@xgamesfun/xcore 0.2.1 → 0.4.0

package/lib/secret-patterns.mjs

@@ -1,58 +1,67 @@
 // Key-shaped strings: the one list of them. The publish scan (./publish/scan.mjs) reads every pattern here, and the
 // kit imports SECRET_PATTERNS for its own scanner. Pure: no imports.
 //
-// Every run in a pattern has an upper bound, so no match is longer than MAX_MATCH characters: the scan reads a big
-// file in pieces that overlap by more than that, and finds a key that straddles two pieces (tests/scan.test.mjs checks
-// each pattern's longest match against it). The bounds are far past any real key's length (a JWT with a large payload,
-// a long secret pasted into code), so bounding a pattern never lets one through that an unbounded one caught.
+// Every pattern runs in time linear in the file, as xgames.fun's own scan does: every run has an upper bound, nothing
+// optional repeats inside a repeat, a look-behind reads a few characters at most, and a pattern that starts inside a run
+// of the characters it then reads (a JWT, an RPC URL's host) starts only where that run begins, so a long run is read once
+// rather than once for each place it could start (tests/scan.test.mjs times each on 4 MiB of text written to hold it
+// up). No match is longer than MAX_MATCH characters, so the scan reads a big file in pieces that overlap by more than
+// that, and finds a key that straddles two pieces (tests/scan.test.mjs checks each pattern's longest match against it).
+// Each pattern xgames.fun's own scan has is here as it is there, with the same bounds, so the kit refuses what the
+// host refuses, and nothing the host would publish (tests/scan.test.mjs holds the *_SECRET literal's bounds to it).
+// Three are the kit's own, for the key formats it writes itself (a signing key's seed, a {pub, seed} key file, secret
+// key bytes in code): the host does not read those, and a publish that carries one is refused here first.
 
-/** The longest text any pattern here can match (the JWT's: 4,096 + 16,384 + 2,048 and its marks). */
-export const MAX_MATCH = 32 * 1024;
+/** The longest text any pattern here can match (the JWT's: 8,192 + 16,384 + 8,192 and its marks). */
+export const MAX_MATCH = 40 * 1024;
 
 /**
  * [kind, pattern]. Each kind is the words a refusal names it by. The last, 'JSON web token', is any JWT: the publish
  * scan reads a JWT's role instead (a Supabase anon key is public by design), and the kit replaces it the same way.
  */
 export const SECRET_PATTERNS = [
-  ['private key block', /-----BEGIN (?:[A-Z]{1,20} )?PRIVATE KEY-----/],
+  ['private key block', /-----BEGIN (?:[A-Z]{1,32} )?PRIVATE KEY-----/],
   // not inside a word or a class name (style-sk-aria-pressed): a key stands on its own
   [
     'OpenAI or Anthropic key',
-    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,500}|[A-Za-z0-9]{32,500})/,
+    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,256}|[A-Za-z0-9]{32,256})/,
   ],
-  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,500}/],
+  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,256}/],
   ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
-  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,500}|github_pat_[A-Za-z0-9_]{30,500})/],
-  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,500}/],
+  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,256}|github_pat_[A-Za-z0-9_]{30,256})/],
+  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,256}/],
   ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
-  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,500}/],
-  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,500}/],
-  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,500}/],
-  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]{1,200}:[^\s@/'"]{1,200}@/i],
-  ['xgames.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,500}/],
+  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,256}/],
+  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,256}/],
+  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,256}/],
+  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]{1,256}:[^\s@/'"]{1,256}@/i],
+  ['xgames.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,256}/],
