@xgamesfun/xcore 0.1.0 → 0.2.1

package/lib/server/data-calls.mjs

@@ -0,0 +1,136 @@
+// The server's own calls to the older database (server/database.js: dataOf(env)) that 0.2.0 reads differently from
+// 0.1.0. In 0.1.0 a document was found by its collection and id alone, whoever wrote it; now every player has a space
+// of their own and dataOf(env) without an owner is the server's: a get by id alone answers 404 for a player's
+// document, and a put, add or delete writes the server's own copy, which the player never sees. A list without an
+// owner is everyone's, as it was; its `offset` is refused. Read where `xcore add database` brings a 0.1.0
+// database.js up to date, and at publish, so each call is said with the change it needs (CHANGELOG / README
+// "Upgrading from 0.1.0").
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+/** Comments and strings blanked (same length), so a word in them is not code. */
+export function codeOnly(src) {
+  // a string keeps its quotes (so `import('./x.js')` still reads as a literal path), its text becomes spaces
+  return src.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|'(?:\\.|[^'\\\n])*'|"(?:\\.|[^"\\\n])*"/g, m =>
+    m[0] === '/' ? m.replace(/[^\n]/g, ' ') : m[0] + ' '.repeat(m.length - 2) + m[0],
+  );
+}
+
+/** Each call's options: the argument after collection, id and value (get(c, id, opts), list(c, opts), …). */
+const OPTS_AT = { get: 2, put: 3, add: 2, delete: 2, list: 1 };
+const CALL = '(get|put|add|list|delete)';
+const lineAt = (text, i) => text.slice(0, i).split('\n').length;
+
+/** The arguments of the call whose ( is at `open` in `code`, as [start, end) spans; null if it never closes. */
+function argsAt(code, open) {
+  const spans = [];
+  let depth = 0,
+    start = open + 1;
+  for (let i = open; i < code.length; i++) {
+    const c = code[i];
+    if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') {
+      if (--depth === 0) {
+        if (code.slice(start, i).trim()) spans.push([start, i]);
+        return { spans, end: i + 1 };
+      }
+    } else if (c === ',' && depth === 1) {
+      spans.push([start, i]);
+      start = i + 1;
+    }
+  }
+  return null;
+}
+
+/** What one call needs, or null when it says whose space it means (or its options are not written out here). */
+function needs(op, opts) {
+  if (op === 'list') {
+    if (opts && opts.startsWith('{') && /\boffset\b/.test(opts) && !/\boffset\s*:\s*0\s*[,}]/.test(opts))
+      return "offset is refused now: page with the last answer's after (.list(c, {after})), which the answer gives with more";
+    return null;
+  }
+  if (opts !== null && (!opts.startsWith('{') || /\bowner\b|\.\.\./.test(opts))) return null;
+  const mean = {
+    get: 'reads the server\'s own space (owner "server"), so a document a player wrote answers 404',
+    put: "writes the server's own copy, which the player never sees",
+    add: "adds to the server's own space, not a player's",
+    delete: "deletes the server's own copy; a player's document stays",
+  }[op];
+  return `without an owner it ${mean}. For a player's document pass {owner: sub} (their id, from env.GF.verifyPlayer); for the server's own, {owner: 'server'}`;
