@xgamesfun/xcore 0.3.0 → 0.4.0

package/lib/review.mjs

@@ -6,7 +6,8 @@
 //   the server    this package's own static reading of server/ and the page: PAY.check written or still the template,
 //                 one that pays from the request alone, VOUCHERS.payOnly against the grants, the voucher key and the
 //                 grants that name it, `trust` on each voucher grant, .dev.vars in git or in the published folder, a
-//                 seed in the page's files, and every api/ route the code names (for the live part).
+//                 seed in the page's files, a server of the game's own that does work before (or without) checking a
+//                 player's token, and every api/ route the code names (for the live part).
 //   live          (--live) each route asked with no sign-in and with a forged one, GET and POST; api/vouchers/key
 //                 against the grants' keys; the published economy file's `live` against this folder's. Read-only:
 //                 nothing it sends could spend or sign (a route that pays gets an empty body).
@@ -271,6 +272,217 @@ function gitState(dir, rel) {
 }
 
 const TEXT_CODE = /\.(m?js|cjs|jsx|tsx?|html?|svelte|vue|astro)$/i;
+
+// ---- Work done before a token is checked ----------------------------------------------------------------------------
+// A request with no good token is a stranger's, and the work a server does for strangers counts toward what caps the
+// game (a capped game's server is switched off until the month ends). So: check the token before any work. Read simply,
+// to say nothing that is not so, over the game's own server files (not the parts xcore writes, which check where they
+// must or are public by design), with comments and strings left out:
+//   work    a call to the platform's saves, scores, files or loot (env.GF.saves.get, env.GF?.saves?.get, through
+//           `const g = env.GF` or `const { GF } = env` too), a database, a Durable Object, or a fetch() out;
+//   a check env.GF.verifyPlayer, gf-db.js's withPlayer or a JWT library's jwtVerify, or a call to a function of the
+//           game's own that makes one (in any of its own files, through other functions of its own);
+//   not decided: a binding from a package whose name says it checks (a router's jwt or auth middleware): nothing is said.
+// Named when the game's own files do work and make no check anywhere (medium), and when the entry's fetch does work
+// before its first check (low: a public read there is fine, and the person decides), unless the only work is waking a
+// Durable Object whose class checks the token itself.
+/** The files xcore writes into server/ (lib/add.mjs), each checking a token where it must or public by design. */
+const XCORE_PARTS = new Set(['database.js', 'gf-docs.js', 'gf-db.js', 'rooms.js', 'rpc.js', 'vouchers.js']);
+const TOKEN_CHECK = /(?<![\w$])(?:verifyPlayer|withPlayer|jwtVerify)\s*(?:\?\.\s*)?\(/;
+const DOT = '\\s*\\??\\.\\s*';
+const CALL = '\\s*(?:\\?\\.\\s*)?\\(';
+/** The kinds of work, as patterns over code whose platform binding may also be called `gf` (its aliases). */
+const workPatterns = gf => [
+  ['saves', new RegExp(`(?<![\\w$])(?:${gf})${DOT}saves${DOT}[\\w$]+${CALL}`)],
+  ['scores', new RegExp(`(?<![\\w$])(?:${gf})${DOT}scores${DOT}[\\w$]+${CALL}`)],
+  ['files', new RegExp(`(?<![\\w$])(?:${gf})${DOT}files${DOT}[\\w$]+${CALL}`)],
+  ['loot', new RegExp(`(?<![\\w$])(?:${gf})${DOT}loot${DOT}[\\w$]+${CALL}`)],
+  [
+    'a database',
+    new RegExp(
+      `\\benv${DOT}[A-Z][A-Z0-9_]*${DOT}(?:prepare|batch|exec|dump)${CALL}|\\b(?:db|docsOf|dataOf)\\s*\\(\\s*env\\s*\\)`,
+    ),
+  ],
+  [
+    'a Durable Object',
+    new RegExp(`\\benv${DOT}[A-Z][A-Z0-9_]*${DOT}(?:get|idFromName|idFromString|newUniqueId|getByName)${CALL}`),
+  ],
+  ['a fetch out', /(?<![\w$.])fetch\s*\(/],
+];
+/** Code with every string and template literal blanked out (lengths and lines kept): a word there is never a call. */
+export function withoutStrings(code) {
+  let out = '';
+  for (let i = 0; i < code.length;) {
+    const c = code[i];
+    if (c !== '"' && c !== "'" && c !== '`') {
+      out += c;
+      i++;
+      continue;
+    }
+    let j = i + 1;
+    while (j < code.length && code[j] !== c && !(c !== '`' && code[j] === '\n')) j += code[j] === '\\' ? 2 : 1;
