def-game 5.1.0-timeout.0 → 6.1.0

package/templates/starter/public/app.js

@@ -0,0 +1,93 @@
+const $ = id => document.getElementById(id);
+let roomId = new URL(location.href).searchParams.get('room');
+let socket, view, stopped = false, refreshing;
+const { issuer } = await (await fetch('/auth-config')).json();
+const status = text => { $('status').textContent = text; };
+
+function login() {
+  stopped = true;
+  const url = new URL('/login', issuer); url.searchParams.set('return_to', location.href); location.assign(url);
+}
+async function refresh() {
+  if (!refreshing) refreshing = fetch(new URL('/refresh', issuer), { credentials: 'include', cache: 'no-store' })
+    .then(response => { if (response.status === 401) { login(); return false; } if (!response.ok) throw Error('認証を更新できません'); return true; })
+    .finally(() => { refreshing = undefined; });
+  return refreshing;
+}
+/** 認証段階の401だけ再試行する。通信失敗やゲームCommandを自動再送しない。 */
+async function api(path, body) {
+  const options = { credentials: 'include', cache: 'no-store', ...(body === undefined ? {} : {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }) };
+  let response = await fetch(path, options);
+  if (response.status === 401) {
+    if (!(await refresh())) throw Error('ログインへ移動します');
+    response = await fetch(path, options);
+    if (response.status === 401) { login(); throw Error('ログインが必要です'); }
+  }
+  const result = await response.json();
+  if (!response.ok || result.ok === false) throw Error(result.error?.detail ?? result.error?.code ?? '操作できませんでした');
+  return result;
+}
+function showRoomId() {
+  $('join').textContent = roomId ? 'この部屋に参加' : '部屋を作る';
+  $('invite-label').hidden = !roomId;
+  if (roomId) { history.replaceState(null, '', `?room=${encodeURIComponent(roomId)}`); $('invite').value = location.href; }
+}
+async function connect() {
+  if (stopped) return;
+  await api('/api/me'); // 再接続時に認証を確認する。接続中の定期再認証は行わない。
+  if (stopped) return;
+  const url = new URL(`/ws/rooms/${roomId}`, location.href); url.protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
+  const current = new WebSocket(url); socket = current;
+  current.onopen = () => { status('接続しました'); $('join-form').hidden = true; };
+  current.onmessage = event => {
+    const message = JSON.parse(event.data);
+    if (message.type === 'ViewStateEvent') { view = message.viewState; render(); }
+    if (message.ok === false || message.type === 'ProtocolErrorEvent') status(message.error?.detail ?? message.error?.code ?? '操作できませんでした');
+  };
+  current.onclose = event => {
+    if (socket !== current || stopped) return;
+    if (event.code === 1008) { status('この部屋への接続が許可されていません'); return; }
+    status('再接続しています…'); setTimeout(() => connect().catch(error => status(error.message)), 1500);
+  };
+}
+function send(command) {
+  if (socket?.readyState !== WebSocket.OPEN) { status('接続をお待ちください'); return; }
+  socket.send(JSON.stringify({ type: 'GameCommandRequest', requestId: crypto.randomUUID(), command }));
+}
+function render() {
+  $('room').hidden = false;
+  $('phase').textContent = { lobby: 'ロビー', playing: '対戦中', finished: '結果' }[view.phase];
+  $('players').replaceChildren(...view.players.map(player => {
+    const li = document.createElement('li'); li.textContent = `${player.name}${player.isYou ? '（あなた）' : ''} — ${player.score}点 / ${player.ready ? '準備済み' : 'デッキ未選択'}`; return li;
+  }));
+  $('deck-form').hidden = !view.availableActions.includes('select-deck');
+  $('start').hidden = !view.availableActions.includes('start');
+  $('turn').textContent = view.activePlayer ? `${view.activePlayer}さんの手番` : '';
+  $('cards').replaceChildren(...(view.phase === 'playing' ? view.yourCards : []).map(card => {
+    const button = document.createElement('button'); button.textContent = `${card.id} / ${card.power}点`;
+    button.disabled = !view.availableActions.includes('play');
+    button.onclick = () => send({ type: 'play', cardId: card.id, decisionId: view.decision.id }); return button;
+  }));
+}
+$('join-form').onsubmit = async event => {
+  event.preventDefault(); $('join').disabled = true;
+  try {
+    if (!roomId) { roomId = (await api('/api/rooms', {})).roomId; showRoomId(); }
+    await api(`/api/rooms/${roomId}/join`, { name: $('name').value });
+    await connect();
+  } catch (error) { status(error.message); } finally { $('join').disabled = false; }
+};
+$('deck-form').onsubmit = async event => {
+  event.preventDefault();
+  try { await api(`/api/rooms/${roomId}/deck`, { deckId: $('deck').value }); } catch (error) { status(error.message); }
+};
+$('start').onclick = () => send({ type: 'start' });
+showRoomId();
+try {
+  await api('/api/me');
+  const { decks } = await api('/api/decks');
+  for (const deck of decks) { const option = document.createElement('option'); option.value = deck.id; option.textContent = deck.name; $('deck').append(option); }
+  status('表示名を入力してください');
+} catch (error) { status(error.message); }

