283226b · d33cef3 · d916659 · 584e768
@@ -1503,3 +1503,26 @@
network here is the forge and the package registry), so the influence is from
what PufferLib is known for rather than from its documentation: flat observation
and action spaces, environment throughput treated as the thing that decides
whether a run is possible, and plain PPO rather than a clever algorithm.
## Playing with friends: rooms
The match at `/` runs in your own browser against bots. A **room** is the other
thing: make one from the menu, read the six-character code out to your friends,
and they type it in. A room's round is stepped **on this server** at the game's
own 64 Hz — `src/rooms/room.ts` runs the shooter's own `createWorld` and
`updateWith` — and every member is sent the same 544-byte packed snapshot sixteen
times a second (`src/rooms/wire.ts`), so nobody in a room can disagree about what
happened. Joining takes a bot's seat, so a round is always five against five, and
leaving hands the body straight back to the bot with the money and guns it had.
What is real and what is not, today:
- Real: shared rounds, shots, damage, deaths, the bomb, the kill feed, the
  economy (the buy goes up with the input frame and is spent on the server), and
  the caps — twenty rooms a process, ten people a room, an empty room forgotten
  after ninety seconds (`src/rooms/hub.ts`).
- Not yet: your own movement is **not** predicted, so it answers on the round
  trip rather than instantly; a room has no hit marker or damage arrow (both are
  effects recorded for one screen and a snapshot goes to everybody); and a room's
  result is not posted to the leaderboard. Rooms live in this process only — a
  deploy ends them.
@@ -49,7 +49,7 @@
function fixture(): { dir: string; entries: Entry[]; source: (n: string, t: stri
test("the entry table is what the app ships today, each with the size it may not pass", () => {
  expect(ENTRIES).toEqual([
    { name: "app", entry: "src/client/main.ts", ceiling: { raw: 110_000, gzip: 43_500 } },
    { name: "app", entry: "src/client/main.ts", ceiling: { raw: 122_000, gzip: 47_500 } },
    { name: "range", entry: "src/range/main.ts", ceiling: { raw: 37_000, gzip: 15_500 } },
    { name: "example", entry: "src/example/main.ts", ceiling: { raw: 23_500, gzip: 10_200 } },
  ]);
@@ -100,6 +100,10 @@
import { drawBuy, HINT, labelOf, offers } from "./buy.ts";
import { buy, canBuy, priceOf, type BuyItem } from "./economy.ts";
import { atRound, createLoadout, noteBuy, rebuy, saidRebuy } from "./loadout.ts";
import { createWorld, eyePos, say as showMessage, update, type Player, type World } from "./world.ts";
import { createSession, type Session, type Socket } from "./session.ts";
import { roomCodeFrom } from "../rooms/code.ts";
import { SWITCH_KNIFE, SWITCH_NONE, SWITCH_PRIMARY, SWITCH_SECONDARY } from "../rooms/wire.ts";
import type { BuyItem as Item } from "./economy.ts";
import { unpack } from "../engine/index.ts";
const TICK = 1 / 64;
@@ -142,6 +146,12 @@
export const NO_POLICY =
  "if it keeps happening, this deployment is missing the weights the page asked for.";
/** What the copy control says once the URL is on the clipboard, and if it is not. */
/** What the menu says when this browser cannot open a socket at all. */
export const NO_SOCKET = "This browser has no WebSocket, so it cannot join a room. The match above still plays.";
/** And what it says when a room could not be made or joined. */
export const NO_ROOM = "That room could not be joined — check the code, or make a new room.";
export const NO_MAKE = "A room could not be made right now. Try again in a moment.";
export const COPIED = "Copied";
export const NOT_COPIED = "Copy failed — the link still works";
@@ -285,6 +295,12 @@
export type Host = {
   * into a message. `location.origin`; no path, no query, nothing of the id.
   */
  origin: string;
  /**
   * A socket to a room, when this browser has WebSocket: `(url) => new WebSocket(url)`.
   * Absent is a browser that cannot play with other people, and the two room
   * controls in the menu stay disabled and say so.
   */
  connect?(url: string): Socket;
  /**
   * `navigator.clipboard.writeText`, when this browser has one and the page is
   * allowed it. Absent is a browser where the copy control is only a link, and
@@ -372,6 +388,10 @@
export function boot(host: Host): Frame {
  const copyLabel = copyMap.textContent;
  const prep = by("prep");
  const play = by<Panel & { disabled: boolean }>("play");
  const roomField = by<Field>("room");
  const joinRoom = by<Panel & { disabled: boolean }>("joinroom");
  const makeRoom = by<Panel & { disabled: boolean }>("makeroom");
  const roomSaid = by("roomsaid");
  // Where this game's weights are: the shell put the link in the head with the
  // content-hashed URL on it, so this is the only place the path is known.
  const weightsLink = doc.getElementById("weights") as Link | null;
@@ -514,6 +534,14 @@
export function boot(host: Host): Frame {
  // meshes were built from, and a match on another map swaps that one mesh.
  let shown: Level = DE_FORGE;
  let running = false;
  /**
   * The room this page is in, or null for the match that runs in this browser.
   * When it is set the world is the session's — filled from the server's
   * snapshots — and the frame below sends keys upstream instead of stepping.
   */
  let session: Session | null = null;
  /** One item asked for, sent on the next frame and then forgotten. */
  let roomBuy: Item | null = null;
  let lastSound = 0;
  let frameAverage = 16.7;
  let posted = -1;
@@ -567,6 +595,12 @@
export function boot(host: Host): Frame {
    }
    show(prep, false);
    play.disabled = false;
    // A browser with no WebSocket can still play the match in its own page; the
    // two controls that need one say so rather than failing when pressed.
    const canJoin = host.connect !== undefined;
    joinRoom.disabled = !canJoin;
    makeRoom.disabled = !canJoin;
    if (!canJoin) roomSaid.textContent = NO_SOCKET;
  }
  // --- the buy menu, rebuilt whenever it opens so the prices are honest
@@ -606,6 +640,13 @@
export function boot(host: Host): Frame {
  function pressBuy(item: BuyItem): void {
    if (world === null) return;
    const me = world.me;
    // In a room the shelf is the server's: the ask goes up with the next input
    // frame and the money is spent there, so nothing is spent here twice.
    if (session !== null) {
      roomBuy = item;
      sayBuy(`Asked for ${labelOf(item, me.team)}.`);
      return;
    }
    if (buy(world, me, item)) {
      noteBuy(loadout, item);
      audio.beep(700, 0.05);
@@ -1027,6 +1068,96 @@
export function boot(host: Host): Frame {
    host.storage.setItem("cs.name", name);
  }
  /**
   * Into a room: the same match, with the round decided on the server. What
   * `start` above does with a world it makes, this does with a world the first
   * snapshot describes — so the level, the rules and the ten bodies come from
   * the room and not from the menu, and everything else about the screen is the
   * same frame as ever.
   */
  function startRoom(code: string): void {
    if (renderer === null || !policyIn || host.connect === undefined) return;
    const name = nameField.value.trim().slice(0, 24) || "you";
    host.storage.setItem("cs.name", name);
    session?.close();
    world = null;
    session = createSession({
      connect: host.connect,
      url: `/ws?room=${encodeURIComponent(code)}&name=${encodeURIComponent(name)}`,
      code,
      now: () => win.performance.now(),
      build: (hello) => {
        const level = hello.map === "de_forge" ? DE_FORGE : generateLevel(seedOf(hello.map) ?? 0);
        if (level !== shown && renderer !== null) {
          renderer.replace("level", meshFor("level", level));
          shown = level;
        }
        playingId.textContent = `room ${code}`;
        mapName.textContent = level.name;
        pauseId.textContent = `Room ${code} on ${level.name}.`;
        return createWorld(level, hello.rules === "long" ? COMPETITIVE : SHORT, name, "ct", 5, hello.seed);
      },
    });
    loadout = createLoadout();
    roomBuy = null;
    posted = -1;
    postedFinal = true; // a room's result is the server's to write, never this page's
    loop.reset();
    controls.sensitivity = clamp(Number(sensField.value) || 2.2, 0.2, 12);
    running = true;
    lastSound = 0;
    show(menu, false);
    show(pause, false);
    show(summaryPanel, false);
    show(touchPanel, win.matchMedia("(pointer: coarse)").matches);
    audio.resume();
    void sceneCanvas.requestPointerLock();
  }
  joinRoom.addEventListener("click", () => {
    const code = roomCodeFrom(roomField.value);
    if (code === null) {
      roomSaid.textContent = NO_ROOM;
      return;
    }
    roomField.value = code;
    startRoom(code);
  });
  /**
   * A room of one's own: the server makes it — a world it will step until the
   * room empties — and hands back the code a person reads out. The map and the
   * length are the menu's own two choices; everything else about the room is the
   * server's.
   */
  makeRoom.addEventListener("click", () => {
    const chosen = chosenMap();
    void host.fetch("/api/room", {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ map: chosen === "generated" ? "de_forge" : chosen, length: lengthField.value }),
    }).then(
      (reply) => void reply.text().then(
        (body) => {
          let code: string | null = null;
          try {
            code = roomCodeFrom((JSON.parse(body) as { code?: unknown }).code);
          } catch {
            code = null;
          }
          if (!reply.ok || code === null) {
            roomSaid.textContent = NO_MAKE;
            return;
          }
          roomField.value = code;
          startRoom(code);
        },
        () => void (roomSaid.textContent = NO_MAKE),
      ),
      () => void (roomSaid.textContent = NO_MAKE),
    );
  });
  play.addEventListener("click", start);
  // Resume is the gesture that puts back whatever the pause cost: the screen
  // first, if a browser took it, and then the pointer.
@@ -1043,6 +1174,8 @@
export function boot(host: Host): Frame {
   */
  function toMenu(): void {
    running = false;
    session?.close();
    session = null;
    world = null;
    wantsFull = false;
    full.exit();
@@ -1208,11 +1341,18 @@
export function boot(host: Host): Frame {
      planAt = null;
      drawMapPlan();
    }
    // In a room the world is the session's, and there is nothing to draw until
    // the first snapshot has described it.
    if (session !== null) {
      world = session.world();
      const said = session.standing(now);
      roomSaid.textContent = `Room ${said.code} — ${said.line}. ${said.people} here.`;
    }
    if (world === null || !running) return;
    // A round nobody has planned yet — the first of a match, or the one that
    // just started — is planned here, on the frame that noticed it.
    if (world.match.round !== plannedRound) planFor(world);
    if (session === null && world.match.round !== plannedRound) planFor(world);
    // And the same frame rolls the wallet's memory over: what was bought in the
    // round that just ended is what X buys back in this one.
    atRound(loadout, world.match.round);
@@ -1237,12 +1377,28 @@
export function boot(host: Host): Frame {
      slotWanted === 1 ? me.primary : null;
    const steps = loop.advance(elapsed);
    const switchCode =
      slotWanted === 3 ? SWITCH_KNIFE :
      slotWanted === 2 ? SWITCH_SECONDARY :
      slotWanted === 1 ? SWITCH_PRIMARY : SWITCH_NONE;
    // Buying keeps the pointer, so the keys have to be kept off the player: with
    // the panel open the trigger is dead and the number row buys instead of
    // switching weapons. Movement is not suppressed, and never was — walking out
    // of spawn while you buy is the point.
    for (let step = 0; step < steps; step++)
      update(world, TICK, buyPanel.hidden ? input : { ...input, fire: false, switchTo: null });
    if (session !== null) {
      // A room's round is stepped on the server: what goes up is one frame of
      // keys for the tick the loop just counted — coalesced into one message
      // however many ticks this frame was worth, because a tick the page never
      // simulated has no separate keys to send. The buy is asked for once.
      const held = buyPanel.hidden ? input : { ...input, fire: false, switchTo: null };
      if (steps > 0) {
        session.press({ input: held, yaw: me.yaw, pitch: me.pitch, switchCode, buy: roomBuy });
        roomBuy = null;
      }
    } else {
      for (let step = 0; step < steps; step++)
        update(world, TICK, buyPanel.hidden ? input : { ...input, fire: false, switchTo: null });
    }
    // The camera, and with it whose eyes this frame is drawn and heard from.
    // It is moved after the steps and before anything reads it, and it is the
@@ -0,0 +1,178 @@
/**
 * The page's end of a room: one socket, one world it writes into, and the two
 * sentences it can say about the connection.
 *
 * A member of a room does not simulate. The round is stepped on the server
 * (`src/rooms/room.ts`) and this fills a local world from the snapshots that
 * arrive, so everything already built on a `World` — the scene, the HUD, the
 * minimap, the sounds, the spectator camera — draws a room without knowing it
 * is one. Two things are the browser's own even so: the view angles, which the
 * frame writes on `world.me` and sends upstream, so aim answers the hand rather
 * than the network; and nothing else. Your body's position is the server's
 * word, arriving 16 times a second — which is honest and is also the lag a
 * player feels in a room today. Predicting your own movement is #305's
 * remaining half and is deliberately not faked here.
 *
 * Nothing in here is a browser either: `connect` is handed in, so `session.test.ts`
 * plays a whole room through a socket of plain objects.
 */
import type { Hello, Pressed } from "../rooms/wire.ts";
import { applySnapshot, forget, readDown, writeInput, SNAPSHOT_FRAME } from "../rooms/wire.ts";
import type { Player, World } from "./world.ts";
/** All this file asks a WebSocket to be. A browser's is one of these. */
export type Socket = {
  binaryType: string;
  send(data: Uint8Array): void;
  close(): void;
  onopen: (() => void) | null;
  onmessage: ((event: { data: unknown }) => void) | null;
  onclose: (() => void) | null;
  onerror: (() => void) | null;
};
/** What the page shows about a room while it is up. */
export type Standing = {
  /** The room's code, which is what a person reads out to their friends. */
  code: string;
  /** Whether the socket is open right now. */
  live: boolean;
  /** Milliseconds since the last snapshot landed, or −1 before the first one. */
  behind: number;
  /** One sentence: what the connection is doing. */
  line: string;
  /** How many people are in the room, bots not counted. */
  people: number;
};
export type Session = {
  /** The world the snapshots are filling, or null until the first `hello`. */
  world(): World | null;
  /** Which body is ours, or −1 before `hello`. */
  seat(): number;
  standing(now: number): Standing;
  /** One tick of keys upstream. Dropped silently while the socket is not open. */
  press(pressed: Omit<Pressed, "tick">): void;
  close(): void;
};
/** The sentences a room says about itself. Exported because the tests read them. */
export const CONNECTING = "Joining the room…";
export const PLAYING = "In the room";
export const BEHIND = "The connection is behind — the round is still the server's";
export const DROPPED = "The room closed the connection. Leave the match and join again.";
/** How far behind the last snapshot has to be before the page says so, in ms. */
export const BEHIND_MS = 500;
export function createSession(options: {
  connect(url: string): Socket;
  /** Where to connect: the socket's path with the room and the name on it. */
  url: string;
  code: string;
  /**
   * The world a `hello` describes, built by the caller — which is the one place
   * that knows how to carve a level and make a world of this game. Handed the
   * message rather than the pieces, so a field added to `hello` needs no change
   * here.
   */
  build(hello: Hello): World;
  now(): number;
}): Session {
  const socket = options.connect(options.url);
  socket.binaryType = "arraybuffer";
  let world: World | null = null;
  let seat = -1;
  let live = false;
  let closed = false;
  let landed = -1;
  let people = 0;
  /** What the next input frame is stamped with: our own count of ticks sent. */
  let sent = 0;
  const frame = new Uint8Array(16);
  socket.onopen = (): void => void (live = true);
  socket.onclose = (): void => {
    live = false;
    closed = true;
  };
  socket.onerror = (): void => void (live = false);
  socket.onmessage = (event): void => {
    const data = event.data;
    if (typeof data === "string") {
      const down = readDown(data);
      if (down === null) return;
      if (down.k === "hello") {
        seat = down.seat;
        const built = options.build(down);
        // A body nobody else is holding is a bot to everything that reads the
        // world; ours is not, and it is the one the camera and the HUD follow.
        built.me = (built.players[seat] ?? built.me) as Player;
        built.me.bot = false;
        forget(built);
        world = built;
        apply(down.roster);
      } else if (down.k === "roster") {
        apply(down.roster);
      } else if (world !== null) {
        // The words of the round, which are written inside the server's own tick.
        for (const entry of down.feed) world.feed.push({ ...entry, weapon: entry.weapon as never });
        for (const line of down.say) world.messages.push(line);
        if (world.feed.length > 8) world.feed.splice(0, world.feed.length - 8);
        if (world.messages.length > 8) world.messages.splice(0, world.messages.length - 8);
      }
      return;
    }
    if (world === null || seat < 0) return;
    const bytes = data instanceof ArrayBuffer ? new Uint8Array(data) : data instanceof Uint8Array ? data : null;
    if (bytes === null || bytes[0] !== SNAPSHOT_FRAME) return;
    const got = applySnapshot(world, bytes, seat);
    if (got === null) return;
    landed = options.now();
    // Our own body: the server's position, handed over rather than written in
    // (`wire.ts`), so this is the one place a page decides what to do with it.
    if (got.own !== null) {
      world.me.pos = got.own.pos;
      world.me.vel = got.own.vel;
    }
  };
  /** Names and bots off the roster, onto the bodies they belong to. */
  function apply(roster: Hello["roster"]): void {
    if (world === null) return;
    people = 0;
    for (const seated of roster) {
      const body = world.players[seated.seat];
      if (body === undefined) continue;
      body.name = seated.name;
      body.bot = seated.bot;
      if (!seated.bot) people += 1;
    }
    // Ours is ours whatever the roster says about the body: the camera follows it.
    if (world.players[seat] !== undefined) world.me = world.players[seat] as Player;
  }
  return {
    world: () => world,
    seat: () => seat,
    standing(now) {
      const behind = landed < 0 ? -1 : now - landed;
      const line =
        closed ? DROPPED :
        !live || landed < 0 ? CONNECTING :
        behind > BEHIND_MS ? BEHIND : PLAYING;
      return { code: options.code, live, behind, line, people };
    },
    press(pressed) {
      if (!live) return;
      sent += 1;
      socket.send(writeInput({ ...pressed, tick: sent }, frame));
    },
    close() {
      closed = true;
      live = false;
      socket.close();
    },
  };
}
@@ -207,7 +207,7 @@
export type FakeStage = {
 * contract between the page and this file, so `src/server.test.ts` checks the
 * served page against this same list rather than a second copy of it.
 */
export const PAGE_IDS = ["weights", "stage", "scene", "hud", "menu", "pause", "summary", "buy", "buyshelf", "buysays", "touch", "stats", "saved", "name", "length", "side", "sens", "map", "mapseed", "matchid", "onid", "onmap", "today", "ontoday", "willplay", "plan", "planalt", "copymap", "play", "prep", "resume", "quit", "esc", "pauseid", "sumtitle", "sumscore", "sumyou", "sumboard", "sumsaved", "again", "leave", "playing", "mapname", "share", "fps", "full"];
export const PAGE_IDS = ["weights", "stage", "scene", "hud", "menu", "pause", "summary", "buy", "buyshelf", "buysays", "touch", "stats", "saved", "name", "length", "side", "sens", "map", "mapseed", "matchid", "onid", "onmap", "today", "ontoday", "willplay", "plan", "planalt", "copymap", "play", "room", "joinroom", "makeroom", "roomsaid", "prep", "resume", "quit", "esc", "pauseid", "sumtitle", "sumscore", "sumyou", "sumboard", "sumsaved", "again", "leave", "playing", "mapname", "share", "fps", "full"];
/** The ones the server renders with `hidden` on them: the page starts at the menu. */
const HIDDEN = ["pause", "summary", "buy", "touch", "full"];
@@ -8,14 +8,14 @@
import { WEAPONS } from "./weapons.ts";
import { buy } from "./economy.ts";
import {
  aimAt, applyInput, bodyCentre, canSee, createWorld, currentWeapon, deployTicks, EFFECT_CAPACITY,
  eyePos, insideSmoke, NO_INPUT, shoot, startRound, throwOne, update,
  eyePos, insideSmoke, NO_INPUT, shoot, startRound, throwOne, update, updateWith,
  type Input, type Player, type Sound, type World,
} from "./world.ts";
import { cloudRadius, type Cloud } from "./grenade.ts";
import { HE, SMOKE } from "./weapons.ts";
import { CS_HULL } from "./movement.ts";
import {
  effectAt, eyeHeight, pushEffect, type Burst, type SoundDevice, type Tone, type Vec3,
  angleVectors, effectAt, eyeHeight, pushEffect, type Burst, type SoundDevice, type Tone, type Vec3,
} from "../engine/index.ts";
const TICK = 1 / 64;
@@ -655,3 +655,46 @@
test("a blast you are caught in came from the blast, and not from whoever threw
  expect(Math.hypot(hit.from[0] - world.me.pos[0], hit.from[1] - world.me.pos[1]))
    .toBeLessThan(HE.blast.radius);
});
/**
 * The tick's inputs are asked for body by body (`updateWith`), which is what
 * lets a room drive five people through one world. Two claims, and the room in
 * `src/rooms/` is built on both: a body somebody drives does what they pressed
 * rather than what a bot would, and a body nobody drives and nobody thinks for
 * stands still.
