@zaisma/game-server 1.7.0 → 1.9.0

package/bin/node-parts.js

@@ -96,7 +96,8 @@ export function localDatabase(file) {
         statement.setReadBigInts(true);
         for (const row of statement.iterate(...values)) {
           if (rows.length >= DATABASE_LIMITS.maximumRowCount) throw tooManyRows();
-          rows.push(checkedRow(numbersFrom(row)));
+          // node:sqlite gives an INTEGER as a BigInt and a REAL as a number: a REAL as big as 1e20 is no whole number to refuse.
+          rows.push(checkedRow(numbersFrom(row), new Set(Object.entries(row).filter(([, columnValue]) => typeof columnValue === "number").map(([column]) => column))));
         }
         return rows;
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaisma/game-server",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "Run your Zaisma game server: the same rooms on Zaisma or on your own server.",
   "license": "MIT",
   "homepage": "https://zaisma.com",

package/sdk/saves.js

@@ -33,7 +33,7 @@
   // first, doubling up to 1,024 while a batch's text stays under 1 MB (games keep whole files as records).
   var FIRST_BATCH_RECORD_COUNT = 16;
   var MAXIMUM_BATCH_RECORD_COUNT = 1024;
-  var SMALL_BATCH_CHARACTER_COUNT = 1024 * 1024;
+  var SMALL_BATCH_BYTE_COUNT = 1024 * 1024;
 
   // Tests check the save format through this (test/node/saves.test.ts).
   if (__ZAISMA_SAVES__.test) return __ZAISMA_SAVES__.test({ encode: encode, decode: decode, saveText: saveText, putSave: putSave, readDatabases: readDatabases, databasesReader: databasesReader });
@@ -67,6 +67,17 @@
     return textOf(canonical(local), idbText);
   }
   // The same text as canonicalSave on the server: all three keys, always in this order.
+  /** Text's size in UTF-8 bytes, as the server counts a save against the limit, without encoding it. */
+  function byteLength(text) {
+    var byteCount = text.length;
+    for (var i = 0; i < text.length; i++) {
+      var code = text.charCodeAt(i);
+      if (code < 0x80) continue;
+      // Two bytes below U+0800, and each half of a surrogate pair (four bytes the pair); three for the rest.
+      byteCount += code < 0x800 || (code >= 0xd800 && code < 0xe000) ? 1 : 2;
+    }
+    return byteCount;
+  }
   function textOf(localText, idbText) {
     return '{"save_format_version_number":1,"local_storage_items":' + localText + ',"indexeddb_databases":' + (idbText || "[]") + "}";
   }
@@ -319,21 +330,23 @@
 