package/templates/starter/public/index.html

@@ -0,0 +1,37 @@
+<!doctype html>
+<html lang="ja">
+<head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>DefGame Starter</title>
+  <style>
+    :root { font-family: system-ui, sans-serif; color: #182c32; background: #f1f5f3; }
+    body { max-width: 700px; margin: 48px auto; padding: 0 24px; }
+    h1 { margin-bottom: 8px; } section { background: white; padding: 24px; margin: 20px 0; border-radius: 12px; }
+    input, button, select { font: inherit; padding: 10px; margin: 4px; border: 1px solid #a7b9b4; border-radius: 6px; }
+    button { cursor: pointer; background: #174d46; color: white; } button:disabled { opacity: .4; cursor: default; }
+    #status { min-height: 1.5em; } #invite { width: 95%; } li { margin: 12px 0; }
+    .muted { color: #607570; } [hidden] { display: none !important; }
+  </style>
+</head>
+<body>
+  <h1>DefGame Starter</h1>
+  <p class="muted">2人がデッキを選び、1枚ずつカードを出します。得点が高い方の勝ち。手番は30秒です。</p>
+  <p id="status" role="status">接続を準備しています…</p>
+  <section>
+    <form id="join-form">
+      <label>表示名 <input id="name" maxlength="24" required autocomplete="nickname"></label>
+      <button id="join">部屋を作る</button>
+    </form>
+    <label id="invite-label" hidden>このURLを相手に共有してください<input id="invite" readonly></label>
+  </section>
+  <section id="room" hidden>
+    <h2 id="phase">ロビー</h2>
+    <ul id="players"></ul>
+    <form id="deck-form"><label>デッキ <select id="deck"></select></label><button id="select-deck">選ぶ</button></form>
+    <button id="start" hidden>ゲーム開始</button>
+    <p id="turn"></p>
+    <div id="cards"></div>
+  </section>
+  <script type="module" src="/app.js"></script>
+</body>
+</html>

package/templates/starter/scripts/dev-auth.mjs

@@ -0,0 +1,40 @@
+import { createServer } from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { generateKeyPair, exportJWK, SignJWT } from 'jose';
+
+/** ローカル開発専用の認証サーバー。Workerからimportせず、公開デプロイに含めない。 */
+export async function startDevAuth({ port = 8790, appOrigin = 'http://127.0.0.1:8787' } = {}) {
+  const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true });
+  const jwk = { ...await exportJWK(publicKey), kid: 'local-development', alg: 'ES256', use: 'sig' };
+  let issuer;
+  const server = createServer((request, response) => {
+    void handle(request, response).catch(() => { response.writeHead(500); response.end('Local authentication failed'); });
+  });
+  async function handle(request, response) {
+    const url = new URL(request.url, issuer);
+    response.setHeader('Cache-Control', 'no-store');
+    if (request.headers.origin && request.headers.origin !== appOrigin) { response.writeHead(403); response.end(); return; }
+    response.setHeader('Access-Control-Allow-Origin', appOrigin);
+    response.setHeader('Access-Control-Allow-Credentials', 'true');
+    if (url.pathname === '/.well-known/jwks.json') {
+      response.setHeader('Content-Type', 'application/json'); response.end(JSON.stringify({ keys: [jwk] })); return;
+    }
+    if (url.pathname !== '/login' && url.pathname !== '/refresh') { response.writeHead(404); response.end(); return; }
+    const cookieActor = request.headers.cookie?.match(/(?:^|;\s*)__dev_actor=([0-9a-f-]{36})(?:;|$)/)?.[1];
+    if (url.pathname === '/refresh' && !cookieActor) { response.writeHead(401); response.end(); return; }
+    const actorId = cookieActor ?? randomUUID();
+    const token = await new SignJWT({}).setProtectedHeader({ alg: 'ES256', kid: jwk.kid })
+      .setIssuer(issuer).setAudience('def-game-local').setSubject(actorId).setIssuedAt().setExpirationTime('15m').sign(privateKey);
+    response.setHeader('Set-Cookie', [
+      `__token=${token}; HttpOnly; SameSite=Lax; Path=/`,
+      `__dev_actor=${actorId}; HttpOnly; SameSite=Lax; Path=/`,
+    ]);
+    if (url.pathname === '/refresh') { response.writeHead(204); response.end(); return; }
+    const target = new URL(url.searchParams.get('return_to') ?? '/', appOrigin);
+    if (target.origin !== appOrigin) { response.writeHead(400); response.end('Invalid return URL'); return; }
+    response.writeHead(302, { Location: target.toString() }); response.end();
+  }
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+  issuer = `http://127.0.0.1:${server.address().port}`;
+  return { issuer, jwksUrl: `${issuer}/.well-known/jwks.json`, close: () => new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve())) };
+}