 */
test("a tick asks for each body's input, and a driven bot does what it was told", () => {
  const world = createWorld(DE_FORGE, SHORT, "you", "ct", 5, 41);
  world.match.phase = "live";
  world.match.timer = SHORT.roundTime;
  const seat = world.players.find((p) => p.team === "ct" && p !== world.me) as Player;
  const was: Vec3 = [...seat.pos] as Vec3;
  // Driven straight forward for half a second, with every other body left to
  // the bots — including `me`, who nobody is driving here.
  const driving: Input = { ...NO_INPUT, forward: 1 };
  for (let i = 0; i < 32; i++) updateWith(world, TICK, (p) => (p === seat ? driving : undefined));
  // It moved, and it moved along its own yaw rather than wherever a bot wanted:
  // nearly all of the ground it covered is in front of where it is looking.
  const went = Math.hypot(seat.pos[0] - was[0], seat.pos[1] - was[1]);
  expect(went).toBeGreaterThan(50);
  const { forward } = angleVectors(seat.yaw, 0);
  const along = (seat.pos[0] - was[0]) * forward[0] + (seat.pos[1] - was[1]) * forward[1];
  expect(along).toBeGreaterThan(went * 0.9);
});
test("a body nobody drives and nobody thinks for stands still", () => {
  const world = createWorld(DE_FORGE, SHORT, "you", "ct", 5, 41);
  world.match.phase = "live";
  world.match.timer = SHORT.roundTime;
  // Every bot turned into a person nobody is holding the keys for: ten bodies,
  // no input anywhere, so nothing in the round moves at all.
  for (const p of world.players) p.bot = false;
  const before = world.players.map((p) => [...p.pos] as Vec3);
  for (let i = 0; i < 64; i++) updateWith(world, TICK, () => undefined);
  world.players.forEach((p, i) => {
    const was = before[i] as Vec3;
    expect(Math.hypot(p.pos[0] - was[0], p.pos[1] - was[1])).toBeLessThan(0.001);
  });
});
@@ -112,7 +112,14 @@
export type Effect =
  | { kind: "tracer"; from: Vec3; to: Vec3; at: number }
  | { kind: "impact"; at: number; pos: Vec3; normal: Vec3 }
  | { kind: "blood"; at: number; pos: Vec3 }
  | { kind: "shot"; at: number; pos: Vec3; weapon: WeaponId; mine: boolean }
  /**
   * A gun going off, where and which. `mine` is whether it is the gun on *this*
   * screen — the frame draws its own muzzle differently — and `by` is whose body
   * fired it, which is the same question asked in a form that survives a wire: a
   * room's snapshot goes to everybody at once, so `mine` cannot travel and the
   * id it is derived from can (`src/rooms/wire.ts`).
   */
  | { kind: "shot"; at: number; pos: Vec3; weapon: WeaponId; mine: boolean; by: number }
  | { kind: "hitmark"; at: number; headshot: boolean }
  /**
   * Damage *you* took, and where it came from: the shooter's feet, or the
@@ -552,7 +559,7 @@
export function shoot(world: World, p: Player): boolean {
  const dir = angleVectors(yaw, pitch).forward;
  const to: Vec3 = [from[0] + dir[0] * range, from[1] + dir[1] * range, from[2] + dir[2] * range];
  const hit = traceBullet(from, to, world.level.boxes, world.players, p.id);
  record(world, { kind: "shot", at: world.time, pos: from, weapon: w.id, mine: p === world.me });
  record(world, { kind: "shot", at: world.time, pos: from, weapon: w.id, mine: p === world.me, by: p.id });
  if (w.kind !== "knife") record(world, { kind: "tracer", at: world.time, from, to: hit.kind === "none" ? to : hit.point });
  if (hit.kind === "world") {
@@ -793,8 +800,27 @@
export function applyInput(world: World, p: Player, input: Input, dt: number): v
  bombTick(world, p, input.use, dt);
}
/** One fixed simulation tick. `input` is the person's; bots think for themselves. */
export function update(world: World, dt: number, input: Input): void {
/**
 * Where a tick gets its inputs: one body in, the input whoever is driving it
 * pressed this tick, or undefined for a body nobody is driving. A bot nobody
 * drives thinks for itself; a person's body nobody drives stands still.
 *
 * It is a function rather than a map because the two callers ask different
 * questions of it. The single-player game drives exactly one body — its own —
 * and a room drives as many bodies as it has members in seats, the rest left to
 * the bots. Neither needs the other's shape, and `update` below is the one
 * place either answer is turned into a tick.
 */
export type Inputs = (p: Player) => Input | undefined;
/**
 * One fixed simulation tick, with the inputs asked for body by body. Bodies are
 * stepped in the order they are in `world.players`, which is the order the
 * single-player game always stepped them in — its own first, because it is
 * `players[0]`, and then the bots — so a round played through here and a round
 * played through `update` below are the same round, tick for tick.
 */
export function updateWith(world: World, dt: number, inputs: Inputs): void {
  world.time += dt;
  const before = world.match.phase;
  for (const event of rules.tick(world.match, dt)) {
@@ -838,10 +864,10 @@
export function update(world: World, dt: number, input: Input): void {
  // and it does so for everybody, standing or dead, before anyone acts on it.
  for (const p of world.players) if (p.blind > 0) p.blind = Math.max(0, p.blind - dt);
  applyInput(world, world.me, world.me.alive ? input : NO_INPUT, dt);
  for (const p of world.players) {
    if (!p.bot || !p.alive) continue;
    applyInput(world, p, botThink(world, p, dt), dt);
    const driven = inputs(p);
    if (driven !== undefined) applyInput(world, p, p.alive ? driven : NO_INPUT, dt);
    else if (p.bot && p.alive) applyInput(world, p, botThink(world, p, dt), dt);
  }
  // After everyone has moved, so a grenade is solved against where people
  // ended the tick rather than where they started it.
@@ -859,6 +885,16 @@
export function update(world: World, dt: number, input: Input): void {
  expireEffects(world.effects, world.time, EFFECT_LIFE);
}
/**
 * One fixed simulation tick of the game one person plays in one browser:
 * `input` is theirs, and every other body is a bot thinking for itself. It is
 * `updateWith` with the one body this page is holding the keys for, and it is
 * the whole of what the single-player game ever needed.
 */
export function update(world: World, dt: number, input: Input): void {
  updateWith(world, dt, (p) => (p === world.me ? input : undefined));
}
/**
 * Is `target` visible to `from`, eye to eye? The one question the whole game
 * asks about sight: the bots pick their fights with it, a bot deciding whether
@@ -98,13 +98,13 @@
export const GAMES: readonly Game[] = [
    label: "cs",
    entry: "src/client/main.ts",
    /**
     * Raised by #153, which made the buy panel keyboard-driven: the number row
     * on the tiles, the rebuy and the loadout it remembers. 103,334 raw and
     * 40,719 gzipped, measured by `bun run scripts/build.ts` — 334 bytes over
     * the ceiling #165 set for the smoke grenade, and worth it for a round that
     * is bought without the pointer leaving the game.
     * Raised by #300, which put multiplayer in the page: `src/client/session.ts`
     * is the room's end of the socket and `src/rooms/wire.ts` is the codec both
     * ends read. 115,156 raw and 44,864 gzipped, measured by
     * `bun run scripts/build.ts` — 1.8 kB of gzip for a round five people can
     * play together, and the rooms' own server half ships in no bundle at all.
     */
    ceiling: { raw: 110_000, gzip: 43_500 },
    ceiling: { raw: 122_000, gzip: 47_500 },
    assets: [
      {
        name: "weights",
@@ -356,6 +356,16 @@
const menu = (visitor: Who, asked: Asked, daily: Daily): string => `
        </div>
      </div>
      <div class="row"><button type="button" class="primary" id="play" disabled>Play</button></div>
      <div class="row">
        <label>Room code<input id="room" maxlength="6" placeholder="ABCDEF" autocapitalize="characters"
          autocomplete="off" spellcheck="false"></label>
        <button type="button" id="joinroom" disabled>Join room</button>
        <button type="button" id="makeroom" disabled>Make a room</button>
      </div>
      <p class="hint" id="roomsaid">Play with friends: make a room, read the code out, and they join it. A room&#39;s
        round is decided on this server, so everyone in it sees the same round — the match above runs in your
        own browser against bots. Rooms live in this process: a deploy ends them, and an empty one is forgotten
        after ninety seconds.</p>
      <p class="hint" id="prep">Preparing textures…</p>
      <p class="hint"><kbd>WASD</kbd> move · <kbd>Space</kbd> jump · <kbd>Ctrl</kbd> crouch · <kbd>Shift</kbd> walk ·
        mouse to aim and fire · <kbd>R</kbd> reload · <kbd>G</kbd> throw an HE · <kbd>T</kbd> throw a flashbang · <kbd>V</kbd> throw a smoke ·
@@ -0,0 +1,59 @@
/**
 * What a room is called: six characters a person can read out loud over a
 * voice call and type without asking which letter that was.
 *
 * It is the whole of the public name of a room, so it is an input twice over —
 * the query on the socket upgrade, and the field in the menu — and it is
 * validated here on both sides, the way `src/matchid.ts` is the one door a match
 * id goes through. A code is never a path, never a key in anything on disk, and
 * never interpolated into markup without escaping.
 *
 * The alphabet leaves out the characters a person reads wrong: no O or 0, no I,
 * l or 1, no S against 5. That is 32 symbols, so a code is 32^6 ≈ 1.07 billion,
 * and with the room cap this process holds — a hundred — a blind guess finds a
 * room about once in ten million tries, against a limiter that allows nowhere
 * near that many. The code is drawn from `crypto.getRandomValues`, not from
 * `Math.random`: it is the only thing standing between a room and a stranger.
 */
/** The symbols a code is made of, and the only ones. */
export const ALPHABET = "ABCDEFGHJKMNPQRTUVWXYZ2346789";
/** How many characters a code is. */
export const LENGTH = 6;
const SHAPE = new RegExp(`^[${ALPHABET}]{${LENGTH}}$`);
/** Is this a room code at all? The shape above, and nothing else. */
export const isRoomCode = (value: unknown): value is string =>
  typeof value === "string" && SHAPE.test(value);
/**
 * The code a caller handed over, upper-cased first because a person typing one
 * types it however their keyboard was, or null when it is not a code. This is
 * the boundary: the server's upgrade goes through it and the page's field goes
 * through it again, and neither trusts the other.
 */
export function roomCodeFrom(value: unknown): string | null {
  if (typeof value !== "string") return null;
  const code = value.trim().toUpperCase();
  return isRoomCode(code) ? code : null;
}
/**
 * A fresh code. `bytes` is a source of random bytes — `crypto.getRandomValues`
 * in both a browser and Bun — and is a parameter so a test can hand over a
 * sequence it chose.
 *
 * The modulo is not quite uniform over 256: with 29 symbols the first 24 are
 * drawn slightly more often than the last 5, by about four per cent. That is
 * not a weakness worth code here — it costs a fraction of a bit out of the
 * thirty a code carries — and rejection sampling would be a loop with a
 * pathological case in the one place this app cannot afford one.
 */
export function newRoomCode(bytes: (into: Uint8Array) => Uint8Array = (into) => crypto.getRandomValues(into)): string {
  const drawn = bytes(new Uint8Array(LENGTH));
  let code = "";
  for (let i = 0; i < LENGTH; i++) code += ALPHABET[(drawn[i] as number) % ALPHABET.length];
  return code;
}
@@ -0,0 +1,225 @@
/**
 * Every room this process is holding, and the one clock that steps them.
 *
 * A room is CPU on a shared box, so this file is mostly numbers with reasons.
 * One room is one world stepped 64 times a second: measured by
 * `src/budget.test.ts` a tick of ten bodies with nine of them thinking costs
 * about 0.08 ms, so a room costs about **5 ms of CPU a second** — half a per
 * cent of one core — and `ROOM_CAP` rooms at once is a tenth of a core plus the
 * snapshots. That is the whole argument for the cap being where it is, and it is
 * the number to revisit before raising it.
 *
 * Nothing here is a socket either. The hub is handed a `Wire` — deliver these
 * bytes to that member, close that member — and the server is the only file that
 * knows what one really is. So `hub.test.ts` runs a hub with five members, an
 * idle sweep and a room cap without opening a port.
 *
 * Rooms live in memory and die with the process. Nothing is written under
 * `FORGE_APP_DATA`: a half-finished round is not worth keeping, a deploy ends
 * every room it was holding, and the page says so rather than implying a room
 * survives one.
 */
import { createLimiter, type Limiter } from "../limit.ts";
import { newRoomCode } from "./code.ts";
import {
  createRoom, describeRoom, drive, helloFor, isIdle, join, leave, logSince, rosterMessage, snapshotFor,
  stepRoom, SNAPSHOT_HZ, TICK, type Member, type Room,
} from "./room.ts";
import type { PlayedMap } from "../mapname.ts";
/**
 * How many rooms one deployment holds at once. Twenty rooms is about 0.1 s of
 * CPU a second — a tenth of a core — against a box that also serves pages, and
 * two hundred people in them at ten a room. Past it a create is refused with a
 * sentence, which is the honest answer: a twenty-first room would make the
 * other twenty judder.
 */
export const ROOM_CAP = 20;
/**
 * How long a room with nobody in it is kept, in milliseconds. Long enough that
 * a person who created a room, read the code out loud and reloaded the page
 * comes back to the same round; short enough that a forgotten room is a minute
 * of a core and not an hour of one.
 */
export const IDLE_MS = 90_000;
/**
 * How long a connection that says nothing at all is kept, in milliseconds. A
 * member's browser sends an input frame every tick while the page is open, so
 * thirty seconds of silence is a tab that is gone, a laptop that slept or a
 * network that will not come back — and the seat it is holding belongs to
 * somebody who is here.
 */
export const SILENT_MS = 30_000;
/**
 * The most bytes one frame from a member may be. An input frame is fourteen; a
 * ceiling of sixty-four leaves room for the wire to grow a field without
 * becoming somewhere to push a megabyte. Past it the connection is closed
 * rather than the frame dropped: a member sending frames of the wrong size is
 * not a member playing this game.
 */
export const MESSAGE_MAX = 64;
/** WebSocket close codes this app sends, from the private range 4000–4999. */
export const CLOSE_TOO_BIG = 4001;
export const CLOSE_FLOOD = 4002;
export const CLOSE_SILENT = 4003;
export const CLOSE_GONE = 4004;
/**
 * How many frames a second one connection may send. The page sends one a tick,
 * 64 a second; a burst of 160 and one more every 8 ms is two and a half times
 * that, which absorbs a tab that was descheduled and caught up, and is a wall
 * to anything trying to make this process do more work than a player can.
 */
export const FRAME_LIMIT = { burst: 160, per: 8 };
/**
 * The most ticks one call of `advance` will step a room. A quarter of a second:
 * past that the room is behind and stays behind rather than stealing the whole
 * process to catch up.
 */
export const MAX_CATCHUP = 16;
/** What the hub needs a connection to be, which is two functions. */
export type Wire = {
  /** These bytes, or this line of JSON, to that member. */
  deliver(id: string, frame: Uint8Array | string): void;
  /** That member, disconnected, with a code and a sentence. */
  close(id: string, code: number, reason: string): void;
};
export type Hub = {
  rooms: Map<string, Room>;
  /** A fresh room, or null when this process is already holding `ROOM_CAP`. */
  open(options: { map: PlayedMap; seed: number; length: "short" | "long"; now: number }): Room | null;
  find(code: string): Room | undefined;
  /** Somebody joins a room by code. Null is a full room or a room that is gone. */
  enter(code: string, id: string, name: unknown, now: number): { room: Room; member: Member } | null;
  /** And leaves it, whichever room they were in. */
  exit(id: string, now: number): void;
  /** One frame off the wire from a member. False when it was refused. */
  frame(id: string, bytes: Uint8Array, now: number): boolean;
  /**
   * The clock: step every room by however many ticks are due at `now`, send the
   * snapshots that fall due, and drop what is idle or silent. Called from one
   * interval in `src/server.ts` and from a test with a clock it moves itself.
   */
  advance(now: number): void;
  /** How many members this process is holding, over every room. */
  members(): number;
  /** One line per room, for the terminal. */
  lines(now: number): string[];
};
/** Where a member is: which room, and since when they were last heard from. */
type Seated = { code: string; heardAt: number };
export function createHub(wire: Wire, options: { now: number; limiter?: Limiter } = { now: Date.now() }): Hub {
  const rooms = new Map<string, Room>();
  const where = new Map<string, Seated>();
  const limiter = options.limiter ?? createLimiter(FRAME_LIMIT);
  /** The wall clock of the last step, so a tick is never stepped twice. */
  let steppedAt = options.now;
  /** When each room last sent its snapshots, on the wall clock. */
  const sentAt = new Map<string, number>();
  const send = (room: Room, member: Member): void => {
    wire.deliver(member.id, snapshotFor(room, member));
  };
  const hub: Hub = {
    rooms,
    open(o) {
      if (rooms.size >= ROOM_CAP) return null;
      // A collision is a room that exists, not an error: draw again. Thirty bits
      // against twenty rooms means this loop runs once, and it is bounded anyway.
      let code = newRoomCode();
      for (let tries = 0; tries < 8 && rooms.has(code); tries++) code = newRoomCode();
      if (rooms.has(code)) return null;
      const room = createRoom(code, o);
      rooms.set(code, room);
      sentAt.set(code, o.now);
      return room;
    },
    find: (code) => rooms.get(code),
    enter(code, id, name, now) {
      const room = rooms.get(code);
      if (room === undefined) return null;
      const member = join(room, id, name, now);
      if (member === null) return null;
      where.set(id, { code, heardAt: now });
      wire.deliver(id, JSON.stringify(helloFor(room, member)));
      // Everybody, the arrival included, gets the roster the arrival changed.
      const roster = JSON.stringify(rosterMessage(room));
      for (const other of room.members.values()) wire.deliver(other.id, roster);
      return { room, member };
    },
    exit(id, now) {
      const seated = where.get(id);
      where.delete(id);
      if (seated === undefined) return;
      const room = rooms.get(seated.code);
      if (room === undefined) return;
      if (leave(room, id, now) === null) return;
      const roster = JSON.stringify(rosterMessage(room));
      for (const other of room.members.values()) wire.deliver(other.id, roster);
    },
    frame(id, bytes, now) {
      const seated = where.get(id);
      if (seated === undefined) return false;
      if (bytes.byteLength > MESSAGE_MAX) {
        wire.close(id, CLOSE_TOO_BIG, "frame too large");
        return false;
      }
      if (!limiter.take(`ws:${id}`, now)) {
        wire.close(id, CLOSE_FLOOD, "too many frames");
        return false;
      }
      seated.heardAt = now;
      const room = rooms.get(seated.code);
      return room !== undefined && drive(room, id, bytes);
    },
    advance(now) {
      // Every 64 Hz step that has fallen due since the last call, capped: a
      // process that was descheduled for a second does not then burn a second of
      // CPU catching up on every room at once. Past the cap the rooms' clocks
      // simply run slow for that moment, which is a hitch and not a hole.
      const due = Math.min(Math.floor((now - steppedAt) / (TICK * 1000)), MAX_CATCHUP);
      if (due > 0) steppedAt += due * TICK * 1000;
      const interval = 1000 / SNAPSHOT_HZ;
      for (const [code, room] of rooms) {
        for (let i = 0; i < due; i++) stepRoom(room);
        if (room.members.size > 0) room.usedAt = now;
        const last = sentAt.get(code) ?? now;
        if (now - last >= interval) {
          sentAt.set(code, now);
          const log = logSince(room);
          const words = log === null ? null : JSON.stringify(log);
          for (const member of room.members.values()) {
            send(room, member);
            if (words !== null) wire.deliver(member.id, words);
          }
        }
      }
      // A member nobody has heard from is holding a seat somebody else could
      // have: closed here, and the close is what takes them out of the room.
      for (const [id, seated] of where) {
        if (now - seated.heardAt > SILENT_MS) wire.close(id, CLOSE_SILENT, "no input for thirty seconds");
      }
      for (const [code, room] of rooms) {
        if (isIdle(room, now, IDLE_MS)) {
          rooms.delete(code);
          sentAt.delete(code);
        }
      }
    },
    members: () => where.size,
    lines: (now) => [...rooms.values()].map((room) => describeRoom(room, now)),
  };
  return hub;
}
@@ -0,0 +1,366 @@
/**
 * One room: a code, a world stepped in *this* process, and up to ten bodies —
 * bots until somebody sits in one.
