Prepare Clusterio 2.0.2 release (#1089)

Refresh installation and stable release documentation

.devcontainer/devcontainer.json

@@ -0,0 +1,4 @@
+{
+	"image":"mcr.microsoft.com/devcontainers/universal:2",
+	"postCreateCommand": "mkdir factorio && cd factorio && wget https://factorio.com/get-download/1.1.107/headless/linux64 && tar -xf linux64 && mv factorio factorio_1.1.107 && rm linux64 && wget https://factorio.com/get-download/2.0.47/headless/linux64 && tar -xf linux64 && mv factorio factorio_2.0.47 && rm linux64 && pnpm install",
+}

.dockerignore

@@ -0,0 +1,22 @@
+# No need to invalidate cache just because we try speeding up the build
+.dockerignore
+Dockerfile
+docker-compose*
+
+# Install dependencies during the build
+node_modules
+packages/**/node_modules
+plugins/**/node_modules
+
+# Download factorio during the build
+factorio
+factorio.tar.gz
+
+# We build internal mods during build, mods from local test env should not be applied
+mods
+
+# These files should never be required during the build
+.git
+.github
+dist
+temp

.emmyrc.json

@@ -0,0 +1,48 @@
+{
+    "$schema": "https://raw.githubusercontent.com/EmmyLuaLs/emmylua-analyzer-rust/refs/heads/main/crates/emmylua_code_analysis/resources/schema.json",
+    "runtime": {
+        "version": "Lua5.2",
+        "requirePattern": [ "?", "?.lua" ]
+    },
+    "workspace": {
+        "$comment-moduleMap": "Rewrites each file's own module path rather than the require string",
+        "$comment-library": "The factorio typedefs are provided by a second config, generated with fmtk luals-addon in ci",
+        "$comment-templates": "The create templates contain __plugin_name__ placeholders and are not valid lua",
+        "ignoreGlobs": [
+            "**/node_modules/**",
+            "**/dist/**",
+            "database/**",
+            "docs/**",
+            "external_plugins/**",
+            "factorio/**",
+            "instances/**",
+            "logs/**",
+            "mods/**",
+            "modules/**",
+            "temp/**",
+            "packages/create/templates/**"
+        ],
+        "moduleMap": [
+            { "pattern": "^packages\\.host\\.modules\\.(.+)$", "replace": "modules.$1" },
+            { "pattern": "^plugins\\.([^.]+)\\.module\\.(.+)$", "replace": "modules.$1.$2" },
+            { "pattern": "^packages\\.host\\.lua\\.export\\.(.+)$", "replace": "$1" },
+            { "pattern": "^packages\\.host\\.lua\\.clusterio_lib\\.(.+)$", "replace": "$1" }
+        ]
+    },
+    "doc": {
+        "privateName": [ "__*" ]
+    },
+    "$comment-disable": "Same set as ExpCluster, these are editor level hints rather than ci checks",
+    "$comment-unnecessary-if": "Disabled by the config fmtk generates for itself, the api union types make it unreliable",
+    "diagnostics": {
+        "globals": [ "__DebugAdapter", "__Profiler" ],
+        "disable": [
+            "assign-type-mismatch",
+            "param-type-mismatch",
+            "preferred-local-alias",
+            "unnecessary-assert",
+            "unnecessary-if",
+            "unused"
+        ]
+    }
+}

.gitattributes

@@ -0,0 +1 @@
+package-lock.json -diff

.github/actions/pnpm-install/action.yml

@@ -0,0 +1,53 @@
+name: Install dependencies
+description: Set up pnpm and Node.js, restore caches and run pnpm install
+
+inputs:
+  node-version:
+    description: Node.js version passed to actions/setup-node
+    required: true
+  ignore-scripts:
+    description: Skip the prepare scripts that build the workspace packages
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@v6
+    - uses: actions/setup-node@v7
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    # The lockfile is not committed, so the usual lockfile hash key does not
+    # apply. Instead a new store snapshot is saved whenever a package.json
+    # changes or a week passes, and every run restores the most recent one.
+    - id: store
+      shell: bash
+      run: |
+        echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+        echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v6
+      with:
+        path: ${{ steps.store.outputs.path }}
+        key: pnpm-store-${{ runner.os }}-${{ steps.store.outputs.week }}-${{ hashFiles('**/package.json', 'pnpm-workspace.yaml') }}
+        restore-keys: pnpm-store-${{ runner.os }}-
+
+    # The prepare scripts run tsc --build and webpack, both incremental when
+    # their previous output is present. Every run saves its output and the
+    # next run starts from the most recent one.
+    - if: inputs.ignore-scripts != 'true'
+      uses: actions/cache@v6
+      with:
+        path: |
+          packages/*/dist
+          plugins/*/dist
+          packages/*/node_modules/.cache
+          plugins/*/node_modules/.cache
+        key: build-${{ runner.os }}-${{ github.sha }}
+        restore-keys: build-${{ runner.os }}-
+
+    - shell: bash
+      run: pnpm i --no-frozen-lockfile ${{ inputs.ignore-scripts == 'true' && '--ignore-scripts' || '' }}
+    # Drop packages the restored store had but this install did not use, so
+    # the snapshot does not grow with every version bump.
+    - shell: bash
+      run: pnpm store prune

.github/pull_request_template.md

@@ -0,0 +1,22 @@
+<!--
+Describe why and what has been changed by this pull request, feel free to also ask for input on decisions you are unsure about etc.
+
+The changelog lines below will be copied directly from merged pull requests to the changelog on new releases. Changes are expected to preferentially link to the associated issues. If there are no relevant issues, link to the pull request itself.
+
+If there are no relevant changelog entries replace the code block below with "None." followed by an optional reason for why it is not needed.
+-->
+
+### Changelog
+```
+### Features
+- Added doodad to web interface. #999
+
+### Changes
+- ...
+
+### Fixes
+- ...
+
+### Breaking Changes
+- ...
+```

.github/workflows/lua-lint.yml

@@ -0,0 +1,83 @@
+name: Lua Lint
+
+on:
+  push:
+  pull_request:
+
+env:
+  EMMYLUA_CHECK_VERSION: "0.25.1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+      - name: Generate Factorio typedefs
+        run: |
+          npm install --prefix "$RUNNER_TEMP/fmtk" factoriomod-debug
+          "$RUNNER_TEMP/fmtk/node_modules/.bin/fmtk" luals-addon "$RUNNER_TEMP"
+      - name: Install emmylua_check
+        run: |
+          curl -fsSL "https://github.com/EmmyLuaLs/emmylua-analyzer-rust/releases/download/${EMMYLUA_CHECK_VERSION}/emmylua_check-linux-x64.tar.gz" \
+            | tar -xz -C "$RUNNER_TEMP"
+      - name: Run Lint Report
+        shell: bash
+        run: |
+          # The typedefs are generated per run, so their path is passed via a second config
+          jq -n --arg lib "$RUNNER_TEMP/factorio/library" \
+            '{ workspace: { library: [ $lib ] } }' \
+            > "$RUNNER_TEMP/ci.emmyrc.json"
+
+          # Exits non zero on error severity, so the gate below is used instead
+          "$RUNNER_TEMP/emmylua_check" . --config ".emmyrc.json,$RUNNER_TEMP/ci.emmyrc.json" \
+            --output-format json --output check.json || true
+
+          # Credit to https://github.com/Krealle/luals-check-action/blob/main/action.yml
+          # Although some minor fixes were needed
+
+          # Format and print the messages (would be nice to format as a table, but that's too complex for jq)
+          jq -r --arg root "$PWD/" \
+            '.[] | (.file | ltrimstr($root)) as $file | .diagnostics[] |
+              {
+                file: $file,
+                code: .code,
+                line: .range.start.line,
+                message: (.message | split("\n")
+                  | map(if startswith("- ") then .[2:] else . end)
+                  | join("\n")),
+                severity: (if .severity <= 1 then "ERR" else "WARN" end)
+              } |
+              "**[\(.severity)] \(.code):** \(.file)#L\(.line + 1)<br><code>\(.message)</code>"' \
+            check.json > "$GITHUB_STEP_SUMMARY"
+
+          echo ""
+
+          # Github Annotations (limited to 10)
+          jq -r --arg root "$PWD/" \
+            '.[] | (.file | ltrimstr($root)) as $file | .diagnostics[] |
+              {
+                file: $file,
+                title: .code,
+                line: .range.start.line,
+                endLine: .range.end.line,
+                col: .range.start.character,
+                endColumn: .range.end.character,
+                message: (.message | gsub("\n"; "%0A"; "m")),
+                level: (if .severity <= 1 then "error" else "warning" end)
+              } |
+              "::\(.level) file=\(.file),line=\(.line + 1),endLine=\(.endLine + 1),col=\(.col + 1),endColumn=\(.endColumn + 1),title=\(.title)::\(.message) (\(.title))"' \
+            check.json
+
+          # An entry is emitted for every file checked, including clean ones, so
+          # the gate counts diagnostics and asserts the workspace was actually read
+          if [[ $(jq 'length' check.json) -lt 20 ]] ; then
+            echo "::error::Only $(jq 'length' check.json) files were checked, expected the whole workspace"
+            exit 1
+          elif [[ $(jq '[.[].diagnostics[]] | length' check.json) -gt 0 ]] ; then
+            exit 1
+          else
+            echo "✅ All checks succeeded!" | tee "$GITHUB_STEP_SUMMARY"
+          fi

.github/workflows/node.js.yml

@@ -0,0 +1,119 @@
+# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+
+name: Node.js CI
+
+on:
+  push:
+  pull_request:
+
+env:
+  NODE_VERSION: 24.x
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # Test Node.js 24 and 26 across the Factorio matrix; Node.js 22 runs coverage below.
+        # Node.js release schedule: https://nodejs.org/en/about/releases/
+        node-version: [24.x, 26.x]
+
+        # Supported factorio versions are latest stable and one minor version before stable (even if from a previous major) 
+        factorio-version: [1.1.110, 2.0.77, 2.1.17]
+    
+        # Coverage is performed on the older of the supported node versions
+        include:
+          - node-version: 22.x
+            factorio-version: 2.1.17
+            coverage: true
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: Prepare and install
+      uses: ./.github/actions/pnpm-install
+      with:
+        node-version: ${{ matrix.node-version }}
+    - name: Use Factorio ${{ matrix.factorio-version }}
+      run: wget -q -O factorio.tar.gz https://www.factorio.com/get-download/${{ matrix.factorio-version }}/headless/linux64 && tar -xf factorio.tar.gz && rm factorio.tar.gz
+    - name: Run tests
+      if: ${{ !matrix.coverage }}
+      run: pnpm test
+    - name: Run coverage
+      if: ${{ matrix.coverage }}
+      run: pnpm run ci-cover
+    - name: Upload coverage to Codecov
+      if: ${{ matrix.coverage }}
+      uses: codecov/codecov-action@v7
+      with:
+        files: ./coverage/lcov.info
+        token: ${{ secrets.CODECOV_TOKEN }}
+    - name: Upload test logs for debugging
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: logs-${{ matrix.node-version }}-${{ matrix.factorio-version }}
+        path: temp/test/logs
+
+  version-compat:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # npm version spec for the published side of the compatibility test.
+      # If each release is compatible with the one before it then testing
+      # against the latest release transitively covers older versions too.
+      PUBLISHED_VERSION: latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - controller: local
+            host: published
+          - controller: published
+            host: local
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: Prepare and install
+      uses: ./.github/actions/pnpm-install
+      with:
+        node-version: ${{ env.NODE_VERSION }}
+    - name: Build
+      run: pnpm run build
+    - name: Test ${{ matrix.controller }} controller with ${{ matrix.host }} host
+      run: >
+        node scripts/version-compat-test.js
+        --controller ${{ matrix.controller }}
+        --host ${{ matrix.host }}
+        --published-version "$PUBLISHED_VERSION"
+
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+    - uses: actions/checkout@v7
+    - uses: ./.github/actions/pnpm-install
+      with:
+        node-version: ${{ env.NODE_VERSION }}
+        ignore-scripts: true
+    - run: pnpm run lint
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+    - uses: actions/checkout@v7
+    - uses: ./.github/actions/pnpm-install
+      with:
+        node-version: ${{ env.NODE_VERSION }}
+        ignore-scripts: true
+    - run: pnpm run build-mod
+    # Upload build to artifacts
+    - name: Upload build to artifacts
+      uses: actions/upload-artifact@v7
+      with:
+        name: clusterio_lib
+        path: ./dist
+        if-no-files-found: error

.github/workflows/publish.yml

@@ -0,0 +1,46 @@
+
+name: Publish
+
+on:
+  release:
+    types:
+      - released
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  npm:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24.x
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --no-frozen-lockfile
+      - run: pnpm -r --filter='./packages/*' --filter='./plugins/*' --fail-if-no-match publish --no-git-checks
+      - uses: softprops/action-gh-release@v3
+        with:
+          files: pnpm-lock.yaml
+
+  factorio:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24.x
+      - run: pnpm install --no-frozen-lockfile
+      - run: pnpm -r --filter='./packages/*' --filter='./plugins/*' --fail-if-no-match run build-mod --output-dir ../../dist
+      - run: node ./publish.js factorio ./dist
+        env:
+          FACTORIO_TOKEN: ${{ secrets.FACTORIO_TOKEN }}
+      - uses: softprops/action-gh-release@v3
+        with:
+          files: ./dist/*

.gitignore

@@ -1,7 +1,6 @@
 # Logs
 logs
-*.log
-npm-debug.log*
+*debug.log*
 
 # Runtime data
 pids
@@ -11,7 +10,7 @@ pids
 # Directory for instrumented libs generated by jscoverage/JSCover
 lib-cov
 
-# Coverage directory used by tools like istanbul
+# Coverage directories used by tools like c8 and codecov
 coverage
 
 # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
@@ -22,33 +21,27 @@ coverage
 
 # Compiled binary addons (http://nodejs.org/api/addons.html)
 build/Release
+dist/
 
-node_modules/*
-!node_modules/_app
+# Autogenerated docs output
+/docs/api
 
-Factorio*
-/factorio
+node_modules
+
+/factorio*
 /instances
-/sharedMods
+/mods
 /database
-database/items.db
-config.json
-package-lock.json
-secret-api-token.txt
+/plugin-list.json
+/config-*.json
+/config-*.json.lock
+pnpm-lock.yaml
 mod_cache.json
-static/pictures/spritesheet.js
-static/pictures/spritesheet.png
-static/external
+.luarc.json
+/static/
 saves
+/temp/
 
-# weird pattern to ignore sharedPlugins except not ignore some core modules
-!sharedPlugins/
-sharedPlugins/*
-!sharedPlugins/inventoryImports/
-!sharedPlugins/UPSdisplay/
-!sharedPlugins/remoteMap/
-!sharedPlugins/remoteCommands/
-!sharedPlugins/researchSync/
-!sharedPlugins/globalChat/
-
-\.cache-require-paths\.json
+# IDE
+.idea/
+.vs/

.travis.yml

@@ -1,10 +0,0 @@
-language: node_js
-node_js:
-  - "node"
-before_install:
-  - sudo apt-get -qq update
-  - sudo apt-get install -y curl git tar
-  - curl -o factorio.tar.gz -L https://www.factorio.com/get-download/latest/headless/linux64
-  - tar -xvf factorio.tar.gz
-script:
-  - npm run cover

.vscode/.gitignore

@@ -0,0 +1,3 @@
+*
+!.gitignore
+!settings.json

.vscode/settings.json

@@ -0,0 +1,11 @@
+{
+	"editor.detectIndentation": false,
+	"editor.insertSpaces": false,
+	"files.eol": "\n",
+	"files.insertFinalNewline": true,
+	"files.trimFinalNewlines": true,
+	"[markdown]": {
+		"editor.indentSize": 4,
+		"editor.insertSpaces": true,
+	},
+}

