@netforge/kit-play 0.0.0-stage → 0.1.0

package/dist/host/profile.js

@@ -0,0 +1,163 @@
+// Saved progress for local play, in memory only: achievements, goals and
+// titles the sim reports, the looks and unlocks bought with play money,
+// settings and a display name. Everything is gone when `kit play` stops.
+// Nothing here is a wallet, a balance or a claim.
+import { metaPrice, openKeepers, ownedCosmetics, todaysGoals, utcDay } from "@netforge/engine/game";
+const GUEST_RE = /^[A-Za-z0-9_-]{16,80}$/;
+export function isGuestId(v) {
+    return typeof v === "string" && GUEST_RE.test(v);
+}
+export class LocalProfiles {
+    game;
+    spec;
+    now;
+    byId = new Map();
+    listeners = new Set();
+    constructor(game, spec, now = Date.now) {
+        this.game = game;
+        this.spec = spec;
+        this.now = now;
+    }
+    onChange(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    saved(id) {
+        let s = this.byId.get(id);
+        if (!s) {
+            s = { achievements: new Map(), goals: new Map(), titles: new Map(), owned: new Set(), meta: {}, settings: {}, displayName: null };
+            this.byId.set(id, s);
+        }
+        return s;
+    }
+    changed(id) {
+        for (const fn of this.listeners)
+            fn(id);
+    }
+    /** Keeper indices this profile may pick (null: the game has no keepers). */
+    keepers(id) {
+        const spec = this.spec;
+        if (!spec || spec.keepers.length === 0)
+            return null;
+        const s = id ? this.saved(id) : null;
+        return openKeepers(spec, { achievements: s ? s.achievements.keys() : [], owned: s ? s.owned : [] });
+    }
+    ownsCosmetic(id, value) {
+        if (value === 0)
+            return true;
+        if (!this.spec || !id)
+            return false;
+        return ownedCosmetics(this.spec, this.saved(id).owned).includes(value);
+    }
+    record(id, kind, item) {
+        const s = this.saved(id);
+        if (kind === "achievement") {
+            if (s.achievements.has(item))
+                return;
+            s.achievements.set(item, this.now());
+        }
+        else if (kind === "goal") {
+            const day = utcDay(this.now());
+            const set = s.goals.get(day) ?? new Set();
+            if (set.has(item))
+                return;
+            set.add(item);
+            s.goals.set(day, set);
+        }
+        else {
+            s.titles.set(item, (s.titles.get(item) ?? 0) + 1);
+        }
+        this.changed(id);
+    }
+    /** A permanent SKU bought with play money (POST /profile/redeem): the look or unlock is owned from now on. */
+    redeem(id, item) {
+        const def = this.spec?.meta.get(item);
+        if (def) {
+            const s = this.saved(id);
+            const level = s.meta[item] ?? 0;
+            if (level >= def.levels)
+                return { ok: false, error: "at the top level" };
+            s.meta[item] = level + 1;
+            this.changed(id);
+            return { ok: true };
+        }
+        const sku = this.spec?.skus.get(item);
+        if (!sku)
+            return { ok: false, error: "no such item" };
+        const s = this.saved(id);
+        if (sku.kind === "consumable")
+            return { ok: false, error: "a run upgrade is bought in the run" };
+        s.owned.add(item);
+        this.changed(id);
+        return { ok: true };
+    }
+    /** Meta upgrade levels owned (bought with play money). */
+    metaLevels(id) {
+        return id ? { ...this.saved(id).meta } : {};
+    }
+    settings(id, settings) {
+        if (typeof settings !== "object" || settings === null || Array.isArray(settings))
+            return;
+        if (JSON.stringify(settings).length > 8192)
+            return;
+        this.saved(id).settings = { ...settings };
+        this.changed(id);
+    }
+    name(id, displayName) {
+        if (typeof displayName !== "string")
+            return;
+        const n = displayName.replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 24);
+        this.saved(id).displayName = n || null;
+        this.changed(id);
+    }
+    view(id) {
+        const spec = this.spec;
+        const day = utcDay(this.now());
+        const today = spec ? todaysGoals([...spec.missions.keys()], day) : [];
+        const s = id ? this.saved(id) : null;