   /**
    * readNumberbText while the game plays: each store's text is kept, and a read only reads again the stores
-   * the game changed (changed: { isAll, databases: [name], stores: ["<database>\n<store>"] }), a batch of
-   * records at a time, stopping once the save passes maximumCharacterCount characters. The text is exactly
+   * the game changed (changed: { isAll, isCountCheck, databases: [name], stores: ["<database>\n<store>"] }), a batch
+   * of records at a time, stopping once the save passes maximumByteCount bytes (UTF-8, as the server counts).
+   * isCountCheck also reads again any database whose version, stores or record counts changed, which catches most
+   * writes the script can't watch (the game's own workers) without reading what didn't change. The text is exactly
    * readNumberbText's, put together from the kept parts. Answers { text } or { isOverLimit: true }.
    */
   function databasesReader() {
     // Database name -> { version, stores: { name: { text, hasRecords } } }
     var kept = {};
-    return function read(changed, maximumCharacterCount) {
+    return function read(changed, maximumByteCount) {
       var changedStores = {};
       changed.stores.forEach(function (storeKey) {
         changedStores[storeKey] = true;
       });
       return names().then(function (list) {
         var keptNow = {};
-        var characterCount = 0;
+        var byteCount = 0;
         var index = 0;
         function next() {
           if (index === list.length) {
@@ -355,26 +368,73 @@
           var isAnyStore = isWhole || Object.keys(changedStores).some(function (storeKey) {
             return storeKey.indexOf(name + "\n") === 0;
           });
-          if (!isAnyStore) {
+          var keep = function () {
             keptNow[name] = before;
-            characterCount += before.characterCount;
-            return characterCount > maximumCharacterCount ? { isOverLimit: true } : next();
-          }
-          return readChanged(name, before, isWhole, changedStores, maximumCharacterCount - characterCount).then(function (database) {
-            if (database && database.isOverLimit) return { isOverLimit: true };
-            if (database) {
-              keptNow[name] = database;
-              characterCount += database.characterCount;
-            }
-            return next();
+            byteCount += before.byteCount;
+            return byteCount > maximumByteCount ? { isOverLimit: true } : next();
+          };
+          var readAgain = function (isWholeRead) {
+            return readChanged(name, before, isWholeRead, changedStores, maximumByteCount - byteCount).then(function (database) {
+              if (database && database.isOverLimit) return { isOverLimit: true };
+              if (database) {
+                keptNow[name] = database;
+                byteCount += database.byteCount;
+              }
+              return next();
+            });
+          };
+          if (isAnyStore) return readAgain(isWhole);
+          if (!changed.isCountCheck) return keep();
+          return countsChanged(name, before).then(function (isChanged) {
+            return isChanged ? readAgain(true) : keep();
           });
         }
         return next();
       });
     };
   }
+  /** Whether a database kept from an earlier read looks changed: its version, stores or a store's record count. Only counts are read, never records. */
+  function countsChanged(name, before) {
+    var created = false;
+    return open(name, 0, function () {
+      created = true;
+    }).then(function (database) {
+      var stores = storeNames(database);
+      if (created || database.version !== before.version || stores.join("\n") !== before.storeNames.join("\n")) {
+        database.close();
+        if (created) indexedDB.deleteDatabase(name);
+        return true;
+      }
+      if (!stores.length) {
+        database.close();
+        return false;
+      }
+      return new Promise(function (ok) {
+        var transaction = database.transaction(stores, "readonly");
+        var recordCounts = {};
+        stores.forEach(function (storeName) {
+          var counting = transaction.objectStore(storeName).count();
+          counting.onsuccess = function () {
+            recordCounts[storeName] = counting.result;
+          };
+        });
+        transaction.oncomplete = function () {
+          database.close();
+          ok(
+            stores.some(function (storeName) {
+              return recordCounts[storeName] !== before.stores[storeName].recordCount;
+            }),
+          );
+        };
+        transaction.onerror = transaction.onabort = function () {
+          database.close();
+          ok(true);
+        };
+      });
+    });
+  }
   /** One database for databasesReader: its stores read again where changed, the rest as kept. null when it's gone or has no stores. */
-  function readChanged(name, before, isWhole, changedStores, maximumCharacterCount) {
+  function readChanged(name, before, isWhole, changedStores, maximumByteCount) {
     var created = false;
     return open(name, 0, function () {