 *
 * This is where multiplayer stops being a relay and becomes a game. The round
 * is not simulated in anybody's browser: `createWorld` and `updateWith` from
 * `src/client/world.ts` run here at the game's own 64 Hz, every member's keys
 * are one body's input, and what each of them sees is a snapshot of the same
 * numbers. So two people in a room cannot disagree about who shot first, and
 * nothing a page says about the round is taken on trust.
 *
 * What a seat is, and the rule that makes it safe: **a member holds exactly one
 * body, and a body is held by at most one member.** Joining takes a bot's seat
 * — so the round is always five against five — and leaving hands it straight
 * back to the bot with the money, the guns and the position it had, under the
 * bot's own name. An input for a seat nobody holds, or for somebody else's,
 * never reaches the world: `drive` looks the member up and writes to their own
 * seat or to nothing.
 *
 * Nothing here is a socket. A room is plain data with a world in it: `join`,
 * `leave`, `drive`, `stepRoom` and `snapshotFor` are functions of their
 * arguments, `src/rooms/hub.ts` holds the rooms and `src/server.ts` is the only
 * file that knows what a WebSocket is. That is what lets `room.test.ts` play a
 * whole round with five members in it and no network at all.
 */
import { DE_FORGE } from "../client/map.ts";
import { generateLevel } from "../client/generate.ts";
import { buy as spend, canBuy } from "../client/economy.ts";
import type { Level } from "../client/level.ts";
import { COMPETITIVE, SHORT, type Rules, type Team } from "../client/match.ts";
import { seedOf, type PlayedMap } from "../mapname.ts";
import {
  INPUT_BYTES, readInput, resolveSwitch, SNAPSHOT_MAX, writeSnapshot,
  type Hello, type Log, type Pressed, type Roster, type Seated,
} from "./wire.ts";
import { createWorld, NO_INPUT, updateWith, type Input, type Player, type World } from "../client/world.ts";
/** The fixed step a room's world takes, which is the game's own. */
export const TICK = 1 / 64;
/**
 * How many snapshots a member is sent a second. Sixteen is the number #302's
 * arithmetic lands on and the number this ships at: a snapshot of a ten-body
 * round is 544 bytes, so sixteen of them is 8.7 kB a second down to each member
 * — half a megabyte a minute, which a phone on a mobile connection can hold —
 * and the frame between two of them is 62 ms of interpolation, which is what
 * `src/client/session.ts` hides. Thirty-two would double the bytes to buy a
 * smoothness the interpolation already has.
 */
export const SNAPSHOT_HZ = 16;
/**
 * How long a member's last input is held before their body drops the keys, in
 * ticks. An input frame is one tick, and the rule for a late one is that it is
 * the member's last one — otherwise a packet lost at 250 u/s would stutter a
 * body every time the network hiccups. But *held forever* is a body that runs
 * into a wall for the rest of the match because a laptop closed, so a third of
 * a second of silence is a body that stands still and keeps looking where it
 * was looking.
 */
export const INPUT_HOLD = 21;
/** How many bodies a round has, per side. Five, like the game. */
export const TEAM_SIZE = 5;
/** One person in a room, and the body they are holding. */
export type Member = {
  /** The session that joined. Opaque here: the server makes it, this never reads it. */
  id: string;
  /** What the scoreboard calls them. Cleaned and made unique on the way in. */
  name: string;
  /** Which body is theirs — an index into `world.players`. */
  seat: number;
  /** When they arrived, on the wall clock. */
  joined: number;
  /** The tick of the newest input frame that has arrived from them. */
  lastTick: number;
  /** The world clock of the last snapshot they were sent, so an effect goes once. */
  sentAt: number;
  /** How many frames of theirs were refused for being the wrong shape. */
  dropped: number;
};
export type Room = {
  code: string;
  created: number;
  map: PlayedMap;
  seed: number;
  length: "short" | "long";
  rules: Rules;
  level: Level;
  world: World;
  /** How many 64 Hz steps this room's world has taken. The tick an input names. */
  tick: number;
  members: Map<string, Member>;
  /** The latest input for each seat, by seat, and the tick it was pressed on. */
  pressed: Map<number, { pressed: Pressed; tick: number }>;
  /** What each bot is called, by seat, so a leave gives the name back. */
  botNames: string[];
  /** The buy each seat has already been charged for, so one ask is one buy. */
  bought: Map<number, string>;
  /** The world clock of the newest feed entry and line already sent out. */
  loggedFeed: number;
  loggedSay: number;
  /** When the room last had a member in it, on the wall clock. */
  usedAt: number;
  /** One buffer per room, written through by every snapshot. */
  frame: Uint8Array;
};
/** The level a room stands on: de_forge, or the one that map name carves. */
export const levelOf = (map: PlayedMap): Level =>
  map === "de_forge" ? DE_FORGE : generateLevel(seedOf(map) ?? 0);
/**
 * A room on a map, with ten bots in it. The world is the shooter's own and so is
 * every rule in it; the only thing done to it that the single-player game does
 * not is that `world.me` is a bot like the other nine — a room has no "the
 * person", it has seats, and the body that happens to be `players[0]` is not
 * special until somebody sits in it.
 */
export function createRoom(
  code: string,
  options: { map: PlayedMap; seed: number; length: "short" | "long"; now: number },
): Room {
  const rules = options.length === "long" ? COMPETITIVE : SHORT;
  const level = levelOf(options.map);
  const world = createWorld(level, rules, "Sentinel", "ct", TEAM_SIZE, options.seed);
  // Every body a bot, `players[0]` included: see above.
  world.me.bot = true;
  return {
    code,
    created: options.now,
    map: options.map,
    seed: options.seed,
    length: options.length,
    rules,
    level,
    world,
    tick: 0,
    members: new Map(),
    pressed: new Map(),
    botNames: world.players.map((p) => p.name),
    bought: new Map(),
    loggedFeed: 0,
    loggedSay: 0,
    usedAt: options.now,
    frame: new Uint8Array(SNAPSHOT_MAX),
  };
}
/** Who is in this room, in seat order: everyone, bots included. */
export const rosterOf = (room: Room): Seated[] =>
  room.world.players.map((p, seat) => ({ seat, name: p.name, bot: p.bot, team: p.team as "t" | "ct" }));
export const rosterMessage = (room: Room): Roster => ({ k: "roster", roster: rosterOf(room) });
/**
 * A name nobody else in this room already has: trimmed, capped, stripped of
 * anything that is not printable, and suffixed with a number if it collides.
 * Two members called "you" would make the kill feed a lie — the feed is names —
 * so the second one is "you (2)".
 */
export function uniqueName(room: Room, wanted: unknown): string {
  const base = (typeof wanted === "string" ? wanted : "")
    .replace(/[^\x20-\x7e]/g, "")
    .trim()
    .slice(0, 20) || "player";
  const taken = new Set(room.world.players.map((p) => p.name));
  if (!taken.has(base)) return base;
  for (let n = 2; n < 100; n++) {
    const tried = `${base} (${n})`;
    if (!taken.has(tried)) return tried;
  }
  return base;
}
/** How many people are in a room, bots not counted. */
export const memberCount = (room: Room): number => room.members.size;
/**
 * Which body a person arriving takes: a bot's, on whichever side has fewer
 * people on it, so two friends joining land opposite each other only once the
 * teams are even. Null when every body is already held, which is the member cap.
 */
export function freeSeat(room: Room): number | null {
  const held = { t: 0, ct: 0 };
  for (const member of room.members.values()) {
    const body = room.world.players[member.seat];
    if (body !== undefined) held[body.team] += 1;
  }
  const want: Team = held.t <= held.ct ? "t" : "ct";
  const on = (team: Team): number => room.world.players.findIndex((p) => p.bot && p.team === team);
  const first = on(want);
  if (first >= 0) return first;
  const other = on(want === "t" ? "ct" : "t");
  return other >= 0 ? other : null;
}
/**
 * Somebody sits down. The bot in that seat stands aside — it keeps its money,
 * its guns and where it is standing, because a round in progress does not stop
 * for an arrival — and the seat is theirs until they leave.
 *
 * Null is a full room, which is the member cap and is answered as a sentence by
 * the caller rather than as a dropped connection.
 */
export function join(room: Room, id: string, wanted: unknown, now: number): Member | null {
  const existing = room.members.get(id);
  if (existing !== undefined) return existing;
  const seat = freeSeat(room);
  if (seat === null) return null;
  const body = room.world.players[seat] as Player;
  const name = uniqueName(room, wanted);
  body.bot = false;
  body.name = name;
  // A bot's brain is left where it is: if this member leaves, the bot picks the
  // body up with everything else it had.
  const member: Member = { id, name, seat, joined: now, lastTick: 0, sentAt: 0, dropped: 0 };
  room.members.set(id, member);
  room.usedAt = now;
  return member;
}
/** And stands up again: the bot takes the body back, under its own name. */
export function leave(room: Room, id: string, now: number): Member | null {
  const member = room.members.get(id);
  if (member === undefined) return null;
  const body = room.world.players[member.seat];
  if (body !== undefined) {
    body.bot = true;
    body.name = room.botNames[member.seat] ?? body.name;
  }
  room.members.delete(id);
  room.pressed.delete(member.seat);
  room.bought.delete(member.seat);
  room.usedAt = now;
  return member;
}
/**
 * One frame of input off the wire, for the member it came from and for nobody
 * else. The bytes are validated in `wire.ts` — every field in range or the
 * frame is refused — and the seat is resolved here from the member, never from
 * anything in the frame, which is what makes "an input for a slot you do not
 * hold" a message that cannot be written rather than one that is checked for.
 *
 * An older tick than the one already in hand is dropped: a frame that overtook
 * another on the way here must not undo it.
 */
export function drive(room: Room, id: string, bytes: Uint8Array): boolean {
  const member = room.members.get(id);
  if (member === undefined) return false;
  if (bytes.byteLength !== INPUT_BYTES) {
    member.dropped += 1;
    return false;
  }
  const pressed = readInput(bytes);
  if (pressed === null) {
    member.dropped += 1;
    return false;
  }
  if (pressed.tick !== 0 && pressed.tick < member.lastTick) return false;
  member.lastTick = pressed.tick;
  room.pressed.set(member.seat, { pressed, tick: room.tick });
  return true;
}
/**
 * What one seat is doing this tick: the member's own keys, their own view
 * angles, whatever they asked to hold, and whatever they asked to buy. Applied
 * to the body before the world steps it, because a view angle is a property of
 * the body the mover reads and not part of the `Input` it takes.
 */
function driveSeat(room: Room, seat: number, p: Player): Input | undefined {
  const held = room.pressed.get(seat);
  if (held === undefined) return undefined;
  // Silence for a third of a second is a body that drops the keys, not one that
  // keeps running: see `INPUT_HOLD`.
  if (room.tick - held.tick > INPUT_HOLD) return { ...NO_INPUT };
  const { pressed } = held;
  p.yaw = pressed.yaw;
  p.pitch = pressed.pitch;
  // One ask is one buy: the frame goes up every tick while the key is held, and
  // the shelf would empty a wallet sixty-four times a second without this.
  if (pressed.buy !== null) {
    const key = `${pressed.tick}:${pressed.buy}`;
    if (room.bought.get(seat) !== key) {
      room.bought.set(seat, key);
      if (canBuy(room.world, p)) spend(room.world, p, pressed.buy);
    }
  }
  return { ...pressed.input, switchTo: resolveSwitch(pressed.switchCode, p) };
}
/** One 64 Hz step of this room's round, with every seat's own input in it. */
export function stepRoom(room: Room): void {
  room.tick += 1;
  const seats = new Map<Player, number>();
  room.world.players.forEach((p, seat) => seats.set(p, seat));
  updateWith(room.world, TICK, (p) => {
    const seat = seats.get(p);
    return seat === undefined || p.bot ? undefined : driveSeat(room, seat, p);
  });
}
/**
 * The bytes one member is sent now: the round, and everything that happened
 * since *their* last snapshot. It is per member rather than per room because
 * that last clock is per member — somebody who joined half a second ago has a
 * different idea of "since" than somebody who has been here all match — and
 * because the buffer is one room's, written through each time.
 */
export function snapshotFor(room: Room, member: Member): Uint8Array {
  const bytes = writeSnapshot(room.world, room.tick, member.sentAt, room.frame);
  member.sentAt = room.world.time;
  return bytes;
}
/**
 * The words of the round since the last time it was asked for: the kill feed and
 * the lines in the middle of the screen. Both are written inside the world's own
 * tick and a member's page never runs one, so they travel as themselves.
 *
 * Null when nothing was said, which is almost every beat — a room sends this
 * only when there is something in it.
 */
export function logSince(room: Room): Log | null {
  const feed = room.world.feed.filter((entry) => entry.at > room.loggedFeed);
  const say = room.world.messages.filter((line) => line.at > room.loggedSay);
  if (feed.length === 0 && say.length === 0) return null;
  for (const entry of feed) room.loggedFeed = Math.max(room.loggedFeed, entry.at);
  for (const line of say) room.loggedSay = Math.max(room.loggedSay, line.at);
  return {
    k: "log",
    feed: feed.map((e) => ({
      at: e.at, killer: e.killer, victim: e.victim, weapon: e.weapon,
      headshot: e.headshot, killerTeam: e.killerTeam as "t" | "ct",
    })),
    say: say.map((line) => ({ at: line.at, text: line.text })),
  };
}
/** What a member is told the moment they are in: their seat, and the ground. */
export const helloFor = (room: Room, member: Member): Hello => ({
  k: "hello",
  code: room.code,
  seat: member.seat,
  map: room.map,
  seed: room.seed,
  rules: room.length,
  tick: room.tick,
  snapshotHz: SNAPSHOT_HZ,
  roster: rosterOf(room),
});
/** A room with nobody in it, for longer than `idle` milliseconds. */
export const isIdle = (room: Room, now: number, idle: number): boolean =>
  room.members.size === 0 && now - room.usedAt > idle;
/** For the terminal and the tests: one line about a room. */
export const describeRoom = (room: Room, now: number): string =>
  `${room.code}  ${String(room.members.size).padStart(2)}/${TEAM_SIZE * 2} on ${room.map}` +
  `  round ${room.world.match.round} ${room.world.match.score.t}-${room.world.match.score.ct}` +
  `  ${Math.round((now - room.created) / 1000)}s old`;
@@ -0,0 +1,507 @@
/**
 * A room, played without a network. Everything in `src/rooms/` is plain data
 * with a world in it, so every claim multiplayer rests on is made here: the
 * code is a code, an input frame is validated at the boundary, a snapshot round
 * trips, a seat is one person's, a leaving member hands the bot its body back,
 * and the caps refuse politely.
 *
 * The socket's own half — the upgrade, the same-origin check, the 404 on a plain
 * GET — is in `src/server.test.ts`, where the server is.
 */
import { expect, test } from "bun:test";
import { ALPHABET, isRoomCode, LENGTH, newRoomCode, roomCodeFrom } from "./code.ts";
import {
  createRoom, drive, freeSeat, isIdle, join, leave, logSince, rosterOf, snapshotFor, stepRoom,
  uniqueName, INPUT_HOLD, TICK, type Room,
} from "./room.ts";
import {
  applySnapshot, readInput, writeInput, writeSnapshot, BUY_ITEMS, INPUT_BYTES, SNAPSHOT_MAX,
  SWITCH_PRIMARY, SWITCH_SECONDARY, readDown, forget,
} from "./wire.ts";
import { createHub, CLOSE_FLOOD, CLOSE_TOO_BIG, IDLE_MS, MESSAGE_MAX, ROOM_CAP, type Wire } from "./hub.ts";
import { createWorld, NO_INPUT, type Input, type Player } from "../client/world.ts";
import { DE_FORGE } from "../client/map.ts";
import { SHORT } from "../client/match.ts";
import { useShipped } from "../client/shipped.ts";
import { pushEffect } from "../engine/index.ts";
useShipped(); // a room's bots think with the shipped policy, like the game's
const room = (now = 1000): Room => createRoom("ABCDEF", { map: "de_forge", seed: 9, length: "short", now });
// --- the code -------------------------------------------------------------
test("a room code is six readable characters, and nothing else is one", () => {
  expect(isRoomCode("ABCDEF")).toBe(true);
  expect(isRoomCode("abcdef")).toBe(false);
  expect(isRoomCode("ABCDE")).toBe(false);
  // The characters a person reads wrong are not in the alphabet at all.
  for (const wrong of ["O", "0", "I", "1", "L", "S", "5"]) expect(ALPHABET.includes(wrong)).toBe(false);
  expect(isRoomCode("ABCDE0")).toBe(false);
  expect(isRoomCode({ code: "ABCDEF" })).toBe(false);
  // The boundary upper-cases what a person typed and refuses what is not a code.
  expect(roomCodeFrom(" abcdef ")).toBe("ABCDEF");
  expect(roomCodeFrom("../../etc/passwd")).toBe(null);
  expect(roomCodeFrom(null)).toBe(null);
});
test("a fresh code is drawn from the alphabet and is the stated length", () => {
  for (let i = 0; i < 50; i++) {
    const code = newRoomCode();
    expect(code.length).toBe(LENGTH);
    expect(isRoomCode(code)).toBe(true);
  }
  // And it is drawn from the bytes it is handed, so a test can choose one.
  expect(newRoomCode((into) => into.fill(0))).toBe((ALPHABET[0] as string).repeat(LENGTH));
});
// --- the input frame ------------------------------------------------------
test("an input frame round trips, and every field comes back in range", () => {
  const input: Input = {
    ...NO_INPUT, forward: 1, side: -1, jump: true, fire: true, walk: true, throwing: "smoke",
  };
  const bytes = writeInput({ tick: 4242, input, yaw: -91.25, pitch: 37.5, switchCode: SWITCH_PRIMARY, buy: "ak47" });
  expect(bytes.byteLength).toBe(INPUT_BYTES);
  const read = readInput(bytes);
  expect(read).not.toBe(null);
  const got = read as NonNullable<typeof read>;
  expect(got.tick).toBe(4242);
  expect(got.input.forward).toBeCloseTo(1, 2);
  expect(got.input.side).toBeCloseTo(-1, 2);
  expect(got.input.jump).toBe(true);
  expect(got.input.fire).toBe(true);
  expect(got.input.walk).toBe(true);
  expect(got.input.duck).toBe(false);
  expect(got.input.throwing).toBe("smoke");
  expect(got.yaw).toBeCloseTo(-91.25, 1);
  expect(got.pitch).toBeCloseTo(37.5, 1);
  expect(got.switchCode).toBe(SWITCH_PRIMARY);
  expect(got.buy).toBe("ak47");
  // A weapon id never crosses this wire: a switch is one of four things the
  // server resolves against the body it is holding.
  expect(BUY_ITEMS.includes("ak47")).toBe(true);
});
test("a frame off the wire cannot ask for more than a keyboard can", () => {
  // Every byte set: the widest values this encoding can carry.
