cajonzero 0.1.1 → 0.1.2

package/dist/core.d.ts

@@ -1,6 +1,6 @@
-import { M as MapEntry, W as WorldSeed } from './providers-Dh-umPQ6.js';
-export { c as EMPTY_MAP_CATALOG, E as EnvProvider, d as MapCatalog, e as Repos, R as Room, f as RoomOptions, g as RuntimeProviders, h as SETTINGS, i as SETTING_KEYS, a as SettingDefaults, j as SettingDefinition, k as Settings, l as SettingsError, m as SettingsErrorCode, n as SettingsService, o as StorageFactory, S as StorageSource, p as Store, q as WorldSeedReader, r as configureDefaultKV, s as createMemoryStore, t as createRepos, u as createSettingsService, v as createStore, w as findMap, x as getRuntimeProviders, y as isSettingKey, z as memoryDriver, A as parseMapCatalog, B as resolveAdminToken, C as resolveEnvironment, F as resolveRooms, G as resolveSessionSecret, H as resolveSettingDefaults, I as resolveStore, J as setRuntimeProviders, K as setStorageFactory } from './providers-Dh-umPQ6.js';
-export { C as CajonzeroConfig, D as DEFAULT_CONFIG, G as GAME_NET_INBOUND_BASE, a as GAME_NET_OUTBOUND_BASE, I as INBOUND_LAYOUT, M as MAX_INBOUND_FRAME_BYTES, b as MapsConfig, N as NetCodec, c as NetCodecError, d as NetCodecErrorCode, e as NetCodecHandlers, f as NetCodecOptions, O as OFFICIAL_PREFIX, g as OUTBOUND_LAYOUT, P as ProtocolDirection, h as ProtocolLayout, i as ProtocolSchemaLike, R as RoomConfig, j as chainLayouts, l as layoutMessages, k as layoutProtocol, m as matchesLayout, n as messageIds, o as messageNameAt, r as readNetFrameHeader, p as readNetMessageType, q as resolveConfig } from './config-YtU8BYQM.js';
+import { M as MapEntry, W as WorldSeed } from './providers-BX7e4pNW.js';
+export { c as EMPTY_MAP_CATALOG, E as EnvProvider, d as MapCatalog, e as Repos, R as Room, f as RoomOptions, g as RuntimeProviders, h as SETTINGS, i as SETTING_KEYS, a as SettingDefaults, j as SettingDefinition, k as Settings, l as SettingsError, m as SettingsErrorCode, n as SettingsService, o as StorageFactory, S as StorageSource, p as Store, q as WorldSeedReader, r as configureDefaultKV, s as createMemoryStore, t as createRepos, u as createSettingsService, v as createStore, w as findMap, x as getRuntimeProviders, y as isSettingKey, z as memoryDriver, A as parseMapCatalog, B as resolveAdminToken, C as resolveEnvironment, F as resolveRooms, G as resolveSessionSecret, H as resolveSettingDefaults, I as resolveStore, J as setRuntimeProviders, K as setStorageFactory } from './providers-BX7e4pNW.js';
+export { C as CajonzeroConfig, D as DEFAULT_CONFIG, G as GAME_NET_INBOUND_BASE, a as GAME_NET_OUTBOUND_BASE, I as INBOUND_LAYOUT, M as MAX_INBOUND_FRAME_BYTES, b as MapsConfig, N as NetCodec, c as NetCodecError, d as NetCodecErrorCode, e as NetCodecHandlers, f as NetCodecOptions, O as OFFICIAL_PREFIX, g as OUTBOUND_LAYOUT, P as ProtocolDirection, h as ProtocolLayout, i as ProtocolSchemaLike, R as RoomConfig, j as chainLayouts, l as layoutMessages, k as layoutProtocol, m as matchesLayout, n as messageIds, o as messageNameAt, r as readNetFrameHeader, p as readNetMessageType, q as resolveConfig } from './config-BOzAyP7m.js';
 import 'unstorage';
 import 'gl-matrix';
 import 'zod';