       created = true;
@@ -390,12 +450,12 @@
       var reading = stores.filter(function (storeName) {
         return isWhole || !before.stores[storeName] || changedStores[name + "\n" + storeName];
       });
-      var out = { version: database.version, storeNames: stores, stores: {}, characterCount: 0, hasRecords: false };
+      var out = { version: database.version, storeNames: stores, stores: {}, byteCount: 0, hasRecords: false };
       stores.forEach(function (storeName) {
         if (reading.indexOf(storeName) === -1) out.stores[storeName] = before.stores[storeName];
       });
       stores.forEach(function (storeName) {
-        if (out.stores[storeName]) out.characterCount += out.stores[storeName].text.length;
+        if (out.stores[storeName]) out.byteCount += out.stores[storeName].byteCount;
       });
       if (!reading.length) {
         database.close();
@@ -421,20 +481,21 @@
           var keys = store.getAllKeys(range, batchRecordCount);
           var values = store.getAll(range, batchRecordCount);
           values.onsuccess = function () {
-            var previousCharacterCount = out.characterCount;
+            var previousByteCount = out.byteCount;
             var blobCharacterCount = pending.blobCharacterCount || 0;
             values.result.forEach(function (record, i) {
               var encoded = encode([keys.result[i], record], pending, []);
               copy.records.push(encoded);
-              out.characterCount += JSON.stringify(encoded).length + 1;
+              out.byteCount += byteLength(JSON.stringify(encoded)) + 1;
             });
-            out.characterCount += (pending.blobCharacterCount || 0) - blobCharacterCount;
-            if (out.characterCount > maximumCharacterCount) {
+            // A file's base64 text is all ASCII: a character a byte.
+            out.byteCount += (pending.blobCharacterCount || 0) - blobCharacterCount;
+            if (out.byteCount > maximumByteCount) {
               isOverLimit = true;
               transaction.abort();
               return;
             }
-            var isSmall = out.characterCount - previousCharacterCount < SMALL_BATCH_CHARACTER_COUNT;
+            var isSmall = out.byteCount - previousByteCount < SMALL_BATCH_BYTE_COUNT;
             if (values.result.length === batchRecordCount) nextBatch(keys.result[keys.result.length - 1], isSmall ? Math.min(batchRecordCount * 2, MAXIMUM_BATCH_RECORD_COUNT) : batchRecordCount);
             else nextStore();
           };
@@ -448,11 +509,12 @@
               var recordTexts = stored.records.map(function (record) {
                 return JSON.stringify(record);
               });
-              out.stores[stored.shape.name] = { text: shapeText.slice(0, -1) + ',"records":[' + recordTexts.join(",") + "]}", hasRecords: stored.records.length > 0 };
+              var storeText = shapeText.slice(0, -1) + ',"records":[' + recordTexts.join(",") + "]}";
+              out.stores[stored.shape.name] = { text: storeText, byteCount: byteLength(storeText), recordCount: stored.records.length, hasRecords: stored.records.length > 0 };
             });
-            out.characterCount = 0;
+            out.byteCount = 0;
             stores.forEach(function (storeName) {
-              out.characterCount += out.stores[storeName].text.length;
+              out.byteCount += out.stores[storeName].byteCount;
             });
             ok(finish(out));
           }, fail);
@@ -477,7 +539,7 @@
     var read = databasesReader();
     addEventListener("message", function (event) {
       var asked = event.data || {};
-      read(asked.changed, asked.maximumCharacterCount).then(
+      read(asked.changed, asked.maximumByteCount).then(
         function (answer) {
           answer.id = asked.id;
           postMessage(answer);
@@ -596,7 +658,7 @@
     // The page always hands over a v1 save.
     var local = save.local_storage_items;
     var databases = decode(save.indexeddb_databases);
-    // IndexedDB first: it's the part that can fail, and then localStorage is still as it was.
+    // IndexedDB first, so a database that can't be set up leaves localStorage as it was.
     var writing =
       window.indexedDB && indexedDB.databases
         ? writeDatabases(databases, onBlocked)
@@ -604,10 +666,20 @@
           ? Promise.reject(new Error("No IndexedDB here"))
           : Promise.resolve();
     return writing.then(function () {
-      localStorage.clear();
-      Object.keys(local).forEach(function (key) {
-        localStorage.setItem(key, String(local[key]));
-      });
+      // A write that throws (the browser's storage is full) puts this device's localStorage back as it was.
+      var before = snapshot();
+      try {
+        localStorage.clear();
+        Object.keys(local).forEach(function (key) {
+          localStorage.setItem(key, String(local[key]));
+        });
+      } catch (error) {
+        localStorage.clear();
+        Object.keys(before).forEach(function (key) {
+          localStorage.setItem(key, before[key]);
+        });
+        throw error;
+      }
     });
   }
 
