@xgamesfun/xcore 0.3.0 → 0.4.0

package/lib/server/contract.mjs

@@ -21,8 +21,15 @@
 //              env.<binding>   a Durable Object namespace for each declared object, SQLite storage
 //              env.GF_GAME_ID, env.GF_SLUG, env.GF_CONTRACT   plain text
 //              env.<database.binding>   the game's D1 database, when gamesfun.json has a database (env.DB)
-//   Runtime:   Workers, compatibility date 2025-06-01; nodejs_compat only when gamesfun.json asks for it
-//   Outbound:  fetch() reaches only backend.json's origins and xgames.fun's (hosted; not enforced on this machine)
+//   Runtime:   Workers, compatibility date 2025-06-01; no compatibility flags (nodejs_compat is not offered: the host
+//              refuses a publish that asks for it)
+//   Outbound:  backend.json's origins (and xgames.fun's) are the list for the fetch() calls the entry makes while it
+//              answers a request (hosted; not enforced on this machine); nothing else is promised of it. No number of
+//              calls out a request is promised. A bundle that can open a raw socket is refused (SOCKET_MODULES,
+//              ./bundle.mjs).
+//   Off:       an unpublished, taken-down or capped game's server is switched off: every request answers 451
+//              {error: 'stopped', reason}, alarms lapse and sockets close (a running room within about five minutes);
+//              its Durable Objects' data is kept, and it comes back when the game is published again or the cap lifts.
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
@@ -34,8 +41,37 @@ export const DEFAULT_ENTRY = 'server/index.js';
 export const SERVER_DIR = 'server';
 /** The runtime the hosted script runs on (xgames.fun's upload and its local parity use these). */
 export const COMPATIBILITY_DATE = '2025-06-01';
-/** The only compatibility flag a game may ask for (gamesfun.json server.compatibilityFlags). */
-export const ALLOWED_FLAGS = Object.freeze(['nodejs_compat']);
+/**
+ * The compatibility flags a game may ask for (gamesfun.json server.compatibilityFlags): none. nodejs_compat is not
+ * offered: with Node's built-in modules a server can open raw network connections in ways a check at publish cannot
+ * see, so xgames.fun refuses a publish that asks for it.
+ */
+export const ALLOWED_FLAGS = Object.freeze([]);
+/** What a gamesfun.json that asks for nodejs_compat is told. */
+export const NODE_COMPAT_REFUSED = `${CONFIG_FILE} server.compatibilityFlags asks for "nodejs_compat", which xgames.fun does not offer: with Node's built-in modules a server can open raw network connections, so a publish that asks for it is refused. Take it out ("compatibilityFlags": []) and use the Web APIs a Worker has (fetch, crypto.subtle, URL, TextEncoder, Response); a package that needs node:… does not run on xgames.fun`;
+/**
+ * Modules a game's server may not import (statically, as a re-export or with import()), with or without `node:`: they
+ * open raw network connections (TCP, TLS, UDP, HTTP/2 over a socket) or load other modules by name. The host parses
+ * every module of the bundle and refuses one that imports them, and one with an import() of anything but a plain string
+ * (it could name any module at run time). A game's server reaches the network with fetch() only.
+ */
+export const SOCKET_MODULES = Object.freeze([
+  'cloudflare:sockets',
+  'node:net',
+  'node:tls',
+  'node:dgram',
+  'node:http2',
+  'node:module',
+  'node:child_process',
+]);
+const SOCKET_NAMES = new Set(SOCKET_MODULES.flatMap(m => (m.startsWith('node:') ? [m, m.slice(5)] : [m])));
+/** The socket module an import names, as the runtime would resolve it (no query or fragment, any case); else null. */
+export const socketModule = spec => {
+  const s = String(spec)
+    .replace(/[?#].*$/, '')
+    .toLowerCase();
+  return SOCKET_NAMES.has(s) ? (s.includes(':') ? s : `node:${s}`) : null;
+};
 export const ROUTES = '/api/*';
 /** The keys gamesfun.json → server takes. */
 export const SERVER_KEYS = Object.freeze(['main', 'objects', 'routes', 'compatibilityFlags']);
@@ -57,8 +93,8 @@ export const reservedBinding = b => b === 'GF' || b.startsWith('GF_');
 export const API_PREFIX = '/api/';
 export const PLATFORM_PREFIX = '/platform/v1/';
 /**
- * Node built-ins nodejs_compat does not give a Worker at COMPATIBILITY_DATE (or gives only as a stub that throws):
- * an import of one is refused at bundle time with words, not left to fail on the first request hosted.
+ * Node built-ins nodejs_compat does not give a Worker at COMPATIBILITY_DATE (or gives only as a stub that throws). Kept
+ * for code that reads it: no game's server gets Node's built-ins now (ALLOWED_FLAGS), so every node: import is refused.
  */
 export const NODE_REFUSED = Object.freeze([
   'child_process',
@@ -83,6 +119,9 @@ export const NODE_REFUSED = Object.freeze([
  * env.GF, the platform binding (a Workers RPC service, entrypoint GameServices; locally ./gf-local.js). Every answer is
  * {ok: true, …} or {ok: false, code, why}; a refusal is an answer, never a throw.
  *   verifyPlayer(token)                  → {ok, sub, wallet | null, x: {id, handle} | null, lvl, exp (unix s),
+ *                                           (sub: the player's account, x:<X id>, or g:<id> for a Google account, an id
+ *                                           different in every game; never the wallet, which is its own claim and may be
+ *                                           null or change: data kept by wallet reads `wallet`)
  *                                           banned?: {kind: 'ban' | 'hide', until: ms | null} | null}
  *                                           (banned: the creator's ban on the player from the console; a token made
  *                                           before the ban still verifies, so a server refuses kind 'ban' itself)
@@ -96,7 +135,8 @@ export const NODE_REFUSED = Object.freeze([
  *                                          'server': the page's /platform/v1/scores submit is refused, 403
  *                                          server-only, and what the page wrote before is removed; board may be a
  *                                          pattern, 'daily-*' or '*': the rule for every board it names, to come too)
- *   scores.drop(board)                   → {ok, dropped, removed}      (the board gone: its place among the 16 free)
+ *   scores.drop(board)                   → {ok, dropped, removed}      (the board gone: its place among the plan's
+ *                                          boards free again: 8 on Free, 16 on Creator and Scale, PLAN_LIMITS)
  *   scores.top(board, {limit?, offset?}) → {ok, order, writer, entries: [{rank, player, name, score, at}]}
  *   scores.best(board, player)           → {ok, entry: {rank, score, name, at} | null}
  *   scores.remove(board, player)         → {ok, removed}
@@ -202,10 +242,49 @@ export const fileType = p => BY_EXTENSION[/\.([a-z0-9]+)$/i.exec(p)?.[1]?.toLowe
 