+    out += c + code.slice(i + 1, j).replace(/[^\n]/g, ' ') + (j < code.length ? c : '');
+    i = j + 1;
+  }
+  return out;
+}
+/** A method's own `fetch(…) {` taken out, so only calls remain. */
+const withoutFetchHandlers = code =>
+  code.replace(/\b(?:async\s+)?fetch\s*(?::\s*(?:async\s*)?(?:function\s*)?)?\(([^()]*)\)\s*(?:=>\s*)?\{/g, m =>
+    ' '.repeat(m.length),
+  );
+/** The names `env.GF` goes by in `code`: GF, and `const g = env.GF` aliases. → a pattern's alternatives */
+const gfNames = code =>
+  [
+    'GF',
+    ...[
+      ...code.matchAll(
+        /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:this\s*\.\s*)?env\s*\??\.\s*GF\b(?!\s*\??\.)/g,
+      ),
+    ].map(m => m[1]),
+  ]
+    .map(n => n.replace(/\$/g, '\\$'))
+    .join('|');
+/** The kinds of work `code` does, and where the first one is. → {kinds: [word], at} */
+function workIn(code, gf = 'GF') {
+  const c = withoutFetchHandlers(code);
+  const hits = workPatterns(gf)
+    .map(([what, re]) => [what, re.exec(c)?.index ?? -1])
+    .filter(([, at]) => at >= 0);
+  return { kinds: hits.map(([what]) => what), at: hits.length ? Math.min(...hits.map(([, at]) => at)) : -1 };
+}
+/** The functions (and methods) `code` defines: [{name, body}]. A body is its braces, or an arrow's line. */
+function definitions(code) {
+  const out = [];
+  const add = (name, from) => {
+    const brace = code.indexOf('{', from);
+    const eol = code.indexOf('\n', from);
+    const body =
+      brace >= 0 && (eol < 0 || brace < eol)
+        ? (braced(code, brace) ?? '')
+        : code.slice(from, eol < 0 ? undefined : eol);
+    out.push({ name, body });
+  };
+  for (const m of code.matchAll(/\bfunction\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/g)) add(m[1], m.index + m[0].length);
+  for (const m of code.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>)/g,
+  ))
+    add(m[1], m.index + m[0].length);
+  // methods of a class or an object literal (wherever they start: { async check(…) { … } }), and an object's
+  // arrow or function properties (check: async (…) => { … })
+  for (const m of code.matchAll(/(?:^|[{},;\s])(?:static\s+)?(?:async\s+)?\*?\s*([A-Za-z_$][\w$]*)\s*\([^()]*\)\s*\{/g))
+    if (!/^(?:if|for|while|switch|catch|function|return|fetch|with)$/.test(m[1])) add(m[1], m.index + m[0].length - 1);
+  for (const m of code.matchAll(
+    /(?:^|[{,\s])([A-Za-z_$][\w$]*)\s*:\s*(?:async\s*)?(?:function\b[^(]*\(|\(|[A-Za-z_$][\w$]*\s*=>)/g,
+  ))
+    if (m[1] !== 'fetch') add(m[1], m.index + m[0].length);
+  return out;
+}
+/** The names of the game's own functions that check a token, directly or through another of them. */
+function checkingFunctions(codes) {
+  const defs = codes.flatMap(definitions);
+  const names = new Set(defs.filter(d => TOKEN_CHECK.test(d.body)).map(d => d.name));
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const d of defs)
+      if (!names.has(d.name) && [...names].some(n => callOf(n).test(d.body))) {
+        names.add(d.name);
+        changed = true;
+      }
+  }
+  return names;
+}
+const callOf = name => new RegExp(`(?<![\\w$])${name.replace(/\$/g, '\\$')}\\s*(?:\\?\\.\\s*)?\\(`);
+/** Where the first check is in `code`: a token check, or a call to a checking function. → index or -1 */
+function firstCheck(code, checking) {
+  const at = [TOKEN_CHECK, ...[...checking].map(callOf)].map(re => re.exec(code)?.index ?? -1).filter(i => i >= 0);
+  return at.length ? Math.min(...at) : -1;
+}
+/** The default export's fetch body in comment-free code, or null. */
+function fetchBody(code) {
+  const start = /export\s+default\s*\{/.exec(code);
+  if (!start) return null;
+  const obj = braced(code, start.index + start[0].length - 1);
+  if (!obj) return null;
+  const m = /\b(?:async\s+)?fetch\s*(?::\s*(?:async\s*)?(?:function\s*)?)?\(([^()]*)\)\s*(?:=>\s*)?\{/.exec(obj);
+  return m ? braced(obj, m.index + m[0].length - 1) : null;
+}
+/**
+ * An import from a package that says it checks a sign-in (a router's jwt or auth middleware): a whole word of the
+ * package's name or path (auth, @scope/auth, x-auth, auth-kit, hono/jwt) or of a name it imports (jwt, requireAuth,
+ * verifyToken), never a word that only has one inside it (authority, authorName).
