@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/server/bundle.mjs

@@ -8,18 +8,30 @@
 //     importScripts (a Worker refuses them anyway; here the person reads where);
 //   - no secrets: the publish scan (../publish/scan.mjs) over each server file and over the bundle;
 //   - a default export (the Worker), and each room class gamesfun.json declares exported by that name;
-//   - the size: games.fun's cap (5 MB, the wasm included), with a word above 1 MB;
+//   - the size: xgames.fun's cap (5 MB, the wasm included), with a word above 1 MB;
 //   - a compiled WebAssembly file (`import wasm from '../vendor/x.wasm'`: a physics engine, a codec) is not bundled into
 //     the JS: it goes up as its own module (a Worker compiles no wasm from bytes at run time, only a module shipped with
 //     it), named by its file name (unique), and the bundle imports it as `./<name>.wasm` (contract §3: up to 16 modules).
-// The esbuild options are the contract's (§3), minified as publish sends it: the same input gives games.fun's bytes.
+// The esbuild options are the contract's (§3), minified as publish sends it: the same input gives xgames.fun's bytes.
 // esbuild is this package's own dependency (package.json); without it the answer says why.
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { scanFile } from '../publish/scan.mjs';
 import { createRequire } from 'node:module';
-import { LIMITS, NODE_REFUSED, readServerConfig, BUNDLE_NAME } from './contract.mjs';
+import { fileURLToPath } from 'node:url';
+import { CMD } from '../command.mjs';
+import { codeOnly, dataCallLine, ownerlessDataCalls } from './data-calls.mjs';
+import {
+  CONFIG_FILE,
+  LIMITS,
+  NODE_REFUSED,
+  OLD_DEFAULT_RULES,
+  OWNER_SPACES,
+  readServerConfig,
+  BUNDLE_NAME,
+  usesFiles,
+} from './contract.mjs';
 
 const NODE_BUILTINS = new Set([
   'assert',
@@ -79,14 +91,6 @@ export const FORBIDDEN = [
 
 const sha256 = b => createHash('sha256').update(b).digest('hex');
 const lineAt = (text, i) => text.slice(0, i).split('\n').length;
-/** Comments and strings blanked (same length), so a word in them is not code. */
-function codeOnly(src) {
-  // a string keeps its quotes (so `import('./x.js')` still reads as a literal path), its text becomes spaces
-  return src.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|'(?:\\.|[^'\\\n])*'|"(?:\\.|[^"\\\n])*"/g, m =>
-    m[0] === '/' ? m.replace(/[^\n]/g, ' ') : m[0] + ' '.repeat(m.length - 2) + m[0],
-  );
-}
-
 let esbuildOnce = null;
 /** esbuild, this package's dependency. Throws with words (code NO_ESBUILD) when it cannot be had. */
 export async function loadEsbuild() {
@@ -103,7 +107,7 @@ export async function loadEsbuild() {
   }
 }
 
