@@ -173,17 +243,37 @@ export default function CharacterSheet({ char, moderation = false }) {
)}
+ {/* Loyalty & points — one entry per system this character has scored in */}
+ {points.length > 0 && (
+
+
+ Loyalty & points ({points.length})
+
+
+ {points.map((p) => (
+
+ ))}
+
+
+ )}
+
{/* Equipment */}
{equipment.length > 0 && (
Equipment
- {equipment.map((it) => (
+ {equipment.map((it) => {
+ const label = itemName(it)
+ const layer = it.layer || 'Item'
+ // The layer only earns its own line once the headline is a real
+ // name; when it IS the headline, repeating it is just noise.
+ const detail = [label === layer ? null : layer, `id ${it.itemId}`, it.hue ? `hue ${it.hue}` : null]
+ return (
-
{it.layer || 'Item'}
-
id {it.itemId}{it.hue ? ` · hue ${it.hue}` : ''}
+
{label}
+
{detail.filter(Boolean).join(' · ')}
{it.mods && Object.keys(it.mods).length > 0 && (
@@ -193,7 +283,8 @@ export default function CharacterSheet({ char, moderation = false }) {
)}
- ))}
+ )
+ })}
)}
diff --git a/client/src/components/SiteHeader.jsx b/client/src/components/SiteHeader.jsx
index 4394419..a3c0341 100644
--- a/client/src/components/SiteHeader.jsx
+++ b/client/src/components/SiteHeader.jsx
@@ -2,9 +2,15 @@ import { Link, NavLink } from 'react-router-dom'
import MoonDot from './MoonDot.jsx'
import { useAuth } from '../contexts/AuthContext.jsx'
import { useSite } from '../contexts/SiteContext.jsx'
+import { useShardFeatures, canSee } from '../lib/useShardFeatures.js'
// One consistent top nav for the whole public site. Every page gets the same
// main links plus an auth-aware entry on the right (Sign in / My Account / Admin).
+//
+// Entries carrying a `feature` are shard surfaces an admin can disable or gate
+// to a higher audience (Admin -> Shard Visibility). They are hidden when this
+// viewer can't reach them, so we never render a link that would 403. The gate
+// itself is server-side; this is only about not advertising a dead end.
const NAV = [
{ label: 'Home', to: '/', end: true },
{ label: 'News', to: '/site/news' },
@@ -12,11 +18,15 @@ const NAV = [
{ label: 'Five on Friday', to: '/site/five-on-friday' },
{ label: 'Newsletter', to: '/site/newsletter' },
{ label: 'Wiki', to: '/wiki' },
- { label: 'Shard', to: '/site/shard' },
- { label: 'Champions', to: '/site/champs' },
- { label: 'Guilds', to: '/site/guilds' },
- { label: 'Governors', to: '/site/governors' },
- { label: 'Houses', to: '/site/houses' },
+ { label: 'Shard', to: '/site/shard', feature: 'status' },
+ { label: 'Champions', to: '/site/champs', feature: 'champs' },
+ { label: 'Guilds', to: '/site/guilds', feature: 'guilds' },
+ { label: 'Governors', to: '/site/governors', feature: 'governors' },
+ { label: 'Houses', to: '/site/houses', feature: 'houses' },
+ { label: 'Rules', to: '/site/rules', feature: 'ruleset' },
+ { label: 'Atlas', to: '/site/atlas', feature: 'atlas' },
+ { label: 'Leaderboards', to: '/site/leaderboards', feature: 'leaderboards' },
+ { label: 'Market', to: '/site/market', feature: 'market' },
{ label: 'About', to: '/site/about' },
]
@@ -29,6 +39,8 @@ const linkStyle = ({ isActive }) => ({
export default function SiteHeader() {
const { user, loading } = useAuth()
const { siteTitle } = useSite()
+ const shardFeatures = useShardFeatures()
+ const nav = NAV.filter((item) => !item.feature || canSee(shardFeatures, item.feature))
// Where the auth entry points: staff → admin, player → portal, else sign in.
let account
@@ -60,7 +72,7 @@ export default function SiteHeader() {
{siteTitle}
- {NAV.map((l) => (
+ {nav.map((l) => (
{l.label}
diff --git a/client/src/lib/useShardFeatures.js b/client/src/lib/useShardFeatures.js
new file mode 100644
index 0000000..f1c8533
--- /dev/null
+++ b/client/src/lib/useShardFeatures.js
@@ -0,0 +1,58 @@
+import { useEffect, useState } from 'react'
+import { api } from '../api/client.js'
+
+// Which shard surfaces the current viewer may reach, from
+// GET /public/shard/features. Admins configure this per feature (Admin → Shard
+// Visibility), so the nav can't be a static list any more.
+//
+// This is PRESENTATION only. The gate is server-side: a disabled feature 404s
+// and an out-of-rung one 403s whether or not the link is rendered. So while the
+// answer is still in flight we return `null` and callers show their default set
+// — better a link that briefly 403s than a nav that flickers in on every load.
+//
+// Cached module-level: the answer is per-viewer but stable for a session, and
+// every consumer would otherwise refetch it on mount.
+let cached = null
+let inFlight = null
+
+export function resetShardFeatures() {
+ cached = null
+ inFlight = null
+}
+
+export function useShardFeatures() {
+ const [features, setFeatures] = useState(cached)
+
+ useEffect(() => {
+ if (cached) return undefined
+ let alive = true
+ inFlight =
+ inFlight ||
+ api.shard
+ .features()
+ .then((data) => {
+ cached = { level: data.level, set: new Set(data.features || []) }
+ return cached
+ })
+ .catch(() => {
+ // A failed lookup must not blank the nav — fall back to "show
+ // everything" and let the server do the gating.
+ cached = null
+ inFlight = null
+ return null
+ })
+ inFlight.then((result) => {
+ if (alive) setFeatures(result)
+ })
+ return () => {
+ alive = false
+ }
+ }, [])
+
+ return features
+}
+
+// Convenience: true when `name` is visible, or when we don't know yet.
+export function canSee(features, name) {
+ return !features || features.set.has(name)
+}
diff --git a/client/src/routes/admin/AdminLayout.jsx b/client/src/routes/admin/AdminLayout.jsx
index f54811c..200476a 100644
--- a/client/src/routes/admin/AdminLayout.jsx
+++ b/client/src/routes/admin/AdminLayout.jsx
@@ -78,6 +78,8 @@ const NAV = [
{ to: '/admin/auth-providers', label: 'Authentication', icon: IconKey, roles: ['admin'] },
{ to: '/admin/discord-bot', label: 'Discord Bot', icon: IconBot, roles: ['admin'] },
{ to: '/admin/shard', label: 'Shard (uo-link)', icon: IconShard, roles: ['admin'] },
+ { to: '/admin/shard-visibility', label: 'Shard Visibility', icon: IconShard, roles: ['admin'] },
+ { to: '/admin/shard-atlas', label: 'Spawn Atlas', icon: IconShard, roles: ['admin'] },
{ to: '/admin/bot-activity', label: 'Web Bot Activity', icon: IconPulse, roles: ['admin'] },
],
},
@@ -106,6 +108,8 @@ const TITLES = {
'/admin/bot-activity': 'Web Bot Activity',
'/admin/discord-bot': 'Discord Bot',
'/admin/shard': 'Shard (uo-link)',
+ '/admin/shard-visibility': 'Shard Visibility',
+ '/admin/shard-atlas': 'Spawn Atlas',
'/admin/characters': 'My Characters',
'/admin/auth-providers': 'Authentication',
'/admin/users': 'Users',
diff --git a/client/src/routes/admin/views/ShardAdmin.jsx b/client/src/routes/admin/views/ShardAdmin.jsx
index e59a405..5179b42 100644
--- a/client/src/routes/admin/views/ShardAdmin.jsx
+++ b/client/src/routes/admin/views/ShardAdmin.jsx
@@ -155,7 +155,7 @@ export default function ShardAdmin() {
const [baseUrl, setBaseUrl] = useState('')
const [wsUrl, setWsUrl] = useState('')
const [token, setToken] = useState('')
- const [protocol, setProtocol] = useState(1)
+ const [protocol, setProtocol] = useState(3)
const [enabled, setEnabled] = useState(false)
const [busy, setBusy] = useState(false)
const [msg, setMsg] = useState('')
@@ -172,7 +172,7 @@ export default function ShardAdmin() {
if (!initializedRef.current) {
setBaseUrl(c.baseUrl || '')
setWsUrl(c.wsUrl || '')
- setProtocol(c.protocol || 1)
+ setProtocol(c.protocol || 3)
setEnabled(c.enabled)
initializedRef.current = true
}
diff --git a/client/src/routes/admin/views/ShardVisibility.jsx b/client/src/routes/admin/views/ShardVisibility.jsx
new file mode 100644
index 0000000..e2de447
--- /dev/null
+++ b/client/src/routes/admin/views/ShardVisibility.jsx
@@ -0,0 +1,325 @@
+import { useCallback, useEffect, useState } from 'react'
+import { Loading, ErrorState } from '../../../components/PageState.jsx'
+import { api } from '../../../api/client.js'
+
+// ── Admin · Shard visibility ────────────────────────────────────────────────
+//
+// Who may see which shard surface, and which sensitive fields within it.
+// Admin-only, because this decides what ANONYMOUS visitors get.
+//
+// Two things the UI must communicate honestly, because they are not negotiable
+// server-side (see docs/link/v3.md §3.4):
+// • acct / webId are admin-only always and are not listed as editable fields.
+// • an event kind the server doesn't know about never reaches anyone below
+// admin, whatever is set here.
+//
+// Defaults reproduce the behavior the site had before this panel existed, so a
+// fresh install shows "everything as it was" rather than an empty form.
+
+const RUNG_LABEL = {
+ anonymous: 'Everyone',
+ logged_in: 'Signed in',
+ player: 'Linked players',
+ staff: 'Staff',
+ admin: 'Admins only',
+}
+
+const RUNG_HINT = {
+ anonymous: 'Visible to anyone, signed in or not.',
+ logged_in: 'Any signed-in account, linked or not.',
+ player: 'Accounts with a linked game account. Staff always qualify.',
+ staff: 'Admins and moderators.',
+ admin: 'Admins only.',
+}
+
+const FEATURE_LABEL = {
+ status: 'Shard status',
+ activity: 'Activity feed',
+ champs: 'Champion spawns',
+ guilds: 'Guilds',
+ governors: 'Town governors',
+ houses: 'Houses / IDOC',
+ presence: 'Players online',
+ ruleset: 'Shard rules',
+ atlas: 'Spawn atlas',
+ leaderboards: 'Leaderboards',
+ market: 'Marketplace',
+}
+
+const FEATURE_HINT = {
+ status: 'Connection state, online count, gold-supply series.',
+ activity: 'Deaths, kills, skill gains, quests, logins.',
+ champs: 'The live champion / mini-champ / sea-boss board.',
+ guilds: 'Guild rosters, alliances and leaders.',
+ governors: 'City Loyalty governors, elections and term history.',
+ houses: 'Houses in danger (IDOC). Owner and price are separate fields below.',
+ presence: 'Population aggregate and the staff-online widget.',
+ ruleset: 'Skill/stat caps, house limits, vet rewards and the rest of the ruleset.',
+ atlas: 'The spawn atlas and bestiary. Static shard content, not live state.',
+ leaderboards: 'Point and loyalty standings across every points system.',
+ market: 'The shard-wide player-vendor index.',
+}
+
+const FIELD_LABEL = {
+ owner: 'House owner',
+ price: 'House price',
+ location: 'In-game location (map + coordinates)',
+ connect: 'Server connect address',
+ // Keyed on the WIRE field, which for a leaderboard entry is `name` — the
+ // projection matches literal JSON keys, so the rule cannot be spelled after the
+ // field's meaning. The label is what carries the meaning to the admin.
+ name: 'Character names on leaderboards',
+ ownerName: 'Vendor owner name',
+ // One rule, one key — `location` is a nested object on both the wire frame and
+ // the stored read model precisely so that hiding it takes the facet, the
+ // coordinates, the region and the house together.
+ ownerSerial: 'Vendor owner character id',
+}
+
+function RungSelect({ value, onChange, ladder, disabled }) {
+ return (
+ onChange(e.target.value)}
+ style={{ maxWidth: 200 }}
+ >
+ {ladder.map((rung) => (
+
+ {RUNG_LABEL[rung] || rung}
+
+ ))}
+
+ )
+}
+
+function FeatureRow({ name, settings, defaults, ladder, onPatch }) {
+ const fields = Object.entries(settings.fields || {})
+ const changed =
+ defaults &&
+ (settings.enabled !== defaults.enabled ||
+ settings.audience !== defaults.audience ||
+ settings.stream !== defaults.stream ||
+ JSON.stringify(settings.fields) !== JSON.stringify(defaults.fields))
+
+ return (
+
+
+
+
+ {FEATURE_LABEL[name] || name}
+ {changed && (
+
+ changed
+
+ )}
+
+
+ {FEATURE_HINT[name]}
+
+
+
+ onPatch(name, { enabled: e.target.checked })}
+ />
+ Enabled
+
+
+
+
+
+ Who can see it
+ onPatch(name, { audience })}
+ />
+
+ {RUNG_HINT[settings.audience]}
+
+
+
+ onPatch(name, { stream: e.target.checked })}
+ />
+ Live updates
+
+
+
+ {fields.length > 0 && (
+
+
+ Sensitive fields
+
+
+ {fields.map(([field, rung]) => (
+
+
+ {FIELD_LABEL[field] || field}
+
+
+ onPatch(name, { fieldRules: { ...settings.fields, [field]: level } })
+ }
+ />
+
+ ))}
+
+
+ )}
+
+ )
+}
+
+export default function ShardVisibility() {
+ const [config, setConfig] = useState(null)
+ const [defaults, setDefaults] = useState(null)
+ const [ladder, setLadder] = useState([])
+ const [lockedFields, setLockedFields] = useState([])
+ const [loading, setLoading] = useState(true)
+ const [error, setError] = useState('')
+ const [saving, setSaving] = useState(false)
+ const [msg, setMsg] = useState('')
+
+ const load = useCallback(async () => {
+ setLoading(true)
+ setError('')
+ try {
+ const data = await api.admin.getShardVisibility()
+ setConfig(data.features)
+ setDefaults(data.defaults)
+ setLadder(data.ladder || [])
+ setLockedFields(data.lockedFields || [])
+ } catch (err) {
+ setError(err.message || 'Could not load visibility settings.')
+ } finally {
+ setLoading(false)
+ }
+ }, [])
+
+ useEffect(() => {
+ load()
+ }, [load])
+
+ function patch(name, changes) {
+ setMsg('')
+ setConfig((prev) => {
+ const next = { ...prev[name], ...changes }
+ // `fieldRules` in the API is `fields` in the effective config.
+ if (changes.fieldRules) {
+ next.fields = changes.fieldRules
+ delete next.fieldRules
+ }
+ return { ...prev, [name]: next }
+ })
+ }
+
+ async function save() {
+ setSaving(true)
+ setMsg('')
+ setError('')
+ try {
+ const body = {}
+ for (const [name, s] of Object.entries(config)) {
+ body[name] = {
+ enabled: s.enabled,
+ audience: s.audience,
+ stream: s.stream,
+ fieldRules: s.fields || {},
+ }
+ }
+ const data = await api.admin.saveShardVisibility(body)
+ setConfig(data.features)
+ setMsg('Saved. Changes take effect within a few seconds, including on open live streams.')
+ } catch (err) {
+ setError(err.message || 'Could not save.')
+ } finally {
+ setSaving(false)
+ }
+ }
+
+ function resetToDefaults() {
+ setMsg('')
+ setConfig(structuredClone(defaults))
+ }
+
+ if (loading) return
+ if (error && !config) return
+
+ return (
+
+
+
+ Shard visibility
+
+
+ Choose who can see each shard surface on the public site, and how much detail they get.
+ Turning a feature off hides it entirely — its pages return “not found” rather than
+ revealing that it exists. “Live updates” controls whether the feature streams changes in
+ real time; the pages still work without it, they just refresh on load.
+
+ {lockedFields.length > 0 && (
+
+ Not configurable: {lockedFields.join(', ')} —
+ game account names and website user ids are never shown below admin, on any surface. They
+ aren’t visible in game either, so publishing them would disclose something the shard
+ itself doesn’t.
+
+ )}
+
+
+
+ {Object.entries(config).map(([name, settings]) => (
+
+ ))}
+
+
+
+
+ {saving ? 'Saving…' : 'Save changes'}
+
+
+ Restore defaults
+
+ {msg && {msg} }
+ {error && {error} }
+
+
+ )
+}
diff --git a/client/src/routes/admin/views/SpawnAtlas.jsx b/client/src/routes/admin/views/SpawnAtlas.jsx
new file mode 100644
index 0000000..87bc852
--- /dev/null
+++ b/client/src/routes/admin/views/SpawnAtlas.jsx
@@ -0,0 +1,285 @@
+import { useCallback, useEffect, useState } from 'react'
+import { Loading, ErrorState } from '../../../components/PageState.jsx'
+import { api } from '../../../api/client.js'
+
+// ── Admin · Spawn atlas ─────────────────────────────────────────────────────
+//
+// The atlas re-derives itself from the shard's ServUO tree on every boot, so
+// this panel exists for the three things a restart cannot do:
+//
+// • point it at a different tree,
+// • apply a map change without restarting, and
+// • answer a refresh that was parsed but deliberately NOT applied because it
+// would remove a facet.
+//
+// That last one is the reason the panel is worth building. Losing a facet looks
+// exactly like a half-copied or mid-update tree, and boot cannot tell them
+// apart — so it stages the decision for a human instead of guessing. Until
+// someone decides here, the site keeps serving the atlas it already had.
+
+// A refresh reports its outcome rather than throwing (the boot path must never
+// be stopped by a bad tree), so these are answers, not errors — the panel says
+// what happened in the shard's terms instead of showing a failure box.
+const OUTCOME = {
+ imported: (r) =>
+ `Imported — ${r.counts?.points?.toLocaleString() ?? '?'} spawners, ${r.counts?.creatures?.toLocaleString() ?? '?'} creatures.`,
+ unchanged: (r) =>
+ r.reason === 'refresh previously rejected'
+ ? 'Unchanged — this exact tree was already reviewed and declined.'
+ : 'Unchanged — the tree matches what is already loaded.',
+ needsReview: () => 'Staged for review: this refresh would remove a facet, so it was not applied.',
+ unavailable: (r) => `The tree could not be read: ${r.reason || 'unknown reason'}`,
+ skipped: () => 'No ServUO path is configured, so there is nothing to import.',
+ failed: (r) => `Refresh failed: ${r.reason || 'unknown reason'}`,
+ rejected: () => 'Declined. It will not be offered again until the tree changes.',
+}
+
+const describe = (result) => (OUTCOME[result?.status] || (() => `Result: ${result?.status}`))(result)
+
+function Row({ label, children }) {
+ return (
+
+ {label}
+ {children}
+
+ )
+}
+
+function PendingReview({ pending, busy, onApprove, onReject }) {
+ const declined = pending.status === 'rejected'
+ return (
+
+
+ {declined ? 'A refresh was declined' : 'A refresh is waiting for you'}
+
+
+ {declined ? (
+ <>
+ This tree was reviewed and declined, so it is not offered again until the files change.
+ Approving now applies it anyway.
+ >
+ ) : (
+ <>
+ The tree parses cleanly but would remove {pending.removedFacets?.length || 0} facet
+
+ {(pending.removedFacets?.length || 0) === 1 ? '' : 's'} the site is currently serving. That
+ is what a half-copied or mid-update tree looks like as well as a real map change, so it was
+ not applied. Approving re-parses the tree as it is right now — if you have since fixed the
+ mount, what lands is the corrected import.
+ >
+ )}
+
+ {(pending.removedFacets || []).join(', ') || '—'}
+ {(pending.addedFacets || []).join(', ') || '—'}
+ {pending.detectedAt ? new Date(pending.detectedAt).toLocaleString() : '—'}
+
+
+ Approve and import
+
+ {!declined && (
+
+ Keep the current atlas
+
+ )}
+
+
+ )
+}
+
+export default function SpawnAtlas() {
+ const [status, setStatus] = useState(null)
+ const [path, setPath] = useState('')
+ const [force, setForce] = useState(false)
+ const [loading, setLoading] = useState(true)
+ const [busy, setBusy] = useState(false)
+ const [error, setError] = useState('')
+ const [msg, setMsg] = useState('')
+
+ const load = useCallback(async () => {
+ setLoading(true)
+ setError('')
+ try {
+ const data = await api.admin.atlas.status()
+ setStatus(data)
+ setPath(data.path || '')
+ } catch (err) {
+ setError(err.message || 'Could not load atlas status.')
+ } finally {
+ setLoading(false)
+ }
+ }, [])
+
+ useEffect(() => {
+ load()
+ }, [load])
+
+ // Every mutating action shares this: run it, report what it said, then reload
+ // status so the panel reflects the world rather than what we assumed happened.
+ async function run(action, fn) {
+ setBusy(true)
+ setMsg('')
+ setError('')
+ try {
+ const result = await fn()
+ setMsg(describe(result))
+ const fresh = await api.admin.atlas.status()
+ setStatus(fresh)
+ setPath(fresh.path || '')
+ } catch (err) {
+ setError(err.message || `Could not ${action}.`)
+ } finally {
+ setBusy(false)
+ }
+ }
+
+ async function savePath() {
+ setBusy(true)
+ setMsg('')
+ setError('')
+ try {
+ const fresh = await api.admin.atlas.setPath(path.trim())
+ setStatus(fresh)
+ setPath(fresh.path || '')
+ setMsg(
+ fresh.path === ''
+ ? 'Path cleared. The atlas will be skipped on the next boot; what is loaded keeps serving.'
+ : fresh.treeReadable
+ ? 'Saved. The tree is readable — import when you are ready.'
+ : 'Saved, but the tree could not be read from here. Check the mount and permissions.',
+ )
+ } catch (err) {
+ setError(err.message || 'Could not save the path.')
+ } finally {
+ setBusy(false)
+ }
+ }
+
+ if (loading) return
+ if (error && !status) return
+
+ const counts = status?.counts || null
+
+ return (
+
+
+
+ Spawn atlas
+
+
+ The bestiary and spawn map on the public site, parsed from the shard’s own ServUO files.
+ It refreshes itself on every server start; everything here is for the times you don’t want
+ to wait for one. Nothing on this page touches the sidecar — the atlas is shard content, not
+ shard state, and stays complete while the shard is down.
+
+
+
+ {status?.pending && (
+
run('approve the refresh', () => api.admin.atlas.approve())}
+ onReject={() => run('decline the refresh', () => api.admin.atlas.reject())}
+ />
+ )}
+
+
+
+ What is loaded
+
+
+ {status?.importedAt ? new Date(status.importedAt).toLocaleString() : 'Never'}
+
+ {status?.facets?.length ? status.facets.join(', ') : '—'}
+ {counts && (
+ <>
+ {counts.points?.toLocaleString() ?? '—'}
+ {counts.creatures?.toLocaleString() ?? '—'}
+
+ {`${counts.regions?.toLocaleString() ?? '—'} / ${counts.landmarks?.toLocaleString() ?? '—'}`}
+
+ {counts.champions?.toLocaleString() ?? '—'}
+ >
+ )}
+
+ {!status?.configured ? 'No path set' : status.treeReadable ? 'Yes' : 'No'}
+
+
+ {status?.drift == null ? '—' : status.drift ? 'Yes — an import would pick it up' : 'No'}
+
+
+
+
+
+
+
+ {(msg || error) && (
+
+ {msg && {msg} }
+ {error && {error} }
+
+ )}
+
+ )
+}
diff --git a/client/src/routes/public/Atlas.jsx b/client/src/routes/public/Atlas.jsx
new file mode 100644
index 0000000..049e5af
--- /dev/null
+++ b/client/src/routes/public/Atlas.jsx
@@ -0,0 +1,310 @@
+import { useCallback, useEffect, useMemo, useState } from 'react'
+import { Link } from 'react-router-dom'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState, EmptyState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { api } from '../../api/client.js'
+
+// ── The spawn atlas ─────────────────────────────────────────────────────────
+//
+// What the shard CONTAINS, as opposed to what it is doing: which creatures
+// spawn, where, and which champion altars are configured. There is no live feed
+// here and no `connected` indicator, deliberately — this is parsed from the
+// shard's own files and stays complete while the shard is down.
+//
+// Facet names come from the shard's data, never from a list in this file. A
+// shard running custom maps gets its own names in the filter with no code
+// change (docs/link/v3.md §6.1 R2).
+
+const PAGE = 50
+
+const num = (v) => (Number.isFinite(v) ? v.toLocaleString() : '—')
+
+const TABS = [
+ { key: 'creatures', label: 'Creatures' },
+ { key: 'champions', label: 'Champion altars' },
+ { key: 'places', label: 'Places' },
+]
+
+function Chip({ active, onClick, children }) {
+ return (
+
+ {children}
+
+ )
+}
+
+function CreatureCard({ creature }) {
+ const facets = Object.entries(creature.facets || {}).sort((a, b) => b[1] - a[1])
+ return (
+
+
+
+ {creature.name}
+
+
+ {facets.length === 0
+ ? '—'
+ : facets.map(([facet, n]) => `${facet} (${n})`).join(' · ')}
+
+
+
+
{num(creature.total)}
+
+ {num(creature.points)} spawners
+
+
+
+ )
+}
+
+// The creature list owns its own paging rather than going through useAsync: a
+// "load more" appends to what is already on screen, which a hook that resets to
+// `{ loading: true, data: null }` on every dependency change cannot express.
+function Creatures({ q, facet }) {
+ const [state, setState] = useState({ loading: true, error: null, items: [], total: 0 })
+ const [more, setMore] = useState(false)
+
+ const load = useCallback(
+ async (offset) => {
+ const page = await api.atlas.creatures({ q, facet, limit: PAGE, offset })
+ return page
+ },
+ [q, facet],
+ )
+
+ useEffect(() => {
+ let alive = true
+ setState({ loading: true, error: null, items: [], total: 0 })
+ load(0)
+ .then((page) => {
+ if (alive) setState({ loading: false, error: null, items: page.creatures || [], total: page.total || 0 })
+ })
+ .catch((error) => alive && setState({ loading: false, error, items: [], total: 0 }))
+ return () => {
+ alive = false
+ }
+ }, [load])
+
+ const loadMore = async () => {
+ setMore(true)
+ try {
+ const page = await load(state.items.length)
+ setState((s) => ({ ...s, items: [...s.items, ...(page.creatures || [])], total: page.total ?? s.total }))
+ } catch {
+ // A failed "load more" leaves what is already on screen alone; the button
+ // simply stays available to retry.
+ } finally {
+ setMore(false)
+ }
+ }
+
+ if (state.loading) return
+ if (state.error) return
+ if (state.items.length === 0) {
+ return Nothing in the atlas matches that.
+ }
+
+ return (
+ <>
+
+ Showing {num(state.items.length)} of {num(state.total)}
+
+
+ {state.items.map((c) => (
+
+ ))}
+
+ {state.items.length < state.total && (
+
+
+ {more ? 'Loading…' : 'Load more'}
+
+
+ )}
+ >
+ )
+}
+
+// The CONFIGURED altar roster — where the altars are and what each summons. The
+// live board ("it is on level 3 right now") is a different page, /site/champs,
+// fed by the sidecar. Both exist; they are not the same thing.
+function Champions({ facet }) {
+ const { loading, error, data } = useAsync(() => api.atlas.champions(facet), [facet])
+ if (loading) return
+ if (error) return
+ if (!data || data.length === 0) return No champion altars are configured.
+ return (
+
+ {data.map((champ) => (
+
+
+
+ {champ.label || champ.name}
+
+
+ {champ.facet}
+ {champ.group ? ` · ${champ.group}` : ''} · {champ.x}, {champ.y}
+
+
+
+ {champ.randomType ? 'Random champion' : champ.type || '—'}
+
+
+ ))}
+
+ )
+}
+
+// Regions and landmarks together: both answer "where is that?", and splitting
+// them into two tabs would make the visitor guess which list a name lives in.
+function Places({ q, facet }) {
+ const { loading, error, data } = useAsync(
+ () => Promise.all([api.atlas.regions({ q, facet }), api.atlas.landmarks({ q, facet })]),
+ [q, facet],
+ )
+ const rows = useMemo(() => {
+ if (!data) return []
+ const [regions, landmarks] = data
+ return [
+ ...regions.map((r) => ({ key: `r:${r.facet}:${r.name}`, name: r.name, facet: r.facet, detail: r.parent || r.type || 'Region', kind: 'Region' })),
+ ...landmarks.map((l) => ({ key: `l:${l.facet}:${l.group || ''}:${l.name}:${l.x}:${l.y}`, name: l.group ? `${l.group} — ${l.name}` : l.name, facet: l.facet, detail: `${l.x}, ${l.y}`, kind: 'Landmark' })),
+ ].sort((a, b) => a.name.localeCompare(b.name))
+ }, [data])
+
+ if (loading) return
+ if (error) return
+ if (rows.length === 0) return No regions or landmarks match that.
+ return (
+
+ {rows.map((row) => (
+
+ {row.name}
+ {row.facet} · {row.detail}
+ {row.kind}
+
+ ))}
+
+ )
+}
+
+export default function Atlas() {
+ const [tab, setTab] = useState('creatures')
+ const [input, setInput] = useState('')
+ const [q, setQ] = useState('')
+ const [facet, setFacet] = useState('')
+ const meta = useAsync(() => api.atlas.meta())
+
+ // Debounced: typing "lizardman" should be one request, not nine.
+ useEffect(() => {
+ const timer = setTimeout(() => setQ(input.trim()), 250)
+ return () => clearTimeout(timer)
+ }, [input])
+
+ const facets = meta.data?.facets || []
+ const counts = meta.data?.counts || null
+ const imported = meta.data?.importedAt ? new Date(meta.data.importedAt) : null
+
+ return (
+
+
+
+
+ {/* The atlas is only as good as its placement rate, so the page states
+ it rather than implying every spawner resolved to a named place. */}
+ {counts && (
+
+ {num(counts.creatures)} creatures across {num(counts.points)} spawners
+ {Number.isFinite(counts.unresolvedPoints) && counts.points
+ ? ` · ${Math.round(((counts.points - counts.unresolvedPoints) / counts.points) * 100)}% placed to a named region or landmark`
+ : ''}
+ {imported ? ` · parsed ${imported.toLocaleDateString()}` : ''}
+
+ )}
+
+
+ {TABS.map((t) => (
+ setTab(t.key)}>
+ {t.label}
+
+ ))}
+
+
+ {tab !== 'champions' && (
+
setInput(e.target.value)}
+ placeholder={tab === 'creatures' ? 'Search creatures…' : 'Search regions and landmarks…'}
+ style={{ width: '100%', marginBottom: 12 }}
+ />
+ )}
+
+ {facets.length > 0 && (
+
+ setFacet('')}>
+ All facets
+
+ {facets.map((f) => (
+ setFacet(f)}>
+ {f}
+
+ ))}
+
+ )}
+
+ {meta.error &&
}
+ {!meta.error && !meta.loading && !imported && (
+
The spawn atlas has not been imported yet.
+ )}
+
+ {!meta.error && imported && (
+ <>
+ {tab === 'creatures' &&
}
+ {tab === 'champions' &&
}
+ {tab === 'places' &&
}
+ >
+ )}
+
+
+ )
+}
diff --git a/client/src/routes/public/AtlasCreature.jsx b/client/src/routes/public/AtlasCreature.jsx
new file mode 100644
index 0000000..d479067
--- /dev/null
+++ b/client/src/routes/public/AtlasCreature.jsx
@@ -0,0 +1,201 @@
+import { useMemo, useState } from 'react'
+import { Link, useParams } from 'react-router-dom'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState, EmptyState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { api } from '../../api/client.js'
+
+// One creature: where it spawns, and what spawns alongside it.
+//
+// `places` is the point of the page — the aggregate that turns 62 raw
+// coordinates into "Shrines, Isamu-Jima, Yew". The individual spawners are
+// available underneath for the reader who actually wants a coordinate, but they
+// are secondary and collapsed by default.
+
+const num = (v) => (Number.isFinite(v) ? v.toLocaleString() : '—')
+
+// Spawn delays are stored in seconds. A raw "1200" tells the reader nothing.
+function delay(min, max) {
+ const fmt = (s) => (s >= 60 ? `${Math.round(s / 60)}m` : `${s}s`)
+ if (!Number.isFinite(min) || !Number.isFinite(max)) return null
+ if (min === max) return fmt(min)
+ return `${fmt(min)}–${fmt(max)}`
+}
+
+function Panel({ title, right, children }) {
+ return (
+
+
+
+ {title}
+
+ {right}
+
+ {children}
+
+ )
+}
+
+function Places({ places }) {
+ if (places.length === 0) {
+ return No placed spawners.
+ }
+ return (
+
+ {places.map((place) => (
+
+ {place.label}
+
+ {place.facet} · {num(place.spawners)} spawner{place.spawners === 1 ? '' : 's'} · up to{' '}
+ {num(place.maxAlive)} at once
+
+
+ ))}
+
+ )
+}
+
+function Spawners({ spawners, truncated }) {
+ const [open, setOpen] = useState(false)
+ if (spawners.length === 0) return null
+ return (
+ setOpen((v) => !v)}
+ style={{ background: 'none', border: 'none', color: 'var(--accent)', cursor: 'pointer', fontSize: '0.78rem' }}
+ >
+ {open ? 'Hide' : `Show ${num(spawners.length)}`}
+
+ }
+ >
+ {open && (
+
+
+
+
+ Place
+ Facet
+ Coords
+ Max
+ Respawn
+
+
+
+ {spawners.map((s) => (
+
+ {s.label}
+ {s.facet}
+ {s.x}, {s.y}
+ {num(s.maxCount)}
+ {delay(s.minDelay, s.maxDelay) || '—'}
+
+ ))}
+
+
+ {truncated && (
+
+ Only the largest spawners are listed.
+
+ )}
+
+ )}
+
+ )
+}
+
+export default function AtlasCreature() {
+ const { slug } = useParams()
+ const { loading, error, data } = useAsync(() => api.atlas.creature(slug), [slug])
+
+ // A 404 here means "no such creature in this atlas", which is a real answer
+ // and not a failure — a visitor following a stale link deserves to be told
+ // that plainly rather than shown a generic error box.
+ const missing = error?.status === 404 || error?.message === 'Not Found'
+
+ const facets = useMemo(
+ () => Object.entries(data?.facets || {}).sort((a, b) => b[1] - a[1]),
+ [data],
+ )
+
+ return (
+
+
+
+
+ ← Spawn atlas
+
+
+
+ {loading &&
}
+ {error && !missing &&
}
+ {missing &&
Nothing by that name spawns on this shard. }
+
+ {!loading && !error && data && (
+ <>
+
+
+
+
+ {facets.map(([facet, n]) => `${facet} (${n})`).join(' · ')}
+
+ }
+ >
+
+
+
+
+
+ {data.alsoHere?.length > 0 && (
+
+
+ {data.alsoHere.map((other) => (
+
+ {other.name} ×{num(other.shared)}
+
+ ))}
+
+
+ )}
+
+ >
+ )}
+
+
+ )
+}
diff --git a/client/src/routes/public/Leaderboards.jsx b/client/src/routes/public/Leaderboards.jsx
new file mode 100644
index 0000000..fc432b9
--- /dev/null
+++ b/client/src/routes/public/Leaderboards.jsx
@@ -0,0 +1,240 @@
+import { useMemo, useState } from 'react'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { useShardFeed } from '../../lib/useShardFeed.js'
+import { api } from '../../api/client.js'
+import { useSite } from '../../contexts/SiteContext.jsx'
+
+// Points / loyalty leaderboards (Protocol 3.0 §7). The shard carries ~25 separate
+// point currencies — Queen's Loyalty, Void Pool, Clean Up Britannia, the nine city
+// loyalties, the Doom/Khaldun/Kotl treasure systems — every one of them a standing
+// players build over months, and none of them visible anywhere but an in-game gump
+// until now.
+//
+// Loaded from /public/shard/points, then kept current from the live feed. Unlike
+// the ruleset (one frame = the whole thing), a points.board frame describes ONE
+// system, so live frames are merged over the fetched set by system key rather than
+// replacing it.
+const POINTS_KINDS = new Set(['points.board'])
+
+// A board's display name may arrive as a literal (`nameString`), a cliloc id
+// (`nameNumber`), or both — Name is a ServUO TextDefinition. We have no cliloc
+// table on the site, so a cliloc-only board falls back to humanising its own
+// PointsType key, which is already close to a display name ("CleanUpBritannia" →
+// "Clean Up Britannia"). Better than showing a bare number.
+const humanise = (key) =>
+ String(key || '')
+ .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+ .replace(/^./, (c) => c.toUpperCase())
+
+const boardTitle = (b) => b.nameString || humanise(b.system)
+
+const num = (v) => (Number.isFinite(v) ? v.toLocaleString() : '—')
+
+// Merge live frames over the fetched boards. Newest frame per system wins; a
+// system that has never appeared in either is simply absent.
+function mergeBoards(fetched, events) {
+ const bySystem = new Map()
+ for (const b of Array.isArray(fetched) ? fetched : []) {
+ if (b && b.system) bySystem.set(b.system, b)
+ }
+ // Events arrive newest-first, so walk backwards and let the newest land last.
+ for (let i = events.length - 1; i >= 0; i--) {
+ const ev = events[i]
+ if (ev && ev.system) bySystem.set(ev.system, ev)
+ }
+ return [...bySystem.values()].sort((a, b) => boardTitle(a).localeCompare(boardTitle(b)))
+}
+
+function Medal({ rank }) {
+ // Gold / silver / bronze for the podium, plain for the rest.
+ const tone = rank === 1 ? '#c9a24b' : rank === 2 ? '#b6bcc6' : rank === 3 ? '#b3805a' : 'var(--muted)'
+ return (
+
+ {rank}
+
+ )
+}
+
+// One ranked player. `name` is absent rather than empty when an admin has gated
+// the leaderboards `name` field above this viewer's rung — the row still renders,
+// because the standing itself is the point.
+function Entry({ entry, best }) {
+ const pct = best > 0 ? Math.max(2, Math.round((entry.points / best) * 100)) : 0
+ return (
+
+
+
+
+
+ {entry.name || 'Name hidden'}
+
+
+ {num(entry.points)}
+
+
+
+
+
+ )
+}
+
+function Board({ board }) {
+ const { siteTitle } = useSite()
+ const top = Array.isArray(board.top) ? board.top : []
+ // Bars are relative to the board leader, not to maxPoints: most systems have no
+ // cap (maxPoints 0), and where there is one the leader is often nowhere near it,
+ // which would render every bar as a stub.
+ const best = top.reduce((m, e) => Math.max(m, e.points || 0), 0)
+
+ return (
+
+
+
+ {boardTitle(board)}
+
+ {Number.isFinite(board.players) && (
+
+ {num(board.players)} ranked
+
+ )}
+
+
+ {top.length === 0 ? (
+ // A board nobody has scored on still gets a row, so the page reads as a set
+ // of standings waiting to be filled rather than a stack of blanks. It is
+ // deliberately NOT shaped like an Entry — no medal, no bar, an em dash where
+ // a score goes — because a placeholder that looked like a real standing would
+ // be a fabricated one. The first real entry replaces it.
+
+
+
+ {siteTitle}
+
+ —
+
+
+ Nobody has earned points here yet.
+
+
+ ) : (
+
+ {top.map((entry) => (
+
+ ))}
+
+ )}
+
+ {Number.isFinite(board.maxPoints) && board.maxPoints > 0 && (
+
+ Maximum {num(board.maxPoints)} points
+
+ )}
+
+ )
+}
+
+export default function Leaderboards() {
+ const { loading, error, data } = useAsync(() => api.shard.points())
+ // Buffer generously: a single sweep can emit a frame for every system at once,
+ // and a board dropped from the buffer would silently revert to its fetched copy.
+ const { events, connected } = useShardFeed({ filter: POINTS_KINDS, max: 60 })
+ const [query, setQuery] = useState('')
+
+ const boards = useMemo(() => mergeBoards(data, events), [data, events])
+
+ const shown = useMemo(() => {
+ const q = query.trim().toLowerCase()
+ if (!q) return boards
+ // Match the board name, the raw system key, or any ranked player on it — the
+ // last is what makes the filter useful ("where do I appear?").
+ return boards.filter(
+ (b) =>
+ boardTitle(b).toLowerCase().includes(q) ||
+ String(b.system).toLowerCase().includes(q) ||
+ (b.top || []).some((e) => e.name && e.name.toLowerCase().includes(q)),
+ )
+ }, [boards, query])
+
+ return (
+
+
+
+
+
+
+ {connected ? 'Live' : 'Offline'}
+
+
+
+ {loading &&
}
+ {error &&
}
+
+ {!loading && !error && boards.length === 0 && (
+
+
+ The shard has not published any leaderboards yet.
+
+
+ )}
+
+ {!loading && !error && boards.length > 0 && (
+ <>
+
setQuery(e.target.value)}
+ placeholder="Filter by board or player name…"
+ aria-label="Filter leaderboards"
+ style={{ maxWidth: 340, marginBottom: 14 }}
+ />
+
+ {shown.length === 0 ? (
+
No board or ranked player matches “{query}”.
+ ) : (
+
+ {shown.map((board) => (
+
+ ))}
+
+ )}
+ >
+ )}
+
+
+ )
+}
diff --git a/client/src/routes/public/Market.jsx b/client/src/routes/public/Market.jsx
new file mode 100644
index 0000000..612cf17
--- /dev/null
+++ b/client/src/routes/public/Market.jsx
@@ -0,0 +1,325 @@
+import { useCallback, useEffect, useState } from 'react'
+import { Link } from 'react-router-dom'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState, EmptyState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { api } from '../../api/client.js'
+
+// ── The player-vendor marketplace ───────────────────────────────────────────
+//
+// What every player vendor on the shard is selling, for how much, and where it
+// is standing — the same index the in-game Vendor Search gump reads, honouring
+// the same per-vendor opt-out, reachable without logging in to the game.
+//
+// Three things this page must be honest about, all of them consequences of how
+// the data is gathered (docs/link/v3.md §8):
+//
+// • **The prices are not live.** The shard sweeps vendors round-robin, so a
+// shop can be a full cycle behind. The banner says how far, from `staleAt`.
+// A page that implied live prices would send people across the world to a
+// vendor whose item sold twenty minutes ago.
+// • **A shop can be truncated.** A commodity reseller with thousands of stacks
+// publishes only the first N, and saying so beats presenting a partial shop
+// as complete.
+// • **An item may have no name.** On a shard whose operator has not converted
+// a cliloc table, `displayName` is null and the honest render is the item id
+// — not an invented name.
+//
+// There is deliberately no live feed here. The market feature's SSE stream ships
+// disabled: a firehose of whole vendor inventories would be the site's single
+// biggest bandwidth consumer, and nothing on this page needs it.
+
+const PAGE = 50
+
+const num = (v) => (Number.isFinite(Number(v)) ? Number(v).toLocaleString() : '—')
+
+const SORTS = [
+ { key: 'price_asc', label: 'Cheapest' },
+ { key: 'price_desc', label: 'Priciest' },
+ { key: 'recent', label: 'Recently seen' },
+]
+
+// How old the index may be, in words. `staleAt` is the OLDEST vendor row, so
+// this is a worst case rather than an average — which is the number worth
+// showing, because the one stale shop is the one that wastes a trip.
+function staleness(staleAt) {
+ if (!staleAt) return null
+ const ms = Date.now() - new Date(staleAt).getTime()
+ if (!Number.isFinite(ms) || ms < 0) return null
+ const mins = Math.round(ms / 60000)
+ if (mins < 1) return 'just now'
+ if (mins < 60) return `${mins} minute${mins === 1 ? '' : 's'} ago`
+ const hours = Math.round(mins / 60)
+ if (hours < 48) return `${hours} hour${hours === 1 ? '' : 's'} ago`
+ return `${Math.round(hours / 24)} days ago`
+}
+
+// The item's name, or an honest statement that we do not have one. Never a
+// fabricated label — "Item 3922" would be indistinguishable from a real name.
+const itemLabel = (l) => l.displayName || l.name || `id ${l.itemId}`
+
+function Chip({ active, onClick, children }) {
+ return (
+
+ {children}
+
+ )
+}
+
+function ListingRow({ listing }) {
+ const v = listing.vendor || {}
+ // `location` is one field the admin can gate away wholesale, so everything
+ // that reads from it has to tolerate its absence rather than assuming a map.
+ const loc = v.location || null
+ const where = loc ? [loc.region, loc.map].filter(Boolean).join(', ') : null
+
+ return (
+
+
+
+ {listing.amount > 1 ? `${num(listing.amount)} × ` : ''}
+ {itemLabel(listing)}
+
+
+ {v.serial ? (
+
+ {v.shopName || 'an unnamed shop'}
+
+ ) : (
+ v.shopName || 'an unnamed shop'
+ )}
+ {v.ownerName ? ` · ${v.ownerName}` : ''}
+ {where ? ` · ${where}` : ''}
+ {/* Priced by the container it sits in, exactly as the in-game search
+ reports it — the price buys the whole container, not this item. */}
+ {listing.child ? ' · sold with its container' : ''}
+
+
+
+
{num(listing.price)}
+
gold
+
+
+ )
+}
+
+export default function Market() {
+ const [input, setInput] = useState('')
+ const [q, setQ] = useState('')
+ const [map, setMap] = useState('')
+ const [region, setRegion] = useState('')
+ const [sort, setSort] = useState('price_asc')
+ const [minPrice, setMinPrice] = useState('')
+ const [maxPrice, setMaxPrice] = useState('')
+ // Applied prices are separate from the typed ones so the search fires when the
+ // user is done, not on every digit of "250000".
+ const [prices, setPrices] = useState({ min: '', max: '' })
+
+ const [state, setState] = useState({ loading: true, error: null, listings: [], total: 0, staleAt: null })
+ const [more, setMore] = useState(false)
+
+ const meta = useAsync(() => api.shard.marketMeta())
+
+ // Debounced: typing "vanquishing" should be one request, not eleven — and the
+ // endpoint is rate-limited, so an undebounced box would 429 a fast typist.
+ useEffect(() => {
+ const timer = setTimeout(() => setQ(input.trim()), 300)
+ return () => clearTimeout(timer)
+ }, [input])
+
+ useEffect(() => {
+ const timer = setTimeout(() => setPrices({ min: minPrice, max: maxPrice }), 500)
+ return () => clearTimeout(timer)
+ }, [minPrice, maxPrice])
+
+ const load = useCallback(
+ (offset) =>
+ api.shard.market({
+ q,
+ map,
+ region,
+ sort,
+ minPrice: prices.min,
+ maxPrice: prices.max,
+ limit: PAGE,
+ offset,
+ }),
+ [q, map, region, sort, prices],
+ )
+
+ useEffect(() => {
+ let alive = true
+ setState({ loading: true, error: null, listings: [], total: 0, staleAt: null })
+ load(0)
+ .then((page) => {
+ if (!alive) return
+ setState({
+ loading: false,
+ error: null,
+ listings: page.listings || [],
+ total: page.total || 0,
+ staleAt: page.staleAt || null,
+ })
+ })
+ .catch((error) => alive && setState({ loading: false, error, listings: [], total: 0, staleAt: null }))
+ return () => {
+ alive = false
+ }
+ }, [load])
+
+ const loadMore = async () => {
+ setMore(true)
+ try {
+ const page = await load(state.listings.length)
+ setState((s) => ({
+ ...s,
+ listings: [...s.listings, ...(page.listings || [])],
+ total: page.total ?? s.total,
+ staleAt: page.staleAt ?? s.staleAt,
+ }))
+ } catch {
+ // A failed "load more" leaves what is on screen alone; the button stays
+ // available to retry.
+ } finally {
+ setMore(false)
+ }
+ }
+
+ const maps = meta.data?.maps || []
+ const regions = meta.data?.regions || []
+ const age = staleness(state.staleAt)
+
+ return (
+
+
+
+
+ {/* Not decoration. The sweep is round-robin, so the index is inherently
+ up to one full cycle old and the page has to say so. */}
+ {age && (
+
+ Prices last refreshed {age}
+ {meta.data?.vendors ? ` · ${num(meta.data.vendors)} shops` : ''}
+ {meta.data?.items ? ` · ${num(meta.data.items)} listings` : ''}
+
+ )}
+
+
setInput(e.target.value)}
+ placeholder="Search listings…"
+ style={{ width: '100%', marginBottom: 10 }}
+ />
+
+
+ setMinPrice(e.target.value)}
+ placeholder="Min price"
+ style={{ maxWidth: 140 }}
+ />
+ setMaxPrice(e.target.value)}
+ placeholder="Max price"
+ style={{ maxWidth: 140 }}
+ />
+
+
+
+ {SORTS.map((s) => (
+ setSort(s.key)}>
+ {s.label}
+
+ ))}
+
+
+ {/* Facet and region names come from the shard's own data, never a list in
+ this file — a shard running custom maps gets its own names here with
+ no code change (docs/link/v3.md §6.1 R2). */}
+ {maps.length > 0 && (
+
+ setMap('')}>All facets
+ {maps.map((m) => (
+ setMap(m)}>{m}
+ ))}
+
+ )}
+
+ {regions.length > 0 && (
+
setRegion(e.target.value)}
+ style={{ width: '100%', marginBottom: 18 }}
+ >
+ Anywhere
+ {regions.map((r) => (
+ {r}
+ ))}
+
+ )}
+
+ {state.loading &&
}
+ {state.error &&
}
+
+ {!state.loading && !state.error && state.listings.length === 0 && (
+
+ {meta.data?.vendors
+ ? 'Nothing on the shard matches that.'
+ : 'No player vendors have been indexed yet.'}
+
+ )}
+
+ {!state.loading && !state.error && state.listings.length > 0 && (
+ <>
+
+ Showing {num(state.listings.length)} of {num(state.total)}
+
+
+ {state.listings.map((l) => (
+
+ ))}
+
+ {state.listings.length < state.total && (
+
+
+ {more ? 'Loading…' : 'Load more'}
+
+
+ )}
+ >
+ )}
+
+
+ )
+}
diff --git a/client/src/routes/public/MarketVendor.jsx b/client/src/routes/public/MarketVendor.jsx
new file mode 100644
index 0000000..7359b9e
--- /dev/null
+++ b/client/src/routes/public/MarketVendor.jsx
@@ -0,0 +1,102 @@
+import { Link, useParams } from 'react-router-dom'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState, EmptyState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { api } from '../../api/client.js'
+
+// One player vendor: where to find it and everything it is selling.
+//
+// The page a search result points at. Two states it has to render honestly and
+// which the search list cannot (docs/link/v3.md §8):
+//
+// • `truncated` — the shop holds more than the shard publishes per frame. A
+// commodity reseller with thousands of stacks is a real thing, and showing
+// 250 of 3,104 as if it were the whole shop would be a lie about the shard.
+// • a gated `location` — an admin may put vendor whereabouts behind a rung, in
+// which case there is nothing to render and the page says so rather than
+// showing an empty coordinate.
+
+const num = (v) => (Number.isFinite(Number(v)) ? Number(v).toLocaleString() : '—')
+
+const itemLabel = (i) => i.displayName || i.name || `id ${i.itemId}`
+
+export default function MarketVendor() {
+ const { serial } = useParams()
+ const { loading, error, data } = useAsync(() => api.shard.marketVendor(serial), [serial])
+
+ if (loading) {
+ return (
+
+
+
+ )
+ }
+
+ if (error || !data) {
+ return (
+
+
+
+
+ ← Back to the marketplace
+
+
+
+ )
+ }
+
+ const loc = data.location || null
+ const items = data.items || []
+
+ return (
+
+
+
+
+
+ {data.truncated
+ ? `Showing ${num(data.count)} of ${num(data.total)} listings — this shop holds more than the shard publishes.`
+ : `${num(data.total)} listing${data.total === 1 ? '' : 's'}`}
+ {data.updatedAt ? ` · last seen ${new Date(data.updatedAt).toLocaleString()}` : ''}
+
+
+ {items.length === 0 ? (
+
This shop has nothing priced for sale.
+ ) : (
+
+ {items.map((i) => (
+
+
+ {i.amount > 1 ? `${num(i.amount)} × ` : ''}
+ {itemLabel(i)}
+ {i.child ? · sold with its container : null}
+
+
+ {num(i.price)}
+
+
+ ))}
+
+ )}
+
+
+ ← Back to the marketplace
+
+
+
+ )
+}
diff --git a/client/src/routes/public/Rules.jsx b/client/src/routes/public/Rules.jsx
new file mode 100644
index 0000000..87618f6
--- /dev/null
+++ b/client/src/routes/public/Rules.jsx
@@ -0,0 +1,341 @@
+import { useMemo } from 'react'
+import PublicLayout from '../../components/PublicLayout.jsx'
+import PageHeader from '../../components/PageHeader.jsx'
+import { Loading, ErrorState } from '../../components/PageState.jsx'
+import { useAsync } from '../../lib/useAsync.js'
+import { useShardFeed } from '../../lib/useShardFeed.js'
+import { api } from '../../api/client.js'
+
+// The shard ruleset. Loaded from /public/shard/ruleset, replaced wholesale by any
+// world.ruleset frame on the live feed (the shard re-emits the entire ruleset, so
+// there is nothing to merge — latest wins).
+//
+// Everything on this page is published BY THE SHARD from its own Config/*.cfg, so
+// it cannot drift the way a hand-written rules page does. That is the whole point
+// of the feature, and the page says so.
+const RULESET_KINDS = new Set(['world.ruleset'])
+
+// Skill and stat caps arrive in tenths, the way ServUO stores them: 1000 is 100.0
+// skill. Showing the raw number would be actively misleading.
+const tenths = (v) => (Number.isFinite(v) ? (v / 10).toFixed(1) : null)
+
+const num = (v) => (Number.isFinite(v) ? v.toLocaleString() : null)
+
+const pct = (v) => (Number.isFinite(v) ? `${v}%` : null)
+
+// The systems block is a flat bag of booleans; these are their display names, and
+// the order here is the order they render. A key the shard sends that we don't
+// know about still renders, humanised, rather than being silently dropped — a new
+// plugin must not go invisible against an older client.
+const SYSTEM_LABELS = {
+ cityLoyalty: 'City Loyalty (governors)',
+ vvv: 'Vice vs Virtue',
+ factions: 'Factions',
+ siege: 'Siege ruleset',
+ chat: 'In-game chat',
+ store: 'Ultima Store',
+ dailyRares: 'Daily rares',
+ honesty: 'Honesty virtue',
+ shadowguard: 'Shadowguard',
+ treasureMaps: 'Treasure maps',
+ vetRewards: 'Veteran rewards',
+ testCenter: 'Test Center',
+}
+
+const humanise = (key) =>
+ key.replace(/([A-Z])/g, ' $1').replace(/^./, (c) => c.toUpperCase())
+
+function Panel({ title, children }) {
+ return (
+
+
+ {title}
+
+ {children}
+
+ )
+}
+
+// A label/value row. Rows whose value is null are dropped by the caller, so a
+// block never renders a dangling label for something the shard didn't publish.
+function Row({ label, value }) {
+ return (
+
+ {label}
+ {value}
+
+ )
+}
+
+function Rows({ items }) {
+ const rows = items.filter(([, value]) => value !== null && value !== undefined)
+ if (rows.length === 0) return null
+ return (
+
+ {rows.map(([label, value]) => (
+
+ ))}
+
+ )
+}
+
+function SystemPill({ label, on }) {
+ const color = on ? '#8fdcae' : 'var(--muted)'
+ return (
+
+
+ {label}
+
+ )
+}
+
+function Systems({ systems }) {
+ // Known keys first in their declared order, then anything the shard added that
+ // this build doesn't know about.
+ const known = Object.keys(SYSTEM_LABELS).filter((k) => k in systems)
+ const extra = Object.keys(systems).filter((k) => !(k in SYSTEM_LABELS))
+ const keys = [...known, ...extra]
+ if (keys.length === 0) return null
+ return (
+
+
+ {keys.map((k) => (
+
+ ))}
+
+
+ )
+}
+
+function Caps({ caps }) {
+ return (
+
+
+
+ )
+}
+
+function AccountsAndHousing({ accounts, housing, vetRewards }) {
+ const items = []
+ if (accounts) {
+ items.push(['Accounts per IP', num(accounts.perIp)])
+ items.push(['Character slots', num(accounts.charSlots)])
+ items.push([
+ 'In-game account creation',
+ accounts.autoCreate === undefined ? null : accounts.autoCreate ? 'Enabled' : 'Website only',
+ ])
+ }
+ if (housing) items.push(['Houses per account', num(housing.accountHouseLimit)])
+ if (vetRewards?.enabled) {
+ items.push(['Veteran reward interval', vetRewards.rewardIntervalDays
+ ? `${vetRewards.rewardIntervalDays} days`
+ : null])
+ }
+ if (items.length === 0) return null
+ return (
+
+
+
+ )
+}
+
+function Champions({ champions }) {
+ const t = champions.rankThresholds
+ return (
+
+ 0 ? t.join(' · ') : null,
+ ],
+ ]}
+ />
+
+ )
+}
+
+function Felucca({ loot }) {
+ return (
+
+
+
+ )
+}
+
+function Vendors({ vendors }) {
+ return (
+
+
+
+ )
+}
+
+function Pvp({ vvv }) {
+ return (
+
+
+
+ )
+}
+
+function Schedule({ schedule }) {
+ const items = []
+ if (schedule.autoSaveEnabled && schedule.autoSaveFrequencyMinutes) {
+ items.push(['World save', `every ${schedule.autoSaveFrequencyMinutes} min`])
+ } else if (schedule.autoSaveEnabled === false) {
+ items.push(['World save', 'Disabled'])
+ }
+ if (schedule.autoRestartEnabled) {
+ const h = String(schedule.autoRestartHour ?? 0).padStart(2, '0')
+ const m = String(schedule.autoRestartMinute ?? 0).padStart(2, '0')
+ items.push(['Automatic restart', `${h}:${m} server time`])
+ if (schedule.autoRestartFrequencyHours) {
+ items.push(['Restart interval', `every ${schedule.autoRestartFrequencyHours}h`])
+ }
+ }
+ if (items.length === 0) return null
+ return (
+
+
+
+ )
+}
+
+export default function Rules() {
+ const { loading, error, data } = useAsync(() => api.shard.ruleset())
+ const { events, connected } = useShardFeed({ filter: RULESET_KINDS, max: 4 })
+
+ // The newest world.ruleset on the feed wins outright over the fetched copy —
+ // the frame is a complete ruleset, not a delta.
+ const ruleset = useMemo(() => events[0] || data || null, [data, events])
+
+ return (
+
+
+
+
+
+
+ {connected ? 'Live' : 'Offline'}
+
+
+
+ {loading &&
}
+ {error &&
}
+
+ {!loading && !error && !ruleset && (
+
+
+ The shard has not published its ruleset yet.
+
+
+ )}
+
+ {!loading && !error && ruleset && (
+
+
+
+
+
+ {ruleset.systems &&
}
+ {ruleset.caps &&
}
+
+ {ruleset.champions &&
}
+ {ruleset.loot &&
}
+ {ruleset.vendors &&
}
+ {ruleset.vvv?.enabled &&
}
+ {ruleset.schedule &&
}
+
+ )}
+
+
+ )
+}
diff --git a/client/test/apiClient.test.js b/client/test/apiClient.test.js
index a5fda7c..03ea7dd 100644
--- a/client/test/apiClient.test.js
+++ b/client/test/apiClient.test.js
@@ -140,3 +140,44 @@ test('DELETE self-service session revoke encodes the id and uses the DELETE meth
assert.equal(calls[0].opts.method, 'DELETE')
assert.match(calls[0].url, /\/auth\/me\/sessions\/a%20b%2Fc$/)
})
+
+// ── spawn atlas (Protocol 3.0 Part C) ───────────────────────────────────
+// The atlas lives at /public/atlas, NOT under /public/shard: it is static shard
+// content parsed from the shard's own files, so it must not look sidecar-backed.
+// Asserted here because the split is a design decision, not an accident of
+// spelling.
+test('atlas reads hit /public/atlas, not /public/shard', async () => {
+ willReply({ body: { creatures: [] } })
+ await api.atlas.creatures()
+ assert.equal(calls[0].url, '/api/v1/public/atlas/creatures')
+})
+
+test('atlas.creatures() sends only the filters that are set', async () => {
+ willReply({ body: { creatures: [] } })
+ await api.atlas.creatures({ q: 'lizard man', facet: 'Ter Mur', limit: 25 })
+ const url = new URL(calls[0].url, 'http://x')
+ assert.equal(url.pathname, '/api/v1/public/atlas/creatures')
+ assert.equal(url.searchParams.get('q'), 'lizard man')
+ assert.equal(url.searchParams.get('facet'), 'Ter Mur')
+ assert.equal(url.searchParams.get('limit'), '25')
+ assert.equal(url.searchParams.get('offset'), null) // 0 is not sent
+})
+
+test('atlas.creature() encodes the slug and carries the facet filter through', async () => {
+ willReply({ body: {} })
+ await api.atlas.creature('lizardman/rare', { facet: 'Felucca' })
+ assert.match(calls[0].url, /\/public\/atlas\/creatures\/lizardman%2Frare\?facet=Felucca$/)
+})
+
+test('admin atlas actions use the right methods and bodies', async () => {
+ willReply({ body: {} })
+ await api.admin.atlas.import(true)
+ assert.equal(calls[0].url, '/api/v1/admin/shard/atlas/import')
+ assert.equal(calls[0].opts.method, 'POST')
+ assert.equal(calls[0].opts.body, JSON.stringify({ force: true }))
+
+ willReply({ body: {} })
+ await api.admin.atlas.setPath('/srv/servuo')
+ assert.equal(calls[1].opts.method, 'PUT')
+ assert.equal(calls[1].opts.body, JSON.stringify({ path: '/srv/servuo' }))
+})
diff --git a/server/db/data/spawnAtlas.art.example.json b/server/db/data/spawnAtlas.art.example.json
new file mode 100644
index 0000000..309108a
--- /dev/null
+++ b/server/db/data/spawnAtlas.art.example.json
@@ -0,0 +1,24 @@
+{
+ "_comment": [
+ "OPTIONAL operator-supplied creature art for the spawn atlas. Copy this file to",
+ "spawnAtlas.art.json (same directory) and edit it, then restart the server or run",
+ "`npm run atlas:import` — the art map is read on every atlas refresh.",
+ "",
+ "This project ships NO creature artwork and never will. UO sprites live in your",
+ "own client's .mul/.uop files and are yours to extract, not ours to redistribute.",
+ "If you want art on the atlas pages, export it yourself (UOFiddler, ClassicUO's",
+ "tooling, or any art extractor), drop the images under server/uploads/atlas/, and",
+ "map each creature slug to its file name here.",
+ "",
+ "Both spawnAtlas.art.json and server/uploads/ are gitignored, so neither the map",
+ "nor the images can be committed by accident.",
+ "",
+ "Keys are creature slugs, as reported by the atlas API and derived from the type",
+ "names in your own shard's Spawns/*.xml. Values are file names relative to",
+ "server/uploads/atlas/. Any creature with no entry here simply renders without",
+ "art — that is the default and fully supported state, not a degraded one."
+ ],
+ "lizardman": "lizardman.png",
+ "orc": "orc.png",
+ "dragon": "dragon.png"
+}
diff --git a/server/db/schema.sql b/server/db/schema.sql
index b8de326..a61a8bf 100644
--- a/server/db/schema.sql
+++ b/server/db/schema.sql
@@ -359,7 +359,7 @@ CREATE TABLE IF NOT EXISTS uo_link_config (
base_url VARCHAR(255) NULL,
ws_url VARCHAR(255) NULL,
auth_token_enc TEXT NULL,
- protocol INT NOT NULL DEFAULT 1,
+ protocol INT NOT NULL DEFAULT 3,
enabled TINYINT(1) NOT NULL DEFAULT 0,
status VARCHAR(20) NOT NULL DEFAULT 'disconnected',
status_detail VARCHAR(500) NULL,
@@ -597,6 +597,142 @@ CREATE TABLE IF NOT EXISTS shard_presence (
CONSTRAINT chk_shard_presence_singleton CHECK (id = 1)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+-- The shard's published ruleset (Protocol 3.0 world.ruleset). Singleton row
+-- (id = 1) holding the latest frame: expansion, which optional systems are on,
+-- skill/stat caps, account and house limits, champion scroll rules, the
+-- save/restart schedule. The shard re-emits it on every sidecar connect, so this
+-- row is simply overwritten; `rev` is the shard's own FNV-1a of the body, which
+-- distinguishes "same ruleset, re-sent on reconnect" from "an operator changed a
+-- .cfg". No row at all means the shard has never published one — served as null,
+-- which the rules page renders differently from a published ruleset.
+CREATE TABLE IF NOT EXISTS shard_ruleset (
+ id INT PRIMARY KEY DEFAULT 1,
+ rev VARCHAR(32) NULL,
+ expansion VARCHAR(16) NULL, -- hoisted for cheap display
+ payload JSON NOT NULL, -- the whole world.ruleset frame
+ t BIGINT NULL, -- frame time, epoch ms
+ updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+ CONSTRAINT chk_shard_ruleset_singleton CHECK (id = 1)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Points/loyalty leaderboards (Protocol 3.0 points.board). One row per point
+-- system, keyed by the shard's own PointsType name. The shard publishes ~25 of
+-- these (Queen's Loyalty, Void Pool, the nine city loyalties, …), each a standing
+-- players accumulate over months.
+--
+-- The top-N list stays inside `payload` rather than being normalized into a
+-- shard_points_entries table. It is a fixed-size list (10 by default) that is only
+-- ever read whole, exactly like shard_governors.candidates — normalizing it would
+-- buy nothing until something needs a per-character reverse lookup, and a
+-- character's own standings already ride inside char.profile instead.
+--
+-- No delete path: the shard's set of systems is fixed at startup, so there is no
+-- points.remove to mirror.
+CREATE TABLE IF NOT EXISTS shard_points_boards (
+ system VARCHAR(48) PRIMARY KEY, -- PointsType name, e.g. QueensLoyalty
+ name VARCHAR(128) NULL, -- resolved display name, if the shard sent a literal
+ name_cliloc INT NULL, -- cliloc id when the name is a TextDefinition number
+ max_points BIGINT NULL,
+ players INT NULL, -- players actually holding points in this system
+ show_on_gump TINYINT(1) NOT NULL DEFAULT 1, -- the shard's own "is this player-facing?" flag
+ payload JSON NOT NULL, -- the whole points.board frame, incl. `top`
+ t BIGINT NULL, -- frame time, epoch ms
+ updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Player-vendor market index (Protocol 3.0 vendor.listing). One row per player
+-- vendor and one per priced listing, so the site can offer the search the in-game
+-- Vendor Search gump offers — from outside the game.
+--
+-- The shard sweeps vendors round-robin and emits one AUTHORITATIVE frame per
+-- vendor, so ingest is delete-then-insert of that vendor's items inside one
+-- transaction (see shardMarket.db.js). No foreign key from items to vendors, in
+-- keeping with every other shard_* table: the ingest transaction is what keeps
+-- them consistent, and an FK would turn a malformed frame into a failed write
+-- rather than a dropped row.
+--
+-- Only vendors whose owner left the in-game Vendor Search flag ON are ever sent,
+-- so a player who hid their shop in game is hidden here too — see BridgeMarket.cs.
+CREATE TABLE IF NOT EXISTS shard_vendors (
+ serial VARCHAR(20) NOT NULL PRIMARY KEY, -- "0x40001234"
+ shop_name VARCHAR(160) NULL,
+ owner_serial VARCHAR(20) NULL,
+ owner_name VARCHAR(64) NULL,
+ map VARCHAR(40) NULL,
+ x INT NULL,
+ y INT NULL,
+ z INT NULL,
+ region VARCHAR(80) NULL,
+ house VARCHAR(160) NULL, -- the house SIGN's name, not the house type
+ item_count INT NOT NULL DEFAULT 0, -- listings published in the frame
+ item_total INT NOT NULL DEFAULT 0, -- listings the shop actually holds
+ truncated TINYINT(1) NOT NULL DEFAULT 0, -- item_total > item_count
+ t BIGINT NULL, -- frame time, epoch ms
+ updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+ INDEX idx_shard_vendors_owner (owner_name),
+ INDEX idx_shard_vendors_map (map),
+ INDEX idx_shard_vendors_region (region),
+ -- The market page's staleness banner is MIN(updated_at) over this column: the
+ -- round-robin sweep means the oldest row is how far behind the index can be.
+ INDEX idx_shard_vendors_updated (updated_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- One priced listing. Unlike the points board's top-N — a fixed-size list read
+-- whole — these are the searchable rows the whole feature exists for, so they are
+-- normalized rather than left inside a payload column, and there is no payload
+-- column on shard_vendors at all.
+--
+-- `display_name` is DENORMALIZED at ingest: the shard sends `cliloc` (the item's
+-- LabelNumber) and, rarely, a literal `name`, and resolving 50 clilocs per page
+-- at query time would make the cliloc table a join on the hot path AND make
+-- search-by-name impossible. Resolving once on write buys the index. It is
+-- re-resolved in bulk after a cliloc import, because the diff sweep will not
+-- re-send an unchanged shop just because the site learned what its items are
+-- called.
+CREATE TABLE IF NOT EXISTS shard_vendor_items (
+ id BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY,
+ vendor_serial VARCHAR(20) NOT NULL,
+ serial VARCHAR(20) NOT NULL,
+ item_id INT NOT NULL DEFAULT 0, -- ItemID (the art/graphic id)
+ hue INT NOT NULL DEFAULT 0,
+ amount INT NOT NULL DEFAULT 1,
+ price BIGINT NOT NULL DEFAULT 0,
+ name VARCHAR(160) NULL, -- the item's literal Name, null for most
+ cliloc INT NULL, -- LabelNumber, resolved against shard_clilocs
+ display_name VARCHAR(160) NULL, -- resolved at ingest; what search matches
+ child TINYINT(1) NOT NULL DEFAULT 0, -- priced by an enclosing container, not itself
+ INDEX idx_shard_vendor_items_vendor (vendor_serial),
+ INDEX idx_shard_vendor_items_price (price),
+ INDEX idx_shard_vendor_items_item (item_id),
+ INDEX idx_shard_vendor_items_name (display_name),
+ -- Search filters on name and sorts on price; the composite covers the common
+ -- "cheapest matching X" without a filesort over the whole table.