+ */
+const PACKAGE_IMPORT =
+  /\bimport\s+(?:([A-Za-z_$][\w$]*)\s*,?\s*)?(?:\{([^}]*)\}|\*\s*as\s+[A-Za-z_$][\w$]*)?\s*from\s*['"]((?![./])[^'"]+)['"]/g;
+const SIGN_IN_WORDS = new Set([
+  'auth',
+  'oauth',
+  'jwt',
+  'jose',
+  'bearer',
+  'session',
+  'verify',
+  'authenticate',
+  'authorize',
+]);
+/** A name's words: split at - _ . / @ and at CamelCase, lower case. */
+const wordsOfName = s =>
+  String(s)
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter(Boolean);
+const packageChecks = code =>
+  [...code.matchAll(PACKAGE_IMPORT)].some(m =>
+    [m[3], m[1] ?? '', ...(m[2] ?? '').split(',').map(x => x.trim().split(/\s+as\s+/)[0])].some(n =>
+      wordsOfName(n).some(w => SIGN_IN_WORDS.has(w)),
+    ),
+  );
+const TOKEN_WHY =
+  "The work a server does for a caller with no token counts toward what caps the game, and a capped game's server is switched off until the month ends.";
+const TOKEN_FIX =
+  'Check the game token before any work: answer 401 at once when the request has none, then const player = await env.GF.verifyPlayer(token) (it checks the token\'s signature, its audience and its expiry) and 401 when it is not ok; keep only what is truly public (a leaderboard read) before it (docs/SERVER.md, "Check the token first").';
+
+/** The findings for work done without, or before, a token check (see above). `files`: [{f, code (comments out), text}]. */
+function tokenFindings(dir, files, add) {
+  const own = files
+    .filter(({ f, text }) => !XCORE_PARTS.has(f) && !(f === 'index.js' && /Written by `xcore add/.test(text)))
+    .map(x => ({ ...x, bare: withoutStrings(x.code) }));
+  if (!own.length || own.some(x => packageChecks(x.code))) return; // not decided: nothing said
+  const working = own.map(x => ({ ...x, work: workIn(x.bare, gfNames(x.bare)) })).filter(x => x.work.kinds.length);
+  if (!working.length) return;
+  const checking = checkingFunctions(own.map(x => x.bare));
+  if (!own.some(x => TOKEN_CHECK.test(x.bare))) {
+    const names = working.map(x => `server/${x.f}`);
+    const kinds = [...new Set(working.flatMap(x => x.work.kinds))];
+    add(
+      'server-no-token-check',
+      'medium',
+      `${names.join(', ')} ${names.length === 1 ? 'does' : 'do'} work for every request (${kinds.join(', ')}) and never check${names.length === 1 ? 's' : ''} a player's token: anyone, signed in or not, can make it spend the game's allowance. ${TOKEN_WHY}`,
+      TOKEN_FIX,
+    );
+    return;
+  }
+  // the entry's fetch: work before its first check
+  const cfg = readJson(path.join(dir, 'gamesfun.json'));
+  const main = typeof cfg?.server?.main === 'string' ? cfg.server.main.replace(/^\.\//, '') : 'server/index.js';
+  const entry = own.find(x => `server/${x.f}` === main);
+  const body = entry ? fetchBody(entry.bare) : null;
+  if (!body) return;
+  const work = workIn(body, gfNames(entry.bare));
+  if (work.at < 0) return;
+  const check = firstCheck(body, checking);
+  if (check >= 0 && check < work.at) return;
+  // only a room woken, and the room's class checks the token itself: the room turns the stranger away
+  const rooms = own.filter(x => /\bextends\s+DurableObject\b/.test(x.bare));
+  if (work.kinds.every(k => k === 'a Durable Object') && rooms.some(x => firstCheck(x.bare, checking) >= 0)) return;
+  add(
+    'work-before-token',
+    'low',
+    `${main}'s fetch does work (${work.kinds.join(', ')}) before it checks a player's token${check < 0 ? ' (it checks none there itself)' : ''}: fine for what is truly public (a leaderboard read), but every stranger's request runs it. ${TOKEN_WHY}`,
+    TOKEN_FIX,
+  );
+}
 const OWN_COPIES = ['gf', 'gamesfun.js']; // xcore's and loot's copies in the page: not the game's own routes
 
 /**
@@ -291,11 +503,14 @@ export async function serverReview(dir, { spec = null, economy = null, available
     TEXT_CODE.test(f),
   );
   let serverCode = '';
+  const read = [];
   for (const f of serverFiles) {
     const text = await readFile(path.join(dir, 'server', f), 'utf8');
     serverCode += `\n${withoutComments(text)}`;
+    read.push({ f, code: withoutComments(text), text });
     for (const r of apiRoutes(text)) named(r, `server/${f}`);
   }
+  tokenFindings(dir, read, add);
   // A token checked by hand (a JWT library against <play host>/player/v1/key): every game's tokens are signed with the
   // one key, so a check that skips the audience takes a token any other game was given (a game a player signed in to,
   // whose creator then replays the token here). env.GF.verifyPlayer checks it; a hand-made check must name it.