package/dist/core.js

@@ -4989,7 +4989,6 @@ var KEY_PREFIX = {
   account: "account",
   session: "session",
   ban: "ban",
-  ratelimit: "ratelimit",
   settings: "settings",
   mapStorage: "mapstorage"
 };
@@ -5021,9 +5020,6 @@ function banAccountKey(subjectId) {
 function banIdentityKey(kind, hash) {
   return `ban:identity:${kind}:${seg2(hash)}`;
 }
-function ratelimitKey(scope, hash) {
-  return `ratelimit:${seg2(scope)}:${seg2(hash)}`;
-}
 function settingsKey(key) {
   return `settings:${seg2(key)}`;
 }
@@ -5066,12 +5062,6 @@ function parseKey(key) {
       }
       return void 0;
     }
-    case KEY_PREFIX.ratelimit: {
-      if (parts2.length !== 3) return void 0;
-      const scope = decode(parts2[1]);
-      const hash = decode(parts2[2]);
-      return scope === void 0 || hash === void 0 ? void 0 : { kind: "ratelimit", scope, hash };
-    }
     case KEY_PREFIX.settings: {
       if (parts2.length !== 2) return void 0;
       const settingKey = decode(parts2[1]);
@@ -15214,34 +15204,6 @@ function banDetails(input, at) {
   const expiresAt = input.expiresAt ?? (input.durationSeconds === void 0 ? void 0 : at + input.durationSeconds * 1e3);
   return { reason: input.reason, expiresAt, createdBy: input.createdBy };
 }
-function createRateLimitsRepo(store, now) {
-  const repo = {
-    async increment(scope, hash, options = {}) {
-      const windowSeconds = Math.max(1, options.windowSeconds ?? 60);
-      const amount = options.amount ?? 1;
-      const at = now();
-      const current = await repo.get(scope, hash);
-      const windowStart = current !== void 0 && current.expiresAt > at ? current.windowStart : at;
-      const expiresAt = windowStart + windowSeconds * 1e3;
-      const next = {
-        count: (current !== void 0 && current.expiresAt > at ? current.count : 0) + amount,
-        windowStart,
-        expiresAt
-      };
-      const ttl = Math.max(1, Math.ceil((expiresAt - at) / 1e3));
-      await store.setItem(ratelimitKey(scope, hash), next, { ttl });
-      return next;
-    },
-    async get(scope, hash) {
-      const record = await store.getItem(ratelimitKey(scope, hash));
-      return record ?? void 0;
-    },
-    async reset(scope, hash) {
-      await store.removeItem(ratelimitKey(scope, hash));
-    }
-  };
-  return repo;
-}
 function createSettingsRepo(store) {
   return {
     async get(key) {
@@ -15506,7 +15468,6 @@ function createRepos(store, options = {}) {
     accounts: createAccountsRepo(store, now),
     sessions: createSessionsRepo(store, now),
     bans: createBansRepo(store, now),
-    ratelimits: createRateLimitsRepo(store, now),
     settings: createSettingsRepo(store),
     mapStorage: (scope, namespace) => createMapStorageRepo(store, {
       scope,
@@ -16660,6 +16621,8 @@ var Room = class {
   mapLoading;
   worldReady = false;
   snapshotRestored = false;
+  /** One-shot guard for the "proof without sessionSecret" diagnostic. */
+  guestWarningLogged = false;
   persistence;
   socketsStarted = false;
   perf = { minPing: 0, maxPing: 0, avgPing: 0, pingCount: 0 };
@@ -17005,6 +16968,13 @@ var Room = class {
         this.pendingIdentities.set(sessionId, identity2);
       }
     } else {
+      const proof = extractSessionProof(request.headers.get("sec-websocket-protocol"));
+      if (proof !== void 0 && !this.guestWarningLogged) {
+        this.guestWarningLogged = true;
+        this.logger.error(
+          "cajonzero: a session proof was supplied but no sessionSecret is configured; players join as guest. Pass serve({ sessionSecret: (env) => env.<SECRET> })."
+        );
+      }
       identity2 = guestIdentity(sessionId);
     }
     const ip = resolveClientIp(request);