+        const owned = s ? [...s.owned] : [];
+        const keeperIdx = this.keepers(id) ?? [];
+        return {
+            game: this.game,
+            kind: id ? "guest" : null,
+            wallet: null,
+            displayName: s?.displayName ?? null,
+            achievements: s ? [...s.achievements].map(([a, at]) => ({ id: a, at, source: "sim" })) : [],
+            keepers: spec ? keeperIdx.map((i) => spec.keepers[i]?.id ?? "").filter(Boolean) : [],
+            owned,
+            cosmetics: spec ? ownedCosmetics(spec, owned) : [0],
+            meta: s ? { ...s.meta } : {},
+            goals: { day, today, done: s ? [...(s.goals.get(day) ?? [])].filter((g) => today.includes(g)) : [] },
+            titles: s ? Object.fromEntries(s.titles) : {},
+            settings: s ? { ...s.settings } : {},
+            store: spec ? this.store(owned, s?.meta ?? {}) : [],
+            imported: false,
+            credit: 0,
+            totals: { achievements: s?.achievements.size ?? 0, titles: s ? [...s.titles.values()].reduce((a, b) => a + b, 0) : 0, games: s ? 1 : 0 },
+        };
+    }
+    store(owned, meta) {
+        const spec = this.spec;
+        if (!spec)
+            return [];
+        const have = new Set(owned);
+        const out = [];
+        for (const sku of spec.skus.values()) {
+            if (sku.kind === "consumable" || !sku.grants)
+                continue;
+            const g = sku.grants;
+            const mine = have.has(sku.id);
+            if ("cosmetic" in g)
+                out.push({ id: sku.id, kind: "cosmetic", coins: mine ? null : sku.coins, owned: mine, cosmetic: g.cosmetic });
+            else if ("keeper" in g)
+                out.push({ id: sku.id, kind: "unlock", coins: mine ? null : sku.coins, owned: mine, keeper: g.keeper });
+            else if ("gear" in g)
+                out.push({ id: sku.id, kind: "gear", coins: mine ? null : sku.coins, owned: mine, gear: g.gear, loseBelow: g.loseBelow });
+        }
+        for (const [id, def] of spec.meta) {
+            const level = meta[id] ?? 0;
+            out.push({ id, kind: "meta", coins: metaPrice(def, level), owned: level > 0, stat: def.stat, step: def.step, level, levels: def.levels, bonus: level * def.step });
+        }
+        return out;
+    }
+}

package/dist/host/room.d.ts

@@ -0,0 +1,37 @@
+import { Room, type Client } from "@colyseus/core";
+import { type ProfileSpec } from "@netforge/engine/game";
+import { type CreateOptions, type JoinOptions, type SimAdapter } from "@netforge/engine/net";
+import { type LocalAoi } from "./core.js";
+import { type LocalProfiles } from "./profile.js";
+/** What the host serves: one game, set once before the server listens. */
+export interface LocalGame {
+    readonly sim: SimAdapter<unknown, unknown>;
+    readonly template: string;
+    readonly place: string;
+    readonly instanceCap: number;
+    readonly aoi: LocalAoi;
+    readonly profile: ProfileSpec | null;
+    readonly profiles: LocalProfiles;
+    /** SKU ids the store sells for coins (play money here): the only commands a client may send. */
+    readonly storeCommands: ReadonlySet<string>;
+}
+export declare function setLocalGame(g: LocalGame): void;
+/** Why local play turns these down, in the words the client shows. */
+export declare const LOCAL_ONLY = "Local play uses play money only";
+export declare class LocalRoom extends Room {
+    private core;
+    private g;
+    private readonly seats;
+    private readonly clients_;
+    private unsubscribe;
+    onCreate(options: CreateOptions): void;
+    onJoin(client: Client, options?: JoinOptions): void;
+    onLeave(client: Client): void;
+    onDispose(): void;
+    private applyProfile;
+    private sendInfo;
+    private recordProgress;
+    private tickOnce;
+    /** The sim ended a run: a fresh world, as the hosted room does between runs. Players stay connected. */
+    private newRun;
+}

package/dist/host/room.js

@@ -0,0 +1,199 @@
+// The local play room: one Colyseus room per place, speaking the engine's
+// room protocol (@netforge/engine/net protocol.ts) so the template
+// clients connect to it exactly as they connect to a hosted room. Play
+// money only: there are no wallets, no sign-in, no stakes, no pots and no
+// claims here, and earn events are shown to the player but pay nothing.