package/templates/starter/scripts/dev.mjs

@@ -0,0 +1,16 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { startDevAuth } from './dev-auth.mjs';
+
+// CLIの--varはローカル実行だけに適用する。本番のWrangler設定を書き換えない。
+const auth = await startDevAuth();
+const require = createRequire(import.meta.url);
+const worker = spawn(process.execPath, [path.join(path.dirname(require.resolve('wrangler/package.json')), 'bin/wrangler.js'), 'dev', '--local',
+  '--ip', '127.0.0.1', '--port', '8787',
+  '--var', `AUTH_ISSUER:${auth.issuer}`, '--var', 'AUTH_AUDIENCE:def-game-local', '--var', `AUTH_JWKS_URL:${auth.jwksUrl}`,
+], { stdio: 'inherit' });
+console.log('Open http://127.0.0.1:8787 — use another browser profile for the second player.');
+for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => { worker.kill(signal); });
+worker.once('error', async error => { console.error(error.message); await auth.close(); process.exitCode = 1; });
+worker.once('exit', async code => { await auth.close(); process.exitCode = code ?? 0; });

package/templates/starter/src/env.ts

@@ -0,0 +1,10 @@
+import type { RoomDurableObject } from './room.js';
+
+/** アプリ所有のbinding。外部デッキ保存などを追加するときはここへ接続する。 */
+export interface Env {
+  ROOMS: DurableObjectNamespace<RoomDurableObject>;
+  ASSETS: Fetcher;
+  AUTH_ISSUER: string;
+  AUTH_AUDIENCE: string;
+  AUTH_JWKS_URL: string;
+}

package/templates/starter/src/external/decks.ts

@@ -0,0 +1,15 @@
+import type { Deck } from '../game/types.js';
+
+/** ゲーム進行から独立したデッキ取得の例。Aquare等ではここを個人保存・図鑑APIへ接続する。 */
+const decks: readonly Deck[] = [
+  { id: 'swift', name: 'Swift', cards: [{ id: 'swift-1', power: 2 }, { id: 'swift-2', power: 4 }] },
+  { id: 'steady', name: 'Steady', cards: [{ id: 'steady-1', power: 3 }, { id: 'steady-2', power: 5 }] },
+];
+export function listDecks() { return decks.map(({ id, name }) => ({ id, name })); }
+
+/** 認証済みActorからアクセス可否を判断できる入口。例では両方を全員に提供する。 */
+export async function loadDeck(actorId: string, deckId: string): Promise<Deck | null> {
+  if (!actorId) return null;
+  const deck = decks.find(d => d.id === deckId);
+  return deck ? structuredClone(deck) : null;
+}

