@diffenderfer-games/hub-contract 2.0.0-next.0 → 2.0.0-next.1

package/package.json

@@ -1,53 +1,53 @@
-{
-  "name": "@diffenderfer-games/hub-contract",
-  "version": "2.0.0-next.0",
-  "description": "The diffenderfer.games hub wire contract: zod schemas and types for its REST endpoints, socket ops and events, errors and the game.* manifest.",
-  "license": "MIT",
-  "type": "module",
-  "sideEffects": false,
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/diffenderfer-games/diffenderfer-games.git",
-    "directory": "next/packages/public/contract"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "files": [
-    "dist",
-    "src",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "exports": {
-    ".": {
-      "source": "./src/index.ts",
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "types": "./dist/index.d.ts",
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc -p tsconfig.json"
-  },
-  "dependencies": {
-    "@ayepi/core": "0.4.1"
-  },
-  "peerDependencies": {
-    "zod": "^4.1.0"
-  },
-  "peerDependenciesMeta": {
-    "zod": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "zod": "4.6.5"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@diffenderfer-games/hub-contract",
+  "version": "2.0.0-next.1",
+  "description": "The diffenderfer.games hub wire contract: zod schemas and types for its REST endpoints, socket ops and events, errors and the game.* manifest.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/diffenderfer-games/diffenderfer-games.git",
+    "directory": "next/packages/public/contract"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@ayepi/core": "0.4.1"
+  },
+  "peerDependencies": {
+    "zod": "^4.1.0"
+  },
+  "peerDependenciesMeta": {
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "zod": "4.6.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/api/analytics.ts

@@ -1,81 +1,81 @@
-/**
- * Gameplay events and client error logs sent by games and the menu, and the
- * play counts built from them. Events need no account: they carry the user id
- * when signed in and always the anonymous `hub_cid` client id.
- */
-import { use } from '@ayepi/core';
-import { z } from 'zod';
-import { Ok, Slug } from '../common';
-import { ErrorBody } from '../errors';
-import { game, session } from '../middleware';
-import { LooseText, requiredText } from '../coerce';
-
-/** Play counts for one game or the whole catalog. A player is an account, else a client id. */
-export const Metrics = z.object({
-  /** `play` events recorded. */
-  totalPlays: z.number().int().nonnegative(),
-  /** Distinct players who sent any event. */
-  uniquePlayers: z.number().int().nonnegative(),
-  /** Distinct players with a `play` or `heartbeat` in the last 5 minutes (`HUB_ACTIVE_WINDOW_MS`). */
-  activeNow: z.number().int().nonnegative(),
-});
-
-/** Play counts. */
-export type Metrics = z.infer<typeof Metrics>;
-
-/** The analytics endpoints. */
-export const analyticsEndpoints = {
-  ...session.group({
-    getSiteAnalytics: {
-      method: 'GET', path: '/analytics',
-      response: z.object({
-        global: Metrics,
-        games: z.array(Metrics.extend({ slug: Slug, title: z.string() })),
-      }),
-      doc: { summary: 'Catalog-wide play counts with a per-game breakdown', tags: ['analytics'] },
-    },
-    /**
-     * Report a client-side failure (for example the social runtime failing
-     * to load) to the admin console. Open to signed-out visitors; limited to
-     * 20 an hour per IP, after which it answers `{ ok: false }` and drops the
-     * report. Fields are clipped, never rejected.