+import { Room } from "@colyseus/core";
+import { packMeta, RESERVED_COMMANDS } from "@netforge/engine/game";
+import { MSG_INPUT, MSG_SNAPSHOT, } from "@netforge/engine/net";
+import { LocalCore, SNAPSHOT_HZ } from "./core.js";
+import { isGuestId } from "./profile.js";
+let current = null;
+export function setLocalGame(g) {
+    current = g;
+}
+function game() {
+    if (!current)
+        throw new Error("local game not set");
+    return current;
+}
+/** Why local play turns these down, in the words the client shows. */
+export const LOCAL_ONLY = "Local play uses play money only";
+const INFO_EVERY_TICKS = 15;
+function parseCommand(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    const o = raw;
+    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 32)
+        return null;
+    const value = typeof o.value === "number" && Number.isFinite(o.value) ? o.value : undefined;
+    return { name: o.name, ...(value !== undefined ? { value } : {}) };
+}
+export class LocalRoom extends Room {
+    core;
+    g;
+    seats = new Map();
+    clients_ = new Map();
+    unsubscribe = null;
+    onCreate(options) {
+        this.g = game();
+        if (options?.template !== this.g.template)
+            throw new Error(`this host plays the ${this.g.template} template`);
+        const sim = this.g.sim;
+        this.maxClients = this.g.instanceCap;
+        this.autoDispose = true;
+        this.setPatchRate(null);
+        void this.setMetadata({ place: this.g.place, template: this.g.template });
+        this.core = new LocalCore(sim, this.g.aoi, (Math.random() * 2 ** 31) | 0);
+        this.unsubscribe = this.g.profiles.onChange((id) => {
+            for (const seat of this.seats.values())
+                if (seat.profile === id)
+                    this.applyProfile(seat);
+        });
+        this.onMessageBytes(MSG_INPUT, (client, bytes) => {
+            const seat = this.seats.get(client.sessionId);
+            if (seat)
+                this.core.receiveInput(seat.player, bytes);
+        });
+        this.onMessage("command", (client, raw) => {
+            const seat = this.seats.get(client.sessionId);
+            const cmd = parseCommand(raw);
+            if (!seat || !cmd)
+                return;
+            const reply = (r) => client.send("command-result", r);
+            if (!sim.command)
+                return reply({ name: cmd.name, ok: false, reason: "no store in this game" });
+            if (RESERVED_COMMANDS.has(cmd.name))
+                return reply({ name: cmd.name, ok: false, reason: "not for sale" });
+            const sold = cmd.name === "cosmetic" ? this.g.profiles.ownsCosmetic(seat.profile, cmd.value ?? 0) : this.g.storeCommands.has(cmd.name);
+            if (!sold)
+                return reply({ name: cmd.name, ok: false, reason: "not for sale" });
+            const ok = this.core.command(seat.player, { name: cmd.name, ...(cmd.value !== undefined ? { value: cmd.value } : {}) });
+            reply(ok ? { name: cmd.name, ok } : { name: cmd.name, ok, reason: "not applicable now" });
+        });
+        this.onMessage("stake", (client) => client.send("stake", { state: "refused", stake: 0, reason: LOCAL_ONLY }));
+        this.onMessage("pot", (client) => client.send("pot", { state: "refused", entry: 0, reason: LOCAL_ONLY }));
+        this.onMessage("sign-in", (client) => client.send("sign-in-result", { ok: false, runId: null, earnRefused: "guest" }));
+        this.onMessage("claim", (client) => client.send("attest-error", LOCAL_ONLY));
+        this.onMessage("ping", (client, t) => client.send("pong", t));
+        this.setSimulationInterval(() => this.tickOnce(), 1000 / sim.tickHz);
+    }
+    onJoin(client, options) {
+        const { player, entity } = this.core.addPlayer();
+        const seat = { sessionId: client.sessionId, player, entity, profile: isGuestId(options?.guest) ? `g:${options.guest}` : null, metaApplied: 0 };
+        this.seats.set(client.sessionId, seat);
+        this.clients_.set(player, client);
+        const sim = this.g.sim;
+        const welcome = {