+ INDEX idx_shard_vendor_items_name_price (display_name, price)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Per-feature visibility for every shard-derived surface (Protocol 3.0). One row
+-- per feature; an absent row means "use the compiled default", and the compiled
+-- defaults reproduce the behavior that shipped before v3 — so an empty table is
+-- a no-op. See utils/shardVisibility.js for the catalog and the ladder, and
+-- docs/link/v3.md §3 for the contract.
+--
+-- audience the minimum rung on anonymous < logged_in < player < staff < admin
+-- stream whether this feature's kinds fan out over SSE at all (the market
+-- index ships with this off: no page needs a live firehose of
+-- whole vendor inventories)
+-- field_rules {"": ""} for SENSITIVE fields only. `acct` and
+-- `webId` are admin-only always and are rejected here — they are
+-- not in-game visible and are deliberately not configurable.
+CREATE TABLE IF NOT EXISTS shard_feature_visibility (
+ feature VARCHAR(48) NOT NULL PRIMARY KEY,
+ enabled TINYINT(1) NOT NULL DEFAULT 1,
+ audience VARCHAR(20) NOT NULL DEFAULT 'anonymous',
+ stream TINYINT(1) NOT NULL DEFAULT 1,
+ field_rules JSON NULL,
+ updated_by INT NULL,
+ updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
-- Admin email invites (Protocol 2.0 provisioning). A staff member invites someone
-- by email at a pre-chosen access level; the invitee accepts via a tokened link,
-- which creates their website user at that role (and optionally a linked game
@@ -999,6 +1135,189 @@ CREATE TABLE IF NOT EXISTS announce_jobs (
INDEX idx_announce_due_discord (discord_status, discord_next_attempt_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+-- ── Spawn atlas (Protocol 3.0 Part C) ───────────────────────────────────────
+-- Static shard CONTENT, not live shard state: what spawns where, which regions
+-- and landmarks exist, and which champion altars are configured. Nothing here
+-- comes from the sidecar — it is imported from a committed artifact built off a
+-- ServUO tree by `npm run atlas:build` (see docs/website/SPAWN_ATLAS.md), so
+-- these tables stay populated whether the shard is up or not.
+--
+-- Every table is import-owned: `npm run atlas:import` TRUNCATEs and reloads them
+-- in one transaction. Nothing else may write here, and nothing else may hold a
+-- foreign key to them. No FKs at all, consistent with every other shard_* table.
+
+-- One row per spawnable type, aggregated across the world. `total` is the sum of
+-- each type's own MX across every point that spawns it (how many exist at once);
+-- `facets` is a per-facet point count, so the facet filter and "where does this
+-- live" both answer without touching shard_spawn_points.
+CREATE TABLE IF NOT EXISTS shard_spawn_creatures (
+ slug VARCHAR(120) NOT NULL PRIMARY KEY, -- slugified class name; the /atlas/:slug key
+ name VARCHAR(120) NOT NULL, -- display spelling chosen by the build
+ total INT NOT NULL DEFAULT 0,
+ points INT NOT NULL DEFAULT 0,
+ facets JSON NULL, -- { "Felucca": 171, "Trammel": 160, ... }
+ -- Operator-supplied artwork, always NULL on a fresh import. The repo ships no
+ -- creature art: sprites live in the operator's own client .mul/.uop files and
+ -- are theirs to extract and place under uploads/atlas/. The UI renders without
+ -- art when this is NULL, which is the normal case.
+ art VARCHAR(255) NULL,
+ -- Plain INDEX, deliberately NOT FULLTEXT: ~800 rows makes a LIKE scan free,
+ -- and FULLTEXT's min-token-length would break searches for names like "orc".
+ INDEX idx_shard_spawn_creatures_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- One row per spawner. `region`/`landmark` are the resolved place name — the
+-- point-in-rect transform that turns "5411,1234" into "Despise" — and `label` is
+-- the resolved display string (region, else landmark, else 'Wilderness').
+CREATE TABLE IF NOT EXISTS shard_spawn_points (
+ id INT AUTO_INCREMENT PRIMARY KEY,
+ facet VARCHAR(40) NOT NULL,
+ name VARCHAR(120) NULL, -- the ServUO spawner's own name
+ x INT NOT NULL,
+ y INT NOT NULL,
+ width INT NOT NULL DEFAULT 0,
+ height INT NOT NULL DEFAULT 0,
+ spawn_range INT NOT NULL DEFAULT 0, -- `range` is reserved in MariaDB
+ max_count INT NOT NULL DEFAULT 0,
+ min_delay INT NOT NULL DEFAULT 0,
+ max_delay INT NOT NULL DEFAULT 0,
+ tod_start INT NOT NULL DEFAULT 0, -- meaningless unless tod_mode <> 0
+ tod_end INT NOT NULL DEFAULT 0,
+ tod_mode INT NOT NULL DEFAULT 0,
+ region VARCHAR(120) NULL,
+ landmark VARCHAR(120) NULL,
+ label VARCHAR(120) NOT NULL DEFAULT 'Wilderness',
+ INDEX idx_shard_spawn_points_facet (facet),
+ INDEX idx_shard_spawn_points_label (label)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- The many-to-many between the two above: one spawner commonly carries several
+-- types (a single Trammel point spawns six), each with its own max. This is how
+-- /atlas/creatures/:slug finds the places a creature appears.
+CREATE TABLE IF NOT EXISTS shard_spawn_point_types (
+ point_id INT NOT NULL,
+ slug VARCHAR(120) NOT NULL, -- → shard_spawn_creatures.slug (no FK)
+ max_count INT NOT NULL DEFAULT 1,
+ PRIMARY KEY (point_id, slug),
+ INDEX idx_shard_spawn_point_types_slug (slug)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Named regions from Data/Regions.xml, flattened out of their nesting. `rects`
+-- holds the region's rectangles; `priority` and rect area are what resolved each
+-- spawn point at build time, kept here so the admin drift check can re-derive.
+CREATE TABLE IF NOT EXISTS shard_regions (
+ id INT AUTO_INCREMENT PRIMARY KEY,
+ facet VARCHAR(40) NOT NULL,
+ name VARCHAR(120) NOT NULL,
+ type VARCHAR(80) NULL, -- ServUO region class
+ priority INT NOT NULL DEFAULT 0,
+ parent VARCHAR(120) NULL, -- enclosing named region, if any
+ rects JSON NULL,
+ INDEX idx_shard_regions_facet (facet),
+ INDEX idx_shard_regions_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Points of interest from Data/Locations/*.xml. `grp` is the innermost enclosing
+-- parent ("Covetous"), which is the label worth showing — "Covetous" reads
+-- better than the individual marker "Level 1". (`group` is reserved in SQL.)
+CREATE TABLE IF NOT EXISTS shard_landmarks (
+ id INT AUTO_INCREMENT PRIMARY KEY,
+ facet VARCHAR(40) NOT NULL,
+ name VARCHAR(120) NOT NULL,
+ grp VARCHAR(120) NULL,
+ x INT NOT NULL,
+ y INT NOT NULL,
+ z INT NOT NULL DEFAULT 0,
+ INDEX idx_shard_landmarks_facet (facet),
+ INDEX idx_shard_landmarks_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Configured champion altars from Config/ChampionSpawns.xml. This is static
+-- roster data ("there is an Unholy Terror altar in Deceit") and is distinct from
+-- the live champ.update feed in shard_champs ("it is on level 3 right now").
+CREATE TABLE IF NOT EXISTS shard_champion_spawns (
+ slug VARCHAR(160) NOT NULL PRIMARY KEY, -- facet-name, e.g. "felucca-deceit"
+ name VARCHAR(120) NOT NULL,
+ grp VARCHAR(80) NULL, -- spawn group; one active per group
+ type VARCHAR(80) NULL, -- '' when randomised per activation
+ random_type TINYINT(1) NOT NULL DEFAULT 0,
+ facet VARCHAR(40) NOT NULL,
+ x INT NOT NULL,
+ y INT NOT NULL,
+ z INT NOT NULL DEFAULT 0,
+ radius INT NOT NULL DEFAULT 0,
+ label VARCHAR(120) NULL, -- resolved place name
+ INDEX idx_shard_champion_spawns_facet (facet)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- UO's localization table: cliloc id -> display string. Items carry a
+-- `LabelNumber` rather than a name, so without this the site can only render
+-- `id 1023721` where the game shows "quarter staff". The shard has always sent
+-- the id (char.profile's `cliloc`, and one per marketplace listing) — the number
+-- was never the missing piece, the table was.
+--
+-- Sourced from a file the OPERATOR converts once from their own UO client and
+-- points the site at (docs/website/CLILOCS.md); nothing derived from the client
+-- is committed, the same rule the spawn atlas and the creature art map follow.
+-- A shard with no cliloc file configured simply renders item ids, which is what
+-- it did before this table existed.
+--
+-- `text` is TEXT, not VARCHAR: real tables top out around 12 KB for the long
+-- property descriptions, and truncating them silently would be worse than
+-- storing them. Item NAMES are all short — the index that matters for search is
+-- on the denormalized `shard_vendor_items.display_name`, not here.
+CREATE TABLE IF NOT EXISTS shard_clilocs (
+ number INT NOT NULL PRIMARY KEY,
+ flag SMALLINT NOT NULL DEFAULT 0,
+ text TEXT NOT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Singleton (id = 1) describing the cliloc table currently loaded: the source
+-- file, its sha256, the entry count and the parser version. The boot path
+-- compares the stored hash against the file on disk and skips the parse when
+-- they match, which is every restart that did not follow a client patch.
+CREATE TABLE IF NOT EXISTS shard_cliloc_meta (
+ id TINYINT NOT NULL PRIMARY KEY DEFAULT 1,
+ payload JSON NOT NULL,
+ imported_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+ CONSTRAINT chk_shard_cliloc_meta_singleton CHECK (id = 1)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Singleton (id = 1) describing the artifact currently loaded: when it was
+-- built, its counts, and a sha256 per ServUO source file. The admin drift check
+-- compares this against db/data/spawnAtlas.meta.json to report when the database
+-- is behind the committed artifact.
+CREATE TABLE IF NOT EXISTS shard_atlas_meta (
+ id TINYINT NOT NULL PRIMARY KEY DEFAULT 1,
+ payload JSON NOT NULL,
+ imported_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+ CONSTRAINT chk_shard_atlas_meta_singleton CHECK (id = 1)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Singleton (id = 1) holding an atlas refresh that was parsed but deliberately
+-- NOT applied, because it would remove a facet the site currently serves.
+--
+-- Losing a facet is the signature of a half-copied or mid-update ServUO tree as
+-- much as of a real map change, and boot cannot tell the two apart — so the
+-- refresh is staged here for a human instead of being applied. Startup is never
+-- blocked by it: the site comes up serving the atlas it already had.
+--
+-- Only the DECISION is stored, not the parsed world: `payload` holds the source
+-- hashes and the facet diff (a few KB), and approving re-parses the tree. That
+-- keeps a multi-megabyte blob out of the database and guarantees the applied
+-- atlas matches the tree as it is at approval time, not as it was at boot.
+--
+-- `rejected` is remembered against those exact source hashes so a declined
+-- refresh does not re-prompt on every restart; changing the tree changes the
+-- hashes and asks again.
+CREATE TABLE IF NOT EXISTS shard_atlas_pending (
+ id TINYINT NOT NULL PRIMARY KEY DEFAULT 1,
+ status ENUM('pending','rejected') NOT NULL DEFAULT 'pending',
+ payload JSON NOT NULL, -- source hashes + facet diff
+ detected_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+ CONSTRAINT chk_shard_atlas_pending_singleton CHECK (id = 1)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
-- Migrations for databases created before the wiki upgrade. Each statement uses
-- IF NOT EXISTS so re-running on every boot is a harmless no-op. New installs get
-- these columns from the CREATE TABLE above; existing installs get them here.
@@ -1078,3 +1397,19 @@ ALTER TABLE mobile_refresh_tokens ADD COLUMN IF NOT EXISTS last_used_at DATETIME
-- trust token. A boolean only — the token is returned over that app→server call
-- and never persisted here (only its sha256 lands in trusted_devices).
ALTER TABLE mobile_auth_sessions ADD COLUMN IF NOT EXISTS trust_device TINYINT(1) NOT NULL DEFAULT 0;
+
+-- Protocol 3.0 cutover: this build speaks wire protocol 3 (world.ruleset,
+-- points.board, vendor.listing), so the pinned version an existing install
+-- carries has to move with it — a 2 against a v3 sidecar 409s every REST call
+-- and closes the WS on ws.hello. MODIFY fixes the column default for installs
+-- created before the bump (idempotent, like the other MODIFYs here).
+ALTER TABLE uo_link_config MODIFY COLUMN protocol INT NOT NULL DEFAULT 3;
+-- The row itself is admin-editable, and schema.sql runs on EVERY boot, so this
+-- must be one-shot: an operator who deliberately pins an older sidecar in
+-- Admin → Shard has to stay pinned. The marker row in `settings` is what makes
+-- it fire once — written after the UPDATE, and on a fresh install (no
+-- uo_link_config row yet) it is simply written with nothing to update.
+UPDATE uo_link_config SET protocol = 3
+ WHERE id = 1 AND protocol < 3
+ AND NOT EXISTS (SELECT 1 FROM settings WHERE `key` = 'uo_link_protocol_3_migrated');
+INSERT IGNORE INTO settings (`key`, value) VALUES ('uo_link_protocol_3_migrated', '1');
diff --git a/server/package.json b/server/package.json
index 9f01910..9bc9042 100644
--- a/server/package.json
+++ b/server/package.json
@@ -9,6 +9,7 @@
"seed": "node db/seed.js",
"swagger": "node swagger/swagger.js",
"routes:manifest": "node scripts/routeManifest.js",
+ "atlas:import": "node scripts/importSpawnAtlas.js",
"test": "node --test"
},
"keywords": [
diff --git a/server/routes.guards.json b/server/routes.guards.json
index c1f4b2f..c7c6c5e 100644
--- a/server/routes.guards.json
+++ b/server/routes.guards.json
@@ -636,6 +636,55 @@
"requireAuth"
]
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/atlas",
+ "handlers": 2,
+ "gates": [
+ "noindex",
+ "requireAuth"
+ ]
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/approve",
+ "handlers": 2,
+ "gates": [
+ "noindex",
+ "requireAuth"
+ ]
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/import",
+ "handlers": 4,
+ "gates": [
+ "noindex",
+ "requireAuth",
+ "middleware",
+ "validate"
+ ]
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/atlas/path",
+ "handlers": 4,
+ "gates": [
+ "noindex",
+ "requireAuth",
+ "middleware",
+ "validate"
+ ]
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/reject",
+ "handlers": 2,
+ "gates": [
+ "noindex",
+ "requireAuth"
+ ]
+ },
{
"method": "GET",
"path": "/api/v1/admin/shard/audit",
@@ -678,6 +727,37 @@
"validate"
]
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/clilocs",
+ "handlers": 2,
+ "gates": [
+ "noindex",
+ "requireAuth"
+ ]
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/clilocs/import",
+ "handlers": 5,
+ "gates": [
+ "noindex",
+ "requireAuth",
+ "middleware",
+ "validate"
+ ]
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/clilocs/path",
+ "handlers": 4,
+ "gates": [
+ "noindex",
+ "requireAuth",
+ "middleware",
+ "validate"
+ ]
+ },
{
"method": "GET",
"path": "/api/v1/admin/shard/houses",
@@ -782,6 +862,26 @@
"validate"
]
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/visibility",
+ "handlers": 2,
+ "gates": [
+ "noindex",
+ "requireAuth"
+ ]
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/visibility",
+ "handlers": 4,
+ "gates": [
+ "noindex",
+ "requireAuth",
+ "middleware",
+ "validate"
+ ]
+ },
{
"method": "PUT",
"path": "/api/v1/admin/site-mode",
@@ -1761,6 +1861,64 @@
"validate"
]
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/champions",
+ "handlers": 5,
+ "gates": [
+ "middleware",
+ "validate",
+ "siteMode"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/creatures",
+ "handlers": 8,
+ "gates": [
+ "middleware",
+ "validate",
+ "siteMode"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/creatures/:slug",
+ "handlers": 7,
+ "gates": [
+ "middleware",
+ "validate",
+ "siteMode"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/landmarks",
+ "handlers": 6,
+ "gates": [
+ "middleware",
+ "validate",
+ "siteMode"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/meta",
+ "handlers": 3,
+ "gates": [
+ "siteMode"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/regions",
+ "handlers": 6,
+ "gates": [
+ "middleware",
+ "validate",
+ "siteMode"
+ ]
+ },
{
"method": "POST",
"path": "/api/v1/public/contact",
@@ -1809,22 +1967,28 @@
{
"method": "GET",
"path": "/api/v1/public/shard/champs",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/economy",
- "handlers": 3,
+ "handlers": 4,
"gates": [
"middleware",
"validate"
]
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/features",
+ "handlers": 1,
+ "gates": []
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/feed",
- "handlers": 4,
+ "handlers": 5,
"gates": [
"middleware",
"validate"
@@ -1833,13 +1997,13 @@
{
"method": "GET",
"path": "/api/v1/public/shard/governors",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/governors/:city/history",
- "handlers": 4,
+ "handlers": 5,
"gates": [
"middleware",
"validate"
@@ -1848,37 +2012,79 @@
{
"method": "GET",
"path": "/api/v1/public/shard/guilds",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/houses",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/idoc",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market",
+ "handlers": 13,
+ "gates": [
+ "middleware",
+ "validate"
+ ]
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market/meta",
+ "handlers": 2,
+ "gates": []
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market/vendors/:serial",
+ "handlers": 7,
+ "gates": [
+ "middleware",
+ "validate"
+ ]
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/online",
- "handlers": 1,
+ "handlers": 2,
+ "gates": []
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/points",
+ "handlers": 2,
+ "gates": []
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/points/:system",
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/presence",
- "handlers": 1,
+ "handlers": 2,
+ "gates": []
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/ruleset",
+ "handlers": 2,
"gates": []
},
{
"method": "GET",
"path": "/api/v1/public/shard/status",
- "handlers": 1,
+ "handlers": 2,
"gates": []
},
{
diff --git a/server/routes.manifest.json b/server/routes.manifest.json
index 63a0207..1692271 100644
--- a/server/routes.manifest.json
+++ b/server/routes.manifest.json
@@ -257,6 +257,26 @@
"method": "GET",
"path": "/api/v1/admin/shard/accounts"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/atlas"
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/approve"
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/import"
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/atlas/path"
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/atlas/reject"
+ },
{
"method": "GET",
"path": "/api/v1/admin/shard/audit"
@@ -273,6 +293,18 @@
"method": "GET",
"path": "/api/v1/admin/shard/char/:serial"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/clilocs"
+ },
+ {
+ "method": "POST",
+ "path": "/api/v1/admin/shard/clilocs/import"
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/clilocs/path"
+ },
{
"method": "GET",
"path": "/api/v1/admin/shard/houses"
@@ -313,6 +345,14 @@
"method": "GET",
"path": "/api/v1/admin/shard/vendors/:account"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/admin/shard/visibility"
+ },
+ {
+ "method": "PUT",
+ "path": "/api/v1/admin/shard/visibility"
+ },
{
"method": "PUT",
"path": "/api/v1/admin/site-mode"
@@ -705,6 +745,30 @@
"method": "GET",
"path": "/api/v1/player/shard/vendors/:account"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/champions"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/creatures"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/creatures/:slug"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/landmarks"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/meta"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/atlas/regions"
+ },
{
"method": "POST",
"path": "/api/v1/public/contact"
@@ -737,6 +801,10 @@
"method": "GET",
"path": "/api/v1/public/shard/economy"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/features"
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/feed"
@@ -761,14 +829,38 @@
"method": "GET",
"path": "/api/v1/public/shard/idoc"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market/meta"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/market/vendors/:serial"
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/online"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/points"
+ },
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/points/:system"
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/presence"
},
+ {
+ "method": "GET",
+ "path": "/api/v1/public/shard/ruleset"
+ },
{
"method": "GET",
"path": "/api/v1/public/shard/status"
diff --git a/server/scripts/importSpawnAtlas.js b/server/scripts/importSpawnAtlas.js
new file mode 100644
index 0000000..b9ecbb8
--- /dev/null
+++ b/server/scripts/importSpawnAtlas.js
@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+//
+// Refresh the spawn atlas from a ServUO tree, from the command line.
+//
+// npm run atlas:import # use the configured path
+// npm run atlas:import -- --servuo # override it for this run
+// npm run atlas:import -- --force # reimport even if unchanged
+// npm run atlas:import -- --approve # apply a staged refresh
+// npm run atlas:import -- --status # report without changing anything
+//
+// The server does this itself on every boot (see `shardAtlas.refreshOnBoot`), so
+// this is for operators who want to apply a map change without a restart, and
+// for approving a refresh that was staged because it would remove a facet.
+//
+// All the logic lives in `src/model/shardAtlas/shardAtlas.model.js`; this file
+// is argument parsing and output formatting.
+
+const db = () => require('../src/utils/db')
+
+function parseArgs(argv) {
+ const args = {}
+ for (let i = 0; i < argv.length; i += 1) {
+ const flag = argv[i]
+ if (flag === '--servuo') args.servuo = argv[++i]
+ else if (flag === '--force') args.force = true
+ else if (flag === '--approve') args.approve = true
+ else if (flag === '--reject') args.reject = true
+ else if (flag === '--status') args.status = true
+ else if (flag === '--help' || flag === '-h') args.help = true
+ }
+ return args
+}
+
+const USAGE = `
+Refresh the spawn atlas from a ServUO tree.
+
+ node scripts/importSpawnAtlas.js [options]
+
+ --servuo Use this tree for this run instead of the configured path.
+ --force Reimport even when the source files are unchanged.
+ --approve Apply a refresh that was staged for removing a facet.
+ --reject Keep the current atlas and dismiss the staged refresh.
+ --status Report atlas and source state; change nothing.
+
+With no options this imports only if the tree differs from what is loaded.
+`
+
+function describe(result) {
+ switch (result.status) {
+ case 'skipped':
+ return (
+ 'No ServUO path configured — nothing to import.\n' +
+ 'Set one with SERVUO_PATH, the admin panel, or --servuo .\n'
+ )
+ case 'unavailable':
+ return `ServUO tree unavailable: ${result.reason}\n`
+ case 'unchanged':
+ return `Atlas is already up to date${result.reason ? ` (${result.reason})` : ''}.\n`
+ case 'needsReview': {
+ return (
+ 'Refresh NOT applied — it would remove ' +
+ `${result.removedFacets.length} facet(s): ${result.removedFacets.join(', ')}.\n` +
+ 'This is what a half-copied or mid-update tree looks like, so it has been\n' +
+ 'staged for review. The current atlas is unchanged.\n' +
+ 'Apply it with --approve, or dismiss it with --reject.\n'
+ )
+ }
+ case 'imported': {
+ const c = result.counts
+ const added = result.addedFacets?.length ? ` Added facets: ${result.addedFacets.join(', ')}.` : ''
+ const removed = result.removedFacets?.length
+ ? ` Removed facets: ${result.removedFacets.join(', ')}.`
+ : ''
+ return (
+ `Atlas imported: ${c.points} points, ${c.creatures} creatures, ` +
+ `${c.pointTypes} point/type rows, ${c.regions} regions, ` +
+ `${c.landmarks} landmarks, ${c.champions} champion altars.${added}${removed}\n`
+ )
+ }
+ case 'failed':
+ return `Atlas refresh failed: ${result.reason}\n`
+ default:
+ return `${JSON.stringify(result, null, 2)}\n`
+ }
+}
+
+async function main() {
+ const args = parseArgs(process.argv.slice(2))
+ if (args.help) {
+ process.stdout.write(USAGE)
+ return
+ }
+
+ const shardAtlas = require('../src/model/shardAtlas/shardAtlas.model')
+
+ // `--servuo` is a per-run override and deliberately does NOT persist to the
+ // configured path; changing where the atlas permanently reads from is an
+ // admin action, not a side effect of a one-off import.
+ const override = { path: args.servuo ?? '' }
+
+ if (args.status) {
+ process.stdout.write(`${JSON.stringify(await shardAtlas.status(override), null, 2)}\n`)
+ return
+ }
+ if (args.reject) {
+ process.stdout.write(`${JSON.stringify(await shardAtlas.rejectPending(), null, 2)}\n`)
+ return
+ }
+
+ const result = args.approve
+ ? await shardAtlas.approvePending(override)
+ : await shardAtlas.refresh({ ...override, force: Boolean(args.force) })
+
+ process.stdout.write(describe(result))
+ if (result.status === 'failed') process.exitCode = 1
+}
+
+if (require.main === module) {
+ main()
+ .catch((err) => {
+ process.stderr.write(`atlas:import failed: ${err.message}\n`)
+ process.exitCode = 1
+ })
+ .finally(() => db().close())
+}
+
+module.exports = { describe, parseArgs }
diff --git a/server/src/middleware/rateLimit.js b/server/src/middleware/rateLimit.js
index 33ab13f..7821694 100644
--- a/server/src/middleware/rateLimit.js
+++ b/server/src/middleware/rateLimit.js
@@ -118,6 +118,19 @@ const passwordResetConfirmLimiter = makeLimiter({
message: 'Too many attempts. Please try again later.',
})
+// The player-vendor market search. The first genuinely expensive PUBLIC endpoint
+// on the site: every call is a LIKE scan plus a COUNT over the listings table,
+// which on a large shard is the biggest table there is, and it is anonymous by
+// default. Generous for a human browsing shops (a typed search is debounced to
+// one request, and paging is a click), tight enough that it cannot be used as a
+// cheap way to load the database.
+const marketLimiter = makeLimiter({
+ windowMs: 60 * 1000,
+ max: 60,
+ label: 'market',
+ message: 'Too many searches. Please slow down.',
+})
+
// CSP violation reports. Unauthenticated by necessity (browsers send them with no
// session), and every accepted report writes a log line — so an attacker who can get
// a victim to load a page could otherwise use it as a log-flood amplifier. Generous
@@ -141,5 +154,6 @@ module.exports = {
mobileSsoExchangeLimiter,
passwordResetRequestLimiter,
passwordResetConfirmLimiter,
+ marketLimiter,
cspReportLimiter,
}
diff --git a/server/src/model/settings/settings.model.js b/server/src/model/settings/settings.model.js
index 979d8b2..6c4b61e 100644
--- a/server/src/model/settings/settings.model.js
+++ b/server/src/model/settings/settings.model.js
@@ -70,6 +70,24 @@ async function isMobileAppLinksEnabled() {
}
}
+/**
+ * This instance's name, resolved exactly as `getPublic().brand.name` resolves it —
+ * the admin-editable site title wins over BRAND_NAME. Anything that has to *speak*
+ * the instance's name outside the settings payload must use this rather than
+ * `brand.name`, or an install that set only the site title gets two different names
+ * on two different pages.
+ *
+ * Never throws: a name is always better than an error, so a DB fault falls back to
+ * the env value.
+ */
+async function getInstanceName() {
+ try {
+ return (await settingsDb.get('site_title')) || brand.name
+ } catch {
+ return brand.name
+ }
+}
+
async function get(key) {
return settingsDb.get(key)
}
@@ -154,6 +172,7 @@ module.exports = {
setMany,
getAll,
getPublic,
+ getInstanceName,
PUBLIC_KEYS,
REGISTRATION_KEY,
REGISTRATION_MODES,
diff --git a/server/src/model/shardAtlas/shardAtlas.db.js b/server/src/model/shardAtlas/shardAtlas.db.js
new file mode 100644
index 0000000..ae05106
--- /dev/null
+++ b/server/src/model/shardAtlas/shardAtlas.db.js
@@ -0,0 +1,390 @@
+const { pool, query } = require('../../utils/db')
+
+// Raw SQL for the spawn atlas. Every table here is IMPORT-OWNED: `replaceAtlas`
+// empties and refills all six inside one transaction, and nothing else in the
+// codebase writes to them. There are no foreign keys, consistent with every
+// other shard_* table.
+
+const BATCH = 500
+
+const ATLAS_TABLES = [
+ 'shard_spawn_point_types',
+ 'shard_spawn_points',
+ 'shard_spawn_creatures',
+ 'shard_regions',
+ 'shard_landmarks',
+ 'shard_champion_spawns',
+]
+
+async function insertBatched(conn, sql, rows) {
+ for (let i = 0; i < rows.length; i += BATCH) {
+ await conn.batch(sql, rows.slice(i, i + BATCH))
+ }
+ return rows.length
+}
+
+/**
+ * Replace the entire atlas in one transaction.
+ *
+ * All-or-nothing on purpose: a failed reload must leave the previous atlas
+ * intact rather than a half-loaded world, since a partially-imported atlas is
+ * indistinguishable from a real one to anyone reading it.
+ *
+ * `DELETE`, not `TRUNCATE` — `TRUNCATE` is DDL in MariaDB and implicitly
+ * commits, which would defeat exactly that guarantee. At ~7k rows the cost of
+ * `DELETE` is irrelevant.
+ */
+async function replaceAtlas(atlas, art = {}) {
+ const conn = await pool.getConnection()
+ const counts = {}
+ try {
+ await conn.beginTransaction()
+
+ for (const table of ATLAS_TABLES) await conn.query(`DELETE FROM ${table}`)
+
+ counts.creatures = await insertBatched(
+ conn,
+ 'INSERT INTO shard_spawn_creatures (slug, name, total, points, facets, art) VALUES (?,?,?,?,?,?)',
+ atlas.creatures.map((c) => [
+ c.slug,
+ c.name,
+ c.total ?? 0,
+ c.points ?? 0,
+ JSON.stringify(c.facets ?? {}),
+ art[c.slug] ?? null,
+ ]),
+ )
+
+ counts.regions = await insertBatched(
+ conn,
+ 'INSERT INTO shard_regions (facet, name, type, priority, parent, rects) VALUES (?,?,?,?,?,?)',
+ atlas.regions.map((r) => [
+ r.facet,
+ r.name,
+ r.type || null,
+ r.priority ?? 0,
+ r.parent || null,
+ JSON.stringify(r.rects ?? []),
+ ]),
+ )
+
+ counts.landmarks = await insertBatched(
+ conn,
+ 'INSERT INTO shard_landmarks (facet, name, grp, x, y, z) VALUES (?,?,?,?,?,?)',
+ atlas.landmarks.map((l) => [
+ l.facet,
+ l.name,
+ l.group || null,
+ l.x ?? 0,
+ l.y ?? 0,
+ l.z ?? 0,
+ ]),
+ )
+
+ counts.champions = await insertBatched(
+ conn,
+ 'INSERT INTO shard_champion_spawns ' +
+ '(slug, name, grp, type, random_type, facet, x, y, z, radius, label) ' +
+ 'VALUES (?,?,?,?,?,?,?,?,?,?,?)',
+ atlas.champions.map((c) => [
+ c.slug,
+ c.name,
+ c.group || null,
+ c.type || null,
+ c.randomType ? 1 : 0,
+ c.facet,
+ c.x ?? 0,
+ c.y ?? 0,
+ c.z ?? 0,
+ c.radius ?? 0,
+ c.label || null,
+ ]),
+ )
+
+ // Point ids are assigned explicitly rather than left to AUTO_INCREMENT: the
+ // join rows need to know them and `conn.batch()` reports no usable insertId
+ // for a multi-row insert. Safe because this transaction just emptied the
+ // table and nothing else writes to it.
+ counts.points = await insertBatched(
+ conn,
+ 'INSERT INTO shard_spawn_points ' +
+ '(id, facet, name, x, y, width, height, spawn_range, max_count, min_delay, max_delay, ' +
+ 'tod_start, tod_end, tod_mode, region, landmark, label) ' +
+ 'VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)',
+ atlas.points.map((p, i) => [
+ i + 1,
+ p.facet,
+ p.name,
+ p.x,
+ p.y,
+ p.width ?? 0,
+ p.height ?? 0,
+ p.range ?? 0,
+ p.maxCount ?? 0,
+ p.minDelay ?? 0,
+ p.maxDelay ?? 0,
+ p.todStart ?? 0,
+ p.todEnd ?? 0,
+ p.todMode ?? 0,
+ p.region,
+ p.landmark,
+ p.label || 'Wilderness',
+ ]),
+ )
+
+ counts.pointTypes = await insertBatched(
+ conn,
+ 'INSERT INTO shard_spawn_point_types (point_id, slug, max_count) VALUES (?,?,?)',
+ atlas.pointTypes,
+ )
+
+ await conn.query(
+ 'INSERT INTO shard_atlas_meta (id, payload) VALUES (1, ?) ' +
+ 'ON DUPLICATE KEY UPDATE payload = VALUES(payload), imported_at = CURRENT_TIMESTAMP',
+ [JSON.stringify({ ...atlas.meta, importedCounts: counts })],
+ )
+
+ // A completed import answers whatever was pending.
+ await conn.query('DELETE FROM shard_atlas_pending')
+
+ await conn.commit()
+ return counts
+ } catch (err) {
+ await conn.rollback().catch(() => {})
+ throw err
+ } finally {
+ conn.release()
+ }
+}
+
+async function getMeta() {
+ const rows = await query('SELECT payload, imported_at FROM shard_atlas_meta WHERE id = 1')
+ if (rows.length === 0) return null
+ const payload = typeof rows[0].payload === 'string' ? JSON.parse(rows[0].payload) : rows[0].payload
+ return { ...payload, importedAt: rows[0].imported_at }
+}
+
+/** Facet names currently loaded, used to detect a facet disappearing. */
+async function getFacets() {
+ const rows = await query('SELECT DISTINCT facet FROM shard_spawn_points ORDER BY facet')
+ return rows.map((row) => row.facet)
+}
+
+// ── Pending review ─────────────────────────────────────────────────────────
+
+async function getPending() {
+ const rows = await query('SELECT payload, status, detected_at FROM shard_atlas_pending WHERE id = 1')
+ if (rows.length === 0) return null
+ const payload = typeof rows[0].payload === 'string' ? JSON.parse(rows[0].payload) : rows[0].payload
+ return { ...payload, status: rows[0].status, detectedAt: rows[0].detected_at }
+}
+
+async function setPending(payload, status = 'pending') {
+ return query(
+ 'INSERT INTO shard_atlas_pending (id, status, payload) VALUES (1, ?, ?) ' +
+ 'ON DUPLICATE KEY UPDATE status = VALUES(status), payload = VALUES(payload), ' +
+ 'detected_at = CURRENT_TIMESTAMP',
+ [status, JSON.stringify(payload)],
+ )
+}
+
+async function clearPending() {
+ return query('DELETE FROM shard_atlas_pending')
+}
+
+// ── Reads (the public /atlas surface) ──────────────────────────────────────
+//
+// Every read here is a plain indexed query over ~7k rows and is served entirely
+// from MariaDB: the atlas is static shard content, so nothing on this path
+// touches the sidecar and nothing degrades when the shard is down.
+//
+// A facet filter is expressed as EXISTS over the points, never as a JSON path
+// built from caller input. `shard_spawn_creatures.facets` is a JSON object keyed
+// by facet name, and matching a key means either concatenating the name into a
+// path or handing it to JSON_SEARCH — whose search string treats `%` and `_` as
+// wildcards, so `?facet=%` would quietly match everything. The join is exact and
+// uses the indexes that already exist.
+const CREATURE_FACET_EXISTS = `EXISTS (
+ SELECT 1 FROM shard_spawn_point_types t
+ JOIN shard_spawn_points p ON p.id = t.point_id
+ WHERE t.slug = c.slug AND p.facet = ?
+)`
+
+// Build the WHERE for a creature search. `q` is a substring match on the display
+// name — a LIKE scan, which is free at ~800 rows and, unlike FULLTEXT, has no
+// minimum token length to break a search for "orc".
+function creatureWhere({ q, facet }) {
+ const where = []
+ const params = []
+ if (q) {
+ where.push('c.name LIKE ?')
+ params.push(`%${q}%`)
+ }
+ if (facet) {
+ where.push(CREATURE_FACET_EXISTS)
+ params.push(facet)
+ }
+ return { sql: where.length ? `WHERE ${where.join(' AND ')}` : '', params }
+}
+
+async function countCreatures({ q = '', facet = '' } = {}) {
+ const { sql, params } = creatureWhere({ q, facet })
+ const rows = await query(`SELECT COUNT(*) AS n FROM shard_spawn_creatures c ${sql}`, params)
+ return rows[0] ? Number(rows[0].n) : 0
+}
+
+function listCreatures({ q = '', facet = '', limit = 50, offset = 0 } = {}) {
+ const { sql, params } = creatureWhere({ q, facet })
+ return query(
+ `SELECT c.slug, c.name, c.total, c.points, c.facets, c.art
+ FROM shard_spawn_creatures c
+ ${sql}
+ ORDER BY c.total DESC, c.name ASC
+ LIMIT ? OFFSET ?`,
+ [...params, limit, offset],
+ )
+}
+
+async function getCreature(slug) {
+ const rows = await query(
+ 'SELECT slug, name, total, points, facets, art FROM shard_spawn_creatures WHERE slug = ?',
+ [slug],
+ )
+ return rows[0] || null
+}
+
+/**
+ * Where a creature spawns, grouped by resolved place.
+ *
+ * This is the answer the atlas exists to give — "lizardman → Shrines,
+ * Isamu-Jima, Yew" — so it is aggregated in SQL rather than by summing 6,455
+ * point rows in Node.
+ */
+function listCreaturePlaces(slug, { facet = '' } = {}) {
+ const params = [slug]
+ let facetSql = ''
+ if (facet) {
+ facetSql = 'AND p.facet = ?'
+ params.push(facet)
+ }
+ return query(
+ `SELECT p.facet, p.label, COUNT(*) AS spawners, SUM(t.max_count) AS max_alive
+ FROM shard_spawn_point_types t
+ JOIN shard_spawn_points p ON p.id = t.point_id
+ WHERE t.slug = ? ${facetSql}
+ GROUP BY p.facet, p.label
+ ORDER BY spawners DESC, p.facet ASC, p.label ASC`,
+ params,
+ )
+}
+
+/** The individual spawners for a creature, newest-largest first. Bounded. */
+function listCreaturePoints(slug, { facet = '', limit = 200 } = {}) {
+ const params = [slug]
+ let facetSql = ''
+ if (facet) {
+ facetSql = 'AND p.facet = ?'
+ params.push(facet)
+ }
+ params.push(limit)
+ return query(
+ `SELECT p.id, p.facet, p.name, p.x, p.y, p.width, p.height, p.spawn_range,
+ p.min_delay, p.max_delay, p.tod_start, p.tod_end, p.tod_mode,
+ p.region, p.landmark, p.label, t.max_count
+ FROM shard_spawn_point_types t
+ JOIN shard_spawn_points p ON p.id = t.point_id
+ WHERE t.slug = ? ${facetSql}
+ ORDER BY t.max_count DESC, p.facet ASC, p.label ASC, p.id ASC
+ LIMIT ?`,
+ params,
+ )
+}
+
+/** Every other creature sharing a spawner with this one. */
+function listCreatureCompanions(slug, { limit = 24 } = {}) {
+ return query(
+ `SELECT o.slug, c.name, COUNT(*) AS shared
+ FROM shard_spawn_point_types t
+ JOIN shard_spawn_point_types o ON o.point_id = t.point_id AND o.slug <> t.slug
+ JOIN shard_spawn_creatures c ON c.slug = o.slug
+ WHERE t.slug = ?
+ GROUP BY o.slug, c.name
+ ORDER BY shared DESC, c.name ASC
+ LIMIT ?`,
+ [slug, limit],
+ )
+}
+
+function listRegions({ facet = '', q = '' } = {}) {
+ const where = []
+ const params = []
+ if (facet) {
+ where.push('facet = ?')
+ params.push(facet)
+ }
+ if (q) {
+ where.push('name LIKE ?')
+ params.push(`%${q}%`)
+ }
+ return query(
+ `SELECT facet, name, type, priority, parent, rects
+ FROM shard_regions
+ ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+ ORDER BY facet ASC, name ASC`,
+ params,
+ )
+}
+
+function listLandmarks({ facet = '', q = '' } = {}) {
+ const where = []
+ const params = []
+ if (facet) {
+ where.push('facet = ?')
+ params.push(facet)
+ }
+ if (q) {
+ where.push('(name LIKE ? OR grp LIKE ?)')
+ params.push(`%${q}%`, `%${q}%`)
+ }
+ return query(
+ `SELECT facet, name, grp, x, y, z
+ FROM shard_landmarks
+ ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+ ORDER BY facet ASC, grp ASC, name ASC`,
+ params,
+ )
+}
+
+function listChampions({ facet = '' } = {}) {
+ const params = []
+ let where = ''
+ if (facet) {
+ where = 'WHERE facet = ?'
+ params.push(facet)
+ }
+ return query(
+ `SELECT slug, name, grp, type, random_type, facet, x, y, z, radius, label
+ FROM shard_champion_spawns
+ ${where}
+ ORDER BY facet ASC, name ASC`,
+ params,
+ )
+}
+
+module.exports = {
+ replaceAtlas,
+ getMeta,
+ getFacets,
+ getPending,
+ setPending,
+ clearPending,
+ countCreatures,
+ listCreatures,
+ getCreature,
+ listCreaturePlaces,
+ listCreaturePoints,
+ listCreatureCompanions,
+ listRegions,
+ listLandmarks,
+ listChampions,
+}
diff --git a/server/src/model/shardAtlas/shardAtlas.model.js b/server/src/model/shardAtlas/shardAtlas.model.js
new file mode 100644
index 0000000..73e5a26
--- /dev/null
+++ b/server/src/model/shardAtlas/shardAtlas.model.js
@@ -0,0 +1,485 @@
+const fs = require('fs')
+const path = require('path')
+
+const db = require('./shardAtlas.db')
+const settings = require('../settings/settings.model')
+const { slugify } = require('../../utils/spawnAtlasParse')
+const {
+ AtlasSourceError,
+ PARSER_VERSION,
+ buildAtlas,
+ hashSources,
+ sameSources,
+} = require('../../utils/spawnAtlasSource')
+const log = require('../../utils/logger')('shardAtlas')
+
+// The spawn atlas, refreshed from the shard's own ServUO tree.
+//
+// The tree is the single source of truth. Nothing is precomputed and committed,
+// because a shard's maps change over its lifetime — facets get added, replaced
+// or renamed — and a snapshot in the repo would go stale against the world
+// players actually see. So the atlas is re-derived on every boot.
+//
+// Two rules govern the boot path:
+//
+// 1. **It never blocks startup.** No configured path, an unreadable path, a
+// malformed file, a database error — all of it is caught and logged. The
+// site comes up either way, serving whatever atlas it already had.
+// 2. **A facet disappearing is not applied automatically.** Losing a facet is
+// the signature of a half-copied or mid-update tree as much as of a real
+// map change, and the two are indistinguishable from here. The refresh is
+// staged for a human instead, and an admin approves or rejects it.
+//
+// Everything else — new facets, renamed regions, changed spawns — applies
+// straight away, because none of it can silently destroy data an operator would
+// miss.
+
+const SETTING_KEY = 'spawn_atlas_servuo_path'
+
+/**
+ * Where the ServUO tree lives.
+ *
+ * The admin setting wins over the environment so an operator can point the
+ * atlas at a different tree without a redeploy, matching how the rest of the
+ * shard integration is admin-managed rather than env-configured. `SERVUO_PATH`
+ * remains as the deploy-time default, since the path usually describes a mount
+ * that the deployment sets up.
+ */
+async function getServuoPath() {
+ try {
+ const configured = await settings.get(SETTING_KEY)
+ if (configured && String(configured).trim() !== '') return String(configured).trim()
+ } catch {
+ // Settings unavailable is not fatal — fall through to the env default.
+ }
+ const fromEnv = process.env.SERVUO_PATH
+ return fromEnv && fromEnv.trim() !== '' ? fromEnv.trim() : ''
+}
+
+async function setServuoPath(value, updatedBy = null) {
+ return settings.set(SETTING_KEY, String(value ?? '').trim(), updatedBy)
+}
+
+/**
+ * Optional operator-supplied art map, `{ "": " " }`.
+ *
+ * Never committed and never shipped — creature sprites come out of the
+ * operator's own client `.mul`/`.uop` files, which are theirs, not ours to
+ * redistribute. Absent (the normal case) every `art` stays NULL and the UI
+ * renders text-only.
+ */
+function loadArtMap(dir = path.join(__dirname, '..', '..', '..', 'db', 'data')) {
+ try {
+ const file = path.join(dir, 'spawnAtlas.art.json')
+ if (!fs.existsSync(file)) return {}
+ const map = JSON.parse(fs.readFileSync(file, 'utf8'))
+ return map && typeof map === 'object' ? map : {}
+ } catch (err) {
+ log.warn('spawn atlas art map could not be read', { error: err.message })
+ return {}
+ }
+}
+
+/**
+ * Flatten each point's types into `shard_spawn_point_types` rows.
+ *
+ * A spawner may legitimately list the same type twice, and the primary key is
+ * (point_id, slug), so duplicates collapse to the larger max rather than
+ * failing the insert.
+ */
+function pointTypeRows(points) {
+ const rows = []
+ points.forEach((point, i) => {
+ const bySlug = new Map()
+ for (const entry of point.types ?? []) {
+ const slug = slugify(entry.type)
+ if (slug === '') continue
+ bySlug.set(slug, Math.max(bySlug.get(slug) ?? 0, entry.max ?? 1))
+ }
+ for (const [slug, max] of bySlug) rows.push([i + 1, slug, max])
+ })
+ return rows
+}
+
+async function applyAtlas(atlas) {
+ return db.replaceAtlas({ ...atlas, pointTypes: pointTypeRows(atlas.points) }, loadArtMap())
+}
+
+/**
+ * Refresh the atlas from the configured ServUO tree.
+ *
+ * Returns a result describing what happened rather than throwing, so the caller
+ * — including the boot path — can log it and move on:
+ *
+ * `skipped` no path configured
+ * `unavailable` path configured but unreadable / missing required files
+ * `unchanged` source hashes match the loaded atlas; nothing parsed
+ * `imported` parsed and applied
+ * `needsReview` parsed, but a facet would be lost; staged for an admin
+ * `failed` parsed or applied and something went wrong
+ *
+ * `force` skips the hash check (an admin asking for a reimport) and `approve`
+ * additionally accepts facet loss (an admin approving a staged refresh).
+ */
+/**
+ * Was the loaded atlas built by THIS parser?
+ *
+ * An atlas imported before `parserVersion` existed reports undefined, which is
+ * correctly "no" — those are exactly the ones carrying the old readings.
+ */
+const currentParser = (meta) => meta?.parserVersion === PARSER_VERSION
+
+async function refresh({ force = false, approve = false, path: pathOverride = '' } = {}) {
+ // An explicit override wins outright — it is a one-off "use this tree", and it
+ // must not be silently overruled by the configured path the way an env default
+ // would be.
+ const root = pathOverride.trim() !== '' ? pathOverride.trim() : await getServuoPath()
+ if (root === '') return { status: 'skipped', reason: 'no ServUO path configured' }
+
+ let hashes
+ try {
+ hashes = hashSources(root)
+ } catch (err) {
+ if (err instanceof AtlasSourceError) {
+ return { status: 'unavailable', reason: err.message, code: err.code, path: root }
+ }
+ return { status: 'failed', reason: err.message, path: root }
+ }
+
+ const meta = await db.getMeta().catch(() => null)
+ const loaded = meta?.source
+ ? Object.fromEntries(Object.entries(meta.source).map(([label, v]) => [label, v.sha256]))
+ : null
+
+ // Two things make a loaded atlas stale: the tree changed, or the PARSER did.
+ // Only checking the tree would strand an install whose maps never change on
+ // whatever an older build derived — a corrected parse would ship and never
+ // reach the data.
+ if (!force && sameSources(hashes, loaded) && currentParser(meta)) {
+ return { status: 'unchanged', path: root }
+ }
+
+ // A rejected refresh must not re-prompt on every boot. It stays rejected until
+ // the tree changes again, at which point the hashes differ and it is a new
+ // decision.
+ const pending = await db.getPending().catch(() => null)
+ if (!approve && !force && pending?.status === 'rejected' && sameSources(hashes, pending.hashes)) {
+ return { status: 'unchanged', path: root, reason: 'refresh previously rejected' }
+ }
+
+ let atlas
+ try {
+ atlas = buildAtlas(root)
+ } catch (err) {
+ return { status: 'failed', reason: err.message, path: root }
+ }
+
+ const currentFacets = await db.getFacets().catch(() => [])
+ const incomingFacets = atlas.facets
+ const removedFacets = currentFacets.filter((facet) => !incomingFacets.includes(facet))
+ const addedFacets = incomingFacets.filter((facet) => !currentFacets.includes(facet))
+
+ // Losing a facet is indistinguishable here from a half-copied tree, so it is
+ // staged rather than applied — but startup is never blocked by it.
+ if (removedFacets.length > 0 && !approve) {
+ const summary = {
+ hashes,
+ path: root,
+ currentFacets,
+ incomingFacets,
+ removedFacets,
+ addedFacets,
+ counts: atlas.meta.counts,
+ }
+ await db.setPending(summary, 'pending').catch((err) => {
+ log.warn('could not stage spawn atlas refresh', { error: err.message })
+ })
+ return { status: 'needsReview', ...summary }
+ }
+
+ try {
+ const counts = await applyAtlas(atlas)
+ return { status: 'imported', path: root, counts, addedFacets, removedFacets }
+ } catch (err) {
+ return { status: 'failed', reason: err.message, path: root }
+ }
+}
+
+/** Admin approved a staged refresh: apply it, facet loss and all. */
+async function approvePending(options = {}) {
+ return refresh({ ...options, approve: true, force: true })
+}
+
+/**
+ * Admin rejected a staged refresh: keep the current atlas and remember the
+ * decision against those exact source hashes, so it does not re-prompt every
+ * boot. A further change to the tree produces different hashes and asks again.
+ */
+async function rejectPending() {
+ const pending = await db.getPending()
+ if (!pending) return { status: 'none' }
+ await db.setPending({ ...pending, rejectedAt: new Date().toISOString() }, 'rejected')
+ return { status: 'rejected' }
+}
+
+/** Everything the admin panel needs to describe atlas state. */
+async function status({ path: pathOverride = '' } = {}) {
+ const root = pathOverride.trim() !== '' ? pathOverride.trim() : await getServuoPath()
+ const [meta, pending, facets] = await Promise.all([
+ db.getMeta().catch(() => null),
+ db.getPending().catch(() => null),
+ db.getFacets().catch(() => []),
+ ])
+
+ let treeReadable = false
+ let drift = null
+ if (root !== '') {
+ try {
+ const hashes = hashSources(root)
+ treeReadable = true
+ const loaded = meta?.source
+ ? Object.fromEntries(Object.entries(meta.source).map(([l, v]) => [l, v.sha256]))
+ : null
+ // Same question `refresh` asks: an import picks something up when either
+ // the tree or the parser has moved on.
+ drift = !sameSources(hashes, loaded) || !currentParser(meta)
+ } catch {
+ treeReadable = false
+ }
+ }
+
+ return {
+ configured: root !== '',
+ path: root,
+ treeReadable,
+ drift,
+ facets,
+ importedAt: meta?.importedAt ?? null,
+ counts: meta?.counts ?? null,
+ pending,
+ }
+}
+
+/**
+ * Boot hook. Best-effort by contract: it logs and returns, never throws, so a
+ * missing tree or a bad file can never stop the site coming up.
+ */
+async function refreshOnBoot() {
+ try {
+ const result = await refresh()
+ switch (result.status) {
+ case 'imported':
+ log.info('spawn atlas refreshed from ServUO tree', {
+ ...result.counts,
+ added: result.addedFacets,
+ })
+ break
+ case 'needsReview':
+ log.warn(
+ 'spawn atlas refresh staged for admin review — a facet would be removed; ' +
+ 'the existing atlas is unchanged',
+ { removed: result.removedFacets, added: result.addedFacets },
+ )
+ break
+ case 'unavailable':
+ log.warn('spawn atlas source unavailable', { reason: result.reason, path: result.path })
+ break
+ case 'failed':
+ log.warn('spawn atlas refresh failed', { reason: result.reason })
+ break
+ default:
+ break
+ }
+ return result
+ } catch (err) {
+ log.warn('spawn atlas refresh errored', { error: err.message })
+ return { status: 'failed', reason: err.message }
+ }
+}
+
+// ── Reads ──────────────────────────────────────────────────────────────────
+//
+// The shapes the /public/atlas endpoints serve. Rows are camelCased here rather
+// than in the controller, for the same reason shardState does it: the column
+// names are an implementation detail of the import, and the browser contract
+// should not move when a column is renamed.
+
+const jsonOr = (value, fallback) => {
+ if (value == null) return fallback
+ if (typeof value !== 'string') return value
+ try {
+ return JSON.parse(value)
+ } catch {
+ return fallback
+ }
+}
+
+const shapeCreature = (row) => ({
+ slug: row.slug,
+ name: row.name,
+ // `total` is the summed MaxCount across every spawner (how many can be alive
+ // at once); `points` is how many spawners mention it. They answer different
+ // questions and the UI shows both.
+ total: row.total,
+ points: row.points,
+ facets: jsonOr(row.facets, {}),
+ art: row.art || null,
+})
+
+const shapePlace = (row) => ({
+ facet: row.facet,
+ label: row.label,
+ spawners: Number(row.spawners) || 0,
+ maxAlive: Number(row.max_alive) || 0,
+})
+
+const shapePoint = (row) => ({
+ id: row.id,
+ facet: row.facet,
+ name: row.name || null,
+ x: row.x,
+ y: row.y,
+ width: row.width,
+ height: row.height,
+ range: row.spawn_range,
+ maxCount: row.max_count,
+ minDelay: row.min_delay,
+ maxDelay: row.max_delay,
+ todStart: row.tod_start,
+ todEnd: row.tod_end,
+ todMode: row.tod_mode,
+ region: row.region || null,
+ landmark: row.landmark || null,
+ label: row.label,
+})
+
+/**
+ * Paginated creature search. Returns the page plus the unpaginated total, so
+ * the UI can say "showing 50 of 800" without a second round trip.
+ */
+async function searchCreatures({ q = '', facet = '', limit = 50, offset = 0 } = {}) {
+ const [rows, total] = await Promise.all([
+ db.listCreatures({ q, facet, limit, offset }),
+ db.countCreatures({ q, facet }),
+ ])
+ return { total, limit, offset, creatures: rows.map(shapeCreature) }
+}
+
+/**
+ * One creature: its totals, the places it spawns (the aggregate the atlas
+ * exists for), the individual spawners, and what else shares those spawners.
+ *
+ * `null` when the slug is unknown — the controller turns that into a 404.
+ */
+async function getCreature(slug, { facet = '', points = 200 } = {}) {
+ const row = await db.getCreature(slug)
+ if (!row) return null
+ const [places, pointRows, alsoHere] = await Promise.all([
+ db.listCreaturePlaces(slug, { facet }),
+ db.listCreaturePoints(slug, { facet, limit: points }),
+ db.listCreatureCompanions(slug),
+ ])
+ return {
+ ...shapeCreature(row),
+ places: places.map(shapePlace),
+ // `spawners`, not `points`: shapeCreature already uses `points` for the
+ // COUNT of spawners, and reusing the key for the list of them would make the
+ // same field a number on the search route and an array here.
+ spawners: pointRows.map(shapePoint),
+ // Bounded by the query, so a creature on hundreds of spawners returns a page
+ // rather than the world.
+ spawnersTruncated: pointRows.length >= points,
+ alsoHere: alsoHere.map((r) => ({
+ slug: r.slug,
+ name: r.name,
+ shared: Number(r.shared) || 0,
+ })),
+ }
+}
+
+async function listRegions(opts = {}) {
+ const rows = await db.listRegions(opts)
+ return rows.map((r) => ({
+ facet: r.facet,
+ name: r.name,
+ type: r.type || null,
+ priority: r.priority,
+ parent: r.parent || null,
+ rects: jsonOr(r.rects, []),
+ }))
+}
+
+async function listLandmarks(opts = {}) {
+ const rows = await db.listLandmarks(opts)
+ return rows.map((r) => ({
+ facet: r.facet,
+ name: r.name,
+ group: r.grp || null,
+ x: r.x,
+ y: r.y,
+ z: r.z,
+ }))
+}
+
+async function listChampions(opts = {}) {
+ const rows = await db.listChampions(opts)
+ return rows.map((r) => ({
+ slug: r.slug,
+ name: r.name,
+ group: r.grp || null,
+ // '' on the wire means "randomised at activation"; `randomType` says so
+ // explicitly rather than making the client infer it from an empty string.
+ type: r.type || null,
+ randomType: !!r.random_type,
+ facet: r.facet,
+ x: r.x,
+ y: r.y,
+ z: r.z,
+ radius: r.radius,
+ label: r.label || null,
+ }))
+}
+
+/**
+ * What is loaded: the facet list, the counts, and when it was imported.
+ *
+ * Deliberately does NOT report the source path, the per-file hashes or whether
+ * a refresh is pending. Those describe the operator's filesystem, and this is a
+ * public endpoint; the admin status route carries them instead.
+ */
+async function publicMeta() {
+ const [meta, facets] = await Promise.all([
+ db.getMeta().catch(() => null),
+ db.getFacets().catch(() => []),
+ ])
+ return {
+ importedAt: meta?.importedAt ?? null,
+ generatedAt: meta?.generatedAt ?? null,
+ // The parse counts, not the row counts: `unresolvedPoints` is what lets the
+ // page state its own placement accuracy instead of implying it is complete.
+ counts: meta?.counts ?? null,
+ facets,
+ }
+}
+
+const listFacets = () => db.getFacets()
+
+module.exports = {
+ refresh,
+ refreshOnBoot,
+ approvePending,
+ rejectPending,
+ status,
+ getServuoPath,
+ setServuoPath,
+ pointTypeRows,
+ loadArtMap,
+ SETTING_KEY,
+ searchCreatures,
+ getCreature,
+ listRegions,
+ listLandmarks,
+ listChampions,
+ listFacets,
+ publicMeta,
+}
diff --git a/server/src/model/shardClilocs/shardClilocs.db.js b/server/src/model/shardClilocs/shardClilocs.db.js
new file mode 100644
index 0000000..d944524
--- /dev/null
+++ b/server/src/model/shardClilocs/shardClilocs.db.js
@@ -0,0 +1,108 @@
+const { pool, query } = require('../../utils/db')
+
+// Raw SQL for the cliloc table. `shard_clilocs` is IMPORT-OWNED: `replaceAll`
+// empties and refills it inside one transaction, and nothing else in the
+// codebase writes to it. No foreign keys, consistent with every other shard_*
+// table.
+
+const BATCH = 1000
+
+/**
+ * Replace the entire cliloc table in one transaction.
+ *
+ * All-or-nothing on purpose: a failed reload must leave the previous table
+ * intact rather than a half-loaded one, because a partially-imported cliloc
+ * table is indistinguishable from a complete one to anyone reading it — you
+ * would just see some items named and some not, which is also what "no table at
+ * all" looks like.
+ *
+ * `DELETE`, not `TRUNCATE` — `TRUNCATE` is DDL in MariaDB and implicitly
+ * commits, which would defeat exactly that guarantee. (The same trap the spawn
+ * atlas import documents; at ~123k rows `DELETE` is still well under a second.)
+ */
+async function replaceAll(entries, meta) {
+ const conn = await pool.getConnection()
+ try {
+ await conn.beginTransaction()
+ await conn.query('DELETE FROM shard_clilocs')
+
+ // Blank entries are dropped rather than stored. Roughly HALF of a real
+ // cliloc table is empty strings — ids the client reserves and never uses —
+ // and a row that resolves to no name is indistinguishable from no row at
+ // all to every caller. Dropping them halves the table (123,490 → ~67,500)
+ // and, more importantly, makes the binary and text imports converge on
+ // identical content: the binary format carries the blanks explicitly and a
+ // text export may or may not, depending on the tool.
+ //
+ // Later duplicates win. Merging across sources already happened upstream in
+ // `readCliloc`, so in practice this collapses nothing — it is kept because
+ // the plain format permits a repeated id WITHIN one file and the client's
+ // own loader resolves it the same way (its dictionary assignment
+ // overwrites). Without it, a file the game itself would load happily would
+ // fail the batch insert on a primary-key collision.
+ const byNumber = new Map()
+ let blank = 0
+ for (const entry of entries) {
+ if (!Number.isInteger(entry.number)) continue
+ if (String(entry.text ?? '').trim() === '') {
+ blank++
+ continue
+ }
+ byNumber.set(entry.number, entry)
+ }
+
+ const rows = [...byNumber.values()].map((e) => [e.number, e.flag ?? 0, e.text])
+ for (let i = 0; i < rows.length; i += BATCH) {
+ await conn.batch('INSERT INTO shard_clilocs (number, flag, text) VALUES (?,?,?)', rows.slice(i, i + BATCH))
+ }
+
+ await conn.query(
+ 'INSERT INTO shard_cliloc_meta (id, payload) VALUES (1, ?) ' +
+ 'ON DUPLICATE KEY UPDATE payload = VALUES(payload), imported_at = CURRENT_TIMESTAMP',
+ [JSON.stringify({ ...meta, count: rows.length })],
+ )
+
+ await conn.commit()
+ return { count: rows.length, blank, duplicates: entries.length - blank - rows.length }
+ } catch (err) {
+ await conn.rollback().catch(() => {})
+ throw err
+ } finally {
+ conn.release()
+ }
+}
+
+async function getMeta() {
+ const rows = await query('SELECT payload, imported_at FROM shard_cliloc_meta WHERE id = 1')
+ if (rows.length === 0) return null
+ const payload = typeof rows[0].payload === 'string' ? JSON.parse(rows[0].payload) : rows[0].payload
+ return { ...payload, importedAt: rows[0].imported_at }
+}
+
+/**
+ * Look up a batch of ids.
+ *
+ * Batched rather than one-at-a-time because every caller has a LIST: a character
+ * sheet resolves a dozen equipment ids at once, and a page of marketplace
+ * listings resolves fifty. `IN (...)` with generated placeholders keeps it one
+ * round trip and one parameterized statement.
+ */
+async function lookup(numbers) {
+ if (!Array.isArray(numbers) || numbers.length === 0) return []
+ const ids = [...new Set(numbers.filter((n) => Number.isInteger(n)))]
+ if (ids.length === 0) return []
+ const placeholders = ids.map(() => '?').join(',')
+ return query(`SELECT number, text FROM shard_clilocs WHERE number IN (${placeholders})`, ids)
+}
+
+async function count() {
+ const rows = await query('SELECT COUNT(*) AS n FROM shard_clilocs')
+ return Number(rows[0]?.n) || 0
+}
+
+module.exports = {
+ replaceAll,
+ getMeta,
+ lookup,
+ count,
+}
diff --git a/server/src/model/shardClilocs/shardClilocs.model.js b/server/src/model/shardClilocs/shardClilocs.model.js
new file mode 100644
index 0000000..6f193bd
--- /dev/null
+++ b/server/src/model/shardClilocs/shardClilocs.model.js
@@ -0,0 +1,368 @@
+const db = require('./shardClilocs.db')
+const settings = require('../settings/settings.model')
+const { displayText } = require('../../utils/clilocParse')
+const {
+ ClilocFormatError,
+ ClilocSourceError,
+ PARSER_VERSION,
+ hashSources,
+ sameSources,
+ missingSources,
+ readCliloc,
+} = require('../../utils/clilocSource')
+const log = require('../../utils/logger')('shardClilocs')
+
+// The cliloc table — UO's id → display-string map, refreshed from a file the
+// operator converts once from their own client.
+//
+// Why the site holds this at all: items on the wire carry a `LabelNumber`, not a
+// name. `char.profile.equipment` has always sent `cliloc`, and every marketplace
+// listing sends one too. Without the table the UI can only print `id 1023721`
+// where the game prints "quarter staff".
+//
+// Two rules govern the boot path, both inherited from the spawn atlas:
+//
+// 1. **It never blocks startup.** No configured path, an unreadable file, a
+// wrong-format file, a database error — all caught and logged. The site
+// comes up either way, serving whatever table it already had (or none, in
+// which case the UI falls back to item ids exactly as it did before).
+// 2. **Nothing client-derived is committed.** The table is built from the
+// operator's own file at a configured path. The repo ships no strings.
+//
+// The table is built from a SET of sources — the converted client table plus
+// every operator-maintained overlay beside it — because shards edit items and
+// add new ones, and those carry cliloc ids no stock client table has. All of
+// them are re-read on every boot and hash-gated together, so adding one custom
+// item never means re-exporting a 5 MB client file. Later sources win.
+//
+// That set is also why this has the atlas's escalation, in a lighter form. A
+// single corrupt file fails the parse loudly, but a source that has simply
+// VANISHED parses perfectly and imports a table quietly missing everything it
+// contributed — the same ambiguity (real change vs half-copied mount) the atlas
+// stages a facet removal for. So a disappearing source is refused and reported
+// rather than applied.
+//
+// It is lighter than the atlas's because it needs to be: the atlas stores a
+// pending decision in its own table and adds approve/reject endpoints, whereas
+// here the decision is a single boolean an admin passes to the import they were
+// already going to run. Re-parsing at approval time — the property that makes
+// the atlas store only the decision — is automatic when there is nothing stored.
+
+const SETTING_KEY = 'cliloc_client_path'
+
+/**
+ * Where the converted cliloc file lives.
+ *
+ * The admin setting wins over the environment so an operator can repoint it
+ * without a redeploy, matching how the rest of the shard integration is
+ * admin-managed rather than env-configured. `UO_CLIENT_PATH` remains as the
+ * deploy-time default, since the path usually describes a mount the deployment
+ * sets up.
+ */
+async function getClientPath() {
+ try {
+ const configured = await settings.get(SETTING_KEY)
+ if (configured && String(configured).trim() !== '') return String(configured).trim()
+ } catch {
+ // Settings unavailable is not fatal — fall through to the env default.
+ }
+ const fromEnv = process.env.UO_CLIENT_PATH
+ return fromEnv && fromEnv.trim() !== '' ? fromEnv.trim() : ''
+}
+
+async function setClientPath(value, updatedBy = null) {
+ const result = await settings.set(SETTING_KEY, String(value ?? '').trim(), updatedBy)
+ invalidate()
+ return result
+}
+
+// ── Refresh ────────────────────────────────────────────────────────────────
+
+/** Was the loaded table built by THIS parser? */
+const currentParser = (meta) => meta?.parserVersion === PARSER_VERSION
+
+/**
+ * Refresh the cliloc table from the configured file.
+ *
+ * Returns a result describing what happened rather than throwing, so the caller
+ * — including the boot path — can log it and move on:
+ *
+ * `skipped` no path configured
+ * `unavailable` path configured but missing / unreadable / not a cliloc file
+ * `unchanged` source hashes match the loaded table; nothing parsed
+ * `imported` parsed and applied
+ * `needsReview` a previously-present source has vanished; NOT applied
+ * `failed` parsed or applied and something went wrong
+ *
+ * `force` skips the hash check (an admin asking for a reimport). `approve`
+ * additionally accepts a vanished source.
+ */
+async function refresh({ force = false, approve = false, path: pathOverride = '' } = {}) {
+ // An explicit override wins outright — a one-off "use this file", which must
+ // not be silently overruled by the configured path the way an env default is.
+ const configured = pathOverride.trim() !== '' ? pathOverride.trim() : await getClientPath()
+ if (configured === '') return { status: 'skipped', reason: 'no cliloc path configured' }
+
+ let fingerprint
+ try {
+ fingerprint = hashSources(configured)
+ } catch (err) {
+ if (err instanceof ClilocSourceError) {
+ return { status: 'unavailable', reason: err.message, code: err.code, path: configured }
+ }
+ return { status: 'failed', reason: err.message, path: configured }
+ }
+
+ const meta = await db.getMeta().catch(() => null)
+
+ // Two things make a loaded table stale: any source changed, or the PARSER did.
+ // Only checking the sources would strand an install whose client never patches
+ // on whatever an older build derived.
+ if (!force && sameSources(fingerprint.hashes, meta?.hashes) && currentParser(meta)) {
+ return {
+ status: 'unchanged',
+ path: configured,
+ file: fingerprint.file,
+ count: meta.count ?? null,
+ customCount: fingerprint.customCount,
+ }
+ }
+
+ // A source that was there last import and is not there now is refused, not
+ // applied — an unmounted volume and a deliberate deletion look identical from
+ // here, and the wrong guess silently drops every name that file contributed.
+ const gone = missingSources(fingerprint.hashes, meta?.hashes)
+ if (gone.length > 0 && !approve) {
+ return {
+ status: 'needsReview',
+ reason: `${gone.length} previously-loaded cliloc source(s) are missing; the existing table is unchanged`,
+ missingSources: gone,
+ path: configured,
+ file: fingerprint.file,
+ }
+ }
+
+ let parsed
+ try {
+ parsed = readCliloc(configured)
+ } catch (err) {
+ if (err instanceof ClilocFormatError || err instanceof ClilocSourceError) {
+ return { status: 'unavailable', reason: err.message, code: err.code, path: configured }
+ }
+ return { status: 'failed', reason: err.message, path: configured }
+ }
+
+ try {
+ const applied = await db.replaceAll(parsed.entries, parsed.source)
+ invalidate()
+ return {
+ status: 'imported',
+ path: configured,
+ file: parsed.source.file,
+ count: applied.count,
+ parsed: parsed.entries.length,
+ blank: applied.blank,
+ // Per-source breakdown: how many entries each file contributed and how
+ // many of them overrode something already merged. An operator who adds an
+ // overlay wants to see it took effect, and "overrode: 0" on a file meant
+ // to re-label stock items says it did not.
+ sources: parsed.source.sources,
+ acceptedMissing: gone.length > 0 ? gone : undefined,
+ }
+ } catch (err) {
+ return { status: 'failed', reason: err.message, path: configured }
+ }
+}
+
+/**
+ * Boot hook. Best-effort by contract: it logs and returns, never throws, so a
+ * missing or malformed cliloc file can never stop the site coming up.
+ */
+async function refreshOnBoot() {
+ try {
+ const result = await refresh()
+ switch (result.status) {
+ case 'imported':
+ log.info('cliloc table refreshed', {
+ file: result.file,
+ count: result.count,
+ overlays: (result.sources || []).filter((s) => s.kind === 'custom').length,
+ })
+ break
+ case 'needsReview':
+ log.warn(
+ 'cliloc refresh staged for admin review — a previously-loaded source is missing; ' +
+ 'the existing table is unchanged',
+ { missing: result.missingSources },
+ )
+ break
+ case 'unavailable':
+ // Deliberately a warning, not an error: an operator who has not supplied
+ // a cliloc file is in a supported state (the UI shows item ids), and the
+ // most common cause — pointing at the client's own compressed file —
+ // needs the reason spelled out rather than a stack trace.
