@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/publish/scan.mjs

@@ -1,4 +1,4 @@
-// What a published game may carry. The kit checks these rules before a publish, for a fast answer; games.fun runs the
+// What a published game may carry. The kit checks these rules before a publish, for a fast answer; xgames.fun runs the
 // same rules again on its side for every publish, whatever the kit already checked.
 //
 // 1. Secrets. A published game's files are public: anyone can download them. A file that
@@ -12,69 +12,15 @@
 //    The play host adds exactly those to that game's content-security policy (connect-src; the https ones also
 //    img-src and media-src) and nothing else; every other third-party request stays refused.
 import { CMD } from '../command.mjs';
+import { MAX_MATCH, SECRET_PATTERNS as ALL_PATTERNS } from '../secret-patterns.mjs';
 
-/** Key-shaped strings (the kit's general scanner, lib/secret-patterns.mjs, plus Supabase's). */
-export const SECRET_PATTERNS = [
-  ['private key block', /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/g],
-  // not inside a word or a class name (style-sk-aria-pressed): a key stands on its own
-  [
-    'OpenAI or Anthropic key',
-    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,}|[A-Za-z0-9]{32,})/g,
-  ],
-  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,}/g],
-  ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
-  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,})/g],
-  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,}/g],
-  ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
-  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g],
-  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,}/g],
-  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,}/g],
-  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]+:[^\s@/'"]+@/gi],
-  ['games.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,}/g],
-  // providers whose keys have a shape of their own (each prefix, length and alphabet as the provider issues them)
-  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,}\b/g],
-  ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/g],
-  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,}/g],
-  ['SendGrid key', /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g],
-  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,}/g],
-  ['Shopify token', /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/g],
-  ['Google OAuth client secret', /\bGOCSPX-[A-Za-z0-9_-]{28}\b/g],
-  ['DigitalOcean token', /\bdo[opr]_v1_[a-f0-9]{64}\b/g],
-  ['Telegram bot token', /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/g],
-  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key
-  [
-    'an RPC URL with its key (helius, alchemy, quicknode, infura)',
-    /https?:\/\/[^\s"'`]*(?:helius-rpc\.com[^\s"'`]*[?&]api-key=[A-Za-z0-9-]{16,}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,}|\.quiknode\.pro\/[A-Za-z0-9]{20,}|\.infura\.io\/v3\/[a-f0-9]{32})/g,
-  ],
-  [
-    'a Solana keypair in code (fromSecretKey)',
-    /\bfromSecretKey\s*\(\s*(?:(?:new\s+Uint8Array|Uint8Array\.from|bs58\.decode)\s*\(\s*)?[["'`]/g,
-  ],