+            player,
+            entity,
+            tickHz: sim.tickHz,
+            snapshotHz: SNAPSHOT_HZ,
+            sim: sim.name,
+            version: sim.version,
+            place: this.g.place,
+            template: this.g.template,
+            runId: null,
+            earnLive: false,
+        };
+        client.send("welcome", welcome);
+        this.applyProfile(seat);
+        this.sendInfo(seat, client, true);
+    }
+    onLeave(client) {
+        const seat = this.seats.get(client.sessionId);
+        if (!seat)
+            return;
+        this.seats.delete(client.sessionId);
+        this.clients_.delete(seat.player);
+        this.core.removePlayer(seat.player);
+    }
+    onDispose() {
+        this.unsubscribe?.();
+        this.core?.dispose();
+    }
+    applyProfile(seat) {
+        const keepers = this.g.profiles.keepers(seat.profile);
+        this.core.setRights(seat.player, keepers ? { keepers } : null);
+        const spec = this.g.profile;
+        if (spec && spec.economy.metaUpgrades && spec.meta.size > 0) {
+            const value = packMeta(spec, this.g.profiles.metaLevels(seat.profile));
+            if (value !== seat.metaApplied) {
+                this.core.command(seat.player, { name: "meta", value });
+                seat.metaApplied = value;
+            }
+        }
+        this.clients_.get(seat.player)?.send("profile", this.g.profiles.view(seat.profile));
+    }
+    sendInfo(seat, client, force) {
+        const sim = this.g.sim;
+        if (sim.infoFor) {
+            const v = sim.infoFor(this.core.world, seat.player);
+            if (v === null || v === undefined)
+                return;
+            const json = JSON.stringify(v);
+            if (!force && json === seat.lastInfo)
+                return;
+            seat.lastInfo = json;
+            client.send("run", v);
+            return;
+        }
+        const info = sim.info?.(this.core.world);
+        if (info)
+            client.send("run", info);
+    }
+    recordProgress(e) {
+        if (!this.g.profile)
+            return;
+        const c = this.clients_.get(e.player);
+        const seat = c ? this.seats.get(c.sessionId) : undefined;
+        if (seat?.profile)
+            this.g.profiles.record(seat.profile, e.kind, e.id);
+    }
+    tickOnce() {
+        const res = this.core.step();
+        let reset = false;
+        for (const e of res.events) {
+            if (e.type === "run.reset")
+                reset = true;
+            else if (e.type === "progress")
+                this.recordProgress(e);
+            else
+                this.clients_.get(e.player)?.send("earn", { rule: e.rule, units: e.units });
+        }
+        for (const [player, bytes] of res.snapshots)
+            this.clients_.get(player)?.sendBytes(MSG_SNAPSHOT, bytes);
+        const sim = this.g.sim;
+        if (res.tick % (sim.infoEveryTicks ?? INFO_EVERY_TICKS) === 0) {
+            if (sim.infoFor) {
+                for (const seat of this.seats.values()) {
+                    const c = this.clients_.get(seat.player);
+                    if (c)
+                        this.sendInfo(seat, c, false);
+                }
+            }
+            else if (sim.info) {
+                const info = sim.info(this.core.world);
+                if (info)
+                    this.broadcast("run", info);
+            }
+        }
+        if (reset)
+            this.newRun();
+    }
+    /** The sim ended a run: a fresh world, as the hosted room does between runs. Players stay connected. */
+    newRun() {
+        const entities = this.core.rebase((Math.random() * 2 ** 31) | 0);
+        const sim = this.g.sim;
+        for (const seat of this.seats.values()) {
+            const entity = entities.get(seat.player);
+            if (entity === undefined)
+                continue;
+            seat.entity = entity;
+            seat.lastInfo = undefined;
+            seat.metaApplied = 0;
+            this.clients_.get(seat.player)?.send("rebase", { entity, sim: sim.name, version: sim.version });