-     */
-    reportClientError: {
-      method: 'POST', path: '/client-log',
-      body: z.object({
-        /** Which part failed, up to 40 characters (`unknown` when empty). */
-        where: LooseText.optional(),
-        /** Up to 300 characters. */
-        message: LooseText.optional(),
-        /** Up to 1200 characters. */
-        stack: LooseText.optional(),
-        /** The page, up to 200 characters. */
-        url: LooseText.optional(),
-      }),
-      response: z.object({
-        /** `false` when the report was dropped by the rate limit. */
-        ok: z.boolean(),
-      }),
-      doc: { summary: 'Report a client error to the admin console', tags: ['analytics'] },
-    },
-  }),
-  ...use(session, game).path('/games/:slug').group({
-    /** Record one event. The menu sends `play` on load and periodic `heartbeat`s; games may add their own. */
-    recordGameEvent: {
-      method: 'POST', path: '/events',
-      body: z.object({
-        /** 1 to 32 of letters, digits and `_ . : -` (surrounding spaces are trimmed). */
-        type: requiredText('Invalid event type.').pipe(z.string().trim().regex(/^[a-z0-9_.:-]{1,32}$/i, 'Invalid event type.')),
-      }),
-      response: Ok,
-      errors: { 400: ErrorBody, 404: ErrorBody },
-      doc: { summary: 'Record a gameplay event', tags: ['analytics'] },
-    },
-    getGameAnalytics: {
-      method: 'GET', path: '/analytics',
-      response: Metrics.extend({ slug: Slug }),
-      errors: { 404: ErrorBody },
-      doc: { summary: "This game's play counts", tags: ['analytics'] },
-    },
-  }),
-};
+/**
+ * Gameplay events and client error logs sent by games and the menu, and the
+ * play counts built from them. Events need no account: they carry the user id
+ * when signed in and always the anonymous `hub_cid` client id.
+ */
+import { use } from '@ayepi/core';
+import { z } from 'zod';
+import { Ok, Slug } from '../common';
+import { ErrorBody } from '../errors';
+import { game, session } from '../middleware';
+import { LooseText, requiredText } from '../coerce';
+
+/** Play counts for one game or the whole catalog. A player is an account, else a client id. */
+export const Metrics = z.object({
+  /** `play` events recorded. */
+  totalPlays: z.number().int().nonnegative(),
+  /** Distinct players who sent any event. */
+  uniquePlayers: z.number().int().nonnegative(),
+  /** Distinct players with a `play` or `heartbeat` in the last 5 minutes (`HUB_ACTIVE_WINDOW_MS`). */
+  activeNow: z.number().int().nonnegative(),
+});
+
+/** Play counts. */
+export type Metrics = z.infer<typeof Metrics>;
+
+/** The analytics endpoints. */
+export const analyticsEndpoints = {
+  ...session.group({
+    getSiteAnalytics: {
+      method: 'GET', path: '/analytics',
+      response: z.object({
+        global: Metrics,
+        games: z.array(Metrics.extend({ slug: Slug, title: z.string() })),
+      }),
+      doc: { summary: 'Catalog-wide play counts with a per-game breakdown', tags: ['analytics'] },
+    },
+    /**
+     * Report a client-side failure (for example the social runtime failing
+     * to load) to the admin console. Open to signed-out visitors; limited to
+     * 20 an hour per IP, after which it answers `{ ok: false }` and drops the
+     * report. Fields are clipped, never rejected.
+     */
+    reportClientError: {
+      method: 'POST', path: '/client-log',
+      body: z.object({
+        /** Which part failed, up to 40 characters (`unknown` when empty). */
+        where: LooseText.optional(),
+        /** Up to 300 characters. */
+        message: LooseText.optional(),
+        /** Up to 1200 characters. */
+        stack: LooseText.optional(),
+        /** The page, up to 200 characters. */
+        url: LooseText.optional(),
+      }),
+      response: z.object({
+        /** `false` when the report was dropped by the rate limit. */
+        ok: z.boolean(),
+      }),
+      doc: { summary: 'Report a client error to the admin console', tags: ['analytics'] },
+    },
+  }),
+  ...use(session, game).path('/games/:slug').group({
+    /** Record one event. The menu sends `play` on load and periodic `heartbeat`s; games may add their own. */
+    recordGameEvent: {
+      method: 'POST', path: '/events',
+      body: z.object({
+        /** 1 to 32 of letters, digits and `_ . : -` (surrounding spaces are trimmed). */
+        type: requiredText('Invalid event type.').pipe(z.string().trim().regex(/^[a-z0-9_.:-]{1,32}$/i, 'Invalid event type.')),
+      }),
+      response: Ok,
+      errors: { 400: ErrorBody, 404: ErrorBody },
+      doc: { summary: 'Record a gameplay event', tags: ['analytics'] },
+    },
+    getGameAnalytics: {
+      method: 'GET', path: '/analytics',
+      response: Metrics.extend({ slug: Slug }),
+      errors: { 404: ErrorBody },
+      doc: { summary: "This game's play counts", tags: ['analytics'] },
+    },
+  }),
+};

package/src/api/auth.ts

@@ -1,77 +1,77 @@
-/**
- * Accounts and sessions: guests, claiming, sign-up, log-in, log-out, and the
- * current user (`/me`). Sessions ride the `hub_session` cookie.