package/templates/starter/src/game/definition.ts

@@ -0,0 +1,79 @@
+import type { GameDefinition, TransitionResult } from 'def-game';
+import type { ActorCommand, SystemCommand, State, View, Effect, GameError } from './types.js';
+
+const TURN_MS = 30_000;
+const reject = (error: GameError): TransitionResult<State, Effect, GameError> => ({ ok: false, error });
+
+/** 外部I/Oを行わず、次の入力を待てる状態とEffectを返す。 */
+export const game: GameDefinition<State, ActorCommand | SystemCommand, string, View, Effect, GameError> = {
+  createInitialState: () => ({ phase: 'lobby', players: [], turn: 0, revision: 0, decision: null }),
+  handleCommand(state, command, context) {
+    if (command.type === 'decision-timeout') {
+      if (context.origin !== 'system' || !Number.isFinite(command.now)) return reject('InvalidCommand');
+      if (state.phase !== 'playing' || !state.decision || command.decisionId !== state.decision.id
+        || command.now < state.decision.deadline) return reject('StaleDecision');
+      return finishTurn(state, 0, command.now);
+    }
+    if (context.origin !== 'actor') return reject('InvalidCommand');
+    const index = state.players.findIndex(p => p.actorId === context.actorId);
+    if (command.type === 'join') {
+      if (index >= 0) return { ok: true, state, effects: [] }; // 再送・再参加で席を増やさない
+      if (state.phase !== 'lobby') return reject('AlreadyStarted');
+      if (state.players.length >= 2) return reject('RoomFull');
+      if (typeof command.name !== 'string' || !command.name.trim() || command.name.trim().length > 24) return reject('InvalidName');
+      return { ok: true, state: { ...state, revision: state.revision + 1,
+        players: [...state.players, { actorId: context.actorId, name: command.name.trim(), deck: null, score: 0 }] }, effects: [] };
+    }
+    if (index < 0) return reject('NotMember');
+    if (command.type === 'select-deck') {
+      if (state.phase !== 'lobby') return reject('AlreadyStarted');
+      if (!command.deck.cards.length || command.deck.cards.some(c => !c.id || !Number.isFinite(c.power))) return reject('InvalidCard');
+      return { ok: true, state: { ...state, revision: state.revision + 1,
+        players: state.players.map((p, i) => i === index ? { ...p, deck: command.deck } : p) }, effects: [] };
+    }
+    if (!Number.isFinite(command.now)) return reject('InvalidCommand');
+    if (command.type === 'start') {
+      if (state.phase !== 'lobby') return reject('AlreadyStarted');
+      if (state.players.length !== 2 || state.players.some(p => !p.deck)) return reject('NotReady');
+      const decision = { id: `turn-${state.revision + 1}`, deadline: command.now + TURN_MS };
+      return { ok: true, state: { ...state, phase: 'playing', revision: state.revision + 1, decision },
+        effects: [{ type: 'schedule', decisionId: decision.id, deadline: decision.deadline }] };
+    }
+    if (command.type === 'play') {
+      if (state.phase !== 'playing' || !state.decision || state.decision.id !== command.decisionId
+        || command.now >= state.decision.deadline) return reject('StaleDecision');
+      if (index !== state.turn) return reject('NotYourTurn');
+      const card = state.players[index].deck?.cards.find(c => c.id === command.cardId);
+      if (!card) return reject('InvalidCard');
+      return finishTurn(state, card.power, command.now);
+    }
+    return reject('InvalidCommand');
+  },
+  project(state, actorId) {
+    const index = state.players.findIndex(p => p.actorId === actorId);
+    const member = index >= 0;
+    return {
+      phase: state.phase,
+      players: state.players.map(p => ({ name: p.name, score: p.score, ready: p.deck !== null, isYou: p.actorId === actorId })),
+      yourCards: member ? state.players[index].deck?.cards ?? [] : [],
+      activePlayer: state.phase === 'playing' ? state.players[state.turn].name : null,
+      decision: state.decision,
+      availableActions: !member ? [] : state.phase === 'lobby'
+        ? ['select-deck', ...(state.players.length === 2 && state.players.every(p => p.deck) ? ['start' as const] : [])]
+        : state.phase === 'playing' && index === state.turn ? ['play'] : [],
+    };
+  },
+};
+
+/** 手番終了と次の期限を同じ遷移で決める。期限切れは得点0として扱う。 */
+function finishTurn(state: State, score: number, now: number): TransitionResult<State, Effect, GameError> {
+  const players = state.players.map((p, i) => i === state.turn ? { ...p, score } : p);
+  const revision = state.revision + 1;
+  if (state.turn + 1 === players.length) {
+    return { ok: true, state: { ...state, players, revision, phase: 'finished', decision: null },
+      effects: [{ type: 'cancel', decisionId: state.decision!.id }, { type: 'finished' }] };
+  }
+  const decision = { id: `turn-${revision}`, deadline: now + TURN_MS };
+  return { ok: true, state: { ...state, players, revision, turn: state.turn + 1, decision },
+    effects: [{ type: 'schedule', decisionId: decision.id, deadline: decision.deadline }] };
+}