  const wild = new Uint8Array(INPUT_BYTES).fill(0xff);
  wild[0] = 1; // still an input frame
  const read = readInput(wild);
  const got = read as NonNullable<typeof read>;
  expect(got.input.forward).toBeGreaterThanOrEqual(-1);
  expect(got.input.side).toBeGreaterThanOrEqual(-1);
  expect(Math.abs(got.pitch)).toBeLessThanOrEqual(89);
  expect(Number.isFinite(got.yaw)).toBe(true);
  // And a frame of the wrong size or the wrong kind is not a frame at all.
  expect(readInput(new Uint8Array(INPUT_BYTES - 1))).toBe(null);
  expect(readInput(new Uint8Array(INPUT_BYTES + 1))).toBe(null);
  expect(readInput(new Uint8Array(INPUT_BYTES))).toBe(null); // first byte is not INPUT_FRAME
});
// --- the snapshot ---------------------------------------------------------
/** A round with something in it: a body hurt, a grenade in the air, a plant. */
function busy(): Room {
  const r = room();
  const world = r.world;
  world.match.phase = "live";
  world.match.timer = SHORT.roundTime;
  for (let i = 0; i < 64 * 3; i++) stepRoom(r);
  const thrower = world.players[2] as Player;
  world.grenades.push({
    pos: [thrower.pos[0], thrower.pos[1], thrower.pos[2] + 60], vel: [300, 20, 150],
    onGround: false, ducking: false, duckAmount: 0,
    weapon: "he", owner: thrower.id, team: thrower.team, fuse: 1.25,
  });
  world.clouds.push({ pos: [500, 500, 40], born: world.time - 1, owner: 3 });
  world.bomb.state = "planted";
  world.bomb.pos = [DE_FORGE.sites.A[0], DE_FORGE.sites.A[1], 4];
  world.bomb.site = "A";
  world.bomb.plantProgress = 1;
  world.bomb.defuseProgress = 0.5;
  return r;
}
test("a snapshot round trips: every body, the grenades, the smoke, the bomb and the clock", () => {
  const r = busy();
  const bytes = writeSnapshot(r.world, r.tick, 0, new Uint8Array(SNAPSHOT_MAX));
  // The other end has the same ten bodies on the same map from the same seed,
  // and has never stepped the world once.
  const mine = createWorld(r.level, SHORT, "watching", "ct", 5, r.seed);
  const got = applySnapshot(mine, bytes, 0);
  expect(got).not.toBe(null);
  const snap = got as NonNullable<typeof got>;
  expect(snap.tick).toBe(r.tick);
  expect(snap.time).toBeCloseTo(r.world.time, 2);
  expect(snap.own).not.toBe(null);
  r.world.players.forEach((p, i) => {
    const q = mine.players[i] as Player;
    // Seat 0 is the reader's own body, whose position is handed back rather
    // than written in: everybody else's is the server's, to a hundredth.
    if (i > 0) {
      expect(q.pos[0]).toBeCloseTo(p.pos[0], 2);
      expect(q.pos[1]).toBeCloseTo(p.pos[1], 2);
      expect(q.pos[2]).toBeCloseTo(p.pos[2], 2);
      expect(q.vel[0]).toBeCloseTo(p.vel[0], 2);
      // An angle is 16 bits of a turn, so it is right to a hundredth of a degree.
      expect(Math.abs(((q.yaw - p.yaw + 540) % 360) - 180)).toBeCloseTo(0, 1);
    }
    expect(q.health).toBe(Math.round(p.health));
    expect(q.armor).toBe(Math.round(p.armor));
    expect(q.alive).toBe(p.alive);
    expect(q.team).toBe(p.team);
    expect(q.weapon).toBe(p.weapon);
    expect(q.primary).toBe(p.primary);
    expect(q.money).toBe(p.money);
    expect(q.kills).toBe(p.kills);
    expect(q.deaths).toBe(p.deaths);
    expect(q.ammo[q.weapon]?.mag).toBe(p.ammo[p.weapon]?.mag ?? 0);
    expect(q.duckAmount).toBeCloseTo(p.duckAmount, 2);
  });
  expect(mine.match.phase).toBe(r.world.match.phase);
  expect(mine.match.round).toBe(r.world.match.round);
  expect(mine.match.timer).toBeCloseTo(r.world.match.timer, 2);
  expect(mine.bomb.state).toBe("planted");
  expect(mine.bomb.site).toBe("A");
  expect(mine.bomb.pos[0]).toBeCloseTo(r.world.bomb.pos[0], 2);
  expect(mine.bomb.defuseProgress).toBeCloseTo(0.5, 3);
  expect(mine.grenades.length).toBe(1);
  expect(mine.grenades[0]?.weapon).toBe("he");
  expect(mine.grenades[0]?.pos[0]).toBeCloseTo(r.world.grenades[0]?.pos[0] as number, 2);
  expect(mine.grenades[0]?.fuse).toBeCloseTo(r.world.grenades[0]?.fuse as number, 1);
  expect(mine.clouds.length).toBe(1);
  expect(mine.clouds[0]?.pos[1]).toBeCloseTo(500, 2);
  // The cloud's age survives, which is what its radius is read off.
  expect(mine.time - (mine.clouds[0]?.born as number)).toBeCloseTo(1, 1);
});
test("a snapshot carries what happened, and a member's own shot is their own", () => {
  const r = room();
  const world = r.world;
  world.match.phase = "live";
  const at = world.time;
  pushEffect(world.effects, { kind: "shot", at, pos: [1, 2, 3], weapon: "ak47", mine: false, by: 3 }, at);
  pushEffect(world.effects, { kind: "tracer", at, from: [0, 0, 0], to: [10, 0, 0] }, at);
  pushEffect(world.effects, { kind: "sound", at, pos: [4, 5, 6], name: "step", by: 7 }, at);
  const bytes = writeSnapshot(world, r.tick, at - 0.001, new Uint8Array(SNAPSHOT_MAX));
  const mine = createWorld(r.level, SHORT, "watching", "ct", 5, r.seed);
  forget(mine);
  expect(applySnapshot(mine, bytes, 3)?.events).toBe(3);
  const shot = mine.effects.events.find((e) => e?.kind === "shot");
  expect(shot?.kind).toBe("shot");
  if (shot?.kind === "shot") {
    // Seat 3 read this snapshot, and seat 3 fired: it is their own gun.
    expect(shot.mine).toBe(true);
    expect(shot.weapon).toBe("ak47");
    expect(shot.pos[0]).toBeCloseTo(1, 2);
  }
  const heard = mine.effects.events.find((e) => e?.kind === "sound");
  expect(heard?.kind === "sound" && heard.by).toBe(7);
  // And the same snapshot read by somebody else is somebody else's gun.
  const theirs = createWorld(r.level, SHORT, "watching", "ct", 5, r.seed);
  forget(theirs);
  applySnapshot(theirs, bytes, 8);
  const other = theirs.effects.events.find((e) => e?.kind === "shot");
  expect(other?.kind === "shot" && other.mine).toBe(false);
});
test("a snapshot of a ten-body round stays inside the bytes the rate was chosen for", () => {
  const r = busy();
  const bytes = writeSnapshot(r.world, r.tick, r.world.time - 0.0625, new Uint8Array(SNAPSHOT_MAX));
  // The number the snapshot rate was picked against: 16 a second of this is
  // under 10 kB a second down to each member. A change that doubles it should
  // be read here first, not discovered on somebody's phone.
  expect(bytes.byteLength).toBeLessThan(700);
  console.log(`  a snapshot of a busy ten-body round: ${bytes.byteLength} bytes` +
    ` — ${(bytes.byteLength * 16 / 1000).toFixed(1)} kB/s a member at 16 Hz`);
});
test("a snapshot that is not one changes nothing", () => {
  const r = room();
  const mine = createWorld(r.level, SHORT, "watching", "ct", 5, r.seed);
  const was: number[] = [...(mine.players[1] as Player).pos];
  expect(applySnapshot(mine, new Uint8Array(0), 0)).toBe(null);
  expect(applySnapshot(mine, new Uint8Array([9, 9, 9, 9]), 0)).toBe(null);
  // A frame that is the right kind and then stops: refused, and nothing written.
  const good = writeSnapshot(r.world, r.tick, 0, new Uint8Array(SNAPSHOT_MAX));
  expect(applySnapshot(mine, good.slice(0, 30), 0)).toBe(null);
  expect([...(mine.players[1] as Player).pos]).toEqual(was);
});
test("a control message off the wire is validated field by field", () => {
  const hello = readDown(JSON.stringify({
    k: "hello", code: "ABCDEF", seat: 3, map: "de_forge", seed: 9, rules: "short", tick: 10,
    snapshotHz: 16, roster: [{ seat: 0, name: "you", bot: false, team: "ct" }],
  }));
  expect(hello?.k).toBe("hello");
  expect(readDown("not json")).toBe(null);
  expect(readDown(JSON.stringify({ k: "hello" }))).toBe(null);
  expect(readDown(JSON.stringify({ k: "hello", code: "A", seat: 0, map: "x", seed: Infinity, rules: "short", tick: 0, snapshotHz: 16, roster: [] }))).toBe(null);
  expect(readDown(JSON.stringify({ k: "roster", roster: [{ seat: 0, name: "a", bot: true, team: "zz" }] }))).toBe(null);
  expect(readDown(JSON.stringify({ k: "log", feed: [], say: [{ at: 1, text: "hi" }] }))?.k).toBe("log");
  expect(readDown(JSON.stringify({ k: "nonsense" }))).toBe(null);
});
// --- seats ---------------------------------------------------------------
test("a member takes a bot's seat and gives it back on the way out", () => {
  const r = room();
  const seat = freeSeat(r) as number;
  const body = r.world.players[seat] as Player;
  const botName = body.name;
  body.money = 4321;
  const member = join(r, "s1", "  Vesper  ", 2000);
  expect(member?.seat).toBe(seat);
  expect(body.bot).toBe(false);
  expect(body.name).toBe("Vesper");
  // The bot's money, guns and position are not reset by an arrival.
  expect(body.money).toBe(4321);
  expect(rosterOf(r).filter((s) => !s.bot).length).toBe(1);
  leave(r, "s1", 3000);
  expect(body.bot).toBe(true);
  expect(body.name).toBe(botName);
  expect(body.money).toBe(4321);
  expect(r.members.size).toBe(0);
});
test("two friends land on opposite sides, and a name is never two people's", () => {
  const r = room();
  const first = join(r, "s1", "sam", 1) as NonNullable<ReturnType<typeof join>>;
  const second = join(r, "s2", "sam", 2) as NonNullable<ReturnType<typeof join>>;
  const a = r.world.players[first.seat] as Player;
  const b = r.world.players[second.seat] as Player;
  expect(a.team).not.toBe(b.team);
  expect(second.name).toBe("sam (2)");
  expect(uniqueName(r, "")).toBe("player");
  // A member who reconnects with the same session keeps the seat they had.
  expect(join(r, "s1", "sam", 3)?.seat).toBe(first.seat);
  expect(r.members.size).toBe(2);
});
test("a room fills up, and the eleventh person is refused rather than dropped", () => {
  const r = room();
  for (let i = 0; i < 10; i++) expect(join(r, `s${i}`, `p${i}`, i)).not.toBe(null);
  expect(freeSeat(r)).toBe(null);
  expect(join(r, "s10", "late", 11)).toBe(null);
  expect(r.members.size).toBe(10);
});
// --- input into the world -------------------------------------------------
/** The bytes a member would send for one tick of holding W. */
const forward = (tick: number, yaw: number): Uint8Array =>
  writeInput({ tick, input: { ...NO_INPUT, forward: 1 }, yaw, pitch: 0, switchCode: 0, buy: null });
test("a member's keys move their own body, and nobody else's", () => {
  const r = room();
  r.world.match.phase = "live";
  r.world.match.timer = SHORT.roundTime;
  const member = join(r, "s1", "sam", 1) as NonNullable<ReturnType<typeof join>>;
  const body = r.world.players[member.seat] as Player;
  const was: [number, number] = [body.pos[0], body.pos[1]];
  for (let i = 0; i < 32; i++) {
    expect(drive(r, "s1", forward(i, 90))).toBe(true);
    stepRoom(r);
  }
  // It walked, and it walked where the frame said it was looking.
  expect(Math.hypot(body.pos[0] - was[0], body.pos[1] - was[1])).toBeGreaterThan(40);
  expect(body.yaw).toBeCloseTo(90, 2);
  // An input from somebody who is not in this room reaches nothing at all.
  expect(drive(r, "stranger", forward(40, 0))).toBe(false);
  // And a frame of the wrong size is refused and counted.
  expect(drive(r, "s1", new Uint8Array(MESSAGE_MAX))).toBe(false);
  expect(member.dropped).toBe(1);
});
test("a late frame is the member's last one, and silence drops the keys", () => {
  const r = room();
  r.world.match.phase = "live";
  r.world.match.timer = SHORT.roundTime;
  join(r, "s1", "sam", 1);
  const body = r.world.players[freeSeatOf(r)] as Player;
  drive(r, "s1", forward(1, 0));
  // Nothing else arrives: the last input is held for INPUT_HOLD ticks and the
  // body keeps walking, then drops the keys and comes to a stop.
  for (let i = 0; i < INPUT_HOLD; i++) stepRoom(r);
  const moving = Math.hypot(body.vel[0], body.vel[1]);
  expect(moving).toBeGreaterThan(50);
  for (let i = 0; i < 64; i++) stepRoom(r);
  expect(Math.hypot(body.vel[0], body.vel[1])).toBeLessThan(1);
  // A frame that overtook another on the way here does not undo it.
  drive(r, "s1", forward(100, 10));
  expect(drive(r, "s1", forward(50, 200))).toBe(false);
  stepRoom(r);
  expect(body.yaw).toBeCloseTo(10, 2);
});
/** The seat the one member of this room is holding. */
const freeSeatOf = (r: Room): number => [...r.members.values()][0]?.seat as number;
test("a member buys once for one ask, and only what the money covers", () => {
  const r = room();
  const member = join(r, "s1", "sam", 1) as NonNullable<ReturnType<typeof join>>;
  const body = r.world.players[member.seat] as Player;
  body.money = 2700;
  const ask = (tick: number, item: "ak47"): void => {
    drive(r, "s1", writeInput({ tick, input: NO_INPUT, yaw: 0, pitch: 0, switchCode: 0, buy: item }));
  };
  // The key is held for a quarter of a second, which is sixteen frames of the
  // same ask: one rifle, not sixteen.
  for (let i = 0; i < 16; i++) { ask(1, "ak47"); stepRoom(r); }
  expect(body.primary).toBe("ak47");
  expect(body.money).toBe(2700 - 2700);
  // And with the wallet empty, the next ask changes nothing.
  ask(2, "ak47");
  stepRoom(r);
  expect(body.money).toBe(0);
  // Holding the rifle is a switch the server resolves against the body.
  drive(r, "s1", writeInput({ tick: 3, input: NO_INPUT, yaw: 0, pitch: 0, switchCode: SWITCH_PRIMARY, buy: null }));
  stepRoom(r);
  expect(body.weapon).toBe("ak47");
  drive(r, "s1", writeInput({ tick: 4, input: NO_INPUT, yaw: 0, pitch: 0, switchCode: SWITCH_SECONDARY, buy: null }));
  for (let i = 0; i < 64; i++) stepRoom(r);
  expect(body.weapon).toBe(body.secondary);
});
test("a room's round is played by its own bots and says what happened", () => {
  const r = room();
  // Straight into a live round, and then a few seconds of it.
  r.world.match.phase = "live";
  r.world.match.timer = SHORT.roundTime;
  for (let i = 0; i < 64 * 20; i++) stepRoom(r);
  expect(r.tick).toBe(64 * 20);
  expect(r.world.time).toBeCloseTo(20, 0);
  // Bots left their spawns and somebody shot somebody.
  expect(r.world.players.some((p) => p.kills > 0 || p.damage > 0)).toBe(true);
  const log = logSince(r);
  // The words of the round travel as themselves: the feed and the lines.
  if (log !== null) expect(log.feed.length + log.say.length).toBeGreaterThan(0);
  // Asked twice, nothing is said twice.
  const again = logSince(r);
  expect(again === null || again.feed.length + again.say.length === 0).toBe(true);
});
// --- the hub -------------------------------------------------------------
/** A wire that remembers instead of sending. */
function spy(): Wire & { sent: Map<string, (Uint8Array | string)[]>; closed: { id: string; code: number }[] } {
  const sent = new Map<string, (Uint8Array | string)[]>();
  const closed: { id: string; code: number }[] = [];
  return {
    sent, closed,
    deliver(id, frame) {
      const list = sent.get(id) ?? [];
      list.push(frame);
      sent.set(id, list);
    },
    close(id, code) { closed.push({ id, code }); },
  };
}
const opened = { map: "de_forge" as const, seed: 5, length: "short" as const, now: 0 };
test("a hub holds its rooms, hears one member and never the other room", () => {
  const wire = spy();
  const hub = createHub(wire, { now: 0 });
  const first = hub.open({ ...opened, now: 0 });
  const second = hub.open({ ...opened, seed: 6, now: 0 });
  expect(first).not.toBe(null);
  expect(second).not.toBe(null);
  const a = hub.enter((first as Room).code, "s1", "sam", 0);
  const b = hub.enter((second as Room).code, "s2", "kim", 0);
  expect(a).not.toBe(null);
  expect(b).not.toBe(null);
  // Each was told which body is theirs, on which map, with who else is here.
  const hello = wire.sent.get("s1")?.[0] as string;
  expect(JSON.parse(hello).k).toBe("hello");
  expect(JSON.parse(hello).code).toBe((first as Room).code);
  // A quarter of a second: sixteen ticks a room, four snapshots a member.
  for (let ms = 10; ms <= 250; ms += 10) hub.advance(ms);
  const snapshots = (id: string): number =>
    (wire.sent.get(id) ?? []).filter((f) => f instanceof Uint8Array).length;
  expect(snapshots("s1")).toBeGreaterThanOrEqual(3);
  expect(snapshots("s1")).toBeLessThanOrEqual(5);
  // The two rooms stepped their own worlds and nobody else's.
  expect((first as Room).tick).toBeGreaterThan(8);
  expect((first as Room).world.players[0]?.pos).not.toEqual((second as Room).world.players[0]?.pos);
  expect(hub.members()).toBe(2);
  expect(hub.lines(250).length).toBe(2);
  // One member's input reaches their own room's world, and the other room's
  // member is in no way touched by it.
  const before = [...((second as Room).world.players[(b as { member: { seat: number } }).member.seat] as Player).pos];
  expect(hub.frame("s1", forward(1, 0), 260)).toBe(true);
  hub.advance(300);
  expect((second as Room).world.players[(b as { member: { seat: number } }).member.seat]?.pos).not.toBe(before);
});
test("a frame over the cap or over the limiter closes the connection", () => {
  const wire = spy();
  const hub = createHub(wire, { now: 0 });
  const r = hub.open(opened) as Room;
  hub.enter(r.code, "s1", "sam", 0);
  expect(hub.frame("s1", new Uint8Array(MESSAGE_MAX + 1), 1)).toBe(false);
  expect(wire.closed[0]).toEqual({ id: "s1", code: CLOSE_TOO_BIG });
  // And a caller that sends far more than a page can: closed, and the process
  // is still here to say so.
  const wire2 = spy();
  const hub2 = createHub(wire2, { now: 0 });
  const r2 = hub2.open(opened) as Room;
  hub2.enter(r2.code, "s2", "kim", 0);
  let refused = 0;
  for (let i = 0; i < 400; i++) if (!hub2.frame("s2", forward(i, 0), 1)) refused += 1;
  expect(refused).toBeGreaterThan(200);
  expect(wire2.closed.some((c) => c.code === CLOSE_FLOOD)).toBe(true);
});
test("the room cap refuses politely, and an empty room is collected", () => {
  const wire = spy();
  const hub = createHub(wire, { now: 0 });
  for (let i = 0; i < ROOM_CAP; i++) expect(hub.open({ ...opened, seed: i })).not.toBe(null);
  expect(hub.open(opened)).toBe(null);
  expect(hub.rooms.size).toBe(ROOM_CAP);
  // Nobody ever joined any of them, so they all go on the first sweep past the
  // idle time — and the cap is a cap again.
  hub.advance(IDLE_MS + 1000);
  expect(hub.rooms.size).toBe(0);
  const r = hub.open({ ...opened, now: IDLE_MS + 1000 }) as Room;
  hub.enter(r.code, "s1", "sam", IDLE_MS + 1000);
  // A room with somebody in it is never idle, however long the match runs.
  hub.advance(IDLE_MS * 3);
  expect(hub.rooms.size).toBe(1);
  expect(isIdle(r, IDLE_MS * 3, IDLE_MS)).toBe(false);
  // They leave, and it is collected on the sweep after the idle time.
  hub.exit("s1", IDLE_MS * 3);
  hub.advance(IDLE_MS * 3 + IDLE_MS + 1);
  expect(hub.rooms.size).toBe(0);
});
test("a member nobody has heard from loses the seat they are holding", () => {
  const wire = spy();
  const hub = createHub(wire, { now: 0 });
  const r = hub.open(opened) as Room;
  hub.enter(r.code, "s1", "sam", 0);
  hub.advance(1000);
  expect(wire.closed.length).toBe(0);
  hub.advance(40_000);
  expect(wire.closed.some((c) => c.id === "s1")).toBe(true);
  // The close is what takes them out, the way a browser closing does.
  hub.exit("s1", 40_000);
  expect(r.members.size).toBe(0);
  expect(r.world.players.every((p) => p.bot)).toBe(true);
});
test("one member's snapshot is a snapshot of the room they are in", () => {
  const r = room();
  const member = join(r, "s1", "sam", 0) as NonNullable<ReturnType<typeof join>>;
  for (let i = 0; i < 64; i++) stepRoom(r);
  const bytes = snapshotFor(r, member);
  expect(bytes.byteLength).toBeGreaterThan(100);
  // Asking again sends only what happened since: the clock moved on.
  expect(member.sentAt).toBeCloseTo(r.world.time, 5);
});
@@ -0,0 +1,677 @@
/**
 * What crosses the socket between a room and a member, and nothing about how it
 * gets there. Two frames, in two directions, and they are different shapes on
 * purpose.
