@crowdedkingdoms/ckx-kit 0.5.0 → 0.6.0-dev.1

package/crates/ckx-sdk/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ckx-sdk"
-version = "0.12.1"
+version = "0.13.0-dev.1"
 edition = "2024"
 description = "Write ck-exec hubs, spokes and mods for Crowded Kingdoms in Rust, compiled to wasm32-unknown-unknown"
 license = "MIT OR Apache-2.0"

package/crates/ckx-sdk/src/lib.rs

@@ -31,15 +31,18 @@
 //! Realtime events players around see at once go through [`Ctx::emit_spatial`],
 //! [`Ctx::emit_actor`] and [`Ctx::emit_channel`]; see [`emit`].
 //!
-//! Platform data (world, grids, players, grid permissions, players' access to the app) is behind
-//! [`Ctx::world`], [`Ctx::grids`], [`Ctx::players`], [`Ctx::permissions`] and [`Ctx::access`],
-//! each needing a scope the node type declares in the manifest; see [`node`].
+//! Platform data (world, grids, players, grid permissions, players' access to the app, safety
+//! reports) is behind [`Ctx::world`], [`Ctx::grids`], [`Ctx::players`], [`Ctx::permissions`],
+//! [`Ctx::access`] and [`Ctx::safety`], each needing a scope the node type declares in the
+//! manifest; see [`node`].
 //!
 //! Hubs also get platform events, each a default no-op on [`Hub`]: timers they set
 //! ([`Hub::on_timer`]), topics they watch ([`Hub::on_topic`]), players entering and leaving
 //! the app ([`Hub::on_presence`], root hub only) and players' connections subscribing to them
 //! ([`Hub::on_session`]). A timer can follow a cron schedule, the legacy automations' syntax:
-//! see [`cron`] and [`Ctx::timer_cron`].
+//! see [`cron`] and [`Ctx::timer_cron`]. Two more concern what a hub holds about a player:
+//! erasing it when their account is erased ([`Hub::on_player_erased`]) and exporting it
+//! ([`Hub::on_player_export`]); a hub that does not implement them answers "not implemented".
 //!
 //! Nodes are unit tested natively with `cargo test`: `testing` runs one against a fake of the
 //! platform (calls, timers, events, snapshots, the node API, a mod's grid). [`limits`] has the
@@ -63,12 +66,14 @@ pub mod rt;
 pub mod testing;
 
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
+/// What [`Hub::on_player_export`] answers in, for a crate that does not depend on it itself.
+pub use serde_json;
 
 pub mod prelude {
     pub use crate::cron::Cron;
     pub use crate::emit::{Spatial, actor_id};
     pub use crate::model::{Model, PropKind, Schema, Viewer, Visibility};
-    pub use crate::node::{ChunkPos, GridPick, VoxelWrite};
+    pub use crate::node::{AgeBracket, ChunkPos, GridPick, ReportReason, SafetyReport, VoxelWrite};
     pub use crate::{
         Call, CallError, Caller, Ctx, Error, Hub, Kind, Level, Presence, PresencePlayer, Result, Session, Spoke, Status, TopicMsg,
         WorldEvent, decode, encode,
@@ -88,6 +93,13 @@ impl Error {
     pub fn unknown_method(method: &str) -> Self {
         Self(format!("unknown method `{method}`"))
     }
+
+    /// What a hook the hub does not implement answers ([`Hub::on_player_erased`],
+    /// [`Hub::on_player_export`]). The platform tells it from a failure: it records it and goes
+    /// on.
+    pub fn not_implemented(hook: &str) -> Self {
+        Self(format!("not implemented: `{hook}`"))
+    }
 }
 
 impl std::fmt::Display for Error {
@@ -446,6 +458,11 @@ impl Ctx {
         node::Access(self)
     }
 
+    /// Safety reports a player files through this hub (scope `safety.write`).
+    pub fn safety(&self) -> node::Safety<'_> {
+        node::Safety(self)
+    }
+
     pub fn log(&self, level: Level, msg: &str) {
         abi::log(level as u32, msg);
     }
@@ -528,6 +545,22 @@ pub trait Hub: Sized + 'static {
     fn on_world(&mut self, _ctx: &Ctx, _events: &[WorldEvent]) -> Result<()> {
         Ok(())
     }
+    /// `player`'s account is being erased: delete or anonymize everything this hub holds about
+    /// them. Every hub of the app that holds state hears it, a stopped one started for it,
+    /// the player's own included (one keyed by their id, which the platform then deletes with
+    /// its snapshot). The platform counts the hub done once a snapshot taken after this returns
+    /// is stored; an error is recorded, and the erasure asks again later. Left out, the hub
+    /// answers "not implemented", which is recorded and does not hold the erasure up.
+    fn on_player_erased(&mut self, _ctx: &Ctx, _player: u64) -> Result<()> {
+        Err(Error::not_implemented("on_player_erased"))
+    }
+    /// What this hub holds about `player`, for their data export: JSON, at most
+    /// [`limits::MAX_EXPORT_BYTES`] of it, or `Value::Null` when it holds nothing. Every hub of
+    /// the app that holds state is asked, a stopped one started for it. Left out, the hub
+    /// answers "not implemented", which the export records.
+    fn on_player_export(&mut self, _ctx: &Ctx, _player: u64) -> Result<serde_json::Value> {
+        Err(Error::not_implemented("on_player_export"))
+    }
 }
 