package/lib/secret-patterns.mjs

@@ -1,58 +1,67 @@
 // Key-shaped strings: the one list of them. The publish scan (./publish/scan.mjs) reads every pattern here, and the
 // kit imports SECRET_PATTERNS for its own scanner. Pure: no imports.
 //
-// Every run in a pattern has an upper bound, so no match is longer than MAX_MATCH characters: the scan reads a big
-// file in pieces that overlap by more than that, and finds a key that straddles two pieces (tests/scan.test.mjs checks
-// each pattern's longest match against it). The bounds are far past any real key's length (a JWT with a large payload,
-// a long secret pasted into code), so bounding a pattern never lets one through that an unbounded one caught.
+// Every pattern runs in time linear in the file, as xgames.fun's own scan does: every run has an upper bound, nothing
+// optional repeats inside a repeat, a look-behind reads a few characters at most, and a pattern that starts inside a run
+// of the characters it then reads (a JWT, an RPC URL's host) starts only where that run begins, so a long run is read once
+// rather than once for each place it could start (tests/scan.test.mjs times each on 4 MiB of text written to hold it
+// up). No match is longer than MAX_MATCH characters, so the scan reads a big file in pieces that overlap by more than
+// that, and finds a key that straddles two pieces (tests/scan.test.mjs checks each pattern's longest match against it).
+// Each pattern xgames.fun's own scan has is here as it is there, with the same bounds, so the kit refuses what the
+// host refuses, and nothing the host would publish (tests/scan.test.mjs holds the *_SECRET literal's bounds to it).
+// Three are the kit's own, for the key formats it writes itself (a signing key's seed, a {pub, seed} key file, secret
+// key bytes in code): the host does not read those, and a publish that carries one is refused here first.
 
-/** The longest text any pattern here can match (the JWT's: 4,096 + 16,384 + 2,048 and its marks). */
-export const MAX_MATCH = 32 * 1024;
+/** The longest text any pattern here can match (the JWT's: 8,192 + 16,384 + 8,192 and its marks). */
+export const MAX_MATCH = 40 * 1024;
 
 /**
  * [kind, pattern]. Each kind is the words a refusal names it by. The last, 'JSON web token', is any JWT: the publish
  * scan reads a JWT's role instead (a Supabase anon key is public by design), and the kit replaces it the same way.
  */
 export const SECRET_PATTERNS = [
-  ['private key block', /-----BEGIN (?:[A-Z]{1,20} )?PRIVATE KEY-----/],
+  ['private key block', /-----BEGIN (?:[A-Z]{1,32} )?PRIVATE KEY-----/],
   // not inside a word or a class name (style-sk-aria-pressed): a key stands on its own
   [
     'OpenAI or Anthropic key',
-    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,500}|[A-Za-z0-9]{32,500})/,
+    /(?<![A-Za-z0-9_-])sk-(?:(?:proj|ant|svcacct|admin)-[A-Za-z0-9_-]{20,256}|[A-Za-z0-9]{32,256})/,
   ],
-  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,500}/],
+  ['Meshy key', /\bmsy_[A-Za-z0-9_-]{16,256}/],
   ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
-  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,500}|github_pat_[A-Za-z0-9_]{30,500})/],
-  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,500}/],
+  ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,256}|github_pat_[A-Za-z0-9_]{30,256})/],
+  ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,256}/],
   ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
-  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,500}/],
-  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,500}/],
-  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,500}/],
-  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]{1,200}:[^\s@/'"]{1,200}@/i],
-  ['xgames.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,500}/],
+  ['Stripe secret key', /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,256}/],
+  ['Supabase secret key', /\bsb_secret_[A-Za-z0-9_-]{16,256}/],
