@onceworlds/cli 0.11.0 → 0.13.0

package/README.md

@@ -7,7 +7,7 @@ players) with no server code.
 ## Deploy from GitHub Actions
 
 Deploys run from GitHub Actions: GitHub vouches for the repo, so there are no API
-keys. The easiest setup is to import the repo at https://onceworlds.com/create?new=github,
+keys. The easiest setup is to import the repo at https://onceworlds.com/upload?new=github,
 which adds `onceworlds.json` and `.github/workflows/onceworlds.yml` for you (that
 workflow also builds with npm, pnpm, yarn or bun when there's a build script). To write
 the same files into a folder before it is on GitHub, run `npx @onceworlds/cli init` there.
@@ -96,7 +96,7 @@ from the running game and commit them under `store/`. `onceworlds doctor` says w
   whose idea, look and screens are never yours; it adds its own notes as `KIT.md` and its fingerprints as `.onceworlds/kit.json`,
   so `check` can note what is still the kit's. `--template party` or `starter` starts from a complete game on the SDK, and
   `--template <name>` from a scene project of Onceworlds Build.
-- `onceworlds check [dir]` is what to run before a deploy, for any game (canvas, three.js, PixiJS, Phaser, the DOM, the engine):
+- `onceworlds check [dir]` is what to run before a deploy, for any game (canvas, three.js, PixiJS, Phaser, the DOM, the engine, a Godot or Ren'Py web export):
   doctor's findings, plus the hosts the platform's CSP won't let the game reach, WebSockets of its own, text too small for a phone,
   a second countdown under the platform's lobby, shared state written from `Math.random()` or the device's clock, and a `DESIGN.md`
   silent on originality and the first minute. Then it plays the game on the local platform (`serve`'s) in headless Chrome: it loads
@@ -123,7 +123,7 @@ from the running game and commit them under `store/`. `onceworlds doctor` says w
   imports it (next to a `AGENTS.md` of your own it writes `ONCEWORLDS.md` and adds a pointer to yours). It never
   overwrites a file you have: `--force` replaces only what init writes, never your own `AGENTS.md`, `CLAUDE.md` or `.gitignore`.
   `onceworlds new` writes the same workflow and `.gitignore` into every game it makes.
-  Then commit, push, and import the repo at https://onceworlds.com/create?new=github.
+  Then commit, push, and import the repo at https://onceworlds.com/upload?new=github.
 - `onceworlds deploy [dir]` uploads only the files that changed and publishes the game
   (the workflow runs it). It lists every file it skipped because Onceworlds can't serve it. A game's tests never go up: `*.test.js`, `vitest.config.*` and the `test/` folder at the top of the game.
 - `onceworlds serve [dir]` plays any game in your own browser on this computer, offline and with no login, on a local platform

package/dist/cli.js

@@ -615,6 +615,8 @@ var CONTENT_TYPES = {
   wgsl: "text/plain; charset=utf-8",
   pck: "application/octet-stream",
   data: "application/octet-stream",
+  // Ren'Py's web build loads its game from a game.zip.
