@xgamesfun/xcore 0.2.1 → 0.4.0

package/lib/economy.mjs

@@ -35,6 +35,18 @@ export function solanaCommand(env = process.env) {
   return [process.execPath, path.join(root, bin)];
 }
 
+/** Does the installed package's command have `command` (a version from before it says it has none)? Read from its
+ *  command's own source, so nothing runs. */
+export function solanaHas(command, env = process.env) {
+  const xsolana = solanaCommand(env);
+  if (!xsolana) return false;
+  try {
+    return new RegExp(`['"]${command}['"]`).test(readFileSync(xsolana[1], 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
 // ---- The page client in a game ---------------------------------------------------------------------------------------
 // A published page has no node_modules: the package's page side (@xgamesfun/solana/play and every file it imports, all
 // relative plain ES modules with no dependency) is copied into a game with an economy as gf/loot/. Its record

package/lib/login-reach.mjs

@@ -0,0 +1,184 @@
+// What an `xcore login` reaches. xgames.fun's approval page asks the developer which games the command line may work
+// on: the games they tick (and any game they publish as new from that sign-in), or their whole account. The token
+// exchange answers which ({scope: 'games', games: [ids]} or {scope: 'account'}); this module says it after sign-in,
+// keeps it beside the sign-in's public record (kit-reach.json in the config folder, keyed by the token's id: never a
+// secret), and words a refusal for a game the sign-in was not given (xgames.fun's 'not-granted', 403) as what it is,
+// with what to do. A sign-in's games grow after it is made (a game it publishes as new joins them), so `xcore login
+// --status` and a refusal ask xgames.fun for them again (GET /api/kit/plan lists the games the sign-in reaches) and
+// keep the answer; when xgames.fun cannot be asked, the saved list stands, said to be possibly out of date.
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { configDir, listEntries } from './credentials.mjs';
+import { call, credentialKey, login, savedLogin, storeWords, studioOrigin } from './publish/client.mjs';
+import { CMD } from './command.mjs';
+
+const reachFile = env => path.join(configDir({ env }), 'kit-reach.json');
+async function readAll(env) {
+  try {
+    const v = JSON.parse(await readFile(reachFile(env), 'utf8'));
+    return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+  } catch {
+    return {};
+  }
+}
+async function writeAll(env, all) {
+  const file = reachFile(env);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  await writeFile(`${file}.${process.pid}.tmp`, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
+  await rename(`${file}.${process.pid}.tmp`, file);
+}
+
+/** The reach xgames.fun gave in a token exchange's answer: {scope, games: [id] | null}, or null when it says none. */
+function reachOf(answer) {
+  if (answer?.scope === 'account') return { scope: 'account', games: null };
+  if (answer?.scope === 'games')
+    return { scope: 'games', games: Array.isArray(answer.games) ? answer.games.map(String) : [] };
+  return null;
+}
+
+/**
+ * `xcore login` (../lib/publish/client.mjs login, with the same options) that also learns what the sign-in reaches,
+ * names those games (GET /api/kit/plan lists the games the sign-in reaches, with their titles; when it does not answer,
+ * the ids stand) and keeps it for --status. → login's answer and {scope: 'games' | 'account' | null, games: [{id,
+ * title, slug}] | null}
+ */
+export async function loginWithReach({ origin = studioOrigin(), env = process.env, fetchImpl = fetch, ...opts } = {}) {
+  let exchanged = null;
+  const watching = async (url, init) => {
+    const res = await fetchImpl(url, init);
+    if (String(url) === `${origin}/api/kit/token` && init?.method === 'POST' && res.ok)
+      exchanged = await res
+        .clone()
+        .json()
+        .catch(() => null);
+    return res;
+  };
+  const r = await login({ origin, env, fetchImpl: watching, ...opts });
+  const reach = reachOf(exchanged);
+  if (!reach) return { ...r, studio: origin, scope: null, games: null };
+  let games = null;
+  if (reach.scope === 'games') {
+    const titles = new Map();
+    if (reach.games.length)
+      try {
+        for (const g of gamesOf(await call(origin, '/api/kit/plan', { token: exchanged.token, fetchImpl })))
+          titles.set(g.id, g);
+      } catch {
+        /* the ids stand */
+      }
+    games = reach.games.map(id => titles.get(id) ?? { id, title: null, slug: null });
+  }
+  const all = await readAll(env);
+  all[credentialKey(origin)] = { tokenId: exchanged?.tokenId ?? null, scope: reach.scope, games };
+  await writeAll(env, all);
+  return { ...r, studio: origin, scope: reach.scope, games };
+}
+
+/** What this computer's sign-in to `origin` reaches, as kept at sign-in: {scope, games} or null (none kept). */
+export async function readReach(origin = studioOrigin(), { env = process.env } = {}) {