 /// A stateless node. Replicas may run anywhere; keep nothing here you cannot lose.

package/crates/ckx-sdk/src/limits.rs

@@ -19,6 +19,9 @@ pub const MAX_LOG_BYTES: usize = 4 << 10;
 pub const MAX_EMIT_BYTES: usize = 70 + crate::emit::MAX_PAYLOAD;
 /// The largest snapshot a hub may persist. A larger one fails to save, and the last one stands.
 pub const MAX_SNAPSHOT_BYTES: usize = 8 << 20;
+/// The most JSON a hub's [`crate::Hub::on_player_export`] may answer. A larger answer is an
+/// error, and the export records the hub as failed.
+pub const MAX_EXPORT_BYTES: usize = 1 << 20;
 /// The largest module an app's node type may deploy.
 pub const ARTIFACT_MAX_BYTES: usize = 16 << 20;
 

package/crates/ckx-sdk/src/node.rs

@@ -1,10 +1,11 @@
 //! Typed node API operations: the platform's world, grid, player, permission and access data,
-//! always within this instance's app. Each needs a scope its node type declares in the manifest
-//! (`"scopes": ["world.read", ...]`); without it the call fails with [`Status::Denied`].
+//! and safety reports, always within this instance's app. Each needs a scope its node type
+//! declares in the manifest (`"scopes": ["world.read", ...]`); without it the call fails with
+//! [`Status::Denied`].
 //!
 //! | Scope | Operations |
 //! |---|---|
-//! | `players.read` | [`Players::get`], [`Players::features`], [`Players::check_permission`], [`Players::state`], [`Players::avatar_state`] |
+//! | `players.read` | [`Players::get`], [`Players::features`], [`Players::check_permission`], [`Players::state`], [`Players::avatar_state`], [`Players::blocked`] |
 //! | `players.write` | [`Players::set_state`] |
 //! | `world.read` | [`World::chunk`], [`World::voxels`], [`World::actors`], [`World::actors_near`] |
 //! | `world.write` | [`World::set_voxels`], [`World::set_chunk_state`] |
@@ -13,6 +14,7 @@
 //! | `permissions.write` | [`Permissions::grant`], [`Permissions::revoke`] |
 //! | `access.read` | [`Access::get`] |
 //! | `access.write` | [`Access::grant`], [`Access::revoke`], [`Access::suspend`], [`Access::unsuspend`] |
+//! | `safety.write` | [`Safety::report`] |
 //!
 //! The game API rate limits each app (reads and writes separately); a refusal is
 //! [`Status::RateLimited`].
@@ -31,6 +33,8 @@ pub const MAX_VOXEL_WRITES: usize = 16;
 pub const MAX_VOXEL_STATE: usize = 1024;
 /// A chunk's state bytes ([`World::set_chunk_state`]).
 pub const MAX_CHUNK_STATE: usize = 65_536;
+/// A safety report's details, in characters as the game API counts them (UTF-16 units).
+pub const MAX_REPORT_DETAILS: usize = 1_000;
 