CHANGELOG.md

@@ -0,0 +1,961 @@
+# Changelog
+
+<!-- Template for entries. Add sections that apply as changes are made.
+## Version 2.0.0-alpha.xx
+
+### Major Features
+
+- Major additions and/or major improvements to managing clusters.
+
+### Features
+
+- New features added.
+
+### Changes
+
+- Small changes to existing behaviour.
+
+### Fixes
+
+- Bugfixes
+
+### Breaking Changes
+
+- Changes which break backwards compatibility with older hosts or plugins code.
+
+### Meta
+
+- Changes to the project activities / structure worth highlighting but have no impact on the published package.
+
+Many thanks to the following for contributing to this release:  
+[@username](https://github.com/username)
+-->
+
+## Version 2.0.2
+
+### Fixes
+
+- Fixed installation with selected plugins by relying on automatic plugin discovery, and ensured installer failures return a nonzero exit status. [#1082](<https://github.com/clusterio/clusterio/pull/1082>), [#1084](<https://github.com/clusterio/clusterio/issues/1084>)
+- Fixed web plugin `controllerConnectionEvent` handlers receiving the connector's event data instead of the event name. [#1083](<https://github.com/clusterio/clusterio/issues/1083>)
+- Updated installation instructions to recommend latest Node.js LTS and corrected outdated mod management, CLI, plugin, and release documentation. [#1086](<https://github.com/clusterio/clusterio/pull/1086>)
+
+### Meta
+
+- Made player-auth login tests independent of wall-clock timing and added verification-token expiry coverage. [#1087](<https://github.com/clusterio/clusterio/pull/1087>)
+- Added Node.js 26 to the CI test matrix across all tested Factorio versions. [#1088](<https://github.com/clusterio/clusterio/pull/1088>)
+
+Many thanks to the following for contributing to this release:
+[@psihius](<https://github.com/psihius>), [@bbassie](<https://github.com/bbassie>)
+
+## Version 2.0.1
+
+### Fixes
+
+- Removed obsolete development-branch warnings from controller, host and ctl startup. [#1078](<https://github.com/clusterio/clusterio/pull/1078>)
+- Removed the obsolete alpha label and development warning from the Clusterio Library mod title and description. [#1079](<https://github.com/clusterio/clusterio/pull/1079>)
+- Fixed Factorio mod release uploads to use valid multipart requests and files from the requested output directory, uploading variants in version order. [#1080](<https://github.com/clusterio/clusterio/pull/1080>)
+
+Many thanks to the following for contributing to this release:
+[@psihius](<https://github.com/psihius>)
+
+## Version 2.0.0
+
+### Features
+
+- Mod packs now show informational notices for disabled recommended mods and available compatible updates. [#949](<https://github.com/clusterio/clusterio/issues/949>)
+- Added host, server name, save copy and start options to the create instance dialog in the web UI. [#405](<https://github.com/clusterio/clusterio/issues/405>)
+- Added `InstanceSaveGameRequest` and `clusterioctl instance save-game` to save the running game of an instance. [#405](<https://github.com/clusterio/clusterio/issues/405>)
+- Added `permissions` to `PluginDeclaration` and a `Permissions` type registry so plugin permission names are checked at compile time. [#987](<https://github.com/clusterio/clusterio/issues/987>)
+- Added Update All to the web interface and `--all` to the ctl update commands, updating the core package and all npm installed plugins in one npm call. [#910](<https://github.com/clusterio/clusterio/issues/910>)
+- Added typed hook system for plugin registration. ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- Added `plugin install <package>` command to controller, host and ctl which installs a plugin from npm and adds it to the plugin list. [#1008](<https://github.com/clusterio/clusterio/issues/1008>)
+- Added a guard that prevents controller and host restart requests from unintentionally downgrading Clusterio. [#950](<https://github.com/clusterio/clusterio/issues/950>)
+- Added option to load static assets from a separate URL from where the controller's web API is hosted at. [#983](<https://github.com/clusterio/clusterio/pull/983>)
+- Added `clusteriocontroller copy-static` command to copy static web assets to a folder to ease hosting assets on a separate server. [#983](<https://github.com/clusterio/clusterio/pull/983>)
+- Added Mark Restart Required to the host and controller pages and matching ctl commands, for plugins installed by other means than the install request. [#1043](<https://github.com/clusterio/clusterio/pull/1043>)
+- Added the RoleViewPageBeforePermissions web extension slot for plugin components above the permissions on the role page. [#1045](<https://github.com/clusterio/clusterio/pull/1045>)
+- Added a list of permission groups to the role page, highlighting groups with granted permissions. [#1044](<https://github.com/clusterio/clusterio/pull/1044>)
+- Added `clusteriohost create-scenario` to create a scenario with the Clusterio modules patched in for use outside of Clusterio. [#1014](<https://github.com/clusterio/clusterio/pull/1014>)
+- Plugins can declare a `migrationEntrypoint` to migrate the config fields and role permissions core stores for them. Configs track the plugin version they were last loaded with in a hidden `<plugin>.version` field. [#1073](<https://github.com/clusterio/clusterio/pull/1073>)
+
+### Fixes
+
+- Deprecation warning DEP0190 is no longer printed when installing. [#851](<https://github.com/clusterio/clusterio/issues/851>)
+- Events sent to subscribers are no longer addressed to the request id of the request that created the subscription. [#847](<https://github.com/clusterio/clusterio/issues/847>)
+- Factorio account token no longer written to the log when a mod download fails. [#795](<https://github.com/clusterio/clusterio/issues/795>)
+- Failed downloads no longer leave a temporary file and an open file handle behind, which could shift the file names used by later downloads. [#957](<https://github.com/clusterio/clusterio/pull/957>)
+- Requests that could not be forwarded to the next hop are no longer answered a second time when the link disconnects. [#650](<https://github.com/clusterio/clusterio/issues/650>)
+- Events broadcast from an instance to all hosts are now delivered to every host instead of only the one running the instance. [#575](<https://github.com/clusterio/clusterio/issues/575>)
+- Web interface now asks to be reloaded when the controller's plugins change, instead of continuing against plugins that are no longer loaded. [#804](<https://github.com/clusterio/clusterio/issues/804>)
+- Plugin list no longer reports a plugin added since the page was opened as having failed to load. [#729](<https://github.com/clusterio/clusterio/issues/729>)
+- Instance console no longer hides the Factorio server's replies to console commands, or Factorio's own errors, when filtering to game activity. [#853](<https://github.com/clusterio/clusterio/issues/853>)
+- Allow player online autosave slots to be disabled while autosaves are enabled. [#966](<https://github.com/clusterio/clusterio/issues/966>)
+- Plugin web bundles are now loaded relative to `staticRoot` instead of `webRoot`. [#980](<https://github.com/clusterio/clusterio/issues/980>)
+- Fixed inventory_sync not preserving the personal roboport toggle, the equipment movement bonus toggle, game view settings such as alt mode, and toggleable mod shortcuts between instances. [#898](<https://github.com/clusterio/clusterio/issues/898>)
+- Schema validation errors are now included when an InvalidMessage is logged from IPC and event handlers. [#986](<https://github.com/clusterio/clusterio/issues/986>)
+- Fixed clusterioctl not being able to reference hosts, instances, mod packs and roles by an integer like name. [#886](<https://github.com/clusterio/clusterio/issues/886>)
+- Fixed the web-only plugin template referencing a permission that was never defined. [#987](<https://github.com/clusterio/clusterio/issues/987>)
+- Config files are no longer world readable by default. [#1005](<https://github.com/clusterio/clusterio/issues/1005>)
+- Fixed failed recipe notification names being duplicated on every upload from the same instance in inventory sync. [#964](<https://github.com/clusterio/clusterio/issues/964>)
+- Instances refuse to start with a mod pack for a newer Factorio version than the instance runs, instead of Factorio silently loading default mod settings. [#1006](<https://github.com/clusterio/clusterio/issues/1006>)
+- Documented the config options missing from configuration.md, marked the internal ones and noted the validation rules. [#985](<https://github.com/clusterio/clusterio/issues/985>)
+- Fixed concurrent saves of the same file racing on a shared temporary file. [#1026](<https://github.com/clusterio/clusterio/pull/1026>)
+- Fixed control connections leaving their log subscription and debug dump listeners attached after closing. [#1027](<https://github.com/clusterio/clusterio/pull/1027>)
+- Fixed the Load Scenario modal reading the wrong field for map settings. [#1032](<https://github.com/clusterio/clusterio/pull/1032>)
+- Fixed the controller exiting when a control message's permission check threw an unexpected error. [#1033](<https://github.com/clusterio/clusterio/pull/1033>)
+- Fixed the host exiting on server log lines that look like actions but do not match the expected format. [#1034](<https://github.com/clusterio/clusterio/pull/1034>)
+- Fixed the controller crashing when a control connection with the WebSocket debug dump active was resumed. [#1035](<https://github.com/clusterio/clusterio/pull/1035>)
+- Fixed deleted users keeping their permissions on any open connection until they disconnected. [#1030](<https://github.com/clusterio/clusterio/pull/1030>)
+- Restored pagination on the instance save list. [#967](<https://github.com/clusterio/clusterio/issues/967>)
+- Mod dependency resolution now only picks releases made for the mod pack's Factorio version. [#965](<https://github.com/clusterio/clusterio/issues/965>)
+- Inventory sync no longer uploads an empty inventory over the stored one after a failed download. [#912](<https://github.com/clusterio/clusterio/issues/912>)
+- Inventory sync now releases players who leave while using a temporary inventory, instead of showing them as busy until the instance stops. [#975](<https://github.com/clusterio/clusterio/pull/975>)
+- Fixed reading map exchange strings from Factorio 2.1.13 and later, which broke `instance load-scenario --map-exchange-string` on current Factorio. [#977](<https://github.com/clusterio/clusterio/pull/977>)
+- Fixed instances getting stuck on a host after a failed assign, and instance create requests no longer accept `instance.assigned_host`. [#1029](<https://github.com/clusterio/clusterio/pull/1029>)
+- Fixed the host exiting when an instance's whitelist or server settings config changed while it was starting, or when tags contained non-string values. [#1028](<https://github.com/clusterio/clusterio/pull/1028>)
+- Fixed a host being able to modify the controller's stored save list for, or forge log messages attributed to, instances assigned to other hosts. [#1036](<https://github.com/clusterio/clusterio/pull/1036>)
+- Fixed a stop request or RCON command hanging when the Factorio process exited before its RCON connection was established. [#1031](<https://github.com/clusterio/clusterio/pull/1031>)
+- Fixed core plugins needlessly installing the web_ui, controller, host and ctl packages. [#1021](<https://github.com/clusterio/clusterio/pull/1021>)
+- Installing a plugin on a host or the controller now marks it as needing a restart. [#1042](<https://github.com/clusterio/clusterio/pull/1042>)
+- Fixed plugin manifest path resolution when loading web assets. [#1046](<https://github.com/clusterio/clusterio/issues/1046>)
+- A plugin whose web build is expected but missing is reported again: `Controller.loadJsonObject(path, true)` throws on a missing file instead of returning `{}`, and a malformed JSON file always throws. [#1046](<https://github.com/clusterio/clusterio/issues/1046>)
+- Preserve full configuration field names when using the CLI config editor. [#796](<https://github.com/clusterio/clusterio/issues/796>)
+- Plugin metrics hook handlers may return nothing. [#1052](<https://github.com/clusterio/clusterio/pull/1052>)
+- Fixed save names given when starting an instance or creating a save not being checked, allowing files outside the instance directory to be written or modified. [#1053](<https://github.com/clusterio/clusterio/pull/1053>)
+- Fixed access tokens from request headers being written to the controller and cluster logs. [#1054](<https://github.com/clusterio/clusterio/pull/1054>)
+- Fixed subscriptions and log following continuing after the user lost permission for them. [#1056](<https://github.com/clusterio/clusterio/pull/1056>)
+- Fixed web interface data staying marked as up to date after the user lost permission to view it, and not loading after permission was granted. [#1058](<https://github.com/clusterio/clusterio/pull/1058>)
+- Fixed ctl config edit showing fields that cannot be edited and leaving out field descriptions. [#1051](<https://github.com/clusterio/clusterio/issues/1051>)
+- Fixed the reason an instance failed to start being logged as "undefined". [#1065](<https://github.com/clusterio/clusterio/issues/1065>)
+- Fixed subspace inventory combinators missing items after instance startup. [#1069](<https://github.com/clusterio/clusterio/issues/1069>)
+- Fixed the controller crashing when a WebSocket client sent an invalid frame before completing the handshake. [#1063](<https://github.com/clusterio/clusterio/issues/1063>)
+- Fixed an instance reusing a stored game port that another process holds, which made it fail to start until the port was freed. [#1065](<https://github.com/clusterio/clusterio/issues/1065>)
+- Fixed credentials in request query parameters, such as OAuth codes, being written to the controller's HTTP log. [#1074](<https://github.com/clusterio/clusterio/pull/1074>)
+- Fixed plugin `ctlConfigFields` not being registered in the clusterioctl config. [#1075](<https://github.com/clusterio/clusterio/pull/1075>)
+- Fixed startup failures and plugin loading when installing Clusterio from published npm packages after the ES module migration. [#1070](<https://github.com/clusterio/clusterio/pull/1070>)
+
+### Changes
+
+- Global chat now filters server-specific GPS, blueprint, train, and train-stop rich-text tags before relaying messages between instances. [#593](<https://github.com/clusterio/clusterio/issues/593>)
+- Instance console filter is now a labelled Game/Instance control instead of a single-label toggle, and Factorio's output in the log consoles is prefixed with `[server]` like every other log level. [#853](<https://github.com/clusterio/clusterio/issues/853>)
+- Inventory sync sends only the recipe notifications that differ from the destination instance's state on download. [#964](<https://github.com/clusterio/clusterio/issues/964>)
+- Log the source of responses received without a pending request, the peer of timed out connections and the number of messages resent on session resume. [#1007](<https://github.com/clusterio/clusterio/issues/1007>)
+- Plugins that are not expected to have a web build are no longer shown with an error in the plugins page. [#1004](<https://github.com/clusterio/clusterio/issues/1004>)
+- Plugins should now return a function to register handlers via hooks. ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- Plugin templates from `@clusterio/create` use entrypoint functions and hooks. ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- Improved typing for plugin APIs and webui extension points. ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- Plugin hooks run concurrently instead of one plugin at a time. ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- Access tokens are also accepted as an `Authorization: Bearer` header on HTTP API endpoints. [#1009](<https://github.com/clusterio/clusterio/issues/1009>)
+- `plugin install` and `plugin add` with a package name now check that they are run from a Clusterio installation directory. [#1008](<https://github.com/clusterio/clusterio/issues/1008>)
+- Bumped pnpm to 12, the GitHub Actions used by CI to their current majors, and the CI Factorio version to 2.1.17. [#1022](<https://github.com/clusterio/clusterio/pull/1022>)
+- Bumped dependencies, including eslint 10, yargs 18, chalk 6, @types/express 5 and @types/node 24. [#1023](<https://github.com/clusterio/clusterio/pull/1023>)
+- Plugin discovery now traverses dependencies only after confirming the parent package is a Clusterio plugin. [#963](<https://github.com/clusterio/clusterio/pull/963>)
+- Converted the project to using ES Modules. [#984](<https://github.com/clusterio/clusterio/pull/984>)
+- Converted the bundled plugins to entrypoint functions. [#1052](<https://github.com/clusterio/clusterio/pull/1052>)
+- Added `controller.max_subscription_filters` config to limit the number of filters a connection can subscribe with for one event. [#1055](<https://github.com/clusterio/clusterio/pull/1055>)
+- Added `controller.max_send_buffer_size` config to limit how much the controller buffers for a connection that does not acknowledge messages. [#1057](<https://github.com/clusterio/clusterio/pull/1057>)
+- Added links to the ExpCluster and Chat Relay community plugins in the README. [#1062](<https://github.com/clusterio/clusterio/pull/1062>)
+
+### Breaking Changes
+
+- `staticRoot` in the web interface now includes the `static/` prefix. Plugins that fetch assets with `${staticRoot}static/...` should drop the `static/` part. [#980](<https://github.com/clusterio/clusterio/issues/980>)
+- `checkPermission` and the web UI `hasPermission` helpers take `PermissionName`; TypeScript plugins must augment the `Permissions` interface. [#987](<https://github.com/clusterio/clusterio/issues/987>)
+- Replaced `plugins` map with `loadedPlugins` set across core classes (except WebUi). ([#730](<https://github.com/clusterio/clusterio/issues/730>))
+- The `/metrics` endpoint requires a user token with the new `core.controller.metrics` permission. Concurrent scrapes share a single gather from the hosts. [#1009](<https://github.com/clusterio/clusterio/issues/1009>)
+- Config files now have to be explicitly created. Use the `--create-config` flag to get the old behaviour of creating it if missing. [#548](<https://github.com/clusterio/clusterio/issues/548>)
+- Renamed clusterioctl's config-control subcommand to config. [#1039](<https://github.com/clusterio/clusterio/pull/1039>)
+- Renamed clusterioctl's main class from Control to Ctl. [#1039](<https://github.com/clusterio/clusterio/pull/1039>)
+- Renamed clusterioctl's config entries from control.[name] to ctl.[name]. [#1039](<https://github.com/clusterio/clusterio/pull/1039>)
+- Plugin entrypoints must now specify the full filename including the `.js` extension. [#984](<https://github.com/clusterio/clusterio/pull/984>)
+- Renamed the inventory_sync plugin to player_sync, published as `@clusterio/plugin-player_sync`. Config fields, the inventory view permission, the controller database file and save data are migrated on load. Uninstall `@clusterio/plugin-inventory_sync` before installing the new package. [#1072](<https://github.com/clusterio/clusterio/pull/1072>)
+
+### Meta
+
+- Added a `NO_EXTERNAL_TEST` flag to skip tests that use external APIs. [#976](<https://github.com/clusterio/clusterio/pull/976>)
+- Added a CI check that the controller and host stay compatible with the latest published release. [#978](<https://github.com/clusterio/clusterio/pull/978>)
+- Added a Lua lint CI job using emmylua_check. [#979](<https://github.com/clusterio/clusterio/pull/979>)
+- Added a plugin migration guide for 2.0 and documented that minor versions may contain breaking changes for the plugin API. [#1050](<https://github.com/clusterio/clusterio/pull/1050>)
+
+Many thanks to the following for contributing to this release:
+[@bbassie](<https://github.com/bbassie>), [@lntutor](<https://github.com/lntutor>), [@ColumbusLabs](<https://github.com/ColumbusLabs>), [@floze-the-genius](<https://github.com/floze-the-genius>), [@Cooldude2606](<https://github.com/Cooldude2606>), [@solarcloud7](<https://github.com/solarcloud7>), [@Hornwitser](<https://github.com/Hornwitser>), [@ILLISIS](<https://github.com/ILLISIS>), [@Danielv123](<https://github.com/Danielv123>), [@PHIDIAS0303](<https://github.com/PHIDIAS0303>)
+
+## Version 2.0.0-alpha.27
+
+### Features
+
+- Added a cluster overview landing page. [#928](<https://github.com/clusterio/clusterio/issues/928>)
+- Remember the instance console chat/log toggle. [#932](<https://github.com/clusterio/clusterio/pull/932>)
+- Show the public address on the instance details page. [#934](<https://github.com/clusterio/clusterio/issues/934>)
+- Navigation links can now be opened in a new tab. [#929](<https://github.com/clusterio/clusterio/issues/929>)
+- Instances can target a Factorio release channel (e.g. `stable` or `experimental`) as their version, resolved from `factorio.com/api/latest-releases`. [#937](<https://github.com/clusterio/clusterio/pull/937>)
+- The instance console in the Web UI can be resized by dragging its bottom edge, and the chosen height is remembered across page reloads. [#938](<https://github.com/clusterio/clusterio/issues/938>)
+- Tables now remember their sort and filters in the URL. [#927](<https://github.com/clusterio/clusterio/issues/927>)
+- Display Factorio server version in login server list. [#906](<https://github.com/clusterio/clusterio/issues/906>)
+- Add "Connect via Steam" button to login server list. [#915](<https://github.com/clusterio/clusterio/pull/915>)
+
+### Fixes
+
+- Silenced two Ant Design console warnings in the Web UI: the deprecated Modal `destroyOnClose` prop, and a duplicate-value warning from the instance version selector. [#940](<https://github.com/clusterio/clusterio/pull/940>)
+- Surface the mod portal's own error when downloading mods for an unsupported Factorio version. [#941](<https://github.com/clusterio/clusterio/pull/941>)
+- Instances always create their config file on assignment preventing duplicate folder creation. [#945](<https://github.com/clusterio/clusterio/pull/945>)
+
+### Changes
+
+- Reworked the site layout into a fixed sidebar with a top bar. [#924](<https://github.com/clusterio/clusterio/pull/924>)
+- The builtin "recycler" mod is now included correctly as builtin. [#925](<https://github.com/clusterio/clusterio/issues/925>)
+- Mod `info.json` versions (a mod's version and its `factorio_version`) are now parsed leniently, matching how the game reads them, instead of being validated against a fixed list of Factorio versions. [#941](<https://github.com/clusterio/clusterio/pull/941>)
+- SubscriptionFilter now directly extends Set<string>. [#942](<https://github.com/clusterio/clusterio/pull/942>)
+- EventSubscriber now exposes network errors, include permission errors. [#942](<https://github.com/clusterio/clusterio/pull/942>)
+- Quick bar syncing now supports quality filters. [#944](<https://github.com/clusterio/clusterio/pull/944>)
+- Added support for recommended mod dependencies. [#946](<https://github.com/clusterio/clusterio/pull/946>)
+
+### Meta
+
+- Node 20 is no longer officially supported as it went EoL in March 2026. Please update to v22 or v24. [#943](<https://github.com/clusterio/clusterio/pull/943>)
+
+Many thanks to the following for contributing to this release:
+[@bbassie](<https://github.com/bbassie>)
+[@Cooldude2606](<https://github.com/Cooldude2606>)
+
+## Version 2.0.0-alpha.26
+
+### Features
+
+- Added filter state to `EventSubscriber` allowing plugings to more easilly filter events. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Added `replace` subscription action allowing filter state to be fully replaced with a single request. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Added `ValueSubscriber` and `MapSubscriber` as subclasses of `EventSubscriber`. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Added changelog viewer accessible from the version number in the web interface. [#907](<https://github.com/clusterio/clusterio/issues/907>)
+- Added about popup to user menu containing support links, build, clusterio, and debug info. [#914](<https://github.com/clusterio/clusterio/pull/914>)
+- Added user status filtering (admin, whitelisted, banned) to the users table. [#905](<https://github.com/clusterio/clusterio/issues/905>)
+- Added instance selector to users page to scope user stats by instance. [#905](<https://github.com/clusterio/clusterio/issues/905>)
+
+### Fixes
+
+- Online user table on instance page now correctly defaults to online only filter. [#909](<https://github.com/clusterio/clusterio/pull/909>)
+- Fixed popup not opening when pressing kill within the instance control button. [#859](<https://github.com/clusterio/clusterio/issues/859>)
+- Fix division by zero in CPU usage calculation. [#916](<https://github.com/clusterio/clusterio/issues/916>)
+- Fixed permissions list not including `grantByDefault` in the json representation. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Fixed subscription resources being `synced = false` if the remote data was empty. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Fix incorrect use of `path.parse` within create template for plugins. [#919](<https://github.com/clusterio/clusterio/pull/919>)
+- Fixed active filter icon behaviour in user search using empty string. [#917](<https://github.com/clusterio/clusterio/pull/917>)
+
+### Changes
+
+- Player auth now uses a scroll pane for listing instance names. [#909](<https://github.com/clusterio/clusterio/pull/909>)
+- `subscriptionUpdate` now fires for all subscription requests rather than just added subscriptions. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- Unified instance and global user table columns for consistent behaviour. [#917](<https://github.com/clusterio/clusterio/pull/917>)
+- Improved loading states for tables and inputs using synced state. [#917](<https://github.com/clusterio/clusterio/pull/917>)
+- Refactored username rendering into a reusable component. [#917](<https://github.com/clusterio/clusterio/pull/917>)
+
+### Breaking Changes
+
+- Renamed `lib.Address.index` to `requestIndex` and added `addressIndex`. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+- `EventSubscriber` no longer includes a values map, use `MapSubscriber` instead. [#913](<https://github.com/clusterio/clusterio/pull/913>)
+
+### Meta
+
+- Version dependencies now use `^` which enables updates to be applied one package at a time. [#803](<https://github.com/clusterio/clusterio/issues/803>)
+- Updated change log creation to include new lines and user contributions. [#909](<https://github.com/clusterio/clusterio/pull/909>)
+
+Many thanks to the following for contributing to this release:
+[@Cooldude2606](<https://github.com/Cooldude2606>)
+
+## Version 2.0.0-alpha.25
+
+### Features
+
+- Added double interrupt logic to ctl to force immediate exit. [#887](<https://github.com/clusterio/clusterio/issues/887>)
+- Allow selection of factorio versions not listed on the Wube website for instances and mod packs. [#867](<https://github.com/clusterio/clusterio/issues/867>)
+
+### Fixes
+
+- Fix the webui being unable to set host config values and that no error was displayed. [#891](<https://github.com/clusterio/clusterio/issues/891>)
+- Fix instance config not updating on changes being applied. [#901](<https://github.com/clusterio/clusterio/pull/901>)
+- Incorrect acccessing of player inventory during crafting queue serialisation when in remote view. [#892](<https://github.com/clusterio/clusterio/issues/892>)
+- Use physical location and controller for syncing player to prevent teleporting with remote view. [#894](<https://github.com/clusterio/clusterio/pull/894>)
+- Fixed player exiting space platform hub on sync and other remote view edge cases.  [#894](<https://github.com/clusterio/clusterio/pull/894>)
+
+### Changes
+
+- Config validation errors are no longer logged when raised during an request handler. [#888](<https://github.com/clusterio/clusterio/issues/888>)
+- Updated role permission editor to use grouped layout with search and improved formatting. [#902](<https://github.com/clusterio/clusterio/pull/902>)
+
+### Breaking Changes
+
+- Removed obsolete functionality to download headless server in the installer. [#890](<https://github.com/clusterio/clusterio/pull/890>)
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](<https://github.com/Cooldude2606>)
+[@Daniel](<https://github.com/Daniel>)
+[@Hornwitser](<https://github.com/Hornwitser>)
+
+## Version 2.0.0-alpha.24
+
+### Features
+
+- Added `FactorioIcon` component for showing icons from the game in the web UI. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Added `useDefaultModPack` hook to the web UI. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Added types for the exported metadata for mod packs. [#526](https://github.com/clusterio/clusterio/issues/526)
+- Added config value validation beyond simple type checks. [#856](https://github.com/clusterio/clusterio/pull/856)
+- Added config staging to allow setting many values at once. [#856](https://github.com/clusterio/clusterio/pull/856)
+- Added a warning when attempting to set player autosave slots lower than autosave slots. [#855](https://github.com/clusterio/clusterio/issues/855)
+- Added `controller.authSecret` as the type of config field `controller.auth_secret` was inconsistent. [#856](https://github.com/clusterio/clusterio/pull/856)
+- Added support for the `node:` prefix in import statements in web UI code. [#881](https://github.com/clusterio/clusterio/pull/881)
+- Added config validation to load plugin to error when save patching or script commands are disabled [#884](https://github.com/clusterio/clusterio/issues/884)
+
+### Fixes
+
+- Fixed host printing a deprecation warning on startup. [#855](https://github.com/clusterio/clusterio/issues/855)
+- Fixed exported prototype metadata missing localised_name. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Fixed headless download option in installer failing with `TypeError: callback is not a function`. [#860](https://github.com/clusterio/clusterio/issues/860)
+- Fixed controller crashing if a host attempted to download a mod that had been deleted from the controller's filesystem while the controller was running. [#860](https://github.com/clusterio/clusterio/issues/860)
+
+### Changes
+
+- Moved `/icon-reference` to `/mods/mod-packs/:id/icon-reference` and linked it from the mod pack page. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Made the `useAccount`, `useModPacks`, `useMods`, `useRoles`, `useSaves`, `useSystems`, `useUsers` and related hooks in the web UI available to plugins. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Exported prototypes are now based on the `defines.prototypes` mapping from the game. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Removed usage of fs-extra. [#860](https://github.com/clusterio/clusterio/issues/860)
+
+### Breaking Changes
+
+- Removed `useExportManifest` from the web UI. Use `.exportManifest` on a mod pack from one of the `useModPack` hooks instead. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Replaced the 8 `useTypeMetadata` hooks in the web UI such as `useItemMetadata` with `useExportPrototypeMetadata`. [#875](https://github.com/clusterio/clusterio/pull/875)
+- `.item-name` css classes are no longer created in the web UI, and will not render icons from the game. Use the `FactorioIcon` component instead and pass it a prototype from `useExportPrototypeMetadata`. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Renamed `useLocale` hook in web UI to `useExportLocale` which now requires the mod pack to load the exported locale from as an argument. [#875](https://github.com/clusterio/clusterio/pull/875)
+- Fluids are no longer merged with items in the exported prototype metadata for mod packs. [#875](https://github.com/clusterio/clusterio/pull/875)
+
+### Meta
+
+- Changelog entries are now parsed with a script from pull request descriptions. [#871](https://github.com/clusterio/clusterio/pull/871)
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Hornwitser](https://github.com/Hornwitser)
+
+## Version 2.0.0-alpha.23
+
+### Major Features
+
+- Added automatic headless download and update on linux. [#330](https://github.com/clusterio/clusterio/issues/330)
+- Added recipe notification sync to inventory sync. [#506](https://github.com/clusterio/clusterio/issues/506)
+
+### Features
+
+- Added config lock files to prevent process duplication. [#815](https://github.com/clusterio/clusterio/issues/815)
+- Added process and system start times to system metrics. [#826](https://github.com/clusterio/clusterio/issues/826)
+- Added icons to status tags for host and instances. [#827](https://github.com/clusterio/clusterio/issues/827)
+- Extended export-data to produce icons for recipes, signals, technologies, planets, qualities and entities. [#838](https://github.com/clusterio/clusterio/pull/838)
+- Added Icon Reference page to web interface at `/icon-reference` for browsing all exported icons. [#838](https://github.com/clusterio/clusterio/pull/838)
+- Added visual flash to RCON result box to confirm command execution, even when the output is identical to the previous result. [#793](https://github.com/clusterio/clusterio/issues/793)
+
+### Changes
+
+- Login screen now displays the cluster name. [#818](https://github.com/clusterio/clusterio/issues/818)
+- Instance versions can now be set using Major.Minor without specifying a patch version. [#820](https://github.com/clusterio/clusterio/issues/820)
+- Versions for factorio and mod packs can now be selected using a drop down menu. [#820](https://github.com/clusterio/clusterio/issues/820)
+- The controller will now refuse to start if no users were loaded from file. [#814](https://github.com/clusterio/clusterio/issues/814)
+- Improved wording and display of the generate host token modal. [#828](https://github.com/clusterio/clusterio/issues/828)
+- Installations where multiple conflicting clusterio/lib packages have been installed will now fail with an error [#863](https://github.com/clusterio/clusterio/issues/863).
+- Export completion now logs per-category icon counts. [#838](https://github.com/clusterio/clusterio/pull/838)
+
+### Fixes
+
+- Removed debug log statement from equipment grid serialization. [#807](https://github.com/clusterio/clusterio/pull/807)
+- Fix that the documentation had a dead link to details of the message passing protocol [#812](https://github.com/clusterio/clusterio/issues/812)
+- Fixed case where achievements were not disabled. [#817](https://github.com/clusterio/clusterio/pull/817)
+- Fix headless download on linux install. [#816](https://github.com/clusterio/clusterio/issues/816)
+- Fix option `--no-download-headless` being ignored. [#816](https://github.com/clusterio/clusterio/issues/816)
+- Fixed action buttons overflowing on narrow screens across the web interface. [#810](https://github.com/clusterio/clusterio/issues/810)
+- Fixed player logistics failing to load on servers without unlocked logistics networks. [#806](https://github.com/clusterio/clusterio/issues/806)
+- Fixed mod dependency parser breaking with inconsistent spaces. [#834](https://github.com/clusterio/clusterio/issues/834)
+- No longer attempts to sync inventory in single player. [#835](https://github.com/clusterio/clusterio/issues/835)
+- Fixed tests failing when the configured factorio_directory contains stuff other than Factorio installs [#540](https://github.com/clusterio/clusterio/issues/540).
+- Always create a whitelist file so it can be watched for changes. [#865](https://github.com/clusterio/clusterio/issues/865)
+- Added missing await statements which could cause an instance to start with an outdated admin/ban/whitelist. [#869](https://github.com/clusterio/clusterio/issues/869)
+- Fixed metrics breaking when labels contain comma or equal signs [#861](https://github.com/clusterio/clusterio/issues/861)
+- Fixed Host page show repeated errors when viewing an offline local host [#848](https://github.com/clusterio/clusterio/issues/848)
+- Fixed bad mod paths in icon specifications crashing the export. [#841](https://github.com/clusterio/clusterio/issues/841)
+- Fixed prototypes with no icon data causing errors during export. [#841](https://github.com/clusterio/clusterio/issues/841)
+
+### Breaking Changes
+
+- Custom permission methods should use `IUser` rather than `IControllerUser` [#837](https://github.com/clusterio/clusterio/pull/837)
+- `controller.userManager` has been refactored, see PR for details. [#837](https://github.com/clusterio/clusterio/pull/837)
+- `controller.instances` has been refactored, see PR for details. [#837](https://github.com/clusterio/clusterio/pull/837)
+- `User/Instance/HostInfo` renamed to `User/Instance/HostRecord` [#837](https://github.com/clusterio/clusterio/pull/837)
+- Removed `host.tls_ca` and `control.tls_ca` config options, see [section on self signed certificates](https://github.com/clusterio/clusterio/blob/master/docs/setting-up-tls.md#creating-and-using-a-self-signed-certificate) for the replacement for this option [#857](https://github.com/clusterio/clusterio/issues/857)
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Daniel](https://github.com/Danielv123)
+[@Double](https://github.com/DoubleThoughtTheProgrammer)
+[@Hornwitser](https://github.com/Hornwitser)
+[@Ryan Walker](https://github.com/solarcloud7)
+
+## Version 2.0.0-alpha.22
+
+### Major Features
+
+- Added a download dependencies button which downloads missing dependencies. [#726](https://github.com/clusterio/clusterio/issues/726)
+- Added an update mod button which downloads the latest compatible version of a mod. [#725](https://github.com/clusterio/clusterio/issues/725)
+
+### Features
+
+- Added online player list to instance details page. [#666](https://github.com/clusterio/clusterio/issues/666)
+- Added ability to restart instances as a single action. [#779](https://github.com/clusterio/clusterio/issues/779)
+- Added ability to exclude instances from the 'Start all' web UI button. [#451](https://github.com/clusterio/clusterio/issues/451)
+- Added plugin update detection for restart required [#759](https://github.com/clusterio/clusterio/issues/759)
+- Added detection for mismatched mod and mod pack factorio version. [#727](https://github.com/clusterio/clusterio/issues/727)
+- Added detection for dependency issues such as incompatible or wrong version. [#727](https://github.com/clusterio/clusterio/issues/727)
+- Added a quick fix button for resolving detected dependency issues. [#801](https://github.com/clusterio/clusterio/issues/801)
+
+### Changes
+
+- Restart host / controller is now the default action with stop moved to a dropdown. [#780](https://github.com/clusterio/clusterio/issues/780)
+- Restart host / controller no longer shows unless it is enabled for that machine. [#780](https://github.com/clusterio/clusterio/issues/780)
+- Plugin templates no longer depend on a dev install of Clusterio. [#786](https://github.com/clusterio/clusterio/issues/786)
+- Better error message for when a plugin is missing an index file. [#799](https://github.com/clusterio/clusterio/pull/799)
+- `ModStore.downloadMods` no longer checks if the mod is already downloaded. [#801](https://github.com/clusterio/clusterio/issues/801
+- Mod version for buildins will always be fully qualified, matching the requirement enforced on other mods. [#801](https://github.com/clusterio/clusterio/issues/801))
+- Subscriptions can now be filtered. [#788](https://github.com/clusterio/clusterio/pull/788)
+
+### Fixes
+
+- Fixed the missing space between action buttons on the users and hosts list. [#780](https://github.com/clusterio/clusterio/issues/780)
+- Fixed "rendered more hooks" error when refreshing hosts page. [#769](https://github.com/clusterio/clusterio/issues/769)
+- Fixed inventory combinator time signal not always updating [#610](https://github.com/clusterio/clusterio/issues/610)
+- Renamed templates for `.gitignore` and `.npmignore` that caused `create --plugin-template` to fail. [#800](https://github.com/clusterio/clusterio/pull/800)
+- Fixed npm update button failing to apply update and restart.
+
+### Breaking changes
+
+- `ModPortalDownloadRequest` now requires an array of mod version pairs rather than a single mod name and version. [#801](https://github.com/clusterio/clusterio/issues/801)
+- Version strings (e.g. `1.0`, `1.0.0`) now have stricter typing and validation, passing unchecked strings to functions will error. [#801](https://github.com/clusterio/clusterio/issues/801)
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@Hornwitser](https://github.com/Hornwitser)
+
+## Version 2.0.0-alpha.21
+
+### Major Features
+
+- Added import, export, and restore of user lists (bans / admins / whitelist / combined). [#717](https://github.com/clusterio/clusterio/issues/717)
+- Added remote update for core packages and third party plugins. [#761](https://github.com/clusterio/clusterio/issues/761)
+- Added config cloning on instance creation. [#720](https://github.com/clusterio/clusterio/issues/720)
+
+### Features
+
+- Added social links and instructions to error page. [#742](https://github.com/clusterio/clusterio/issues/742)
+- Added button to download control config. [#740](https://github.com/clusterio/clusterio/issues/740)
+- Added server action filter (aka "chat filter") to instance log in web ui. [#744](https://github.com/clusterio/clusterio/issues/744)
+- Added `factorio.console_logging` to enable dedicated console log file for servers. [#748](https://github.com/clusterio/clusterio/issues/748)
+- Added a recovery mode to host and controller accessible as an option on the run command. [#752](https://github.com/clusterio/clusterio/issues/752)
+- Added username search to the users list. [#751](https://github.com/clusterio/clusterio/issues/751)
+- Added log level filtering to the web ui. [#745](https://github.com/clusterio/clusterio/issues/745)
+- Added pending update detection for host and controller. [#758](https://github.com/clusterio/clusterio/issues/758)
+- Added restart required indicator for host and controller. [#758](https://github.com/clusterio/clusterio/issues/758)
+- Added version mismatch indicator in host list. [#758](https://github.com/clusterio/clusterio/issues/758)
+- Added host plugin list command to crl where previously only controller plugin list existed. [#760](https://github.com/clusterio/clusterio/issues/760)
+- Added optional feature which allows new plugins to be installed remotely.
+- Added bidirectional whitelist syncing. [#716](https://github.com/clusterio/clusterio/issues/716)
+- Added support for v2 map exchange strings. [#700](https://github.com/clusterio/clusterio/issues/700)
+
+### Fixes
+
+- Fixed handling of zip files with multiple top-level folders. [#739](https://github.com/clusterio/clusterio/issues/739)
+- Fixed looping between instances of ban and admin sync events. [#736](https://github.com/clusterio/clusterio/issues/736)
+- Fixed quality being stripped from power armour equipment when moving between servers [#753](https://github.com/clusterio/clusterio/pull/753)
+- Resolved webpack type export warnings [#750](https://github.com/clusterio/clusterio/pull/750)
+- Reduce page load time on users list by enabling pagination. [#718](https://github.com/clusterio/clusterio/issues/718)
+- Corrected stack trace and enabled source mapping during bootstrap. [#764](https://github.com/clusterio/clusterio/pull/764)
+- Fixed map gen settings using the incorrect name for cliff settings following exchange string decode.
+
+### Meta
+
+- Silent testing is now truly silent. [#764](https://github.com/clusterio/clusterio/pull/764)
+- Node 18 has reached end of life and is no longer maintained, we no longer guarantee support for it.
+- CI testing now runs on node 20 & 22 as well as factorio 1.1.110 & 2.0.47.
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@Hornwitser](https://github.com/Hornwitser)
+
+## Version 2.0.0-alpha.20
+
+### Features
+
+- Update subspace storage to 2.0 and space age. [#733](https://github.com/clusterio/clusterio/pull/733)
+- A fresh install of Clusterio will include default mod packs. [#719](https://github.com/clusterio/clusterio/issues/719)
+
+### Fixes
+
+- Fix crash when leaving a server without a logistic requester point [#731](https://github.com/clusterio/clusterio/pull/731)
+- Use floor instead of round to prevent "1 minute and 60 seconds" being shown [#723](https://github.com/clusterio/clusterio/issues/723)
+- Fixed production statistics overwriting consumption statistics and vise versa [#734](https://github.com/clusterio/clusterio/pulls/734)
+- Hot patch to add the updated 2.0.29 control.lua freeplay hash to know scenarios. [commit](https://github.com/clusterio/clusterio/commit/26269df7d4d8f39042c59653008bc8f034a4f3b4)
+
+### Meta
+
+- We have now introduced a new [decisions log](https://github.com/clusterio/clusterio/blob/master/docs/decisions.md) to aid tracking all the technical and design decisions we make and their reasons. [#714](https://github.com/clusterio/clusterio/pull/714)
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@psihius](https://github.com/psihius)
+
+## Version 2.0.0-alpha.19
+
+### Major Features
+
+- Added support for 2.0 builtin mods during mod pack creation. [#684](https://github.com/clusterio/clusterio/pull/684)
+- Added basic 2.0 support to clusterio lua api and 1st party plugins. [#685](https://github.com/clusterio/clusterio/pull/685)
+
+### Features
+
+- Added Datastore and Datastore Provider classes to the library to support savable Maps. [#629](https://github.com/clusterio/clusterio/pull/629)
+- Added clean script to speed up publishing and debugging of build steps. [#640](https://github.com/clusterio/clusterio/pull/640)
+- Added sub-tile option on plugin page headers. [#642](https://github.com/clusterio/clusterio/pull/642)
+- Greatly improved plugin and module template generation. [#641](https://github.com/clusterio/clusterio/pull/641)
+- Duplicate host connections from the same address will kill the older host process. [#647](https://github.com/clusterio/clusterio/pull/647)
+- Controller will refuse duplicate host connections from different addresses. [#647](https://github.com/clusterio/clusterio/pull/647)
+- Monorepos are now supported for external plugins. [#654](https://github.com/clusterio/clusterio/pull/654)
+- Changed default role selection to be a dropdown menu rather than id. [#664](https://github.com/clusterio/clusterio/pull/664)
+- Added credential option to config entries to allow writing sensitive data that can't be read back remotely.
+- Allow hidden and readonly graphical representations of config values. [#665](https://github.com/clusterio/clusterio/pull/665)
+- Added locale exporting for all builtin mods, not just for the base mod. [#684](https://github.com/clusterio/clusterio/pull/684)
+- Added option for silent testing which only shows the results, can be ran using `pnpm silent-test` [#680](https://github.com/clusterio/clusterio/pull/680)
+- Added prompt for http port on installation of Clusterio. [#564](https://github.com/clusterio/clusterio/issues/564)
+- Added drag and drop overlay to upload button on mods page and save table on instance page. [#591](https://github.com/clusterio/clusterio/issues/591)
+- Automatically add plugins from ./plugins, ./external_plugins and installed npm modules. [#692](https://github.com/clusterio/clusterio/pull/692)
+- `compat.table_to_json` and `compat.json_to_table` supported in all stages in pre 2.0 [#687](https://github.com/clusterio/clusterio/issues/687)
+- Add "connect to server" button to web interface, launches with steam api. [#608](https://github.com/clusterio/clusterio/issues/608)
+- Add space platform name mapping to space platform statistics. [#706](https://github.com/clusterio/clusterio/pull/706)
+- Track space platform speed metric clusterio_statistics_exporter_platform_speed. [#706](https://github.com/clusterio/clusterio/pull/706)
+- Track space platform weight metric clusterio_statistics_exporter_platform_weight. [#706](https://github.com/clusterio/clusterio/pull/706)
+- Added bidirectional sync to admin and ban list. [#709](https://github.com/clusterio/clusterio/pull/709)
+
+### Fixes
+
+- Fixed IPC errors reporting undefined when no stack trace was present. [#624](https://github.com/clusterio/clusterio/pull/624)
+- Fixed loopback routing for instances reporting the wrong error message. [#625](https://github.com/clusterio/clusterio/pull/625)
+- Fixed docs linking to non-existing js files after ts migration. [#633](https://github.com/clusterio/clusterio/pull/633)
+- Fixed CI workflows using deprecated version of nodejs. [#637](https://github.com/clusterio/clusterio/pull/637)
+- Fixed linux only tests to run on windows. [#661](https://github.com/clusterio/clusterio/pull/661)
+- Fixed log events being sent from a host over an invalid websocket. [#639](https://github.com/clusterio/clusterio/pull/639)
+- Fixed spaces passed in arguments to the installer causing it to break. [#620](https://github.com/clusterio/clusterio/issues/620)
+- Fixed numeric admin name breaking login. [#536](https://github.com/clusterio/clusterio/issues/536)
+- Fixed issues with subscriptions which prevented them from working on instances or generic events. [#655](https://github.com/clusterio/clusterio/pull/655).
+- Fixed unreliable datastore tests. [#662](https://github.com/clusterio/clusterio/pull/662).
+- Fixed 2.0 version extraction from linux headless. downloaded during installation of clusterio. [#671](https://github.com/clusterio/clusterio/pull/671)
+- Fixed invalid transient state during server start. [#676](https://github.com/clusterio/clusterio/issues/676)
+- Fixed host user sync to instances after reconnecting to the. controller. [#678](https://github.com/clusterio/clusterio/pull/678)
+- Fixed WebUI adding and displaying the wrong base mod version. [#684](https://github.com/clusterio/clusterio/pull/684)
+- Fixed WebUI inconsistent pattern matching for factorio version. [#684](https://github.com/clusterio/clusterio/pull/684)
+- Fixed `safeOutputFile` not being atomic because of a missing path separator. [#659](https://github.com/clusterio/clusterio/pull/659)
+- Fixed built-in mods showing as missing in the WebUI. [#581](https://github.com/clusterio/clusterio/issues/581)
+- Fixed dirty flag not being set when only the config of an instance is updated. [#675](https://github.com/clusterio/clusterio/pull/675)
+- Fixed incorrect command being used to remove players from the whitelist. [#679](https://github.com/clusterio/clusterio/pull/679)
+- Fixed CI following undocumented breaking change from downstream dependency. [#683](https://github.com/clusterio/clusterio/pull/683)
+- Fixed instance crash when missing saves folder. [#698](https://github.com/clusterio/clusterio/issues/698)
+- Fixed statistics exporter not working on newer versions of windows 11 due to wmic deprecation. [#707](https://github.com/clusterio/clusterio/issues/707)
+
+### Changes
+
+- Added prompt for the HTTP port to host the controller to the installer. [#619](https://github.com/clusterio/clusterio/pull/619)
+- Added tests for sendEvent and sendRequest throwing the correct error messages. [#638](https://github.com/clusterio/clusterio/pull/638)
+- Updated all web ui pages to use correct page header component. [#643](https://github.com/clusterio/clusterio/pull/643)
+- Bumped Typescript version to 5.5 and implemented `${configDir}` in base configs for "outDir". [#648](https://github.com/clusterio/clusterio/pull/648).
+- Added factorio.executable_path option which allows overriding the default path to the Factorio executable run.
+- Added instance version display. [#573](https://github.com/clusterio/clusterio/pull/573)
+- Added `factorio.shutdown_timeout` config to set the time the host will wait for a Factorio server to shut down befor killing it.
+- Changed shutdown logic to prefer sending a /quit command via RCON instead of using diverging logic on Windows and Linux.
+- Added `controller.factorio_username` and `controller.factorio_token` config to set Factorio credentials used for the whole cluster.
+- Added `controller.share_factorio_credential_with_hosts` config to optionally require hosts to provide their own credentials.
+- Added `host.factorio_username` and `host.factorio_token` config to set Factorio credentials used on a given host.
+- Changed `instance.rcon_password` config to be a credential field that can not be read by the control interface.
+- Changed `host.id` `instance.id` and `instance.assign_host` config to be hidden fields that can not be seen on the web ui.
+- Updated display name and description of `controller.external_address` to avoid confusion. [#674](https://github.com/clusterio/clusterio/pull/674)
+- Renamed config value `controller.external_address` to `controller.public_url`, migrations are applied automatically.
+- String config values with whitelisted values (enum) now display as a selection dropdown. [#701](https://github.com/clusterio/clusterio/pull/701)
+- Existing selection dropdowns now support search filtering. [#701](https://github.com/clusterio/clusterio/pull/701)
+- Added surface label to clusterio_statistics_exporter_instance_force_flow_statistics. [#691](https://github.com/clusterio/clusterio/issues/691)
+- Compat lib now supports versions from 0.17 to 2.0 [#711](https://github.com/clusterio/clusterio/pull/711)
+- Add bidirectional sync to admin and ban list. [#709](https://github.com/clusterio/clusterio/pull/709)
+
+### Breaking Changes
+
+- Previously silent errors for controller.sendEvent now throw exceptions [#625](https://github.com/clusterio/clusterio/pull/625).
+- @clusterio/controller export InstanceInfo has added factorioVersion parameter.
+- Argument order for `Config.canAccess` changed to require an access mode passed as the second argument.
+- Instances can now have `factorio.enable_script_commands` disabled which will throw an error when any script command is used over rcon. [#681](https://github.com/clusterio/clusterio/pull/681).
+- User IDs are now case insensitive, duplicate users will be automatically merged with a backup created. [#682](https://github.com/clusterio/clusterio/pull/682)
+- Plugins now require the keyword "clusterio-plugin" in package.json to be automatically loaded [#692](https://github.com/clusterio/clusterio/pull/692)
+
+Many thanks to the following for contributing to this release:  
+[@CCpersonguy](https://github.com/CCpersonguy)
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@Hornwitser](https://github.com/Hornwitser)
+[@Laar](https://github.com/Laar)
+[@psihius](https://github.com/psihius)
+
+
+## Version 2.0.0-alpha.18
+
+### Features
+
+- Added logging of HTTP requests and errors on the controller [#556](https://github.com/clusterio/clusterio/pull/556).
+- Added caching of data parsed from mods to speed up startup time [#606](https://github.com/clusterio/clusterio/pull/606).
+- Added command to installer to generate the code for making a new plugin [#570](https://github.com/clusterio/clusterio/pull/570).
+
+### Changes
+
+- Fixed Inventory Sync reporting a negative database size [#598](https://github.com/clusterio/clusterio/pull/598).
+- Fixed plugin events being invoked while a host connection was in an invalid state.
+- Suppresed bogus warning about event listener leak in the browser's console [#600](https://github.com/clusterio/clusterio/pull/600).
+- Fixed installer breaking on Windows after Node.js released a security fix [#614](https://github.com/clusterio/clusterio/pull/614).
+- During a data export the mod settings in mod packs will now be corrected to the type of the settings prototype if the type is incorrect.
+- Fixed missing color setting causing the Mod Pack view in the Web UI to show an error [#609](https://github.com/clusterio/clusterio/issues/609).
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@Hornwitser](https://github.com/Hornwitser)
+
+
+## Version 2.0.0-alpha.17
+
+### Features
+
+- Made the host an instance is assigned to link to the host page for that host in the Web UI [#587](https://github.com/clusterio/clusterio/pull/587).
+- Added pagination to the saves list.
+
+### Changes
+
+- Fixed an unhandled error in Subspace Storage crashing the host.
+- Fixed an unhandled rejection in disconnect logic crashing the host.
+- Fixed instance screen in Web UI not updating when an instance was reassigned.
+- Fixed an error thrown in the rendering of one page in the Web UI causing all pages to become inaccessible.
+- Fixed Web UI not showing instance saves when the permission to list and subscribe the saves is granted but the user is not a cluster admin.
+- Similarly fixed Web UI not showing the mod pack create, delete, list and host revoke token actions if the user is not a cluster admin.
+- Fixed Research Sync applying progress of a previous techology level to the level on the controller when it's the active research during instance startup.
+- Fixed data export with a mod using shorthand notation for the default value of a color-setting causing the ModPack data to be set to invalid data.
+- Fixed per user per instance player stats not being deleted when the instance it's for is deleted.
+- Fixed mods setting the item prototype icons property to an object mapping instead of an array breaking the data export.
+- Fixed a bad mod in the host's mods folder causing instance start to fail instead of the host re-downloading the mod.
+
+### Breaking Changes
+
+- Renamed the permission `core.instance.save.list.subscribe` to `core.instance.save.subscribe`.
+
+Many thanks to the following for contributing to this release:  
+[@Cooldude2606](https://github.com/Cooldude2606)
+[@Danielv123](https://github.com/Danielv123)
+[@Hornwitser](https://github.com/Hornwitser)
+
+
+## Version 2.0.0-alpha.16
+
+### Changes
+
+- Fixed message sequences not being renumbered when forwarded between links causing reconnects to send duplicated messages.
+
+
+## Version 2.0.0-alpha.15
+
+### Features
+
+- Added support for `color-settings` Mod settings [#568](https://github.com/clusterio/clusterio/issues/568).
+- Added `clusterio_controller_pending_requests` and `clusterio_host_pending_requests` metrics.
+
+### Changes
+
+- Fixed generated systemd file for clusteriohost not enabling source maps.
+- Fixed ctl not exporting types used for adding commands to ctl plugins.
+- Fixed controller only plugins throwing an error about missing a config field on startup out when added to hosts.
+- Fixed installer incorrectly claiming the options --factorio-dir and --no-download-headless conflicts with each other.
+- Fixed a memory leak on every request sent over the WebSocket.
+- Fixed assertion error on closing or invalidating a link with messages forwarded from a virtual link.
+- Fixed host hanging if stopped while an instance is in the process of creating a save during startup.
+- Fixed `instance.auto_start` option.
+- Fixed host log spammed with errors when plugins broadcast messages to instances with the plugin disabled.
+- Fixed properties of object config fields not being possible to remove.
+
+
+## Version 2.0.0-alpha.14
+
+This release does not retain backwards compatibility with 2.0.0-alpha.13 meaning all parts of the cluster needs to updated at the same time.
+See the [migration guide](https://github.com/clusterio/clusterio/blob/e0755cb4ee7bce0068c844ab6271da481a843e62/docs/migrating-from-2.0.0-alpha.13.md) for how to update.
+
+### Major Features
+
+- Added mod management. Mods can be uploaded to the controller and included in mod packs that can be assigned to instances and run.
+- Added host port ranges which the instance ports will be automatically assigned a port from if factorio.game_port is not set.
+- Added system info such as CPU model, hostname and kernel along with basic metrics for CPU usage, memory usage and disk usage for the controller and hosts.
+- Added ability to remotely view and modify the configuration of hosts.
+
+### Features
+
+- Added logging of Clusterio version on startup
+- Added `clusterio_controller_log_bytes` metric counting the size of the log files on the controller.
+- Added warning logged when plugins on a connecting host does not match the ones installed on the controller.
+- Added ability to revoke user tokens.
+- Added restart required indicator to config fields in the Web UI.
+- Added ability to revoke host tokens.
+- Added support for plugins to run in the context of a host.
+- Added more feedback when the web UI and or its plugins fails to load.
+- Added autosaving of data held in memory on the controller such as configs, instances, users, mods to prevent large data loss on crashing.
+- Added `system_info` metric with kernel, instruction set, CPU Model, hostname and Node.js version of the controller.
+- Added `clusterio_host_system_info` metric with kernel, instruction set, CPU Model, hostname and Node.js version of hosts.
+- Added `system_cpu_seconds_total`, `system_cpu_idle_seconds_total`, `system_memory_capacity_bytes`, `system_memory_available_bytes`, `system_disk_capacity_bytes`, `system_disk_available_bytes` metrics for CPU, memory and disk usage on the controller.
+- Added `clusterio_host_system_cpu_seconds_total`, `clusterio_host_system_cpu_idle_seconds_total`, `clusterio_host_system_memory_capacity_bytes`, `clusterio_host_system_memory_available_bytes`, `clusterio_host_system_disk_capacity_bytes`, `clusterio_host_system_disk_available_bytes` metrics for CPU, memory and disk usage on hosts.
+- Added support for reading the client's IP address from the `X-Forwarded-For` header when the source address is in the `controller.trusted_proxies` config option.
+- Added field showing the IP address a host is connecting from.
+- Added per player statistic tracking when they were first seen joining a particular server.
+- Added ability to remotely restart and/or stop the controller and hosts.
+
+### Changes
+
+- Fixed filenames with extensions that are invalid on Windows such as "con.zip" not being treated as invalid.
+- Fixed generate host token modal not using a random id when the optional id field is unset.
+- Exported Factorio data is now tied to mod packs instead of being per cluster.
+- Fixed export failing if a mod uses a different root folder mod_version in its zip file.
+- Fixed sorting of user last seen column in the Web UI.
+- The list users permission is now granted by default to players.
+- Fixed incorrect handling of hosts and instance with an id of 0 causing them to not update properly.
+- Fixed unable to unassign instances in the Web UI.
+- Fixed host crashing if the Factorio server is not marked executable.
+- Fixed errors logged from instance not being attributed to the instance in certain situations.
+- Hosts no longer print messages from instances into their console.
+- Clusterio now treat unhandled Node.js errors and promise rejections as fatal and exit immediately.
+- Fixed a potential for data loss after a hard system crash due to fsync not being called on files written.
+- Fixed Factorio server crashing in the research_sync plugin when a mod enables a previously disabled technology and a player attempts to research it.
+- Fixed Factorio server crashing when the game starts with tick_paused = true
+- Removed migration of alpha 10's single file log format.
+- Log errors linking mods on Windows instead of preventing startup.
+- Added locale support for modules patched into to the game save.
+- Added support for defining a module_exports.lua file for modules patched into the game save.
+- Fixed controller logs being split on server's local time day boundary instead of UTC day boundary.
+- Fixed Unicode BOM in mod locale files breaking instance data export.
+- Added a warning to the server-setting.json that is automatically written to instance folders stating changes will be overwritten.
+- Changed save patching to use a `.tmp.zip` extension for the temporary file created instead of `zip.tmp`.
+- Fixed Inventory Sync wiping the player's inventory when logging out while in the Space Exploration remote view mode.
+- Fixed the public /api/plugins endponit leaking filesystem paths on the controller.
+- Refactored list subscriptions in the Web UI to cache and only fetch updated entries when navigating to previously seen list.
+- Added caching of save lists on the controller, enabling the saves of instances on offline hosts to still be seen.
+- Hosts in the assign instance dropdown is now sorted by name.
+- Added `non_blocking_saving` as one of the default settings added to `factorio.settings` on new instances.
+
+### Breaking Changes
+
+- Renamed usage of the terms master and slave to controller and host in all places they occur.
+- Mods located in `sharedMods` are no longer copied to instances' mods folder.
+- The instances' mods folder is now managed through mod packs, mods not part of the mod pack will be automatically deleted.
+- Removed ability to import sub packages like `@clusterio/lib/link` from.
+- Replaced `clusterio_controller_http_hits_total` metric with `clusterio_controller_http_endpoint_duration_seconds`.
+- Replaced `clusterio_controller_last_query_log_duration_seconds` metric with `clusterio_controller_query_log_duration_seconds` summary.
+- Reworked the network protocol to be simpler to work and reason with.
+- Bumped minimum supported Node.js version to v18.
+- Ported the codebase to TypeScript
+- Changed the config format stored on disk to be much simpler.
+
+### Contributors
+
+Many thanks to the following for contributing code in this release:  
+[@Hornwitser](https://github.com/Hornwitser) [@Luciole0x](https://github.com/Luciole0x) [@Cooldude2606](https://github.com/Cooldude2606) [@Danielv123](https://github.com/Danielv123) [@Reavershark](https://github.com/Reavershark) [@Laar](https://github.com/Laar) [@rstrom1763](https://github.com/rstrom1763)
+
+## Version 2.0.0
+
+### Major Features
+
+- Replaced Hotpatch with save patching.
+  Removed the Hotpatch scenario and the depency on it for getting code into the game.
+  Added a save patcher than runs before starting up Factorio that patches in lua modules based on the event_loader lib into the savegame.
+  Regular freeplay games can now be used with Clusterio and will be compatible without having to convert them to Hotpatch.
+- Daemonized hosts.
+  Hosts now have the ability to run multiple Factorio instances, starting and stopping them individually.
+  To manage this the local command line interface has been replaced with a remote interface on the controller that can be accessed through the clusterioctl cli tool.
+- Rewritten the communication between hosts and the controller from scratch.
+  The new system is based on a WebSocket connection between the hosts and the controller and provides efficient validated bi-directonal communication.
+- Rewritten the plugin system from scratch.
+  Plugins now inherit from a base class and use the same WebSocket connection Clusterio uses to communicate.
+- New configuration system with support for initializing configs when needed, modifying config entries using built-in commands, and updating instance configuration remotely.
+- Packaged and uploaded to npm again, greatly simplifying distribution and installation of both Clusterio and plugins.
+- Added centralized logging for the cluster.
+  All logs from both Clusterio and Factorio is stored in a shared log which can be inspected and queried.
+- Added remote save management with the ability to list, create, rename, copy, upload, download, transfer, delete and load saves for instances.
+
+### Features
+
+- Added export of pollution statitics.
+- Reconnection logic that esures no data is dropped talking to the controller provided the session can be resumed.
+- Added support for having multiple Factorio installs and selecting which version to use on a per instance basis.
+- Added config to specify which path the controller interface is accessed under, allowing it to be proxied behind web-server.
+- Added WebSocket usage statistics.
+- Added commands sent statistic.
+- Added Factorio server CPU and memory usage statistic.
+- Added Factorio autosave size statistic.
+- Added support for extracting locale and item icons from Factorio and mods.
+- Added integrated user management for controlling access and storing per player data.
+- Added synchronization of in-game adminlist, banlist and whitelist to Clusterio core.
+  Previously this was handled by the playerManager plugin.
+- Added stripping of long paths in the Factorio server log.
+- Added option to configure maximum number of commands to send in parallel.
+- Added option to auto start instances on host startup.
+- Added metric mapping of host and instance ids to their names, allowing them to be displayed by name in queries that join with the mapping.
+- Added option to configure timeout for exported Prometheus metrics.
+- Added option to set address to bind HTTP(S) port to.
+- Added an overview of the installed plugins to the web interface.
+- Added clusterioctl command to list plugins on the controller.
+- Added Player Auth plugin for logging in to the web interface by proving the ability to log in to a server as a given user.
+- Added Node.js based installer to simplify setting up a cluster.
+
+### Changes
+
+- Added error handling during controller startup.
+- Factorio game and rcon port now defaults to a random port above 49151.
+- Removed unimplemented mods update command.
+- Fixed rcon password being generated with Math.random().
+- Added plugins directory to the views path.
+  This makes it possible for plugins to render their own ejs views or pages in their own folders by using paths of the format "pluginName/path/to/page-or-view".
+- Replaced the per instance copy of the shared Factorio mods with symlinks.
+  On Windows hard links are used instead due to the privileges requirements of symlinks.
+- Changed the per instance scenario folder to be linked instead of copied on instance creation.
+- Instance id is no longer derived from the rcon password, instead it's generated upon instance creation and stored in the instance config.
+- The game port, RCON port and RCON password instance config entries are are now null by default, indicating that a random one will be generated every time the instance is started.
+- Removed the broken client download command as this would download pre-releases.
+- Moved the item database and HTTP definitions for /api/place, /api/remove, /api/inventory, /api/inventoryAsObject and the web interface view for the storage page into the clusterioMod plugin.
+  If you disable this plugin then these things will not be available.
+- Removed undocumented --port and --rcon-port arguments to client.
+- Removed undocumented FACTORIOPORT and RCONPORT enviroment variable handling in client.
+- Removed redundant call to /api/slaves in globalChat plugin.
+- Removed broken serverManager plugin.
+- Removed factorio_version from config.
+  The version installed is auto detected and used instead.
+- Removed the playerManager specific command CLI tools/delete_player.js.
+- Creating an instance, assigning it to a host, creating a save for an instance and starting an instance is now four separate commands.
+- Removed oddball limits to hosts.json size.
+- Moved host specific and instance specific configuration into their own configuration files.
+- Removed unused binary option from plugin config.
+- Removed info and shout command from globalChat plugin - Removed mirrorAllChat and enableCrossServerShout configuration options for globalChat plugin.
+- Removed UPSdisplay plugin.
+  UPS statistics is exported by the statistics exporter plugin.
+- Controller now defaults to hosting on https on port 8443.
+- Renamed client to slave.
+- Removed rotation of factorio-current.log files.
+
+### Breaking Changes
+
+- Removed lib/authenticate.
+  Breaks playerManager.
+- The masterIP and masterPort config entries has been merged into masterURL.
+  Breaks discordChat, playerManager, serverSelect, trainTeleports and clusterioModel.
+- Removed config management from the command line and the server manager.
+- Moved ejs templates into views folder and changed their extension to .ejs.
+  Breaks playerManager.
+- Mods are no longer copied from the per instance instanceMods directory.
+  If you need per instance mods you can now place them directly in the mods directory inside the instance folder.
+- Hotpatch scenarios and code loading is no longer compatible with Clusterio.
+  Breaks playerManager, serverSelect, and tranTeleports.
+- Removed getLua and getCommand from lib/clusterTools.
+  If you need to run more than the most trivial of code in commands use the save patcher and add in a remote interface.
+- Removed mod uploading and distributing from the HTTP interface.
+  Breaks the old unmaintained and no longer needed factorioClusterioClient.
+- Removed the remoteCommands plugin and the old runCommand interface.
+  Breaks playerManager and external tools sending commands.
+- Removed broken serverManager plugin.
+- Removed fields info, time, rconPort, rconPassword, serverPort, unique, mods, instanceName, playerCount, mac, and meta from the hosts in the host database.
+- Removed getInstanceName and lib/clusterTools.
+  Breaks playerManager, and discordChat.
+- Removed the /api/rconPasswords, and /api/slaves endpoints.
+  Breaks web interface, trainTeleports, and discordChat.
+- Removed the /api/getSlaveMeta and /api/editSlaveMeta endpoints.
+  Breaks researchSync, and UPSdisplay.
+- Removed the hello event from the socket connection handshake.
+  Breaks playerManager, trainTeleports, serverSelect, and discordChat
+- Changed the format of database/hosts.json.
+- Removed the output file subscription system.
+  Breaks inventoryImports, playerManager, trainTeleports, serverSelect and researchSync.
+- Removed the factorioOutput hook from instance plugins.
+  The onOutput hook provides parsed output instead.
+- Removed the onLoadFinish hook from master plugins.
+- Moved plugins from the sharedPlugins directory to plugins directory.
+- Implemented a new plugin system that replaces the old.
+  Breaks all plugins.
+- Removed express metric http_request_duration_milliseconds metric.
+- Removed socket.io metrics socket_io_connected, socket_io_connect_total, socket_io_disconnect_total, socket_io_events_received_total, socket_io_events_sent_total, socket_io_recieve_bytes, and socket_io_transmit_bytes,
+- Removed clusterio_connected_instaces_gauge and added clusterio_master_connected_clients_count in its place.
+- Renamed clusterio_player_count_gauge to clusterio_statistics_exporter_instance_player_count
+- Removed clusterio_UPS_gauge and added clusterio_statistics_exporter_instance_game_ticks_total in its place.
+- Renamed clusterio_endpoint_hit_gauge to clusterio_http_enpoint_hits_total
+- Renamed clusterio_statistics_gauge to clusterio_statistics_exporter_instance_force_flows
+- Renamed clusterio_nn_dole_gauge to clusterio_subspace_storage_nn_dole_gauge.
+- Renamed clusterio_dole_factor_gauge to clusterio_subspace_storage_dole_factor_gauge.
+- Renamed clusterio_import_gauge to clusterio_subspace_storage_import_total.
+- Renamed clusterio_export_gauge to clusterio_subspace_storage_export_total.
+- Renamed clusterio_master_inventory_gauge to clusterio_subspace_storage_master_inventory.
+- Removed clusterioMod plugin specific config options logItemTransfers, disableFairItemDistribution useNeuralNetDoleDivider, autosaveInterval, and disableImportsOfEverythingExceptElectricity from the master config.
+- Removed msBetweenCommands config option.
+  The RCON is instead limited to 5 concurrent commands.
+- Removed allowRemoteCommandExecution config option.
+  Remote commands are always allowed with the move to controller managing hosts/instances.
+- Removed `--databaseDirectory`, `--controllerPort`, and `--sslPort` command line arguments from the controller.
+- Implemented a new config system that replaces the old.
+  Breaks all plugins.
+- Removed usage of socket.io entirely in favor of a plain WebSocket connection.
+- Renamed clusterioMod plugin to subspace_storage.
+- Controller no longer creates secret-api-token.txt.
+- Removed automatic creation of self-signed TLS certificate.
+- Node.js versions below 12 are no longer supported.
+
+## Version 1.2.4
+
+- Removed broken remote combinator signaling.
+- Fixed research sync endlessly updating already researched technologies
+- Removed obsolete item/fluid statistics from clusterioMod
+- Removed per mod upload logging when config.uploadModsToMaster disabled
+- Fixed bcrypt failing to install on windows due to the new version not having Windows binaries.
+
+
+## Version 1.2.3
+
+- Disabled uploading mods to the master server by default as this is mostly just a waste of bandwidth with the mod portal being integrated into the game now.
+- Fixed researchSync breaking with heavily modded games due to the tech tree exceeding the default 100kb limit on JSON payloads.
+- Fixed the command inventoryImport sends referencing player instead of character, and trying to count the non-existant quick bar slots.
+- Fixed inventoryImport never receiving the script output after the default mode for reading script output changed to tail mode.
+- Fixed desync caused by the mods and loaded mods arrays in Hotpatch getting out of sync when plugins update their scenario mod code.
+  To fix existing games you will need copy lib/scenarios/Hotpatch/hotpatch/mod-tools.lua over the existing mod-tools.lua in the save's hotpatch folder.
+- Updated the Windows install instructions.
+
+
+## Version 1.2.2
+
+- Fixed possible crash with modded technologies named the same as a built-in Object prototype property in researchSync.
+- Fixed progress of a current infinite tech carrying over to the next one when researching it and another node completes it in researchSync.
+- Fixed progress of a previous infinite tech from another node being applied to the current one in researchSync.
+- Fixed crash in researchSync when modded technologies are present only on some nodes.
+- Fixed install failing due to bcrypt version less than 3 not being supported on node v10.
+- Reordered install instructions to avoid problem with npm creating files owned by root in the home directory.
+- Swapped curl out with wget in the install instructions as the latter comes pre-installed on Ubuntu.
+
+### Breaking Changes
+
+- Node.js versions below 10 are no longer supported.
+
+
+## Version 1.2.1
+
+- Updated node-factorio-api to v0.3.8 to fix mod downloads randomly breaking ([#229][#229]).
+- Fixed SIGINT being sent twice to Factorio server when interrupted by CTRL+C on Linux ([#217][#217]).
+- Fixed package.json incorrectly reporting the license as ISC.
+
+[#217]: https://github.com/clusterio/clusterio/issues/217
+[#229]: https://github.com/clusterio/clusterio/issues/229
+
+### Breaking Changes
+
+- Added authentication to the socket.io server running on the master.

Dockerfile

@@ -1,19 +1,58 @@
-FROM node:latest
-RUN apt-get update && apt install git -y
+FROM node:24 AS subspace_storage_builder
+RUN apt update && apt install -y git
+WORKDIR /
+RUN git clone https://github.com/clusterio/subspace_storage.git
+WORKDIR /subspace_storage
+RUN npm install \
+&& node build
 
-RUN mkdir factorioClusterio
-RUN git clone -b dev https://github.com/Danielv123/factorioClusterio.git && cd factorioClusterio && npm install && curl -o factorio.tar.gz -L https://www.factorio.com/get-download/latest/headless/linux64 && tar -xvzf factorio.tar.gz
+FROM node:24 AS clusterio_builder
+RUN apt update \
+&& apt install -y wget \
+&& mkdir /clusterio
+WORKDIR /clusterio
+RUN wget -q -O factorio.tar.gz https://www.factorio.com/get-download/latest/headless/linux64 && tar -xf factorio.tar.gz && rm factorio.tar.gz
+# Copy project files into the container
+COPY . .
 
-WORKDIR factorioClusterio
-RUN mkdir instances sharedMods sharedPlugins
+RUN pnpm install
 
-RUN node client.js download
+# Install plugins. This is intended as a reasonable default, enabling plugins to make for fun gameplay.
+# If you want a different set of plugins, consider using this as the base image for your own.
+#RUN pnpm install @clusterio/plugin-subspace_storage
+#RUN npx clusteriocontroller plugin add @clusterio/plugin-subspace_storage
 
-LABEL maintainer "danielv@live.no"
+COPY --from=subspace_storage_builder /subspace_storage/dist/ /clusterio/mods/
 
-EXPOSE 8080 34167
-VOLUME /factorioClusterio/instances
-VOLUME /factorioClusterio/sharedMods
-VOLUME /factorioClusterio/sharedPlugins
+# Build Lua library mod
+RUN node packages/lib/build_mod --build --source-dir packages/host/lua/clusterio_lib \
+&& mv dist/* mods/ \
+&& mkdir temp \
+&& mkdir temp/test \
+&& cp mods/ temp/test/ -r \
+&& ls mods
 
-CMD RCONPORT="$RCONPORT" FACTORIOPORT="$FACTORIOPORT" MODE="$MODE" node $MODE\.js start $INSTANCE
+# Remove node_modules
+RUN find . -name 'node_modules' -type d -prune -print -exec rm -rf '{}' \;
+
+FROM frolvlad/alpine-glibc AS clusterio_final
+
+RUN apk add --update bash nodejs npm
+
+COPY --from=clusterio_builder /clusterio /clusterio
+WORKDIR /clusterio
+
+# Install runtime dependencies
+RUN pnpm install --production
+LABEL maintainer "danielv@danielv.no"
+
+FROM frolvlad/alpine-glibc AS clusterio_testing
+
+RUN apk add --update bash nodejs npm
+
+COPY --from=clusterio_builder /clusterio /clusterio
+WORKDIR /clusterio
+
+# Install runtime dependencies
+RUN pnpm install
+RUN pnpm install chalk semver

LICENSE.md

@@ -1,4 +1,4 @@
-MIT License
+This product uses the MIT License
 
 Copyright (c) 2016 Daniel Vestøl
 

README.md

@@ -1,209 +1,324 @@
-# factorioClusterio
-[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2FDanielv123%2FfactorioClusterio.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2FDanielv123%2FfactorioClusterio?ref=badge_shield)
+<img src="./logo.svg" width="100%" align="right">
 
-| Branch | Coverage | Build |
-|--------|----------| ----- |
-| Master | [![codecov](https://codecov.io/gh/Danielv123/factorioClusterio/branch/master/graph/badge.svg)](https://codecov.io/gh/Danielv123/factorioClusterio) | [![Build Status](https://travis-ci.org/Danielv123/factorioClusterio.svg?branch=master)](https://travis-ci.org/Danielv123/factorioClusterio) |
-| Dev    | [![codecov](https://codecov.io/gh/Danielv123/factorioClusterio/branch/dev/graph/badge.svg)](https://codecov.io/gh/Danielv123/factorioClusterio) | [![Build Status](https://travis-ci.org/Danielv123/factorioClusterio.svg?branch=dev)](https://travis-ci.org/Danielv123/factorioClusterio) |
+<br/>
+<br/>
+<br/>
 
-If you want to connect to a clusterio cluster, please reffer to the [client](https://github.com/Danielv123/factorioClusterioClient)
+# Clusterio
+
+Discord for development/support/play: https://discord.gg/5XuDkje
+
+## Important notice
+
+Clusterio 2.0 is the current stable release and requires Node.js 22 or newer.
+For new installations, use the latest Node.js LTS release (see [Installation](#installation)).
+The previous stable series is no longer supported.
+If you are upgrading from a 2.0 alpha, review the [changelog](CHANGELOG.md) before upgrading.
+Plugin authors should also follow the [2.0 migration guide](docs/devs/plugin-migration-to-2.0.md).
+
+
+### Ways to support me/the project:
+
+* Contribute with code/documentation.
+  See [Contributing](docs/contributing.md) for how to make pull requests.
+  Always nice to move the project forward.
+
+* Support me monetarily on [patreon](https://www.patreon.com/danielv123) or paypal: danielv@live.no
 
 ### Table of contents
 
-* [Introduction & methodology](#introduction)
+* [Introduction](#introduction)
+* [Features](#features)
+* [Plugins](#plugins)
+* [Installation](#installation)
+  * [Ubuntu setup](#ubuntu-setup)
+  * [Windows setup](#windows-setup)
+  * [MacOS setup](#macos-setup)
+  * [Installing Plugins](#installing-plugins)
+* [Configure Controller](#configure-controller)
+* [Managing Factorio mods](#managing-factorio-mods)
+* [Setting up shared storage](#setting-up-shared-storage)
+* [Running Clusterio](#running-clusterio)
+* [Setting up remote hosts](#setting-up-remote-hosts)
+* [Setting up clusterioctl](#setting-up-clusterioctl)
+* [Known issues](#known-issues)
+* [Common problems](#common-problems)
 
-* [Ubuntu setup](#ubuntu-setup)
-
-* [Windows setup](#windows-setup)
-
-* [Command cheatsheet](#cheatsheet)
 
 ## Introduction
 
-Features:
+Clusterio is a clustered Factorio server manager that provides the tooling for implementing cross server interactions in Factorio.
+It was previously best known for implementing cross server transfer and cloud storage of items via teleporter chests.
+But this functionality has been pulled out of Clusterio into its own plugin for Clusterio named [Subspace Storage](https://github.com/clusterio/subspace_storage).
 
-- Entities to send/recieve items
+By itself Clusterio doesn't change the gameplay in any way, you could even use Clusterio to manage completely vanilla Factorio servers.
+Plugins do the work of modding in the visible changes into the game, see the [Plugins section](#plugins) for ready-made plugins you can install into a Clusterio cluster.
 
-- Cross dimensional storage
 
-- Sending of liquids
+## Features
 
-- Sending of circuit network signals
+- Clustered Factorio server management allowing you manage the running of Factorio servers across a fleet of physical servers from both a web interface and a command line interface.
 
-- Inventory combinator to display item levels in the cluster (and epoch time)
+- User list management for synchronizing in-game admins, whitelisted users, and bans to all the servers in the cluster.
 
-- Reporting of graphs and UPS on master interface
+- Integrated support for exporting statistics for the whole cluster to Prometheus via a single metrics endpoint.
 
-Connection diagram:
+- Extensive plugin support for adding your own cross server features to Factorio using Clusterio's communication backbone.
 
-![http://i.imgur.com/7FdVfgB.png](http://i.imgur.com/7FdVfgB.png)
 
-There can be any number of clients connected to each slave, and any number of slaves connected to a master but there can only be one master server in each cluster.
+## Plugins
 
-**How does it work?**
+The heart of Clusterio is its plugin system.
+Plugins add functionality to Factorio servers, Clusterio itself or both.
+These are the plugins supported and maintained by the Clusterio developers:
 
-Traditional factorio mods have always been limited by the games deterministic design. This gives us a very bug free and predictable game, but doesn't allow us cool stuff such as internet communication.
-Clusterio exploits one of the games logging features, game.write_file and RCON to communicate between servers. Sending an item from one server to another takes this path:
+- [Global Chat](/plugins/global_chat/README.md): share the in-game chat between servers.
+- [Research Sync](/plugins/research_sync/README.md): synchronize research progress and technologies unlocked between servers.
+- [Statistics Exporter](/plugins/statistics_exporter/README.md): collect in-game statistics from all the servers and makes it available to the Prometheus endpoint on the controller.
+- [Subspace Storage](https://github.com/clusterio/subspace_storage): Provide shared storage that can transport items between servers via teleport chests.
+- [Player Auth](/plugins/player_auth/README.md): Provides authentication to the cluster via logging into a Factorio server.
+- [Player Sync](/plugins/player_sync/README.md): Synchronizes your inventory and player settings between servers.
 
-1. server1: Chest has stuff in it, write the contents to a file and delete them from the game world
+There's also plugins developed and maintained by the community:
 
-2. client.js on server1: File has stuff in it, parse and send to the master for storage
+- [Discord Bridge](https://github.com/Hornwitser/discord_bridge) (@hornwitser/discord_bridge): Bridges chat between instances and Discord.
+  By Hornwitser.
+- [Server Select](https://github.com/Hornwitser/server_select/tree/clusterio-2.0) (@hornwitser/server_select): In-game GUI for connecting to other servers in the cluster.
+  Originally by Godmave, ported to 2.0 by Hornwitser.
+- [ExpCluster](https://github.com/explosivegaming/ExpCluster) (@expcluster/*): A collection of plugins and scenario features including role and group syncing, moderation tools, quality of life additions, and discord account linking.
+  See repo readme for plugin breakdown. Maintained by Cooldude2606.
+- [Chat Relay](https://github.com/PHIDIAS0303/chat_relay) (@PHIDIAS0303/chat_relay): Chat relay of Discord and Factorio, seperate channel.
 
-3. master: server1 gave us stuff, store it in the storage and write some statistics
+Want to make your own plugin?
+Check out the documentation on [Writing Plugins](/docs/writing-plugins.md) for where to start.
+If you have a plugin written for an earlier 2.0 alpha, see [Migrating Plugins to 2.0](/docs/devs/plugin-migration-to-2.0.md).
+Note that from 2.0 onwards minor versions of Clusterio may contain breaking changes for plugins, while breaking changes for users running a cluster are held back for major versions.
 