-  [
-    'secret assigned a literal',
-    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText')
-    /(?<!\?\s*["']?)\b[A-Za-z0-9_]*(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]*["']?\s*[:=]\s*["']([A-Za-z0-9+/_=.-]{16,})["']/gi,
-  ],
-  // never touching + / = : those break up base64 data (an inlined picture), where a run of base58 letters is chance
-  // a signing key's 32-byte seed in hex, by its name (VOUCHER_SEED=…, voucherSeed: '…'): xcore add vouchers' format
-  [
-    'signing key seed (hex)',
-    /\b[A-Za-z0-9_]*(?:VOUCHER|WALLET|SIGNER|SIGNING|KEY)_?SEED[A-Za-z0-9_]*["']?\s*[:=]\s*["'`]?[0-9a-fA-F]{64}(?![0-9a-fA-F])/gi,
-  ],
-  // a key file as a script writes one: {"pub": "<address>", "seed": "<64 hex>"} (either order)
-  [
-    'key file (pub and seed)',
-    /["']seed["']\s*:\s*["'][0-9a-fA-F]{64}["'][\s\S]{0,200}?["']pub(?:lic)?(?:Key)?["']\s*:|["']pub(?:lic)?(?:Key)?["']\s*:\s*["'][1-9A-HJ-NP-Za-km-z]{32,44}["'][\s\S]{0,200}?["']seed["']\s*:\s*["'][0-9a-fA-F]{64}["']/g,
-  ],
-  // a 64-byte secret key written into code by its name (const SECRET_KEY = [12, 200, …] or new Uint8Array([…]))
-  [
-    'secret key bytes in code',
-    /\b[A-Za-z0-9_]*(?:SECRET|PRIVATE|KEYPAIR|SEED)[A-Za-z0-9_]*["']?\s*[:=]\s*(?:new\s+Uint8Array\(\s*)?\[\s*(?:\d{1,3}\s*,\s*){31,63}\d{1,3}\s*\]/gi,
-  ],
-  ['Solana secret key (base58)', /(?<![A-Za-z0-9+/])[1-9A-HJ-NP-Za-km-z]{86,90}(?![A-Za-z0-9+/=])/g],
-];
-const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{16,}/g;
-
+const global = re => new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+/** Key-shaped strings (../secret-patterns.mjs, the one list), each to run over a whole text. A JWT is read below. */
+export const SECRET_PATTERNS = ALL_PATTERNS.filter(([kind]) => kind !== 'JSON web token').map(([kind, re]) => [
+  kind,
+  global(re),
+]);
+const JWT = global(ALL_PATTERNS.find(([kind]) => kind === 'JSON web token')[1]);
 /** Files refused by name, wherever they are in the folder. */
 export const REFUSED_FILES = [
   [/(^|\/)\.env(\.[^/]*)?$/i, 'a .env file (secrets live there, never in a game)'],
@@ -93,7 +39,13 @@ export const isBinaryPath = path => BINARY_EXT.test(path);
 /** Whether the scanner reads a file: known text extensions, or no NUL byte in the first 8 KB and not a known binary. */
 export const looksText = (path, bytes) =>
   TEXT_EXT.test(path) || (!BINARY_EXT.test(path) && !bytes.subarray(0, 8192).includes(0));
-/** The scanner reads text files up to this size; bigger text (a bundled engine) is still scanned, in its first part. */
+/** The secret scan reads a text file whole, this many bytes at a time (a bundled engine is many pieces). */
+export const SCAN_CHUNK = 4 * 1024 * 1024;
+/** How far each piece reaches into the next: more than the longest key a pattern can match. */
+export const SCAN_OVERLAP = Math.max(64 * 1024, MAX_MATCH);
+/** The text before a match that a pattern's look-behind and the checks read (a Firebase config is 400 characters). */
+const SCAN_CONTEXT = 1024;
+/** The reference-name check (./names.mjs) reads the first this many bytes of a text file. */
 export const SCAN_BYTES = 4 * 1024 * 1024;
 
