@onceworlds/cli 0.2.0 → 0.2.1

package/README.md

@@ -6,12 +6,17 @@ players) with no server code.
 
 ## Deploy from GitHub Actions
 
-Add `.github/workflows/deploy.yml` to your game's repo:
+Deploys run from GitHub Actions: GitHub vouches for the repo, so there are no API
+keys. The easiest setup is to import the repo at https://onceworlds.com/dashboard/new,
+which adds `onceworlds.json` and `.github/workflows/onceworlds.yml` for you (that
+workflow also builds with npm, pnpm, yarn or bun when there's a build script). By
+hand, the minimum is:
 
 ```yaml
 name: Deploy to Onceworlds
 on:
   push:
+    branches: ['**']
 permissions:
   contents: read
   id-token: write # proves which repo is deploying; no API keys needed
@@ -26,17 +31,15 @@ jobs:
       - run: npx --yes @onceworlds/cli@latest deploy
 ```
 
-Pushes to `main` go live at `onceworlds.com/play/<slug>`; other branches get a
-preview URL in the job log. Sign in at https://onceworlds.com with the GitHub
+Pushes to the production branch (`main` unless you change it in the dashboard or
+`onceworlds.json`) go live at `onceworlds.com/play/<slug>`; other branches get a
+preview URL in the job log. Log in to https://onceworlds.com with the GitHub
 account that owns the repo (or any member of its organization) before the first
-deploy.
+deploy. If a deploy fails, the dashboard shows why.
 
 New games start private: only the repo's owner (or its organization's members)
-can play them. When it's ready to share, open the game in the dashboard and click
-"Make public" in the Settings tab.
-
-You can also skip the setup: import the repo at https://onceworlds.com/dashboard/new,
-which adds `onceworlds.json` and this workflow for you.
+can play them. To share one, open it in the dashboard and pick Unlisted (anyone
+with the link) or Public (also listed on Onceworlds).
 
 ## Project file
 
@@ -44,19 +47,20 @@ which adds `onceworlds.json` and this workflow for you.
 
 ```json
 {
-  "slug": "star-party",
-  "name": "Star Party",
-  "description": "Grab stars with everyone online.",
+  "slug": "kart-rush",
+  "name": "Kart Rush",
+  "description": "Race friends around twisty tracks.",
   "dir": ".",
-  "genre": "Party",
+  "genre": "Racing",
   "icon": "store/icon.png",
   "thumbnails": ["store/thumb-1.png", "store/thumb-2.png"],
-  "badges": [{ "id": "first-star", "name": "First Star", "description": "Grab a star." }]
+  "badges": [{ "id": "first-win", "name": "Top Step", "description": "Win a race." }]
 }
 ```
 
 `dir` is the folder to publish (for example `dist` after a build); it must contain
-`index.html`. `productionBranch` (default `main`) picks the branch that goes live.
+`index.html`. `productionBranch` (default `main`) picks the branch that goes live;
+the dashboard can change it too, and the file wins again only when this value changes.
 
 The rest fills in the game page: `genre`, a square `icon` (at least 128×128),
 16:9 `thumbnails` (at least 480 wide; the first is the cover) and `badges` (`id`,
@@ -66,8 +70,10 @@ these fields only when they change, so edits made in the dashboard last until th
 
 ## Commands
 
-- `onceworlds deploy [dir]` uploads only the files that changed and publishes the game.
-- `onceworlds dev [dir]` deploys to a local Onceworlds platform and redeploys on every save.
+- `onceworlds deploy [dir]` uploads only the files that changed and publishes the game
+  (the workflow runs it). It lists every file it skipped because Onceworlds can't serve it.
+- `onceworlds dev [dir]` deploys to a local Onceworlds platform (for platform development)
+  and redeploys on every save.
 
 Games talk to the platform through the injected `window.onceworlds` SDK. The
 starter template's `AGENTS.md` documents it for AI coding tools.