+  zip: "application/zip",
   woff: "font/woff",
   woff2: "font/woff2",
   ttf: "font/ttf",
@@ -715,6 +717,25 @@ var NEW_GAME_RESERVED_SLUGS = /* @__PURE__ */ new Set([
 ]);
 var NEW_GAME_RESERVED_PREFIXES = ["onceworlds", "admin", "free-"];
 var SLUG_AUTH_WORDS = /* @__PURE__ */ new Set(["login", "logon", "signin", "signon", "signup", "verify", "verification", "password", "passwords", "billing"]);
+var NAME_AUTH_WORDS = /* @__PURE__ */ new Set([
+  "login",
+  "logon",
+  "signin",
+  "signup",
+  "verify",
+  "verification",
+  "password",
+  "billing",
+  "account",
+  "support",
+  "helpdesk",
+  "official",
+  "staff",
+  "admin",
+  "administrator",
+  "moderator",
+  "security"
+]);
 var BRANDS = ["onceworlds", "roblox", "robux", "vbucks", "fortnite", "minecraft", "xbox", "playstation", "nintendo"];
 var LOOKALIKES = {
   "0": "o",
@@ -793,6 +814,10 @@ function hasBrand(text2) {
   }
   return false;
 }
+function isReservedGameName(name) {
+  if (hasBrand(name)) return true;
+  return foldedWords(name).some((words3) => NAME_AUTH_WORDS.has(words3.join("")));
+}
 var DEFAULT_PRODUCTION_BRANCH = "main";
 function isValidBranchName(name) {
   return name.length > 0 && name.length <= 200 && /^[A-Za-z0-9._/-]+$/.test(name) && !/^[-/.]|[/.]$|\.\.|\/\/|\/\.|\.lock$|^HEAD$/.test(name);
@@ -1480,9 +1505,26 @@ function checkGame(files) {
         line: at,
         level: "note",
         id: "matches",
-        message: `This joins a room but doesn't use the platform's lobby or match lifecycle. That's right for a world people drop in and out of; a game with rounds gets ready-up, a countdown, spectators and pausing from rooms.join({ lobby: 'card' }) (see AGENTS.md, "Matches").`
+        message: `This joins a room but doesn't use the platform's lobby or match lifecycle. That's right for a world people drop in and out of; a game with rounds gets ready-up, a countdown, spectators and pausing from rooms.join({ lobby: 'bar' }), or 'card' (see AGENTS.md, "Matches").`
       });
     }
+    const lobbyLine = (id, level, test, message) => {
+      const file = code.find((f) => test.test(f.text));
+      if (file) found.push({ file: file.path, line: lineOf(file.text, file.text.search(test)), level, id, message });
+    };
+    lobbyLine("hide-lobby", "warn", /\.\s*hideLobby\s*\(/, "room.hideLobby does nothing now: the platform's strip or card always shows in the lobby. Take it out.");
+    lobbyLine("own-countdown", "warn", /\bownCountdown\s*:\s*true\b/, "The 3-2-1 is the platform's. Drop ownCountdown and your own numeral, and start the match's action on matchstart, so one countdown shows.");
+    const gameDrawn = /\blobby\s*:\s*['"]game['"]/;
+    if (gameDrawn.test(all)) {
+      if (/\.\s*setReady\s*\(/.test(all)) lobbyLine("game-lobby", "warn", gameDrawn, "lobby: 'game' with setReady: this game draws Ready itself, so it can't match the rest of the platform (Enter, the same words, a strip that's always there). Use lobby: 'bar' or 'card'.");
+    } else if (/\blobby\s*:\s*['"]bar['"]/.test(all)) {
+      const drawn = /(?:textContent|innerText|innerHTML|fillText\s*\(|label\s*:)\s*=?\s*['"`](?:<[^>]*>)*\s*(Ready|Ready up|Start|Start match|Not ready)\s*(?:<[^>]*>)*['"`]/;
+      const htmlButton = /<button\b[^>]*>\s*(Ready|Ready up|Start match)\s*<\/button>/i;
+      if (/\.\s*(setReady|startMatch)\s*\(/.test(all)) {
+        const test = drawn.test(all) ? drawn : htmlButton;
+        lobbyLine("double-ready", "warn", test, "This joins with lobby: 'bar', and draws a Ready or Start button of its own too: players see two. The strip's button and Enter are the way; take yours out.");
+      }
+    }
     if (/\bDate\s*\.\s*now\s*\(/.test(all) && !/\bonceworlds\s*\.\s*now\s*\(|\bow\s*\.\s*now\s*\(|\bmatchNow\s*\(/.test(all)) {
       found.push({
         file: host.path,
@@ -3185,7 +3227,7 @@ ${line3}
 Next:
   1. Check onceworlds.json: "slug" is your game's link (onceworlds.com/play/<slug>) and "name" is its title.
   2. Commit these files and push the repo to GitHub.
-  3. Open ${options.api}/create?new=github, import the repo, and every push publishes your game.`);
+  3. Open ${options.api}/upload?new=github, import the repo, and every push publishes your game.`);
 }
 async function readPackage2(dir) {
   try {
@@ -4319,7 +4361,7 @@ ${game.description ? `${game.description}
 - \`npm test\`: the tests of rules.js (\`node --test\`, nothing to install).
 - \`npx @onceworlds/cli check\`: common mistakes, before every deploy. \`shot --story\` shows its first minute.
 - \`npx @onceworlds/cli deploy\` (after \`login\`) pushes a draft to play and publish at ${game.api}/create/${game.slug}. Or push the repo to GitHub
-  and import it at ${game.api}/create?new=github: \`.github/workflows/onceworlds.yml\` deploys every push.
+  and import it at ${game.api}/upload?new=github: \`.github/workflows/onceworlds.yml\` deploys every push.
 `
   );
   return files;
@@ -6513,6 +6555,7 @@ import { extname, join as join10, resolve as resolve6, sep } from "node:path";
 // ../protocol/src/hosting.ts
 var GAME_FRAME_SANDBOX = "allow-scripts allow-pointer-lock allow-forms allow-orientation-lock";
 var GAME_FRAME_ALLOW = ["autoplay", "gamepad", "screen-wake-lock", "accelerometer", "gyroscope"].map((feature) => `${feature} *`).join("; ");
+var GAME_STORAGE_BYTES = 100 * 1024 * 1024;
 var GAME_CDNS = ["https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com", "https://unpkg.com", "https://esm.sh", "https://ga.jspm.io"];
 var GOOGLE_FONTS = { styles: "https://fonts.googleapis.com", files: "https://fonts.gstatic.com" };
 function gameContentSecurityPolicy(options) {
@@ -6542,6 +6585,9 @@ function gameContentSecurityPolicy(options) {
     `sandbox ${GAME_FRAME_SANDBOX}`
   ].join("; ");
 }
+var BRIDGE_PAGE = "onceworlds:page";
+var PAGE_WATCH_SCRIPT = `(function(){var n=0,s=function(w,d){if(n++<12)try{parent.postMessage({type:${JSON.stringify(BRIDGE_PAGE)},what:w,detail:String(d).slice(0,200)},"*")}catch(e){}};s("ran",document.readyState);addEventListener("securitypolicyviolation",function(e){s("blocked",e.effectiveDirective+" "+e.blockedURI)});addEventListener("error",function(e){var t=e.target;t&&t.tagName?s("failed",t.tagName+" "+(t.src||t.href)):s("threw",e.message+" "+e.filename+":"+e.lineno)},true);addEventListener("load",function(){s("loaded",typeof onceworlds)})})();`;
+var PAGE_WATCH_TAG = `<script>${PAGE_WATCH_SCRIPT}</script>`;
 function gameMayReach(url, kind) {
   let parsed;
   try {
@@ -7488,7 +7534,7 @@ var LocalRoom = class {
     const blocker = startBlocker(lobby);
     if (blocker) return this.error(ws, blocker.code, blocker.message);
     const countdown = clampCountdown(msg.countdown, config.countdown ?? LIMITS.matchCountdownMs);
-    this.mrec = this.enterStarting(this.mrec, rosterOf(lobby), Date.now(), config, countdown, msg.open === true);
+    this.mrec = this.enterStarting(this.mrec, rosterOf(lobby), Date.now(), config, countdown, true);
     this.stepMatch();
   }
   hostOpen(ws, me, msg, config) {
@@ -8696,7 +8742,7 @@ async function gameSources(root) {
   return out;
 }
 async function usesPlatformMatch(root) {