 function base64urlJson(part) {
@@ -137,9 +89,11 @@ export const isSignature = (text, at) => SIGNATURE_KEY.test(text.slice(Math.max(
 
 /**
  * Every secret-shaped thing in one file: [{path, line, kind}]. Never returns the value. `bytes` is a Uint8Array.
- * Binary files are not read (a key inside a PNG is not a thing anyone ships by accident).
+ * Binary files are not read (a key inside a PNG is not a thing anyone ships by accident). A text file is read whole,
+ * however big, a piece at a time: each piece goes on SCAN_OVERLAP characters past where the next one starts, more than
+ * any pattern can match (MAX_MATCH), so a key across the line between two pieces is found as well.
  */
-export function scanFile(path, bytes) {
+export function scanFile(path, bytes, { chunk = SCAN_CHUNK, overlap = SCAN_OVERLAP } = {}) {
   const hits = [];
   for (const [re, why] of REFUSED_FILES)
     if (re.test(path)) {
@@ -147,44 +101,66 @@ export function scanFile(path, bytes) {
       break;
     }
   if (!looksText(path, bytes)) return hits;
-  const text = new TextDecoder().decode(bytes.subarray(0, SCAN_BYTES));
-  for (const [kind, re] of SECRET_PATTERNS) {
-    re.lastIndex = 0;
-    for (let m; (m = re.exec(text));) {
-      if (kind === 'secret assigned a literal' && isPublicKey(m[1])) continue;
-      if (kind === 'Google API key' && isFirebaseWebKey(text, m.index)) continue;
-      if (
-        kind === 'secret assigned a literal' &&
-        /^AIza/.test(m[1]) &&
-        isFirebaseWebKey(text, m.index + m[0].lastIndexOf(m[1]))
-      )
-        continue;
-      // a real key is random: a run of one letter (a tile map row) is not one; and a transaction's signature is the
-      // same length (an economy's xsolana.json records the ones that put it live, and a server that imports it carries them)
-      if (kind === 'Solana secret key (base58)' && (new Set(m[0]).size < 20 || isSignature(text, m.index))) continue;
-      hits.push({ path, line: lineAt(text, m.index), kind });
-      break; // one hit per kind per file is enough to refuse it
-    }
-  }
-  JWT.lastIndex = 0;
-  for (let m; (m = JWT.exec(text));) {
-    const role = jwtRole(m[0]);
-    if (role === 'anon') continue;
-    hits.push({
-      path,
-      line: lineAt(text, m.index),
-      kind:
-        role === 'service_role'
-          ? 'Supabase service-role key (it bypasses row-level security: never in a game)'
-          : role
-            ? `a signed token with role "${role}"`
-            : 'a signed token (JWT)',
+  const found = new Map(); // a pattern's place in the list → its first hit: one hit per kind per file refuses it
+  const decoder = new TextDecoder();
+  let carry = '', // the end of the last piece: the overlap, and the text just before it that a check reads
+    from = 0, // where the matches this piece owns start in it (earlier ones were the last piece's)
+    lines = 0; // the lines before this piece
+  for (let at = 0; at < bytes.length || at === 0; at += chunk) {
+    const last = at + chunk >= bytes.length;
+    const text = carry + decoder.decode(bytes.subarray(at, at + chunk), { stream: !last });
+    // a match starting in [from, to) is this piece's; one starting later is the next piece's, which sees all of it
+    const to = last ? text.length : Math.max(from, text.length - overlap);
+    const lineOf = i => lines + lineAt(text, i);
+    SECRET_PATTERNS.forEach(([kind, re], n) => {
+      if (found.has(n)) return;
+      re.lastIndex = from;
+      for (let m; (m = re.exec(text)) && m.index < to;) {
+        if (kind === 'secret assigned a literal' && isPublicKey(m[1])) continue;
+        if (kind === 'Google API key' && isFirebaseWebKey(text, m.index)) continue;
+        if (
+          kind === 'secret assigned a literal' &&
+          /^AIza/.test(m[1]) &&
+          isFirebaseWebKey(text, m.index + m[0].lastIndexOf(m[1]))
+        )
+          continue;
+        // a real key is random: a run of one letter (a tile map row) is not one; and a transaction's signature is the
+        // same length (an economy's xsolana.json records the ones that put it live, and a server that imports it carries them)
+        if (kind === 'Solana secret key (base58)' && (new Set(m[0]).size < 20 || isSignature(text, m.index))) continue;
+        found.set(n, { path, line: lineOf(m.index), kind });
+        break;
+      }
     });
-    break;
+    if (!found.has(SECRET_PATTERNS.length)) {
+      JWT.lastIndex = from;
+      for (let m; (m = JWT.exec(text)) && m.index < to;) {
+        const role = jwtRole(m[0]);
+        if (role === 'anon') continue;
+        found.set(SECRET_PATTERNS.length, {
+          path,
+          line: lineOf(m.index),
+          kind:
+            role === 'service_role'
+              ? 'Supabase service-role key (it bypasses row-level security: never in a game)'
+              : role
+                ? `a signed token with role "${role}"`
+                : 'a signed token (JWT)',
+        });
+        break;
+      }
+    }
+    if (last) break;
+    // the next piece starts with the overlap, and the text before it that a check looks back over
+    const keep = Math.max(0, to - SCAN_CONTEXT);
+    lines += text.slice(0, keep).split('\n').length - 1;
+    carry = text.slice(keep);
+    from = to - keep;
   }
-  if (/\.json$/i.test(path)) {
+  hits.push(...[...found].sort(([a], [b]) => a - b).map(([, h]) => h));
+  // a wallet keypair file is a small JSON array: read whole when it is small enough to be one
+  if (/\.json$/i.test(path) && bytes.length <= 64 * 1024) {
     try {
-      const v = JSON.parse(text);
+      const v = JSON.parse(new TextDecoder().decode(bytes));
       if (Array.isArray(v) && v.length === 64 && v.every(n => Number.isInteger(n) && n >= 0 && n < 256))
         hits.push({ path, line: 1, kind: 'a wallet keypair (64-byte array)' });
     } catch {
@@ -249,7 +225,7 @@ export function backendOrigin(value, { own = [] } = {}) {
       }
     })
   )
-    throw bad('is games.fun itself; the game reaches its own host without listing it');
+    throw bad('is xgames.fun itself; the game reaches its own host without listing it');
   return url.origin;
 }
 