package/templates/starter/src/game/types.ts

@@ -0,0 +1,44 @@
+import type { GameTypes } from 'def-game/cloudflare';
+
+/** デッキの内容はアプリが取得し、ゲームがスナップショットとして保存する。 */
+export interface Card { readonly id: string; readonly power: number }
+export interface Deck { readonly id: string; readonly name: string; readonly cards: readonly Card[] }
+export interface Player {
+  readonly actorId: string;
+  readonly name: string;
+  readonly deck: Deck | null;
+  readonly score: number;
+}
+/** 所有者のいないロビーを初期状態とする、2人で1回ずつカードを出す最小ゲーム。 */
+export interface State {
+  readonly phase: 'lobby' | 'playing' | 'finished';
+  readonly players: readonly Player[];
+  readonly turn: number;
+  readonly revision: number;
+  readonly decision: { readonly id: string; readonly deadline: number } | null;
+}
+export type ActorCommand =
+  | { readonly type: 'join'; readonly name: string }
+  | { readonly type: 'select-deck'; readonly deck: Deck }
+  | { readonly type: 'start'; readonly now: number }
+  | { readonly type: 'play'; readonly cardId: string; readonly decisionId: string; readonly now: number };
+export type SystemCommand = { readonly type: 'decision-timeout'; readonly decisionId: string; readonly now: number };
+export type Effect =
+  | { readonly type: 'schedule'; readonly decisionId: string; readonly deadline: number }
+  | { readonly type: 'cancel'; readonly decisionId: string }
+  | { readonly type: 'finished' };
+export type GameError = 'AlreadyStarted' | 'RoomFull' | 'InvalidName' | 'NotMember' | 'NotReady'
+  | 'NotYourTurn' | 'InvalidCard' | 'StaleDecision' | 'InvalidCommand';
+/** 他人のカードは公開しない。クライアントはavailableActionsに従って操作を表示する。 */
+export interface View {
+  readonly phase: State['phase'];
+  readonly players: readonly { readonly name: string; readonly score: number; readonly ready: boolean; readonly isYou: boolean }[];
+  readonly yourCards: readonly Card[];
+  readonly activePlayer: string | null;
+  readonly decision: State['decision'];
+  readonly availableActions: readonly ('select-deck' | 'start' | 'play')[];
+}
+export interface Types extends GameTypes {
+  state: State; actorCommand: ActorCommand; systemCommand: SystemCommand;
+  view: View; effect: Effect; error: GameError;
+}

package/templates/starter/src/game-adapter.ts

@@ -0,0 +1,29 @@
+import type { GameAdapter } from 'def-game/cloudflare';
+import type { Env } from './env.js';
+import { game } from './game/definition.js';
+import type { Types } from './game/types.js';
+
+/** WSで許す入力を制限し、時刻はクライアントの自己申告を使わず実行側で付ける。 */
+export const adapter: GameAdapter<Env, Types> = {
+  game,
+  webSocket: { parseCommand(input) {
+    if (typeof input !== 'object' || input === null || !('type' in input)) return null;
+    if (input.type === 'start') return { type: 'start', now: Date.now() };
+    if (input.type === 'play' && 'cardId' in input && typeof input.cardId === 'string'
+      && 'decisionId' in input && typeof input.decisionId === 'string') {
+      return { type: 'play', cardId: input.cardId, decisionId: input.decisionId, now: Date.now() };
+    }
+    // select-deckはHTTPで外部情報を取得してからdispatchする。WSからの自己申告は拒否。
+    return null;
+  } },
+  canConnect: (state, actorId) => state.players.some(p => p.actorId === actorId),
+  timeout: {
+    effect: effect => effect.type === 'schedule' || effect.type === 'cancel' ? effect : null,
+    command: decisionId => ({ type: 'decision-timeout', decisionId, now: Date.now() }),
+  },
+  async executeEffect(effect, { roomId }) {
+    if (effect.type === 'finished') console.info('Game finished', { roomId });
+    // 外部処理の結果をゲームへ戻す場合は { command: SystemCommand } を返す。
+    // 保存済み状態を直接変更しない。外部配送はbest-effort。
+  },
+};

