Hosted service

Service boundary

The browser sends non-secret inputs to POST /api/query on the public web service. This same-origin route validates and limits callers before forwarding requests over Railway private networking. The private API independently repeats target and resource checks and never exposes its origin token to browser code.

Public playground route

The web boundary accepts only the game, host, optional ports, query mode, and deadline. It canonicalizes game aliases, bounds the request body, and applies per-caller, global-start, active-query, and tracked-caller limits before any private API work begins. Successful forwarding returns the hosted response JSON unchanged and adds no private proxy metadata.

• At most 8 query starts per caller each minute.
• At most 60 query starts globally each minute per web instance.
• At most 8 forwarded queries active at once per web instance.
• At most 2,048 caller counters retained in memory.
• Request bodies are capped at 2 KiB.
• The private API response deadline is capped at 7 seconds.

These are deliberately small in-memory controls, not a distributed quota system. The private API still owns destination, concurrency, and protocol safety.

Private API routes

• POST /query performs a hosted query.
• GET /games returns the package-exported registry.
• GET /health returns liveness and bounded operational counters.

There is no /v1 prefix. The current API is private and has no public domain.

Caching

• The direct library does not cache.
• The private API uses a bounded in-memory LRU and in-flight coalescing.
• Successful results live for 10 seconds, partial results for 5 seconds, and timeout or offline failures for 2 seconds.
• Invalid, blocked, malformed, aborted, and internal failures are not cached.
• Static documentation and hashed assets use public cache headers from this web service.

Security and abuse constraints

User-directed network access can become an SSRF tool, port scanner, internal-network probe, or UDP abuse source. QueryHost restricts inputs to known game profiles, validates and pins public destinations, refuses redirects, caps concurrency and admission, bounds every parser and transport, and fails closed when capacity is exhausted.

Initial cost boundary

The initial deployment uses one small web service and one private API service with Railway resource limits, usage alerts, and a hard spending limit. It does not add Redis, D1, KV, databases, accounts, billing, persistent monitoring, replicas, or multi-region infrastructure.