 /** Server code that calls env.GF.files (its sources, comments left out), which needs "files" in server.features. */
 export const usesFiles = code => /\bGF\s*\.\s*files\b|\bfiles\b[^;{}]*\}\s*=\s*[\w.]*\bGF\b/.test(code);
-/** The platform's per-game limits (xgames.fun platform/limits.mjs), the same here so a game fits both. */
+const MB = 1024 * 1024;
+const frozen = o => Object.freeze(Object.fromEntries(Object.entries(o).map(([k, v]) => [k, Object.freeze(v)])));
+/**
+ * The platform's numbers by the game's plan (xgames.fun's plan table; README "Its plan", `xcore plan` shows a published
+ * game's own): CPU a request, saves, scores, reads a minute, project files. A game is on Free unless it is in a paid
+ * slot (Creator) or granted Scale.
+ */
+export const PLAN_LIMITS = Object.freeze({
+  free: frozen({
+    cpuMs: 50,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 10 * MB, writesPerMinute: 600 },
+    scores: { boards: 8, rules: 16, entriesPerBoard: 10_000, submitsPerMinute: 600 },
+    reads: { perMinute: 1_200 },
+    files: { bytes: 100 * MB, fileBytes: 25 * MB },
+  }),
+  creator: frozen({
+    cpuMs: 200,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 1024 * MB, writesPerMinute: 12_000 },
+    scores: { boards: 16, rules: 32, entriesPerBoard: 1_000_000, submitsPerMinute: 6_000 },
+    reads: { perMinute: 12_000 },
+    files: { bytes: 10 * 1024 * MB, fileBytes: 25 * MB },
+  }),
+  scale: frozen({
+    cpuMs: 1_000,
+    saves: { valueBytes: 64 * 1024, keysPerPlayer: 16, gameBytes: 10 * 1024 * MB, writesPerMinute: 60_000 },
+    scores: { boards: 16, rules: 32, entriesPerBoard: 1_000_000, submitsPerMinute: 30_000 },
+    reads: { perMinute: 60_000 },
+    files: { bytes: 100 * 1024 * MB, fileBytes: 25 * MB },
+  }),
+});
+/**
+ * The platform's per-game limits that a single number stands for: the same on every plan, and, where a plan sets it
+ * (boards, rules), Free's, the plan every game starts on (PLAN_LIMITS has the others).
+ */
 export const PLATFORM_LIMITS = Object.freeze({
   saves: Object.freeze({ playerChars: 128, valueBytes: 64 * 1024, keysPerPlayer: 16 }),
-  scores: Object.freeze({ boards: 16, rules: 32, nameChars: 32, perPlayerEveryMs: 1000, topMax: 100 }),
+  scores: Object.freeze({
+    boards: PLAN_LIMITS.free.scores.boards,
+    rules: PLAN_LIMITS.free.scores.rules,
+    nameChars: 32,
+    perPlayerEveryMs: 1000,
+    topMax: 100,
+  }),
   loot: Object.freeze({ winners: 16 }),
 });
 /** A save key or a board name. */
@@ -674,9 +753,10 @@ export async function readServerConfig(dir) {
       `${CONFIG_FILE} declares ${objects.length} Durable Object classes; a game's server may have ${LIMITS.objects}`,
     );
   const flags = srv.compatibilityFlags ?? [];
-  if (!Array.isArray(flags) || flags.some(f => !ALLOWED_FLAGS.includes(f)))
+  if (Array.isArray(flags) && flags.includes('nodejs_compat')) problems.push(NODE_COMPAT_REFUSED);
+  else if (!Array.isArray(flags) || flags.some(f => !ALLOWED_FLAGS.includes(f)))
     problems.push(
-      `${CONFIG_FILE} server.compatibilityFlags may hold only ${ALLOWED_FLAGS.map(f => JSON.stringify(f)).join(', ')}`,
+      `${CONFIG_FILE} server.compatibilityFlags must be an empty list: remove ${Array.isArray(flags) ? flags.map(f => JSON.stringify(f)).join(', ') : JSON.stringify(flags)} ("compatibilityFlags": []), since xgames.fun runs every game's server with none`,
     );
   const database = await readDatabaseConfig(dir, config, { objects, own: true });
   problems.push(...database.problems);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/xcore",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "xgames.fun from the command line: bring a web game you already made, check it as xgames.fun hosts it, give it a backend and a Solana economy, and publish it at a link anyone can play.",
   "keywords": [
     "game",
@@ -56,7 +56,7 @@
     "test": "node --test \"tests/**/*.test.mjs\""
   },
   "dependencies": {
-    "@xgamesfun/solana": "0.25.1",
+    "@xgamesfun/solana": "0.26.0",
     "esbuild": "0.28.2",
     "playwright-core": "1.63.0"
   },