-4. server2: get-chest is empty, write a request to file
 
-5. client.js on server2: Request file has stuff in it, parse and send a request to master for more items of that type
+## Installation
 
-6. master: server2 asked for stuff, check if we have enough and how much demand there is, then send however much is appropriate back
+Install the latest [Node.js LTS release](https://nodejs.org/en/download), which is recommended for new Clusterio installations.
+Clusterio is distributed via npm and comes with a guided install script.
+If you already have a supported Node.js version installed, you can set it up in a new directory with:
 
-7. client.js on server2: We were allowed to import x of item y, run command /c remote.call("clusterio", "importMany", "{'copper-plate':120}")
+    npm init "@clusterio"
 
-This process works the same for both items and liquids, independant on what mods are used. Yes, modded items are fully supported.
+Otherwise see below for OS specific instructions.  
+Check out all our of decisions for [node, factorio, and operation support](/docs/decisions.md#supportability).
 
-Clusterio also handles a few other neat things, such as giving you access to epoch time, transmitting combinator signals between worlds (and any other application who wants to) and 
-creating graphs on the master web interface.
+### Ubuntu setup
 
-## Ubuntu setup
+1.  Install the latest Node.js LTS release using the NodeSource repository for Ubuntu/Debian.
+    The distribution's default repository may provide an older version.
 
-NodeJS does not support EOL ubuntu releases. Make sure you are on the most recent LTS release or newer.
+        curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - &&\
+        sudo apt-get install -y nodejs
 
-Master and all slaves:
+    Verify the installation with `node --version` and `npm --version`.
 
-    sudo curl -sL https://deb.nodesource.com/setup_9.x | sudo -E bash -
-    sudo apt install -y nodejs python-dev git wget curl tar build-essential
-    sudo npm install pm2 -g
-    git clone https://github.com/Danielv123/factorioClusterio.git
-    cd factorioClusterio
-    curl -o factorio.tar.gz -L https://www.factorio.com/get-download/latest/headless/linux64
-    tar -xf factorio.tar.gz
-    npm install
-    node ./lib/npmPostinstall.js
+2.  Log in as the user you wish to install Clusterio as (do not use root), and then create a new directory and run the Clusterio installer:
 
-downloads and installs nodejs, pm2, git and clusterio. To specify a version, change "latest" in the link to a version number like 0.14.21.
+        mkdir clusterio
+        cd clusterio
+        npm init "@clusterio"
 
-*Copy config.json.dist to config.json* - Otherwise it will crash, as you'd expect.
+    Make sure to note down the admin authentication token it provides at the end as you will need it later.
 
-**Master**
+3.  Optionally copy the generated systemd service files in `systemd` folder to `/etc/systemd/system/`.
 
-    pm2 start master.js --name master
-    
-**Server Host**
-    
-To download the mod for all its non vanilla features and items, (optional, but very recommended)
-
-    node client.js manage shared mods add clusterio
-	
-Add the master API key, found in the masters install directory (secret-api-token.txt) to your config.json masterAuthToken field
-
-To create a new instance (its own save, set of mods and config files)
-
-    node client.js start [instancename]
-
-To launch an instance with pm2
-
-    pm2 start --name [instancename] client.js -- start [instancename]
-
-use `nano config.json` to change settings.
 
 **Ubuntu with Docker**
 
-Clusterio has limited support for using docker.
+The Docker support for Clusterio is currently broken.
+If you need it open an issue about it.
 
-    sudo docker build -t clusterio --no-cache --force-rm factorioClusterio
-	
-	sudo docker run --name master -e MODE=master -p 1234:8080 -d -it --restart=unless-stopped danielvestol/clusterio
-	
-	sudo docker run --name slave -e MODE=client -e INSTANCE=world1 -v /srv/clusterio/instances:/factorioClusterio/instances -p 1235:34167 -it --restart=unless-stopped danielvestol/clusterio
+<!--
+Clusterio has *very* limited support for using docker.
 
-The -v flag is used to specify the instance directory. Your instances (save files etc) will be stored there.
+    sudo docker build -t clusterio --no-cache --force-rm clusterio
 
-## Windows setup
+	sudo docker run --name controller -e MODE=controller -p 1234:8080 -d -it --restart=unless-stopped danielvestol/clusterio
 
-Clusterio is built up of multiple parts. Here is a quick guide:
+	sudo docker run --name host -e MODE=host -e INSTANCE=world1 -v /srv/clusterio/instances:/clusterio/instances -p 1235:34167 -it --restart=unless-stopped danielvestol/clusterio
 
-Master = master.js
+The -v flag is used to specify the instance directory.
+Your instances (save files etc) will be stored there.
+-->
 
-Server host (Slave) = client.js + factorio server
+### Windows setup
 
-Game Client = The people connecting to the server
+1.  Download and install the latest [Node.js LTS release](https://nodejs.org/en/download).
 
-All Server Hosts (Slaves) AND Game Clients need to be running the clusterio mod located at [github](https://github.com/Danielv123/factorioClusterioMod) Install it by dropping it into either the sharedMods folder or instances/[instanceName]/instanceMods folder.
+2.  Create a new empty directory for the installation and navigate into it.
+    Open a PowerShell window in this new directory by Shift+Right clicking inside it and choosing "Open PowerShell window here" and then run the following command.
 
-There are no requirements for other mods, they can be ran in any configuration allowed by the base game.
+        npm init "@clusterio"
 
-**Requirements**
+    Make sure to note down the admin authentication token it provides at the end as you will need it later.
 
-download and install nodeJS 8 or 9 from http://nodejs.org
+3.  If you chose to use local factorio directory for the Factorio installation, download the Windows 64-bit zip package from https://www.factorio.com/download and extract it to the `factorio` folder in your clusterio installation folder.
 
-download and install git from https://git-scm.com/
 
-reboot when you are done, then proceed to the next steps. *reboots matter*
+### MacOS Setup
 
-**Master**
+1.  Install the latest [Node.js LTS release](https://nodejs.org/en/download).
+    If you use [nvm](https://github.com/nvm-sh/nvm#installing-and-updating), run `nvm install --lts`.
 
-1. download and run https://puu.sh/toFHl/01eebbb333.bat
+2.  Open Terminal or Command prompt in the directory you want to install to and run the following commands.
 
-2. Copy config.json.dist to config.json
+        mkdir clusterio
+        cd clusterio
+        npm init "@clusterio"
 
-3. Follow the instructions in the bat file
+    Make sure to note down the admin authentication token it provides at the end as you will need it later.
 
-4. Run `node client.js manage shared mods add clusterio`
+3.  If you chose to use local factorio directory for the Factorio installation, you will need to obtain and copy a mac version of Factorio and unpack it to the `factorio` folder in your clusterio installation folder.
 
-5. type `node master.js` to start the server
 
-**Server Host**
+### Installing Plugins
 
-1. download and run https://puu.sh/toFHl/01eebbb333.bat
+For well-known plugins you can select them during installation and no further steps are necessary to make them work.
+Plugins that are not offered by the installer can be installed by the name of the npm package that provides them, for example
 
-2. Copy config.json.dist to config.json
+    npx clusteriocontroller plugin install @clusterio/plugin-subspace_storage
 
-3. Follow the instructions given
+This installs the package with npm and adds it to the default `plugin-list.json` file which in the shared folder setup is loaded by controller, host and ctl.
+The command must be run from the directory clusterio was installed in and will refuse to run anywhere else.
+If you have hosts or ctl installed on separate computers (or directories) then you need to repeat the plugin install process for all of them.
+The clusteriocontroller, clusteriohost and clusterioctl commands has the plugin sub-command so you do not need to install clusteriocontroller to add plugins, instead use the clusterio command you have available.
 
-4. Type `node client.js start [instancename]` to create a new instance.
+For development purposes the `plugin add` command supports adding plugins by the absolute path to them, or a relative path that must start with either . or .. (which will then be resolved to an absolute path).
 
-To connect to a master server running on a remote machine, open config.json with your favourite text editor (notepad++). You can also set it up to use the official server browser.
 
-Change masterIP to something like 31.152.123.14 (provided by master server owner)
-e war
-Change masterPort to something like 8080 (provided by master server owner)
+## Configure Controller
 
-Repeat step 3 for more servers on one machine. You should be able to find its port by looking at the slave section on master:8080 (the web interface)
+By default the controller will listen for HTTP on port 8080.
+You can change the port used with the command
 
-**GameClient**
+    npx clusteriocontroller config set controller.http_port 1234
 
-Fancy game client that does the following steps automatically, but is really old so be warned: [clusterioClient](https://github.com/Danielv123/factorioClusterioClient)
+When changing the port you will also need to change the address hosts connect with.
+For the standalone installation mode you can use
 
-1. Download the same version of the mod as the slave is running from [the mod portal](https://mods.factorio.com/mods/Danielv123/clusterio) or [github](https://github.com/Danielv123/factorioClusterioMod
+    npx clusteriohost config set host.controller_url http://localhost:1234/
 
-2. Drop it into ./factorio/mods
+If you plan to make your cluster available externally set the address
+that it will be accessible under with, for example
 
-3. Run factorio and connect to slave as a normal MP game. You will find the port number to connect to at http://[masterAddress]:8080
+    npx clusteriocontroller config set controller.public_url http://203.0.113.4:1234/
 
-## Cheatsheet
+Change the url to reflect the IP, protocol, and port the controller is accessible under, dns names are also supported.
+If you're planning on making the controller accessible on the internet it's recommended to set up TLS, see the [Setting Up TLS](/docs/setting-up-tls.md) document for more details.
 
-**To create a new instance/start it**
+You can list the config of the controller with the `npx clusteriocontroller config list` command.
+See the [readme for @clusterio/controller](/packages/controller/README.md) for more information.
 
-    node client.js start [instanceName]
 
-**Other instance management tools:**
-```
-node client.js delete [instanceName]
-node client.js list
-```
-**To update clusterio to the latest version:**
+## Managing Factorio mods
 
-1. Download the latest zip version of factorio for your platform manually from factorio.com. Place it in the project root folder and call it "factorio" (folder name is specified in config.json)
+Mods in Clusterio are managed as parts of mod packs.
+On the Mods page of the web interface, use **Search** to browse the Factorio Mod Portal and download mods to the controller, or upload mod zip files directly.
+Mod Portal downloads require the controller's [Factorio account credentials](docs/configuration.md#controllerfactorio_username) to be configured.
+Use **Create** in the Mod Packs section to create a mod pack, then add the mods you want to use.
+Assign the mod pack to an instance under Instance config -> Factorio -> Mod pack, or set a default mod pack for new instances in the controller settings.
 
-2. Grab the latest version of the repo
+![Select mod pack for instance](docs/assets/config_select_mod_pack.png)
 
-```
-git pull
+Mod settings can be managed under the modpack configuration page in the web UI. For mod settings to show, you first need to run an export. This is done by creating an instance with the modpack assigned, opening the instance page and pressing More -> Export data.
 
-npm install
-```
+![Export mod configuration data](docs/assets/export_mod_config_data.png)
 
-3. Download the latest version of the factorioClusterioMod from its github repo
-```
-node client.js manage shared mods add clusterio
-```
+Once this is done, the mod settings will show up under the modpack configuration page.
+
+![Mod settings configuration in web interface](docs/assets/mod_settings_configuration.png)
+
+
+## Setting up shared storage
+
+The chests teleporting items to and from the shared storage on the controller has been moved into the Subspace Storage mod and plugin.
+To get this to work, install the Subspace Storage plugin on the controller and hosts using the [plugin installation instructions](#installing-plugins).
+Download or upload the [Subspace Storage mod](https://mods.factorio.com/mod/subspace_storage) and the [Clusterio Lib mod](https://mods.factorio.com/mod/clusterio_lib) to the controller, add them to a mod pack, and assign it to each participating instance as described in [Managing Factorio mods](#managing-factorio-mods).
+Hosts fetch the mods from the controller and synchronize each instance's mods folder with its assigned mod pack when the instance starts.
+
+Do not install the [Clusterio mod](https://mods.factorio.com/mod/clusterio), this was for the old 1.2.x version of Clusterio and is not compatible with Clusterio 2.0.
+
+
+## Running Clusterio
+
+After completing the installation and creating your admin user, start up the controller and at least one host separately.
+The installer provides the `run-controller` and `run-host` scripts to make this simple.
+Once the controller process is running you can log into the web interface which is hosted by default on http://localhost:8080/ (adjust the port number if you changed it), use the admin authentication token provided from the installation to log in.
+
+The basics of setting up a Factorio server from the web interface is to create an instance, assign it to a host and then click start. You can also use the "Connect via Steam" button to launch Factorio directly and connect to the server using Steam's protocol handler.
+
+### Running via Systemd
+
+The install script creates systemd service scripts for clusteriocontroller and clusteriohost (if applicable) to start up as the user than ran the installer.
+If you have copied these files over to `/etc/systemd/system/` then you can startup Clusterio as a background service using:
+    
+#### To start as a service run:
+ 
+    sudo systemctl start clusteriocontroller # for the controller
+    sudo systemctl start clusteriohost # for each physical server intended to host Factorio servers
+
+#### To automatically get it to start on boot:
+ 
+    sudo systemctl enable clusteriocontroller # for the controller
+    sudo systemctl enable clusteriohost # for each physical server intended to host Factorio servers
+
+
+## Setting up remote hosts
+
+Run the installer as described in the installation section and choose "Host only" as the operating mode to install, it'll ask for a controller URL and an authentication token.
+The URL is the same as what is needed to connect to the web interface, and the authentication token can be generated on the Hosts page in the web interface.
+Once you start up the host it should show up in the Hosts list and be available for assigning and running instances on.
+
+
+## Setting up clusterioctl
+
+There's a command line interface available for Clusterio which is installed separately with the same installer as for the controller and host.
+Run the installer as described in the installation section and choose "Ctl only" as the operating mode to install, you can do this in the same directory as you have installed other Clusterio component(s) to.
+The installer will ask for a controller URL and an authentication token, these are the same as you would use to connect to the web interface.
+If you want to use a different user for the command line interface, you can generate an authentication token for an existing user with
+
+    npx clusteriocontroller bootstrap generate-user-token <username>
+
+
+## Known Issues
+
+- When the `server_select` plugin is installed you may see `[error] Unhandled event server_select:UpdateInstancesEvent` logged when starting an instance.
+  This should be ignored as it does not indicate an error occured.
+- After updating Factorio you may get the error `Error: Expected empty response but got "Cannot execute command. Error: [string "clusterio_private.update_instance(..."]:1: attempt to index global 'clusterio_private' (a nil value)?` on instance start.
+  This is due to Factorio applying a migration replacing the patched content of the save with the original scenario, attempting to start the instance again should resolve the issue.
+
+
+## Common problems
+
+### EACCESS [...] LISTEN 443
+
+Some systems don't let non root processes listen to ports below 1000.
+Either run with `sudo` or change config.json to use higher port numbers.
+
+According to [this link](https://askubuntu.com/questions/839520/open-port-443-for-a-node-web-app) if you manually installed node.js following the above instructions, you may need to run the following command to fix this issue:
+
+    sudo setcap 'cap_net_bind_service=+ep' $(readlink -f $(which node))
+
+### Port forwarding doesn't work on the controller when running under WSL
+
+If you follow the ubuntu guide on WSL (Windows Subsystem for Linux, Bash on Ubuntu on Windows specifically), you will find that the website works on localhost and on your local ip, but not on the global ip.
+This is also true when you correctly port-forwarded the correct ports.
+Even when routing this server through nginx in WSL, the issue persists.
+Then, on a hunch, I tried to run nginx from windows itself and found that this DID work.
+It came to me that the only usage difference between the 2 versions of nginx is that I got a Windows Firewall popup.
+
+TLDR: the tested fix is:
+
+- open your windows firewall and go to advanced settings
+
+- click on inbound rules and click on new rule...
+
+- select port and click next >
+
+- select TCP and select specific local ports and type in the ports that you want to open (comma separated) and click next > 3 times
+
+- give the rule a name (like 'web server' or something), give it a description (optionally) and click finish

clean.js

@@ -0,0 +1,120 @@
+/**
+ * Clean the repository of build and execution artifacts.
+ *
+ * clean: A quick clean that removes all build artifacts making the output safe to publish
+ * clean-tests: Removes all build and test artifacts should not be required if tests are setup correctly.
+ * clean-all: Removes all build, test, and execution artifacts. Including cluster config and logs!
+ */
+
+import path from "node:path";
+import fs from "node:fs/promises";
+import yargs from "yargs";
+
+import npmPackage from "./package.json" with { type: "json" };
+const workspaces = npmPackage.workspaces
+	.map(p => p.slice(0, -2))
+	.filter(p => !p.includes("external_plugins"));
+
+let DRY = false;
+
+/**
+ * Attempt to remove a file / directory if it exists.
+ *
+ * @param {string} filePath The path to remove.
+ */
+async function tryRemove(filePath) {
+	try {
+		await fs.access(filePath);
+		console.log(filePath);
+	} catch {
+		return;
+	}
+
+	if (!DRY) {
+		await fs.rm(filePath, { force: true, recursive: true, maxRetries: 10 });
+	}
+}
+
+/**
+ * Removes all build artifacts
+ */
+async function removeBuildArtifacts() {
+	const tasks = [];
+
+	for (const workspace of workspaces) {
+		const basePath = path.resolve(workspace);
+		const packages = await fs.readdir(basePath);
+		for (const packageName of packages) {
+			tasks.push(
+				tryRemove(path.join(basePath, packageName, "dist"))
+			);
+			tasks.push(
+				tryRemove(path.join(basePath, packageName, "node_modules", ".cache"))
+			);
+		}
+	}
+
+	await Promise.all(tasks);
+}
+
+/**
+ * Removes all test artifacts
+ */
+async function removeTestArtifacts() {
+	const artifacts = [
+		".nyc_output", "coverage", "temp", "static",
+	];
+
+	await Promise.all(artifacts.map(artifact => tryRemove(path.resolve(artifact))));
+}
+
+/**
+ * Removes all execution artifacts
+ */
+async function removeExecutionArtifacts() {
+	const artifacts = [
+		"database", "instances", "logs", "mods",
+		"config-ctl.json", "config-controller.json", "config-host.json",
+		"FactorioAdminToken.txt", "plugin-list.json",
+	];
+
+	await Promise.all(artifacts.map(artifact => tryRemove(path.resolve(artifact))));
+}
+
+/**
+ * Main function for this script
+ */
+async function main() {
+	await yargs(process.argv.slice(2))
+		.scriptName("clean")
+		.option("dry-run", {
+			alias: "dry",
+			nargs: 0,
+			describe: "Will not delete any files",
+			default: false,
+			type: "boolean",
+		})
+		.command("all", "Remove all artifacts", () => {}, argv => {
+			DRY = argv.dry;
+			removeBuildArtifacts();
+			removeTestArtifacts();
+			removeExecutionArtifacts();
+		})
+		.command("tests", "Remove all build and test artifacts", () => {}, argv => {
+			DRY = argv.dry;
+			removeBuildArtifacts();
+			removeTestArtifacts();
+		})
+		.command("$0", "Remove all build artifacts", () => {}, argv => {
+			DRY = argv.dry;
+			removeBuildArtifacts();
+		})
+		.demandCommand(1, "A command must be specified")
+		.strict()
+		.parse();
+}
+
+// Run main if started from command line
+if (import.meta.main) {
+	main();
+}

client.js

@@ -1,999 +0,0 @@
-const fs = require('fs-extra');
-const https = require('follow-redirects').https;
-const needle = require("needle");
-const child_process = require('child_process');
-const path = require('path');
-const syncRequest = require('sync-request');
-const request = require("request");
-const ncp = require('ncp').ncp;
-const Rcon = require('rcon-client').Rcon;
-const hashFiles = require('hash-files');
-const _ = require('underscore');
-const deepmerge = require("deepmerge");
-const getMac = require('getmac').getMac;
-const rmdirSync = require('rmdir-sync');
-const ioClient = require("socket.io-client");
-
-// internal libraries
-const objectOps = require("./lib/objectOps.js");
-const fileOps = require("_app/fileOps");
-const stringUtils = require("./lib/stringUtils.js");
-const modManager = require("./lib/manager/modManager.js");
-const configManager = require("./lib/manager/configManager.js");
-
-// require config.json
-var config = require('./config');
-var global = {};
-
-if (!fs.existsSync(config.instanceDirectory)) {
-	fs.mkdirSync(config.instanceDirectory);
-}
-if (!fs.existsSync("./sharedPlugins/")) {
-	fs.mkdirSync("sharedPlugins");
-}
-if (!fs.existsSync("./sharedMods/")) {
-	fs.mkdirSync("sharedMods");
-}
-const instance = process.argv[3];
-const instancedirectory = config.instanceDirectory + '/' + instance;
-const command = process.argv[2];
-
-// Set the process title, shows up as the title of the CMD window on windows
-// and as the process name in ps/top on linux.
-process.title = "clusterioClient "+instance;
-
-// make sure we have the master access token (can't write to master without it since clusterio 2.0)
-if(!config.masterAuthToken || typeof config.masterAuthToken !== "string"){
-	console.log("ERROR invalid config!");
-	console.log("Master server now needs an access token for write operations. As clusterio slaves depends \
-	upon this, please add your token to config.js in the field named masterAuthToken. \
-	You can retrieve your auth token from the master in secret-api-token.txt after running it once.");
-}
-const needleOptionsWithTokenAuthHeader = {
-	headers: {
-		'x-access-token': config.masterAuthToken
-	},
-};
-
-var instanceInfo = {};
-var commandBuffer=[];
-// messageInterface Management
-setInterval(function(){
-	let command=commandBuffer.shift();
-	if(command){
-		messageInterfaceInternal(command[0], command[1], command[2], command[3]);
-	}
-},config.msBetweenCommands || 50);
-
-// function to handle sending commands into the game
-async function messageInterfaceInternal(command, callback, resolve, reject) {
-	// try to save us if you send a buffer instead of string
-	if(typeof command == "object") {
-		command = command.toString('utf8');
-	}
-	
-	if(false && process.platform == "linux" && typeof command == "string" && serverprocess) {
-		/*
-			to send to stdin, use:
-			serverprocess.stdin.write("/c command;\n")
-		*/
-		serverprocess.stdin.write(command+"\n");
-		if(typeof callback == "function"){
-			callback();
-		}
-		resolve();
-	} else if(typeof command == "string" && client && client.send && typeof client.send == "function") {
-		try {
-			let str = await client.send(command+"\n");
-			if(typeof callback == "function") callback(str)
-			resolve(str)
-		} catch (err) {
-			console.log("RCON failed, server might be paused or shutting down");
-			// console.log(err);
-			// reject(err);
-			if(typeof callback == "function"){
-				callback();
-			}
-		}
-	}
-}
-function messageInterface(command, callback) {
-	return new Promise((resolve,reject) => {
-		commandBuffer.push([command,callback, resolve, reject]);
-	});
-}
-
-
-// handle commandline parameters
-if (!command || command == "help" || command == "--help") {
-	console.error("Usage: ");
-	console.error("node client.js start [instance name]");
-	console.error("node client.js list");
-	console.error("node client.js delete [instance]");
-	console.error("To download the latest version of the Clusterio lua mod, do");
-	console.error("node client.js manage shared mods download clusterio");
-	console.error("For more management options, do");
-	console.error("node client.js manage");
-	process.exit(1);
-} else if (command == "list") {
-	let instanceNames = fileOps.getDirectoriesSync(config.instanceDirectory);
-	instanceNames.unshift("Name:");
-	let longestInstanceName = 0;
-	// determine longest instance name
-	instanceNames.forEach(function(instance){
-		if(instance.length > longestInstanceName) longestInstanceName = instance.length;
-	});
-	let displayLines = [];
-	// push name coloumn to array
-	instanceNames.forEach(function(instance){
-		while(instance.length < longestInstanceName+1){
-			instance += " ";
-		}
-		displayLines.push("| "+ instance + "|");
-	});
-	// create port colloumn
-	let factorioPorts = [];
-	instanceNames.forEach(function(instance){
-		let factorioPort
-		
-		if(instance.includes("Name:")){
-			factorioPort = "Port:"
-		} else {
-			factorioPort = require(config.instanceDirectory+"/"+instance+"/config").factorioPort;
-		}
-		factorioPorts.push(factorioPort);
-	});
-	factorioPorts.forEach((port, index) => {
-		let longestPort = 0;
-		factorioPorts.forEach((port, index) => {
-			if(port.toString().length > longestPort) longestPort = port.toString().length;
-		});
-		while(port.toString().length < longestPort){
-			port += " ";
-		}
-		factorioPorts[index] = port;
-	});
-	instanceNames.forEach(function(instance, index){
-		displayLines[index] += " " + factorioPorts[index] + " |";
-	});
-	
-	displayLines.forEach(line => console.log(line));
-	process.exit(0);
-} else if (command == "manage"){
-	// console.log("Launching mod manager");
-	//const fullUsage = 'node client.js manage [instance, "shared"] ["mods", "config"] ...';
-	function usage(instance, tool, action){
-		if(tool && tool == "mods"){
-			console.log('node client.js manage '+instance+' '+tool+' ["list", "search", "add", "remove", "update"]');
-		} else if(tool && tool == "config") {
-			console.log('node client.js manage '+instance+' '+tool+' ["list", "edit"]');
-		} else {
-			console.log('node client.js manage '+(instance || '[instance, "shared"]') +' '+ (tool || '["mods", "config"]') + ' ...');
-		}
-	}
-	const tool = process.argv[4] || "";
-	const action = process.argv[5] || "";
-	if(instance){
-		if(tool == "mods"){
-			(async function(){try{
-				// allow managing mods
-				if(action == "list"){
-					console.log(await modManager.listMods(instance));
-				} else if(action == "search"){
-					console.log(await modManager.findMods(process.argv[6]));
-				} else if(action == "add" || action == "download"){
-					await modManager.addMod(process.argv[6], instance);
-				} else if(action == "remove" || action == "rm" || action == "delete"){
-					await modManager.removeMod(process.argv[6], instance);
-				} else if(action == "update"){
-					await modManager.updateAllMods();
-				} else {
-					usage(instance, tool);
-				}
-				process.exit(0);
-			}catch(e){
-				console.log("Got error from modManager:")
-				console.log(e);
-			}})();
-		} else if(tool == "config"){
-			// allow managing the config
-			if(action == "list" || action == "show" || action == "display"){
-				configManager.displayConfig(instance);
-			} else if(action == "edit"){
-				let newConfigValue = "";
-				process.argv.forEach((arg, i)=>{
-					if(i >= 8){
-						newConfigValue += " "+arg;
-					} else if(i >= 7){
-						newConfigValue += arg;
-					}
-				});
-				configManager.editConfig(instance, process.argv[6], newConfigValue);
-			} else {
-				usage(instance, tool);
-			}
-		} else {
-			usage(instance);
-		}
-	} else {
-		console.log('Usage:');
-		usage(instance);
-	}
-	// process.exit(0);
-} else if (command == "delete") {
-	if (!process.argv[3]) {
-		console.error("Usage: node client.js delete [instance]");
-		process.exit(1);
-	} else if (typeof process.argv[3] == "string" && fs.existsSync(config.instanceDirectory+"/" + process.argv[3]) && process.argv[3] != "/" && process.argv[3] != "") {
-		fileOps.deleteFolderRecursiveSync(config.instanceDirectory+"/" + process.argv[3]);
-		console.log("Deleted instance " + process.argv[3]);
-		process.exit(0);
-	} else {
-		console.error("Instance not found: " + process.argv[3]);
-		process.exit(0);
-	}
-} else if (command == "download") {
-	console.log("Downloading mods...");
-	// get JSON data about releases
-	let res = syncRequest('GET', 'https://api.github.com/repos/Danielv123/factorioClusterioMod/releases', {"headers":{"User-Agent":"Fuck you for requiring user agents!"}});
-	let url = JSON.parse(res.getBody())[0].assets[0].browser_download_url;
-	let name = JSON.parse(res.getBody())[0].assets[0].name;
-	if(url) {
-		console.log(url);
-		let file = fs.createWriteStream("sharedMods/"+name);
-		https.get(url, function(response) {
-			response.pipe(file);
-			console.log("Downloaded "+name);
-			process.exit(0);
-		});
-	}
-} else if (command == "start" && instance === undefined) {
-	console.log("ERROR: No instanceName provided!");
-	console.log("Usage: node client.js start [instanceName]");
-	process.exit(0);
-} else if (command == "start" && typeof instance == "string" && instance != "/" && !fs.existsSync(instancedirectory)) {
-	// if instance does not exist, create it
-	console.log("Creating instance...");
-	fs.mkdirSync(instancedirectory);
-	fs.mkdirSync(instancedirectory + "/script-output/");
-	fs.mkdirSync(instancedirectory + "/saves/");
-	fs.writeFileSync(instancedirectory + "/script-output/output.txt", "");
-	fs.writeFileSync(instancedirectory + "/script-output/orders.txt", "");
-	fs.writeFileSync(instancedirectory + "/script-output/txbuffer.txt", "");
-	fs.mkdirSync(instancedirectory + "/mods/");
-	fs.mkdirSync(instancedirectory + "/instanceMods/");
-	// fs.symlinkSync('../../../sharedMods', instancedirectory + "/mods", 'junction') // This is broken because it can only take a file as first argument, not a folder
-	fs.writeFileSync(instancedirectory + `/config.ini`, `[path]\r\n
-read-data=${ path.resolve(config.factorioDirectory, "data") }\r\n
-write-data=${ path.resolve(config.instanceDirectory, instance) }\r\n
-	`);
-	
-	// this line is probably not needed anymore but Im not gonna remove it
-	fs.copySync('sharedMods', instancedirectory + "/mods");
-	let instconf = {
-		"factorioPort": process.env.FACTORIOPORT || Math.floor(Math.random() * 65535),
-		"clientPort": process.env.RCONPORT || Math.floor(Math.random() * 65535),
-		"clientPassword": Math.random().toString(36).replace(/[^a-z]+/g, '').substr(0, 8),
-	}
-	console.log("Clusterio | Created instance with settings:")
-	console.log(instconf);
-	
-	// create instance config
-	fs.writeFileSync(instancedirectory + "/config.json", JSON.stringify(instconf, null, 4));
-	
-	let name = "Clusterio instance: " + instance;
-	if (config.username) {
-		name = config.username + "'s clusterio " + instance;
-	}
-	let serversettings = {
-		"name": name,
-		"description": config.description,
-		"tags": ["clusterio"],
-		"max_players": "20",
-		"visibility": config.visibility,
-		"username": config.username,
-		"token": config.token,
-		"game_password": config.game_password,
-		"verify_user_identity": config.verify_user_identity,
-		"admins": [config.username],
-		"allow_commands": config.allow_commands,
-		"autosave_interval": 10,
-		"autosave_slots": 5,
-		"afk_autokick_interval": 0,
-		"auto_pause": config.auto_pause,
-	}
-	fs.writeFileSync(instancedirectory + "/server-settings.json", JSON.stringify(serversettings, null, 4));
-	let createSave = child_process.spawnSync(
-		'./' + config.factorioDirectory + '/bin/x64/factorio', [
-			'-c', instancedirectory + '/config.ini',
-			'--create', instancedirectory + '/saves/save.zip',
-		]
-	);
-	console.log("Instance created!");
-	process.exit(0);
-} else if (command == "start" && typeof instance == "string" && instance != "/" && fs.existsSync(instancedirectory)) {
-	// Exit if no instance specified (it should be, just a safeguard);
-	if(instancedirectory != config.instanceDirectory+"/undefined"){
-		var instanceconfig = require(path.resolve(instancedirectory,'config'));
-		instanceconfig.unique = stringUtils.hashCode(instanceconfig.clientPassword);
-		if(process.env.FACTORIOPORT){
-			instanceconfig.factorioPort = process.env.FACTORIOPORT;
-		}
-		if(process.env.RCONPORT){
-			instanceconfig.rconPort = process.env.RCONPORT;
-		}
-	} else {
-		process.exit(1);
-	}
-	console.log("Deleting .tmp.zip files");
-	let savefiles = fs.readdirSync(instancedirectory + "/saves/");
-	for(i = 0; i < savefiles.length; i++){
-		if(savefiles[i].substr(savefiles[i].length - 8, 8) == ".tmp.zip") {
-			fs.unlinkSync(instancedirectory + "/saves/" + savefiles[i]);
-		}
-	}
-	console.log("Deleting logs");
-	// clean old log file to avoid crash
-	// file exists, delete so we don't get in trouble
-	try {
-		fs.unlinkSync(instancedirectory+'/factorio-current.log');
-	} catch (err){
-		if(err){
-			console.log(err);
-		} else {
-			console.log("Clusterio | Deleting old logs...");
-		}
-	}
-	
-	// move mods from ./sharedMods to the instances mod directory
-	try{fs.mkdirSync(instancedirectory + "/instanceMods/");}catch(e){}
-	try{rmdirSync(instancedirectory + "/mods");}catch(e){}
-	try {
-		// mods directory that will be emptied (deleted) when closing the server to facilitate seperation of instanceMods and sharedMods
-		fs.mkdirSync(instancedirectory + "/mods/");
-	} catch(e){}
-	console.log("Clusterio | Moving shared mods from sharedMods/ to instance/mods...");
-	fs.copySync('sharedMods', instancedirectory + "/mods");
-	console.log("Clusterio | Moving instance specific mods from instance/instanceMods to instance/mods...");
-	fs.copySync(instancedirectory + "/instanceMods", instancedirectory + "/mods");
-
-	process.on('SIGINT', function () {
-		console.log("Caught interrupt signal, sending /quit");
-		messageInterface("/quit");
-	});
-
-	// Spawn factorio server
-	//var serverprocess = child_process.exec(commandline);
-	fileOps.getNewestFile(instancedirectory + "/saves/", fs.readdirSync(instancedirectory + "/saves/"),function(err, latestSave) {
-		if(err) {
-			console.error("ERROR!")
-			console.error("Your savefile seems to be missing. This might because you created an instance without having factorio\
- installed and configured properly. Try installing factorio and adding your savefile to instances/[instancename]/saves/\n");
-			throw err;
-		}
-		// implicit global
-		serverprocess = child_process.spawn(
-			'./' + config.factorioDirectory + '/bin/x64/factorio', [
-				'-c', instancedirectory + '/config.ini',
-				'--start-server', latestSave.file,
-				'--rcon-port', Number(process.env.RCONPORT) || instanceconfig.clientPort,
-				'--rcon-password', instanceconfig.clientPassword,
-				'--server-settings', instancedirectory + '/server-settings.json',
-				'--port', Number(process.env.FACTORIOPORT) || instanceconfig.factorioPort
-			], {
-				'stdio': ['pipe', 'pipe', 'pipe']
-			}
-		);
-
-		serverprocess.on('close', (code) => {
-			console.log(`child process exited with code ${code}`);
-			process.exit();
-		});
-		serverprocess.stdout.on("data", (data) => {
-			// log("Stdout: " + data);
-			if(data.toString('utf8').includes("Couldn't parse RCON data: Maximum payload size exceeded")){
-				console.error("ERROR: RCON CONNECTION BROKE DUE TO TOO LARGE PACKET!");
-				console.error("Attempting reconnect...");
-				client.close();
-				client.connect();
-			}
-			// we have to do this to make logs visible on linux and in powershell. Causes log duplication for people with CMD.
-			console.log('Fact: ' + data);
-		});
-		serverprocess.stderr.on('data', (chunk) => {
-			console.log('ERR: ' + chunk);
-		});
-
-		// connect to the server with rcon
-		if(true || process.platform != "linux"){
-			// IP, port, password
-			client = new Rcon();
-			
-			// check the logfile to see if the RCON interface is running as there is no way to continue without it
-			// we read the log every 2 seconds and stop looping when we start connecting to factorio
-			function checkRcon() {
-				fs.readFile(instancedirectory+"/factorio-current.log", function (err, data) {
-					// if (err) console.log(err);
-					if(data && data.indexOf('Starting RCON interface') > 0){
-						client.connect({
-							host: 'localhost',
-							port: Number(process.env.RCONPORT) || instanceconfig.clientPort,
-							password: instanceconfig.clientPassword,
-							timeout: 5000
-						});
-					} else {
-						setTimeout(function(){
-							checkRcon();
-						},5000);
-					}
-				});
-			}
-			setTimeout(checkRcon, 5000);
-		
-			client.onDidAuthenticate(() => {
-				console.log('Clusterio | RCON Authenticated!');
-				instanceManagement(); // start using rcons
-			});
-			client.onDidConnect(() => {
-				console.log('Clusterio | RCON Connected!');
-				// getID();
-			});
-			client.onDidDisconnect(() => {
-				console.log('Clusterio | RCON Disconnected!');
-				process.exit(0); // exit because RCON disconnecting is undefined behaviour and we rather just wanna restart now
-			});
-		} else if(process.platform == "linux"){
-			// don't open an RCON connection and just use stdio instead, does not work on windows.
-			instanceManagement();
-		}
-
-		// set some globals
-		confirmedOrders = [];
-		lastSignalCheck = Date.now();
-	});
-}
-
-// ensure instancemanagement only ever runs once
-_.once(instanceManagement);
-function instanceManagement() {
-	/* Open websocket connection to master */
-	var socket = ioClient("http://"+config.masterIP+":"+config.masterPort);
-	socket.on("hello", data => {
-		console.log("SOCKET | registering slave!");
-		socket.emit("registerSlave", {
-			instanceID: instanceconfig.unique,
-		});
-		setInterval(B=> socket.emit("heartbeat"), 10000);
-	});
-	
-	console.log("Started instanceManagement();");
-	// load plugins and execute onLoad event
-	let pluginDirectories = fileOps.getDirectoriesSync("./sharedPlugins/");
-	let plugins = [];
-	for(let i=0; i<pluginDirectories.length; i++) {
-		let I = i
-		let log = function(message) {
-			console.log("Clusterio | "+ pluginDirectories[I] + " | " + message);
-		}
-		// these are our two config files. We need to send these in case plugin
-		// wants to contact master or know something.
-		let combinedConfig = deepmerge(instanceconfig,config,{clone:true})
-		let pluginConfig = require("./sharedPlugins/" + pluginDirectories[i] + "/config.js");
-		
-		if(!global.subscribedFiles) {
-			global.subscribedFiles = {};
-		}
-		if(pluginConfig.binary == "nodePackage"){
-			// require index.js.main() of plugin and execute it as a class
-			let pluginClass = require("./sharedPlugins/" + pluginDirectories[I] + "/index.js");
-			plugins[I] = new pluginClass(combinedConfig, async function(data, callback){
-				if(data.toString('utf8')[0] != "/") {
-					log("Stdout: " + data.toString('utf8'));
-					return true;
-				} else {
-					return messageInterface(data.toString('utf8'), callback);
-				}
-			}, { // extra functions to pass in object. Should have done it like this from the start, but won't break backwards compat.
-				socket, // socket.io connection to master (and ES6 destructuring, yay)
-			});
-			if(plugins[I].factorioOutput && typeof plugins[I].factorioOutput === "function"){
-				// when factorio logs a line, send it to the plugin. This includes things like autosaves, chat, errors etc
-				serverprocess.stdout.on("data", data => plugins[I].factorioOutput(data.toString()));
-			}
-			if(pluginConfig.scriptOutputFileSubscription && typeof pluginConfig.scriptOutputFileSubscription == "string"){
-				if(global.subscribedFiles[pluginConfig.scriptOutputFileSubscription]) {
-					// please choose a unique file to subscribe to. If you need plugins to share this interface, set up a direct communication
-					// between those plugins instead.
-					throw "FATAL ERROR IN " + pluginDirectories[i] + " FILE ALREADY SUBSCRIBED " + pluginConfig.scriptOutputFileSubscription;
-				}
-				
-				if (!fs.existsSync(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription)) {
-					// Do something
-					fs.writeFileSync(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription, "");
-				}
-				global.subscribedFiles[pluginConfig.scriptOutputFileSubscription] = true;
-				console.log("Clusterio | Registered file subscription on "+instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription);
-				fs.watch(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription, fileChangeHandler);
-				// run once in case a plugin wrote out information before the plugin loaded fully
-				fileChangeHandler(false, pluginConfig.scriptOutputFileSubscription);
-				
-				// send file contents to plugin for processing
-				function fileChangeHandler(eventType, filename) {
-					if(filename != null){
-						setTimeout(
-							()=>{
-								// get array of lines in file
-								let stuff = fs.readFileSync(instancedirectory + "/script-output/" + filename, "utf8").split("\n");
-
-								// if you found anything, reset the file
-								if (stuff[0]) {
-									fs.writeFileSync(instancedirectory + "/script-output/" + filename, "");
-								}
-								for(let i = 0; i < stuff.length; i++) {
-									if(stuff[i] && !stuff[i].includes('\u0000\u0000')) {
-										try{
-											plugins[I].scriptOutput(stuff[i]);
-										}catch(e){console.log(e)}
-									}
-								}
-							},
-							pluginConfig.fileReadDelay || 0
-						);
-					}
-				}
-			}
-			console.log("Clusterio | Loaded plugin " + pluginDirectories[i]);
-		} else if(pluginConfig.binary != "nodePackage" && pluginConfig.binary){
-			// handle as fragile executable plugin
-			let args = pluginConfig.args || [];
-			plugins[I]=child_process.spawn(pluginConfig.binary, args, {
-				cwd: "./sharedPlugins/"+pluginDirectories[i],
-				stdio: ['pipe', 'pipe', 'pipe'],
-			});
-			
-			/*
-				to send to stdin, use:
-				spawn.stdin.write("text\n");
-			*/
-			// If plugin has subscribed to a file, send any text appearing in that file to stdin
-			if(pluginConfig.scriptOutputFileSubscription && typeof pluginConfig.scriptOutputFileSubscription == "string") {
-				if(global.subscribedFiles[pluginConfig.scriptOutputFileSubscription]) {
-					// please choose a unique file to subscribe to. If you need plugins to share this interface, set up a direct communication
-					// between those plugins instead.
-					throw "FATAL ERROR IN " + pluginDirectories[i] + " FILE ALREADY SUBSCRIBED " + pluginConfig.scriptOutputFileSubscription;
-				}
-				
-				if (!fs.existsSync(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription)) {
-					// Do something
-					fs.writeFileSync(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription, "");
-				}
-				global.subscribedFiles[pluginConfig.scriptOutputFileSubscription] = true;
-				fs.watch(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription, function (eventType, filename) {
-					// get array of lines in file
-					// TODO async
-					let stuff = fs.readFileSync(instancedirectory + "/script-output/" + filename, "utf8").split("\n");
-					// if you found anything, reset the file
-					if (stuff[0]) {
-						fs.writeFileSync(instancedirectory + "/script-output/" + filename, "");
-					}
-					for (let i = 0; i < stuff.length; i++) {
-						if (stuff[i]) {
-							plugins[I].stdin.write(stuff[i]);
-						}
-					}
-				});
-			}
-			// these are our two config files. We need to send these in case plugin
-			// wants to contact master or know something.
-			// send through script-output file, maybe more compat?
-			fs.writeFileSync(instancedirectory + "/script-output/" + pluginConfig.scriptOutputFileSubscription, JSON.stringify(combinedConfig)+"\r\n");
-			// send directly through stdin
-			// plugins[i].stdin.write(JSON.stringify(combinedConfig)+"\n");
-			
-			console.log("Clusterio | Loaded plugin " + pluginDirectories[i]);
-			plugins[i].stdout.on("data", (data) => {
-				if(data.toString('utf8')[0] != "/") {
-					log("Stdout: " + data.toString('utf8'))
-				} else {
-					messageInterface(data.toString('utf8'));
-				}
-			});
-			plugins[i].stderr.on("data", (data) => {
-				log("STDERR: " + data);
-			});
-			plugins[i].on('close', (code) => {
-				log(`child process exited with code ${code}`);
-			});
-		} else {
-			// This plugin doesn't have a client portion
-		}
-	}
-	
-	// world IDs ------------------------------------------------------------------
-	hashMods(instance, function(modHashes){
-		setInterval(getID, 10000);
-		getID();
-		function getID() {
-			messageInterface("/silent-command rcon.print(#game.connected_players)", function(playerCount) {
-				var payload = {
-					time: Date.now(),
-					rconPort: instanceconfig.clientPort,
-					rconPassword: instanceconfig.clientPassword,
-					serverPort: instanceconfig.factorioPort,
-					unique: instanceconfig.unique,
-					publicIP: config.publicIP, // IP of the server should be global for all instances, so we pull that straight from the config
-					mods:modHashes,
-					instanceName: instance,
-					playerCount:playerCount.replace(/(\r\n\t|\n|\r\t)/gm, ""),
-				}
-				
-				function callback(err, mac) {
-					if (err) {
-						mac = "unknown";
-						console.log("##### getMac crashed, but we don't really give a shit because we are probably closing down #####");
-					}
-					payload.mac = mac;
-					console.log("Registered our precense with master "+config.masterIP+" at " + payload.time);
-					needle.post(config.masterIP + ":" + config.masterPort + '/api/getID', payload, needleOptionsWithTokenAuthHeader, function (err, response, body) {
-						if (err && err.code != "ECONNRESET"){
-							console.error("We got problems, something went wrong when contacting master");
-							console.error(err);
-						} else if (response && response.body) {
-							// In the future we might be interested in whether or not we actually manage to send it, but honestly I don't care.
-							console.log(response.body);
-						}
-					});
-				}
-				if(global.mac){
-					callback(undefined, global.mac);
-				} else {
-					getMac(callback);
-				}
-			});
-		}
-	});
-	// Mod uploading and management -----------------------------------------------
-	// get mod names and hashes
-	// string: instance, function: callback
-	
-	setTimeout(function(){hashMods(instance, uploadMods)}, 5000);
-	function uploadMods(modHashes) {
-		// [{modName:string,hash:string}, ... ]
-		for(let i=0;i<modHashes.length;i++){
-			let payload = {
-				modName: modHashes[i].modName,
-				hash: modHashes[i].hash,
-			}
-			needle.post(config.masterIP + ":" + config.masterPort + '/api/checkMod', payload, needleOptionsWithTokenAuthHeader, function (err, response, body) {
-				if(err) console.log(new Error("Unable to contact master server! Please check your config.json."));
-				if(response && body && body == "found") {
-					console.log("master has mod "+modHashes[i].modName);
-				} else if (response && body && typeof body == "string") {
-					let mod = response.body;
-					if(config.uploadModsToMaster){
-						console.log("Sending mod: " + mod);
-						// Send mods master says it wants
-						// response.body is a string which is a modName.zip
-						var req = request.post({url: "http://"+config.masterIP + ":" + config.masterPort + '/api/uploadMod',
-							headers: {
-								"x-access-token": config.masterAuthToken,
-							},
-						}, function (err, resp, body) {
-							if (err) {
-								console.log(new Error("Unable to contact master server! Please check your config.json."));
-							} else {
-								console.log('URL: ' + body);
-							}
-						});
-						var form = req.form();
-						form.append('file', fs.createReadStream(config.instanceDirectory+"/"+instance+"/mods/"+mod));
-					} else {
-						console.log("Not sending mod: " + mod + " to master because config.uploadModsToMaster is not enabled")
-					}
-				}
-			});
-		}
-	}
-	
-	// flow/production statistics ------------------------------------------------------------
-	oldFlowStats = false
-	setInterval(function(){
-		fs.readFile(instancedirectory + "/script-output/flows.txt", {encoding: "utf8"}, function(err, data) {
-			if(!err && data) {
-				let timestamp = Date.now();
-				data = data.split("\n");
-				let flowStats = [];
-				for(let i = 0; i < data.length; i++) {
-					// try catch to remove any invalid json
-					try{
-						flowStats[flowStats.length] = JSON.parse(data[i]);
-					} catch (e) {
-						// console.log(" invalid json: " + i);
-						// some lines of JSON are invalid but don't worry, we just filter em out
-					}
-				}
-				// fluids
-				let flowStat1 = flowStats[flowStats.length-1].flows.player.input_counts
-				// items
-				let flowStat2 = flowStats[flowStats.length-2].flows.player.input_counts
-				// merge fluid and item flows
-				let totalFlows = {};
-				for(let key in flowStat1) totalFlows[key] = flowStat1[key];
-				for(let key in flowStat2) totalFlows[key] = flowStat2[key];
-				if(oldFlowStats && totalFlows && oldTimestamp) {
-					let payload = objectOps.deepclone(totalFlows);
-					// change from total reported to per time unit
-					for(let key in oldFlowStats) {
-						// get production per minute
-						payload[key] = Math.floor((payload[key] - oldFlowStats[key])/(timestamp - oldTimestamp)*60000);
-						if(payload[key] < 0) {
-							payload[key] = 0;
-						}
-					}
-					for(let key in payload) {
-						if(payload[key] == '0') {
-							delete payload[key];
-						}
-					}
-					console.log("Recorded flows, copper plate since last time: " + payload["copper-plate"]);
-					needle.post(config.masterIP + ":" + config.masterPort + '/api/logStats', {timestamp: timestamp, instanceID: instanceconfig.unique,data: payload}, needleOptionsWithTokenAuthHeader, function (err, response, body) {
-						// we did it, keep going
-					});
-				}
-				oldTimestamp = timestamp;
-				oldFlowStats = totalFlows;
-				fs.writeFileSync(instancedirectory + "/script-output/flows.txt", "");
-			}
-		});
-		// we don't need to update stats quickly as that could be expensive
-	}, 60000*5);
-	
-	// provide items --------------------------------------------------------------
-	// trigger when something happens to output.txt
-	fs.watch(instancedirectory + "/script-output/output.txt", function (eventType, filename) {
-		// get array of lines in file
-		let items = fs.readFileSync(instancedirectory + "/script-output/output.txt", "utf8").split("\n");
-		// if you found anything, reset the file
-		if (items[0]) {
-			fs.writeFileSync(instancedirectory + "/script-output/output.txt", "");
-		}
-		for (let i = 0; i < items.length; i++) {
-			if (items[i]) {
-				let g = items[i].split(" ");
-				g[0] = g[0].replace("\u0000", "");
-				// console.log("exporting " + JSON.stringify(g));
-				// send our entity and count to the master for him to keep track of
-				needle.post(config.masterIP + ":" + config.masterPort + '/api/place', {
-					name: g[0],
-					count: g[1],
-					instanceName: instance, // name of instance
-					instanceID: instanceconfig.unique, // a hash computed from the randomly generated rcon password
-				}, needleOptionsWithTokenAuthHeader, function (err, resp, body) {
-					if(body == "failure") console.error("#### Export failed! Lost: "+g[1]+" "+g[0]);
-					if(config.logItemTransfers){
-						if(body == "success") console.log(`Exported ${g[1]} ${g[0]} to master`);
-					}
-				});
-			}
-		}
-	});
-	// request items --------------------------------------------------------------
-	setInterval(function () {
-		// get array of lines in file
-		let items = fs.readFileSync(instancedirectory + "/script-output/orders.txt", "utf8").split("\n");
-		// if we actually got anything from the file, proceed and reset file
-		if (items[0]) {
-			fs.writeFileSync(instancedirectory + "/script-output/orders.txt", "");
-			// prepare a package of all our requested items in a more tranfer friendly format
-			var preparedPackage = {};
-			for (let i = 0; i < items.length; i++) {
-				(function (i) {
-					if (items[i]) {
-						items[i] = items[i].split(" ");
-						items[i][0] = items[i][0].replace("\u0000", "");
-						items[i][0] = items[i][0].replace(",", "");
-						if (preparedPackage[items[i][0]]) {
-							// if we have buffered some already, sum the new items
-							if (typeof Number(preparedPackage[items[i][0]].count) == "number" && typeof Number(items[i][1]) == "number") {
-								preparedPackage[items[i][0]] = {
-									"name": items[i][0],
-									"count": Number(preparedPackage[items[i][0]].count) + Number(items[i][1]),
-									"instanceName":instance,
-									"instanceID":instanceconfig.unique,
-								};
-							// else just add em in without summing
-							} else if (typeof Number(items[i][1]) == "number") {
-								preparedPackage[items[i][0]] = {
-									"name": items[i][0],
-									"count": Number(items[i][1]),
-									"instanceName":instance,
-									"instanceID":instanceconfig.unique,
-								};
-							}
-						// this condition will NEVER be triggered but we know how that goes
-						} else if (typeof Number(items[i][1]) == "number") {
-							preparedPackage[items[i][0]] = {
-								"name": items[i][0],
-								"count": Number(items[i][1]),
-								"instanceName":instance,
-								"instanceID":instanceconfig.unique,
-							};
-						}
-					}
-				})(i);
-			}
-			// request our items, one item at a time
-			for (let i = 0; i < Object.keys(preparedPackage).length; i++) {
-				// console.log(preparedPackage[Object.keys(preparedPackage)[i]]);
-				needle.post(config.masterIP + ":" + config.masterPort + '/api/remove', preparedPackage[Object.keys(preparedPackage)[i]], needleOptionsWithTokenAuthHeader, function (err, response, body) {
-					if (response && response.body && typeof response.body == "object") {
-						// buffer confirmed orders
-						confirmedOrders[confirmedOrders.length] = {name:response.body.name,count:response.body.count}
-						if(config.logItemTransfers){
-							console.log(`Imported ${response.body.count} ${response.body.name} from master`);
-						}
-					}
-				});
-			}
-			// if we got some confirmed orders
-			// console.log("Importing " + confirmedOrders.length + " items! " + JSON.stringify(confirmedOrders));
-			//if (!(confirmedOrders.length>0)){return;}
-			let cmd="local t={";
-			for(let i=0;i<confirmedOrders.length;i++)
-			{
-			    cmd+='["'+confirmedOrders[i].name+'"]='+confirmedOrders[i].count+',';
-			    if(cmd.length>320) // Factorio max packet size is 508
-			    {
-			        messageInterface("/silent-command remote.call('clusterio', 'runcode', '"+cmd.slice(0, -1)+"}"+ " for k, item in pairs(t) do GiveItemsToStorage(k, item) end')");
-			        cmd="local t={";
-			    }
-			}
-			if (!(cmd==="local t={")){
-				messageInterface("/silent-command remote.call('clusterio', 'runcode', '"+cmd.slice(0, -1)+"}"+ " for k, item in pairs(t) do GiveItemsToStorage(k, item) end')");
-			}
-			confirmedOrders=[];
-		}
-	}, 1000);
-	// COMBINATOR SIGNALS ---------------------------------------------------------
-	// get inventory from Master and RCON it to our slave
-	setInterval(function () {
-		needle.get(config.masterIP + ":" + config.masterPort + '/api/inventory', function (err, response, body) {
-			if(err){
-				console.log("Unable to get JSON master/api/inventory, master might be unaccessible");
-			} else if (response && response.body) {
-				// Take the inventory we (hopefully) got and turn it into the format LUA accepts
-				if(Buffer.isBuffer(response.body)) {console.log(response.body.toString("utf-8")); throw new Error();} // We are probably contacting the wrong webserver
-				try {
-					var inventory = JSON.parse(response.body);
-					var inventoryFrame = {};
-					for (let i = 0; i < inventory.length; i++) {
-						inventoryFrame[inventory[i].name] = Number(inventory[i].count);
-						if(inventoryFrame[inventory[i].name] >= Math.pow(2, 31)){
-							inventoryFrame[inventory[i].name] = Math.pow(2, 30); // set it waaay lower, 31 -1 would probably suffice
-						}
-					}
-					inventoryFrame["signal-unixtime"] = Math.floor(Date.now()/1000);
-					// console.log("RCONing inventory! " + JSON.stringify(inventoryFrame));
-					let first = true;
-					let cmd="local s={";
-					for (let key in inventoryFrame)
-					{
-						cmd+='["'+key+'"]='+inventoryFrame[key]+",";
-						if(first && cmd.length>300 || !first && cmd.length > 320) // Factorio max packet size is 508
-						{
-					       		messageInterface("/silent-command remote.call('clusterio', 'runcode', '"+(first ? 'global.ticksSinceMasterPinged=0 ':'')+cmd.slice(0, -1)+"}"+ " for name,count in pairs(s) do global.invdata[name]=count end')");
-					       		cmd="local s={";
-					       		first = false;
-						}
-					}
-					if (!(cmd==="local s={")){
-						messageInterface("/silent-command remote.call('clusterio', 'runcode', '"+(first ? 'global.ticksSinceMasterPinged=0 ':'')+cmd.slice(0, -1)+"}"+ " for name,count in pairs(s) do global.invdata[name]=count end')");
-					}
-					messageInterface("/silent-command remote.call('clusterio', 'runcode', 'UpdateInvCombinators()')");
-				} catch (e){
-					console.log(e);
-				}
-			}
-		});
-	}, 1550);
-	// Make sure world has its worldID
-	setTimeout(function(){
-		messageInterface("/silent-command remote.call('clusterio','setWorldID',"+instanceconfig.unique+")")
-	}, 20000);
-	/* REMOTE SIGNALLING
-	 * send any signals the slave has been told to send
-	 * Fetch combinator signals from the server
-	*/
-	socket.on("processCombinatorSignal", circuitFrameWithMeta => {
-		if(circuitFrameWithMeta && typeof circuitFrameWithMeta == "object" && circuitFrameWithMeta.frame && Array.isArray(circuitFrameWithMeta.frame)){
-			messageInterface("/silent-command remote.call('clusterio', 'receiveFrame', '"+JSON.stringify(circuitFrameWithMeta.frame)+"')");
-		}
-	});
-	// get outbound frames from file and send to master
-	// get array of lines in file, each line should correspond to a JSON encoded frame
-	let signals = fs.readFileSync(instancedirectory + "/script-output/txbuffer.txt", "utf8").split("\n");
-	// if we actually got anything from the file, proceed and reset file
-	let readingTxBufferSoon = false;
-	let txBufferClearCounter = 0;
-	fs.watch(instancedirectory + "/script-output/txbuffer.txt", "utf-8", (eventType, filename) => {
-		if(!readingTxBufferSoon){ // use a 100ms delay to avoid messing with rapid sequential writes from factorio (I think that might be a problem maybe?)
-			readingTxBufferSoon = true;
-			setTimeout(()=>{
-				txBufferClearCounter++;
-				fs.readFile(instancedirectory + "/script-output/txbuffer.txt", "utf-8", (err, signals) => {
-					signals = signals.split("\n");
-					if (signals[0]) {
-						//if(txBufferClearCounter > 500){
-							fs.writeFileSync(instancedirectory + "/script-output/txbuffer.txt", "");
-						//	txBufferClearCounter = 0;
-						//}
-						
-						// loop through all our frames
-						for (let i = 0; i < signals.length; i++) {
-							if (signals[i] && objectOps.isJSON(signals[i])) {
-								// signals[i] is a JSON array called a "frame" of signals. We timestamp it for storage on master
-								// then we unpack and RCON in this.frame to the game later.
-								let framepart = JSON.parse(signals[i]);
-								let doneframe = {
-									time: Date.now(),
-									frame: framepart, // thats our array of objects(single signals);
-								}
-								// send to master using socket.io, opened at the top of instanceManagement()
-								socket.emit("combinatorSignal", doneframe);
-							} else {
-								// console.log("Invalid jsony: "+typeof signals[i])
-							}
-						}
-					}
-				});
-				readingTxBufferSoon = false;
-			},100);
-		}
-	});
-} // END OF INSTANCE START ---------------------------------------------------------------------
-
-// string, function
-// returns [{modName:string,hash:string}, ... ]
-function hashMods(instanceName, callback) {
-	if(!callback) {
-		throw new Error("ERROR in function hashMods NO CALLBACK");
-	}
-	function callback2(hash, modName){
-		hashedMods[hashedMods.length] = {
-			modName: modName,
-			hash: hash,
-		}
-		// check if this callback has ran once for each mod
-		if(hashedMods.length == instanceMods.length) {
-			callback(hashedMods);
-		}
-		//console.log(modname);
-	}
-	let hashedMods = [];
-	/*let mods = fs.readdirSync("./sharedMods/")*/
-	let instanceMods = fs.readdirSync(config.instanceDirectory+"/"+instanceName+"/mods/");
-	if(instanceMods.length == 0){
-		callback({}); // there are no mods installed, return an empty object
-	}
-	for(let o=0;o<instanceMods.length;o++) {
-		if(path.extname(instanceMods[o]) != ".zip") {
-			instanceMods.splice(instanceMods.indexOf(instanceMods[o]), 1); // remove element from array, we can't hash unzipped mods
-		}
-	}
-	for(let i=0; i<instanceMods.length; i++){
-		let path = config.instanceDirectory+"/"+instanceName+"/mods/"+instanceMods[i];
-		let name = instanceMods[i];
-		let options = {
-			files:path,
-		}
-		// options {files:[array of paths]}
-		hashFiles(options, function(error, hash) {
-			// hash will be a string if no error occurred
-			if(!error){
-				callback2(hash, name);
-			} else {
-				throw error;
-			}
-		});
-	}
-}