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import { Context, Hono } from 'hono';
 import { ContentfulStatusCode } from 'hono/utils/http-status';
-import { b as Env, d as MapCatalog, e as Repos, L as SessionsRepo, D as DurableObjectNamespace } from './providers-Dh-umPQ6.js';
+import { b as Env, d as MapCatalog, e as Repos, L as SessionsRepo, D as DurableObjectNamespace } from './providers-BX7e4pNW.js';
 import { Store, SettingDefaults } from './core.js';
-export { c as EMPTY_MAP_CATALOG, M as MapEntry, R as Room, w as findMap, A as parseMapCatalog } from './providers-Dh-umPQ6.js';
-import { C as CajonzeroConfig } from './config-YtU8BYQM.js';
-export { D as DEFAULT_CONFIG, G as GAME_NET_INBOUND_BASE, a as GAME_NET_OUTBOUND_BASE, b as MapsConfig, N as NetCodec, e as NetCodecHandlers, R as RoomConfig, q as resolveConfig } from './config-YtU8BYQM.js';
+export { c as EMPTY_MAP_CATALOG, M as MapEntry, R as Room, w as findMap, A as parseMapCatalog } from './providers-BX7e4pNW.js';
+import { C as CajonzeroConfig } from './config-BOzAyP7m.js';
+export { D as DEFAULT_CONFIG, G as GAME_NET_INBOUND_BASE, a as GAME_NET_OUTBOUND_BASE, b as MapsConfig, N as NetCodec, e as NetCodecHandlers, R as RoomConfig, q as resolveConfig } from './config-BOzAyP7m.js';
 export { DO_CLASSES, ServeOptions, WorkersEntry, WorkersModule, serve } from './serve.js';
 import 'unstorage';
 import 'gl-matrix';
@@ -18,7 +18,7 @@ import 'zod';
  * can read the version without creating a circular import.
  */
 declare const NAME = "cajonzero";
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.1.1";
 
 /** The authenticated principal carried by a login session (T11 supplies it). */
 interface SessionIdentity {

package/dist/index.js

@@ -11,7 +11,7 @@ import 'unstorage/drivers/memory';
 
 // src/version.ts
 var NAME = "cajonzero";
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 
 // src/core/config.ts
 var ConfigError = class extends Error {
@@ -288,7 +288,6 @@ var KEY_PREFIX = {
   account: "account",
   session: "session",
   ban: "ban",
-  ratelimit: "ratelimit",
   settings: "settings",
   mapStorage: "mapstorage"
 };
@@ -320,9 +319,6 @@ function banAccountKey(subjectId) {
 function banIdentityKey(kind, hash) {
   return `ban:identity:${kind}:${seg(hash)}`;
 }
-function ratelimitKey(scope, hash) {
-  return `ratelimit:${seg(scope)}:${seg(hash)}`;
-}
 function settingsKey(key) {
   return `settings:${seg(key)}`;
 }
@@ -365,12 +361,6 @@ function parseKey(key) {
       }
       return void 0;
     }
-    case KEY_PREFIX.ratelimit: {
-      if (parts2.length !== 3) return void 0;
-      const scope = decode(parts2[1]);
-      const hash = decode(parts2[2]);
-      return scope === void 0 || hash === void 0 ? void 0 : { kind: "ratelimit", scope, hash };
-    }
     case KEY_PREFIX.settings: {
       if (parts2.length !== 2) return void 0;
       const settingKey = decode(parts2[1]);
@@ -594,34 +584,6 @@ function banDetails(input, at) {
   const expiresAt = input.expiresAt ?? (input.durationSeconds === void 0 ? void 0 : at + input.durationSeconds * 1e3);
   return { reason: input.reason, expiresAt, createdBy: input.createdBy };
 }
-function createRateLimitsRepo(store, now) {
-  const repo = {
-    async increment(scope, hash, options = {}) {
-      const windowSeconds = Math.max(1, options.windowSeconds ?? 60);
-      const amount = options.amount ?? 1;
-      const at = now();
-      const current = await repo.get(scope, hash);
-      const windowStart = current !== void 0 && current.expiresAt > at ? current.windowStart : at;
-      const expiresAt = windowStart + windowSeconds * 1e3;
-      const next = {
-        count: (current !== void 0 && current.expiresAt > at ? current.count : 0) + amount,
-        windowStart,
-        expiresAt
-      };
-      const ttl = Math.max(1, Math.ceil((expiresAt - at) / 1e3));
-      await store.setItem(ratelimitKey(scope, hash), next, { ttl });
-      return next;
-    },
-    async get(scope, hash) {
-      const record = await store.getItem(ratelimitKey(scope, hash));
-      return record ?? void 0;
-    },
-    async reset(scope, hash) {
-      await store.removeItem(ratelimitKey(scope, hash));
-    }
-  };
-  return repo;
-}
 function createSettingsRepo(store) {
   return {
     async get(key) {
@@ -886,7 +848,6 @@ function createRepos(store, options = {}) {
     accounts: createAccountsRepo(store, now),
     sessions: createSessionsRepo(store, now),
     bans: createBansRepo(store, now),
-    ratelimits: createRateLimitsRepo(store, now),
     settings: createSettingsRepo(store),
     mapStorage: (scope, namespace) => createMapStorageRepo(store, {
       scope,
@@ -9331,8 +9292,6 @@ var skinRegistry = new SkinRegistry();
 