package/lib/publish/secrets.mjs

@@ -1,23 +1,22 @@
-// `xcore secret`'s calls to games.fun (the rules: ../server/secrets.mjs; games.fun's hosting contract, gf-server-v1):
+// `xcore secret`'s calls to xgames.fun (the rules: ../server/secrets.mjs; xgames.fun's hosting contract, gf-server-v1):
 //   GET    /api/kit/games/<gameId>/secrets            → {ok, game, names}
 //   PUT    /api/kit/games/<gameId>/secrets/<NAME>     {"value"} → {ok, game, name, names}
 //   DELETE /api/kit/games/<gameId>/secrets/<NAME>     → {ok, game, name, removed, names}
 // The game is the folder's own (its .gamesfun/publish.json for this Studio); the credential is publish's.
 import { readLinks } from './index.mjs';
 import { call, studioOrigin } from './client.mjs';
-import { publishCredential } from './oidc.mjs';
+import { requireCredential } from './oidc.mjs';
 import { secretNameProblem, secretValueProblem } from '../server/secrets.mjs';
 import { CMD } from '../command.mjs';
 
-/** The game's id on games.fun (from its publish record) and how to sign the call. Throws in plain words.  (from its publish record) and how to sign the call. Throws in plain words. */
+/** The game's id on xgames.fun (from its publish record) and how to sign the call. Throws in plain words.  (from its publish record) and how to sign the call. Throws in plain words. */
 async function target(dir, { origin, env, fetchImpl }) {
   const known = (await readLinks(dir))[origin];
   if (!known?.projectId)
     throw new Error(
       `this folder's game is not on ${origin} yet: publish it with its server/ first (${CMD} publish), then set its secrets`,
     );
-  const cred = await publishCredential(origin, { env, fetchImpl });
-  if (!cred) throw new Error(`not signed in to ${origin}: run ${CMD} login first`);
+  const cred = await requireCredential(origin, { env, fetchImpl });
   return { id: known.projectId, auth: await cred.auth() };
 }
 const route = (id, name) =>