codecov.yml

@@ -0,0 +1,6 @@
+coverage:
+  status:
+    project:
+      default:
+        if_ci_failed: success
+        informational: true

config.json.dist

@@ -1,52 +0,0 @@
-{
-	"__comment": "Where factorio folder. Should be in the same folder as this config file.",
-	"factorioDirectory": "factorio",
-	"instanceDirectory": "instances",
-	
-	"__comment1": "IP players should connect to to join your servers, should be portforwarded and stuff",
-	"publicIP": "localhost",
-	
-	"__comment2": "IP the master web server runs at, can be ignored on the master system",
-	"masterIP": "localhost",
-	
-	"__commentMasterPort": "HTTP port for the master to listen to, set to 0 or an empty string to not listen for HTTP requests",
-	"masterPort": 8080,
-	
-	"__commentsslPort": "HTTPS port for the master to listen to. Set to 0 or an empty string to not use HTTPS.",
-	"sslPort": 443,
-	"sslCert": "database/certificates/cert.crt",
-	"sslPrivKey": "database/certificates/cert.key",
-	
-	"__commentMasterAuthToken": "Authentication token to connect to the master server. Find it in secret-api-token.txt on the master.",
-	"masterAuthToken": "",
-	
-	"__commentAuthSecret": "This is a long random string used for generating authentication tokens. Do not share. Regenerates when secret-api-token.txt is deleted.",
-	"masterAuthSecret": "",
-	
-	"__comment3": "Your factorio.com username for factorio MP services, also username will be admin on new instances",
-	"username": "",
-	"__comment4": "Token from your factorio.com profile page. Required for MP and mod manager services.",
-	"token": "",
-	"__comment7": "Used for communication with the mod portal, not needed if you manage mods by hand",
-	"factorio_version": "0.16.41",
-	
-	"__comment5": "General user settings",
-	"verify_user_identity": true,
-	"auto_pause": false,
-	"allow_commands": "admins-only",
-	"game_password": "",
-	"description": "This server runs Clusterio",
-	"visibility": {
-		"public": true,
-		"lan": true
-	},
-	"__comment6": "Statistic gathering statistics, may affect server performance (master memory usage especially)",
-	"itemStats": {
-		"maxEntries":60,
-		"entriesPerSecond": 0.01666666667
-	},
-	"logItemTransfers": false,
-	"uploadModsToMaster": true,
-	"msBetweenCommands": 10,
-	"allowRemoteCommandExecution": true
-}

docker-compose.test.yml

@@ -0,0 +1,7 @@
+version: '3'
+
+services:
+  unit_test:
+    image: clusterio
+    build: .
+    command: npm run test

docker-compose.yml

@@ -0,0 +1,9 @@
+version: '3'
+
+services:
+  controller:
+    build: .
+    command: npx clusteriocontroller run
+  host:
+    build: .
+    command: npx clusteriohost run

docs/assets/WsClientConnector.svg

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="1000px" height="840px" viewBox="-0.5 -0.5 1000 840" style="background-color: rgb(238, 243, 250);"><defs/><g><rect x="40" y="550" width="320" height="250" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 318px; height: 1px; padding-top: 547px; margin-left: 42px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">connected</div></div></div></foreignObject><text x="42" y="547" fill="#000000" font-family="Helvetica" font-size="12px">connected</text></switch></g><rect x="780" y="40" width="180" height="150" fill="#cedbee" stroke="none" pointer-events="all"/><path d="M 300 750 L 300 730 L 440 730 L 440 140 L 376.37 140" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 371.12 140 L 378.12 136.5 L 376.37 140 L 378.12 143.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 723px; margin-left: 346px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">yes</div></div></div></foreignObject><text x="346" y="726" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">yes</text></switch></g><rect x="520" y="490" width="440" height="310" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 438px; height: 1px; padding-top: 487px; margin-left: 522px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">resuming</div></div></div></foreignObject><text x="522" y="487" fill="#000000" font-family="Helvetica" font-size="12px">resuming</text></switch></g><rect x="40" y="210" width="380" height="300" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 378px; height: 1px; padding-top: 207px; margin-left: 42px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">connecting</div></div></div></foreignObject><text x="42" y="207" fill="#000000" font-family="Helvetica" font-size="12px">connecting</text></switch></g><path d="M 120 150 L 120 223.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 120 228.88 L 116.5 221.88 L 120 223.63 L 123.5 221.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 191px; margin-left: 151px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; coLine truncated

docs/assets/WsServerConnector.svg

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="919px" height="620px" viewBox="-0.5 -0.5 919 620" style="background-color: rgb(238, 243, 250);"><defs/><g><rect x="40" y="260" width="320" height="300" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 318px; height: 1px; padding-top: 257px; margin-left: 42px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">connected</div></div></div></foreignObject><text x="42" y="257" fill="#000000" font-family="Helvetica" font-size="12px">connected</text></switch></g><rect x="700" y="40" width="180" height="150" fill="#cedbee" stroke="none" pointer-events="all"/><path d="M 280 390 L 280 370 L 380 370 L 380 130 L 346.37 130" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 341.12 130 L 348.12 126.5 L 346.37 130 L 348.12 133.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 360px; margin-left: 291px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">yes</div></div></div></foreignObject><text x="291" y="363" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">yes</text></switch></g><rect x="420" y="190" width="160" height="160" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 158px; height: 1px; padding-top: 187px; margin-left: 422px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">resuming</div></div></div></foreignObject><text x="422" y="187" fill="#000000" font-family="Helvetica" font-size="12px">resuming</text></switch></g><path d="M 120 140 L 120 273.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 120 278.88 L 116.5 271.88 L 120 273.63 L 123.5 271.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 194px; margin-left: 151px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">ready()</div></div></div></foreignObject><text x="151" y="197" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">ready()</text></switch></g><rect x="40" y="80" width="320" height="80" fill="none" stroke="#000000" stroke-dasharray="3 3" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe flex-end; justify-content: unsafe flex-start; width: 318px; height: 1px; padding-top: 77px; margin-left: 42px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #00Line truncated

docs/assets/connection_flow.drawio

@@ -0,0 +1,321 @@
+<mxfile host="Electron" modified="2021-08-30T18:05:06.237Z" agent="5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/14.9.6 Chrome/89.0.4389.128 Electron/12.0.16 Safari/537.36" etag="uzcLt7Oh4qtDsMY9WSdT" compressed="false" version="14.9.6" type="device">
+  <diagram id="GSbHU_PhJe-l3NQpc0X3" name="Connection Flow">
+    <mxGraphModel dx="710" dy="734" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="760" pageHeight="630" background="#EEF3FA" math="0" shadow="0">
+      <root>
+        <mxCell id="GTJXd52-XhRZD3rAr2nm-0" />
+        <mxCell id="GTJXd52-XhRZD3rAr2nm-1" parent="GTJXd52-XhRZD3rAr2nm-0" />
+        <mxCell id="2r3fOvGVNr9_K5ZBoRis-18" value="Client" style="text;html=1;align=left;verticalAlign=middle;resizable=1;points=[];autosize=0;strokeColor=none;fontStyle=1" parent="GTJXd52-XhRZD3rAr2nm-1" vertex="1">
+          <mxGeometry x="440" y="80" width="145" height="20" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="2r3fOvGVNr9_K5ZBoRis-28" target="IKjVovVhkWe_WipwIJL3-0">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="260" y="320.02" />
+              <mxPoint x="260" y="320.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-5" value="receive&lt;br&gt;resume" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;spacingRight=4;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-1">
+          <mxGeometry x="0.086" relative="1" as="geometry">
+            <mxPoint x="-20" y="-6" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="2r3fOvGVNr9_K5ZBoRis-28" target="IKjVovVhkWe_WipwIJL3-2">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="180" y="320.02" />
+              <mxPoint x="180" y="320.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-26" value="receive&lt;br&gt;register" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;spacingRight=4;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-3">
+          <mxGeometry x="-0.2268" relative="1" as="geometry">
+            <mxPoint x="-20" y="2" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-14" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="2r3fOvGVNr9_K5ZBoRis-28" target="IKjVovVhkWe_WipwIJL3-13">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="40" y="285.02" />
+              <mxPoint x="40" y="580.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-27" value="bad handshake&lt;br&gt;timeout" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-14">
+          <mxGeometry x="-0.6341" y="-2" relative="1" as="geometry">
+            <mxPoint x="28" y="17" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="2r3fOvGVNr9_K5ZBoRis-28" value="Wait for handshake" style="rounded=0;whiteSpace=wrap;html=1;strokeWidth=2;" parent="GTJXd52-XhRZD3rAr2nm-1" vertex="1">
+          <mxGeometry x="160" y="270.02000000000004" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="HutjLCx0ygpoBEJLSh69-0" value="Server" style="text;html=1;align=left;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fontStyle=1" parent="GTJXd52-XhRZD3rAr2nm-1" vertex="1">
+          <mxGeometry x="40" y="80" width="50" height="20" as="geometry" />
+        </mxCell>
+        <mxCell id="_PUvpjEMIo1z1dIbIUzw-0" value="&lt;p&gt;&lt;span&gt;Connection Flow&lt;/span&gt;&lt;br&gt;&lt;/p&gt;" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;rounded=0;fontStyle=0;fontSize=20;" parent="GTJXd52-XhRZD3rAr2nm-1" vertex="1">
+          <mxGeometry x="40" y="30" width="230" height="20" as="geometry" />
+        </mxCell>
+        <mxCell id="fGsjKHM69yN9R0Hf5M05-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="fGsjKHM69yN9R0Hf5M05-0" target="IKjVovVhkWe_WipwIJL3-7">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="220" y="180" />
+              <mxPoint x="180" y="180" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="fGsjKHM69yN9R0Hf5M05-0" value="WebSocket Open" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="160" y="119.98" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-4" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-0" target="IKjVovVhkWe_WipwIJL3-9">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="300" y="300.02" />
+              <mxPoint x="300" y="300.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-6" value="bad session" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;spacingLeft=4;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-4">
+          <mxGeometry x="-0.429" y="-1" relative="1" as="geometry">
+            <mxPoint x="29" y="-4" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-20" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-0" target="IKjVovVhkWe_WipwIJL3-19">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-29" value="valid" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-20">
+          <mxGeometry x="-0.1944" y="2" relative="1" as="geometry">
+            <mxPoint x="18" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-0" value="Validate resume" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="230" y="340.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-21" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-2" target="IKjVovVhkWe_WipwIJL3-18">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-28" value="valid" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-21">
+          <mxGeometry x="-0.2778" relative="1" as="geometry">
+            <mxPoint x="20" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-24" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-2" target="IKjVovVhkWe_WipwIJL3-13">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="60" y="355.02" />
+              <mxPoint x="60" y="560.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-30" value="bad token" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-24">
+          <mxGeometry x="-0.8093" y="1" relative="1" as="geometry">
+            <mxPoint x="29" y="23" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-2" value="Validate register" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="90" y="340.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-7" target="2r3fOvGVNr9_K5ZBoRis-28">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="180" y="260.02" />
+              <mxPoint x="180" y="260.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-7" value="Send hello" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="90" y="199.96" width="120" height="30.02" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-9" target="2r3fOvGVNr9_K5ZBoRis-28">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="260" y="260.02" />
+              <mxPoint x="260" y="260.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-9" value="Send invalidate" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="230" y="199.96" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-13" value="Close connection" style="rounded=1;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="160" y="550.02" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-15" value="Connected" style="rounded=1;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="160" y="480.02" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-22" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-18" target="IKjVovVhkWe_WipwIJL3-15">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="180" y="470" />
+              <mxPoint x="180" y="470" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-18" value="Send ready" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="90" y="410.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-23" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-19" target="IKjVovVhkWe_WipwIJL3-15">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="260" y="470" />
+              <mxPoint x="260" y="470" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-19" value="Send continue" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="230" y="410.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-31" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-37" target="IKjVovVhkWe_WipwIJL3-44">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="630" y="240.02" />
+              <mxPoint x="630" y="240.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-32" value="previous&lt;br&gt;session" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;spacingRight=8;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-31">
+          <mxGeometry x="0.086" relative="1" as="geometry">
+            <mxPoint x="-20" y="-2" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-33" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-37" target="IKjVovVhkWe_WipwIJL3-49">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="550" y="250.02" />
+              <mxPoint x="550" y="250.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-34" value="no&lt;br&gt;session" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;spacingRight=8;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-33">
+          <mxGeometry x="-0.2268" relative="1" as="geometry">
+            <mxPoint x="-20" y="5" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-35" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-37" target="IKjVovVhkWe_WipwIJL3-54">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="440" y="215.02" />
+              <mxPoint x="440" y="570.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-36" value="bad handshake&lt;br&gt;timeout" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-35">
+          <mxGeometry x="-0.6341" y="-2" relative="1" as="geometry">
+            <mxPoint x="35" y="-23" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-37" value="Wait for hello" style="rounded=0;whiteSpace=wrap;html=1;strokeWidth=2;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="530" y="199.96000000000006" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-60" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-39" target="IKjVovVhkWe_WipwIJL3-37">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-39" value="WebSocket Open" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="530" y="119.98" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-65" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-44" target="IKjVovVhkWe_WipwIJL3-61">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="660" y="360.02" />
+              <mxPoint x="660" y="360.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-44" value="Send resume" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="600" y="270.0199999999999" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-68" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-49" target="IKjVovVhkWe_WipwIJL3-67">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-49" value="Send register" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="460" y="270.0199999999999" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-54" value="Close connection" style="rounded=1;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="530" y="550.02" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-55" value="Connected" style="rounded=1;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="530" y="480.0199999999999" width="120" height="40" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-64" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-61" target="IKjVovVhkWe_WipwIJL3-62">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="630" y="390.02" />
+              <mxPoint x="630" y="390.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-73" value="receive&lt;br&gt;invalidate" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-64">
+          <mxGeometry x="0.2133" relative="1" as="geometry">
+            <mxPoint x="-30" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-70" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-61" target="IKjVovVhkWe_WipwIJL3-54">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="700" y="570.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-74" value="bad handshake&lt;br&gt;timeout" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;rotation=90;spacingTop=7;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-70">
+          <mxGeometry x="-0.7644" y="2" relative="1" as="geometry">
+            <mxPoint x="-12" y="29" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-71" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-61" target="IKjVovVhkWe_WipwIJL3-55">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="630" y="450.02" />
+              <mxPoint x="630" y="450.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-75" value="receive&lt;br&gt;continue" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];spacingRight=4;labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-71">
+          <mxGeometry x="-0.3167" y="-1" relative="1" as="geometry">
+            <mxPoint x="-19" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-61" value="Wait for continue" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;strokeWidth=2;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="600" y="410.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-63" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-62" target="IKjVovVhkWe_WipwIJL3-49">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="550" y="320.02" />
+              <mxPoint x="550" y="320.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-62" value="Invalidate session" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="530" y="340.02" width="120" height="30" as="geometry" />
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-69" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-67" target="IKjVovVhkWe_WipwIJL3-54">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="470" y="560.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-77" value="bad handshake&lt;br&gt;timeout" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];rotation=90;labelBackgroundColor=none;spacingBottom=4;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-69">
+          <mxGeometry x="-0.8148" y="1" relative="1" as="geometry">
+            <mxPoint x="12" y="33" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-72" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="GTJXd52-XhRZD3rAr2nm-1" source="IKjVovVhkWe_WipwIJL3-67" target="IKjVovVhkWe_WipwIJL3-55">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="550" y="470.02" />
+              <mxPoint x="550" y="470.02" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-76" value="receive&lt;br&gt;ready" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];labelBackgroundColor=none;" vertex="1" connectable="0" parent="IKjVovVhkWe_WipwIJL3-72">
+          <mxGeometry x="-0.2389" y="2" relative="1" as="geometry">
+            <mxPoint x="-22" as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="IKjVovVhkWe_WipwIJL3-67" value="Wait for ready" style="rounded=0;whiteSpace=wrap;html=1;labelBackgroundColor=none;strokeWidth=2;" vertex="1" parent="GTJXd52-XhRZD3rAr2nm-1">
+          <mxGeometry x="460" y="410.02" width="120" height="30" as="geometry" />
+        </mxCell>
+      </root>
+    </mxGraphModel>
+  </diagram>
+</mxfile>

docs/assets/connection_flow.svg

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="760px" height="630px" viewBox="-0.5 -0.5 760 630" style="background-color: rgb(238, 243, 250);"><defs/><g><rect x="440" y="80" width="145" height="20" fill="none" stroke="none" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 1px; height: 1px; padding-top: 90px; margin-left: 442px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; font-weight: bold; white-space: nowrap; ">Client</div></div></div></foreignObject><text x="442" y="94" fill="#000000" font-family="Helvetica" font-size="12px" font-weight="bold">Client</text></switch></g><path d="M 260 300.02 L 260 320 L 260 333.65" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 260 338.9 L 256.5 331.9 L 260 333.65 L 263.5 331.9 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 316px; margin-left: 238px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">receive<br />resume</div></div></div></foreignObject><text x="238" y="319" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">receive...</text></switch></g><path d="M 180 300.02 L 180 320 L 180 333.65" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 180 338.9 L 176.5 331.9 L 180 333.65 L 183.5 331.9 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 318px; margin-left: 158px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">receive<br />register</div></div></div></foreignObject><text x="158" y="322" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">receive...</text></switch></g><path d="M 160 285 L 40 285 L 40 580 L 153.63 580" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 158.88 580 L 151.88 583.5 L 153.63 580 L 151.88 576.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 300px; margin-left: 91px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 11px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: nowrap; ">bad handshake<br />timeout</div></div></div></foreignObject><text x="91" y="304" fill="#000000" font-family="Helvetica" font-size="11px" text-anchor="middle">bad handshake...</text></switch></g><rect x="160" y="270.02" width="120" height="30" fill="#ffffff" stroke="#000000" stroke-width="2" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 118px; height: 1px; padding-top: 285px; margin-left: 161px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "Line truncated

docs/assets/connector_states.svg

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="800px" height="440px" viewBox="-0.5 -0.5 800 440" style="background-color: rgb(238, 243, 250);"><defs/><g><path d="M 170 365.02 L 170 385 L 290 385 L 290 371.39" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 290 366.14 L 293.5 373.14 L 290 371.39 L 286.5 373.14 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><path d="M 110 350 L 40 350 L 40 130 L 103.63 130" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 108.88 130 L 101.88 133.5 L 103.63 130 L 101.88 126.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><rect x="110" y="335.02" width="100" height="30" fill="#ffffff" stroke="#000000" stroke-width="2" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 98px; height: 1px; padding-top: 350px; margin-left: 111px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">connected</div></div></div></foreignObject><text x="160" y="354" fill="#000000" font-family="Helvetica" font-size="12px" text-anchor="middle">connected</text></switch></g><path d="M 290 335.02 L 290 315 L 180 315 L 180 328.65" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 180 333.9 L 176.5 326.9 L 180 328.65 L 183.5 326.9 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><path d="M 350 335.02 L 350 135 L 216.37 135" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 211.12 135 L 218.12 131.5 L 216.37 135 L 218.12 138.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><path d="M 320 335.02 L 320 235 L 216.37 235" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 211.12 235 L 218.12 231.5 L 216.37 235 L 218.12 238.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><rect x="270" y="335.02" width="100" height="30" fill="#ffffff" stroke="#000000" stroke-width="2" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 98px; height: 1px; padding-top: 350px; margin-left: 271px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">resuming</div></div></div></foreignObject><text x="320" y="354" fill="#000000" font-family="Helvetica" font-size="12px" text-anchor="middle">resuming</text></switch></g><path d="M 500 149.96 L 500 223.59" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 500 228.84 L 496.5 221.84 L 500 223.59 L 503.5 221.84 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><rect x="460" y="119.96" width="80" height="30" fill="#ffffff" stroke="#000000" stroke-width="2" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 78px; height: 1px; padding-top: 135px; margin-left: 461px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; "><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: #000000; line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">closed</div></div></div></foreignObject><text x="500" y="139" fill="#000000" font-family="Helvetica" font-size="12px" text-anchor="middle">closed</text></switch></g><path d="M 520 259.96 L 520 280 L 630 280 L 630 266.33" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 630 261.08 L 633.5 268.08 L 630 266.33 L 626.5 268.08 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="all"/><path d="M 480 229.96 L 480 190 L 480 156.33" fill="noneLine truncated

docs/communication.md

@@ -0,0 +1,36 @@
+# Communication Layer
+
+<sub>This document describes the communication layer in Clusterio and unless you're developing Clusterio it's probably not going to be very useful for you.</sub>
+
+Communication is facilitated by the lib/link library and is based on three core abstractions: links, connectors and messages.
+Links represents one side of a two way communication pipe, connectors deal with connecting and establishing communication, and messages are the content sent over the link.
+
+
+## Link
+
+The Link class represents one side of a two way communication channel where the actual communication is done by a connector associated with the link.
+The link also knows what the endpoint types it's connected to are via the source and target attributes.
+
+The endpoint types currently implemented are controller, host, instance, and control.
+Although host and instances run in the same Node.js program they use virtual links to communicate between them in order to simplify the communication architecture.
+
+Upon creation the link will register with the connector in order to receive and process messages from it.
+The messages received are validated using the validator registered for the type of the message.
+A message for which there is no validator for is considered an error.
+
+
+## Connector
+
+The connector used with a link is responsible for establishing and/or maintain the connection that messages are sent over.
+Reconnect logic is expected to be implemented in the connector, though this has not yet been done.
+
+There's also the virtual connector which lets two links in the same program be connected to each other without having to establish a network connection.
+
+
+## Message
+
+There's two types of messages currently implemented apart from the Link builtin close message and that's Request and Event.
+The builtin messages are defined in [packages/lib/src/link/messages.ts](/packages/lib/src/link/messages.ts) and are attached to links via the attachAllMessages function, which is usally called in the Link subclass constructor.
+
+The messages define which links they are valid on and only attaches handlers for those links.
+There's also a forwarding mechanism for when a request or event is to be forwarded another hop.

docs/config-system.md

@@ -0,0 +1,115 @@
+# Configuration System
+
+<sub>This document describes the implementation and inner working of the configuration system in Clusterio, and unless you're developing Clusterio it's probably not going to be very useful for you.</sub>
+
+Clusterio uses a field based configuration system to manage settings for the controller, instances, hosts, and the clusterioctl utility.
+Plugins can add their own config fields for the controller, host and instance configs.
+The fields are defined early in the startup, and fields for disabled plugins will still be created.
+
+The built-in config fields are defined in [packages/lib/src/config/definitions.ts](/packages/lib/src/config/definitions.ts) while plugins can add their own config field definitions to the `controllerConfigFields`, `hostConfigFields` and `instanceConfigFields` properties of the `plugin` export.
+A `<plugin_name>.load_plugin` field is automatically created for each plugin and it's used to enable/disable the loading plugins on startup.
+
+
+## Defing Fields
+
+Fields are defined as POJS object properties where the name of the property correspond to the name of the configuration field.
+The property name is the primary way the field is accessed both in code and on the command line, as such it should follow the lower\_case\_underscore style and consist of a group name and a field name separated by a dot.
+For plugins the group name is the name of the plugin, e.g., the `level` field of the `foo_frobber` plugin would be named `foo_frobber.lavel`.
+
+**access**:
+    The locations this config field can be read and modified from.
+    This is an array of strings which can contain the values `"controller"`, `"host"` and `"control"`.
+    If a party is missing in this array then that party will not receive the value of this field when the config is shared, and will be unable to modify the field.
+    If not set any party can read and modify this config entry.
+    Note that instance config fields should have both `"controller"` and `"host"` or unexpected behaviour may occur.
+
+**type**:
+    The type of config value this field will support.
+    The supported values are boolean, string, number, and object, and if an attept is made to set the field to a value that is not of the right type it will be reject unless it's a string that can be converted to the right type.
+
+**title** (optional):
+    Text used to identify the config field in user interfaces.
+    This should not contain the grouping used in `name`.
+
+**description** (optional):
+    Text used to describe the config field in user interfaces.
+
+**enum** (optional):
+    Array of acceptable values this field can have.
+    Attempts to set a value not in this array will be rejected, which makes it useful for making enumareted list of choices.
+
+**optional** (optional):
+    True if this field can be set to null.
+    Defaults to false.
+
+**initialValue** (optional if optional is true):
+    Value this config field should take in a newly initialized config.
+    This can also be an async function returning the value to use.
+
+**validator** (optional):
+    Function called with the value being set and the config it belongs to.
+    It should throw an error if the value is not acceptable, and the message of the error is passed on to whoever tried to set it.
+    Common validators such as `greaterThanZero`, `greaterThanEqualZero`, `integer` and `filePath` are available on `Config.validators`, along with `optional` to skip null and `all` to combine several.
+    The config is read only while the validator runs.
+
+**dependsOn** (optional):
+    Names of other fields the validator reads the value of.
+    When one of those fields is changed the validator of this field is run again against the new value, and the change is rejected if it fails.
+
+**restartRequired** (optional):
+    True if a restart of the controller, host or instance the config belongs to is needed for changes to take effect.
+    Changing such a field sets the `restartRequired` flag on the config, which the web interface uses to show that a restart is pending.
+    Defaults to false.
+
+**restartRequiredProps** (optional):
+    For object fields, names of properties that have the opposite of `restartRequired`.
+    Only used by the web interface to show which properties need a restart, `factorio.settings` uses it to mark the settings that are applied live.
+
+**credential** (optional):
+    Locations allowed to read the value of this field.
+    Other locations can still change the value if allowed by `access`, which is what you want for tokens and passwords.
+
+**readonly** (optional):
+    Locations allowed to change the value of this field.
+    Other locations can still read the value if allowed by `access`.
+
+**hidden** (optional):
+    True if the web interface should not show this field.
+    Used for internal values that are managed by Clusterio.
+
+**autoComplete** (optional):
+    Value for the autocomplete attribute of the input in the web interface, e.g. `section-factorio new-password`.
+    Only used for string and number fields.
+
+**inputComponent** (optional):
+    Name of the input component the web interface should render for this field instead of the default for its type.
+    Plugins can add their own components through `inputComponents` on their web plugin class.
+
+If the value for a field stored in on disk somehow ends up being invalid the field will take on the initial\_value instead when the config is loaded.
+
+
+## Accessing Fields
+
+On the Config instance there's two ways to access fields: through the set and get methods.
+E.g.:
+
+    let value = configInstance.get("group.field");
+
+Or by through the raw fields object (which is best avoided as it doesn't check types or whether the accessed field exists).
+E.g.:
+
+    let value = configInstance.fields["group.field"]
+
+The set method also takes an extra argument, which is the value to set the field to.
+If the value is not valid this will throw an InvalidValue exception, if the field doesn't exist it will throw an InvalidField exception.
+
+
+## Config Lifecycle
+
+Values for all config fields are created when the config is initialized, as well as for any fields with missing values when a config is loaded.
+Once a field has a value it is never automatically removed, even if the field it was part of no longer exists.
+This ensures that plugin configuration is not lost should the server be started up without the plugins that defined the configuration installed.
+
+For instance configs, they are kept on the controller and serialized and sent over to the relevant hosts on startup.
+This makes it possible to edit instance configs when the host the instance is on is offline.
+A copy is also stored in the instance directory on the host, and this config will be deliverd to the controller on host startup, which enables instances to be copied between clusters as long as their IDs are unique.