 /// A chunk's coordinates.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
@@ -164,6 +168,85 @@ pub struct Player {
     /// What tells players with the same gamertag apart; most players have none.
     #[serde(default)]
     pub disambiguation: Option<String>,
+    /// The player's age bracket; `None` from a platform that does not say.
+    #[serde(default, alias = "ageBracket")]
+    pub age_bracket: Option<AgeBracket>,
+}
+
+/// How old a player is, as a bracket: never their age itself.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum AgeBracket {
+    /// No age is known: the platform refuses such a player a token, so a hub rarely sees one.
+    Unknown,
+    Under13,
+    From13To15,
+    From16To17,
+    Adult,
+}
+
+impl AgeBracket {
+    /// As the platform writes it: `unknown`, `under_13`, `13_15`, `16_17` or `18_plus`.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            AgeBracket::Unknown => "unknown",
+            AgeBracket::Under13 => "under_13",
+            AgeBracket::From13To15 => "13_15",
+            AgeBracket::From16To17 => "16_17",
+            AgeBracket::Adult => "18_plus",
+        }
+    }
+
+    /// 13 to 17: the platform holds the player to minors' defaults.
+    pub fn is_minor(self) -> bool {
+        matches!(self, AgeBracket::From13To15 | AgeBracket::From16To17)
+    }
+}
+
+/// A bracket this SDK does not know reads as [`AgeBracket::Unknown`], the most guarded.
+impl<'de> Deserialize<'de> for AgeBracket {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        let s = String::deserialize(d)?;
+        let known = [AgeBracket::Under13, AgeBracket::From13To15, AgeBracket::From16To17, AgeBracket::Adult];
+        Ok(known.into_iter().find(|b| b.as_str() == s).unwrap_or(AgeBracket::Unknown))
+    }
+}
+
+/// Why a player is reported ([`SafetyReport::reason`]).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ReportReason {
+    ChildSafety,
+    Harassment,
+    SexualContent,
+    Hate,
+    SelfHarm,
+    Cheating,
+    Other,
+}
+
+/// A safety report a hub files for one player about another ([`Safety::report`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SafetyReport {
+    /// The player reporting.
+    pub reporter: u64,
+    /// The player reported.
+    pub reported: u64,
+    /// The reported player's actor (its 32-character id), when the report is about what it
+    /// did in the world.
+    pub reported_actor: Option<String>,
+    pub reason: ReportReason,
+    /// What happened, in the reporter's words: at most [`MAX_REPORT_DETAILS`] characters.
+    pub details: String,
+    /// When it happened, in Unix milliseconds.
+    pub occurred_at_ms: u64,
+}
+
+/// A report the platform recorded.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+pub struct FiledReport {
+    /// What moderators know it by.
+    #[serde(deserialize_with = "de_u64", alias = "reportId")]
+    pub report_id: u64,
 }
 
 /// A player's access to the app, from [`Access::get`] and [`Access::grant`].
@@ -201,6 +284,21 @@ fn b64(bytes: &[u8]) -> String {
     B64.encode(bytes)
 }
 
+/// Unix milliseconds as the game API writes a time: `2026-01-01T00:00:00.000Z`.
+pub(crate) fn rfc3339(ms: u64) -> String {
+    let (secs, millis) = (ms / 1000, ms % 1000);
+    let (days, rem) = ((secs / 86_400) as i64, secs % 86_400);
+    let z = days + 719_468;
+    let (era, doe) = (z.div_euclid(146_097), z.rem_euclid(146_097));
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let day = doy - (153 * mp + 2) / 5 + 1;
+    let month = if mp < 10 { mp + 3 } else { mp - 9 };
+    let year = yoe + era * 400 + i64::from(month <= 2);
+    format!("{year:04}-{month:02}-{day:02}T{:02}:{:02}:{:02}.{millis:03}Z", rem / 3600, rem % 3600 / 60, rem % 60)
+}
+
 // ---- wire shapes ----
 
 #[derive(Deserialize)]
@@ -585,6 +683,19 @@ impl Players<'_> {
         self.state_op("players.avatar_state", json!({ "avatar": avatar.to_string() }))
     }
 
+    /// Whether either player has blocked the other in this app: check it before mail, friend
+    /// requests, trades, duels or invites pass between them, and before the hub's own events
+    /// carry one's words to the other (the realtime servers pass what a hub emits, blocks or
+    /// not). Scope `players.read`.
+    pub fn blocked(&self, player: u64, other: u64) -> Result<bool, CallError> {
+        #[derive(Deserialize)]
+        struct R {
+            blocked: bool,
+        }
+        let r: R = op(self.0, "players.blocked", json!({ "player": player.to_string(), "other": other.to_string() }))?;
+        Ok(r.blocked)
+    }
+
     fn state_op(&self, name: &str, body: Value) -> Result<Option<Vec<u8>>, CallError> {
         #[derive(Deserialize)]
         struct R {
@@ -678,6 +789,31 @@ impl Access<'_> {
     }
 }
 