+}
+
+/**
+ * The calls to dataOf(env) in one file's text that need a change: dataOf(env).get(…) and a name it was kept under
+ * (const data = dataOf(env); data.get(…)). → [{file, line, op, fix}]
+ */
+export function dataCallsIn(file, text) {
+  const code = codeOnly(text);
+  const found = [];
+  const look = (re, from) => {
+    for (const m of code.matchAll(re)) {
+      const open = m.index + m[0].length - 1;
+      const args = argsAt(code, open);
+      if (!args) continue;
+      const op = m[from];
+      const at = OPTS_AT[op];
+      const opts = args.spans[at] ? text.slice(...args.spans[at]).trim() : null;
+      const fix = needs(op, opts);
+      if (fix) found.push({ file, line: lineAt(code, m.index), op, fix });
+    }
+  };
+  // dataOf(env).get(…), dataOf(env)?.put(…)
+  for (const m of code.matchAll(/(?<![\w$.])dataOf\s*\(/g)) {
+    const args = argsAt(code, m.index + m[0].length - 1);
+    if (!args) continue;
+    const rest = new RegExp(String.raw`^\s*\??\.\s*${CALL}\s*\(`).exec(code.slice(args.end));
+    if (!rest) continue;
+    const at = args.end + rest[0].length - 1;
+    const call = argsAt(code, at);
+    if (!call) continue;
+    const opts = call.spans[OPTS_AT[rest[1]]] ? text.slice(...call.spans[OPTS_AT[rest[1]]]).trim() : null;
+    const fix = needs(rest[1], opts);
+    if (fix) found.push({ file, line: lineAt(code, m.index), op: rest[1], fix });
+  }
+  // const data = dataOf(env); … data.get(…)
+  for (const m of code.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?dataOf\s*\(/g))
+    look(new RegExp(String.raw`(?<![\w$.])${m[1].replace(/\$/g, '\\$')}\s*\??\.\s*${CALL}\s*\(`, 'g'), 1);
+  return found.sort((a, b) => a.line - b.line);
+}
+
+const SOURCE = /\.(m?js|cjs|ts|mts|jsx|tsx)$/;
+/** xcore's own files, and code of others: not the game's calls. */
+const NOT_OURS = rel =>
+  rel === 'server/database.js' || rel.startsWith('server/gf-loot/') || rel.split('/').includes('node_modules');
+
+/**
+ * The calls in the game's server code that need a change: `files`, the paths (relative to `dir`, with /) to read, or
+ * every source file in server/. → [{file, line, op, fix}]
+ */
+export async function ownerlessDataCalls(dir, files = null) {
+  if (!files) {
+    files = [];
+    const walk = async rel => {
+      let entries;
+      try {
+        entries = await readdir(path.join(dir, ...rel.split('/')), { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const e of entries) {
+        const r = `${rel}/${e.name}`;
+        if (e.isDirectory()) await walk(r);
+        else files.push(r);
+      }
+    };
+    await walk('server');
+  }
+  const out = [];
+  for (const rel of files.filter(f => SOURCE.test(f) && !NOT_OURS(f))) {
+    const text = await readFile(path.join(dir, ...rel.split('/')), 'utf8').catch(() => null);
+    if (text?.includes('dataOf')) out.push(...dataCallsIn(rel, text));
+  }
+  return out;
+}
+
+/** One call, as a line a person reads. */
+export const dataCallLine = c => `${c.file}:${c.line} dataOf(env).${c.op}(…): ${c.fix}`;