   // providers whose keys have a shape of their own (each prefix, length and alphabet as the provider issues them)
-  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,500}\b/],
+  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,256}\b/],
   ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
-  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,500}/],
+  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,256}/],
   ['SendGrid key', /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/],
-  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,500}/],
+  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,256}/],
   ['Shopify token', /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/],
   ['Google OAuth client secret', /\bGOCSPX-[A-Za-z0-9_-]{28}\b/],
   ['DigitalOcean token', /\bdo[opr]_v1_[a-f0-9]{64}\b/],
   ['Telegram bot token', /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/],
-  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key
+  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key. The host is
+  // read only from where it starts (right after the scheme) and up to a DNS name's 253 characters; helius's key is in
+  // the query, at most 512 characters along
   [
     'an RPC URL with its key (helius, alchemy, quicknode, infura)',
-    /https?:\/\/[^\s"'`]{0,1000}(?:helius-rpc\.com[^\s"'`]{0,300}[?&]api-key=[A-Za-z0-9-]{16,200}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,200}|\.quiknode\.pro\/[A-Za-z0-9]{20,200}|\.infura\.io\/v3\/[a-f0-9]{32})/,
+    /https?:\/\/[A-Za-z0-9.-]{0,253}(?:helius-rpc\.com[^\s"'`]{0,512}?[?&]api-key=[A-Za-z0-9-]{16,256}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,256}|\.quiknode\.pro\/[A-Za-z0-9]{20,256}|\.infura\.io\/v3\/[a-f0-9]{32})/,
   ],
   [
     'a Solana keypair in code (fromSecretKey)',
-    /\bfromSecretKey\s{0,20}\(\s{0,20}(?:(?:new\s{1,20}Uint8Array|Uint8Array\.from|bs58\.decode)\s{0,20}\(\s{0,20})?[["'`]/,
+    /\bfromSecretKey\s{0,16}\(\s{0,16}(?:(?:new\s{1,16}Uint8Array|Uint8Array\.from|bs58\.decode)\s{0,16}\(\s{0,16})?[["'`]/,
   ],
   [
     'secret assigned a literal',
-    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText'); the value is its first group
-    /(?<!\?\s*["']?)\b[A-Za-z0-9_]{0,100}(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]{0,100}["']?\s{0,20}[:=]\s{0,20}["']([A-Za-z0-9+/_=.-]{16,16384})["']/i,
+    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText'), the spaces looked back over up to 16
+    // (unbounded, the look-behind read every space before every place in a file of spaces); the value is its first group
+    /(?<!\?\s{0,16}["']?)\b[A-Za-z0-9_]{0,64}(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]{0,64}["']?\s{0,16}[:=]\s{0,16}["']([A-Za-z0-9+/_=.-]{16,1024})["']/i,
   ],
   // a signing key's 32-byte seed in hex, by its name (VOUCHER_SEED=…, voucherSeed: '…'): xcore add vouchers' format
   [
@@ -71,6 +80,7 @@ export const SECRET_PATTERNS = [
   ],
   // never touching + / = : those break up base64 data (an inlined picture), where a run of base58 letters is chance
   ['Solana secret key (base58)', /(?<![A-Za-z0-9+/])[1-9A-HJ-NP-Za-km-z]{86,90}(?![A-Za-z0-9+/=])/],
-  // header, payload (16K: a token with many claims), signature (an RS512 one with a 8192-bit key is 1,366)
-  ['JSON web token', /\beyJ[A-Za-z0-9_-]{10,4096}\.eyJ[A-Za-z0-9_-]{10,16384}\.[A-Za-z0-9_-]{16,2048}/],
+  // header, payload (16K: a token with many claims), signature (an RS512 one with a 8192-bit key is 1,366); it starts
+  // where its run of base64url letters starts, never at an "eyJ" inside one
+  ['JSON web token', /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,8192}\.eyJ[A-Za-z0-9_-]{10,16384}\.[A-Za-z0-9_-]{16,8192}/],
 ];

package/lib/server/bundle.mjs

@@ -2,10 +2,15 @@
 // into one ES module, and the same checks run for the kit's dev server, `xcore publish --check` and the publish itself:
 //   - it builds (an import that does not resolve, a syntax error: esbuild's own words, with the file and line);
 //   - every file it reads is inside the game folder (a game's own node_modules counts), never the kit or the machine;
-//   - Node built-ins only with nodejs_compat on (gamesfun.json), as `node:<name>`, left for the runtime; those it does