+  const k = credentialKey(origin);
+  const kept = (await readAll(env))[k];
+  const entry = (await listEntries({ env }))[k];
+  // only for the sign-in it was kept for: another login since (from an older xcore) leaves it unknown
+  if (!kept || !entry || (kept.tokenId ?? null) !== (entry.tokenId ?? null)) return null;
+  return { scope: kept.scope, games: kept.games ?? null };
+}
+
+/** The games GET /api/kit/plan lists for the sign-in, as {id, title, slug}. */
+const gamesOf = plan =>
+  (Array.isArray(plan?.games) ? plan.games : [])
+    .filter(g => g && typeof g.id === 'string')
+    .map(g => ({
+      id: g.id,
+      title: typeof g.title === 'string' ? g.title : null,
+      slug: typeof g.slug === 'string' ? g.slug : null,
+    }));
+
+/**
+ * What this computer's sign-in to `origin` reaches now: its scope as given at sign-in (a sign-in's scope never
+ * changes), and for one given games, those games as xgames.fun lists them now, kept for next time. → {scope, games,
+ * checked: true} (xgames.fun answered), {scope, games, checked: false} (the saved copy: xgames.fun could not be asked),
+ * or null (not known: no sign-in, or one made by an older xcore).
+ */
+export async function currentReach(origin = studioOrigin(), { env = process.env, fetchImpl = fetch } = {}) {
+  const saved = await readReach(origin, { env });
+  if (!saved) return null;
+  if (saved.scope !== 'games') return { ...saved, checked: true };
+  try {
+    const s = await savedLogin(origin, { env });
+    if (!s?.token) throw new Error('no token');
+    const plan = await call(origin, '/api/kit/plan', { token: s.token, fetchImpl });
+    // an answer that is not a list of games (a page, {}, games of another shape) is no answer: the saved copy stands
+    if (!Array.isArray(plan?.games) || !plan.games.every(x => x && typeof x === 'object' && typeof x.id === 'string'))
+      throw new Error('not a list of games');
+    const games = gamesOf(plan);
+    const all = await readAll(env);
+    const k = credentialKey(origin);
+    if (all[k]) {
+      all[k] = { ...all[k], games };
+      await writeAll(env, all);
+    }
+    return { scope: 'games', games, checked: true };
+  } catch {
+    return { ...saved, checked: false };
+  }
+}
+
+/** Forget what the sign-in to `origin` reaches (`xcore logout`). */
+export async function forgetReach(origin = studioOrigin(), { env = process.env } = {}) {
+  const all = await readAll(env);
+  if (!(credentialKey(origin) in all)) return;
+  delete all[credentialKey(origin)];
+  await writeAll(env, all);
+}
+
+const gameName = g => (g.title ? `${g.title}${g.slug ? ` (${g.slug})` : ''}` : g.slug || g.id);
+const MAYBE_OLD =
+  ' (xgames.fun could not be asked just now, so this is the list saved at sign-in or at the last check, and may be out of date.)';
+/** The reach in a sentence: "This sign-in reaches …". '' when it is not known. `checked: false`: said to be saved. */
+export function reachWords(reach) {
+  if (reach?.scope === 'account') return 'This sign-in reaches your whole account: every game, now and later.';
+  if (reach?.scope !== 'games') return '';
+  const games = reach.games ?? [];
+  const old = reach.checked === false ? MAYBE_OLD : '';
+  if (!games.length)
+    return `This sign-in reaches none of your games yet: a game you publish as new from here is added to it. To work on a game you have, run ${CMD} login again and tick it.${old}`;
+  return (
+    `This sign-in reaches ${games.length} of your games: ${games.map(gameName).join(', ')}. ` +
+    `A game you publish as new from here is added to it; for another, run ${CMD} login again and tick it.${old}`
+  );
+}
+
+/** What `xcore login` prints once signed in. */
+export function loginWords(r) {
+  const reach = reachWords(r);
+  return (
+    `Signed in to ${r.studio ?? studioOrigin()} as ${r.email}.${reach ? ` ${reach}` : ''} The token is kept in ` +
+    `${storeWords(r.store)} until ${new Date(r.expiresAt).toISOString().slice(0, 10)}. Next: ${CMD} publish`
+  );
+}
+
+/**
+ * A refusal for a game the sign-in was not given (code 'not-granted'), in plain words with what to do, naming what the
+ * sign-in does reach when that is known. The error is changed in place (message, next). → the error
+ */
+export async function explainNotGranted(e, { env = process.env } = {}) {
+  let reach = null;
+  try {
+    reach = await currentReach(studioOrigin(env), { env });
+  } catch {
+    /* unknown */
+  }
+  const has =
+    reach?.scope === 'games'
+      ? reach.games?.length
+        ? ` This sign-in reaches: ${reach.games.map(gameName).join(', ')}.`
+        : ' This sign-in reaches none of your games yet.'
+      : '';
+  const old = reach?.scope === 'games' && reach.checked === false ? MAYBE_OLD : '';
+  e.message =
+    `xgames.fun refused this: your sign-in (${CMD} login) was not given this game. Run ${CMD} login again and tick ` +
+    `this game on the approval page (or choose your whole account).${has}${old}`;
+  e.next = `${CMD} login`;
+  return e;
+}

