CosmicGameSanctuary

Demo

About

Cosmic Game Sanctuary is a storefront for browser games where the money and the ownership settle on Hedera instead of through a card network. The thing we think is actually interesting is that it's a games storefront where an autonomous agent is a first-class buyer, same as a person. For a person: browse with no login, sign in with just an email (no wallet popup, no seed phrase, no gas jargon), fund your wallet, buy a game, and it boots right there in the same tab a few seconds later, because the build is already pinned to IPFS and gets unpacked live in your browser. You get a GameKey, a real NFT, as proof you own it. You can also try a game minute by minute before buying, and every minute you already paid for a trial comes off the price if you decide to buy. For an agent: you put a game on your wishlist with a budget and walk away. The agent watches the store's public event feed on Hedera, and when something goes on sale it doesn't panic buy, it waits until the last responsible moment before the sale ends, checks what else you want and whether you can still afford both, asks a small model to decide only if the answer isn't obvious, then pays with its own wallet while the game itself lands in your account. It also has an ENS name of its own, and the ceiling it's allowed to spend is published as a record on that name and checked on chain before every purchase, not just asserted by us. For a developer: your build runs live in the page before you even publish it, you split revenue with your team by email (a teammate doesn't need a wallet yet, just an email, and the split locks the moment you publish, no editing it after), and your studio gets its own subname on ENS as its identity. We're deliberately not a web3 game, not GameFi. The goal is to feel like Poki or itch.io first and a crypto app never.

How it's made

Frontend is Vite, React 19, TypeScript, Tailwind v4. Backend is Node, Express, Drizzle over Postgres on Neon. Two of us, one repo each side, talking over a plain REST contract, with one deliberate exception below. Hedera is where the money and ownership actually live. We use the Hiero SDK (the renamed Hashgraph SDK) plus the official x402 packages for Hedera. Every game gets its own HTS NFT collection at publish time with no wipe, freeze, pause, or admin key on it, so "we can't take your game back" is something you can check on HashScan instead of something we just say. Buying a game, running a paid trial by the minute, and the agent paying for its own LLM call are all separate x402 gated routes, all settled through Blocky402 as the facilitator. The buyer never needs HBAR, the facilitator's own fee payer covers gas, and HIP-542 means a plain token transfer is enough to spin up a brand new Hedera account by itself. We also write to three public HCS topics, one for every listing and price change (so a sale's countdown is checkable by anyone watching the topic, not just printed on our own page), one for every settled sale, and one anchoring each agent's identity to the human who funds it. That last one is hand rolled against the HCS-14 spec, SHA-384 and Base58 over six canonical fields, because the standards SDK's install never finished in over four minutes and the spec explicitly allows offline derivation anyway. The agent calls Groq (openai/gpt-oss-20b) with structured output enforced, but only when a decision is actually contested, most rounds resolve without ever calling the model. It subscribes to the HCS listings topic directly instead of polling, so it costs the same whether there's 1 agent watching or 1000. Getting the decision timing right took three rewrites. The first version could only ever see one eligible option at a time, because two sales almost never start in the same second, so the hard choice the whole feature exists for never actually came up. The fix was scheduling the decision itself for the last responsible moment before a sale ends, and re-checking eligibility fresh every time instead of trusting a plan made earlier. ENS is ENSv2 on Sepolia, not just a name lookup. We deployed our own subregistry through VerifiableFactory and registered cgs-sanctuary.eth for real through commit reveal. Studio subnames mint on chain at signup with a role bitmap that only lets a studio point its own name and renew it, never unregister or transfer it away from us, same trust shape as the NFT keys above. Agents can claim a subname too, under that same scoped role, so an agent gets its own onchain identity the same way a studio does. One thing worth calling out because it was a real bug, not a design choice: the subnames were genuinely registered on Sepolia, but ENSv2 gives every name its own resolver instance, and ours were pointed at a resolver we held no write role on. Every name was real, what it pointed at was 0x0. A Discord question about whether resolution was actually live, or just registered, made us check on chain instead of trusting our own code, and that's where we found it. Fixed by deploying our own PermissionedResolver through VerifiableFactory and repointing every name without re-registering any of them. While we were in there we made the agent's spending ceiling a real text record on its own name too, cgs:maxSpend, read back and enforced before every purchase, and deliberately fail-open if the name or Sepolia itself is unreachable, so an ENS hiccup can never block or loosen a Hedera purchase. Privy handles login and wallets. Email in, embedded wallet out, no seed phrase ever shown. The hacky part worth mentioning: Privy never actually returns a wallet's public key from its own API, it comes back empty on both create and get. So we make the wallet sign a throwaway message and recover the public key from the signature itself, which works because the signature's recovery byte makes the key mathematically recoverable. We use the same trick on a buyer's real payment signature to confirm the signer actually holds the wallet being charged, before letting a transfer settle. The server builds and freezes the transfer, the browser signs the raw hash with the embedded wallet, and the server settles it, nothing about the wallet is ever delegated to us. One more hacky bit. Uploaded game builds are real zips, unzipped client side with fflate and served out of the Cache API through a service worker, on a second origin from the app itself. Engines like Godot and Unity crash on boot without allow-same-origin, but granting that on our own origin would let an uploaded game read the session and rewrite our own page. So builds get an origin of their own instead, same trick itch.io uses for html-classic.itch.zone.