+/// Safety reports: [`Ctx::safety`].
+pub struct Safety<'a>(pub(crate) &'a Ctx);
+
+impl Safety<'_> {
+    /// Files `report` as its reporter would from the game, both players being the app's:
+    /// moderators review it with what the app's safety log recorded of both around when it
+    /// happened. Scope `safety.write`.
+    pub fn report(&self, report: &SafetyReport) -> Result<FiledReport, CallError> {
+        if report.details.encode_utf16().count() > MAX_REPORT_DETAILS {
+            return Err(bad_request(format!("a report's details are at most {MAX_REPORT_DETAILS} characters")));
+        }
+        let mut body = json!({
+            "reporter": report.reporter.to_string(),
+            "reported": report.reported.to_string(),
+            "reason": report.reason,
+            "details": report.details,
+            "occurred_at": rfc3339(report.occurred_at_ms),
+        });
+        if let Some(actor) = &report.reported_actor {
+            body["reported_actor"] = json!(actor);
+        }
+        op(self.0, "safety.report", body)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::cell::RefCell;
@@ -769,13 +905,98 @@ mod tests {
         let reply = json!({ "player": "42", "gamertag": "Ada", "disambiguation": null });
         let (got, name, body) = exchange(reply, |c| c.players().get(42));
         assert_eq!((name.as_str(), body), ("players.get", json!({ "player": "42" })));
-        assert_eq!(got.unwrap(), Player { player: 42, gamertag: "Ada".into(), disambiguation: None });
+        assert_eq!(got.unwrap(), Player { player: 42, gamertag: "Ada".into(), disambiguation: None, age_bracket: None });
         let (got, ..) = exchange(json!({ "player": 42, "gamertag": "Ada" }), |c| c.players().get(42));
         assert_eq!(got.unwrap().disambiguation, None, "a platform that leaves it out");
         let (got, ..) = exchange(json!({ "player": "42", "gamertag": "Ada", "disambiguation": "0001" }), |c| c.players().get(42));
         assert_eq!(got.unwrap().disambiguation.as_deref(), Some("0001"));
     }
 
+    #[test]
+    fn a_player_names_their_age_bracket_and_an_older_platform_none() {
+        let get = |reply: Value| exchange(reply, |c| c.players().get(42)).0.unwrap().age_bracket;
+        assert_eq!(get(json!({ "player": "42", "gamertag": "Ada", "disambiguation": null })), None, "an older ck-api");
+        for (wire, bracket) in [
+            ("unknown", AgeBracket::Unknown),
+            ("under_13", AgeBracket::Under13),
+            ("13_15", AgeBracket::From13To15),
+            ("16_17", AgeBracket::From16To17),
+            ("18_plus", AgeBracket::Adult),
+        ] {
+            assert_eq!(get(json!({ "player": "42", "gamertag": "Ada", "age_bracket": wire })), Some(bracket), "{wire}");
+            assert_eq!(bracket.as_str(), wire);
+        }
+        assert_eq!(get(json!({ "player": "42", "gamertag": "Ada", "ageBracket": "16_17" })), Some(AgeBracket::From16To17));
+        assert_eq!(get(json!({ "player": "42", "gamertag": "Ada", "age_bracket": null })), None);
+        assert_eq!(
+            get(json!({ "player": "42", "gamertag": "Ada", "age_bracket": "21_plus" })),
+            Some(AgeBracket::Unknown),
+            "one it does not know"
+        );
+        assert!(AgeBracket::From13To15.is_minor() && AgeBracket::From16To17.is_minor());
+        assert!(!AgeBracket::Adult.is_minor() && !AgeBracket::Unknown.is_minor() && !AgeBracket::Under13.is_minor());
+    }
+
+    #[test]
+    fn whether_either_player_blocked_the_other() {
+        let (got, name, body) = exchange(json!({ "blocked": true }), |c| c.players().blocked(42, u64::MAX));
+        assert!(got.unwrap());
+        assert_eq!((name.as_str(), body), ("players.blocked", json!({ "player": "42", "other": "18446744073709551615" })));
+        let (got, ..) = exchange(json!({ "blocked": false }), |c| c.players().blocked(42, 43));
+        assert!(!got.unwrap());
+        let (got, ..) = exchange(json!({}), |c| c.players().blocked(42, 43));
+        assert_eq!(got.unwrap_err().status, Status::Internal, "a reply without the answer");
+    }
+
+    #[test]
+    fn a_safety_report_sends_what_the_game_api_reads_and_its_id_comes_back() {
+        let report = SafetyReport {
+            reporter: 42,
+            reported: u64::MAX,
+            reported_actor: Some("0123456789abcdef0123456789abcdef".into()),
+            reason: ReportReason::SexualContent,
+            details: "asked for pictures".into(),
+            occurred_at_ms: 951_782_400_123,
+        };
+        let (got, name, body) = exchange(json!({ "report_id": "77" }), |c| c.safety().report(&report));
+        assert_eq!(got.unwrap(), FiledReport { report_id: 77 });
+        assert_eq!(name, "safety.report");
+        assert_eq!(
+            body,
+            json!({ "reporter": "42", "reported": "18446744073709551615", "reported_actor": "0123456789abcdef0123456789abcdef",
+                    "reason": "sexual_content", "details": "asked for pictures", "occurred_at": "2000-02-29T00:00:00.123Z" })
+        );
+        let no_actor = SafetyReport { reported_actor: None, reason: ReportReason::ChildSafety, ..report.clone() };
+        let (got, _, body) = exchange(json!({ "report_id": 78 }), |c| c.safety().report(&no_actor));
+        assert_eq!(got.unwrap().report_id, 78);
+        assert!(body.get("reported_actor").is_none(), "left out when there is none");
+        assert_eq!(body["reason"], "child_safety");
+        let (got, ..) = exchange(json!({ "reportId": "79" }), |c| c.safety().report(&no_actor));
+        assert_eq!(got.unwrap().report_id, 79);
+        for (reason, wire) in [
+            (ReportReason::Harassment, "harassment"),
+            (ReportReason::Hate, "hate"),
+            (ReportReason::SelfHarm, "self_harm"),
+            (ReportReason::Cheating, "cheating"),
+            (ReportReason::Other, "other"),
+        ] {
+            assert_eq!(serde_json::to_value(reason).unwrap(), wire);
+        }
+
+        let at_cap = SafetyReport { details: "\u{1F600}".repeat(MAX_REPORT_DETAILS / 2), ..no_actor.clone() };
+        let (got, ..) = exchange(json!({ "report_id": "80" }), |c| c.safety().report(&at_cap));
+        assert!(got.is_ok(), "the cap itself is allowed");
+        let over = SafetyReport { details: format!("{}a", "\u{1F600}".repeat(MAX_REPORT_DETAILS / 2)), ..no_actor };
+        assert_eq!(refused_here(|c| c.safety().report(&over)).status, Status::BadRequest, "counted as the game API counts");
+    }
+
+    #[test]
+    fn writes_times_as_the_game_api_does() {
+        assert_eq!(rfc3339(1_767_225_600_000), "2026-01-01T00:00:00.000Z");
+        assert_eq!(rfc3339(951_782_400_123), "2000-02-29T00:00:00.123Z");
+        assert_eq!(rfc3339(0), "1970-01-01T00:00:00.000Z");
+    }
+
     #[test]
     fn voxels_are_signed_and_name_their_author_and_time() {
         let reply = json!({ "voxels": [