package/lib/publish/adopt.mjs

@@ -728,6 +728,7 @@ export async function scanPage(out, { backend = [], limits = DEFAULT_LIMITS, pre
 
   let rootPaths = 0,
     sw = false,
+    fullscreen = false, // a way to go full screen: the page's own button, an engine's, or GamesFun.fullscreen()
     devices = new Map(), // what it asks for → where
     callsApi = [];
   // a file the page loads by a path from the root: the first three are listed, the rest counted
@@ -903,6 +904,10 @@ export async function scanPage(out, { backend = [], limits = DEFAULT_LIMITS, pre
         });
       }
       if (!engine && /serviceWorker\s*\.\s*register\s*\(/.test(text)) sw = true;
+      if (
+        /\b(?:webkitR|r)equestFullscreen\b|\bfullscreen\s*\(|gf:fullscreen|window_set_mode|\bSetFullscreen\b/.test(text)
+      )
+        fullscreen = true;
       for (const [what, re] of [
         ['the camera or microphone', /getUserMedia\s*\(/],
         ['the location', /geolocation\s*\.\s*(getCurrentPosition|watchPosition)/],
@@ -977,6 +982,12 @@ export async function scanPage(out, { backend = [], limits = DEFAULT_LIMITS, pre
       what: `${at('index.html')} names no tab icon: browsers ask for /favicon.ico, and the live game's console shows a 404 for it`,
       fix: 'Add one beside the page and link it relatively: <link rel="icon" href="./icon.png"> (or put a favicon.ico at the root of what is published)',
     });
+  // most players come from a post on X or a phone, where the game first shows in a small frame
+  if (!fullscreen && files.some(f => /\.html?$/i.test(f.rel)))
+    warn.push({
+      what: 'it has no way to go full screen: in a post on X and on a phone the game first shows in a small frame',
+      fix: "Give it a full screen button that calls GamesFun.fullscreen() (gamesfun.js, xcore add signin): on xgames.fun the page around it goes full screen (or fills the screen in an app's own browser, X's among them), and elsewhere the browser does, or the game opens in a tab of its own. Or call the browser's element.requestFullscreen() from a click",
+    });
   if (sw)
     warn.push({
       what: 'it registers a service worker',