-  return (await gameSources(root)).some((f) => /\b(setReady|startMatch|matchNow)\s*\(|\bmatch\s*\.\s*phase\b|\blobby\s*:\s*['"](card|bar)['"]|\bFlow\s*\.\s*(rounds|turns|coop)\s*\(|\bcreateMatch\s*\(/.test(f.text));
+  return (await gameSources(root)).some((f) => /\b(setReady|startMatch|matchNow)\s*\(|\bmatch\s*\.\s*phase\b|\blobby\s*:\s*['"](card|bar)['"]|\bminPlayers\s*:|\bFlow\s*\.\s*(rounds|turns|coop)\s*\(|\bcreateMatch\s*\(/.test(f.text));
 }
 async function readProbe(p) {
   try {
@@ -12195,9 +12241,10 @@ function lintAny(input) {
   for (const { file } of scripts) {
     const join18 = /\brooms\s*\.\s*join\s*\(\s*\{[^}]*\blobby\s*:\s*["'](card|bar)["'][^}]*\}/.exec(file.text);
     if (!join18 || /\bownCountdown\s*:\s*true\b/.test(join18[0])) continue;
-    const all = scripts.map((s) => s.code).join("\n");
-    const own = /\bstartsAt\b/.exec(all) && /countdown|count_down|\b3\s*,\s*2\s*,\s*1\b/i.test(all);
-    if (own) push(file, join18.index, "warn", "countdown", `This joins with the platform's lobby ('${join18[1]}'), which draws the 3-2-1 itself, and the game seems to draw one too (it reads match.startsAt): players see two countdowns. Say ownCountdown: true in rooms.join to draw yours alone, or drop yours.`);
+    const own = scripts.some(
+      ({ code: text2 }) => [...text2.matchAll(/\bstartsAt\b/g)].some((m) => /fillText|textContent|innerText|innerHTML|\btext\s*\(|draw\w*\s*\(/.test(text2.slice(m.index, m.index + 240).split(/\n\s*\}/)[0]))
+    );
+    if (own) push(file, join18.index, "warn", "countdown", `This joins with the platform's lobby ('${join18[1]}'), which draws the 3-2-1 itself, and the game seems to draw one too (it reads match.startsAt): players see two countdowns. Drop yours.`);
   }
   for (const { file, code: text2 } of scripts) {
     for (const m of text2.matchAll(/\b(setState|send)\s*\(/g)) {
@@ -12292,12 +12339,15 @@ function checkProjectConfig(config) {
     return out;
   }
   const c = config;
-  if (typeof c.slug !== "string" || !isValidSlug(c.slug)) {
+  if (typeof c.slug === "string" && isReservedSlug(c.slug, false)) {
+    error("slug", `The link "${c.slug}" in onceworlds.json isn't available.`, `Pick another link, like "star-party": it is the game's address, onceworlds.com/play/<slug>.`);
+  } else if (typeof c.slug !== "string" || !isValidSlug(c.slug)) {
     error("slug", `"slug" in onceworlds.json must be 1-40 lowercase letters, digits or single dashes (got ${JSON.stringify(c.slug)}).`, `Pick a link like "star-party": it is the game's address, onceworlds.com/play/<slug>.`);
   }
   const name = typeof c.name === "string" ? cleanLine(c.name) : "";
   if (!name) error("name", '"name" is required in onceworlds.json.', 'Give the game its title: "name": "Star Party".');
   else if (name.length > LIMITS.gameNameLength) error("name", `"name" in onceworlds.json can be at most ${LIMITS.gameNameLength} characters (it has ${name.length}).`, "Shorten the title.");
+  else if (isReservedGameName(name)) note("name", `A game can't take the name "${name}".`, "Give it a title of its own.");
   if (c.description !== void 0 && typeof c.description !== "string") {
     error("description", '"description" in onceworlds.json must be text.', "Write one or two sentences about the game.");
   } else if (typeof c.description === "string" && c.description.trim().length > DESCRIPTION_SHOWN) {
@@ -12363,8 +12413,29 @@ function checkProjectConfig(config) {
   return out;
 }
 
+// ../protocol/src/deploy-files.ts