docs/configuration.md

@@ -0,0 +1,753 @@
+# Configuration
+
+Config values are changed with the `config set` commands of clusterioctl, clusteriocontroller and clusteriohost, or from the settings pages in the web interface.
+See [Managing a Cluster](/docs/managing-a-cluster.md) for the commands.
+
+All values are checked against the type of the field when set.
+Some fields have additional rules on top of that, such as a number having to be greater than 0, and these are listed under the field.
+Setting a value that fails a check is rejected with an error and the old value is kept.
+
+A few fields are internal to Clusterio.
+These are managed by Clusterio itself, hidden in the web interface and should not be modified by hand.
+
+
+## Controller Configuration
+
+### controller.name
+
+Name of the cluster.
+Used to distinguish it from other clusters and is prepended to the name of servers in the server list.
+
+Defaluts to "Your Cluster".
+
+
+### controller.database_directory
+
+Directory used to store cluster data to.
+Needs to be writeable by the controller.
+This is also used by plugins to store its data.
+
+Defaults to "database".
+
+
+### controller.mods_directory
+
+Directory where mods shared with the cluster are stored.
+Mods uploaded through the web interface or downloaded from the mod portal end up here, and hosts fetch the mods they need for their instances from here.
+Needs to be writeable by the controller.
+
+Defaults to "mods".
+
+
+### controller.autosave_interval
+
+Interval in seconds the controller saves the data it holds in memory, such as users, instances, mod packs and plugin data, to controller.database_directory.
+The data is also saved on shutdown.
+Must be greater than 0.
+
+Defaults to 60.
+
+
+### controller.http_port
+
+Port to host HTTP server on.
+If set to null no HTTP server will be exposed.
+At least one of this and controller.https_port needs to be set to a port.
+Must be a whole number greater than 0.
+
+Defaults to 8080.
+
+
+### controller.https_port
+
+Port to host HTTPS server on.
+Uses controller.tls_certificate and controller.tls_private_key as the certificate and private key for the HTTPS server.
+If set to null no HTTPS server will be exposed.
+At least one of this and controller.http_port needs to be set to a port.
+Must be a whole number greater than 0.
+
+See the [Setting up TLS](/docs/setting-up-tls.md) document for a guide to setting up HTTPS with Clusterio.
+
+Defaults to null.
+
+
+### controller.bind_address
+
+IP address to bind the HTTP and HTTPS ports on.
+Useful to limit which interface to accept connections from.
+If set to null the unspecified IPv6 address will be used, which on most systems means it will also listen on the unspecified IPv4 address and accept connections from all
+interfaces.
+
+Defaults to null.
+
+
+### controller.trusted_proxies
+
+Comma separated list of IP addresses and/or CIDR blocks of reverse proxies in front of the controller to trust the `X-Forwarded-For` header from.
+When a connection comes from one of these addresses the last address in the `X-Forwarded-For` header is used as the remote address of the connection instead of the address of the proxy.
+Entries that are not valid IP addresses are logged as errors and ignored.
+
+Defaults to null meaning the header is never trusted.
+
+
+### controller.public_url
+
+Public address the controller is accessible on.
+Used as the URL in configs generated with `clusteriocontroller bootstrap create-ctl-config` and `clusterioctl host create-config`, and by plugins like Player Auth that need to show the address of the web interface in-game.
+This should be a full URL ending with a /.
+
+Defaults to null meaning assume localhost.
+
+
+### controller.static_url
+
+Used to override where static assets such as the web bundle is loaded from.
+This can be used if you want to put the static assets on a separate cdn url like `https://cdn.example.com/static/` while keeping the API hosted directly by clusterio.
+Due to a limitation on how the webpack assets are built the pathname component of the url have to be `/static/`, values with any other path are rejected.
+
+See also the `clusteriocontroller copy-static` command for how to obtain the static asset files that need to be hosted.
+
+Defaults to null meaning use the internally hosted assets.
+
+
+### controller.grafana_url
+
+URL of a Grafana dashboard to link to from the overview page of the web interface, including the protocol.
+If null no link is shown.
+
+Defaults to null.
+
+
+### controller.tls_certificate
+
+Path to TLS certificate to use for the HTTPS server when controller.https_port is configured.
+Both this and controller.tls_private_key have to be set for the controller to start with controller.https_port configured.
+
+Defaults to null.
+
+
+### controller.tls_private_key
+
+Path to TLS private key to use for the HTTPS server when controller.https_port is configured.
+
+Defaults to null.
+
+
+### controller.auth_secret
+
+Base64 encoded authentication secret used to verify tokens issued to hosts, users, and sessions.
+This should contain 256 bytes of random data, and if changed will cause all tokens become invalid.
+Keep this secret if leaked an attacker could easily compromise the cluster.
+The value can only be read and changed from the controller itself, it is not available through clusterioctl or the web interface.
+
+Defaults to null which means generate a secure secret on startup.
+
+
+### controller.heartbeat_interval
+
+Interval in seconds heartbeats are sent out at for WebSocket connections.
+If a WebSocket connection hasn't received a heartbeat in 2 times the heartbeat interval it will be considered stale and closed.
+A lower value means less time between connections going stale and them being closed.
+Must be greater than 0.
+
+Defaults to 15.
+
+
+### controller.session_timeout
+
+Time in seconds from the connection is closed following a heartbeat timeout until the session is invalidated and data loss occurs.
+A higher timeout gives more time for a client to recconect and resume an active session over a connection that was dropped, but also leads to stale connections taking longer to clear out.
+In the case of the controller or client crashing the data loss is unavoidable.
+
+Value should not be less than the configured `max_reconnect_delay` of the clients and it should be greater than 2 times `controller.heartbeat_interval`.
+Must be greater than 0.
+
+Defaults to 60.
+
+
+### controller.max_send_buffer_size
+
+Size in MiB of messages sent to a connection that it has not yet acknowledged before the controller ends its session.
+The controller keeps these so they can be resent if the connection drops and resumes.
+A client that stops acknowledging messages, or falls far behind, gets disconnected and starts a new session when it reconnects.
+Changes apply to new sessions.
+Set to 0 for no limit.
+
+Defaults to 64.
+
+
+### controller.metrics_timeout
+
+Timeout in seconds before a call to gather metrics from a host times out.
+This should be less than both the timeout and collection interval configured for the collection job in Prometheus.
+Must be greater than 0.
+
+Defaults to 8.
+
+
+### controller.max_subscription_filters
+
+Maximum number of filters one connection can hold for a single subscribed event.
+Subscription requests that would go over this limit are rejected.
+Set to 0 for no limit.
+Lowering the limit does not remove filters connections already hold.
+
+Defaults to 10000.
+
+
+### controller.system_metrics_interval
+
+Interval in seconds the controller gathers CPU, memory and disk usage from itself and every connected host for display in the web interface.
+Whether the controller needs a restart to apply an update is also checked on this interval.
+If 0 system metrics are not gathered.
+Must be 0 or greater.
+
+Defaults to 10.
+
+
+### controller.proxy_stream_timeout
+
+Timeout in seconds for proxy streams through the controller that has been created but is not yet sending data to be automatically closed.
+Streams that have started sending data before this timeout is not affected.
+Must be greater than 0.
+
+Defaults to 15.
+
+
+### controller.factorio_username
+
+Username of the Factorio.com account to authenticate with the Factorio API with.
+Together with controller.factorio_token this is used by the controller to download mods from the mod portal, and if controller.share_factorio_credentials_with_hosts is enabled, as the credentials in the server settings of instances.
+
+Defaults to null.
+
+
+### controller.factorio_token
+
+Token of the Factorio.com account to authenticate with the Factorio API with, see controller.factorio_username.
+This is the token shown on your profile page on factorio.com, not your password.
+The value is treated as a credential, it can be set from anywhere but only read back from the controller itself.
+
+Defaults to null.
+
+
+### controller.share_factorio_credentials_with_hosts
+
+If enabled hosts get controller.factorio_username and controller.factorio_token from the controller when they start an instance and put them in the server settings of that instance.
+Credentials set on the host with host.factorio_username and host.factorio_token, or on the instance through `username` and `token` in factorio.settings, take precedence over the ones from the controller.
+Disable this if you don't want the controller's credentials to be sent to the hosts.
+
+Defaults to true.
+
+
+### controller.default_mod_pack_id
+
+ID of the mod pack to use for instances that don't have factorio.mod_pack_id set.
+Instances without a mod pack of their own fail to start if this is null.
+
+Defaults to null.
+
+
+### controller.default_role_id
+
+Role to automatically grant to new users.
+If null no role is granted.
+
+Defaults to 1 which correspond to the default Player role.
+
+
+### controller.mod_portal_cache_duration_minutes
+
+Time in minutes the controller caches the list of mods fetched from the Factorio mod portal when browsing it from the web interface.
+Set to 0 to disable the cache and fetch the list on every request.
+Must be 0 or greater.
+
+Defaults to 30.
+
+
+### controller.mod_portal_page_size
+
+Number of results to request per page when fetching the list of mods from the Factorio mod portal.
+Must be greater than 0.
+
+Defaults to 1000.
+
+
+### controller.allow_remote_updates
+
+Whether the `controller update` command in clusterioctl and the update button in the web interface are allowed to update the `@clusterio/controller` package with npm.
+For security reasons this can only be changed locally with `clusteriocontroller config set` while the controller is stopped, and it is hidden in the web interface.
+See [Managing a Cluster](/docs/managing-a-cluster.md) for details on remote updates.
+
+Defaults to true.
+
+
+### controller.allow_plugin_updates
+
+Whether remote requests to update plugins installed on the controller with npm are allowed.
+Like controller.allow_remote_updates this can only be changed locally.
+
+Defaults to true.
+
+
+### controller.allow_plugin_install
+
+Whether remote requests to install new plugins on the controller with npm are allowed.
+Like controller.allow_remote_updates this can only be changed locally.
+
+Defaults to false.
+
+
+### controller.version
+
+Version of the controller package that last loaded this config.
+Set automatically on startup and used to detect when the controller has been updated or downgraded.
+Internal, hidden in the web interface and should not be changed.
+
+
+### <plugin_name>.load_plugin
+
+Whether to load the plugin on the controller.
+Plugins not loaded on the controller will not be loaded on instances.
+
+Defaults to true.
+
+
+## Host Configuration
+
+### host.name
+
+Name of the host.
+Shows up in host lists and is used to reference this host in the clusterioctl command line interface.
+
+Defaults to "New Host".
+
+
+### host.id
+
+Immutable numeric id of the host which uniquely identifies this host in the cluster.
+Hidden in the web interface.
+
+Defaults to a random 31 bit number.
+
+
+### host.factorio_directory
+
+Directory to look for the Factorio server(s) in.
+This can either point to a Factorio server directory, or to a directory containing multiple versions of the Factorio server.
+
+Defaults to "factorio".
+
+
+### host.mods_directory
+
+Directory the host stores mods downloaded from the controller in.
+When an instance starts the mods in its mod pack are downloaded here if missing and then linked into the mods directory of the instance.
+
+Defaults to "mods".
+
+
+### host.instances_directory
+
+Directory to store instances in.
+One sub-directory will be created in it for each instance assigned to this host and these sub-directories will contain logs, saves, and various auto generated configuration files for the instances.
+
+Defaults to "instances".
+
+
+### host.controller_url
+
+URL to connect to the controller to.
+
+Defaults to "http://localhost:8080/".
+
+
+### host.controller_token
+
+Access token used for authenticating with the controller.
+You can generate an access token with `clusterioctl host generate-token --id <host-id>`, or use the `clusterioctl host create-config` to create a new host config with the correct url and token in it.
+The value can only be read and changed from the host itself.
+
+Defaults to "enter token here".
+
+
+### host.public_address
+
+External address instances hosted on this host can be accessed on.
+This is used by plugins like Server Select to give the correct address to switch between instances in-game.
+
+Defaults to "localhost".
+
+
+### host.factorio_port_range
+
+UDP ports the host hands out to instances that don't have factorio.game_port set.
+Written as a comma separated list of ports and/or ranges of ports separated with a dash, for example "34100-34199" or "34100, 34200-34210".
+A port is picked when the instance is started and remembered in factorio.host_assigned_game_port, so an instance keeps the same port as long as it is still free.
+Starting an instance fails if all ports in the range are taken.
+
+Defaults to "34100-34199".
+
+
+### host.factorio_username
+
+Username of the Factorio.com account to put in the server settings of instances on this host.
+If set this takes precedence over the credentials shared by the controller, but not over `username` set in factorio.settings of an instance.
+
+Defaults to null.
+
+
+### host.factorio_token
+
+Token of the Factorio.com account to go with host.factorio_username.
+The value is treated as a credential, it can be set from anywhere but only read back from the host itself.
+
+Defaults to null.
+
+
+### host.max_reconnect_delay
+
+Maximum delay in seconds to wait after connection to the controller is dropped before attempting to reconnect to it.
+The actual delay on each reconnect will be a random number between 0 and this configured value to avoid all clients trying to reconnect at the same time.
+Must be greater than 0.
+
+Defaults to 60.
+
+
+### host.allow_remote_updates
+
+Whether the `host update` command in clusterioctl and the update button in the web interface are allowed to update the `@clusterio/host` package with npm.
+For security reasons this can only be changed locally with `clusteriohost config set` while the host is stopped, and it is hidden in the web interface.
+See [Managing a Cluster](/docs/managing-a-cluster.md) for details on remote updates.
+
+Defaults to true.
+
+
+### host.allow_plugin_updates
+
+Whether remote requests to update plugins installed on the host with npm are allowed.
+Like host.allow_remote_updates this can only be changed locally.
+
+Defaults to true.
+
+
+### host.allow_plugin_install
+
+Whether remote requests to install new plugins on the host with npm are allowed.
+Like host.allow_remote_updates this can only be changed locally.
+
+Defaults to false.
+
+
+### host.version
+
+Version of the host package that last loaded this config.
+Set automatically on startup and used to detect when the host has been updated or downgraded.
+Internal, hidden in the web interface and should not be changed.
+
+
+### <plugin_name>.load_plugin
+
+Whether to load the plugin on the host.
+Only plugins with a host or instance part have this field in the host config.
+Plugins not loaded on the host will not be loaded on the instances it hosts.
+
+Defaults to true.
+
+
+## Instance Configuration
+
+### instance.name
+
+Name of the instance, shown in instance lists and used to reference to this instance in the clusterioctl command line interface.
+
+Defaults to "New Instance".
+
+
+### instance.id
+
+Imutable numeric id of the instance which uniquely identifies this instance in the cluster.
+Hidden in the web interface.
+
+Defaluts to a random 31 bit integer.
+
+
+### instance.assigned_host
+
+Host this instance is assigned to.
+To change this you need to use the separate assign instance interface.
+After being assigned to a host the directory for the instance is created on the host.
+Internal and hidden in the web interface.
+
+Defaults to null meaning not assigned.
+
+
+### instance.auto_start
+
+If enabled start this instance when the host it is assigned to is started up.
+Does not affect start or stop of the instance while the host is running.
+
+Defaults to false.
+
+
+### instance.exclude_from_start_all
+
+If enabled this instance will be excluded from the "Start all" button operation in the web interface.
+This allows you to prevent certain instances from being started when using the bulk start operation.
+
+Defaults to false.
+
+
+### factorio.version
+
+Version of Factorio to use for this instance.
+Can be a specific version like "2.0" or "2.0.15", a release channel like "stable" or "experimental", or the special string "latest" meaning the latest version of Factorio found on the host.
+A release channel is resolved to a version through the latest releases data the controller keeps, and the instance fails to start if that is unavailable.
+Values that don't match one of these forms are rejected.
+
+Defaults to "latest".
+
+
+### factorio.executable_path
+
+Path relative to the Factorio installation directory of the executable to run.
+If null the path is auto detected, which is `bin/x64/factorio` on Linux and Windows and `MacOS/factorio` on macOS.
+Only needed in special setups.
+
+Defaults to null.
+
+
+### factorio.shutdown_timeout
+
+Time in seconds to wait for the Factorio server to exit after asking it to stop before the process is killed.
+Set to 0 to wait forever.
+Changing this while the instance is stopping restarts the timer with the new value.
+Must be 0 or greater.
+
+Defaults to 300.
+
+
+### factorio.game_port
+
+UDP port to run the Factorio server on.
+If null a port from host.factorio_port_range on the host is assigned to the instance.
+Negative values are rejected.
+
+Defaults to null.
+
+
+### factorio.host_assigned_game_port
+
+Port from host.factorio_port_range the host has assigned to this instance while factorio.game_port is null.
+Internal, set by the host and only accessible from the host.
+
+
+### factorio.rcon_port
+
+TCP port to start the RCON interface on the Factorio server on.
+If null a random port in the dynamic range is assigned each time the instance starts.
+Negative values are rejected.
+
+Defaults to null.
+
+
+### factorio.rcon_password
+
+Password to use for the RCON interafec.
+If null a random secure password is generated and used each time the instance starts.
+The value is treated as a credential and can only be read back by the controller and the host.
+
+Defaults to null.
+
+
+### factorio.player_online_autosave_slots
+
+Keeps a separate pool for autosaves where at least on player has been online since the previous autosave was done.
+This requires regular autosaving to be enabled and will rename autosaves to `_autosave_poN.zip` (where N is a slot number) whenever a player has been online for that save.
+The slot numbers start at 1, are incremented by 1 after each autosave that is renamed and reset back to 1 whenever this value is exceeded.
+Setting this to a value lower than `autosave_slots` in factorio.settings is rejected, unless it is 0.
+The same check is done when factorio.settings is changed.
+Useful for preventing the loss of all progress when nobody is around on always online servers with auto pause disabled.
+
+If 0 no autosave renaming takes place.
+
+Defaults to 5.
+
+
+### factorio.mod_pack_id
+
+ID of the mod pack to use on this instance.
+The mods in the pack are linked into the mods directory of the instance every time it starts, and any other files in that directory are removed.
+If null the mod pack set in controller.default_mod_pack_id is used.
+
+Defaults to null.
+
+
+### factorio.enable_save_patching
+
+Whether to use save patching or not.
+When enabled lua code is patched into the game save before starting it.
+Most plugins require the use of save patching to function.
+Turning it off makes it possible to use Clusterio to run and manage regular vanilla games and scenarios not compatible with Clusterio.
+Plugins that need save patching can't be loaded on the instance while this is disabled.
+Disabling it while such a plugin is loaded is rejected, and so is loading such a plugin while it is disabled.
+
+Defaults to true.
+
+
+### factorio.enable_script_commands
+
+Allow Clusterio and plugins to send commands that disable achievements to the server over RCON, that is `/c`, `/sc`, `/mc`, `/cheat`, `/editor` and their long forms.
+Clusterio integrations and most plugins need this, and when enabled achievements are disabled on the server at startup.
+When disabled attempts to send such a command fail with an error.
+This does not stop players from using these commands themselves.
+Like factorio.enable_save_patching, plugins that need script commands can't be loaded on the instance while this is disabled.
+
+Defaults to true.
+
+
+### factorio.enable_whitelist
+
+Turn on the whitelist on the server.
+
+Defaults to false.
+
+
+### factorio.enable_authserver_bans
+
+Pass the `--use-authserver-bans` flag to Factorio, which makes the server check connecting players against the multiplayer bans on Factorio.com and report bans and unbans done on the server back to it.
+
+Defaults to false.
+
+
+### factorio.settings
+
+Object with the settings to put into `server-settings.json` for the Factorio server.
+The settings in `data/server-settings.example.json` of the Factorio installation is used as the base and properties specified here overrides the properties there.
+
+Changes to the following properties will be applied live if the instance is running while it is changed: `afk_autokick_interval`, `allow_commands`, `autosave_interval`, `autosave_only_on_server`, `description`, `ignore_player_limit_for_returning_players`, `max_players`, `max_upload_slots`, `max_upload_in_kilobytes_per_second`, `name`, `only_admins_can_pause_the_game`, `game_password`, `require_user_verification`, `tags`, `visibility`.
+
+Defaults to a set of common settings filled in when the instance is created, such as `"tags": ["clusterio"]`, `"auto_pause": false` and a `name` and `description` based on the cluster and instance names.
+
+
+### factorio.verbose_logging
+
+Pass the `--verbose` flag to Factorio when starting the server.
+This prints more messages to the log.
+
+Defaults to false.
+
+
+### factorio.console_logging
+
+Pass the `--console-log` flag to Factorio to make it write the console output, such as chat, commands and player joins, to `console.log` in the instance directory.
+Useful for 3rd party tools that read the console log of the server.
+
+Defaults to false.
+
+
+### factorio.strip_paths
+
+Strip down absolute paths in the server log going to files inside the instance directory such that they are relative to the instance directory.
+This improves the signal to noise ratio of the log.
+
+Sample output when disabled:
+
+    0.487 Loading map /srv/clusterio/instances/test/saves/world.zip: 2615888 bytes.
+    0.614 Checksum for script /srv/clusterio/instances/test/temp/currently-playing/control.lua: 2390553941
+    1.277 Script @/srv/clusterio/instances/test/temp/currently-playing/modules/example/test.lua:7: Example log line.
+
+Sample output when enabled:
+
+    0.487 Loading map saves/world.zip: 2615888 bytes.
+    0.614 Checksum for script temp/currently-playing/control.lua: 2390553941
+    1.277 Script @modules/example/test.lua:7: Example log line.
+
+Defaults to true.
+
+### factorio.sync_adminlist
+
+Synchronize in-game admin list with admin status of the users in cluster.
+One of "disabled", "enabled" or "bidirectional".
+If enabled Clusterio will generate a new `server-adminlist.json` on instance startup based on the users in the cluster with admin status set to true, and keep the admins in sync with the users that have admin status while the instance is running.
+With "bidirectional" players promoted or demoted in-game with `/promote` and `/demote` are also updated in the cluster, and from there on the other instances.
+Configs from before this became a choice are migrated from true and false to "enabled" and "disabled".
+
+Defaults to "bidirectional".
+
+
+### factorio.sync_whitelist
+
+Synchronize in-game whitelist with the whitelisted status of the users in the cluster.
+One of "disabled", "enabled" or "bidirectional".
+If enabled Clusterio will generate a new `server-whitelist.json` on instance startup based on the users in the cluster with whitelisted status set to true, and keep the whitelisted users in sync with the users that have whitelisted status while the instance in running.
+With "bidirectional" changes made in-game with `/whitelist` are picked up by watching `server-whitelist.json` for changes and updated in the cluster as well.
+This requires factorio.enable_whitelist to be on, as Factorio doesn't write the file otherwise.
+Configs from before this became a choice are migrated from true and false to "enabled" and "disabled".
+
+Defaults to "bidirectional".
+
+
+### factorio.sync_banlist
+
+Synchronize in-game banlist with the banned status of users in the cluster.
+One of "disabled", "enabled" or "bidirectional".
+If enabled Clusterio will generate a new `server-banlist.json` on instance startup based on users in the cluster with banned status set to true, and keep the banned users in sync with the users that have the banned status while the instance is running.
+With "bidirectional" players banned or unbanned in-game with `/ban` and `/unban` are also updated in the cluster, and from there on the other instances.
+Configs from before this became a choice are migrated from true and false to "enabled" and "disabled".
+
+Defaults to "bidirectional".
+
+
+### factorio.max_concurrent_commands
+
+Maximum number of commands being transmitted into the game in parallel.
+Since the rate at which long commands are streamed into the game is by default limeted to 100 bytes/tick and scales down to 25 bytes/tick when there's 20 players connected, long commands can hold up the command interface and cause large latencies in getting data pushed into the game.
+(The rates are controlled by the `segment_size` options in the server settings.)
+To counteract this Clusterio sends up to this configured value number of commands in parallel over the RCON interface.
+This causes the game updates sent to clients to have this many command streams in parallel contained in them, drastically increasing the maxiumum size they can become.
+Since commands are only processed so ofter the maximum rate of commands that can be sustained is roughly 30 times this configured value per second, though note that large commands will lower this value.
+
+The game updates sent by the server is split into roughly 500 byte packets, and if any one of those parts are lost the entire update is resent.
+This means a high number of concurrent commands can amplify resends due to packet loss and degrade the player experience up to the point of becomming completely unplayable.
+
+Prior to 0.18.7 the maximum practical size of game update sent where arround 8 kB due to the UDP receive buffer on windows defaulting to this value, larger updates would not get through the receive buffer and cause the connection to drop.
+To stay below the 8 kB limit the maximum safe value for this option would be around 7000 / (3 * game_speed * maximum_segment_size), which is around 20 in normal circumstances.
+Must be greater than 0.
+
+Defaults to 5.
+
+
+### <plugin_name>.load_plugin
+
+Whether to load the given plugin on the instance.
+Note that plugins need to be loaded on the controller and the host in order for them to be loaded on instances.
+Loading a plugin that requires save patching or script commands is rejected while factorio.enable_save_patching or factorio.enable_script_commands respectively is disabled on the instance.
+
+Defaults to true.
+
+
+## Ctl Configuration
+
+### ctl.controller_url
+
+URL to connect to the controller to.
+
+Defaults to null meaning complain about it not being set and exit.
+
+
+### ctl.controller_token
+
+Access token used for authenticating with the controller.
+You can generate an access token with `clusteriocontroller bootstrap generate-user-token <username>`, or use the `clusteriocontroller bootstrap create-ctl-config <username>` to create a new ctl config with the correct url and token in it.
+
+Defaults to null meaning complain about it not being set and exit.
+
+
+### ctl.max_reconnect_delay
+
+Max duration in seconds to wait before attempting to reconnect with the controller after the connection is dropped.
+The actual delay on each reconnect will be a random number between 0 and this configured value to avoid all clients trying to reconnect at the same time.
+Must be 0 or greater.
+
+Defaults to 60.

docs/contributing.md

@@ -0,0 +1,304 @@
+# Contributing to Clusterio
+
+You are probably reading this because you want to contribute code to Clusterio.
+Great!  We need people like you.
+Though we have some conventions and workflows that we kindly ask you to follow.
+We have included all the pratical considerations in this document.
+Although, we recomend checking out out our [past decisions](/docs/decisions.md) if you have the time.
+
+
+## Contents
+
+- [Workflow](#workflow)
+    - [Starting a Feature Branch](#starting-a-feature-branch)
+    - [Setting up the Development Environment](#setting-up-the-development-environment)
+    - [Checking your code for errors](#checking-your-code-for-errors)
+    - [Submitting a Pull Request](#submitting-a-pull-request)
+    - [Editing your Feature Branch](#editing-your-feature-branch)
+    - [Resolving Merge Conflicts](#resolving-merge-conflicts)
+    - [Updating Your GitHub Fork](#updating-your-github-fork)
+    - [Publishing releases to npm](#publishing-releases-to-npm)
+- [Changelog](#changelog)
+- [Supported Node.js and Factorio Versions](#supported-nodejs-and-factorio-versions)
+- [Code Style](#code-style)
+    - [Naming Style](#naming-style)
+    - [Units](#units)
+    - [Indenting](#indenting)
+    - [Line Length](#line-length)
+    - [Markdown](#markdown)
+
+
+## Workflow
+
+While we don't require you to follow this workflow, it makes things much simpler for both you and us if you choose to do so.
+Especially when it comes to making the commit history reflect what happened and not be a giant ball of mess.
+GitHub's git workflow is less than ideal for dealing with small feature-branches so you might see things being done here a little diffrent than the usual.
+
+It is recommended that you use the command line git version for doing the operations described here.
+GUI wrappers tend to have different ideas of what is what and you might find it difficult to make it do the things described here.
+For doing the actual commits though, your faviorit git GUI should work just fine.
+
+If you pressed the fork button on GitHub and used `git clone` _on your own fork_ you can skip to the next paragraph.
+Otherwise you will have to click the fork button and clone your fork.
+If you already cloned the main GitHub repository you can change your clone to point at your own fork using the `git remote` command, but it's probably easier to delete your local clone and clone it again.
+
+To keep your local repository up to to date with the main repository add the main repository as a remote.
+
+    git remote add upstream https://github.com/clusterio/clusterio
+
+After this running `git fetch upstream` will get the updated branches from the main repository.
+Do not run `git pull upstream` it will mess thing up!
+
+
+### Setting up the Development Environment
+
+The project is organized into several packages that are all tied together using pnpm's workspace feature.
+In order to get the development environment up and running you will need to run the following command:
+
+    pnpm install
+
+This installs dependencies needed by tests and links the packages up so they work from the git work tree.
+To start a cluster from the repo you will first need to initialize it, this can be done using the installer:
+
+    node packages/create --dev
+
+To add plugins to use in the development environment use
+
+    node packages/ctl plugin add ./path/to/plugin
+
+It's important that the path starts with `./`.
+The `plugins/` directory contains the core plugins for the project and can be added using the above mentioned command.
+
+The documentation uses the binaries provided by the packages, but for the development environment you will need to call the packages directly:
+
+    npx clusteriocontroller -> node packages/controller
+    npx clusteriohost -> node packages/host
+    npx clusterioctl -> node packages/ctl
+
+By default node does not enable source maps, to get stack traces pointing to the `.ts` files you will need to pass `--enable-source-maps` to `node` or set the environment variable `NODE_OPTIONS=--enable-source-maps`.
+
+Note that to use `clusterioctl` you will have to create a ctl config first:
+
+    node packages/controller bootstrap create-ctl-config [admin-user]
+
+Once you've set up the cluster you can use `node packages/controller run` to run the controller and `node packages/host run` to run the host which connects to the controller.
+
+When editing TypeScript files ran by Node.js you need to run `pnpm build` to compile the files to JavaScript before restarting the controller/host/ctl for changes take effect.
+To have TypeScript watch for changes and rebuild immediadly you may run `pnpm watch` instead.
+
+For web development on the controller there are also the following flags:
+
+`--dev` - Recompile the `web_ui` package on the fly providing live reloading of it.
+
+`--dev-plugin [name]` - Recompile the web module for the given plugin on the fly proving live reloading of it.
+
+These options can be combined and multiple plugins can be actived for dev mode.
+Keep in mind if you're working on external plugins the `--dev-plugin` option is likely to only work if the plugin is placed inside the `external_plugins` directory and its dependencies are installed with pnpm as part of the clusterio repository workspace.
+Note that webpack is configured to delete the web interface build when using these options, so you will have to run `pnpm run -r --if-present prepare` before you start the controller without these flags again.
+
+
+### Starting a Feature Branch
+
+Development is done exclusively in feature branches.
+This means the first thing to do before starting any development at all is to make a new branch starting from the master branch of the main repository.
+To do this check out that branch from the main repository.
+
+    git fetch upstream
+    git checkout upstream/master
+
+This will give a warning about detached HEAD which means you did it correctly.
+Now you can make a feature branch based on this with.
+
+    git checkout -b my-feature-branch
+
+The name of the branch is not important, as long as it's not a name you've used before.
+But it's nice to have its name be somewhat descriptive of what it implements.
+
+
+### Checking your code for errors
+
+There's automated tests and linting setup for the project.
+Please do add tests for any code you add and run both:
+
+    pnpm run test
+    pnpm run lint
+
+To check that your changes pass the integration tests as well as the ESLint rules set up for the project.
+
+The full test suite can take a while to run.
+Use `pnpm run fast-test` to skip tests marked as slow, or `pnpm run no-external-test` to skip tests that depend on external APIs such as the Factorio mod portal or GitHub.
+These correspond to setting the `FAST_TEST` and `NO_EXTERNAL_TEST` environment variables and can be combined.
+When writing tests that take a lot of time call `slowTest(this)` at the start of the test, and for tests that call out to external APIs call `externalTest(this)`, both are exported from `test/integration/index.js`.
+
+
+### Submitting a Pull Request
+
+Once you've commited changes to your feature branch that you want to have included into the main repository push it to you fork with
+
+    git push origin my-feature-branch
+
+and make a pull request through the GitHub web interface.
+You can also pass the `--set-upstream` (or `-u`) flag to make `git push` do the same thing for this branch.
+After your feature branch have been merged you should consider it final.
+If there are more changes you want to have merged or mistakes you need to fix you must start a new feature branch and submit a new pull request.
+
+Pull request descriptions should contain a `### Changelog` section with additions for the changelog contained inside a code block, see the [CHANGELOG.md](/CHANGELOG.md) file for the formatting of changelog entries and possible sections to use.
+If there are no changelog entries to add, remove the code block and start the changelog section with the text `None.`, followed by an optional reason for why it is not is needed.
+
+### Editing your Feature Branch
+
+Until your feature branch is merged you can edit it as you see fit by using the rebase tool.
+If your feature branch has been merged however it's final and you will have to start a new feature branch and submit that in a new pull request.
+The base usage of rebase assuming you are checked out on your feature branch is the following command
+
+    git rebase -i upstream/master
+
+This will open up an editor with the commits of your feature branch and let you reorder, edit, and remove commits as you see fit.
+
+If the main repository has been updated and you have fetched down those updates with `git fetch upstream` this will also move your feature branch so that it is based on the latest commit from the main repository.
+
+If you have already pushed your feature branch to your fork a simple `git push origin my-feature-branch` will no longer work as the histories are different, instead you will have to run
+
+    git push origin +my-feature-branch
+
+The + sign signifies a force push and should be used with care.
+If you have a pull request that has not yet been merged submitted for this feature branch this will update the pull request too.
+
+
+### Resolving Merge Conflicts
+
+The best way to resolve merge conflicts in feature braches is to rebase it on top of the updated upstream.
+Run the following commands
+
+    git fetch upstream
+    git rebase upstream/master
+
+This will stop on the commit(s) that caused the merge conflict and let you resolve them manually before continuing.
+Once you're done force push your updated feature branch with
+
+    git push origin +my-feature-branch
+
+
+### Updating Your GitHub Fork
+
+No.
+This is pointless busywork that accomplishes nothing.
+Fetch the main repository directly as described above and base your feature branches on the refs from it.
+GitHub has no interface or functionality for keeping the branches in your fork up to date with the branches in the main repository and there is no point in doing this for our feature branch based workflow.
+
+
+### Publishing releases to npm
+
+For publishing new releases see [package release workflow](./release-workflow.md#packages).
+
+## Changelog
+
+There's a [Changelog](../CHANGELOG.md) in the root of the project.
+If you make changes that are visible to users of this project you should add an entry to the changelog describing what has changed.
+The format of this log should be self explanatory, please follow it carefully. Please make sure to document any [breaking changes](/docs/decisions.md#breaking-changes).
+
+
+## Supported Node.js and Factorio Versions
+
+Clusterio requires Node.js 22 or newer and supports LTS releases in their active and maintenance phases.
+For a new development environment, install the latest LTS release using the [installation instructions](../README.md#installation).
+Make sure the Node.js built-in APIs and npm packages you use remain compatible with the supported versions.
+The GitHub Actions tests currently run on Node.js 24 and 26 across the Factorio matrix, with Node.js 22 used for coverage; see the [CI workflow](../.github/workflows/node.js.yml) for the version matrix.
+
+For Factorio, active support covers the latest stable version and the previous major version, using version lines such as 2.1, 2.0 and 1.1 as described in the [Factorio support policy](decisions.md#factorio).
+Older versions from 0.17 onwards receive passive support where it does not restrict actively supported versions.
+Check the Lua API documentation for the Factorio versions your changes target and preserve compatibility with the actively supported versions.
+The GitHub Actions tests use pinned Factorio releases; see the [CI workflow](../.github/workflows/node.js.yml) for the current version matrix.
+
+Check out all our of decisions for [node, factorio, and operation support](/docs/decisions.md#supportability).
+
+
+## Code Style
+
+The style of the code is a bit of a mixed bag at the moment.
+But there are at least a few things that have been agreed upon.
+See our [decisions document](/docs/decisions.md) for justifcations.
+
+### Naming style
+
+JavaScript variables in general uses camelCase.
+The exception is for classes/constructors which use PascalCase and variables destructured from over the wire objects.
+
+Fields in configs uses lowercase_underscore.
+
+JavaScript files are named using lowercase_underscore for files that export multiple items.
+Files containing and exporting a single class should be named the same as the class in PascalCase.
+
+Relative imports in lib package are prefixed with lib to make them easier to distinguish, as the names tend to be very generic.
+E.g.:
+
+    import libLink from "./link";
+    import libLuaTools from "./lua_tools";
+
+Note that no sub-modules of the lib package is imported directly from the outside of it with the exception of `build_mod`.
+
+For lua code lowercase_underscore is used for everything.
+
+### Units
+
+When naming variables whos unit is not a base SI unit like seconds or metres the unit used should be suffixed in the variable name:
+E.g.:
+
+    const startTimeMs = date.now();
+    const endNs = process.hrtime();
+
+This makes it easier to spot different unit bases are being mixed in the code.
+
+
+### Strings
+
+JavaScript and Lua code should use double quoted strings (`"string"`) for all strings with the only exception that strings that contain double quotes may use single quotes (i.e., `'String with "quotes"'`).
+JavaScript template literals may also be used where appropriate.
+
+
+### Indenting
+
+JavaScript and Lua code should be indented with tabs.
+
+Other files types should prefer tabs for indents where reasonable with the exception of Markdown.
+
+
+### Line Length
+
+Lines are limited to 120 characters where tabs count as 4 characters.
+If the argument list for a function or expressino for compound statement gets very long break them out on their own line(s).
+For example:
+
+    function foo(
+        really, long, argument, list,
+        over, multiple, lines
+    ) {
+        if (
+            really && long && expression
+            || over && multiple && lines
+        ) {
+            // code
+        }
+    })
+
+
+### Markdown
+
+Markdown files are formatted using one line per sentence to improve diff reports when making changes.
+Headings have two spaces before them and on space after them to make them stand out, the heading at the top of the file does not have any spaces before it, and heading immediadly followed by another heading have one space between them.
+For example:
+
+```md
+# A markdown File
+
+Sentence of text which end in a period.
+Each sentence is on it's own line.
+And there's two spaces before the next heading.
+
+
+## Subheading
+
+### Sub-subheading
+
+Headings use the `# heading` format.
+```

docs/decisions.md

@@ -0,0 +1,479 @@
+# Decisions
+
+This document outlines key decisions taken by the project team that should be followed by all maintainers and contributors.
+If there is a particular issue or concern you would like the team to comment on then please create a github issue for it.
+
+<!-- Try to use categories that already exist if possible -->
+<!-- Sublists should be alphabetical, avoiding starting with "the" -->
+<!-- For code style, add (Lang) to section names if present in both -->
+
+1. Documentation
+    - [Decision Log](#decision-log)
+    - [TSDoc](#tsdoc)
+2. Code Style (General)
+    - [Indenting](#indenting)
+    - [Line Length](#line-length)
+    - [Naming Booleans](#naming-booleans)
+    - [Naming Files](#naming-files)
+    - [Naming Times and Durations](#naming-times-and-durations)
+    - [Strings](#strings)
+3. Code Style (TS / JS / Web)
+    - [ESLint](#eslint)
+    - [Imports Within `lib` Package](#imports-within-lib-package)
+    - [Name Style](#name-style-ts)
+4. Code Style (Lua)
+    - [FMTK](#fmtk)
+    - [Name Style](#name-style-lua)
+5. Code Style (Other)
+    - [Markdown](#markdown)
+6. Repository Structure
+    - [External Plugins](#external-plugins)
+    - [First Party Plugins](#first-party-plugins)
+    - [Core Packages](#core-packages)
+    - [TypeScript Configs](#typescript-configs)
+    - [Workspace](#workspace)
+7. Project Architecture
+    - [Deprecation of Phin in favour of `fetch`](#deprecation-of-phin-in-favour-of-fetch)
+    - [Minimal Dependencies](#minimal-dependencies)
+    - [React](#react)
+    - [Separation of Host and Controller](#separation-of-host-and-controller)
+    - [Typescript](#typescript)
+    - [Webpack](#webpack)
+8. Supportability
+    - [Breaking Changes](#breaking-changes)
+    - [Distribution](#distribution)
+    - [Factorio](#factorio)
+    - [General Support](#general-support)
+    - [NodeJS](#nodejs)
+    - [Operating System](#operating-systems)
+9. Testing
+    - [Continuous Integration](#continuous-integration)
+    - [Continuous Deployment](#continuous-deployment)
+    - [Mocha](#mocha)
+    - [Version Matrix](#version-matrix)
+
+> [!note]
+> The use of `Time Immemorial` indicates an obsverion of a previously undocumented decision with no known start date, which has remained unchallenged.
+
+<!--
+### Template
+
+🧾 0th Month 2000 | Source
+
+> A short sentence describing the action to take in the context of our project.
+
+Write a breif description which includes: the reason a decision was needed, the outcome of the discussion, and the justification of the outcome.
+Write using the active voice in third person "we".
+Remember to have one sentence per line.
+-->
+
+
+## Documentation
+
+### Decision Log
+
+🧾 22nd December 2024 | Discord Voice Call
+
+> Maintain a document that includes a brief description of the outcomes and the reasoning behind our decisions, along with links to the relevant sources for further reading.
+
+We discovered that we were beginning to ask similar questions to other maintainers that we had previously raised, which led to a waste of time for all involved.
+Consequently, we decided that a log of important decisions should be kept for the benefit of ourselves and future maintainers.
+
+
+### TSDoc
+
+🧾 12th August 2023 | [Discord Discussion](https://discord.com/channels/450361298220351489/450361298220351491/1320573126731370506) | [Github PR #493](https://github.com/clusterio/clusterio/pull/493)
+
+> When a function or it's arguments do not have a clear purpose, a TSDoc comment should be used to describe it.
+
+While TypeScript provides useful type infomation in function hover text, it does not allow for comments about the purpose of functions and their arguments.
+Therefore, we decided to use TSDoc comments for this purpose as it is well intergrated in many text editors and IDEs (such as VSCode).
+Our specific implementation is TypeDoc because it is lightweight it and can output TSDoc comments as html.
+API Extractor was also considered but not selected.
+
+
+## Code Style (General)
+
+### Indenting
+
+🧾 Time Immemorial  
+
+> Use tabs for indention. Except for Markdown where spaces carry meaning.
+
+We needed to maintain a consistent whitespace style across all our files.
+Therefore, we selected tabs as our standard.
+
+
+### Line Length
+
+🧾 Time Immemorial  
+
+> Lines are limited to 120 characters where tabs count as 4 characters.
+
+We needed to maintain a consistent max line legnth across all our files.
+Therefore, we selected 120 characters as our standard.
+
+
+### Naming Booleans
+
+🧾 25th November 2024 | [Discord Discussion](https://discord.com/channels/450361298220351489/450361298220351491/1310611960508977223)
+
+> Variable and member properties which contain booleans should be named starting with a verb unless it ends with "ed", e.g. `canRestart` `expectEmpty` `hasFallback` `connected` `enabled` `loaded` `banned`
+
+We had inconsistencies in our naming of booleans and aimed to standardise them.
+There was little preference for any particular approach, so we chose the one that would require the fewest changes to existing code.
+As a result, all boolean values should begin with a verb, unless they end with "ed." For clarity, both "is" and "has" are considered verbs.
+
+
+### Naming Files
+
+🧾 Time Immemorial  
+
+> Files use lowercase_underscore if multiple values are exported. If a single class is exported then it uses the class name in PascalCase.
+
+We needed to maintain a consistent name style across all our files.
+Therefore, we selected lowercase undercore for most files, with class files using PascalCase.
+
+
+### Naming Times and Durations
+
+🧾 18th January 2024 | [Discord Discussion](https://discord.com/channels/450361298220351489/450361298220351491/1197566542548828170)
+
+> Variable and member properties which contain times or durations should end with their SI unit of messure, e.g. `updatedAtMs`
+
+We found verifying the units of measurement used in different locations to be a simple yet repetitive task that could lead to errors.
+Our main concern was the mixing of variables containing seconds and milliseconds.
+Therefore, we decided that times and durations should explicitly include their units, whereas other value types do not require any units.
+
+
+### Strings
+
+🧾 Time Immemorial  
+
+> Strings should use double quotes `"` unless the string contains them, in which case single quotes `'` can be used. For JS string templates use backticks ``` ` ``` as normal.
+
+We needed to maintain a consistent string style across all our files.
+Therefore, we selected double quotes as our standard.
+
+## Code Style (TS / JS / Web)
+
+### ESLint
+
+🧾 Time Immemorial  
+
+> Use ESLint for style checking.
+
+We needed to maintain a consistent style across all our files.
+Therefore, we utilise the industry-standard ESLint, as it is familiar and highly configurable.
+
+
+### Imports Within `lib` Package
+
+🧾 Time Immemorial  
+
+> When importing files within the lib package, all names should be prefixed with "lib".
+
+The exports of the various library files are often very generic and may conflict with variable names.
+Therefore, when importing these files the "lib" prefix should be used to avoid confussing.
+This only applies to files within `lib` importing other files in `lib` because all other packages import the whole of `lib` as a single package.
+
+
+### Name Style (TS)
+
+🧾 Time Immemorial  
+
+> Variables and members of classes use camelCase. Classes use PascalCase. Config values use lowercase_underscore. Exceptions allowed for over the write objects.
+
+We needed to maintain a consistent name style across all our files.
+Therefore, we follow common practive for JavaScript of using camelCase and PascalCase.
+Although, we have also allowed the use of lowercase_underscore for config values to distinguish them from other variables.
+
+
+## Code Style (Lua)
+
+### FMTK
+
+🧾 14th June 2024 | [External PR](https://github.com/justarandomgeek/vscode-factoriomod-debug/pull/126)
+
+> Use of FMTK is not required but is advised.
+> To enable Clusterio support, use the CLI flag `--clusterio-modules` under `Lua.runtime.pluginArgs`.
+
+We needed to maintain a consistent style across all our files.
+There are multiple competing standards for Lua code, and given the limited amount of Lua code in this project, we chose not to adopt any automatic linting or shared luarc file.
+Nevertheless, we recomend the use of [FMTK](https://github.com/justarandomgeek/vscode-factoriomod-debug) and have taken steps towords supporting it in Clusterio.
+
+
+### Name Style (Lua)
+
+🧾 Time Immemorial  
+
+> Everything uses lowercase_underscore
+
+We needed to maintain a consistent name style across all our files.
+Therefore, we follow common practive for Lua of using lowercase_underscore.
+
+
+## Code Style (Other)
+
+### Markdown
+
+🧾 Time Immemorial  
+
+> Use one sentence per line.
+> Place two lines before each heading, except for the first one or when two headings are adjacent.
+
+We needed to maintain a consistent code style across all our markdown files.
+Therefore, we selected an approach which makes diff reports more useful and which makes headings use additional space to make them stand out.
+
+
+## Repository Structure
+
+### External Plugins
+
+🧾 Time Immemorial
+
+> No external plugins should be included in the main repository.
+> A folder will exist which external plugin repositories can be cloned into and will be given the same treatment as first party plugins.
+
+We require a designated space for developers to create their plugins without the concern of conflicts with first-party plugins.
+To address this, we have introduced a dedicated folder for external plugins.
+This solution is straightforward and has since proven to be highly effective.
+
+
+### First Party Plugins
+
+🧾 Time Immemorial
+
+> First party plugins are included in the main repository.
+> Those selected to be first party are held to the same stanards which apply to the core packages.
+> Each will recieve a new release in step with the core packages.
+
+We require a designated space for first-party plugins, separate from the core packages, to clearly represent the dependency between them.
+Creating a folder provided a simple solution to this.
+
+
+### Core Packages
+
+🧾 Time Immemorial
+
+> All core packages will be contained in the packages folder of the repository.
+> They are allowed to be interdependent on each other.
+
+We require a set of core packages to represent the different applications used in a cluster.
+See [Separation of Host and Controller](#separation-of-host-and-controller).
+To avoid putting more files into the repository root we created a folder for the core packages.
+
+
+### TypeScript Configs
+
+🧾 26th August 2023 | [Github PR #504](https://github.com/clusterio/clusterio/pull/504)
+
+> Each package / plugin may contain any of: `tsconfig.json` `tsconfig.node.json` and `tsconfig.web.json`.
+> The main respository root will contain all three files in addition to `tsconfig.base.json` which node and web extend from.
+> The configs inside packages / plugins should extend from those in the respository root.
+
+We found that maintaining independent tsconfig files became burdensome and required a way to consolidate them.
+Initially, we introduced a base configuration file; however, this proved insufficient, so we extended it to include separate configurations for Node.js and the Web.
+This approach led to each package having up to three tsconfig files.
+Nevertheless, we believe this to be justified, given the need to differentiate between Node.js and Web builds while maintaining a single, shared configuration.
+
+
+### Workspace
+
+🧾 Time Immemorial
+
+> The workspace root should contain only: configuration files, scripts used to build / clean the workspace, the readme, and the changelog.
+
+We need to maintain a clean workspace root by only including files which effect all pacakges and plugins such as configuration files.
+We have allowed for build and clean scripts to exist here as long as they are not published as part of any package or plugin.
+
+
+## Project Architecture
+
+### Deprecation of Phin in favour of `fetch`
+
+🧾 12th December 2024 | [Discord Discussion Dec 24](https://discord.com/channels/450361298220351489/450361298220351491/1316781609206419567) | [Discord Discussion May 25](https://discord.com/channels/450361298220351489/450361298220351491/1240246997496102942)
+
+> The builtin `fetch` method should be used as a replacement of the deprecated Phin module.
+
+We required a replacement for the deprecated Phin HTTP client, which was used for making server-side requests and as part of testing.
+With `fetch` being marked as stable in Node.js v21.0.0 and having first been made available in v16.15.0, it serves as a suitable replacement without the need to add new dependencies.
+It had previously not been used because it was not marked as stable in any LTS version of NodeJS.
+
+
+### Minimal Dependencies
+
+🧾 Time Immemorial
+
+> Any new dependencies need to be well justified.
+
+We aim to minimise our exposure to upstream changes by using a minimal number of dependencies.
+This also serves to reduce the bloat of a cluster installation and improve installation times.
+Consequently, the addition of any new dependencies must be thoroughly justified, with evidence of research into alternative options and comparisons between them.
+
+
+### React
+
+🧾 Time Immemorial
+
+> Our web stack uses ReactJS
+
+We require a reactive website for our control panel, and ReactJS was selected due to its widespread use and familiarity.
+Switching away from React for any reason would represent a significant undertaking.
+
+
+### Separation of Host and Controller
+
+🧾 Time Immemorial
+
+> The primary application locations are Control (web and cli), Controller, and Host.
+> Therefore the core packages are: `ctl` `controller` `host`. There are two libaray packages `lib` and `web_ui`.
+> Additionally `create` exists to provide easy creation of a cluster.
+
+A single application to perform all the duties of a cluster would complicate the reasoning and maintenance of the project, so we decided to split it into several packages.
+The primary components of a cluster include servers connected to an instance, which runs on a host that connects to the controller, whose configuration is managed via a control connection from a CLI or web portal.
+Based on this structure, we found it logical to divide the packages according to their installation location, resulting in `ctl`, `controller`, and `host`, with shared code separated into `lib` and `web_ui` depending on where it is utilised.
+The additional `create` package is used by `npm create` to provide a user-friendly installation process.
+
+
+### TypeScript
+
+🧾 6th August 2023 | [Github PR #491](https://github.com/clusterio/clusterio/issues/491)
+
+> We use TypeScript as our language of choice.
+
+We previously used JavaScript and switched to TypeScript to provide a robust type system.
+Transitioning to any other langauge would be too significant an undertaking.
+Initially, we supported multiple languages for plugins, including Rust and Go; however, this approach was quickly abandoned due to its complexity.
+
+
+### Webpack
+
+🧾 Time Immemorial
+
+> Our web stack uses Webpack and associated plugins.
+
+We required a bundler for our web build, and at the time, Webpack was the standard.
+While we have considered alternatives since, transitioning to another solution would be a significant undertaking.
+
+
+## Supportability
+
+### Breaking Changes
+
+🧾 7th October 2026
+
+> From 2.0.0 onwards, major versions contain breaking changes for end users, while minor versions may contain breaking changes for the plugin API.
+> All breaking changes are documented in the changelog along with migration actions.
+
+We aim to be highly transparent with breaking changes and maintain compatibility with as many existing installations as possible.
+During the alpha stage every alpha was allowed to contain breaking changes, as long as they were documented and provided migration actions.
+From 2.0 onwards changes which require action from people running a cluster, such as changes to configs, stored data or the command line, are held back for the next major version.
+Changes to the plugin API may still be made in minor versions.
+Plugin authors should check the changelog when a new minor version is released, non-trivial changes come with a migration guide such as [Migrating Plugins to 2.0](/docs/devs/plugin-migration-to-2.0.md).
+
+
+### Distribution
+
+🧾 Time Immemorial
+
+> We use `git` and `pnpm` for development distribution.
+> We use `npm` and the factorio mod portal for production distribution.
+
+We need to distribute both production builds and development source code for the project.
+By necessity, we use `npm` and the Factorio Mod Portal to distribute our production builds.
+For development, we rely on `git` and GitHub, which are industry standards, while using `pnpm` as a more efficient variant of `npm` for development installations.
+Although bun was considered upon its release, we were not convinced it was the right choice.
+
+
+### Factorio
+
+🧾 26th October 2024 | [Discord Discussion](https://discord.com/channels/450361298220351489/450361298220351491/1299637042350653461)
+
+> We actively provide full support for the last two major versions of Factorio.
+> This approach does not follow semantic versioning; instead, it follows the "middle" versions: 2.1 > 2.0 > 1.1 > 1.0 > 0.18 > 0.17.
+> We offer passive support for all versions from 0.17 onwards, where implementation is trivial and does not impose restrictions on our actively supported versions.
+
+Following the 2.0 update of Factorio, which introduced a large number of breaking changes, we needed to reconsider which versions would be actively supported, as it was no longer trivial to support all versions.
+Anticipating that future breaking changes would also be significant, and assuming the majority of players would update to the latest stable version upon release, we decided to support the latest stable version and the previous major version that introduced breaking changes.
+Support for other versions will not be removed if they have already been implemented and do not impose restrictions on our ability to support newer versions.
+
+
+### General Support
+
+🧾 Time Immemorial
+
+> We provide full support via GitHub and our Discord server for the latest published version of Clusterio, as well as assistance with migrating from the previous published version.
+> However, we do not offer any guarantees with our support; we assist when time permits and may not be able to resolve every issue.
+> Additionally, while we offer support in setting up development workspaces and guidance for plugin development, we do not provide support for those running development builds as production instances.
+
+We aim to support as many users of Clusterio as possible in setting up and using the platform for a variety of purposes, including setting up production instances, development workspaces, and providing guidance on plugin development.
+However, our time to work on Clusterio is limited, and even more so our ability to offer support.
+As such, we cannot assist with every issue and must set reasonable restrictions to ensure expectations are aligned.
+Consequently, we do not offer any guarantees for our support, but we strive to provide as much assistance as possible for those setting up or running the latest published version.
+Additionally, we support users in setting up development workspaces, as the more people willing to contribute, the better.
+
+
+### NodeJS
+
+🧾 Time Immemorial
+
+> We support all LTS versions of NodeJS in their active and maintenance phases.
+
+Our options were: supporting all versions, supporting all active versions, supporting all LTS versions, or supporting only the latest version.
+As we aim to provide a stable, production-ready tool while still limiting the number of versions we need to manage, we chose to support all LTS versions because NodeJS can be installed by the majority of linux distro package managers which will always offer at least one LTS version.
+
+
+### Operating Systems
+
+🧾 Time Immemorial
+
+> We support all major versions of Windows, Linux, and MacOS.
+This is largely inpart to our use of NodeJS and is not a guarantee from us.
+
+Our choice of Node.js has enabled us to support all major operating systems with minimal effort on our part.
+Nevertheless, there have been instances where code paths have diverged between systems, and we have attempted to maintain support for as many systems as possible.
+However, this is not a priority, and such support has often been reactive or provided by external contributors.
+
+
+## Testing
+
+### Continuous Integration
+
+🧾 Time Immemorial
+
+> We run unit and integration tests through GitHub CI actions as well as test coverage through CodeCov.
+
+Continuous integration actions in GitHub are a valuable tool that we use to assist with the review of pull requests from both maintainers and contributors.
+While we aim to increase the number of useful checks performed by CI in the future, this is not a priority over the development of new features.
+
+
+### Continuous Deployment
+
+🧾 Time Immemorial
+
+> We do not use any CD actions, and have no plans of implementing them.
+
+Unlike CI, we do not find continuous deployment useful at our current stage of the project.
+This is due to the frequent breaking changes merged into the main branch, which we prefer to bundle together as a single version.
+In the future, we may automate the deployment process, but it will always require manual activation.
+
+
+### Mocha
+
+🧾 Time Immemorial
+
+> We use Mocha for testing and CodeCov for coverage.
+
+We chose Mocha because it was a good fit when we selected it.
+However, we are always looking for a better framework which is worth the effort of switching.
+
+
+### Version Matrix
+
+🧾 Time Immemorial
+
+> We perform all tests through GitHub actions using Ubuntu latest, using all supported versions of node and all supported versions of factorio.
+
+We perform tests on all versions of NodeJS and Factorio that we support.
+However, we do not conduct tests on all supported operating systems, as the added demand on our testing resources would be significant, and the value it would provide for a cross-platform engine like NodeJS would be limited.

