feat(rust): Rust's own world events — feed, credit rule, triggers, Call a world event (PLAN_REDESIGNS §14.3.1)

The site half of stage 1, on protocol 14:

- server/worldEvents.js: the 24 types, D372's four credit rules, the grid
  from the map's geometry (none off the map), and the per-viewer reading.
- The feed serves `world.event` (a public kind): an unknown type is staff's;
  the event and its grid are public; names only for the presence audience
  (D376); Steam ids and positions only for staff (D353). A downed one carries
  `credited`/`creditedCount` by the server's rule. Client lines for all 24
  types and a World events filter.
- rust_servers.credit_rule (blow, last, most, all; default blow), set on the
  server's settings. Ingest counts heli_kills (patrol helicopters and
  Chinooks, D379) and apc_kills from `world.event` by that rule, so the line
  and Rotorbane / Tankbreaker agree. A protocol-13 tally's heliKills/apcKills
  still add as before.
- The tally's cratesHacked / dropsLooted → crates_hacked / drops_looted;
  title categories Safecracker and Scavenger (D356); leaderboard columns
  Crates hacked and Drops looted, sortable (D377).
- 24 engagement triggers rust.world.<event> (D355): ceiling everyone,
  cooldown subject the server and event (crates add where), names only.
- server/eventWorldCall.js: rust.world.call, "Call a world event"
  (risk change, reversible none, budget rust.world.calls). A position for an
  airdrop or a patrol helicopter only; the Chinook takes none (D378).

Server 585/585 (22 new in test/worldEvents.test.js), client 84/84, every
check; booted against the pinned core (43 triggers, 12 actions, 10 budgets,
20 option sources), routes.manifest unchanged at 89. Engagement manifest and
swagger fragment regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/events/events.db.js

@@ -148,6 +148,9 @@ const TITLE_SUMS = {
   rockets: 'rockets',
   explosives: 'explosives',
   missions: 'missions',
+  // Protocol 14 (D356): Safecracker and Scavenger.
+  cratesHacked: 'crates_hacked',
+  dropsLooted: 'drops_looted',
 }
 
 /** The two *best* fields and their columns: the longest single kill, never a sum. */
@@ -339,7 +342,15 @@ async function recentEvents({ serverId, kinds, wipeId = null, limit = 50 }) {
  */
 async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25, balanceFloor = null }) {
   const byBalance = sort === 'balance' && wipeId && Number.isFinite(balanceFloor)
-  const column = { kills: 'kills', deaths: 'deaths', npcKills: 'npc_kills', playtime: 'playtime_sec' }[sort] || 'kills'
+  const column = {
+    kills: 'kills',
+    deaths: 'deaths',
+    npcKills: 'npc_kills',
+    playtime: 'playtime_sec',
+    // Protocol 14 (D356, D377): the columns Safecracker and Scavenger bring.
+    cratesHacked: 'crates_hacked',
+    dropsLooted: 'drops_looted',
+  }[sort] || 'kills'
 
   const params = [serverId]
   let where = 's.server_id = ?'
@@ -363,6 +374,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
             SUM(s.npc_kills) AS npcKills,
             SUM(s.structures) AS structures,
             SUM(s.playtime_sec) AS playtimeSec,
+            SUM(s.crates_hacked) AS cratesHacked,
+            SUM(s.drops_looted) AS dropsLooted,
             MAX(s.balance) AS balance,
             MAX(s.last_seen) AS lastSeen
        FROM ${STATS} s

server/model/events/events.model.js

@@ -13,7 +13,10 @@
 // type.
 
 const catalogue = require('../../catalogue')
+const worldEvents = require('../../worldEvents')
 const db = require('./events.db')
+const mapDb = require('../map/map.db')
+const serversDb = require('../servers/servers.db')
 
 /** Hard ceiling on a page, whatever a caller asks for. */
 const MAX_LIMIT = 200
@@ -51,7 +54,7 @@ function parseKinds(raw) {
  * refused: naming it in an error would confirm the kind exists, which is a small
  * thing to leak and a free one to avoid.
  */
-async function recent({ serverId, admin = false, presence = false, kind = null, wipeId = null, limit }) {
+async function recent({ serverId, admin = false, staff = false, presence = false, kind = null, wipeId = null, limit }) {
   const kinds = catalogue.kindsFor({ admin, presence, requested: parseKinds(kind) })
 
   // Every requested kind was refused. Answering with an empty list is right —
@@ -65,7 +68,38 @@ async function recent({ serverId, admin = false, presence = false, kind = null,
     limit: boundedLimit(limit),
   })
 
-  return rows.map(shape)
+  const shaped = rows.map(shape)
+  if (!shaped.some((r) => r.kind === 'world.event')) return shaped
+
+  // Protocol 14 (§14.3.1): each world event is read for THIS viewer — its type
+  // allowed, its names to the presence audience, its Steam ids to staff, its
+  // credit by the server's rule — and given a grid from the map's geometry.
+  // Both reads only when the page holds a world event at all.
+  const view = await worldView(serverId, { staff: staff || admin, presence })
+  return shaped.map((row) => (row.kind === 'world.event' ? worldRow(row, view) : row)).filter(Boolean)
+}
+
+/** What reading a world event for one viewer needs: the server's credit rule and map geometry. */
+async function worldView(serverId, { staff, presence }) {
+  const [server, meta] = await Promise.all([
+    serversDb.getServer(serverId).catch(() => null),
+    mapDb.getMeta(serverId).catch(() => null),
+  ])
+  return {
+    staff,
+    presence,
+    rule: worldEvents.creditRuleOf(server && server.creditRule),
+    geometry: meta
+      ? { worldSize: Number(meta.worldSize), gridCells: Number(meta.gridCells), gridCellSize: Number(meta.gridCellSize) }
+      : null,
+  }
+}
+
+/** One world-event row for a viewer, or null when they may not see it. The row's own Steam id is staff's too. */
+function worldRow(row, view) {
+  const frame = worldEvents.shapeFor(row.frame, view)
+  if (!frame) return null
+  return { ...row, steamId: view.staff ? row.steamId : null, frame }
 }
 