-//     not give a Worker (node:fs, child_process, vm, …: contract.mjs NODE_REFUSED) refuse it;
-//   - no code made from text at run time: eval, new Function, a dynamic import() of anything but a literal path,
-//     importScripts (a Worker refuses them anyway; here the person reads where);
+//   - no Node built-ins (xgames.fun offers no nodejs_compat: contract.mjs ALLOWED_FLAGS), named in words;
+//   - what xgames.fun refuses in a bundle: an import, a re-export or an import() of a module that opens raw sockets or
+//     loads modules by name (contract.mjs SOCKET_MODULES), and an import() of anything but a plain string, which could
+//     name any module at run time. The verdict is the bundle's, as xgames.fun reads the bundle it is sent: the bundle
+//     the kit would send is read again by esbuild's own parser (bundleImports; never by searching its text), so code
+//     esbuild leaves out (a package's export the game never uses) refuses nothing. Each refusal names the file that
+//     has the import, as esbuild saw it while bundling;
+//   - no code made from text at run time: eval, new Function, importScripts (a Worker refuses them anyway; here the
+//     person reads where);
 //   - no secrets: the publish scan (../publish/scan.mjs) over each server file and over the bundle;
 //   - a default export (the Worker), and each room class gamesfun.json declares exported by that name;
 //   - the size: xgames.fun's cap (5 MB, the wasm included), with a word above 1 MB;
@@ -25,11 +30,11 @@ import { codeOnly, dataCallLine, ownerlessDataCalls } from './data-calls.mjs';
 import {
   CONFIG_FILE,
   LIMITS,
-  NODE_REFUSED,
   OLD_DEFAULT_RULES,
   OWNER_SPACES,
   readServerConfig,
   BUNDLE_NAME,
+  socketModule,
   usesFiles,
 } from './contract.mjs';
 
@@ -79,15 +84,86 @@ const NODE_BUILTINS = new Set([
   'worker_threads',
   'zlib',
 ]);
-/** Code made from text at run time: [what, pattern]. Matched in each file the bundle reads. */
+/**
+ * Code made from text at run time: [what, pattern]. Matched in each file the bundle reads. (An import() of a name made
+ * at run time is read by the parse instead: refusedImports below.)
+ */
 export const FORBIDDEN = [
   ['eval()', /(?<![.\w$])eval\s*\(/],
   ['new Function()', /\bnew\s+Function\s*\(/],
-  ['a dynamic import() of a computed path', /(?<![.\w$])import\s*\(\s*(?!['"`]|\))/],
-  // a string built at run time: import('./' + name), import(`./${name}`)
-  ['a dynamic import() of a computed path', /(?<![.\w$])import\s*\(\s*(?:(['"])[^'"\n]*\1\s*\+|`[^`]*\$\{)/],
   ['importScripts()', /(?<![.\w$])importScripts\s*\(/],
 ];
+/** esbuild's word for an import() it cannot bundle because its argument is not a plain string. */
+const COMPUTED_IMPORT = 'unsupported-dynamic-import';
+/** A string literal in printed code: "…" or '…' (never a template: the host's parse reads only these as plain). */
+const STRING = /^\s*("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')\s*,/;
+const unquote = q => {
+  try {
+    return JSON.parse(q[0] === '"' ? q : `"${q.slice(1, -1).replace(/\\'/g, "'").replace(/"/g, '\\"')}"`);
+  } catch {
+    return null;
+  }
+};
+/**
+ * An import() esbuild did not bundle (its warning, `w`), read at its place: → {module} when its first argument is a
+ * plain string after all (an import() with a second argument esbuild does not take, such as `{}`), else {computed}.
+ */
+function unbundled(w) {
+  const text = w.location?.lineText ?? '',
+    col = w.location?.column ?? 0;
+  const at = text.slice(col).startsWith('import') ? col : text.lastIndexOf('import', col);
+  const m = at >= 0 ? /^import\s*\(/.exec(text.slice(at)) : null;
+  const lit = m ? STRING.exec(text.slice(at + m[0].length)) : null;
+  const value = lit ? unquote(lit[1]) : null;
+  return typeof value === 'string' ? { module: value } : { computed: true };
+}
+
+/**
+ * The imports a bundle (its bytes) still has, read by esbuild's parser as xgames.fun's parse reads them: → {modules:
+ * Set of what is imported (statically, as a re-export or by import() of a plain string, as written), computed: the
+ * number of import() calls of anything else}. null when it cannot be read (then nothing is taken off what the build saw).