package/crates/ckx-sdk/src/rt.rs

@@ -298,12 +298,27 @@ impl<T: Hub> HubNode<T> {
                 };
                 self.0.on_session(ctx, p, session)?
             }
+            (ERASE, Caller::Platform) => self.0.on_player_erased(ctx, decode::<PlayerEvent>(call.payload)?.player)?,
+            (EXPORT, Caller::Platform) => {
+                let held = self.0.on_player_export(ctx, decode::<PlayerEvent>(call.payload)?.player)?;
+                let json = serde_json::to_vec(&held).map_err(|e| Error(format!("export: {e}")))?;
+                if json.len() > crate::limits::MAX_EXPORT_BYTES {
+                    return Err(Error(format!("the export of {} bytes exceeds {}", json.len(), crate::limits::MAX_EXPORT_BYTES)));
+                }
+                return Ok(json);
+            }
             (m, c) => return Err(Error(format!("no platform event `{m}` from {c:?}"))),
         }
         Ok(Vec::new())
     }
 }
 
+/// The payload of `$erase` and `$export`.
+#[derive(Serialize, Deserialize)]
+pub(crate) struct PlayerEvent {
+    pub player: u64,
+}
+
 /// The platform's reserved method names: its events.
 pub(crate) mod ckx_platform {
     pub const TIMER: &str = "$timer";
@@ -313,6 +328,8 @@ pub(crate) mod ckx_platform {
     pub const SESSION: &str = "$session";
     pub const SESSION_JOINED: u8 = 1;
     pub const SESSION_LEFT: u8 = 0;
+    pub const ERASE: &str = "$erase";
+    pub const EXPORT: &str = "$export";
 }
 
 impl<T: Hub> Node for HubNode<T> {

package/crates/ckx-sdk/src/testing.rs

@@ -2,8 +2,8 @@
 //!
 //! [`TestHub`] and [`TestSpoke`] run a node on the test's thread the way a sandbox runs it:
 //! calls from players, developers and other instances; a hub's platform events (timers on a
-//! clock the test moves, topics it watches, presence, sessions, and a mod's world events); and
-//! a snapshot and a start from it. The platform's side is a [`FakePlatform`]. It keeps what the
+//! clock the test moves, topics it watches, presence, sessions, a mod's world events, and a
+//! player's erasure and export); and a snapshot and a start from it. The platform's side is a [`FakePlatform`]. It keeps what the
 //! node logged, published, sent and emitted; holds each call to the sandbox's bounds
 //! ([`crate::limits`]); answers calls to other types and node API operations with what the test
 //! scripts; and serves a mod its [`FakeGrid`] under the node API's rules for mods.
@@ -70,7 +70,7 @@ use serde::de::DeserializeOwned;
 use serde_json::{Value, json};
 
 use crate::abi::native::{self, Host};
-use crate::node::{Actor, Chunk, ChunkPos, Voxel};
+use crate::node::{Actor, Chunk, ChunkPos, Voxel, rfc3339};
 use crate::rt::{HubNode, Node, SpokeNode, ckx_platform as platform};
 use crate::{Call, CallError, Caller, Ctx, Error, Hub, Kind, Level, Presence, Session, Spoke, Status, WorldEvent, decode, encode, limits};
 