+            this.applyProfile(seat);
+        }
+    }
+}

package/dist/host/server.d.ts

@@ -0,0 +1,25 @@
+import { type LocalGame } from "./room.js";
+export interface HostOptions {
+    readonly port: number;
+    /** Interface to bind; 127.0.0.1 keeps the game on this computer. */
+    readonly host: string;
+    /** The built client (index.html and its assets). */
+    readonly clientDir: string;
+    /** The built asset library (index.json and the style folders), or null to serve none. */
+    readonly libraryDir: string | null;
+}
+export interface RunningHost {
+    readonly url: string;
+    close(): Promise<void>;
+}
+/** Rooms one local host keeps open at once (each runs its own sim). */
+export declare const MAX_ROOMS = 8;
+/** A file under `root` for a request path, or null (never outside root). */
+export declare function fileUnder(root: string, urlPath: string): string | null;
+/**
+ * On a loopback bind, only requests addressed to this computer by name are
+ * answered (a page elsewhere that rebinds its own host name to 127.0.0.1
+ * gets 403), and only same-origin or non-browser requests may POST.
+ */
+export declare function allowedRequest(bindHost: string, port: number, host: string | undefined, origin: string | undefined, method: string | undefined): boolean;
+export declare function startServer(g: LocalGame, o: HostOptions): Promise<RunningHost>;

package/dist/host/server.js

@@ -0,0 +1,233 @@
+// The local play host's HTTP side, on one port: the built game page, the
+// asset library, the seat request (POST /world/join) and in-memory profiles,
+// with Colyseus behind them for the room itself. It binds to 127.0.0.1
+// unless told otherwise. Sign-in, the referee and every money route answer
+// 403: local play has none of them.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { createServer } from "node:http";
+import { extname, normalize, resolve, sep } from "node:path";
+import { defineRoom, defineServer, matchMaker } from "@colyseus/core";
+import { WebSocketTransport } from "@colyseus/ws-transport";
+import { ROOM_NAME } from "@netforge/engine/net";
+import { LOCAL_ONLY, LocalRoom, setLocalGame } from "./room.js";
+import { isGuestId } from "./profile.js";
+const TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json",
+    ".wasm": "application/wasm",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".jpg": "image/jpeg",
+    ".glb": "model/gltf-binary",
+    ".ktx2": "image/ktx2",
+    ".ogg": "audio/ogg",
+    ".mp3": "audio/mpeg",
+    ".woff2": "font/woff2",
+};
+const MAX_BODY = 64 * 1024;
+/** Rooms one local host keeps open at once (each runs its own sim). */
+export const MAX_ROOMS = 8;
+function send(res, status, body) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+    res.end(JSON.stringify(body));
+}
+/** A file under `root` for a request path, or null (never outside root). */
+export function fileUnder(root, urlPath) {
+    let rel;
+    try {
+        rel = decodeURIComponent(urlPath);
+    }
+    catch {
+        return null;
+    }
+    if (rel.includes("\0"))
+        return null;
+    const base = resolve(root);
+    const file = resolve(base, "." + normalize("/" + rel));
+    if (file !== base && !file.startsWith(base + sep))
+        return null;
+    if (!existsSync(file) || !statSync(file).isFile())
+        return null;
+    return file;
+}
+function serveFile(res, file) {
+    res.writeHead(200, { "content-type": TYPES[extname(file).toLowerCase()] ?? "application/octet-stream", "cache-control": "no-cache" });
+    res.end(readFileSync(file));
+}
+function readBody(req) {
+    return new Promise((ok, fail) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > MAX_BODY) {
+                fail(new Error("body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => {
+            if (chunks.length === 0)
+                return ok({});
+            try {
+                ok(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            }
+            catch {
+                ok({});
+            }
+        });
+        req.on("error", fail);
+    });
+}