- */
-import { z } from 'zod';
-import { Ok, Slug } from '../common';
-import { AuthUser, SessionUser } from '../entities';
-import { ContentRejected, ErrorBody } from '../errors';
-import { requireUser, session } from '../middleware';
-
-/**
- * A credential field, read like the hub's `String(x ?? '')`: a missing field
- * is empty text (the hub then answers with its own rule, or a failed log-in)
- * and a number becomes text. Clients should send a string.
- */
-function credentialText(message: string) {
-  return z.union([z.string(), z.number()], { error: message }).nullish().transform((value) => String(value ?? ''));
-}
-
-/** Username + password, as the sign-up, claim and log-in forms send them. */
-export const Credentials = z.object({
-  /** 2 to 24 characters: letters, digits, `_`, `-` and spaces. */
-  username: credentialText('Username can use letters, numbers, _, -, and spaces.'),
-  /** At least 6 characters. */
-  password: credentialText('Password must be at least 6 characters.'),
-});
-
-/** `{ user }`: the session's account after an auth call. */
-export const AuthResult = z.object({ user: AuthUser });
-
-/** A 400 from sign-up or claim: a bad name or password, or a name the filter rejects. */
-const CredentialsError = z.union([ContentRejected, ErrorBody]);
-
-/** The auth endpoints. */
-export const authEndpoints = {
-  ...session.group({
-    /**
-     * Make sure a session exists. Idempotent: returns the current user if
-     * signed in (the full {@link SessionUser}), else creates a guest.
-     */
-    ensureGuestSession: {
-      method: 'POST', path: '/auth/guest',
-      response: z.object({ user: z.union([SessionUser, AuthUser]) }),
-      doc: { summary: 'Ensure a session (creates a guest if needed)', tags: ['auth'] },
-    },
-    signUpWithPassword: {
-      method: 'POST', path: '/auth/signup', body: Credentials, response: AuthResult,
-      errors: { 400: CredentialsError, 409: ErrorBody, 429: ErrorBody },
-      doc: { summary: 'Create an account and sign in', tags: ['auth'] },
-    },
-    logInWithPassword: {
-      method: 'POST', path: '/auth/login', body: Credentials, response: AuthResult,
-      errors: { 401: ErrorBody, 429: ErrorBody },
-      doc: { summary: 'Sign in; a guest session on this device is merged into the account', tags: ['auth'] },
-    },
-    logOut: {
-      method: 'POST', path: '/auth/logout', response: Ok,
-      doc: { summary: 'Sign out and clear the session cookie', tags: ['auth'] },
-    },
-    getCurrentUser: {
-      method: 'GET', path: '/me',
-      response: z.object({
-        user: SessionUser.nullable(),
-        /** Games the user has a profile in. */
-        profiles: z.array(z.object({ game: Slug, displayName: z.string().nullable() })),
-      }),
-      doc: { summary: 'The current user (or null) and their game profiles', tags: ['auth'] },
-    },
-  }),
-  ...requireUser.group({
-    claimGuestAccount: {
-      method: 'POST', path: '/auth/claim', body: Credentials, response: AuthResult,
-      errors: { 400: CredentialsError, 401: ErrorBody, 409: ErrorBody, 429: ErrorBody },
-      doc: { summary: 'Turn the current guest into an account, keeping its progress', tags: ['auth'] },
-    },
-  }),
-};
+/**
+ * Accounts and sessions: guests, claiming, sign-up, log-in, log-out, and the
+ * current user (`/me`). Sessions ride the `hub_session` cookie.