+ */
+export async function bundleImports(build, code) {
+  const modules = new Set();
+  let computed = 0;
+  try {
+    const r = await build({
+      stdin: { contents: new TextDecoder().decode(code), loader: 'js', sourcefile: BUNDLE_NAME },
+      bundle: true,
+      write: false,
+      format: 'esm',
+      platform: 'neutral',
+      logLevel: 'silent',
+      logOverride: { [COMPUTED_IMPORT]: 'warning' },
+      plugins: [
+        {
+          name: 'gf-bundle-imports',
+          setup(b) {
+            b.onResolve({ filter: /.*/ }, a => {
+              if (a.kind === 'import-statement' || a.kind === 'dynamic-import') modules.add(a.path);
+              return { path: a.path, external: true };
+            });
+          },
+        },
+      ],
+    });
+    for (const w of r.warnings)
+      if (w.id === COMPUTED_IMPORT) {
+        const u = unbundled(w);
+        if (u.computed) computed++;
+        else modules.add(u.module);
+      }
+  } catch {
+    return null;
+  }
+  return { modules, computed };
+}
+/** What xgames.fun refuses, said where it is: a socket module. */
+const socketWords = (where, mod) =>
+  `${where} imports ${mod}, which opens raw network connections or loads modules by name: xgames.fun refuses a server that can (a game's server reaches the network with fetch() only). Take out what needs it (a database driver, a mail or chat client) and call a service over fetch() instead`;
+/** … and an import() of a name made at run time. */
+const computedWords = where =>
+  `${where} imports a module named at run time (import() of something other than a plain string): xgames.fun refuses it, since it could load any module. Import each module by its own name (import('./levels/forest.js')), or a path esbuild can list (import(\`./levels/\${name}.js\`) bundles every file there)`;
 
 const sha256 = b => createHash('sha256').update(b).digest('hex');
 const lineAt = (text, i) => text.slice(0, i).split('\n').length;
@@ -135,7 +211,6 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   const root = path.resolve(dir);
   const cfg = await readServerConfig(root);
   if (!cfg.has) return { has: false, problems: cfg.problems };
-  const nodeCompat = cfg.compatibilityFlags.includes('nodejs_compat');
   const out = {
     has: true,
     ok: false,
@@ -158,6 +233,27 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   const { build } = await loadEsbuild();
   if (cfg.stock) return bundleStock(build, out, { minify });
   const refusedImports = [];
+  const rel = p => path.relative(root, path.resolve(root, p)).replace(/\\/g, '/');
+  // what the build saw import a socket module or a Node built-in, by module: [the words for each file that has it].
+  // Only a module the bundle still imports refuses it (below): esbuild leaves out what nothing uses.
+  const seen = new Map();
+  const saw = (mod, line) => {
+    const lines = seen.get(mod) ?? [];
+    if (!lines.includes(line)) lines.push(line);
+    seen.set(mod, lines);
+  };
+  const sockets = {
+    name: 'gf-server-sockets',
+    setup(b) {
+      b.onResolve({ filter: /.*/ }, args => {
+        if (args.kind !== 'import-statement' && args.kind !== 'dynamic-import') return undefined;
+        const mod = socketModule(args.path);
+        if (!mod) return undefined;
+        saw(mod, socketWords(rel(args.importer), mod));
+        return { path: args.path, external: true };
+      });
+    },
+  };
   // compiled wasm: its own module, never inlined (the runtime can't compile wasm from bytes)
   const wasmFiles = new Map(); // name → absolute path
   const wasm = {
@@ -182,36 +278,31 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
       });
     },
   };
-  // Node's built-ins: only as nodejs_compat gives them (§3), named in words, never a bare name esbuild cannot find
+  // Node's built-ins: a game's server has none (xgames.fun offers no nodejs_compat), named in words, never a bare name
+  // esbuild cannot find
   const guard = {
     name: 'gf-server-node',
     setup(b) {
       b.onResolve({ filter: /^node:|^[a-z_]+(\/[a-z_]+)?$/ }, args => {