package/templates/starter/src/index.ts

@@ -0,0 +1,88 @@
+import { Hono } from 'hono';
+import { getCookie } from 'hono/cookie';
+import { getRoom } from 'def-game/cloudflare';
+import { authenticate } from './auth.js';
+import { listDecks, loadDeck } from './external/decks.js';
+import type { Env } from './env.js';
+export { RoomDurableObject } from './room.js';
+
+const app = new Hono<{ Bindings: Env; Variables: { actorId: string } }>();
+
+/** 認証とリクエスト保護を独自APIにも共通適用する。static shellに秘密情報は置かない。 */
+app.use('*', async (c, next) => {
+  if (!c.req.path.startsWith('/api/') && !c.req.path.startsWith('/ws/')) return next();
+  c.header('Cache-Control', 'no-store');
+  const origin = c.req.header('origin');
+  if (origin && origin !== new URL(c.req.url).origin && (c.req.method !== 'GET' || c.req.path.startsWith('/ws/'))) {
+    return c.json({ ok: false, error: { code: 'InvalidOrigin' } }, 403);
+  }
+  const actorId = await authenticate(getCookie(c, '__token'), c.env);
+  if (!actorId) return c.json({ ok: false, error: { code: 'AuthenticationRequired' } }, 401);
+  c.set('actorId', actorId);
+  await next();
+});
+app.get('/auth-config', c => c.json({ issuer: c.env.AUTH_ISSUER }, 200, { 'Cache-Control': 'no-store' }));
+app.get('/api/me', c => c.json({ ok: true, actorId: c.get('actorId') }));
+app.get('/api/decks', c => c.json({ decks: listDecks() }));
+
+app.post('/api/rooms', async c => {
+  // 公開room IDはアプリ所有。DO内部のIDと同じ形式にする必要はない。
+  const roomId = crypto.randomUUID();
+  const result = await getRoom(c.env.ROOMS, c.env.ROOMS.idFromName(roomId)).create();
+  return result.ok ? c.json({ ok: true, roomId }, 201) : c.json(result, 500);
+});
+
+app.use('/api/rooms/:roomId/*', async (c, next) => {
+  if (!validRoomId(c.req.param('roomId'))) return c.json({ ok: false, error: { code: 'InvalidRoomId' } }, 400);
+  await next();
+});
+app.post('/api/rooms/:roomId/join', async c => {
+  const input = await readInput(c.req.raw);
+  if (!input || typeof input.name !== 'string') return c.json({ ok: false, error: { code: 'InvalidRequest' } }, 400);
+  const room = getRoom(c.env.ROOMS, c.env.ROOMS.idFromName(c.req.param('roomId')));
+  const result = await room.dispatchActor({ actorId: c.get('actorId') }, { type: 'join', name: input.name });
+  return c.json(result, result.ok ? 200 : 409);
+});
+app.post('/api/rooms/:roomId/deck', async c => {
+  const input = await readInput(c.req.raw);
+  if (!input || typeof input.deckId !== 'string') return c.json({ ok: false, error: { code: 'InvalidRequest' } }, 400);
+  // ここで外部ドメインの取得・権限確認を済ませる。本文のdeckやpowerは使用しない。
+  const deck = await loadDeck(c.get('actorId'), input.deckId);
+  if (!deck) return c.json({ ok: false, error: { code: 'DeckNotFound' } }, 404);
+  const room = getRoom(c.env.ROOMS, c.env.ROOMS.idFromName(c.req.param('roomId')));
+  const result = await room.dispatchActor({ actorId: c.get('actorId') }, { type: 'select-deck', deck });
+  return c.json(result, result.ok ? 200 : 409);
+});
+app.get('/ws/rooms/:roomId', c => {
+  if (!validRoomId(c.req.param('roomId'))) return c.json({ ok: false, error: { code: 'InvalidRoomId' } }, 400);
+  if (c.req.header('upgrade')?.toLowerCase() !== 'websocket') return c.json({ ok: false, error: { code: 'InvalidRequest' } }, 426);
+  return getRoom(c.env.ROOMS, c.env.ROOMS.idFromName(c.req.param('roomId'))).connect({ actorId: c.get('actorId') });
+});
+app.all('/api/*', c => c.json({ ok: false, error: { code: 'NotFound' } }, 404));
+app.all('/ws/*', c => c.json({ ok: false, error: { code: 'NotFound' } }, 404));
+app.all('*', c => c.env.ASSETS.fetch(c.req.raw));
+app.onError((_error, c) => {
+  console.error('Worker request failed');
+  return c.json({ ok: false, error: { code: 'InternalError' } }, 500);
+});
+export default app;
+
+function validRoomId(id: string) { return /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(id); }
+/** 上限付きでJSONを読む。認可やゲームルールはここへ入れない。 */
+async function readInput(request: Request): Promise<Record<string, unknown> | null> {
+  if (!request.headers.get('content-type')?.startsWith('application/json') || !request.body) return null;
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = []; let length = 0;
+  while (true) {
+    const { done, value } = await reader.read(); if (done) break;
+    length += value.byteLength;
+    if (length > 64 * 1024) { await reader.cancel(); return null; }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(length); let offset = 0;
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+  try {
+    const input: unknown = JSON.parse(new TextDecoder().decode(bytes));
+    return typeof input === 'object' && input !== null && !Array.isArray(input) ? input as Record<string, unknown> : null;
+  } catch { return null; }
+}