package/lib/publish/site.mjs

@@ -1,5 +1,5 @@
-// `xcore embed` and `xcore domain`'s calls to games.fun: where a published game may be framed (sites of the creator's
-// own that embed it) and the domains it is served on besides <slug>-play.xgames.fun. games.fun's routes:
+// `xcore embed` and `xcore domain`'s calls to xgames.fun: where a published game may be framed (sites of the creator's
+// own that embed it) and the domains it is served on besides <slug>-play.xgames.fun. xgames.fun's routes:
 //   GET    /api/kit/games/<gameId>/site                                 → the site
 //   PUT    /api/kit/games/<gameId>/site            {"embed": [origin…]} → the site (the whole list, replaced)
 //   POST   /api/kit/games/<gameId>/site/domains    {"hostname"}         → the site (one added, pending its DNS records)
@@ -7,27 +7,26 @@
 //   DELETE /api/kit/games/<gameId>/site/domains?hostname=<hostname>     → the site
 // The site: {ok, game, slug, tier, limits: {embed, domains}, embed: [origin], domains: [{hostname, status, records,
 // error?, url, checkedAt?, activeAt?}], domainsOn, why?}. Refusals carry a code: 'plan' (over the plan's limit),
-// 'taken' (a domain another game has), 'domains-off' (games.fun has not set custom domains up).
+// 'taken' (a domain another game has), 'domains-off' (xgames.fun has not set custom domains up).
 // The game is the folder's own (its .gamesfun/publish.json for this Studio); the credential is publish's.
 import { readLinks } from './index.mjs';
 import { call, studioOrigin } from './client.mjs';
-import { publishCredential } from './oidc.mjs';
+import { requireCredential } from './oidc.mjs';
 import { CMD } from '../command.mjs';
 
 async function target(dir, { origin, env, fetchImpl }) {
   const known = (await readLinks(dir))[origin];
   if (!known?.projectId)
     throw new Error(`this folder's game is not on ${origin} yet: publish it first (${CMD} publish)`);
-  const cred = await publishCredential(origin, { env, fetchImpl });
-  if (!cred) throw new Error(`not signed in to ${origin}: run ${CMD} login first`);
+  const cred = await requireCredential(origin, { env, fetchImpl });
   return { id: known.projectId, auth: await cred.auth() };
 }
 const route = (id, rest = '') => `/api/kit/games/${encodeURIComponent(id)}/site${rest}`;
-/** A games.fun older than these routes answers 404 with no words of its own: said plainly. */
+/** A xgames.fun older than these routes answers 404 with no words of its own: said plainly. */
 function older(e) {
   if (e?.status === 404 && e.answered === false)
     throw Object.assign(
-      new Error(`this games.fun does not offer embedding and custom domains yet (it needs a newer games.fun).`),
+      new Error(`this xgames.fun does not offer embedding and custom domains yet (it needs a newer xgames.fun).`),
       { status: 404 },
     );
   throw e;
@@ -73,7 +72,7 @@ export function domainName(value) {
   )
     return { problem: `${value} is not a domain name (like play.mygame.com)` };
   if (raw === 'xgames.fun' || raw.endsWith('.xgames.fun'))
-    return { problem: `${value} is games.fun's own: every game has its xgames.fun link already` };
+    return { problem: `${value} is xgames.fun's own: every game has its xgames.fun link already` };
   return { hostname: raw };
 }
 
@@ -182,7 +181,7 @@ export function describeSite(site, origin = studioOrigin()) {
       ? `Embedded on: ${site.embed.join(', ')} (${site.embed.length} of ${lim.embed ?? '?'} on ${tier})`
       : `Embedded on: no sites yet (${tier} allows ${lim.embed ?? '?'}: ${CMD} embed add https://mygame.com)`,
   );
-  if (site.domainsOn === false) lines.push(`Custom domains: ${site.why ?? 'not set up on this games.fun yet'}`);
+  if (site.domainsOn === false) lines.push(`Custom domains: ${site.why ?? 'not set up on this xgames.fun yet'}`);
   else if (!site.domains?.length)
     lines.push(
       lim.domains

