for native integrations. The caller fetches on a worker thread; the adapter checks path, final URL, status, headers, response size, and cancellation before the Reader verifies content. | Public · C++ preview |
| Session.hpp | Verified game session refresh, catalogue access, and item fetch. | Public |
| Transport.hpp | Carrier part, resource, audio location, and app index structures. | Public |
| OpenSslCrypto.hpp | OpenSSL SHA-256 and AES crypto host. Linux build tested; a local source-free review ZIP passes a clean consumer; it is not published. | Public · Linux preview |
| CurlHttp.hpp | Bounded same-origin libcurl range, suffix, and whole-body transport with cancellation. Linux build tested; a local source-free review ZIP passes a clean consumer; it is not published. | Public · Linux preview |
| PosixFileOutput.hpp | Private sibling staging and no-overwrite publication under a trusted real directory. Linux build tested; a local source-free review ZIP passes a clean consumer; it is not published. | Public · Linux preview |
| PosixMedia.hpp | libpng-backed PNG low-bit and sparse-frame decoding plus four-tone WAV recovery. Linux generated-site fixture tested; a local source-free review ZIP passes a clean consumer; it is not published. | Public · Linux preview |
| WindowsCrypto.hpp | Windows CNG crypto host. | Public · Windows |
| WindowsHttp.hpp | Bounded WinHTTP host and cancellation. | Public · Windows |
| WindowsMedia.hpp | Windows PNG, frame, and WAV media decoder. | Public · Windows |
| WindowsFileOutput.hpp | No-overwrite transactional file output. | Public · Windows |
| PreviewC.h | Complete plain-C ABI declarations and constants. | Public · preview |
| PreviewHandles.hpp | Source-only C++17 ownership wrappers for preview site and operation handles; calls still use the C ABI. Download the working example. | Public · preview |
| UnrealAmoosedWebSubsystem.h | Blueprint callable catalogue refresh, public item fetch, results, and cancellation. | Public · Unreal preview |
Read the native integration guide for a working session example and host responsibilities. The C ABI guide explains its current symbols, ownership, and 1.0 plan. The Win64 GameReader review SDK includes its matching public headers; the Unreal subsystem header is provided with the Unreal plugin. Linux adapter headers and a local source-free review ZIP have passed clean CMake consumer tests; no public Linux binary is available yet. No C++ implementation source is needed to compile against the Win64 SDK.
Verified Reader operations Binary SDK terms apply
Reader.hpp declares the C++17 operation and host contracts. Each function returns true on success. On failure, inspect ReaderFailure for control flow and use error only as diagnostic text. A failed download must leave no published output.
| Operation | Inputs and result | Failure and lifetime rule |
|---|---|---|
open_hosted_index | Read and verify the current site's /favicon.ico index through HttpHost and CryptoHost; fill IndexResult with the app resource map and payload digest. | Keep the origin inside the supplied host. The verified index is a snapshot; it is not a revocation signal for older downloaded bytes. |
open_external_index | Supply the separately delivered AMWKEY1 file bytes or packed ICO bytes; verify the encrypted index at its same-origin carrier locator. | The credential is a transferable bearer key. Keep its bytes outside the public build and logs. |
download_resource | Supply an indexed resource path, optional 32-byte member content key, hosts, and an OutputHost. Receive the verified plaintext byte count and SHA-256 in DownloadResult. | Every stored part and the assembled plaintext must verify before OutputHost::commit. On failure or cancellation, the Reader calls abort; the caller still owns the output object. |
ReaderFailure distinguishes absent resources or items, an unready game session, a rejected game revision rollback, bad format, authentication, verification, network, output, unsupported codec, cancellation, and internal failure. The revision-16 plain-C preview exposes those distinctions as NOT_FOUND, INVALID_STATE, and STALE_REVISION; C++ enum layout and object types are not a stable 1.0 binary ABI.