package/skills/bring-your-own-game/SKILL.md

@@ -79,7 +79,9 @@ console errors, nothing missing, nothing from the root, something on screen), it
 screenshots in `evidence/verify-N/` and look at them. A failing check 4 names the origin and why: declare it in
 `backend.json` if the game really calls it, or remove the call. The page check does not say the game plays well:
 that is the person's own game; ask them what to try, and try it with `xcore dev <folder>` (the game as xgames.fun
-hosts it, with its server, sign-in, saves, rooms and economy RPC) or their own.
+hosts it, with its server, sign-in, saves, rooms and economy RPC, refusing what xgames.fun refuses on the Free plan;
+`--plan creator` for a Creator game) or their own. A refusal there (`rate`, `full`, `too-many`, `order`) is one the
+published game would get: fix the game, not the stand-in.
 
 ## 4. Players, a database, a backend (only when the game has or needs them)
 
@@ -111,7 +113,11 @@ supabase|railway` with the kit installed). Without the kit, they set one up them
   ([docs/SERVER.md](../../docs/SERVER.md)): a Worker on `/api/*`, Durable Objects for rooms, `env.GF` for sign-in, saves
   and scores. Their page calls it with a relative address (`fetch('api/scores')`): `/api/*` at the published origin,
   `/game/api/*` under `xcore dev`, which runs it under workerd with a local `env.GF`. A Node-only server stays on
-  their own host.
+  their own host, and so does anything that opens raw sockets (a database driver, a mail or chat client): xgames.fun
+  refuses `cloudflare:sockets`, `node:net` and the like, an `import()` of a name made at run time, and `nodejs_compat`.
+  Every route that does work checks the player's token first (`env.GF.verifyPlayer`; 401 at once without one): a
+  stranger's request that does work counts toward what caps the game. Key a player's data on `sub` (the account:
+  `x:…`, or `g:…` for Google, different in every game), never on the wallet; `wallet` is its own claim, maybe null.
 
 ## 5. An economy (only when they ask: tokens, NFTs, a shop, prizes, staking)
 
@@ -200,11 +206,14 @@ xcore publish <folder>          # or gamesfun_login, then gamesfun_publish {"gam
 ```
 
 It builds, runs the page check on exactly those files, uploads the published folder and the `server/` bundle. A failed
-check makes a private draft only. Tell them the link, what you changed in their files, what the checks proved and what
+check makes a private draft only. `xcore login` asks the person to tick, on xgames.fun's approval page, the games this
+computer may work on (or their whole account), and says which it got; a command refused with code `not-granted` means
+the sign-in was not given that game: they run `xcore login` again and tick it (never work around it). Tell them the link, what you changed in their files, what the checks proved and what
 nothing checked (their gameplay, their backend's own behaviour).
 
 A game with a `server/`, saves or scores runs under its **plan** (`xcore plan <folder>`): Free by default (50 ms of CPU
-and 600 requests a minute, $1 of use a month, then capped and slow until the month ends). When the game needs more
+and 600 requests a minute, $1 of use a month; past it the game is capped until the month ends: its server is switched
+off and saves and scores slow down). When the game needs more
 (a server that replays play, many players at once), tell them: a paid slot makes it Creator
 (`xcore plan activate <folder>` once they have one), and the paid slot moves between their games at any time. Everyone
 has 2 free slots: a third game is refused on publish (`no-free-slot`) until they archive one on their console