+  ['Supabase access token', /\bsbp_[A-Za-z0-9]{20,256}/],
+  ['database address with a password', /\bpostgres(?:ql)?:\/\/[^\s:@/'"]{1,256}:[^\s@/'"]{1,256}@/i],
+  ['xgames.fun publish token', /\bgfk_[A-Za-z0-9_-]{30,256}/],
   // providers whose keys have a shape of their own (each prefix, length and alphabet as the provider issues them)
-  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,500}\b/],
+  ['Hugging Face token', /\bhf_[A-Za-z0-9]{34,256}\b/],
   ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
-  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,500}/],
+  ['GitLab token', /\bglpat-[A-Za-z0-9_-]{20,256}/],
   ['SendGrid key', /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/],
-  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,500}/],
+  ['Stripe webhook secret', /\bwhsec_[A-Za-z0-9]{32,256}/],
   ['Shopify token', /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/],
   ['Google OAuth client secret', /\bGOCSPX-[A-Za-z0-9_-]{28}\b/],
   ['DigitalOcean token', /\bdo[opr]_v1_[a-f0-9]{64}\b/],
   ['Telegram bot token', /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/],
-  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key
+  // a game's page never holds an RPC URL (it calls its own /loot/v1/rpc): one with a key in it is that key. The host is
+  // read only from where it starts (right after the scheme) and up to a DNS name's 253 characters; helius's key is in
+  // the query, at most 512 characters along
   [
     'an RPC URL with its key (helius, alchemy, quicknode, infura)',
-    /https?:\/\/[^\s"'`]{0,1000}(?:helius-rpc\.com[^\s"'`]{0,300}[?&]api-key=[A-Za-z0-9-]{16,200}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,200}|\.quiknode\.pro\/[A-Za-z0-9]{20,200}|\.infura\.io\/v3\/[a-f0-9]{32})/,
+    /https?:\/\/[A-Za-z0-9.-]{0,253}(?:helius-rpc\.com[^\s"'`]{0,512}?[?&]api-key=[A-Za-z0-9-]{16,256}|\.alchemy\.com\/v2\/[A-Za-z0-9_-]{20,256}|\.quiknode\.pro\/[A-Za-z0-9]{20,256}|\.infura\.io\/v3\/[a-f0-9]{32})/,
   ],
   [
     'a Solana keypair in code (fromSecretKey)',
-    /\bfromSecretKey\s{0,20}\(\s{0,20}(?:(?:new\s{1,20}Uint8Array|Uint8Array\.from|bs58\.decode)\s{0,20}\(\s{0,20})?[["'`]/,
+    /\bfromSecretKey\s{0,16}\(\s{0,16}(?:(?:new\s{1,16}Uint8Array|Uint8Array\.from|bs58\.decode)\s{0,16}\(\s{0,16})?[["'`]/,
   ],
   [
     'secret assigned a literal',
-    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText'); the value is its first group
-    /(?<!\?\s*["']?)\b[A-Za-z0-9_]{0,100}(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]{0,100}["']?\s{0,20}[:=]\s{0,20}["']([A-Za-z0-9+/_=.-]{16,16384})["']/i,
+    // not the first branch of a ternary (cond ? 'MySecretsText' : 'OtherText'), the spaces looked back over up to 16
+    // (unbounded, the look-behind read every space before every place in a file of spaces); the value is its first group
+    /(?<!\?\s{0,16}["']?)\b[A-Za-z0-9_]{0,64}(?:SECRET|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_TOKEN|SERVICE_ROLE|PASSWORD)[A-Za-z0-9_]{0,64}["']?\s{0,16}[:=]\s{0,16}["']([A-Za-z0-9+/_=.-]{16,1024})["']/i,
   ],
   // a signing key's 32-byte seed in hex, by its name (VOUCHER_SEED=…, voucherSeed: '…'): xcore add vouchers' format
   [
@@ -71,6 +80,7 @@ export const SECRET_PATTERNS = [
   ],
   // never touching + / = : those break up base64 data (an inlined picture), where a run of base58 letters is chance
   ['Solana secret key (base58)', /(?<![A-Za-z0-9+/])[1-9A-HJ-NP-Za-km-z]{86,90}(?![A-Za-z0-9+/=])/],
-  // header, payload (16K: a token with many claims), signature (an RS512 one with a 8192-bit key is 1,366)
-  ['JSON web token', /\beyJ[A-Za-z0-9_-]{10,4096}\.eyJ[A-Za-z0-9_-]{10,16384}\.[A-Za-z0-9_-]{16,2048}/],
+  // header, payload (16K: a token with many claims), signature (an RS512 one with a 8192-bit key is 1,366); it starts
+  // where its run of base64url letters starts, never at an "eyJ" inside one
+  ['JSON web token', /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,8192}\.eyJ[A-Za-z0-9_-]{10,16384}\.[A-Za-z0-9_-]{16,8192}/],