         const bare = args.path.replace(/^node:/, '');
         if (!args.path.startsWith('node:') && !NODE_BUILTINS.has(bare)) return undefined; // a package of the game's own
-        const where = path.relative(root, args.importer).replace(/\\/g, '/');
-        if (!args.path.startsWith('node:'))
-          refusedImports.push(
-            `${where} imports "${args.path}": write "node:${bare}"${nodeCompat ? '' : ', and turn on nodejs_compat in gamesfun.json (server.compatibilityFlags: ["nodejs_compat"])'}`,
-          );
-        else if (!nodeCompat)
-          refusedImports.push(
-            `${where} imports ${args.path}: Node's built-ins need nodejs_compat (gamesfun.json server.compatibilityFlags: ["nodejs_compat"]); or use the Web APIs (fetch, crypto.subtle, URL, TextEncoder)`,
-          );
-        else if (NODE_REFUSED.includes(bare))
-          refusedImports.push(
-            `${where} imports ${args.path}: the hosted runtime (a Worker) does not have it. Keep data in env.GF (saves, scores) or a Durable Object's storage, and use the Web APIs (fetch, crypto.subtle, URL)`,
-          );
-        return { path: args.path.startsWith('node:') ? args.path : `node:${bare}`, external: true };
+        saw(
+          `node:${bare}`,
+          `${rel(args.importer)} imports ${JSON.stringify(args.path)}, one of Node's built-in modules, which a game's server on xgames.fun does not have. Use the Web APIs a Worker has: fetch, crypto.subtle and crypto.getRandomValues, URL, TextEncoder and TextDecoder, Response; keep data in env.GF (saves, scores), a database or a Durable Object's storage`,
+        );
+        return { path: `node:${bare}`, external: true };
       });
     },
   };
   let result;
   try {
     result = await build({
-      ...buildOptions(path.join(root, cfg.entry), { minify, nodeCompat }),
+      ...buildOptions(path.join(root, cfg.entry), { minify }),
       absWorkingDir: root,
-      plugins: [guard, wasm],
+      plugins: [sockets, guard, wasm],
+      // an import() esbuild cannot bundle (its argument is not a plain string) stays in the bundle, where xgames.fun
+      // refuses it: said as a warning with its file and line, in a package's code too
+      logOverride: { [COMPUTED_IMPORT]: 'warning' },
     });
   } catch (e) {
     for (const m of e.errors ?? [{ text: e.message }])
@@ -220,6 +311,26 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
       );
     return out;
   }
+  // the bundle as it would be sent, read as xgames.fun reads it: only what it still imports is refused
+  const kept = await bundleImports(build, result.outputFiles[0].contents);
+  const keptMods = kept ? new Set([...kept.modules].map(m => socketModule(m) ?? m)) : null;
+  // a plain-string import() esbuild did not take (a second argument it does not read) is an import of that module
+  const computedAt = [];
+  for (const w of result.warnings ?? [])
+    if (w.id === COMPUTED_IMPORT) {
+      const where = w.location ? `${rel(w.location.file)}:${w.location.line}` : 'server/';
+      const u = unbundled(w);
+      if (u.computed) computedAt.push(where);
+      else if (socketModule(u.module)) saw(socketModule(u.module), socketWords(where, socketModule(u.module)));
+    }
+  for (const [mod, lines] of seen) if (!keptMods || keptMods.has(mod)) refusedImports.push(...lines);
+  if (kept) {
+    // a module the bundle imports that the build never named (not expected; said for the bundle)
+    for (const mod of keptMods)
+      if (socketModule(mod) && !seen.has(mod)) refusedImports.push(socketWords(`the server bundle`, mod));
+    if (kept.computed)
+      refusedImports.push(...(computedAt.length ? computedAt : ['the server bundle']).map(computedWords));
+  } else refusedImports.push(...computedAt.map(computedWords));
   out.problems.push(...refusedImports);
   const inputs = Object.keys(result.metafile.inputs).filter(p => !/^(cloudflare|node):/.test(p));
   for (const p of inputs) {
@@ -320,7 +431,7 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   // here would see it. Read in an unminified pass, where each export's declaration is its own line.