 *
 * **Up, from a browser: one input a tick, fourteen bytes.** A member's keys, the
 * tick they were pressed on, and where they are looking. The view angles are the
 * one thing a client is believed about — a person's aim has to answer their hand
 * and not a round trip — and everything else is a request the world may refuse.
 * `readInput` is the boundary: it takes bytes off a wire and hands back an
 * `Input` whose every field is in range, or null, and a null is a frame that is
 * dropped rather than a room that is confused.
 *
 * **Down, from the room: one snapshot a beat.** The whole round as numbers —
 * every body, the grenades in the air, the smoke standing, the bomb and the
 * clock — plus what *happened* since the last one, so a shot is a tracer and a
 * noise on the member's screen and not a silently smaller number. It is packed
 * binary and quantised rather than JSON because it is the only thing on this
 * wire that is sent sixteen times a second to everybody: 544 bytes against
 * about 3.4 kB of JSON for the same round, which is 8.7 kB a second a member
 * instead of 54.
 *
 * Positions are `f32` and not quantised integers. A generated map is a few
 * thousand Source units across and the honest 16-bit encoding of that is a
 * quarter-unit grid, which is visible on a body standing still; two bytes a
 * coordinate is the cheapest thing in this frame to buy correctness with.
 * Angles are 16-bit — 0.0055° a step, far under what a screen can show — and
 * everything else is a byte or two of its own natural range.
 *
 * Nothing here knows about a socket, a request or a page: bytes in, plain data
 * out, so every claim in `wire.test.ts` is made without either end running.
 */
import type { Bomb, BombState } from "../client/bomb.ts";
import type { Cloud, Grenade } from "../client/grenade.ts";
import type { Phase } from "../client/match.ts";
import { emptyAmmo, type BuyItem } from "../client/economy.ts";
import { pushEffect, resetEffects, type Vec3 } from "../engine/index.ts";
import { WEAPONS, type ThrownId, type WeaponId } from "../client/weapons.ts";
import { NO_INPUT, type Effect, type Input, type Player, type Sound, type World } from "../client/world.ts";
/** The first byte of every frame: which of the two shapes it is. */
export const INPUT_FRAME = 1;
export const SNAPSHOT_FRAME = 2;
/**
 * The tables both ends index into. Each is sorted rather than written out in
 * declaration order, so a weapon added to `weapons.ts` cannot silently renumber
 * the wire for a page that is still open on a previous deploy — it lands in
 * alphabetical order and the numbers around it stay put.
 */
export const WEAPON_IDS: readonly WeaponId[] = (Object.keys(WEAPONS) as WeaponId[]).sort();
export const THROWN_IDS: readonly ThrownId[] = ["flash", "he", "smoke"];
export const PHASES: readonly Phase[] = ["freeze", "live", "planted", "over", "match_over"];
export const BOMB_STATES: readonly BombState[] = ["carried", "dropped", "planted", "defused", "detonated"];
export const SOUNDS: readonly Sound[] = [
  "beep", "bounce", "blast", "death", "defuse", "flash", "plant", "smoke", "step", "throw",
];
/** The widest frame this module will ever write, so the buffer is made once. */
export const SNAPSHOT_MAX = 8192;
/** How many bodies, grenades, clouds and events one snapshot may carry. */
export const MAX_PLAYERS = 16;
export const MAX_GRENADES = 32;
export const MAX_CLOUDS = 16;
export const MAX_EVENTS = 64;
// --- reading and writing bytes --------------------------------------------
/**
 * A cursor over bytes. Both directions use one, because a frame is written and
 * read field by field in one order and the two halves of that have to be read
 * side by side to stay the same order.
 */
class Cursor {
  view: DataView;
  at = 0;
  constructor(public bytes: Uint8Array) {
    this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
  }
  u8(v: number): void { this.view.setUint8(this.at++, v & 0xff); }
  i8(v: number): void { this.view.setInt8(this.at++, Math.max(-128, Math.min(127, v | 0))); }
  u16(v: number): void { this.view.setUint16(this.at, v & 0xffff, true); this.at += 2; }
  i16(v: number): void { this.view.setInt16(this.at, Math.max(-32768, Math.min(32767, v | 0)), true); this.at += 2; }
  u32(v: number): void { this.view.setUint32(this.at, v >>> 0, true); this.at += 4; }
  f32(v: number): void { this.view.setFloat32(this.at, Number.isFinite(v) ? v : 0, true); this.at += 4; }
  ru8(): number { return this.view.getUint8(this.at++); }
  ri8(): number { return this.view.getInt8(this.at++); }
  ru16(): number { const v = this.view.getUint16(this.at, true); this.at += 2; return v; }
  ri16(): number { const v = this.view.getInt16(this.at, true); this.at += 2; return v; }
  ru32(): number { const v = this.view.getUint32(this.at, true); this.at += 4; return v; }
  rf32(): number { const v = this.view.getFloat32(this.at, true); this.at += 4; return v; }
  /** Room for `n` more bytes. A frame that claims more than it carries is refused. */
  has(n: number): boolean { return this.at + n <= this.bytes.byteLength; }
}
/** An angle as 16 bits of a turn: 0.0055° a step, which no screen can show. */
const packAngle = (degrees: number): number => Math.round(((degrees % 360) + 360) % 360 / 360 * 65536) & 0xffff;
const unpackAngle = (bits: number): number => (bits / 65536) * 360;
/** The same, read back into the −180…180 half the view uses. */
const unpackSigned = (bits: number): number => {
  const a = unpackAngle(bits);
  return a > 180 ? a - 360 : a;
};
const clamp = (v: number, lo: number, hi: number): number => (v < lo ? lo : v > hi ? hi : v);
/** A number off a wire, or the fallback: NaN and Infinity are not numbers here. */
const finite = (v: number, fallback = 0): number => (Number.isFinite(v) ? v : fallback);
// --- up: one member's input ----------------------------------------------
/**
 * Which weapon a member asked to hold, as one of four things the *server*
 * resolves against the body: nothing, the knife, the pistol, the rifle. A
 * client cannot name a weapon id on this wire at all, so "switch to the AWP I
 * do not own" is not a message that exists rather than a message that is
 * refused — and `applyInput` in the world refuses it a second time anyway.
 */
export const SWITCH_NONE = 0;
export const SWITCH_KNIFE = 1;
export const SWITCH_SECONDARY = 2;
export const SWITCH_PRIMARY = 3;
/**
 * Everything a member may buy, sorted for the reason the weapon table is: this
 * is an index on a wire, and a page open on yesterday's deploy must not be able
 * to buy a rifle by asking for armour. Zero is "nothing asked for".
 */
export const BUY_ITEMS: readonly BuyItem[] = ([...WEAPON_IDS, "armor", "helmet", "kit"] as BuyItem[]).sort();
/** What one member pressed, on the tick they pressed it. */
export type Pressed = {
  tick: number;
  input: Input;
  yaw: number;
  pitch: number;
  switchCode: number;
  /**
   * The one thing a member asks for that is not a key: an item off the shelf,
   * by index into `BUY_ITEMS`, or null. It rides on the input frame because it
   * happens during freeze time when the frame is already going up every tick,
   * and because a buy that needs its own message needs its own limiter; the
   * room spends it once — `economy.ts` refuses it if the money is not there.
   */
  buy: BuyItem | null;
};
/** The fourteen bytes a browser sends once a tick. */
export function writeInput(pressed: Pressed, into = new Uint8Array(INPUT_BYTES)): Uint8Array {
  const c = new Cursor(into);
  const { input } = pressed;
  c.u8(INPUT_FRAME);
  c.u32(pressed.tick);
  c.u8(
    (input.jump ? 1 : 0) | (input.duck ? 2 : 0) | (input.walk ? 4 : 0) | (input.fire ? 8 : 0) |
    (input.reload ? 16 : 0) | (input.use ? 32 : 0) | (input.scope ? 64 : 0),
  );
  c.i8(Math.round(clamp(input.forward, -1, 1) * 127));
  c.i8(Math.round(clamp(input.side, -1, 1) * 127));
  c.u16(packAngle(pressed.yaw));
  c.u16(packAngle(pressed.pitch));
  const throwing = input.throwing === null ? 0 : THROWN_IDS.indexOf(input.throwing) + 1;
  c.u8(throwing | (clamp(pressed.switchCode, 0, 3) << 2));
  c.u8(pressed.buy === null ? 0 : BUY_ITEMS.indexOf(pressed.buy) + 1);
  return into.subarray(0, c.at);
}
export const INPUT_BYTES = 14;
/**
 * The inverse, and the boundary. Every field comes back inside its own range —
 * a wish is at most one in each direction, a pitch is at most 89° from level, a
 * grenade is one of three or none, a switch is one of four — or this is null,
 * which is a frame the room drops. Nothing a caller writes can make the world
 * do something the keyboard cannot.
 */
export function readInput(bytes: Uint8Array): Pressed | null {
  if (bytes.byteLength !== INPUT_BYTES) return null;
  const c = new Cursor(bytes);
  if (c.ru8() !== INPUT_FRAME) return null;
  const tick = c.ru32();
  const flags = c.ru8();
  const forward = clamp(c.ri8() / 127, -1, 1);
  const side = clamp(c.ri8() / 127, -1, 1);
  const yaw = unpackSigned(c.ru16());
  const pitch = clamp(unpackSigned(c.ru16()), -89, 89);
  const extra = c.ru8();
  const thrown = extra & 3;
  const switchCode = (extra >> 2) & 3;
  const wanted = c.ru8();
  // An index nothing is filed under is nothing asked for, not a refusal: a
  // frame is dropped for being the wrong shape and never for one bad field.
  const buy = wanted === 0 ? null : (BUY_ITEMS[wanted - 1] ?? null);
  const input: Input = {
    ...NO_INPUT,
    forward, side,
    jump: (flags & 1) !== 0,
    duck: (flags & 2) !== 0,
    walk: (flags & 4) !== 0,
    fire: (flags & 8) !== 0,
    reload: (flags & 16) !== 0,
    use: (flags & 32) !== 0,
    scope: (flags & 64) !== 0,
    throwing: thrown === 0 ? null : (THROWN_IDS[thrown - 1] as ThrownId),
    switchTo: null,
  };
  return { tick, input, yaw, pitch, switchCode, buy };
}
/**
 * The weapon a switch code means for this body: the knife, whatever is in the
 * holster, whatever is on the back, or nothing. A code for a rifle nobody owns
 * is nothing, because `primary` is null on a body that never bought one.
 */
export const resolveSwitch = (code: number, p: Player): WeaponId | null =>
  code === SWITCH_KNIFE ? "knife" :
  code === SWITCH_SECONDARY ? p.secondary :
  code === SWITCH_PRIMARY ? p.primary : null;
// --- down: the round, and what just happened in it ------------------------
/** Which kinds of effect travel. The viewer-relative ones do not: see below. */
const EFFECT_KINDS = ["tracer", "impact", "blood", "shot", "blast", "sound"] as const;
/**
 * What arrived: the tick it is the truth of, the clock it was taken on, how many
 * effects came with it, and — separately from the world it was written into —
 * where the server has the member's *own* body. That last one is handed back
 * rather than written in because it is the one number the page does not simply
 * accept: `src/client/session.ts` predicted a position for this tick already and
 * reconciles against this one.
 */
export type Snapshot = { tick: number; time: number; events: number; own: { pos: Vec3; vel: Vec3 } | null };
/**
 * One room's round, whole, into `into`. Everything in `world` that a screen or
 * a HUD reads, and every effect younger than `since` — which is the clock of
 * the last snapshot this member was sent, so a shot is delivered exactly once.
 *
 * Two kinds of effect are left out and cannot be sent from here: `hitmark` and
 * `hurt` are recorded for one body's screen only (`world.me`'s), and a room's
 * world has no such body — every snapshot goes to everybody. A room therefore
 * has no hit marker and no damage arrow yet, which is stated on the page and in
 * the README rather than faked.
 */
export function writeSnapshot(world: World, tick: number, since: number, into: Uint8Array): Uint8Array {
  const c = new Cursor(into);
  c.u8(SNAPSHOT_FRAME);
  c.u32(tick);
  c.f32(world.time);
  const m = world.match;
  c.u8(Math.max(0, PHASES.indexOf(m.phase)));
  c.u8(clamp(m.round, 0, 255));
  c.u8(clamp(m.score.t, 0, 255));
  c.u8(clamp(m.score.ct, 0, 255));
  c.f32(m.timer);
  c.u8(m.matchWinner === null ? 0 : m.matchWinner === "t" ? 1 : 2);
  // The bomb: its state, where it is, and how far through a plant or a defuse
  // somebody is — both of which are bars on a screen and so both of which go.
  c.u8(Math.max(0, BOMB_STATES.indexOf(world.bomb.state)));
  c.f32(world.bomb.pos[0]); c.f32(world.bomb.pos[1]); c.f32(world.bomb.pos[2]);
  c.f32(world.bomb.plantProgress);
  c.f32(world.bomb.defuseProgress);
  c.u8(world.bomb.site === "A" ? 1 : world.bomb.site === "B" ? 2 : 0);
  c.u8(Math.min(world.players.length, MAX_PLAYERS));
  for (const p of world.players.slice(0, MAX_PLAYERS)) writePlayer(c, p);
  const grenades = world.grenades.slice(0, MAX_GRENADES);
  c.u8(grenades.length);
  for (const g of grenades) {
    c.f32(g.pos[0]); c.f32(g.pos[1]); c.f32(g.pos[2]);
    c.u8(Math.max(0, THROWN_IDS.indexOf(g.weapon)));
    c.u8(clamp(g.owner, 0, 255));
    c.u8(g.team === "t" ? 1 : 0);
    // A fuse is at most a handful of seconds, in thirty-seconds of one.
    c.u8(clamp(Math.round(g.fuse * 32), 0, 255));
  }
  const clouds = world.clouds.slice(0, MAX_CLOUDS);
  c.u8(clouds.length);
  for (const s of clouds) {
    c.f32(s.pos[0]); c.f32(s.pos[1]); c.f32(s.pos[2]);
    // Seconds ago it opened, in sixteenths: a cloud's radius is read off this.
    c.u8(clamp(Math.round((world.time - s.born) * 16), 0, 255));
    c.u8(clamp(s.owner, 0, 255));
  }
  const events = eventsSince(world, since);
  c.u8(events.length);
  for (const e of events) writeEvent(c, e);
  return into.subarray(0, c.at);
}
/** Everything in the ring younger than `since`, newest last, capped. */
function eventsSince(world: World, since: number): Effect[] {
  const out: Effect[] = [];
  const ring = world.effects;
  for (let i = 0; i < ring.count; i++) {
    const e = ring.events[i];
    if (e === undefined || e.at <= since) continue;
    if (!(EFFECT_KINDS as readonly string[]).includes(e.kind)) continue;
    out.push(e);
  }
  // A busier two hundredths of a second than this game can have: the newest are
  // what a frame is about to draw, so it is the oldest that are dropped.
  return out.length <= MAX_EVENTS ? out : out.slice(out.length - MAX_EVENTS);
}
const writeEvent = (c: Cursor, e: Effect): void => {
  c.u8(Math.max(0, (EFFECT_KINDS as readonly string[]).indexOf(e.kind)));
  c.f32(e.at);
  switch (e.kind) {
    case "tracer":
      c.f32(e.from[0]); c.f32(e.from[1]); c.f32(e.from[2]);
      c.f32(e.to[0]); c.f32(e.to[1]); c.f32(e.to[2]);
      break;
    case "impact":
      c.f32(e.pos[0]); c.f32(e.pos[1]); c.f32(e.pos[2]);
      // A normal is a unit vector: a byte a component is a fiftieth of a degree
      // of tilt, and nothing but a spark's direction is read off it.
      c.i8(Math.round(e.normal[0] * 127)); c.i8(Math.round(e.normal[1] * 127)); c.i8(Math.round(e.normal[2] * 127));
      break;
    case "blood":
      c.f32(e.pos[0]); c.f32(e.pos[1]); c.f32(e.pos[2]);
      break;
    case "shot":
      c.f32(e.pos[0]); c.f32(e.pos[1]); c.f32(e.pos[2]);
      c.u8(Math.max(0, WEAPON_IDS.indexOf(e.weapon)));
      // Whose gun it was, so the member reading this decides whether it is
      // theirs. `mine` cannot cross a wire one snapshot serves everybody on.
      c.u8(clamp(e.by ?? 255, 0, 255));
      break;
    case "blast":
      c.f32(e.pos[0]); c.f32(e.pos[1]); c.f32(e.pos[2]);
      c.u8(Math.max(0, THROWN_IDS.indexOf(e.weapon)));
      break;
    case "sound":
      c.f32(e.pos[0]); c.f32(e.pos[1]); c.f32(e.pos[2]);
      c.u8(Math.max(0, SOUNDS.indexOf(e.name)));
      c.u8(e.by < 0 ? 255 : clamp(e.by, 0, 255));
      break;
    default:
      break;
  }
};
function writePlayer(c: Cursor, p: Player): void {
  c.f32(p.pos[0]); c.f32(p.pos[1]); c.f32(p.pos[2]);
  c.f32(p.vel[0]); c.f32(p.vel[1]); c.f32(p.vel[2]);
  c.u16(packAngle(p.yaw));
  c.u16(packAngle(p.pitch));
  c.u8(clamp(Math.round(p.health), 0, 255));
  c.u8(clamp(Math.round(p.armor), 0, 255));
  c.u8(
    (p.alive ? 1 : 0) | (p.team === "t" ? 2 : 0) | (p.onGround ? 4 : 0) | (p.ducking ? 8 : 0) |
    (p.hasBomb ? 16 : 0) | (p.helmet ? 32 : 0) | (p.defuseKit ? 64 : 0) | (p.scoped ? 128 : 0),
  );
  c.u8(clamp(Math.round(p.duckAmount * 255), 0, 255));
  c.u8(Math.max(0, WEAPON_IDS.indexOf(p.weapon)));
  c.u8(p.primary === null ? 255 : Math.max(0, WEAPON_IDS.indexOf(p.primary)));
  c.u8(Math.max(0, WEAPON_IDS.indexOf(p.secondary)));
  const ammo = p.ammo[p.weapon];
  c.u16(clamp(ammo?.mag ?? 0, 0, 65535));
  c.u16(clamp(ammo?.reserve ?? 0, 0, 65535));
  c.u16(clamp(Math.round(p.money), 0, 65535));
  // Blindness in thirty-seconds of a second: a flash is at most a few of them.
  c.u8(clamp(Math.round(p.blind * 32), 0, 255));
  c.u8((p.pocket.he & 3) | ((p.pocket.flash & 3) << 2) | ((p.pocket.smoke & 3) << 4));
  c.u8(clamp(p.kills, 0, 255));
  c.u8(clamp(p.deaths, 0, 255));
  c.u16(clamp(Math.round(p.damage), 0, 65535));
}
/** How many bytes one body is, which is what the size test holds. */
export const PLAYER_BYTES = 44;
/**
 * A snapshot into a world the member already has: the level, the rules and the
 * ten bodies were built from the room's own seed when they joined, so what
 * arrives is the numbers on them and never their shape. Nothing is allocated
 * per body — the arrays are written through.