+var LARGE_FILE_EXTENSIONS = ["wasm", "pck", "data", "zip"];
+var DEPLOY_LARGE_FILE_BYTES = 95 * 1024 * 1024;
+function deployFileLimit(path) {
+  return LARGE_FILE_EXTENSIONS.includes(extensionOf(path)) ? DEPLOY_LARGE_FILE_BYTES : LIMITS.deployFileBytes;
+}
+var NOT_A_WEB_GAME = [
+  { pattern: "(^|/)project\\.godot$", text: "This is a Godot project, not its web export. In Godot: Project > Export > Add > Web, with Thread Support off, and name the file index.html." },
+  { pattern: "\\.(rpy|rpyc|rpa)$", text: "This is a Ren'Py game, not its web build. In the Ren'Py launcher: Web, then Build Web Application." },
+  { pattern: "(^|/)(ProjectSettings|Assets)/|(^|/)UnityPlayer\\.dll$", text: "This is a Unity project, not a web build. Build for WebGL with Compression Format: Disabled." },
+  { pattern: "\\.py$", text: "Python games need a web export, such as pygbag." },
+  { pattern: "\\.(exe|apk|aab|ipa|dmg|msi|deb|rpm|appimage|x86_64)$|\\.app/", text: "This is a program to install. Games here run in the browser: export a web version with an index.html." }
+];
+function notAWebGame(paths) {
+  for (const { pattern: pattern2, text: text2 } of NOT_A_WEB_GAME) {
+    const test = new RegExp(pattern2, "i");
+    if (paths.some((path) => test.test(path))) return text2;
+  }
+  return null;
+}
+
 // src/index.ts
-var CLI_VERSION = "0.11.0";
+var CLI_VERSION = "0.13.0";
 var PRODUCTION_API = "https://onceworlds.com";
 var LOCAL_API = "http://localhost:8787";
 var USAGE = `Usage:
@@ -12372,7 +12443,7 @@ var USAGE = `Usage:
   onceworlds logout                 Forget this computer's login
   onceworlds whoami                 Who you're logged in as
   onceworlds mcp                    Run as an MCP server, so Claude Code, Codex and other AI tools can build games
-                                    on your account (they push drafts; only you publish, on onceworlds.com/create)
+                                    on your account (they push drafts; only you publish, on onceworlds.com/library)
   onceworlds new [dir]              Start a game on the web platform and the SDK: index.html, game.js on the stack you pick
                                     (--stack canvas, three, pixi or phaser, from a CDN; canvas by default), rules.js with tests
                                     that run in Node, DESIGN.md to write first, the platform guide as AGENTS.md and the deploy
@@ -12384,7 +12455,7 @@ var USAGE = `Usage:
   onceworlds init [project-dir]     Set a game folder up for Onceworlds: writes onceworlds.json, the GitHub workflow
                                     that publishes every push, and AGENTS.md and CLAUDE.md for AI coding tools
   onceworlds deploy [project-dir]   Upload the game (to ${PRODUCTION_API}): from GitHub Actions it goes live; after login
-                                    it is a draft you play and publish on onceworlds.com/create
+                                    it is a draft you play and publish from onceworlds.com/library
   onceworlds dev [project-dir]      Deploy to a local platform (${LOCAL_API}), then redeploy on every change
   onceworlds serve [project-dir]    Play any game in your own browser on this computer, offline, with no login: a local platform
                                     (the play page, rooms, lobby and SDK, saves and badges in memory) at http://127.0.0.1:8788/.