   const others = out.exports.filter(n => n !== 'default' && !cfg.objects.some(o => o.class === n));
   if (others.length) {
-    const plain = await plainExports(build, path.join(root, cfg.entry), root, nodeCompat).catch(() => []);
+    const plain = await plainExports(build, path.join(root, cfg.entry), root).catch(() => []);
     for (const { name, value } of plain.filter(x => others.includes(x.name)))
       out.problems.push(
         `${cfg.entry} exports ${name} = ${value}: the hosted runtime takes only functions, classes and objects as a server's exports, and refuses to start a server with a plain value. Keep ${name} unexported (or in a module the server imports)`,

package/lib/server/contract.mjs

@@ -21,8 +21,15 @@
 //              env.<binding>   a Durable Object namespace for each declared object, SQLite storage
 //              env.GF_GAME_ID, env.GF_SLUG, env.GF_CONTRACT   plain text
 //              env.<database.binding>   the game's D1 database, when gamesfun.json has a database (env.DB)
-//   Runtime:   Workers, compatibility date 2025-06-01; nodejs_compat only when gamesfun.json asks for it
-//   Outbound:  fetch() reaches only backend.json's origins and xgames.fun's (hosted; not enforced on this machine)
+//   Runtime:   Workers, compatibility date 2025-06-01; no compatibility flags (nodejs_compat is not offered: the host
+//              refuses a publish that asks for it)
+//   Outbound:  backend.json's origins (and xgames.fun's) are the list for the fetch() calls the entry makes while it
+//              answers a request (hosted; not enforced on this machine); nothing else is promised of it. No number of
+//              calls out a request is promised. A bundle that can open a raw socket is refused (SOCKET_MODULES,
+//              ./bundle.mjs).
+//   Off:       an unpublished, taken-down or capped game's server is switched off: every request answers 451
+//              {error: 'stopped', reason}, alarms lapse and sockets close (a running room within about five minutes);
+//              its Durable Objects' data is kept, and it comes back when the game is published again or the cap lifts.
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
@@ -34,8 +41,37 @@ export const DEFAULT_ENTRY = 'server/index.js';
 export const SERVER_DIR = 'server';
 /** The runtime the hosted script runs on (xgames.fun's upload and its local parity use these). */
 export const COMPATIBILITY_DATE = '2025-06-01';
-/** The only compatibility flag a game may ask for (gamesfun.json server.compatibilityFlags). */
-export const ALLOWED_FLAGS = Object.freeze(['nodejs_compat']);
+/**
+ * The compatibility flags a game may ask for (gamesfun.json server.compatibilityFlags): none. nodejs_compat is not
+ * offered: with Node's built-in modules a server can open raw network connections in ways a check at publish cannot
+ * see, so xgames.fun refuses a publish that asks for it.
+ */
+export const ALLOWED_FLAGS = Object.freeze([]);
+/** What a gamesfun.json that asks for nodejs_compat is told. */
+export const NODE_COMPAT_REFUSED = `${CONFIG_FILE} server.compatibilityFlags asks for "nodejs_compat", which xgames.fun does not offer: with Node's built-in modules a server can open raw network connections, so a publish that asks for it is refused. Take it out ("compatibilityFlags": []) and use the Web APIs a Worker has (fetch, crypto.subtle, URL, TextEncoder, Response); a package that needs node:… does not run on xgames.fun`;
+/**
+ * Modules a game's server may not import (statically, as a re-export or with import()), with or without `node:`: they
+ * open raw network connections (TCP, TLS, UDP, HTTP/2 over a socket) or load other modules by name. The host parses
+ * every module of the bundle and refuses one that imports them, and one with an import() of anything but a plain string
+ * (it could name any module at run time). A game's server reaches the network with fetch() only.