+ log.warn('cliloc source unavailable (item names will show as ids)', {
+ reason: result.reason,
+ code: result.code,
+ path: result.path,
+ })
+ break
+ case 'failed':
+ log.warn('cliloc refresh failed', { reason: result.reason })
+ break
+ default:
+ break
+ }
+ return result
+ } catch (err) {
+ log.warn('cliloc refresh errored', { error: err.message })
+ return { status: 'failed', reason: err.message }
+ }
+}
+
+/** Everything the admin panel needs to describe cliloc state. */
+async function status({ path: pathOverride = '' } = {}) {
+ const configured = pathOverride.trim() !== '' ? pathOverride.trim() : await getClientPath()
+ const meta = await db.getMeta().catch(() => null)
+ const loaded = await db.count().catch(() => 0)
+
+ let fileReadable = false
+ let file = null
+ let drift = null
+ let problem = null
+ let code = null
+ let sources = []
+ let missing = []
+ if (configured !== '') {
+ try {
+ const fingerprint = hashSources(configured)
+ fileReadable = true
+ file = fingerprint.file
+ sources = Object.keys(fingerprint.hashes)
+ missing = missingSources(fingerprint.hashes, meta?.hashes)
+ // A compressed file is readable but not importable, and the panel has to
+ // say so HERE — otherwise pointing at an unconverted client directory
+ // reports a healthy file with pending drift ("ready to import") and the
+ // operator only finds out when the import fails. `drift` stays null
+ // because comparing hashes with an unusable file answers nothing.
+ if (fingerprint.compressed) {
+ problem =
+ 'This is a compressed (Mythic-format) cliloc file, which the site cannot read. ' +
+ 'Convert it to the plain format first — see docs/website/CLILOCS.md.'
+ code = 'COMPRESSED'
+ } else {
+ drift = !sameSources(fingerprint.hashes, meta?.hashes) || !currentParser(meta)
+ }
+ } catch (err) {
+ fileReadable = false
+ problem = err.message
+ code = err.code ?? null
+ }
+ }
+
+ return {
+ configured: configured !== '',
+ path: configured,
+ file,
+ fileReadable,
+ problem,
+ code,
+ drift,
+ count: loaded,
+ // Every source found now (base first, then overlays), what each contributed
+ // at the last import, and any that have since vanished — which is the state
+ // an import will refuse without `approve`.
+ sources,
+ loadedSources: meta?.sources ?? null,
+ missingSources: missing,
+ importedAt: meta?.importedAt ?? null,
+ sourceBytes: meta?.bytes ?? null,
+ }
+}
+
+// ── Lookup ─────────────────────────────────────────────────────────────────
+//
+// Resolution happens SERVER-SIDE, not in the browser. Two reasons: the table is
+// ~123k rows and shipping it to a client would dwarf every page that uses it,
+// and the Android app consumes the same JSON and would otherwise need its own
+// copy. Callers get names, not ids-plus-a-table.
+
+// A small write-through cache in front of the table. Item ids repeat heavily —
+// one page of listings is mostly the same few hundred clilocs, and a character
+// sheet re-resolves the same gear on every view — so this turns the steady state
+// into zero queries. Capped so a pathological caller cannot grow it without
+// bound; on overflow it is dropped wholesale rather than evicted entry-by-entry,
+// which is cheap and correct for a table that only changes on reimport.
+const CACHE_MAX = 20000
+let cache = new Map()
+
+function invalidate() {
+ cache = new Map()
+}
+
+/**
+ * Resolve a batch of cliloc ids to display strings.
+ *
+ * Returns a `Map` holding only the ids that resolved to
+ * something displayable — an id with no row, or one whose text is nothing but
+ * interpolated arguments we do not have, is simply absent. Callers fall back to
+ * whatever they had (the item id), so "missing" and "unnamed" collapse into one
+ * branch at the call site.
+ *
+ * Never throws: a cliloc lookup is decoration on someone's character sheet, and
+ * a database blip must not fail the sheet.
+ */
+async function resolveMany(numbers) {
+ const out = new Map()
+ if (!Array.isArray(numbers)) return out
+
+ const wanted = [...new Set(numbers.filter((n) => Number.isInteger(n) && n > 0))]
+ if (wanted.length === 0) return out
+
+ const missing = []
+ for (const number of wanted) {
+ if (cache.has(number)) {
+ const hit = cache.get(number)
+ if (hit !== '') out.set(number, hit)
+ } else {
+ missing.push(number)
+ }
+ }
+
+ if (missing.length > 0) {
+ try {
+ const rows = await db.lookup(missing)
+ const found = new Map(rows.map((r) => [Number(r.number), displayText(r.text)]))
+ if (cache.size + missing.length > CACHE_MAX) invalidate()
+ for (const number of missing) {
+ // Cache the miss too ('' meaning "no usable name"), so an id absent from
+ // the table does not re-query on every page view.
+ const text = found.get(number) ?? ''
+ cache.set(number, text)
+ if (text !== '') out.set(number, text)
+ }
+ } catch (err) {
+ log.warn('cliloc lookup failed', { message: err.message })
+ }
+ }
+
+ return out
+}
+
+/** Single-id convenience. Returns `null` when there is no usable name. */
+async function resolve(number) {
+ const found = await resolveMany([number])
+ return found.get(number) ?? null
+}
+
+module.exports = {
+ SETTING_KEY,
+ getClientPath,
+ setClientPath,
+ refresh,
+ refreshOnBoot,
+ status,
+ resolveMany,
+ resolve,
+ invalidate,
+}
diff --git a/server/src/model/shardEvents/shardEvents.db.js b/server/src/model/shardEvents/shardEvents.db.js
index 6c8f864..5e424f4 100644
--- a/server/src/model/shardEvents/shardEvents.db.js
+++ b/server/src/model/shardEvents/shardEvents.db.js
@@ -16,6 +16,11 @@ async function insertIgnore({ kind, t, bootId, payload, dedupeKey }) {
// `kinds` (IN clause) — the public feed uses the allowlist so it can never leak
// staff/sensitive kinds. limit is clamped by the model.
async function list({ kind, kinds, limit }) {
+ // An allowlist that resolved to NOTHING means "serve nothing" — never "serve
+ // everything". Falling through to the unfiltered query below would have turned
+ // a fully-gated visibility config into a full dump of the event log, staff
+ // audit and cheat detections included.
+ if (kinds && kinds.length === 0) return []
if (kinds && kinds.length) {
const placeholders = kinds.map(() => '?').join(', ')
return query(
diff --git a/server/src/model/shardMarket/shardMarket.db.js b/server/src/model/shardMarket/shardMarket.db.js
new file mode 100644
index 0000000..44db273
--- /dev/null
+++ b/server/src/model/shardMarket/shardMarket.db.js
@@ -0,0 +1,299 @@
+const { pool, query } = require('../../utils/db')
+
+// Raw SQL for the player-vendor market index (Protocol 3.0 vendor.listing).
+//
+// Two tables, both INGEST-OWNED: `shard_vendors` (one row per shop) and
+// `shard_vendor_items` (one row per priced listing). Nothing else in the codebase
+// writes to either. No foreign keys, consistent with every other shard_* table.
+
+// Insert batch size for one vendor's listings. A shop is capped at
+// MarketMaxListings (250 by default) on the shard side, so in practice this is
+// one batch — it exists for the operator who raised that cap.
+const BATCH = 500
+
+// LIKE wildcards in user input. `%` and `_` are not special to the parameterized
+// query — they are special to LIKE itself — so a search for "50% off" would
+// otherwise match everything containing "50" and a search for "_" would match
+// every single-character name. Escaped with a backslash, which is MariaDB's
+// default LIKE escape (no ESCAPE clause needed).
+const likeTerm = (q) => `%${String(q).replace(/[\\%_]/g, (c) => `\\${c}`)}%`
+
+/**
+ * Replace one vendor's whole row and listing set, in one transaction.
+ *
+ * Delete-then-insert rather than a diff, because the frame is AUTHORITATIVE for
+ * that vendor: the shard's sweep only emits a shop whose contents, prices or
+ * location moved, and when it does it sends the whole shop. Reconciling it item
+ * by item would be more code for the same result and would leave sold items
+ * behind on any path the reconciliation missed.
+ *
+ * All-or-nothing matters here for a specific reason: the two writes are "the
+ * shop" and "what is in it", and a failure between them leaves a shop advertising
+ * an inventory it no longer has (or none at all) — visibly wrong on the page, and
+ * indistinguishable from a genuinely empty shop.
+ */
+async function replaceVendor(vendor, items) {
+ const conn = await pool.getConnection()
+ try {
+ await conn.beginTransaction()
+
+ await conn.query(
+ `INSERT INTO shard_vendors
+ (serial, shop_name, owner_serial, owner_name, map, x, y, z, region, house,
+ item_count, item_total, truncated, t)
+ VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+ ON DUPLICATE KEY UPDATE shop_name = VALUES(shop_name), owner_serial = VALUES(owner_serial),
+ owner_name = VALUES(owner_name), map = VALUES(map), x = VALUES(x), y = VALUES(y),
+ z = VALUES(z), region = VALUES(region), house = VALUES(house),
+ item_count = VALUES(item_count), item_total = VALUES(item_total),
+ truncated = VALUES(truncated), t = VALUES(t),
+ -- Touched explicitly rather than left to ON UPDATE CURRENT_TIMESTAMP:
+ -- MariaDB does not fire that when every column is written back
+ -- unchanged, and a shop that is re-published identically is still
+ -- FRESHLY CONFIRMED. Without this the staleness banner would age a
+ -- perfectly current shop forever.
+ updated_at = CURRENT_TIMESTAMP`,
+ [
+ vendor.serial,
+ vendor.shopName ?? null,
+ vendor.ownerSerial ?? null,
+ vendor.ownerName ?? null,
+ vendor.map ?? null,
+ Number.isFinite(vendor.x) ? vendor.x : null,
+ Number.isFinite(vendor.y) ? vendor.y : null,
+ Number.isFinite(vendor.z) ? vendor.z : null,
+ vendor.region ?? null,
+ vendor.house ?? null,
+ items.length,
+ Number.isFinite(vendor.itemTotal) ? vendor.itemTotal : items.length,
+ vendor.truncated ? 1 : 0,
+ Number.isFinite(vendor.t) ? vendor.t : null,
+ ],
+ )
+
+ await conn.query('DELETE FROM shard_vendor_items WHERE vendor_serial = ?', [vendor.serial])
+
+ const rows = items.map((i) => [
+ vendor.serial,
+ i.serial,
+ i.itemId,
+ i.hue,
+ i.amount,
+ i.price,
+ i.name,
+ i.cliloc,
+ i.displayName,
+ i.child ? 1 : 0,
+ ])
+
+ for (let i = 0; i < rows.length; i += BATCH) {
+ await conn.batch(
+ `INSERT INTO shard_vendor_items
+ (vendor_serial, serial, item_id, hue, amount, price, name, cliloc, display_name, child)
+ VALUES (?,?,?,?,?,?,?,?,?,?)`,
+ rows.slice(i, i + BATCH),
+ )
+ }
+
+ await conn.commit()
+ return { items: rows.length }
+ } catch (err) {
+ await conn.rollback().catch(() => {})
+ throw err
+ } finally {
+ conn.release()
+ }
+}
+
+/** Drop one vendor and its listings (vendor.listing.remove). */
+async function removeVendor(serial) {
+ const conn = await pool.getConnection()
+ try {
+ await conn.beginTransaction()
+ await conn.query('DELETE FROM shard_vendor_items WHERE vendor_serial = ?', [serial])
+ await conn.query('DELETE FROM shard_vendors WHERE serial = ?', [serial])
+ await conn.commit()
+ } catch (err) {
+ await conn.rollback().catch(() => {})
+ throw err
+ } finally {
+ conn.release()
+ }
+}
+
+// ── Search ─────────────────────────────────────────────────────────────────
+//
+// The unit of a search RESULT is a listing, not a vendor: "who sells a vanquishing
+// kryss and for how much" is the question, and answering it per vendor would make
+// the caller flatten the shops back out. The vendor's columns ride along on the
+// join so a result row is self-contained.
+
+function searchWhere({ q, minPrice, maxPrice, itemId, map, region }) {
+ const where = ['i.price > 0']
+ const params = []
+
+ if (q) {
+ // Both the resolved display name and the item's own literal, because an item
+ // with a player-set name (most of what is actually worth searching for on a
+ // player-run shard) may have a generic cliloc.
+ where.push('(i.display_name LIKE ? OR i.name LIKE ?)')
+ params.push(likeTerm(q), likeTerm(q))
+ }
+ if (Number.isFinite(minPrice)) {
+ where.push('i.price >= ?')
+ params.push(minPrice)
+ }
+ if (Number.isFinite(maxPrice)) {
+ where.push('i.price <= ?')
+ params.push(maxPrice)
+ }
+ if (Number.isFinite(itemId)) {
+ where.push('i.item_id = ?')
+ params.push(itemId)
+ }
+ if (map) {
+ where.push('v.map = ?')
+ params.push(map)
+ }
+ if (region) {
+ where.push('v.region = ?')
+ params.push(region)
+ }
+
+ return { sql: `WHERE ${where.join(' AND ')}`, params }
+}
+
+// Whitelisted, because this interpolates into the statement. `recent` sorts by
+// the vendor's freshness, which is the only way to see what has just been listed
+// on a shard whose sweep is minutes wide.
+const SORTS = {
+ price_asc: 'i.price ASC, i.id ASC',
+ price_desc: 'i.price DESC, i.id ASC',
+ recent: 'v.updated_at DESC, i.id ASC',
+}
+
+async function searchListings({ q, minPrice, maxPrice, itemId, map, region, sort, limit, offset }) {
+ const { sql, params } = searchWhere({ q, minPrice, maxPrice, itemId, map, region })
+ const order = SORTS[sort] || SORTS.price_asc
+
+ const rows = await query(
+ `SELECT i.serial, i.item_id, i.hue, i.amount, i.price, i.name, i.cliloc, i.display_name, i.child,
+ v.serial AS vendor_serial, v.shop_name, v.owner_serial, v.owner_name,
+ v.map, v.x, v.y, v.z, v.region, v.house, v.updated_at
+ FROM shard_vendor_items i
+ JOIN shard_vendors v ON v.serial = i.vendor_serial
+ ${sql}
+ ORDER BY ${order}
+ LIMIT ? OFFSET ?`,
+ [...params, limit, offset],
+ )
+
+ const counted = await query(
+ `SELECT COUNT(*) AS n
+ FROM shard_vendor_items i
+ JOIN shard_vendors v ON v.serial = i.vendor_serial
+ ${sql}`,
+ params,
+ )
+
+ return { rows, total: Number(counted[0]?.n) || 0 }
+}
+
+async function getVendor(serial) {
+ const rows = await query(
+ `SELECT serial, shop_name, owner_serial, owner_name, map, x, y, z, region, house,
+ item_count, item_total, truncated, t, updated_at
+ FROM shard_vendors WHERE serial = ?`,
+ [serial],
+ )
+ return rows[0] || null
+}
+
+async function listVendorItems(serial, { limit, offset }) {
+ return query(
+ `SELECT serial, item_id, hue, amount, price, name, cliloc, display_name, child
+ FROM shard_vendor_items
+ WHERE vendor_serial = ?
+ ORDER BY price ASC, id ASC
+ LIMIT ? OFFSET ?`,
+ [serial, limit, offset],
+ )
+}
+
+/**
+ * What the market page's header needs: how big the index is, and how stale it may
+ * be. `staleAt` is the OLDEST vendor row — the round-robin sweep means a shop can
+ * be a full cycle behind, and the page says so rather than implying live prices.
+ */
+async function meta() {
+ const rows = await query(
+ `SELECT COUNT(*) AS vendors, MIN(updated_at) AS stale_at, MAX(updated_at) AS fresh_at
+ FROM shard_vendors`,
+ )
+ const items = await query('SELECT COUNT(*) AS n FROM shard_vendor_items')
+ return {
+ vendors: Number(rows[0]?.vendors) || 0,
+ items: Number(items[0]?.n) || 0,
+ staleAt: rows[0]?.stale_at || null,
+ freshAt: rows[0]?.fresh_at || null,
+ }
+}
+
+/** The distinct facets and regions holding vendors — drives the page's filters. */
+async function listPlaces() {
+ const maps = await query(
+ 'SELECT DISTINCT map FROM shard_vendors WHERE map IS NOT NULL ORDER BY map',
+ )
+ const regions = await query(
+ 'SELECT DISTINCT region FROM shard_vendors WHERE region IS NOT NULL ORDER BY region',
+ )
+ return { maps: maps.map((r) => r.map), regions: regions.map((r) => r.region) }
+}
+
+// ── Cliloc re-resolution ───────────────────────────────────────────────────
+
+/**
+ * One page of listings whose name still needs resolving, for the bulk pass that
+ * runs after a cliloc import.
+ *
+ * Keyed on `id > after` rather than OFFSET: the pass updates the very rows it is
+ * scanning, and an OFFSET walk over a table being rewritten skips rows. Every
+ * row with a cliloc is re-read, not just the unresolved ones, because an import
+ * can also CHANGE a name — a shard overlay relabelling a stock item is the whole
+ * reason overlays exist.
+ */
+async function listResolvableItems(after, limit) {
+ return query(
+ `SELECT id, cliloc, name, display_name
+ FROM shard_vendor_items
+ WHERE cliloc IS NOT NULL AND cliloc > 0 AND id > ?
+ ORDER BY id
+ LIMIT ?`,
+ [after, limit],
+ )
+}
+
+/** Write back a batch of re-resolved display names. */
+async function updateDisplayNames(pairs) {
+ if (pairs.length === 0) return 0
+ const conn = await pool.getConnection()
+ try {
+ await conn.batch('UPDATE shard_vendor_items SET display_name = ? WHERE id = ?', pairs)
+ return pairs.length
+ } finally {
+ conn.release()
+ }
+}
+
+module.exports = {
+ replaceVendor,
+ removeVendor,
+ searchListings,
+ getVendor,
+ listVendorItems,
+ meta,
+ listPlaces,
+ listResolvableItems,
+ updateDisplayNames,
+ likeTerm,
+}
diff --git a/server/src/model/shardMarket/shardMarket.model.js b/server/src/model/shardMarket/shardMarket.model.js
new file mode 100644
index 0000000..a0c781d
--- /dev/null
+++ b/server/src/model/shardMarket/shardMarket.model.js
@@ -0,0 +1,329 @@
+// ── Player-vendor market index (Protocol 3.0 vendor.listing) ───────────────
+//
+// The shard-wide shop index: what every player vendor is selling, for how much,
+// and where it is standing. This is the website's half of the search the in-game
+// Vendor Search gump offers — the same data, the same opt-out, reachable without
+// logging in to the game.
+//
+// Ingest is per-vendor and authoritative: the shard's round-robin sweep emits one
+// `vendor.listing` frame per shop whose contents, prices or location moved, and
+// the frame is the whole shop (see docs/link/v3.md §8 and BridgeMarket.cs). This
+// module normalizes it into shard_vendors + shard_vendor_items and, crucially,
+// resolves each listing's cliloc to a DISPLAY NAME on the way in — a search for
+// "kryss" is a search over names, and the shard only ever sends numbers.
+
+const db = require('./shardMarket.db')
+const clilocs = require('../shardClilocs/shardClilocs.model')
+const log = require('../../utils/logger')('shard-market')
+
+// Defense in depth on top of the shard's own MarketMaxListings cap. The shard is
+// trusted, but it is a separately-versioned component: a frame from a plugin
+// whose cap was raised (or a shard running modified scripts) must not be able to
+// turn one ingest into an unbounded transaction.
+const MAX_ITEMS_PER_VENDOR = 5000
+
+// Column widths in schema.sql. Truncating here rather than letting MariaDB do it
+// keeps the behavior the same in strict mode, where an over-length value is an
+// ERROR and would fail the whole vendor rather than shortening one name.
+const MAX_NAME = 160
+const MAX_SHOP = 160
+const MAX_OWNER = 64
+const MAX_MAP = 40
+const MAX_REGION = 80
+const MAX_SERIAL = 20
+
+const clip = (value, max) => {
+ if (value == null) return null
+ const s = String(value)
+ return s.length > max ? s.slice(0, max) : s
+}
+
+const int = (value, fallback = 0) => {
+ const n = Number(value)
+ return Number.isFinite(n) ? Math.trunc(n) : fallback
+}
+
+// ── Ingest ─────────────────────────────────────────────────────────────────
+
+/**
+ * Flatten one `vendor.listing` frame into the row shapes the DB layer wants.
+ *
+ * `location` arrives as a nested object rather than flat map/x/y/region, and that
+ * shape is load-bearing rather than cosmetic: the visibility projection matches
+ * literal JSON keys, so ONE `market.location` rule can hide a vendor's
+ * whereabouts only if `location` is a single key on both the live frame and the
+ * stored read model. Flattening it here for storage and re-nesting it on read is
+ * what keeps that true on both paths.
+ *
+ * Exported for tests — it is the part with rules in it, and it is pure.
+ */
+function flattenFrame(ev) {
+ const loc = (ev && ev.location) || {}
+ return {
+ serial: clip(ev.serial, MAX_SERIAL),
+ shopName: clip(ev.shopName, MAX_SHOP),
+ ownerSerial: clip(ev.ownerSerial, MAX_SERIAL),
+ ownerName: clip(ev.ownerName, MAX_OWNER),
+ map: clip(loc.map, MAX_MAP),
+ x: Number.isFinite(loc.x) ? Math.trunc(loc.x) : null,
+ y: Number.isFinite(loc.y) ? Math.trunc(loc.y) : null,
+ z: Number.isFinite(loc.z) ? Math.trunc(loc.z) : null,
+ region: clip(loc.region, MAX_REGION),
+ house: clip(loc.house, MAX_SHOP),
+ // What the SHOP holds, which is not what the frame carries when it was
+ // truncated. Kept apart so the page can say "showing 250 of 3,104" rather
+ // than presenting a partial shop as a complete one.
+ itemTotal: int(ev.total, int(ev.count, 0)),
+ truncated: ev.truncated === true,
+ t: Number.isFinite(ev.t) ? ev.t : null,
+ }
+}
+
+/**
+ * Resolve each listing's display name.
+ *
+ * Order of preference is the item's own literal `name` first, then the cliloc.
+ * That is the opposite of what "resolve the id" suggests and it is right: a
+ * literal name only exists because a player set one ("Bob's vanquishing kryss"),
+ * and it is strictly more specific than the generic cliloc the item still
+ * carries.
+ *
+ * One batched lookup per frame rather than per item; `resolveMany` is cached and
+ * never throws, so a cliloc table that is missing entirely just leaves
+ * `displayName` null and the page renders item ids, exactly as it did before the
+ * table existed.
+ */
+async function shapeItems(ev) {
+ const raw = Array.isArray(ev.items) ? ev.items.slice(0, MAX_ITEMS_PER_VENDOR) : []
+
+ const wanted = raw
+ .map((i) => int(i && i.cliloc, 0))
+ .filter((n) => n > 0)
+
+ const names = await clilocs.resolveMany(wanted)
+
+ return raw
+ .filter((i) => i && i.serial)
+ .map((i) => {
+ const literal = clip(i.name, MAX_NAME)
+ const cliloc = int(i.cliloc, 0) || null
+ return {
+ serial: clip(i.serial, MAX_SERIAL),
+ itemId: int(i.itemId, 0),
+ hue: int(i.hue, 0),
+ amount: int(i.amount, 1),
+ price: int(i.price, 0),
+ name: literal,
+ cliloc,
+ displayName: literal || (cliloc ? clip(names.get(cliloc) ?? null, MAX_NAME) : null),
+ child: i.child === true,
+ }
+ })
+ // Unpriced rows are inventory, not listings. The shard already drops them;
+ // this is the same rule enforced where the table is written, so a plugin that
+ // stops enforcing it cannot put un-buyable rows on the market page.
+ .filter((i) => i.price > 0)
+}
+
+/** Ingest one `vendor.listing` frame. */
+async function upsertVendor(ev) {
+ if (!ev || !ev.serial) return
+ const vendor = flattenFrame(ev)
+ const items = await shapeItems(ev)
+ await db.replaceVendor(vendor, items)
+}
+
+/** Ingest one `vendor.listing.remove` frame. */
+async function removeVendor(serial) {
+ if (!serial) return
+ await db.removeVendor(String(serial).slice(0, MAX_SERIAL))
+}
+
+// ── Read models ────────────────────────────────────────────────────────────
+//
+// `location` is re-nested (see flattenFrame) so the stored read model and the
+// live wire frame present the same keys to the visibility projection.
+
+const place = (r) => ({
+ map: r.map,
+ x: r.x,
+ y: r.y,
+ z: r.z,
+ region: r.region,
+ house: r.house,
+})
+
+// A listing as the search returns it: the item, plus enough of its shop to be
+// actionable without a second request. `displayName` falls back to nothing rather
+// than to a fabricated "Item 3922" — the client decides how to render an
+// unresolved id, and inventing a name here would make it indistinguishable from
+// a real one.
+const shapeListing = (r) => ({
+ serial: r.serial,
+ itemId: r.item_id,
+ hue: r.hue,
+ amount: r.amount,
+ price: Number(r.price),
+ name: r.name,
+ cliloc: r.cliloc,
+ displayName: r.display_name,
+ child: !!r.child,
+ vendor: {
+ serial: r.vendor_serial,
+ shopName: r.shop_name,
+ ownerSerial: r.owner_serial,
+ ownerName: r.owner_name,
+ location: place(r),
+ updatedAt: r.updated_at,
+ },
+})
+
+const shapeVendor = (r) => ({
+ serial: r.serial,
+ shopName: r.shop_name,
+ ownerSerial: r.owner_serial,
+ ownerName: r.owner_name,
+ location: place(r),
+ count: r.item_count,
+ total: r.item_total,
+ truncated: !!r.truncated,
+ updatedAt: r.updated_at,
+})
+
+const shapeItem = (r) => ({
+ serial: r.serial,
+ itemId: r.item_id,
+ hue: r.hue,
+ amount: r.amount,
+ price: Number(r.price),
+ name: r.name,
+ cliloc: r.cliloc,
+ displayName: r.display_name,
+ child: !!r.child,
+})
+
+/**
+ * Search the index. Returns a page of LISTINGS (not vendors) plus the
+ * unpaginated total and the staleness stamp the page's banner needs.
+ */
+async function search({
+ q = '',
+ minPrice,
+ maxPrice,
+ itemId,
+ map = '',
+ region = '',
+ sort = 'price_asc',
+ limit = 50,
+ offset = 0,
+} = {}) {
+ const { rows, total } = await db.searchListings({
+ q: q.trim(),
+ minPrice: Number.isFinite(minPrice) ? minPrice : undefined,
+ maxPrice: Number.isFinite(maxPrice) ? maxPrice : undefined,
+ itemId: Number.isFinite(itemId) ? itemId : undefined,
+ map: map.trim(),
+ region: region.trim(),
+ sort,
+ limit,
+ offset,
+ })
+
+ const info = await db.meta()
+
+ return {
+ listings: rows.map(shapeListing),
+ total,
+ limit,
+ offset,
+ // Repeated on every search response rather than left to a separate /meta
+ // call: the banner that says how old these prices are must age with the
+ // results it labels, and a client that fetched it once would keep showing a
+ // stamp from before the page it is looking at.
+ staleAt: info.staleAt,
+ vendors: info.vendors,
+ }
+}
+
+/** One shop and its listings. `null` when the index has never seen that serial. */
+async function getVendor(serial, { limit = 250, offset = 0 } = {}) {
+ const row = await db.getVendor(serial)
+ if (!row) return null
+ const items = await db.listVendorItems(serial, { limit, offset })
+ return { ...shapeVendor(row), items: items.map(shapeItem) }
+}
+
+/** Index size, staleness, and the facet/region filter options. */
+async function meta() {
+ const [info, places] = await Promise.all([db.meta(), db.listPlaces()])
+ return { ...info, ...places }
+}
+
+// ── Cliloc re-resolution ───────────────────────────────────────────────────
+
+// Batch size for the post-import pass. Big enough that a 40k-row table is ~40
+// round trips, small enough that a single batch is not a long-held connection.
+const RESOLVE_BATCH = 1000
+
+/**
+ * Re-resolve every listing's display name against the current cliloc table.
+ *
+ * Called after a cliloc import, and it has to be: the market's diff sweep will
+ * NOT re-send an unchanged shop just because the site learned what its items are
+ * called, so without this an operator who configures clilocs after the first
+ * market sweep sees item ids until every shop happens to change. That is the same
+ * class of staleness the spawn atlas avoids by re-parsing on boot — here the
+ * source of truth for names moved, not the data.
+ *
+ * Never throws. It is a cosmetic backfill on a table that is already serving; a
+ * failure means names stay as they were, which is exactly the pre-import state.
+ */
+async function refreshDisplayNames() {
+ let after = 0
+ let scanned = 0
+ let changed = 0
+
+ try {
+ for (;;) {
+ const rows = await db.listResolvableItems(after, RESOLVE_BATCH)
+ if (rows.length === 0) break
+
+ after = rows[rows.length - 1].id
+ scanned += rows.length
+
+ const names = await clilocs.resolveMany(rows.map((r) => Number(r.cliloc)))
+
+ const pairs = []
+ for (const row of rows) {
+ // The literal name still wins, so a re-resolution never overwrites a
+ // player-set name with the generic cliloc behind it.
+ const next = row.name
+ ? clip(row.name, MAX_NAME)
+ : clip(names.get(Number(row.cliloc)) ?? null, MAX_NAME)
+ if (next !== row.display_name) pairs.push([next, row.id])
+ }
+
+ changed += await db.updateDisplayNames(pairs)
+ }
+
+ if (changed > 0) log.info('market display names refreshed', { scanned, changed })
+ return { scanned, changed }
+ } catch (err) {
+ log.warn('market display-name refresh failed', { message: err.message, scanned, changed })
+ return { scanned, changed, error: err.message }
+ }
+}
+
+module.exports = {
+ upsertVendor,
+ removeVendor,
+ search,
+ getVendor,
+ meta,
+ refreshDisplayNames,
+ flattenFrame,
+ shapeItems,
+ shapeListing,
+ shapeVendor,
+ MAX_ITEMS_PER_VENDOR,
+}
diff --git a/server/src/model/shardState/shardState.db.js b/server/src/model/shardState/shardState.db.js
index c834bb6..38378dd 100644
--- a/server/src/model/shardState/shardState.db.js
+++ b/server/src/model/shardState/shardState.db.js
@@ -259,6 +259,69 @@ async function latestPresence() {
return rows[0] || null
}
+// ── Shard ruleset (Protocol 3.0 world.ruleset) ─────────────────────────────
+// Singleton, same shape as shard_presence: the shard re-emits the whole frame on
+// every connect, so there is nothing to merge — the latest one wins outright.
+async function setRuleset({ rev, expansion, payload, t }) {
+ await query(
+ `INSERT INTO shard_ruleset (id, rev, expansion, payload, t) VALUES (1, ?, ?, ?, ?)
+ ON DUPLICATE KEY UPDATE rev = VALUES(rev), expansion = VALUES(expansion),
+ payload = VALUES(payload), t = VALUES(t)`,
+ [rev ?? null, expansion ?? null, payload, Number.isFinite(t) ? t : null],
+ )
+}
+
+async function getRuleset() {
+ const rows = await query(
+ 'SELECT rev, expansion, payload, t, updated_at FROM shard_ruleset WHERE id = 1',
+ )
+ return rows[0] || null
+}
+
+// ── Points/loyalty boards (Protocol 3.0 points.board) ──────────────────────
+// One row per point system. The shard only emits a system whose top N actually
+// moved, so this is a sparse stream of overwrites; there is no delete, because
+// the shard's set of systems is fixed at startup.
+async function upsertPointsBoard({ system, name, nameCliloc, maxPoints, players, showOnGump, payload, t }) {
+ await query(
+ `INSERT INTO shard_points_boards
+ (system, name, name_cliloc, max_points, players, show_on_gump, payload, t)
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+ ON DUPLICATE KEY UPDATE name = VALUES(name), name_cliloc = VALUES(name_cliloc),
+ max_points = VALUES(max_points), players = VALUES(players),
+ show_on_gump = VALUES(show_on_gump), payload = VALUES(payload), t = VALUES(t)`,
+ [
+ system,
+ name ?? null,
+ Number.isFinite(nameCliloc) ? nameCliloc : null,
+ Number.isFinite(maxPoints) ? maxPoints : null,
+ Number.isFinite(players) ? players : null,
+ showOnGump ? 1 : 0,
+ payload,
+ Number.isFinite(t) ? t : null,
+ ],
+ )
+}
+
+// Ordered by display name, falling back to the system key for a board whose name
+// arrived as a bare cliloc — otherwise every unresolved board would sort together
+// under NULL.
+async function listPointsBoards() {
+ return query(
+ `SELECT system, name, name_cliloc, max_points, players, show_on_gump, payload, t, updated_at
+ FROM shard_points_boards ORDER BY COALESCE(name, system), system`,
+ )
+}
+
+async function getPointsBoard(system) {
+ const rows = await query(
+ `SELECT system, name, name_cliloc, max_points, players, show_on_gump, payload, t, updated_at
+ FROM shard_points_boards WHERE system = ?`,
+ [system],
+ )
+ return rows[0] || null
+}
+
module.exports = {
upsertOnline,
removeOnline,
@@ -290,6 +353,11 @@ module.exports = {
listGovernorTerms,
setPresence,
latestPresence,
+ setRuleset,
+ getRuleset,
+ upsertPointsBoard,
+ listPointsBoards,
+ getPointsBoard,
upsertChamp,
removeChamp,
clearChamps,
diff --git a/server/src/model/shardState/shardState.model.js b/server/src/model/shardState/shardState.model.js
index 1cce781..10a3ba2 100644
--- a/server/src/model/shardState/shardState.model.js
+++ b/server/src/model/shardState/shardState.model.js
@@ -508,6 +508,79 @@ async function latestPresence() {
}
}
+// ── Shard ruleset (Protocol 3.0 world.ruleset) ─────────────────────────────
+//
+// The whole frame is stored in `payload` and served back whole. Nothing is
+// normalized out of it: it is a flat description of config read as one page, and
+// splitting it into columns would mean a schema change every time the shard grows
+// a new block. `rev` and `expansion` are hoisted only because they are cheap to
+// index/display, following shard_champs' payload-plus-hoisted-columns pattern.
+async function setRuleset(ev) {
+ if (!ev) return
+ await db.setRuleset({
+ rev: ev.rev ?? null,
+ expansion: ev.expansion ?? null,
+ payload: JSON.stringify(ev),
+ t: ev.t,
+ })
+}
+
+// The stored ruleset, or null when the shard has never published one (an old
+// plugin, or Bridge.RulesetEnabled=false). Null is a real answer here — the page
+// says "not published yet" rather than rendering an empty ruleset as if the shard
+// had no rules — so it is deliberately not smoothed into {}.
+async function getRuleset() {
+ const r = await db.getRuleset()
+ if (!r) return null
+ const payload = typeof r.payload === 'string' ? safeJson(r.payload) : r.payload
+ if (!payload) return null
+ return { ...payload, updatedAt: r.updated_at }
+}
+
+// ── Points/loyalty boards (Protocol 3.0 points.board) ──────────────────────
+//
+// The whole frame is stored in `payload`; the columns beside it are hoisted for
+// listing and ordering only. The top-N list deliberately stays inside the payload
+// (see schema.sql) — it is a fixed-size list read whole, like the governor board's
+// candidates.
+async function upsertPointsBoard(ev) {
+ if (!ev || !ev.system) return
+ await db.upsertPointsBoard({
+ system: String(ev.system).slice(0, 48),
+ name: ev.nameString ?? null,
+ nameCliloc: ev.nameNumber,
+ maxPoints: ev.maxPoints,
+ players: ev.players,
+ showOnGump: ev.showOnGump !== false,
+ payload: JSON.stringify(ev),
+ t: ev.t,
+ })
+}
+
+// A stored frame plus the freshness stamp. `top` is normalized to an array so a
+// caller never has to guard it — a board with nobody on it is a real state (a
+// system nobody has scored in yet), distinct from a system that was never
+// published at all, which is absent from the table entirely.
+function shapePointsBoard(r) {
+ const payload = (typeof r.payload === 'string' ? safeJson(r.payload) : r.payload) || {}
+ return {
+ ...payload,
+ system: r.system,
+ top: Array.isArray(payload.top) ? payload.top : [],
+ updatedAt: r.updated_at,
+ }
+}
+
+async function listPointsBoards() {
+ const rows = await db.listPointsBoards()
+ return rows.map(shapePointsBoard)
+}
+
+async function getPointsBoard(system) {
+ const r = await db.getPointsBoard(system)
+ return r ? shapePointsBoard(r) : null
+}
+
function safeJson(s) {
try {
return JSON.parse(s)
@@ -557,4 +630,9 @@ module.exports = {
replaceGovernors,
setPresence,
latestPresence,
+ setRuleset,
+ getRuleset,
+ upsertPointsBoard,
+ listPointsBoards,
+ getPointsBoard,
}
diff --git a/server/src/model/shardVisibility/shardVisibility.db.js b/server/src/model/shardVisibility/shardVisibility.db.js
new file mode 100644
index 0000000..2294482
--- /dev/null
+++ b/server/src/model/shardVisibility/shardVisibility.db.js
@@ -0,0 +1,37 @@
+const { query } = require('../../utils/db')
+
+// One row per shard feature. Absent rows are fine — utils/shardVisibility.js
+// compiles a default for every known feature and merges stored rows over it, so
+// a fresh install with an empty table behaves exactly as the site did pre-v3.
+
+const COLS = 'feature, enabled, audience, stream, field_rules, updated_by, updated_at'
+
+const listAll = () => query(`SELECT ${COLS} FROM shard_feature_visibility`)
+
+const getOne = (feature) =>
+ query(`SELECT ${COLS} FROM shard_feature_visibility WHERE feature = ?`, [feature])
+
+// Upsert one feature's settings. `fieldRules` is stored as a JSON object of
+// {field: rung}; the caller has already stripped locked fields and validated
+// every rung against the ladder.
+const upsert = ({ feature, enabled, audience, stream, fieldRules, updatedBy }) =>
+ query(
+ `INSERT INTO shard_feature_visibility (feature, enabled, audience, stream, field_rules, updated_by)
+ VALUES (?, ?, ?, ?, ?, ?)
+ ON DUPLICATE KEY UPDATE
+ enabled = VALUES(enabled),
+ audience = VALUES(audience),
+ stream = VALUES(stream),
+ field_rules = VALUES(field_rules),
+ updated_by = VALUES(updated_by)`,
+ [
+ feature,
+ enabled ? 1 : 0,
+ audience,
+ stream ? 1 : 0,
+ fieldRules == null ? null : JSON.stringify(fieldRules),
+ updatedBy ?? null,
+ ],
+ )
+
+module.exports = { listAll, getOne, upsert }
diff --git a/server/src/model/shardVisibility/shardVisibility.model.js b/server/src/model/shardVisibility/shardVisibility.model.js
new file mode 100644
index 0000000..094989a
--- /dev/null
+++ b/server/src/model/shardVisibility/shardVisibility.model.js
@@ -0,0 +1,44 @@
+// ── Shard feature visibility (model) ───────────────────────────────────────
+//
+// Thin row-shaping layer over shardVisibility.db. The policy — the ladder, the
+// feature catalog, the locked fields, the kind→feature map — lives in
+// utils/shardVisibility.js; this file only reads and writes rows.
+
+const db = require('./shardVisibility.db')
+
+// The `field_rules` JSON column comes back as a string on the mariadb driver.
+function parseRules(raw) {
+ if (raw == null) return {}
+ if (typeof raw === 'object') return raw
+ try {
+ const parsed = JSON.parse(raw)
+ return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {}
+ } catch {
+ return {}
+ }
+}
+
+const toSafe = (row) =>
+ row && {
+ feature: row.feature,
+ enabled: !!row.enabled,
+ audience: row.audience,
+ stream: row.stream == null ? null : !!row.stream,
+ fieldRules: parseRules(row.field_rules),
+ updatedBy: row.updated_by,
+ updatedAt: row.updated_at,
+ }
+
+async function listAll() {
+ const rows = await db.listAll()
+ return rows.map(toSafe)
+}
+
+async function getOne(feature) {
+ const rows = await db.getOne(feature)
+ return toSafe(rows[0])
+}
+
+const upsert = (entry) => db.upsert(entry)
+
+module.exports = { listAll, getOne, upsert }
diff --git a/server/src/model/uoLinkConfig/uoLinkConfig.model.js b/server/src/model/uoLinkConfig/uoLinkConfig.model.js
index 5b3736e..b783367 100644
--- a/server/src/model/uoLinkConfig/uoLinkConfig.model.js
+++ b/server/src/model/uoLinkConfig/uoLinkConfig.model.js
@@ -7,7 +7,10 @@
const db = require('./uoLinkConfig.db')
const secretBox = require('../../utils/secretBox')
-const DEFAULT_PROTOCOL = Number(process.env.UOLINK_PROTOCOL) || 1
+// The wire protocol this build speaks (link/sidecar/src/main.rs PROTOCOL_VERSION).
+// Only used before an admin has saved anything — the stored row wins once it exists,
+// and UOLINK_PROTOCOL still overrides for an operator running an older sidecar.
+const DEFAULT_PROTOCOL = Number(process.env.UOLINK_PROTOCOL) || 3
function toSafe(row) {
if (!row) {
diff --git a/server/src/router/v1/admin/shard.router.js b/server/src/router/v1/admin/shard.router.js
index 70a2ada..e886647 100644
--- a/server/src/router/v1/admin/shard.router.js
+++ b/server/src/router/v1/admin/shard.router.js
@@ -23,6 +23,9 @@ const express = require('express')
const { body, param } = require('express-validator')
const shardOps = require('./shardOps.controller')
+const shardVisibility = require('./shardVisibility.controller')
+const shardAtlas = require('./shardAtlas.controller')
+const shardClilocs = require('./shardClilocs.controller')
const selfShard = require('../player/shard.controller')
const { requireRole } = require('../../../utils/auth')
const validate = require('../../../middleware/validate')
@@ -31,6 +34,8 @@ const shardRouter = express.Router()
// Moderator gate. Admins can do everything a moderator can.
const modAccess = requireRole('admin', 'moderator')
+// Admin-only gate, for settings that decide what the PUBLIC sees.
+const adminOnly = requireRole('admin')
// ── Game account linking (self-service, any staff role) ───────────────
// Staff link their OWN in-game account here, exactly like players do under
@@ -232,4 +237,150 @@ shardRouter.get(
shardOps.listHouses,
)
+// ── Spawn atlas (admin only) ──────────────────────────────────────────
+// Operating the atlas import. Admin-only rather than moderator: it reads a path
+// on the server's filesystem and replaces every atlas table, which is closer to
+// a deploy action than to moderation.
+//
+// These routes sit under /admin/shard even though the public ones deliberately
+// do NOT sit under /public/shard. That is not an inconsistency: the public split
+// says "this data does not come from the sidecar", while the admin panel is
+// simply part of shard administration and belongs beside the rest of it.
+shardRouter.get(
+ '/atlas',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Spawn atlas status: path, drift, counts, pending review (admin only)'
+ // #swagger.description = 'Where the ServUO tree is, whether it can be read, whether its source files have drifted from the loaded atlas, and any refresh staged for approval. The public /atlas/meta route reports the game world only; the filesystem detail is here.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.responses[200] = { description: 'Atlas status', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasStatus" } } } } */
+ /* #swagger.responses[403] = { description: 'Admin role required', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ adminOnly,
+ shardAtlas.getStatus,
+)
+shardRouter.post(
+ '/atlas/import',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Re-import the spawn atlas from the ServUO tree (admin only)'
+ // #swagger.description = 'Applies a map change without a restart. `force` reimports even when the source hashes match what is loaded. A refresh that would REMOVE a facet is still staged for approval rather than applied — that decision is never taken implicitly. An unreadable tree answers 200 with status "unavailable" rather than 500: the refresh contract reports outcomes instead of throwing, and the admin needs to be told what is wrong with the path.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.requestBody = { required: false, content: { "application/json": { schema: { type: "object", properties: { force: { type: "boolean", description: "Reimport even if the tree is unchanged." } } } } } } */
+ /* #swagger.responses[200] = { description: 'What happened', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasRefreshResult" } } } } */
+ adminOnly,
+ body('force').optional().isBoolean(),
+ validate,
+ shardAtlas.importAtlas,
+)
+shardRouter.post(
+ '/atlas/approve',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Approve a staged atlas refresh that removes a facet (admin only)'
+ // #swagger.description = 'Re-parses the tree and applies it, facet loss included. Only the decision was stored, never the parsed world, so what lands matches the tree at approval time — an operator who has since fixed a half-copied mount gets the corrected import.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.responses[200] = { description: 'What happened', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasRefreshResult" } } } } */
+ adminOnly,
+ shardAtlas.approve,
+)
+shardRouter.post(
+ '/atlas/reject',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Reject a staged atlas refresh (admin only)'
+ // #swagger.description = 'Keeps the current atlas and remembers the decision against those exact source hashes, so a declined refresh does not re-prompt on every restart. Changing the tree asks again.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.responses[200] = { description: 'Rejected', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasRefreshResult" } } } } */
+ /* #swagger.responses[404] = { description: 'Nothing is awaiting review', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ adminOnly,
+ shardAtlas.reject,
+)
+shardRouter.put(
+ '/atlas/path',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Set the ServUO tree the atlas reads from (admin only)'
+ // #swagger.description = 'Persisted as a setting, which wins over the SERVUO_PATH deploy default so the mount can move without a redeploy. Blank clears it and the atlas is simply skipped on the next boot. Deliberately does not import as a side effect — the response carries the refreshed status so the panel can offer that as the next step.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: "object", required: ["path"], properties: { path: { type: "string", description: "Absolute path to the ServUO server root. Blank disables the atlas." } } } } } } */
+ /* #swagger.responses[200] = { description: 'Atlas status after the change', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasStatus" } } } } */
+ adminOnly,
+ body('path').isString().isLength({ max: 512 }),
+ validate,
+ shardAtlas.setPath,
+)
+
+// ── Cliloc table (admin only) ─────────────────────────────────────────────
+// UO's id → display-string map, converted once by the operator from their own
+// client (docs/website/CLILOCS.md). Sits beside the atlas for the same reason:
+// it is static content derived from operator-supplied files rather than anything
+// the sidecar sends, and operating it is shard administration.
+//
+// There is deliberately NO public counterpart. The table is never served as a
+// table — 123k rows would dwarf any page that used it, and the Android client
+// consumes the same already-resolved JSON. Names are applied server-side to the
+// responses that need them.
+shardRouter.get(
+ '/clilocs',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Cliloc table status: sources, drift, entry count (admin only)'
+ // #swagger.description = 'Where the cliloc sources are, whether they can be read, how many entries are loaded, and whether the files on disk have drifted from them. The table is built from a SET of sources — the converted client table plus every operator-maintained overlay under `custom/`, which is how shard-added and shard-edited items get names. `missingSources` lists any source that was loaded before and is now gone; an import refuses that without `approve`. A shard with nothing configured is a supported state — item names simply render as ids.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.responses[200] = { description: 'Cliloc status', content: { "application/json": { schema: { $ref: "#/components/schemas/ClilocStatus" } } } } */
+ /* #swagger.responses[403] = { description: 'Admin role required', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ adminOnly,
+ shardClilocs.getStatus,
+)
+shardRouter.post(
+ '/clilocs/import',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Re-import the cliloc table from its source files (admin only)'
+ // #swagger.description = 'Applies a client patch, or a change to the shard\'s own overlay files, without a restart. `force` reimports even when the source hashes match what is loaded. `approve` accepts a refresh in which a previously-loaded source has VANISHED — refused by default, because an unmounted volume and a deliberate deletion are indistinguishable from the server, and the wrong guess silently drops every name that file contributed. A missing path — or the common mistake of pointing at the client\'s own COMPRESSED Cliloc.enu — answers 200 with status "unavailable" and the reason, rather than 500: the refresh contract reports outcomes instead of throwing, and the admin needs to be told which file to convert.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.requestBody = { required: false, content: { "application/json": { schema: { type: "object", properties: { force: { type: "boolean", description: "Reimport even if the sources are unchanged." }, approve: { type: "boolean", description: "Accept a refresh in which a previously-loaded source has vanished." } } } } } } */
+ /* #swagger.responses[200] = { description: 'What happened', content: { "application/json": { schema: { $ref: "#/components/schemas/ClilocRefreshResult" } } } } */
+ adminOnly,
+ body('force').optional().isBoolean(),
+ body('approve').optional().isBoolean(),
+ validate,
+ shardClilocs.importClilocs,
+)
+shardRouter.put(
+ '/clilocs/path',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Set the cliloc source the site reads from (admin only)'
+ // #swagger.description = 'Accepts either the converted base file itself or a directory to search. Overlays are read from a `custom/` directory beside it either way — pointing at a file does not forfeit them. Persisted as a setting, which wins over the UO_CLIENT_PATH deploy default so the mount can move without a redeploy. Blank clears it and resolution is skipped on the next boot. Deliberately does not import as a side effect — the response carries the refreshed status so the panel can offer that as the next step.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: "object", required: ["path"], properties: { path: { type: "string", description: "Path to the converted cliloc file, or a directory containing one. Blank disables resolution." } } } } } } */
+ /* #swagger.responses[200] = { description: 'Cliloc status after the change', content: { "application/json": { schema: { $ref: "#/components/schemas/ClilocStatus" } } } } */
+ adminOnly,
+ body('path').isString().isLength({ max: 512 }),
+ validate,
+ shardClilocs.setPath,
+)
+
+// ── Feature visibility (admin only) ───────────────────────────────────
+// Who can see which shard surface, and which sensitive fields within it. This
+// decides what ANONYMOUS visitors get, so it sits above the moderator tier.
+shardRouter.get(
+ '/visibility',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Get per-feature shard visibility config (admin only)'
+ // #swagger.description = 'The effective config (compiled defaults merged with stored overrides) plus the vocabulary the admin UI renders from: the audience ladder and the always-locked fields. Defaults reproduce pre-v3 behavior.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.responses[200] = { description: 'Visibility config', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardVisibilityConfig" } } } } */
+ /* #swagger.responses[403] = { description: 'Admin role required', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ adminOnly,
+ shardVisibility.getVisibility,
+)
+shardRouter.put(
+ '/visibility',
+ // #swagger.tags = ['Admin · Shard']
+ // #swagger.summary = 'Update per-feature shard visibility config (admin only)'
+ // #swagger.description = 'Patch one or more features. Unknown feature names, unknown rungs, and any attempt to configure a locked field (acct / webId — admin-only always) are rejected with 400 rather than silently dropped.'
+ // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+ /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ShardVisibilityUpdate" } } } } */
+ /* #swagger.responses[200] = { description: 'Updated config', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardVisibilityConfig" } } } } */
+ /* #swagger.responses[400] = { description: 'Unknown feature, rung, or a locked field', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ adminOnly,
+ body('features').isObject(),
+ validate,
+ shardVisibility.putVisibility,
+)
+
module.exports = shardRouter
diff --git a/server/src/router/v1/admin/shardAtlas.controller.js b/server/src/router/v1/admin/shardAtlas.controller.js
new file mode 100644
index 0000000..b674673
--- /dev/null
+++ b/server/src/router/v1/admin/shardAtlas.controller.js
@@ -0,0 +1,117 @@
+// ── Admin · Spawn atlas ────────────────────────────────────────────────────
+//
+// Operating the atlas import: where the ServUO tree is, whether it has drifted
+// from what is loaded, and the approve/reject decision for a refresh that would
+// remove a facet (docs/website/SPAWN_ATLAS.md).
+//
+// The policy lives in the model. This controller does three things and no more:
+// it validates input, it maps a refresh RESULT onto an HTTP status, and it
+// records the action in the admin activity log.
+//
+// **A refresh result is not an exception.** `shardAtlas.refresh()` reports
+// `unavailable` / `failed` / `needsReview` rather than throwing, because the boot
+// path must never be stopped by a bad tree. That contract is preserved here: an
+// unreadable mount is a 200 carrying `status: 'unavailable'`, not a 500. The
+// admin needs to be told what is wrong with their path, and a 500 says only
+// "something broke".
+
+const atlas = require('../../../model/shardAtlas/shardAtlas.model')
+const activity = require('../../../model/activity/activity.model')
+
+const log = require('../../../utils/logger')('admin-shard-atlas')
+
+// GET /admin/shard/atlas — what is loaded, what the tree looks like, what is
+// staged. Unlike the public /atlas/meta route this DOES carry the filesystem
+// path and the drift flag: that is the whole point of the panel.
+async function getStatus(req, res) {
+ try {
+ return res.json(await atlas.status())
+ } catch (err) {
+ log.error('getStatus', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// POST /admin/shard/atlas/import — apply a map change without a restart.
+//
+// `force` reimports even when the source hashes match what is loaded (the escape
+// hatch for "the database is wrong but the tree is not"). Facet loss is still
+// staged rather than applied — approving is a separate, explicit act.
+async function importAtlas(req, res) {
+ try {
+ const force = !!req.body?.force
+ const result = await atlas.refresh({ force })
+ await activity.log({
+ req,
+ action: 'shard.atlas.import',
+ detail: { force, status: result.status, counts: result.counts ?? null },
+ })
+ return res.json(result)
+ } catch (err) {
+ log.error('importAtlas', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// POST /admin/shard/atlas/approve — apply a staged refresh, facet loss and all.
+//
+// Re-parses the tree rather than applying something captured at boot: only the
+// DECISION was stored, so what lands matches the tree as it is now. If the
+// operator has since fixed a half-copied mount, the approved import is simply
+// the corrected one — which is the desired outcome, not a surprise.
+async function approve(req, res) {
+ try {
+ const result = await atlas.approvePending()
+ await activity.log({
+ req,
+ action: 'shard.atlas.approve',
+ detail: { status: result.status, removed: result.removedFacets ?? null },
+ })
+ return res.json(result)
+ } catch (err) {
+ log.error('approveAtlas', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// POST /admin/shard/atlas/reject — keep the current atlas and remember the
+// decision against those exact source hashes, so a declined refresh does not
+// re-prompt on every restart. Changing the tree asks again.
+async function reject(req, res) {
+ try {
+ const result = await atlas.rejectPending()
+ if (result.status === 'none') {
+ return res.status(404).json({ message: 'No refresh is awaiting review.' })
+ }
+ await activity.log({ req, action: 'shard.atlas.reject', detail: {} })
+ return res.json(result)
+ } catch (err) {
+ log.error('rejectAtlas', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// PUT /admin/shard/atlas/path — point the atlas at a different ServUO tree.
+//
+// Persisted as a setting, which wins over the SERVUO_PATH env default so an
+// operator can move the mount without a redeploy. Blank clears it, which turns
+// the atlas off (boot skips, the loaded atlas keeps serving) — that is a
+// legitimate thing to want, so it is allowed rather than validated away.
+//
+// Deliberately does NOT import as a side effect: changing where the atlas reads
+// from and reloading it are separate decisions, and an operator fixing a typo
+// should not have a multi-thousand-row replace happen under them. The response
+// carries the refreshed status so the panel can offer the import immediately.
+async function setPath(req, res) {
+ try {
+ const value = String(req.body?.path ?? '').trim()
+ await atlas.setServuoPath(value, req.user?.id ?? null)
+ await activity.log({ req, action: 'shard.atlas.path', detail: { path: value } })
+ return res.json(await atlas.status())
+ } catch (err) {
+ log.error('setAtlasPath', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+module.exports = { getStatus, importAtlas, approve, reject, setPath }
diff --git a/server/src/router/v1/admin/shardClilocs.controller.js b/server/src/router/v1/admin/shardClilocs.controller.js
new file mode 100644
index 0000000..2ecf4a3
--- /dev/null
+++ b/server/src/router/v1/admin/shardClilocs.controller.js
@@ -0,0 +1,106 @@
+// ── Admin · Cliloc table ───────────────────────────────────────────────────
+//
+// Operating the cliloc import: where the converted cliloc file is, whether it
+// has drifted from what is loaded, and a forced reimport after a client patch
+// (docs/website/CLILOCS.md).
+//
+// The policy lives in the model. This controller does three things and no more:
+// it validates input, it maps a refresh RESULT onto an HTTP status, and it
+// records the action in the admin activity log.
+//
+// **A refresh result is not an exception.** `shardClilocs.refresh()` reports
+// `unavailable` / `failed` rather than throwing, because the boot path must never
+// be stopped by a bad file. That contract is preserved here: a missing file, or
+// the single most likely operator mistake — pointing at the client's own
+// COMPRESSED `Cliloc.enu` — is a 200 carrying `status: 'unavailable'` and the
+// reason, not a 500. A 500 would say only "something broke"; the operator needs
+// to be told which file to convert.
+
+const clilocs = require('../../../model/shardClilocs/shardClilocs.model')
+const market = require('../../../model/shardMarket/shardMarket.model')
+const activity = require('../../../model/activity/activity.model')
+
+const log = require('../../../utils/logger')('admin-shard-clilocs')
+
+// GET /admin/shard/clilocs — what is loaded, what the file looks like, whether
+// they disagree. There is no public counterpart: the cliloc table is never
+// served as a table, only applied to names the site already returns.
+async function getStatus(req, res) {
+ try {
+ return res.json(await clilocs.status())
+ } catch (err) {
+ log.error('getStatus', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// POST /admin/shard/clilocs/import — reload after a client patch or a change to
+// the shard's own overlay files, without a restart.
+//
+// `force` reimports even when the source hashes match what is loaded (the escape
+// hatch for "the database is wrong but the files are not").
+//
+// `approve` accepts a refresh in which a previously-loaded source has VANISHED.
+// That is refused by default because an unmounted volume and a deliberate
+// deletion look identical from the server — the lighter cousin of the atlas's
+// approve/reject flow, and the reason it can be a flag here rather than a
+// pending table is that nothing is stored to approve: the import re-reads the
+// files at approval time by construction.
+async function importClilocs(req, res) {
+ try {
+ const force = !!req.body?.force
+ const approve = !!req.body?.approve
+ const result = await clilocs.refresh({ force, approve })
+
+ // The marketplace denormalizes resolved item names into
+ // shard_vendor_items.display_name, and the shard's market sweep will NOT
+ // re-send an unchanged shop just because the site learned what its items are
+ // called — so without this pass, an operator who imports clilocs after the
+ // first sweep keeps seeing item ids until every shop happens to change.
+ // Awaited (rather than fired and forgotten) so the panel's "imported" is
+ // honest about the names being live; the pass is a bounded walk of one table
+ // and never throws.
+ if (result.status === 'imported') await market.refreshDisplayNames()
+
+ await activity.log({
+ req,
+ action: 'shard.clilocs.import',
+ detail: {
+ force,
+ approve,
+ status: result.status,
+ count: result.count ?? null,
+ missingSources: result.missingSources ?? result.acceptedMissing ?? null,
+ },
+ })
+ return res.json(result)
+ } catch (err) {
+ log.error('importClilocs', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// PUT /admin/shard/clilocs/path — point the site at a different cliloc file.
+//
+// Persisted as a setting, which wins over the UO_CLIENT_PATH env default so an
+// operator can move the mount without a redeploy. Blank clears it, which turns
+// resolution off (boot skips, the loaded table keeps serving) — a legitimate
+// thing to want, so it is allowed rather than validated away.
+//
+// Deliberately does NOT import as a side effect, for the same reason the atlas
+// path does not: changing where the table reads from and reloading it are
+// separate decisions. The response carries the refreshed status so the panel can
+// offer the import immediately.
+async function setPath(req, res) {
+ try {
+ const value = String(req.body?.path ?? '').trim()
+ await clilocs.setClientPath(value, req.user?.id ?? null)
+ await activity.log({ req, action: 'shard.clilocs.path', detail: { path: value } })
+ return res.json(await clilocs.status())
+ } catch (err) {
+ log.error('setClilocPath', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+module.exports = { getStatus, importClilocs, setPath }
diff --git a/server/src/router/v1/admin/shardVisibility.controller.js b/server/src/router/v1/admin/shardVisibility.controller.js
new file mode 100644
index 0000000..eab2bd6
--- /dev/null
+++ b/server/src/router/v1/admin/shardVisibility.controller.js
@@ -0,0 +1,98 @@
+// ── Admin · Shard visibility ───────────────────────────────────────────────
+//
+// Read/write the per-feature audience config that gates every shard-derived
+// surface. Admin-only: this decides what anonymous visitors can see, so it is
+// not part of the moderator tier.
+//
+// The policy itself (the ladder, the feature catalog, which fields are locked)
+// lives in utils/shardVisibility.js. This controller only validates input
+// against that policy and persists it.
+
+const model = require('../../../model/shardVisibility/shardVisibility.model')
+const visibility = require('../../../utils/shardVisibility')
+const log = require('../../../utils/logger')('admin-shard-visibility')
+
+// GET /admin/shard/visibility — the effective config (defaults merged with any
+// stored overrides), plus the vocabulary the admin UI needs to render itself:
+// the ladder, and which fields each feature exposes as configurable.
+async function getVisibility(req, res) {
+ try {
+ const config = await visibility.getConfig()
+ return res.json({
+ ladder: visibility.LADDER,
+ lockedFields: Object.keys(visibility.LOCKED_FIELDS),
+ defaults: visibility.compileDefaults(),
+ features: config,
+ })
+ } catch (err) {
+ log.error('getVisibility', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// PUT /admin/shard/visibility — replace the settings for one or more features.
+// Body: { features: { : { enabled, audience, stream, fieldRules } } }
+//
+// Rejects unknown feature names, unknown rungs, and any attempt to configure a
+// locked field — a 400 rather than a silent drop, so an admin who tries to make
+// `acct` public learns that it is not negotiable.
+async function putVisibility(req, res) {
+ try {
+ const incoming = req.body?.features
+ if (!incoming || typeof incoming !== 'object' || Array.isArray(incoming)) {
+ return res.status(400).json({ message: 'features object required' })
+ }
+
+ const entries = []
+ for (const [name, patch] of Object.entries(incoming)) {
+ if (!visibility.isFeature(name)) {
+ return res.status(400).json({ message: `Unknown feature: ${name}` })
+ }
+ if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
+ return res.status(400).json({ message: `Invalid settings for ${name}` })
+ }
+ if (patch.audience != null && !visibility.isLevel(patch.audience)) {
+ return res.status(400).json({ message: `Unknown audience for ${name}: ${patch.audience}` })
+ }
+
+ const fieldRules = {}
+ for (const [field, level] of Object.entries(patch.fieldRules || {})) {
+ // Matches flattened spellings too (`ownerAcct`, `leaderWebId`), so the
+ // rejection covers every way the field can be named rather than the two
+ // canonical keys.
+ if (visibility.isLockedField(field)) {
+ return res.status(400).json({ message: `Field '${field}' is admin-only and cannot be configured` })
+ }
+ if (!visibility.isLevel(level)) {
+ return res.status(400).json({ message: `Unknown rung for ${name}.${field}: ${level}` })
+ }
+ fieldRules[field] = level
+ }
+
+ const current = (await visibility.getConfig())[name]
+ entries.push({
+ feature: name,
+ enabled: patch.enabled == null ? current.enabled : !!patch.enabled,
+ audience: patch.audience ?? current.audience,
+ stream: patch.stream == null ? current.stream : !!patch.stream,
+ fieldRules,
+ updatedBy: req.user?.id ?? null,
+ })
+ }
+
+ for (const entry of entries) await model.upsert(entry)
+ visibility.invalidate()
+
+ log.info('shard visibility updated', {
+ by: req.user?.id,
+ features: entries.map((e) => e.feature),
+ })
+
+ return res.json({ features: await visibility.getConfig() })
+ } catch (err) {
+ log.error('putVisibility', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+module.exports = { getVisibility, putVisibility }
diff --git a/server/src/router/v1/player/shard.controller.js b/server/src/router/v1/player/shard.controller.js
index 1603000..9f7c5d3 100644
--- a/server/src/router/v1/player/shard.controller.js
+++ b/server/src/router/v1/player/shard.controller.js
@@ -10,6 +10,7 @@
const uoLinkClient = require('../../../utils/uoLinkClient')
const shardLinks = require('../../../model/shardLinks/shardLinks.model')
const shardState = require('../../../model/shardState/shardState.model')
+const shardClilocs = require('../../../model/shardClilocs/shardClilocs.model')
const settings = require('../../../model/settings/settings.model')
const { salesForAccounts } = require('../../../utils/shardSales')
const activity = require('../../../model/activity/activity.model')
@@ -18,9 +19,62 @@ const log = require('../../../utils/logger')('player-shard')
const SERIAL_RE = /^0x[0-9a-fA-F]+$/
+/**
+ * Resolve the cliloc ids on a profile into display names.
+ *
+ * Items on the wire carry a `LabelNumber`, not a name — `BridgeProfile.WriteItem`
+ * sends `cliloc` on every equipment entry and `name` only for the minority of
+ * items a player has renamed. Reward titles are the same shape: the shard sends
+ * a cliloc number as a string, which the sheet previously had to SKIP because it
+ * had no way to turn it into words.
+ *
+ * Resolution happens here rather than in the browser because the table is ~123k
+ * rows: shipping it to render a dozen names would dwarf the page, and the
+ * Android client consumes this same JSON and would otherwise need its own copy.
+ *
+ * A shard with no cliloc table configured resolves nothing and the sheet renders
+ * ids exactly as it did before — this is decoration, and it is applied in the
+ * same best-effort block as the guild/governor cross-links.
+ */
+async function resolveProfileClilocs(profile) {
+ const wanted = []
+
+ const equipment = Array.isArray(profile.equipment) ? profile.equipment : []
+ for (const item of equipment) {
+ if (Number.isInteger(item?.cliloc)) wanted.push(item.cliloc)
+ }
+
+ // Reward titles arrive as strings that may be either a literal ("Knight of
+ // Trinsic") or a cliloc number in string form. Only the numeric ones need us.
+ const reward = Array.isArray(profile.titles?.reward) ? profile.titles.reward : []
+ const rewardNumbers = reward.map((r) => (/^\d+$/.test(String(r)) ? Number(r) : null))
+ for (const n of rewardNumbers) if (n !== null) wanted.push(n)
+
+ if (wanted.length === 0) return
+
+ const names = await shardClilocs.resolveMany(wanted)
+ if (names.size === 0) return
+
+ for (const item of equipment) {
+ // A player-given name always wins over the type name: an item called "Bob's
+ // lucky axe" should not be relabelled "hatchet".
+ if (item?.name) continue
+ const resolved = names.get(item?.cliloc)
+ if (resolved) item.clilocName = resolved
+ }
+
+ if (rewardNumbers.some((n) => n !== null)) {
+ profile.titles.rewardResolved = reward.map((raw, i) => {
+ const n = rewardNumbers[i]
+ return n === null ? String(raw) : names.get(n) ?? null
+ })
+ }
+}
+
// Decorate a char.profile with cross-links from our own board data: the guild the
-// character leads and any city governorship on its account. Best-effort — a
-// failure here never fails the profile (it's a nicety, not the sheet).
+// character leads and any city governorship on its account, plus resolved cliloc
+// names. Best-effort — a failure here never fails the profile (it's a nicety,
+// not the sheet).
async function enrichCharProfile(profile) {
if (!profile) return profile
try {
@@ -30,6 +84,7 @@ async function enrichCharProfile(profile) {
const govs = await shardState.listGovernorshipsForAccounts([profile.acct])
if (govs.length) profile.governorOf = govs.map((g) => g.city)
}
+ await resolveProfileClilocs(profile)
} catch (err) {
log.warn('enrichCharProfile failed', { serial: profile.serial, message: err.message })
}
diff --git a/server/src/router/v1/public/atlas.controller.js b/server/src/router/v1/public/atlas.controller.js
new file mode 100644
index 0000000..b002519
--- /dev/null
+++ b/server/src/router/v1/public/atlas.controller.js
@@ -0,0 +1,134 @@
+// ── Public: the spawn atlas ────────────────────────────────────────────────
+//
+// A browsable catalogue of what the shard CONTAINS — which creatures spawn,
+// where, how many, and which champion altars are configured. Everything here is
+// a plain indexed read of the tables the boot-time import fills from the shard's
+// own ServUO tree (docs/website/SPAWN_ATLAS.md).
+//
+// Two properties separate this from /public/shard/*:
+//
+// • **Nothing touches the sidecar.** The atlas is static shard content, not
+// live shard state, so these pages stay fully populated while the shard is
+// down. That is why the routes are mounted at /public/atlas and are
+// siteMode-gated like /posts and /wiki, rather than under /shard.
+// • **The live champion feed is a different thing.** `/atlas/champions` is the
+// configured roster ("there is an Unholy Terror altar in Deceit");
+// `/shard/champs` is the running state ("it is on level 3 right now").
+//
+// Every response is still passed through `projectFeature` for the `atlas`
+// feature. It declares no sensitive fields today, so the projection is a
+// no-op — but v3.md §3.6.1's rule is that a read path returning shard data and
+// not projecting is a bug, and the cost of honouring it is one call per handler
+// rather than a retrofit the first time a field needs gating.
+
+const atlas = require('../../../model/shardAtlas/shardAtlas.model')
+const visibility = require('../../../utils/shardVisibility')
+
+const log = require('../../../utils/logger')('public-atlas')
+
+const FEATURE = 'atlas'
+
+// Query params arrive as strings; express-validator has already bounded them.
+const int = (value, fallback) => {
+ const n = Number.parseInt(value, 10)
+ return Number.isFinite(n) ? n : fallback
+}
+
+const str = (value) => (typeof value === 'string' ? value.trim() : '')
+
+// GET /public/atlas/creatures?q=&facet=&limit=&offset=
+async function getCreatures(req, res) {
+ try {
+ const page = await atlas.searchCreatures({
+ q: str(req.query.q),
+ facet: str(req.query.facet),
+ limit: int(req.query.limit, 50),
+ offset: int(req.query.offset, 0),
+ })
+ return res.json(await visibility.project(FEATURE, page, req))
+ } catch (err) {
+ log.error('atlas.getCreatures', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/atlas/creatures/:slug — one creature, with the places it spawns.
+//
+// 404 means "no such creature in this atlas", which also covers "the atlas has
+// never been imported" — an empty atlas has no slugs, and there is nothing more
+// specific to say to an anonymous caller.