package/lib/publish/tree.mjs

@@ -1,5 +1,5 @@
-// The files `xcore publish` sends: a game folder as games.fun's file tree (gf-tree-v1: path, sha256, bytes for
-// every file; the bytes go up separately, only those games.fun does not have yet).
+// The files `xcore publish` sends: a game folder as xgames.fun's file tree (gf-tree-v1: path, sha256, bytes for
+// every file; the bytes go up separately, only those xgames.fun does not have yet).
 //
 // Left out, never uploaded:  evidence/ (verify's screenshots and verdicts), supabase/ (a backend's server-side SQL:
 //                            not secret, but not the game; `xcore backend`), server/ (the game's own server code:
@@ -10,7 +10,7 @@
 //                            (README.md, NOTES.md, LAUNCH.md, FRICTION.md, CLAUDE.md, AGENTS.md, TODO.md: how the
 //                            game and its server work is no player's business).
 // Refused (nothing is sent): a .env file anywhere in the folder, and symbolic links (a tree holds ordinary files).
-// Added, in the upload only: foundation.lock.json and adaptation-plan.json when the game has none (games.fun keeps
+// Added, in the upload only: foundation.lock.json and adaptation-plan.json when the game has none (xgames.fun keeps
 // them with every version; a game made in the kit does not need them on disk). They are made from gf-three.json and
 // spec.json, and the lock is the same for every kit publish, so each update of a game keeps it.
 // Copied, in the upload only: spec.json without the names of the games it was made to look or play like
@@ -30,9 +30,9 @@ export const LEFT_OUT_FILES = ['gamesfun.json'];
 /** The notes a game folder keeps for the people and agents making it, at its top: never the game. */
 export const MAKERS_NOTES = /^(README|NOTES|LAUNCH|FRICTION|CLAUDE|AGENTS|TODO)\.md$/i;
 export const TREE_FORMAT = 'gf-tree-v1';
-// Every publish sends this lock, a brought game's too. games.fun refuses a revision whose lock differs from the game's
+// Every publish sends this lock, a brought game's too. xgames.fun refuses a revision whose lock differs from the game's
 // ("A revision must preserve its foundation lock"), so changing it here would refuse the next update of every game
-// already published (tried live, 2026-10-31). A truer lock for brought games needs games.fun to accept the change.
+// already published (tried live, 2026-10-31). A truer lock for brought games needs xgames.fun to accept the change.
 export const KIT_LOCK = Object.freeze({
   schemaVersion: 1,
   id: 'gf-three',
@@ -41,7 +41,7 @@ export const KIT_LOCK = Object.freeze({
 });
 
 export const sha256 = data => createHash('sha256').update(data).digest('hex');
-/** Canonical JSON (sorted keys), as games.fun hashes trees. */
+/** Canonical JSON (sorted keys), as xgames.fun hashes trees. */
 export function canonical(value) {
   if (value === null || typeof value !== 'object') return JSON.stringify(value);
   if (Array.isArray(value)) return '[' + value.map(canonical).join(',') + ']';
@@ -70,7 +70,7 @@ export async function referenceNamesOf(dir) {
   return referenceNames({ spec, ledger: state?.ledger ?? null });
 }
 
-/** The two files games.fun keeps with every version, made from the game's own records (`names` taken out). */
+/** The two files xgames.fun keeps with every version, made from the game's own records (`names` taken out). */
 export async function kitRecords(dir, { names = [] } = {}) {
   const raw = (await readJson(path.join(dir, 'spec.json'))) ?? {};
   const spec = names.length ? redactJson(raw, names) : raw;
@@ -87,7 +87,7 @@ export async function kitRecords(dir, { names = [] } = {}) {
     brief: String(
       spec.prompt ||
         spec.hook ||
-        (brought ? `${title}, a web game brought to the games.fun kit.` : `${title}, made with the games.fun kit.`),
+        (brought ? `${title}, a web game brought to the xgames.fun kit.` : `${title}, made with the xgames.fun kit.`),
     ).slice(0, 2000),
     requirements: [
       spec.hook,