package/templates/starter/src/room.ts

@@ -0,0 +1,9 @@
+import { SessionRuntime } from 'def-game/cloudflare';
+import { adapter } from './game-adapter.js';
+import type { Env } from './env.js';
+import type { Types } from './game/types.js';
+
+/** 共通DO実装にこのゲームのadapterを接続する。状態保存・WS管理を複製しない。 */
+export class RoomDurableObject extends SessionRuntime<Env, Types> {
+  protected readonly adapter = adapter;
+}

package/templates/starter/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "compilerOptions": {
+    "target": "ES2022", "lib": ["ES2022"], "module": "ESNext",
+    "moduleResolution": "Bundler", "types": ["@cloudflare/workers-types"],
+    "strict": true, "noEmit": true, "skipLibCheck": true
+  },
+  "include": ["src"]
+}

package/templates/starter/wrangler.jsonc

@@ -0,0 +1,14 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "def-game-starter",
+  "main": "src/index.ts",
+  "compatibility_date": "2026-09-12",
+  "assets": { "directory": "public", "binding": "ASSETS", "run_worker_first": true },
+  "durable_objects": { "bindings": [{ "name": "ROOMS", "class_name": "RoomDurableObject" }] },
+  "exports": { "RoomDurableObject": { "type": "durable-object", "storage": "sqlite" } },
+  "vars": {
+    "AUTH_ISSUER": "https://auth.waki.work",
+    "AUTH_AUDIENCE": "waki.work",
+    "AUTH_JWKS_URL": "https://auth.waki.work/.well-known/jwks.json"
+  }
+}

package/templates/worker/env.ts

@@ -1,9 +0,0 @@
-import type { SessionDurableObject } from "./session.js";
-
-export interface Env {
-  SESSIONS: DurableObjectNamespace<SessionDurableObject>;
-  ASSETS: Fetcher;
-  AUTH_ISSUER: string;
-  AUTH_AUDIENCE: string;
-  AUTH_JWKS_URL: string;
-}