package/lib/server/secrets.mjs

@@ -1,19 +1,21 @@
-// A game server's own secrets (gf-server-v1, games.fun's hosting contract): `xcore secret set|list|delete`.
-// The owner sets a name and a value; games.fun hands the value to Cloudflare as a secret on the game's server script
+// A game server's own secrets (gf-server-v1, xgames.fun's hosting contract): `xcore secret set|list|delete`.
+// The owner sets a name and a value; xgames.fun hands the value to Cloudflare as a secret on the game's server script
 // and never stores, logs or answers it; the server reads env.<NAME> from the next request. Never the page: a page's
 // files are public. Locally, `xcore dev` gives the server the same names from the game folder's .dev.vars.
-// This file is the rules (shared with xcore dev's .dev.vars); the calls to games.fun are ../publish/secrets.mjs.
+// This file is the rules (shared with xcore dev's .dev.vars); the calls to xgames.fun are ../publish/secrets.mjs.
 
-/** games.fun's limits for a game's secrets. */
+/** xgames.fun's limits for a game's secrets. */
 export const SECRET_LIMITS = Object.freeze({ perGame: 32, valueBytes: 5120, nameChars: 64 });
 const NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
 
-/** The name's problem in plain words, or null (games.fun's rule). `taken`: the server's room bindings. */
+/** The name's problem in plain words, or null (xgames.fun's rule). `taken`: the server's bindings (rooms, database). */
 export function secretNameProblem(name, taken = []) {
   if (typeof name !== 'string' || !NAME.test(name))
     return 'a secret’s name is 1–64 of A–Z, 0–9 and _, starting with a letter (for example VOUCHER_KEY)';
-  if (name === 'GF' || name.startsWith('GF_')) return `${name} is games.fun’s own (env.GF and GF_*): pick another name`;
-  if (taken.includes(name)) return `${name} is already one of the server's rooms (a Durable Object binding)`;
+  if (name === 'GF' || name.startsWith('GF_'))
+    return `${name} is xgames.fun’s own (env.GF and GF_*): pick another name`;
+  if (taken.includes(name))
+    return `${name} is already one of the server's bindings (its rooms' Durable Objects, or its database)`;
   return null;
 }
 

package/lib/solana-rpc.mjs

@@ -1,6 +1,6 @@
 // The Solana RPC a game's economy talks to (devnet only, like loot). One setting, XSOLANA_RPC_URL (@xgamesfun/solana's
 // own name for it; LOOT_RPC_URL, its older name, is read too), from the environment or the workspace's .env: unset, it
-// is games.fun's shared relay (the play host's /loot/v1/rpc, which holds games.fun's own RPC key on its side); set,
+// is xgames.fun's shared relay (the play host's /loot/v1/rpc, which holds xgames.fun's own RPC key on its side); set,
 // it is the person's own devnet RPC (Helius, Triton, QuickNode, a local validator). The shared one is the default
 // for now; a published game brings its own with `xcore add rpc` (server/rpc.js at api/rpc, the URL a secret of its
 // server), which the page client asks first.
@@ -12,7 +12,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { parseEnv } from 'node:util';
 
-/** games.fun's shared devnet relay (the play host's /loot/v1/rpc). */
+/** xgames.fun's shared devnet relay (the play host's /loot/v1/rpc). */
 export const SHARED_RPC = 'https://play.xgames.fun/loot/v1/rpc';
 /** The path a game's page calls, on whatever host serves it. */
 export const PAGE_RPC = '/loot/v1/rpc';
@@ -34,7 +34,7 @@ function setting(env, file) {
 
 /**
  * The RPC in use: {url, shared, problem}. `file`: the .env it reads (the folder the command runs in, or GAMESFUN_WORK; the
- * kit passes its workspace's). `shared` is games.fun's relay (nothing set). A setting that is mainnet, not a
+ * kit passes its workspace's). `shared` is xgames.fun's relay (nothing set). A setting that is mainnet, not a
  * URL, or plain http to anything but this machine is not used: `problem` says why and `url` is the shared relay.
  */
 export function solanaRpc(env = process.env, { file = path.join(env.GAMESFUN_WORK || process.cwd(), '.env') } = {}) {
@@ -43,7 +43,7 @@ export function solanaRpc(env = process.env, { file = path.join(env.GAMESFUN_WOR
   const refuse = why => ({
     url: SHARED_RPC,
     shared: true,
-    problem: `XSOLANA_RPC_URL ${why}; using games.fun's shared devnet RPC instead`,
+    problem: `XSOLANA_RPC_URL ${why}; using xgames.fun's shared devnet RPC instead`,
   });
   let url;
   try {
@@ -60,7 +60,7 @@ export function solanaRpc(env = process.env, { file = path.join(env.GAMESFUN_WOR
 /** The RPC in words, never its URL when it is the person's own (it usually carries their key). */
 export function rpcWords(rpc) {
   if (rpc.shared)
-    return `games.fun's shared devnet RPC (${SHARED_RPC}; set XSOLANA_RPC_URL in .env to use your own)${rpc.problem ? `: ${rpc.problem}` : ''}`;
+    return `xgames.fun's shared devnet RPC (${SHARED_RPC}; set XSOLANA_RPC_URL in .env to use your own)${rpc.problem ? `: ${rpc.problem}` : ''}`;
   let host = 'your own';
   try {
     host = new URL(rpc.url).host;