 // src/core/identity/account-routes.ts
 var SESSION_COOKIE_NAME = "cajonzero_session";
-var RATE_LIMIT_MAX_ATTEMPTS = 5;
-var RATE_LIMIT_WINDOW_SECONDS = 300;
 var USERNAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]{2,31}$/;
 var MIN_PASSWORD_LENGTH = 10;
 var MAX_PASSWORD_LENGTH = 128;
@@ -9401,22 +9360,6 @@ function clientIp(request) {
   }
   return "unknown";
 }
-async function enforceAttempts(c, deps, attempts) {
-  let retryAfter = null;
-  for (const attempt of attempts) {
-    const state = await deps.ratelimits.increment(attempt.scope, attempt.key, {
-      windowSeconds: RATE_LIMIT_WINDOW_SECONDS
-    });
-    if (state.count > RATE_LIMIT_MAX_ATTEMPTS) {
-      const seconds = Math.max(1, Math.ceil((state.expiresAt - deps.now()) / 1e3));
-      retryAfter = retryAfter === null ? seconds : Math.max(retryAfter, seconds);
-    }
-  }
-  if (retryAfter !== null) {
-    c.header("Retry-After", String(retryAfter));
-    throw new HttpError(429, "rate_limited");
-  }
-}
 async function issueSession(c, deps, account, ip) {
   const minted = await mintSessionToken(
     {
@@ -9449,10 +9392,6 @@ function accountRoutes(deps) {
     const username = body.username;
     const password = body.password;
     const ip = clientIp(c.req.raw);
-    await enforceAttempts(c, deps, [
-      { scope: "register-ip", key: ip },
-      { scope: "register-account", key: username.toLowerCase() }
-    ]);
     const saltBytes = randomSalt();
     const passwordHash = await derivePassword(password, saltBytes);
     let account;
@@ -9477,11 +9416,6 @@ function accountRoutes(deps) {
     const username = body.username;
     const password = body.password;
     const ip = clientIp(c.req.raw);
-    const attempts = [{ scope: "login-ip", key: ip }];
-    if (username.length > 0) {
-      attempts.push({ scope: "login-account", key: username.toLowerCase() });
-    }
-    await enforceAttempts(c, deps, attempts);
     const account = username.length > 0 ? await deps.accounts.getByUsername(username) : void 0;
     if (account === void 0 || account.disabled) {
       await dummyVerify(password);
@@ -10180,7 +10114,6 @@ function registerRoutes(app, deps) {
       now: deps.now,
       accounts: repos.accounts,
       sessions: repos.sessions,
-      ratelimits: repos.ratelimits,
       getSession,
       sessionSecret: deps.sessionSecret,
       environment: deps.environment,
@@ -24633,6 +24566,8 @@ var Room = class {
   mapLoading;
   worldReady = false;
   snapshotRestored = false;
+  /** One-shot guard for the "proof without sessionSecret" diagnostic. */
+  guestWarningLogged = false;
   persistence;
   socketsStarted = false;
   perf = { minPing: 0, maxPing: 0, avgPing: 0, pingCount: 0 };
@@ -24978,6 +24913,13 @@ var Room = class {
         this.pendingIdentities.set(sessionId, identity2);
       }
     } else {
+      const proof = extractSessionProof(request.headers.get("sec-websocket-protocol"));
+      if (proof !== void 0 && !this.guestWarningLogged) {
+        this.guestWarningLogged = true;
+        this.logger.error(
+          "cajonzero: a session proof was supplied but no sessionSecret is configured; players join as guest. Pass serve({ sessionSecret: (env) => env.<SECRET> })."
+        );
+      }
       identity2 = guestIdentity(sessionId);
     }
     const ip = resolveClientIp(request);