package/dist/cli.js

@@ -39,7 +39,15 @@ var LIMITS = {
   envValueBytes: 4 * 1024,
   proxyRequestBytes: 1024 * 1024,
   proxyResponseBytes: 10 * 1024 * 1024,
+  proxyMaxOutputTokens: 8192,
   proxyCallsPerDay: 2e3,
+  proxyCallsPerDayMax: 1e5,
+  proxyCallsPerPlayerPerDay: 100,
+  proxyCallsPerNetworkPerDay: 1e3,
+  proxyMediaCallsPerDay: 100,
+  proxyMediaCallsPerDayMax: 1e4,
+  proxyMediaCallsPerPlayerPerDay: 20,
+  proxyMediaCallsPerNetworkPerDay: 25,
   errorReportsPerPage: 10,
   gameNameLength: 60,
   gameDescriptionLength: 1e3,
@@ -52,19 +60,49 @@ var LIMITS = {
   leaderboardsPerGame: 25,
   leaderboardTop: 100,
   gamesPerOwner: 50,
+  /** New games per creator in any rolling 24-hour period. Redeploys do not count. */
+  gamesCreatedPerCreatorPerDay: 3,
   deploysPerOwnerPerDay: 100,
+  /** Finished versions retained per game, including its live version. */
+  deploymentsKeptPerGame: 10,
   deployBytesPerOwnerPerDay: 2 * 1024 * 1024 * 1024,
   bioLength: 500,
   friendsMax: 200,
   friendRequestsMax: 100,
   passwordMinLength: 8,
-  passwordMaxLength: 72
+  passwordMaxLength: 72,
+  /** Account creation attempts, with or without email, per network (IP, or IPv6 /64) in 24 hours. */
+  signupsPerNetworkPerDay: 100,
+  /** New guest players per network per day (each one can hold saves). */
+  guestsPerNetworkPerDay: 300,
+  /** Visits a game gets per network (IP, or IPv6 /64) per day: a script can't pump the count. */
+  visitsPerNetworkPerDay: 10,
+  /** Seconds of visible play before a play counts as a visit. */
+  visitSeconds: 10,
+  /** Distinct errors kept per deploy of a game (more are counted by nobody). */
+  errorsPerDeployment: 100,
+  /** On-screen controls: buttons beside the thumbstick, and their labels. */
+  controlButtons: 4,
+  controlLabelLength: 12,
+  /** Friends in one party, the leader included. */
+  partySize: 6,
+  partyChatHistory: 50,
+  /** Messages outside games: saved chats between friends. */
+  messageLength: 500,
+  messagesPerPage: 50,
+  groupChatMembers: 20,
+  groupChatNameLength: 40,
+  conversationsListed: 50,
+  notificationsListed: 50,
+  /** Friends one game invite can go to. */
+  invitesPerRequest: 10
 };
 var CONTENT_TYPES = {
   html: "text/html; charset=utf-8",
   htm: "text/html; charset=utf-8",
   js: "text/javascript; charset=utf-8",
   mjs: "text/javascript; charset=utf-8",
+  cjs: "text/javascript; charset=utf-8",
   css: "text/css; charset=utf-8",
   json: "application/json; charset=utf-8",
   map: "application/json; charset=utf-8",
@@ -90,6 +128,7 @@ var CONTENT_TYPES = {
   opus: "audio/ogg",
   wav: "audio/wav",
   m4a: "audio/mp4",
+  aac: "audio/aac",
   flac: "audio/flac",
   mp4: "video/mp4",
   webm: "video/webm",
@@ -100,6 +139,11 @@ var CONTENT_TYPES = {
   mtl: "text/plain; charset=utf-8",
   fbx: "application/octet-stream",
   wasm: "application/wasm",
+  // Shaders, loaded as text.
+  glsl: "text/plain; charset=utf-8",
+  vert: "text/plain; charset=utf-8",
+  frag: "text/plain; charset=utf-8",
+  wgsl: "text/plain; charset=utf-8",
   pck: "application/octet-stream",
   data: "application/octet-stream",
   woff: "font/woff",
@@ -132,6 +176,7 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set(["www", "api", "play", "admin", "st
 function isValidSlug(slug) {
   return SLUG_RE.test(slug) && !slug.includes("--") && !RESERVED_SLUGS.has(slug);
 }
+var DEFAULT_PRODUCTION_BRANCH = "main";
 var BADGE_KEY_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
 var GENRES = [
   "Action",
@@ -217,15 +262,18 @@ var USAGE = `Usage:
 
 Options:
   --api <url>     Platform URL (default: $ONCEWORLDS_API, else the ones above)
-  --token <t>     Deploy token (default: $ONCEWORLDS_TOKEN, GitHub Actions OIDC, or "dev" on localhost)
+  --token <t>     Local platform's deploy token (default: "dev")
+
+Deploys to onceworlds.com run from GitHub Actions: the repo's Onceworlds
+workflow runs this on every push, and GitHub vouches for the repo.
 