docs/developing-for-clusterio.md

@@ -0,0 +1,297 @@
+# Developing for Clusterio
+
+This document describes the various different types of content that can be created for Factorio and/or Clusterio and how this is made compatible with Clusterio.
+
+
+## Contents
+
+- [Factorio Mods](#factorio-mods)
+- [Factorio Scenarios](#factorio-scenarios)
+    - [event_handler interface](#event_handler-interface)
+- [Communicating with Clusterio](#communicating-with-clusterio)
+- [Clusterio Modules](#clusterio-modules)
+- [Clusterio Lua API](#clusterio-lua-api)
+- [Clusterio Plugins](#clusterio-plugins)
+
+
+## Factorio Mods
+
+Factorio mods that do not interact with Clusterio should not have any considerations that need to be taken into account for them to work with Clusterio.
+
+
+## Factorio Scenarios
+
+Clusterio patches saves and because of this scenarios have a few limitations and must explicitly mark themselves as compatible with Clusterio to work.
+The main limitation is that the [event_handler](https://github.com/wube/factorio-data/blob/master/core/lualib/event_handler.lua) lib must be used, and control.lua cannot contain any code other than calls to event_handler loading the relevant libs of the scenario.
+This is because the control.lua file will be overwritten by the save patcher.
+Scenarios also cannot use the event registering functions exposed by `script` such as `script.on_event` or `script.on_nth_tick` as using these will overwrite the handlers registered by the event_handler lib.
+
+A brief description of the usage of the event_handler library is provided in the [event_handler interface](#event_handler-interface) section.
+
+Once a scenario is made using the event_handler it should have a control.lua file that looks something like this:
+
+```lua
+-- control.lua
+local event_handler = require("event_handler")
+event_handler.add_lib(require("module_foo"))
+event_handler.add_lib(require("module_bar"))
+```
+
+To make Clusterio recognize and correctly handle this scenario it needs to include a clusterio.json file with following content:
+
+```json
+{
+    "scenario": {
+        "name": "example-scenario",
+        "modules": [
+            "module_foo",
+            "module_bar"
+        ]
+    }
+}
+```
+
+This tells Clusterio that it should load both module_foo and module_bar by passing the result of requiring them to the `add_lib` function when writing a new control.lua file to the save.
+
+
+### event_handler interface
+
+<sub>**Note:** At the time of writing the event_handler lib has been a part of Factorio since at least 0.17.4, and was moved from base to core in 0.17.63 but is still not documented anywhere.
+A brief description is provided here for this reason.</sub>
+
+The event_handler lib provides a simple interface for registering multiple callbacks to the same events without having to be concerned with callback chaining or overwriting callbacks defined elsewhere.
+It works by taking over the task of registering the actual callbacks with Factorio, providing its own interface for the rest of the code to use.
+
+The sole function of interest exported by event_handler is `add_lib` which accepts a table with event handler callbacks definitions that it will register.
+The following entries are recognized by `add_lib`, all of which are optional:
+
+- `on_init`:
+    Callback called when the callback of `script.on_init` is invoked.
+- `on_load`:
+    Callback called when the callback of `script.on_load` is invoked.
+- `on_configuration_changed`:
+    Callback called when the callback of `script.on_configuration_changed` is invoked.
+- `events`:
+    Table mapping event ids as defined in `defines.events` to callbacks.
+    For example the table `{ [defines.events.on_player_died] = foo }` will call bar with the usual `event` table as argument every time a player dies.
+- `on_nth_tick`:
+    Table mapping the nth tick number to a callback.
+    For example the table `{ [30] = bar }` will call bar every 30th tick.
+- `add_remote_interface`:
+    Callback called before on_init/on_load callbacks<sup>[1]</sup>.
+    It has no special meaning and receives no arguments but should be used for registering remote interfaces.
+- `add_commands`:
+    Callback called before on_init/on_load callbacks<sup>[1]</sup>.
+    It has no special meaning and receives no arguments but should be used for registering commands.
+
+<sub>1: Before 0.17.69 these callbacks were called after on_init/on_load.</sub>
+
+The usual way to use `add_lib` is to define the table of events to register in a separate file and return it, then load it in control.lua via `require` before passing it to `add_lib`.
+For example a module could be defined as
+
+```lua
+-- example.lua
+local function my_handler(event)
+    local name = game.player[event.player_index].name
+    game.print("It appears that " .. name .. " has died")
+end
+
+return {
+    on_init = function() game.print("example_lib init") end,
+    events = {
+        [defines.events.on_player_died] = my_handler,
+    },
+}
+```
+
+And then in control.lua the following used to load it with `add_lib`:
+
+```lua
+-- control.lua
+local event_handler = require("event_handler")
+event_handler.add_lib(require("example"))
+```
+
+Because the event_handler lib registers events itself you may not use `script.on_load` or `script.on_init` at all in your code and any usage of `script.on_configuration_changed`, `script.on_nth_tick` and/or `script.on_event` will cause the corresponding events registered with event_handler to break and should therefore not be used.
+
+There's also the `add_libraries` function exported by event_handler, which accepts a table and calls `add_lib` for each value in the table.
+
+
+## Communicating with Clusterio
+
+Clusterio uses a homebrew protocol based on sending JSON payloads over a WebSocket connection.
+See [protocol.md](devs/protocol.md) for the implementation details of it.
+
+It's also possible to write a plugin for Clusterio that exposes a custom interface over HTTP, WebSocket or any other technology supported by Node.js.
+
+
+## Clusterio Modules
+
+Modules are primarily used by plugins to inject code into Factorio games with the save patcher, though it's also possible to make stand alone modules that are loaded into the game if you don't need the capabilites of the plugin system.
+The save patcher puts modules into the `modules` folder of the Factorio save and adds code to `control.lua` to load the module according to the `load` and `require` options to the module.json file.
+Like with scenarios for Clusterio the [event_handler interface](#event_handler-interface) has to be used for any event subscriptions in modules.
+
+Stand alone modules are placed into the modules folder of Clusterio, plugin modules are located in the module folder of the plugin.
+In either case a `module.json` file is required and has the following structure:
+
+```json
+{
+    "name": "my_module",
+    "version": "1.2.0",
+    "dependencies": {
+        "clusterio": "*",
+        "foo": ">=0.4.2"
+    },
+    "require": ["bar.lua"],
+    "load": ["foo.lua"]
+}
+```
+
+The following entries are supported in the module.json file:
+
+- `name`:
+    Name of the module, must match the folder the module is located in for stand alone modules or the name of the plugin the module is located in.
+- `version`:
+    Version of the module.
+    Must be compatible with [Semantic Versioning 2.0.0](https://semver.org/).
+    In plugin modules this defaults to the version of the plugin otherwise it's required.
+- `dependencies`:
+    Optional mapping of modules this module depends on and their version.
+    In the example `>=0.4.2` means that the foo module must be at least version 0.4.2.
+    See the [Ranges syntax](https://www.npmjs.com/package/semver#ranges) of the node-semver package for a full description of what operators are supported.
+    The events for dependencies is invoked before the events of the dependent, and starting an instance will fail if the dependencies cannot be satisfied.
+    If not specified it will default to depending on `clusterio`.
+    Make sure to add `clusterio` to your dependencies if you add other dependencies and depend on the Lua API.
+- `require`:
+    Lua files to require in `control.lua`.
+    This should only really be needed if you want to make a global function available for use in Lua commands.
+    The paths are relative to the module's own folder and should be specified using forward slashes as directory sepparators if it's located in a sub directory in the module.
+- `load`:
+    Lua files to load with the `event_handler` lib, the result of requiring the file will be passed to the `add_lib` function of the `event_handler` lib in `control.lua`.
+    See the section on the [event_handler interface](#event_handler-interface) for a detailed description on how the `event_handler` lib works.
+    The paths are relative to the module's own folder and should be specified using forward slashes as directory sepparators if it's located in a sub directory in the module.
+
+It's recommended to use the new style of defining modules in Lua, as well as avoid the use of global variables as much as possible.
+This means always declearing your top level variables and functions local and exporting only the things you need in other files.
+You can require other files in your module by prefixing your require paths with `modules/your_module_name/`.
+It's also possible to require files from other modules this way too.
+
+The global variables and data stored in the global table is shared by all Clusterio modules as well as the scenario, so it's important that you use unique names.
+It's recommended to prefix the global variables and data in the global table that your module has with the name of your module.
+
+Because modules can be patched into an existing game you cannot rely on the `on_init` callback to be called in Clusterio Modules.
+Nor can you rely on the `on_configuration_changed` callback, as this is not called when level code changes.
+The Clusterio Lua API provides the custom `on_server_startup` event that can be used as a substitute, see the next section.
+
+
+## Clusterio Lua API
+
+Clusterio provides a save patched module as well as a regular Factorio mod for interfacing with Clusterio.
+This includes tools sending data to plugins, script events to listen for, and an item serialization module.
+
+
+### clusterio_api library
+
+**require path**  
+From a module  
+`local clusterio_api = require("modules/clusterio/api")`  
+From a mod  
+`local clusterio_api = require("__clusterio_lib__/api")`
+
+Provides the main interface to Clusterio from within the game.
+When using the mod version you must call `init` before it'll function properly.
+
+#### init
+
+<sub>Mod version only</sub>
+
+Initialize the API.
+This should be called from both the `on_init` and `on_load` events in your mod, and before this is called certain features will not be available, most notably the events table.
+
+#### clusterio_api.events
+
+Table of events raised by clusterio.
+If the game is started outside of Clusterio then none of these events will be raised.
+
+In the mod version this table does not exist before the `init` function is called.
+
+##### on_instance_updated
+
+Raised after the name and id of an instance has been updated.
+This may occur even if the id and name didn't change.
+
+Event data:
+- `instance_id`: the id of the instance.
+- `instance_name`: the name of the instance.
+
+##### on_server_startup
+
+Raised when Clusterio is starting up the server.
+It can be used to initialize clusterio related features in a mod, and as a stand-in for the `on_init` and `on_configuration_changed` event for modules.
+It is invoked on the first tick the server runs after the save has been patched, before most other events.
+
+Use this event to initialize and/or migrate the data structures you need.
+Keep in mind that both mods and Clusterio modules can switch from any version to any version so it should be able to handle both forwards and backwards migrations gracefully.
+
+#### clusterio_api.send_json(channel, data)
+
+Send JSON data to Clusterio over the given channel.
+The `data` argument should be table that can be serialized with `game.table_to_json`.
+Clusterio plugins can listen to channels and will receive an event with the data sent here.
+See the [Communicating with Factorio section](writing-plugins.md#communicating-with-factorio) in the Writing Plugins document for more information.
+
+If the game is started outside of Clusterio the data will be sent, but since there's no code following stdout to pick it up it will be lost.
+
+**Note**: Payloads greater than 4 MB will cause stuttering in the game.
+
+**Note**: This is not a binary safe way of sending data.
+Strings embedded into the tables sent must be valid UTF-8 text.
+
+Parameters:
+- `channel`: string identifying which channel to send it on.
+- `data`: table that can be converted to JSON with game.table_to_json
+
+
+### serialize library
+
+**require path**  
+From a module  
+`local serialize = require("modules/clusterio/serialize")`  
+From a mod  
+`local serialize = require("__clusterio_lib__/serialize")`
+
+Serializes inventories and item stacks into a table that in turn can be converted into JSON with `game.table_to_json`.
+Properly handles the extra data for most items.
+
+#### serialize.serialize_equipment_grid(LuaEquipmentGrid)
+
+Returns a table containing a serialized representation of the equipment grid passed.
+
+#### serialize.deserialize_equipment_grid(LuaEquipmentGrid, serialized_grid)
+
+Deserialize a previously serialized equipment grid into the target LuaEquipmentGrid.
+Overwrites all content in the target.
+
+#### serialize.serialize_item_stack(LuaItemStack, destination_table)
+
+Serialize the LuaItemStack passed into the target destination_table.
+The destination_table should be a new empty table.
+
+#### serialize.deserialize_item_stack(LuaItemStack, serialized_stack)
+
+Deserialize a previously serialized item stack into the target LuaItemStack.
+Overwrites the content of the item stack.
+
+#### serialize.serialize_inventory(LuaInventory)
+
+Returns a table containing a serialized representation of the inventory passed.
+
+#### serialize.deserialize_inventory(LuaInventory, serialized_inventory)
+
+Deserialize a previously serialized inventory into the target LuaInventory.
+Overwrites slots that have content in the serialized inventory.
+
+
+## Clusterio Plugins
+
+See the [Writing Plugins](writing-plugins.md) document for details on the plugin interface and how to write plugins for Clusterio.

docs/devs/json-serialisable-classes.md

@@ -0,0 +1,114 @@
+# JSON Serialisable Classes
+
+To serialise and deserialise data the Clusterio codebase uses a JSON serialisable data class pattern.
+Instances of these classes can be serialised to JSON by passing them directly to `JSON.serialise` and deserialised by passing the serialised JSON representation to its static `fromJSON` method.
+The data class also has a static `jsonSchema` property describing the serialised JSON representation for validation purposes.
+See the following example code for a hypothetical `Data` class with a single property `member` defaulting to a value of `"foo"`.
+
+
+```js
+// Data.js
+"use strictc";
+
+/**
+ * A Data class example
+ * @alias module:Data
+ */
+export class Data {
+    /** @type {string} */
+    member = "foo";
+
+    constructor(member) {
+        if (member !== undefined) { this.member = member; }
+    }
+
+    static jsonSchema = {
+        type: "object",
+        properties: {
+            "member": { type: "string" },
+        },
+    };
+
+    static fromJSON(json) {
+        return new this(json.member);
+    }
+
+    // toJSON is called by JSON.stringify when serialising this class
+    toJSON() {
+        let json = {};
+        // Omit property if it's set to the default value
+        if (this.member !== "foo") { json["member"] = this.member; }
+        return json;
+    }
+}
+```
+
+Serialising an instance of `Data` for JSON is as simple as doing `serialised = JSON.stringify(data)` as the `toJSON` method is automatically called by `JSON.stringify` to create a suitable object.
+Deserialising is done by calling the static `fromJSON` method with the serialised JSON data, like `data = Data.fromJSON(JSON.parse(serialised))`.
+
+By structuring the classes like this they can be easily composed together.
+For example a class holding a data property with an instance of the Data class from the previous example can be created as follows.
+
+```js
+// Composed.js
+import Data from "./Data";
+
+/**
+ * Composed data class example
+ * @alias module:Data
+ */
+export class Composed {
+    /** @type {module:Data|undefined} */
+    data;
+
+    constructor(data) {
+        if (data) { this.data = data; }
+    }
+
+    static jsonSchema = {
+        type: "object",
+        properties: {
+            "data": Data.jsonSchema,
+        },
+    };
+
+    static fromJSON(json) {
+        let data;
+        if (json["data"]) { data = Data.fromJSON(json["data"]); }
+        return new this(data);
+    }
+
+    // toJSON is optional and not needed for this particular class
+}
+```
+
+It's easy to create a new instance of Composed by calling `new Composed(new Data("spam"))` and serialising to and from JSON is the same as for Data.
+Meaning `serialised = JSON.stringify(composed)` and `composed = Composed.fromJSON(JSON.parse(serialised))` does as expected.
+
+## Interface description
+
+Data classes are ES6 style class declarations with the following methods and fields:
+
+### toJSON(): any (optional)
+
+Method returning an object or primitive suitable for passing to JSON.stringify in order to create a JSON representation of the class instance.
+The returned object may contain objects that have their own toJSON methods which JSON.stringify will then call recursively.
+
+This method is optional if calling `JSON.stringify` on an instance without it would produce the desired serialised form, however this is rarely the case as often you'll have to provide it to convert the values fram Map/Set properites, omit default values or do similar actions.
+
+Note that the primary use case for serialising data classes is to send them over the network, this method should therefore try to reduce the size of the resulting JSON by for example omitting properties who's values are the default value.
+
+### static fromJSON(json: any): this
+
+Method constructing an instance of this class from one that was previously serialised by passing an instance of it to `JSON.stringify`.
+
+While not a requirement it is preferrable if the input is not mutated and that no references to any any structures in the input ends up in the returned object.
+In other words calling fromJSON twice with the same input should produce two independent objects.
+
+Note that directly passing the output of `toJSON` to `fromJSON` is not valid, as the output of `toJSON` may require further expansion calling `toJSON` on objects returned by it.
+It has to go through `JSON.stringify` or an equivalent recursive expansion of `toJSON`.
+
+### static jsonSchema
+
+A [JSON schema](http://json-schema.org/) describing the format of the JSON resulting from passing an instance of this class to `JSON.stringify`.
+This should be lenient towards adding additional properties that would be ignored by `fromJSON` as it makes it easier to extend these classes in the future without breaking compatibility.

docs/devs/plugin-migration-to-2.0.md

@@ -0,0 +1,333 @@
+# Migrating Plugins to 2.0
+
+This guide covers the changes needed to bring a plugin written for 2.0.0-alpha.27 up to 2.0.0.
+If your plugin targets an older alpha, go through the Breaking Changes sections in the [changelog](/CHANGELOG.md) for the versions in between first.
+Plugins still on alpha 13 should start with the [alpha 14 guide](plugin-migration-to-alpha-14.md).
+
+
+## Versioning from 2.0
+
+From 2.0.0 onwards a major version (3.0.0) contains breaking changes for users running a cluster, while a minor version (2.1.0) may contain breaking changes for the plugin API.
+This means a plugin written for 2.0 is not guaranteed to work with 2.1 without changes.
+Check the Breaking Changes section of the changelog when a new minor version is released and publish an update to your plugin if needed.
+See [Breaking Changes](/docs/decisions.md#breaking-changes) in the decision log.
+
+
+## Convert to ES modules
+
+Clusterio's packages are now ES modules and plugins should be too.
+Add `"type": "module"` to the plugin's `package.json` and replace `require()` and `module.exports` with `import` and `export`.
+
+Keep `"clusterio-plugin"` in the package's `"keywords"` for automatic discovery, and keep `"main"` pointing to the plugin info module (or use the default `index.js`).
+An `"exports"` map is not required for ES modules.
+If you add one, expose `"./package.json": "./package.json"`; otherwise Clusterio cannot discover or load the plugin by its package name.
+Clusterio currently reads the implementation path from `"main"` rather than conditional exports.
+See [Plugin Structure](../writing-plugins.md#plugin-structure) for a compatible package example.
+
+Relative imports must include the full filename with the `.js` extension.
+This also applies in TypeScript, where you import `./messages.js` even though the source file is `messages.ts`.
+Importing a directory no longer resolves to its `index.js`.
+
+**Alpha 27**
+```js
+"use strict";
+const lib = require("@clusterio/lib");
+const messages = require("./messages");
+
+const plugin = {
+    name: "foo_frobber",
+    controllerEntrypoint: "controller",
+    messages: [messages.Frobnicate],
+};
+
+module.exports = {
+    plugin,
+};
+```
+
+**2.0**
+```js
+import * as lib from "@clusterio/lib";
+import * as messages from "./messages.js";
+
+export const plugin = {
+    name: "foo_frobber",
+    controllerEntrypoint: "controller.js",
+    messages: [messages.Frobnicate],
+};
+```
+
+The entrypoint paths in the plugin declaration must include the `.js` extension as well, for TypeScript plugins this means `"./dist/node/controller.js"` instead of `"./dist/node/controller"`.
+
+`__dirname` and `__filename` do not exist in ES modules, use `import.meta.dirname` and `import.meta.filename` instead.
+JSON files are imported with `import packageJson from "./package.json" with { type: "json" };`.
+
+A `webpack.config.js` written with `require()` stops working once the package is an ES module.
+Rename it to `webpack.config.cjs`, webpack-cli finds it under that name without further changes.
+If your `prepare` script passes `--config webpack.config.js` update it to the new name.
+
+TypeScript plugins using `"module": "node16"` in their tsconfig, as the plugin templates do, emit ES modules once `"type": "module"` is set and need no further config changes.
+
+Node.js can still import a CommonJS plugin, but it only finds the `plugin` export if it can detect it from the source, which works for `module.exports = { plugin };` and fails for other forms such as an object literal written in place.
+Converting the plugin avoids the problem.
+
+
+## Replace plugin classes with entrypoint functions
+
+Entrypoints now export a default async function instead of a class deriving from `BaseControllerPlugin`, `BaseHostPlugin`, `BaseInstancePlugin`, `BaseCtlPlugin` or `BaseWebPlugin`.
+The function is called once when the plugin loads and attaches handlers to the hooks it needs.
+Class exports still load, but they are deprecated and a warning is logged for each one.
+See [Defining the plugin entrypoint](/docs/writing-plugins.md#defining-the-plugin-entrypoint) for the details.
+
+**Alpha 27**
+```js
+const { BaseControllerPlugin } = require("@clusterio/controller");
+
+class ControllerPlugin extends BaseControllerPlugin {
+    async init() {
+        this.controller.handle(Frobnicate, this.handleFrobnicate.bind(this));
+    }
+
+    async onSaveData() {
+        await this.saveFrobnicationData();
+    }
+
+    async onInstanceStatusChanged(instance, prev) {
+        this.logger.info(`Instance ${instance.id} went from ${prev} to ${instance.status}`);
+    }
+
+    async handleFrobnicate(request) { /* ... */ }
+}
+
+module.exports = {
+    ControllerPlugin,
+};
+```
+
+**2.0 (JS)**
+```js
+export default async function(context) {
+    const { controller, logger, plugin } = context;
+
+    controller.handle(Frobnicate, async (request) => { /* ... */ });
+
+    controller.hooks.save.attach(plugin.name, async () => {
+        await saveFrobnicationData();
+    });
+
+    controller.hooks.instanceStatusChanged.attach(plugin.name, async (instance, prev) => {
+        logger.info(`Instance ${instance.id} went from ${prev} to ${instance.status}`);
+    });
+}
+```
+
+**2.0 (TS)**
+```ts
+import type { ControllerPluginContext } from "@clusterio/controller";
+
+export default async function(context: ControllerPluginContext) {
+    // Same as above
+}
+```
+
+The code from `init()` goes into the body of the function, and state that lived on `this` becomes local variables.
+The context types are `ControllerPluginContext`, `HostPluginContext`, `InstancePluginContext`, `CtlPluginContext` and `WebPluginContext` from the respective packages.
+
+
+### Keeping a class for state
+
+If the plugin has enough state that a class is still the better fit, give the class a private constructor and an async `static fromContext` that creates it from the context and attaches its hooks.
+`fromContext` can then be the default export of the entrypoint.
+Instances are kept in a static `WeakMap` keyed by the controller, host or instance they belong to, which lets other code look them up without holding a reference to them.
+
+```ts
+import type { Controller, ControllerPluginContext } from "@clusterio/controller";
+import type * as lib from "@clusterio/lib";
+
+export class Frobber {
+    private static instances = new WeakMap<Controller, Frobber>();
+    private frobnications = new Map<string, number>();
+
+    private constructor(
+        private controller: Controller,
+        private logger: lib.Logger,
+    ) { }
+
+    static async fromContext(context: ControllerPluginContext) {
+        const frobber = new Frobber(context.controller, context.logger);
+        await frobber.load();
+        context.controller.hooks.save.attach(context.plugin.name, () => frobber.save());
+        Frobber.instances.set(context.controller, frobber);
+        return frobber;
+    }
+
+    static get(controller: Controller) {
+        return Frobber.instances.get(controller);
+    }
+
+    async load() { /* ... */ }
+    async save() { /* ... */ }
+}
+
+export default Frobber.fromContext;
+```
+
+The loader calls the default export without `this`, so refer to the class by name inside `fromContext` rather than using `this`.
+Don't extend the deprecated base classes for this, they attach `on*` methods to hooks themselves and log a warning.
+
+
+### Method to hook names
+
+Each `on*` method has a hook of the same name without the `on` prefix and with the first letter lowercased, so `onInstanceStatusChanged` becomes `controller.hooks.instanceStatusChanged`.
+The exceptions are:
+
+- `onSaveData` on the controller is `controller.hooks.save`.
+- `addCommands` on ctl plugins is `context.hooks.addCommands`.
+- The `pages`, `loginForms` and `inputComponents` properties of web plugins are the `pages`, `loginForms` and `inputComponents` hooks on `control.hooks`, with handlers that return the value.
+- The `componentExtra` property of web plugins is the `control.hooks.extensionComponents` hook.
+
+Controller hooks are on `controller.hooks`, host hooks on `host.hooks`, instance hooks on `instance.hooks`, and web hooks on `control.hooks`.
+The ctl hooks are passed directly as `context.hooks`.
+
+**Alpha 27**
+```jsx
+class WebPlugin extends BaseWebPlugin {
+    async init() {
+        this.pages = [
+            { path: "/foo_frobber", sidebarName: "Foo Frobber", content: <FrobberPage/> },
+        ];
+    }
+}
+```
+
+**2.0**
+```jsx
+export default async function(context) {
+    const { control, plugin } = context;
+
+    control.hooks.pages.attach(plugin.name, () => [
+        { path: "/foo_frobber", sidebarName: "Foo Frobber", content: <FrobberPage/> },
+    ]);
+}
+```
+
+
+### Replacing other class members
+
+The class properties are on the context object passed to the entrypoint:
+
+- `this.info` is `context.plugin`.
+- `this.logger` is `context.logger`.
+- `this.controller`, `this.host`, `this.instance` and `this.control` are `context.controller`, `context.host`, `context.instance` and `context.control`.
+- `this.metrics` on controller plugins is `context.metrics`.
+- `this.package` on web plugins is `context.package`.
+
+The helper methods of the base classes have the following replacements:
+
+- `this.sendRcon(message, expectEmpty)` is `instance.sendRcon(message, expectEmpty, plugin.name)`.
+  The plugin name is used to label the RCON metrics.
+- `this.broadcastEventToHosts(event)` is `controller.sendTo("allHosts", event)`.
+- `this.sendOrderedRcon(message)` has no replacement.
+  If your plugin needs commands to execute in order, queue them in the plugin and send the next one after the previous one resolves.
+
+
+### Changes to hook behaviour
+
+Handlers attached by different plugins to the same hook now run concurrently, where the `on*` methods were called one plugin at a time.
+Don't rely on another plugin's handler having finished before yours runs.
+
+A handler that throws or takes more than 15 seconds is logged and does not prevent the other handlers from running.
+Each hook accepts one handler per name, attach it under `plugin.name`.
+
+
+## Accessing other plugins
+
+The `plugins` map on `Controller`, `Host` and `Instance` has been removed.
+It's replaced with `loadedPlugins`, a set of the plugin info objects for the plugins that loaded.
+The set holds info objects rather than names, so look the info up in `pluginInfos` by name first to check if a plugin is loaded on the controller or host:
+
+```js
+const info = controller.pluginInfos.find(info => info.name === "other_plugin");
+const loaded = info !== undefined && controller.loadedPlugins.has(info);
+```
+
+In the web interface `control.loadedPlugins` is a map from plugin name to plugin info.
+`control.plugins` is deprecated and only holds plugins still using the class export.
+
+With no plugin class instances, `controller.plugins.get("other_plugin")` has no direct replacement.
+If one plugin needs to call into another, have the other plugin export its class and use the static lookup from [Keeping a class for state](#keeping-a-class-for-state):
+
+```ts
+import { Frobber } from "other_plugin/dist/node/controller.js";
+
+const frobber = Frobber.get(controller);
+if (!frobber) {
+    throw new Error("other_plugin is not loaded");
+}
+```
+
+This only works if both plugins resolve `other_plugin` to the same file on disk, otherwise the lookup goes to a different copy of the class and returns undefined.
+
+For state shared between components of a web plugin, assign it to a module level variable in the entrypoint.
+The web plugin template created by `@clusterio/create` shows this for a subscriber.
+
+
+## Declare permissions on the plugin
+
+Permissions can now be declared under `permissions` in the plugin declaration instead of with `lib.definePermission()`.
+`lib.definePermission()` still works, but don't use both for the same permission name.
+
+For TypeScript plugins `user.checkPermission()`, `account.hasPermission()` and the `permission` of web pages now only accept known permission names.
+Add your permission names to the `Permissions` interface or these calls will fail to compile, even if you keep using `lib.definePermission()`:
+
+```ts
+declare module "@clusterio/lib" {
+    export interface Permissions {
+        "foo_frobber.frobnicate": never;
+    }
+}
+```
+
+The plugin template's `tsconfig.browser.json` now includes `index.ts` so the web build also sees the declaration, add it to the `include` list if your plugin has its own tsconfig for the browser.
+See [Plugin Permissions](/docs/writing-plugins.md#plugin-permissions).
+
+
+## Renamed ctl classes and config
+
+The remaining uses of "control" for clusterioctl were renamed to "ctl":
+
+- `controlConfigFields` in the plugin declaration is `ctlConfigFields`.
+  Fields under the old name are silently ignored.
+- The `ControlConfigFields` interface is `CtlConfigFields`.
+- `lib.ControlConfig` is `lib.CtlConfig`.
+- The `Control` class exported by `@clusterio/ctl` is `Ctl`.
+
+The term "control" is still used in message `src` and `dst` and in config field locations, where it covers both ctl and the web interface.
+
+
+## Static assets in the web interface
+
+`staticRoot` now includes the `static/` prefix.
+Plugins that fetch assets with `${staticRoot}static/...` should drop the `static/` part.
+
+
+## Package dependencies
+
+npm installs peer dependencies by default, so listing `@clusterio/web_ui` under `peerDependencies` installs it everywhere the plugin is installed even though it's only needed to build the web bundle.
+Move `@clusterio/web_ui` to `devDependencies` and mark `@clusterio/controller`, `@clusterio/host` and `@clusterio/ctl` as optional in `peerDependenciesMeta`:
+
+```json
+"peerDependencies": {
+    "@clusterio/controller": "^2.0.0",
+    "@clusterio/host": "^2.0.0",
+    "@clusterio/lib": "^2.0.0"
+},
+"peerDependenciesMeta": {
+    "@clusterio/controller": {
+        "optional": true
+    },
+    "@clusterio/host": {
+        "optional": true
+    }
+}
+```

docs/devs/plugin-migration-to-alpha-14.md

@@ -0,0 +1,523 @@
+# Migrating Plugins to Alpha 14
+
+Between version 2.0.0-alpha.13 and 2.0.0-alpha.14 the codebase underwent major refactoring and was ported to TypeScript.
+In order to support alpha 14 there are several major changes that need to be done to existing plugins, these are in no particular order
+
+
+## Rename master and slave
+
+All references to slave and master in the code was renamed to controller and host respectively which means that code referencing these in plugins must be renamed.
+In short this means performing a global search and replace on the codebase replacing:
+
+- `master` with `controller`
+- `Master` with `Controller`
+- `slave` with `host`
+- `Slave` with `Host`
+
+in all places it occurs, even as part of longer names such as changing `BaseMasterPlugin` to `BaseControllerPlugin`.
+
+
+## Change lib imports to import directly from the top level package
+
+Previously code could import sub packages of lib such as lib/lua_tools.
+These imports need to be changed to all import from lib directly.
+
+**Alpha 13**
+```js
+const libLuaTools = require("@clusterio/lib/lua_tools");
+const libErrors = require("@clusterio/lib/errors");
+
+// Using imports
+new libErrors.RequestError(...)
+libLuaTools.escapeString(...)
+```
+
+**Alpha 14 (JS)**
+```js
+const lib = require("@clusterio/lib");
+
+// Using library components
+new lib.RequestError(...)
+lib.escapeString(...)
+```
+
+**Alpha 14 (TS)**
+```ts
+import * as lib from "@clusterio/lib";
+
+// Using library components
+new lib.RequestError(...)
+lib.escapeString(...)
+```
+
+
+## Change import of base plugins
+
+Previously `BaseMasterPlugin` and `BaseInstancePlugin` were imported from `@clusterio/lib`, these have been moved to `@clusterio/controller` and `@clusterio/host` respectively.
+
+**Alpha 13**
+```js
+const { BaseMasterPlugin } = require("@clusterio/lib");
+const { BaseInstancePlugin } = require("@clusterio/lib");
+```
+
+**Alpha 14 (JS)**
+```js
+const { BaseControllerPlugin } = require("@clusterio/controller");
+const { BaseInstancePlugin } = require("@clusterio/host");
+```
+
+**Alpha 14 (TS)**
+```ts
+import { BaseControllerPlugin } from "@clusterio/controller";
+import { BaseInstancePlugin } from "@clusterio/host";
+```
+
+
+## Change main entrypoint of plugin
+
+Previously the info of a plugin would be loaded by requiring `./plugin_dir/info`, this has been changed to require `./plugin_dir` which in turn means that `info.js` is no longer the default entrypoint.
+To solve this you can either add `"main": "info.js",` to package.json or rename `info.js` to `index.js` (the rest of this guide assumes the entrypoint was renamed to `index.js`).
+The motivation behind this change was to allow TypeScript to output its build to a sub-folder of the plugin, if you're using TypeScript you'll likely have the entrypoint be located in `dist/node/index.js` instead.
+
+The expected place where the declaration of a plugin is exported has also changed from `module.exports` to `module.exports.plugin`:
+
+**Alpha 13**
+```js
+// info.js
+module.exports = {
+    name: "plugin_name",
+    ...
+}
+```
+
+**Alpha 14 (JS)**
+```js
+// index.js
+const plugin = {
+    name: "plugin_name",
+    ...
+}
+
+module.exports = {
+    plugin,
+};
+```
+
+**Alpha 14 (TS)**
+```ts
+// index.ts
+import type * as lib from "@clusterio/lib";
+
+export const plugin: lib.PluginDeclaration = {
+    name: "plugin_name",
+    ...
+};
+```
+
+
+### Modify exposed path in webpack.config.js
+
+The `./info` import path exposed in the ModuleFederationPlugin in the `webpack.config.js` needs to be changed to `./`.
+E.g.:
+
+**Alpha 13**
+```js
+// In webpack.config.js
+new webpack.container.ModuleFederationPlugin({
+    ...
+    exposes: {
+        "./info": "./info.js",
+        ...
+    },
+}),
+```
+
+**Alpha 14**
+```js
+// In webpack.config.js
+new webpack.container.ModuleFederationPlugin({
+    ...
+    exposes: {
+        "./": "./index.js",
+        ...
+    },
+}),
+```
+
+## Remove usage of ConfigGroup
+
+The Config system was refactored and the `ConfigGroup` concept was completely removed.
+Config fields are now defined directly on the exported plugin info.
+
+**Alpha 13**
+```js
+const lib = require("@clusterio/lib");
+
+class MasterConfigGroup extends lib.PluginConfigGroup { }
+MasterConfigGroup.groupName = "plugin_name";
+MasterConfigGroup.defaultAccess = ["master", "control"];
+MasterConfigGroup.define({
+    name: "option",
+    title: "Option",
+    description: "A config option.",
+    type: "string",
+    optional: true,
+});
+
+module.exports = {
+    name: "plugin_name",
+    MasterConfigGroup,
+    ...
+}
+```
+
+**Alpha 14 (JS)**
+```js
+const plugin = {
+    name: "plugin_name",
+    controllerConfigFields: {
+        "plugin_name.option": {
+            title: "Option",
+            description: "A config option.",
+            type: "string",
+            initial_value: "foo",
+            optional: true,
+        },
+    },
+    ...
+}
+
+module.exports = {
+    plugin,
+};
+```
+
+**Alpha 14 (TS)**
+```ts
+import type * as lib from "@clusterio/lib";
+
+// Declare the type of the field to make the type of controller.config.get(field) correctly deduced.
+declare module "@clusterio/lib" {
+    export interface ControllerConfigFields {
+        "plugin_name.option": null | string;
+    }
+}
+
+export const plugin: lib.PluginDeclaration = {
+    name: "plugin_name",
+    controllerConfigFields: {
+        "plugin_name.option": {
+            title: "Option",
+            description: "A config option.",
+            type: "string",
+            initialValue: "foo",
+            optional: true,
+        },
+    },
+    ...
+};
+```
+
+
+### Use onControllerConfigFieldChanged instead of listering to the fieldChanged event
+
+**Alpha 13**
+```js
+this.controller.config.on("fieldChanged", (group, field, prev) => {
+    if (group.name === "plugin_name" && field === "option") {
+        const curr = group.get(field);
+        // Do stuff with curr and or prev
+    }
+}
+```
+
+**Alpha 14 (JS)**
+```js
+async onControllerConfigFieldChanged(field, curr, prev) {
+    if (field === "plugin_name.option") {
+        // Do stuff with curr and or prev
+    }
+}
+```
+
+**Alpha 14 (TS)**
+```ts
+async onControllerConfigFieldChanged(field: string, curr: unknown, prev: unknown) {
+    if (field === "plugin_name.option") {
+        // Do stuff with curr and or prev
+    }
+}
+```
+
+## Redefine link messages as classes
+
+The link layer has been majorly refactored and Request and Events are now defined as [JSON Serialisable Classes](./json-serialisable-classes.md).
+
+**Alpha 13**
+```js
+module.exports = {
+    name: "plugin_name",
+    messages: {
+        forwarded: new lib.Event({
+            type: "plugin_name:forwarded",
+            links: ["instance-slave", "slave-master"],
+            forwardTo: "master",
+            eventProperties: {
+                "string_value": { type: "string" },
+                "number_value": { type: "number" },
+            },
+        }),
+        simple: new lib.Request({
+            type: "plugin_name:simple",
+            links: ["master-slave", "slave-instance"],
+            forwardTo: "instance",
+            requestProperties: {
+                "instance_id": { type: "number" },
+                "string_value": { type: "string" },
+            },
+            responseProperties: {
+                "number_value": { type: "number" },
+            },
+        }),
+    },
+};
+```
+
+**Alpha 14 (JS)**
+```js
+const lib = require("@clusterio/lib");
+
+class ForwardedEvent {
+    static type = "event";
+    static src = "instance";
+    static dst = "controller";
+    static plugin = "plugin_name";
+
+    constructor(stringValue, numberValue) {
+        this.stringValue = stringValue;
+        this.numberValue = numberValue;
+    }
+
+    static jsonSchema = {
+        type: "object",
+        required: ["stringValue", "numberValue"],
+        properties: {
+            "stringValue": { type: "string" },
+            "numberValue": { type: "number" },
+        },
+    };
+
+    static fromJSON(json) {
+        return new this(json.stringValue, json.numberValue);
+    }
+}
+
+class SimpleRequest {
+    static type = "request";
+    static src = "controller";
+    static dst = "instance";
+    static plugin = "plugin_name";
+
+    constructor(stringValue) {
+        this.stringValue = stringValue;
+    }
+
+    static jsonSchema = {
+        type: "object",
+        required: ["stringValue"],
+        properties: {
+            "stringValue": { type: "string" },
+        },
+    };
+
+    static Response = lib.JsonNumber
+}
+
+const plugin = {
+    name: "plugin_name",
+    messages: [
+        ForwardedEvent,
+        SimpleRequest,
+    ],
+    ...
+};
+
+module.exports = {
+    plugin,
+    ForwardedEvent,
+    SimpleRequest,
+}
+```
+
+**Alpha 14 (TS)**
+```ts
+import * as lib from "@clusterio/lib";
+import { Static, Type } from "@sinclair/typebox";
+
+export class ForwardedEvent {
+    declare ["constructor"]: typeof ForwardedEvent;
+    static type = "event" as const;
+    static src = "instance" as const;
+    static dst = "controller" as const;
+    static plugin = "plugin_name" as const;
+
+    constructor(
+        public stringValue: string,
+        public numberValue: number,
+    ) { }
+
+    static jsonSchema = Type.Object({
+        "stringValue": Type.String(),
+        "numberValue": Type.Number(),
+    });
+
+    static fromJSON(json: Static<typeof this.jsonSchema>) {
+        return new this(json.stringValue, json.numberValue);
+    }
+}
+
+export class SimpleRequest {
+    declare ["constructor"]: typeof SimpleRequest;
+    static type = "request" as const;
+    static src = "controller" as const;
+    static dst = "instance" as const;
+    static plugin = "plugin_name" as const;
+
+    constructor(
+        public stringValue: string,
+    ) { }
+
+    static jsonSchema = Type.Object({
+        "stringValue": Type.String(),
+    });
+
+    static fromJSON(json: Static<typeof this.jsonSchema>) {
+        return new this(json.stringValue);
+    }
+
+    static Response = lib.JsonNumber
+}
+
+export const plugin: lib.PluginDeclaration = {
+    name: "plugin_name",
+    messages: [
+        ForwardedEvent,
+        SimpleRequest,
+    ],
+    ...
+}
+```
+
+### Refactor message sending
+
+Message handlers are now explicitly registered instead of relying on magic name lookups that don't make sense unless you know them.
+
+**Alpha 13**
+```js
+const lib = require("@clusterio/lib");
+
+class ControllerPlugin extends lib.BaseControllerPlugin {
+    // event name is magically created by concatenating EventHandler or
+    // RequestHandler to the name in the messages export in in info.js.
+    async forwardedEventHandler(message) {
+        // message.data contains the raw JSON data sent.
+        if (message.data.string_value) {
+            // ...
+        }
+    }
+}
+```
+
+**Alpha 14 (JS)**
+```js
+const { BaseControllerPlugin } = require("@clusterio/lib");
+const { ForwardedEvent } = require("./index.js");
+
+class ControllerPlugin extends BaseControllerPlugin {
+    async init() {
+        // Explicit binding between message class and the handler for it
+        this.controller.handle(ForwardedEvent, this.handleForwardedEvent.bind(this));
+        // Note: On an instance plugin you would use this.instance.handle
+    }
+
+    async handleForwardedEvent(event, src, dst) {
+        // Event is an instance of the ForwardedEvent class
+        if (event.stringValue) {
+            // ...
+        }
+
+        // src and dst are instances of lib.Address and describe where
+        // the message came from and who it was addressed to.
+    }
+
+    ...
+}
+
+module.exports = {
+    ControllerPlugin,
+}
+```
+
+**Alpha 14 (TS)**
+```ts
+import * as lib from "@clusterio/lib";
+import { BaseControllerPlugin } from "@clusterio/controller";
+import { ForwardedEvent } from "./index.js";
+
+export class ControllerPlugin extends BaseControllerPlugin {
+    async init() {
+        // When using TypeScript this call is type checked to make sure the handler accepts the right class.
+        this.controller.handle(ForwardedEvent, this.handleForwardedEvent.bind(this));
+        // Note: On an instance plugin you would use this.instance.handle
+    }
+
+    async handleForwardedEvent(event: ForwardedEvent, src: lib.Address, dst: lib.Address) {
+        // Event is an instance of the ForwardedEvent class
+        if (event.stringValue) {
+            // ...
+        }
+
+        // src and dst describe where the message came from and who it was addressed to.
+    }
+
+    ...
+}
+```
+
+
+### Refactor message sending
+
+Message are now addressed end to end instead of using the confusing forwardTo and broadcastTo properties of the message definition.
+When broadcasting events the special `"allInstances"`, `"allHosts"`, and `"allControls"` shorthand addresses can be used.
+There's two methods for sending messages `.send` and `.sendTo` where `.send` is a shorthand for `.sendTo` with an address filled in as the other side of the link, this is mostly only useful in control plugins where the other side of the link is the controller.
+
+**Alpha 13**
+```js
+// from instance plugin
+this.info.messages.forwarded.send(this.instance, {
+    string_value: "foo",
+    number_value: 123,
+});
+
+// from master plugin
+const instance_id = ...
+const response = await this.forwardRequestToInstance(this.info.messages.simple, {
+    instance_id,
+    string_value: "foo",
+});
+const value = response.number_value;
+```
+
+**Alpha 14**
+```js
+const { ForwardedEvent } = require("./info.js");
+
+// from instance plugin
+this.instance.sendTo("controller", new ForwardedEvent("foo", 123));
+
+// from controller plugin
+const instanceId = ...
+const value = await this.controller.sendTo({ instanceId }, new SimpleRequest("foo"));
+// if using TypeScript then the type of value will be inferred as number here
+```

docs/devs/protocol.md

@@ -0,0 +1,263 @@
+# Protocol
+
+Clusterio communicates using a simple homebrew message passing protocol based on JSON over WebSocket with limited support for reliable transport of messages.
+The protocol is implemented in [packages/lib/src/link](/packages/lib/src/link) and uses the `ws` library to handle the WebSocket connections on the Node.js side and the native WebSocket API on the browser side.
+
+Two general kinds of messages are supported: events and requests.
+Events are messages sent by one party and received by the other and offer no notification for the sender on whether it was actually received.
+Requests are pairs of request-response messages where one side sends the requests and the other side replies with a response.
+Apart from the handshake used to establish connections the protocol is directionless, and either party can send or receive both requests and events.
+
+Events and requests are defined as instances of the `Request` and `Event` classes, and specify a unique type string, who can send and receive the message, optional forwarding of the message and the format of the data payload as a JSON schema.
+All messages sent and received are validated with JSON schemas to catch potential errors in sending messages and avoid having to write lots of validation code in message handlers.
+
+Messages are sent by calling the `.send()` method of the message instance and passing a `Link` instance to send it over and the data to send.
+For the controller there's a `Link` instance for each host and control connection stored in the `WsServer` class.
+For hosts the `Host` instance is a link to the controller, and each `Instance` instance is an in-memory link to the `Host` instance and has a corresponding `InstanceConnection` link stored on the `Host` instance.
+For ctl there's a `Ctl` instance and web_ui there's a `Control` instance that acts as the link to the controller.
+
+Messages received invokes message handlers that were registered when the link was brought up.
+These handlers are named after the name of the property the message is stored under with `EventHandler` appended for events and `RequestHandler` appended for requests.
+The handlers are defined on the link class itself for core messages, and on the plugin class in the case of plugin defined messages.
+
+
+## Connection flow
+
+Clients connect via WebSocket to the `/api/socket` endpoint and upon establishing connection to the server the connection is in the handshake phase and the server will send a `hello` message to the client.
+If the client has no previous session with the server it sends a `register_host` or `register_control` message depending on what kind of client it is to the server.
+If the register is valid then the server will respond with a `ready` message with a session token and the connection has left the handshake phase, otherwise the server will close the connection with a WebSocket close code indicating the kind of failure.
+
+Upon leaving the handshake phase both parties should start sending heartbeat messages with the sequence number of the last received message.
+Messages sent over the link should be stored in a send buffer and only cleared from the send buffer when a heartbeat with a `last_seq` equal or or higher is received or the session is invalidated.
+
+If the connection goes stale or is unexpectedly closed the client can reastablish the same session by connecting to the server again and sending a `resume` message after received the `hello` from the server.
+If the session resume is successful then the server will respond with a `continue` message and the connection is active again.
+The client should then re-send all messages it has in its send buffer that is greater than the `last_seq` number in the `continue` message.
+Otherwise the server will respond with `invalidate` and the client is expected to drop its send buffer start a new session with `register_host` or `register_control`.
+
+![Connection flow](../assets/connection_flow.svg)
+
+
+## Connector flow
+
+To manage the complexity of connecting, reconnecting, resuming or invalidating dropped sessions the WebSocket connection for a `Link` class is managed by a connector.
+There's three kinds of connectors defined: `WebSocketClientConnector`, `WebSocketServerConnector` and `VirtualConnector`.
+The virtual connector is for in-memory connections and doesn't have any connection state logic.
+
+For the WebSocket connectors there's four states they can exist in:
+- `closed` - The connector has just been created or has been explicitly closed.
+- `connecting` (client only) - The connector is in the process of trying to connect to the server.
+- `connected` - The connector is successfully connected.
+- `resuming` - The connection dropped and the connector is in the process of attempting to resume it.
+
+Along with the following events emitted when transition between states:
+- `connect` From `connecting` (client) or `closed` (server) to `connected`
+- `drop` - From `connected` to `resuming`
+- `resume` - From `resuming` to `connected`
+- `invalidate` - From `resuming` to `connecting` or `closed`
+- `close` - From any state to `closed`
+
+![Conector States](../assets/connector_states.svg)
+
+
+### WsClientConnector
+
+The client connector will keep trying to establish and mantain a connection after `.connect()` is called on it, stopping only in the case of authentication failure or `.close()`/`.setClosing()` being called.
+Other than that, the logic is pretty straight forward.
+
+![WsClientConnector](../assets/WsClientConnector.svg)
+
+
+### WsServerConnector
+
+The server connector doesn't do the work of connecting or validating the handshake.
+Instead it's handed over a WebSocket connection from `WsServer` once there's only the step of sending the final message left to do.
+Because of this there's no `connecting` state, and once a session times out from the `resuming` state it goes directly to closed.
+
+![WsServerConnector](../assets/WsServerConnector.svg)
+
+
+## Wire format
+
+All communication in the protocol is done via WebSocket text frames containing a JSON payload with the following properties:
+
+- `seq: integer | null` - The sequence number of the message, can only be null for handshake and heartbeats.
+- `type: string` - The type of message
+- `data: object` - Message data
+
+Before a connection is established it's in the handshake phase and the `seq` property is `null`.
+The `type` property is used to distinguish which of handshake, heartbeat, events or requests this message is and determines the expected format of the `data` property.
+
+
+### Handshake Messages
+
+The following messages are the only valid messages that can be sent during the handshake phase.
+
+
+#### `hello`
+
+Sent by the controller when the WebSocket connection has been opened.
+
+- `version: string` - The version of the controller, e.g. "2.0.0".
+- `plugins: Object<string, string>` -
+    Object mapping plugin names to plugin version for plugins that are loaded on the controller.
+
+#### `register_host`
+
+Host handshake for establishing a new connection session.
+
+- `token: string` - Authentication token.
+- `version: string` - The protocol version of the host, e.g. "2.0.0".
+- `id: integer` - ID of the host.
+- `plugins: Object<string, string>` -
+    Object mapping plugin names to plugin version for plugins that are available on the host.
+
+#### `register_control`
+
+Control handshake for enstablishing a new connection session.
+
+- `token: string` - Authentication token.
+- `version: string` - The protocol version of the control, e.g. "2.0.0".
+
+#### `resume`
+
+Handshake for resuming an existing connection session where the connection had dropped unexpectedly.
+
+- `session_token: string` - Session token to resume session with.
+- `last_seq: integer | null` - Last message seq received by the client.
+
+#### `invalidate`
+
+Sent by the controller in reply to a resume for a session that cannot be resumed.
+The client should start a new session with a register\_\* message in response.
+
+#### `continue`
+
+Sent by the controller to signal resuming the session was successful.
+
+- `last_seq: integer | null` - Last message seq received by the server.
+- `session_timeout: integer` - Session timeout in seconds.
+- `heartbeat_interval: number` - Rate client should send heartbeats at.
+
+#### `ready`
+
+Sent by the controller to signal the connection has been established with a new session.
+
+- `session_token: string` - Token to resume the session with.
+- `session_timeout: integer` - Session timeout in seconds.
+- `heartbeat_interval: number` - Rate client should send heartbeats at.
+
+
+### Heartbeat message
+
+Once connected as indicated by the `ready` and `continue` messages both sides of the connection starts sending heartbeats at the inverval given in the `ready` and `continue` messages.
+The heartbeat should contain the `seq` of the last received message, and receiving a heartbeat with a given sequence number means that the other party of the link has received all messages up to that seq number.
+
+
+#### `heartbeat`
+
+Sent by both the controller and clients at the interval given in the continue/ready messages.
+
+- `last_seq: integer` - Last message seq received over the link.
+
+### Events
+
+Events are messages send in one direction over the link, that the receiver is expected to act upon, but not make any replies (for that there's [Requests](#requests).
+By convention message types ending in `*_event` are events.
+The data payload of an event consists solely of event specific properties.
+
+See [packages/lib/src/link/messages.ts](/packages/lib/src/link/messages.ts) for the recognized core events and their contents.
+Plugins may defined their own events as well.
+
+#### `*_event`
+
+- any properties defined by the event type.
+
+
+### Requests
+
+Requests are messages which expects a response in return.
+They function a lot like HTTP requests except that both parties of a connection can inniate a request that is expected to be responded to.
+By convention message types ending in `*_request` are requests, and is expected to be replied to with a corresponding `*_response` message.
+If an error occured while processing the request an error response containing an error property in the data payload is sent instead.
+
+See [packages/lib/src/link/messages.ts](/packages/lib/src/link/messages.ts) for the recognized core requests and their contents.
+Plugins may define their own requests as well.
+
+#### `*_request`
+
+- any properties defined by the request type.
+
+#### `*_response` success
+
+- `seq: integer` - The seq number of the request message.
+- any additional properties defined by the request type.
+
+#### `*_response` error
+
+- `seq: integer` - The seq number of the request message.
+- `error: string` - Human readable text message describing the error.
+
+
+### Graceful Disconnect
+
+To ensure no data is lost when closing the link it's important to send a prepare disconnect request and wait for it to complete before closing the WebSocket.
+Either party of the link can send this request and the party sending the request should be the one that initates the close of the WebSocket.
+
+#### `prepare_disconnect_request`
+
+Request graceful disconnect of the connection.
+The receiving party should stop tasks that send events and requests over the link and wait for pending requests it has over the link to complete, but it should not stop responding to requests sent to it.
+Only after this process is done should the response be sent.
+
+#### `prepare_disconnect_response`
+
+Signals the preparation for disconnect is complete and that the connection can be closed.
+The party that initiatied the prepare disconnect request may still send other requests/events over the link to finish its part of the disconnection proceedure.
+
+If the error response variant is received it should be logged if possible and treated as a success.
+
+
+### Example handshake
+
+Server hello after opening the WebSocket.
+
+```json
+{
+    "seq": null,
+    "type": "hello",
+    "data": {
+        "version": "2.0.0"
+    }
+}
+```
+
+Host registering a new connection session.
+
+```json
+{
+    "seq": null,
+    "type": "register_host",
+    "data": {
+        "token": "xyzabc123",
+        "version": "2.0.0",
+        "id": 123
+    }
+}
+```
+
+Controller reply signaling the session is established and ready.
+
+```json
+{
+    "seq": null,
+    "type": "ready",
+    "data": {
+        "session_token": "xyz.azy.bzy",
+        "session_timeout": 60,
+        "heartbeat_interval": 15
+    }
+}
+```
+
+Host and controller can now send events and requests over the connection.