+ */
+import { z } from 'zod';
+import { Ok, Slug } from '../common';
+import { AuthUser, SessionUser } from '../entities';
+import { ContentRejected, ErrorBody } from '../errors';
+import { requireUser, session } from '../middleware';
+
+/**
+ * A credential field, read like the hub's `String(x ?? '')`: a missing field
+ * is empty text (the hub then answers with its own rule, or a failed log-in)
+ * and a number becomes text. Clients should send a string.
+ */
+function credentialText(message: string) {
+  return z.union([z.string(), z.number()], { error: message }).nullish().transform((value) => String(value ?? ''));
+}
+
+/** Username + password, as the sign-up, claim and log-in forms send them. */
+export const Credentials = z.object({
+  /** 2 to 24 characters: letters, digits, `_`, `-` and spaces. */
+  username: credentialText('Username can use letters, numbers, _, -, and spaces.'),
+  /** At least 6 characters. */
+  password: credentialText('Password must be at least 6 characters.'),
+});
+
+/** `{ user }`: the session's account after an auth call. */
+export const AuthResult = z.object({ user: AuthUser });
+
+/** A 400 from sign-up or claim: a bad name or password, or a name the filter rejects. */
+const CredentialsError = z.union([ContentRejected, ErrorBody]);
+
+/** The auth endpoints. */
+export const authEndpoints = {
+  ...session.group({
+    /**
+     * Make sure a session exists. Idempotent: returns the current user if
+     * signed in (the full {@link SessionUser}), else creates a guest.
+     */
+    ensureGuestSession: {
+      method: 'POST', path: '/auth/guest',
+      response: z.object({ user: z.union([SessionUser, AuthUser]) }),
+      doc: { summary: 'Ensure a session (creates a guest if needed)', tags: ['auth'] },
+    },
+    signUpWithPassword: {
+      method: 'POST', path: '/auth/signup', body: Credentials, response: AuthResult,
+      errors: { 400: CredentialsError, 409: ErrorBody, 429: ErrorBody },
+      doc: { summary: 'Create an account and sign in', tags: ['auth'] },
+    },
+    logInWithPassword: {
+      method: 'POST', path: '/auth/login', body: Credentials, response: AuthResult,
+      errors: { 401: ErrorBody, 429: ErrorBody },
+      doc: { summary: 'Sign in; a guest session on this device is merged into the account', tags: ['auth'] },
+    },
+    logOut: {
+      method: 'POST', path: '/auth/logout', response: Ok,
+      doc: { summary: 'Sign out and clear the session cookie', tags: ['auth'] },
+    },
+    getCurrentUser: {
+      method: 'GET', path: '/me',
+      response: z.object({
+        user: SessionUser.nullable(),
+        /** Games the user has a profile in. */
+        profiles: z.array(z.object({ game: Slug, displayName: z.string().nullable() })),
+      }),
+      doc: { summary: 'The current user (or null) and their game profiles', tags: ['auth'] },
+    },
+  }),
+  ...requireUser.group({
+    claimGuestAccount: {
+      method: 'POST', path: '/auth/claim', body: Credentials, response: AuthResult,
+      errors: { 400: CredentialsError, 401: ErrorBody, 409: ErrorBody, 429: ErrorBody },
+      doc: { summary: 'Turn the current guest into an account, keeping its progress', tags: ['auth'] },
+    },
+  }),
+};