 The project directory needs an onceworlds.json:
-  { "slug": "star-party", "name": "Star Party", "dir": "." }
+  { "slug": "my-game", "name": "My Game", "dir": "." }
 `;
 var CliError = class extends Error {
 };
 var QUIET_SKIPS = /* @__PURE__ */ new Set(["node_modules", "onceworlds.json", "package.json", "package-lock.json", "tsconfig.json", "jsconfig.json", "LICENSE"]);
-var QUIET_EXTENSIONS = /* @__PURE__ */ new Set(["md", "ts", "tsx", "jsx", "lock", "log", "yml", "yaml", "sh"]);
+var QUIET_EXTENSIONS = /* @__PURE__ */ new Set(["md", "ts", "tsx", "jsx", "lock", "lockb", "log", "yml", "yaml", "sh"]);
 async function main() {
   const { values, positionals } = parseArgs({
     allowPositionals: true,
@@ -251,7 +299,11 @@ ${USAGE}`);
 async function deploy(projectDir, api, tokenArg, quiet = false) {
   const config = await loadConfig(projectDir);
   const root = resolve(projectDir, config.dir ?? ".");
-  const files = await collectFiles(root, quiet);
+  const { files, skipped } = await collectFiles(root);
+  if (skipped.length > 0) {
+    console.warn(`  ! ${skipped.length} unsupported file${skipped.length === 1 ? "" : "s"} not deployed:`);
+    for (const path of skipped) console.warn(`    ${path}`);
+  }
   if (!files.some((f) => f.path === "index.html")) {
     throw new CliError(`No index.html in ${root}. Set "dir" in onceworlds.json to the folder that contains it.`);
   }
@@ -265,7 +317,7 @@ async function deploy(projectDir, api, tokenArg, quiet = false) {
       slug: config.slug,
       name: config.name,
       description: config.description ?? "",
-      productionBranch: config.productionBranch ?? "main",
+      productionBranch: config.productionBranch ?? DEFAULT_PRODUCTION_BRANCH,
       store
     },
     files: files.map(({ path, hash, size }) => ({ path, hash, size })),
@@ -282,8 +334,9 @@ async function deploy(projectDir, api, tokenArg, quiet = false) {
   });
   const result = await send("POST", `${api}/api/deploy/${start.deploymentId}/finalize`, start.uploadToken, {});
   if (!quiet) {
+    const branch = result.productionBranch ?? start.productionBranch;
     if (result.production) console.log(`\u2713 Live: ${result.playUrl}`);
-    else console.log(`\u2713 Preview (this branch isn't ${config.productionBranch ?? "main"}): ${result.previewUrl}`);
+    else console.log(`\u2713 Preview${branch ? ` (only ${branch} goes live)` : ""}: ${result.previewUrl}`);
     for (const note of result.notes ?? []) console.log(`  ${note}`);
   }
   return result;
@@ -296,7 +349,7 @@ async function dev(projectDir, api, tokenArg) {
   Play (reloads on every change): ${first.playUrl}?watch
   Watching ${root}. Press Ctrl+C to stop.
 `);
-  const projectSignature = async () => signature(await collectFiles(root, true)) + await readFile(join(projectDir, "onceworlds.json"), "utf8").catch(() => "");
+  const projectSignature = async () => signature((await collectFiles(root)).files) + await readFile(join(projectDir, "onceworlds.json"), "utf8").catch(() => "");
   let lastSignature = await projectSignature();
   let timer;
   let running = false;
@@ -409,7 +462,7 @@ async function loadStore(projectDir, config) {
   }
   return { store: { genre, icon, thumbnails, badges }, images: [...images.values()] };
 }
-async function collectFiles(root, quiet) {
+async function collectFiles(root) {
   const files = [];
   const skipped = [];
   async function walk(dir, prefix) {
@@ -439,9 +492,8 @@ async function collectFiles(root, quiet) {
     }
   }
   await walk(root, "");
-  if (skipped.length > 0 && !quiet) console.warn(`  ! skipped unsupported files: ${skipped.join(", ")}`);
   if (files.length > LIMITS.deployFiles) throw new CliError(`Too many files (${files.length}); the limit is ${LIMITS.deployFiles}.`);
-  return files;
+  return { files, skipped };
 }
 function signature(files) {
   return files.map((f) => `${f.path}:${f.hash}`).join("\n");
@@ -458,7 +510,6 @@ function gitInfo(cwd) {
 }
 async function getToken(api, tokenArg) {
   if (tokenArg) return tokenArg;
-  if (process.env.ONCEWORLDS_TOKEN) return process.env.ONCEWORLDS_TOKEN;
   const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
   const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
   if (requestUrl && requestToken) {
@@ -471,7 +522,7 @@ async function getToken(api, tokenArg) {
   const host = new URL(api).hostname;
   if (host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost")) return "dev";
   throw new CliError(
-    "No deploy credentials. In GitHub Actions, add `permissions: id-token: write` to the workflow. Elsewhere, set ONCEWORLDS_TOKEN."
+    "Deploys to Onceworlds run from GitHub Actions: push to GitHub and the repo's Onceworlds workflow deploys (it needs `permissions: id-token: write`)."
   );
 }
 async function send(method, url, token, body) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onceworlds/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Deploy games to Onceworlds.",
   "homepage": "https://onceworlds.com",
   "type": "module",