package/templates/worker/index.ts

@@ -1,84 +0,0 @@
-import { Hono, type Context } from "hono";
-import { getCookie } from "hono/cookie";
-import type { ActorId, CreateSessionResponse, JoinSessionResponse, ProtocolError, PublicError } from __ADAPTER_IMPORT__;
-import type { Env } from "./env.js";
-import { authenticate } from "./auth.js";
-export { SessionDurableObject } from "./session.js";
-
-type AppEnv = { Bindings: Env; Variables: { actorId: ActorId } };
-const app = new Hono<AppEnv>();
-
-// Static Assets を含む全ルートで認証し、以後は検証済み ActorId を context から取得する。
-app.use("*", async (c, next) => {
-  const actorId = await authenticate(getCookie(c, "__token"), c.env);
-  if (!actorId) return errorResponse(c, "AuthenticationRequired", 401);
-  c.set("actorId", actorId);
-  await next();
-});
-
-app.use("*", async (c, next) => {
-  const origin = c.req.header("origin");
-  const isWebSocket = c.req.path.startsWith("/ws/");
-  if (origin && origin !== new URL(c.req.url).origin && (c.req.method !== "GET" || isWebSocket)) {
-    return errorResponse(c, "InvalidRequest", 403);
-  }
-  await next();
-});
-
-app.post("/api/sessions", (c) => joinSession(c, c.env.SESSIONS.newUniqueId(), "create"));
-
-app.post("/api/sessions/:sessionId/join", (c) => {
-  const sessionId = c.req.param("sessionId");
-  if (!/^[0-9a-f]{64}$/.test(sessionId)) return errorResponse(c, "InvalidRequest", 404);
-  return joinSession(c, c.env.SESSIONS.idFromString(sessionId), "join");
-});
-
-app.get("/ws/:sessionId", (c) => {
-  const sessionId = c.req.param("sessionId");
-  if (!/^[0-9a-f]{64}$/.test(sessionId)) return errorResponse(c, "InvalidRequest", 404);
-  if (c.req.header("upgrade")?.toLowerCase() !== "websocket") return errorResponse(c, "InvalidRequest", 426);
-  const id = c.env.SESSIONS.idFromString(sessionId);
-  // DO の Hibernation 接続をそのまま返す。token や外部のヘッダーは転送しない。
-  return c.env.SESSIONS.get(id).fetch(new Request("https://session/connect", {
-    headers: { upgrade: "websocket", "x-actor-id": c.get("actorId") },
-  }));
-});
-
-app.all("/api/*", (c) => errorResponse(c, "InvalidRequest", 404));
-app.all("/ws/*", (c) => errorResponse(c, "InvalidRequest", 404));
-app.all("*", (c) => c.env.ASSETS.fetch(c.req.raw));
-
-app.onError((_error, c) => {
-  console.error("Worker request failed");
-  return errorResponse(c, "InternalError", 500);
-});
-
-export default app;
-
-/** create と join に共通する本文検証と DO 呼び出し。本文のゲーム固有形式と参加可否は DO 内の adapter / domain が判断する。 */
-async function joinSession(c: Context<AppEnv>, id: DurableObjectId, operation: "create" | "join"): Promise<Response> {
-  if (!c.req.header("content-type")?.startsWith("application/json")) return errorResponse(c, "InvalidRequest", 400);
-  const raw = await c.req.text();
-  if (raw.length > 64 * 1024) return errorResponse(c, "InvalidRequest", 400);
-  let body: unknown;
-  try { body = JSON.parse(raw); } catch { return errorResponse(c, "InvalidRequest", 400); }
-
-  const result = await c.env.SESSIONS.get(id).fetch(new Request(`https://session/${operation}`, {
-    method: "POST", headers: { "x-actor-id": c.get("actorId"), "content-type": "application/json" },
-    body: JSON.stringify(body),
-  }));
-  const data = await result.json<{ ok: true } | { ok: false; error: PublicError }>();
-  const type = operation === "create" ? "CreateSessionResponse" : "JoinSessionResponse";
-  const response: CreateSessionResponse | JoinSessionResponse = data.ok
-    ? { type, ok: true, sessionId: id.toString() }
-    : { type, ok: false, error: data.error };
-  return Response.json(response, { status: result.status });
-}
-
-/** middleware で拒否する場合も、既存の公開レスポンス形式を維持する。 */
-function errorResponse(c: Context<AppEnv>, code: ProtocolError["code"], status: 400 | 401 | 403 | 404 | 426 | 500): Response {
-  const type = c.req.method === "POST" && c.req.path === "/api/sessions"
-    ? "CreateSessionResponse"
-    : /^\/api\/sessions\/[0-9a-f]{64}\/join$/.test(c.req.path) ? "JoinSessionResponse" : undefined;
-  return c.json({ ...(type ? { type } : {}), ok: false, error: { code } }, status);
-}

package/templates/worker/runtime/game-adapter.ts

@@ -1,15 +0,0 @@
-import type { GameDefinition } from "def-game";
-
-/**
- * 生成対象の runtime とゲーム固有コードの接続契約。GameDefinition 自体は変更しない。
- * decoder は未検証の本文からゲーム command を作り、形式不正なら null を返す。
- * 参加・復帰の意味や認可は game.handleCommand が判断する。
- * 現段階は Effect なし。timeout / Effect の生成オプションは実装時に別途追加する。
- */
-export interface GameAdapter<State, Command, View, Error> {
-  readonly game: GameDefinition<State, Command, string, View, never, Error>;
-  readonly parseCreate: (input: unknown) => Command | null;
-  readonly parseJoin: (input: unknown) => Command | null;
-  readonly parseCommand: (input: unknown) => Command | null;
-  readonly canConnect: (state: State, actorId: string) => boolean;
-}

package/templates/worker/runtime/parse.ts

@@ -1,14 +0,0 @@
-export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/** 通信 envelope だけを検証する。command の名前・payload の意味は adapter が判断する。 */
-export function parseCommandRequest(raw: string | ArrayBuffer): { requestId: string; command: unknown } | null {
-  if (typeof raw !== "string" || raw.length > 64 * 1024) return null;
-  try {
-    const value: unknown = JSON.parse(raw);
-    if (!isRecord(value) || value.type !== "GameCommandRequest" || typeof value.requestId !== "string"
-      || value.requestId.length === 0 || value.requestId.length > 128 || !Object.hasOwn(value, "command")) return null;
-    return { requestId: value.requestId, command: value.command };
-  } catch { return null; }
-}