@@ -431,7 +431,7 @@ impl FakePlatform {
         }
         match caller {
             Caller::Platform => {
-                Err(bad_request("the platform calls a node only with its events: advance, topic, presence, session, world"))
+                Err(bad_request("the platform calls a node only with its events: advance, topic, presence, session, world, erase, export"))
             }
             Caller::Instance(_) if self.state.borrow().is_mod() => Err(denied("only players call mods")),
             _ => Ok(()),
@@ -696,6 +696,26 @@ impl<T: Hub> TestHub<T> {
         self.event(Caller::Platform, platform::PRESENCE, &payload)
     }
 
+    /// `player`'s account being erased, as the platform tells every hub: `$erase`, then a
+    /// snapshot, which the platform stores before it counts the hub done. A hub without the hook
+    /// answers `AppError` "not implemented: …".
+    pub fn erase(&mut self, player: u64) -> Result<(), CallError> {
+        let payload = player_payload(player).map_err(|Error(m)| bad_request(m))?;
+        self.event(Caller::Platform, platform::ERASE, &payload)?;
+        self.persist().map(|_| ())
+    }
+
+    /// What the hub holds about `player`, as the platform asks it for their data export:
+    /// `Value::Null` when it holds nothing. A hub without the hook answers `AppError` "not
+    /// implemented: …".
+    pub fn export(&mut self, player: u64) -> Result<Value, CallError> {
+        let payload = player_payload(player).map_err(|Error(m)| bad_request(m))?;
+        let node = self.node.as_mut().expect("the hub runs");
+        let json = self.platform.handle(node, Caller::Platform, platform::EXPORT, &payload)?;
+        serde_json::from_slice(&json)
+            .map_err(|e| CallError { status: Status::Internal, message: format!("an export that is not JSON: {e}") })
+    }
+
     /// `node_type`/`key` publishing `payload` on `topic`. A hub hears only the topics it
     /// watches.
     pub fn topic(&mut self, node_type: &str, key: &str, topic: &str, payload: &[u8]) -> Result<(), CallError> {
@@ -818,6 +838,12 @@ pub fn world_payload(events: &[WorldEvent]) -> crate::Result<Vec<u8>> {
     encode(&Batch { events })
 }
 
+/// The payload of the `$erase` and `$export` calls the platform makes about `player`: what
+/// [`TestHub::erase`] and [`TestHub::export`] hand a hub.
+pub fn player_payload(player: u64) -> crate::Result<Vec<u8>> {
+    encode(&crate::rt::PlayerEvent { player })
+}
+
 // ---- the node API, as it serves a mod ----
 
 /// The node API operations a mod may call.
@@ -825,12 +851,13 @@ const MOD_OPS: [&str; 7] =
     ["world.chunk", "world.voxels", "world.actors", "world.actors_radius", "world.set_voxels", "grids.get", "grids.check_permission"];
 
 /// Each node API operation and the scope it needs.
-const OP_SCOPES: [(&str, &str); 27] = [
+const OP_SCOPES: [(&str, &str); 29] = [
     ("players.get", "players.read"),
     ("players.features", "players.read"),
     ("players.check_permission", "players.read"),
     ("players.state", "players.read"),
     ("players.avatar_state", "players.read"),
+    ("players.blocked", "players.read"),
     ("players.set_state", "players.write"),
     ("world.chunk", "world.read"),
     ("world.voxels", "world.read"),
@@ -853,6 +880,7 @@ const OP_SCOPES: [(&str, &str); 27] = [
     ("access.revoke", "access.write"),
     ("access.suspend", "access.write"),
     ("access.unsuspend", "access.write"),
+    ("safety.report", "safety.write"),
 ];
 
 /// Rows the node API returns at most: actors in one chunk, in a radius, voxels in a chunk.
@@ -954,21 +982,6 @@ fn b64(bytes: &[u8]) -> String {
     B64.encode(bytes)
 }
 
-/// Unix milliseconds as the game API writes a time: `2026-01-01T00:00:00.000Z`.
-fn rfc3339(ms: u64) -> String {
-    let (secs, millis) = (ms / 1000, ms % 1000);
-    let (days, rem) = ((secs / 86_400) as i64, secs % 86_400);
-    let z = days + 719_468;
-    let (era, doe) = (z.div_euclid(146_097), z.rem_euclid(146_097));
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let day = doy - (153 * mp + 2) / 5 + 1;
-    let month = if mp < 10 { mp + 3 } else { mp - 9 };
-    let year = yoe + era * 400 + i64::from(month <= 2);
-    format!("{year:04}-{month:02}-{day:02}T{:02}:{:02}:{:02}.{millis:03}Z", rem / 3600, rem % 3600 / 60, rem % 60)
-}
-
 type Pos = (i64, i64, i64);
 
 fn key(p: ChunkPos) -> Pos {
@@ -1424,6 +1437,85 @@ mod tests {
         assert_eq!(hub.call(Caller::Player(1), "nope", &[]).unwrap_err().status, Status::AppError);
     }
 