docs/how-it-works.md

@@ -0,0 +1,18 @@
+## Save Patching
+
+In order to efficiently get data in and out of running Factorio servers and to provide custom interfaces Clusterio uses save patching<sup>[1]</sup> to add code to the game.
+The save patching is based on the built in [event_handler](https://github.com/wube/factorio-data/blob/master/core/lualib/event_handler.lua) library to Factorio and requires scenarios to be coded specifically for it.
+Mods on the other hand work without modifications.
+
+This can be disabled with the `factorio.enable_save_patching` config on a per instance basis, however disabling it means that modules are not loaded into the game and most plugins will not function.
+To use the modules outside of Clusterio the `npx clusteriohost create-scenario` command creates a scenario with the modules patched into it.
+Note that the IPC between the game and the host is not available outside of Clusterio, so modules that depend on it will not work as expected in such a scenario.
+
+<sub>1: Before version 2.0 of Clusterio this was done at runtime with a patcher called Hotpatch, but due to the difficulty in supporting run time patching and the lack of documentation it was replace it with save patching instead.</sub>
+
+
+## User Accounts
+
+The controller creates and stores accounts for all Factorio users that log into instances under its control.
+These accounts are used to store per player data and authorize management of the cluster.
+By default users accounts are assigned a Player role that gives a limited read access to the cluster resources, and admins of the cluster can be assigned a Cluster Admin role to get access to manage it.

docs/managing-a-cluster.md

@@ -0,0 +1,311 @@
+# Managing a Cluster
+
+Clusterio clusters are managed through the controller by using the `clusterioctl` command line interface which is invoked by running `npx clusterioctl <command>` in the clusterio directory.
+This document uses the shorthand `ctl> foo` to indicate `npx clusterioctl foo` should be executed.
+Mandatory parameters are shown in `<angles bracket>` and optional pameters are in `[square brackets]`.
+
+Before `clusterioctl` can be used it needs to be configured for the cluster it will connect to.
+The easiest way to do this is to run `npx clusteriocontroller bootstrap create-ctl-config <username>` on the controller, which creates the necessary `config-ctl.json` for managing the cluster as the given user.
+
+
+## Hosts
+
+### List hosts
+
+    ctl> host list
+
+Lists all hosts.
+
+### Generate token
+
+    ctl> host generate-token [--id <host id>]
+
+Generate a token for a host. `--id` is the host id.
+
+### Create config
+
+    ctl> host create-config [--id <host id>] [--name <host name>] [--generate-token <bool>] [--output <path to output>]
+
+Create a host config. `--id` id the host id. `--name` is the host name. `--generate-token` decides whether to also generate a token, defaulting to `0`. `--output` is the filename for the output of the config; Default is "config-host.json", "-" for stdout.
+
+### Update Clusterio
+
+    ctl> host update <host> [--all] [--restart]
+
+Specify the host by name or ID.
+If remote updates are enabled on the host, this will attempt to update `@clusterio/host` on the machine. Add `--all` to also update all npm-installed plugins. Changes will not be applied until the host is restarted. If the `--restart` flag is provided, the host will automatically restart once the update is complete.
+
+Remote updates are enabled by default but can be disabled on a per-machine basis at the owner's discretion. For security reasons, this configuration setting cannot be changed remotely. To modify it, run the following command locally while the host is offline:
+
+    host> config set host.allow_remote_updates true/false
+
+The controller also supports remote updates, following the same logic. The corresponding commands are:
+
+    ctl> controller update [--all] [--restart]
+    controller> config set controller.allow_remote_updates true/false
+
+### Mark restart required
+
+    ctl> host mark-restart-required <host>
+
+Marks the host as requiring a restart, the same way a plugin update does. Use it after installing or changing a plugin by other means than `host plugin install`, such as a plugin checked out into `external_plugins`. The mark shows up in the web interface on the next system metrics poll. The controller has the same command:
+
+    ctl> controller mark-restart-required
+
+## Instances
+
+### List Instances
+
+    ctl> instance list
+
+List instances.
+
+### Create instance
+
+    ctl> instance create <name> [--id <instance id>]
+
+Create a new instance. `name` is the instance name. `--id` is the optional id.
+
+### Kill instance
+
+    ctl> instance kill <name>
+
+Terminates the running Factorio server without giving it a chance to save or cleanup after itself.
+
+Note: This may cause loss of data.
+
+### Save game
+
+    ctl> instance save-game <name>
+
+Saves the running game of the instance to the save it was started from and waits for the save to finish.
+
+### Extract players from instance
+
+    ctl> instance extract-players <name>
+
+Creates a user account in the cluster for each player that has been online on the currently running save of the instance and sets the online time of that account on this instance to the online time recorded in the save.
+
+Useful when importing a save to a cluster.
+Note that the online time in a save is recorded differntly from how Clusterio records online time.
+Most notably Clusterio records wall clock time while the save time is recorded in ticks and this extraction of player time assumes the game runs at 60 ticks a second.
+
+
+### Config management
+
+#### List Configuration
+
+    ctl> instance config list <instance>
+
+List config values for an instance. `instance` is the instance whose config values to list.
+
+#### Set config value
+
+    ctl> instance config set <instance> <field> [value] [--stdin]
+
+Set field in instance config. `instance` is instance to set. `field` is field to set. `value` is value to set in field. `--stdin` signals to read value from stdin.
+
+#### Set config property of field
+
+To be written.
+
+#### Edit instance config
+
+    ctl> instance config edit <instance> [editor]
+
+Edit instance config in a text editor. Once file is saved and editor has been exited, config values will be read back in. `instance` is the instance to edit, `editor` is the editor to use. If `editor` is not given, clusterioctl will read from the `EDITOR` or `VISUAL` enviroment variables.
+
+### Assign instance to host
+
+    ctl> instance assign <instance> [host]
+
+Assigns instance to host. `instance` is instance to assign, `host` is host to assign to. If `host` is not provided, instance will be unassigned.
+
+## Users
+
+Clusterio automatically creates user accounts for all players that join an instance when save patching is enabled.
+These accounts are used to store per player data shared between instances, like if the player should be whitelisted, admin or banned.
+
+### List users
+
+    ctl> user list
+
+Lists all user accounts in the cluster along with some data for each.
+
+
+### Create User
+
+    ctl> user create <name>
+
+Creates a new empty user account for the given Factorio player.
+Note that case matters here.
+This is usually not required as user accounts are created automatically for players that join instances with save patching enabled.
+
+
+### Promote User to Server Admin
+
+    ctl> user set-admin <name> [--revoke] [--create]
+
+Promotes the user given to in-game admin on instances with the `sync_adminlist` option enabled.
+If the `--revoke` switch is used the user is removed from the adminlist.
+
+Since admin status is a part of the account data the account must exist for this to succeed, passing `--create` will create the account if it does not exist.
+
+**Note:** Being a server admin does not grant any access to manage the cluster.
+See [set-roles](#set-cluster-roles) for adding roles which grant access to managing the clusetr.
+
+
+### Whitelist User
+
+    ctl> user set-whitelisted <name> [--remove] [--create]
+
+Add the user given to the whitelist on instances with the `sync_whitelist` option enabled.
+If the `--remove` switch is used the user is removed from the whitelist.
+
+Since whitelisted status is a part of the account data the account must exist for this to succeed, passing `--create` will create the account if it does not exist.
+
+
+### Ban User
+
+    ctl> user set-banned <name> [--reason <message>] [--pardon] [--create]
+
+Ban user in-game from instances with the `sync_banlist` option enabled.
+Reason is a message that will be shown to the user when attemption to log in.
+If the `--pardon` switch is used it removes the ban.
+
+Since ban status is a part of the account data the account must exist for this to succeed, passing `--create` will create the account if it does not exist.
+
+Note: This bans the user from logging in to Factorio servers in the cluster, it does not revoke access to any cluster management they might have, see next section on setting roles for revoking tha.
+
+### Bulk importing admin, whitelist and ban lists
+
+Whitelists and admin lists can be bulk imported with the following commands:
+
+    ctl> user whitelist-bulk-import <file> [--create]
+    ctl> user admin-bulk-import <file> [--create]
+
+The file should simply be newline seperated names:
+
+    joe
+    bob
+    allan
+
+The `--create` option will create the user if they do not exist, and then set the relevent value.
+
+Banlists can be bulk imported with the following command:
+    
+    ctl> user banned-bulk-import <file> [--create]
+
+The file should be names, followed by a ban reason:
+
+    joe greifed copper mines
+    bob stole materials
+    allan rude language
+
+The first string on the line is used as the username, the others are used as the ban reason.
+The `--create` option will create the user if they do not exist, then ban them.
+
+### Set Cluster Roles
+
+    ctl> user set-roles <name> [roles...]
+
+Replaces the roles the user has in the cluster with a new list of roles.
+Calling with an empty roles argument will remove all roles from the user.
+
+By default there's a roled named Cluster Admin which grants access to everything and a role named Player which grants a limited read access to the cluster, see [the section on roles](#roles) for more information about setting up roles and permissions.
+
+
+### Delete user
+
+    ctl> user delete <name>
+
+Deletes everything stored on the controller for this user.
+
+Note: If the player is banned from the cluster this will effectively unban them, as the ban status is stored with the user account.
+
+Note: If the player joins the cluster again a new account will be made for them automatically.
+
+
+## Roles
+
+To be written.
+
+
+## Plugins (Local)
+
+To be written.
+
+
+## Plugins (Remote)
+
+By default, remote updates are enabled unless you selected "no" during installation.
+Remote updates allow ctl and the web UI to update plugins on machines within the cluster.
+However, remote installations are disabled by default to prevent the risk of arbitrary code execution through the installation of malicious npm packages onto the machine. See below if you wish to enable this feature.
+
+### List
+
+    ctl> controller plugin list
+    ctl> host plugin list <host>
+
+This command lists all plugins currently known to the remote. Newly installed plugins will not be displayed until the remote is restarted. Plugins that are distributed as an npm package can be updated remotely.
+
+### Update
+
+    ctl> controller plugin update <name> [--restart]
+    ctl> host plugin update <host> <name> [--restart]
+
+If remote plugin updates are enabled on the remote, this will execute `npm update --save <name>`. Changes will not be applied until the remote is restarted. If the `--restart` flag is provided, the remote will automatically restart once the update is complete.
+
+### Update All
+
+    ctl> controller update --all [--restart]
+    ctl> host update <host> --all [--restart]
+
+Updates the Clusterio package and all plugins installed from npm in a single `npm update --save` command. Updating everything at once avoids ending up with multiple versions of `@clusterio/lib` in the installation. Requires both remote updates and remote plugin updates to be enabled on the remote.
+
+### Install
+
+    ctl> controller plugin install <name> [--restart]
+    ctl> host plugin install <host> <name> [--restart]
+
+If remote plugin installs are enabled on the remote, this will execute `npm install --save <name>`. Changes will not be applied until the remote is restarted. If the `--restart` flag is provided, the remote will automatically restart once the update is complete.
+
+### Enable/Disable Updates
+
+    host> config set host.allow_plugin_updates true/false
+    controller> config set controller.allow_plugin_updates true/false
+
+Remote updates are enabled by default but can be disabled on a per-machine basis at the owner's discretion. For security reasons, this configuration setting cannot be changed remotely. To modify it, run the above commands locally while the remote is offline.
+
+### Enable/Disable Installs
+
+    host> config set host.allow_plugin_install true/false
+    controller> config set controller.allow_plugin_install true/false
+
+Remote installs are disabled by default but can be enabled on a per-machine basis at the owner's discretion. For security reasons, this configuration setting cannot be changed remotely. To modify it, run the above commands locally while the remote is offline.
+
+
+## Prometheus Metrics
+
+The controller exports metrics for the whole cluster on the `/metrics` endpoint.
+Fetching it requires a token for a user with the `core.controller.metrics` permission, sent either as an `Authorization: Bearer <token>` header or as an `X-Access-Token` header.
+Requests without a valid token get a 401 response and requests for users lacking the permission get a 403 response.
+
+Create a role with just this permission, a user to hold it, and generate a token for that user.
+Give the user a name that is not a valid Factorio player name, such as one starting with `#`, so a player joining the cluster can never claim the account and its token:
+
+    ctl> role create Prometheus --permissions core.controller.metrics
+    ctl> user create #prometheus
+    ctl> user set-roles #prometheus Prometheus
+    $ npx clusteriocontroller bootstrap generate-user-token '#prometheus'
+
+Then pass the token in the scrape job for the controller in `prometheus.yml`:
+
+    scrape_configs:
+      - job_name: clusterio
+        authorization:
+          credentials: <token>
+        static_configs:
+          - targets: ["localhost:8080"]
+
+Concurrent scrapes share a single round of metrics gathering from the hosts, so multiple scrapers polling the controller do not multiply the load on the hosts.

docs/release-workflow.md

@@ -0,0 +1,88 @@
+# Release workflow
+
+## Update changelog
+
+- CHANGELOG.md in the repository root
+- The changelog.txt file in mod directories
+
+Pull requests will usually have suggestions for changelog entries. These can be automatically parsed and formatted by running `node scripts/pr_to_changelog.mts`, though you will have to manually sort through which should go in the changelog in the repository root and which should go in the changelogs in mod directories.
+
+If the script fails due to GitHub's 60/hour public access rate limit, you can set the `GH_TOKEN` environment variable to a fine-grained personal access token which has a much higher rate limits.
+
+## Packages
+
+The [Publish workflow](../.github/workflows/publish.yml) publishes npm packages and Lua mods when a GitHub release is published.
+For this workflow, first merge the changelog and package version updates into `master`, then create and push the release tag on that merged commit.
+Create a draft GitHub release for the existing tag and use the GitHub Release Markdown from `scripts/pr_to_changelog.mts` as its notes.
+Publishing the draft triggers the workflow; pushing a tag alone does not.
+The steps below describe publishing npm packages manually instead.
+
+> [!NOTE]
+> You will need commit access to the repository as well publish access to the @clusterio org on npm to do this.
+
+1. Ensure you are on the latest version of master branch with no untracked files
+
+    ```sh
+    git switch master
+    git pull --ff-only upstream master
+    git status
+    ```
+
+2. Create a release branch and bump the version in the `package.json` files. The commands below use 2.0.1 to 2.0.2 as an example; substitute the versions for the release you are preparing.
+
+    ```sh
+    git switch -c release/2.0.2
+    sed -i 's/"version": "2\.0\.1"/"version": "2.0.2"/' {packages,plugins}/*/package.json
+    pnpm install --no-frozen-lockfile
+    ```
+
+3. Review and commit the version and changelog changes, then open and merge a release pull request.
+
+    ```sh
+    git add -p
+    git commit -m "Prepare 2.0.2 release"
+    ```
+
+4. After the release pull request is merged, tag the merged commit and push the tag.
+
+    ```sh
+    git switch master
+    git pull --ff-only upstream master
+    git tag v2.0.2
+    git push upstream v2.0.2
+    ```
+
+5. For manual publication, perform a clean install and publish the packages. For automated publication, publish the GitHub release as described above instead.
+
+    The repository does not track `pnpm-lock.yaml`, so allow pnpm to generate or update it during installation.
+
+    ```sh
+    pnpm clean
+    pnpm install --no-frozen-lockfile
+    pnpm -r --filter='./packages/*' --filter='./plugins/*' --fail-if-no-match publish
+    ```
+
+## Plugins
+
+1. Bump the version in the `package.json` file
+2. Run `pnpm install` in the repository root
+3. Run `pnpm adduser` to authenticate
+4. Run `pnpm publish` in the plugin/package directory
+
+Before confirming the publish, ensure the packed size is approximately the same size as the last version (or within the expected size)
+
+After publishing, test creating and installing the plugin on a fresh install.
+
+## Lua mods
+
+To publish lua mods like clusterio_lib, start by building from source:
+
+```sh
+pnpm run build-mod
+```
+
+or download the latest artifacts from the CI. When uploading the mods to the mod portal, make sure the latest version is the last version uploaded, as the game/mod portal/ingame updater isn't consistent in how it figures out the "latest version"
+
+## Release notes
+
+Release notes are expected to be published alongside new releases. We use the github releases system as well as posting in the #announcements channel on the discord. Major releases may warrant a ping.

docs/setting-up-tls.md

@@ -0,0 +1,87 @@
+# Setting up TLS
+
+By default Clusterio will listen for connections over HTTP which is fine for local networks but over the Internet it should idealy be over HTTPS as there are some credentials that could be exposed to eavesdroppers.
+The recommended setup is to have an ordinary HTTPS server software like Apache or Nginx to act as a reverse proxy in front of the Clusterio controller.
+The reverse proxy would then be set up with a TLS certificate from a Certificate Authoritiy like [Let's Encrypt](https://letsencrypt.org).
+Alternatively you can have Clusterio listen for connections over HTTPS directly by providing it with a TLS certificate and private key.
+
+Note that a TLS certificate signed by a recognized Certificate Authority in general requires that you own a domain.
+See the last section for how to create and use a self-signed certificate for an IP address if you don't have a domain.
+
+
+## Using a reverse proxy
+
+Configure the proxy to forward requests over HTTP to the port the controller is listening to so that for example a request to `https://example.com/instances/` is forwarded to `http://localhost:8080/instances/`.
+It is possible to host the interface under a sub-path, in that case a request under the sub-path should be mapped to the controller with the sub-path stripped out.
+For example `https://example.com/sub/path/instances/` would be mapped to `http://localhost:8080/instances`.
+
+Additianlly WebSocket connections to `/api/socket` also needs to be forwarded.
+Typically this requires explicit configuration and support for forwarding WebSocket connections.
+If the interface hosted under a sub-path the `/api/socket` address is relative to the sub-path and the sub-path also needs to be stripped out when forwarded.
+
+You can also optionally set the controller to listen only on the loopback interface to prevent it being directly connected to from the outside.
+
+    npx clusteriocontroller config set controller.bind_address 127.0.0.1
+
+
+### Apache Config
+
+To proxy with Apache make sure that `proxy_module`, `proxy_http_module` and `proxy_wstunnel_module` is loaded in the config, then add the following directives to wherever is the approriate place for your flavour of Apache config organization.
+
+```apache
+<Location /sub/path/>
+    ProxyPass "http://localhost:8080/"
+</location>
+<Location /sub/path/api/socket>
+    ProxyPass "ws://localhost:8080/api/socket"
+</Location>
+```
+
+Replace `/sub/path/` with the location on the proxy you want to host the Clusterio interface under.
+If the whole domain is to be dedicated to the Clusterio interface then `/sub/path/` should be just `/`.
+Pay attention to the use of trailing slashes, as they are important.
+
+
+## Hosting HTTPS directly from Node.js
+
+Listening on HTTPS is supported by the Clusterio controller via the `controller.https_port` option provided paths to a certificate file and a private key file is configured for the `controller.tls_certificate` and `controller.tls_private_key` options.
+Both of these are expected to be unencrypted PEM files.
+
+
+## Creating and using a self-signed certificate
+
+Create a self-signed certificate with OpenSSL by running
+
+    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 3650 -subj /CN=localhost -addext "subjectAltName=IP:<ip>"
+
+substituting `<ip>` with the IP address the server will be accessed under, for example `IP:203.0.113.4`.
+Multiple addresses can be given by supplying a comma sepparated list of `IP:address` pairs and DNS names can also be specified using the `DNS:example.com` format.
+You need to supply every name you want to connect to the server under the subjectAltName field, for example to connect to the HTTPS port locally via an address like `https://localhost:4443/` you need to add `DNS:localhost`.
+
+This creates a private key file named `key.pem` and a public certificate file named `cert.pem` and these are used for the `controller.tls_certificate` and `controller.tls_private_key` config options respectively on the controller:
+
+    npx clusteriocontroller config set controller.tls_certificate cert.pem
+    npx clusteriocontroller config set controller.tls_private_key key.pem
+
+Additionally you will need copy the `cert.pem` file to all of the computers you want to set up as hosts and configure node to trust it by setting the `NODE_EXTRA_CA_CERTS` environment variable to a path to this file before the host is started. You can do this by passing `--self-signed-cert path/to/cert` to the installer when setting up a host, or manually by editing run-host.cmd, run-host.sh and/or clusteriohost.service by adding the following line next to the one setting `NODE_OPTIONS`: 
+
+**For run-host.cmd**
+
+    set "NODE_EXTRA_CA_CERTS=path\to\cert.pem"
+
+**For run-host.sh**
+
+    export "NODE_EXTRA_CA_CERTS=path/to/cert.pem"
+
+**For clusteriohost.service**
+
+    Environment=NODE_EXTRA_CA_CERTS=path/to/cert.pem
+
+You will also need to copy the `cert.pem` file to all of the computers you want to remotely manage the cluster via clusterctl and set the `NODE_EXTRA_CA_CERTS` environment variable as a path to that file before running clusterioctl. For example:
+
+    # On Windows
+    set "NODE_EXTRA_CA_CERTS=path\to\cert.pem"
+    # On Linux
+    export NODE_EXTRA_CA_CERTS="path/to/cert.pem"
+    # You can now use clusterioctl
+    npx clusterioctl instance list

docs/writing-plugins.md

@@ -0,0 +1,786 @@
+# Writing Plugins
+
+Plugins for Clusterio are JavaScript modules that run under Node.js.
+Each entrypoint of a plugin exports a function that attaches handlers to hooks called during various stages and operations of Clusterio.
+
+
+## Contents
+
+- [Plugin Structure](#plugin-structure)
+- [Defining the plugin entrypoint](#defining-the-plugin-entrypoint)
+- [Logging Messages](#logging-messages)
+- [Plugin Configuration](#plugin-configuration)
+- [Plugin Permissions](#plugin-permissions)
+- [Migrating Stored Data](#migrating-stored-data)
+- [Communicating with Factorio](#communicating-with-factorio)
+- [Defining Link Messages](#defining-link-messages)
+- [Sending Link Messages](#sending-link-messages)
+    - [Handling connection events](#handling-connection-events)
+- [Collecting Statistics](#collecting-statistics)
+- [Adding Custom Commands to clusterioctl](#adding-custom-commands-to-clusterioctl)
+
+
+## Plugin Structure
+
+The basic file structure of a plugin is the following.
+
+    plugin_name/
+      +- index.js
+      +- package.json
+      +- controller.js
+      +- instance.js
+      +- ctl.js
+      +- test/
+      |  +- plugin.js
+      +- module/
+         +- module.json
+         +- plugin.lua
+
+Clusterio plugins are Node.js packages that can be published on npm for ease of installation and distribution.
+The usual guides for creating such packages apply.
+At minimum the `package.json` file must contain a version entry.
+For automatic discovery, include `"clusterio-plugin"` in the package's `"keywords"` array.
+Installed npm plugins are discovered from the installation's dependencies when controller, host or ctl loads its configuration, and added to `plugin-list.json`.
+
+A possible workflow for developing plugins is to place the plugin in a sub-directory of where clusterio has been installed, and rely on Node.js searching up the folder heirarchy for it to find `@clusterio/lib`.
+After creating a directory for your plugin, the boilerplate can be generated automaticlly from a set of tempaltes using `npm exec @clusterio/create -y -- --plugin-template` after which you will be asked which areas your plugin will interact with and your plugin's name.
+To add it to `plugin-list.json` so that it gets loaded use the `plugin add <path>` sub-command to either clusteriocontroller, clusteriohost or clusterioctl.
+Note that it's important that the path starts with ./ or ../ (use .\ or ..\ on Windows).
+
+For a plugin to be recognised by Clusterio it needs to export an entry named `plugin` from its main entrypoint.
+By default the main entrypoint is the `index.js` file, but this may be changed by setting the `"main"` entry to a different file in `package.json`.
+Keep this `"main"` entry when using a package `"exports"` map: Clusterio currently loads the plugin implementation from `"main"` (or `index.js`), rather than selecting a conditional export.
+
+If a plugin published on npm defines an `"exports"` map, it must also expose `"./package.json"`.
+Both automatic discovery and runtime loading resolve `<package-name>/package.json` to read the plugin's metadata.
+Packages that hide this file are currently skipped by discovery, and manually adding their package names to `plugin-list.json` does not make them loadable.
+The generated plugin templates omit `"exports"`, which leaves `package.json` accessible.
+For example, a plugin that needs an export map can use:
+
+```json
+{
+    "name": "example-clusterio-plugin",
+    "version": "1.0.0",
+    "type": "module",
+    "main": "./index.js",
+    "keywords": ["clusterio-plugin"],
+    "exports": {
+        ".": "./index.js",
+        "./package.json": "./package.json"
+    }
+}
+```
+
+Here's an example of `index.js`:
+
+```js
+export const plugin = {
+    name: "foo_frobber",
+    title: "Foo Frobber",
+    description: "Does advanced frobnication",
+    instanceEntrypoint: "instance.js",
+    controllerEntrypoint: "controller.js",
+    messages: {
+        /* See below */
+    },
+};
+```
+
+The following properties are recognized:
+
+**name**:
+    Stable internal identifier of the plugin, used as its key in the plugin list.
+    For local plugins automatically discovered under `plugins/` or `external_plugins/`, it must match the plugin's directory name.
+    It does not have to match the npm package name.
+    For example, the package `@clusterio/plugin-subspace_storage` declares the name `subspace_storage`.
+
+**title**:
+    Name of the plugin as shown to users.
+    Currently not used.
+
+**description**:
+    Brief description of what the plugin does.
+    Currently not used.
+
+**instanceEntrypoint**:
+    Path to a Node.js module relative to the plugin directory which exports the instance entrypoint function for this plugin.
+    This is an optional paramater.
+    A plugin may have code only for instances but it must still be loaded on the controller in order for it to be possible to load it on an instance.
+
+**instanceConfigFields**:
+    Object mapping instance configuration fields to `FieldDefinitions`for this plugin.
+    See [Plugin Configuration](#plugin-configuration)
+
+**controllerEntrypoint**:
+    Path to a Node.js module relative to the plugin directory which exports the controller entrypoint function for this plugin.
+    This is an optional parameter.
+    A plugin can be made that only runs on the controller.
+
+**controllerConfigFields**:
+    Object mapping controller configuration fields to `FieldDefinition` objects for this plugin.
+    See [Plugin Configuration](#plugin-configuration)
+
+**ctlEntrypoint**:
+    Path to a Node.js module relative to the plugin directory which exports the clusterioctl entrypoint function for this plugin.
+    This is an optional paramater.
+    A plugin can be made that only runs on the clusterioctl side.
+
+**migrationEntrypoint**:
+    Path to a Node.js module relative to the plugin directory which exports the migration entrypoint function for this plugin.
+    This is an optional parameter.
+    See [Migrating Stored Data](#migrating-stored-data)
+
+**features**:
+    Array of features the plugin needs from the instances it is loaded on, `"SavePatching"` and/or `"ScriptCommands"`.
+    See [Handling Invalid Configuration](#handling-invalid-configuration)
+
+**messages**:
+    Object with link messages definitions for this plugin.
+    See guide for [defining link messages](#defining-link-messages) below.
+
+**permissions**:
+    Array of permission definitions for this plugin.
+    See [Plugin Permissions](#plugin-permissions)
+
+The optional module folder contains a Clusterio module that will be patched into the save when the plugin is loaded.
+See the section on [Clusterio Modules](developing-for-clusterio.md) in the Developing for Clusterio document.
+The only restriction imposed on modules embedded into plugins is that they must be named the same as the plugin.
+
+While there is no standard for how to organize a plugin it's recommended to put the controller entrypoint into controller.js and the instance entrypoint into instance.js.
+You can put them into whatever file you want (even the same one for both).
+
+The entrypoint paths must include the .js extension and use forward slashes for directory separators if any.
+
+
+## Defining the plugin entrypoint
+
+Each entrypoint module exports a default async function which is called once when the plugin is loaded.
+It is passed a context object with what the plugin needs to interact with Clusterio, and attaches handlers to the hooks it is interested in.
+For example, a controller entrypoint can look like this:
+
+```js
+export default async function(context) {
+    const { controller, logger, plugin } = context;
+
+    controller.hooks.save.attach(plugin.name, async () => {
+        await saveFrobnicationData();
+    });
+
+    controller.hooks.shutdown.attach(plugin.name, async () => {
+        logger.info("Stopping frobnication");
+    });
+}
+```
+
+The context has the following properties:
+
+**plugin**:
+    The plugin's own info, as exported from the main entrypoint.
+
+**logger**:
+    Logger for this plugin, see [Logging Messages](#logging-messages).
+
+**controller**, **host**, **instance**, **hooks** or **control**:
+    The object the entrypoint is loaded for.
+    Controller entrypoints get `controller`, host entrypoints get `host`, instance entrypoints get both `instance` and `host`, clusterioctl entrypoints get `hooks` and web entrypoints get `control`.
+
+The available hooks are documented on the `ControllerHooks`, `HostHooks`, `InstanceHooks`, `CtlHooks` and `WebHooks` classes.
+Handlers are attached under a name, which should be the name of the plugin, and a hook only accepts one handler per name.
+An error thrown by a handler is logged and does not affect the other handlers, the same goes for handlers that take more than 15 seconds to complete.
+
+For TypeScript the context types are exported as `ControllerPluginContext`, `HostPluginContext`, `InstancePluginContext`, `CtlPluginContext` and `WebPluginContext` from their respective packages.
+
+### Class based plugins
+
+Plugins written as classes deriving from `BaseControllerPlugin`, `BaseHostPlugin`, `BaseInstancePlugin`, `BaseCtlPlugin` or `BaseWebPlugin` still load, but this way of defining plugins is deprecated and a warning is logged when such a plugin is loaded.
+The base class constructor attaches the `on*` methods overridden by the plugin to the corresponding hooks, and the async `init` method is called immediately after.
+See [Migrating Plugins to 2.0](devs/plugin-migration-to-2.0.md) for how to convert them.
+
+
+## Logging Messages
+
+The load context provides a winston logger for logging messages to the shared cluster log.
+For instances a copy of the log is also stored on the host the instance is on.
+To use it, pass a string to one of the log levels functions, for example:
+
+```js
+export default async function(context) {
+    context.logger.info("Initializing frobbing");
+}
+```
+
+Metadata covering which plugin and instance (for instance entrypoints) the log event happened on will automatically be attached to the log message.
+
+The available levels are fatal, error, warn, audit, info, and verbose.
+These levels have roughly the following meanings:
+
+- fatal: Unrecoverable error that prevents continuing execution of the Node.js process.
+  Note that Plugins shouldn't have fatal errors.
+- error: An unexpected error condition occured, usually an exception thrown when it wasn't expected.
+  Should be investigated and fixed.
+- warn: An potential error was detected, but operation continued gracefully.
+  These may indicate that something is running sub-optimally, or is not working as intedend.
+- audit: Record of actions performed by users of the cluster.
+  This is usually emitted in response to management requests by a control link.
+- info: A general log message.
+  May indicae a status or operation completed.
+  This should not be emitted by periodic tasks that run often.
+- verbose: A verbose log message which might be useful when investigating issues, does not show by default.
+  Note that logging messages is not a cheap operation even when the messages do not show up and spammy logging should be avoided for the verbose level.
+  If the logs are still valuable in certain cases consider putting them behind a config option.
+
+For guarding unexpected errors the best option is to log a short description along with the`stack` property of the Error:
+
+```js
+try {
+    // Operation that should not throw but may end up throwing
+} catch (err) {
+    logger.error(`Operation failed:\n${err.stack}`);
+)
+```
+
+For plugin hooks expections thrown are automatically catched and logged, but for event handlers registered on EventEmitters it's critical that exceptions are catched and handled appropriately.
+
+
+## Plugin Configuration
+
+Clusterio provides a configuration system that handles storing, distributing, editing and validating config fields for you.
+You can take advantage of it by declaring config fields under either `controllerConfigFields` or `instanceConfigFields` in the `plugin` export.
+For example in index.js:
+
+```ts
+import type * as lib from "@clusterio/lib";
+
+declare module "@clusterio/lib" {
+    // Extend the interface defining available fields so that instance.config.get(...)
+    // will have our own options.
+    export interface ControllerConfigFields {
+        "foo_frobber.level": number, // If optional is true then this should have | null in addition.
+    }
+}
+
+export const plugin = {
+    ...
+    controllerConfigFields: {
+        "foo_frobber.level": {
+            description: "Level of frobnication done",
+            type: "number",
+            initialValue: 2,
+        },
+    }
+} satisfies lib.PluginDeclaration;
+```
+
+The controller entrypoint will then be able to access the level config field through the `Config` object at `controller.config`:
+
+```ts
+export default async function(context: ControllerPluginContext) {
+    const level = context.controller.config.get("foo_frobber.level");
+    context.logger.info(`I got a frobnication level of ${level}`);
+}
+```
+
+The same applies for instance configs, replace "controller" with "instance" where appropriate.
+See [Configuration System](config-system.md) for more details on how this system works.
+
+
+### Handling Invalid Configuration
+
+If the plugin requires save patching or script commands to function, which can be disabled to run vanilla or scenarios not compatible with Clusterio, declare it under `features` in the `plugin` export:
+
+```js
+export const plugin = {
+    name: "foo_frobber",
+    // ...
+    features: ["SavePatching"],
+};
+```
+
+Enabling the plugin on an instance that has the feature turned off then fails config validation, so the mistake is caught when the config is edited instead of when the instance starts.
+
+Other constraints on config fields are expressed with a `validator` on the field definition, which throws when the value is not acceptable.
+Use `dependsOn` when the check involves other fields so that the validator runs when those change too.
+See [Configuration System](config-system.md) for details.
+
+
+## Plugin Permissions
+
+Permissions are granted to roles and checked on users, both on the controller and in the web UI.
+A plugin declares the permissions it uses under `permissions` in the `plugin` export.
+Names must start with the plugin name followed by a dot.
+For example in index.ts:
+
+```ts
+import type * as lib from "@clusterio/lib";
+
+declare module "@clusterio/lib" {
+    // Extend the interface of known permission names so that
+    // user.checkPermission(...) accepts our permission.
+    export interface Permissions {
+        "foo_frobber.frobnicate": never;
+    }
+}
+
+export const plugin = {
+    ...
+    permissions: [
+        {
+            name: "foo_frobber.frobnicate",
+            title: "Frobnicate",
+            description: "Run frobnication on instances.",
+            grantByDefault: false, // Whether the generated Player role is granted this permission
+        },
+    ],
+} satisfies lib.PluginDeclaration;
+```
+
+The `Permissions` interface only exists at the type level, its values are always `never` and only the keys are used.
+Adding your permission names to it gives you autocomplete and a compile error on typos when calling `user.checkPermission`, `account.hasPermission` or setting the `permission` of a web UI page.
+In JavaScript the `declare module` block is not needed.
+
+Permissions declared this way are registered when the plugin is loaded.
+The older `lib.definePermission()` function still works, but a plugin should not use both for the same permission name.
+
+
+## Migrating Stored Data
+
+Clusterio stores the config fields and permissions of plugins, so a plugin that renames them needs to migrate the stored values or users lose what they had set.
+This is done from the migration entrypoint, which is loaded on the controller and hosts before any config or role is read, for all plugins in the plugin list including those disabled with `load_plugin`.
+It is passed a context with `hooks` and attaches handlers for the data it needs to migrate:
+
+```js
+import * as lib from "@clusterio/lib";
+
+export default function(context) {
+    const { hooks, plugin } = context;
+    // Plugin was renamed from frobber in 2.0.0
+    const renameFields = config => lib.renameConfigPrefix(config, "frobber.", "foo_frobber.");
+    hooks.controllerConfig.attach(plugin.name, renameFields);
+    hooks.hostConfig.attach(plugin.name, renameFields);
+    hooks.instanceConfig.attach(plugin.name, renameFields);
+    hooks.role.attach(plugin.name, role => lib.renamePermissionPrefix(role, "frobber.", "foo_frobber."));
+}
+```
+
+The handlers get the serialized config or role after the core migrations and return the migrated version.
+They run synchronously, a handler that throws stops the controller or host from starting.
+`lib.renameConfigField`, `lib.renameConfigPrefix`, `lib.renamePermission` and `lib.renamePermissionPrefix` cover the common case of renaming.
+
+Handlers run every time the data is loaded and must leave data that is already migrated unchanged.
+For changes that can't be repeated, each config has a hidden `<plugin>.version` field with the version of the plugin it was last loaded with, which is updated after the migrations have run:
+
+```js
+hooks.instanceConfig.attach(plugin.name, config => {
+    const version = config["foo_frobber.version"];
+    // The default delay went from 1 to 2 in 1.2.0, update configs still on the old default
+    if (
+        version && lib.integerFullVersion(version) < lib.integerFullVersion("1.2.0")
+        && config["foo_frobber.delay"] === 1
+    ) {
+        config["foo_frobber.delay"] = 2;
+    }
+    return config;
+});
+```
+
+The version field is missing or empty in configs saved before Clusterio tracked it, and in configs last loaded in recovery mode.
+
+Roles have no version of their own.
+They are stored on the controller, so use the version in the controller config, which is loaded before the roles:
+
+```js
+let controllerVersion;
+hooks.controllerConfig.attach(plugin.name, config => {
+    controllerVersion ??= config["foo_frobber.version"] ?? "";
+    return config;
+});
+hooks.role.attach(plugin.name, role => {
+    // foo_frobber.edit was split out of foo_frobber.view in 1.2.0
+    if (
+        controllerVersion && lib.integerFullVersion(controllerVersion) < lib.integerFullVersion("1.2.0")
+        && role.permissions.includes("foo_frobber.view")
+    ) {
+        role.permissions.push("foo_frobber.edit");
+    }
+    return role;
+});
+```
+
+Data the plugin stores itself, like files in the database directory or values in the save, is up to the plugin to migrate from its other entrypoints.
+Modules don't need migrating, save patching replaces the files of every module when an instance starts.
+
+
+## Communicating with Factorio
+
+For pushing data into Factorio there's RCON, which lets you send arbitrary Lua commands to invoke whatever code you want in the game.
+This is done by calling the `sendRcon` method on the instance.
+For example:
+
+```js
+instance.hooks.start.attach(plugin.name, async () => {
+    const response = await instance.sendRcon(
+        "/sc rcon.print('data')"
+    );
+
+    // Do stuff with response.
+});
+```
+
+Because data into Factorio is streamed at a rate of 3-6 kB/s by default, it is recommended to avoid sending large commands as much as possible, and to strip down the data on the ones you send to only what's strictly necessary.
+You can have lua code injected into the game via the module system and call that from RCON to avoid having to send code through the commands.
+
+For getting data out from Factorio there's both RCON and the `send_json` API of the Clusterio module.
+Returning data via RCON is prefered if the action is initiated from the Node.js side.
+The `send_json` API allows sending JSON payloads on channels that plugins can listen to.
+From a plugin you listen for an event named `ipc-channel_name` in order to get data sent by `send_json`.
+For example in the plugin code:
+
+```js
+export default async function(context) {
+    const { instance, logger } = context;
+    instance.server.on("ipc-my_plugin_foo", content =>
+        handleFoo(content).catch(err => logger.error(
+            `Error handling foo:\n${err.stack}`
+        ))
+    );
+}
+
+async function handleFoo(content) {
+    // Do stuff with content
+}
+```
+
+And then in the module for the plugin:
+
+```lua
+local clusterio_api = require("modules/clusterio/api")
+
+-- inside some event handler
+clusterio_api.send_json("my_plugin_foo", { data = 123 })
+```
+
+For convience a helper function is exposed on server specifically for handling IPC events.
+
+```js
+export default async function(context) {
+    context.instance.server.handle("my_plugin_foo", handleFoo);
+}
+
+async function handleFoo(content) {
+    // Do stuff with content
+}
+```
+
+**Note:** This only handles IPC events, all other events must use `on`. You should not include the `ipc-` prefix when using this method. Error logging is handled for you, if you want custom error handling use `on`.
+
+It's recommended to either use the plugin name as the channel name or to prefix the channel name with the name of the plugin if you need multiple channels.
+It's also important to catch any errors that might occur as they will otherwise be propogated to the instance code and kill the server.
+
+Data out from Factorio does not have the same limits as data into Factorio, RCON responses can be in 100kB range without causing issues, and payloads to the `send_json` API can be in the 4MB range provided the server has a fast enough storage system.
+
+**Note:** both `send_json` and RCON can operate out of order.
+For `send_json` it's possible that payloads greater than 4kB are received after payloads that were sent at a later point in time.
+For RCON, commands longer than 50 characters may end up being executed after shorter commands sent after it.
+
+
+## Defining Link Messages
+
+You will most likely have to communicate with the controller or other instances in your plugin for it to do anything useful.
+For this there's a WebSocket communication channel established between the hosts and the controller that plugins can define their own messages to send over it.
+This channel is bi-directional and all messages sent over it are validated with a JSON schema (see [this guide][guide] for an introduction to writing JSON schema).
+
+[guide]: https://json-schema.org/learn/getting-started-step-by-step.html
+
+There are currently two kinds of messages that can be defined: events and requests.
+Events are simple one-way notifications that invoke a handler on the target it's sent to.
+Requests are pairs of request and response messages where the request is sent to the target and the response is the reply back from the target.
+The requests are similar to HTTP requests, except both parties of a link may initiate one.
+
+Messages are defined as items of the `plugin.messages` array exported by `index.js`.
+For example, the following could be defined in `plugin`:
+
+```js
+messages: [
+    class Frobnicate {
+        static plugin = "foo_frobber"; // Plugin name
+        static type = "request";
+        static src = "controller";
+        static dst = "instance";
+        static jsonSchema = {
+            type: "object",
+            properties: {
+                "verbosity": { type: "integer" },
+                "special": { type: "boolean" },
+            },
+            required: ["verbosity"],
+            additionalProperties: false,
+        };
+        constructor(json) {
+            this.verbosity = json.verbosity;
+            this.special = json.special;
+        }
+        static fromJSON(json) {
+            return new Frobnicate(json);
+        }
+        toJSON() {
+            return {
+                verbosity: this.verbosity,
+                special: this.special,
+            };
+        }
+        static Response = {
+            jsonSchema: {
+                type: "object",
+                properties: {
+                    "report": {
+                        type: "array",
+                        items: { type: "string" },
+                    },
+                },
+            },
+            fromJSON(json) {
+                return json
+            }
+        }
+    }
+]
+```
+
+This specifies a request that can be sent from the controller to an instance, being routed through the correct host behind the scenes.
+The request data must contain the property `verbosity` with an integer number as the value, and it may also contain a boolean `special` property.
+It also defines that the response sent may contain a `report` property mapping to an array of strings.
+
+The following properties are recognized as part of a message class:
+
+#### static plugin
+
+Must contain the name of the plugin this message is defined by.
+This property is not used in core messages.
+
+#### static type
+
+A string describing the message type sent over the wire.
+This can be either `"request"` or `"event"`.
+The primary difference is whether they allow for a response.
+
+#### static src
+
+A string or an array of strings describing where this message is allowed to originate from.
+The available endpoints are `"controller"`, `"host"`, `"instance"`, or `"control"`.
+Messages sent from a different source will be rejected.
+
+#### static dst
+
+A string or array of strings describing where this message may be addressed to.
+The available endpoints are `"controller"`, `"host"`, `"instance"`, or `"control"`.
+If the target is multiple hops away it the message will be forwarded towards its destination by the intermediaries.
+For example a message sent from a control connection an instance will be forwarded by the controller to the relevant host and from the host to the correct instance.
+Messages sent to a different destination will be rejected.
+
+#### static jsonSchema
+
+A JSON schema that specifies what's valid to send in the message.
+
+#### toJSON
+
+Optional method to serialize an instance of the class to a JSON object, see the [documentation for `JSON.stringify()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify#description) for the semantics of this method.
+This should return an object that's valid according to `jsonSchema` and accepted by `fromJSON`, and may be omitted if the default serialisation by `JSON.stringify()` already does this.
+
+#### static fromJSON
+
+Required function to restore the class from a JSON object.
+This function is called when the message reaches its destination and is expected to return an identical instance of the class.
+I.e. the result of `fromJSON(JSON.parse(JSON.stringify(instance)))` should be a complete copy of the message.
+
+#### static Response
+
+Optional [JSON sterilisable class](/docs/devs/json-serialisable-classes.md) that specifies the response to the request.
+Required properties are `jsonSchema` and `fromJSON`.
+
+## Sending Link Messages
+
+Link messages are sent by calling the `.sendTo()` method on a connection object with the destination and the data you want to send, where the data is an instance of one of the defined message classes in plugin.messages.
+For example:
+
+```js
+// In an instance entrypoint
+async function frobnicate(instance) {
+    const response = await instance.sendTo("controller", new messages.Frobnicate({ 
+        verbosity: 2,
+        special: false,
+    }));
+    console.log(response); // { report: [...] }
+}
+```
+Because the send and handle methods rely on this, you should always call them directly on the connection object.
+
+If you extract them into a variable, destructure them, or pass them as unbound callbacks, they lose their this context. The method will eventually crash with an error like Cannot read properties of undefined (reading 'sendRequest').
+
+While it's fine to type cast a direct method invocation, casting and then storing the result causes that same dangerous loss of context.
+
+Here is what that looks like in practice:
+
+```js
+// ❌ BAD: The extracted method loses its `this` binding and crashes when called.
+const send = instance.sendTo;
+send("controller", new messages.Frobnicate({ foo: "bar" }));
+
+// ✅ GOOD: Call it directly on the connection object. (Cast args/results here if needed).
+instance.sendTo("controller", new messages.Frobnicate({ foo: "bar" }));
+
+// ✅ GOOD: Explicitly bind the receiver if you need to pass a method as a value (like a handler).
+instance.handle(messages.Frobnicate, plugin.handleFrobnicate.bind(plugin));
+```
+
+For classes with `static type = "request"` the send method is async and returns a promise that resolves to the response data received from the target it was sent to, or rejects with an error if the request failed.
+The destination specification can either be the ID of a particular control, host or instance, or one of the keywords used to send to multiple targets at once.
+
+Example destinations:
+
+```js
+sendTo("controller", message);
+sendTo("allHosts", message);
+sendTo("allControls", message);
+sendTo("allInstances", message);
+sendTo({ hostId: 123 }, message);
+sendTo({ instanceId: 123 }, message);
+sendTo({ controlId: 123 }, message);
+```
+
+### Handling connection events
+
+There are a few connection related events that plugins neeed to repsond to in order to avoid data loss and connection problems.
+The most important is the prepare disconnect for the link between controller and host.
+This is signaled to controller plugins via the `prepareHostDisconnect` hook and to instance plugins via the `prepareControllerDisconnect` hook.
+
+After the prepare disconnect the connection will be closed, which will result in pending requests and events being dropped.
+Plugins must respond to the prepare disconnect by stopping any processess it does that send events or requests over the link in question.
+This can be accomplished either through listening for the prepare disconnect hook, or by checking the `connected` property of the `HostConnection` class and `Host` class on the controller and host respectively.
+For example the sending of an event from an instance plugin can be stopped while the connection is not connected, not in the dropped state, and not in the process of discunnecting by using the following code:
+
+```js
+if (host.connected) {
+    instance.sendTo("controller", new messages.Frobnicate({ foo: "bar" }));
+}
+```
+
+If the event or request needs to be sent to the controller it can be put into a queue and sent out when the connection is established again.
+The re-establishement of the connection is  notified to plugins via the `connect` event to the `controllerConnectionEvent` and `hostConnectionEvent` hooks.
+
+The second connection event which is of lesser importance to respond to is the `drop` connection event served through `controllerConnectionEvent` for instance plugins and through `hostConnectionEvent` for controller plugins.
+This is raised when the connection between the controller and host in question is lost, most likely due to networking issues.
+When in the dropped state the host will keep trying to reconnect to the controller in order to re-establish it, and if successful no events or requests will be lost.
+However while in the dropped state any requests and events sent gets queued up in memory until the connection is either re-established or the session times out.
+This means that if your plugin sends a lot of events or requests, they can end up being queued up in a buffer and sent out all at once the connection is re-estabished.
+To avoid this you should be throtteling and/or stopping your requests/events after `drop` has been raised, and continue back as normal when `resume` is raised.
+
+
+## Collecting Statistics
+
+Clusterio comes with its own Prometheus client implementation, one part due to Not Invented Here and another part due to collectors in prom-client being difficult to get to work nicely with collecting data from plugins optionally loaded at runtime on different computers.
+
+In its simplest form collecting data from plugins consists of defining the metric and updating it somewhere in the plugin code.
+For example:
+
+```js
+import { Counter } from "@clusterio/lib";
+
+const fooMetric = new Counter(
+    "clusterio_foo_frobber_foo_metric", "Measures the level of foo",
+);
+
+// Somewhere in the controller plugin code
+fooMetric.inc();
+```
+
+This works for controller plugins, and the metric will be automatically available through the /metrics HTTP endpoint.
+It's recommended that plugin metrics follow `clusterio_<plugin_name>_<metric_name>` as the naming scheme.
+
+For metrics that are per-instance, you must define an `instance_id` label and set it accordingly, for example:
+
+```js
+import { Counter } from "@clusterio/lib";
+
+const barMetric = new Gauge(
+    "clusterio_foo_frobber_bar_metric", "Bar instance level",
+    { labels: ["instance_id"] }
+);
+
+// Somewhere in the instance plugin code
+barMetric.labels(String(instance.id)).set(someValue);
+```
+
+Metrics are automatically registered to the default registry, and this default registry is automatically polled by the controller on hosts.
+This means that it's important that you place the definition of the metric at module level so that it's not created more than once over the lifetime of a host.
+Since the metrics remember their values and would continue to be exported after an instance is shutdown, there's code at instance shutdown that removes all the values where the `instance_id` label matches the id of the instance shut down.
+
+For statistics you need to update on collection there's a `metrics` hook on the controller, host and instance that is run before the metrics in the default registry are collected.
+
+```js
+import { Gauge } from "@clusterio/lib";
+
+const frobnicationsMetric = new Gauge(
+    "clusterio_foo_frobber_frobnications", "Frobnications currently in progress"
+);
+
+// In the controller entrypoint
+controller.hooks.metrics.attach(plugin.name, async () => {
+    frobnicationsMetric.set(frobnications.size);
+});
+```
+
+A handler may also return the results of collecting collectors that are not in the default registry, and they are added to the response.
+
+```js
+import { CollectorRegistry, Counter } from "@clusterio/lib";
+
+const fooRegistry = new CollectorRegistry();
+const fooCounter = new Counter("clusterio_foo_frobber_foos", "Foos frobbed", { register: false });
+fooRegistry.register(fooCounter);
+
+controller.hooks.metrics.attach(plugin.name, async () => fooRegistry.collect());
+```
+
+
+## Adding Custom Commands to clusterioctl
+
+The ctl entrypoint for plugins allows you to extend clustectl with your own commands.
+The creation of custom commands typically starts with defining a command tree for the plugin:
+
+```js
+import { Command, CommandTree } from "@clusterio/lib";
+const fooFrobberCommands = new CommandTree({
+    name: "foo-frobber", description: "Foo Frobber Plugin commands"
+});
+```
+
+Then commands are added to the the plugin's command tree:
+
+```js
+import * as messages from "./messages.js";
+
+fooFrobberCommands.add(new Command({
+    definition: ["frobnicate <type>", "Do frobnications", (yargs) => {
+        yargs.positional("type", {
+            describe: "type of frobnication", type: "string"
+        });
+    }],
+    handler: async function(args, ctl) {
+        await ctl.sendTo("controller", new messages.FrobnicateRequest(args.type));
+    },
+}));
+```
+
+For a command the `definition` is the arguments to pass to [yargs.command](http://yargs.js.org/docs/#api-reference-commandcmd-desc-builder-handler) (see also [yargs.positional](http://yargs.js.org/docs/#api-reference-positionalkey-opt) and [yargs.options](http://yargs.js.org/docs/#api-reference-optionskey-opt) for setting up positional and optional arguments to commands).
+The `handler` is an async function that's invoked when the command is executed and it's passed the parsed command line arguments and a reference to the `Ctl` class of clusterioctl.
+Note that messages sent from clusterioctl needs to have `"control"` as a part of `src` for it to be accepted by the controller, see [Defining Link Messages](#defining-link-messages) for how to define the messages that can be sent to the controller.
+
+To have the command tree become part of clusterioctl it needs to be added to the rootCommand tree in the `addCommands` hook of the ctl entrypoint:
+
+```js
+export default async function(context) {
+    context.hooks.addCommands.attach(context.plugin.name, async (rootCommand) => {
+        rootCommand.add(fooFrobberCommands);
+    });
+}
+```