 /**
@@ -123,6 +157,9 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit, pre
     npcKills: Number(r.npcKills) || 0,
     structures: Number(r.structures) || 0,
     playtimeSec: Number(r.playtimeSec) || 0,
+    // Protocol 14 (D356): Safecracker's and Scavenger's counts.
+    cratesHacked: Number(r.cratesHacked) || 0,
+    dropsLooted: Number(r.dropsLooted) || 0,
     // Withheld below the presence audience. A tally refreshes it every minute a
     // player is on, so a `lastSeen` of forty seconds ago is the Online tab by
     // another name. The ORDER still uses it as a tie-break — that says who was

server/model/servers/servers.db.js

@@ -24,7 +24,7 @@ async function listServers({ enabledOnly = false } = {}) {
   return core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
             protocol, enabled, sort_order AS sortOrder, announce_news AS announceNews,
-            news_delivery AS newsDelivery,
+            news_delivery AS newsDelivery, credit_rule AS creditRule,
             wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
             DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
             created_at AS createdAt, updated_at AS updatedAt
@@ -37,7 +37,7 @@ async function listServers({ enabledOnly = false } = {}) {
 async function getServer(id) {
   const rows = await core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
-            protocol, enabled, sort_order AS sortOrder,
+            protocol, enabled, sort_order AS sortOrder, credit_rule AS creditRule,
             wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
             DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
             created_at AS createdAt, updated_at AS updatedAt
@@ -97,6 +97,15 @@ async function setSchedule(id, { wipeRule, wipeDay, wipeTime, wipeTz, wipeAnchor
   )
 }
 
+/**
+ * One server's credit rule (D372). Its own statement, like the schedule, and for
+ * the same reason: written only when a save carries one, so a client that
+ * predates the rule cannot reset it to the default.
+ */
+async function setCreditRule(id, rule) {
+  await core.query(`UPDATE ${SERVERS} SET credit_rule = ? WHERE id = ?`, [rule, id])
+}
+
 async function deleteServer(id) {
   await core.query(`DELETE FROM ${SERVERS} WHERE id = ?`, [id])
 }
@@ -256,6 +265,7 @@ module.exports = {
   getServer,
   upsertServer,
   setSchedule,
+  setCreditRule,
   deleteServer,
   listState,
   getState,

server/model/servers/servers.model.js

@@ -17,6 +17,7 @@
 const core = require('../../core')
 const db = require('./servers.db')
 const { nextWipe } = require('./nextWipe')
+const worldEvents = require('../../worldEvents')
 
 const log = core.logger('servers')
 
@@ -59,6 +60,8 @@ function withToken(row) {
     announceNews: Boolean(Number(row.announceNews)),
     // D142: where that post goes — chat, or a popup.
     newsDelivery: row.newsDelivery === 'popup' ? 'popup' : 'chat',
+    // D372: who a downed helicopter, Chinook or Bradley credits, for ingest.
+    creditRule: worldEvents.creditRuleOf(row.creditRule),
   }
 }
 
@@ -212,6 +215,8 @@ async function listForAdmin(now = Date.now()) {
       // bridge makes. Anything but `patched` is said on the servers page.
       zoneHelper: (state && state.zoneHelper) || null,
       schedule: scheduleOf(row),
+      // D372: who a downed helicopter, Chinook or Bradley credits on this server.
+      creditRule: worldEvents.creditRuleOf(row.creditRule),
     }
   })
 }

server/model/titles/titles.js

@@ -20,7 +20,8 @@ const crypto = require('node:crypto')
 
 /**
  * The categories a rule may rank (PLAN_REDESIGNS §5, D172): the twenty-three
- * conditions and their shipped titles, the richest (§11.2.2, Magnate), plus
+ * conditions and their shipped titles, the richest (§11.2.2, Magnate), the
+ * two world-event counts (§14.3.1, Safecracker and Scavenger), plus
  * `playtime`, which predates them and has no default title, so a playtime rule
  * always carries its own text.
  *
@@ -65,6 +66,9 @@ const STATS = {
   rockets: { label: 'Rockets fired', title: 'Artillerist', source: { sum: 'rockets' } },
   explosives: { label: 'Explosives thrown', title: 'Demolitionist', source: { sum: 'explosives' } },
   missions: { label: 'Missions completed', title: 'Wayfarer', source: { sum: 'missions' } },
+  // Protocol 14, Rust's own world events (D356): a hack counts for its starter, once per crate.
+  crateshacked: { label: 'Locked crates hacked', title: 'Safecracker', source: { sum: 'crates_hacked' } },
+  dropslooted: { label: 'Airdrops looted first', title: 'Scavenger', source: { sum: 'drops_looted' } },
   richest: { label: 'Richest (Economics)', title: 'Magnate', source: { balance: 'balance' } },
   playtime: { label: 'Playtime', title: null, source: { sum: 'playtime_sec' } },
   profilekills: { label: 'Kills of an NPC profile', title: null, source: { npcProfile: true } },