 ];

package/lib/server/bundle.mjs

@@ -2,10 +2,15 @@
 // into one ES module, and the same checks run for the kit's dev server, `xcore publish --check` and the publish itself:
 //   - it builds (an import that does not resolve, a syntax error: esbuild's own words, with the file and line);
 //   - every file it reads is inside the game folder (a game's own node_modules counts), never the kit or the machine;
-//   - Node built-ins only with nodejs_compat on (gamesfun.json), as `node:<name>`, left for the runtime; those it does
-//     not give a Worker (node:fs, child_process, vm, …: contract.mjs NODE_REFUSED) refuse it;
-//   - no code made from text at run time: eval, new Function, a dynamic import() of anything but a literal path,
-//     importScripts (a Worker refuses them anyway; here the person reads where);
+//   - no Node built-ins (xgames.fun offers no nodejs_compat: contract.mjs ALLOWED_FLAGS), named in words;
+//   - what xgames.fun refuses in a bundle: an import, a re-export or an import() of a module that opens raw sockets or
+//     loads modules by name (contract.mjs SOCKET_MODULES), and an import() of anything but a plain string, which could
+//     name any module at run time. The verdict is the bundle's, as xgames.fun reads the bundle it is sent: the bundle
+//     the kit would send is read again by esbuild's own parser (bundleImports; never by searching its text), so code
+//     esbuild leaves out (a package's export the game never uses) refuses nothing. Each refusal names the file that
+//     has the import, as esbuild saw it while bundling;
+//   - no code made from text at run time: eval, new Function, importScripts (a Worker refuses them anyway; here the
+//     person reads where);
 //   - no secrets: the publish scan (../publish/scan.mjs) over each server file and over the bundle;
 //   - a default export (the Worker), and each room class gamesfun.json declares exported by that name;
 //   - the size: xgames.fun's cap (5 MB, the wasm included), with a word above 1 MB;
@@ -25,11 +30,11 @@ import { codeOnly, dataCallLine, ownerlessDataCalls } from './data-calls.mjs';
 import {
   CONFIG_FILE,
   LIMITS,
-  NODE_REFUSED,
   OLD_DEFAULT_RULES,
   OWNER_SPACES,
   readServerConfig,
   BUNDLE_NAME,
+  socketModule,
   usesFiles,
 } from './contract.mjs';
 
@@ -79,15 +84,86 @@ const NODE_BUILTINS = new Set([
   'worker_threads',
   'zlib',
 ]);
-/** Code made from text at run time: [what, pattern]. Matched in each file the bundle reads. */
+/**
+ * Code made from text at run time: [what, pattern]. Matched in each file the bundle reads. (An import() of a name made
+ * at run time is read by the parse instead: refusedImports below.)
+ */
 export const FORBIDDEN = [
   ['eval()', /(?<![.\w$])eval\s*\(/],
   ['new Function()', /\bnew\s+Function\s*\(/],
-  ['a dynamic import() of a computed path', /(?<![.\w$])import\s*\(\s*(?!['"`]|\))/],
-  // a string built at run time: import('./' + name), import(`./${name}`)
-  ['a dynamic import() of a computed path', /(?<![.\w$])import\s*\(\s*(?:(['"])[^'"\n]*\1\s*\+|`[^`]*\$\{)/],
   ['importScripts()', /(?<![.\w$])importScripts\s*\(/],
 ];
+/** esbuild's word for an import() it cannot bundle because its argument is not a plain string. */
+const COMPUTED_IMPORT = 'unsupported-dynamic-import';
+/** A string literal in printed code: "…" or '…' (never a template: the host's parse reads only these as plain). */
+const STRING = /^\s*("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')\s*,/;
+const unquote = q => {
+  try {
+    return JSON.parse(q[0] === '"' ? q : `"${q.slice(1, -1).replace(/\\'/g, "'").replace(/"/g, '\\"')}"`);
+  } catch {
+    return null;
+  }
+};
+/**
+ * An import() esbuild did not bundle (its warning, `w`), read at its place: → {module} when its first argument is a
+ * plain string after all (an import() with a second argument esbuild does not take, such as `{}`), else {computed}.