+    /// Scores by player: what the platform's erasure and export reach.
+    #[derive(Default, Serialize, Deserialize)]
+    struct Keeper {
+        scores: std::collections::BTreeMap<u64, i64>,
+    }
+
+    impl Hub for Keeper {
+        fn spawn(_ctx: &Ctx, _seed: &[u8]) -> Result<Self> {
+            Ok(Self::default())
+        }
+
+        fn load(_ctx: &Ctx, snapshot: &[u8], _from_version: u64) -> Result<Self> {
+            decode(snapshot)
+        }
+
+        fn persist(&mut self, _ctx: &Ctx) -> Result<Vec<u8>> {
+            encode(self)
+        }
+
+        fn handle(&mut self, _ctx: &Ctx, call: Call<'_>) -> Result<Vec<u8>> {
+            match call.method {
+                "score" => {
+                    *self.scores.entry(call.player()?).or_default() += call.decode::<i64>()?;
+                    Ok(Vec::new())
+                }
+                "flood" => {
+                    self.scores.extend((0..60_000).map(|p| (p, i64::MAX)));
+                    Ok(Vec::new())
+                }
+                other => Err(Error::unknown_method(other)),
+            }
+        }
+
+        fn on_player_erased(&mut self, _ctx: &Ctx, player: u64) -> Result<()> {
+            self.scores.remove(&player);
+            Ok(())
+        }
+
+        fn on_player_export(&mut self, _ctx: &Ctx, player: u64) -> Result<Value> {
+            if player == 7 {
+                return Ok(json!({ "everyone": self.scores }));
+            }
+            Ok(self.scores.get(&player).map_or(Value::Null, |s| json!({ "score": s })))
+        }
+    }
+
+    #[test]
+    fn a_hub_erases_and_exports_a_player_as_the_platform_asks() {
+        let mut hub = TestHub::<Keeper>::spawn("board", "a").unwrap();
+        hub.call(Caller::Player(42), "score", &encode(&5).unwrap()).unwrap();
+        hub.call(Caller::Player(43), "score", &encode(&9).unwrap()).unwrap();
+        assert_eq!(hub.export(42).unwrap(), json!({ "score": 5 }));
+        assert_eq!(hub.export(44).unwrap(), Value::Null, "nothing held");
+        hub.erase(42).unwrap();
+        assert_eq!(hub.export(42).unwrap(), Value::Null);
+        hub.restart().unwrap();
+        assert_eq!(hub.hub().scores.keys().copied().collect::<Vec<_>>(), vec![43], "the erasure is in the snapshot");
+        for method in ["$erase", "$export"] {
+            for caller in [Caller::Player(42), Caller::Developer(1), Caller::Instance(9)] {
+                let e = hub.call(caller, method, &player_payload(43).unwrap()).unwrap_err();
+                assert_eq!(e.status, Status::Denied, "{method} from {caller:?}");
+            }
+        }
+        assert_eq!(hub.hub().scores.len(), 1);
+
+        hub.call(Caller::Player(1), "flood", &[]).unwrap();
+        let e = hub.export(7).unwrap_err();
+        assert!(e.status == Status::AppError && e.message.contains("exceeds"), "{e}");
+    }
+
+    #[test]
+    fn a_hub_without_the_hooks_answers_not_implemented() {
+        let mut hub = TestHub::<Ticker>::spawn("ticker", "a").unwrap();
+        for e in [hub.erase(42).unwrap_err(), hub.export(42).unwrap_err()] {
+            assert_eq!(e.status, Status::AppError);
+            assert!(e.message.starts_with("not implemented: `on_player_e"), "{e}");
+        }
+    }
+
     #[test]
     fn one_node_runs_on_a_thread_at_a_time() {
         let hub = TestHub::<Ticker>::spawn("ticker", "a").unwrap();
@@ -1432,11 +1524,4 @@ mod tests {
         drop(hub);
         TestHub::<Ticker>::spawn("ticker", "b").unwrap();
     }
-
-    #[test]
-    fn writes_times_as_the_game_api_does() {
-        assert_eq!(rfc3339(START_MS), "2026-01-01T00:00:00.000Z");
-        assert_eq!(rfc3339(951_782_400_123), "2000-02-29T00:00:00.123Z");
-        assert_eq!(rfc3339(0), "1970-01-01T00:00:00.000Z");
-    }
 }

package/crates/crowdy-client-sdk/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "crowdy-client-sdk"
-version = "0.1.0"
+version = "0.1.0-dev.1"
 edition = "2021"
 description = "Guest SDK for the CLIENT half of a ck-exec mod: browser WASM (ck ABI v0 + the client host calls)."
 license = "MIT OR Apache-2.0"