package/lib/publish/index.mjs

@@ -3,15 +3,17 @@
 // check): the command, the kit's MCP tool and its studio's Publish tab all come here.
 //
 //   1. signed in?           ./client.mjs (xcore login)
-//   2. the files            ./tree.mjs: refuses .env files and links; leaves out evidence/ and hidden files
+//   2. the files            ./tree.mjs: refuses .env files, links, programs, installers and archives (as xgames.fun
+//                           does); leaves out evidence/ and hidden files
 //   3. no secrets           ./scan.mjs (xgames.fun runs the same scan again on its side)
 //      no reference names   ./names.mjs: a file that names a game this one was made to look or play
 //                           like refuses it (spec.json goes up as a copy without them; the person's records keep them)
 //   4. its backend          backend.json → origins (`xcore backend connect`): the only other sites the game may
 //                           talk to once published; xgames.fun's play host opens that game's CSP to exactly those
 //   5. its server code      server/ (the gf-server-v1 contract, ../server/contract.mjs): bundled into one file and
-//                           checked (it builds, no code from text, no Node built-in a Worker lacks, no secrets, its
-//                           Durable Objects exported, its size); a problem refuses the publish. Sent only when
+//                           checked (it builds, no code from text, no Node built-in, no raw sockets or import() of a
+//                           name made at run time, no secrets, its Durable Objects exported, its size); a problem
+//                           refuses the publish. Sent only when
 //                           xgames.fun says it takes server code (GET /api/kit/me → server.contracts has gf-server-v1);
 //                           otherwise the files go up alone, and the person is told. server/ itself is never a
 //                           public file.
@@ -19,7 +21,9 @@
 //                           the page check (../check.mjs). A game the kit made: the kit's six gates, its `check`; one
 //                           without it is refused here, never checked by less
 //   7. upload               only the files (and the server bundle) xgames.fun does not have yet
-//   8. the version + link   unlisted; an update is the next version at the same link
+//   8. the version + link   unlisted; an update is the next version at the same link. A first publish's link name is
+//                           xgames.fun's, from the title; the kit says before it uploads when reserved words are left
+//                           out of it (./names.mjs linkName)
 // A brought game (gamesfun.json → page, ./page.mjs; `xcore adopt`) is built first when it has a build, and its `out`
 // folder is what goes up (with its server/ bundle, as for any game); the files publish adds live in its `static` folder.
 // Signed in by `xcore login`, or in a GitHub Actions job by the job's own OIDC token (./oidc.mjs; actions/publish).
@@ -38,7 +42,7 @@ import {
   SCAN_BYTES,
   BACKEND_FILE,
 } from './scan.mjs';
-import { findNames, namesMessage } from './names.mjs';
+import { findNames, linkNameNote, namesMessage } from './names.mjs';
 import { gate } from './gate.mjs';
 import { call, ownOrigins, signInState, studioOrigin } from './client.mjs';
 import { shown as shownDir } from '../games.mjs';
@@ -250,7 +254,10 @@ export async function preflight(dir, { origin = studioOrigin() } = {}) {
   const backend = backendOrigins(config, { own: ownOrigins(origin) });
   problems.push(...backend.problems);
   const names = namesMessage(named);
+  // a game with no link here yet: the link name its first publish will get, when its title has words xgames.fun leaves out
+  const linked = (await readLinks(dir))[origin];
   return {
+    linkName: linked ? null : linkNameNote(built.title),
     built,
     hits,
     secrets,
@@ -386,7 +393,7 @@ export async function publishGame(
       progress(
         `Its economy's Solana calls go to the game's own RPC (server/rpc.js, api/rpc) once its server has XSOLANA_RPC_URL: ${CMD} secret set XSOLANA_RPC_URL (once; ${CMD} secret list shows whether it is set). Until then they use xgames.fun's shared relay.`,
       );
-      // the server may call only backend.json's origins: the RPC's must be one
+      // the server's entry (where api/rpc runs) may call only backend.json's origins: the RPC's must be one
       const local = serverRpc(dir);
       if (local && !(pre.backend ?? []).includes(local.origin))
         progress(
@@ -394,7 +401,7 @@ export async function publishGame(
         );
       else if (!local && !(pre.backend ?? []).length)
         progress(
-          `Worth fixing: ${BACKEND_FILE} names no origins, and a game's server may call only those: add your RPC's (https://host alone) to its "origins".`,
+          `Worth fixing: ${BACKEND_FILE} names no origins, and a game's server (its entry, where api/rpc runs) may call only those: add your RPC's (https://host alone) to its "origins".`,
         );
     } else {
       const rpc = solanaRpc(env, rpcFile ? { file: rpcFile } : undefined);
@@ -472,6 +479,8 @@ export async function publishGame(
   const links = await readLinks(dir),
     known = newGame ? null : (links[origin] ?? null);
   const name = title ?? built.title;
+  const linkWords = known ? null : linkNameNote(name);
+  if (linkWords) progress(linkWords);
   progress(
     `${known ? `Updating ${known.slug ? `/play/${known.slug}` : 'your game'}` : `Publishing “${name}”`} on ${origin}…`,
   );