+const obj = (v) => (typeof v === "object" && v !== null && !Array.isArray(v) ? v : {});
+async function joinSeat(g, body) {
+    if (body.template !== g.template)
+        throw new Error(`this host plays the ${g.template} template`);
+    const place = typeof body.place === "string" && body.place.length > 0 && body.place.length <= 64 ? body.place : g.place;
+    const rooms = await matchMaker.query({ name: ROOM_NAME });
+    const open = rooms.find((r) => r.metadata?.place === place && !r.locked && r.clients < r.maxClients);
+    if (!open && rooms.length >= MAX_ROOMS)
+        throw new Error("too many rooms on this computer");
+    const room = open ?? (await matchMaker.createRoom(ROOM_NAME, { place, template: g.template }));
+    const reservation = await matchMaker.reserveSeatFor(room, isGuestId(body.guest) ? { guest: body.guest } : {});
+    return { roomId: room.roomId, reason: open ? "joined" : "created", reservations: [reservation] };
+}
+async function route(g, o, req, res) {
+    const url = new URL(req.url ?? "/", "http://local");
+    const path = url.pathname;
+    if (path === "/health")
+        return send(res, 200, { ok: true, local: true, template: g.template }), true;
+    if (path.startsWith("/auth/") || path.startsWith("/referee/") || path.startsWith("/admin/"))
+        return send(res, 403, { error: LOCAL_ONLY }), true;
+    if (path === "/world/join" && req.method === "POST") {
+        try {
+            send(res, 200, await joinSeat(g, obj(await readBody(req))));
+        }
+        catch (e) {
+            send(res, 409, { error: e instanceof Error ? e.message : "join failed" });
+        }
+        return true;
+    }
+    if (path.startsWith("/profile")) {
+        const guest = req.headers["x-guest-id"];
+        const id = isGuestId(guest) ? `g:${guest}` : null;
+        if (req.method === "GET" && path.startsWith("/profile/game/"))
+            return send(res, 200, g.profiles.view(id)), true;
+        if (req.method === "GET" && path === "/profile")
+            return send(res, 200, { kind: id ? "guest" : null, wallet: null, displayName: null, settings: {}, totals: { achievements: 0, titles: 0, games: 0 }, games: [] }), true;
+        if (req.method !== "POST")
+            return send(res, 405, { error: "method" }), true;
+        let body;
+        try {
+            body = obj(await readBody(req));
+        }
+        catch {
+            return send(res, 413, { error: "body too large" }), true;
+        }
+        if (!id)
+            return send(res, 400, { error: "a guest id is required" }), true;
+        if (path === "/profile/settings")
+            g.profiles.settings(id, body.settings);
+        else if (path === "/profile/name")
+            g.profiles.name(id, body.displayName);
+        else if (path === "/profile/redeem") {
+            const r = g.profiles.redeem(id, typeof body.item === "string" ? body.item : "");
+            if (!r.ok)
+                return send(res, 400, { error: r.error ?? "refused" }), true;
+        }
+        else if (path !== "/profile/import" && path !== "/profile/claim")
+            return send(res, 404, { error: "not found" }), true;
+        return send(res, 200, g.profiles.view(id)), true;
+    }
+    if (req.method !== "GET" && req.method !== "HEAD")
+        return send(res, 404, { error: "not found" }), true;
+    if (path.startsWith("/library/")) {
+        const file = o.libraryDir ? fileUnder(o.libraryDir, path.slice("/library/".length)) : null;
+        if (!file)
+            return send(res, 404, { error: "not in the asset library" }), true;
+        return serveFile(res, file), true;
+    }
+    const file = fileUnder(o.clientDir, path === "/" ? "index.html" : path.slice(1));
+    if (!file)
+        return send(res, 404, { error: "not found" }), true;
+    serveFile(res, file);
+    return true;
+}
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+/**
+ * On a loopback bind, only requests addressed to this computer by name are
+ * answered (a page elsewhere that rebinds its own host name to 127.0.0.1
+ * gets 403), and only same-origin or non-browser requests may POST.