+async function getCreature(req, res) {
+ try {
+ const creature = await atlas.getCreature(req.params.slug, {
+ facet: str(req.query.facet),
+ points: int(req.query.points, 200),
+ })
+ if (!creature) return res.status(404).json({ message: 'Not Found' })
+ return res.json(await visibility.project(FEATURE, creature, req))
+ } catch (err) {
+ log.error('atlas.getCreature', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/atlas/regions?facet=&q=
+async function getRegions(req, res) {
+ try {
+ const regions = await atlas.listRegions({
+ facet: str(req.query.facet),
+ q: str(req.query.q),
+ })
+ return res.json(await visibility.project(FEATURE, regions, req))
+ } catch (err) {
+ log.error('atlas.getRegions', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/atlas/landmarks?facet=&q=
+async function getLandmarks(req, res) {
+ try {
+ const landmarks = await atlas.listLandmarks({
+ facet: str(req.query.facet),
+ q: str(req.query.q),
+ })
+ return res.json(await visibility.project(FEATURE, landmarks, req))
+ } catch (err) {
+ log.error('atlas.getLandmarks', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/atlas/champions?facet= — the CONFIGURED altar roster.
+async function getChampions(req, res) {
+ try {
+ const champions = await atlas.listChampions({ facet: str(req.query.facet) })
+ return res.json(await visibility.project(FEATURE, champions, req))
+ } catch (err) {
+ log.error('atlas.getChampions', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/atlas/meta — what is loaded: facets, counts, when it was imported.
+//
+// Public-safe by construction: the model omits the ServUO path, the per-file
+// hashes and the pending-refresh state, all of which describe the operator's
+// filesystem rather than the game world. The admin status route carries those.
+async function getMeta(req, res) {
+ try {
+ return res.json(await visibility.project(FEATURE, await atlas.publicMeta(), req))
+ } catch (err) {
+ log.error('atlas.getMeta', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+module.exports = {
+ getCreatures,
+ getCreature,
+ getRegions,
+ getLandmarks,
+ getChampions,
+ getMeta,
+}
diff --git a/server/src/router/v1/public/atlas.router.js b/server/src/router/v1/public/atlas.router.js
new file mode 100644
index 0000000..97498ec
--- /dev/null
+++ b/server/src/router/v1/public/atlas.router.js
@@ -0,0 +1,128 @@
+// Public · Atlas — the spawn atlas / bestiary. Static shard CONTENT derived from
+// the shard's own ServUO tree, not live shard state.
+//
+// Mounted at /api/v1/public/atlas by public/index.js. Two deliberate differences
+// from the /public/shard routes next door (docs/link/v3.md §6):
+//
+// • **Not under /shard.** Nothing here round-trips the sidecar, and the pages
+// stay fully populated while the shard is down. Mounting it under /shard
+// would imply a dependency it does not have.
+// • **siteMode-gated, like /posts and /wiki.** The shard routes are exempt
+// because shard status is wanted *during* maintenance; a bestiary is site
+// content and follows site content's rules.
+//
+// Every route also carries `requireFeature('atlas')` — 404 when an admin has
+// disabled the feature, 403 when the caller sits below its configured audience.
+// The default audience is `anonymous`, so these gates are inert until an admin
+// changes something.
+
+const express = require('express')
+const { param, query } = require('express-validator')
+
+const atlas = require('./atlas.controller')
+const siteMode = require('../../../middleware/siteMode')
+const validate = require('../../../middleware/validate')
+const { requireFeature } = require('../../../utils/shardVisibility')
+
+const atlasRouter = express.Router()
+
+// Facet names come from the shard's own files and are never validated against a
+// list — nothing in the codebase names a facet (§6.1 R2). Only the length is
+// bounded, and the query matches exactly, so an unknown name returns an empty
+// result rather than an error.
+const facetParam = query('facet').optional({ values: 'falsy' }).isString().isLength({ max: 40 })
+
+atlasRouter.get(
+ '/creatures',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'Search the bestiary (paginated)'
+ // #swagger.description = 'Every creature the shard spawns, most numerous first. `total` is how many can be alive at once across all spawners; `points` is how many spawners mention it; `facets` maps facet name to that creature\'s share on it. Static content parsed from the shard\'s ServUO tree — unaffected by the shard being offline.'
+ // #swagger.parameters['q'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Substring match on the creature name (max 60 chars).' }
+ // #swagger.parameters['facet'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to creatures spawning on this facet. Facet names come from the shard\'s own files; an unknown one returns an empty page.' }
+ // #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Page size, 1..100 (default 50).' }
+ // #swagger.parameters['offset'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Rows to skip (default 0).' }
+ /* #swagger.responses[200] = { description: 'A page of creatures plus the unpaginated total', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasCreaturePage" } } } } */
+ /* #swagger.responses[403] = { description: 'The atlas feature is gated above this caller', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ /* #swagger.responses[404] = { description: 'The atlas feature is disabled', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ query('q').optional({ values: 'falsy' }).isString().isLength({ max: 60 }),
+ facetParam,
+ query('limit').optional().isInt({ min: 1, max: 100 }),
+ query('offset').optional().isInt({ min: 0, max: 100000 }),
+ validate,
+ siteMode,
+ atlas.getCreatures,
+)
+atlasRouter.get(
+ '/creatures/:slug',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'One creature: where it spawns, and what spawns with it'
+ // #swagger.description = 'The answer the atlas exists to give. `places` is the aggregate — "lizardman → Shrines, Isamu-Jima, Yew" — resolved by point-in-rect against the shard\'s own region rectangles, falling back to the nearest landmark, else "Wilderness". `spawners` lists the individual spawn points (bounded; `spawnersTruncated` says when the list was cut), and `alsoHere` is what shares those spawners.'
+ // #swagger.parameters['slug'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'Creature slug, e.g. lizardman.' }
+ // #swagger.parameters['facet'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Restrict places and spawners to one facet.' }
+ // #swagger.parameters['points'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Max spawners to return, 1..1000 (default 200).' }
+ /* #swagger.responses[200] = { description: 'The creature', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasCreature" } } } } */
+ /* #swagger.responses[404] = { description: 'No such creature in this atlas (or the feature is disabled)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ param('slug').isString().isLength({ min: 1, max: 120 }),
+ facetParam,
+ query('points').optional().isInt({ min: 1, max: 1000 }),
+ validate,
+ siteMode,
+ atlas.getCreature,
+)
+atlasRouter.get(
+ '/regions',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'Named regions and their rectangles'
+ // #swagger.description = 'Flattened out of the shard\'s nested Regions.xml. `priority` and the rectangles are what placed each spawn point, kept so the placement can be re-derived rather than taken on trust.'
+ // #swagger.parameters['facet'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to one facet.' }
+ // #swagger.parameters['q'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Substring match on the region name.' }
+ /* #swagger.responses[200] = { description: 'Regions, by facet then name', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AtlasRegion" } } } } } */
+ facetParam,
+ query('q').optional({ values: 'falsy' }).isString().isLength({ max: 60 }),
+ validate,
+ siteMode,
+ atlas.getRegions,
+)
+atlasRouter.get(
+ '/landmarks',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'Points of interest (dungeon levels, town markers)'
+ // #swagger.description = 'From the shard\'s Data/Locations files. `group` is the innermost enclosing parent ("Covetous"), which is the label worth showing over the individual marker ("Level 1").'
+ // #swagger.parameters['facet'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to one facet.' }
+ // #swagger.parameters['q'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Substring match on the landmark name or its group.' }
+ /* #swagger.responses[200] = { description: 'Landmarks, by facet then group', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AtlasLandmark" } } } } } */
+ facetParam,
+ query('q').optional({ values: 'falsy' }).isString().isLength({ max: 60 }),
+ validate,
+ siteMode,
+ atlas.getLandmarks,
+)
+atlasRouter.get(
+ '/champions',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'Configured champion altars (the roster, not the live board)'
+ // #swagger.description = 'Where the altars are and what each one summons — "there is an Unholy Terror altar in Deceit". `randomType` marks altars whose champion is drawn at activation. Do not conflate this with GET /public/shard/champs, which is the live sidecar-fed board ("it is on level 3 right now").'
+ // #swagger.parameters['facet'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to one facet.' }
+ /* #swagger.responses[200] = { description: 'Altars, by facet then name', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AtlasChampion" } } } } } */
+ facetParam,
+ validate,
+ siteMode,
+ atlas.getChampions,
+)
+atlasRouter.get(
+ '/meta',
+ requireFeature('atlas'),
+ // #swagger.tags = ['Public · Atlas']
+ // #swagger.summary = 'What atlas is loaded: facets, counts, when it was imported'
+ // #swagger.description = 'Drives the facet filter and the "parsed from the shard\'s own files on " line. Reports the game world only — the ServUO path, the per-file hashes and any pending refresh are operator detail and live on the admin status route.'
+ /* #swagger.responses[200] = { description: 'Atlas metadata', content: { "application/json": { schema: { $ref: "#/components/schemas/AtlasMeta" } } } } */
+ siteMode,
+ atlas.getMeta,
+)
+
+module.exports = atlasRouter
diff --git a/server/src/router/v1/public/index.js b/server/src/router/v1/public/index.js
index 3f90671..4de3329 100644
--- a/server/src/router/v1/public/index.js
+++ b/server/src/router/v1/public/index.js
@@ -21,6 +21,7 @@ const postsRouter = require('./posts.router')
const wikiRouter = require('./wiki.router')
const pagesRouter = require('./pages.router')
const shardRouter = require('./shard.router')
+const atlasRouter = require('./atlas.router')
const siteRouter = require('./site.router')
const publicRouter = express.Router()
@@ -32,6 +33,11 @@ publicRouter.use('/wiki', wikiRouter)
publicRouter.use('/pages', pagesRouter)
// Live shard data, never site-mode gated.
publicRouter.use('/shard', shardRouter)
+// The spawn atlas: static shard CONTENT, parsed from the shard's ServUO tree
+// rather than fetched from the sidecar. Deliberately not under /shard — nothing
+// here depends on the bridge — and site-mode gated per route like the content
+// routers above, which is the other half of that distinction.
+publicRouter.use('/atlas', atlasRouter)
// The four singletons that own no path segment of their own: /settings, /status,
// /version and /contact. Mounted at the group root, last — safe only because
diff --git a/server/src/router/v1/public/shard.controller.js b/server/src/router/v1/public/shard.controller.js
index 64fbdf1..e94fc3f 100644
--- a/server/src/router/v1/public/shard.controller.js
+++ b/server/src/router/v1/public/shard.controller.js
@@ -11,9 +11,10 @@
const shardEvents = require('../../../model/shardEvents/shardEvents.model')
const shardState = require('../../../model/shardState/shardState.model')
+const shardMarket = require('../../../model/shardMarket/shardMarket.model')
const uoLinkConfig = require('../../../model/uoLinkConfig/uoLinkConfig.model')
const broadcast = require('../../../utils/shardBroadcast')
-const auth = require('../../../utils/auth')
+const visibility = require('../../../utils/shardVisibility')
const log = require('../../../utils/logger')('public-shard')
@@ -39,21 +40,49 @@ async function getStatus(req, res) {
}
}
-// GET /public/shard/feed?kind=&limit= — recent notable events from the log,
-// restricted to the public-safe allowlist so staff audit / cheat / link events
-// (which are stored for the admin channel) can never leak to the public.
+// GET /public/shard/feed?kind=&limit= — recent notable events from the log.
+//
+// This is the stored-history twin of the SSE stream, and it must reach the same
+// verdict the stream does about the same event. Two things are therefore resolved
+// against the LIVE config rather than the compiled defaults:
+//
+// • which kinds this viewer may read at all — `visibleKinds`, not the static
+// PUBLIC_KINDS set (which is fixed at module load, so an admin moving
+// `guilds` to `staff` would gate /guilds while /feed kept serving
+// guild.join to anonymous callers), and
+// • the payload itself, projected per event against ITS OWN kind's feature —
+// the rows are a mix of features, and without this the stored frames were
+// returned verbatim, `acct`/`webId` and all, on an anonymous endpoint.
async function getFeed(req, res) {
try {
+ const config = await visibility.getConfig()
+ const level = req.viewerLevel || (await visibility.viewerLevel(req))
+ const allowed = new Set(visibility.visibleKinds(level, config))
+
const { kind, limit } = req.query
+ // No readable kinds ⇒ nothing to serve. Returning early also keeps us clear
+ // of `list({ kinds: [] })`, which means "no filter", not "match nothing".
+ if (allowed.size === 0) return res.json([])
+
let events
if (kind) {
- // A specific kind is only served if it is itself public-safe.
- if (!broadcast.PUBLIC_KINDS.has(kind)) return res.json([])
+ if (!allowed.has(kind)) return res.json([])
events = await shardEvents.list({ kind, limit })
} else {
- events = await shardEvents.list({ kinds: [...broadcast.PUBLIC_KINDS], limit })
+ events = await shardEvents.list({ kinds: [...allowed], limit })
}
- return res.json(events)
+
+ return res.json(
+ events.map((ev) => ({
+ ...ev,
+ payload: visibility.projectFeature(
+ visibility.KIND_FEATURE.get(ev.kind),
+ ev.payload,
+ level,
+ config,
+ ),
+ })),
+ )
} catch (err) {
log.error('shard.getFeed', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -72,18 +101,21 @@ async function getEconomy(req, res) {
// GET /public/shard/online — players online now whose account is linked to a
// STAFF website user (admin/editor/moderator). Everyone sees that a staff member
-// is online (name + serial); their in-game location (map + coordinates) is only
-// included for privileged viewers (admin/moderator) so it is never exposed to
-// players or the public via the network tab. Non-staff players are never listed.
-function canSeeStaffLocation(req) {
- const viewer = auth.getUserFromRequest(req)
- return !!viewer && (viewer.role === 'admin' || viewer.role === 'moderator')
+// is online (name + serial); their in-game location (map + coordinates) is gated
+// on the `presence` feature's `location` field rule, which defaults to `staff`
+// — the same admin/moderator set this used to hardcode. Non-staff players are
+// never listed.
+async function canSeeStaffLocation(req) {
+ const config = await visibility.getConfig()
+ const required = config.presence?.fields?.location || 'staff'
+ const level = req.viewerLevel || (await visibility.viewerLevel(req))
+ return visibility.meets(level, required)
}
async function getOnline(req, res) {
try {
const rows = await shardState.listOnlineLinked()
- const showLocation = canSeeStaffLocation(req)
+ const showLocation = await canSeeStaffLocation(req)
return res.json(
rows.map((r) => {
const entry = { serial: r.serial, name: r.name }
@@ -103,9 +135,14 @@ async function getOnline(req, res) {
}
// GET /public/shard/idoc — houses currently in danger (stage IDOC).
+//
+// Projected: shapeHouse flattens the owner actor into `ownerSerial`/`ownerAcct`/
+// `ownerName`, so this endpoint used to hand an anonymous caller the house
+// owner's GAME ACCOUNT NAME. The public IDOC board only ever needed name, region
+// and location — which is all that survives projection below `staff`.
async function getIdoc(req, res) {
try {
- return res.json(await shardState.listIdoc())
+ return res.json(await visibility.project('houses', await shardState.listIdoc(), req))
} catch (err) {
log.error('shard.getIdoc', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -117,7 +154,7 @@ async function getIdoc(req, res) {
// the public SSE stream so the page can update in place.
async function getChamps(req, res) {
try {
- return res.json(await shardState.listChamps())
+ return res.json(await visibility.project('champs', await shardState.listChamps(), req))
} catch (err) {
log.error('shard.getChamps', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -126,9 +163,13 @@ async function getChamps(req, res) {
// GET /public/shard/guilds — the current guild board. Served from our store;
// live via guild.update / guild.remove / guild.join on the public SSE stream.
+//
+// Projected: the stored payload is the raw guild.update frame, whose `leader`
+// actor carries `acct` and `webId`. Those are admin-only and were previously
+// returned verbatim to anonymous callers.
async function getGuilds(req, res) {
try {
- return res.json(await shardState.listGuilds())
+ return res.json(await visibility.project('guilds', await shardState.listGuilds(), req))
} catch (err) {
log.error('shard.getGuilds', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -136,10 +177,11 @@ async function getGuilds(req, res) {
}
// GET /public/shard/governors — the current town-governor board (empty on shards
-// without City Loyalty). Live via city.update on the public SSE stream.
+// without City Loyalty). Live via city.update on the public SSE stream. Projected
+// for the same reason as getGuilds: `governor` / `governorElect` are actors.
async function getGovernors(req, res) {
try {
- return res.json(await shardState.listGovernors())
+ return res.json(await visibility.project('governors', await shardState.listGovernors(), req))
} catch (err) {
log.error('shard.getGovernors', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -150,7 +192,8 @@ async function getGovernors(req, res) {
// (look-back: "who were all the governors of Britain?"), newest first.
async function getGovernorHistory(req, res) {
try {
- return res.json(await shardState.listGovernorHistory(req.params.city, req.query.limit))
+ const terms = await shardState.listGovernorHistory(req.params.city, req.query.limit)
+ return res.json(await visibility.project('governors', terms, req))
} catch (err) {
log.error('shard.getGovernorHistory', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -161,7 +204,7 @@ async function getGovernorHistory(req, res) {
// + per-region). Live via presence.online on the public SSE stream.
async function getPresence(req, res) {
try {
- return res.json(await shardState.latestPresence())
+ return res.json(await visibility.project('presence', await shardState.latestPresence(), req))
} catch (err) {
log.error('shard.getPresence', err)
return res.status(500).json({ message: 'Internal Server Error' })
@@ -185,16 +228,175 @@ async function getHouses(req, res) {
z: h.z,
isIdoc: true,
}))
- return res.json(publicHouses)
+ // Already a hand-picked safe subset; projected anyway so an admin who
+ // tightens a `houses` field rule sees it honoured on every houses surface
+ // rather than on some of them.
+ return res.json(await visibility.project('houses', publicHouses, req))
} catch (err) {
log.error('shard.getHouses', err)
return res.status(500).json({ message: 'Internal Server Error' })
}
}
-// GET /public/shard/stream — public live-event SSE channel (safe kinds only).
+// GET /public/shard/ruleset — the shard's published ruleset (Protocol 3.0):
+// expansion, which optional systems are on, skill/stat caps, account and house
+// limits, champion scroll rules, the save/restart schedule. Served from our own
+// store, so it renders while the shard is down; live via world.ruleset on the
+// public SSE stream.
+//
+// `null` means the shard has never published one (an old plugin, or
+// Bridge.RulesetEnabled=false) — a real answer, distinct from a published
+// ruleset, and the page says so rather than rendering an empty one.
+//
+// Projected like every other shard read (§3.6.1's rule: a read path that returns
+// shard data and does not call projectFeature is a bug). The `connect` string is
+// the one configurable field — an operator who published a connect address may
+// still want it behind a login.
+async function getRuleset(req, res) {
+ try {
+ const ruleset = await shardState.getRuleset()
+ if (!ruleset) return res.json(null)
+ return res.json(await visibility.project('ruleset', ruleset, req))
+ } catch (err) {
+ log.error('shard.getRuleset', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// The shard keys boards by its own PointsType enum name (QueensLoyalty,
+// CleanUpBritannia, …). Constrain the path param to that shape before it reaches
+// the model: the column is VARCHAR(48), and an unbounded string here is a needless
+// query on a value that can only ever be an identifier.
+const SYSTEM_RE = /^[A-Za-z][A-Za-z0-9_]{0,47}$/
+
+// GET /public/shard/points — every points/loyalty leaderboard the shard publishes.
+// Served from our own store, so the page renders while the shard is down — which
+// matters more here than for live state: these are standings accumulated over
+// months, and blanking them during a restart would look like a data loss.
+async function getPointsBoards(req, res) {
+ try {
+ const boards = await shardState.listPointsBoards()
+ return res.json(await visibility.project('leaderboards', boards, req))
+ } catch (err) {
+ log.error('shard.getPointsBoards', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/shard/points/:system — one system's board.
+//
+// 404 for a system the shard has never published, matching the sidecar: "no such
+// board" and "a board nobody is on yet" are different answers.
+async function getPointsBoard(req, res) {
+ const { system } = req.params
+ if (!SYSTEM_RE.test(system)) return res.status(400).json({ message: 'Invalid points system.' })
+ try {
+ const board = await shardState.getPointsBoard(system)
+ if (!board) return res.status(404).json({ message: 'Unknown points system.' })
+ return res.json(await visibility.project('leaderboards', board, req))
+ } catch (err) {
+ log.error('shard.getPointsBoard', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// ── Marketplace (Protocol 3.0 vendor.listing) ──────────────────────────────
+//
+// The shard-wide player-vendor index. Served entirely from our own tables — the
+// sidecar is never touched on this path — so shops stay browsable while the shard
+// is down, labelled with how stale they may be.
+//
+// The staleness label is not decoration. The shard sweeps vendors round-robin, so
+// a shop can legitimately be a full cycle behind; a page that implied live prices
+// would send people to a vendor whose item sold twenty minutes ago.
+
+// The serial spelling the bridge uses everywhere: "0x" and hex. Constrained
+// before it reaches the model, like SYSTEM_RE above.
+const SERIAL_RE = /^0x[0-9A-Fa-f]{1,16}$/
+
+const intParam = (value) => {
+ const n = Number.parseInt(value, 10)
+ return Number.isFinite(n) ? n : undefined
+}
+
+// GET /public/shard/market — search the index.
+//
+// Returns LISTINGS, not vendors: "who sells a vanquishing kryss and for how much"
+// is the question, and a vendor-shaped result would make every caller flatten the
+// shops back out.
+async function getMarket(req, res) {
+ try {
+ const page = await shardMarket.search({
+ q: typeof req.query.q === 'string' ? req.query.q : '',
+ minPrice: intParam(req.query.minPrice),
+ maxPrice: intParam(req.query.maxPrice),
+ itemId: intParam(req.query.itemId),
+ map: typeof req.query.map === 'string' ? req.query.map : '',
+ region: typeof req.query.region === 'string' ? req.query.region : '',
+ sort: typeof req.query.sort === 'string' ? req.query.sort : 'price_asc',
+ limit: intParam(req.query.limit) ?? 50,
+ offset: intParam(req.query.offset) ?? 0,
+ })
+ return res.json(await visibility.project('market', page, req))
+ } catch (err) {
+ log.error('shard.getMarket', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/shard/market/meta — index size, staleness, and the filter options
+// (which facets and regions actually hold vendors). Separate from the search so
+// the page can build its filters without running a query it will throw away.
+async function getMarketMeta(req, res) {
+ try {
+ return res.json(await visibility.project('market', await shardMarket.meta(), req))
+ } catch (err) {
+ log.error('shard.getMarketMeta', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/shard/market/vendors/:serial — one shop and its listings.
+//
+// 404 for a serial the index has never seen, which also covers a vendor that has
+// since been dismissed or hidden: to an anonymous caller "no such shop" is the
+// only honest answer, and distinguishing the two would leak that a vendor exists
+// but was hidden.
+async function getMarketVendor(req, res) {
+ const { serial } = req.params
+ if (!SERIAL_RE.test(serial)) return res.status(400).json({ message: 'Invalid vendor serial.' })
+ try {
+ const vendor = await shardMarket.getVendor(serial, {
+ limit: intParam(req.query.limit) ?? 250,
+ offset: intParam(req.query.offset) ?? 0,
+ })
+ if (!vendor) return res.status(404).json({ message: 'Unknown vendor.' })
+ return res.json(await visibility.project('market', vendor, req))
+ } catch (err) {
+ log.error('shard.getMarketVendor', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/shard/features — the shard features THIS caller can actually see,
+// so the SPA (and the Android client) can hide nav entries instead of rendering
+// links that 403. Deliberately reports only what the viewer may reach: the list
+// itself must not disclose the existence of a feature they're gated out of.
+async function getFeatures(req, res) {
+ try {
+ const config = await visibility.getConfig()
+ const level = await visibility.viewerLevel(req)
+ return res.json({ level, features: visibility.visibleFeatures(level, config) })
+ } catch (err) {
+ log.error('shard.getFeatures', err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+}
+
+// GET /public/shard/stream — live-event SSE channel. What arrives depends on the
+// caller's audience rung, resolved once at subscribe time; see shardBroadcast.js.
function stream(req, res) {
- broadcast.subscribe(req, res, 'public')
+ return broadcast.subscribe(req, res, 'public')
}
module.exports = {
@@ -209,5 +411,12 @@ module.exports = {
getGovernorHistory,
getPresence,
getHouses,
+ getRuleset,
+ getPointsBoards,
+ getPointsBoard,
+ getMarket,
+ getMarketMeta,
+ getMarketVendor,
+ getFeatures,
stream,
}
diff --git a/server/src/router/v1/public/shard.router.js b/server/src/router/v1/public/shard.router.js
index 372a51a..38fb66b 100644
--- a/server/src/router/v1/public/shard.router.js
+++ b/server/src/router/v1/public/shard.router.js
@@ -10,19 +10,29 @@
// visitors *and* by the Android ShardStreamClient, neither of which sends an
// Authorization header; adding requireAuth here blacks out the public live boards
// on web and mobile. The sensitive kinds (staff audit, cheat detection, login
-// attempts, IPs) are withheld by the allowlist in utils/shardBroadcast.js, not by
-// a route gate — that allowlist split is the security boundary, not this file.
+// attempts, IPs) are withheld by utils/shardBroadcast.js, not by a route gate —
+// that per-frame filtering is the security boundary, not this file. /stream is
+// deliberately NOT wrapped in requireFeature either: it spans every feature, and
+// each frame is gated individually against the subscriber's rung.
+//
+// Every other route carries `requireFeature()` (utils/shardVisibility.js),
+// which 404s when an admin has disabled the feature and 403s when the caller sits
+// below its configured audience. Defaults reproduce pre-v3 behavior exactly, so
+// these gates are inert until an admin changes something.
const express = require('express')
const { param, query } = require('express-validator')
const shard = require('./shard.controller')
const validate = require('../../../middleware/validate')
+const { marketLimiter } = require('../../../middleware/rateLimit')
+const { requireFeature } = require('../../../utils/shardVisibility')
const shardRouter = express.Router()
shardRouter.get(
'/status',
+ requireFeature('status'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Shard connection state, online count and latest economy'
/* #swagger.responses[200] = { description: 'Shard status', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardStatus" } } } } */
@@ -30,9 +40,11 @@ shardRouter.get(
)
shardRouter.get(
'/feed',
+ requireFeature('activity'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Recent notable shard events (from the ingested log)'
- // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale.' }
+ // #swagger.description = 'The stored-history twin of /shard/stream, and it reaches the same verdict: which kinds are returned is resolved against the caller\'s audience rung under the live visibility config, and each event\'s payload is field-projected against its own kind\'s feature. Kinds the caller may not read are omitted (an explicit ?kind= for one of them returns []), and acct/webId never appear below admin.'
+ // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale. Returns [] if the caller may not read that kind.' }
// #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Max rows (default 100, max 1000).' }
/* #swagger.responses[200] = { description: 'Events, newest first', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardEvent" } } } } } */
query('kind').optional({ values: 'falsy' }).isString().isLength({ max: 48 }),
@@ -42,6 +54,7 @@ shardRouter.get(
)
shardRouter.get(
'/economy',
+ requireFeature('status'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Gold-supply time series (oldest → newest)'
// #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Max samples (default 100, max 1000).' }
@@ -52,6 +65,7 @@ shardRouter.get(
)
shardRouter.get(
'/online',
+ requireFeature('presence'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Staff online now (linked staff accounts; location is admin/moderator-only)'
/* #swagger.responses[200] = { description: 'Online players', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardOnlinePlayer" } } } } } */
@@ -59,13 +73,16 @@ shardRouter.get(
)
shardRouter.get(
'/idoc',
+ requireFeature('houses'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Houses currently in danger (IDOC)'
+ // #swagger.description = 'Location-level board of the houses about to collapse. Owner identity and price are gated by the `houses` feature\'s field rules (default `staff`), and the owner\'s game account is admin-only always — so an anonymous caller sees name, region and coordinates only.'
/* #swagger.responses[200] = { description: 'IDOC houses', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardHouse" } } } } } */
shard.getIdoc,
)
shardRouter.get(
'/champs',
+ requireFeature('champs'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Current champion-spawn board (all categories)'
// #swagger.description = 'The live board of every champion / mini-champ / sea-boss spawn. Update in place via the champ.update / champ.remove frames on /shard/stream.'
@@ -74,6 +91,7 @@ shardRouter.get(
)
shardRouter.get(
'/guilds',
+ requireFeature('guilds'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Current guild board (rosters, alliances, leaders)'
// #swagger.description = 'The live board of every guild. Update in place via the guild.update / guild.remove / guild.join frames on /shard/stream.'
@@ -82,6 +100,7 @@ shardRouter.get(
)
shardRouter.get(
'/governors',
+ requireFeature('governors'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Current town-governor board (City Loyalty)'
// #swagger.description = 'One entry per city with its governor and election phase. Empty if the shard does not run the City Loyalty system. Live via city.update on /shard/stream.'
@@ -90,6 +109,7 @@ shardRouter.get(
)
shardRouter.get(
'/governors/:city/history',
+ requireFeature('governors'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Governor term history for a city'
// #swagger.parameters['city'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'City name, e.g. Britain.' }
@@ -102,6 +122,7 @@ shardRouter.get(
)
shardRouter.get(
'/presence',
+ requireFeature('presence'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'Online population aggregate (count + per-facet + per-region)'
// #swagger.description = 'The latest presence.online snapshot powering the "Players Online" widget. Live via presence.online on /shard/stream.'
@@ -110,17 +131,121 @@ shardRouter.get(
)
shardRouter.get(
'/houses',
+ requireFeature('houses'),
// #swagger.tags = ['Public · Shard']
// #swagger.summary = 'House registry (owner, co-owners, price, decay)'
// #swagger.description = 'Every house seen via the house.update registry feed. `price` is the placement value, not a for-sale flag. Live via house.update / house.remove on /shard/stream.'
/* #swagger.responses[200] = { description: 'Houses, ordered by name', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardHouse" } } } } } */
shard.getHouses,
)
+shardRouter.get(
+ '/ruleset',
+ requireFeature('ruleset'),
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'The shard\'s published ruleset (expansion, systems, caps, limits)'
+ // #swagger.description = 'How this shard is actually configured, published by the shard itself as one world.ruleset frame: expansion, which optional systems are on, skill/stat caps, account and house limits, champion scroll rules and the save/restart schedule. Served from our own store, so it renders while the shard is down; live via world.ruleset on /shard/stream. Returns `null` if the shard has never published one (an older plugin, or Bridge.RulesetEnabled=false) — distinct from a published ruleset, and the page renders it differently.'
+ /* #swagger.responses[200] = { description: 'The ruleset, or null if never published', content: { "application/json": { schema: { type: "object", nullable: true, additionalProperties: true } } } } */
+ shard.getRuleset,
+)
+shardRouter.get(
+ '/points',
+ requireFeature('leaderboards'),
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'Points / loyalty leaderboards, one board per point system'
+ // #swagger.description = 'Every points/loyalty leaderboard the shard publishes (Queen\'s Loyalty, Void Pool, the nine city loyalties, Clean Up Britannia, …), each with its display name, max points, participant count and top N. Served from our own store, so it renders while the shard is down; live via points.board on /shard/stream. A board\'s display name may arrive as a literal (`nameString`) or a cliloc id (`nameNumber`) — resolve clilocs client-side.'
+ /* #swagger.responses[200] = { description: 'Boards, ordered by display name', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardPointsBoard" } } } } } */
+ shard.getPointsBoards,
+)
+shardRouter.get(
+ '/points/:system',
+ requireFeature('leaderboards'),
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'One points system\'s leaderboard'
+ // #swagger.description = 'A single board by the shard\'s own PointsType name (e.g. `QueensLoyalty`, `CleanUpBritannia`). Returns 404 when the shard has never published that system — distinct from a published board that nobody has scored in yet, which returns 200 with an empty `top`.'
+ /* #swagger.parameters['system'] = { in: 'path', required: true, description: 'PointsType name, e.g. QueensLoyalty', schema: { type: 'string' } } */
+ /* #swagger.responses[200] = { description: 'The board', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardPointsBoard" } } } } */
+ /* #swagger.responses[400] = { description: 'Malformed system name' } */
+ /* #swagger.responses[404] = { description: 'The shard has never published that system' } */
+ shard.getPointsBoard,
+)
+// ── Marketplace ────────────────────────────────────────────────────────────
+//
+// Rate-limited, unlike every other route in this file. These are the first
+// genuinely expensive PUBLIC reads on the site — a LIKE scan plus a COUNT over
+// what is typically the largest shard_* table, reachable with no session.
+shardRouter.get(
+ '/market',
+ requireFeature('market'),
+ marketLimiter,
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'Search the player-vendor marketplace'
+ // #swagger.description = 'Every priced listing on every player vendor the shard publishes — the same index the in-game Vendor Search gump reads, and it honours the same per-vendor opt-out, so a player who hid their shop in game is hidden here too. Results are LISTINGS, each carrying enough of its shop to be actionable. Served from the site\'s own tables (the sidecar is not touched), so it renders while the shard is down; `staleAt` is the oldest vendor row and the page must say how far behind the index can be — the shard sweeps vendors round-robin, so prices are inherently up to one full cycle old. Item names are resolved server-side against the cliloc table (docs/website/CLILOCS.md); on a shard that has not configured one, `displayName` is null and clients render the item id.'
+ // #swagger.parameters['q'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Substring match on the resolved item name or the item\'s own literal name (max 60 chars).' }
+ // #swagger.parameters['minPrice'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Lowest price to include.' }
+ // #swagger.parameters['maxPrice'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Highest price to include.' }
+ // #swagger.parameters['itemId'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Exact ItemID (art id) match, for "more like this".' }
+ // #swagger.parameters['map'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to one facet. Facet names come from the shard\'s own data; an unknown one returns an empty page.' }
+ // #swagger.parameters['region'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Limit to one named region.' }
+ // #swagger.parameters['sort'] = { in: 'query', required: false, schema: { type: 'string', enum: ['price_asc','price_desc','recent'] }, description: 'Default price_asc. `recent` orders by when the shop was last seen.' }
+ // #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Page size, 1..100 (default 50).' }
+ // #swagger.parameters['offset'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Rows to skip (default 0).' }
+ /* #swagger.responses[200] = { description: 'A page of listings plus the unpaginated total and the staleness stamp', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardMarketPage" } } } } */
+ /* #swagger.responses[403] = { description: 'The market feature is gated above this caller', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ /* #swagger.responses[404] = { description: 'The market feature is disabled', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ /* #swagger.responses[429] = { description: 'Rate limited', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+ query('q').optional({ values: 'falsy' }).isString().isLength({ max: 60 }),
+ query('minPrice').optional({ values: 'falsy' }).isInt({ min: 0, max: 999999999 }),
+ query('maxPrice').optional({ values: 'falsy' }).isInt({ min: 0, max: 999999999 }),
+ query('itemId').optional({ values: 'falsy' }).isInt({ min: 0, max: 65535 }),
+ query('map').optional({ values: 'falsy' }).isString().isLength({ max: 40 }),
+ query('region').optional({ values: 'falsy' }).isString().isLength({ max: 80 }),
+ query('sort').optional({ values: 'falsy' }).isIn(['price_asc', 'price_desc', 'recent']),
+ query('limit').optional().isInt({ min: 1, max: 100 }),
+ query('offset').optional().isInt({ min: 0, max: 100000 }),
+ validate,
+ shard.getMarket,
+)
+shardRouter.get(
+ '/market/meta',
+ requireFeature('market'),
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'Marketplace size, staleness and filter options'
+ // #swagger.description = 'How many vendors and listings the index holds, how stale it may be (`staleAt` = the oldest vendor row, `freshAt` = the newest), and which facets and regions actually hold vendors — so a client can build its filters without running a search it will discard.'
+ /* #swagger.responses[200] = { description: 'Marketplace metadata', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardMarketMeta" } } } } */
+ shard.getMarketMeta,
+)
+shardRouter.get(
+ '/market/vendors/:serial',
+ requireFeature('market'),
+ marketLimiter,
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'One player vendor and everything it is selling'
+ // #swagger.description = 'A single shop by its vendor serial, with its listings. `truncated` (and `total` exceeding `count`) means the shop holds more than the shard publishes per frame — a commodity reseller with thousands of stacks is a real thing, and the page says so rather than presenting a partial shop as complete. Returns 404 for a serial the index has never seen, which also covers a vendor since dismissed or hidden.'
+ /* #swagger.parameters['serial'] = { in: 'path', required: true, description: 'Vendor serial, e.g. 0x40001234', schema: { type: 'string' } } */
+ // #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Listings to return, 1..500 (default 250).' }
+ // #swagger.parameters['offset'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Listings to skip (default 0).' }
+ /* #swagger.responses[200] = { description: 'The vendor', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardMarketVendor" } } } } */
+ /* #swagger.responses[400] = { description: 'Malformed vendor serial' } */
+ /* #swagger.responses[404] = { description: 'No such vendor in the index' } */
+ param('serial').isString().isLength({ max: 20 }),
+ query('limit').optional().isInt({ min: 1, max: 500 }),
+ query('offset').optional().isInt({ min: 0, max: 100000 }),
+ validate,
+ shard.getMarketVendor,
+)
+shardRouter.get(
+ '/features',
+ // #swagger.tags = ['Public · Shard']
+ // #swagger.summary = 'Shard features visible to the caller (drives client nav)'
+ // #swagger.description = 'The caller\'s audience rung plus the shard features they may reach, so a client can hide nav entries instead of rendering links that 403. Reports only what the caller can see — the list itself does not disclose gated features.'
+ /* #swagger.responses[200] = { description: 'Visible features', content: { "application/json": { schema: { $ref: "#/components/schemas/ShardFeatures" } } } } */
+ shard.getFeatures,
+)
shardRouter.get(
'/stream',
// #swagger.tags = ['Public · Shard']
- // #swagger.summary = 'Live shard event stream (Server-Sent Events, public/safe kinds)'
- // #swagger.description = 'text/event-stream of curated live events. Sensitive kinds (staff audit, cheat detection, login attempts, IPs) are NOT sent on this channel.'
+ // #swagger.summary = 'Live shard event stream (Server-Sent Events, filtered by audience)'
+ // #swagger.description = 'text/event-stream of live events. The caller\'s audience rung is resolved once at subscribe time and frozen for the connection; each frame is then gated on its feature and field-projected, so sensitive kinds and fields (staff audit, cheat detection, login attempts, IPs, acct/webId) never reach a caller below their configured rung.'
/* #swagger.responses[200] = { description: 'An SSE stream (Content-Type: text/event-stream).' } */
shard.stream,
)
diff --git a/server/src/server.js b/server/src/server.js
index f9890a3..e6e7afa 100644
--- a/server/src/server.js
+++ b/server/src/server.js
@@ -14,6 +14,9 @@ const { seedDefaults, createInitialAdminFromEnv } = require('../db/seed')
const settings = require('./model/settings/settings.model')
const revokedSessions = require('./model/revokedSessions/revokedSessions.model')
const mobileAuthBridge = require('./model/mobileAuthBridge/mobileAuthBridge.model')
+const shardAtlas = require('./model/shardAtlas/shardAtlas.model')
+const shardClilocs = require('./model/shardClilocs/shardClilocs.model')
+const shardMarket = require('./model/shardMarket/shardMarket.model')
const createLogger = require('./utils/logger')
const { evaluateBotInternalKey } = require('./utils/botInternalKey')
const brand = require('./config/brand')
@@ -77,6 +80,32 @@ async function start() {
log.warn('mobile-auth-bridge prune failed', { error: err.message })
}
+ // Re-derive the spawn atlas from the shard's own ServUO tree. The shard's maps
+ // change over its lifetime — facets get added, replaced or renamed — so the
+ // atlas is rebuilt on every boot rather than shipped as a snapshot that would
+ // silently go stale. Hash-gated, so an unchanged tree costs one read pass and
+ // no database write.
+ //
+ // Best-effort by contract: no configured path, an unreadable mount or a
+ // malformed file must never stop the site coming up. A refresh that would
+ // REMOVE a facet is staged for admin approval instead of being applied.
+ await shardAtlas.refreshOnBoot()
+
+ // Refresh the cliloc table (UO's id → display-string map) from the file the
+ // operator converted out of their own client. Same contract as the atlas:
+ // hash-gated so an unchanged file costs one read, and best-effort so a missing
+ // or wrong-format file never stops the site coming up — it just means item
+ // names render as ids, which is what they did before the table existed.
+ const clilocResult = await shardClilocs.refreshOnBoot()
+
+ // A cliloc import changes what item names RESOLVE to, and the marketplace
+ // stores those names denormalized (shard_vendor_items.display_name) so it can
+ // index and search them. The shard's market sweep will not re-send an unchanged
+ // shop just because the site learned what its items are called, so the backfill
+ // has to be pulled rather than waited for. Only after an actual import — the
+ // common boot is hash-gated to a no-op and must stay one.
+ if (clilocResult && clilocResult.status === 'imported') await shardMarket.refreshDisplayNames()
+
const mode = await settings.get('site_mode')
log.info(`site mode: ${String(mode || 'live').toUpperCase()}`)
diff --git a/server/src/utils/clilocParse.js b/server/src/utils/clilocParse.js
new file mode 100644
index 0000000..cf1a113
--- /dev/null
+++ b/server/src/utils/clilocParse.js
@@ -0,0 +1,287 @@
+// Cliloc parsing — the pure half.
+//
+// A "cliloc" is UO's localization table: an integer id mapped to a display
+// string. Items carry a `LabelNumber` rather than a name, so without this table
+// the site can only render `id 1023721` where the game shows "quarter staff".
+// The shard already sends the id on every equipment entry (`char.profile`'s
+// `cliloc` field) and will send one per marketplace listing — the *number* was
+// never the missing piece, the *table* was.
+//
+// This module is fs-free on purpose, exactly like `spawnAtlasParse.js`: the
+// suite runs in CI where there is no UO client, so every parser here is driven
+// from inline fixtures. `clilocSource.js` is the only thing that touches disk.
+//
+// ── Two input formats, and why ─────────────────────────────────────────────
+//
+// The client's own `Cliloc.enu` is COMPRESSED (Mythic format) on any modern
+// client, and decompressing it is a bit-level port of an inverse-BWT coder that
+// nothing in this stack needs at runtime. ServUO's own bundled `Ultima.StringList`
+// cannot read it either — which is why `VendorSearch.GetItemName` is already inert
+// on such a shard and the plugin could not supply names even if we asked it to.
+//
+// So the operator converts once, from their own client, and points the site at
+// the result (see docs/website/CLILOCS.md). Two shapes are accepted because
+// different tools produce different things:
+//
+// • PLAIN BINARY — the pre-compression cliloc layout: a 6-byte header, then
+// records of {int32 number, byte flag, uint16 length, UTF-8 bytes}.
+// • DELIMITED TEXT — `numbertext` per line, which is what the common
+// GUI exports emit. Quoted CSV fields and a header row are tolerated.
+//
+// Nothing derived from the client is ever committed: the converted file lives at
+// an operator-supplied path and is gitignored, the same rule the spawn atlas art
+// map already follows.
+
+/** Raised for a file we can identify but deliberately refuse to guess at. */
+class ClilocFormatError extends Error {
+ constructor(message, code) {
+ super(message)
+ this.name = 'ClilocFormatError'
+ this.code = code
+ }
+}
+
+/**
+ * Bumped when this parser produces DIFFERENT data from an IDENTICAL source file.
+ *
+ * Stored beside the source hash so the boot path can tell "same file, but the
+ * parser moved on" from "same file, nothing to do". Without it a corrected parse
+ * would ship and never reach an install whose cliloc file never changes — the
+ * trap `spawnAtlasSource.PARSER_VERSION` documents.
+ */
+const PARSER_VERSION = 1
+
+// The plain layout's header is `02 00 00 00 01 00` — a 4-byte version and a
+// 2-byte language marker. Only the size matters for parsing; the values are
+// checked to sniff the format, not to validate it.
+const HEADER_BYTES = 6
+const RECORD_HEADER_BYTES = 7 // int32 number + byte flag + uint16 length
+
+// Every compressed cliloc file the client ships begins with a DWORD whose high
+// byte is 0x8E (the XOR key UOFiddler calls `HeaderXorKey`, 0x8E2C9A3D). That is
+// the single cheapest way to tell an operator they exported the wrong file —
+// without it, the plain parser happily reads compressed bytes as ~19k records of
+// negative ids and 60 KB "strings" before dying somewhere in the middle, and the
+// resulting error names the wrong problem.
+const MYTHIC_HIGH_BYTE = 0x8e
+
+/** True when `buffer` is a Mythic-compressed cliloc rather than the plain layout. */
+function isCompressedCliloc(buffer) {
+ return buffer.length >= 4 && buffer[3] === MYTHIC_HIGH_BYTE
+}
+
+/**
+ * Parse the plain binary cliloc layout.
+ *
+ * Strict about truncation, and that strictness is load-bearing: a half-copied or
+ * partly-written file is the realistic failure here, and it must fail loudly
+ * rather than import a silently short table that then renders half the world as
+ * `id 1023721`. A record that runs past the end of the buffer throws.
+ */
+function parseClilocBinary(buffer) {
+ if (!Buffer.isBuffer(buffer)) throw new ClilocFormatError('Not a buffer', 'NOT_BUFFER')
+ if (isCompressedCliloc(buffer)) {
+ throw new ClilocFormatError(
+ 'This is a compressed (Mythic-format) cliloc file, which the site cannot read. ' +
+ 'Convert it to the plain format first — see docs/website/CLILOCS.md.',
+ 'COMPRESSED',
+ )
+ }
+ if (buffer.length < HEADER_BYTES) {
+ throw new ClilocFormatError('File is shorter than a cliloc header', 'TRUNCATED')
+ }
+
+ const entries = []
+ let offset = HEADER_BYTES
+
+ while (offset < buffer.length) {
+ if (offset + RECORD_HEADER_BYTES > buffer.length) {
+ throw new ClilocFormatError(
+ `Truncated record header at byte ${offset} (${entries.length} entries read)`,
+ 'TRUNCATED',
+ )
+ }
+ const number = buffer.readInt32LE(offset)
+ const flag = buffer.readUInt8(offset + 4)
+ // The length is written by the client as an unsigned 16-bit value. Reading it
+ // signed (as ServUO's own SDK does) turns any string over 32 KB into a
+ // negative length; real tables top out around 12 KB, so this has no effect on
+ // current data and costs nothing to get right.
+ const length = buffer.readUInt16LE(offset + 5)
+ offset += RECORD_HEADER_BYTES
+
+ if (offset + length > buffer.length) {
+ throw new ClilocFormatError(
+ `Truncated record body at byte ${offset} (${entries.length} entries read)`,
+ 'TRUNCATED',
+ )
+ }
+ entries.push({ number, flag, text: buffer.toString('utf8', offset, offset + length) })
+ offset += length
+ }
+
+ return entries
+}
+
+// A delimited line splits on the FIRST separator only: cliloc text is full of
+// commas ("a scroll of magery, unfinished") and splitting on all of them would
+// truncate every such entry at its first comma.
+const TEXT_SEPARATORS = ['\t', ',', ';']
+
+/** Unwrap one CSV field: strip surrounding quotes and unescape doubled quotes. */
+function unquote(value) {
+ const trimmed = value.trim()
+ if (trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"')) {
+ return trimmed.slice(1, -1).replace(/""/g, '"')
+ }
+ return trimmed
+}
+
+/**
+ * Parse a delimited text export: `numbertext` per line.
+ *
+ * Tolerant by design — this is whatever an operator's GUI tool produced, not a
+ * format we control. A header row, blank lines, `#` comments and a trailing
+ * flags column are all ignored. A line whose first field is not an integer is
+ * skipped rather than fatal, because that is exactly what a header row is.
+ *
+ * The one thing it will NOT do is return an empty table quietly: a file that
+ * yields no entries at all is a wrong file, not an empty one.
+ */
+function parseClilocText(text) {
+ const entries = []
+ for (const line of String(text).split(/\r?\n/)) {
+ // The line is deliberately NOT trimmed before the separator search. Roughly
+ // half of a real cliloc table is empty strings (unused ids), which export as
+ // `1005008` — and trimming eats that trailing separator, leaving a bare
+ // number that then looks like a header row and is skipped. That silently
+ // dropped 55,994 of 123,490 entries. Individual FIELDS are trimmed instead,
+ // by `unquote`.
+ if (line.trim() === '' || line.trimStart().startsWith('#')) continue
+
+ // Pick the separator that actually appears first, so a tab-delimited line
+ // whose text contains a comma still splits on the tab.
+ let cut = -1
+ for (const sep of TEXT_SEPARATORS) {
+ const at = line.indexOf(sep)
+ if (at !== -1 && (cut === -1 || at < cut)) cut = at
+ }
+ if (cut === -1) continue
+
+ // An EMPTY first field must not become id 0: `Number('')` is 0, not NaN, so
+ // a line that merely starts with a separator would otherwise import as a
+ // bogus cliloc 0 instead of being skipped.
+ const head = unquote(line.slice(0, cut))
+ if (head === '') continue
+ const number = Number(head)
+ if (!Number.isInteger(number)) continue // header row, or a wrapped line
+
+ let rest = line.slice(cut + 1)
+ // Some exports carry `number,flag,text`. A bare integer in the second field
+ // is a flag; anything else is the text itself (and a text field that IS just
+ // a number is indistinguishable, so it stays as the text — the safer miss).
+ let flag = 0
+ for (const sep of TEXT_SEPARATORS) {
+ const at = rest.indexOf(sep)
+ if (at === -1) continue
+ const head = unquote(rest.slice(0, at))
+ if (/^\d{1,3}$/.test(head) && rest.slice(at + 1).trim() !== '') {
+ flag = Number(head)
+ rest = rest.slice(at + 1)
+ }
+ break
+ }
+
+ entries.push({ number, flag, text: unquote(rest) })
+ }
+
+ if (entries.length === 0) {
+ throw new ClilocFormatError('No cliloc entries found in the text export', 'EMPTY')
+ }
+ return entries
+}
+
+/**
+ * Parse either supported shape, sniffing which one this is.
+ *
+ * The sniff is on the binary header rather than the file extension: operators
+ * name these things whatever they like, and an `.enu` that is really a TSV (or a
+ * `.txt` that is really binary) should still import.
+ */
+function parseCliloc(buffer) {
+ const buf = Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer)
+
+ if (isCompressedCliloc(buf)) {
+ throw new ClilocFormatError(
+ 'This is a compressed (Mythic-format) cliloc file, which the site cannot read. ' +
+ 'Convert it to the plain format first — see docs/website/CLILOCS.md.',
+ 'COMPRESSED',
+ )
+ }
+
+ // The plain layout always opens with version 2 / language 1. Anything else is
+ // treated as text, which is the recoverable guess: a mis-sniffed text file
+ // yields "no entries found", while a mis-sniffed binary yields nonsense.
+ if (buf.length >= HEADER_BYTES && buf.readInt32LE(0) === 2 && buf.readUInt16LE(4) === 1) {
+ return parseClilocBinary(buf)
+ }
+ return parseClilocText(buf.toString('utf8'))
+}
+
+// ── Display ────────────────────────────────────────────────────────────────
+
+// Cliloc strings interpolate arguments the client supplies out of an item's
+// property list: `~1_val~`, `~2_NAME~`, `~1_ITEM~`. We never have those — the
+// bridge sends the id, not the packet — so a name carrying them must be reduced
+// to what is actually knowable rather than shown with the raw tokens in it.
+const PLACEHOLDER_RE = /~\d+_[^~]*~/g
+
+/**
+ * Reduce a raw cliloc string to something displayable.
+ *
+ * Placeholders are dropped and the leftover punctuation tidied, so
+ * `"[~1_stuff~]"` becomes `""` (correctly nothing — the whole string was the
+ * argument) and `"cold damage ~1_val~%"` becomes `"cold damage"`.
+ *
+ * **Punctuation is only tidied when a placeholder was actually removed.** The
+ * trailing `%` above is the unit belonging to the number we never had, and the
+ * brackets in `[~1_stuff~]` only ever wrapped the argument — but a string with
+ * no placeholder has no such debris, and trimming it anyway corrupts real names.
+ * A shard's `"Runic Gateway Sigil (v2)"` came back as `"(v2"` while this was
+ * unconditional.
+ *
+ * Returns `''` when nothing survives, which callers treat as "no name" and fall
+ * back to the item id — better than showing a bracket.
+ */
+const DEBRIS = /^[\s\-–—,.;:%[\]()]+|[\s\-–—,.;:%[\]()]+$/g
+
+function displayText(raw) {
+ if (raw == null) return ''
+ const source = String(raw)
+ const hadPlaceholder = PLACEHOLDER_RE.test(source)
+ PLACEHOLDER_RE.lastIndex = 0 // the regex is global; `test` advances it
+
+ if (!hadPlaceholder) return source.replace(/\s+/g, ' ').trim()
+
+ return source
+ .replace(PLACEHOLDER_RE, ' ')
+ .replace(/\s+/g, ' ')
+ .replace(/\s+([,.;:!?])/g, '$1')
+ .replace(DEBRIS, '')
+ .trim()
+}
+
+/** True when a raw cliloc string is nothing but interpolated arguments. */
+const isPlaceholderOnly = (raw) => raw != null && String(raw).trim() !== '' && displayText(raw) === ''
+
+module.exports = {
+ ClilocFormatError,
+ PARSER_VERSION,
+ HEADER_BYTES,
+ isCompressedCliloc,
+ parseCliloc,
+ parseClilocBinary,
+ parseClilocText,
+ displayText,
+ isPlaceholderOnly,
+}
diff --git a/server/src/utils/clilocSource.js b/server/src/utils/clilocSource.js
new file mode 100644
index 0000000..93ae061
--- /dev/null
+++ b/server/src/utils/clilocSource.js
@@ -0,0 +1,316 @@
+// Cliloc table — the filesystem layer.
+//
+// `clilocParse.js` holds the pure parsers; this module is the only thing that
+// touches cliloc files on disk, and it is shared by both callers:
+//
+// - the server, which refreshes the table on boot (`shardClilocs.model.js`)
+// - the admin panel, which can force a reimport without a restart
+//
+// The files are the OPERATOR'S (see docs/website/CLILOCS.md). Nothing derived
+// from them is committed: the repo holds no string table, exactly as it holds no
+// map snapshot and no artwork. That rule is why this module reads a configured
+// path instead of a path inside the repo.
+//
+// ── Why this reads a SET of files, not one ────────────────────────────────
+//
+// Shards edit items and add new ones. Those carry cliloc ids that a stock client
+// table does not have — and forcing a 5 MB client re-export every time an
+// operator adds one item would be miserable enough that the table would simply
+// go stale, which is the exact failure the spawn atlas was redesigned to avoid.
+//
+// So this mirrors `spawnAtlasSource.readSources()`: a BASE table (the converted
+// client file) plus every operator-maintained OVERLAY beside it, all re-read on
+// every boot and hash-gated as a SET. Adding, editing or removing any overlay
+// counts as drift and re-imports. Later sources win, so an overlay both adds new
+// ids and overrides stock ones.
+//
+// Measured on a real shard: the script tree references 16,434 cliloc ids and only
+// 37 are absent from the stock client table. Tens of entries against a 67k base
+// is what makes the overlay the right shape rather than a second full table.
+//
+// Reading and hashing ~5 MB costs a few milliseconds and a full parse ~50 ms, so
+// the boot path hashes first and only parses when something actually changed.
+
+const crypto = require('crypto')
+const fs = require('fs')
+const path = require('path')
+
+const { ClilocFormatError, PARSER_VERSION, parseCliloc, isCompressedCliloc } = require('./clilocParse')
+
+/**
+ * Filenames looked for as the BASE table when the configured path is a directory.
+ *
+ * Ordered by how specific they are: an explicitly converted file wins over
+ * something that merely sits in a client folder, so an operator who dropped a
+ * `cliloc.plain.enu` next to the original compressed `cliloc.enu` gets the one
+ * they made rather than the one that will be rejected.
+ *
+ * Matching is case-insensitive against the real directory listing, because the
+ * client ships `Cliloc.enu` on Windows and the site usually runs on Linux, where
+ * a hardcoded lowercase open would simply miss.
+ */
+const CANDIDATE_NAMES = [
+ 'clilocs.tsv',
+ 'clilocs.csv',
+ 'clilocs.plain',
+ 'cliloc.plain',
+ 'cliloc.plain.enu',
+ 'cliloc.enu.plain',
+ 'clilocs.txt',
+ 'cliloc.enu',
+]
+
+/**
+ * Where shard-specific additions and overrides live: a `custom/` directory
+ * beside the base table.
+ *
+ * ServUO has **no server-side convention** for custom clilocs — they live in the
+ * patched client file a shard distributes to its players, and nothing in the
+ * tree declares them. There is therefore nothing to discover, and this is the
+ * one place in the cliloc pipeline that is a convention we chose rather than one
+ * the shard already has. It is a directory rather than a single file so an
+ * operator can keep additions grouped however they like (per system, per patch)
+ * without the site caring.
+ */
+const CUSTOM_DIR = 'custom'
+const CUSTOM_EXTENSIONS = ['.tsv', '.csv', '.txt', '.enu', '.plain']
+
+class ClilocSourceError extends Error {
+ constructor(message, code) {
+ super(message)
+ this.name = 'ClilocSourceError'
+ this.code = code
+ }
+}
+
+function sha256(buffer) {
+ return crypto.createHash('sha256').update(buffer).digest('hex')
+}
+
+/**
+ * Resolve the configured path to `{ root, base }`.
+ *
+ * Accepts either a direct file path or a directory to search, because operators
+ * reasonably supply both — "here is the file" and "here is the folder I put it
+ * in" are equally natural answers to the admin panel's prompt. When it is a
+ * file, `root` is the directory CONTAINING it, so overlays work either way: an
+ * operator who pointed at a file should not have to re-point at its folder just
+ * to add a `custom/` directory next to it.
+ */
+function resolveBase(configured) {
+ if (!configured || String(configured).trim() === '') {
+ throw new ClilocSourceError('No cliloc path configured', 'NO_PATH')
+ }
+ const target = String(configured).trim()
+
+ let stat
+ try {
+ stat = fs.statSync(target)
+ } catch {
+ throw new ClilocSourceError(`Cliloc path does not exist: ${target}`, 'NOT_FOUND')
+ }
+
+ if (stat.isFile()) return { root: path.dirname(target), base: target }
+
+ if (!stat.isDirectory()) {
+ throw new ClilocSourceError(`Cliloc path is neither a file nor a directory: ${target}`, 'NOT_FOUND')
+ }
+
+ let listing
+ try {
+ listing = fs.readdirSync(target)
+ } catch {
+ throw new ClilocSourceError(`Cliloc directory is not readable: ${target}`, 'NOT_FOUND')
+ }
+
+ const byLower = new Map(listing.map((name) => [name.toLowerCase(), name]))
+ for (const candidate of CANDIDATE_NAMES) {
+ const actual = byLower.get(candidate)
+ if (actual) return { root: target, base: path.join(target, actual) }
+ }
+
+ throw new ClilocSourceError(
+ `No cliloc file found in ${target} (looked for ${CANDIDATE_NAMES.join(', ')})`,
+ 'NO_FILE',
+ )
+}
+
+/** Overlay files under `/custom/`, sorted so precedence is deterministic. */
+function listCustom(root) {
+ const dir = path.join(root, CUSTOM_DIR)
+ let listing
+ try {
+ listing = fs.readdirSync(dir, { withFileTypes: true })
+ } catch (err) {
+ // No overlay directory is the normal case, not an error.
+ if (err.code === 'ENOENT' || err.code === 'ENOTDIR') return []
+ throw new ClilocSourceError(`Cliloc overlay directory is not readable: ${dir}`, 'UNREADABLE')
+ }
+ return listing
+ .filter((e) => e.isFile() && CUSTOM_EXTENSIONS.includes(path.extname(e.name).toLowerCase()))
+ .map((e) => e.name)
+ .sort()
+ .map((name) => path.join(dir, name))
+}
+
+function readFileOrThrow(file) {
+ try {
+ return fs.readFileSync(file)
+ } catch {
+ throw new ClilocSourceError(`Cliloc file is not readable: ${file}`, 'UNREADABLE')
+ }
+}
+
+/**
+ * Read every cliloc source under the configured path.
+ *
+ * Returns `{ root, files: [{ label, kind, file, buffer, sha256, bytes, compressed }] }`
+ * with the base first and overlays after, in the order they must be merged.
+ *
+ * Labels are root-relative and forward-slashed so a hash map compares equal
+ * across platforms — the same directory read on Windows and Linux must produce
+ * the same fingerprint, or every boot would look like a change. (The same
+ * reasoning, and the same bug, as `spawnAtlasSource.readSources`.)
+ */
+function readSources(configured) {
+ const { root, base } = resolveBase(configured)
+
+ const describe = (file, kind) => {
+ const buffer = readFileOrThrow(file)
+ return {
+ label: path.relative(root, file).split(path.sep).join('/'),
+ kind,
+ file,
+ buffer,
+ sha256: sha256(buffer),
+ bytes: buffer.length,
+ compressed: isCompressedCliloc(buffer),
+ }
+ }
+
+ const files = [describe(base, 'base')]
+ for (const overlay of listCustom(root)) files.push(describe(overlay, 'custom'))
+
+ return { root, files }
+}
+
+/**
+ * A fingerprint of every source: `{ "": "" }`, plus the base's
+ * details for the admin panel.
+ *
+ * `compressed` is reported here rather than left to the parse because the admin
+ * panel calls this and NOT `readCliloc` (parsing 5 MB on every status poll would
+ * be wasteful). Without it, pointing the setting at an unconverted client
+ * directory reports a perfectly readable file with pending drift — "ready to
+ * import" — and the operator only learns otherwise when the import fails. The
+ * check is four bytes of a buffer already in hand.
+ */
+function hashSources(configured) {
+ const { root, files } = readSources(configured)
+ const hashes = {}
+ for (const file of files) hashes[file.label] = file.sha256
+ const base = files[0]
+ return {
+ root,
+ hashes,
+ file: base.file,
+ bytes: base.bytes,
+ compressed: files.some((f) => f.compressed),
+ customCount: files.length - 1,
+ }
+}
+
+/** True when two source fingerprints describe the same set of files. */
+function sameSources(a, b) {
+ if (!a || !b) return false
+ const aKeys = Object.keys(a).sort()
+ const bKeys = Object.keys(b).sort()
+ if (aKeys.length !== bKeys.length) return false
+ return aKeys.every((key, i) => key === bKeys[i] && a[key] === b[key])
+}
+
+/**
+ * Labels present in `loaded` that are absent from `current`.
+ *
+ * This is the multi-source hazard that a single file did not have. One corrupt
+ * file fails the parse loudly, but a source that has simply VANISHED — an
+ * unmounted volume, a half-copied deploy — parses perfectly and imports a table
+ * quietly missing everything that file contributed. That is the same ambiguity
+ * the spawn atlas escalates for a disappearing facet, so it is escalated here
+ * too rather than applied.
+ */
+function missingSources(current, loaded) {
+ if (!loaded) return []
+ return Object.keys(loaded).filter((label) => !Object.hasOwn(current, label))
+}
+
+/**
+ * Read and parse every source, merged into one entry list.
+ *
+ * Later sources win: the base client table first, then each overlay in sorted
+ * order, so an overlay both ADDS ids the client never had and OVERRIDES stock
+ * ones the shard has re-purposed.
+ *
+ * Returns `{ entries, source }`. Throws `ClilocSourceError` for anything about
+ * the paths and `ClilocFormatError` for anything about the contents — different
+ * problems for an operator (wrong place vs wrong file), and the admin panel says
+ * which. A format error names the file it came from, because "which of my six
+ * overlay files is malformed" is otherwise a guessing game.
+ */
+function readCliloc(configured) {
+ const { root, files } = readSources(configured)
+
+ const merged = new Map()
+ const perSource = []
+
+ for (const file of files) {
+ let entries
+ try {
+ entries = parseCliloc(file.buffer)
+ } catch (err) {
+ if (err instanceof ClilocFormatError) {
+ throw new ClilocFormatError(`${file.label}: ${err.message}`, err.code)
+ }
+ throw err
+ }
+
+ let added = 0
+ let overrode = 0
+ for (const entry of entries) {
+ if (!Number.isInteger(entry.number)) continue
+ if (merged.has(entry.number)) overrode++
+ else added++
+ merged.set(entry.number, entry)
+ }
+ perSource.push({ label: file.label, kind: file.kind, entries: entries.length, added, overrode })
+ }
+
+ return {
+ entries: [...merged.values()],
+ source: {
+ root,
+ file: files[0].file,
+ sha256: files[0].sha256,
+ bytes: files[0].bytes,
+ hashes: Object.fromEntries(files.map((f) => [f.label, f.sha256])),
+ parserVersion: PARSER_VERSION,
+ sources: perSource,
+ },
+ }
+}
+
+module.exports = {
+ ClilocFormatError,
+ ClilocSourceError,
+ PARSER_VERSION,
+ CANDIDATE_NAMES,
+ CUSTOM_DIR,
+ CUSTOM_EXTENSIONS,
+ resolveBase,
+ listCustom,
+ readSources,
+ hashSources,
+ sameSources,
+ missingSources,
+ readCliloc,
+}
diff --git a/server/src/utils/shardBroadcast.js b/server/src/utils/shardBroadcast.js
index ab1542e..ea5941f 100644
--- a/server/src/utils/shardBroadcast.js
+++ b/server/src/utils/shardBroadcast.js
@@ -2,67 +2,66 @@
//
// The browser can't talk to the sidecar's WebSocket directly (the token must
// never reach it, and the WS may be on another host). Instead the server ingests
-// the WS feed and re-broadcasts curated events to browsers over Server-Sent
-// Events (plain HTTP — works through any reverse proxy).
+// the WS feed and re-broadcasts events to browsers over Server-Sent Events
+// (plain HTTP — works through any reverse proxy).
//
-// Two channels:
-// • public — safe kinds only (sales, deaths, IDOC, logins, economy). No IPs,
-// no account-login attempts, no staff audit / cheat events.
-// • admin — everything, including the sensitive kinds above.
+// Since Protocol 3.0 the split is no longer "one public channel with a static
+// allowlist plus one admin channel". Each subscriber carries the audience rung
+// it resolved to at subscribe time, and every frame is
+//
+// 1. mapped kind → feature (an UNMAPPED kind reaches nobody below admin —
+// fail closed; see utils/shardVisibility.js rule 2),
+// 2. gated on that feature being enabled, streamed, and within the viewer's
+// rung, and
+// 3. passed through field projection, so `acct` / `webId` and any field an
+// admin has re-gated are stripped per viewer.
+//
+// **This is the security boundary.** It used to be the PUBLIC_KINDS set in this
+// file; it is now the kind map plus the visibility config. PUBLIC_KINDS still
+// exists and is still exported, but it is now DERIVED from the kind map (see
+// shardVisibility.js) so the two can no longer drift.
//
// shardIngest calls broadcast(event) for each ingested event; the public/admin
// SSE route handlers call subscribe(req, res, channel).
+const visibility = require('./shardVisibility')
const log = require('./logger')('shard-broadcast')
-// Kinds safe to expose to unauthenticated browsers. Note: vendor.sale is
-// deliberately NOT here — sales are owner-private (a linked player sees only
-// their own, via /player/shard/sales).
-const PUBLIC_KINDS = new Set([
- 'player.death',
- 'player.murdered',
- 'mob.killed',
- 'house.decay',
- 'quest.complete',
- 'skill.gain',
- 'fame.change',
- 'karma.change',
- 'mob.login',
- 'mob.logout',
- 'economy.supply',
- 'server.hello',
- 'server.shutdown',
- 'server.crashed',
- // Champion-spawn board deltas — the public Champions page renders these live.
- 'champ.update',
- 'champ.remove',
- // Protocol 2.0 boards — public, rendered live on their respective pages.
- 'guild.update',
- 'guild.remove',
- 'guild.join',
- 'city.update',
- 'presence.online',
- 'region.enter',
- // NOTE: house.update / house.remove (the full registry — owner, price, co-owners)
- // are deliberately NOT public. The public Houses page shows only IDOC houses (via
- // house.decay, which is public above) with location only; the full registry is
- // staff-only and rides the admin SSE channel. See public/shard.controller getHouses.
-])
+// Re-exported for back-compat: shardEvents `/feed` filtering and
+// config/notificationStreams.js both ask "is this kind public-safe?".
+const { PUBLIC_KINDS } = visibility
-// Open response streams per channel.
+// Open streams. Each entry is { res, level }. The admin bucket is kept separate
+// because it is unconditional and must not depend on a config read.
const clients = { public: new Set(), admin: new Set() }
const KEEPALIVE_MS = 25000
// Register an SSE stream on a channel. Sets the SSE headers, sends an initial
// comment, keeps the connection warm with periodic pings, and cleans up on close.
-function subscribe(req, res, channel) {
+//
+// The viewer's rung is resolved ONCE, here, and frozen for the life of the
+// connection — a long-lived stream must not silently gain privilege because the
+// caller's session changed underneath it. (Config changes, by contrast, DO take
+// effect live: the config is read per broadcast, cached ~5s.)
+async function subscribe(req, res, channel) {
const bucket = clients[channel]
if (!bucket) {
res.status(400).end()
return
}
+ let level = 'admin'
+ if (channel === 'public') {
+ try {
+ level = await visibility.viewerLevel(req)
+ } catch (err) {
+ // Fail closed: an unresolvable viewer is anonymous, not privileged.
+ log.warn('viewerLevel failed on subscribe; treating as anonymous', { message: err.message })
+ level = 'anonymous'
+ }
+ }
+
res.writeHead(200, {
'Content-Type': 'text/event-stream',
'Cache-Control': 'no-cache, no-transform',
@@ -72,9 +71,10 @@ function subscribe(req, res, channel) {
res.write('retry: 5000\n\n') // tell EventSource to reconnect after 5s if dropped
res.write(': connected\n\n')
- bucket.add(res)
+ const client = { res, level, ping: null }
+ bucket.add(client)
- const ping = setInterval(() => {
+ client.ping = setInterval(() => {
try {
res.write(': ping\n\n')
} catch {
@@ -82,45 +82,80 @@ function subscribe(req, res, channel) {
}
}, KEEPALIVE_MS)
- const cleanup = () => {
- clearInterval(ping)
- bucket.delete(res)
- }
+ const cleanup = () => drop(bucket, client)
req.on('close', cleanup)
res.on('error', cleanup)
}
-function writeTo(bucket, payload) {
- for (const res of bucket) {
- try {
- res.write(payload)
- } catch (err) {
- log.warn('sse write failed; dropping client', { message: err.message })
- bucket.delete(res)
- }
+// The ONLY way a client leaves a bucket. Clearing the keepalive here (rather
+// than only in the close handler) matters: a client dropped because its write
+// threw never fires `req.close`, so its interval would otherwise keep firing on
+// a dead socket for the life of the process.