package/lib/publish/names.mjs

@@ -13,7 +13,8 @@
 // name the person typed with a slip ("ultmate") still finds the real spelling (an edit or two, by the name's length).
 // A one-word name shorter than four letters is not matched (too many ordinary words). A multi-word name's first word
 // on its own, capitalised, is a warning, not a refusal: it is often an ordinary word ("frogs", "portal").
-// Pure (no Node imports): the kit's publish and a host's scan can share it.
+// Pure (no Node imports): the kit's publish and a host's scan can share it. The link name a first publish gives a game
+// (linkName, at the end) is here too.
 
 export const REDACTED = 'a reference game';
 const LEAD =
@@ -203,3 +204,129 @@ export function namesMessage(hits) {
     "Style is fair game; another game's name is not. Take the name out of the game's own words (titles, text, comments, file names), then publish again. The person's prompt and the look's records keep it on this machine."
   );
 }
+
+// ---- A game's link name -----------------------------------------------------------------------------------------------
+// The first publish gives a game its link name, from its title, and the game keeps it for good (through renames): it
+// plays at https://<name>-play.xgames.fun. xgames.fun makes the name, never the kit; these are its rules, so the kit can
+// say before anything is sent what the name will be. A new name never carries a sign-in, wallet, support or brand word
+// (a game titled "Phantom Wallet Connect" would put a wallet's name beside xgames.fun's): each is left out, as a word,
+// as two words that make one ("sign in", "x games") and, for RESERVED_INSIDE, inside a longer word ("walletconnect").
+// What is left is the name ("Wallet Wars" → wars); nothing left is "game". A name that is taken gets a number (-2, -3).
+
+export const SLUG_MIN = 3,
+  SLUG_MAX = 48;
+/** Names xgames.fun routes by, never a game's link ("api-2" and the like are fine). */
+export const RESERVED_SLUGS = new Set([
+  'api',
+  'play',
+  'p',
+  'v',
+  'd',
+  'signal',
+  'world',
+  'admin',
+  'studio',
+  'operator',
+  'signin',
+  'signout',
+  'auth',
+  'demos',
+  'tokens',
+  'meta',
+  'launchpad',
+  'dashboard',
+  'dev',
+  'gf',
+  'www',
+  'static',
+  'assets',
+  'new',
+  'index',
+  'null',
+  'undefined',
+]);
+/** Words a new link name never carries: signing in, wallets, support, and brands (xgames.fun's, wallets', sign-ins'). */
+export const RESERVED_WORDS = new Set(
+  [
+    // signing in
+    'login logon logout signin signon signup signout auth oauth sso password passwords passcode passkey 2fa mfa otp',
+    'verify verified verification validate validation authenticate authentication account accounts recover recovery',
+    'security kyc',
+    // wallets
+    'wallet wallets connector walletconnect seedphrase mnemonic privatekey keypair airdrop airdrops claim claims',
+    'presale whitelist revoke approve approval rectify dapp',
+    // support
+    'support helpdesk customer billing refund refunds admin administrator moderator',
+    // brands
+    'xgames xgamesfun gamesfun phantom metamask solflare trustwallet coinbase binance okx bybit kucoin ledgerlive',