@@ -681,7 +753,8 @@
 
   // What the game changed since the last check, so a check reads only that again: a store, a whole
   // database (set up anew or deleted) or localStorage. Writes the game's own workers make, and
-  // localStorage set as a property, aren't seen, so every 10th check (5 minutes) reads everything.
+  // localStorage set as a property, aren't seen: every 10th check (5 minutes) reads localStorage and any
+  // database whose version or record counts changed, and leaving the page reads every database whole.
   var changedStores = {};
   var changedDatabases = {};
   var isLocalChanged = true;
@@ -735,7 +808,7 @@
   var hereReader = null;
   var waiting = null;
   var readNumber = 0;
-  function readDatabasesText(changed, maximumCharacterCount) {
+  function readDatabasesText(changed, maximumByteCount) {
     if (!isWorkerTried) {
       isWorkerTried = true;
       try {
@@ -755,7 +828,7 @@
     }
     if (!worker) {
       hereReader = hereReader || databasesReader();
-      return hereReader(changed, maximumCharacterCount);
+      return hereReader(changed, maximumByteCount);
     }
     var id = ++readNumber;
     return new Promise(function (ok) {
@@ -766,14 +839,14 @@
           ok(answer);
         },
       };
-      worker.postMessage({ id: id, changed: changed, maximumCharacterCount: maximumCharacterCount });
+      worker.postMessage({ id: id, changed: changed, maximumByteCount: maximumByteCount });
     }).then(function (answer) {
       if (!answer.isFailed) return answer;
       // The worker can't read here (or stopped): read on the page from now on, from the start.
       if (worker) worker.terminate();
       worker = null;
       hereReader = databasesReader();
-      return hereReader({ isAll: true, databases: [], stores: [] }, maximumCharacterCount);
+      return hereReader({ isAll: true, databases: [], stores: [] }, maximumByteCount);
     });
   }
 