+function drop(bucket, client) {
+ clearInterval(client.ping)
+ bucket.delete(client)
+}
+
+function writeTo(bucket, client, payload) {
+ try {
+ client.res.write(payload)
+ } catch (err) {
+ log.warn('sse write failed; dropping client', { message: err.message })
+ drop(bucket, client)
}
}
-// Fan an ingested event out to the admin channel (always) and the public
-// channel (safe kinds only). A no-op when nobody is subscribed.
-function broadcast(event) {
+// Fan an ingested event out. The admin channel gets it verbatim, always. Public
+// subscribers are filtered and projected per their own rung — so two viewers on
+// the same channel can legitimately receive different versions of one frame, or
+// one of them nothing at all.
+async function broadcast(event) {
if (!event || !event.kind) return
- const frame = `data: ${JSON.stringify(event)}\n\n`
- if (clients.admin.size) writeTo(clients.admin, frame)
- if (clients.public.size && PUBLIC_KINDS.has(event.kind)) writeTo(clients.public, frame)
+
+ if (clients.admin.size) {
+ const frame = `data: ${JSON.stringify(event)}\n\n`
+ for (const client of [...clients.admin]) writeTo(clients.admin, client, frame)
+ }
+
+ if (!clients.public.size) return
+
+ let config
+ try {
+ config = await visibility.getConfig()
+ } catch (err) {
+ // Fail closed: without a config we cannot prove a frame is safe to send.
+ log.error('visibility config unavailable; withholding public frame', err)
+ return
+ }
+
+ // Most frames land on one rung set, so cache the serialised payload per level
+ // instead of re-projecting and re-stringifying for every subscriber.
+ const byLevel = new Map()
+ for (const client of [...clients.public]) {
+ let frame = byLevel.get(client.level)
+ if (frame === undefined) {
+ frame = visibility.kindVisibleTo(event.kind, client.level, config)
+ ? `data: ${JSON.stringify(visibility.projectFeature(visibility.KIND_FEATURE.get(event.kind), event, client.level, config))}\n\n`
+ : null
+ byLevel.set(client.level, frame)
+ }
+ if (frame) writeTo(clients.public, client, frame)
+ }
}
-// Close every open stream (graceful shutdown).
+// Close every open stream (graceful shutdown). Clears each keepalive timer too —
+// without that the intervals keep the event loop alive after the streams are
+// gone, and the process won't exit.
function closeAll() {
- for (const channel of Object.values(clients)) {
- for (const res of channel) {
+ for (const bucket of Object.values(clients)) {
+ for (const client of [...bucket]) {
+ drop(bucket, client)
try {
- res.end()
+ client.res.end()
} catch {
/* ignore */
}
}
- channel.clear()
}
}
diff --git a/server/src/utils/shardIngest.js b/server/src/utils/shardIngest.js
index 4f0675e..13b62cc 100644
--- a/server/src/utils/shardIngest.js
+++ b/server/src/utils/shardIngest.js
@@ -15,7 +15,9 @@
const shardEventsModel = require('../model/shardEvents/shardEvents.model')
const shardStateModel = require('../model/shardState/shardState.model')
const shardLinksModel = require('../model/shardLinks/shardLinks.model')
+const shardMarketModel = require('../model/shardMarket/shardMarket.model')
const uoLinkConfigModel = require('../model/uoLinkConfig/uoLinkConfig.model')
+const settingsModel = require('../model/settings/settings.model')
const broadcaster = require('./shardBroadcast')
const pushDispatch = require('./pushDispatch')
const defaultLog = require('./logger')('shard-ingest')
@@ -62,6 +64,31 @@ function shouldLog(event) {
return LOGGED_KINDS.has(event.kind)
}
+// ServUO's stock Server.cfg name. An operator who never set one publishes this
+// verbatim, so it carries no more information than a blank — matched
+// case-insensitively and trim-tolerantly, but ONLY as an exact whole value: a
+// shard genuinely called "My Shard Reborn" keeps its name.
+const STOCK_SHARD_NAME = 'my shard'
+
+/**
+ * The name to publish for the shard: its own, or this instance's when it has
+ * effectively not given one.
+ *
+ * Deliberately not a general "blank means brand" rule applied across the wire —
+ * it is scoped to this one field, where the two names denote the same thing.
+ */
+async function resolveShardName(shard, deps) {
+ const given = String(shard ?? '').trim()
+ if (given !== '' && given.toLowerCase() !== STOCK_SHARD_NAME) return given
+ try {
+ return (await deps.settings.getInstanceName()) || given
+ } catch {
+ // A ruleset that publishes the stock name is still better than one that
+ // fails to store because the settings read hiccuped.
+ return given
+ }
+}
+
// Apply the state-change side effect for a kind (if any). Returns a promise.
async function applyStateChange(event, deps) {
const { shardState, uoLinkConfig, log } = deps
@@ -173,6 +200,42 @@ async function applyStateChange(event, deps) {
case 'house.remove':
await shardState.removeHouse(event.serial)
return
+ // ── Protocol 3.0 ─────────────────────────────────────────────────────
+ // The shard re-emits its whole ruleset on every sidecar connect, so this is
+ // an overwrite, not an append — and deliberately NOT in LOGGED_KINDS: it
+ // would put a duplicate row in the event log on every reconnect, and
+ // server.hello already marks each of those.
+ case 'world.ruleset':
+ // A shard whose operator never edited Server.cfg publishes ServUO's stock
+ // "My Shard". That is the shard saying *unnamed*, not a name, so the site
+ // answers with its own — the rules page reading "My Shard" under a header
+ // reading UOMysticmoon is the shard failing to introduce itself.
+ //
+ // Normalized HERE rather than on read because the ruleset is also live: the
+ // same `event` object is handed to the SSE broadcast a few lines below, and
+ // a read-time fix would be undone by the next reconnect's frame.
+ event.shard = await resolveShardName(event.shard, deps)
+ await shardState.setRuleset(event)
+ return
+ // Board state, like guild.update — the newest frame for a system replaces the
+ // previous one, so it is NOT in LOGGED_KINDS. Logging would append a row every
+ // time anyone's score moved the top ten, which is a board, not an event.
+ case 'points.board':
+ await shardState.upsertPointsBoard(event)
+ return
+ // Player-vendor market index. Each frame is authoritative for one shop, so
+ // the model replaces that vendor's whole listing set rather than merging.
+ //
+ // NOT in LOGGED_KINDS, and this is the strongest case of the three v3 kinds:
+ // one frame carries up to 250 listings, the sweep re-emits a shop on any
+ // price change, and appending each of those to the event log would make
+ // shard_events mostly a price history nobody reads. The market IS the state.
+ case 'vendor.listing':
+ await deps.shardMarket.upsertVendor(event)
+ return
+ case 'vendor.listing.remove':
+ await deps.shardMarket.removeVendor(event.serial)
+ return
case 'account.unlinked':
// A player ran [unlink in game (or a site-side unlink echoed back) — drop
// our local link mirror so attribution stops immediately.
@@ -195,7 +258,9 @@ function resolveDeps(deps) {
shardEvents: deps.shardEvents || shardEventsModel,
shardState: deps.shardState || shardStateModel,
shardLinks: deps.shardLinks || shardLinksModel,
+ shardMarket: deps.shardMarket || shardMarketModel,
uoLinkConfig: deps.uoLinkConfig || uoLinkConfigModel,
+ settings: deps.settings || settingsModel,
broadcast: deps.broadcast || broadcaster.broadcast,
pushDispatch: deps.pushDispatch || pushDispatch.fromShardEvent,
log: deps.log || defaultLog,
@@ -229,11 +294,12 @@ async function ingest(event, deps = {}) {
}
if (!deps.fromBackfill) {
- try {
- d.broadcast(event)
- } catch (err) {
- d.log.warn('broadcast failed', { kind: event.kind, message: err.message })
- }
+ // Broadcast is async since v3 (it reads the visibility config to decide what
+ // each subscriber may see). Fire-and-forget, like the push fan-out below: a
+ // slow config read must never delay or fail ingest.
+ Promise.resolve(d.broadcast(event)).catch((err) =>
+ d.log.warn('broadcast failed', { kind: event.kind, message: err.message }),
+ )
// Opt-in push fan-out, off the same event source as the SSE broadcast.
// Fire-and-forget (a slow/dead ntfy relay must never delay or fail ingest);
// fromShardEvent is self-guarding, but .catch() covers any lookup rejection.
diff --git a/server/src/utils/shardVisibility.js b/server/src/utils/shardVisibility.js
new file mode 100644
index 0000000..4d65605
--- /dev/null
+++ b/server/src/utils/shardVisibility.js
@@ -0,0 +1,435 @@
+// ── Shard feature visibility ───────────────────────────────────────────────
+//
+// Admin-configurable, per-feature and per-field audience control over every
+// shard-derived surface on the site. Replaces the hardcoded split that used to
+// live in two places (the PUBLIC_KINDS allowlist in shardBroadcast.js, and the
+// ad-hoc `canSeeStaffLocation` style checks in the public controllers).
+//
+// Design rules (docs/link/v3.md §3):
+//
+// • Visibility lives HERE, on the website — never in the sidecar. The sidecar
+// is a dumb forwarder: it accepts frames, stores them, forwards them
+// verbatim, and serves store-backed reads. It defines no audiences.
+// • Every default reproduces the behavior that shipped before this module, so
+// installing it changes nothing until an admin edits the config.
+// • Two rules an admin CANNOT override:
+// 1. `acct` / `webId` are admin-only, always. They are not in-game
+// visible (unlike a character name) and are not configurable fields.
+// 2. A kind absent from KIND_FEATURE is never broadcast below `admin`.
+// Fail closed — this is what keeps the kind map a security boundary
+// rather than a convenience filter.
+//
+// The audience ladder is ordered; each rung implies the ones below it.
+
+const db = require('../model/shardVisibility/shardVisibility.model')
+const shardLinks = require('../model/shardLinks/shardLinks.model')
+const auth = require('./auth')
+const log = require('./logger')('shard-visibility')
+
+// ── The ladder ─────────────────────────────────────────────────────────────
+
+const LADDER = ['anonymous', 'logged_in', 'player', 'staff', 'admin']
+const RANK = new Map(LADDER.map((level, i) => [level, i]))
+
+const isLevel = (level) => RANK.has(level)
+
+// The two fallbacks are deliberately ASYMMETRIC, and the asymmetry is the whole
+// point: an unrecognised value must always lose. A single shared fallback cannot
+// do that — whichever direction it picks, it fails open on one side. So:
+//
+// • an unknown VIEWER level floors to the bottom rung (grants nothing), and
+// • an unknown REQUIREMENT ceils to the top rung (satisfied by nobody but admin).
+//
+// With one `rank()` defaulting to admin, a viewer level that fell through (a
+// typo, a future rung this build doesn't know, a value from a caller that
+// skipped viewerLevel) would have been treated as an ADMIN and passed every gate.
+const viewerRank = (level) => RANK.get(level) ?? 0
+const requiredRank = (level) => RANK.get(level) ?? RANK.get('admin')
+
+// True when a viewer at `viewer` satisfies a requirement of `required`.
+const meets = (viewer, required) => viewerRank(viewer) >= requiredRank(required)
+
+// Exported for tests/diagnostics; `meets` is what callers should use.
+const rank = viewerRank
+
+// ── Features ───────────────────────────────────────────────────────────────
+//
+// All ten shard surfaces: the six that shipped before v3 plus the four v3 adds.
+// `fields` lists only the SENSITIVE fields — those an admin may re-gate. A field
+// not listed here is visible whenever the feature itself is.
+//
+// LOCKED_FIELDS are exempt from configuration entirely (rule 1 above).
+
+const LOCKED_FIELDS = { acct: 'admin', webId: 'admin' }
+
+// Rule 1 matches on the FIELD'S MEANING, not on one exact spelling. The wire
+// frames nest actors (`leader.acct`), but several read models flatten them
+// instead (`shapeHouse` emits `ownerAcct`, `shapeGuild`'s fallback emits
+// `leaderAcct`/`leaderWebId`), and an exact-key check silently missed every
+// flattened one — which is how `GET /public/shard/idoc` served `ownerAcct` to
+// anonymous callers while the same account name was correctly stripped from the
+// live `house.decay` frame.
+//
+// So a key is locked when it IS `acct`/`webId` or ENDS in one, case-insensitively
+// (`ownerAcct`, `leaderWebId`, `governorAcct`). Suffix matching is what makes this
+// fail closed for shapes nobody has written yet.
+const LOCKED_SUFFIXES = ['acct', 'webid']
+const isLockedField = (key) => {
+ const k = String(key).toLowerCase()
+ return LOCKED_SUFFIXES.some((suffix) => k === suffix || k.endsWith(suffix))
+}
+
+const FEATURES = {
+ // ── Shipped before v3. Defaults reproduce the previous hardcoded behavior. ──
+ status: { audience: 'anonymous', fields: {} },
+ activity: { audience: 'anonymous', fields: {} },
+ champs: { audience: 'anonymous', fields: {} },
+ guilds: { audience: 'anonymous', fields: {} },
+ governors: { audience: 'anonymous', fields: {} },
+ // The public Houses page showed IDOC location only; owner/price were staff.
+ // `owner` is the actor object on the house.decay/house.update frames;
+ // `ownerName`/`ownerSerial` are the flattened spellings shapeHouse emits on the
+ // REST read models. Both are listed so one rule covers the wire and the read
+ // model — the flattened `ownerAcct` needs no entry, being locked by rule 1.
+ houses: {
+ audience: 'anonymous',
+ fields: { owner: 'staff', ownerName: 'staff', ownerSerial: 'staff', price: 'staff' },
+ },
+ // /public/shard/online listed linked staff to everyone but gated location to
+ // admin+moderator — which is exactly the `staff` rung.
+ presence: { audience: 'anonymous', fields: { location: 'staff' } },
+
+ // ── New in v3. ──
+ ruleset: { audience: 'anonymous', fields: { connect: 'anonymous' } },
+ atlas: { audience: 'anonymous', fields: {} },
+ // `name` is the ranked character's name inside points.board's `top` entries, and
+ // it is spelled the way the WIRE spells it, not the way v3.md §7.4 describes it
+ // ("characterName"). projectValue matches on the literal JSON key, so a rule
+ // named for the field's meaning rather than its key silently does nothing — the
+ // same failure §3.6.1 records for the flattened `ownerAcct` spelling. Within a
+ // leaderboards payload `name` can only be a character name: the board's own
+ // display name arrives as `nameString`/`nameNumber`.
+ leaderboards: { audience: 'anonymous', fields: { name: 'anonymous' } },
+ // Shop name, owner character name and vendor location are already globally
+ // visible in-game via the stock Vendor Search gump, so publishing them is not
+ // a new disclosure — but they stay configurable so an admin can tighten them.
+ //
+ // `ownerName` and `location` were pre-wired here by Part A, before the frame
+ // existed; both were re-checked against the real `vendor.listing` and both are
+ // genuine keys on it (unlike leaderboards' `characterName`, which was inert).
+ // `location` is a NESTED object on the wire and on the read model precisely so
+ // that one rule hides map, coordinates, region and house together — five flat
+ // keys would be five rules that drift apart.
+ //
+ // `ownerSerial` is listed alongside `ownerName` for the same reason `houses`
+ // lists both: an admin who hides the owner's name and is left with a serial
+ // that every other board resolves back to that name has not hidden anything.
+ market: {
+ audience: 'anonymous',
+ fields: { ownerName: 'anonymous', ownerSerial: 'anonymous', location: 'anonymous' },
+ },
+}
+
+const FEATURE_NAMES = Object.keys(FEATURES)
+const isFeature = (name) => Object.hasOwn(FEATURES, name)
+
+// ── Kind → feature ─────────────────────────────────────────────────────────
+//
+// Every event kind that may ever leave the admin channel must appear here.
+// Anything else is admin-only by omission (rule 2). This map is seeded from
+// what PUBLIC_KINDS listed before v3, so the public stream carries exactly the
+// same kinds it did — now attributed to a feature that an admin can re-gate.
+
+const KIND_FEATURE = new Map(
+ Object.entries({
+ // status / lifecycle
+ 'server.hello': 'status',
+ 'server.shutdown': 'status',
+ 'server.crashed': 'status',
+ 'economy.supply': 'status',
+ // activity feed
+ 'player.death': 'activity',
+ 'player.murdered': 'activity',
+ 'mob.killed': 'activity',
+ 'quest.complete': 'activity',
+ 'skill.gain': 'activity',
+ 'fame.change': 'activity',
+ 'karma.change': 'activity',
+ 'mob.login': 'activity',
+ 'mob.logout': 'activity',
+ // boards
+ 'champ.update': 'champs',
+ 'champ.remove': 'champs',
+ 'guild.update': 'guilds',
+ 'guild.remove': 'guilds',
+ 'guild.join': 'guilds',
+ 'city.update': 'governors',
+ 'presence.online': 'presence',
+ 'region.enter': 'presence',
+ // house.decay is the IDOC signal the public Houses page renders. The full
+ // registry (house.update / house.remove — owner, price, co-owners) stays
+ // off the map deliberately, so it remains admin-only exactly as before.
+ 'house.decay': 'houses',
+ // v3
+ 'world.ruleset': 'ruleset',
+ 'points.board': 'leaderboards',
+ // vendor.listing IS mapped, but the market feature ships with its stream
+ // disabled (see DEFAULT_STREAM_OFF): a live firehose of full vendor
+ // inventories would be the site's biggest bandwidth consumer and no page
+ // needs it live. An admin can turn it on.
+ 'vendor.listing': 'market',
+ 'vendor.listing.remove': 'market',
+ }),
+)
+
+// Features whose SSE fan-out is off unless an admin enables it. The REST reads
+// are unaffected; only the live stream is suppressed.
+const DEFAULT_STREAM_OFF = new Set(['market'])
+
+// Back-compat: the set of kinds that reach an anonymous viewer under the default
+// config. shardEvents `/feed` filtering and notificationStreams.js both consume
+// this. Derived from the map above rather than hand-maintained, so the two can
+// no longer drift.
+const PUBLIC_KINDS = new Set(
+ [...KIND_FEATURE.entries()]
+ .filter(([, feature]) => {
+ if (DEFAULT_STREAM_OFF.has(feature)) return false
+ return FEATURES[feature].audience === 'anonymous'
+ })
+ .map(([kind]) => kind),
+)
+
+// ── Config (DB-backed, cached) ─────────────────────────────────────────────
+
+const CONFIG_TTL_MS = 5000
+let cache = null
+let cachedAt = 0
+
+// Merge a stored row over its compiled default. Unknown feature names in the DB
+// are ignored (a stale row from a removed feature must not resurrect it), and an
+// invalid rung falls back to the default rather than failing open.
+function applyRow(name, row) {
+ const base = FEATURES[name]
+ const audience = isLevel(row?.audience) ? row.audience : base.audience
+ const fields = { ...base.fields }
+ for (const [field, level] of Object.entries(row?.fieldRules || {})) {
+ if (isLockedField(field)) continue // rule 1: not configurable
+ if (isLevel(level)) fields[field] = level
+ }
+ return {
+ enabled: row ? !!row.enabled : true,
+ audience,
+ fields,
+ stream: row?.stream == null ? !DEFAULT_STREAM_OFF.has(name) : !!row.stream,
+ }
+}
+
+function compileDefaults() {
+ const out = {}
+ for (const name of FEATURE_NAMES) out[name] = applyRow(name, null)
+ return out
+}
+
+// Read the config, cached briefly. Falls back to compiled defaults if the DB is
+// unreachable — the defaults reproduce pre-v3 behavior, so a DB blip degrades to
+// "what the site did before" rather than to "everything is public".
+async function getConfig() {
+ const now = Date.now()
+ if (cache && now - cachedAt < CONFIG_TTL_MS) return cache
+ try {
+ const rows = await db.listAll()
+ const byName = new Map(rows.map((r) => [r.feature, r]))
+ const out = {}
+ for (const name of FEATURE_NAMES) out[name] = applyRow(name, byName.get(name))
+ cache = out
+ cachedAt = now
+ } catch (err) {
+ log.error('getConfig; falling back to defaults', err)
+ cache = cache || compileDefaults()
+ cachedAt = now
+ }
+ return cache
+}
+
+const invalidate = () => {
+ cache = null
+ cachedAt = 0
+}
+
+// ── Viewer level ───────────────────────────────────────────────────────────
+//
+// anonymous no session
+// logged_in authenticated, no linked game account
+// player authenticated with a linked game account
+// staff admin | moderator — the same set as the existing `modAccess` gate.
+// `editor` is a CONTENT role with no shard privilege today, so it
+// resolves by link status like any other member; mapping it to staff
+// here would silently widen what editors can see.
+// admin admin
+//
+// Staff always satisfy the `player` rung (rank order guarantees it) even without
+// a linked account, matching the existing rule that /player/* is role-agnostic
+// self-service.
+
+// Same TTL as the config cache: this decides a privilege rung, so an unlinked
+// (or newly relinked) account must not keep the old answer for long. Anonymous,
+// staff and admin callers short-circuit before this runs, so the lookup only
+// costs a query on the logged-in-member path.
+const LINK_TTL_MS = CONFIG_TTL_MS
+const linkCache = new Map() // userId → { hasLink, at }
+
+async function hasLinkedAccount(userId) {
+ const hit = linkCache.get(userId)
+ const now = Date.now()
+ if (hit && now - hit.at < LINK_TTL_MS) return hit.hasLink
+ let hasLink = false
+ try {
+ const links = await shardLinks.listForUser(userId)
+ hasLink = Array.isArray(links) && links.length > 0
+ } catch (err) {
+ log.warn('hasLinkedAccount failed; treating as unlinked', { message: err.message })
+ }
+ linkCache.set(userId, { hasLink, at: now })
+ return hasLink
+}
+
+// Drop a user's cached link status (called when a link is created or removed so
+// the rung takes effect immediately rather than up to LINK_TTL_MS later).
+const forgetUser = (userId) => linkCache.delete(userId)
+
+async function viewerLevel(req) {
+ const viewer = req.user || auth.getUserFromRequest(req)
+ if (!viewer) return 'anonymous'
+ if (viewer.role === 'admin') return 'admin'
+ if (viewer.role === 'moderator') return 'staff'
+ return (await hasLinkedAccount(viewer.id)) ? 'player' : 'logged_in'
+}
+
+// ── Enforcement ────────────────────────────────────────────────────────────
+
+// Route gate. 404 when the feature is disabled (do not leak that it exists);
+// 403 when it exists but the viewer sits below its audience. Stashes the
+// resolved level on the request so controllers can project without re-resolving.
+function requireFeature(name) {
+ return async (req, res, next) => {
+ try {
+ const config = await getConfig()
+ const feature = config[name]
+ if (!feature || !feature.enabled) return res.status(404).json({ message: 'Not Found' })
+ const level = await viewerLevel(req)
+ req.viewerLevel = level
+ if (!meets(level, feature.audience)) return res.status(403).json({ message: 'Forbidden' })
+ return next()
+ } catch (err) {
+ log.error(`requireFeature(${name})`, err)
+ return res.status(500).json({ message: 'Internal Server Error' })
+ }
+ }
+}
+
+// Strip the fields a viewer at `level` may not see. Applies the locked rules
+// first (so acct/webId can never survive below admin), then the feature's
+// configured field rules. Recurses into arrays and nested objects because the
+// sensitive fields sit inside actor sub-objects (guild.leader, city.governor).
+// Only ARRAYS and PLAIN objects are walked. A Date, Buffer or other class
+// instance is a value, not a bag of fields: rebuilding one key-by-key would
+// return `{}` (a Date has no enumerable own properties), which is how the DB-
+// backed read models — whose rows carry real Date columns — differ from the
+// pure-JSON wire frames the projection was first written against.
+const isPlainObject = (v) => {
+ if (v === null || typeof v !== 'object') return false
+ const proto = Object.getPrototypeOf(v)
+ return proto === Object.prototype || proto === null
+}
+
+function projectValue(value, rules, level) {
+ if (Array.isArray(value)) return value.map((v) => projectValue(v, rules, level))
+ if (!isPlainObject(value)) return value
+ const out = {}
+ for (const [key, v] of Object.entries(value)) {
+ // Locked fields are checked by meaning first, so no configured rule (and no
+ // flattened spelling) can widen them past `admin`.
+ const required = isLockedField(key) ? 'admin' : rules[key]
+ if (required && !meets(level, required)) continue
+ out[key] = projectValue(v, rules, level)
+ }
+ return out
+}
+
+// Project a payload for one feature. `level` defaults to admin-equivalent only
+// when explicitly passed; callers should always pass a resolved level.
+function projectFeature(name, payload, level, config) {
+ const feature = config?.[name]
+ const rules = { ...LOCKED_FIELDS, ...(feature ? feature.fields : {}) }
+ return projectValue(payload, rules, level)
+}
+
+// Convenience for controllers: resolve config once, project, return.
+async function project(name, payload, req) {
+ const config = await getConfig()
+ const level = req.viewerLevel || (await viewerLevel(req))
+ return projectFeature(name, payload, level, config)
+}
+
+// Is this event kind allowed to reach a viewer at `level`? Fail closed on an
+// unmapped kind (rule 2), and honour both the feature gate and its stream flag.
+function kindVisibleTo(kind, level, config) {
+ if (level === 'admin') return true
+ const name = KIND_FEATURE.get(kind)
+ if (!name) return false // rule 2: unmapped ⇒ admin-only
+ const feature = config?.[name]
+ if (!feature || !feature.enabled || !feature.stream) return false
+ return meets(level, feature.audience)
+}
+
+// The event kinds a viewer at `level` may read under the CURRENT config. This is
+// the live counterpart of PUBLIC_KINDS, which is a module-load constant derived
+// from the compiled DEFAULTS and therefore cannot answer "may THIS viewer see
+// this kind, given what the admin has configured?".
+//
+// Deliberately ignores the `stream` flag: that governs SSE fan-out only, so a
+// feature whose live firehose is off (market) is still readable from the stored
+// history. Unmapped kinds are absent by construction (rule 2).
+function visibleKinds(level, config) {
+ return [...KIND_FEATURE.entries()]
+ .filter(([, name]) => {
+ const feature = config?.[name]
+ return !!feature && feature.enabled && meets(level, feature.audience)
+ })
+ .map(([kind]) => kind)
+}
+
+// The features a viewer at `level` can actually see — drives SPA nav so it never
+// renders a link that would 403.
+function visibleFeatures(level, config) {
+ return FEATURE_NAMES.filter((name) => {
+ const feature = config[name]
+ return feature.enabled && meets(level, feature.audience)
+ })
+}
+
+module.exports = {
+ LADDER,
+ FEATURES,
+ FEATURE_NAMES,
+ LOCKED_FIELDS,
+ KIND_FEATURE,
+ PUBLIC_KINDS,
+ DEFAULT_STREAM_OFF,
+ isLevel,
+ isFeature,
+ isLockedField,
+ rank,
+ meets,
+ getConfig,
+ invalidate,
+ compileDefaults,
+ viewerLevel,
+ forgetUser,
+ requireFeature,
+ projectFeature,
+ project,
+ kindVisibleTo,
+ visibleKinds,
+ visibleFeatures,
+}
diff --git a/server/src/utils/spawnAtlasParse.js b/server/src/utils/spawnAtlasParse.js
new file mode 100644
index 0000000..5d909f5
--- /dev/null
+++ b/server/src/utils/spawnAtlasParse.js
@@ -0,0 +1,686 @@
+// Spawn atlas parsers — pure functions over strings, no `fs`, no dependencies.
+//
+// These back the CLI build script (`scripts/buildSpawnAtlas.js`), which is the
+// only thing that reads a ServUO tree. Keeping every parser pure and fs-free is
+// what lets the test suite cover them in CI, where no ServUO tree exists: the
+// tests hand these functions literal XML strings.
+//
+// Four source shapes, two very different parsing strategies:
+//
+// Spawns/*.xml ~10.5 MB across 13 files, FLAT records
+// → streaming regex, never a DOM. See parsePoints().
+// Data/Regions.xml 129 KB, genuinely nested inside
+// Data/Locations/*.xml nested /
+// Config/ChampionSpawns.xml 4.8 KB, /
+// → the small recursive tokenizer below.
+//
+// The server has zero XML dependencies and this adds none. The tokenizer is
+// deliberately a *subset* parser: it handles the constructs these four files
+// actually use (elements, attributes, self-closing tags, comments, the XML
+// declaration, CDATA, the five predefined entities plus numeric refs) and
+// nothing else. It is not a general-purpose XML parser and must not be reused
+// as one — no namespaces, no DTDs, no entity declarations.
+
+// ── Entities ───────────────────────────────────────────────────────────────
+
+const NAMED_ENTITIES = {
+ amp: '&',
+ lt: '<',
+ gt: '>',
+ quot: '"',
+ apos: "'",
+}
+
+// Region and location names carry apostrophes ("Mondain's Legacy", "Wrong's
+// Level 3"), so entity decoding is load-bearing here, not decorative.
+function decodeEntities(text) {
+ if (!text.includes('&')) return text
+ return text.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (match, body) => {
+ if (body[0] === '#') {
+ const code =
+ body[1] === 'x' || body[1] === 'X'
+ ? Number.parseInt(body.slice(2), 16)
+ : Number.parseInt(body.slice(1), 10)
+ return Number.isFinite(code) ? String.fromCodePoint(code) : match
+ }
+ const named = NAMED_ENTITIES[body.toLowerCase()]
+ return named === undefined ? match : named
+ })
+}
+
+// ── The tokenizer ──────────────────────────────────────────────────────────
+
+const ATTR_RE = /([\w:.-]+)\s*=\s*("([^"]*)"|'([^']*)')/g
+
+function parseAttrs(source) {
+ const attrs = {}
+ ATTR_RE.lastIndex = 0
+ let match
+ while ((match = ATTR_RE.exec(source)) !== null) {
+ const raw = match[3] !== undefined ? match[3] : match[4]
+ attrs[match[1]] = decodeEntities(raw)
+ }
+ return attrs
+}
+
+/**
+ * Parse a small nested XML document into `{ name, attrs, children, text }`.
+ *
+ * Intended for Regions.xml / Locations / ChampionSpawns.xml only — never for
+ * the multi-megabyte Spawns files. Returns the root element, or `null` for a
+ * document with no elements.
+ *
+ * Mismatched or stray closing tags are ignored rather than thrown on: these are
+ * hand-maintained shard config files, and one malformed region should degrade
+ * to a missing region, not abort a build that is otherwise fine.
+ */
+function parseXml(source) {
+ const text = String(source)
+ const root = { name: '#document', attrs: {}, children: [], text: '' }
+ const stack = [root]
+ let i = 0
+
+ while (i < text.length) {
+ const lt = text.indexOf('<', i)
+ if (lt === -1) {
+ appendText(stack[stack.length - 1], text.slice(i))
+ break
+ }
+ if (lt > i) appendText(stack[stack.length - 1], text.slice(i, lt))
+
+ // Comment, declaration/DOCTYPE, or CDATA — skipped wholesale.
+ if (text.startsWith('', lt + 4)
+ i = end === -1 ? text.length : end + 3
+ continue
+ }
+ if (text.startsWith('', lt + 9)
+ const stop = end === -1 ? text.length : end
+ appendRawText(stack[stack.length - 1], text.slice(lt + 9, stop))
+ i = end === -1 ? text.length : end + 3
+ continue
+ }
+ if (text.startsWith('', lt)) {
+ const end = text.indexOf('?>', lt + 2)
+ i = end === -1 ? text.length : end + 2
+ continue
+ }
+ if (text.startsWith('', lt + 2)
+ i = end === -1 ? text.length : end + 1
+ continue
+ }
+
+ const gt = findTagEnd(text, lt)
+ if (gt === -1) {
+ // Unterminated tag: nothing sane is left to read.
+ break
+ }
+ const inner = text.slice(lt + 1, gt)
+
+ if (inner[0] === '/') {
+ const name = inner.slice(1).trim()
+ // Pop to the nearest matching open element. If there is no match the tag
+ // is stray and we drop it rather than unwinding the whole stack.
+ for (let depth = stack.length - 1; depth > 0; depth -= 1) {
+ if (stack[depth].name === name) {
+ stack.length = depth
+ break
+ }
+ }
+ i = gt + 1
+ continue
+ }
+
+ const selfClosing = inner.endsWith('/')
+ const body = selfClosing ? inner.slice(0, -1) : inner
+ const space = body.search(/\s/)
+ const name = (space === -1 ? body : body.slice(0, space)).trim()
+ const node = {
+ name,
+ attrs: space === -1 ? {} : parseAttrs(body.slice(space)),
+ children: [],
+ text: '',
+ }
+ stack[stack.length - 1].children.push(node)
+ if (!selfClosing) stack.push(node)
+ i = gt + 1
+ }
+
+ return root.children.length > 0 ? root.children[0] : null
+}
+
+// `>` inside a quoted attribute value must not end the tag.
+function findTagEnd(text, from) {
+ let quote = null
+ for (let i = from + 1; i < text.length; i += 1) {
+ const ch = text[i]
+ if (quote) {
+ if (ch === quote) quote = null
+ } else if (ch === '"' || ch === "'") {
+ quote = ch
+ } else if (ch === '>') {
+ return i
+ }
+ }
+ return -1
+}
+
+function appendText(node, chunk) {
+ if (chunk.trim() === '') return
+ appendRawText(node, decodeEntities(chunk))
+}
+
+function appendRawText(node, chunk) {
+ node.text = node.text ? `${node.text}${chunk}` : chunk
+}
+
+function childrenNamed(node, name) {
+ if (!node || !node.children) return []
+ return node.children.filter((child) => child.name === name)
+}
+
+// ── Facet names ────────────────────────────────────────────────────────────
+//
+// Facets are NOT a fixed list. A shard may add facets, replace them wholesale,
+// or rename them when its maps are updated, so nothing here may name Felucca,
+// Trammel or any other stock facet. The facet set is whatever the shard's own
+// files say it is, discovered at parse time.
+//
+// The complication is that the sources disagree about spelling for the SAME
+// facet and nothing in the files reconciles them: `Spawns/*.xml` `` and
+// `Regions.xml` `` say `TerMur`, while `Data/Locations/*.xml` spells
+// it `Ter Mur` and calls Tokuno `Tokuno Islands`. Left unreconciled this fails
+// silently — the landmark bucket is keyed differently from the points looking it
+// up, so the fallback never fires and every unregioned spawn on those facets
+// reads "Wilderness".
+//
+// Reconciliation is therefore done by MATCHING, not by a lookup table:
+// `facetKey()` collapses spelling differences, and `resolveFacetName()` matches
+// a loosely-spelled name against the canonical set discovered from the shard's
+// own data. A facet nobody else mentions keeps its own name rather than being
+// dropped.
+
+/**
+ * Collapse a facet name to a comparison key: lowercase, alphanumerics only.
+ * `TerMur`, `Ter Mur` and `ter-mur` all key alike.
+ */
+function facetKey(value) {
+ return String(value ?? '')
+ .toLowerCase()
+ .replace(/[^a-z0-9]+/g, '')
+}
+
+/**
+ * Build a key → canonical-spelling lookup from the authoritative facet names.
+ *
+ * The authority is what the spawn records and region definitions actually say,
+ * since those are the names the atlas keys everything on. Later names do not
+ * overwrite earlier ones, so the first source wins consistently.
+ */
+function buildFacetIndex(names) {
+ const index = new Map()
+ for (const name of names) {
+ const key = facetKey(name)
+ if (key !== '' && !index.has(key)) index.set(key, String(name).trim())
+ }
+ return index
+}
+
+/**
+ * Resolve a loosely-spelled facet name against the discovered canonical set.
+ *
+ * Tried in order: exact key match (`Ter Mur` → `TerMur`), then a prefix match in
+ * either direction (`Tokuno Islands` → `Tokuno`), longest candidate first so a
+ * more specific facet wins over a shorter one that merely prefixes it.
+ *
+ * A name matching nothing is returned trimmed rather than dropped — on a shard
+ * with a custom facet that is a real facet the atlas simply has no spawns for
+ * yet, and inventing a match would be worse than leaving it alone.
+ */
+function resolveFacetName(value, index) {
+ const raw = String(value ?? '').trim()
+ const key = facetKey(raw)
+ if (key === '') return ''
+ if (index.has(key)) return index.get(key)
+
+ let best = null
+ for (const [candidateKey, canonical] of index) {
+ if (!key.startsWith(candidateKey) && !candidateKey.startsWith(key)) continue
+ if (best === null || candidateKey.length > facetKey(best).length) best = canonical
+ }
+ return best ?? raw
+}
+
+// ── Small coercions ────────────────────────────────────────────────────────
+
+function toInt(value, fallback = 0) {
+ const n = Number.parseInt(value, 10)
+ return Number.isFinite(n) ? n : fallback
+}
+
+function toBool(value) {
+ return String(value).trim().toLowerCase() === 'true'
+}
+
+/**
+ * URL-safe slug used as the creature primary key and in `/atlas/:slug`.
+ * Spawn type tokens are C# class names, so they are already ASCII-ish; this
+ * mainly lowercases and collapses punctuation.
+ */
+function slugify(value) {
+ return String(value)
+ .trim()
+ .toLowerCase()
+ .replace(/[^a-z0-9]+/g, '-')
+ .replace(/^-+|-+$/g, '')
+}
+
+// ── Objects2 ───────────────────────────────────────────────────────────────
+
+/**
+ * Parse a `` value into `[{ type, max }]`.
+ *
+ * The format is one or more segments joined by `:OBJ=`, each segment being
+ * `Type:MX=n:SB=0:RT=0:...` — the type is the token before the first `:`, and
+ * every following token is a `KEY=value` pair. Verified against trammel.xml,
+ * where a single point carries six types:
+ *
+ * Giantserpent:MX=1:...:OBJ=Giantspider:MX=1:...:OBJ=Boar:MX=1:...
+ *
+ * Splitting on `:` alone would shred this, which is why the `:OBJ=` split comes
+ * first. `MX` is that type's own max count and is what the atlas displays;
+ * every other flag (spawn/trigger/refractory bookkeeping) is dropped.
+ *
+ * The type token itself may carry XmlSpawner directives appended to the class
+ * name — property assignments after `/` and an amount/argument list after `,`:
+ *
+ * Agralem/Name/Agralem alchemist/z/-50 Fairy,{RND,4,8}
+ * GargishRefugee/hue/34532 greatape,true GargishRouser,1
+ *
+ * Taken literally these produce creatures that do not exist ("alchemist/z/-50")
+ * AND split real ones in two, because `Fairy` and `Fairy,{RND,4,8}` slug apart —
+ * 71 of 845 entries were affected before this was stripped. Only the leading
+ * class name identifies the creature, so everything from the first `/` or `,`
+ * is dropped.
+ */
+/** Reduce an XmlSpawner type token to the bare class name. */
+function stripSpawnerDirectives(token) {
+ const cut = String(token).search(/[/,]/)
+ return (cut === -1 ? String(token) : String(token).slice(0, cut)).trim()
+}
+
+function parseObjects2(value) {
+ const source = String(value ?? '').trim()
+ if (source === '') return []
+
+ return source
+ .split(':OBJ=')
+ .map((segment) => {
+ const tokens = segment.split(':')
+ const type = stripSpawnerDirectives(tokens.shift() ?? '')
+ if (type === '') return null
+ let max = 1
+ for (const token of tokens) {
+ const eq = token.indexOf('=')
+ if (eq === -1) continue
+ if (token.slice(0, eq).trim().toUpperCase() === 'MX') {
+ max = toInt(token.slice(eq + 1), 1)
+ }
+ }
+ return { type, max }
+ })
+ .filter((entry) => entry !== null)
+}
+
+// ── Spawns/*.xml ───────────────────────────────────────────────────────────
+
+const POINT_RE = /([\s\S]*?)<\/Points>/g
+
+function tagValue(block, name) {
+ const match = block.match(new RegExp(`<${name}>([\\s\\S]*?)${name}>`))
+ return match ? decodeEntities(match[1]).trim() : ''
+}
+
+/**
+ * Parse a `Spawns/.xml` file into spawn point records.
+ *
+ * Deliberately regex/streaming and NOT `parseXml` — these files total ~10.5 MB
+ * and putting them through a DOM builder would allocate a node per element for
+ * ~40 fields on every one of ~6,500 records to keep 14 of them. The records are
+ * flat, so a per-record regex sweep is both correct and cheap.
+ *
+ * Only the fields the site can actually show are kept. Everything to do with
+ * triggering, refractory windows, proximity, sequential spawning, sounds and
+ * `UniqueId` is dropped here rather than downstream — that is what holds the
+ * committed artifact under 1 MB.
+ *
+ * NOTE: the facet comes from each record's own ``, never from the file
+ * name. `Eodon.xml`, `GravewaterLake.xml` and the other named-area files all
+ * carry TerMur/Trammel points, so there are 13 files but only 6 facets.
+ */
+/**
+ * A spawner's respawn window, in seconds.
+ *
+ * `DelayInSec` decides the unit of `MinDelay`/`MaxDelay`; absent (older files)
+ * it is false, which is minutes — the same default XmlSpawner assumes.
+ */
+function delaySeconds(block) {
+ const scale = toBool(tagValue(block, 'DelayInSec')) ? 1 : 60
+ return {
+ minDelay: toInt(tagValue(block, 'MinDelay')) * scale,
+ maxDelay: toInt(tagValue(block, 'MaxDelay')) * scale,
+ }
+}
+
+function parsePoints(source) {
+ const text = String(source)
+ const points = []
+ POINT_RE.lastIndex = 0
+ let match
+
+ while ((match = POINT_RE.exec(text)) !== null) {
+ const block = match[1]
+ // Reported exactly as written. `` is the authority the rest of the
+ // atlas keys on, so it is never rewritten.
+ const facet = tagValue(block, 'Map')
+ if (facet === '') continue
+
+ points.push({
+ name: tagValue(block, 'Name'),
+ facet,
+ x: toInt(tagValue(block, 'X')),
+ y: toInt(tagValue(block, 'Y')),
+ width: toInt(tagValue(block, 'Width')),
+ height: toInt(tagValue(block, 'Height')),
+ range: toInt(tagValue(block, 'Range')),
+ maxCount: toInt(tagValue(block, 'MaxCount')),
+ // Normalised to SECONDS here, because the unit is per-record. XmlSpawner
+ // writes minutes by default and switches to seconds only when a spawner's
+ // delay does not divide into whole minutes, flagging that with
+ // `DelayInSec` (XmlSpawner2.cs:7462-7480, read back at :6345-6358). Taken
+ // literally the two are indistinguishable — a `5` means five minutes on
+ // one spawner and five seconds on the next — so a consumer that assumed
+ // either unit would be wrong about the other. Stock ServUO 57.4 has ~30
+ // second-flagged spawners, few enough to look like noise and quietly
+ // mislabel.
+ ...delaySeconds(block),
+ // Time-of-day gating: TODMode 0 means "always", in which case the start
+ // and end values are meaningless and the site must not render them.
+ todStart: toInt(tagValue(block, 'TODStart')),
+ todEnd: toInt(tagValue(block, 'TODEnd')),
+ todMode: toInt(tagValue(block, 'TODMode')),
+ // A spawner switched off in-world spawns nothing; the build filters these
+ // out so the atlas describes what actually appears, not what is merely
+ // configured. Parsed here so the decision stays in the build script.
+ running: toBool(tagValue(block, 'IsRunning')),
+ types: parseObjects2(tagValue(block, 'Objects2')),
+ })
+ }
+
+ return points
+}
+
+// ── Data/Regions.xml ───────────────────────────────────────────────────────
+
+/**
+ * Flatten `Data/Regions.xml` into `[{ facet, name, type, priority, parent, rects }]`.
+ *
+ * Regions nest: a `` may contain further `` elements, and the
+ * inner ones frequently omit `name` and `priority` (``
+ * inside "Prism of Light"). Unnamed regions are skipped — they cannot label a
+ * spawn point — but their children are still walked, and a child that omits
+ * `priority` inherits its parent's rather than defaulting to 0, which would
+ * quietly sort it below every top-level region.
+ */
+function parseRegions(source) {
+ const root = parseXml(source)
+ const regions = []
+ if (!root) return regions
+
+ for (const facetNode of childrenNamed(root, 'Facet')) {
+ const facet = (facetNode.attrs.name || '').trim()
+ if (facet === '') continue
+ walkRegions(facetNode, facet, null, 0, regions)
+ }
+ return regions
+}
+
+function walkRegions(node, facet, parentName, parentPriority, out) {
+ for (const regionNode of childrenNamed(node, 'region')) {
+ const name = regionNode.attrs.name || ''
+ const priority = Object.hasOwn(regionNode.attrs, 'priority')
+ ? toInt(regionNode.attrs.priority, parentPriority)
+ : parentPriority
+
+ if (name !== '') {
+ const rects = childrenNamed(regionNode, 'rect').map((rect) => ({
+ x: toInt(rect.attrs.x),
+ y: toInt(rect.attrs.y),
+ width: toInt(rect.attrs.width),
+ height: toInt(rect.attrs.height),
+ }))
+ // A named region with no rects (some exist purely to carry music or a
+ // `go` point) can never contain anything, so it is not worth indexing.
+ if (rects.length > 0) {
+ out.push({
+ facet,
+ name,
+ type: regionNode.attrs.type || '',
+ priority,
+ parent: parentName,
+ rects,
+ })
+ }
+ }
+
+ walkRegions(regionNode, facet, name === '' ? parentName : name, priority, out)
+ }
+}
+
+// ── Data/Locations/*.xml ───────────────────────────────────────────────────
+
+/**
+ * Flatten a `Data/Locations/.xml` into landmark points.
+ *
+ * The file nests `` arbitrarily deep and puts coordinates only on
+ * ``: Trammel → Dungeons → Covetous → "Level 1". The outermost parent is
+ * the facet itself and is dropped from `path`; `group` is the innermost
+ * enclosing parent ("Covetous"), which is the label worth showing — "Covetous"
+ * reads better than "Level 1" when naming where a spawn is.
+ */
+function parseLocations(source, facetHint = '') {
+ const root = parseXml(source)
+ const landmarks = []
+ if (!root) return landmarks
+
+ for (const top of childrenNamed(root, 'parent')) {
+ // The file name (`Data/Locations/termur.xml`) is the more reliable signal
+ // and is preferred over the display label inside the file, which is where
+ // the `Ter Mur` / `Tokuno Islands` drift lives. Both are carried so the
+ // build can fall back to matching the label if the file name resolves to
+ // nothing — a shard may well name its files differently from its facets.
+ landmarks.push(
+ ...collectLocations(top, facetHint || top.attrs.name || '', top.attrs.name || ''),
+ )
+ }
+ return landmarks
+}
+
+function collectLocations(top, facet, label) {
+ const out = []
+ walkLocations(top, facet, [], out)
+ for (const landmark of out) landmark.facetLabel = label
+ return out
+}
+
+function walkLocations(node, facet, path, out) {
+ for (const child of childrenNamed(node, 'child')) {
+ const name = child.attrs.name || ''
+ if (name === '') continue
+ out.push({
+ facet,
+ name,
+ group: path.length > 0 ? path[path.length - 1] : name,
+ path: [...path],
+ x: toInt(child.attrs.x),
+ y: toInt(child.attrs.y),
+ z: toInt(child.attrs.z),
+ })
+ }
+ for (const parent of childrenNamed(node, 'parent')) {
+ const name = parent.attrs.name || ''
+ walkLocations(parent, facet, name === '' ? path : [...path, name], out)
+ }
+}
+
+// ── Config/ChampionSpawns.xml ──────────────────────────────────────────────
+
+/**
+ * Parse `Config/ChampionSpawns.xml` into champion altar records.
+ *
+ * This is the shard's *configured* champion roster — which altars exist, where,
+ * and which type each is pinned to. It is static content and distinct from the
+ * live `champ.update` feed the bridge already carries: this says "there is an
+ * Unholy Terror altar in Deceit", the feed says "it is on level 3 right now".
+ *
+ * A spawn with no `type` is randomised on every activation, which the site must
+ * render as "random" rather than as an empty type.
+ */
+function parseChampions(source) {
+ const root = parseXml(source)
+ const champions = []
+ if (!root) return champions
+
+ for (const spawnNode of childrenNamed(root, 'spawn')) {
+ const location = childrenNamed(spawnNode, 'location')[0]
+ const attrs = location ? location.attrs : {}
+ champions.push({
+ name: spawnNode.attrs.name || '',
+ group: spawnNode.attrs.group || '',
+ type: spawnNode.attrs.type || '',
+ randomType: !spawnNode.attrs.type,
+ facet: (attrs.map || '').trim(),
+ x: toInt(attrs.x),
+ y: toInt(attrs.y),
+ z: toInt(attrs.z),
+ radius: toInt(attrs.radius),
+ })
+ }
+ return champions
+}
+
+// ── Placement ──────────────────────────────────────────────────────────────
+
+const DEFAULT_LANDMARK_RADIUS = 200
+
+function inRect(x, y, rect) {
+ return (
+ x >= rect.x && x < rect.x + rect.width && y >= rect.y && y < rect.y + rect.height
+ )
+}
+
+function rectArea(rect) {
+ return Math.max(1, rect.width) * Math.max(1, rect.height)
+}
+
+/**
+ * Group parsed regions and landmarks by facet once, so the per-point resolve
+ * below is a scan of one facet instead of the whole world. With ~6,500 points
+ * and a few thousand rects this stays comfortably sub-second; there is no need
+ * for a spatial index and none is worth the complexity.
+ */
+function buildPlacementIndex(regions, landmarks) {
+ const byFacet = new Map()
+ // Keyed on facetKey(), not the raw name, so two spellings of one facet cannot
+ // land in separate buckets — the failure that silently emptied the landmark
+ // bucket for Ter Mur and Tokuno.
+ const facet = (name) => {
+ const key = facetKey(name)
+ if (!byFacet.has(key)) byFacet.set(key, { regions: [], landmarks: [] })
+ return byFacet.get(key)
+ }
+ for (const region of regions) facet(region.facet).regions.push(region)
+ for (const landmark of landmarks) facet(landmark.facet).landmarks.push(landmark)
+ return byFacet
+}
+
+/**
+ * Turn a raw coordinate into a human place name.
+ *
+ * This is the transform the whole atlas exists for: it is what makes a row read
+ * "Lizardman — Despise, Felucca" instead of "Lizardman — 5411, 1234".
+ *
+ * Resolution order:
+ * 1. The highest-`priority` named region whose rect contains the point. Ties
+ * break toward the SMALLEST rect, so a specific room inside a dungeon wins
+ * over the dungeon-wide rect it sits in.
+ * 2. Otherwise the nearest landmark within `landmarkRadius` tiles, labelled by
+ * its group ("Covetous"), not the individual marker ("Level 1").
+ * 3. Otherwise "Wilderness". The radius cap is what keeps step 3 reachable —
+ * without it the nearest landmark is always *some* landmark, however far,
+ * and open countryside would get labelled with a dungeon on the far side
+ * of the map.
+ */
+function resolveRegion(x, y, facetName, index, options = {}) {
+ const radius = options.landmarkRadius ?? DEFAULT_LANDMARK_RADIUS
+ const bucket = index.get(facetKey(facetName))
+ const result = { region: null, landmark: null, label: 'Wilderness' }
+ if (!bucket) return result
+
+ let best = null
+ let bestPriority = -Infinity
+ let bestArea = Infinity
+ for (const region of bucket.regions) {
+ for (const rect of region.rects) {
+ if (!inRect(x, y, rect)) continue
+ const area = rectArea(rect)
+ if (region.priority > bestPriority || (region.priority === bestPriority && area < bestArea)) {
+ best = region
+ bestPriority = region.priority
+ bestArea = area
+ }
+ }
+ }
+ if (best) {
+ result.region = best.name
+ result.label = best.name
+ return result
+ }
+
+ let nearest = null
+ let nearestDistance = Infinity
+ const limit = radius * radius
+ for (const landmark of bucket.landmarks) {
+ const dx = landmark.x - x
+ const dy = landmark.y - y
+ const distance = dx * dx + dy * dy
+ if (distance < nearestDistance) {
+ nearest = landmark
+ nearestDistance = distance
+ }
+ }
+ if (nearest && nearestDistance <= limit) {
+ result.landmark = nearest.group || nearest.name
+ result.label = result.landmark
+ }
+ return result
+}
+
+module.exports = {
+ parseXml,
+ parseObjects2,
+ parsePoints,
+ parseRegions,
+ parseLocations,
+ parseChampions,
+ buildPlacementIndex,
+ resolveRegion,
+ facetKey,
+ buildFacetIndex,
+ resolveFacetName,
+ slugify,
+ decodeEntities,
+ DEFAULT_LANDMARK_RADIUS,
+}
diff --git a/server/src/utils/spawnAtlasSource.js b/server/src/utils/spawnAtlasSource.js
new file mode 100644
index 0000000..10d307b
--- /dev/null
+++ b/server/src/utils/spawnAtlasSource.js
@@ -0,0 +1,336 @@
+// Spawn atlas — the filesystem layer over a ServUO tree.
+//
+// `spawnAtlasParse.js` holds the pure parsers; this module is the only thing
+// that touches a ServUO tree on disk, and it is shared by both callers:
+//
+// - the server, which refreshes the atlas on boot (`shardAtlas.model.js`)
+// - the CLI (`scripts/importSpawnAtlas.js`)
+//
+// The shard's own files are the single source of truth. Nothing is precomputed
+// and committed, because a shard's maps change over its lifetime — facets get
+// added, replaced or renamed — and a snapshot in the repo would silently go
+// stale against the world players actually see.
+//
+// Reading and hashing the whole tree costs ~120 ms and a full parse ~400 ms, so
+// the boot path hashes first and only parses when something actually changed.
+
+const crypto = require('crypto')
+const fs = require('fs')
+const path = require('path')
+
+const {
+ parsePoints,
+ parseRegions,
+ parseLocations,
+ parseChampions,
+ buildPlacementIndex,
+ buildFacetIndex,
+ resolveFacetName,
+ resolveRegion,
+ facetKey,
+ slugify,
+} = require('./spawnAtlasParse')
+
+const REGIONS_FILE = path.join('Data', 'Regions.xml')
+const LOCATIONS_DIR = path.join('Data', 'Locations')
+const SPAWNS_DIR = 'Spawns'
+const CHAMPIONS_FILE = path.join('Config', 'ChampionSpawns.xml')
+
+class AtlasSourceError extends Error {
+ constructor(message, code) {
+ super(message)
+ this.name = 'AtlasSourceError'
+ this.code = code
+ }
+}
+
+// ── Reading ────────────────────────────────────────────────────────────────
+
+function sha256(text) {
+ return crypto.createHash('sha256').update(text, 'utf8').digest('hex')
+}
+
+function listXml(dir) {
+ try {
+ return fs
+ .readdirSync(dir)
+ .filter((name) => name.toLowerCase().endsWith('.xml'))
+ .sort()
+ } catch (err) {
+ if (err.code === 'ENOENT' || err.code === 'ENOTDIR') return []
+ throw err
+ }
+}
+
+function readIfPresent(file) {
+ try {
+ return fs.readFileSync(file, 'utf8')
+ } catch (err) {
+ if (err.code === 'ENOENT' || err.code === 'ENOTDIR') return null
+ throw err
+ }
+}
+
+/**
+ * Read every atlas source file under `root`.
+ *
+ * Returns `{ files: [{ label, text, sha256, bytes }] }`, labels being
+ * tree-relative and forward-slashed so a hash map compares equal across
+ * platforms — the same tree read on Windows and Linux must produce the same
+ * fingerprint or every boot would look like a change.
+ */
+function readSources(root) {
+ if (!root || String(root).trim() === '') {
+ throw new AtlasSourceError('No ServUO path configured', 'NO_PATH')
+ }
+ if (!fs.existsSync(root)) {
+ throw new AtlasSourceError(`ServUO path does not exist: ${root}`, 'NOT_FOUND')
+ }
+
+ const files = []
+ const push = (label, file) => {
+ const text = readIfPresent(file)
+ if (text === null) return false
+ files.push({ label, text, sha256: sha256(text), bytes: Buffer.byteLength(text, 'utf8') })
+ return true
+ }
+
+ if (!push('Data/Regions.xml', path.join(root, REGIONS_FILE))) {
+ throw new AtlasSourceError(`Missing required file: ${REGIONS_FILE}`, 'NO_REGIONS')
+ }
+
+ for (const name of listXml(path.join(root, LOCATIONS_DIR))) {
+ push(`Data/Locations/${name}`, path.join(root, LOCATIONS_DIR, name))
+ }
+
+ const spawnFiles = listXml(path.join(root, SPAWNS_DIR))
+ if (spawnFiles.length === 0) {
+ throw new AtlasSourceError(`No spawn files found in ${SPAWNS_DIR}`, 'NO_SPAWNS')
+ }
+ for (const name of spawnFiles) push(`Spawns/${name}`, path.join(root, SPAWNS_DIR, name))
+
+ push('Config/ChampionSpawns.xml', path.join(root, CHAMPIONS_FILE))
+
+ return { files }
+}
+
+/**
+ * A fingerprint of the tree: `{ "": "" }`.
+ *
+ * The boot path compares this against what was last imported and skips the
+ * parse entirely when it matches, which is the normal case on every restart
+ * that did not follow a map update.
+ */
+function hashSources(root) {
+ const { files } = readSources(root)
+ const hashes = {}
+ for (const file of files) hashes[file.label] = file.sha256
+ return hashes
+}
+
+/**
+ * Bumped whenever the parser produces DIFFERENT data from IDENTICAL source
+ * files — a fixed misreading, a new field, a changed unit.
+ *
+ * Without it the hash gate is a trap: an install whose tree has not changed
+ * would keep serving what an older parser derived, indefinitely, because the
+ * only thing the boot path compares is the tree. The version is stored beside
+ * the source hashes and a mismatch counts as drift, so a deploy that corrects
+ * the parse actually reaches the data.
+ *
+ * 2 — respawn delays normalised to seconds (they are per-record minutes OR
+ * seconds in the source, decided by `DelayInSec`).
+ */
+const PARSER_VERSION = 2
+
+/** True when two source fingerprints describe the same tree. */
+function sameSources(a, b) {
+ if (!a || !b) return false
+ const aKeys = Object.keys(a).sort()
+ const bKeys = Object.keys(b).sort()
+ if (aKeys.length !== bKeys.length) return false
+ return aKeys.every((key, i) => key === bKeys[i] && a[key] === b[key])
+}
+
+// ── Aggregation ────────────────────────────────────────────────────────────
+
+/**
+ * Choose one display spelling for a creature.
+ *
+ * Spawn files are not consistent about case — the same creature is `Lizardman`
+ * in one file and `lizardman` in another. Slugging collapses them correctly, but
+ * the display name would otherwise depend on file read order. Most frequent
+ * spelling wins; ties break toward more capitals, then alphabetically.
+ */
+function displayName(spellings) {
+ const capitals = (value) => (value.match(/[A-Z]/g) || []).length
+ return [...spellings.entries()].sort((a, b) => {
+ if (b[1] !== a[1]) return b[1] - a[1]
+ const caps = capitals(b[0]) - capitals(a[0])
+ if (caps !== 0) return caps
+ return a[0].localeCompare(b[0])
+ })[0][0]
+}
+
+/**
+ * Roll spawn points up into per-type creature rows.
+ *
+ * `total` is the sum of each type's own max across every point that spawns it —
+ * how many of this creature the world holds at once. `facets` is a per-facet
+ * point count, so "where does this live" answers without touching the points.
+ */
+function aggregateCreatures(points) {
+ const creatures = new Map()
+ for (const point of points) {
+ for (const entry of point.types) {
+ const slug = slugify(entry.type)
+ if (slug === '') continue
+ let creature = creatures.get(slug)
+ if (!creature) {
+ creature = { slug, name: '', total: 0, points: 0, facets: {}, spellings: new Map() }
+ creatures.set(slug, creature)
+ }
+ creature.total += entry.max
+ creature.points += 1
+ creature.facets[point.facet] = (creature.facets[point.facet] || 0) + 1
+ creature.spellings.set(entry.type, (creature.spellings.get(entry.type) || 0) + 1)
+ }
+ }
+
+ return [...creatures.values()]
+ .map(({ spellings, ...creature }) => ({ ...creature, name: displayName(spellings) }))
+ .sort((a, b) => a.slug.localeCompare(b.slug))
+}
+
+// ── Build ──────────────────────────────────────────────────────────────────
+
+/**
+ * Parse a ServUO tree into the full atlas.
+ *
+ * Pure with respect to the database — it reads files and returns data; nothing
+ * here writes. `shardAtlas.model.js` decides what to do with the result.
+ */
+function buildAtlas(root, options = {}) {
+ const { files } = readSources(root)
+ const byLabel = new Map(files.map((file) => [file.label, file]))
+ const source = {}
+ for (const file of files) source[file.label] = { bytes: file.bytes, sha256: file.sha256 }
+
+ const regions = parseRegions(byLabel.get('Data/Regions.xml').text)
+
+ const rawLandmarks = []
+ for (const file of files) {
+ if (!file.label.startsWith('Data/Locations/')) continue
+ const basename = path.basename(file.label, '.xml')
+ rawLandmarks.push(...parseLocations(file.text, basename))
+ }
+
+ const rawPoints = []
+ for (const file of files) {
+ if (!file.label.startsWith('Spawns/')) continue
+ rawPoints.push(...parsePoints(file.text))
+ }
+
+ // The facet set is whatever THIS tree declares — never a built-in list. A
+ // shard may add facets, replace them outright, or rename them when its maps
+ // are updated, and the atlas has to follow without a code change. Spawn
+ // records and region definitions are the authority, because those are the
+ // names everything else is keyed on.
+ const facetIndex = buildFacetIndex([
+ ...rawPoints.map((point) => point.facet),
+ ...regions.map((region) => region.facet),
+ ])
+
+ // Landmark facets are then matched against that set, which is what absorbs the
+ // `Ter Mur` / `Tokuno Islands` spelling drift between Locations and .
+ const landmarks = rawLandmarks.map(({ facetLabel, ...landmark }) => {
+ const fromFile = resolveFacetName(landmark.facet, facetIndex)
+ const matchedFile = facetIndex.has(facetKey(fromFile))
+ const resolved = matchedFile ? fromFile : resolveFacetName(facetLabel, facetIndex)
+ return { ...landmark, facet: resolved || landmark.facet }
+ })
+
+ const placement = buildPlacementIndex(regions, landmarks)
+ const resolveOpts = options.landmarkRadius ? { landmarkRadius: options.landmarkRadius } : {}
+
+ const disabled = rawPoints.filter((point) => !point.running).length
+ const points = rawPoints
+ // A spawner switched off in-world produces nothing; advertising it would be
+ // a straight lie to a player planning a hunt.
+ .filter((point) => point.running)
+ // A spawner with no types is a placeholder — nothing to show.
+ .filter((point) => point.types.length > 0)
+ .map((point) => {
+ const place = resolveRegion(point.x, point.y, point.facet, placement, resolveOpts)
+ return {
+ name: point.name,
+ facet: point.facet,
+ x: point.x,
+ y: point.y,
+ width: point.width,
+ height: point.height,
+ range: point.range,
+ maxCount: point.maxCount,
+ minDelay: point.minDelay,
+ maxDelay: point.maxDelay,
+ todStart: point.todStart,
+ todEnd: point.todEnd,
+ todMode: point.todMode,
+ region: place.region,
+ landmark: place.landmark,
+ label: place.label,
+ types: point.types,
+ }
+ })
+
+ const championsFile = byLabel.get('Config/ChampionSpawns.xml')
+ const champions = (championsFile ? parseChampions(championsFile.text) : []).map((champ) => {
+ const facet = resolveFacetName(champ.facet, facetIndex) || champ.facet
+ return {
+ ...champ,
+ facet,
+ slug: slugify(`${facet}-${champ.name}`),
+ label: resolveRegion(champ.x, champ.y, facet, placement, resolveOpts).label,
+ }
+ })
+
+ const creatures = aggregateCreatures(points)
+ const facets = [...new Set(points.map((point) => point.facet))].sort()
+ const unresolved = points.filter((point) => !point.region && !point.landmark).length
+
+ return {
+ meta: {
+ generatedAt: new Date().toISOString(),
+ parserVersion: PARSER_VERSION,
+ landmarkRadius: options.landmarkRadius ?? undefined,
+ counts: {
+ facets: facets.length,
+ points: points.length,
+ pointsDisabled: disabled,
+ creatures: creatures.length,
+ regions: regions.length,
+ landmarks: landmarks.length,
+ champions: champions.length,
+ unresolvedPoints: unresolved,
+ },
+ source,
+ },
+ facets,
+ creatures,
+ regions,
+ landmarks,
+ champions,
+ points,
+ }
+}
+
+module.exports = {
+ AtlasSourceError,
+ PARSER_VERSION,
+ readSources,
+ hashSources,
+ sameSources,
+ buildAtlas,
+ aggregateCreatures,
+ displayName,
+}
diff --git a/server/src/utils/uoLinkClient.js b/server/src/utils/uoLinkClient.js
index 0a44099..44d5f5f 100644
--- a/server/src/utils/uoLinkClient.js
+++ b/server/src/utils/uoLinkClient.js
@@ -58,7 +58,7 @@ async function call(path, { method = 'GET', body } = {}) {
const headers = {
'Content-Type': 'application/json',
- 'X-UOLink-Version': String(config.protocol || 1),
+ 'X-UOLink-Version': String(config.protocol || 3),
}
if (config.token) headers.Authorization = `Bearer ${config.token}`
@@ -128,6 +128,18 @@ const getGuilds = () => call('/guilds')
const getGovernors = () => call('/governors')
const getHouses = () => call('/houses')
const getPresence = () => call('/online') // aggregate population (count + byFacet/byRegion)
+// Protocol 3.0: the shard's published ruleset. Object-shaped, not a board — the
+// sidecar answers `{ ruleset: null }` until the shard has published one.
+const getRuleset = () => call('/ruleset')
+// Protocol 3.0: points/loyalty leaderboards. `/points` is board-shaped (an array
+// under `boards`); the per-system read 404s for a system the shard never published.
+const getPoints = () => call('/points')
+const getPointsBoard = (system) => call(`/points/${encodeURIComponent(system)}`)
+// Protocol 3.0: the player-vendor market index. The one PAGED sidecar read — a
+// whole-world market does not fit in a response — so it answers with
+// `{ vendors, total, limit, offset }` and the caller walks it (see uoLinkSocket).
+const getMarket = ({ limit = 200, offset = 0 } = {}) =>
+ call(`/market?limit=${encodeURIComponent(limit)}&offset=${encodeURIComponent(offset)}`)
// ── Commands ──────────────────────────────────────────────────────────────
const confirmLink = (code, websiteUserId) =>
@@ -191,6 +203,10 @@ module.exports = {
getGovernors,
getHouses,
getPresence,
+ getRuleset,
+ getPoints,
+ getPointsBoard,
+ getMarket,
confirmLink,
linkLookup,
createAccount,
diff --git a/server/src/utils/uoLinkSocket.js b/server/src/utils/uoLinkSocket.js
index b4822db..5cadd31 100644
--- a/server/src/utils/uoLinkSocket.js
+++ b/server/src/utils/uoLinkSocket.js
@@ -63,6 +63,55 @@ async function ingestEach(events) {
for (const ev of events) await shardIngest.ingest(ev, { fromBackfill: true })
}
+// ── Market backfill ────────────────────────────────────────────────────────
+//
+// The market is the only board that does not fit in one response, so /market is
+// paged and this walks it. Two bounds, both deliberate:
+//
+// • MARKET_SNAPSHOT_MAX caps the walk. A pathological world (or a sidecar whose
+// store was never pruned) must not be able to hang startup — backfill runs
+// before the site is serving the live feed, so an unbounded loop here is
+// downtime, not slowness.
+// • The loop stops on a SHORT page as well as on `total`, because a concurrent
+// sweep can shrink the index underneath the walk and paging to a stale total
+// would spin.
+//
+// Vendors are upserted, never reconciled-by-replacement. A vendor absent from the
+// snapshot is absent because the sidecar dropped it on vendor.listing.remove —
+// which our own ingest already processed — so clearing the table first would only
+// create a window where the market page is empty.
+const MARKET_SNAPSHOT_MAX = 5000
+const MARKET_PAGE = 200
+
+async function backfillMarket() {
+ let offset = 0
+ let seen = 0
+
+ for (;;) {
+ const res = await uoLinkClient.getMarket({ limit: MARKET_PAGE, offset })
+ if (!res.ok || !res.data || !Array.isArray(res.data.vendors)) return
+
+ const page = res.data.vendors
+ if (page.length === 0) break
+
+ await ingestEach(page)
+ seen += page.length
+ offset += page.length
+
+ if (page.length < MARKET_PAGE) break
+ if (seen >= MARKET_SNAPSHOT_MAX) {
+ log.warn('market snapshot truncated at the safety cap', {
+ cap: MARKET_SNAPSHOT_MAX,
+ total: res.data.total,
+ })
+ break
+ }
+ if (Number.isFinite(res.data.total) && offset >= res.data.total) break
+ }
+
+ if (seen > 0) log.info('snapshotted player-vendor market from /market', { count: seen })
+}
+
// Pull recent events from the sidecar's own store and replay them through the
// dispatcher (fromBackfill = no SSE re-broadcast). dedupe_key + INSERT IGNORE
// make this idempotent, so overlap with what we already stored is harmless.
@@ -88,6 +137,32 @@ async function backfill() {
await snapshot(() => uoLinkClient.getGovernors(), 'cities', (c) => shardState.replaceGovernors(c), 'snapshotted governor board from /governors')
await snapshot(() => uoLinkClient.getHouses(), 'houses', ingestEach, 'snapshotted house registry from /houses')
+ // ── Protocol 3.0 ─────────────────────────────────────────────────────
+ // The ruleset is object-shaped, not a board, so it can't go through
+ // snapshot() (which asserts an array under `key`). The shard also re-emits
+ // world.ruleset on its own connect — this covers the other order, where the
+ // sidecar was already up and holding the ruleset when WE reconnected.
+ //
+ // Routed through the dispatcher rather than straight to shardState, exactly as
+ // ingestEach does for the array-shaped boards: the two orders must produce the
+ // same stored frame, and calling setRuleset directly here made this a second
+ // write path that silently skipped the shard-name normalization the live frame
+ // gets. One writer, one set of rules.
+ const ruleset = await uoLinkClient.getRuleset()
+ if (ruleset.ok && ruleset.data && ruleset.data.ruleset) {
+ await shardIngest.ingest(ruleset.data.ruleset, { fromBackfill: true })
+ log.info('snapshotted shard ruleset from /ruleset', { rev: ruleset.data.ruleset.rev })
+ }
+
+ // Points boards ARE array-shaped, so they go through snapshot() — but with
+ // ingestEach rather than a replace*: there is no points.remove and the shard's
+ // system set is fixed, so upserting is the whole reconciliation. A system the
+ // operator has since excluded keeps its last-known board rather than vanishing,
+ // which is the right answer for a month-scale standing.