+ */
+export const SOCKET_MODULES = Object.freeze([
+  'cloudflare:sockets',
+  'node:net',
+  'node:tls',
+  'node:dgram',
+  'node:http2',
+  'node:module',
+  'node:child_process',
+]);
+const SOCKET_NAMES = new Set(SOCKET_MODULES.flatMap(m => (m.startsWith('node:') ? [m, m.slice(5)] : [m])));
+/** The socket module an import names, as the runtime would resolve it (no query or fragment, any case); else null. */
+export const socketModule = spec => {
+  const s = String(spec)
+    .replace(/[?#].*$/, '')
+    .toLowerCase();
+  return SOCKET_NAMES.has(s) ? (s.includes(':') ? s : `node:${s}`) : null;
+};
 export const ROUTES = '/api/*';
 /** The keys gamesfun.json → server takes. */
 export const SERVER_KEYS = Object.freeze(['main', 'objects', 'routes', 'compatibilityFlags']);
@@ -57,8 +93,8 @@ export const reservedBinding = b => b === 'GF' || b.startsWith('GF_');
 export const API_PREFIX = '/api/';
 export const PLATFORM_PREFIX = '/platform/v1/';
 /**
- * Node built-ins nodejs_compat does not give a Worker at COMPATIBILITY_DATE (or gives only as a stub that throws):
- * an import of one is refused at bundle time with words, not left to fail on the first request hosted.
+ * Node built-ins nodejs_compat does not give a Worker at COMPATIBILITY_DATE (or gives only as a stub that throws). Kept
+ * for code that reads it: no game's server gets Node's built-ins now (ALLOWED_FLAGS), so every node: import is refused.
  */
 export const NODE_REFUSED = Object.freeze([
   'child_process',
@@ -82,7 +118,13 @@ export const NODE_REFUSED = Object.freeze([
 /**
  * env.GF, the platform binding (a Workers RPC service, entrypoint GameServices; locally ./gf-local.js). Every answer is
  * {ok: true, …} or {ok: false, code, why}; a refusal is an answer, never a throw.
- *   verifyPlayer(token)                  → {ok, sub, wallet | null, x: {id, handle} | null, lvl, exp (unix s)}
+ *   verifyPlayer(token)                  → {ok, sub, wallet | null, x: {id, handle} | null, lvl, exp (unix s),
+ *                                           (sub: the player's account, x:<X id>, or g:<id> for a Google account, an id
+ *                                           different in every game; never the wallet, which is its own claim and may be
+ *                                           null or change: data kept by wallet reads `wallet`)
+ *                                           banned?: {kind: 'ban' | 'hide', until: ms | null} | null}
+ *                                           (banned: the creator's ban on the player from the console; a token made
+ *                                           before the ban still verifies, so a server refuses kind 'ban' itself)
  *   saves.get(player, key = 'main')      → {ok, value | null, updatedAt}
  *   saves.put(player, key, value)        → {ok, bytes}                 (a JSON value, 64 KB; 16 keys a player)
  *   saves.delete(player, key)            → {ok, deleted}
@@ -93,7 +135,8 @@ export const NODE_REFUSED = Object.freeze([
  *                                          'server': the page's /platform/v1/scores submit is refused, 403
  *                                          server-only, and what the page wrote before is removed; board may be a
  *                                          pattern, 'daily-*' or '*': the rule for every board it names, to come too)
- *   scores.drop(board)                   → {ok, dropped, removed}      (the board gone: its place among the 16 free)
+ *   scores.drop(board)                   → {ok, dropped, removed}      (the board gone: its place among the plan's
+ *                                          boards free again: 8 on Free, 16 on Creator and Scale, PLAN_LIMITS)
  *   scores.top(board, {limit?, offset?}) → {ok, order, writer, entries: [{rank, player, name, score, at}]}
  *   scores.best(board, player)           → {ok, entry: {rank, score, name, at} | null}
  *   scores.remove(board, player)         → {ok, removed}
@@ -199,10 +242,49 @@ export const fileType = p => BY_EXTENSION[/\.([a-z0-9]+)$/i.exec(p)?.[1]?.toLowe
 
 /** Server code that calls env.GF.files (its sources, comments left out), which needs "files" in server.features. */
 export const usesFiles = code => /\bGF\s*\.\s*files\b|\bfiles\b[^;{}]*\}\s*=\s*[\w.]*\bGF\b/.test(code);
-/** The platform's per-game limits (xgames.fun platform/limits.mjs), the same here so a game fits both. */
+const MB = 1024 * 1024;
+const frozen = o => Object.freeze(Object.fromEntries(Object.entries(o).map(([k, v]) => [k, Object.freeze(v)])));
+/**
+ * The platform's numbers by the game's plan (xgames.fun's plan table; README "Its plan", `xcore plan` shows a published
+ * game's own): CPU a request, saves, scores, reads a minute, project files. A game is on Free unless it is in a paid
+ * slot (Creator) or granted Scale.