package/lib/state-folder.mjs

@@ -0,0 +1,23 @@
+// <game>/.gamesfun/: xcore's own files for one game (the publish link, the local database and files, the dev
+// platform's saves, exports of the players' data). Hidden, so never published; and kept out of git by a .gitignore of
+// its own (`*`), written whenever xcore writes into the folder and finds none, so an export of players' data is not
+// committed by a `git add .`.
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+export const STATE_FOLDER = '.gamesfun';
+export const STATE_GITIGNORE = `# xcore's own files for this game: the publish link, the local database and files, exports of your players' data.
+# Never published, and kept out of git. xcore writes this file again whenever it is missing, so deleting it does not
+# let anything in: change it instead (it is left as you write it). A line such as !publish.json commits that file.
+*
+`;
+
+/** <dir>/.gamesfun, made with its .gitignore when either is missing. → the folder */
+export async function stateFolder(dir) {
+  const folder = path.join(dir, STATE_FOLDER);
+  await mkdir(folder, { recursive: true });
+  const ignore = path.join(folder, '.gitignore');
+  if (!existsSync(ignore)) await writeFile(ignore, STATE_GITIGNORE, { flag: 'wx' }).catch(() => {});
+  return folder;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xgamesfun/xcore",
-  "version": "0.1.0",
-  "description": "games.fun from the command line, the one place to start: sign in, bring a web game you already made, check it as games.fun hosts it, give it a backend and a Solana economy on loot (@xgamesfun/solana), and publish it at a link anyone can play. Making a game from an idea is the kit's (@xgamesfun/kit), which it hands those commands to.",
+  "version": "0.2.1",
+  "description": "xgames.fun from the command line: bring a web game you already made, check it as xgames.fun hosts it, give it a backend and a Solana economy, and publish it at a link anyone can play.",
   "keywords": [
     "game",
     "browser-game",
@@ -9,7 +9,7 @@
     "hosting",
     "web3",
     "solana",
-    "games.fun"
+    "xgames.fun"
   ],
   "homepage": "https://github.com/XGamesFun/xcore#readme",
   "repository": {
@@ -19,7 +19,7 @@
   "bugs": {
     "url": "https://github.com/XGamesFun/xcore/issues"
   },
-  "author": "games.fun",
+  "author": "xgames.fun",
   "license": "MIT",
   "type": "module",
   "bin": {

package/skills/bring-your-own-game/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: bring-your-own-game
-description: Help someone bring a web game they already made without this kit (plain HTML/JS, or a Vite, Next.js static export, Astro, SvelteKit, Nuxt, Create React App or Parcel project) to games.fun - adopt it, fix what does not fit the hosting (server-side rendering, paths from the root, CDN scripts and fonts, undeclared backend origins, secrets, size limits), check it with the page check, connect their own backend or a server/ Worker, add a loot economy, and publish it. Use when the person has an existing game folder or repository and wants web3, games.fun hosting, or the kit's checks for it; never rebuild such a game through the creation loop.
+description: Help someone bring a web game they already made without this kit (plain HTML/JS, or a Vite, Next.js static export, Astro, SvelteKit, Nuxt, Create React App or Parcel project) to xgames.fun - adopt it, fix what does not fit the hosting (server-side rendering, paths from the root, CDN scripts and fonts, undeclared backend origins, secrets, size limits), check it with the page check, connect their own backend or a server/ Worker, add a loot economy, and publish it. Use when the person has an existing game folder or repository and wants web3, xgames.fun hosting, or the kit's checks for it; never rebuild such a game through the creation loop.
 ---
 
 # Bring your own game
 
-The person already has a game. Your job is to make it fit games.fun's hosting with the smallest changes to _their_
+The person already has a game. Your job is to make it fit xgames.fun's hosting with the smallest changes to _their_
 files, never to remake it. The whole story, with every rule of the hosting, is xcore's README
 (github.com/XGamesFun/xcore; on npm, @xgamesfun/xcore's page); read its "What the hosting takes" table once. Everything
 here is `@xgamesfun/xcore` (the `xcore` command: `npx -y @xgamesfun/xcore …`, or `xcore …` once installed with `npm i -g
@@ -67,7 +67,7 @@ Four checks: it builds, it fits the hosting, the page starts (phone and desktop,
 console errors, nothing missing, nothing from the root, something on screen), it stays inside its origins. Open the two
 screenshots in `evidence/verify-N/` and look at them. A failing check 4 names the origin and why: declare it in
 `backend.json` if the game really calls it, or remove the call. The page check does not say the game plays well:
-that is the person's own game; ask them what to try, and try it with `xcore dev <folder>` (the game as games.fun
+that is the person's own game; ask them what to try, and try it with `xcore dev <folder>` (the game as xgames.fun
 hosts it, with its server, sign-in, saves, rooms and economy RPC) or their own.
 