+    'trezor raydium magiceden opensea pumpfun solscan ethereum metaplex google gmail microsoft outlook icloud paypal',
+    'stripe discord telegram twitter facebook instagram whatsapp tiktok youtube roblox epicgames playstation xbox',
+    'nintendo netflix openai chatgpt anthropic',
+  ]
+    .join(' ')
+    .split(' '),
+);
+/** The reserved words also left out inside a longer word (none is part of an ordinary one). */
+export const RESERVED_INSIDE = Object.freeze([
+  'wallet',
+  'login',
+  'signup',
+  'password',
+  'passcode',
+  'metamask',
+  'solflare',
+  'coinbase',
+  'binance',
+  'seedphrase',
+  'privatekey',
+  'airdrop',
+  'xgames',
+  'gamesfun',
+  'magiceden',
+  'opensea',
+  'pumpfun',
+  'paypal',
+  'phantom',
+]);
+
+const trimTo = (s, n) => s.slice(0, n).replace(/-+$/, '');
+
+/**
+ * The link name xgames.fun gives a new game with this title (before a number for a taken name), and the reserved words
+ * it leaves out ("sign in" for two words that make one). → {slug, dropped: [word]}
+ */
+export function linkName(title) {
+  const kebab = String(title ?? '')
+    .normalize('NFKD')
+    .replace(/[̀-ͯ]/g, '')
+    .toLowerCase()
+    .replace(/['’]/g, '')
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  const words = kebab.split('-').filter(Boolean),
+    kept = [],
+    dropped = [];
+  for (let i = 0; i < words.length; i++) {
+    if (i + 1 < words.length && RESERVED_WORDS.has(words[i] + words[i + 1])) {
+      dropped.push(`${words[i]} ${words[i + 1]}`);
+      i++;
+      continue;
+    }
+    if (RESERVED_WORDS.has(words[i]) || RESERVED_INSIDE.some(w => words[i].includes(w))) {
+      dropped.push(words[i]);
+      continue;
+    }
+    kept.push(words[i]);
+  }
+  let slug = trimTo(kept.join('-'), SLUG_MAX);
+  if (!slug) slug = 'game';
+  else if (slug.length < SLUG_MIN || RESERVED_SLUGS.has(slug)) slug = `${trimTo(slug, SLUG_MAX - 5)}-game`;
+  return { slug, dropped: [...new Set(dropped)] };
+}
+
+/** What the kit says before a first publish whose title has reserved words: the name it will get, and why. Or null. */
+export function linkNameNote(title) {
+  const { slug, dropped } = linkName(title);
+  if (!dropped.length) return null;
+  return `Its link name will be "${slug}" (or "${slug}-2" and so on if that is taken), not one made of all of “${title}”: xgames.fun leaves sign-in, wallet, support and brand words out of every new link name, here ${dropped.join(', ')}. The title stays as it is, and a game keeps its link name for good: to choose another, change the title before its first publish.`;
+}

package/lib/publish/scan.mjs

@@ -21,7 +21,7 @@ export const SECRET_PATTERNS = ALL_PATTERNS.filter(([kind]) => kind !== 'JSON we
   global(re),
 ]);
 const JWT = global(ALL_PATTERNS.find(([kind]) => kind === 'JSON web token')[1]);
-/** Files refused by name, wherever they are in the folder. */
+/** Files refused by name, wherever they are in the folder (by type: REFUSED_TYPES below, refused before the scan). */
 export const REFUSED_FILES = [
   [/(^|\/)\.env(\.[^/]*)?$/i, 'a .env file (secrets live there, never in a game)'],
   [/\.(pem|key|p12|pfx)$/i, 'a key or certificate file'],
@@ -30,6 +30,25 @@ export const REFUSED_FILES = [
   [/(^|\/)service[-_]?account[^/]*\.json$/i, 'a cloud service-account key'],
 ];
 