 *
 * `seat` is the member's own body, and two things are *not* overwritten on it:
 * the view angles, which the browser owns and is sending upstream, and the
 * position, which `src/client/session.ts` reconciles against rather than
 * replaces. Everything else about it is the server's word, health included.
 *
 * Returns what arrived, or null for a frame that is not one: a wrong first
 * byte, a count past the cap, a frame that ends early. A refused snapshot
 * changes nothing at all, which is what makes a truncated read safe.
 */
export function applySnapshot(world: World, bytes: Uint8Array, seat: number): Snapshot | null {
  if (bytes.byteLength < 2) return null;
  const c = new Cursor(bytes);
  if (c.ru8() !== SNAPSHOT_FRAME) return null;
  if (!c.has(4 + 4 + 4 + 4 + 1 + 1 + 13 + 9 + 1)) return null;
  const tick = c.ru32();
  const time = finite(c.rf32());
  const phase = PHASES[c.ru8()];
  const round = c.ru8();
  const scoreT = c.ru8();
  const scoreCt = c.ru8();
  const timer = finite(c.rf32());
  const matchWinner = c.ru8();
  const bombState = BOMB_STATES[c.ru8()];
  const bombPos: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
  const plantProgress = finite(c.rf32());
  const defuseProgress = finite(c.rf32());
  const site = c.ru8();
  const count = c.ru8();
  if (phase === undefined || bombState === undefined) return null;
  if (count !== world.players.length || count > MAX_PLAYERS) return null;
  if (!c.has(count * PLAYER_BYTES)) return null;
  world.time = time;
  world.match.phase = phase;
  world.match.round = round;
  world.match.score.t = scoreT;
  world.match.score.ct = scoreCt;
  world.match.timer = timer;
  world.match.matchWinner = matchWinner === 1 ? "t" : matchWinner === 2 ? "ct" : null;
  const bomb: Bomb = world.bomb;
  bomb.state = bombState;
  bomb.pos = bombPos;
  bomb.plantProgress = plantProgress;
  bomb.defuseProgress = defuseProgress;
  bomb.site = site === 1 ? "A" : site === 2 ? "B" : null;
  world.bombPlanted = world.bombPlanted || bombState === "planted" || bombState === "defused";
  mine = null;
  for (let i = 0; i < count; i++) readPlayer(c, world.players[i] as Player, i === seat);
  const own = mine;
  if (!c.has(1)) return null;
  const grenades = c.ru8();
  if (grenades > MAX_GRENADES || !c.has(grenades * 16)) return null;
  world.grenades.length = 0;
  for (let i = 0; i < grenades; i++) {
    const pos: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
    const weapon = THROWN_IDS[c.ru8()] ?? "he";
    const owner = c.ru8();
    const team = c.ru8() === 1 ? "t" : "ct";
    const fuse = c.ru8() / 32;
    const grenade: Grenade = {
      pos, vel: [0, 0, 0], onGround: false, ducking: false, duckAmount: 0,
      weapon, owner, team, fuse,
    };
    world.grenades.push(grenade);
  }
  if (!c.has(1)) return null;
  const clouds = c.ru8();
  if (clouds > MAX_CLOUDS || !c.has(clouds * 14)) return null;
  world.clouds.length = 0;
  for (let i = 0; i < clouds; i++) {
    const pos: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
    const born = world.time - c.ru8() / 16;
    const owner = c.ru8();
    const cloud: Cloud = { pos, born, owner };
    world.clouds.push(cloud);
  }
  if (!c.has(1)) return null;
  const events = c.ru8();
  let read = 0;
  for (let i = 0; i < events; i++) {
    const effect = readEvent(c, seat);
    if (effect === null) break;
    pushEffect(world.effects, effect, effect.at);
    read += 1;
  }
  return { tick, time, events: read, own };
}
let mine: { pos: Vec3; vel: Vec3 } | null = null;
function readPlayer(c: Cursor, p: Player, own: boolean): void {
  const pos: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
  const vel: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
  const yaw = unpackSigned(c.ru16());
  const pitch = clamp(unpackSigned(c.ru16()), -89, 89);
  // Your own body's position and view are yours: the session reconciles the one
  // and the mouse owns the other, so the server's copy is handed back rather
  // than written in. Everybody else's is simply the truth.
  if (own) {
    mine = { pos, vel };
  } else {
    p.pos = pos;
    p.vel = vel;
    p.yaw = yaw;
    p.pitch = pitch;
  }
  p.health = c.ru8();
  p.armor = c.ru8();
  const flags = c.ru8();
  p.alive = (flags & 1) !== 0;
  p.team = (flags & 2) !== 0 ? "t" : "ct";
  p.onGround = (flags & 4) !== 0;
  p.ducking = (flags & 8) !== 0;
  p.hasBomb = (flags & 16) !== 0;
  p.helmet = (flags & 32) !== 0;
  p.defuseKit = (flags & 64) !== 0;
  p.scoped = (flags & 128) !== 0;
  p.duckAmount = c.ru8() / 255;
  const weapon = WEAPON_IDS[c.ru8()];
  const primaryAt = c.ru8();
  const secondary = WEAPON_IDS[c.ru8()];
  if (weapon !== undefined) p.weapon = weapon;
  p.primary = primaryAt === 255 ? null : (WEAPON_IDS[primaryAt] ?? null);
  if (secondary !== undefined) p.secondary = secondary;
  const mag = c.ru16();
  const reserve = c.ru16();
  // The HUD reads the magazine off `ammo[weapon]`, so the held weapon always
  // has one here even on a body that arrived holding something new.
  p.ammo[p.weapon] = { mag, reserve };
  if (p.primary !== null && p.ammo[p.primary] === undefined) p.ammo[p.primary] = emptyAmmo(p.primary);
  p.money = c.ru16();
  p.blind = c.ru8() / 32;
  const pocket = c.ru8();
  p.pocket = { he: pocket & 3, flash: (pocket >> 2) & 3, smoke: (pocket >> 4) & 3 };
  p.kills = c.ru8();
  p.deaths = c.ru8();
  p.damage = c.ru16();
}
function readEvent(c: Cursor, seat: number): Effect | null {
  if (!c.has(5)) return null;
  const kind = EFFECT_KINDS[c.ru8()];
  const at = finite(c.rf32());
  if (kind === undefined) return null;
  const need = kind === "tracer" ? 24 : kind === "impact" ? 15 : kind === "blood" ? 12 : kind === "blast" ? 13 : kind === "shot" ? 14 : 14;
  if (!c.has(need)) return null;
  if (kind === "tracer") {
    const from: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
    const to: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
    return { kind, at, from, to };
  }
  const pos: Vec3 = [finite(c.rf32()), finite(c.rf32()), finite(c.rf32())];
  if (kind === "impact") {
    const normal: Vec3 = [c.ri8() / 127, c.ri8() / 127, c.ri8() / 127];
    return { kind, at, pos, normal };
  }
  if (kind === "blood") return { kind, at, pos };
  if (kind === "shot") {
    const weapon = WEAPON_IDS[c.ru8()] ?? "knife";
    const by = c.ru8();
    return { kind, at, pos, weapon, mine: by === seat, by };
  }
  if (kind === "blast") {
    const weapon = THROWN_IDS[c.ru8()] ?? "he";
    return { kind, at, pos, weapon };
  }
  const name = SOUNDS[c.ru8()] ?? "step";
  const by = c.ru8();
  return { kind: "sound", at, pos, name, by: by === 255 ? -1 : by };
}
/**
 * What a member is told once, when they join: which body is theirs, what the
 * round is played on, and who else is here. It is JSON and not packed, because
 * it is sent once and read by a person in a log when something is wrong.
 *
 * The map and the seed are what the page carves its own copy of the level from,
 * so nothing about the geometry crosses the wire: the same two numbers that
 * make a match reproducible make a room's world reproducible.
 */
export type Hello = {
  k: "hello";
  code: string;
  seat: number;
  map: string;
  seed: number;
  rules: "short" | "long";
  tick: number;
  snapshotHz: number;
  roster: Seated[];
};
/** One body in the room, and whether a person or a bot is holding it. */
export type Seated = { seat: number; name: string; bot: boolean; team: "t" | "ct" };
/** The roster again, whenever somebody joins or leaves. */
export type Roster = { k: "roster"; roster: Seated[] };
/**
 * The words of the round: the kill feed and the lines in the middle of the
 * screen. Both are written inside the world's own tick — a room's client never
 * runs one — so they come down as themselves rather than being re-derived from
 * numbers that could not say them.
 */
export type Log = {
  k: "log";
  feed: { at: number; killer: string; victim: string; weapon: string; headshot: boolean; killerTeam: "t" | "ct" }[];
  say: { at: number; text: string }[];
};
export type Down = Hello | Roster | Log;
/**
 * A control message off the wire, validated field by field, or null. It comes
 * from this app's own server, and it is checked anyway: a page that trusts
 * whatever JSON a socket hands it is a page one proxy away from a surprise, and
 * every other input in this repository is checked at the boundary.
 */
export function readDown(text: string): Down | null {
  let value: unknown;
  try {
    value = JSON.parse(text);
  } catch {
    return null;
  }
  if (typeof value !== "object" || value === null) return null;
  const v = value as Record<string, unknown>;
  if (v.k === "hello") {
    const roster = readRoster(v.roster);
    if (
      typeof v.code !== "string" || typeof v.seat !== "number" || typeof v.map !== "string" ||
      typeof v.seed !== "number" || !Number.isFinite(v.seed) ||
      (v.rules !== "short" && v.rules !== "long") || typeof v.tick !== "number" ||
      typeof v.snapshotHz !== "number" || roster === null
    ) return null;
    return {
      k: "hello", code: v.code, seat: Math.trunc(v.seat), map: v.map, seed: v.seed,
      rules: v.rules, tick: Math.trunc(v.tick), snapshotHz: v.snapshotHz, roster,
    };
  }
  if (v.k === "roster") {
    const roster = readRoster(v.roster);
    return roster === null ? null : { k: "roster", roster };
  }
  if (v.k === "log") {
    if (!Array.isArray(v.feed) || !Array.isArray(v.say)) return null;
    const feed: Log["feed"] = [];
    for (const entry of v.feed as Record<string, unknown>[]) {
      if (
        typeof entry?.at !== "number" || typeof entry.killer !== "string" || typeof entry.victim !== "string" ||
        typeof entry.weapon !== "string" || typeof entry.headshot !== "boolean" ||
        (entry.killerTeam !== "t" && entry.killerTeam !== "ct")
      ) return null;
      feed.push({
        at: entry.at, killer: entry.killer.slice(0, 32), victim: entry.victim.slice(0, 32),
        weapon: entry.weapon.slice(0, 16), headshot: entry.headshot, killerTeam: entry.killerTeam,
      });
    }
    const say: Log["say"] = [];
    for (const line of v.say as Record<string, unknown>[]) {
      if (typeof line?.at !== "number" || typeof line.text !== "string") return null;
      say.push({ at: line.at, text: line.text.slice(0, 160) });
    }
    return { k: "log", feed, say };
  }
  return null;
}
function readRoster(value: unknown): Seated[] | null {
  if (!Array.isArray(value) || value.length > MAX_PLAYERS) return null;
  const out: Seated[] = [];
  for (const entry of value as Record<string, unknown>[]) {
    if (
      typeof entry?.seat !== "number" || typeof entry.name !== "string" || typeof entry.bot !== "boolean" ||
      (entry.team !== "t" && entry.team !== "ct")
    ) return null;
    out.push({ seat: Math.trunc(entry.seat), name: entry.name.slice(0, 24), bot: entry.bot, team: entry.team });
  }
  return out;
}
/**
 * The round's effects, dropped: what a member's world gets on the frame they
 * join, so the first snapshot does not arrive on top of two seconds of a
 * freeze-time round nobody watched. Effects are remembered for `EFFECT_LIFE`
 * seconds, which is why this is worth doing rather than waiting it out.
 */
export const forget = (world: World): void => {
  resetEffects(world.effects);
  world.grenades.length = 0;
  world.clouds.length = 0;
};
@@ -60,6 +60,7 @@
import { createLimiter } from "./limit.ts";
import { examplePage } from "./pages/example.ts";
import { type Asked, gamePage, STYLE as GAME_STYLE, statsHtml } from "./pages/game.ts";
import { mapFrom } from "./mapname.ts";
import { seedFrom } from "./client/generate.ts";
import { localPlan } from "./plan/plan.ts";
import { parseSituation } from "./plan/situation.ts";
import { createPlanner, type Planner } from "./plan/typesafe.ts";
@@ -68,6 +69,9 @@
import { errorPage, notFoundPage, STYLE as MISS_STYLE } from "./pages/miss.ts";
import { boardsHtml, rangePage } from "./pages/range.ts";
import { STYLE as WEAPONS_STYLE, weaponsPage, WEAPONS_HREF } from "./pages/weapons.ts";
import { policyFor } from "./policy.ts";
import { roomCodeFrom } from "./rooms/code.ts";
import { createHub, CLOSE_GONE, MESSAGE_MAX, ROOM_CAP } from "./rooms/hub.ts";
import { playedOn } from "./mapname.ts";
import { styleFor, type Linked } from "./pages/shell.ts";
import { cleanName, parseResult } from "./result.ts";
import { parseRun } from "./run.ts";
@@ -277,6 +281,52 @@
const planLimit = createLimiter(PLAN_LIMIT);
export const PLAN_SPEND = { burst: 30, per: 2000 };
const planSpend = createLimiter(PLAN_SPEND);
/**
 * How often one caller may open a room. A room is a world stepped 64 times a
 * second for as long as somebody is in it, so opening one is the most expensive
 * thing a visitor can ask this process for: three back to back and one more
 * every twenty seconds is a person making a room for their friends, and a wall
 * to a script filling `ROOM_CAP` in a second. Past it the answer is a sentence
 * and a 429, never a room.
 */
export const ROOM_LIMIT = { burst: 3, per: 20_000 };
const roomLimit = createLimiter(ROOM_LIMIT);
/**
 * Every room this process is holding (`src/rooms/hub.ts`), and the sockets they
 * are seen through. The hub knows nothing about a socket: it is handed two
 * functions — deliver these bytes to that member, close that member — and this
 * is the only file that knows what a WebSocket is.
 *
 * A member id is one connection and not one browser: two tabs of the same
 * session are two members, and a reload is a new one whose predecessor is taken
 * out of the room by its own close. So a seat is never held by a tab that is
 * gone, and a session cookie is not a claim on a seat.
 */
const sockets = new Map<string, Bun.ServerWebSocket<Joined>>();
const hub = createHub({
  deliver(id, frame) {
    sockets.get(id)?.send(frame);
  },
  close(id, code, reason) {
    sockets.get(id)?.close(code, reason);
  },
}, { now: Date.now() });
/** What one connection is: which member, in which room, under what name. */
type Joined = { id: string; code: string; name: string };
/**
 * The clock every room steps on. One interval for the whole process rather than
 * one per room: `hub.advance` takes the wall clock, steps each room by the ticks
 * that have fallen due and sends the snapshots that are due with them, so ten
 * rooms are one timer and not ten. Ten milliseconds is below the 15.6 ms a tick
 * takes, so no tick waits for the next wake-up, and the whole call is nothing at
 * all when no room is open.
 */
const roomClock = setInterval(() => hub.advance(Date.now()), 10);
roomClock.unref();
/**
 * Who a result is recorded as. A verified forge identity plays under its own
 * name and the browser's claim is ignored; everyone else is a guest, whose
@@ -691,13 +741,53 @@
const isRead = (request: Request): boolean => request.method === "GET" || reques
const listen = bind(process.env);
export const server = Bun.serve({
/**
 * The one answer that is not an answer: an upgraded request has already been
 * taken over by the socket, and `send` must not write a body to it.
 */
const UPGRADED = new Response(null, { status: 101 });
/** Where a room's socket answers. One path, in one place, for both ends. */
export const SOCKET_PATH = "/ws";
export const server = Bun.serve<Joined, never>({
  port: listen.port,
  hostname: listen.hostname,
  async fetch(request, listener) {
    return send(request, await route(request, listener));
    const made = await route(request, listener);
    // A 101 is the socket's, already written: nothing more goes on that wire.
    if (made === UPGRADED) return undefined as unknown as Response;
    return send(request, made);
  },
  error: onError,
  websocket: {
    // The frame cap is the socket's own as well as the hub's: a frame past it
    // is refused by Bun before this process ever holds the bytes.
    maxPayloadLength: MESSAGE_MAX,
    // Bun closes a connection it has heard nothing on for this long, in
    // seconds. The page sends an input frame every tick, so ten seconds of
    // silence is already a connection that is gone; the hub's own sweep is the
    // one that frees the seat.
    idleTimeout: 30,
    open(ws) {
      sockets.set(ws.data.id, ws);
      const joined = hub.enter(ws.data.code, ws.data.id, ws.data.name, Date.now());
      if (joined === null) {
        ws.close(CLOSE_GONE, "that room is full");
        sockets.delete(ws.data.id);
      }
    },
    message(ws, message) {
      // Only binary frames are input. A text frame is not part of this protocol
      // in that direction at all, so it is dropped rather than parsed.
      if (typeof message === "string") return;
      hub.frame(ws.data.id, new Uint8Array(message.buffer, message.byteOffset, message.byteLength), Date.now());
    },
    close(ws) {
      sockets.delete(ws.data.id);
      hub.exit(ws.data.id, Date.now());
    },
  },
});
/**
@@ -705,7 +795,7 @@
export const server = Bun.serve({
 * body that was weighed at start-up. Nothing here sets `content-encoding` or
 * drops a HEAD's body — `send` above does both, for all of it, in one place.
 */
async function route(request: Request, listener: Bun.Server<undefined>): Promise<Response | Ready> {
async function route(request: Request, listener: Bun.Server<Joined>): Promise<Response | Ready> {
  const url = new URL(request.url);
  if (request.method === "POST" && !sameOrigin(request))
    return text("forbidden", 403);
@@ -765,6 +855,70 @@
async function route(request: Request, listener: Bun.Server<undefined>): Promise
    return json(mine ? await (planner as Planner).plan(situation) : localPlan(situation));
  }
  /**
   * A room to play in with other people. It is a POST because it makes one: a
   * world this process will step 64 times a second until it empties, which is
   * the most expensive thing on this server a visitor can ask for. So it is
   * same-origin (refused above), rate-limited per caller, capped in number by
   * the hub, and it answers with a code and nothing else.
   *
   * The map and the length are the two things a room is opened with, and both
   * are settled here through the doors the game's own query goes through: an
   * unknown map is de_forge and an unknown length is the short match.