+ await snapshot(() => uoLinkClient.getPoints(), 'boards', ingestEach, 'snapshotted points boards from /points')
+
+ await backfillMarket()
+
const presence = await uoLinkClient.getPresence()
if (presence.ok && presence.data && typeof presence.data.count === 'number') {
await shardState.setPresence(presence.data)
@@ -128,7 +203,7 @@ async function connect() {
return
}
- state.protocol = config.protocol || 1
+ state.protocol = config.protocol || 3
helloSeen = false
const url = buildUrl(config.wsUrl, config.token)
diff --git a/server/swagger/swagger-output.json b/server/swagger/swagger-output.json
index 72b23d2..766d02e 100644
--- a/server/swagger/swagger-output.json
+++ b/server/swagger/swagger-output.json
@@ -40,6 +40,10 @@
"name": "Public · Shard",
"description": "Live shard data ingested from the uo-link sidecar (status, feed, economy, IDOC, characters)"
},
+ {
+ "name": "Public · Atlas",
+ "description": "Spawn atlas / bestiary — static shard content parsed from the shard's own ServUO tree, independent of the sidecar"
+ },
{
"name": "Admin · Account",
"description": "Self-service account security (2FA, linked identities)"
@@ -3616,6 +3620,227 @@
]
}
},
+ "/api/v1/admin/shard/atlas": {
+ "get": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Spawn atlas status: path, drift, counts, pending review (admin only)",
+ "description": "Where the ServUO tree is, whether it can be read, whether its source files have drifted from the loaded atlas, and any refresh staged for approval. The public /atlas/meta route reports the game world only; the filesystem detail is here.",
+ "responses": {
+ "200": {
+ "description": "Atlas status",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasStatus"
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Admin role required",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ]
+ }
+ },
+ "/api/v1/admin/shard/atlas/approve": {
+ "post": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Approve a staged atlas refresh that removes a facet (admin only)",
+ "description": "Re-parses the tree and applies it, facet loss included. Only the decision was stored, never the parsed world, so what lands matches the tree at approval time — an operator who has since fixed a half-copied mount gets the corrected import.",
+ "responses": {
+ "200": {
+ "description": "What happened",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasRefreshResult"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ]
+ }
+ },
+ "/api/v1/admin/shard/atlas/import": {
+ "post": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Re-import the spawn atlas from the ServUO tree (admin only)",
+ "description": "Applies a map change without a restart. `force` reimports even when the source hashes match what is loaded. A refresh that would REMOVE a facet is still staged for approval rather than applied — that decision is never taken implicitly. An unreadable tree answers 200 with status \"unavailable\" rather than 500: the refresh contract reports outcomes instead of throwing, and the admin needs to be told what is wrong with the path.",
+ "responses": {
+ "200": {
+ "description": "What happened",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasRefreshResult"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ],
+ "requestBody": {
+ "required": false,
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "object",
+ "properties": {
+ "force": {
+ "type": "boolean",
+ "description": "Reimport even if the tree is unchanged."
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "/api/v1/admin/shard/atlas/path": {
+ "put": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Set the ServUO tree the atlas reads from (admin only)",
+ "description": "Persisted as a setting, which wins over the SERVUO_PATH deploy default so the mount can move without a redeploy. Blank clears it and the atlas is simply skipped on the next boot. Deliberately does not import as a side effect — the response carries the refreshed status so the panel can offer that as the next step.",
+ "responses": {
+ "200": {
+ "description": "Atlas status after the change",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasStatus"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ],
+ "requestBody": {
+ "required": true,
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "object",
+ "required": [
+ "path"
+ ],
+ "properties": {
+ "path": {
+ "type": "string",
+ "description": "Absolute path to the ServUO server root. Blank disables the atlas."
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "/api/v1/admin/shard/atlas/reject": {
+ "post": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Reject a staged atlas refresh (admin only)",
+ "description": "Keeps the current atlas and remembers the decision against those exact source hashes, so a declined refresh does not re-prompt on every restart. Changing the tree asks again.",
+ "responses": {
+ "200": {
+ "description": "Rejected",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasRefreshResult"
+ }
+ }
+ }
+ },
+ "404": {
+ "description": "Nothing is awaiting review",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ]
+ }
+ },
"/api/v1/admin/shard/audit": {
"get": {
"tags": [
@@ -3853,6 +4078,157 @@
]
}
},
+ "/api/v1/admin/shard/clilocs": {
+ "get": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Cliloc table status: sources, drift, entry count (admin only)",
+ "description": "Where the cliloc sources are, whether they can be read, how many entries are loaded, and whether the files on disk have drifted from them. The table is built from a SET of sources — the converted client table plus every operator-maintained overlay under `custom/`, which is how shard-added and shard-edited items get names. `missingSources` lists any source that was loaded before and is now gone; an import refuses that without `approve`. A shard with nothing configured is a supported state — item names simply render as ids.",
+ "responses": {
+ "200": {
+ "description": "Cliloc status",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ClilocStatus"
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Admin role required",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ]
+ }
+ },
+ "/api/v1/admin/shard/clilocs/import": {
+ "post": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Re-import the cliloc table from its source files (admin only)",
+ "description": "Applies a client patch, or a change to the shard\\'s own overlay files, without a restart. `force` reimports even when the source hashes match what is loaded. `approve` accepts a refresh in which a previously-loaded source has VANISHED — refused by default, because an unmounted volume and a deliberate deletion are indistinguishable from the server, and the wrong guess silently drops every name that file contributed. A missing path — or the common mistake of pointing at the client\\'s own COMPRESSED Cliloc.enu — answers 200 with status \"unavailable\" and the reason, rather than 500: the refresh contract reports outcomes instead of throwing, and the admin needs to be told which file to convert.",
+ "responses": {
+ "200": {
+ "description": "What happened",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ClilocRefreshResult"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ],
+ "requestBody": {
+ "required": false,
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "object",
+ "properties": {
+ "force": {
+ "type": "boolean",
+ "description": "Reimport even if the sources are unchanged."
+ },
+ "approve": {
+ "type": "boolean",
+ "description": "Accept a refresh in which a previously-loaded source has vanished."
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "/api/v1/admin/shard/clilocs/path": {
+ "put": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Set the cliloc source the site reads from (admin only)",
+ "description": "Accepts either the converted base file itself or a directory to search. Overlays are read from a `custom/` directory beside it either way — pointing at a file does not forfeit them. Persisted as a setting, which wins over the UO_CLIENT_PATH deploy default so the mount can move without a redeploy. Blank clears it and resolution is skipped on the next boot. Deliberately does not import as a side effect — the response carries the refreshed status so the panel can offer that as the next step.",
+ "responses": {
+ "200": {
+ "description": "Cliloc status after the change",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ClilocStatus"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ],
+ "requestBody": {
+ "required": true,
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "object",
+ "required": [
+ "path"
+ ],
+ "properties": {
+ "path": {
+ "type": "string",
+ "description": "Path to the converted cliloc file, or a directory containing one. Blank disables resolution."
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
"/api/v1/admin/shard/houses": {
"get": {
"tags": [
@@ -4368,6 +4744,98 @@
]
}
},
+ "/api/v1/admin/shard/visibility": {
+ "get": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Get per-feature shard visibility config (admin only)",
+ "description": "The effective config (compiled defaults merged with stored overrides) plus the vocabulary the admin UI renders from: the audience ladder and the always-locked fields. Defaults reproduce pre-v3 behavior.",
+ "responses": {
+ "200": {
+ "description": "Visibility config",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardVisibilityConfig"
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Admin role required",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ]
+ },
+ "put": {
+ "tags": [
+ "Admin · Shard"
+ ],
+ "summary": "Update per-feature shard visibility config (admin only)",
+ "description": "Patch one or more features. Unknown feature names, unknown rungs, and any attempt to configure a locked field (acct / webId — admin-only always) are rejected with 400 rather than silently dropped.",
+ "responses": {
+ "200": {
+ "description": "Updated config",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardVisibilityConfig"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Unknown feature, rung, or a locked field",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ },
+ "security": [
+ {
+ "cookieAuth": []
+ },
+ {
+ "bearerAuth": []
+ }
+ ],
+ "requestBody": {
+ "required": true,
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardVisibilityUpdate"
+ }
+ }
+ }
+ }
+ }
+ },
"/api/v1/admin/site-mode": {
"put": {
"tags": [
@@ -10530,6 +10998,367 @@
]
}
},
+ "/api/v1/public/atlas/champions": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "Configured champion altars (the roster, not the live board)",
+ "description": "Where the altars are and what each one summons — \"there is an Unholy Terror altar in Deceit\". `randomType` marks altars whose champion is drawn at activation. Do not conflate this with GET /public/shard/champs, which is the live sidecar-fed board (\"it is on level 3 right now\").",
+ "parameters": [
+ {
+ "name": "facet",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Limit to one facet."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "Altars, by facet then name",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "array",
+ "items": {
+ "$ref": "#/components/schemas/AtlasChampion"
+ }
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
+ "/api/v1/public/atlas/creatures": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "Search the bestiary (paginated)",
+ "description": "Every creature the shard spawns, most numerous first. `total` is how many can be alive at once across all spawners; `points` is how many spawners mention it; `facets` maps facet name to that creature\\'s share on it. Static content parsed from the shard\\'s ServUO tree — unaffected by the shard being offline.",
+ "parameters": [
+ {
+ "name": "q",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Substring match on the creature name (max 60 chars)."
+ },
+ {
+ "name": "facet",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Limit to creatures spawning on this facet. Facet names come from the shard's own files; an unknown one returns an empty page."
+ },
+ {
+ "name": "limit",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Page size, 1..100 (default 50)."
+ },
+ {
+ "name": "offset",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Rows to skip (default 0)."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "A page of creatures plus the unpaginated total",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasCreaturePage"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "The atlas feature is gated above this caller",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "404": {
+ "description": "The atlas feature is disabled",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
+ "/api/v1/public/atlas/creatures/{slug}": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "One creature: where it spawns, and what spawns with it",
+ "description": "The answer the atlas exists to give. `places` is the aggregate — \"lizardman → Shrines, Isamu-Jima, Yew\" — resolved by point-in-rect against the shard\\'s own region rectangles, falling back to the nearest landmark, else \"Wilderness\". `spawners` lists the individual spawn points (bounded; `spawnersTruncated` says when the list was cut), and `alsoHere` is what shares those spawners.",
+ "parameters": [
+ {
+ "name": "slug",
+ "in": "path",
+ "required": true,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Creature slug, e.g. lizardman."
+ },
+ {
+ "name": "facet",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Restrict places and spawners to one facet."
+ },
+ {
+ "name": "points",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Max spawners to return, 1..1000 (default 200)."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "The creature",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasCreature"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "No such creature in this atlas (or the feature is disabled)",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
+ "/api/v1/public/atlas/landmarks": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "Points of interest (dungeon levels, town markers)",
+ "description": "From the shard\\'s Data/Locations files. `group` is the innermost enclosing parent (\"Covetous\"), which is the label worth showing over the individual marker (\"Level 1\").",
+ "parameters": [
+ {
+ "name": "facet",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Limit to one facet."
+ },
+ {
+ "name": "q",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Substring match on the landmark name or its group."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "Landmarks, by facet then group",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "array",
+ "items": {
+ "$ref": "#/components/schemas/AtlasLandmark"
+ }
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
+ "/api/v1/public/atlas/meta": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "What atlas is loaded: facets, counts, when it was imported",
+ "description": "Drives the facet filter and the \"parsed from the shard\\'s own files on \" line. Reports the game world only — the ServUO path, the per-file hashes and any pending refresh are operator detail and live on the admin status route.",
+ "responses": {
+ "200": {
+ "description": "Atlas metadata",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/AtlasMeta"
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
+ "/api/v1/public/atlas/regions": {
+ "get": {
+ "tags": [
+ "Public · Atlas"
+ ],
+ "summary": "Named regions and their rectangles",
+ "description": "Flattened out of the shard\\'s nested Regions.xml. `priority` and the rectangles are what placed each spawn point, kept so the placement can be re-derived rather than taken on trust.",
+ "parameters": [
+ {
+ "name": "facet",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Limit to one facet."
+ },
+ {
+ "name": "q",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Substring match on the region name."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "Regions, by facet then name",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "array",
+ "items": {
+ "$ref": "#/components/schemas/AtlasRegion"
+ }
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ },
+ "503": {
+ "description": "Service Unavailable"
+ }
+ }
+ }
+ },
"/api/v1/public/contact": {
"post": {
"tags": [
@@ -10849,6 +11678,12 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -10890,6 +11725,36 @@
"400": {
"description": "Bad Request"
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/features": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "Shard features visible to the caller (drives client nav)",
+ "description": "The caller\\'s audience rung plus the shard features they may reach, so a client can hide nav entries instead of rendering links that 403. Reports only what the caller can see — the list itself does not disclose gated features.",
+ "responses": {
+ "200": {
+ "description": "Visible features",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardFeatures"
+ }
+ }
+ }
+ },
"500": {
"description": "Internal Server Error"
}
@@ -10902,7 +11767,7 @@
"Public · Shard"
],
"summary": "Recent notable shard events (from the ingested log)",
- "description": "",
+ "description": "The stored-history twin of /shard/stream, and it reaches the same verdict: which kinds are returned is resolved against the caller\\'s audience rung under the live visibility config, and each event\\'s payload is field-projected against its own kind\\'s feature. Kinds the caller may not read are omitted (an explicit ?kind= for one of them returns []), and acct/webId never appear below admin.",
"parameters": [
{
"name": "kind",
@@ -10911,7 +11776,7 @@
"schema": {
"type": "string"
},
- "description": "Filter to a single event kind, e.g. vendor.sale."
+ "description": "Filter to a single event kind, e.g. vendor.sale. Returns [] if the caller may not read that kind."
},
{
"name": "limit",
@@ -10940,6 +11805,12 @@
"400": {
"description": "Bad Request"
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -10968,6 +11839,12 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11019,6 +11896,12 @@
"400": {
"description": "Bad Request"
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11047,6 +11930,12 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11074,6 +11963,12 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11086,7 +11981,7 @@
"Public · Shard"
],
"summary": "Houses currently in danger (IDOC)",
- "description": "",
+ "description": "Location-level board of the houses about to collapse. Owner identity and price are gated by the `houses` feature\\'s field rules (default `staff`), and the owner\\'s game account is admin-only always — so an anonymous caller sees name, region and coordinates only.",
"responses": {
"200": {
"description": "IDOC houses",
@@ -11101,6 +11996,232 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/market": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "Search the player-vendor marketplace",
+ "description": "Every priced listing on every player vendor the shard publishes — the same index the in-game Vendor Search gump reads, and it honours the same per-vendor opt-out, so a player who hid their shop in game is hidden here too. Results are LISTINGS, each carrying enough of its shop to be actionable. Served from the site\\'s own tables (the sidecar is not touched), so it renders while the shard is down; `staleAt` is the oldest vendor row and the page must say how far behind the index can be — the shard sweeps vendors round-robin, so prices are inherently up to one full cycle old. Item names are resolved server-side against the cliloc table (docs/website/CLILOCS.md); on a shard that has not configured one, `displayName` is null and clients render the item id.",
+ "parameters": [
+ {
+ "name": "itemId",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "map",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "region",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "sort",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "limit",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "offset",
+ "in": "query",
+ "schema": {
+ "type": "string"
+ }
+ },
+ {
+ "name": "q",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Substring match on the resolved item name or the item's own literal name (max 60 chars)."
+ },
+ {
+ "name": "minPrice",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Lowest price to include."
+ },
+ {
+ "name": "maxPrice",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Highest price to include."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "A page of listings plus the unpaginated total and the staleness stamp",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardMarketPage"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Bad Request"
+ },
+ "403": {
+ "description": "The market feature is gated above this caller",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "404": {
+ "description": "The market feature is disabled",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "429": {
+ "description": "Rate limited",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/Error"
+ }
+ }
+ }
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/market/meta": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "Marketplace size, staleness and filter options",
+ "description": "How many vendors and listings the index holds, how stale it may be (`staleAt` = the oldest vendor row, `freshAt` = the newest), and which facets and regions actually hold vendors — so a client can build its filters without running a search it will discard.",
+ "responses": {
+ "200": {
+ "description": "Marketplace metadata",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardMarketMeta"
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/market/vendors/{serial}": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "One player vendor and everything it is selling",
+ "description": "A single shop by its vendor serial, with its listings. `truncated` (and `total` exceeding `count`) means the shop holds more than the shard publishes per frame — a commodity reseller with thousands of stacks is a real thing, and the page says so rather than presenting a partial shop as complete. Returns 404 for a serial the index has never seen, which also covers a vendor since dismissed or hidden.",
+ "parameters": [
+ {
+ "name": "serial",
+ "in": "path",
+ "required": true,
+ "schema": {
+ "type": "string"
+ },
+ "description": "Vendor serial, e.g. 0x40001234"
+ },
+ {
+ "name": "limit",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Listings to return, 1..500 (default 250)."
+ },
+ {
+ "name": "offset",
+ "in": "query",
+ "required": false,
+ "schema": {
+ "type": "integer"
+ },
+ "description": "Listings to skip (default 0)."
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "The vendor",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardMarketVendor"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Malformed vendor serial"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "No such vendor in the index"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11128,6 +12249,89 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/points": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "Points / loyalty leaderboards, one board per point system",
+ "description": "Every points/loyalty leaderboard the shard publishes (Queen\\'s Loyalty, Void Pool, the nine city loyalties, Clean Up Britannia, …), each with its display name, max points, participant count and top N. Served from our own store, so it renders while the shard is down; live via points.board on /shard/stream. A board\\'s display name may arrive as a literal (`nameString`) or a cliloc id (`nameNumber`) — resolve clilocs client-side.",
+ "responses": {
+ "200": {
+ "description": "Boards, ordered by display name",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "array",
+ "items": {
+ "$ref": "#/components/schemas/ShardPointsBoard"
+ }
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/points/{system}": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "One points system\\'s leaderboard",
+ "description": "A single board by the shard\\'s own PointsType name (e.g. `QueensLoyalty`, `CleanUpBritannia`). Returns 404 when the shard has never published that system — distinct from a published board that nobody has scored in yet, which returns 200 with an empty `top`.",
+ "parameters": [
+ {
+ "name": "system",
+ "in": "path",
+ "required": true,
+ "schema": {
+ "type": "string"
+ },
+ "description": "PointsType name, e.g. QueensLoyalty"
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "The board",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/ShardPointsBoard"
+ }
+ }
+ }
+ },
+ "400": {
+ "description": "Malformed system name"
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "The shard has never published that system"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11153,6 +12357,44 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
+ "500": {
+ "description": "Internal Server Error"
+ }
+ }
+ }
+ },
+ "/api/v1/public/shard/ruleset": {
+ "get": {
+ "tags": [
+ "Public · Shard"
+ ],
+ "summary": "The shard\\'s published ruleset (expansion, systems, caps, limits)",
+ "description": "How this shard is actually configured, published by the shard itself as one world.ruleset frame: expansion, which optional systems are on, skill/stat caps, account and house limits, champion scroll rules and the save/restart schedule. Served from our own store, so it renders while the shard is down; live via world.ruleset on /shard/stream. Returns `null` if the shard has never published one (an older plugin, or Bridge.RulesetEnabled=false) — distinct from a published ruleset, and the page renders it differently.",
+ "responses": {
+ "200": {
+ "description": "The ruleset, or null if never published",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "object",
+ "nullable": true,
+ "additionalProperties": true
+ }
+ }
+ }
+ },
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11177,6 +12419,12 @@
}
}
},
+ "403": {
+ "description": "Forbidden"
+ },
+ "404": {
+ "description": "Not Found"
+ },
"500": {
"description": "Internal Server Error"
}
@@ -11188,8 +12436,8 @@
"tags": [
"Public · Shard"
],
- "summary": "Live shard event stream (Server-Sent Events, public/safe kinds)",
- "description": "text/event-stream of curated live events. Sensitive kinds (staff audit, cheat detection, login attempts, IPs) are NOT sent on this channel.",
+ "summary": "Live shard event stream (Server-Sent Events, filtered by audience)",
+ "description": "text/event-stream of live events. The caller\\'s audience rung is resolved once at subscribe time and frozen for the connection; each frame is then gated on its feature and field-projected, so sensitive kinds and fields (staff audit, cheat detection, login attempts, IPs, acct/webId) never reach a caller below their configured rung.",
"responses": {
"200": {
"description": "An SSE stream (Content-Type: text/event-stream)."
@@ -17416,6 +18664,3517 @@
}
}
},
+ "ShardPointsBoard": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "One point system's leaderboard (Protocol 3.0 points.board). The shard carries ~25 separate point currencies; each publishes its own board. The display name may arrive as a literal string, a cliloc id, or both — resolve clilocs client-side."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "system": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "QueensLoyalty"
+ },
+ "description": {
+ "type": "string",
+ "example": "The shard's PointsType name; the board's stable key."
+ }
+ }
+ },
+ "nameString": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Queen's Loyalty"
+ }
+ }
+ },
+ "nameNumber": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 1114938
+ },
+ "description": {
+ "type": "string",
+ "example": "Cliloc id, 0 when the name is a literal."
+ }
+ }
+ },
+ "maxPoints": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 30000
+ }
+ }
+ },
+ "players": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 842
+ },
+ "description": {
+ "type": "string",
+ "example": "Players actually holding points in this system."
+ }
+ }
+ },
+ "showOnGump": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "The shard's own 'is this player-facing?' flag."
+ }
+ }
+ },
+ "top": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "description": {
+ "type": "string",
+ "example": "The ranked players, best first. Capped by the shard (10 by default). Empty when nobody has scored yet."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "rank": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 1
+ }
+ }
+ },
+ "serial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "0x1A2B"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow"
+ },
+ "description": {
+ "type": "string",
+ "example": "Omitted when the leaderboards `name` field is gated above the caller."
+ }
+ }
+ },
+ "points": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 29500
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "t": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Frame time, epoch ms."
+ }
+ }
+ },
+ "updatedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardMarketLocation": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Where a vendor is standing. ONE nested object rather than flat map/x/y/region because it is one admin-configurable field (`market.location`) — the whole object is omitted when that field is gated above the caller."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "map": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Trammel"
+ }
+ }
+ },
+ "x": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 1421
+ }
+ }
+ },
+ "y": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 1699
+ }
+ }
+ },
+ "z": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 0
+ }
+ }
+ },
+ "region": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Britain"
+ }
+ }
+ },
+ "house": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow's Villa"
+ },
+ "description": {
+ "type": "string",
+ "example": "The house SIGN's name, not the house type. Null for a vendor standing outside one."
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardMarketListing": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "One priced listing on a player vendor, carrying enough of its shop to be actionable without a second request."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "serial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "0x40012ABC"
+ }
+ }
+ },
+ "itemId": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 3922
+ },
+ "description": {
+ "type": "string",
+ "example": "ItemID (the art/graphic id)."
+ }
+ }
+ },
+ "hue": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 0
+ }
+ }
+ },
+ "amount": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 1
+ }
+ }
+ },
+ "price": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 25000
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "The item's own literal name, set by a player. Null for most items."
+ }
+ }
+ },
+ "cliloc": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 1023721
+ },
+ "description": {
+ "type": "string",
+ "example": "The item's LabelNumber."
+ }
+ }
+ },
+ "displayName": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "quarter staff"
+ },
+ "description": {
+ "type": "string",
+ "example": "Resolved server-side from `name` (preferred, being player-set and more specific) else `cliloc`. Null on a shard with no cliloc table configured — render the item id."
+ }
+ }
+ },
+ "child": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": false
+ },
+ "description": {
+ "type": "string",
+ "example": "Priced by an enclosing container rather than itself, exactly as the in-game Vendor Search reports it."
+ }
+ }
+ },
+ "vendor": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "serial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "0x40001234"
+ }
+ }
+ },
+ "shopName": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow's Bargains"
+ }
+ }
+ },
+ "ownerSerial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "0x1A2B"
+ },
+ "description": {
+ "type": "string",
+ "example": "Omitted when the market `ownerSerial` field is gated above the caller."
+ }
+ }
+ },
+ "ownerName": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow"
+ },
+ "description": {
+ "type": "string",
+ "example": "Omitted when the market `ownerName` field is gated above the caller."
+ }
+ }
+ },
+ "location": {
+ "$ref": "#/components/schemas/ShardMarketLocation"
+ },
+ "updatedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "description": {
+ "type": "string",
+ "example": "When the shard last published this shop."
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardMarketPage": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "A page of marketplace listings plus the unpaginated total and the staleness stamp."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "listings": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "$ref": "#/components/schemas/ShardMarketListing"
+ }
+ }
+ },
+ "total": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 1284
+ },
+ "description": {
+ "type": "string",
+ "example": "Matching listings, ignoring paging."
+ }
+ }
+ },
+ "limit": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 50
+ }
+ }
+ },
+ "offset": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 0
+ }
+ }
+ },
+ "vendors": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 137
+ },
+ "description": {
+ "type": "string",
+ "example": "Vendors in the whole index."
+ }
+ }
+ },
+ "staleAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "The OLDEST vendor row. The shard sweeps vendors round-robin, so the index can be a full cycle behind and a client must say so rather than implying live prices."
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardMarketVendor": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "One player vendor and its listings."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "serial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "0x40001234"
+ }
+ }
+ },
+ "shopName": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow's Bargains"
+ }
+ }
+ },
+ "ownerSerial": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "ownerName": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Darrow"
+ }
+ }
+ },
+ "location": {
+ "$ref": "#/components/schemas/ShardMarketLocation"
+ },
+ "count": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 250
+ },
+ "description": {
+ "type": "string",
+ "example": "Listings the shard published for this shop."
+ }
+ }
+ },
+ "total": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 3104
+ },
+ "description": {
+ "type": "string",
+ "example": "Listings the shop actually holds."
+ }
+ }
+ },
+ "truncated": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "`total` exceeds `count` — the shop holds more than the shard publishes per frame."
+ }
+ }
+ },
+ "updatedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ }
+ }
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "$ref": "#/components/schemas/ShardMarketListing"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardMarketMeta": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Marketplace size, staleness and the filter options a client needs to build its UI."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "vendors": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 137
+ }
+ }
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 18422
+ }
+ }
+ },
+ "staleAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "freshAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "maps": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "Felucca",
+ "Trammel"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "Facets that actually hold vendors. From the shard's own data — never a hardcoded list."
+ }
+ }
+ },
+ "regions": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "Britain",
+ "Luna"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardFeatures": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "The shard features the caller may reach, plus the audience rung they resolved to. Drives client nav so it never renders a link that would 403."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "level": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "anonymous",
+ "logged_in",
+ "player",
+ "staff",
+ "admin"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "example": {
+ "type": "string",
+ "example": "anonymous"
+ }
+ }
+ },
+ "features": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "status",
+ "activity",
+ "champs",
+ "guilds",
+ "governors",
+ "houses",
+ "presence"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardFeatureVisibility": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Visibility settings for one shard feature."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "audience": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "anonymous",
+ "logged_in",
+ "player",
+ "staff",
+ "admin"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "Minimum rung that may reach this feature. Each rung implies the ones below it."
+ },
+ "example": {
+ "type": "string",
+ "example": "anonymous"
+ }
+ }
+ },
+ "stream": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "description": {
+ "type": "string",
+ "example": "Whether this feature's event kinds fan out over SSE at all."
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "fieldRules": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "Per-field rung overrides for the sensitive fields this feature exposes. acct / webId are admin-only always and are rejected here."
+ },
+ "example": {
+ "type": "object",
+ "properties": {
+ "location": {
+ "type": "string",
+ "example": "staff"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardVisibilityConfig": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "ladder": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "anonymous",
+ "logged_in",
+ "player",
+ "staff",
+ "admin"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "lockedFields": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "acct",
+ "webId"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "defaults": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "$ref": "#/components/schemas/ShardFeatureVisibility"
+ }
+ }
+ },
+ "features": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "$ref": "#/components/schemas/ShardFeatureVisibility"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ShardVisibilityUpdate": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "required": {
+ "type": "array",
+ "example": [
+ "features"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "features": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "$ref": "#/components/schemas/ShardFeatureVisibility"
+ },
+ "example": {
+ "type": "object",
+ "properties": {
+ "market": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean",
+ "example": true
+ },
+ "audience": {
+ "type": "string",
+ "example": "player"
+ },
+ "stream": {
+ "type": "boolean",
+ "example": false
+ },
+ "fieldRules": {
+ "type": "object",
+ "properties": {
+ "ownerName": {
+ "type": "string",
+ "example": "player"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasCreature": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "A creature in the bestiary. `places`/`points`/`alsoHere` are present only on the single-creature route."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "slug": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "lizardman"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Lizardman"
+ }
+ }
+ },
+ "total": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "How many can be alive at once, summed across every spawner."
+ },
+ "example": {
+ "type": "number",
+ "example": 214
+ }
+ }
+ },
+ "points": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "How many spawners mention this creature."
+ },
+ "example": {
+ "type": "number",
+ "example": 62
+ }
+ }
+ },
+ "facets": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "This creature's share per facet."
+ },
+ "example": {
+ "type": "object",
+ "properties": {
+ "Felucca": {
+ "type": "number",
+ "example": 96
+ },
+ "Trammel": {
+ "type": "number",
+ "example": 88
+ },
+ "Tokuno": {
+ "type": "number",
+ "example": 30
+ }
+ }
+ }
+ }
+ },
+ "art": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Operator-supplied art under uploads/atlas/. NULL on a fresh import — the repo ships no creature art."
+ }
+ }
+ },
+ "places": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "description": {
+ "type": "string",
+ "example": "Where it spawns, aggregated by resolved place. The answer the atlas exists to give."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "facet": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Trammel"
+ }
+ }
+ },
+ "label": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "description": {
+ "type": "string",
+ "example": "Resolved region, else nearest landmark group, else \"Wilderness\"."
+ },
+ "example": {
+ "type": "string",
+ "example": "Shrines"
+ }
+ }
+ },
+ "spawners": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 7
+ }
+ }
+ },
+ "maxAlive": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 21
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "spawners": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "description": {
+ "type": "string",
+ "example": "The individual spawners. Named separately from `points` (the count) so one key never means two things."
+ },
+ "items": {
+ "$ref": "#/components/schemas/AtlasSpawner"
+ }
+ }
+ },
+ "spawnersTruncated": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "description": {
+ "type": "string",
+ "example": "True when the spawner list was cut at the requested bound."
+ },
+ "example": {
+ "type": "boolean",
+ "example": false
+ }
+ }
+ },
+ "alsoHere": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "description": {
+ "type": "string",
+ "example": "Creatures sharing a spawner with this one."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "slug": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "lizardman-warrior"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Lizardman Warrior"
+ }
+ }
+ },
+ "shared": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 12
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasSpawner": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "One ServUO spawner, with the place its coordinates resolved to."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "id": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "facet": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Felucca"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "The spawner's own name in the ServUO file."
+ }
+ }
+ },
+ "x": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 5411
+ }
+ }
+ },
+ "y": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 1234
+ }
+ }
+ },
+ "width": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "height": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "range": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Spawn radius."
+ }
+ }
+ },
+ "maxCount": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "How many of THIS creature this spawner keeps alive."
+ },
+ "example": {
+ "type": "number",
+ "example": 3
+ }
+ }
+ },
+ "minDelay": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Respawn window, in SECONDS. Normalised at parse time — the source stores minutes or seconds per record, decided by its own DelayInSec flag."
+ },
+ "example": {
+ "type": "number",
+ "example": 300
+ }
+ }
+ },
+ "maxDelay": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 600
+ }
+ }
+ },
+ "todStart": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Meaningless unless todMode is non-zero."
+ }
+ }
+ },
+ "todEnd": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "todMode": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "region": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Despise"
+ }
+ }
+ },
+ "landmark": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Covetous"
+ }
+ }
+ },
+ "label": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "description": {
+ "type": "string",
+ "example": "Region, else landmark group, else \"Wilderness\"."
+ },
+ "example": {
+ "type": "string",
+ "example": "Despise"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasCreaturePage": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "total": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Matching creatures before pagination."
+ },
+ "example": {
+ "type": "number",
+ "example": 800
+ }
+ }
+ },
+ "limit": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 50
+ }
+ }
+ },
+ "offset": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 0
+ }
+ }
+ },
+ "creatures": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "$ref": "#/components/schemas/AtlasCreature"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasRegion": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "A named region, flattened out of the shard's nested Regions.xml."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "facet": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Felucca"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Despise"
+ }
+ }
+ },
+ "type": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "ServUO region class."
+ },
+ "example": {
+ "type": "string",
+ "example": "DungeonRegion"
+ }
+ }
+ },
+ "priority": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 50
+ }
+ }
+ },
+ "parent": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Britain"
+ }
+ }
+ },
+ "rects": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "description": {
+ "type": "string",
+ "example": "The rectangles that placed each spawn point."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "additionalProperties": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasLandmark": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "facet": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Trammel"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Level 1"
+ }
+ }
+ },
+ "group": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Innermost enclosing parent — the label worth showing."
+ },
+ "example": {
+ "type": "string",
+ "example": "Covetous"
+ }
+ }
+ },
+ "x": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 5411
+ }
+ }
+ },
+ "y": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 1234
+ }
+ }
+ },
+ "z": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 0
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasChampion": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "A CONFIGURED champion altar. Not the live board — see GET /public/shard/champs for that."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "slug": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "felucca-deceit"
+ }
+ }
+ },
+ "name": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Deceit"
+ }
+ }
+ },
+ "group": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Spawn group; one altar active per group."
+ },
+ "example": {
+ "type": "string",
+ "example": "Dungeons"
+ }
+ }
+ },
+ "type": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "NULL when the champion is drawn at activation."
+ },
+ "example": {
+ "type": "string",
+ "example": "UnholyTerror"
+ }
+ }
+ },
+ "randomType": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": false
+ }
+ }
+ },
+ "facet": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "Felucca"
+ }
+ }
+ },
+ "x": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "y": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "z": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "radius": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 60
+ }
+ }
+ },
+ "label": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "string",
+ "example": "Deceit"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasMeta": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "What atlas is loaded. Game-world facts only: the ServUO path, source hashes and any pending refresh are operator detail and live on the admin status route."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "importedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "generatedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "counts": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "additionalProperties": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "object",
+ "properties": {
+ "facets": {
+ "type": "number",
+ "example": 6
+ },
+ "points": {
+ "type": "number",
+ "example": 6455
+ },
+ "creatures": {
+ "type": "number",
+ "example": 800
+ },
+ "regions": {
+ "type": "number",
+ "example": 387
+ },
+ "landmarks": {
+ "type": "number",
+ "example": 558
+ },
+ "champions": {
+ "type": "number",
+ "example": 25
+ },
+ "unresolvedPoints": {
+ "type": "number",
+ "example": 1086
+ }
+ }
+ }
+ }
+ },
+ "facets": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "Felucca",
+ "Ilshenar",
+ "Malas",
+ "TerMur",
+ "Tokuno",
+ "Trammel"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasStatus": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Admin view of atlas state: where the tree is, whether it is readable, whether it has drifted from what is loaded, and any refresh staged for review."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "configured": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "path": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "/srv/servuo"
+ }
+ }
+ },
+ "treeReadable": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "drift": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "True when the tree's source hashes differ from the loaded atlas. NULL when the tree could not be read."
+ },
+ "example": {
+ "type": "boolean",
+ "example": false
+ }
+ }
+ },
+ "facets": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ }
+ }
+ },
+ "importedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "counts": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "additionalProperties": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "pending": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "A refresh that was parsed but NOT applied because it would remove a facet. `status` is pending or rejected."
+ },
+ "additionalProperties": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "AtlasRefreshResult": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Outcome of a refresh. Reported rather than thrown, so an unreadable tree is an answer and not a 500."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "status": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "skipped",
+ "unavailable",
+ "unchanged",
+ "imported",
+ "needsReview",
+ "failed",
+ "rejected",
+ "none"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "example": {
+ "type": "string",
+ "example": "imported"
+ }
+ }
+ },
+ "reason": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "path": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "counts": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "additionalProperties": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "addedFacets": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ }
+ }
+ },
+ "removedFacets": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ClilocStatus": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Admin view of cliloc state: where the converted file is, whether it is readable, how many entries are loaded, and whether the file has drifted from them. `configured: false` is a supported state — item names then render as ids."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "configured": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "path": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "/srv/uo-client"
+ }
+ }
+ },
+ "file": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "The file actually resolved, when the path is a directory."
+ },
+ "example": {
+ "type": "string",
+ "example": "/srv/uo-client/clilocs.tsv"
+ }
+ }
+ },
+ "fileReadable": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "example": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "problem": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Why the file cannot be used, when it cannot. Set (with code COMPRESSED) for a readable-but-unconverted client file."
+ },
+ "example": {}
+ }
+ },
+ "code": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Machine-readable cause of `problem`."
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "NO_PATH",
+ "NOT_FOUND",
+ "NO_FILE",
+ "UNREADABLE",
+ "COMPRESSED"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "drift": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "boolean"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "True when any source hash differs from the loaded table. NULL when the sources could not be read or are not usable."
+ },
+ "example": {
+ "type": "boolean",
+ "example": false
+ }
+ }
+ },
+ "count": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Entries currently loaded."
+ },
+ "example": {
+ "type": "number",
+ "example": 67496
+ }
+ }
+ },
+ "sources": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "Every source found now, root-relative, base first then overlays in merge order."
+ },
+ "example": {
+ "type": "array",
+ "example": [
+ "clilocs.plain",
+ "custom/uomysticmoon.tsv"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "loadedSources": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "What each source contributed at the last import."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "label": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "example": {
+ "type": "string",
+ "example": "custom/uomysticmoon.tsv"
+ }
+ }
+ },
+ "kind": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "base",
+ "custom"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "example": {
+ "type": "string",
+ "example": "custom"
+ }
+ }
+ },
+ "entries": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "example": {
+ "type": "number",
+ "example": 37
+ }
+ }
+ },
+ "added": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Ids this source introduced."
+ },
+ "example": {
+ "type": "number",
+ "example": 25
+ }
+ }
+ },
+ "overrode": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "description": {
+ "type": "string",
+ "example": "Ids it replaced from an earlier source."
+ },
+ "example": {
+ "type": "number",
+ "example": 12
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "missingSources": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "Sources loaded previously and now absent. An import refuses these without `approve`."
+ },
+ "example": {
+ "type": "array",
+ "example": [],
+ "items": {}
+ }
+ }
+ },
+ "importedAt": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "format": {
+ "type": "string",
+ "example": "date-time"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "sourceBytes": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 4973525
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "ClilocRefreshResult": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "description": {
+ "type": "string",
+ "example": "Outcome of a cliloc refresh. Reported rather than thrown, so a missing or compressed file is an answer and not a 500."
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "status": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "skipped",
+ "unavailable",
+ "unchanged",
+ "imported",
+ "needsReview",
+ "failed"
+ ],
+ "items": {
+ "type": "string"
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "`needsReview` means a previously-loaded source has vanished and nothing was applied; re-run with `approve` to accept it."
+ },
+ "example": {
+ "type": "string",
+ "example": "imported"
+ }
+ }
+ },
+ "reason": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "code": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Machine-readable cause. `COMPRESSED` means the client's own Cliloc.enu was supplied instead of a converted one."
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "NO_PATH",
+ "NOT_FOUND",
+ "NO_FILE",
+ "UNREADABLE",
+ "COMPRESSED",
+ "TRUNCATED",
+ "EMPTY",
+ "NOT_BUFFER"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "path": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "file": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ }
+ }
+ },
+ "count": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Entries stored (blank strings are dropped)."
+ },
+ "example": {
+ "type": "number",
+ "example": 67496
+ }
+ }
+ },
+ "parsed": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Entries read across every source before blanks were dropped."
+ },
+ "example": {
+ "type": "number",
+ "example": 123527
+ }
+ }
+ },
+ "blank": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "example": {
+ "type": "number",
+ "example": 55994
+ }
+ }
+ },
+ "sources": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "description": {
+ "type": "string",
+ "example": "Per-source breakdown: what each file contributed and how much of it overrode an earlier source."
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "object"
+ },
+ "properties": {
+ "type": "object",
+ "properties": {
+ "label": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "kind": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ },
+ "enum": {
+ "type": "array",
+ "example": [
+ "base",
+ "custom"
+ ],
+ "items": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "entries": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "added": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ },
+ "overrode": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "integer"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "missingSources": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "On `needsReview`: the sources that vanished. Nothing was applied."
+ }
+ }
+ },
+ "acceptedMissing": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "array"
+ },
+ "nullable": {
+ "type": "boolean",
+ "example": true
+ },
+ "items": {
+ "type": "object",
+ "properties": {
+ "type": {
+ "type": "string",
+ "example": "string"
+ }
+ }
+ },
+ "description": {
+ "type": "string",
+ "example": "On `imported` with `approve`: the vanished sources the admin accepted."
+ }
+ }
+ }
+ }
+ }
+ }
+ },
"ShardLinkRequest": {
"type": "object",
"properties": {
diff --git a/server/swagger/swagger.js b/server/swagger/swagger.js
index ff01550..d1d6ba7 100644
--- a/server/swagger/swagger.js
+++ b/server/swagger/swagger.js
@@ -54,6 +54,7 @@ const doc = {
{ name: 'Auth · SSO', description: 'OAuth2 / OIDC provider discovery and redirect flow' },
{ name: 'Public', description: 'Unauthenticated site content (settings, posts, wiki, contact)' },
{ name: 'Public · Shard', description: 'Live shard data ingested from the uo-link sidecar (status, feed, economy, IDOC, characters)' },
+ { name: 'Public · Atlas', description: 'Spawn atlas / bestiary — static shard content parsed from the shard\'s own ServUO tree, independent of the sidecar' },
{ name: 'Admin · Account', description: 'Self-service account security (2FA, linked identities)' },
{ name: 'Player', description: 'Self-service player accounts (register, credentials, 2FA, linked identities)' },
{ name: 'Player · Shard', description: 'Link an in-game account and read its roster / vendors (uo-link)' },
@@ -881,6 +882,472 @@ const doc = {
updatedAt: { type: 'string', format: 'date-time' },
},
},
+ ShardPointsBoard: {
+ type: 'object',
+ description:
+ "One point system's leaderboard (Protocol 3.0 points.board). The shard carries ~25 separate point currencies; each publishes its own board. The display name may arrive as a literal string, a cliloc id, or both — resolve clilocs client-side.",
+ properties: {
+ system: { type: 'string', example: 'QueensLoyalty', description: "The shard's PointsType name; the board's stable key." },
+ nameString: { type: 'string', nullable: true, example: "Queen's Loyalty" },
+ nameNumber: { type: 'integer', nullable: true, example: 1114938, description: 'Cliloc id, 0 when the name is a literal.' },
+ maxPoints: { type: 'integer', nullable: true, example: 30000 },
+ players: { type: 'integer', nullable: true, example: 842, description: 'Players actually holding points in this system.' },
+ showOnGump: { type: 'boolean', example: true, description: "The shard's own 'is this player-facing?' flag." },
+ top: {
+ type: 'array',
+ description: 'The ranked players, best first. Capped by the shard (10 by default). Empty when nobody has scored yet.',
+ items: {
+ type: 'object',
+ properties: {
+ rank: { type: 'integer', example: 1 },
+ serial: { type: 'string', example: '0x1A2B' },
+ name: { type: 'string', example: 'Darrow', description: 'Omitted when the leaderboards `name` field is gated above the caller.' },
+ points: { type: 'integer', example: 29500 },
+ },
+ },
+ },
+ t: { type: 'integer', nullable: true, description: 'Frame time, epoch ms.' },
+ updatedAt: { type: 'string', format: 'date-time' },
+ },
+ },
+ ShardMarketLocation: {
+ type: 'object',
+ nullable: true,
+ description:
+ "Where a vendor is standing. ONE nested object rather than flat map/x/y/region because it is one admin-configurable field (`market.location`) — the whole object is omitted when that field is gated above the caller.",
+ properties: {
+ map: { type: 'string', nullable: true, example: 'Trammel' },
+ x: { type: 'integer', nullable: true, example: 1421 },
+ y: { type: 'integer', nullable: true, example: 1699 },
+ z: { type: 'integer', nullable: true, example: 0 },
+ region: { type: 'string', nullable: true, example: 'Britain' },
+ house: { type: 'string', nullable: true, example: "Darrow's Villa", description: "The house SIGN's name, not the house type. Null for a vendor standing outside one." },
+ },
+ },
+ ShardMarketListing: {
+ type: 'object',
+ description:
+ 'One priced listing on a player vendor, carrying enough of its shop to be actionable without a second request.',
+ properties: {
+ serial: { type: 'string', example: '0x40012ABC' },
+ itemId: { type: 'integer', example: 3922, description: 'ItemID (the art/graphic id).' },
+ hue: { type: 'integer', example: 0 },
+ amount: { type: 'integer', example: 1 },
+ price: { type: 'integer', example: 25000 },
+ name: { type: 'string', nullable: true, description: "The item's own literal name, set by a player. Null for most items." },
+ cliloc: { type: 'integer', nullable: true, example: 1023721, description: "The item's LabelNumber." },
+ displayName: {
+ type: 'string',
+ nullable: true,
+ example: 'quarter staff',
+ description: 'Resolved server-side from `name` (preferred, being player-set and more specific) else `cliloc`. Null on a shard with no cliloc table configured — render the item id.',
+ },
+ child: { type: 'boolean', example: false, description: 'Priced by an enclosing container rather than itself, exactly as the in-game Vendor Search reports it.' },
+ vendor: {
+ type: 'object',
+ properties: {
+ serial: { type: 'string', example: '0x40001234' },
+ shopName: { type: 'string', nullable: true, example: "Darrow's Bargains" },
+ ownerSerial: { type: 'string', nullable: true, example: '0x1A2B', description: 'Omitted when the market `ownerSerial` field is gated above the caller.' },
+ ownerName: { type: 'string', nullable: true, example: 'Darrow', description: 'Omitted when the market `ownerName` field is gated above the caller.' },
+ location: { $ref: '#/components/schemas/ShardMarketLocation' },
+ updatedAt: { type: 'string', format: 'date-time', description: 'When the shard last published this shop.' },
+ },
+ },
+ },
+ },
+ ShardMarketPage: {
+ type: 'object',
+ description: 'A page of marketplace listings plus the unpaginated total and the staleness stamp.',
+ properties: {
+ listings: { type: 'array', items: { $ref: '#/components/schemas/ShardMarketListing' } },
+ total: { type: 'integer', example: 1284, description: 'Matching listings, ignoring paging.' },
+ limit: { type: 'integer', example: 50 },
+ offset: { type: 'integer', example: 0 },
+ vendors: { type: 'integer', example: 137, description: 'Vendors in the whole index.' },
+ staleAt: {
+ type: 'string',
+ format: 'date-time',
+ nullable: true,
+ description: 'The OLDEST vendor row. The shard sweeps vendors round-robin, so the index can be a full cycle behind and a client must say so rather than implying live prices.',
+ },
+ },
+ },
+ ShardMarketVendor: {
+ type: 'object',
+ description: 'One player vendor and its listings.',
+ properties: {
+ serial: { type: 'string', example: '0x40001234' },
+ shopName: { type: 'string', nullable: true, example: "Darrow's Bargains" },
+ ownerSerial: { type: 'string', nullable: true },
+ ownerName: { type: 'string', nullable: true, example: 'Darrow' },
+ location: { $ref: '#/components/schemas/ShardMarketLocation' },
+ count: { type: 'integer', example: 250, description: 'Listings the shard published for this shop.' },
+ total: { type: 'integer', example: 3104, description: 'Listings the shop actually holds.' },
+ truncated: { type: 'boolean', example: true, description: '`total` exceeds `count` — the shop holds more than the shard publishes per frame.' },
+ updatedAt: { type: 'string', format: 'date-time' },
+ items: { type: 'array', items: { $ref: '#/components/schemas/ShardMarketListing' } },
+ },
+ },
+ ShardMarketMeta: {
+ type: 'object',
+ description: 'Marketplace size, staleness and the filter options a client needs to build its UI.',
+ properties: {
+ vendors: { type: 'integer', example: 137 },
+ items: { type: 'integer', example: 18422 },
+ staleAt: { type: 'string', format: 'date-time', nullable: true },
+ freshAt: { type: 'string', format: 'date-time', nullable: true },
+ maps: { type: 'array', items: { type: 'string' }, example: ['Felucca', 'Trammel'], description: "Facets that actually hold vendors. From the shard's own data — never a hardcoded list." },
+ regions: { type: 'array', items: { type: 'string' }, example: ['Britain', 'Luna'] },
+ },
+ },
+ ShardFeatures: {
+ type: 'object',
+ description:
+ "The shard features the caller may reach, plus the audience rung they resolved to. Drives client nav so it never renders a link that would 403.",
+ properties: {
+ level: {
+ type: 'string',
+ enum: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+ example: 'anonymous',
+ },
+ features: {
+ type: 'array',
+ items: { type: 'string' },
+ example: ['status', 'activity', 'champs', 'guilds', 'governors', 'houses', 'presence'],
+ },
+ },
+ },
+ ShardFeatureVisibility: {
+ type: 'object',
+ description: 'Visibility settings for one shard feature.',
+ properties: {
+ enabled: { type: 'boolean', example: true },
+ audience: {
+ type: 'string',
+ enum: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+ description: 'Minimum rung that may reach this feature. Each rung implies the ones below it.',
+ example: 'anonymous',
+ },
+ stream: {
+ type: 'boolean',
+ description: "Whether this feature's event kinds fan out over SSE at all.",
+ example: true,
+ },
+ fieldRules: {
+ type: 'object',
+ additionalProperties: { type: 'string' },
+ description:
+ 'Per-field rung overrides for the sensitive fields this feature exposes. acct / webId are admin-only always and are rejected here.',
+ example: { location: 'staff' },
+ },
+ },
+ },
+ ShardVisibilityConfig: {
+ type: 'object',
+ properties: {
+ ladder: {
+ type: 'array',
+ items: { type: 'string' },
+ example: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+ },
+ lockedFields: { type: 'array', items: { type: 'string' }, example: ['acct', 'webId'] },
+ defaults: {
+ type: 'object',
+ additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+ },
+ features: {
+ type: 'object',
+ additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+ },
+ },
+ },
+ ShardVisibilityUpdate: {
+ type: 'object',
+ required: ['features'],
+ properties: {
+ features: {
+ type: 'object',
+ additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+ example: { market: { enabled: true, audience: 'player', stream: false, fieldRules: { ownerName: 'player' } } },
+ },
+ },
+ },
+ // ── Spawn atlas (Protocol 3.0 Part C) ────────────────────────────────
+ // Static shard content, parsed from the shard's own ServUO tree. Nothing
+ // here comes from the sidecar, so it stays populated while the shard is
+ // down. Facet names are whatever the shard's files declare — the examples
+ // below are stock ServUO, not a fixed list.
+ AtlasCreature: {
+ type: 'object',
+ description: 'A creature in the bestiary. `places`/`points`/`alsoHere` are present only on the single-creature route.',
+ properties: {
+ slug: { type: 'string', example: 'lizardman' },
+ name: { type: 'string', example: 'Lizardman' },
+ total: { type: 'integer', description: 'How many can be alive at once, summed across every spawner.', example: 214 },
+ points: { type: 'integer', description: 'How many spawners mention this creature.', example: 62 },
+ facets: {
+ type: 'object',
+ additionalProperties: { type: 'integer' },
+ description: "This creature's share per facet.",
+ example: { Felucca: 96, Trammel: 88, Tokuno: 30 },
+ },
+ art: { type: 'string', nullable: true, description: 'Operator-supplied art under uploads/atlas/. NULL on a fresh import — the repo ships no creature art.' },
+ places: {
+ type: 'array',
+ description: 'Where it spawns, aggregated by resolved place. The answer the atlas exists to give.',
+ items: {
+ type: 'object',
+ properties: {
+ facet: { type: 'string', example: 'Trammel' },
+ label: { type: 'string', description: 'Resolved region, else nearest landmark group, else "Wilderness".', example: 'Shrines' },
+ spawners: { type: 'integer', example: 7 },
+ maxAlive: { type: 'integer', example: 21 },
+ },
+ },
+ },
+ spawners: {
+ type: 'array',
+ description: 'The individual spawners. Named separately from `points` (the count) so one key never means two things.',
+ items: { $ref: '#/components/schemas/AtlasSpawner' },
+ },
+ spawnersTruncated: { type: 'boolean', description: 'True when the spawner list was cut at the requested bound.', example: false },
+ alsoHere: {
+ type: 'array',
+ description: 'Creatures sharing a spawner with this one.',
+ items: {
+ type: 'object',
+ properties: {
+ slug: { type: 'string', example: 'lizardman-warrior' },
+ name: { type: 'string', example: 'Lizardman Warrior' },
+ shared: { type: 'integer', example: 12 },
+ },
+ },
+ },
+ },
+ },
+ AtlasSpawner: {
+ type: 'object',
+ description: 'One ServUO spawner, with the place its coordinates resolved to.',
+ properties: {
+ id: { type: 'integer' },
+ facet: { type: 'string', example: 'Felucca' },
+ name: { type: 'string', nullable: true, description: "The spawner's own name in the ServUO file." },
+ x: { type: 'integer', example: 5411 },
+ y: { type: 'integer', example: 1234 },
+ width: { type: 'integer' },
+ height: { type: 'integer' },
+ range: { type: 'integer', description: 'Spawn radius.' },
+ maxCount: { type: 'integer', description: 'How many of THIS creature this spawner keeps alive.', example: 3 },
+ minDelay: { type: 'integer', description: 'Respawn window, in SECONDS. Normalised at parse time — the source stores minutes or seconds per record, decided by its own DelayInSec flag.', example: 300 },
+ maxDelay: { type: 'integer', example: 600 },
+ todStart: { type: 'integer', description: 'Meaningless unless todMode is non-zero.' },
+ todEnd: { type: 'integer' },
+ todMode: { type: 'integer' },
+ region: { type: 'string', nullable: true, example: 'Despise' },
+ landmark: { type: 'string', nullable: true, example: 'Covetous' },
+ label: { type: 'string', description: 'Region, else landmark group, else "Wilderness".', example: 'Despise' },
+ },
+ },
+ AtlasCreaturePage: {
+ type: 'object',
+ properties: {
+ total: { type: 'integer', description: 'Matching creatures before pagination.', example: 800 },
+ limit: { type: 'integer', example: 50 },
+ offset: { type: 'integer', example: 0 },
+ creatures: { type: 'array', items: { $ref: '#/components/schemas/AtlasCreature' } },
+ },
+ },
+ AtlasRegion: {
+ type: 'object',
+ description: 'A named region, flattened out of the shard\'s nested Regions.xml.',
+ properties: {
+ facet: { type: 'string', example: 'Felucca' },
+ name: { type: 'string', example: 'Despise' },
+ type: { type: 'string', nullable: true, description: 'ServUO region class.', example: 'DungeonRegion' },
+ priority: { type: 'integer', example: 50 },
+ parent: { type: 'string', nullable: true, example: 'Britain' },
+ rects: {
+ type: 'array',
+ description: 'The rectangles that placed each spawn point.',
+ items: { type: 'object', additionalProperties: true },
+ },
+ },
+ },
+ AtlasLandmark: {
+ type: 'object',
+ properties: {
+ facet: { type: 'string', example: 'Trammel' },
+ name: { type: 'string', example: 'Level 1' },
+ group: { type: 'string', nullable: true, description: 'Innermost enclosing parent — the label worth showing.', example: 'Covetous' },
+ x: { type: 'integer', example: 5411 },
+ y: { type: 'integer', example: 1234 },
+ z: { type: 'integer', example: 0 },
+ },
+ },
+ AtlasChampion: {
+ type: 'object',
+ description: 'A CONFIGURED champion altar. Not the live board — see GET /public/shard/champs for that.',
+ properties: {
+ slug: { type: 'string', example: 'felucca-deceit' },
+ name: { type: 'string', example: 'Deceit' },
+ group: { type: 'string', nullable: true, description: 'Spawn group; one altar active per group.', example: 'Dungeons' },
+ type: { type: 'string', nullable: true, description: 'NULL when the champion is drawn at activation.', example: 'UnholyTerror' },
+ randomType: { type: 'boolean', example: false },
+ facet: { type: 'string', example: 'Felucca' },
+ x: { type: 'integer' },
+ y: { type: 'integer' },
+ z: { type: 'integer' },
+ radius: { type: 'integer', example: 60 },
+ label: { type: 'string', nullable: true, example: 'Deceit' },
+ },
+ },
+ AtlasMeta: {
+ type: 'object',
+ description: 'What atlas is loaded. Game-world facts only: the ServUO path, source hashes and any pending refresh are operator detail and live on the admin status route.',
+ properties: {
+ importedAt: { type: 'string', format: 'date-time', nullable: true },
+ generatedAt: { type: 'string', format: 'date-time', nullable: true },
+ counts: {
+ type: 'object',
+ nullable: true,
+ additionalProperties: true,
+ example: { facets: 6, points: 6455, creatures: 800, regions: 387, landmarks: 558, champions: 25, unresolvedPoints: 1086 },
+ },
+ facets: { type: 'array', items: { type: 'string' }, example: ['Felucca', 'Ilshenar', 'Malas', 'TerMur', 'Tokuno', 'Trammel'] },
+ },
+ },
+ AtlasStatus: {
+ type: 'object',
+ description: 'Admin view of atlas state: where the tree is, whether it is readable, whether it has drifted from what is loaded, and any refresh staged for review.',
+ properties: {
+ configured: { type: 'boolean', example: true },
+ path: { type: 'string', example: '/srv/servuo' },
+ treeReadable: { type: 'boolean', example: true },
+ drift: { type: 'boolean', nullable: true, description: 'True when the tree\'s source hashes differ from the loaded atlas. NULL when the tree could not be read.', example: false },
+ facets: { type: 'array', items: { type: 'string' } },
+ importedAt: { type: 'string', format: 'date-time', nullable: true },
+ counts: { type: 'object', nullable: true, additionalProperties: true },
+ pending: {
+ type: 'object',
+ nullable: true,
+ description: 'A refresh that was parsed but NOT applied because it would remove a facet. `status` is pending or rejected.',
+ additionalProperties: true,
+ },
+ },
+ },
+ AtlasRefreshResult: {
+ type: 'object',
+ description: 'Outcome of a refresh. Reported rather than thrown, so an unreadable tree is an answer and not a 500.',
+ properties: {
+ status: {
+ type: 'string',
+ enum: ['skipped', 'unavailable', 'unchanged', 'imported', 'needsReview', 'failed', 'rejected', 'none'],
+ example: 'imported',
+ },
+ reason: { type: 'string', nullable: true },
+ path: { type: 'string', nullable: true },
+ counts: { type: 'object', nullable: true, additionalProperties: true },
+ addedFacets: { type: 'array', items: { type: 'string' } },
+ removedFacets: { type: 'array', items: { type: 'string' } },
+ },
+ },
+ ClilocStatus: {
+ type: 'object',
+ description:
+ 'Admin view of cliloc state: where the converted file is, whether it is readable, how many entries are loaded, and whether the file has drifted from them. `configured: false` is a supported state — item names then render as ids.',
+ properties: {
+ configured: { type: 'boolean', example: true },
+ path: { type: 'string', example: '/srv/uo-client' },
+ file: { type: 'string', nullable: true, description: 'The file actually resolved, when the path is a directory.', example: '/srv/uo-client/clilocs.tsv' },
+ fileReadable: { type: 'boolean', example: true },
+ problem: { type: 'string', nullable: true, description: 'Why the file cannot be used, when it cannot. Set (with code COMPRESSED) for a readable-but-unconverted client file.', example: null },
+ code: { type: 'string', nullable: true, description: 'Machine-readable cause of `problem`.', enum: ['NO_PATH', 'NOT_FOUND', 'NO_FILE', 'UNREADABLE', 'COMPRESSED'] },
+ drift: { type: 'boolean', nullable: true, description: 'True when any source hash differs from the loaded table. NULL when the sources could not be read or are not usable.', example: false },
+ count: { type: 'integer', description: 'Entries currently loaded.', example: 67496 },
+ sources: {
+ type: 'array',
+ items: { type: 'string' },
+ description: 'Every source found now, root-relative, base first then overlays in merge order.',
+ example: ['clilocs.plain', 'custom/uomysticmoon.tsv'],
+ },
+ loadedSources: {
+ type: 'array',
+ nullable: true,
+ description: 'What each source contributed at the last import.',
+ items: {
+ type: 'object',
+ properties: {
+ label: { type: 'string', example: 'custom/uomysticmoon.tsv' },
+ kind: { type: 'string', enum: ['base', 'custom'], example: 'custom' },
+ entries: { type: 'integer', example: 37 },
+ added: { type: 'integer', description: 'Ids this source introduced.', example: 25 },
+ overrode: { type: 'integer', description: 'Ids it replaced from an earlier source.', example: 12 },
+ },
+ },
+ },
+ missingSources: {
+ type: 'array',
+ items: { type: 'string' },
+ description: 'Sources loaded previously and now absent. An import refuses these without `approve`.',
+ example: [],
+ },
+ importedAt: { type: 'string', format: 'date-time', nullable: true },
+ sourceBytes: { type: 'integer', nullable: true, example: 4973525 },
+ },
+ },
+ ClilocRefreshResult: {
+ type: 'object',
+ description:
+ 'Outcome of a cliloc refresh. Reported rather than thrown, so a missing or compressed file is an answer and not a 500.',
+ properties: {
+ status: {
+ type: 'string',
+ enum: ['skipped', 'unavailable', 'unchanged', 'imported', 'needsReview', 'failed'],
+ description: '`needsReview` means a previously-loaded source has vanished and nothing was applied; re-run with `approve` to accept it.',
+ example: 'imported',
+ },
+ reason: { type: 'string', nullable: true },
+ code: {
+ type: 'string',
+ nullable: true,
+ description: 'Machine-readable cause. `COMPRESSED` means the client\'s own Cliloc.enu was supplied instead of a converted one.',
+ enum: ['NO_PATH', 'NOT_FOUND', 'NO_FILE', 'UNREADABLE', 'COMPRESSED', 'TRUNCATED', 'EMPTY', 'NOT_BUFFER'],
+ },
+ path: { type: 'string', nullable: true },
+ file: { type: 'string', nullable: true },
+ count: { type: 'integer', nullable: true, description: 'Entries stored (blank strings are dropped).', example: 67496 },
+ parsed: { type: 'integer', nullable: true, description: 'Entries read across every source before blanks were dropped.', example: 123527 },
+ blank: { type: 'integer', nullable: true, example: 55994 },
+ sources: {
+ type: 'array',
+ nullable: true,
+ description: 'Per-source breakdown: what each file contributed and how much of it overrode an earlier source.',
+ items: {
+ type: 'object',
+ properties: {
+ label: { type: 'string' },
+ kind: { type: 'string', enum: ['base', 'custom'] },
+ entries: { type: 'integer' },
+ added: { type: 'integer' },
+ overrode: { type: 'integer' },
+ },
+ },
+ },
+ missingSources: {
+ type: 'array',
+ nullable: true,
+ items: { type: 'string' },
+ description: 'On `needsReview`: the sources that vanished. Nothing was applied.',
+ },
+ acceptedMissing: {
+ type: 'array',
+ nullable: true,
+ items: { type: 'string' },
+ description: 'On `imported` with `approve`: the vanished sources the admin accepted.',
+ },
+ },
+ },
ShardLinkRequest: {
type: 'object',
required: ['code'],
diff --git a/server/test/atlasController.test.js b/server/test/atlasController.test.js
new file mode 100644
index 0000000..653dfbb
--- /dev/null
+++ b/server/test/atlasController.test.js
@@ -0,0 +1,238 @@
+// Point the DB at a closed port BEFORE requiring the controllers (their models
+// build the pool). Every model call is monkeypatched, so no query runs;
+// db.close() at the end releases the pool so the process exits cleanly.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, after, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+// The spawn atlas API, public and admin. What is worth asserting here is not the
+// SQL (that is the parser suite's job) but the contracts the two surfaces make:
+//
+// • the public reads project through the visibility framework — v3.md §3.6.1's
+// standing rule is that a read path returning shard data and not calling
+// projectFeature is a bug, and `atlas` declaring no sensitive fields TODAY is
+// exactly why the call has to be there before one does;
+// • the public /meta route reports the game world only, never the operator's
+// filesystem — the ServUO path, the per-file hashes and any pending refresh
+// stay on the admin route;
+// • a missing creature is a 404, not an empty 200;
+// • an unreadable ServUO tree is a 200 carrying `status: 'unavailable'`, NOT a
+// 500. The refresh contract reports outcomes rather than throwing (so boot is
+// never blocked by a bad tree), and the admin needs to be told what is wrong
+// with their path;
+// • a model failure degrades to a 500 rather than a thrown/uncaught error.
+const pub = require('../src/router/v1/public/atlas.controller')
+const admin = require('../src/router/v1/admin/shardAtlas.controller')
+const atlas = require('../src/model/shardAtlas/shardAtlas.model')
+const activity = require('../src/model/activity/activity.model')
+const visibility = require('../src/utils/shardVisibility')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+// Stub the visibility MODEL rather than the util's exports: project() calls the
+// module-internal getConfig, which an exports-level stub would not intercept — it
+// would hit the closed DB port and cost a ~10s pool timeout per test before
+// falling back to these same defaults.
+const visibilityModel = require('../src/model/shardVisibility/shardVisibility.model')
+visibilityModel.listAll = async () => [] // no overrides ⇒ compiled defaults
+visibility.viewerLevel = async (req) => req?.viewerLevel || 'anonymous'
+
+// The admin controller logs every action; keep it off the DB.
+activity.log = async () => {}
+
+function mockRes() {
+ return {
+ statusCode: 200,
+ body: null,
+ status(c) {
+ this.statusCode = c
+ return this
+ },
+ json(b) {
+ this.body = b
+ return this
+ },
+ }
+}
+
+const originals = {
+ searchCreatures: atlas.searchCreatures,
+ getCreature: atlas.getCreature,
+ listRegions: atlas.listRegions,
+ listLandmarks: atlas.listLandmarks,
+ listChampions: atlas.listChampions,
+ publicMeta: atlas.publicMeta,
+ status: atlas.status,
+ refresh: atlas.refresh,
+ approvePending: atlas.approvePending,
+ rejectPending: atlas.rejectPending,
+ setServuoPath: atlas.setServuoPath,
+}
+afterEach(() => Object.assign(atlas, originals))
+
+// ── Public reads ────────────────────────────────────────────────────────
+test('getCreatures passes the search through and returns the page shape', async () => {
+ let seen = null
+ atlas.searchCreatures = async (opts) => {
+ seen = opts
+ return { total: 1, limit: 50, offset: 0, creatures: [{ slug: 'lizardman', name: 'Lizardman' }] }
+ }
+ const res = mockRes()
+ await pub.getCreatures({ query: { q: ' lizard ', facet: 'Felucca', limit: '10', offset: '20' } }, res)
+ assert.deepEqual(seen, { q: 'lizard', facet: 'Felucca', limit: 10, offset: 20 })
+ assert.equal(res.body.total, 1)
+ assert.equal(res.body.creatures[0].slug, 'lizardman')
+})
+
+test('getCreatures falls back to the documented defaults when nothing is passed', async () => {
+ let seen = null
+ atlas.searchCreatures = async (opts) => {
+ seen = opts
+ return { total: 0, limit: 50, offset: 0, creatures: [] }
+ }
+ await pub.getCreatures({ query: {} }, mockRes())
+ assert.deepEqual(seen, { q: '', facet: '', limit: 50, offset: 0 })
+})
+
+test('an unknown creature is a 404, not an empty 200', async () => {
+ atlas.getCreature = async () => null
+ const res = mockRes()
+ await pub.getCreature({ params: { slug: 'nosuchthing' }, query: {} }, res)
+ assert.equal(res.statusCode, 404)
+})
+
+test('getCreature returns places and spawners, and `points` stays the COUNT', async () => {
+ atlas.getCreature = async () => ({
+ slug: 'lizardman',
+ name: 'Lizardman',
+ total: 214,
+ points: 62,
+ places: [{ facet: 'Trammel', label: 'Shrines', spawners: 7, maxAlive: 21 }],
+ spawners: [{ id: 1, facet: 'Trammel', label: 'Shrines', x: 1, y: 2 }],
+ spawnersTruncated: false,
+ alsoHere: [],
+ })
+ const res = mockRes()
+ await pub.getCreature({ params: { slug: 'lizardman' }, query: {} }, res)
+ // The list route uses `points` as a number; the detail route must not quietly
+ // turn the same key into an array.
+ assert.equal(typeof res.body.points, 'number')
+ assert.ok(Array.isArray(res.body.spawners))
+ assert.equal(res.body.places[0].label, 'Shrines')
+})
+
+// ── The projection rule (§3.6.1) ────────────────────────────────────────
+test('public reads run through projectFeature, so a locked field can never survive', async () => {
+ // `atlas` declares no sensitive fields, so nothing here is stripped by a
+ // FEATURE rule. acct/webId are stripped anyway — they are locked by meaning,
+ // for every feature, and this is what proves the read path projects at all.
+ atlas.searchCreatures = async () => ({
+ total: 1,
+ limit: 50,
+ offset: 0,
+ creatures: [{ slug: 'lizardman', name: 'Lizardman', acct: 'someacct', ownerWebId: 7 }],
+ })
+ const res = mockRes()
+ await pub.getCreatures({ query: {}, viewerLevel: 'anonymous' }, res)
+ const row = res.body.creatures[0]
+ assert.equal(row.name, 'Lizardman')
+ assert.ok(!('acct' in row), 'acct must never reach an anonymous caller')
+ assert.ok(!('ownerWebId' in row), 'a flattened webId spelling is locked too')
+})
+
+test('getMeta reports the game world only — never the operator’s filesystem', async () => {
+ // The model is what enforces this; the assertion documents the boundary so a
+ // future "just return status() here" shortcut fails loudly.