@@ -781,35 +854,44 @@
   var last = null;
   var timer = null;
   var localText = null;
+  var localByteCount = 0;
   var idbText = null;
   var checkCount = 0;
   var reading = false;
   var again = false;
   // localStorage this small is read at every check anyway, which also catches it set as a property.
   var SMALL_LOCAL_CHARACTER_COUNT = 64 * 1024;
-  /** isLeaving: the player is leaving the tab, so localStorage is read whatever was seen. */
-  function check(isLeaving) {
+  /**
+   * isLeaving: the player is leaving the tab, so localStorage is read whatever was seen. isWhole: the page is going
+   * away, so every database is read whole, catching any write the script couldn't see.
+   */
+  function check(isLeaving, isWhole) {
     if (!syncing) return;
     if (reading) {
       again = true;
       return;
     }
-    var isAll = isAllChanged || idbText === null || ++checkCount % 10 === 0;
-    var changed = { isAll: isAll, databases: Object.keys(changedDatabases), stores: Object.keys(changedStores) };
-    var readsIdb = isAll || changed.databases.length > 0 || changed.stores.length > 0;
-    var readsLocal = isAll || isLocalChanged || localText === null || isLeaving === true || localText.length < SMALL_LOCAL_CHARACTER_COUNT;
+    var isAll = isAllChanged || idbText === null || isWhole === true;
+    // Every 10th check (5 minutes), also what the script can't watch: localStorage, and databases whose version or record counts changed.
+    var isCountCheck = !isAll && ++checkCount % 10 === 0;
+    var changed = { isAll: isAll, isCountCheck: isCountCheck, databases: Object.keys(changedDatabases), stores: Object.keys(changedStores) };
+    var readsIdb = isAll || isCountCheck || changed.databases.length > 0 || changed.stores.length > 0;
+    var readsLocal = isAll || isCountCheck || isLocalChanged || localText === null || isLeaving === true || localText.length < SMALL_LOCAL_CHARACTER_COUNT;
     if (!readsIdb && !readsLocal) return;
     changedStores = {};
     changedDatabases = {};
     isAllChanged = false;
     isLocalChanged = false;
     reading = true;
-    if (readsLocal) localText = canonical(snapshot());
-    var maximumCharacterCount = saveLimitBytes - localText.length;
-    (readsIdb ? readDatabasesText(changed, maximumCharacterCount) : Promise.resolve({ text: idbText }))
+    if (readsLocal) {
+      localText = canonical(snapshot());
+      localByteCount = byteLength(localText);
+    }
+    var maximumByteCount = saveLimitBytes - localByteCount;
+    (readsIdb ? readDatabasesText(changed, maximumByteCount) : Promise.resolve({ text: idbText }))
       .then(function (answer) {
         if (answer.isFailed) throw new Error("The save couldn't be read");
-        if (answer.isOverLimit || localText.length > saveLimitBytes) {
+        if (answer.isOverLimit || localByteCount > saveLimitBytes) {
           // Read again in full next time: what's kept stopped partway.
           idbText = null;
           post({ step: "over_limit" });
@@ -856,17 +938,15 @@
         fail(new Error("The game holds its database open"));
       }).then(ok, fail);
     })
-      .then(function () {
-        // What's in storage now is the save the page sent: the next check has nothing new to send.
-        return readNumberbText();
-      })
       .then(
-        function (freshIdbText) {
-          idbText = freshIdbText;
+        function () {
+          // What's in storage now is the save the page sent, already encoded: nothing is read again on the game's thread.
+          idbText = save.indexeddb_databases.length ? JSON.stringify(save.indexeddb_databases) : "";
           localText = canonical(snapshot());
-          // The worker's kept parts are from before: the next check reads everything (and finds nothing new).
+          localByteCount = byteLength(localText);
+          // The worker's kept parts are from before: the next check reads everything there (and finds nothing new).
           isAllChanged = true;
-          last = textOf(localText, freshIdbText);
+          last = textOf(localText, idbText);
           post({ step: "applied", ok: true });
         },
         function () {
@@ -878,7 +958,7 @@
     if (document.visibilityState === "hidden") check(true);
   });
   addEventListener("pagehide", function () {
-    check(true);
+    check(true, true);
   });
   post({ step: "hello", phase: "game", versionId: versionId });
 })();

package/sdk/zaisma.d.ts

@@ -1005,7 +1005,8 @@ declare namespace Zaisma {
     readonly canChat: boolean;
     /**
      * When Zaisma will end this match, an ISO time, or null: set once the game's hosting pauses for the
-     * month, an hour after the pause (the "ending" event). Never set in a room on your own server.
+     * month, an hour after the pause (the "ending" event); null again if Zaisma calls the end off (the
+     * "endingCancelled" event). Never set in a room on your own server.
      */
     readonly endsAt: string | null;
     /**
@@ -1222,6 +1223,11 @@ declare namespace Zaisma {
      * "ended" follows then.
      */
     ending: (ending: Ending) => void;
+    /**
+     * Zaisma called off the end the "ending" event announced, because the game's hosting started again:
+     * room.endsAt is null, and the match goes on. Optional, as events added after v1 are, so v1's types still fit.
+     */
+    endingCancelled?: () => void;
     /** The game server or the host removed the player from the room. The connection closes. */
     kicked: (kicked: Kicked) => void;
     /** The room's listing, Join switch, name or labels changed, or how many watch: room.isListed, room.isOpen, room.friendJoinsEnabled, room.name, room.labels and room.spectatorCount have the new ones. */