   */
  if (request.method === "POST" && url.pathname === "/api/room") {
    const body = await readBody(request, PLAN_BODY_MAX);
    if (body === undefined) return text("too large", 413);
    let parsed: unknown;
    try {
      parsed = JSON.parse(new TextDecoder().decode(body));
    } catch {
      return text("bad json", 400);
    }
    const asked = (typeof parsed === "object" && parsed !== null ? parsed : {}) as Record<string, unknown>;
    const held = readSession(request);
    const caller = `room:${listener.requestIP(request)?.address ?? "?"}|${held ?? "-"}`;
    if (!roomLimit.take(caller))
      return text("slow down", 429, { "retry-after": String(Math.ceil(ROOM_LIMIT.per / 1000)) });
    const map = playedOn(asked.map) ?? "de_forge";
    const length = asked.length === "long" ? "long" : "short";
    const room = hub.open({ map, seed: seedFrom(crypto.randomUUID()), length, now: Date.now() });
    if (room === null) return text(`every room is taken — this deployment holds ${ROOM_CAP}`, 503);
    const session = held ?? newSession();
    return new Response(JSON.stringify({ code: room.code, map: room.map, length }), {
      headers: {
        "content-type": "application/json; charset=utf-8", "cache-control": "no-store",
        ...SECURITY, "set-cookie": sessionCookie(session),
      },
    });
  }
  /**
   * And the socket into one. It is refused rather than dropped: a browser that
   * cannot upgrade gets a status and a sentence, so the page can say which of
   * the four things went wrong. A plain GET of this path — no upgrade header —
   * falls through to the 404 every other wrong path gets.
   *
   * What it takes: same-origin, a room that exists, and a session. The name is
   * whatever the page sent, cleaned and made unique inside the room.
   */
  if (isRead(request) && url.pathname === SOCKET_PATH) {
    if (!sameOrigin(request)) return text("forbidden", 403);
    const code = roomCodeFrom(url.searchParams.get("room"));
    if (code === null) return text("not a room code", 400);
    if (hub.find(code) === undefined) return text("no room with that code — it may have been idle too long", 404);
    const session = readSession(request) ?? newSession();
    const id = `${session}.${crypto.randomUUID().slice(0, 8)}`;
    const name = (url.searchParams.get("name") ?? "").slice(0, 24);
    const upgraded = listener.upgrade(request, {
      data: { id, code, name },
      headers: { ...SECURITY, "set-cookie": sessionCookie(session) },
    });
    // A plain GET of this path — a person following a link, a crawler — is not
    // an error, it is a path with no page: the app's own 404, like any other.
    return upgraded ? UPGRADED : MISS;
  }
  // The games, one table rather than one branch each. HEAD is GET without a
  // body, so a health check on `/` sees the app up.
  if (isRead(request)) {
@@ -793,7 +947,7 @@
if (listen.unusable !== undefined)
console.log(
  `cs listening on http://${server.hostname}:${server.port} (${env}) serving ${[...scripts.values()].join(", ")}` +
    ` — ${buildSummary(built, builtIn, BUNDLES)} — ${staticSummary()}` +
    ` — ${buildSummary(built, builtIn, BUNDLES)} — ${staticSummary()} — up to ${ROOM_CAP} rooms on ${SOCKET_PATH}` +
    `${identityKey ? "" : " — no FORGE_APP_IDENTITY_KEY: every visitor plays as a guest"}` +
    `${planner ? "" : " — no TYPESAFE_API_KEY: the bots plan their rounds locally"}`,
);
		@@ -1503,3 +1503,26 @@ network here is the forge and the package registry), so the influence is from
1503	1503	what PufferLib is known for rather than from its documentation: flat observation
1504	1504	and action spaces, environment throughput treated as the thing that decides
1505	1505	whether a run is possible, and plain PPO rather than a clever algorithm.
	1506
	1507	## Playing with friends: rooms
	1508
	1509	The match at `/` runs in your own browser against bots. A room is the other
	1510	thing: make one from the menu, read the six-character code out to your friends,
	1511	and they type it in. A room's round is stepped on this server at the game's
	1512	own 64 Hz — `src/rooms/room.ts` runs the shooter's own `createWorld` and
	1513	`updateWith` — and every member is sent the same 544-byte packed snapshot sixteen
	1514	times a second (`src/rooms/wire.ts`), so nobody in a room can disagree about what
	1515	happened. Joining takes a bot's seat, so a round is always five against five, and
	1516	leaving hands the body straight back to the bot with the money and guns it had.
	1517
	1518	What is real and what is not, today:
	1519
	1520	- Real: shared rounds, shots, damage, deaths, the bomb, the kill feed, the
	1521	economy (the buy goes up with the input frame and is spent on the server), and
	1522	the caps — twenty rooms a process, ten people a room, an empty room forgotten
	1523	after ninety seconds (`src/rooms/hub.ts`).
	1524	- Not yet: your own movement is not predicted, so it answers on the round
	1525	trip rather than instantly; a room has no hit marker or damage arrow (both are
	1526	effects recorded for one screen and a snapshot goes to everybody); and a room's
	1527	result is not posted to the leaderboard. Rooms live in this process only — a
	1528	deploy ends them.
		@@ -49,7 +49,7 @@ function fixture(): { dir: string; entries: Entry[]; source: (n: string, t: stri
49	49
50	50	test("the entry table is what the app ships today, each with the size it may not pass", () => {
51	51	expect(ENTRIES).toEqual([
52		{ name: "app", entry: "src/client/main.ts", ceiling: { raw: 110_000, gzip: 43_500 } },
	52	{ name: "app", entry: "src/client/main.ts", ceiling: { raw: 122_000, gzip: 47_500 } },
53	53	{ name: "range", entry: "src/range/main.ts", ceiling: { raw: 37_000, gzip: 15_500 } },
54	54	{ name: "example", entry: "src/example/main.ts", ceiling: { raw: 23_500, gzip: 10_200 } },
55	55	]);
		@@ -100,6 +100,10 @@ import { drawBuy, HINT, labelOf, offers } from "./buy.ts";
100	100	import { buy, canBuy, priceOf, type BuyItem } from "./economy.ts";
101	101	import { atRound, createLoadout, noteBuy, rebuy, saidRebuy } from "./loadout.ts";
102	102	import { createWorld, eyePos, say as showMessage, update, type Player, type World } from "./world.ts";
	103	import { createSession, type Session, type Socket } from "./session.ts";
	104	import { roomCodeFrom } from "../rooms/code.ts";
	105	import { SWITCH_KNIFE, SWITCH_NONE, SWITCH_PRIMARY, SWITCH_SECONDARY } from "../rooms/wire.ts";
	106	import type { BuyItem as Item } from "./economy.ts";
103	107	import { unpack } from "../engine/index.ts";
104	108
105	109	const TICK = 1 / 64;
		@@ -142,6 +146,12 @@ export const NO_POLICY =
142	146	"if it keeps happening, this deployment is missing the weights the page asked for.";
143	147
144	148	/** What the copy control says once the URL is on the clipboard, and if it is not. */
	149	/** What the menu says when this browser cannot open a socket at all. */
	150	export const NO_SOCKET = "This browser has no WebSocket, so it cannot join a room. The match above still plays.";
	151	/** And what it says when a room could not be made or joined. */
	152	export const NO_ROOM = "That room could not be joined — check the code, or make a new room.";
	153	export const NO_MAKE = "A room could not be made right now. Try again in a moment.";
	154
145	155	export const COPIED = "Copied";
146	156	export const NOT_COPIED = "Copy failed — the link still works";
147	157
		@@ -285,6 +295,12 @@ export type Host = {
285	295	* into a message. `location.origin`; no path, no query, nothing of the id.
286	296	*/
287	297	origin: string;
	298	/**
	299	* A socket to a room, when this browser has WebSocket: `(url) => new WebSocket(url)`.
	300	* Absent is a browser that cannot play with other people, and the two room
	301	* controls in the menu stay disabled and say so.
	302	*/
	303	connect?(url: string): Socket;
288	304	/**
289	305	* `navigator.clipboard.writeText`, when this browser has one and the page is
290	306	* allowed it. Absent is a browser where the copy control is only a link, and
		@@ -372,6 +388,10 @@ export function boot(host: Host): Frame {
372	388	const copyLabel = copyMap.textContent;
373	389	const prep = by("prep");
374	390	const play = by<Panel & { disabled: boolean }>("play");
	391	const roomField = by<Field>("room");
	392	const joinRoom = by<Panel & { disabled: boolean }>("joinroom");
	393	const makeRoom = by<Panel & { disabled: boolean }>("makeroom");
	394	const roomSaid = by("roomsaid");
375	395	// Where this game's weights are: the shell put the link in the head with the
376	396	// content-hashed URL on it, so this is the only place the path is known.
377	397	const weightsLink = doc.getElementById("weights") as Link \| null;
		@@ -514,6 +534,14 @@ export function boot(host: Host): Frame {
514	534	// meshes were built from, and a match on another map swaps that one mesh.
515	535	let shown: Level = DE_FORGE;
516	536	let running = false;
	537	/**
	538	* The room this page is in, or null for the match that runs in this browser.
	539	* When it is set the world is the session's — filled from the server's
	540	* snapshots — and the frame below sends keys upstream instead of stepping.
	541	*/
	542	let session: Session \| null = null;
	543	/** One item asked for, sent on the next frame and then forgotten. */
	544	let roomBuy: Item \| null = null;
517	545	let lastSound = 0;
518	546	let frameAverage = 16.7;
519	547	let posted = -1;
		@@ -567,6 +595,12 @@ export function boot(host: Host): Frame {
567	595	}
568	596	show(prep, false);
569	597	play.disabled = false;
	598	// A browser with no WebSocket can still play the match in its own page; the
	599	// two controls that need one say so rather than failing when pressed.
	600	const canJoin = host.connect !== undefined;
	601	joinRoom.disabled = !canJoin;
	602	makeRoom.disabled = !canJoin;
	603	if (!canJoin) roomSaid.textContent = NO_SOCKET;
570	604	}
571	605
572	606	// --- the buy menu, rebuilt whenever it opens so the prices are honest
		@@ -606,6 +640,13 @@ export function boot(host: Host): Frame {
606	640	function pressBuy(item: BuyItem): void {
607	641	if (world === null) return;
608	642	const me = world.me;
	643	// In a room the shelf is the server's: the ask goes up with the next input
	644	// frame and the money is spent there, so nothing is spent here twice.
	645	if (session !== null) {
	646	roomBuy = item;
	647	sayBuy(`Asked for ${labelOf(item, me.team)}.`);
	648	return;
	649	}
609	650	if (buy(world, me, item)) {
610	651	noteBuy(loadout, item);
611	652	audio.beep(700, 0.05);
		@@ -1027,6 +1068,96 @@ export function boot(host: Host): Frame {
1027	1068	host.storage.setItem("cs.name", name);
1028	1069	}
1029	1070
	1071	/**
	1072	* Into a room: the same match, with the round decided on the server. What
	1073	* `start` above does with a world it makes, this does with a world the first
	1074	* snapshot describes — so the level, the rules and the ten bodies come from
	1075	* the room and not from the menu, and everything else about the screen is the
	1076	* same frame as ever.
	1077	*/
	1078	function startRoom(code: string): void {
	1079	if (renderer === null \|\| !policyIn \|\| host.connect === undefined) return;
	1080	const name = nameField.value.trim().slice(0, 24) \|\| "you";
	1081	host.storage.setItem("cs.name", name);
	1082	session?.close();
	1083	world = null;
	1084	session = createSession({
	1085	connect: host.connect,
	1086	url: `/ws?room=${encodeURIComponent(code)}&name=${encodeURIComponent(name)}`,
	1087	code,
	1088	now: () => win.performance.now(),
	1089	build: (hello) => {
	1090	const level = hello.map === "de_forge" ? DE_FORGE : generateLevel(seedOf(hello.map) ?? 0);
	1091	if (level !== shown && renderer !== null) {
	1092	renderer.replace("level", meshFor("level", level));
	1093	shown = level;
	1094	}
	1095	playingId.textContent = `room ${code}`;
	1096	mapName.textContent = level.name;
	1097	pauseId.textContent = `Room ${code} on ${level.name}.`;
	1098	return createWorld(level, hello.rules === "long" ? COMPETITIVE : SHORT, name, "ct", 5, hello.seed);
	1099	},
	1100	});
	1101	loadout = createLoadout();
	1102	roomBuy = null;
	1103	posted = -1;
	1104	postedFinal = true; // a room's result is the server's to write, never this page's
	1105	loop.reset();
	1106	controls.sensitivity = clamp(Number(sensField.value) \|\| 2.2, 0.2, 12);
	1107	running = true;
	1108	lastSound = 0;
	1109	show(menu, false);
	1110	show(pause, false);
	1111	show(summaryPanel, false);
	1112	show(touchPanel, win.matchMedia("(pointer: coarse)").matches);
	1113	audio.resume();
	1114	void sceneCanvas.requestPointerLock();
	1115	}
	1116
	1117	joinRoom.addEventListener("click", () => {
	1118	const code = roomCodeFrom(roomField.value);
	1119	if (code === null) {
	1120	roomSaid.textContent = NO_ROOM;
	1121	return;
	1122	}
	1123	roomField.value = code;
	1124	startRoom(code);
	1125	});
	1126
	1127	/**
	1128	* A room of one's own: the server makes it — a world it will step until the
	1129	* room empties — and hands back the code a person reads out. The map and the
	1130	* length are the menu's own two choices; everything else about the room is the
	1131	* server's.
	1132	*/
	1133	makeRoom.addEventListener("click", () => {
	1134	const chosen = chosenMap();
	1135	void host.fetch("/api/room", {
	1136	method: "POST",
	1137	headers: { "content-type": "application/json" },
	1138	body: JSON.stringify({ map: chosen === "generated" ? "de_forge" : chosen, length: lengthField.value }),
	1139	}).then(
	1140	(reply) => void reply.text().then(
	1141	(body) => {
	1142	let code: string \| null = null;
	1143	try {
	1144	code = roomCodeFrom((JSON.parse(body) as { code?: unknown }).code);
	1145	} catch {
	1146	code = null;
	1147	}
	1148	if (!reply.ok \|\| code === null) {
	1149	roomSaid.textContent = NO_MAKE;
	1150	return;
	1151	}
	1152	roomField.value = code;
	1153	startRoom(code);
	1154	},
	1155	() => void (roomSaid.textContent = NO_MAKE),
	1156	),
	1157	() => void (roomSaid.textContent = NO_MAKE),
	1158	);
	1159	});
	1160
1030	1161	play.addEventListener("click", start);
1031	1162	// Resume is the gesture that puts back whatever the pause cost: the screen
1032	1163	// first, if a browser took it, and then the pointer.
		@@ -1043,6 +1174,8 @@ export function boot(host: Host): Frame {
1043	1174	*/
1044	1175	function toMenu(): void {
1045	1176	running = false;
	1177	session?.close();
	1178	session = null;
1046	1179	world = null;
1047	1180	wantsFull = false;
1048	1181	full.exit();
		@@ -1208,11 +1341,18 @@ export function boot(host: Host): Frame {
1208	1341	planAt = null;
1209	1342	drawMapPlan();
1210	1343	}
	1344	// In a room the world is the session's, and there is nothing to draw until
	1345	// the first snapshot has described it.
	1346	if (session !== null) {
	1347	world = session.world();
	1348	const said = session.standing(now);
	1349	roomSaid.textContent = `Room ${said.code} — ${said.line}. ${said.people} here.`;
	1350	}
1211	1351	if (world === null \|\| !running) return;
1212	1352
1213	1353	// A round nobody has planned yet — the first of a match, or the one that
1214	1354	// just started — is planned here, on the frame that noticed it.
1215		if (world.match.round !== plannedRound) planFor(world);
	1355	if (session === null && world.match.round !== plannedRound) planFor(world);
1216	1356	// And the same frame rolls the wallet's memory over: what was bought in the
1217	1357	// round that just ended is what X buys back in this one.
1218	1358	atRound(loadout, world.match.round);
		@@ -1237,12 +1377,28 @@ export function boot(host: Host): Frame {
1237	1377	slotWanted === 1 ? me.primary : null;
1238	1378
1239	1379	const steps = loop.advance(elapsed);
	1380	const switchCode =
	1381	slotWanted === 3 ? SWITCH_KNIFE :
	1382	slotWanted === 2 ? SWITCH_SECONDARY :
	1383	slotWanted === 1 ? SWITCH_PRIMARY : SWITCH_NONE;
1240	1384	// Buying keeps the pointer, so the keys have to be kept off the player: with
1241	1385	// the panel open the trigger is dead and the number row buys instead of
1242	1386	// switching weapons. Movement is not suppressed, and never was — walking out
1243	1387	// of spawn while you buy is the point.
1244		for (let step = 0; step < steps; step++)
1245		update(world, TICK, buyPanel.hidden ? input : { ...input, fire: false, switchTo: null });
	1388	if (session !== null) {
	1389	// A room's round is stepped on the server: what goes up is one frame of
	1390	// keys for the tick the loop just counted — coalesced into one message
	1391	// however many ticks this frame was worth, because a tick the page never
	1392	// simulated has no separate keys to send. The buy is asked for once.
	1393	const held = buyPanel.hidden ? input : { ...input, fire: false, switchTo: null };
	1394	if (steps > 0) {
	1395	session.press({ input: held, yaw: me.yaw, pitch: me.pitch, switchCode, buy: roomBuy });
	1396	roomBuy = null;
	1397	}
	1398	} else {
	1399	for (let step = 0; step < steps; step++)
	1400	update(world, TICK, buyPanel.hidden ? input : { ...input, fire: false, switchTo: null });
	1401	}
1246	1402
1247	1403	// The camera, and with it whose eyes this frame is drawn and heard from.
1248	1404	// It is moved after the steps and before anything reads it, and it is the
		@@ -0,0 +1,178 @@
	1	/**
	2	* The page's end of a room: one socket, one world it writes into, and the two
	3	* sentences it can say about the connection.
	4	*
	5	* A member of a room does not simulate. The round is stepped on the server
	6	* (`src/rooms/room.ts`) and this fills a local world from the snapshots that
	7	* arrive, so everything already built on a `World` — the scene, the HUD, the
	8	* minimap, the sounds, the spectator camera — draws a room without knowing it
	9	* is one. Two things are the browser's own even so: the view angles, which the
	10	* frame writes on `world.me` and sends upstream, so aim answers the hand rather
	11	* than the network; and nothing else. Your body's position is the server's
	12	* word, arriving 16 times a second — which is honest and is also the lag a
	13	* player feels in a room today. Predicting your own movement is #305's
	14	* remaining half and is deliberately not faked here.
	15	*
	16	* Nothing in here is a browser either: `connect` is handed in, so `session.test.ts`
	17	* plays a whole room through a socket of plain objects.
	18	*/
	19
	20	import type { Hello, Pressed } from "../rooms/wire.ts";
	21	import { applySnapshot, forget, readDown, writeInput, SNAPSHOT_FRAME } from "../rooms/wire.ts";
	22	import type { Player, World } from "./world.ts";
	23
	24	/** All this file asks a WebSocket to be. A browser's is one of these. */
	25	export type Socket = {
	26	binaryType: string;
	27	send(data: Uint8Array): void;
	28	close(): void;
	29	onopen: (() => void) \| null;
	30	onmessage: ((event: { data: unknown }) => void) \| null;
	31	onclose: (() => void) \| null;
	32	onerror: (() => void) \| null;
	33	};
	34
	35	/** What the page shows about a room while it is up. */
	36	export type Standing = {
	37	/** The room's code, which is what a person reads out to their friends. */
	38	code: string;
	39	/** Whether the socket is open right now. */
	40	live: boolean;
	41	/** Milliseconds since the last snapshot landed, or −1 before the first one. */
	42	behind: number;
	43	/** One sentence: what the connection is doing. */
	44	line: string;
	45	/** How many people are in the room, bots not counted. */
	46	people: number;
	47	};
	48
	49	export type Session = {
	50	/** The world the snapshots are filling, or null until the first `hello`. */
	51	world(): World \| null;
	52	/** Which body is ours, or −1 before `hello`. */
	53	seat(): number;
	54	standing(now: number): Standing;
	55	/** One tick of keys upstream. Dropped silently while the socket is not open. */
	56	press(pressed: Omit<Pressed, "tick">): void;
	57	close(): void;
	58	};
	59
	60	/** The sentences a room says about itself. Exported because the tests read them. */
	61	export const CONNECTING = "Joining the room…";
	62	export const PLAYING = "In the room";
	63	export const BEHIND = "The connection is behind — the round is still the server's";
	64	export const DROPPED = "The room closed the connection. Leave the match and join again.";
	65
	66	/** How far behind the last snapshot has to be before the page says so, in ms. */
	67	export const BEHIND_MS = 500;
	68
	69	export function createSession(options: {
	70	connect(url: string): Socket;
	71	/** Where to connect: the socket's path with the room and the name on it. */
	72	url: string;
	73	code: string;
	74	/**
	75	* The world a `hello` describes, built by the caller — which is the one place
	76	* that knows how to carve a level and make a world of this game. Handed the
	77	* message rather than the pieces, so a field added to `hello` needs no change
	78	* here.