+ atlas.publicMeta = async () => ({
+ importedAt: '2026-07-28T00:00:00.000Z',
+ generatedAt: '2026-07-28T00:00:00.000Z',
+ counts: { points: 6455, creatures: 800 },
+ facets: ['Felucca', 'Trammel'],
+ })
+ const res = mockRes()
+ await pub.getMeta({ query: {} }, res)
+ assert.deepEqual(Object.keys(res.body).sort(), ['counts', 'facets', 'generatedAt', 'importedAt'])
+ assert.ok(!('path' in res.body))
+ assert.ok(!('pending' in res.body))
+})
+
+test('a model failure degrades to a 500 rather than throwing', async () => {
+ atlas.listChampions = async () => {
+ throw new Error('table is gone')
+ }
+ const res = mockRes()
+ await pub.getChampions({ query: {} }, res)
+ assert.equal(res.statusCode, 500)
+})
+
+// ── Admin ───────────────────────────────────────────────────────────────
+test('an unreadable tree answers 200 with the reason, not a 500', async () => {
+ atlas.refresh = async () => ({ status: 'unavailable', reason: 'no Spawns directory', path: '/bad' })
+ const res = mockRes()
+ await admin.importAtlas({ body: {}, user: { id: 1 } }, res)
+ assert.equal(res.statusCode, 200)
+ assert.equal(res.body.status, 'unavailable')
+ assert.equal(res.body.reason, 'no Spawns directory')
+})
+
+test('import passes `force` through and coerces it to a boolean', async () => {
+ let seen = null
+ atlas.refresh = async (opts) => {
+ seen = opts
+ return { status: 'unchanged' }
+ }
+ await admin.importAtlas({ body: { force: true }, user: { id: 1 } }, mockRes())
+ assert.deepEqual(seen, { force: true })
+})
+
+test('approve applies a staged refresh (facet loss included)', async () => {
+ let called = false
+ atlas.approvePending = async () => {
+ called = true
+ return { status: 'imported', removedFacets: ['Malas'], counts: { points: 6162 } }
+ }
+ const res = mockRes()
+ await admin.approve({ user: { id: 1 } }, res)
+ assert.ok(called)
+ assert.equal(res.body.status, 'imported')
+})
+
+test('rejecting when nothing is staged is a 404', async () => {
+ atlas.rejectPending = async () => ({ status: 'none' })
+ const res = mockRes()
+ await admin.reject({ user: { id: 1 } }, res)
+ assert.equal(res.statusCode, 404)
+})
+
+test('setPath trims, persists, and answers with fresh status — it does not import', async () => {
+ let saved = null
+ let imported = false
+ atlas.setServuoPath = async (value) => {
+ saved = value
+ }
+ atlas.refresh = async () => {
+ imported = true
+ return { status: 'imported' }
+ }
+ atlas.status = async () => ({ configured: true, path: '/srv/servuo', treeReadable: true })
+ const res = mockRes()
+ await admin.setPath({ body: { path: ' /srv/servuo ' }, user: { id: 3 } }, res)
+ assert.equal(saved, '/srv/servuo')
+ assert.equal(imported, false, 'changing the path must not reload the atlas as a side effect')
+ assert.equal(res.body.path, '/srv/servuo')
+})
+
+test('setPath accepts a blank path (clearing it turns the atlas off)', async () => {
+ let saved = 'unset'
+ atlas.setServuoPath = async (value) => {
+ saved = value
+ }
+ atlas.status = async () => ({ configured: false, path: '' })
+ const res = mockRes()
+ await admin.setPath({ body: {}, user: { id: 3 } }, res)
+ assert.equal(saved, '')
+ assert.equal(res.statusCode, 200)
+})
diff --git a/server/test/clilocParse.test.js b/server/test/clilocParse.test.js
new file mode 100644
index 0000000..701af45
--- /dev/null
+++ b/server/test/clilocParse.test.js
@@ -0,0 +1,227 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const {
+ ClilocFormatError,
+ parseCliloc,
+ parseClilocBinary,
+ parseClilocText,
+ isCompressedCliloc,
+ displayText,
+ isPlaceholderOnly,
+} = require('../src/utils/clilocParse')
+
+// These parsers are pure and fs-free precisely so this suite can run in CI,
+// where there is no UO client and no converted cliloc file. Every fixture below
+// is built from the real layout, and the strings are verbatim entries from a
+// real Cliloc.enu (123,490 entries) rather than invented ones.
+
+// ── Fixture builders ───────────────────────────────────────────────────────
+
+/** Build a plain-format cliloc buffer: 6-byte header, then records. */
+function buildBinary(entries, { header1 = 2, header2 = 1 } = {}) {
+ const parts = [Buffer.alloc(6)]
+ parts[0].writeInt32LE(header1, 0)
+ parts[0].writeUInt16LE(header2, 4)
+ for (const e of entries) {
+ const text = Buffer.from(e.text, 'utf8')
+ const head = Buffer.alloc(7)
+ head.writeInt32LE(e.number, 0)
+ head.writeUInt8(e.flag ?? 0, 4)
+ head.writeUInt16LE(text.length, 5)
+ parts.push(head, text)
+ }
+ return Buffer.concat(parts)
+}
+
+// ── Binary ─────────────────────────────────────────────────────────────────
+
+test('parseClilocBinary: reads a plain-format table', () => {
+ const buf = buildBinary([
+ { number: 1015012, text: 'Greater Heal' },
+ { number: 1023721, text: 'quarter staff' },
+ { number: 1025913, flag: 1, text: 'bonnet' },
+ ])
+ assert.deepEqual(parseClilocBinary(buf), [
+ { number: 1015012, flag: 0, text: 'Greater Heal' },
+ { number: 1023721, flag: 0, text: 'quarter staff' },
+ { number: 1025913, flag: 1, text: 'bonnet' },
+ ])
+})
+
+test('parseClilocBinary: length is UNSIGNED 16-bit', () => {
+ // ServUO's own SDK reads this field into a signed short, which turns any
+ // string over 32 KB into a negative length. Real tables top out around 12 KB
+ // so nothing is broken today, but the field is written unsigned and reading it
+ // that way costs nothing.
+ const text = 'x'.repeat(40000)
+ const [entry] = parseClilocBinary(buildBinary([{ number: 1000000, text }]))
+ assert.equal(entry.text.length, 40000)
+})
+
+test('parseClilocBinary: multi-byte UTF-8 survives (length is in BYTES)', () => {
+ const [entry] = parseClilocBinary(buildBinary([{ number: 1000000, text: 'Ilshenar — Ver Lor Reg' }]))
+ assert.equal(entry.text, 'Ilshenar — Ver Lor Reg')
+})
+
+test('parseClilocBinary: a truncated record body throws rather than importing short', () => {
+ // The realistic corruption is a half-copied file. It must fail loudly: a
+ // silently short table renders as "some items named, some not", which is
+ // indistinguishable from having no table at all.
+ const buf = buildBinary([{ number: 1023721, text: 'quarter staff' }])
+ const truncated = buf.subarray(0, buf.length - 4)
+ assert.throws(() => parseClilocBinary(truncated), (err) => {
+ assert.ok(err instanceof ClilocFormatError)
+ assert.equal(err.code, 'TRUNCATED')
+ return true
+ })
+})
+
+test('parseClilocBinary: a truncated record HEADER throws too', () => {
+ const buf = Buffer.concat([buildBinary([{ number: 1023721, text: 'quarter staff' }]), Buffer.alloc(3)])
+ assert.throws(() => parseClilocBinary(buf), (err) => err.code === 'TRUNCATED')
+})
+
+test('parseClilocBinary: an empty table (header only) is valid', () => {
+ assert.deepEqual(parseClilocBinary(buildBinary([])), [])
+})
+
+// ── Compressed detection ───────────────────────────────────────────────────
+
+test('isCompressedCliloc: recognises the Mythic marker', () => {
+ // Every cliloc the client ships opens with a DWORD whose high byte is 0x8E.
+ // Real first bytes of Cliloc.enu (e8 79 67 8e) and Cliloc.deu (99 5d 26 8e).
+ assert.equal(isCompressedCliloc(Buffer.from([0xe8, 0x79, 0x67, 0x8e])), true)
+ assert.equal(isCompressedCliloc(Buffer.from([0x99, 0x5d, 0x26, 0x8e])), true)
+ assert.equal(isCompressedCliloc(buildBinary([])), false)
+})
+
+test('parseCliloc: a compressed file is rejected by NAME, not parsed into nonsense', () => {
+ // This is the whole reason the marker check exists. Without it the plain
+ // parser reads compressed bytes as ~19k records of negative ids and 60 KB
+ // "strings" before dying somewhere in the middle — and the resulting error
+ // names truncation, which is the wrong problem to hand an operator.
+ const compressed = Buffer.concat([Buffer.from([0xe8, 0x79, 0x67, 0x8e]), Buffer.alloc(64, 0x41)])
+ assert.throws(() => parseCliloc(compressed), (err) => {
+ assert.equal(err.code, 'COMPRESSED')
+ assert.match(err.message, /CLILOCS\.md/)
+ return true
+ })
+})
+
+// ── Text ───────────────────────────────────────────────────────────────────
+
+test('parseClilocText: tab-delimited, skipping a header row', () => {
+ const entries = parseClilocText('number\ttext\n1023721\tquarter staff\n1015012\tGreater Heal\n')
+ assert.deepEqual(entries, [
+ { number: 1023721, flag: 0, text: 'quarter staff' },
+ { number: 1015012, flag: 0, text: 'Greater Heal' },
+ ])
+})
+
+test('parseClilocText: splits on the FIRST separator only', () => {
+ // Cliloc text is full of commas. Splitting on all of them would truncate every
+ // such entry at its first one.
+ const [entry] = parseClilocText('1044000,a scroll of magery, unfinished\n')
+ assert.equal(entry.text, 'a scroll of magery, unfinished')
+})
+
+test('parseClilocText: unwraps quoted CSV fields and doubled quotes', () => {
+ const [entry] = parseClilocText('1023721,"a ""quarter"" staff, plain"\n')
+ assert.equal(entry.text, 'a "quarter" staff, plain')
+})
+
+test('parseClilocText: reads an optional flag column', () => {
+ const [entry] = parseClilocText('1025913\t1\tbonnet\n')
+ assert.deepEqual(entry, { number: 1025913, flag: 1, text: 'bonnet' })
+})
+
+test('parseClilocText: text that is itself a number stays the text', () => {
+ // `number,text` where text is "100" is indistinguishable from `number,flag`
+ // with an empty text. Keeping it as the text is the safer miss — the other way
+ // silently deletes a real entry.
+ const [entry] = parseClilocText('1000000,100\n')
+ assert.equal(entry.text, '100')
+})
+
+test('parseClilocText: blank lines and # comments are ignored', () => {
+ const entries = parseClilocText('# exported by hand\n\n1023721\tquarter staff\n\n')
+ assert.equal(entries.length, 1)
+})
+
+test('parseClilocText: a file with no entries is an error, not an empty table', () => {
+ assert.throws(() => parseClilocText('nothing here\nnor here\n'), (err) => err.code === 'EMPTY')
+})
+
+test('parseClilocText: an empty leading field is skipped, not imported as id 0', () => {
+ // `Number('')` is 0, not NaN, so a line that merely starts with a separator
+ // would otherwise become a bogus cliloc 0.
+ assert.throws(() => parseClilocText('\tstray text\n,another\n'), (err) => err.code === 'EMPTY')
+})
+
+test('parseClilocText: keeps entries whose text is EMPTY', () => {
+ // About half of a real table is empty strings (unused ids). They must survive
+ // parsing — the import layer decides whether to store them, and both input
+ // formats have to agree on what the file contained.
+ const entries = parseClilocText('1005008\t\n1023721\tquarter staff\n')
+ assert.equal(entries.length, 2)
+ assert.deepEqual(entries[0], { number: 1005008, flag: 0, text: '' })
+})
+
+// ── Sniffing ───────────────────────────────────────────────────────────────
+
+test('parseCliloc: sniffs binary vs text from the header, not the extension', () => {
+ assert.equal(parseCliloc(buildBinary([{ number: 1023721, text: 'quarter staff' }]))[0].text, 'quarter staff')
+ assert.equal(parseCliloc(Buffer.from('1023721\tquarter staff\n'))[0].text, 'quarter staff')
+})
+
+test('parseCliloc: a binary-looking header that is not 2/1 falls through to text', () => {
+ // The recoverable guess: a mis-sniffed text file says "no entries found",
+ // while a mis-sniffed binary yields plausible nonsense.
+ assert.throws(() => parseCliloc(Buffer.from([9, 0, 0, 0, 9, 0, 65, 66])), (err) => err.code === 'EMPTY')
+})
+
+// ── Display ────────────────────────────────────────────────────────────────
+
+test('displayText: drops interpolated arguments we never receive', () => {
+ // The bridge sends a cliloc id, never the property packet that carries the
+ // arguments, so a name containing them has to be reduced to what is knowable.
+ assert.equal(displayText('cold damage ~1_val~%'), 'cold damage')
+ assert.equal(displayText('~1_NAME~ the ~2_TITLE~'), 'the')
+})
+
+test('displayText: a string that is nothing but arguments resolves to nothing', () => {
+ assert.equal(displayText('[~1_stuff~]'), '')
+ assert.equal(isPlaceholderOnly('[~1_stuff~]'), true)
+ assert.equal(isPlaceholderOnly('quarter staff'), false)
+})
+
+test('displayText: a trailing % is only stripped when a placeholder was removed', () => {
+ // "cold damage ~1_val~%" loses its % because that % was the unit belonging to
+ // the number we never had. A string that genuinely ends in one keeps it.
+ assert.equal(displayText('50%'), '50%')
+ assert.equal(displayText('cold damage ~1_val~%'), 'cold damage')
+})
+
+test('displayText: ordinary names pass through untouched', () => {
+ assert.equal(displayText('quarter staff'), 'quarter staff')
+ assert.equal(displayText('a scroll of magery, unfinished'), 'a scroll of magery, unfinished')
+ assert.equal(displayText(' spiked collar '), 'spiked collar')
+})
+
+test('displayText: punctuation is only tidied when a placeholder was removed', () => {
+ // A shard's custom "Runic Gateway Sigil (v2)" came back as "(v2" while the
+ // bracket trim was unconditional. A string with no placeholder has no debris
+ // to clean, so it is left alone apart from whitespace.
+ assert.equal(displayText('Runic Gateway Sigil (v2)'), 'Runic Gateway Sigil (v2)')
+ assert.equal(displayText('scroll of power - greater'), 'scroll of power - greater')
+ assert.equal(displayText('[Companion] Great Dane'), '[Companion] Great Dane')
+ // …but the debris a placeholder leaves behind is still cleaned.
+ assert.equal(displayText('[~1_stuff~]'), '')
+ assert.equal(displayText('cold damage ~1_val~%'), 'cold damage')
+})
+
+test('displayText: null and undefined are empty, not "null"', () => {
+ assert.equal(displayText(null), '')
+ assert.equal(displayText(undefined), '')
+})
diff --git a/server/test/clilocSource.test.js b/server/test/clilocSource.test.js
new file mode 100644
index 0000000..74b212e
--- /dev/null
+++ b/server/test/clilocSource.test.js
@@ -0,0 +1,194 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const {
+ ClilocSourceError,
+ CUSTOM_DIR,
+ resolveBase,
+ listCustom,
+ readSources,
+ hashSources,
+ sameSources,
+ missingSources,
+ readCliloc,
+} = require('../src/utils/clilocSource')
+
+// The fs layer, exercised against real temp directories rather than mocks —
+// the behaviours that matter here (which file wins, what a directory listing
+// yields, what happens when one vanishes) are precisely the ones a mock would
+// define away.
+
+function tmpdir() {
+ const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cliloc-'))
+ return dir
+}
+
+const tsv = (entries) => entries.map(([n, t]) => `${n}\t${t}`).join('\n') + '\n'
+
+function write(dir, name, contents) {
+ const file = path.join(dir, name)
+ fs.mkdirSync(path.dirname(file), { recursive: true })
+ fs.writeFileSync(file, contents)
+ return file
+}
+
+// ── Resolution ─────────────────────────────────────────────────────────────
+
+test('resolveBase: a directory picks the most specific candidate', () => {
+ const dir = tmpdir()
+ // A converted file sitting next to the client's own compressed one must win —
+ // otherwise pointing at a client folder finds the file that will be rejected.
+ write(dir, 'cliloc.enu', 'ignored')
+ write(dir, 'clilocs.tsv', tsv([[1023721, 'quarter staff']]))
+ assert.equal(path.basename(resolveBase(dir).base), 'clilocs.tsv')
+})
+
+test('resolveBase: a file path roots overlays at its DIRECTORY', () => {
+ // An operator who pointed at a file should not have to re-point at its folder
+ // just to add a custom/ directory beside it.
+ const dir = tmpdir()
+ const file = write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ assert.deepEqual(resolveBase(file), { root: dir, base: file })
+})
+
+test('resolveBase: a missing path and an empty path are different errors', () => {
+ assert.throws(() => resolveBase(''), (err) => err.code === 'NO_PATH')
+ assert.throws(() => resolveBase(path.join(tmpdir(), 'nope')), (err) => err.code === 'NOT_FOUND')
+})
+
+test('resolveBase: a directory with no cliloc file names what it looked for', () => {
+ assert.throws(() => resolveBase(tmpdir()), (err) => {
+ assert.ok(err instanceof ClilocSourceError)
+ assert.equal(err.code, 'NO_FILE')
+ assert.match(err.message, /clilocs\.tsv/)
+ return true
+ })
+})
+
+// ── Overlays ───────────────────────────────────────────────────────────────
+
+test('listCustom: no overlay directory is normal, not an error', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ assert.deepEqual(listCustom(dir), [])
+})
+
+test('listCustom: sorted, and only recognised extensions', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ write(dir, `${CUSTOM_DIR}/b.tsv`, tsv([[2, 'b']]))
+ write(dir, `${CUSTOM_DIR}/a.csv`, tsv([[3, 'c']]))
+ write(dir, `${CUSTOM_DIR}/notes.md`, 'ignore me')
+ assert.deepEqual(listCustom(dir).map((f) => path.basename(f)), ['a.csv', 'b.tsv'])
+})
+
+test('readSources: base first, then overlays, with root-relative labels', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[2, 'b']]))
+ const { files } = readSources(dir)
+ // Forward-slashed so the same directory read on Windows and Linux fingerprints
+ // identically — otherwise every boot on one of them looks like a change.
+ assert.deepEqual(files.map((f) => [f.label, f.kind]), [
+ ['clilocs.tsv', 'base'],
+ ['custom/shard.tsv', 'custom'],
+ ])
+})
+
+// ── Merging ────────────────────────────────────────────────────────────────
+
+test('readCliloc: an overlay ADDS ids the base never had', () => {
+ // The whole point: shards add items, and those carry cliloc ids no stock
+ // client table has.
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1023721, 'quarter staff']]))
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[1180001, 'Runic Gateway Sigil']]))
+ const byNumber = new Map(readCliloc(dir).entries.map((e) => [e.number, e.text]))
+ assert.equal(byNumber.get(1023721), 'quarter staff')
+ assert.equal(byNumber.get(1180001), 'Runic Gateway Sigil')
+})
+
+test('readCliloc: an overlay OVERRIDES a stock id', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1023721, 'quarter staff']]))
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[1023721, 'gnarled staff of testing']]))
+ const byNumber = new Map(readCliloc(dir).entries.map((e) => [e.number, e.text]))
+ assert.equal(byNumber.get(1023721), 'gnarled staff of testing')
+})
+
+test('readCliloc: later overlays beat earlier ones, deterministically', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[7, 'base']]))
+ write(dir, `${CUSTOM_DIR}/01-first.tsv`, tsv([[7, 'first']]))
+ write(dir, `${CUSTOM_DIR}/02-second.tsv`, tsv([[7, 'second']]))
+ const byNumber = new Map(readCliloc(dir).entries.map((e) => [e.number, e.text]))
+ assert.equal(byNumber.get(7), 'second')
+})
+
+test('readCliloc: reports what each source contributed', () => {
+ // An operator who adds an overlay wants to see it took effect; "overrode: 0"
+ // on a file meant to re-label stock items says it did not.
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a'], [2, 'b']]))
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[2, 'B!'], [3, 'c']]))
+ const { source } = readCliloc(dir)
+ assert.deepEqual(source.sources, [
+ { label: 'clilocs.tsv', kind: 'base', entries: 2, added: 2, overrode: 0 },
+ { label: 'custom/shard.tsv', kind: 'custom', entries: 2, added: 1, overrode: 1 },
+ ])
+})
+
+test('readCliloc: a malformed overlay names the file it came from', () => {
+ // "Which of my six overlay files is broken" is otherwise a guessing game.
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ write(dir, `${CUSTOM_DIR}/broken.tsv`, 'no separators here\nnor here\n')
+ assert.throws(() => readCliloc(dir), (err) => {
+ assert.equal(err.code, 'EMPTY')
+ assert.match(err.message, /^custom\/broken\.tsv: /)
+ return true
+ })
+})
+
+test('readCliloc: a compressed BASE is still rejected by name', () => {
+ const dir = tmpdir()
+ write(dir, 'cliloc.enu', Buffer.concat([Buffer.from([0xe8, 0x79, 0x67, 0x8e]), Buffer.alloc(32, 0x41)]))
+ assert.throws(() => readCliloc(dir), (err) => err.code === 'COMPRESSED')
+})
+
+// ── Drift over the SET ─────────────────────────────────────────────────────
+
+test('hashSources: fingerprints every source, and counts the overlays', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[2, 'b']]))
+ const fp = hashSources(dir)
+ assert.deepEqual(Object.keys(fp.hashes).sort(), ['clilocs.tsv', 'custom/shard.tsv'])
+ assert.equal(fp.customCount, 1)
+})
+
+test('sameSources: adding or editing an overlay counts as drift', () => {
+ const dir = tmpdir()
+ write(dir, 'clilocs.tsv', tsv([[1, 'a']]))
+ const before = hashSources(dir).hashes
+
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[2, 'b']]))
+ const added = hashSources(dir).hashes
+ assert.equal(sameSources(before, added), false, 'a new overlay is drift')
+
+ write(dir, `${CUSTOM_DIR}/shard.tsv`, tsv([[2, 'b changed']]))
+ const edited = hashSources(dir).hashes
+ assert.equal(sameSources(added, edited), false, 'an edited overlay is drift')
+ assert.equal(sameSources(edited, hashSources(dir).hashes), true, 'an untouched set is not')
+})
+
+test('missingSources: a vanished source is detected, an added one is not "missing"', () => {
+ const loaded = { 'clilocs.tsv': 'aaa', 'custom/shard.tsv': 'bbb' }
+ assert.deepEqual(missingSources({ 'clilocs.tsv': 'aaa' }, loaded), ['custom/shard.tsv'])
+ assert.deepEqual(missingSources({ ...loaded, 'custom/new.tsv': 'ccc' }, loaded), [])
+ // Nothing loaded yet (a first import) is not a vanished source.
+ assert.deepEqual(missingSources({ 'clilocs.tsv': 'aaa' }, null), [])
+})
diff --git a/server/test/shardBroadcast.visibility.test.js b/server/test/shardBroadcast.visibility.test.js
new file mode 100644
index 0000000..b12cb4c
--- /dev/null
+++ b/server/test/shardBroadcast.visibility.test.js
@@ -0,0 +1,225 @@
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, after, afterEach, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+
+// The SSE fan-out is the security boundary (docs/link/v3.md §3.6). Before v3 it
+// was a static kind allowlist; now each subscriber carries the audience rung it
+// resolved to at subscribe time, and every frame is gated + field-projected per
+// viewer. These tests pin the properties that must hold no matter how the config
+// is set:
+//
+// - the admin channel always gets the frame verbatim;
+// - a public subscriber never receives an unmapped kind;
+// - acct / webId never reach a public subscriber, at any rung below admin;
+// - two subscribers at different rungs get different frames from one event;
+// - a viewer's rung is frozen at subscribe time, not re-read per frame;
+// - if the visibility config can't be read, nothing goes out on public.
+
+const broadcast = require('../src/utils/shardBroadcast')
+const visibility = require('../src/utils/shardVisibility')
+const model = require('../src/model/shardVisibility/shardVisibility.model')
+const shardLinks = require('../src/model/shardLinks/shardLinks.model')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+const originals = {
+ listAll: model.listAll,
+ listForUser: shardLinks.listForUser,
+ getConfig: visibility.getConfig,
+ viewerLevel: visibility.viewerLevel,
+}
+
+beforeEach(() => {
+ model.listAll = async () => []
+ shardLinks.listForUser = async () => []
+ visibility.invalidate()
+})
+
+afterEach(() => {
+ broadcast.closeAll()
+ model.listAll = originals.listAll
+ shardLinks.listForUser = originals.listForUser
+ visibility.getConfig = originals.getConfig
+ visibility.viewerLevel = originals.viewerLevel
+ visibility.invalidate()
+})
+
+// A fake req/res pair that records everything written to the stream.
+function fakeClient() {
+ const req = new EventEmitter()
+ const writes = []
+ const res = {
+ writeHead() {},
+ write(chunk) {
+ writes.push(chunk)
+ },
+ end() {},
+ on() {},
+ }
+ // Frames only — drop the SSE comments/retry preamble and keepalive pings.
+ const frames = () =>
+ writes
+ .filter((w) => w.startsWith('data: '))
+ .map((w) => JSON.parse(w.slice('data: '.length).trim()))
+ return { req, res, frames }
+}
+
+async function subscribeAt(level, channel = 'public') {
+ const client = fakeClient()
+ visibility.viewerLevel = async () => level
+ await broadcast.subscribe(client.req, client.res, channel)
+ return client
+}
+
+const GUILD_FRAME = {
+ kind: 'guild.update',
+ id: 7,
+ name: 'The Nameless',
+ abbr: 'TN',
+ leader: { serial: '0x1A2B', name: 'Darrow', acct: 'whitlocktech', webId: '42', player: true },
+}
+
+test('the admin channel receives the frame verbatim, acct and webId included', async () => {
+ const admin = await subscribeAt('admin', 'admin')
+ await broadcast.broadcast(GUILD_FRAME)
+ const [frame] = admin.frames()
+ assert.deepEqual(frame, GUILD_FRAME)
+})
+
+test('a public subscriber never sees acct or webId, at any rung below admin', async () => {
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ const client = await subscribeAt(level)
+ await broadcast.broadcast(GUILD_FRAME)
+ const [frame] = client.frames()
+ assert.ok(frame, `${level} should receive the guild frame`)
+ assert.equal(frame.leader.name, 'Darrow')
+ assert.equal('acct' in frame.leader, false, `${level} must not see acct`)
+ assert.equal('webId' in frame.leader, false, `${level} must not see webId`)
+ broadcast.closeAll()
+ }
+})
+
+test('an unmapped kind reaches the admin channel and nobody else', async () => {
+ const anon = await subscribeAt('anonymous')
+ const staff = await subscribeAt('staff')
+ const admin = await subscribeAt('admin', 'admin')
+
+ for (const kind of ['audit.command', 'cheat.fastwalk', 'account.login.attempt', 'vendor.sale']) {
+ await broadcast.broadcast({ kind, secret: true })
+ }
+
+ assert.deepEqual(anon.frames(), [])
+ assert.deepEqual(staff.frames(), [])
+ assert.equal(admin.frames().length, 4)
+})
+
+test('one event yields different frames for subscribers at different rungs', async () => {
+ model.listAll = async () => [
+ {
+ feature: 'guilds',
+ enabled: true,
+ audience: 'anonymous',
+ stream: true,
+ fieldRules: { abbr: 'staff' },
+ },
+ ]
+ visibility.invalidate()
+
+ const anon = await subscribeAt('anonymous')
+ const staff = await subscribeAt('staff')
+ await broadcast.broadcast(GUILD_FRAME)
+
+ assert.equal('abbr' in anon.frames()[0], false)
+ assert.equal(staff.frames()[0].abbr, 'TN')
+ // Both still lose the locked fields.
+ assert.equal('acct' in staff.frames()[0].leader, false)
+})
+
+test('raising a feature audience cuts off the lower rungs mid-stream', async () => {
+ const anon = await subscribeAt('anonymous')
+ const player = await subscribeAt('player')
+
+ await broadcast.broadcast(GUILD_FRAME)
+ assert.equal(anon.frames().length, 1)
+ assert.equal(player.frames().length, 1)
+
+ // Config changes DO take effect live — only the viewer's rung is frozen.
+ model.listAll = async () => [
+ { feature: 'guilds', enabled: true, audience: 'player', stream: true, fieldRules: {} },
+ ]
+ visibility.invalidate()
+
+ await broadcast.broadcast(GUILD_FRAME)
+ assert.equal(anon.frames().length, 1, 'anonymous stops receiving')
+ assert.equal(player.frames().length, 2, 'player keeps receiving')
+})
+
+test("a subscriber's rung is frozen at subscribe time", async () => {
+ const client = await subscribeAt('anonymous')
+ // Even if the resolver would now say "admin", the open connection must not
+ // gain privilege — its level was captured when it subscribed.
+ visibility.viewerLevel = async () => 'admin'
+ await broadcast.broadcast({ kind: 'audit.command', command: 'ban' })
+ assert.deepEqual(client.frames(), [])
+})
+
+test('an unresolvable viewer subscribes as anonymous, not as privileged', async () => {
+ const client = fakeClient()
+ visibility.viewerLevel = async () => {
+ throw new Error('session lookup exploded')
+ }
+ await broadcast.subscribe(client.req, client.res, 'public')
+ await broadcast.broadcast({ kind: 'audit.command', command: 'ban' })
+ assert.deepEqual(client.frames(), [])
+
+ // ...but it still receives ordinary public traffic.
+ await broadcast.broadcast({ kind: 'champ.update', serial: '0x1' })
+ assert.equal(client.frames().length, 1)
+})
+
+test('an unreadable visibility config withholds every public frame', async () => {
+ const client = await subscribeAt('anonymous')
+ visibility.getConfig = async () => {
+ throw new Error('db down')
+ }
+ await broadcast.broadcast(GUILD_FRAME)
+ assert.deepEqual(client.frames(), [])
+})
+
+test('a disabled feature stops its kinds without touching others', async () => {
+ model.listAll = async () => [
+ { feature: 'champs', enabled: false, audience: 'anonymous', stream: true, fieldRules: {} },
+ ]
+ visibility.invalidate()
+
+ const client = await subscribeAt('anonymous')
+ await broadcast.broadcast({ kind: 'champ.update', serial: '0x1' })
+ await broadcast.broadcast({ kind: 'guild.update', id: 7 })
+
+ const kinds = client.frames().map((f) => f.kind)
+ assert.deepEqual(kinds, ['guild.update'])
+})
+
+test('a dead client is dropped rather than repeatedly retried', async () => {
+ const client = fakeClient()
+ visibility.viewerLevel = async () => 'anonymous'
+ await broadcast.subscribe(client.req, client.res, 'public')
+ assert.equal(broadcast.stats().publicClients, 1)
+
+ client.res.write = () => {
+ throw new Error('EPIPE')
+ }
+ await broadcast.broadcast({ kind: 'champ.update', serial: '0x1' })
+ assert.equal(broadcast.stats().publicClients, 0)
+})
+
+test('broadcast is a no-op for a malformed event', async () => {
+ const client = await subscribeAt('anonymous')
+ await broadcast.broadcast(null)
+ await broadcast.broadcast({})
+ assert.deepEqual(client.frames(), [])
+})
diff --git a/server/test/shardControllerPublic.test.js b/server/test/shardControllerPublic.test.js
index 1f92c24..bd3c8b5 100644
--- a/server/test/shardControllerPublic.test.js
+++ b/server/test/shardControllerPublic.test.js
@@ -20,10 +20,22 @@ const shardEvents = require('../src/model/shardEvents/shardEvents.model')
const shardState = require('../src/model/shardState/shardState.model')
const uoLinkConfig = require('../src/model/uoLinkConfig/uoLinkConfig.model')
const broadcast = require('../src/utils/shardBroadcast')
+const visibility = require('../src/utils/shardVisibility')
const db = require('../src/utils/db')
after(() => db.close())
+// The controller now resolves the visibility config and the caller's rung on
+// every read. Stub the MODEL rather than the util's exports: getConfig() and
+// project() call the module-internal getConfig, which an exports-level stub does
+// not intercept — it would still hit the closed DB port and cost a ~10s pool
+// timeout per test before falling back to these same defaults.
+const visibilityModel = require('../src/model/shardVisibility/shardVisibility.model')
+visibilityModel.listAll = async () => [] // no overrides ⇒ compiled defaults
+visibility.viewerLevel = async (req) => req?.viewerLevel || 'anonymous'
+
+const DEFAULTS = visibility.compileDefaults()
+
function mockRes() {
return {
statusCode: 200,
@@ -44,6 +56,7 @@ const originals = {
listIdoc: shardState.listIdoc,
onlineCount: shardState.onlineCount,
latestEconomy: shardState.latestEconomy,
+ getRuleset: shardState.getRuleset,
getSafe: uoLinkConfig.getSafe,
}
afterEach(() => {
@@ -51,6 +64,7 @@ afterEach(() => {
shardState.listIdoc = originals.listIdoc
shardState.onlineCount = originals.onlineCount
shardState.latestEconomy = originals.latestEconomy
+ shardState.getRuleset = originals.getRuleset
uoLinkConfig.getSafe = originals.getSafe
})
@@ -81,16 +95,65 @@ test('getFeed serves a specific kind when it IS public-safe', async () => {
assert.equal(res.body[0].kind, publicKind)
})
-test('getFeed with no kind restricts the query to the whole public allowlist', async () => {
+test('getFeed with no kind restricts the query to the kinds THIS viewer may read', async () => {
let seen
shardEvents.list = async (opts) => {
seen = opts
return []
}
await ctrl.getFeed({ query: {} }, mockRes())
- assert.deepEqual(new Set(seen.kinds), broadcast.PUBLIC_KINDS)
+ // Resolved from the LIVE config, not the module-load PUBLIC_KINDS constant, so
+ // an admin re-gating a feature takes effect on the stored history too.
+ assert.deepEqual(new Set(seen.kinds), new Set(visibility.visibleKinds('anonymous', DEFAULTS)))
// Sanity: a known admin-only kind is absent from what the public feed queries.
assert.ok(!seen.kinds.includes('staff.audit'))
+ // The `stream` flag governs SSE fan-out only, so a feature whose live firehose
+ // ships off is still readable from history — the one way this set is WIDER
+ // than PUBLIC_KINDS.
+ for (const kind of broadcast.PUBLIC_KINDS) assert.ok(seen.kinds.includes(kind))
+ assert.ok(seen.kinds.includes('vendor.listing'))
+ assert.ok(!broadcast.PUBLIC_KINDS.has('vendor.listing'))
+})
+
+test('getFeed projects each row against ITS OWN kind\'s feature', async () => {
+ shardEvents.list = async () => [
+ {
+ id: 1,
+ kind: 'player.death',
+ payload: { kind: 'player.death', actor: { serial: '0x1', name: 'Doomed', acct: 'secret', webId: 99 } },
+ },
+ {
+ id: 2,
+ kind: 'guild.join',
+ payload: { kind: 'guild.join', actor: { serial: '0x2', name: 'Joiner', acct: 'secret2', webId: 98 } },
+ },
+ ]
+ const res = mockRes()
+ await ctrl.getFeed({ query: {} }, res)
+ for (const row of res.body) {
+ assert.equal(row.payload.actor.acct, undefined, `${row.kind} leaked acct`)
+ assert.equal(row.payload.actor.webId, undefined, `${row.kind} leaked webId`)
+ assert.ok(row.payload.actor.name, 'the in-game name is still public')
+ }
+})
+
+test('getFeed serves nothing when the viewer may read no kinds at all', async () => {
+ let queried = false
+ shardEvents.list = async () => {
+ queried = true
+ return [{ kind: 'staff.audit' }]
+ }
+ const allGated = Object.fromEntries(
+ Object.entries(DEFAULTS).map(([name, f]) => [name, { ...f, enabled: false }]),
+ )
+ visibility.getConfig = async () => allGated
+ const res = mockRes()
+ await ctrl.getFeed({ query: {} }, res)
+ visibility.getConfig = async () => DEFAULTS
+ assert.deepEqual(res.body, [])
+ // An empty allowlist must never fall through to an unfiltered "give me
+ // everything" query.
+ assert.equal(queried, false)
})
// ── getHouses: the public house view must strip owner/price ─────────────
@@ -122,6 +185,205 @@ test('getHouses exposes only IDOC location fields and strips owner/price/decay',
assert.equal(h.coOwners, undefined)
})
+// ── getIdoc: the flattened owner fields are a security boundary too ──────
+test('getIdoc never serves the owner game account to a viewer below admin', async () => {
+ shardState.listIdoc = async () => [
+ {
+ serial: '0x1',
+ name: 'Marble Tower',
+ region: 'Britain',
+ map: 'Felucca',
+ x: 1,
+ y: 2,
+ z: 3,
+ ownerSerial: '0x2A01',
+ ownerName: 'Sir Cadmus',
+ ownerAcct: 'cadmus_acct', // flattened spelling of the locked `acct`
+ price: 1250000,
+ isIdoc: true,
+ },
+ ]
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ const res = mockRes()
+ await ctrl.getIdoc({ viewerLevel: level }, res)
+ assert.equal(res.body[0].ownerAcct, undefined, `${level} saw the owner's game account`)
+ }
+ const res = mockRes()
+ await ctrl.getIdoc({ viewerLevel: 'admin' }, res)
+ assert.equal(res.body[0].ownerAcct, 'cadmus_acct', 'admin still sees it')
+})
+
+test('getIdoc gates owner identity and price at `staff`, but never the location', async () => {
+ shardState.listIdoc = async () => [
+ { serial: '0x1', name: 'Marble Tower', region: 'Britain', map: 'Felucca', x: 1, y: 2, z: 3,
+ ownerSerial: '0x2A01', ownerName: 'Sir Cadmus', price: 1250000, isIdoc: true },
+ ]
+ const anon = mockRes()
+ await ctrl.getIdoc({ viewerLevel: 'anonymous' }, anon)
+ assert.equal(anon.body[0].ownerName, undefined)
+ assert.equal(anon.body[0].ownerSerial, undefined)
+ assert.equal(anon.body[0].price, undefined)
+ // The public IDOC board still renders: name, region and location survive.
+ assert.equal(anon.body[0].name, 'Marble Tower')
+ assert.equal(anon.body[0].region, 'Britain')
+ assert.equal(anon.body[0].map, 'Felucca')
+
+ const staff = mockRes()
+ await ctrl.getIdoc({ viewerLevel: 'staff' }, staff)
+ assert.equal(staff.body[0].ownerName, 'Sir Cadmus')
+ assert.equal(staff.body[0].price, 1250000)
+})
+
+test('getIdoc preserves Date columns rather than flattening them to {}', async () => {
+ const when = new Date('2026-07-06T19:32:29.000Z')
+ shardState.listIdoc = async () => [
+ { serial: '0x1', name: 'Marble Tower', isIdoc: true, lastRefreshed: when, updatedAt: when },
+ ]
+ const res = mockRes()
+ await ctrl.getIdoc({ viewerLevel: 'anonymous' }, res)
+ assert.ok(res.body[0].updatedAt instanceof Date, 'a Date must survive projection intact')
+ assert.equal(res.body[0].updatedAt.toISOString(), when.toISOString())
+})
+
+// ── getRuleset: "never published" is a real answer ──────────────────────
+test('getRuleset serves null when the shard has never published a ruleset', async () => {
+ shardState.getRuleset = async () => null
+ const res = mockRes()
+ await ctrl.getRuleset({ viewerLevel: 'anonymous' }, res)
+ // Deliberately null, not {} — the page says "not published yet" rather than
+ // rendering an empty ruleset as though the shard had no rules.
+ assert.equal(res.body, null)
+ assert.equal(res.statusCode, 200)
+})
+
+test('getRuleset serves the published ruleset whole, nested blocks intact', async () => {
+ shardState.getRuleset = async () => ({
+ kind: 'world.ruleset',
+ rev: '1a2b3c4d',
+ shard: 'UOMysticmoon',
+ expansion: 'EJ',
+ systems: { cityLoyalty: true, vvv: true, factions: false },
+ caps: { skill: 1000, totalSkill: 7000, stat: 225 },
+ champions: { powerScrolls: 6, rankThresholds: [5, 10, 13] },
+ })
+ const res = mockRes()
+ await ctrl.getRuleset({ viewerLevel: 'anonymous' }, res)
+ assert.equal(res.body.expansion, 'EJ')
+ assert.equal(res.body.systems.vvv, true)
+ assert.equal(res.body.caps.totalSkill, 7000)
+ // Arrays must survive projection as arrays, not become objects.
+ assert.deepEqual(res.body.champions.rankThresholds, [5, 10, 13])
+})
+
+// §3.6.1's rule: a read path that returns shard data and does not project is a
+// bug. The ruleset frame carries no actor today, but it goes through the same
+// gate — so a future block that does cannot leak.
+test('getRuleset projects: acct/webId never survive below admin', async () => {
+ shardState.getRuleset = async () => ({
+ expansion: 'EJ',
+ connect: 'play.example.com,2593',
+ owner: { name: 'Lord British', acct: 'lb_acct', webId: 7 },
+ })
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ const res = mockRes()
+ await ctrl.getRuleset({ viewerLevel: level }, res)
+ assert.equal(res.body.owner.acct, undefined, `${level} saw acct`)
+ assert.equal(res.body.owner.webId, undefined, `${level} saw webId`)
+ // `connect` defaults to the anonymous rung: an operator who published it
+ // meant it to be readable.
+ assert.equal(res.body.connect, 'play.example.com,2593')
+ }
+})
+
+// ── points boards ──────────────────────────────────────────────────────
+const BOARD = {
+ system: 'QueensLoyalty',
+ nameString: "Queen's Loyalty",
+ nameNumber: 1114938,
+ maxPoints: 30000,
+ players: 842,
+ top: [
+ { rank: 1, serial: '0x1A2B', name: 'Darrow', points: 29500 },
+ { rank: 2, serial: '0x1A2C', name: 'Mireille', points: 21000 },
+ ],
+}
+
+test('getPointsBoards serves every board with its ranked list intact', async () => {
+ shardState.listPointsBoards = async () => [BOARD]
+ const res = mockRes()
+ await ctrl.getPointsBoards({ viewerLevel: 'anonymous' }, res)
+ assert.equal(res.body.length, 1)
+ assert.equal(res.body[0].system, 'QueensLoyalty')
+ // The ranked list is an ARRAY through projection, not an object keyed 0/1 —
+ // the same trap the ruleset's rankThresholds assertion guards.
+ assert.ok(Array.isArray(res.body[0].top))
+ assert.equal(res.body[0].top[1].name, 'Mireille')
+})
+
+test('getPointsBoards serves an empty list before the shard has published any', async () => {
+ shardState.listPointsBoards = async () => []
+ const res = mockRes()
+ await ctrl.getPointsBoards({ viewerLevel: 'anonymous' }, res)
+ assert.deepEqual(res.body, [])
+ assert.equal(res.statusCode, 200)
+})
+
+// §3.6.1's rule again: a shard read that does not project is a bug. Boards carry
+// no actor today — they write entries inline as {serial, name} precisely so they
+// never carry acct/webId — but the gate is what keeps that true if the shape grows.
+test('getPointsBoard projects: acct/webId never survive below admin', async () => {
+ shardState.getPointsBoard = async () => ({
+ system: 'QueensLoyalty',
+ top: [{ rank: 1, name: 'Darrow', acct: 'darrow_acct', webId: 9, points: 1 }],
+ })
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ const res = mockRes()
+ await ctrl.getPointsBoard({ params: { system: 'QueensLoyalty' }, viewerLevel: level }, res)
+ assert.equal(res.body.top[0].acct, undefined, `${level} saw acct`)
+ assert.equal(res.body.top[0].webId, undefined, `${level} saw webId`)
+ assert.equal(res.body.top[0].name, 'Darrow', 'the ranked name is public by default')
+ }
+})
+
+// "No such system" and "a board nobody has scored in" are different answers.
+test('getPointsBoard 404s for a system the shard has never published', async () => {
+ shardState.getPointsBoard = async () => null
+ const res = mockRes()
+ await ctrl.getPointsBoard({ params: { system: 'NoSuchSystem' }, viewerLevel: 'anonymous' }, res)
+ assert.equal(res.statusCode, 404)
+})
+
+test('getPointsBoard rejects a malformed system name before touching the model', async () => {
+ let queried = false
+ shardState.getPointsBoard = async () => { queried = true; return null }
+ for (const system of ['../etc', 'a'.repeat(64), '', 'has space', '1leading']) {
+ const res = mockRes()
+ await ctrl.getPointsBoard({ params: { system }, viewerLevel: 'anonymous' }, res)
+ assert.equal(res.statusCode, 400, `${JSON.stringify(system)} should be rejected`)
+ }
+ assert.equal(queried, false, 'a malformed name must never reach the query')
+})
+
+test('getPointsBoards degrades to a 500 when the model fails, without throwing', async () => {
+ shardState.listPointsBoards = async () => {
+ throw new Error('pool down')
+ }
+ const res = mockRes()
+ await ctrl.getPointsBoards({ viewerLevel: 'anonymous' }, res)
+ assert.equal(res.statusCode, 500)
+ assert.equal(res.body.message, 'Internal Server Error')
+})
+
+test('getRuleset degrades to a 500 when the model fails, without throwing', async () => {
+ shardState.getRuleset = async () => {
+ throw new Error('pool down')
+ }
+ const res = mockRes()
+ await ctrl.getRuleset({ viewerLevel: 'anonymous' }, res)
+ assert.equal(res.statusCode, 500)
+ assert.equal(res.body.message, 'Internal Server Error')
+})
+
// ── getStatus assembles the summary ─────────────────────────────────────
test('getStatus merges the sidecar config with the online count and latest economy', async () => {
uoLinkConfig.getSafe = async () => ({
diff --git a/server/test/shardIngest.market.test.js b/server/test/shardIngest.market.test.js
new file mode 100644
index 0000000..82d0bd0
--- /dev/null
+++ b/server/test/shardIngest.market.test.js
@@ -0,0 +1,114 @@
+const { test, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const shardIngest = require('../src/utils/shardIngest')
+
+// Protocol 3.0 vendor.listing / vendor.listing.remove routing. Same shape as
+// shardIngest.points.test.js: stubbed deps, asserting where the dispatcher sends
+// the frame and whether it is appended to the event log.
+function makeDeps() {
+ const calls = { upserts: [], removes: [], appended: [], broadcast: [] }
+ const noop = async () => {}
+ return {
+ calls,
+ shardEvents: { append: async (row) => { calls.appended.push(row); return true } },
+ shardState: {
+ // Present so any stray routing is a harmless no-op rather than a crash.
+ clearOnline: noop, upsertOnline: noop, setOffline: noop, upsertHouse: noop,
+ addEconomySample: noop, setRuleset: noop, upsertPointsBoard: noop,
+ },
+ shardMarket: {
+ upsertVendor: async (ev) => { calls.upserts.push(ev) },
+ removeVendor: async (serial) => { calls.removes.push(serial) },
+ },
+ shardLinks: { removeByAccount: noop },
+ uoLinkConfig: { recordStatus: noop },
+ broadcast: (ev) => { calls.broadcast.push(ev) },
+ pushDispatch: async () => {},
+ log: { warn() {}, info() {}, error() {} },
+ }
+}
+
+const FRAME = {
+ kind: 'vendor.listing',
+ t: 1000,
+ serial: '0x40001234',
+ shopName: "Darrow's Bargains",
+ ownerSerial: '0x1A2B',
+ ownerName: 'Darrow',
+ location: { map: 'Trammel', x: 1421, y: 1699, z: 0, region: 'Britain', house: "Darrow's Villa" },
+ count: 2,
+ total: 2,
+ truncated: false,
+ items: [
+ { serial: '0x40012ABC', itemId: 3922, hue: 0, amount: 1, price: 25000, name: null, cliloc: 1023721 },
+ { serial: '0x40012ABD', itemId: 7026, hue: 1157, amount: 3, price: 500, name: 'a shard sigil', cliloc: 1041243 },
+ ],
+}
+
+beforeEach(() => shardIngest.reset())
+
+test('vendor.listing routes to the market model with the whole frame', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.upserts.length, 1)
+ const stored = deps.calls.upserts[0]
+ assert.equal(stored.serial, '0x40001234')
+ assert.equal(stored.location.region, 'Britain')
+ assert.equal(stored.items.length, 2)
+})
+
+test('vendor.listing.remove routes to removeVendor with the serial', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest({ kind: 'vendor.listing.remove', t: 2000, serial: '0x40001234' }, deps)
+ assert.deepEqual(deps.calls.removes, ['0x40001234'])
+ assert.equal(deps.calls.upserts.length, 0)
+})
+
+// The market IS the state. One frame carries up to 250 listings and the sweep
+// re-emits a shop on any price change, so logging would turn shard_events into a
+// price history nobody reads — the strongest case of the three v3 kinds.
+test('neither market kind is appended to the event log', async () => {
+ const deps = makeDeps()
+ const a = await shardIngest.ingest(FRAME, deps)
+ const b = await shardIngest.ingest({ kind: 'vendor.listing.remove', serial: '0x40001234' }, deps)
+ assert.equal(a.logged, false)
+ assert.equal(b.logged, false)
+ assert.equal(deps.calls.appended.length, 0)
+ assert.equal(shardIngest.LOGGED_KINDS.has('vendor.listing'), false)
+ assert.equal(shardIngest.LOGGED_KINDS.has('vendor.listing.remove'), false)
+})
+
+// Broadcast is unconditional at this layer — whether it actually reaches anyone
+// is shardBroadcast's call, and the market feature ships with its stream off.
+test('vendor.listing is handed to the broadcaster', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.broadcast.length, 1)
+ assert.equal(deps.calls.broadcast[0].kind, 'vendor.listing')
+})
+
+test('a backfilled vendor.listing still stores but does not broadcast', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, { ...deps, fromBackfill: true })
+ assert.equal(deps.calls.upserts.length, 1)
+ assert.equal(deps.calls.broadcast.length, 0)
+})
+
+// The reconnect backfill replays the whole index through this path, so a single
+// bad vendor must not abort it.
+test('an upsertVendor failure does not throw or stop the broadcast', async () => {
+ const deps = makeDeps()
+ deps.shardMarket.upsertVendor = async () => { throw new Error('db down') }
+ const r = await shardIngest.ingest(FRAME, deps)
+ assert.equal(r.logged, false)
+ assert.equal(deps.calls.broadcast.length, 1)
+})
+
+// Each vendor is its own row; the frame is authoritative for that vendor only.
+test('two vendors are stored independently', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ await shardIngest.ingest({ ...FRAME, serial: '0x40009999', shopName: 'Second Shop' }, deps)
+ assert.deepEqual(deps.calls.upserts.map((v) => v.serial), ['0x40001234', '0x40009999'])
+})
diff --git a/server/test/shardIngest.points.test.js b/server/test/shardIngest.points.test.js
new file mode 100644
index 0000000..210003b
--- /dev/null
+++ b/server/test/shardIngest.points.test.js
@@ -0,0 +1,111 @@
+const { test, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const shardIngest = require('../src/utils/shardIngest')
+
+// Protocol 3.0 points.board routing. Same shape as shardIngest.ruleset.test.js:
+// stubbed deps, asserting where the dispatcher sends the frame and whether it is
+// appended to the event log.
+function makeDeps() {
+ const calls = { boards: [], appended: [], broadcast: [] }
+ const noop = async () => {}
+ return {
+ calls,
+ shardEvents: { append: async (row) => { calls.appended.push(row); return true } },
+ shardState: {
+ upsertPointsBoard: async (ev) => { calls.boards.push(ev) },
+ // Present so any stray routing is a harmless no-op.
+ clearOnline: noop, upsertOnline: noop, setOffline: noop, upsertHouse: noop,
+ addEconomySample: noop, setRuleset: noop,
+ },
+ shardLinks: { removeByAccount: noop },
+ uoLinkConfig: { recordStatus: noop },
+ broadcast: (ev) => { calls.broadcast.push(ev) },
+ pushDispatch: async () => {},
+ log: { warn() {}, info() {}, error() {} },
+ }
+}
+
+const FRAME = {
+ kind: 'points.board',
+ t: 1000,
+ system: 'QueensLoyalty',
+ nameString: "Queen's Loyalty",
+ nameNumber: 1114938,
+ maxPoints: 30000,
+ showOnGump: true,
+ players: 842,
+ top: [
+ { rank: 1, serial: '0x1A2B', name: 'Darrow', points: 29500 },
+ { rank: 2, serial: '0x1A2C', name: 'Mireille', points: 21000 },
+ ],
+}
+
+beforeEach(() => shardIngest.reset())
+
+test('points.board routes to upsertPointsBoard with the whole frame', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.boards.length, 1)
+ const stored = deps.calls.boards[0]
+ assert.equal(stored.system, 'QueensLoyalty')
+ assert.equal(stored.nameNumber, 1114938)
+ assert.equal(stored.players, 842)
+ // The ranked list must survive intact — the read model serves it from the payload.
+ assert.equal(stored.top.length, 2)
+ assert.equal(stored.top[0].name, 'Darrow')
+})
+
+// A board is state, not an event. The shard emits a frame every time anyone's
+// score moves the top ten, so logging would grow shard_events without bound for
+// something whose only interesting value is its latest version — the same call
+// guild.update already makes.
+test('points.board is NOT appended to the event log', async () => {
+ const deps = makeDeps()
+ const r = await shardIngest.ingest(FRAME, deps)
+ assert.equal(r.logged, false)
+ assert.equal(deps.calls.appended.length, 0)
+ assert.equal(shardIngest.LOGGED_KINDS.has('points.board'), false)
+})
+
+test('points.board is broadcast (the leaderboards page updates live)', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.broadcast.length, 1)
+ assert.equal(deps.calls.broadcast[0].kind, 'points.board')
+})
+
+test('a backfilled points.board still stores but does not broadcast', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, { ...deps, fromBackfill: true })
+ assert.equal(deps.calls.boards.length, 1)
+ assert.equal(deps.calls.broadcast.length, 0)
+})
+
+// Each system is its own row, so two systems must not collide — this is the whole
+// reason the frame is per-system rather than one board of everything.
+test('two systems are stored independently', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ await shardIngest.ingest({ ...FRAME, system: 'CleanUpBritannia', nameString: null }, deps)
+ assert.deepEqual(deps.calls.boards.map((b) => b.system), ['QueensLoyalty', 'CleanUpBritannia'])
+})
+
+// A re-emitted board is an overwrite of one row, never an append.
+test('a repeated points.board overwrites rather than accumulating', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ await shardIngest.ingest({ ...FRAME, t: 2000, players: 843 }, deps)
+ assert.equal(deps.calls.appended.length, 0)
+ assert.equal(deps.calls.boards.length, 2) // two writes...
+ assert.equal(deps.calls.boards[1].system, 'QueensLoyalty') // ...of the same row
+})
+
+// A model write that throws must not kill the feed.
+test('an upsertPointsBoard failure does not throw or stop the broadcast', async () => {
+ const deps = makeDeps()
+ deps.shardState.upsertPointsBoard = async () => { throw new Error('db down') }
+ const r = await shardIngest.ingest(FRAME, deps)
+ assert.equal(r.logged, false)
+ assert.equal(deps.calls.broadcast.length, 1)
+})
diff --git a/server/test/shardIngest.ruleset.test.js b/server/test/shardIngest.ruleset.test.js
new file mode 100644
index 0000000..1597777
--- /dev/null
+++ b/server/test/shardIngest.ruleset.test.js
@@ -0,0 +1,161 @@
+const { test, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const shardIngest = require('../src/utils/shardIngest')
+
+// Protocol 3.0 world.ruleset routing. Same shape as shardIngest.protocol2.test.js:
+// stubbed deps, asserting where the dispatcher sends the frame and whether it is
+// appended to the event log.
+function makeDeps() {
+ const calls = { rulesetSet: [], appended: [], broadcast: [] }
+ const noop = async () => {}
+ return {
+ calls,
+ shardEvents: { append: async (row) => { calls.appended.push(row); return true } },
+ shardState: {
+ setRuleset: async (ev) => { calls.rulesetSet.push(ev) },
+ // Present so any stray routing is a harmless no-op.
+ clearOnline: noop, upsertOnline: noop, setOffline: noop, upsertHouse: noop,
+ addEconomySample: noop,
+ },
+ shardLinks: { removeByAccount: noop },
+ uoLinkConfig: { recordStatus: noop },
+ broadcast: (ev) => { calls.broadcast.push(ev) },
+ pushDispatch: async () => {},
+ log: { warn() {}, info() {}, error() {} },
+ }
+}
+
+const FRAME = {
+ kind: 'world.ruleset',
+ t: 1000,
+ rev: '1a2b3c4d',
+ shard: 'UOMysticmoon',
+ expansion: 'EJ',
+ systems: { cityLoyalty: true, vvv: true, factions: false },
+ caps: { skill: 1000, totalSkill: 7000 },
+}
+
+beforeEach(() => shardIngest.reset())
+
+test('world.ruleset routes to setRuleset with the whole frame', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.rulesetSet.length, 1)
+ const stored = deps.calls.rulesetSet[0]
+ assert.equal(stored.rev, '1a2b3c4d')
+ assert.equal(stored.expansion, 'EJ')
+ // The nested blocks must survive intact — the read model serves the frame whole.
+ assert.equal(stored.systems.vvv, true)
+ assert.equal(stored.caps.totalSkill, 7000)
+})
+
+// The shard re-emits world.ruleset on EVERY sidecar connect. Logging it would put
+// a duplicate row in shard_events per reconnect, and server.hello already marks
+// each of those — so this assertion is the guard on that decision.
+test('world.ruleset is NOT appended to the event log', async () => {
+ const deps = makeDeps()
+ const r = await shardIngest.ingest(FRAME, deps)
+ assert.equal(r.logged, false)
+ assert.equal(deps.calls.appended.length, 0)
+ assert.equal(shardIngest.LOGGED_KINDS.has('world.ruleset'), false)
+})
+
+test('world.ruleset is broadcast (the rules page updates live)', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ assert.equal(deps.calls.broadcast.length, 1)
+ assert.equal(deps.calls.broadcast[0].kind, 'world.ruleset')
+})
+
+// A backfill replay must reach the store but must NOT re-animate the live ticker.
+test('a backfilled world.ruleset still stores but does not broadcast', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, { ...deps, fromBackfill: true })
+ assert.equal(deps.calls.rulesetSet.length, 1)
+ assert.equal(deps.calls.broadcast.length, 0)
+})
+
+// A re-emitted identical ruleset is an overwrite, not an append: two ingests of
+// the same rev leave one stored frame's worth of state, never a growing log.
+test('a repeated world.ruleset overwrites rather than accumulating', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, deps)
+ await shardIngest.ingest({ ...FRAME, t: 2000 }, deps)
+ assert.equal(deps.calls.appended.length, 0)
+ assert.equal(deps.calls.rulesetSet.length, 2) // two writes...
+ assert.equal(deps.calls.rulesetSet[1].rev, '1a2b3c4d') // ...of the same singleton
+})
+
+// A model write that throws must not kill the feed — ingest swallows it and the
+// frame is still broadcast.
+test('a setRuleset failure does not throw or stop the broadcast', async () => {
+ const deps = makeDeps()
+ deps.shardState.setRuleset = async () => { throw new Error('db down') }
+ const r = await shardIngest.ingest(FRAME, deps)
+ assert.equal(r.logged, false)
+ assert.equal(deps.calls.broadcast.length, 1)
+})
+
+// ── Shard name fallback ────────────────────────────────────────────────────
+//
+// ServUO ships Server.cfg with `Name=My Shard`. An operator who never edited it
+// publishes that verbatim, which says "unnamed" rather than naming anything — so
+// the site answers with its own instance name instead of printing the stock
+// default under a header carrying the real one.
+//
+// Applied at INGEST, not on read, because world.ruleset is also broadcast live:
+// the same object goes to the SSE fan-out, so a read-time fix would be undone by
+// the next reconnect's frame. These tests assert both halves.
+
+function withSettings(deps, name) {
+ return { ...deps, settings: { getInstanceName: async () => name } }
+}
+
+test('the stock ServUO shard name is replaced with the instance name', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest({ ...FRAME, shard: 'My Shard' }, withSettings(deps, 'UOMysticmoon'))
+ assert.equal(deps.calls.rulesetSet[0].shard, 'UOMysticmoon')
+})
+
+test('the substituted name reaches the live broadcast, not just the store', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest({ ...FRAME, shard: 'My Shard' }, withSettings(deps, 'UOMysticmoon'))
+ assert.equal(deps.calls.broadcast.length, 1)
+ assert.equal(deps.calls.broadcast[0].shard, 'UOMysticmoon')
+})
+
+test('a missing or blank shard name gets the same treatment', async () => {
+ for (const shard of [undefined, null, '', ' ']) {
+ const deps = makeDeps()
+ await shardIngest.ingest({ ...FRAME, shard }, withSettings(deps, 'UOMysticmoon'))
+ assert.equal(deps.calls.rulesetSet[0].shard, 'UOMysticmoon')
+ }
+})
+
+// The match is on the whole value, case- and padding-insensitive. A shard that
+// deliberately calls itself "My Shard Reborn" has named itself and keeps it.
+test('a real name that merely contains the stock one is left alone', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest({ ...FRAME, shard: 'My Shard Reborn' }, withSettings(deps, 'UOMysticmoon'))
+ assert.equal(deps.calls.rulesetSet[0].shard, 'My Shard Reborn')
+
+ const padded = makeDeps()
+ await shardIngest.ingest({ ...FRAME, shard: ' MY SHARD ' }, withSettings(padded, 'UOMysticmoon'))
+ assert.equal(padded.calls.rulesetSet[0].shard, 'UOMysticmoon')
+})
+
+test('a shard that named itself is never overridden by the brand', async () => {
+ const deps = makeDeps()
+ await shardIngest.ingest(FRAME, withSettings(deps, 'Some Other Brand'))
+ assert.equal(deps.calls.rulesetSet[0].shard, 'UOMysticmoon')
+})
+
+// The settings read is a DB call on a path that must never fail ingest.
+test('a settings read failure leaves the frame storable', async () => {
+ const deps = makeDeps()
+ const boom = { ...deps, settings: { getInstanceName: async () => { throw new Error('db down') } } }
+ await shardIngest.ingest({ ...FRAME, shard: 'My Shard' }, boom)
+ assert.equal(deps.calls.rulesetSet.length, 1)
+ assert.equal(deps.calls.rulesetSet[0].shard, 'My Shard')
+})
diff --git a/server/test/shardMarket.model.test.js b/server/test/shardMarket.model.test.js
new file mode 100644
index 0000000..0c5760b
--- /dev/null
+++ b/server/test/shardMarket.model.test.js
@@ -0,0 +1,260 @@
+// Point the DB at a closed port BEFORE requiring anything that builds a pool.
+// Nothing here reaches the database: these are the model's PURE parts — the
+// flatten/shape rules the frame passes through on the way in and out — plus the
+// visibility projection over the shapes they produce.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, after } = require('node:test')
+const assert = require('node:assert/strict')
+
+const market = require('../src/model/shardMarket/shardMarket.model')
+const clilocs = require('../src/model/shardClilocs/shardClilocs.model')
+const clilocDb = require('../src/model/shardClilocs/shardClilocs.db')
+const visibility = require('../src/utils/shardVisibility')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+// Stand in for the cliloc table. Without this each unresolved lookup waits out
+// the pool's 10s acquire timeout against the dead port — the model swallows the
+// failure exactly as it would in production (an operator who never converted a
+// cliloc file is in a supported state), so the RESULT is the same either way;
+// this only stops the suite spending half a minute proving it.
+const TABLE = new Map([[1023721, 'quarter staff']])
+clilocDb.lookup = async (numbers) =>
+ numbers.filter((n) => TABLE.has(n)).map((n) => ({ number: n, text: TABLE.get(n) }))
+
+const FRAME = {
+ kind: 'vendor.listing',
+ t: 1000,
+ serial: '0x40001234',
+ shopName: "Darrow's Bargains",
+ ownerSerial: '0x1A2B',
+ ownerName: 'Darrow',
+ location: { map: 'Trammel', x: 1421, y: 1699, z: 0, region: 'Britain', house: "Darrow's Villa" },
+ count: 2,
+ total: 2,
+ truncated: false,
+ items: [],
+}
+
+// ── flattenFrame ───────────────────────────────────────────────────────────
+
+test('flattenFrame lifts the nested location into columns', () => {
+ const v = market.flattenFrame(FRAME)
+ assert.equal(v.serial, '0x40001234')
+ assert.equal(v.map, 'Trammel')
+ assert.equal(v.x, 1421)
+ assert.equal(v.region, 'Britain')
+ assert.equal(v.house, "Darrow's Villa")
+})
+
+// A vendor standing in the street has no house, and a frame from an older plugin
+// may have no location at all. Neither is an error.
+test('flattenFrame tolerates a missing location entirely', () => {
+ const v = market.flattenFrame({ serial: '0x1', shopName: null })
+ assert.equal(v.map, null)
+ assert.equal(v.x, null)
+ assert.equal(v.region, null)
+ assert.equal(v.house, null)
+})
+
+// `total` is what the SHOP holds; `count` is what the frame carried. A truncated
+// shop must not report its published slice as its size, or the page says
+// "showing 250 of 250" for a vendor holding three thousand stacks.
+test('flattenFrame keeps the shop total separate from the published count', () => {
+ const v = market.flattenFrame({ ...FRAME, count: 250, total: 3104, truncated: true })
+ assert.equal(v.itemTotal, 3104)
+ assert.equal(v.truncated, true)
+})
+
+// An older plugin sends no `total`. Falling back to `count` is right — it is the
+// only number available and it is correct whenever nothing was truncated.
+test('flattenFrame falls back to count when total is absent', () => {
+ const v = market.flattenFrame({ ...FRAME, count: 7, total: undefined })
+ assert.equal(v.itemTotal, 7)
+})
+
+test('flattenFrame clips over-length strings rather than letting the insert fail', () => {
+ const v = market.flattenFrame({ ...FRAME, ownerName: 'x'.repeat(200) })
+ assert.equal(v.ownerName.length, 64)
+})
+
+// ── shapeItems ─────────────────────────────────────────────────────────────
+//
+// resolveMany never throws and, with no cliloc table reachable, resolves nothing
+// — which is exactly the state of a shard whose operator never converted one, so
+// these run against the real function rather than a stub.
+
+test('shapeItems prefers the item\'s literal name over its cliloc', async () => {
+ const items = await market.shapeItems({
+ items: [{ serial: '0x1', itemId: 3922, price: 100, name: 'a shard sigil', cliloc: 1023721 }],
+ })
+ assert.equal(items[0].displayName, 'a shard sigil')
+ // The cliloc is kept regardless, so a later import can still re-resolve it.
+ assert.equal(items[0].cliloc, 1023721)
+})
+
+test('shapeItems resolves the cliloc when the item has no literal name', async () => {
+ const items = await market.shapeItems({
+ items: [{ serial: '0x1', itemId: 3922, price: 100, name: null, cliloc: 1023721 }],
+ })
+ assert.equal(items[0].displayName, 'quarter staff')
+})
+
+// The supported state for a shard whose operator never converted a cliloc file:
+// no name, not a fabricated one. Clients render the item id, exactly as they did
+// before the table existed.
+test('shapeItems leaves displayName null for an unknown cliloc', async () => {
+ const items = await market.shapeItems({
+ items: [{ serial: '0x1', itemId: 3922, price: 100, name: null, cliloc: 9999999 }],
+ })
+ assert.equal(items[0].displayName, null)
+})
+
+// Unpriced rows are inventory, not listings. The shard drops them too; enforcing
+// it here as well means a plugin that stops doing so cannot put un-buyable rows
+// on the market page.
+test('shapeItems drops unpriced listings', async () => {
+ const items = await market.shapeItems({
+ items: [
+ { serial: '0x1', itemId: 1, price: 0 },
+ { serial: '0x2', itemId: 2, price: -1 },
+ { serial: '0x3', itemId: 3, price: 5 },
+ ],
+ })
+ assert.deepEqual(items.map((i) => i.serial), ['0x3'])
+})
+
+test('shapeItems caps a pathological frame', async () => {
+ const many = Array.from({ length: market.MAX_ITEMS_PER_VENDOR + 50 }, (_, i) => ({
+ serial: `0x${i}`,
+ itemId: 1,
+ price: 1,
+ }))
+ const items = await market.shapeItems({ items: many })
+ assert.equal(items.length, market.MAX_ITEMS_PER_VENDOR)
+})
+
+test('shapeItems tolerates a frame with no items array', async () => {
+ assert.deepEqual(await market.shapeItems({}), [])
+})
+
+// ── Visibility projection ──────────────────────────────────────────────────
+//
+// The regression that matters. Part A pre-wired `market.ownerName` and
+// `market.location` before the frame existed, and the sibling rule it pre-wired
+// for leaderboards (`characterName`) turned out to be INERT because projectValue
+// matches literal JSON keys. These assert the market rules actually bite — on the
+// read model AND on the wire frame, which is why both carry the same key names.
+
+const config = visibility.compileDefaults()
+
+const listing = market.shapeListing({
+ serial: '0x40012ABC',
+ item_id: 3922,
+ hue: 0,
+ amount: 1,
+ price: 25000,
+ name: null,
+ cliloc: 1023721,
+ display_name: 'quarter staff',
+ child: 0,
+ vendor_serial: '0x40001234',
+ shop_name: "Darrow's Bargains",
+ owner_serial: '0x1A2B',
+ owner_name: 'Darrow',
+ map: 'Trammel',
+ x: 1421,
+ y: 1699,
+ z: 0,
+ region: 'Britain',
+ house: "Darrow's Villa",
+ updated_at: new Date(0),
+})
+
+test('market defaults expose owner and location (they are already public in game)', () => {
+ const out = visibility.projectFeature('market', listing, 'anonymous', config)
+ assert.equal(out.vendor.ownerName, 'Darrow')
+ assert.equal(out.vendor.location.region, 'Britain')
+})
+
+test('tightening market.ownerName hides it from below that rung', () => {
+ const tightened = { ...config, market: { ...config.market, fields: { ...config.market.fields, ownerName: 'staff' } } }
+ const anon = visibility.projectFeature('market', listing, 'anonymous', tightened)
+ const staff = visibility.projectFeature('market', listing, 'staff', tightened)
+ assert.equal('ownerName' in anon.vendor, false)
+ assert.equal(staff.vendor.ownerName, 'Darrow')
+ // The shop name is a separate field and must survive — hiding the owner is not
+ // the same as hiding the shop.
+ assert.equal(anon.vendor.shopName, "Darrow's Bargains")
+})
+
+// The whole reason `location` is one nested object: a single rule has to take the
+// facet, the coordinates, the region and the house together. Five flat keys would
+// be five rules that drift apart.
+test('tightening market.location hides the whole location object at once', () => {
+ const tightened = { ...config, market: { ...config.market, fields: { ...config.market.fields, location: 'player' } } }
+ const anon = visibility.projectFeature('market', listing, 'anonymous', tightened)
+ const player = visibility.projectFeature('market', listing, 'player', tightened)
+ assert.equal('location' in anon.vendor, false)
+ assert.equal(player.vendor.location.map, 'Trammel')
+})
+
+// The same rules must bite on the LIVE frame, not just the stored read model —
+// the market's SSE stream is off by default but an admin can turn it on, and a
+// field rule that only worked on one of the two paths is exactly the leak §3.6.1
+// records.