+ */
+export const PLAN_LIMITS = Object.freeze({
+  free: frozen({
+    cpuMs: 50,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 10 * MB, writesPerMinute: 600 },
+    scores: { boards: 8, rules: 16, entriesPerBoard: 10_000, submitsPerMinute: 600 },
+    reads: { perMinute: 1_200 },
+    files: { bytes: 100 * MB, fileBytes: 25 * MB },
+  }),
+  creator: frozen({
+    cpuMs: 200,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 1024 * MB, writesPerMinute: 12_000 },
+    scores: { boards: 16, rules: 32, entriesPerBoard: 1_000_000, submitsPerMinute: 6_000 },
+    reads: { perMinute: 12_000 },
+    files: { bytes: 10 * 1024 * MB, fileBytes: 25 * MB },
+  }),
+  scale: frozen({
+    cpuMs: 1_000,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 10 * 1024 * MB, writesPerMinute: 60_000 },
+    scores: { boards: 16, rules: 32, entriesPerBoard: 1_000_000, submitsPerMinute: 30_000 },
+    reads: { perMinute: 60_000 },
+    files: { bytes: 100 * 1024 * MB, fileBytes: 25 * MB },
+  }),
+});
+/**
+ * The platform's per-game limits that a single number stands for: the same on every plan, and, where a plan sets it
+ * (boards, rules), Free's, the plan every game starts on (PLAN_LIMITS has the others).
+ */
 export const PLATFORM_LIMITS = Object.freeze({
   saves: Object.freeze({ playerChars: 128, valueBytes: 64 * 1024, keysPerPlayer: 16 }),
-  scores: Object.freeze({ boards: 16, rules: 32, nameChars: 32, perPlayerEveryMs: 1000, topMax: 100 }),
+  scores: Object.freeze({
+    boards: PLAN_LIMITS.free.scores.boards,
+    rules: PLAN_LIMITS.free.scores.rules,
+    nameChars: 32,
+    perPlayerEveryMs: 1000,
+    topMax: 100,
+  }),
   loot: Object.freeze({ winners: 16 }),
 });
 /** A save key or a board name. */
@@ -671,9 +753,10 @@ export async function readServerConfig(dir) {
       `${CONFIG_FILE} declares ${objects.length} Durable Object classes; a game's server may have ${LIMITS.objects}`,
     );
   const flags = srv.compatibilityFlags ?? [];
-  if (!Array.isArray(flags) || flags.some(f => !ALLOWED_FLAGS.includes(f)))
+  if (Array.isArray(flags) && flags.includes('nodejs_compat')) problems.push(NODE_COMPAT_REFUSED);
+  else if (!Array.isArray(flags) || flags.some(f => !ALLOWED_FLAGS.includes(f)))
     problems.push(
-      `${CONFIG_FILE} server.compatibilityFlags may hold only ${ALLOWED_FLAGS.map(f => JSON.stringify(f)).join(', ')}`,
+      `${CONFIG_FILE} server.compatibilityFlags must be an empty list: remove ${Array.isArray(flags) ? flags.map(f => JSON.stringify(f)).join(', ') : JSON.stringify(flags)} ("compatibilityFlags": []), since xgames.fun runs every game's server with none`,
     );
   const database = await readDatabaseConfig(dir, config, { objects, own: true });
   problems.push(...database.problems);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/xcore",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "xgames.fun from the command line: bring a web game you already made, check it as xgames.fun hosts it, give it a backend and a Solana economy, and publish it at a link anyone can play.",
   "keywords": [
     "game",
@@ -56,7 +56,7 @@
     "test": "node --test \"tests/**/*.test.mjs\""
   },
   "dependencies": {
-    "@xgamesfun/solana": "0.25.0",
+    "@xgamesfun/solana": "0.26.0",
     "esbuild": "0.28.2",
     "playwright-core": "1.63.0"
   },