+ */
+export function allowedRequest(bindHost, port, host, origin, method) {
+    if (!LOOPBACK.has(bindHost))
+        return true;
+    const name = (host ?? "").replace(/:\d+$/, "").toLowerCase();
+    if (!LOOPBACK.has(name))
+        return false;
+    if (method === "GET" || method === "HEAD" || origin === undefined)
+        return true;
+    try {
+        const o = new URL(origin);
+        return LOOPBACK.has(o.hostname.toLowerCase()) && Number(o.port || 80) === port;
+    }
+    catch {
+        return false;
+    }
+}
+export async function startServer(g, o) {
+    setLocalGame(g);
+    const http = createServer();
+    const emit = http.emit.bind(http);
+    // Our routes answer first; Colyseus sees only what is left (the WebSocket upgrades that consume a seat).
+    http.emit = ((event, ...args) => {
+        if (event !== "request")
+            return emit(event, ...args);
+        const req = args[0];
+        const res = args[1];
+        const path = (req.url ?? "/").split("?")[0] ?? "/";
+        const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+        if (!allowedRequest(o.host, o.port, req.headers.host, origin, req.method))
+            return send(res, 403, { error: "local play answers this computer only" }), true;
+        // Seats come only from /world/join; Colyseus' own HTTP matchmaking (which could open rooms without limit) is closed.
+        if (path.startsWith("/matchmake"))
+            return send(res, 403, { error: "seats come from /world/join" }), true;
+        void route(g, o, req, res).catch(() => send(res, 500, { error: "local host error" }));
+        return true;
+    });
+    // WebSocket upgrades pass the same Host and Origin check as requests.
+    const upgradeEmit = http.emit;
+    http.emit = ((event, ...args) => {
+        if (event === "upgrade") {
+            const req = args[0];
+            const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+            if (!allowedRequest(o.host, o.port, req.headers.host, origin, "POST")) {
+                args[1].destroy();
+                return true;
+            }
+        }
+        return upgradeEmit.call(http, event, ...args);
+    });
+    const server = defineServer({
+        transport: new WebSocketTransport({ server: http, pingInterval: 5000, pingMaxRetries: 3 }),
+        rooms: { [ROOM_NAME]: defineRoom(LocalRoom) },
+        greet: false,
+        gracefullyShutdown: false,
+    });
+    await server.listen(o.port, o.host);
+    const shown = o.host === "0.0.0.0" || o.host === "::" ? "localhost" : o.host;
+    return {
+        url: `http://${shown}:${o.port}`,
+        close: async () => {
+            await server.gracefullyShutdown(false).catch(() => undefined);
+            http.close();
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { HELP, runPlayCli, type PlayCliIo } from "./cli.js";
+export { ALLOWED_IMPORT, play, PlayError, readGameFolder, type GameFolder, type PlayOptions, type Playing } from "./play.js";
+export { TEMPLATES, templateFor, type TemplateEntry, type TemplateId } from "./templates.js";
+export { namesModule, parseNames, type Names } from "./names.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { HELP, runPlayCli } from "./cli.js";
+export { ALLOWED_IMPORT, play, PlayError, readGameFolder } from "./play.js";
+export { TEMPLATES, templateFor } from "./templates.js";
+export { namesModule, parseNames } from "./names.js";