package/lib/secret-patterns.mjs

@@ -1,39 +1,76 @@
-// Key-shaped strings: the general secret scanner, which the kit imports and extends with Supabase's own shapes.
-// ./publish/scan.mjs keeps its own superset for the publish scan. Pure: no imports.
+// Key-shaped strings: the one list of them. The publish scan (./publish/scan.mjs) reads every pattern here, and the
+// kit imports SECRET_PATTERNS for its own scanner. Pure: no imports.
+//
+// Every run in a pattern has an upper bound, so no match is longer than MAX_MATCH characters: the scan reads a big
+// file in pieces that overlap by more than that, and finds a key that straddles two pieces (tests/scan.test.mjs checks
+// each pattern's longest match against it). The bounds are far past any real key's length (a JWT with a large payload,
+// a long secret pasted into code), so bounding a pattern never lets one through that an unbounded one caught.
+
+/** The longest text any pattern here can match (the JWT's: 4,096 + 16,384 + 2,048 and its marks). */
+export const MAX_MATCH = 32 * 1024;
+
+/**
+ * [kind, pattern]. Each kind is the words a refusal names it by. The last, 'JSON web token', is any JWT: the publish
+ * scan reads a JWT's role instead (a Supabase anon key is public by design), and the kit replaces it the same way.
+ */
 export const SECRET_PATTERNS = [
-  ['private key block', /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/],
+  ['private key block', /-----BEGIN (?:[A-Z]{1,20} )?PRIVATE KEY-----/],
+  // not inside a word or a class name (style-sk-aria-pressed): a key stands on its own
   [
     'OpenAI or Anthropic key',
-    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,}|[A-Za-z0-9]{32,})/,
+    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,500}|[A-Za-z0-9]{32,500})/,
   ],
-  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,}/],
+  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,500}/],
   ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
-  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,})/],
-  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,}/],
+  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,500}|github_pat_[A-Za-z0-9_]{30,500})/],
+  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,500}/],
   ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
-  ['Stripe key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/],
-  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,}\b/],
+  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,500}/],
+  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,500}/],
+  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,500}/],
+  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]{1,200}:[^\s@/'"]{1,200}@/i],
+  ['xgames.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,500}/],
+  // providers whose keys have a shape of their own (each prefix, length and alphabet as the provider issues them)
+  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,500}\b/],
   ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
-  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,}/],
+  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,500}/],
   ['SendGrid key', /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/],
-  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,}/],
+  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,500}/],
   ['Shopify token', /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/],
   ['Google OAuth client secret', /\bGOCSPX-[A-Za-z0-9_-]{28}\b/],
   ['DigitalOcean token', /\bdo[opr]_v1_[a-f0-9]{64}\b/],
   ['Telegram bot token', /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/],
+  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key
   [
-    'an RPC URL with its key',