 ## 4. Players, a database, a backend (only when the game has or needs them)
@@ -96,7 +96,7 @@ await GamesFun.join_room(code)` and `multiplayer.multiplayer_peer = peer`; keep
   answer CORS for the game's origin. Never put their secret keys in the game.
 - **They want one**: Supabase or Railway, connected by the game-making kit (`@xgamesfun/kit`: `xcore backend connect
 supabase|railway` with the kit installed). Without the kit, they set one up themselves and you declare it as above.
-- **Server logic games.fun runs for them**: `server/index.js` and `gamesfun.json` → `server`
+- **Server logic xgames.fun runs for them**: `server/index.js` and `gamesfun.json` → `server`
   ([docs/SERVER.md](../../docs/SERVER.md)): a Worker on `/api/*`, Durable Objects for rooms, `env.GF` for sign-in, saves
   and scores. Their page calls it with a relative address (`fetch('api/scores')`): `/api/*` at the published origin,
   `/game/api/*` under `xcore dev`, which runs it under workerd with a local `env.GF`. A Node-only server stays on
@@ -126,14 +126,14 @@ Unity). A browser with no wallet is told so, with the game still playable. `xcor
 SOL: an economy approved to try it is one the person can approve again later). Going live is the person's own
 `xcore loot approve`, in their wallet: never yours.
 
-Paying a result has two signers (docs/SERVER.md, "Paying a result", has the rule): games.fun's keeper, when the
+Paying a result has two signers (docs/SERVER.md, "Paying a result", has the rule): xgames.fun's keeper, when the
 server already decides who won and the prize is fixed by place (the server calls `env.GF.loot.report`; the owner
 certifies the host key in Studio once, and nobody keeps a key), or the server's own key, when the amount depends on
 the result, when the server replays or bounds runs, for entry fees or a prize pool, or past 120 results an hour. For
 the own key, run `xcore add vouchers <folder>`: it writes `server/vouchers.js` and a test key for `xcore dev` (its
 seed in `.dev.vars`, kept out of git). Then, in order: write `PAY.check` with the person (what their server checks
 before it pays; nothing is paid until it is written) and count payouts in `PAY.paid`; they publish; they run `xcore
-secret set VOUCHER_SEED --new-key` (the live key, made on games.fun and never on their machine; it prints the address);
+secret set VOUCHER_SEED --new-key` (the live key: made here, sent to xgames.fun only and never kept on their machine; it prints the address);
 that address goes in the grant's `vouchers` (`xcore loot check`); they approve and publish again. Never read the seed
 out of `.dev.vars` or repeat it.
 
@@ -165,9 +165,10 @@ nothing checked (their gameplay, their backend's own behaviour).
 
 A game with a `server/`, saves or scores runs under its **plan** (`xcore plan <folder>`): Free by default (50 ms of CPU
 and 600 requests a minute, $1 of use a month, then capped and slow until the month ends). When the game needs more
-(a server that replays play, many players at once), tell them: a paid game slot makes it Creator
-(`xcore plan activate <folder>` once they have a slot), and the slot moves between their games at any time. Never
-activate or deactivate a game without asking.
+(a server that replays play, many players at once), tell them: a paid slot makes it Creator
+(`xcore plan activate <folder>` once they have one), and the paid slot moves between their games at any time. Everyone
+has 2 free slots: a third game is refused on publish (`no-free-slot`) until they archive one on their console
+(xgames.fun/console) or move one to a paid slot. Never activate, deactivate or archive a game without asking.
 
 Their own website can show the game (`xcore embed add https://theirsite.com <folder>` prints the `<iframe>`), and on
 Creator or Scale it can play at their own domain (`xcore domain add play.theirsite.com <folder>` prints two DNS records