package/dist/{providers-Dh-umPQ6.d.ts → providers-BX7e4pNW.d.ts}

@@ -199,7 +199,7 @@ declare function createMemoryStore(): Store;
  * cajonzero — typed repositories over the unstorage layer (T4).
  *
  * Thin, dependency-injected repositories for the embedded account system
- * (`accounts`, `sessions`, `bans`, `ratelimits`), runtime settings, and the
+ * (`accounts`, `sessions`, `bans`), runtime settings, and the
  * map-script storage-kv API (`mapStorage`). Each is a small closure over a
  * {@link Store}; no repository knows about HTTP, Hono, or Cloudflare globals, so
  * every one is exercisable on the in-memory driver.
@@ -332,21 +332,6 @@ interface BansRepo {
     deleteByKey(key: string): Promise<boolean>;
     isActive(ban: BanRecord, at?: number): boolean;
 }
-/** Fixed-window rate-limit state. */
-interface RateLimitState {
-    count: number;
-    windowStart: number;
-    expiresAt: number;
-}
-interface RateLimitIncrementOptions {
-    readonly windowSeconds?: number;
-    readonly amount?: number;
-}
-interface RateLimitsRepo {
-    increment(scope: string, hash: string, options?: RateLimitIncrementOptions): Promise<RateLimitState>;
-    get(scope: string, hash: string): Promise<RateLimitState | undefined>;
-    reset(scope: string, hash: string): Promise<void>;
-}
 interface SettingsRepo {
     get<T = JSONValue>(key: string): Promise<T | undefined>;
     set(key: string, value: JSONValue): Promise<void>;
@@ -384,7 +369,6 @@ interface Repos {
     readonly accounts: AccountsRepo;
     readonly sessions: SessionsRepo;
     readonly bans: BansRepo;
-    readonly ratelimits: RateLimitsRepo;
     readonly settings: SettingsRepo;
     /** Builds a map-script storage repo for one `(scope, namespace)`. */
     mapStorage(scope: string, namespace: string): MapStorageRepo;
@@ -5093,6 +5077,8 @@ declare class Room {
     private mapLoading;
     private worldReady;
     private snapshotRestored;
+    /** One-shot guard for the "proof without sessionSecret" diagnostic. */
+    private guestWarningLogged;
     private persistence;
     private socketsStarted;
     private perf;

package/dist/scaffold.d.ts

@@ -146,5 +146,63 @@ declare function toPackageName(folder: string): string;
  */
 declare function createProject(folder: string, options?: CreateProjectOptions): ScaffoldResult;
 
