Chapter 1 of 13
The model
What an addon is, the four resources it can offer, the three rules everything follows from, and the sandbox your game page runs in.
An addon is a service you host, described by a manifest.json. It offers some of four
resources:
| Resource | What it is |
|---|---|
catalog |
The list of games you offer. |
meta |
A detail page for each game: name, description, player count. |
play |
How to play it: the URL of your game page, optional custom tabs, optional engine. |
engine |
Declared by an addon whose Play Options have an engine: a server that owns the rules, called by CamTable’s room as a stateless reducer. |
Everything else follows from three rules:
- CamTable hosts none of your game. Your game page is an ordinary web page on your own origin. CamTable opens it in a nested frame and never downloads, stores or executes your code in its own extension or server.
- The room stores the state, and your rules decide it. Presence, turns, timers and the game state live in CamTable’s room. A player’s action is an intent, never a state: the room hands it to your rules (the room host’s page, or your engine) and stores what they answer. The room never merges a state a client sent. Your page renders what the room broadcasts and sends what the player did.
- CamTable never lists or recommends community addons. Players install yours by URL or by an install link you share. Official games ship in CamTable’s own official addon, through this same protocol.
Security model
Your game page runs inside a nested sandbox="allow-scripts" frame with an opaque origin, inside
CamTable’s extension page:
- It cannot read Discord’s page, cookies or storage, and it has no access to the extension’s APIs.
- All contact with CamTable is the
postMessagebridge behind@camtable/sdk. Each capability the bridge offers needs a permission your manifest declared (section 4: Permissions). - Your page never receives camera or microphone pixels or audio. Video appears on screen because CamTable draws it behind a hole your page punches (section 6: The game page and the SDK), not because you get the stream.
- Your page can make its own network requests: CamTable does not restrict them. In exchange it minimises what you can learn about players (section 5: Players and privacy).