+ */
+function unbundled(w) {
+  const text = w.location?.lineText ?? '',
+    col = w.location?.column ?? 0;
+  const at = text.slice(col).startsWith('import') ? col : text.lastIndexOf('import', col);
+  const m = at >= 0 ? /^import\s*\(/.exec(text.slice(at)) : null;
+  const lit = m ? STRING.exec(text.slice(at + m[0].length)) : null;
+  const value = lit ? unquote(lit[1]) : null;
+  return typeof value === 'string' ? { module: value } : { computed: true };
+}
+
+/**
+ * The imports a bundle (its bytes) still has, read by esbuild's parser as xgames.fun's parse reads them: → {modules:
+ * Set of what is imported (statically, as a re-export or by import() of a plain string, as written), computed: the
+ * number of import() calls of anything else}. null when it cannot be read (then nothing is taken off what the build saw).
+ */
+export async function bundleImports(build, code) {
+  const modules = new Set();
+  let computed = 0;
+  try {
+    const r = await build({
+      stdin: { contents: new TextDecoder().decode(code), loader: 'js', sourcefile: BUNDLE_NAME },
+      bundle: true,
+      write: false,
+      format: 'esm',
+      platform: 'neutral',
+      logLevel: 'silent',
+      logOverride: { [COMPUTED_IMPORT]: 'warning' },
+      plugins: [
+        {
+          name: 'gf-bundle-imports',
+          setup(b) {
+            b.onResolve({ filter: /.*/ }, a => {
+              if (a.kind === 'import-statement' || a.kind === 'dynamic-import') modules.add(a.path);
+              return { path: a.path, external: true };
+            });
+          },
+        },
+      ],
+    });
+    for (const w of r.warnings)
+      if (w.id === COMPUTED_IMPORT) {
+        const u = unbundled(w);
+        if (u.computed) computed++;
+        else modules.add(u.module);
+      }
+  } catch {
+    return null;
+  }
+  return { modules, computed };
+}
+/** What xgames.fun refuses, said where it is: a socket module. */
+const socketWords = (where, mod) =>
+  `${where} imports ${mod}, which opens raw network connections or loads modules by name: xgames.fun refuses a server that can (a game's server reaches the network with fetch() only). Take out what needs it (a database driver, a mail or chat client) and call a service over fetch() instead`;
+/** … and an import() of a name made at run time. */
+const computedWords = where =>
+  `${where} imports a module named at run time (import() of something other than a plain string): xgames.fun refuses it, since it could load any module. Import each module by its own name (import('./levels/forest.js')), or a path esbuild can list (import(\`./levels/\${name}.js\`) bundles every file there)`;
 
 const sha256 = b => createHash('sha256').update(b).digest('hex');
 const lineAt = (text, i) => text.slice(0, i).split('\n').length;
@@ -135,7 +211,6 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   const root = path.resolve(dir);
   const cfg = await readServerConfig(root);
   if (!cfg.has) return { has: false, problems: cfg.problems };
-  const nodeCompat = cfg.compatibilityFlags.includes('nodejs_compat');
   const out = {
     has: true,
     ok: false,
@@ -158,6 +233,27 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   const { build } = await loadEsbuild();
   if (cfg.stock) return bundleStock(build, out, { minify });
   const refusedImports = [];
+  const rel = p => path.relative(root, path.resolve(root, p)).replace(/\\/g, '/');
+  // what the build saw import a socket module or a Node built-in, by module: [the words for each file that has it].
+  // Only a module the bundle still imports refuses it (below): esbuild leaves out what nothing uses.
+  const seen = new Map();
+  const saw = (mod, line) => {
+    const lines = seen.get(mod) ?? [];
+    if (!lines.includes(line)) lines.push(line);
+    seen.set(mod, lines);
+  };
+  const sockets = {
+    name: 'gf-server-sockets',
+    setup(b) {
+      b.onResolve({ filter: /.*/ }, args => {
+        if (args.kind !== 'import-statement' && args.kind !== 'dynamic-import') return undefined;
+        const mod = socketModule(args.path);
+        if (!mod) return undefined;
+        saw(mod, socketWords(rel(args.importer), mod));
+        return { path: args.path, external: true };
+      });
+    },
+  };
   // compiled wasm: its own module, never inlined (the runtime can't compile wasm from bytes)
   const wasmFiles = new Map(); // name → absolute path
   const wasm = {
@@ -182,36 +278,31 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
       });
     },
   };
-  // Node's built-ins: only as nodejs_compat gives them (§3), named in words, never a bare name esbuild cannot find
+  // Node's built-ins: a game's server has none (xgames.fun offers no nodejs_compat), named in words, never a bare name
+  // esbuild cannot find
   const guard = {
     name: 'gf-server-node',
     setup(b) {