package/dist/checks/src/build/exec-source.js

@@ -13,6 +13,7 @@ exports.EXEC_ARTIFACT_MAX_BYTES = exports.EXEC_ABI_EXPORTS = exports.EXEC_ABI_IM
 exports.validateExecPath = validateExecPath;
 exports.validateExecManifest = validateExecManifest;
 exports.validateExecCrates = validateExecCrates;
+exports.execArtifactName = execArtifactName;
 exports.rewriteExecManifest = rewriteExecManifest;
 exports.clientTickIntervalMs = clientTickIntervalMs;
 exports.validateExecArtifact = validateExecArtifact;
@@ -259,6 +260,39 @@ function validateExecCrates(crates, kind = 'exec') {
     if (total > exports.EXEC_MAX_SOURCE_BYTES)
         fail(`a build's sources are at most ${exports.EXEC_MAX_SOURCE_BYTES} bytes`);
 }
+/**
+ * The file name cargo gives a validated crate's module: its `[lib] name`, else its package
+ * name with `-` as `_`, then `.wasm`. A build's crates share one target directory, so the
+ * module has to be found by name rather than as the only `.wasm` there.
+ */
+function execArtifactName(manifest) {
+    let section = '';
+    let pkg = null;
+    let lib = null;
+    for (const raw of manifest.split(/\r?\n/)) {
+        const line = stripComment(raw).trim();
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            section = header[1].trim();
+            continue;
+        }
+        const kv = line.match(/^name\s*=\s*"([^"]+)"$/);
+        if (!kv)
+            continue;
+        if (section === 'package')
+            pkg = kv[1];
+        if (section === 'lib')
+            lib = kv[1];
+    }
+    const name = lib ?? pkg;
+    if (!name)
+        fail('Cargo.toml has no [package] name');
+    // The name becomes a file name under the build's target directory: a cargo identifier and
+    // nothing a path could be made of, before cargo itself would refuse it.
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
+        fail(`Cargo.toml name '${name}' is not a crate name`);
+    return `${name.replace(/-/g, '_')}.wasm`;
+}
 /**
  * Points the kind's SDK at the toolchain's pinned copy and appends the platform release
  * profile (a crate may not declare its own; the validator refuses [profile]).

package/kit.pin

@@ -1,9 +1,9 @@
 # The platform toolchain release this kit was copied from (sync-kit.sh in the platform's
 # repository). The paths in `copied` are byte-identical to it: change them there, never here.
-toolchain_version=v1.15.0
-toolchain_commit=6eb7628c97d18f14a59e36f692f15530abd56cbe
-sdk_commit=c682f9378d742b7420a3bf0b49309cc27fba85bb
-ckx_sdk_version=0.12.1
+toolchain_version=v1.16.0
+toolchain_commit=c3cb02186b34ad535dd30c333ab4d9b116e5866d
+sdk_commit=27d5774d7b9d3b3c28928ad1a4d27902ac5130e1
+ckx_sdk_version=0.13.0
 crowdy_client_sdk_version=0.1.0
 rust_version=1.97.1
 copied=crates/ckx-sdk/src crates/crowdy-client-sdk/src tools/instrument/Cargo.toml tools/instrument/Cargo.lock tools/instrument/src checks/src/build/exec-source.ts checks/src/build/exec-source.spec.ts checks/src/build/rust-source-guard.ts checks/src/build/rust-source-guard.spec.ts checks/src/build/wasm-inspect.ts checks/src/build/wasm-inspect.spec.ts checks/src/build/client-capabilities.ts checks/src/build/client-capabilities.spec.ts checks/src/test-support/wasm-module.ts checks/compute-toolchain/host-catalog.json starters rust-toolchain.toml vendor.lock

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/ckx-kit",
-  "version": "0.5.0",
+  "version": "0.6.0-dev.1",
   "description": "Build, check and test Crowded Kingdoms ck-exec mods, hubs and spokes on your machine, as the platform builds them",
   "license": "MIT OR Apache-2.0",
   "homepage": "https://docs.crowdedkingdoms.com/exec/intro",

package/starters/arena/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/deck/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/director/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/grid-mod/Cargo.toml

@@ -9,5 +9,5 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }

package/starters/instance/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/leaderboard/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/market/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/matchmaker/Cargo.toml

@@ -9,5 +9,5 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }

package/starters/minigame/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/npc-mobs/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/player/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/racing/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/session/Cargo.toml

@@ -9,5 +9,5 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }

package/starters/tactics/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/territory/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/starters/world-tick/Cargo.toml

@@ -9,6 +9,6 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-ckx-sdk = "0.12.1"
+ckx-sdk = "0.13.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"