-    /https?:\/\/[^\s"'`]*(?:helius-rpc\.com[^\s"'`]*[?&]api-key=[A-Za-z0-9-]{16,}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,}|\.quiknode\.pro\/[A-Za-z0-9]{20,}|\.infura\.io\/v3\/[a-f0-9]{32})/,
+    'an RPC URL with its key (helius, alchemy, quicknode, infura)',
+    /https?:\/\/[^\s"'`]{0,1000}(?:helius-rpc\.com[^\s"'`]{0,300}[?&]api-key=[A-Za-z0-9-]{16,200}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,200}|\.quiknode\.pro\/[A-Za-z0-9]{20,200}|\.infura\.io\/v3\/[a-f0-9]{32})/,
   ],
   [
     'a Solana keypair in code (fromSecretKey)',
-    /\bfromSecretKey\s*\(\s*(?:(?:new\s+Uint8Array|Uint8Array\.from|bs58\.decode)\s*\(\s*)?[["'`]/,
+    /\bfromSecretKey\s{0,20}\(\s{0,20}(?:(?:new\s{1,20}Uint8Array|Uint8Array\.from|bs58\.decode)\s{0,20}\(\s{0,20})?[["'`]/,
   ],
-  ['JSON web token', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{16,}/],
   [
     'secret assigned a literal',
-    /(?<!\?\s*["']?)\b[A-Za-z0-9_]*(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]*["']?\s*[:=]\s*["'][A-Za-z0-9+/_=.-]{16,}["']/i,
+    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText'); the value is its first group
+    /(?<!\?\s*["']?)\b[A-Za-z0-9_]{0,100}(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]{0,100}["']?\s{0,20}[:=]\s{0,20}["']([A-Za-z0-9+/_=.-]{16,16384})["']/i,
+  ],
+  // a signing key's 32-byte seed in hex, by its name (VOUCHER_SEED=…, voucherSeed: '…'): xcore add vouchers' format
+  [
+    'signing key seed (hex)',
+    /\b[A-Za-z0-9_]{0,100}(?:VOUCHER|WALLET|SIGNER|SIGNING|KEY)_?SEED[A-Za-z0-9_]{0,100}["']?\s{0,20}[:=]\s{0,20}["'`]?[0-9a-fA-F]{64}(?![0-9a-fA-F])/i,
+  ],
+  // a key file as a script writes one: {"pub": "<address>", "seed": "<64 hex>"} (either order)
+  [
+    'key file (pub and seed)',
+    /["']seed["']\s{0,20}:\s{0,20}["'][0-9a-fA-F]{64}["'][\s\S]{0,200}?["']pub(?:lic)?(?:Key)?["']\s{0,20}:|["']pub(?:lic)?(?:Key)?["']\s{0,20}:\s{0,20}["'][1-9A-HJ-NP-Za-km-z]{32,44}["'][\s\S]{0,200}?["']seed["']\s{0,20}:\s{0,20}["'][0-9a-fA-F]{64}["']/,
+  ],
+  // a 64-byte secret key written into code by its name (const SECRET_KEY = [12, 200, …] or new Uint8Array([…]))
+  [
+    'secret key bytes in code',
+    /\b[A-Za-z0-9_]{0,100}(?:SECRET|PRIVATE|KEYPAIR|SEED)[A-Za-z0-9_]{0,100}["']?\s{0,20}[:=]\s{0,20}(?:new\s{1,20}Uint8Array\(\s{0,20})?\[\s{0,20}(?:\d{1,3}\s{0,20},\s{0,20}){31,63}\d{1,3}\s{0,20}\]/i,
   ],
   // never touching + / = : those break up base64 data (an inlined picture), where a run of base58 letters is chance
   ['Solana secret key (base58)', /(?<![A-Za-z0-9+/])[1-9A-HJ-NP-Za-km-z]{86,90}(?![A-Za-z0-9+/=])/],
+  // header, payload (16K: a token with many claims), signature (an RS512 one with a 8192-bit key is 1,366)
+  ['JSON web token', /\beyJ[A-Za-z0-9_-]{10,4096}\.eyJ[A-Za-z0-9_-]{10,16384}\.[A-Za-z0-9_-]{16,2048}/],
 ];

package/lib/secret-store.mjs

@@ -126,7 +126,7 @@ const macStore = sec => ({
     const r = run(
       sec,
       ['-i'],
-      `add-generic-password -U -s ${SERVICE} -a ${name} -l "games.fun kit ${name}" -w ${b64}\n`,
+      `add-generic-password -U -s ${SERVICE} -a ${name} -l "xgames.fun kit ${name}" -w ${b64}\n`,
     );
     if (r.status !== 0 || /error/i.test(r.stderr ?? ''))
       throw new Error(`the keychain refused the sign-in: ${(r.stderr || '').trim().slice(0, 200)}`);
@@ -145,7 +145,7 @@ const libsecretStore = tool => ({
     return r.status === 0 && r.stdout ? r.stdout : null;
   },
   set(name, value) {
-    const r = run(tool, ['store', `--label=games.fun kit ${name}`, 'service', SERVICE, 'account', name], value);
+    const r = run(tool, ['store', `--label=xgames.fun kit ${name}`, 'service', SERVICE, 'account', name], value);
     if (r.status !== 0) throw new Error(`the keyring refused the sign-in: ${(r.stderr || '').trim().slice(0, 200)}`);
   },
   delete(name) {