package/sdk/zaisma.js

@@ -29,7 +29,7 @@
   var SMOOTHING_OPTIONS = ["delayMs"];
   var DELIVERIES = ["reliable", "latest_only"];
   var ROOM_INFO_FIELDS = ["name", "labels"];
-  var ROOM_EVENTS = ["message", "bytes", "state", "players", "connectionStatus", "ended", "ending", "kicked", "settings", "move", "moved", "idle", "away", "back", "muted", "error", "versionUpdate", "chat"];
+  var ROOM_EVENTS = ["message", "bytes", "state", "players", "connectionStatus", "ended", "ending", "endingCancelled", "kicked", "settings", "move", "moved", "idle", "away", "back", "muted", "error", "versionUpdate", "chat"];
   /** Chat (room.chat): the longest message, the lines a room keeps in memory for reports, and how many of them a report carries. */
   var MAXIMUM_CHAT_CHARACTER_COUNT = 2000;
   var KEPT_CHAT_LINE_COUNT = 50;
@@ -640,6 +640,9 @@
       } else if (message.type === "ending") {
         room.endsAt = message.endsAt;
         room._emit("ending", { endsAt: message.endsAt });
+      } else if (message.type === "ending_cancelled") {
+        room.endsAt = null;
+        room._emit("endingCancelled");
       } else if (message.type === "version_update") {
         var versionUpdate = { versionId: message.versionId, appliesAt: message.appliesAt, isReloading: message.isReloading === true };
         if (message.step === "now") room._isReloadingForVersion = versionUpdate.isReloading;

package/src/database.d.ts

@@ -76,18 +76,22 @@ export declare function checkPlayerId(playerId: unknown): string;
 /** What erasePlayer says when a table's foreign key refuses the delete. */
 export declare function eraseRefused(tableName: string, error: unknown): DatabaseError;
 export declare const DATABASE_LIMITS: {
-    /** One statement's SQL. */
+    /** One statement's SQL, in characters. */
     readonly maximumSqlCharacterCount: 100000;
+    /** One statement's SQL, in UTF-8 bytes: Cloudflare's SQLite takes 100 KB, so text in other scripts is held to it too. */
+    readonly maximumSqlSizeBytes: 100000;
     /** Values for one statement's ?s. */
     readonly maximumValueCount: 100;
-    /** One text or blob value, in a query and in the database. */
+    /** One text or blob value a game server or query binds. */
     readonly maximumValueSizeBytes: number;
+    /** One text or blob value in an import, which brings back every row an export wrote: what the database holds in a value. */
+    readonly maximumImportValueSizeBytes: number;
     /** Statements in one batch. */
     readonly maximumStatementCount: 100;
     /** Rows one statement may answer; past it, page with LIMIT and OFFSET or a WHERE. */
     readonly maximumRowCount: 10000;
 };
-export type DatabaseErrorCode = "bad_sql" | "bad_values" | "bad_player_id" | "too_many_rows" | "hosting_paused" | "database_full" | "database_unavailable";
+export type DatabaseErrorCode = "bad_sql" | "bad_values" | "bad_player_id" | "too_many_rows" | "hosting_paused" | "database_full" | "database_unavailable" | "integer_too_large";
 /** A call the database refused, with a code, what happened and what to do (like the developer API's errors, docs/NAMING.md). */
 export declare class DatabaseError extends Error {
     readonly code: DatabaseErrorCode;
@@ -110,12 +114,18 @@ export type DatabaseAnswer<T> = {
 export declare function readDatabaseAnswer<T>(answer: DatabaseAnswer<T>): T;
 /** Run work, answering its result or the DatabaseError it threw; any other error is SQLite's (bad_sql). */
 export declare function answerDatabase<T>(work: () => T): DatabaseAnswer<T>;
+/**
+ * The PRAGMAs Cloudflare's SQLite runs; it refuses the rest (user_version, journal_mode…) with SQLITE_AUTH, so both
+ * runtimes refuse them. defer_foreign_keys is what an import's part runs first, in its transaction.
+ */
+export declare const ALLOWED_PRAGMAS: readonly string[];
 /**
  * Check one statement and its values before it runs: one statement only, no transaction control,
- * values of the kinds SQLite takes. Throws a DatabaseError; answers the statement to run (without a
- * trailing ; or comment, which SQLite in a Durable Object takes as an empty statement) and its values.
+ * nothing Cloudflare's SQLite refuses, values of the kinds SQLite takes. Throws a DatabaseError; answers the
+ * statement to run (without a trailing ; or comment, which SQLite in a Durable Object takes as an empty
+ * statement) and its values. A text or blob value may be up to maximumValueSizeBytes (an import's: more).
  */
-export declare function checkStatement(sql: unknown, values: unknown): {
+export declare function checkStatement(sql: unknown, values: unknown, maximumValueSizeBytes?: number): {
     sql: string;
     values: DatabaseValue[];
 };
@@ -128,9 +138,12 @@ export declare function checkBatch(statements: unknown): {
 export declare function plainRow(row: Record<string, unknown>): DatabaseRow;
 /**
  * A row as a game's query gets it: plainRow, refusing a whole number past 2^53, which JavaScript would
- * round (a game would read a different number than the one stored). Dumps and previews keep plainRow.
+ * round (a game would read a different number than the one stored): integer_too_large. Dumps and previews keep
+ * plainRow. realColumns names the columns that hold REALs, which can be as big (1e20) and are not refused.
  */
-export declare function checkedRow(row: Record<string, unknown>): DatabaseRow;
+export declare function checkedRow(row: Record<string, unknown>, realColumns?: ReadonlySet<string>): DatabaseRow;
+/** A whole number past 2^53 in a result, which JavaScript can't hold exactly. */
+export declare function integerTooLarge(column: string): DatabaseError;
 export declare function tooManyRows(): DatabaseError;
 /** One statement in a piece of SQL, as scanStatements finds it. */
 export interface ScannedStatement {