       b.onResolve({ filter: /^node:|^[a-z_]+(\/[a-z_]+)?$/ }, args => {
         const bare = args.path.replace(/^node:/, '');
         if (!args.path.startsWith('node:') && !NODE_BUILTINS.has(bare)) return undefined; // a package of the game's own
-        const where = path.relative(root, args.importer).replace(/\\/g, '/');
-        if (!args.path.startsWith('node:'))
-          refusedImports.push(
-            `${where} imports "${args.path}": write "node:${bare}"${nodeCompat ? '' : ', and turn on nodejs_compat in gamesfun.json (server.compatibilityFlags: ["nodejs_compat"])'}`,
-          );
-        else if (!nodeCompat)
-          refusedImports.push(
-            `${where} imports ${args.path}: Node's built-ins need nodejs_compat (gamesfun.json server.compatibilityFlags: ["nodejs_compat"]); or use the Web APIs (fetch, crypto.subtle, URL, TextEncoder)`,
-          );
-        else if (NODE_REFUSED.includes(bare))
-          refusedImports.push(
-            `${where} imports ${args.path}: the hosted runtime (a Worker) does not have it. Keep data in env.GF (saves, scores) or a Durable Object's storage, and use the Web APIs (fetch, crypto.subtle, URL)`,
-          );
-        return { path: args.path.startsWith('node:') ? args.path : `node:${bare}`, external: true };
+        saw(
+          `node:${bare}`,
+          `${rel(args.importer)} imports ${JSON.stringify(args.path)}, one of Node's built-in modules, which a game's server on xgames.fun does not have. Use the Web APIs a Worker has: fetch, crypto.subtle and crypto.getRandomValues, URL, TextEncoder and TextDecoder, Response; keep data in env.GF (saves, scores), a database or a Durable Object's storage`,
+        );
+        return { path: `node:${bare}`, external: true };
       });
     },
   };
   let result;
   try {
     result = await build({
-      ...buildOptions(path.join(root, cfg.entry), { minify, nodeCompat }),
+      ...buildOptions(path.join(root, cfg.entry), { minify }),
       absWorkingDir: root,
-      plugins: [guard, wasm],
+      plugins: [sockets, guard, wasm],
+      // an import() esbuild cannot bundle (its argument is not a plain string) stays in the bundle, where xgames.fun
+      // refuses it: said as a warning with its file and line, in a package's code too
+      logOverride: { [COMPUTED_IMPORT]: 'warning' },
     });
   } catch (e) {
     for (const m of e.errors ?? [{ text: e.message }])
@@ -220,6 +311,26 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
       );
     return out;
   }
+  // the bundle as it would be sent, read as xgames.fun reads it: only what it still imports is refused
+  const kept = await bundleImports(build, result.outputFiles[0].contents);
+  const keptMods = kept ? new Set([...kept.modules].map(m => socketModule(m) ?? m)) : null;
+  // a plain-string import() esbuild did not take (a second argument it does not read) is an import of that module
+  const computedAt = [];
+  for (const w of result.warnings ?? [])
+    if (w.id === COMPUTED_IMPORT) {
+      const where = w.location ? `${rel(w.location.file)}:${w.location.line}` : 'server/';
+      const u = unbundled(w);
+      if (u.computed) computedAt.push(where);
+      else if (socketModule(u.module)) saw(socketModule(u.module), socketWords(where, socketModule(u.module)));
+    }
+  for (const [mod, lines] of seen) if (!keptMods || keptMods.has(mod)) refusedImports.push(...lines);
+  if (kept) {
+    // a module the bundle imports that the build never named (not expected; said for the bundle)
+    for (const mod of keptMods)
+      if (socketModule(mod) && !seen.has(mod)) refusedImports.push(socketWords(`the server bundle`, mod));
+    if (kept.computed)
+      refusedImports.push(...(computedAt.length ? computedAt : ['the server bundle']).map(computedWords));
+  } else refusedImports.push(...computedAt.map(computedWords));
   out.problems.push(...refusedImports);
   const inputs = Object.keys(result.metafile.inputs).filter(p => !/^(cloudflare|node):/.test(p));
   for (const p of inputs) {
@@ -320,7 +431,7 @@ export async function bundleServer(dir, { limits = LIMITS, minify = true } = {})
   // here would see it. Read in an unminified pass, where each export's declaration is its own line.
   const others = out.exports.filter(n => n !== 'default' && !cfg.objects.some(o => o.class === n));
   if (others.length) {
-    const plain = await plainExports(build, path.join(root, cfg.entry), root, nodeCompat).catch(() => []);
+    const plain = await plainExports(build, path.join(root, cfg.entry), root).catch(() => []);
     for (const { name, value } of plain.filter(x => others.includes(x.name)))
       out.problems.push(
         `${cfg.entry} exports ${name} = ${value}: the hosted runtime takes only functions, classes and objects as a server's exports, and refuses to start a server with a plain value. Keep ${name} unexported (or in a module the server imports)`,