| No code from the network |
The SDK carries data only. Nothing received is executed, loaded or interpreted as a script by NightCoop |
| Memory safety of the wire |
Every reader checks lengths before it allocates or copies (n > max || Remaining() < n), strings are bounded, unknown kinds and versions are refused |
| Only the same mod |
Data goes to a mod only if both sides registered the same id and the same protocol; a mod you do not have never receives anything |
| Permissions |
A mod uses only what its passport declares (NCSDK_MOD_USES_CHANNELS, _SHARED_STATE, _ENTITY_STATE, _POSE, _ACTIONS, _NPC_REQUESTS, _WORLD_TIME, _SAVE for script systems in the save, _MENU for co-op menu items, _VOTES for votes, _WORLD_ASK for asks to the host's world, _EFFECTS for effects and sounds, _REWARDS for rewards, _HOOKS for hook declarations, _FALLBACKS for content substitutes; SPAWNS_ENTITIES for shared spawns, CHANGES_QUESTS for per-player quest facts). An undeclared call answers NCSDK_E_DENIED; partners' data of an undeclared kind is dropped — checked against our mod's flags and against the flags in the sender's passport |
| Size limits |
Per message and per value (§2), 256 shared-state keys per mod, 4096 entity-state records per mod (owned, and received from partners), 1024 queued events per mod (the oldest drop) |
| Rate limits |
Per mod and direction 32 KiB/s and 120 messages/s, bursts up to 4×; incoming per mod and sender |
| Ownership |
Entity state is taken only from the entity's owner as your machine knows it (a player — only from that player; a shared spawn — only from the machine that leads it now) |
| Shared spawns |
A partner announces only its own spawns: the spawn number carries the sender's peer number in its top byte, a number of another creator is dropped (one log line). NCSDK_SHARE_HANDOFF needs SPAWNS_ENTITIES like entityShare; an NPC handed to the nearest player goes through NightCoop's own NPC handoff with its checks — nothing is spawned because a partner said so. A shared vehicle is mirrored by NightCoop's vehicle sync with its own limits (64 shared vehicles per sender, the record must be a vehicle record). entityLeader only reads. A mod effect (effectShow) is shown only from a peer whose passport declares NCSDK_MOD_USES_EFFECTS, at most 20 a second per peer, within 150 m of that peer's player, and only an .effect resource that is in our game (fire and forget: picture and sound, no damage or logic); effects and sounds on entities (effectAttach, soundPlay) — the same passport and rate checks, only on our own mirror or copy of a synced entity |
| Rewards |
A partner's rewardGrant creates an item in our inventory only if we have the same mod (id and protocol), its passport declares NCSDK_MOD_USES_REWARDS, the record is an item of our TweakDB and not tagged Quest, 1..9999 of it, at most 2 a second (bursts of 8) from that peer, we are in one world, and a guest's player is within 100 m of ours (the host — any distance). Each grant number is given at most once and its answer is remembered for 10 minutes: a repeated or replayed message gets the same answer, never a second item |
| Host authority |
Shared state is written only by the host; a guest only asks |
| Clean text |
Every text from a partner that NightCoop shows or logs (passport names and versions), and every text a mod passes to showMessage or log, is cleaned: valid UTF-8, no control characters (C0, DEL, C1), no invisible or direction-changing characters (bidi marks, overrides and isolates, zero-width characters, tags, fillers), no line breaks (a mod's log line cannot forge a NightCoop line), at most 2 combining marks in a row, bounded length. Mods get the same cleaning as cleanText / CleanText |
| Threads |
Callbacks run on the game thread from NightCoop's frame, never from inside a call of the table, never on the network thread |