-/** esbuild's options for a game's server: the contract's (§3, as games.fun bundles it), so a bundle is the same bytes. */
+/** esbuild's options for a game's server: the contract's (§3, as xgames.fun bundles it), so a bundle is the same bytes. */
 export function buildOptions(entry, { minify = true, nodeCompat = false } = {}) {
   return {
     entryPoints: [entry],
@@ -135,9 +139,11 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   const out = {
     has: true,
     ok: false,
+    stock: cfg.stock,
     entry: cfg.entry,
     objects: cfg.objects,
     compatibilityFlags: cfg.compatibilityFlags,
+    database: cfg.database,
     code: null,
     sha256: null,
     bytes: 0,
@@ -146,10 +152,11 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
     sources: [],
     problems: [...cfg.problems],
     hits: [],
-    warnings: [],
+    warnings: [...cfg.warnings],
   };
   if (out.problems.length) return out;
   const { build } = await loadEsbuild();
+  if (cfg.stock) return bundleStock(build, out, { minify });
   const refusedImports = [];
   // compiled wasm: its own module, never inlined (the runtime can't compile wasm from bytes)
   const wasmFiles = new Map(); // name → absolute path
@@ -229,6 +236,10 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   }
   if (out.inputs.length > limits.sourceFiles)
     out.problems.push(`server/ is made of ${out.inputs.length} files; at most ${limits.sourceFiles}`);
+  // who answers api/db/ (the page's gf.db): server/gf-docs.js's handleDocs, the older database's handleDatabase, or a
+  // route of the person's own; the files that define those are not routes themselves
+  let routesDocs = false,
+    usesDocs = false;
   for (const rel of out.inputs) {
     let bytes;
     try {
@@ -239,6 +250,16 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
     if (rel.startsWith('server/')) out.sources.push({ path: rel, sha256: sha256(bytes), bytes: bytes.length });
     if (/\.(m?js|cjs|ts|mts|jsx|tsx)$/.test(rel)) {
       const src = codeOnly(bytes.toString('utf8'));
+      // env.GF.files: the game's project files, which xgames.fun must run (server.features "files")
+      if (rel.startsWith('server/') && usesFiles(src)) out.usesFiles = true;
+      if (rel.startsWith('server/') && rel !== 'server/gf-docs.js' && rel !== 'server/database.js') {
+        if (/\bhandleDocs\s*\(/.test(src)) usesDocs = routesDocs = true;
+        else if (
+          /\b(?:handleDatabase|routeDatabase)\s*\(/.test(src) ||
+          /api\/db\b/.test(bytes.toString('utf8').replace(/\/\*[\s\S]*?\*\/|(?<![:'"`])\/\/[^\n]*/g, ''))
+        )
+          routesDocs = true;
+      }
       for (const [what, re] of FORBIDDEN) {
         const m = re.exec(src);
         if (m)
@@ -314,6 +335,85 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
     out.warnings.push(
       `The server bundle is ${(out.bytes / 1048576).toFixed(1)} MB: it works, but a smaller server starts faster`,
     );
+  // gamesfun.json → database.collections: the page's documents, which a server of its own must answer at api/db/
+  if (cfg.database?.has && cfg.database.collections) {
+    if (!routesDocs) {
+      out.docsUnrouted = true;
+      out.warnings.push(
+        `${CONFIG_FILE} → database.collections says who may read and write the page's documents (gf.db, at api/db/), and this game's own server does not route api/db/: every gf.db call answers 404, and publish refuses the game. ${CMD} add database writes server/gf-docs.js; route it first thing in fetch: const db = await handleDocs(request, env); if (db) return db; (import { handleDocs } from './gf-docs.js')`,
+      );
+    } else if (!usesDocs)
+      out.warnings.push(
+        `${CONFIG_FILE} → database.collections is read by server/gf-docs.js (handleDocs), which this server does not route: its own api/db/ route decides who may read and write`,
+      );
+  }
+  // the database a Durable Object holds (xcore add database before D1): it still works, and the new way is D1
+  if (out.inputs.includes('server/database.js') && cfg.objects.some(o => o.class === 'GameData')) {
+    const text = await readFile(path.join(root, 'server', 'database.js'), 'utf8').catch(() => '');
+    // its RULES as xcore 0.1.0 wrote them, never changed: open to anyone, which is not "working"
+    // 0.1.0's code over the database as it is now: a dataOf(env) call with no owner means the server's own space
+    if (text.includes(OWNER_SPACES)) {
+      const calls = await ownerlessDataCalls(root, out.inputs);
+      if (calls.length)
+        out.warnings.push(
+          `${calls.length === 1 ? 'A call' : `${calls.length} calls`} to dataOf(env) with no owner: since xcore 0.2.0 that is the server's own space, not the document a player wrote (in 0.1.0 a document was found by its id alone). Say whose space each means:\n${calls
+            .slice(0, 20)
+            .map(c => `  ${dataCallLine(c)}`)
+            .join('\n')}${calls.length > 20 ? `\n  and ${calls.length - 20} more` : ''}`,
+        );
+    }
+    if (text.includes(OLD_DEFAULT_RULES))
+      out.warnings.push(
+        `server/database.js still has the RULES xcore 0.1.0 wrote ('*': { read: 'anyone' }): every document in every collection is open to anyone, signed in or not, including what players keep for themselves. ${CMD} add database makes each player's documents their own (read: 'owner'); name a collection that is meant to be public in RULES (levels: { read: 'anyone', write: 'owner' })`,
+      );
+    else
+      out.warnings.push(
+        `server/database.js is the older database (a Durable Object, GameData). It keeps working; a new game's database is its own D1 (gamesfun.json → database: ${CMD} add database in a game without it, docs/SERVER.md "A database of its own")`,
+      );
+  }
+  out.ok = !out.problems.length && !out.hits.length;
+  return out;
+}
+
+const STOCK = fileURLToPath(new URL('../client/server/stock.js', import.meta.url));
+
+/**
+ * The stock server (../client/server/stock.js) as the game's bundle: a game with a database and no server/ of its
+ * own. Its settings (the binding's name and the collections' rules) go in as generated data, the module gf:stock.
+ * Nothing of the game folder is read. → bundleServer's answer
+ */
+async function bundleStock(build, out, { minify }) {
+  const settings = { binding: out.database.binding, rules: out.database.collections };
+  const generated = {
+    name: 'gf-stock',
+    setup(b) {
+      b.onResolve({ filter: /^gf:stock$/ }, () => ({ path: 'gf:stock', namespace: 'gf-stock' }));
+      b.onLoad({ filter: /.*/, namespace: 'gf-stock' }, () => ({
+        contents: `export default ${JSON.stringify(settings)};`,
+        loader: 'js',
+      }));
+    },
+  };
+  let result;
+  try {
+    result = await build({
+      ...buildOptions(STOCK, { minify }),
+      absWorkingDir: path.dirname(STOCK),
+      plugins: [generated],
+    });
+  } catch (e) {
+    for (const m of e.errors ?? [{ text: e.message }]) out.problems.push(`the stock server does not build: ${m.text}`);
+    return out;
+  }
+  const file = result.outputFiles[0];
+  out.code = file.contents;
+  out.bytes = file.contents.byteLength;
+  out.sha256 = sha256(file.contents);
+  out.wasm = [];
+  const meta =
+    Object.values(result.metafile.outputs).find(o => o.entryPoint) ?? Object.values(result.metafile.outputs)[0];
+  out.exports = meta?.exports ?? [];
+  out.hits.push(...scanFile(`server bundle (${BUNDLE_NAME})`, file.contents));
   out.ok = !out.problems.length && !out.hits.length;
   return out;
 }