+/**
+ * File types a published game never serves, refused by xgames.fun whatever the kit says: programs and installers for a
+ * computer or a phone, and archives, which a game's page does not need and a page that lures people hands out as a
+ * "download". By the last extension, any case (and .tar.gz). Not .gz or .br alone (a Unity WebGL build serves its
+ * files precompressed), and not .zip (web builds of some engines load one: a Ren'Py game.zip, a level pack).
+ */
+export const REFUSED_TYPES = [
+  [
+    /\.(exe|msi|msix|msixbundle|appx|appxbundle|dll|scr|bat|cmd|vbs|vbe|wsf|wsh|hta|cpl|jar|apk|aab|xapk|ipa|dmg|pkg|mpkg|deb|rpm|appimage|sys|lnk|reg)$/i,
+    'a program or an installer: a game never hands one out',
+  ],
+  [
+    /\.(rar|7z|tar|tar\.gz|tar\.bz2|tar\.xz|tgz|tbz|tbz2|txz|bz2|xz|cab|iso|lzh|arj)$/i,
+    'an archive: publish the files themselves (a .zip the game loads is fine)',
+  ],
+];
+/** Why xgames.fun refuses a file by its type (REFUSED_TYPES), or null. */
+export const refusedType = path => REFUSED_TYPES.find(([re]) => re.test(path))?.[1] ?? null;
+
 const TEXT_EXT =
   /\.(m?js|cjs|json|jsonl|md|txt|html?|css|ya?ml|toml|ini|cfg|env|sh|ps1|py|ts|tsx|jsx|svg|csv|xml|example|map|glsl|wgsl|vert|frag)$/i;
 const BINARY_EXT =
@@ -212,6 +231,11 @@ export function backendOrigin(value, { own = [] } = {}) {
   if (!['https:', 'wss:'].includes(url.protocol)) throw bad('must start with https:// or wss://');
   if (url.username || url.password || url.search || url.hash || (url.pathname !== '/' && url.pathname !== ''))
     throw bad('must be an origin only (no path, query or user)');
+  // the host is written into the page's content-security policy, which takes a plain name only
+  if (!/^[a-z0-9.-]+$/.test(url.hostname))
+    throw bad(
+      `has a host the page's content-security policy cannot name: a host is letters, digits, dots and dashes only (no "_", ";", "," or quote; an international name in its xn-- form)`,
+    );
   if (value.trim().replace(/\/+$/, '').toLowerCase() !== url.origin) throw bad(`must be written as ${url.origin}`);
   const host = url.hostname.toLowerCase();
   if (IP_LITERAL.test(host) || !host.includes('.') || LOCAL_NAME.test(host))

package/lib/publish/tree.mjs

@@ -9,7 +9,9 @@
 //                            the game's link and its last check), and the notes a folder keeps for its makers at its top
 //                            (README.md, NOTES.md, LAUNCH.md, FRICTION.md, CLAUDE.md, AGENTS.md, TODO.md: how the
 //                            game and its server work is no player's business).
-// Refused (nothing is sent): a .env file anywhere in the folder, and symbolic links (a tree holds ordinary files).
+// Refused (nothing is sent): a .env file anywhere in the folder, symbolic links (a tree holds ordinary files), and the
+//                            file types xgames.fun never serves (./scan.mjs REFUSED_TYPES: programs, installers,
+//                            archives other than .zip).
 // Added, in the upload only: foundation.lock.json and adaptation-plan.json when the game has none (xgames.fun keeps
 // them with every version; a game made in the kit does not need them on disk). They are made from gf-three.json and
 // spec.json, and the lock is the same for every kit publish, so each update of a game keeps it.
@@ -22,6 +24,7 @@ import { existsSync } from 'node:fs';
 import { lstat, readdir, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { referenceNames, redactJson } from './names.mjs';
+import { refusedType } from './scan.mjs';
 import { pageRoots, pageTitle } from './page.mjs';
 import { CMD } from '../command.mjs';
 
@@ -193,6 +196,11 @@ export async function buildTree(dir) {
         refused.push({ path: relPath, why: 'not an ordinary file' });
         continue;
       }
+      const type = refusedType(relPath);
+      if (type) {
+        refused.push({ path: relPath, why: type });
+        continue;
+      }
       let data = await readFile(full),
         own = false;
       // the spec goes up as a copy without the reference games' names (the file on disk keeps the person's words)