	79	*/
	80	build(hello: Hello): World;
	81	now(): number;
	82	}): Session {
	83	const socket = options.connect(options.url);
	84	socket.binaryType = "arraybuffer";
	85	let world: World \| null = null;
	86	let seat = -1;
	87	let live = false;
	88	let closed = false;
	89	let landed = -1;
	90	let people = 0;
	91	/** What the next input frame is stamped with: our own count of ticks sent. */
	92	let sent = 0;
	93	const frame = new Uint8Array(16);
	94
	95	socket.onopen = (): void => void (live = true);
	96	socket.onclose = (): void => {
	97	live = false;
	98	closed = true;
	99	};
	100	socket.onerror = (): void => void (live = false);
	101	socket.onmessage = (event): void => {
	102	const data = event.data;
	103	if (typeof data === "string") {
	104	const down = readDown(data);
	105	if (down === null) return;
	106	if (down.k === "hello") {
	107	seat = down.seat;
	108	const built = options.build(down);
	109	// A body nobody else is holding is a bot to everything that reads the
	110	// world; ours is not, and it is the one the camera and the HUD follow.
	111	built.me = (built.players[seat] ?? built.me) as Player;
	112	built.me.bot = false;
	113	forget(built);
	114	world = built;
	115	apply(down.roster);
	116	} else if (down.k === "roster") {
	117	apply(down.roster);
	118	} else if (world !== null) {
	119	// The words of the round, which are written inside the server's own tick.
	120	for (const entry of down.feed) world.feed.push({ ...entry, weapon: entry.weapon as never });
	121	for (const line of down.say) world.messages.push(line);
	122	if (world.feed.length > 8) world.feed.splice(0, world.feed.length - 8);
	123	if (world.messages.length > 8) world.messages.splice(0, world.messages.length - 8);
	124	}
	125	return;
	126	}
	127	if (world === null \|\| seat < 0) return;
	128	const bytes = data instanceof ArrayBuffer ? new Uint8Array(data) : data instanceof Uint8Array ? data : null;
	129	if (bytes === null \|\| bytes[0] !== SNAPSHOT_FRAME) return;
	130	const got = applySnapshot(world, bytes, seat);
	131	if (got === null) return;
	132	landed = options.now();
	133	// Our own body: the server's position, handed over rather than written in
	134	// (`wire.ts`), so this is the one place a page decides what to do with it.
	135	if (got.own !== null) {
	136	world.me.pos = got.own.pos;
	137	world.me.vel = got.own.vel;
	138	}
	139	};
	140
	141	/** Names and bots off the roster, onto the bodies they belong to. */
	142	function apply(roster: Hello["roster"]): void {
	143	if (world === null) return;
	144	people = 0;
	145	for (const seated of roster) {
	146	const body = world.players[seated.seat];
	147	if (body === undefined) continue;
	148	body.name = seated.name;
	149	body.bot = seated.bot;
	150	if (!seated.bot) people += 1;
	151	}
	152	// Ours is ours whatever the roster says about the body: the camera follows it.
	153	if (world.players[seat] !== undefined) world.me = world.players[seat] as Player;
	154	}
	155
	156	return {
	157	world: () => world,
	158	seat: () => seat,
	159	standing(now) {
	160	const behind = landed < 0 ? -1 : now - landed;
	161	const line =
	162	closed ? DROPPED :
	163	!live \|\| landed < 0 ? CONNECTING :
	164	behind > BEHIND_MS ? BEHIND : PLAYING;
	165	return { code: options.code, live, behind, line, people };
	166	},
	167	press(pressed) {
	168	if (!live) return;
	169	sent += 1;
	170	socket.send(writeInput({ ...pressed, tick: sent }, frame));
	171	},
	172	close() {
	173	closed = true;
	174	live = false;
	175	socket.close();
	176	},
	177	};
	178	}
		@@ -207,7 +207,7 @@ export type FakeStage = {
207	207	* contract between the page and this file, so `src/server.test.ts` checks the
208	208	* served page against this same list rather than a second copy of it.
209	209	*/
210		export const PAGE_IDS = ["weights", "stage", "scene", "hud", "menu", "pause", "summary", "buy", "buyshelf", "buysays", "touch", "stats", "saved", "name", "length", "side", "sens", "map", "mapseed", "matchid", "onid", "onmap", "today", "ontoday", "willplay", "plan", "planalt", "copymap", "play", "prep", "resume", "quit", "esc", "pauseid", "sumtitle", "sumscore", "sumyou", "sumboard", "sumsaved", "again", "leave", "playing", "mapname", "share", "fps", "full"];
	210	export const PAGE_IDS = ["weights", "stage", "scene", "hud", "menu", "pause", "summary", "buy", "buyshelf", "buysays", "touch", "stats", "saved", "name", "length", "side", "sens", "map", "mapseed", "matchid", "onid", "onmap", "today", "ontoday", "willplay", "plan", "planalt", "copymap", "play", "room", "joinroom", "makeroom", "roomsaid", "prep", "resume", "quit", "esc", "pauseid", "sumtitle", "sumscore", "sumyou", "sumboard", "sumsaved", "again", "leave", "playing", "mapname", "share", "fps", "full"];
211	211
212	212	/** The ones the server renders with `hidden` on them: the page starts at the menu. */
213	213	const HIDDEN = ["pause", "summary", "buy", "touch", "full"];
		@@ -8,14 +8,14 @@ import { WEAPONS } from "./weapons.ts";
8	8	import { buy } from "./economy.ts";
9	9	import {
10	10	aimAt, applyInput, bodyCentre, canSee, createWorld, currentWeapon, deployTicks, EFFECT_CAPACITY,
11		eyePos, insideSmoke, NO_INPUT, shoot, startRound, throwOne, update,
	11	eyePos, insideSmoke, NO_INPUT, shoot, startRound, throwOne, update, updateWith,
12	12	type Input, type Player, type Sound, type World,
13	13	} from "./world.ts";
14	14	import { cloudRadius, type Cloud } from "./grenade.ts";
15	15	import { HE, SMOKE } from "./weapons.ts";
16	16	import { CS_HULL } from "./movement.ts";
17	17	import {
18		effectAt, eyeHeight, pushEffect, type Burst, type SoundDevice, type Tone, type Vec3,
	18	angleVectors, effectAt, eyeHeight, pushEffect, type Burst, type SoundDevice, type Tone, type Vec3,
19	19	} from "../engine/index.ts";
20	20
21	21	const TICK = 1 / 64;
		@@ -655,3 +655,46 @@ test("a blast you are caught in came from the blast, and not from whoever threw
655	655	expect(Math.hypot(hit.from[0] - world.me.pos[0], hit.from[1] - world.me.pos[1]))
656	656	.toBeLessThan(HE.blast.radius);
657	657	});
	658
	659	/**
	660	* The tick's inputs are asked for body by body (`updateWith`), which is what
	661	* lets a room drive five people through one world. Two claims, and the room in
	662	* `src/rooms/` is built on both: a body somebody drives does what they pressed
	663	* rather than what a bot would, and a body nobody drives and nobody thinks for
	664	* stands still.
	665	*/
	666	test("a tick asks for each body's input, and a driven bot does what it was told", () => {
	667	const world = createWorld(DE_FORGE, SHORT, "you", "ct", 5, 41);
	668	world.match.phase = "live";
	669	world.match.timer = SHORT.roundTime;
	670	const seat = world.players.find((p) => p.team === "ct" && p !== world.me) as Player;
	671	const was: Vec3 = [...seat.pos] as Vec3;
	672	// Driven straight forward for half a second, with every other body left to
	673	// the bots — including `me`, who nobody is driving here.
	674	const driving: Input = { ...NO_INPUT, forward: 1 };
	675	for (let i = 0; i < 32; i++) updateWith(world, TICK, (p) => (p === seat ? driving : undefined));
	676
	677	// It moved, and it moved along its own yaw rather than wherever a bot wanted:
	678	// nearly all of the ground it covered is in front of where it is looking.
	679	const went = Math.hypot(seat.pos[0] - was[0], seat.pos[1] - was[1]);
	680	expect(went).toBeGreaterThan(50);
	681	const { forward } = angleVectors(seat.yaw, 0);
	682	const along = (seat.pos[0] - was[0]) * forward[0] + (seat.pos[1] - was[1]) * forward[1];
	683	expect(along).toBeGreaterThan(went * 0.9);
	684	});
	685
	686	test("a body nobody drives and nobody thinks for stands still", () => {
	687	const world = createWorld(DE_FORGE, SHORT, "you", "ct", 5, 41);
	688	world.match.phase = "live";
	689	world.match.timer = SHORT.roundTime;
	690	// Every bot turned into a person nobody is holding the keys for: ten bodies,
	691	// no input anywhere, so nothing in the round moves at all.
	692	for (const p of world.players) p.bot = false;
	693	const before = world.players.map((p) => [...p.pos] as Vec3);
	694	for (let i = 0; i < 64; i++) updateWith(world, TICK, () => undefined);
	695
	696	world.players.forEach((p, i) => {
	697	const was = before[i] as Vec3;
	698	expect(Math.hypot(p.pos[0] - was[0], p.pos[1] - was[1])).toBeLessThan(0.001);
	699	});
	700	});
		@@ -112,7 +112,14 @@ export type Effect =
112	112	\| { kind: "tracer"; from: Vec3; to: Vec3; at: number }
113	113	\| { kind: "impact"; at: number; pos: Vec3; normal: Vec3 }
114	114	\| { kind: "blood"; at: number; pos: Vec3 }
115		\| { kind: "shot"; at: number; pos: Vec3; weapon: WeaponId; mine: boolean }
	115	/**
	116	* A gun going off, where and which. `mine` is whether it is the gun on this
	117	* screen — the frame draws its own muzzle differently — and `by` is whose body
	118	* fired it, which is the same question asked in a form that survives a wire: a
	119	* room's snapshot goes to everybody at once, so `mine` cannot travel and the
	120	* id it is derived from can (`src/rooms/wire.ts`).
	121	*/
	122	\| { kind: "shot"; at: number; pos: Vec3; weapon: WeaponId; mine: boolean; by: number }
116	123	\| { kind: "hitmark"; at: number; headshot: boolean }
117	124	/**
118	125	* Damage you took, and where it came from: the shooter's feet, or the
		@@ -552,7 +559,7 @@ export function shoot(world: World, p: Player): boolean {
552	559	const dir = angleVectors(yaw, pitch).forward;
553	560	const to: Vec3 = [from[0] + dir[0] * range, from[1] + dir[1] * range, from[2] + dir[2] * range];
554	561	const hit = traceBullet(from, to, world.level.boxes, world.players, p.id);
555		record(world, { kind: "shot", at: world.time, pos: from, weapon: w.id, mine: p === world.me });
	562	record(world, { kind: "shot", at: world.time, pos: from, weapon: w.id, mine: p === world.me, by: p.id });
556	563	if (w.kind !== "knife") record(world, { kind: "tracer", at: world.time, from, to: hit.kind === "none" ? to : hit.point });
557	564
558	565	if (hit.kind === "world") {
		@@ -793,8 +800,27 @@ export function applyInput(world: World, p: Player, input: Input, dt: number): v
793	800	bombTick(world, p, input.use, dt);
794	801	}
795	802
796		/** One fixed simulation tick. `input` is the person's; bots think for themselves. */
797		export function update(world: World, dt: number, input: Input): void {
	803	/**
	804	* Where a tick gets its inputs: one body in, the input whoever is driving it
	805	* pressed this tick, or undefined for a body nobody is driving. A bot nobody
	806	* drives thinks for itself; a person's body nobody drives stands still.
	807	*
	808	* It is a function rather than a map because the two callers ask different
	809	* questions of it. The single-player game drives exactly one body — its own —
	810	* and a room drives as many bodies as it has members in seats, the rest left to
	811	* the bots. Neither needs the other's shape, and `update` below is the one
	812	* place either answer is turned into a tick.
	813	*/
	814	export type Inputs = (p: Player) => Input \| undefined;
	815
	816	/**
	817	* One fixed simulation tick, with the inputs asked for body by body. Bodies are
	818	* stepped in the order they are in `world.players`, which is the order the
	819	* single-player game always stepped them in — its own first, because it is
	820	* `players[0]`, and then the bots — so a round played through here and a round
	821	* played through `update` below are the same round, tick for tick.
	822	*/
	823	export function updateWith(world: World, dt: number, inputs: Inputs): void {
798	824	world.time += dt;
799	825	const before = world.match.phase;
800	826	for (const event of rules.tick(world.match, dt)) {
		@@ -838,10 +864,10 @@ export function update(world: World, dt: number, input: Input): void {
838	864	// and it does so for everybody, standing or dead, before anyone acts on it.
839	865	for (const p of world.players) if (p.blind > 0) p.blind = Math.max(0, p.blind - dt);
840	866
841		applyInput(world, world.me, world.me.alive ? input : NO_INPUT, dt);
842	867	for (const p of world.players) {
843		if (!p.bot \|\| !p.alive) continue;
844		applyInput(world, p, botThink(world, p, dt), dt);
	868	const driven = inputs(p);
	869	if (driven !== undefined) applyInput(world, p, p.alive ? driven : NO_INPUT, dt);
	870	else if (p.bot && p.alive) applyInput(world, p, botThink(world, p, dt), dt);
845	871	}
846	872	// After everyone has moved, so a grenade is solved against where people
847	873	// ended the tick rather than where they started it.
		@@ -859,6 +885,16 @@ export function update(world: World, dt: number, input: Input): void {
859	885	expireEffects(world.effects, world.time, EFFECT_LIFE);
860	886	}
861	887
	888	/**
	889	* One fixed simulation tick of the game one person plays in one browser:
	890	* `input` is theirs, and every other body is a bot thinking for itself. It is
	891	* `updateWith` with the one body this page is holding the keys for, and it is
	892	* the whole of what the single-player game ever needed.
	893	*/
	894	export function update(world: World, dt: number, input: Input): void {
	895	updateWith(world, dt, (p) => (p === world.me ? input : undefined));
	896	}
	897
862	898	/**
863	899	* Is `target` visible to `from`, eye to eye? The one question the whole game
864	900	* asks about sight: the bots pick their fights with it, a bot deciding whether
		@@ -98,13 +98,13 @@ export const GAMES: readonly Game[] = [
98	98	label: "cs",
99	99	entry: "src/client/main.ts",
100	100	/**
101		* Raised by #153, which made the buy panel keyboard-driven: the number row
102		* on the tiles, the rebuy and the loadout it remembers. 103,334 raw and
103		* 40,719 gzipped, measured by `bun run scripts/build.ts` — 334 bytes over
104		* the ceiling #165 set for the smoke grenade, and worth it for a round that
105		* is bought without the pointer leaving the game.
	101	* Raised by #300, which put multiplayer in the page: `src/client/session.ts`
	102	* is the room's end of the socket and `src/rooms/wire.ts` is the codec both
	103	* ends read. 115,156 raw and 44,864 gzipped, measured by
	104	* `bun run scripts/build.ts` — 1.8 kB of gzip for a round five people can
	105	* play together, and the rooms' own server half ships in no bundle at all.
106	106	*/
107		ceiling: { raw: 110_000, gzip: 43_500 },
	107	ceiling: { raw: 122_000, gzip: 47_500 },
108	108	assets: [
109	109	{
110	110	name: "weights",
		@@ -356,6 +356,16 @@ const menu = (visitor: Who, asked: Asked, daily: Daily): string => `
356	356	</div>
357	357	</div>
358	358	<div class="row"><button type="button" class="primary" id="play" disabled>Play</button></div>
	359	<div class="row">
	360	<label>Room code<input id="room" maxlength="6" placeholder="ABCDEF" autocapitalize="characters"
	361	autocomplete="off" spellcheck="false"></label>
	362	<button type="button" id="joinroom" disabled>Join room</button>
	363	<button type="button" id="makeroom" disabled>Make a room</button>
	364	</div>
	365	<p class="hint" id="roomsaid">Play with friends: make a room, read the code out, and they join it. A room's
	366	round is decided on this server, so everyone in it sees the same round — the match above runs in your
	367	own browser against bots. Rooms live in this process: a deploy ends them, and an empty one is forgotten
	368	after ninety seconds.</p>
359	369	<p class="hint" id="prep">Preparing textures…</p>
360	370	<p class="hint"><kbd>WASD</kbd> move · <kbd>Space</kbd> jump · <kbd>Ctrl</kbd> crouch · <kbd>Shift</kbd> walk ·
361	371	mouse to aim and fire · <kbd>R</kbd> reload · <kbd>G</kbd> throw an HE · <kbd>T</kbd> throw a flashbang · <kbd>V</kbd> throw a smoke ·
		@@ -0,0 +1,59 @@
	1	/**
	2	* What a room is called: six characters a person can read out loud over a
	3	* voice call and type without asking which letter that was.
	4	*
	5	* It is the whole of the public name of a room, so it is an input twice over —
	6	* the query on the socket upgrade, and the field in the menu — and it is
	7	* validated here on both sides, the way `src/matchid.ts` is the one door a match
	8	* id goes through. A code is never a path, never a key in anything on disk, and
	9	* never interpolated into markup without escaping.
	10	*
	11	* The alphabet leaves out the characters a person reads wrong: no O or 0, no I,
	12	* l or 1, no S against 5. That is 32 symbols, so a code is 32^6 ≈ 1.07 billion,
	13	* and with the room cap this process holds — a hundred — a blind guess finds a
	14	* room about once in ten million tries, against a limiter that allows nowhere
	15	* near that many. The code is drawn from `crypto.getRandomValues`, not from
	16	* `Math.random`: it is the only thing standing between a room and a stranger.
	17	*/
	18
	19	/** The symbols a code is made of, and the only ones. */
	20	export const ALPHABET = "ABCDEFGHJKMNPQRTUVWXYZ2346789";
	21
	22	/** How many characters a code is. */
	23	export const LENGTH = 6;
	24
	25	const SHAPE = new RegExp(`^[${ALPHABET}]{${LENGTH}}$`);
	26
	27	/** Is this a room code at all? The shape above, and nothing else. */
	28	export const isRoomCode = (value: unknown): value is string =>
	29	typeof value === "string" && SHAPE.test(value);
	30
	31	/**
	32	* The code a caller handed over, upper-cased first because a person typing one
	33	* types it however their keyboard was, or null when it is not a code. This is
	34	* the boundary: the server's upgrade goes through it and the page's field goes
	35	* through it again, and neither trusts the other.
	36	*/
	37	export function roomCodeFrom(value: unknown): string \| null {
	38	if (typeof value !== "string") return null;
	39	const code = value.trim().toUpperCase();
	40	return isRoomCode(code) ? code : null;
	41	}
	42
	43	/**
	44	* A fresh code. `bytes` is a source of random bytes — `crypto.getRandomValues`
	45	* in both a browser and Bun — and is a parameter so a test can hand over a
	46	* sequence it chose.
	47	*
	48	* The modulo is not quite uniform over 256: with 29 symbols the first 24 are
	49	* drawn slightly more often than the last 5, by about four per cent. That is
	50	* not a weakness worth code here — it costs a fraction of a bit out of the
	51	* thirty a code carries — and rejection sampling would be a loop with a
	52	* pathological case in the one place this app cannot afford one.
	53	*/
	54	export function newRoomCode(bytes: (into: Uint8Array) => Uint8Array = (into) => crypto.getRandomValues(into)): string {
	55	const drawn = bytes(new Uint8Array(LENGTH));
	56	let code = "";
	57	for (let i = 0; i < LENGTH; i++) code += ALPHABET[(drawn[i] as number) % ALPHABET.length];
	58	return code;
	59	}