+test('the same rules apply to the raw vendor.listing frame', () => {
+ const tightened = { ...config, market: { ...config.market, fields: { ...config.market.fields, ownerName: 'admin', location: 'admin' } } }
+ const out = visibility.projectFeature('market', FRAME, 'anonymous', tightened)
+ assert.equal('ownerName' in out, false)
+ assert.equal('location' in out, false)
+ assert.equal(out.shopName, "Darrow's Bargains")
+})
+
+// Rule 1 is not configurable and does not depend on the market rules at all: a
+// frame that somehow carried an account name must never publish it.
+test('acct and webId are stripped from a market payload regardless of config', () => {
+ const out = visibility.projectFeature(
+ 'market',
+ { serial: '0x1', ownerAcct: 'darrow', webId: '42', shopName: 'Shop' },
+ 'staff',
+ config,
+ )
+ assert.equal('ownerAcct' in out, false)
+ assert.equal('webId' in out, false)
+ assert.equal(out.shopName, 'Shop')
+})
+
+// Both kinds must be attributed to a feature, or rule 2 makes them admin-only by
+// omission — which would be a silent failure rather than a loud one.
+test('both market kinds are mapped to the market feature', () => {
+ assert.equal(visibility.KIND_FEATURE.get('vendor.listing'), 'market')
+ assert.equal(visibility.KIND_FEATURE.get('vendor.listing.remove'), 'market')
+})
+
+// The market's live firehose is off by default (a page of whole vendor
+// inventories is the site's biggest bandwidth item and no page needs it live),
+// but the REST reads are unaffected — which is what `visibleKinds` ignoring the
+// stream flag encodes.
+test('market kinds are stream-suppressed by default but still readable', () => {
+ assert.equal(visibility.DEFAULT_STREAM_OFF.has('market'), true)
+ assert.equal(visibility.kindVisibleTo('vendor.listing', 'anonymous', config), false)
+ assert.equal(visibility.PUBLIC_KINDS.has('vendor.listing'), false)
+ assert.ok(visibility.visibleKinds('anonymous', config).includes('vendor.listing'))
+})
+
+test('an admin who enables the stream gets the frames', () => {
+ const on = { ...config, market: { ...config.market, stream: true } }
+ assert.equal(visibility.kindVisibleTo('vendor.listing', 'anonymous', on), true)
+})
+
+// Guards the stub above against silently doing nothing: if the model stopped
+// going through db.lookup, every shapeItems assertion would still "pass" by
+// resolving nothing, which is also what a real miss looks like.
+test('the cliloc resolver is the path shapeItems resolves through', async () => {
+ const found = await clilocs.resolveMany([1023721])
+ assert.equal(found.get(1023721), 'quarter staff')
+})
diff --git a/server/test/shardVisibility.test.js b/server/test/shardVisibility.test.js
new file mode 100644
index 0000000..23f7815
--- /dev/null
+++ b/server/test/shardVisibility.test.js
@@ -0,0 +1,423 @@
+// Point the DB at a closed port BEFORE requiring anything that builds a pool.
+// Every DB call this suite would make is monkeypatched.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, after, afterEach, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+// Unit-test the visibility framework's INVARIANTS — the rules that make it a
+// security boundary rather than a convenience filter (docs/link/v3.md §3):
+//
+// 1. acct / webId are admin-only ALWAYS and cannot be configured down.
+// 2. A kind absent from KIND_FEATURE reaches nobody below admin (fail closed).
+// 3. The compiled defaults reproduce pre-v3 behavior, so installing this
+// module changes nothing until an admin edits the config.
+// 4. The ladder is ordered and each rung implies the ones below it.
+
+const visibility = require('../src/utils/shardVisibility')
+const model = require('../src/model/shardVisibility/shardVisibility.model')
+const shardLinks = require('../src/model/shardLinks/shardLinks.model')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+const originals = { listAll: model.listAll, listForUser: shardLinks.listForUser }
+
+// Default both DB reads to "no rows" so a test that doesn't care never blocks on
+// the dead pool (each such call would otherwise burn the 10s acquire timeout).
+// Tests that exercise stored config or a DB failure override these.
+beforeEach(() => {
+ model.listAll = async () => []
+ shardLinks.listForUser = async () => []
+ visibility.invalidate()
+})
+
+afterEach(() => {
+ model.listAll = originals.listAll
+ shardLinks.listForUser = originals.listForUser
+ visibility.invalidate()
+})
+
+// Stub the stored config; the framework merges rows over compiled defaults.
+function withRows(rows) {
+ model.listAll = async () => rows
+ visibility.invalidate()
+}
+
+// ── The ladder ─────────────────────────────────────────────────────────────
+
+test('ladder is ordered and each rung implies the ones below it', () => {
+ assert.deepEqual(visibility.LADDER, ['anonymous', 'logged_in', 'player', 'staff', 'admin'])
+ for (let i = 0; i < visibility.LADDER.length; i += 1) {
+ for (let j = 0; j <= i; j += 1) {
+ assert.equal(visibility.meets(visibility.LADDER[i], visibility.LADDER[j]), true)
+ }
+ for (let j = i + 1; j < visibility.LADDER.length; j += 1) {
+ assert.equal(visibility.meets(visibility.LADDER[i], visibility.LADDER[j]), false)
+ }
+ }
+})
+
+test('an unknown rung always loses, on BOTH sides of the comparison', () => {
+ assert.equal(visibility.isLevel('not-a-rung'), false)
+
+ // An unknown REQUIREMENT is satisfied by nobody below admin...
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ assert.equal(visibility.meets(level, 'not-a-rung'), false, `${level} vs unknown requirement`)
+ }
+ assert.equal(visibility.meets('admin', 'not-a-rung'), true)
+
+ // ...and an unknown VIEWER level grants nothing. This is the direction that
+ // matters: a shared admin fallback would have made a garbage viewer level
+ // pass every gate.
+ for (const required of visibility.LADDER.slice(1)) {
+ assert.equal(visibility.meets('not-a-rung', required), false, `unknown viewer vs ${required}`)
+ assert.equal(visibility.meets(undefined, required), false, `undefined viewer vs ${required}`)
+ assert.equal(visibility.meets(null, required), false, `null viewer vs ${required}`)
+ }
+})
+
+test('an unknown viewer level cannot see a gated kind or a locked field', async () => {
+ const config = await visibility.getConfig()
+ assert.equal(visibility.kindVisibleTo('champ.update', 'not-a-rung', config), true) // anonymous-tier: fine
+ assert.equal(visibility.kindVisibleTo('audit.command', 'not-a-rung', config), false)
+ const out = visibility.projectFeature(
+ 'guilds',
+ { leader: { name: 'Darrow', acct: 'whitlocktech', webId: '42' } },
+ 'not-a-rung',
+ config,
+ )
+ assert.equal('acct' in out.leader, false)
+ assert.equal('webId' in out.leader, false)
+})
+
+// ── Rule 1: locked fields ──────────────────────────────────────────────────
+
+test('acct and webId are stripped below admin regardless of feature config', () => {
+ const config = visibility.compileDefaults()
+ const frame = {
+ kind: 'guild.update',
+ name: 'The Nameless',
+ leader: { serial: '0x1A2B', name: 'Darrow', acct: 'whitlocktech', webId: '42', player: true },
+ }
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ const out = visibility.projectFeature('guilds', frame, level, config)
+ assert.equal(out.leader.name, 'Darrow', `${level} keeps the character name`)
+ assert.equal(out.leader.serial, '0x1A2B')
+ assert.equal('acct' in out.leader, false, `${level} must not see acct`)
+ assert.equal('webId' in out.leader, false, `${level} must not see webId`)
+ }
+ const asAdmin = visibility.projectFeature('guilds', frame, 'admin', config)
+ assert.equal(asAdmin.leader.acct, 'whitlocktech')
+ assert.equal(asAdmin.leader.webId, '42')
+})
+
+test('a stored rule trying to loosen a locked field is ignored', async () => {
+ withRows([
+ { feature: 'guilds', enabled: true, audience: 'anonymous', stream: true, fieldRules: { acct: 'anonymous', webId: 'anonymous' } },
+ ])
+ const config = await visibility.getConfig()
+ const out = visibility.projectFeature(
+ 'guilds',
+ { leader: { name: 'Darrow', acct: 'whitlocktech', webId: '42' } },
+ 'anonymous',
+ config,
+ )
+ assert.equal('acct' in out.leader, false)
+ assert.equal('webId' in out.leader, false)
+})
+
+test('rule 1 matches FLATTENED spellings, not just the two canonical keys', () => {
+ const config = visibility.compileDefaults()
+ // shapeHouse/shapeGuild flatten the actor into `Acct` / `WebId`.
+ // An exact-key check missed every one of these, which is how GET
+ // /public/shard/idoc served the owner's game account to anonymous callers.
+ const row = {
+ serial: '0x1',
+ name: 'Marble Tower',
+ ownerAcct: 'cadmus_acct',
+ leaderWebId: 42,
+ governorAcct: 'blackthorn_acct',
+ }
+ const out = visibility.projectFeature('houses', row, 'staff', config)
+ assert.equal('ownerAcct' in out, false, 'staff must not see a flattened acct')
+ assert.equal('leaderWebId' in out, false)
+ assert.equal('governorAcct' in out, false)
+ assert.equal(out.name, 'Marble Tower', 'ordinary fields are untouched')
+
+ const asAdmin = visibility.projectFeature('houses', row, 'admin', config)
+ assert.equal(asAdmin.ownerAcct, 'cadmus_acct')
+})
+
+// ── Protocol 3.0 leaderboards ──────────────────────────────────────────────
+//
+// The leaderboards field rule is spelled `name` because that is the key
+// points.board actually puts a ranked character's name under. v3.md §7.4 calls it
+// "characterName", which describes the meaning — and projectValue matches on the
+// literal key, so a rule under that spelling would have been silently inert. This
+// is the same failure mode §3.6.1 records for the flattened `ownerAcct`, and this
+// test is the guard on it: if someone renames the rule back, an admin who tightens
+// character names would get no enforcement and no error.
+test('a tightened leaderboards name rule actually strips ranked character names', async () => {
+ withRows([
+ { feature: 'leaderboards', enabled: true, audience: 'anonymous', stream: true, fieldRules: { name: 'logged_in' } },
+ ])
+ const config = await visibility.getConfig()
+ const board = {
+ system: 'QueensLoyalty',
+ nameString: "Queen's Loyalty",
+ top: [{ rank: 1, serial: '0x1A2B', name: 'Darrow', points: 29500 }],
+ }
+
+ const anon = visibility.projectFeature('leaderboards', board, 'anonymous', config)
+ assert.equal('name' in anon.top[0], false, 'anonymous must not see the ranked name')
+ assert.equal(anon.top[0].points, 29500, 'the rest of the entry survives')
+ // The BOARD's own display name is a different key and must not be caught by it.
+ assert.equal(anon.nameString, "Queen's Loyalty")
+
+ const member = visibility.projectFeature('leaderboards', board, 'logged_in', config)
+ assert.equal(member.top[0].name, 'Darrow')
+})
+
+// Default config: boards are public, exactly as v3.md §7 specifies.
+test('leaderboards are anonymous-visible by default, names included', () => {
+ const config = visibility.compileDefaults()
+ const out = visibility.projectFeature(
+ 'leaderboards',
+ { top: [{ rank: 1, name: 'Darrow', points: 1 }] },
+ 'anonymous',
+ config,
+ )
+ assert.equal(out.top[0].name, 'Darrow')
+ assert.equal(visibility.kindVisibleTo('points.board', 'anonymous', config), true)
+})
+
+test('isLockedField locks acct/webId and their suffixed forms, and nothing else', () => {
+ for (const key of ['acct', 'webId', 'WEBID', 'ownerAcct', 'leaderWebId', 'governorAcct']) {
+ assert.equal(visibility.isLockedField(key), true, `${key} must be locked`)
+ }
+ // Must not over-match: these are ordinary public fields.
+ for (const key of ['name', 'serial', 'ownerName', 'price', 'contact', 'region']) {
+ assert.equal(visibility.isLockedField(key), false, `${key} must stay configurable`)
+ }
+})
+
+test('a Date survives projection instead of collapsing to {}', () => {
+ const config = visibility.compileDefaults()
+ const when = new Date('2026-07-06T19:32:29.000Z')
+ // The DB-backed read models carry real Date columns; rebuilding one key-by-key
+ // yields `{}` because a Date has no enumerable own properties.
+ const out = visibility.projectFeature('houses', { name: 'Keep', updatedAt: when }, 'anonymous', config)
+ assert.ok(out.updatedAt instanceof Date)
+ assert.equal(out.updatedAt.toISOString(), when.toISOString())
+})
+
+test('visibleKinds tracks live config and stays independent of the stream flag', async () => {
+ const config = visibility.compileDefaults()
+ assert.ok(visibleIncludes(config, 'anonymous', 'guild.update'))
+ // `stream: false` suppresses SSE fan-out only — the stored history stays readable.
+ assert.ok(visibleIncludes(config, 'anonymous', 'vendor.listing'))
+ assert.equal(visibility.kindVisibleTo('vendor.listing', 'anonymous', config), false)
+
+ const gated = { ...config, guilds: { ...config.guilds, audience: 'staff' } }
+ assert.equal(visibleIncludes(gated, 'anonymous', 'guild.update'), false)
+ assert.ok(visibleIncludes(gated, 'staff', 'guild.update'))
+
+ const off = { ...config, guilds: { ...config.guilds, enabled: false } }
+ assert.equal(visibleIncludes(off, 'admin', 'guild.update'), false)
+ // Rule 2 still holds: an unmapped kind is in nobody's readable set.
+ assert.equal(visibleIncludes(config, 'admin', 'staff.audit'), false)
+})
+
+const visibleIncludes = (config, level, kind) => visibility.visibleKinds(level, config).includes(kind)
+
+test('projection recurses into arrays and nested actors', () => {
+ const config = visibility.compileDefaults()
+ const rows = [
+ { city: 'Britain', governor: { name: 'A', acct: 'a', webId: '1' } },
+ { city: 'Vesper', governor: { name: 'B', acct: 'b' } },
+ ]
+ const out = visibility.projectFeature('governors', rows, 'anonymous', config)
+ assert.equal(out.length, 2)
+ assert.equal(out[0].governor.name, 'A')
+ assert.equal('acct' in out[0].governor, false)
+ assert.equal('webId' in out[0].governor, false)
+ assert.equal('acct' in out[1].governor, false)
+})
+
+// ── Rule 2: fail closed on unmapped kinds ──────────────────────────────────
+
+test('an unmapped kind reaches nobody below admin', async () => {
+ const config = await visibility.getConfig()
+ for (const kind of ['audit.command', 'cheat.fastwalk', 'account.login.attempt', 'gold.change', 'made.up.kind']) {
+ for (const level of ['anonymous', 'logged_in', 'player', 'staff']) {
+ assert.equal(visibility.kindVisibleTo(kind, level, config), false, `${kind} @ ${level}`)
+ }
+ assert.equal(visibility.kindVisibleTo(kind, 'admin', config), true, `${kind} @ admin`)
+ }
+})
+
+test('the full house registry stays off the kind map (owner/price are staff-only)', () => {
+ assert.equal(visibility.KIND_FEATURE.has('house.update'), false)
+ assert.equal(visibility.KIND_FEATURE.has('house.remove'), false)
+ // house.decay — the IDOC signal the public page renders — IS mapped.
+ assert.equal(visibility.KIND_FEATURE.get('house.decay'), 'houses')
+})
+
+test('vendor.sale is not public (sales are owner-private)', async () => {
+ const config = await visibility.getConfig()
+ assert.equal(visibility.kindVisibleTo('vendor.sale', 'anonymous', config), false)
+ assert.equal(visibility.PUBLIC_KINDS.has('vendor.sale'), false)
+})
+
+// ── Rule 3: defaults reproduce pre-v3 behavior ─────────────────────────────
+
+// The exact allowlist that shipped in shardBroadcast.js before v3. If a change
+// makes the derived PUBLIC_KINDS differ from this, it is a deliberate widening
+// or narrowing of what anonymous visitors see and must be reviewed as such.
+const PRE_V3_PUBLIC_KINDS = [
+ 'player.death',
+ 'player.murdered',
+ 'mob.killed',
+ 'house.decay',
+ 'quest.complete',
+ 'skill.gain',
+ 'fame.change',
+ 'karma.change',
+ 'mob.login',
+ 'mob.logout',
+ 'economy.supply',
+ 'server.hello',
+ 'server.shutdown',
+ 'server.crashed',
+ 'champ.update',
+ 'champ.remove',
+ 'guild.update',
+ 'guild.remove',
+ 'guild.join',
+ 'city.update',
+ 'presence.online',
+ 'region.enter',
+]
+
+// The kinds v3 deliberately ADDS to the anonymous set. vendor.listing is
+// pointedly not among them (its feature ships with stream off).
+const V3_ADDED_PUBLIC_KINDS = ['world.ruleset', 'points.board']
+
+test('derived PUBLIC_KINDS is exactly the pre-v3 allowlist plus the v3 additions', () => {
+ assert.deepEqual(
+ [...visibility.PUBLIC_KINDS].sort(),
+ [...PRE_V3_PUBLIC_KINDS, ...V3_ADDED_PUBLIC_KINDS].sort(),
+ )
+})
+
+test('no pre-v3 public kind was dropped', () => {
+ for (const kind of PRE_V3_PUBLIC_KINDS) {
+ assert.equal(visibility.PUBLIC_KINDS.has(kind), true, `${kind} fell out of the public set`)
+ }
+})
+
+test('the market stream is off by default but its REST feature is not', async () => {
+ const config = await visibility.getConfig()
+ assert.equal(config.market.enabled, true)
+ assert.equal(config.market.audience, 'anonymous')
+ assert.equal(config.market.stream, false)
+ assert.equal(visibility.kindVisibleTo('vendor.listing', 'anonymous', config), false)
+ assert.equal(visibility.PUBLIC_KINDS.has('vendor.listing'), false)
+})
+
+test('presence location defaults to staff, matching the old admin/moderator gate', async () => {
+ const config = await visibility.getConfig()
+ assert.equal(config.presence.fields.location, 'staff')
+ assert.equal(visibility.meets('player', 'staff'), false)
+ assert.equal(visibility.meets('staff', 'staff'), true)
+})
+
+test('every mapped kind names a real feature', () => {
+ for (const [kind, feature] of visibility.KIND_FEATURE) {
+ assert.equal(visibility.isFeature(feature), true, `${kind} → unknown feature ${feature}`)
+ }
+})
+
+// ── Config merge ───────────────────────────────────────────────────────────
+
+test('a disabled feature is invisible to everyone below admin', async () => {
+ withRows([{ feature: 'champs', enabled: false, audience: 'anonymous', stream: true, fieldRules: {} }])
+ const config = await visibility.getConfig()
+ assert.equal(config.champs.enabled, false)
+ assert.equal(visibility.kindVisibleTo('champ.update', 'anonymous', config), false)
+ assert.equal(visibility.kindVisibleTo('champ.update', 'staff', config), false)
+ assert.equal(visibility.visibleFeatures('staff', config).includes('champs'), false)
+})
+
+test('raising a feature audience gates the lower rungs out', async () => {
+ withRows([{ feature: 'guilds', enabled: true, audience: 'player', stream: true, fieldRules: {} }])
+ const config = await visibility.getConfig()
+ assert.equal(visibility.kindVisibleTo('guild.update', 'anonymous', config), false)
+ assert.equal(visibility.kindVisibleTo('guild.update', 'logged_in', config), false)
+ assert.equal(visibility.kindVisibleTo('guild.update', 'player', config), true)
+ assert.equal(visibility.kindVisibleTo('guild.update', 'staff', config), true)
+})
+
+test('an unknown stored feature name is ignored, not resurrected', async () => {
+ withRows([{ feature: 'sekrit', enabled: true, audience: 'anonymous', stream: true, fieldRules: {} }])
+ const config = await visibility.getConfig()
+ assert.equal('sekrit' in config, false)
+ assert.deepEqual(Object.keys(config).sort(), [...visibility.FEATURE_NAMES].sort())
+})
+
+test('an invalid stored rung falls back to the default rather than failing open', async () => {
+ withRows([{ feature: 'houses', enabled: true, audience: 'nonsense', stream: true, fieldRules: { owner: 'nonsense' } }])
+ const config = await visibility.getConfig()
+ assert.equal(config.houses.audience, 'anonymous') // the compiled default
+ assert.equal(config.houses.fields.owner, 'staff') // the compiled default
+})
+
+test('a DB failure degrades to compiled defaults, not to everything-public', async () => {
+ model.listAll = async () => {
+ throw new Error('db down')
+ }
+ visibility.invalidate()
+ const config = await visibility.getConfig()
+ assert.deepEqual(Object.keys(config).sort(), [...visibility.FEATURE_NAMES].sort())
+ assert.equal(config.presence.fields.location, 'staff')
+ assert.equal(visibility.kindVisibleTo('audit.command', 'anonymous', config), false)
+})
+
+// ── Viewer level ───────────────────────────────────────────────────────────
+
+test('viewerLevel resolves the ladder from role and link status', async () => {
+ shardLinks.listForUser = async () => []
+ assert.equal(await visibility.viewerLevel({}), 'anonymous')
+
+ visibility.forgetUser(1)
+ assert.equal(await visibility.viewerLevel({ user: { id: 1, role: 'admin' } }), 'admin')
+ visibility.forgetUser(2)
+ assert.equal(await visibility.viewerLevel({ user: { id: 2, role: 'moderator' } }), 'staff')
+
+ // A member with no linked game account sits at logged_in...
+ visibility.forgetUser(3)
+ assert.equal(await visibility.viewerLevel({ user: { id: 3, role: 'player' } }), 'logged_in')
+
+ // ...and reaches `player` once a link exists.
+ shardLinks.listForUser = async () => [{ account: 'whitlocktech' }]
+ visibility.forgetUser(4)
+ assert.equal(await visibility.viewerLevel({ user: { id: 4, role: 'player' } }), 'player')
+})
+
+test('editor is a content role and gets no shard privilege', async () => {
+ // Mapping editor to `staff` here would silently widen what editors can see;
+ // today's modAccess gate is admin|moderator only.
+ shardLinks.listForUser = async () => []
+ visibility.forgetUser(5)
+ assert.equal(await visibility.viewerLevel({ user: { id: 5, role: 'editor' } }), 'logged_in')
+})
+
+test('a link lookup failure downgrades rather than escalating', async () => {
+ shardLinks.listForUser = async () => {
+ throw new Error('db down')
+ }
+ visibility.forgetUser(6)
+ assert.equal(await visibility.viewerLevel({ user: { id: 6, role: 'player' } }), 'logged_in')
+})
diff --git a/server/test/spawnAtlas.parse.test.js b/server/test/spawnAtlas.parse.test.js
new file mode 100644
index 0000000..bafa252
--- /dev/null
+++ b/server/test/spawnAtlas.parse.test.js
@@ -0,0 +1,601 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const {
+ parseXml,
+ parseObjects2,
+ parsePoints,
+ parseRegions,
+ parseLocations,
+ parseChampions,
+ buildPlacementIndex,
+ resolveRegion,
+ facetKey,
+ buildFacetIndex,
+ resolveFacetName,
+ slugify,
+ decodeEntities,
+} = require('../src/utils/spawnAtlasParse')
+
+// These parsers are pure and fs-free precisely so this suite can run in CI,
+// where there is no ServUO tree. Every fixture below is a literal excerpt of a
+// real shard file, trimmed — not invented shapes.
+
+// ── parseObjects2 ──────────────────────────────────────────────────────────
+
+test('parseObjects2: single type', () => {
+ const types = parseObjects2('Jacob:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1')
+ assert.deepEqual(types, [{ type: 'Jacob', max: 1 }])
+})
+
+test('parseObjects2: splits six types on :OBJ= and keeps each MX', () => {
+ // Verbatim from trammel.xml — the case that a naive split(':') destroys.
+ const raw =
+ 'Gazer:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1' +
+ ':OBJ=Giantspider:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1' +
+ ':OBJ=Harpy:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1' +
+ ':OBJ=Headlessone:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1' +
+ ':OBJ=Lizardman:MX=3:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1' +
+ ':OBJ=Mongbat:MX=1:SB=0:RT=0:TO=0:KL=0:RK=0:CA=1:DN=-1:DX=-1:SP=1:PR=-1'
+ const types = parseObjects2(raw)
+ assert.equal(types.length, 6)
+ assert.deepEqual(
+ types.map((t) => t.type),
+ ['Gazer', 'Giantspider', 'Harpy', 'Headlessone', 'Lizardman', 'Mongbat'],
+ )
+ // MX is per type, not per spawner: the lizardman entry carries 3.
+ assert.equal(types.find((t) => t.type === 'Lizardman').max, 3)
+ assert.equal(types.find((t) => t.type === 'Gazer').max, 1)
+})
+
+test('parseObjects2: empty and whitespace values yield no types', () => {
+ assert.deepEqual(parseObjects2(''), [])
+ assert.deepEqual(parseObjects2(' '), [])
+ assert.deepEqual(parseObjects2(null), [])
+ assert.deepEqual(parseObjects2(undefined), [])
+})
+
+test('parseObjects2: strips XmlSpawner property directives after "/"', () => {
+ // Left in place these become creatures that do not exist.
+ assert.deepEqual(parseObjects2('Agralem/Name/Agralem:MX=1'), [{ type: 'Agralem', max: 1 }])
+ assert.deepEqual(parseObjects2('alchemist/z/-50:MX=1'), [{ type: 'alchemist', max: 1 }])
+ assert.deepEqual(parseObjects2('GargishRefugee/hue/34532'), [
+ { type: 'GargishRefugee', max: 1 },
+ ])
+})
+
+test('parseObjects2: strips argument lists after ","', () => {
+ assert.deepEqual(parseObjects2('Fairy,{RND,4,8}:MX=1'), [{ type: 'Fairy', max: 1 }])
+ assert.deepEqual(parseObjects2('GargishRouser,1'), [{ type: 'GargishRouser', max: 1 }])
+ assert.deepEqual(parseObjects2('greatape,true'), [{ type: 'greatape', max: 1 }])
+})
+
+test('parseObjects2: a directive-laden token slugs the same as the bare one', () => {
+ // The bug this closes: `Fairy` and `Fairy,{RND,4,8}` slugged apart and showed
+ // as two different creatures on the same page.
+ const bare = parseObjects2('Fairy:MX=1')[0]
+ const decorated = parseObjects2('Fairy,{RND,4,8}:MX=1')[0]
+ assert.equal(slugify(decorated.type), slugify(bare.type))
+})
+
+test('parseObjects2: strips a long EQUIP directive chain containing "<" and ">"', () => {
+ const raw =
+ 'xmlquestnpc/UNEQUIP,Innertorso/UNEQUIP,MiddleTorso/EQUIP//blessed/true/name/lord blackthorne/z/:MX=1'
+ assert.deepEqual(parseObjects2(raw), [{ type: 'xmlquestnpc', max: 1 }])
+})
+
+test('parseObjects2: a token that is only a directive yields nothing', () => {
+ assert.deepEqual(parseObjects2('/Name/Foo:MX=1'), [])
+ assert.deepEqual(parseObjects2(',1:MX=1'), [])
+})
+
+test('parseObjects2: a type with no MX token defaults to 1', () => {
+ assert.deepEqual(parseObjects2('Orc'), [{ type: 'Orc', max: 1 }])
+ assert.deepEqual(parseObjects2('Orc:SB=0:RT=0'), [{ type: 'Orc', max: 1 }])
+})
+
+// ── parsePoints ────────────────────────────────────────────────────────────
+
+const POINTS_XML = `
+
+ CovetousSpawner26
+ 001a34e5-0efa-46de-9c93-b6a163d96370
+ Trammel
+ 5412
+ 1970
+ 10
+ 10
+ 5
+ 3
+ 5
+ 10
+ 500
+ 0
+ 0
+ 0
+ True
+ Lizardman:MX=3:SB=0
+
+
+ Disabled
+ Felucca
+ 100
+ 200
+ 1
+ False
+ Orc:MX=1
+
+ `
+
+test('parsePoints: reads the kept fields and drops the rest', () => {
+ const points = parsePoints(POINTS_XML)
+ assert.equal(points.length, 2)
+ const covetous = points[0]
+ assert.equal(covetous.name, 'CovetousSpawner26')
+ assert.equal(covetous.facet, 'Trammel')
+ assert.equal(covetous.x, 5412)
+ assert.equal(covetous.y, 1970)
+ assert.equal(covetous.width, 10)
+ assert.equal(covetous.range, 5)
+ assert.equal(covetous.maxCount, 3)
+ // Delays are normalised to seconds; this record carries no DelayInSec, which
+ // means minutes.
+ assert.equal(covetous.minDelay, 300)
+ assert.equal(covetous.maxDelay, 600)
+ assert.deepEqual(covetous.types, [{ type: 'Lizardman', max: 3 }])
+ // Dropped fields must not survive into the artifact — this is what keeps it
+ // under 1 MB.
+ assert.equal(covetous.uniqueId, undefined)
+ assert.equal(covetous.proximityTriggerSound, undefined)
+})
+
+test('parsePoints: IsRunning is parsed so the build can drop dead spawners', () => {
+ const points = parsePoints(POINTS_XML)
+ assert.equal(points[0].running, true)
+ assert.equal(points[1].running, false)
+})
+
+test('parsePoints: facet comes from , never the file name', () => {
+ // Eodon.xml holds TerMur points; a file-name assumption would mislabel every
+ // one of them.
+ const points = parsePoints(
+ 'a TerMur 1 2 ',
+ )
+ assert.equal(points[0].facet, 'TerMur')
+})
+
+test('parsePoints: a record with no is skipped rather than misfiled', () => {
+ const points = parsePoints('a 1 2 ')
+ assert.deepEqual(points, [])
+})
+
+test('parsePoints: empty document yields no points', () => {
+ assert.deepEqual(parsePoints(' '), [])
+ assert.deepEqual(parsePoints(''), [])
+})
+
+// ── parseRegions ───────────────────────────────────────────────────────────
+
+const REGIONS_XML = `
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ `
+
+test('parseRegions: flattens nested regions and collects rects', () => {
+ const regions = parseRegions(REGIONS_XML)
+ const byName = new Map(regions.map((r) => [r.name, r]))
+ assert.ok(byName.has('Moongates'))
+ assert.ok(byName.has('Prism of Light'))
+ assert.equal(byName.get('Moongates').rects.length, 2)
+ assert.deepEqual(byName.get('Moongates').rects[0], {
+ x: 1330,
+ y: 1991,
+ width: 13,
+ height: 13,
+ })
+ assert.equal(byName.get('Moongates').facet, 'Felucca')
+ assert.equal(byName.get('Moongates').type, 'GuardedRegion')
+})
+
+test('parseRegions: a nested child records its parent', () => {
+ const regions = parseRegions(REGIONS_XML)
+ const crystal = regions.find((r) => r.name === 'Crystal Field')
+ assert.ok(crystal, 'the nested named region should be indexed')
+ assert.equal(crystal.parent, 'Prism of Light')
+ assert.equal(crystal.facet, 'Felucca')
+})
+
+test('parseRegions: a child with no priority inherits its parent', () => {
+ // Defaulting to 0 instead would sort this specific room below every
+ // top-level region that contains it.
+ const crystal = parseRegions(REGIONS_XML).find((r) => r.name === 'Crystal Field')
+ assert.equal(crystal.priority, 50)
+})
+
+test('parseRegions: unnamed regions are skipped but still walked', () => {
+ const regions = parseRegions(REGIONS_XML)
+ // IcyRiver has a type but no name — it cannot label anything.
+ assert.equal(regions.some((r) => r.type === 'IcyRiver'), false)
+})
+
+test('parseRegions: a named region with no rects is not indexed', () => {
+ // It can never contain a point, so indexing it only costs scan time.
+ assert.equal(parseRegions(REGIONS_XML).some((r) => r.name === 'Music Only'), false)
+})
+
+// ── parseLocations ─────────────────────────────────────────────────────────
+
+const LOCATIONS_XML = `
+
+
+
+
+
+
+
+
+
+
+
+
+ `
+
+test('parseLocations: flattens to points carrying their group', () => {
+ const landmarks = parseLocations(LOCATIONS_XML)
+ assert.equal(landmarks.length, 3)
+ const level1 = landmarks.find((l) => l.name === 'Level 1')
+ assert.equal(level1.x, 5456)
+ assert.equal(level1.y, 1863)
+ assert.equal(level1.z, 0)
+ assert.equal(level1.facet, 'Trammel')
+ // "Covetous" is the useful label, not "Level 1".
+ assert.equal(level1.group, 'Covetous')
+ // The facet-level parent is dropped from the path.
+ assert.deepEqual(level1.path, ['Dungeons', 'Covetous'])
+})
+
+// ── Facet canonicalisation ─────────────────────────────────────────────────
+
+// Facets are NOT a fixed list — a shard may add, replace or rename them when its
+// maps are updated, so nothing may hardcode the stock six. Reconciliation is by
+// matching against whatever the shard's own files declare.
+
+test('facetKey: collapses spelling differences to one key', () => {
+ assert.equal(facetKey('Ter Mur'), facetKey('TerMur'))
+ assert.equal(facetKey('ter-mur'), facetKey('TerMur'))
+ assert.equal(facetKey('Felucca'), 'felucca')
+ assert.equal(facetKey(''), '')
+ assert.equal(facetKey(null), '')
+})
+
+test('facetKey: distinct facets keep distinct keys', () => {
+ assert.notEqual(facetKey('Felucca'), facetKey('Trammel'))
+})
+
+test('resolveFacetName: matches a loose spelling to the discovered canonical', () => {
+ // The canonical set comes from the shard's own spawn/region data, not a table.
+ const index = buildFacetIndex(['TerMur', 'Tokuno', 'Felucca'])
+ assert.equal(resolveFacetName('Ter Mur', index), 'TerMur')
+ assert.equal(resolveFacetName('Tokuno Islands', index), 'Tokuno')
+ assert.equal(resolveFacetName('felucca', index), 'Felucca')
+})
+
+test('resolveFacetName: works for facets that do not exist in stock UO', () => {
+ // The whole point: a shard running its own maps gets the same treatment as
+ // the stock ones, with no entry anywhere naming them.
+ const index = buildFacetIndex(['Sosaria', 'The Underdark'])
+ assert.equal(resolveFacetName('sosaria', index), 'Sosaria')
+ assert.equal(resolveFacetName('The Underdark', index), 'The Underdark')
+ assert.equal(resolveFacetName('the-underdark', index), 'The Underdark')
+ // Same shape as the real `Tokuno Islands` → `Tokuno` case.
+ assert.equal(resolveFacetName('Sosaria Isles', index), 'Sosaria')
+})
+
+test('resolveFacetName: a merely similar name is NOT forced to match', () => {
+ // "Underdark Isles" is not a prefix of "The Underdark" in either direction.
+ // Keeping its own name is right — a wrong match would silently file a real
+ // custom facet's landmarks under the wrong facet.
+ const index = buildFacetIndex(['The Underdark'])
+ assert.equal(resolveFacetName('Underdark Isles', index), 'Underdark Isles')
+})
+
+test('resolveFacetName: prefers the longer match when several could prefix', () => {
+ const index = buildFacetIndex(['Tokuno', 'TokunoDeep'])
+ assert.equal(resolveFacetName('TokunoDeep Reaches', index), 'TokunoDeep')
+})
+
+test('resolveFacetName: an unmatched facet keeps its own name', () => {
+ // Inventing a match would be worse than leaving a real custom facet alone.
+ const index = buildFacetIndex(['Felucca'])
+ assert.equal(resolveFacetName('Ilshenar', index), 'Ilshenar')
+ assert.equal(resolveFacetName('', index), '')
+ assert.equal(resolveFacetName(null, index), '')
+})
+
+test('buildFacetIndex: first spelling wins and is stable', () => {
+ const index = buildFacetIndex(['TerMur', 'Ter Mur', 'ter-mur'])
+ assert.equal(index.size, 1)
+ assert.equal(resolveFacetName('Ter Mur', index), 'TerMur')
+})
+
+test('parsePoints and parseRegions report facet names verbatim', () => {
+ // and are the authority; they are never rewritten.
+ const points = parsePoints(
+ 'a Sosaria 1 2 ',
+ )
+ assert.equal(points[0].facet, 'Sosaria')
+ const regions = parseRegions(
+ '' +
+ ' ',
+ )
+ assert.equal(regions[0].facet, 'Sosaria')
+})
+
+test('placement index buckets two spellings of one facet together', () => {
+ // This is the bug the key exists to prevent: unreconciled, the landmark bucket
+ // is keyed apart from the points looking it up, the fallback never fires, and
+ // every unregioned spawn on that facet silently reads "Wilderness".
+ const index = buildPlacementIndex(
+ [],
+ [{ facet: 'Ter Mur', name: 'Bank', group: 'Holy City', path: [], x: 1000, y: 1000, z: 0 }],
+ )
+ assert.equal(resolveRegion(1000, 1000, 'TerMur', index).landmark, 'Holy City')
+})
+
+// ── parseChampions ─────────────────────────────────────────────────────────
+
+const CHAMPIONS_XML = `
+
+
+
+
+
+
+
+
+ `
+
+test('parseChampions: reads altar name, type and location', () => {
+ const champs = parseChampions(CHAMPIONS_XML)
+ assert.equal(champs.length, 2)
+ assert.deepEqual(champs[0], {
+ name: 'Deceit',
+ group: 'FelDungeons',
+ type: 'UnholyTerror',
+ randomType: false,
+ facet: 'Felucca',
+ x: 5178,
+ y: 708,
+ z: 20,
+ radius: 60,
+ })
+})
+
+test('parseChampions: a spawn with no type is flagged random, not blank', () => {
+ const champs = parseChampions(CHAMPIONS_XML)
+ assert.equal(champs[1].randomType, true)
+ assert.equal(champs[1].type, '')
+})
+
+// ── resolveRegion ──────────────────────────────────────────────────────────
+
+function fixtureIndex() {
+ const regions = [
+ {
+ facet: 'Felucca',
+ name: 'Britain',
+ type: 'TownRegion',
+ priority: 10,
+ parent: null,
+ rects: [{ x: 1000, y: 1000, width: 500, height: 500 }],
+ },
+ {
+ facet: 'Felucca',
+ name: 'Britain Bank',
+ type: 'TownRegion',
+ priority: 50,
+ parent: 'Britain',
+ rects: [{ x: 1400, y: 1400, width: 20, height: 20 }],
+ },
+ {
+ facet: 'Felucca',
+ name: 'Wide Low Priority',
+ type: 'TownRegion',
+ priority: 10,
+ parent: null,
+ rects: [{ x: 1000, y: 1000, width: 2000, height: 2000 }],
+ },
+ ]
+ const landmarks = [
+ { facet: 'Felucca', name: 'Level 1', group: 'Covetous', path: [], x: 5000, y: 5000, z: 0 },
+ { facet: 'Felucca', name: 'Far Away', group: 'Vesper', path: [], x: 9000, y: 9000, z: 0 },
+ ]
+ return buildPlacementIndex(regions, landmarks)
+}
+
+test('resolveRegion: a contained point takes the region name', () => {
+ const result = resolveRegion(1100, 1100, 'Felucca', fixtureIndex())
+ assert.equal(result.region, 'Britain')
+ assert.equal(result.label, 'Britain')
+ assert.equal(result.landmark, null)
+})
+
+test('resolveRegion: higher priority wins over a containing region', () => {
+ const result = resolveRegion(1410, 1410, 'Felucca', fixtureIndex())
+ assert.equal(result.region, 'Britain Bank')
+})
+
+test('resolveRegion: equal priority breaks toward the smaller rect', () => {
+ // Both "Britain" (500x500) and "Wide Low Priority" (2000x2000) contain this
+ // point at priority 10; the specific one must win.
+ const result = resolveRegion(1200, 1200, 'Felucca', fixtureIndex())
+ assert.equal(result.region, 'Britain')
+})
+
+test('resolveRegion: rects are half-open — the far edge is outside', () => {
+ const index = fixtureIndex()
+ // Britain spans x 1000..1499. 1499 is in, 1500 belongs to the next region.
+ assert.equal(resolveRegion(1499, 1499, 'Felucca', index).region, 'Britain')
+ assert.equal(resolveRegion(1500, 1500, 'Felucca', index).region, 'Wide Low Priority')
+})
+
+test('resolveRegion: falls back to the nearest landmark group', () => {
+ const result = resolveRegion(5050, 5050, 'Felucca', fixtureIndex())
+ assert.equal(result.region, null)
+ assert.equal(result.landmark, 'Covetous')
+ assert.equal(result.label, 'Covetous')
+})
+
+test('resolveRegion: a landmark beyond the radius yields Wilderness', () => {
+ // Without the radius cap the nearest landmark is always *some* landmark, and
+ // open countryside would get labelled with a dungeon across the map.
+ const result = resolveRegion(7000, 7000, 'Felucca', fixtureIndex())
+ assert.equal(result.landmark, null)
+ assert.equal(result.label, 'Wilderness')
+})
+
+test('resolveRegion: the radius is configurable', () => {
+ const wide = resolveRegion(7000, 7000, 'Felucca', fixtureIndex(), { landmarkRadius: 5000 })
+ assert.equal(wide.label, 'Covetous')
+})
+
+test('resolveRegion: an unknown facet degrades to Wilderness, not a throw', () => {
+ const result = resolveRegion(1100, 1100, 'Malas', fixtureIndex())
+ assert.equal(result.label, 'Wilderness')
+ assert.equal(result.region, null)
+})
+
+test('resolveRegion: does not leak across facets', () => {
+ const index = buildPlacementIndex(
+ [
+ {
+ facet: 'Trammel',
+ name: 'Britain',
+ type: 'TownRegion',
+ priority: 10,
+ parent: null,
+ rects: [{ x: 1000, y: 1000, width: 500, height: 500 }],
+ },
+ ],
+ [],
+ )
+ assert.equal(resolveRegion(1100, 1100, 'Trammel', index).region, 'Britain')
+ assert.equal(resolveRegion(1100, 1100, 'Felucca', index).region, null)
+})
+
+// ── Tokenizer edge cases ───────────────────────────────────────────────────
+
+test('parseXml: skips comments, declarations and DOCTYPE', () => {
+ const root = parseXml(
+ ' ',
+ )
+ assert.equal(root.name, 'r')
+ assert.equal(root.children.length, 1)
+ assert.equal(root.children[0].name, 'a')
+ assert.equal(root.children[0].attrs.x, '1')
+})
+
+test('parseXml: a ">" inside an attribute value does not end the tag', () => {
+ const root = parseXml(' ')
+ assert.equal(root.children[0].attrs.name, '1 > 0')
+ assert.equal(root.children[0].attrs.b, '2')
+})
+
+test('parseXml: single-quoted attributes are read', () => {
+ const root = parseXml(" ")
+ assert.equal(root.children[0].attrs.name, 'Mondain')
+})
+
+test('parseXml: a stray closing tag is ignored, not fatal', () => {
+ // Hand-maintained shard config: one malformed element should degrade to a
+ // missing element, not abort an otherwise good build.
+ const root = parseXml(' ')
+ assert.equal(root.name, 'r')
+ assert.deepEqual(root.children.map((n) => n.name), ['a', 'c'])
+})
+
+test('parseXml: empty or element-free input yields null', () => {
+ assert.equal(parseXml(''), null)
+ assert.equal(parseXml(''), null)
+})
+
+test('decodeEntities: named, numeric and hex refs', () => {
+ assert.equal(decodeEntities("Mondain's Legacy"), "Mondain's Legacy")
+ assert.equal(decodeEntities('a & b'), 'a & b')
+ assert.equal(decodeEntities('<tag>'), '')
+ assert.equal(decodeEntities('AB'), 'AB')
+ // An unknown entity is left alone rather than silently eaten.
+ assert.equal(decodeEntities('&nosuch;'), '&nosuch;')
+})
+
+test('parseXml: decodes entities in attribute values', () => {
+ const root = parseXml(' ')
+ assert.equal(root.children[0].attrs.name, "Mondain's Legacy")
+})
+
+// ── slugify ────────────────────────────────────────────────────────────────
+
+test('slugify: produces URL-safe keys', () => {
+ assert.equal(slugify('Lizardman'), 'lizardman')
+ assert.equal(slugify('Giant Spider'), 'giant-spider')
+ assert.equal(slugify("Mondain's Legacy"), 'mondain-s-legacy')
+ assert.equal(slugify(' Orc '), 'orc')
+})
+
+// ── Respawn delays: the unit is per record ──────────────────────────────────
+// XmlSpawner writes minutes by default and switches to seconds only when a
+// delay does not divide into whole minutes, flagged by DelayInSec. `5` therefore
+// means five MINUTES on one spawner and five SECONDS on the next, and a reader
+// assuming either unit is wrong about the other — silently, since both are
+// plausible respawn times.
+const DELAY_XML = `
+
+ Minutes
+ Sosaria
+ 1 1
+ 5
+ 10
+ True
+ Orc:MX=1
+
+
+ Seconds
+ Sosaria
+ 2 2
+ True
+ 5
+ 10
+ True
+ Orc:MX=1
+
+ `
+
+test('parsePoints: DelayInSec decides the unit, and both come out in seconds', () => {
+ const [minutes, seconds] = parsePoints(DELAY_XML)
+ assert.equal(minutes.minDelay, 300)
+ assert.equal(minutes.maxDelay, 600)
+ assert.equal(seconds.minDelay, 5)
+ assert.equal(seconds.maxDelay, 10)
+})
diff --git a/server/test/spawnAtlas.source.test.js b/server/test/spawnAtlas.source.test.js
new file mode 100644
index 0000000..76df7ed
--- /dev/null
+++ b/server/test/spawnAtlas.source.test.js
@@ -0,0 +1,396 @@
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+const { test, after, beforeEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const {
+ AtlasSourceError,
+ aggregateCreatures,
+ displayName,
+ sameSources,
+ hashSources,
+ buildAtlas,
+ PARSER_VERSION,
+} = require('../src/utils/spawnAtlasSource')
+const shardAtlas = require('../src/model/shardAtlas/shardAtlas.model')
+const atlasDb = require('../src/model/shardAtlas/shardAtlas.db')
+const settings = require('../src/model/settings/settings.model')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+// ── A tiny synthetic ServUO tree ───────────────────────────────────────────
+//
+// Deliberately uses facets that do NOT exist in stock UO. The atlas must not
+// contain a built-in facet list anywhere: a shard may add facets, replace them
+// outright, or rename them when its maps are updated, and everything has to keep
+// working with no code change.
+
+function writeTree(root, { facets = ['Sosaria'], includeChampions = true } = {}) {
+ fs.mkdirSync(path.join(root, 'Spawns'), { recursive: true })
+ fs.mkdirSync(path.join(root, 'Data', 'Locations'), { recursive: true })
+ fs.mkdirSync(path.join(root, 'Config'), { recursive: true })
+
+ for (const facet of facets) {
+ fs.writeFileSync(
+ path.join(root, 'Spawns', `${facet}.xml`),
+ `
+ ${facet}A ${facet} 1100 1100
+ 3 True
+ Lizardman:MX=3:SB=0:OBJ=Orc:MX=1:SB=0
+ ${facet}B ${facet} 9000 9000
+ 1 True
+ lizardman:MX=2:SB=0
+ ${facet}Off ${facet} 1 1
+ 1 False
+ Ghost:MX=1
+ `,
+ 'utf8',
+ )
+ // The location file names its facet differently from , the real
+ // `Ter Mur` / `Tokuno Islands` drift.
+ fs.writeFileSync(
+ path.join(root, 'Data', 'Locations', `${facet.toLowerCase()}.xml`),
+ `
+ `,
+ 'utf8',
+ )
+ }
+
+ fs.writeFileSync(
+ path.join(root, 'Data', 'Regions.xml'),
+ `${facets
+ .map(
+ (facet) => `
+
+
+ `,
+ )
+ .join('')} `,
+ 'utf8',
+ )
+
+ if (includeChampions) {
+ fs.writeFileSync(
+ path.join(root, 'Config', 'ChampionSpawns.xml'),
+ `
+
+ `,
+ 'utf8',
+ )
+ }
+}
+
+function tempTree(options) {
+ const root = fs.mkdtempSync(path.join(os.tmpdir(), 'atlas-test-'))
+ writeTree(root, options)
+ return root
+}
+
+// ── buildAtlas against a custom-facet tree ─────────────────────────────────
+
+test('buildAtlas: works entirely on facets that do not exist in stock UO', () => {
+ const root = tempTree({ facets: ['Sosaria', 'Underdark'] })
+ const atlas = buildAtlas(root)
+ assert.deepEqual(atlas.facets, ['Sosaria', 'Underdark'])
+ assert.equal(atlas.meta.counts.facets, 2)
+})
+
+test('buildAtlas: reconciles a location file that spells the facet differently', () => {
+ // "Sosaria Isles" inside the file vs Sosaria — the same drift that
+ // silently emptied the Ter Mur / Tokuno landmark buckets.
+ const root = tempTree({ facets: ['Sosaria'] })
+ const atlas = buildAtlas(root)
+ assert.deepEqual([...new Set(atlas.landmarks.map((l) => l.facet))], ['Sosaria'])
+ // And the fallback actually fires, rather than the point reading Wilderness.
+ const far = atlas.points.find((p) => p.name === 'SosariaB')
+ assert.equal(far.landmark, 'Deep Cave')
+ assert.equal(far.label, 'Deep Cave')
+})
+
+test('buildAtlas: resolves a contained point to its region', () => {
+ const atlas = buildAtlas(tempTree({ facets: ['Sosaria'] }))
+ const inCity = atlas.points.find((p) => p.name === 'SosariaA')
+ assert.equal(inCity.region, 'Sosaria City')
+ assert.equal(inCity.label, 'Sosaria City')
+})
+
+test('buildAtlas: drops spawners that are switched off in-world', () => {
+ const atlas = buildAtlas(tempTree({ facets: ['Sosaria'] }))
+ assert.equal(atlas.points.some((p) => p.name === 'SosariaOff'), false)
+ assert.equal(atlas.meta.counts.pointsDisabled, 1)
+})
+
+test('buildAtlas: a champion altar resolves through the same placement index', () => {
+ const atlas = buildAtlas(tempTree({ facets: ['Sosaria'] }))
+ assert.equal(atlas.champions[0].label, 'Sosaria City')
+ assert.equal(atlas.champions[0].facet, 'Sosaria')
+})
+
+test('buildAtlas: a tree with no champion file still builds', () => {
+ const atlas = buildAtlas(tempTree({ facets: ['Sosaria'], includeChampions: false }))
+ assert.deepEqual(atlas.champions, [])
+})
+
+test('buildAtlas: missing path and empty path raise typed errors', () => {
+ assert.throws(() => buildAtlas(''), (err) => err instanceof AtlasSourceError && err.code === 'NO_PATH')
+ assert.throws(
+ () => buildAtlas(path.join(os.tmpdir(), 'definitely-not-a-servuo-tree-xyz')),
+ (err) => err instanceof AtlasSourceError && err.code === 'NOT_FOUND',
+ )
+})
+
+test('buildAtlas: a directory with no spawn files raises rather than building empty', () => {
+ const root = fs.mkdtempSync(path.join(os.tmpdir(), 'atlas-empty-'))
+ fs.mkdirSync(path.join(root, 'Data'), { recursive: true })
+ fs.writeFileSync(path.join(root, 'Data', 'Regions.xml'), ' ', 'utf8')
+ assert.throws(() => buildAtlas(root), (err) => err.code === 'NO_SPAWNS')
+})
+
+// ── Hashing ────────────────────────────────────────────────────────────────
+
+test('hashSources: stable across reads, changes when a file changes', () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ const first = hashSources(root)
+ assert.ok(sameSources(first, hashSources(root)))
+
+ fs.appendFileSync(path.join(root, 'Spawns', 'Sosaria.xml'), '', 'utf8')
+ assert.equal(sameSources(first, hashSources(root)), false)
+})
+
+test('sameSources: a missing or extra file is a difference', () => {
+ assert.equal(sameSources({ a: '1' }, { a: '1', b: '2' }), false)
+ assert.equal(sameSources({ a: '1' }, { a: '2' }), false)
+ assert.equal(sameSources({ a: '1' }, { a: '1' }), true)
+ assert.equal(sameSources(null, { a: '1' }), false)
+ assert.equal(sameSources({ a: '1' }, null), false)
+})
+
+// ── Aggregation ────────────────────────────────────────────────────────────
+
+const POINTS = [
+ { facet: 'Sosaria', types: [{ type: 'Lizardman', max: 3 }, { type: 'Orc', max: 1 }] },
+ { facet: 'Sosaria', types: [{ type: 'Lizardman', max: 2 }] },
+ { facet: 'Underdark', types: [{ type: 'lizardman', max: 5 }] },
+]
+
+test('aggregateCreatures: sums each type’s own max and counts per facet', () => {
+ const lizardman = aggregateCreatures(POINTS).find((c) => c.slug === 'lizardman')
+ assert.equal(lizardman.total, 10)
+ assert.equal(lizardman.points, 3)
+ assert.deepEqual(lizardman.facets, { Sosaria: 2, Underdark: 1 })
+})
+
+test('aggregateCreatures: differing case collapses to one creature', () => {
+ const creatures = aggregateCreatures(POINTS)
+ assert.equal(creatures.filter((c) => c.slug === 'lizardman').length, 1)
+ assert.deepEqual(creatures.map((c) => c.slug), ['lizardman', 'orc'])
+ assert.equal(Object.hasOwn(creatures[0], 'spellings'), false)
+})
+
+test('displayName: most common wins, ties break to the capitalised form', () => {
+ assert.equal(displayName(new Map([['lizardman', 9], ['Lizardman', 2]])), 'lizardman')
+ assert.equal(displayName(new Map([['lizardman', 5], ['Lizardman', 5]])), 'Lizardman')
+ // Deterministic regardless of insertion order — a committed artifact is gone,
+ // but a spurious diff in the DB on every restart would be just as wrong.
+ assert.equal(
+ displayName(new Map([['abc', 1], ['abd', 1]])),
+ displayName(new Map([['abd', 1], ['abc', 1]])),
+ )
+})
+
+test('pointTypeRows: collapses a repeated type to the larger max', () => {
+ // The primary key is (point_id, slug), so a duplicate would otherwise fail the
+ // insert and take the whole transaction with it.
+ const rows = shardAtlas.pointTypeRows([
+ { types: [{ type: 'Orc', max: 1 }, { type: 'orc', max: 4 }, { type: 'Rat', max: 2 }] },
+ ])
+ assert.deepEqual(rows.sort(), [[1, 'orc', 4], [1, 'rat', 2]].sort())
+})
+
+test('pointTypeRows: point ids are 1-based and line up with insert order', () => {
+ const rows = shardAtlas.pointTypeRows([
+ { types: [{ type: 'A', max: 1 }] },
+ { types: [{ type: 'B', max: 1 }] },
+ ])
+ assert.deepEqual(rows, [[1, 'a', 1], [2, 'b', 1]])
+})
+
+// ── The refresh decision ───────────────────────────────────────────────────
+//
+// The boot path's two contracts: it never blocks startup, and it never applies a
+// facet removal on its own.
+
+let applied
+let pendingRow
+let facetsInDb
+let metaRow
+
+beforeEach(() => {
+ applied = null
+ pendingRow = null
+ facetsInDb = []
+ metaRow = null
+ atlasDb.replaceAtlas = async (atlas) => {
+ applied = atlas
+ return { points: atlas.points.length, creatures: atlas.creatures.length }
+ }
+ atlasDb.getMeta = async () => metaRow
+ atlasDb.getFacets = async () => facetsInDb
+ atlasDb.getPending = async () => pendingRow
+ atlasDb.setPending = async (payload, status) => {
+ pendingRow = { ...payload, status }
+ }
+ atlasDb.clearPending = async () => {
+ pendingRow = null
+ }
+ settings.get = async () => ''
+ process.env.SERVUO_PATH = ''
+})
+
+test('refresh: no configured path is skipped, not an error', async () => {
+ const result = await shardAtlas.refresh()
+ assert.equal(result.status, 'skipped')
+})
+
+test('refresh: an unreadable tree reports unavailable rather than throwing', async () => {
+ const result = await shardAtlas.refresh({ path: path.join(os.tmpdir(), 'no-such-tree-abc') })
+ assert.equal(result.status, 'unavailable')
+ assert.equal(result.code, 'NOT_FOUND')
+})
+
+test('refresh: a fresh database imports', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'imported')
+ assert.ok(applied)
+ assert.deepEqual(result.addedFacets, ['Sosaria'])
+})
+
+test('refresh: an unchanged tree parses nothing and writes nothing', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ metaRow = buildAtlas(root).meta
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'unchanged')
+ assert.equal(applied, null)
+})
+
+// The hash gate alone would strand an install whose maps never change on
+// whatever an older build derived: a corrected parse would ship and never reach
+// the data, because the only thing compared is the tree.
+test('refresh: an unchanged tree is REIMPORTED when the parser has moved on', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ metaRow = { ...buildAtlas(root).meta, parserVersion: PARSER_VERSION - 1 }
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'imported')
+ assert.ok(applied)
+})
+
+test('refresh: an atlas imported before parser versions existed is stale', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ const meta = buildAtlas(root).meta
+ delete meta.parserVersion
+ metaRow = meta
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'imported')
+})
+
+test('refresh: --force reimports an unchanged tree', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ metaRow = buildAtlas(root).meta
+ const result = await shardAtlas.refresh({ path: root, force: true })
+ assert.equal(result.status, 'imported')
+ assert.ok(applied)
+})
+
+test('refresh: a NEW facet applies straight away', async () => {
+ // Additions cannot destroy anything an operator would miss.
+ const root = tempTree({ facets: ['Sosaria', 'Underdark'] })
+ facetsInDb = ['Sosaria']
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'imported')
+ assert.deepEqual(result.addedFacets, ['Underdark'])
+})
+
+test('refresh: a REMOVED facet is staged, not applied', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ facetsInDb = ['Sosaria', 'Underdark']
+ const result = await shardAtlas.refresh({ path: root })
+ assert.equal(result.status, 'needsReview')
+ assert.deepEqual(result.removedFacets, ['Underdark'])
+ // The critical part: the existing atlas was left alone.
+ assert.equal(applied, null)
+ assert.equal(pendingRow.status, 'pending')
+})
+
+test('refresh: approving applies the removal', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ facetsInDb = ['Sosaria', 'Underdark']
+ await shardAtlas.refresh({ path: root })
+ assert.equal(applied, null)
+
+ const result = await shardAtlas.approvePending({ path: root })
+ assert.equal(result.status, 'imported')
+ assert.ok(applied)
+ assert.deepEqual(result.removedFacets, ['Underdark'])
+})
+
+test('refresh: a rejected refresh does not re-prompt while the tree is unchanged', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ facetsInDb = ['Sosaria', 'Underdark']
+ await shardAtlas.refresh({ path: root })
+ await shardAtlas.rejectPending()
+ assert.equal(pendingRow.status, 'rejected')
+
+ const again = await shardAtlas.refresh({ path: root })
+ assert.equal(again.status, 'unchanged')
+ assert.equal(applied, null)
+})
+
+test('refresh: changing the tree asks again after a rejection', async () => {
+ const root = tempTree({ facets: ['Sosaria'] })
+ facetsInDb = ['Sosaria', 'Underdark']
+ await shardAtlas.refresh({ path: root })
+ await shardAtlas.rejectPending()
+
+ fs.appendFileSync(path.join(root, 'Spawns', 'Sosaria.xml'), '', 'utf8')
+ const again = await shardAtlas.refresh({ path: root })
+ assert.equal(again.status, 'needsReview')
+})
+
+test('refreshOnBoot: never throws, whatever goes wrong', async () => {
+ atlasDb.getMeta = async () => {
+ throw new Error('database is on fire')
+ }
+ atlasDb.getFacets = async () => {
+ throw new Error('still on fire')
+ }
+ atlasDb.replaceAtlas = async () => {
+ throw new Error('and the import too')
+ }
+ process.env.SERVUO_PATH = tempTree({ facets: ['Sosaria'] })
+
+ const result = await shardAtlas.refreshOnBoot()
+ assert.equal(result.status, 'failed')
+})
+
+test('refreshOnBoot: a missing tree is survivable, not fatal', async () => {
+ process.env.SERVUO_PATH = path.join(os.tmpdir(), 'nope-not-here-xyz')
+ const result = await shardAtlas.refreshOnBoot()
+ assert.equal(result.status, 'unavailable')
+})
+
+test('refresh: an explicit path overrides the configured one', async () => {
+ const configured = tempTree({ facets: ['Configured'] })
+ const override = tempTree({ facets: ['Override'] })
+ settings.get = async () => configured
+
+ const result = await shardAtlas.refresh({ path: override })
+ assert.equal(result.status, 'imported')
+ assert.deepEqual(result.addedFacets, ['Override'])
+})
diff --git a/server/tools/cliloc-export/Program.cs b/server/tools/cliloc-export/Program.cs
new file mode 100644
index 0000000..4a1dec3
--- /dev/null
+++ b/server/tools/cliloc-export/Program.cs
@@ -0,0 +1,140 @@
+// Cliloc export — converts a modern client's COMPRESSED Cliloc.enu into the
+// plain format the website can read (docs/website/CLILOCS.md).
+//
+// Why this exists at all: every current UO client ships its cliloc files in the
+// compressed "Mythic" format — the first DWORD's high byte is 0x8E — and the
+// plain layout the website parses is what those files looked like before that
+// change. Decompressing is a bit-level inverse-BWT coder that the site has no
+// business carrying at runtime, and ServUO's own bundled `Ultima.StringList`
+// cannot read it either (which is why `VendorSearch.GetItemName` is already
+// inert on such a shard, and why the shard cannot supply names instead).
+//
+// So the conversion happens ONCE, here, against a decompressor that already
+// exists and is maintained: UOFiddler's `Ultima.dll`.
+//
+// ── Why reflection rather than a project reference ────────────────────────
+//
+// UOFiddler ships as net10.0. Referencing it from a project built by an older
+// SDK fails at COMPILE time with CS1705 ("uses System.Runtime 10.0 which has a
+// higher version than referenced assembly"). Loading it reflectively moves that
+// question to run time, where `RollForward: LatestMajor` answers it — so this
+// builds on whatever SDK an operator happens to have and runs on the newest
+// runtime installed.
+//
+// ── Why not StringList.SaveStringList ────────────────────────────────────
+//
+// It looks like exactly the right method and it is not: it RE-COMPRESSES on
+// save, because its purpose is round-tripping a file back into the client. The
+// output is byte-identical to the compressed input. The plain records below are
+// written by hand for that reason.
+//
+// Usage:
+// dotnet run -- [--tsv]
+//
+// Nothing produced by this tool is committed. See docs/website/CLILOCS.md.
+
+using System;
+using System.Collections;
+using System.IO;
+using System.Reflection;
+using System.Text;
+
+internal static class Program
+{
+ private static int Main(string[] args)
+ {
+ if (args.Length < 3)
+ {
+ Console.Error.WriteLine("usage: clilocexport [--tsv]");
+ Console.Error.WriteLine(" Ultima.dll ships with UOFiddler (https://github.com/polserver/UOFiddler).");
+ return 2;
+ }
+
+ var (ultimaDll, input, output) = (args[0], args[1], args[2]);
+ var asTsv = Array.IndexOf(args, "--tsv") >= 0;
+
+ // The language code only names the file when StringList resolves the path
+ // itself; here the path is explicit, so it is cosmetic.
+ var language = Path.GetExtension(input).TrimStart('.');
+ if (string.IsNullOrWhiteSpace(language)) language = "enu";
+
+ var assembly = Assembly.LoadFrom(Path.GetFullPath(ultimaDll));
+ var stringListType = assembly.GetType("Ultima.StringList")
+ ?? throw new InvalidOperationException("Ultima.StringList not found — is that really UOFiddler's Ultima.dll?");
+
+ // (language, path, decompress). `decompress: true` is the whole point;
+ // the loader falls back to a plain read on its own if the file turns out
+ // not to be compressed, so an already-converted file passes through.
+ var ctor = stringListType.GetConstructor(new[] { typeof(string), typeof(string), typeof(bool) })
+ ?? throw new InvalidOperationException("Unexpected Ultima.StringList API — this tool targets UOFiddler 4.21+.");
+
+ var stringList = ctor.Invoke(new object[] { language, Path.GetFullPath(input), true });
+
+ // A partial parse is reported rather than thrown. Surfacing it matters:
+ // the output would otherwise be a quietly short table, which is exactly
+ // the failure mode the website's parser refuses to import.
+ var warning = stringListType.GetProperty("LoadWarning")?.GetValue(stringList) as string;
+ if (!string.IsNullOrWhiteSpace(warning)) Console.Error.WriteLine("warning: " + warning);
+
+ var entries = (IEnumerable)stringListType.GetProperty("Entries")!.GetValue(stringList)!;
+ var entryType = assembly.GetType("Ultima.StringEntry")!;
+ var numberProp = entryType.GetProperty("Number")!;
+ var textProp = entryType.GetProperty("Text")!;
+ var flagProp = entryType.GetProperty("Flag")!;
+
+ int written = 0, skipped = 0, maxBytes = 0;
+
+ if (asTsv)
+ {
+ using var writer = new StreamWriter(output, false, new UTF8Encoding(false));
+ foreach (var entry in entries)
+ {
+ var number = (int)numberProp.GetValue(entry)!;
+ var text = (string?)textProp.GetValue(entry) ?? "";
+ maxBytes = Math.Max(maxBytes, Encoding.UTF8.GetByteCount(text));
+ // A tab or newline inside a cliloc string would break the row.
+ // Neither occurs in real tables, but silently emitting a broken
+ // file is worse than collapsing the whitespace.
+ writer.WriteLine($"{number}\t{text.Replace('\t', ' ').Replace('\r', ' ').Replace('\n', ' ')}");
+ written++;
+ }
+ }
+ else
+ {
+ using var stream = new FileStream(output, FileMode.Create, FileAccess.Write);
+ using var binary = new BinaryWriter(stream);
+ binary.Write(2); // int32 — the plain-format version marker
+ binary.Write((short)1); // int16 — language marker
+
+ foreach (var entry in entries)
+ {
+ var number = (int)numberProp.GetValue(entry)!;
+ var text = (string?)textProp.GetValue(entry) ?? "";
+ var flag = Convert.ToByte(Convert.ToInt32(flagProp.GetValue(entry)));
+
+ var utf8 = Encoding.UTF8.GetBytes(text);
+ maxBytes = Math.Max(maxBytes, utf8.Length);
+
+ // The length field is 16 bits. Real tables peak around 12 KB, so
+ // this has never fired — but writing a truncated length would
+ // corrupt every record after it, so an oversize entry is dropped
+ // and counted instead.
+ if (utf8.Length > ushort.MaxValue) { skipped++; continue; }
+
+ binary.Write(number);
+ binary.Write(flag);
+ binary.Write((ushort)utf8.Length);
+ binary.Write(utf8);
+ written++;
+ }
+ }
+
+ Console.WriteLine($"wrote {written} entries to {output} (maxTextBytes={maxBytes}, skippedOversize={skipped})");
+ if (written == 0)
+ {
+ Console.Error.WriteLine("no entries were written — is that a cliloc file?");
+ return 1;
+ }
+ return 0;
+ }
+}
diff --git a/server/tools/cliloc-export/README.md b/server/tools/cliloc-export/README.md
new file mode 100644
index 0000000..97efb1c
--- /dev/null
+++ b/server/tools/cliloc-export/README.md
@@ -0,0 +1,64 @@
+# cliloc-export
+
+Converts a UO client's **compressed** `Cliloc.enu` into the plain format the
+website can read.
+
+This is a one-off operator utility, not part of the website build. Nothing in the
+Node application references it and CI never touches it. Full background —
+including why the conversion is necessary at all — is in
+[`docs/website/CLILOCS.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/edge/website/CLILOCS.md).
+
+## The short version
+
+Every current UO client ships its cliloc files in the compressed "Mythic"
+container (the first DWORD's high byte is `0x8E`). The website parses the plain
+layout those files used before that change. Decompressing is an inverse-BWT coder
+that the site has no business carrying at runtime — and ServUO's own bundled
+`Ultima.StringList` cannot read it either, so the shard cannot supply item names
+on our behalf.
+
+So: convert once, here, using a decompressor that already exists and is already
+maintained — [UOFiddler](https://github.com/polserver/UOFiddler)'s `Ultima.dll`.
+
+## Usage
+
+```bash
+dotnet build -c Release
+
+# plain binary (recommended — exact)
+dotnet run -- "/Ultima.dll" "/Cliloc.enu" /srv/uo-data/clilocs.plain
+
+# tab-delimited text (convenient; does not preserve leading/trailing whitespace)
+dotnet run -- "/Ultima.dll" "/Cliloc.enu" /srv/uo-data/clilocs.tsv --tsv
+```
+
+Then point the site at the output: **Admin → Shard → cliloc path**, or the
+`UO_CLIENT_PATH` environment variable. The setting wins over the environment.
+
+Expected output for a stock English client:
+
+```
+wrote 123490 entries to /srv/uo-data/clilocs.plain (maxTextBytes=12150, skippedOversize=0)
+```
+
+The site stores ~67,500 of those — roughly half a cliloc table is empty strings
+for ids the client reserves and never uses.
+
+## Two implementation notes worth keeping
+
+**`Ultima.dll` is loaded reflectively, not referenced.** UOFiddler ships as
+net10.0; a project reference from an older SDK fails at *compile* time with
+CS1705. Reflection moves that to run time, where `RollForward: LatestMajor`
+answers it — so this builds on whatever SDK you have and runs on the newest
+runtime installed.
+
+**`StringList.SaveStringList` is not the export path**, despite looking exactly
+like it. It *re-compresses* on save, because its purpose is round-tripping a file
+back into the client — its output is byte-identical to its input. The plain
+records are written by hand for that reason.
+
+## Output is never committed
+
+UO's strings are EA's. `.gitignore` covers this project's build output and the
+conventional in-repo output location, but the supported arrangement is a path
+**outside** the repository entirely.
diff --git a/server/tools/cliloc-export/clilocexport.csproj b/server/tools/cliloc-export/clilocexport.csproj
new file mode 100644
index 0000000..06d6103
--- /dev/null
+++ b/server/tools/cliloc-export/clilocexport.csproj
@@ -0,0 +1,26 @@
+
+
+
+
+ Exe
+ net8.0
+ clilocexport
+ ClilocExport
+ enable
+ disable
+ LatestMajor
+ true
+
+
+