package/src/database.js

@@ -39,18 +39,22 @@ export function eraseRefused(tableName, error) {
     return new DatabaseError("bad_sql", `Erasing the player from ${tableName} failed, so nothing was erased: SQLite: ${sqliteMessage}`, "Give the foreign key ON DELETE CASCADE, or turn deleted_account_erase_enabled off and erase in your own order.");
 }
 export const DATABASE_LIMITS = {
-    /** One statement's SQL. */
+    /** One statement's SQL, in characters. */
     maximumSqlCharacterCount: 100_000,
+    /** One statement's SQL, in UTF-8 bytes: Cloudflare's SQLite takes 100 KB, so text in other scripts is held to it too. */
+    maximumSqlSizeBytes: 100_000,
     /** Values for one statement's ?s. */
     maximumValueCount: 100,
-    /** One text or blob value, in a query and in the database. */
+    /** One text or blob value a game server or query binds. */
     maximumValueSizeBytes: 1024 * 1024,
+    /** One text or blob value in an import, which brings back every row an export wrote: what the database holds in a value. */
+    maximumImportValueSizeBytes: 2 * 1024 * 1024,
     /** Statements in one batch. */
     maximumStatementCount: 100,
     /** Rows one statement may answer; past it, page with LIMIT and OFFSET or a WHERE. */
     maximumRowCount: 10_000,
 };
-const DATABASE_ERROR_CODES = ["bad_sql", "bad_values", "bad_player_id", "too_many_rows", "hosting_paused", "database_full", "database_unavailable"];
+const DATABASE_ERROR_CODES = ["bad_sql", "bad_values", "bad_player_id", "too_many_rows", "hosting_paused", "database_full", "database_unavailable", "integer_too_large"];
 /** A call the database refused, with a code, what happened and what to do (like the developer API's errors, docs/NAMING.md). */
 export class DatabaseError extends Error {
     code;
@@ -86,16 +90,49 @@ export function answerDatabase(work) {
 }
 // Statements that run their own transactions or reach other files. batch() is the transaction.
 const REFUSED_FIRST_WORDS = new Set(["BEGIN", "COMMIT", "END", "ROLLBACK", "SAVEPOINT", "RELEASE", "ATTACH", "DETACH"]);
+/**
+ * The PRAGMAs Cloudflare's SQLite runs; it refuses the rest (user_version, journal_mode…) with SQLITE_AUTH, so both
+ * runtimes refuse them. defer_foreign_keys is what an import's part runs first, in its transaction.
+ */
+export const ALLOWED_PRAGMAS = ["table_info", "table_xinfo", "table_list", "index_list", "index_info", "index_xinfo", "foreign_key_list", "foreign_key_check", "defer_foreign_keys", "quick_check", "integrity_check", "optimize"];
+/** Functions Cloudflare's SQLite refuses, which would answer in the Node runner. */
+const REFUSED_FUNCTIONS = ["sqlite_version", "sqlite_source_id", "load_extension"];
+/** SQL with its quotes, names and comments blanked, so a word is only found where it's SQL. */
+function sqlWithoutQuotes(sql) {
+    return sql.replace(/'(?:[^']|'')*'|"(?:[^"]|"")*"|`[^`]*`|\[[^\]]*\]|--[^\n]*|\/\*[\s\S]*?\*\//g, " ");
+}
+/** What Cloudflare's SQLite refuses and Node's would run: PRAGMAs outside ALLOWED_PRAGMAS, TEMP objects and unauthorized functions. */
+function checkRefusedByCloudflare(sql, leadingWords) {
+    const [firstWord = "", secondWord = ""] = leadingWords;
+    const bare = sqlWithoutQuotes(sql);
+    if (firstWord === "PRAGMA") {
+        const pragmaName = /^\s*PRAGMA\s+(?:\w+\s*\.\s*)?(\w+)/i.exec(bare)?.[1]?.toLowerCase() ?? "";
+        if (!ALLOWED_PRAGMAS.includes(pragmaName)) {
+            throw new DatabaseError("bad_sql", `PRAGMA ${pragmaName || "…"} isn't allowed: Zaisma's database doesn't take it, and neither does your own server's runner, so a query runs the same in both.`, `Allowed: ${ALLOWED_PRAGMAS.map((name) => `PRAGMA ${name}`).join(", ")}. To keep a schema version, use a table of your own, like CREATE TABLE schema_version (version_number INTEGER NOT NULL).`);
+        }
+    }
+    if (firstWord === "CREATE" && (secondWord === "TEMP" || secondWord === "TEMPORARY")) {
+        throw new DatabaseError("bad_sql", `CREATE ${secondWord} isn't allowed: the database keeps no temporary tables or objects.`, "Make an ordinary table and drop it when done, or use a WITH query for a result you only need inside one statement.");
+    }
+    const refusedFunction = REFUSED_FUNCTIONS.find((name) => new RegExp(`\\b${name}\\s*\\(`, "i").test(bare));
+    if (refusedFunction)
+        throw new DatabaseError("bad_sql", `${refusedFunction}() isn't allowed: Zaisma's database doesn't take it, and neither does your own server's runner.`, "Keep what you need to know about the database (a schema version, say) in a table of your own.");
+}
 /**
  * Check one statement and its values before it runs: one statement only, no transaction control,
- * values of the kinds SQLite takes. Throws a DatabaseError; answers the statement to run (without a
- * trailing ; or comment, which SQLite in a Durable Object takes as an empty statement) and its values.
+ * nothing Cloudflare's SQLite refuses, values of the kinds SQLite takes. Throws a DatabaseError; answers the
+ * statement to run (without a trailing ; or comment, which SQLite in a Durable Object takes as an empty
+ * statement) and its values. A text or blob value may be up to maximumValueSizeBytes (an import's: more).
  */
-export function checkStatement(sql, values) {
+export function checkStatement(sql, values, maximumValueSizeBytes = DATABASE_LIMITS.maximumValueSizeBytes) {
     if (typeof sql !== "string" || !sql.trim())
         throw new DatabaseError("bad_sql", "The SQL isn't text.", 'Give one SQL statement as text, like "SELECT * FROM scores WHERE player_id = ?".');
     if (sql.length > DATABASE_LIMITS.maximumSqlCharacterCount)