Host and output interfaces Binary SDK terms apply
| Interface | What an integration must provide |
|---|---|
HttpHost | fetch_range requests an inclusive byte range; fetch_suffix requests the final bytes; fetch_complete fetches a bounded whole carrier for media codecs. Reject redirects and cross-origin responses, omit credentials and cache, enforce max_body, and expose cancellation through cancelled. The base whole-carrier method reports unsupported until an adapter implements it. |
CryptoHost and Hasher | new_sha256 supplies a streaming hasher; aes256_ctr decodes the public website layer. aes256_gcm_open_result returns GcmOpenResult as success, authentication failure, or local provider failure when opening member parts or an external index. The supplied Windows and OpenSSL hosts distinguish a rejected tag from a provider failure. A custom host may still implement only the older boolean aes256_gcm_open; its false result conservatively means authentication failure. random_bytes supplies cryptographic nonces for native authoring. Built-in Windows and OpenSSL hosts use the platform CSPRNG; a Reader-only custom host may leave it unsupported, in which case native authoring fails closed. aes256_gcm_seal is the compiler-side operation for protected resource parts; its default reports unsupported, so a Reader-only custom host need not implement it. The supplied hosts implement both GCM directions. Failed authentication must leave the caller with no plaintext. |
MediaDecoder | Recover payload bytes from a complete bounded media carrier. The Reader then verifies the indexed shard hash. Pass nullptr only when no indexed resource needs a whole-file media codec. |
OutputHost | Write only to private staging, publish after verification in commit, and remove staging in abort. The product chooses the destination and must avoid deriving it directly from untrusted resource text. |
The supplied Windows adapters are WindowsHttpHost (WinHTTP; HTTPS or loopback HTTP), WindowsCryptoHost (CNG), WindowsMediaDecoder (PNG low bits, sparse frames, and WAV tones), and WindowsFileOutput (new sibling staging and no-overwrite publication). WindowsHttpHost::cancel may be requested from another thread; serialize other operations on that host. The file output requires an absolute local path in a trusted directory and rejects reparse-point ancestors.
The Linux source-build preview offers CurlHttpHost, OpenSslCryptoHost, PosixFileOutput, and PosixMediaDecoder. Call CurlHttpHost::initialize() during startup before creating worker threads when using libcurl versions older than 7.84.0, as described in libcurl's threading guidance. The HTTP host rejects redirects, limits response bytes, accepts HTTPS or loopback HTTP, and supports cancellation from another thread. The output adapter requires an existing trusted real directory, stages privately, and never replaces an existing destination. A local Ubuntu fixture opens a generated hosted index and saves exact byte-addressable, PNG low-bit, sparse-frame, and WAV tone public resources. Linux C ABI site exports pass a plain-C hosted download fixture and exact ELF symbol inventory. A local source-free ZIP passes a clean extracted CMake consumer; wider parity fixtures remain incomplete.
Game catalogue and session Binary SDK terms apply
| Operation | Behavior |
|---|---|
parse_game_catalogue, catalogue_accepts_game | Validate catalogue JSON and determine whether its game ID and version range match the product. The resulting GameCatalogue contains revision and item IDs, kinds, paths, and dependencies. |
GameSession::refresh_hosted, refresh_external | Verify an index and its game catalogue together; accept the new pair only when complete. Failed refresh keeps the last verified snapshot. Lower revisions require explicit allow_rollback. |
GameSession::ready, catalogue, index_digest | Inspect the pinned snapshot. Do not use the catalogue before ready() succeeds; a later successful refresh may invalidate references to the old snapshot. |
GameSession::fetch_item | Resolve a catalogue item ID to its resource, then verify and publish through caller-owned hosts and output. A member key is supplied per fetch and is not retained by the session. |
parse_experiment, select_variant, evaluate_experiment | Parse a bounded experiment, select a repeatable variant using the product's anonymous ID and SHA-256 callback, and apply parameters only if every name and value passes caller-supplied bounds. On failure retain compiled-in defaults. This is not an access-control mechanism. |
Transport.hpp defines Part, Resource, AudioCarrier, and AppIndex. parse_app_index validates a document section's transport schema; it does not authenticate an index by itself. Use an open_*_index operation for verified provenance. Json.hpp exposes parse_json with an explicit byte cap and bounded field access for adapter tooling; it does not replace the Reader's index verification.
Licensed implementation Separate source license
The GameReader C++ implementation and Unreal plugin source are separate from this public interface. They are the licensed parts of this reference; the declarations above remain public. Companies that complete an enterprise source agreement and payment receive a private key to the developer members area. The public header and binary SDK terms are summarized on the API access table; the package contains the draft license text.