-export { SCAFFOLD_COMPATIBILITY_DATE, SCAFFOLD_CONFIG_CONTENT, SCAFFOLD_ENTRY_CONTENT, SCAFFOLD_ENTRY_PATH, SCAFFOLD_KV_PLACEHOLDER_ID, SCAFFOLD_MAPS_CONTENT, ScaffoldError, buildScaffoldFiles, createProject, readCajonzeroPackage, toPackageName };
-export type { CajonzeroPackageInfo, CreateProjectOptions, ScaffoldErrorCode, ScaffoldFile, ScaffoldResult, ScaffoldTemplateOptions };
+/** Where one setup value is written. */
+type SetupKind = "var" | "secret";
+/** One configurable value. */
+interface SetupField {
+    readonly name: string;
+    /** Chinese prompt label. */
+    readonly label: string;
+    readonly kind: SetupKind;
+    /** `true` for the values a project cannot run without. */
+    readonly required: boolean;
+    /** Default shown in the prompt (secrets: generated when absent). */
+    readonly default?: string;
+    /** Short explanation printed next to the prompt. */
+    readonly hint?: string;
+}
+/** Every value `setup` manages. */
+declare const SETUP_FIELDS: readonly SetupField[];
+/** Files `setup` touched. */
+interface SetupResult {
+    readonly configPath: string;
+    readonly devVarsPath: string;
+    /** Non-secret values written to `wrangler.jsonc`. */
+    readonly vars: Record<string, string>;
+    /** Secrets written to `.dev.vars`. */
+    readonly secrets: Record<string, string>;
+}
+interface SetupOptions {
+    readonly cwd?: string;
+    /** Wrangler config path (default `wrangler.jsonc`). */
+    readonly configPath?: string;
+    /** Values to write; managed keys absent here are removed. */
+    readonly values: Readonly<Record<string, string>>;
+}
+/** Generated default for a required secret. */
+declare function generateSecret(): string;
+/** Generated default for the owner token (shorter, URL-safe). */
+declare function generateAdminToken(): string;
+/** Default value for a field when it has no configured value yet. */
+declare function suggestedValue(field: SetupField): string | undefined;
+/** Parse `.dev.vars` (`KEY=value`, `#` comments). */
+declare function parseDevVars(text: string): Record<string, string>;
+/** Serialize `.dev.vars` (stable order, trailing newline). */
+declare function serializeDevVars(values: Record<string, string>): string;
+/**
+ * Merge `vars` into the `wrangler.jsonc` `"vars"` object.
+ *
+ * Keys not managed by cajonzero are preserved; managed keys absent from `vars`
+ * are removed so clearing a setting falls back to its default.
+ */
+declare function setWranglerVars(raw: string, vars: Readonly<Record<string, string>>): string;
+/** Read currently configured values (wrangler vars + `.dev.vars`). */
+declare function readSetupValues(cwd: string, configPath: string, devVarsPath: string): Record<string, string>;
+/**
+ * Apply the answers: non-secret values to `wrangler.jsonc`, secrets to
+ * `.dev.vars`. Throws when the project files are missing.
+ */
+declare function applySetup(options: SetupOptions): SetupResult;
+
+export { SCAFFOLD_COMPATIBILITY_DATE, SCAFFOLD_CONFIG_CONTENT, SCAFFOLD_ENTRY_CONTENT, SCAFFOLD_ENTRY_PATH, SCAFFOLD_KV_PLACEHOLDER_ID, SCAFFOLD_MAPS_CONTENT, SETUP_FIELDS, ScaffoldError, applySetup, buildScaffoldFiles, createProject, generateAdminToken, generateSecret, parseDevVars, readCajonzeroPackage, readSetupValues, serializeDevVars, setWranglerVars, suggestedValue, toPackageName };
+export type { CajonzeroPackageInfo, CreateProjectOptions, ScaffoldErrorCode, ScaffoldFile, ScaffoldResult, ScaffoldTemplateOptions, SetupField, SetupKind, SetupOptions, SetupResult };