         throw new DatabaseError("bad_sql", `The SQL is ${sql.length} characters.`, `Keep one statement under ${DATABASE_LIMITS.maximumSqlCharacterCount} characters, and pass data as values instead of writing it into the SQL.`);
+    // Cloudflare's limit is in bytes: three bytes a character at most, so short statements need no count.
+    const sqlSizeBytes = sql.length * 3 <= DATABASE_LIMITS.maximumSqlSizeBytes ? 0 : new TextEncoder().encode(sql).length;
+    if (sqlSizeBytes > DATABASE_LIMITS.maximumSqlSizeBytes)
+        throw new DatabaseError("bad_sql", `The SQL is ${sqlSizeBytes} bytes.`, `Keep one statement under ${DATABASE_LIMITS.maximumSqlSizeBytes} bytes (UTF-8), and pass data as values instead of writing it into the SQL.`);
     const statements = scanStatements(sql);
     if (statements.length === 0)
         throw new DatabaseError("bad_sql", "The SQL has only comments.", 'Give one SQL statement, like "SELECT * FROM scores WHERE player_id = ?".');
@@ -104,21 +141,22 @@ export function checkStatement(sql, values) {
     const firstWord = statements[0].leadingWords[0] ?? "";
     if (REFUSED_FIRST_WORDS.has(firstWord))
         throw new DatabaseError("bad_sql", `${firstWord} isn't allowed.`, "For a transaction, use a batch (room.database.batch([{ sql, values }, ...]) in a game server, batch_database through the API): its statements all happen or none do.");
+    checkRefusedByCloudflare(sql.slice(statements[0].startIndex, statements[0].endIndex), statements[0].leadingWords);
     const given = values === undefined || values === null ? [] : values;
     if (!Array.isArray(given))
         throw new DatabaseError("bad_values", "values isn't a list.", 'Give the values for the ?s as a list, in order, like ["player_8f3k2m", 1200].');
     if (given.length > DATABASE_LIMITS.maximumValueCount)
         throw new DatabaseError("bad_values", `There are ${given.length} values.`, `Give up to ${DATABASE_LIMITS.maximumValueCount} values per statement; split big inserts into several statements in one batch.`);
-    return { sql: sql.slice(0, statements[0].endIndex), values: given.map(checkValue) };
+    return { sql: sql.slice(0, statements[0].endIndex), values: given.map((givenValue, i) => checkValue(givenValue, i, maximumValueSizeBytes)) };
 }
 /** One value for a ?, the i-th (from 0). */
-function checkValue(givenValue, i) {
+function checkValue(givenValue, i, maximumValueSizeBytes) {
     if (typeof givenValue === "number" && Number.isInteger(givenValue) && !Number.isSafeInteger(givenValue))
         throw new DatabaseError("bad_values", `Value ${i + 1} is a whole number past 2^53, which JavaScript can't hold exactly.`, "Store it as text, like String(value), and read it back as text.");
     if (givenValue === null || typeof givenValue === "string" || givenValue instanceof Uint8Array || (typeof givenValue === "number" && Number.isFinite(givenValue))) {
         const sizeBytes = typeof givenValue === "string" ? new TextEncoder().encode(givenValue).length : givenValue instanceof Uint8Array ? givenValue.byteLength : 0;
-        if (sizeBytes > DATABASE_LIMITS.maximumValueSizeBytes)
-            throw new DatabaseError("bad_values", `Value ${i + 1} is ${sizeBytes} bytes.`, `Keep each text or blob under ${DATABASE_LIMITS.maximumValueSizeBytes / 1024 / 1024} MB; store big files somewhere else and keep a link here.`);
+        if (sizeBytes > maximumValueSizeBytes)
+            throw new DatabaseError("bad_values", `Value ${i + 1} is ${sizeBytes} bytes.`, `Keep each text or blob under ${maximumValueSizeBytes / 1024 / 1024} MB; store big files somewhere else and keep a link here.`);
         return givenValue;
     }
     const kind = typeof givenValue === "boolean" ? "true or false" : typeof givenValue === "number" ? String(givenValue) : Array.isArray(givenValue) ? "a list" : typeof givenValue;
@@ -150,17 +188,21 @@ export function plainRow(row) {
 }
 /**
  * A row as a game's query gets it: plainRow, refusing a whole number past 2^53, which JavaScript would
- * round (a game would read a different number than the one stored). Dumps and previews keep plainRow.
+ * round (a game would read a different number than the one stored): integer_too_large. Dumps and previews keep
+ * plainRow. realColumns names the columns that hold REALs, which can be as big (1e20) and are not refused.
  */
-export function checkedRow(row) {
+export function checkedRow(row, realColumns) {
     const plain = plainRow(row);
     for (const [column, columnValue] of Object.entries(plain)) {
-        if (typeof columnValue === "number" && Number.isInteger(columnValue) && !Number.isSafeInteger(columnValue)) {
-            throw new DatabaseError("bad_sql", `Column ${column} holds a whole number past 2^53, which JavaScript can't hold exactly.`, `Read it as text with CAST(${column} AS TEXT).`);
-        }
+        if (typeof columnValue === "number" && Number.isInteger(columnValue) && !Number.isSafeInteger(columnValue) && !realColumns?.has(column))
+            throw integerTooLarge(column);
     }
     return plain;
 }
+/** A whole number past 2^53 in a result, which JavaScript can't hold exactly. */
+export function integerTooLarge(column) {
+    return new DatabaseError("integer_too_large", `Column ${column} holds a whole number past 2^53 (9,007,199,254,740,991), which JavaScript can't hold exactly.`, `Read it as text with CAST(${column} AS TEXT), or store 64-bit IDs as TEXT.`);
+}
 export function tooManyRows() {
     return new DatabaseError("too_many_rows", `The statement answered more than ${DATABASE_LIMITS.maximumRowCount} rows.`, "Ask for fewer with LIMIT (and OFFSET or a WHERE on the last row for the next page), or count with SELECT count(*).");
 }