@@ -12462,7 +12533,7 @@ The project directory needs an onceworlds.json:
 var QUIET_SKIPS = /* @__PURE__ */ new Set(["node_modules", "onceworlds.json", "package.json", "package-lock.json", "tsconfig.json", "jsconfig.json", "LICENSE"]);
 var TEST_FILE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|^vitest\.config\.[cm]?[jt]s)$/;
 var DEV_FOLDERS = /* @__PURE__ */ new Set(["test", "tests", "__tests__", "coverage"]);
-var QUIET_EXTENSIONS = /* @__PURE__ */ new Set(["md", "ts", "tsx", "jsx", "lock", "lockb", "log", "yml", "yaml", "sh"]);
+var QUIET_EXTENSIONS = /* @__PURE__ */ new Set(["md", "ts", "tsx", "jsx", "lock", "lockb", "log", "yml", "yaml", "sh", "symbols"]);
 async function main() {
   const { values, positionals } = parseArgs({
     allowPositionals: true,
@@ -12569,7 +12640,8 @@ async function deploy(projectDir, api2, tokenArg, quiet = false, dev2 = false) {
     for (const path of skipped) console.warn(`    ${path}`);
   }
   if (!files.some((f) => f.path === "index.html")) {
-    throw new CliError(`No index.html in ${root}. Set "dir" in onceworlds.json to the folder that contains it.`);
+    const hint = notAWebGame([...files.map((f) => f.path), ...skipped]);
+    throw new CliError(`No index.html in ${root}. ${hint ? `${hint} Then set "dir" in onceworlds.json to the folder it makes.` : 'Set "dir" in onceworlds.json to the folder that contains it.'}`);
   }
   const sources = await readSources(files);
   const unnamed = config.engine ? void 0 : sources.find((f) => engineImportAt(f.path, f.text) >= 0);
@@ -12675,8 +12747,9 @@ async function kitPrintOf(projectDir) {
 }
 async function readSources(files) {
   const sources = [];
+  const wasm = new Set(files.filter((f) => /\.wasm$/i.test(f.path)).map((f) => f.path.slice(0, -".wasm".length)));
   for (const file of files) {
-    if (!/\.(html?|m?js|css)$/i.test(file.path) || file.size > 15e5) continue;
+    if (!/\.(html?|m?js|css)$/i.test(file.path) || file.size > 15e5 || wasm.has(file.path.replace(/\.m?js$/i, ""))) continue;
     sources.push({ path: file.path, text: await readFile9(file.abs, "utf8") });
   }
   return sources;
@@ -12874,8 +12947,8 @@ Next:
   npm test                  (the tests of rules.js: node --test, nothing to install)
   onceworlds check          (common mistakes; before every deploy)
   onceworlds shot --story   (its first minute, as a new player sees it)
-  onceworlds login, then onceworlds deploy   (a draft you play and publish on ${api2}/create)
-  To publish from a repo: push it to GitHub and import it at ${api2}/create?new=github (its workflow deploys every push).
+  onceworlds login, then onceworlds deploy   (a draft you play and publish from ${api2}/library)
+  To publish from a repo: push it to GitHub and import it at ${api2}/upload?new=github (its workflow deploys every push).
   Read AGENTS.md: the platform guide, for you and your AI tool. (onceworlds is npx @onceworlds/cli.)`);
     return;
   }
@@ -13027,8 +13100,8 @@ async function collectFiles(root) {
           continue;
         }
         const data = await readFile9(abs);
-        if (data.byteLength > LIMITS.deployFileBytes) {
-          throw new CliError(`${path} is ${formatBytes(data.byteLength)}; files can be at most ${formatBytes(LIMITS.deployFileBytes)}.`);
+        if (data.byteLength > deployFileLimit(path)) {
+          throw new CliError(`${path} is ${formatBytes(data.byteLength)}; files like it can be at most ${formatBytes(deployFileLimit(path))}.`);
         }
         files.push({ path, abs, hash: createHash5("sha256").update(data).digest("hex"), size: data.byteLength });
       }