documentation.yml

@@ -1,10 +0,0 @@
-toc:
- - name: Master Server API
- - clusterioMaster
- - name: Type declarations
- - itemStack
- - name: Internal modules
-   description: |
-     Here are some helper functions for navigation.
- - modManager
- - getFactorioLocale

eslint.config.mjs

@@ -0,0 +1,504 @@
+import {
+	defineConfig,
+	globalIgnores,
+} from "eslint/config";
+
+import typescriptEslint from "@typescript-eslint/eslint-plugin";
+import node from "eslint-plugin-node";
+import globals from "globals";
+import tsParser from "@typescript-eslint/parser";
+import js from "@eslint/js";
+import stylistic from "@stylistic/eslint-plugin";
+
+import {
+	FlatCompat,
+} from "@eslint/eslintrc";
+
+const compat = new FlatCompat({
+	baseDirectory: import.meta.dirname,
+	recommendedConfig: js.configs.recommended,
+	allConfig: js.configs.all,
+});
+
+export default defineConfig([{
+	plugins: {
+		"@typescript-eslint": typescriptEslint,
+		"@stylistic": stylistic,
+		node,
+	},
+
+	languageOptions: {
+		globals: {
+			...globals.node,
+			...globals.commonjs,
+		},
+	},
+
+	"rules": {
+		"@stylistic/indent": ["error", "tab", {
+			"ignoredNodes": [
+				"JSXFragment", // TODO: Linter crashes if this is removed
+			],
+			"ignoreComments": true,
+			"SwitchCase": 1, // Indent case statements one level from switch
+		}],
+		"accessor-pairs": "error",
+		"array-bracket-newline": "off",
+		"array-bracket-spacing": ["error", "never"],
+		"array-callback-return": "error",
+		"array-element-newline": "off",
+		"arrow-body-style": "error",
+		"arrow-parens": "off",
+
+		"arrow-spacing": ["error", {
+			"after": true,
+			"before": true,
+		}],
+
+		"block-scoped-var": "error",
+		"block-spacing": "error",
+
+		"brace-style": ["error", "1tbs", {
+			"allowSingleLine": true,
+		}],
+
+		"camelcase": "off",
+		"capitalized-comments": "off",
+		"class-methods-use-this": "off",
+
+		"comma-dangle": ["error", {
+			"arrays": "always-multiline",
+			"objects": "always-multiline",
+			"imports": "always-multiline",
+			"exports": "always-multiline",
+			"functions": "only-multiline",
+		}],
+
+		"comma-spacing": "error",
+		"comma-style": ["error", "last"],
+		"complexity": ["error", { "max": 25 }],
+		"computed-property-spacing": ["error", "never"],
+		"consistent-return": "error",
+		"consistent-this": "error",
+		"curly": "error",
+		"default-case": "error",
+		"default-case-last": "error",
+		"default-param-last": "off",
+		"dot-location": ["error", "property"],
+
+		"dot-notation": ["error", {
+			"allowPattern": "^[a-z]+(_[a-z]+)*$",
+		}],
+
+		"eol-last": "error",
+		"eqeqeq": "error",
+		"func-call-spacing": "error",
+		"func-name-matching": "error",
+		"func-names": "off",
+
+		"func-style": ["error", "declaration", {
+			"allowArrowFunctions": true,
+		}],
+
+		"function-call-argument-newline": "off",
+		"function-paren-newline": "off",
+
+		"generator-star-spacing": ["error", {
+			"before": false,
+			"after": true,
+		}],
+
+		"grouped-accessor-pairs": "error",
+		"guard-for-in": "error",
+		"id-blacklist": "error",
+		"id-length": "off",
+		"id-match": "error",
+		"implicit-arrow-linebreak": "error",
+
+		"indent-legacy": "off",
+		"init-declarations": "off",
+		"jsx-quotes": "error",
+		"key-spacing": "error",
+		"keyword-spacing": "error",
+		"line-comment-position": "off",
+		"linebreak-style": ["error", "unix"],
+		"lines-around-comment": "off",
+		"lines-around-directive": "off",
+
+		"lines-between-class-members": ["error", "always", {
+			"exceptAfterSingleLine": true,
+		}],
+
+		"max-classes-per-file": "off",
+		"max-depth": "error",
+
+		"max-len": ["error", {
+			"code": 120,
+		}],
+
+		"max-lines": "off",
+		"max-lines-per-function": "off",
+		"max-nested-callbacks": "error",
+		"max-params": "off",
+		"max-statements": "off",
+		"max-statements-per-line": "off",
+		"multiline-comment-style": ["error", "separate-lines"],
+		"multiline-ternary": "off",
+
+		"new-cap": ["error", {
+			"capIsNewExceptions": ["StringEnum", "StringKey"],
+			"capIsNewExceptionPattern": "^Type\\.",
+			"newIsCapExceptions": ["constructor"],
+		}],
+
+		"new-parens": "error",
+		"newline-after-var": "off",
+		"newline-before-return": "off",
+		"newline-per-chained-call": "off",
+		"no-alert": "error",
+		"no-array-constructor": "error",
+		"no-await-in-loop": "off",
+		"no-bitwise": "off",
+		"no-buffer-constructor": "error",
+		"no-caller": "error",
+		"no-catch-shadow": "off",
+		"no-confusing-arrow": "error",
+		"no-console": "error",
+
+		"no-constant-condition": ["error", {
+			"checkLoops": false,
+		}],
+
+		"no-constructor-return": "error",
+		"no-continue": "off",
+		"no-div-regex": "error",
+		"no-duplicate-imports": "error",
+		"no-else-return": "error",
+		"no-empty-function": "off",
+		"no-eq-null": "error",
+		"no-eval": "error",
+		"no-extend-native": "error",
+		"no-extra-bind": "error",
+		"no-extra-label": "error",
+		"no-extra-parens": "off",
+		"no-floating-decimal": "error",
+		"no-implicit-coercion": "error",
+		"no-implicit-globals": "error",
+		"no-implied-eval": "error",
+		"no-inline-comments": "off",
+		"no-invalid-this": "error",
+		"no-iterator": "error",
+		"no-label-var": "error",
+		"no-lone-blocks": "error",
+		"no-lonely-if": "error",
+		"no-loop-func": "error",
+		"no-magic-numbers": "off",
+
+		"no-mixed-operators": ["error", {
+			"groups": [
+				["&", "|", "^", "~", "<<", ">>", ">>>"],
+				["==", "!=", "===", "!==", ">", ">=", "<", "<="],
+				["in", "instanceof"],
+			],
+		}],
+
+		"no-multi-assign": "error",
+		"no-multi-spaces": "error",
+		"no-multi-str": "error",
+		"no-multiple-empty-lines": "error",
+		"no-native-reassign": "error",
+		"no-negated-condition": "off",
+		"no-negated-in-lhs": "error",
+		"no-nested-ternary": "error",
+		"no-new": "error",
+		"no-new-func": "error",
+		"no-new-object": "error",
+		"no-new-wrappers": "error",
+		"no-octal-escape": "error",
+		"no-param-reassign": "off",
+
+		"no-plusplus": ["error", {
+			"allowForLoopAfterthoughts": true,
+		}],
+
+		"no-proto": "error",
+		"no-restricted-exports": "error",
+		"no-restricted-globals": "error",
+		"no-restricted-imports": "error",
+		"no-restricted-properties": "error",
+		"no-restricted-syntax": "error",
+		"no-return-assign": "error",
+		"no-return-await": "off",
+		"no-script-url": "error",
+		"no-self-compare": "error",
+		"no-sequences": "error",
+
+		"no-shadow": ["error", {
+			"allow": ["Event", "Request", "yargs"],
+		}],
+
+		"no-spaced-func": "error",
+
+		"no-tabs": "off",
+
+		"no-template-curly-in-string": "error",
+		"no-ternary": "off",
+		"no-throw-literal": "error",
+		"no-trailing-spaces": "error",
+		"no-undef-init": "error",
+		"no-undefined": "off",
+		"no-unmodified-loop-condition": "error",
+		"no-unneeded-ternary": "error",
+		"no-unused-expressions": "error",
+		"no-use-before-define": "off",
+		"no-useless-backreference": "error",
+		"no-useless-call": "error",
+		"no-useless-computed-key": "error",
+		"no-useless-concat": "error",
+		"no-useless-constructor": "off",
+		"no-useless-rename": "error",
+		"no-useless-return": "error",
+		"no-var": "error",
+
+		"no-void": ["error", {
+			"allowAsStatement": true,
+		}],
+
+		"no-warning-comments": "off",
+		"no-whitespace-before-property": "error",
+		"nonblock-statement-body-position": "error",
+		"object-curly-newline": "error",
+		"object-curly-spacing": "off",
+		"object-shorthand": "off",
+		"one-var": "off",
+		"one-var-declaration-per-line": "error",
+		"operator-assignment": "off",
+
+		"operator-linebreak": ["error", "after", {
+			"overrides": {
+				"?": "before",
+				":": "before",
+				"||": "before",
+				"&&": "before",
+				"??": "before",
+			},
+		}],
+
+		"padded-blocks": "off",
+		"padding-line-between-statements": "error",
+		"prefer-arrow-callback": "error",
+		"prefer-const": "off",
+		"prefer-destructuring": "off",
+		"prefer-exponentiation-operator": "error",
+		"prefer-named-capture-group": "off",
+		"prefer-numeric-literals": "error",
+		"prefer-object-spread": "error",
+		"prefer-promise-reject-errors": "error",
+		"prefer-reflect": "off",
+		"prefer-regex-literals": "error",
+		"prefer-rest-params": "error",
+		"prefer-spread": "error",
+		"prefer-template": "error",
+		"quote-props": "off",
+
+		"quotes": ["error", "double", {
+			"avoidEscape": true,
+		}],
+
+		"radix": ["error", "always"],
+		"require-atomic-updates": "off",
+		"require-await": "off",
+		"require-jsdoc": "off",
+		"require-unicode-regexp": "off",
+		"rest-spread-spacing": ["error", "never"],
+		"semi": "error",
+		"semi-spacing": "error",
+		"semi-style": "off",
+		"sort-imports": "off",
+		"sort-keys": "off",
+		"sort-vars": "off",
+		"space-before-blocks": "error",
+		"space-before-function-paren": "off",
+		"space-in-parens": ["error", "never"],
+		"space-infix-ops": "off",
+		"space-unary-ops": "error",
+
+		"spaced-comment": ["error", "always", {
+			"line": {
+				"markers": ["/"],
+			},
+		}],
+
+		"switch-colon-spacing": "error",
+		"symbol-description": "error",
+		"template-curly-spacing": ["error", "never"],
+		"template-tag-spacing": "error",
+		"unicode-bom": ["error", "never"],
+
+		"vars-on-top": "error",
+		"wrap-iife": "error",
+		"wrap-regex": "off",
+		"yield-star-spacing": "error",
+
+		"yoda": ["error", "never", {
+			"exceptRange": true,
+		}],
+
+		"node/callback-return": "off",
+		"node/exports-style": "off",
+		"node/file-extension-in-import": "off",
+		"node/global-require": "off",
+		"node/handle-callback-err": "off",
+		"node/no-callback-literal": "off",
+		"node/no-deprecated-api": "off",
+		"node/no-exports-assign": "off",
+		"node/no-extraneous-import": "off",
+		"node/no-extraneous-require": "off",
+
+		"node/no-missing-import": "off",
+
+		"node/no-missing-require": "off",
+		"node/no-mixed-requires": "off",
+		"node/no-new-require": "off",
+		"node/no-path-concat": "off",
+		"node/no-process-env": "off",
+		"node/no-process-exit": "off",
+		"node/no-restricted-require": "off",
+		"node/no-sync": "error",
+		"node/no-unpublished-bin": "off",
+		"node/no-unpublished-import": "off",
+
+		"node/no-unpublished-require": "off",
+
+		"node/no-unsupported-features/es-builtins": "off",
+		"node/no-unsupported-features/es-syntax": "off",
+		"node/no-unsupported-features/node-builtins": "off",
+		"node/prefer-global/buffer": "off",
+		"node/prefer-global/console": "off",
+		"node/prefer-global/process": "off",
+		"node/prefer-global/text-decoder": "off",
+		"node/prefer-global/text-encoder": "off",
+		"node/prefer-global/url-search-params": "off",
+		"node/prefer-global/url": "off",
+		"node/prefer-promises/dns": "off",
+		"node/prefer-promises/fs": "off",
+		"node/process-exit-as-throw": "off",
+
+		"node/shebang": "off",
+	},
+}, {
+	files: ["{packages,plugins}/**/*.ts?(x)"],
+
+	languageOptions: {
+		parser: tsParser,
+	},
+
+	extends: compat.extends("plugin:@typescript-eslint/recommended"),
+
+	"rules": {
+		"@typescript-eslint/no-explicit-any": "off",
+		"@typescript-eslint/no-useless-constructor": "error",
+		"@typescript-eslint/no-unused-vars": "off",
+		"@typescript-eslint/triple-slash-reference": "off",
+
+		"@typescript-eslint/no-shadow": ["error", {
+			"allow": ["Event", "Request", "yargs"],
+		}],
+
+		// Allow require imports where necessary (dynamic loading, webpack configs, etc.)
+		"@typescript-eslint/no-require-imports": "off",
+
+		"prefer-const": "off",
+		"no-shadow": "off",
+	},
+}, {
+	files: ["test/**/*.js", "plugins/*/test/**/*.js"],
+
+	languageOptions: {
+		globals: {
+			...globals.mocha,
+		},
+
+		sourceType: "module",
+		parserOptions: {},
+	},
+
+	"rules": {
+		"prefer-arrow-callback": "off",
+		"no-invalid-this": "off",
+		"node/no-unpublished-import": "off",
+		"node/no-unpublished-require": "off",
+	},
+}, {
+	files: [
+		"packages/web_ui/src/**/*.ts?(x)",
+		"packages/lib/browser.ts",
+		"packages/create/templates/*/web/**/*.{t,j}s?(x)",
+		"{packages,plugins}/*/web/**/*.ts?(x)",
+	],
+
+	languageOptions: {
+		globals: {
+			...globals.browser,
+		},
+
+		"sourceType": "module",
+
+		parserOptions: {
+			"ecmaFeatures": {
+				"jsx": true,
+			},
+		},
+	},
+
+	"rules": {
+		"node/callback-return": "off",
+		"node/exports-style": "off",
+		"node/file-extension-in-import": "off",
+		"node/global-require": "off",
+		"node/handle-callback-err": "off",
+		"node/no-callback-literal": "off",
+		"node/no-deprecated-api": "off",
+		"node/no-exports-assign": "off",
+		"node/no-extraneous-import": "off",
+		"node/no-extraneous-require": "off",
+		"node/no-missing-import": "off",
+		"node/no-missing-require": "off",
+		"node/no-mixed-requires": "off",
+		"node/no-new-require": "off",
+		"node/no-path-concat": "off",
+		"node/no-process-env": "off",
+		"node/no-process-exit": "off",
+		"node/no-restricted-require": "off",
+		"node/no-sync": "error",
+		"node/no-unpublished-bin": "off",
+		"node/no-unpublished-import": "off",
+		"node/no-unpublished-require": "off",
+		"node/no-unsupported-features/es-builtins": "off",
+		"node/no-unsupported-features/es-syntax": "off",
+		"node/no-unsupported-features/node-builtins": "off",
+		"node/prefer-global/buffer": "off",
+		"node/prefer-global/console": "off",
+		"node/prefer-global/process": "off",
+		"node/prefer-global/text-decoder": "off",
+		"node/prefer-global/text-encoder": "off",
+		"node/prefer-global/url-search-params": "off",
+		"node/prefer-global/url": "off",
+		"node/prefer-promises/dns": "off",
+		"node/prefer-promises/fs": "off",
+		"node/process-exit-as-throw": "off",
+		"node/shebang": "off",
+	},
+}, {
+	files: ["packages/create/templates/**/*.?(c){t,j}s?(x)"],
+
+	"rules": {
+		"node/no-missing-require": "off",
+		"node/no-missing-import": "off",
+		"@stylistic/indent": "off",
+		"spaced-comment": "off",
+		"comma-spacing": "off",
+		"max-len": "off",
+		"indent": "off",
+	},
+}, globalIgnores(["**/dist/", "dist/"])]);

external_plugins/.gitignore

@@ -0,0 +1,3 @@
+*
+!.gitignore
+!README.md

external_plugins/README.md

@@ -0,0 +1,4 @@
+# External plugins directory
+
+Plugins placed here will have their npm dependencies incorporated in the shared pnpm storage for this repository when `pnpm install` is invoked.
+Use this to enable `--dev-plugin` to work with plugins developed outside of the Clusterio repository.

lib/authenticate.js

@@ -1,15 +0,0 @@
-const jwt = require('jsonwebtoken');
-
-const config = require("./../config");
-
-var middleware = function (req, res, next) {
-	var token = req.headers['x-access-token'];
-	if(!token) return res.status(401).send({ auth: false, message: 'No token provided.', endpoint: req.route.path});
-	
-	jwt.verify(token, config.masterAuthSecret, function(err, decoded) {
-		if(err) return res.status(500).send({ auth: false, message: 'Failed to authenticate token.', endpoint: req.route.path});
-		next();
-	});
-}
-
-module.exports = {middleware};

lib/generateSSLcert.js

@@ -1,49 +0,0 @@
-var forge = require("node-forge");
-forge.options.usePureJavaScript = true;
-var fs = require("fs");
-var mkdirp = require("mkdirp");
-
-var pki = forge.pki;
-var rsa = forge.pki.rsa;
-var startTime, endTime;
-
-
-
-module.exports = function({
-	bits = 2048,
-	certificatePath = "database/certificate",
-	doLogging = false,
-} = {}){
-	function log(t){
-		if(doLogging) console.log("lib/generateSSLcert.js | "+t);
-	}
-	log("Generating SSL certificate with "+bits+" bits at "+certificatePath);
-
-	startTime = Date.now();
-	var keypair = rsa.generateKeyPair({bits: bits, e: 0x10001});
-	endTime = Date.now();
-	log("Generated 2048bit keypair in: "+(endTime-startTime)+" ms");
-
-	startTime = Date.now();
-	var cert = pki.createCertificate();
-	cert.publicKey = keypair.publicKey;
-	cert.serialNumber = "01";
-
-	cert.validity.notBefore = new Date();
-	cert.validity.notAfter = new Date(Date.now()+(1000*60*60*24*365)); // valid for one year
-
-	// self-sign certificate
-	cert.sign(keypair.privateKey);
-
-	// Convert certificate to pem type and write it to a file
-	if(certificatePath[certificatePath.length-1] != "/") certificatePath += "/";
-	if(!fs.existsSync(certificatePath)) {
-		mkdirp.sync(certificatePath);
-		console.log("Created directory: "+certificatePath);
-	}
-	fs.writeFileSync(certificatePath+ "cert.key", pki.privateKeyToPem(keypair.privateKey));
-	fs.writeFileSync(certificatePath+ "cert.crt", pki.certificateToPem(cert));
-
-	endTime = Date.now();
-	log("Generated certificate in: "+(endTime-startTime)+" ms");
-}

lib/generateSSLcert.spec.js

@@ -1,25 +0,0 @@
-var assert = require("assert");
-var fs = require("fs");
-
-var fileOps = require("_app/fileOps");
-var generateSSLcert = require("./generateSSLcert.js")
-
-describe("generateSSLcert.js(options)", ()=>{
-	it("Creates a folder with a .crt and .key file in it", ()=>{
-		let certPath = "lib/certTestPlsDelete";
-		assert(!fs.existsSync(certPath)); // if it already exsits, the test might pass because of leftover data (which is bad)
-		
-		generateSSLcert({
-			// bits:512, // supported, but I just use the default of 2048 for this test
-			certificatePath:certPath,
-			doLogging: false,
-		});
-		
-		assert(fs.existsSync(certPath));
-		assert(fs.existsSync(certPath+"/cert.key")); // private key
-		assert(fs.existsSync(certPath+"/cert.crt")); // certificate file
-		
-		// remove certificates and data from the test
-		fileOps.deleteFolderRecursiveSync(certPath);
-	}).timeout(10000);
-});

lib/getFactorioLocale.js

@@ -1,53 +0,0 @@
-/**
-Module for grabbing factorio locale from a local factorio install
-@module getFactorioLocale
-*/
-
-const fs = require("fs");
-const ini = require("ini");
-
-const cache = {};
-
-/**
-Gets raw factorio locale from the .ini file.
-Not available outside of module through exports.
-
-@memberof getFactorioLocale
-@inner
-@param {string} factorioDirectory
-@param {string} languageCode
-@param {function} callback
-*/
-function getLocale(factorioDirectory, languageCode, callback){
-	var localeFile = factorioDirectory + '/data/base/locale/' + languageCode + '/base.cfg';
-	fs.readFile(localeFile, "utf8", (err, rawLocale) => {
-		callback(err, rawLocale);
-	});
-}
-
-/**
-Gets factorios locale as an object, does not respect mods.
-
-@param {string} factorioDirectory
-@param {string} languageCode
-@param {function} callback
-*/
-module.exports.asObject = function getLocaleAsObject(factorioDirectory, languageCode, callback){
-	if(typeof factorioDirectory != "string" || typeof languageCode != "string" || typeof callback != "function"){
-		throw new Error("Error: wrong parameters provided");
-	}
-	
-	if(!cache[languageCode]){
-		getLocale(factorioDirectory, languageCode, (err, rawLocale) => {
-			if(err){
-				callback(err);
-			} else {
-				let processedLocale = ini.parse(rawLocale);
-				cache[languageCode] = processedLocale;
-				callback(undefined, processedLocale);
-			}
-		});
-	} else {
-		callback(undefined, cache[languageCode]);
-	}
-}

lib/getFactorioLocale.spec.js

@@ -1,74 +0,0 @@
-const assert = require("assert");
-const getFactorioLocale = require("./getFactorioLocale");
-
-describe("getFactorioLocale.js", () => {
-	describe("asObject()", () => {
-		it("requires 2 strings and a function as parameters", () => {
-			let validate = (err) => {
-				return err == "Error: wrong parameters provided"
-			}
-			let message = "getFactorioLocale is responding incorrectly to invalid arguments"
-			let callback = (err,object) => true;
-			
-			assert.throws(() => getFactorioLocale.asObject(), validate, message);
-			assert.throws(() => getFactorioLocale.asObject("hello", "I forgot my callback"), validate, message);
-			assert.throws(() => getFactorioLocale.asObject(undefined, undefined, callback), validate, message);
-			
-			// the proper way to do it
-			assert.doesNotThrow(() => getFactorioLocale.asObject("factorio_0.15.27", "en", callback), validate, message);
-		});
-		it("returns a nested object with base game locale information", (done) => {
-			getFactorioLocale.asObject("factorio", "en", callback);
-			
-			function callback(err, object){
-				assert.equal(typeof object, "object");
-				assert.equal(object["entity-name"]["fish"], "Fish");
-				assert.equal(object["entity-name"]["small-lamp"], "Lamp");
-				Object.keys(object).forEach(key => {
-					// first level of the nested object is always an object
-					assert.equal(typeof object[key], "object");
-					
-					Object.keys(object[key]).forEach(key2 => {
-						// second level of the nested object is always a string, nearly always truthy
-						if(key2 != "so-long-and-thanks-for-all-the-fish"){
-							assert.ok(object[key][key2]);
-							assert.equal(typeof object[key][key2], "string");
-						}
-					});
-				});
-				done();
-			}
-		});
-		it("has some duplicate keys", (done) => {
-			getFactorioLocale.asObject("factorio", "en", callback);
-			
-			function callback(err, object){
-				let arrayOfKeys = [];
-				// collect all keys in a single array
-				Object.keys(object).forEach(key => {
-					arrayOfKeys.push(key);
-					Object.keys(object[key]).forEach(key2 => {
-						arrayOfKeys.push(key2);
-					});
-				});
-				
-				// check for duplicates
-				let duplicateKeys = [];
-				let i = 0;
-				arrayOfKeys.forEach(key => {
-					let o = 0;
-					arrayOfKeys.forEach(key2 => {
-						if(i != o && key == key2){
-							duplicateKeys.push(key);
-						}
-						o++
-					});
-					i++;
-				});
-				// we got 704 but this is a very unexact number
-				assert(duplicateKeys.length > 10)
-				done();
-			}
-		});
-	});
-});

lib/getInstances.js

@@ -1,15 +0,0 @@
-const fileOps = require("_app/fileOps");
-const config = require("./../config");
-
-module.exports = {
-	sync: function(){
-		let instances;
-		try {
-			instances = fileOps.getDirectoriesSync(config.instanceDirectory);
-		} catch (e) {
-			// there are no instances created yet, probably missing the folder
-			instances = [];
-		}
-		return instances;
-	}
-}

lib/manager/configManager.js

@@ -1,48 +0,0 @@
-/**
-Provides tools for managing both masters and slaves config files.
-@module configManager
-*/
-// require modules
-const asTable = require("as-table").configure({delimiter: ' | '});
-const fs = require("fs");
-
-// internal requires
-var config = require("./../../config");
-const objectOps = require("./../objectOps.js");
-/**
-console.log()s each entry in the config
-
-@param {string} instance Either undefined, "shared" or the instance to show the config for.
-*/
-module.exports.displayConfig = function(instance){
-	if(!instance || instance == "shared"){
-		let configArray = [];
-		Object.keys(config).forEach(key=>{
-			if(key != "__comment"){
-				if(typeof config[key] == "object"){
-					configArray.push({entry: key, value: JSON.stringify(config[key])});
-				} else configArray.push({entry: key, value: config[key]});
-			}
-		});
-		console.log(asTable(configArray));
-	}
-}
-module.exports.editConfig = function(instance, entry, newValue){
-	if(!instance || instance == "shared"){
-		if(config[entry] && newValue){
-			if(objectOps.isJSON(newValue)){
-				config[entry] = JSON.parse(newValue);
-				console.log("Changed config entry "+entry+" from "+JSON.stringify(config[entry])+" to "+JSON.stringify(newValue));
-				console.log("new config file:");
-				console.log(JSON.stringify(config, null, "	"))
-				fs.writeFileSync("config.json", JSON.stringify(config, null, 4));
-			} else {
-				config[entry] = newValue;
-				console.log("Changed config entry "+entry+" from "+config[entry]+" to '"+newValue+"'");
-				console.log("new config file:");
-				console.log(JSON.stringify(config, null, "	"))
-				fs.writeFileSync("config.json", JSON.stringify(config, null, 4));
-			}
-		}
-	}
-};

lib/manager/modManager.js

@@ -1,273 +0,0 @@
-/**
-Provides tools to manage mods in a clusterio install
-@module modManager
-*/
-
-const rightpad = require("right-pad");
-const asTable = require("as-table").configure({delimiter: ' | '});
-const moment = require("moment");
-const syncRequest = require("sync-request");
-const fs = require("fs");
-const https = require('follow-redirects').https;
-const factorioAPI = require("node-factorio-api");
-const sLog = require("single-line-log").stdout;
-const query = require('cli-interact').getYesNo;
-
-const fileOps = require("_app/fileOps");
-const config = require("./../../config");
-
-const instances = require("./../getInstances.js").sync();
-
-function ellipse(str, max){
-   return str.length > (max - 3) ? str.substring(0,max-3) + '...' : str;
-}
-// https://stackoverflow.com/questions/15900485/correct-way-to-convert-size-in-bytes-to-kb-mb-gb-in-javascript
-function formatBytes(a,b){if(0==a)return"0 Bytes";var c=1024,d=b||2,e=["Bytes","KB","MB","GB","TB","PB","EB","ZB","YB"],f=Math.floor(Math.log(a)/Math.log(c));return parseFloat((a/Math.pow(c,f)).toFixed(d))+" "+e[f]};
-
-/**
-Lists mods for an instance as a table. Warning, handles printing internally.
-@param {string} instance - Name of the instance or "shared"
-
-@example
-var modManager = require("modManager");
-modManager.listMods("testInstance");
-// console.logs table of mods installed on instance
-modManager.listMods("shared");
-// console.logs mods located in /sharedMods as a nice table
-*/
-module.exports.listMods = function(instance){
-	return new Promise((resolve, reject) => {
-		if(instance && instances.includes(instance)){
-			factorioAPI.init(false, config.instanceDirectory+'/'+instance+'/instanceMods', config.instanceDirectory+'/'+instance+'/saves', config.factorio_version);
-			factorioAPI.authenticate({
-				username: config.username,
-				token: config.token,
-				require_ownership: false
-			}).then(token => {
-				console.log("* Currently installed:");
-				factorioAPI.readModZips().then(list => {
-					console.log(asTable(list.map(mod => {
-						return {
-							name:(mod.title || mod.name),
-							version:mod.version,
-							date:mod.date,
-							factorio_ver:mod.factorio_version,
-							author:mod.author,
-						}
-					})));
-				});
-				// Had issues earlier due to bug in node-factorio-api, see https://github.com/Danacus/node-factorio-api/issues/2
-				// bug is resolved, thanks to @Danacus and @brotherpot
-				factorioAPI.getModsFromSaves().then(list => {
-					console.log("* Mods used in save:");
-					console.log(asTable(list[0].mods))
-				});
-			}).catch(reason => {
-				console.log("Failed to authenticate to factorio.com! Please check your connection and the username+token used for authentication in config.json");
-				resolve();
-			});
-		} else {
-			// list shared mods in /sharedMods/
-			factorioAPI.init(false, 'sharedMods/', '', config.factorio_version);
-			factorioAPI.authenticate({
-				username: config.username,
-				token: config.token,
-				require_ownership: false
-			}).then(() => {
-				console.log("\r\n")
-				console.log("* Mods shared by all instances:")
-				factorioAPI.getInstalledMods().then(mods => {
-					console.log(asTable(mods));
-					resolve();
-				});
-			}).catch(e => {
-				reject(new Error(e));
-			});
-		}
-		
-		// get JSON data about GH releases
-		/*let res = syncRequest('GET', 'https://api.github.com/repos/Danielv123/factorioClusterioMod/releases', {"headers":{"User-Agent":"Fuck you for requiring user agents!"}});
-		let url = JSON.parse(res.getBody())[0].assets[0].browser_download_url;
-		let name = JSON.parse(res.getBody())[0].assets[0].name;
-		console.log(JSON.parse(res.getBody()))
-		*/
-	});
-}
-/**
-Searches mods.factorio.com for mods matching a search term and prints
-the results to console as a neat looking table
-
-@param {string} searchTerm What to search for
-*/
-module.exports.findMods = function(searchTerm){
-	return new Promise((resolve, reject) => {
-		factorioAPI.init(false);
-		factorioAPI.authenticate({
-			username: config.username,
-			token: config.token,
-			require_ownership: false
-		}).then(token => {
-			factorioAPI.searchMods(searchTerm).then(mods => {
-				let result = asTable(mods.reverse().map(mod => {
-					return {
-						title:ellipse(mod.title, 50),
-						name:ellipse(mod.name, 30),
-						downloads:mod.downloads_count,
-						updated: moment(mod.updated_at).format("DD.MM.YY"),
-						latest_version: mod.latest_release.version,
-						owner:mod.owner,
-						//license: mod.license_name,
-					}
-				}));
-				resolve(result);
-				// console.log(result);
-			});
-		}).catch(e => {
-			if(e.contains("Insufficient information")) console.log("We are missing some parameters required for logging in! Make sure your factorio username and token are specified in config.json.");
-			reject(new Error(e));
-		});
-	});
-}
-
-module.exports.addMod = function(term, instance){
-	return new Promise((resolve, reject) => {
-		if(instance == "shared"){ // modDirectory has to end in /
-			var modDirectory = "sharedMods/";
-		} else {
-		var modDirectory = config.instanceDirectory+"/"+instance+"/instanceMods/";
-		}
-		if(term && term.length > 0){
-			if(term.includes("mods.factorio.com/mods/")){ // https://mods.factorio.com/mods/Danielv123/ChooChoo
-				// treat it as a link download
-				factorioAPI.init(false, modDirectory, "", config.factorio_version);
-				factorioAPI.authenticate({
-					username: config.username,
-					token: config.token,
-					require_ownership: false
-				}).then(() => {
-					factorioAPI.searchMods(term.split("/")[term.split("/").length-1]).then(body => {
-						console.log("Im gonna download: "+body[0].name + " in version: " + body[0].latest_release.version);
-						factorioAPI.downloadMod( {name: body[0].name, version: body[0].latest_release.version}).then(()=>{
-							console.log("Mod downloaded");
-							resolve();
-						});
-					});
-				});
-			} else if(term.includes("github.com")){ // https://github.com/Danielv123/factorioClusterioMod
-				// treat it as a github releases download
-				let apiURL = "https://api.github.com/repos/" + term.split("/")[3] + "/" + term.split("/")[4] + "/releases"; // https://api.github.com/repos/Danielv123/factorioClusterioMod/releases
-				
-				let res = syncRequest('GET', apiURL, {"headers":{"User-Agent":"Fuck you for requiring user agents!"}});
-				let url = JSON.parse(res.getBody())[0].assets[0].browser_download_url;
-				let name = JSON.parse(res.getBody())[0].assets[0].name;
-				if(url) {
-					console.log("Downloading " + url);
-					let file = fs.createWriteStream(modDirectory + name);
-					let bytesDownloaded = 0;
-					let downloadStartTime = Date.now();
-					https.get(url, function(response) {
-						let bytesToDownload = response.headers['content-length'];
-						response.pipe(file);
-						response.on("data", chunk => {
-							bytesDownloaded += chunk.length;
-							let downloadTimeElapsed = Date.now() - downloadStartTime;
-							let bytesPerSecond = bytesDownloaded / (downloadTimeElapsed/1000);
-							let timeToComplete = Math.floor((bytesToDownload - bytesDownloaded)/bytesPerSecond);
-							sLog("Downloading "+name+" "+(bytesDownloaded/bytesToDownload*100).toPrecision(3)+"% ("+formatBytes(bytesDownloaded)+" / "+formatBytes(bytesToDownload)+")\r\n"+
-							"about "+timeToComplete+" seconds remaining ("+formatBytes(bytesPerSecond)+"/s)");
-						}).on("end", x => {
-							sLog.clear();
-							console.log(" Downloaded in "+moment.utc(moment.duration(Date.now()-downloadStartTime).as('milliseconds')).format('mm:ss')); // because sLog.clear() doesn't seem to do the job of ending the line properly
-							resolve();
-						});
-					});
-				}
-			} else {
-				// treat it as a search and download the top result
-				factorioAPI.init(false, modDirectory, "", config.factorio_version);
-				factorioAPI.authenticate({
-					username: config.username,
-					token: config.token,
-					require_ownership: false
-				}).then(() => {
-					factorioAPI.searchMods(term).then(body => {
-						console.log(body)
-						console.log("Im gonna download: "+body[0].name + " in version: " + body[0].latest_release.version);
-						factorioAPI.downloadMod( {name: body[0].name, version: body[0].latest_release.version}).then(()=>{
-							console.log("Mod downloaded");
-							resolve();
-						});
-					});
-				});
-			}
-		} else {
-			reject(new Error("Invalid search term"));
-		}
-	});
-}
-module.exports.removeMod = function removeMod(term, instance, force = false){
-	return new Promise((resolve, reject) => {
-		if(instance == "shared"){ // modDirectory has to end in /
-			var modDirectory = "sharedMods/";
-		} else {
-		var modDirectory = config.instanceDirectory+"/"+instance+"/instanceMods/";
-		}
-		if(term && typeof term == "string" && term.length > 0){
-			let mods = fs.readdirSync(modDirectory);
-			let modsMatchingFilter = mods.filter(mod => mod.toLowerCase().includes(term.toLowerCase()));
-			if(modsMatchingFilter.length < 1){
-				console.log("No mods found matching search");
-			} else if(modsMatchingFilter.length == 1){
-				console.log("Deleting "+modsMatchingFilter[0]);
-				fs.unlinkSync(modDirectory+modsMatchingFilter[0]);
-				console.log("Deleted.");
-			} else if(modsMatchingFilter.length > 1){
-				console.log("Found multiple mods");
-				modsMatchingFilter.forEach(mod => console.log(mod));
-				if(query("Delete all mods matching filter?")){
-					let modsToDelete = modsMatchingFilter.length;
-					for(let i = 0; i < modsToDelete; i++){
-						fs.unlinkSync(modDirectory+modsMatchingFilter[i]);
-						console.log("Deleted "+modsMatchingFilter[i]);
-					}
-				} else console.log("Did not delete mods.")
-			}
-			resolve();
-		} else {
-			reject(new Error("Invalid search term"));
-		}
-	});
-}
-
-// 'https://api.github.com/repos/Danielv123/factorioClusterioMod/releases'
-/**
-Download mod from github repo by looking for the first binary download in
-the latest release, saving it to /sharedMods
-
-@param {string} url a github repo  URL, for example https://api.github.com/repos/Danielv123/factorioClusterioMod/releases. Must link to /releases
-*/
-module.exports.downloadFromGitURL = function(url){
-	console.log("Downloading mod from "+url);
-	// get JSON data about releases
-	let res = syncRequest('GET', url, {"headers":{"User-Agent":"Please don't require setting a user agent"}});
-	let downloadUrl = JSON.parse(res.getBody())[0].assets[0].browser_download_url;
-	let name = JSON.parse(res.getBody())[0].assets[0].name;
-	console.log(JSON.parse(res.getBody()))
-	if(downloadUrl) {
-		console.log(downloadUrl);
-		let file = fs.createWriteStream("sharedMods/"+name);
-		https.get(downloadUrl, function(response) {
-			response.pipe(file);
-			console.log("Downloaded "+name);
-		});
-	}
-}
-/*
-module.exports.findUpdates = function(){
-	console.log("Downloading mods...");
-	// get JSON data about releases
-	let res = syncRequest('GET', 'https://api.github.com/repos/Danielv123/factorioClusterioMod/releases', {"headers":{"User-Agent":"Fuck you for requiring user agents!"}});
-	let url = JSON.parse(res.getBody())[0].assets[0].browser_download_url;
-	let name = JSON.parse(res.getBody())[0].assets[0].name;
-	console.log(JSON.parse(res.getBody()))
-}*/

lib/npmPostinstall.js

@@ -1,136 +0,0 @@
-var mkdirp = require("mkdirp");
-var http = require('http');
-var https = require('https');
-var fs = require('fs');
-
-var modManager = require("./manager/modManager.js");
-
-// modManager.addMod("clusterio", "shared");
-
-function makeDirectory(path){
-	return new Promise((resolve, reject) => {
-		mkdirp(path, function(err){
-			if(err){
-				console.error("Unable to mkdirp "+path);
-				console.error(err);
-				resolve(false);
-			} else {
-				console.log("mkdirp "+path);
-				resolve(true);
-			}
-		});
-	});
-}
-function download(url, file, callback){
-	return new Promise((resolve, reject) => {
-		let pathArray = file.split("/");
-		pathArray.pop(); // remove filename from the end
-		if(pathArray.length >= 1){
-			// this might be an invalid path!
-			fs.stat(pathArray.join("/"), (err, stat) => {
-				if(err){
-					makeDirectory(pathArray.join("/")).then(()=>{
-						doDownload(url, file, callback);
-					});
-				} else {
-					doDownload(url, file, callback);
-				}
-			});
-		} else {
-			doDownload(url, file, callback);
-		}
-		function doDownload(url, file, callback){
-			var writeStream = fs.createWriteStream(file);
-			let protocol = http;
-			if(url.split(":")[0] == "https") protocol = https;
-			var request = protocol.get(url, function(response) {
-				response.pipe(writeStream);
-				response.on("end", () => {
-					if(callback && typeof callback == "function") callback(file);
-					console.log("Downloaded "+file+" from "+url);
-					resolve();
-				});
-			});
-		}
-	});
-}
-
-var directories = [
-	"database/linvodb",
-	"sharedMods",
-	"instances",
-];
-let downloadList = [
-	{
-		url: "http://fbpviewer.trakos.pl/images/spritesheet.json",
-		file: "static/pictures/spritesheet.js",
-		callback: function(file){
-			fs.writeFileSync("static/pictures/spritesheet.js", "export default\n"+fs.readFileSync("static/pictures/spritesheet.js"));
-		},
-	},
-	{
-		url: "http://fbpviewer.trakos.pl/images/spritesheet.png",
-		file: "static/pictures/spritesheet.png",
-	},
-	{
-		url: "https://code.jquery.com/jquery.js",
-		file: "static/external/jquery.js",
-	},
-	{
-		url: "https://code.jquery.com/ui/1.12.1/jquery-ui.js",
-		file: "static/external/jquery-ui.js",
-	},
-	{
-		url: "https://cdnjs.cloudflare.com/ajax/libs/canvasjs/1.7.0/canvasjs.js",
-		file: "static/external/canvasjs.js",
-	},
-	{
-		url: "https://momentjs.com/downloads/moment.min.js",
-		file: "static/external/moment.min.js",
-	},
-	{
-		url: "https://craig.global.ssl.fastly.net/js/mousetrap/mousetrap.min.js",
-		file: "static/external/mousetrap.min.js",
-	},
-	{
-		url: "https://fonts.googleapis.com/css?family=Roboto",
-		file: "static/external/css/Roboto.css",
-	},
-	{
-		url: "https://cdnjs.cloudflare.com/ajax/libs/socket.io/2.0.4/socket.io.js",
-		file: "static/external/socket.io.js",
-	},
-]
-
-// initiate folder creations and downloads
-processMkdirRecursive(processDownloadRecursive);
-function processMkdirRecursive(callback){
-	let item = directories.shift();
-	makeDirectory(item).then(()=>{
-		if(directories.length == 0){
-			if(callback) callback();
-		} else {
-			processMkdirRecursive(callback);
-		}
-	});
-}
-function processDownloadRecursive(callback){
-	let item = downloadList.shift();
-	download(item.url, item.file, item.callback).then(()=>{
-		if(downloadList.length == 0){
-			if(callback) callback();
-		} else {
-			processDownloadRecursive(callback);
-		}
-	});
-}
-
-// generate SSL certificates if they are missing
-if(!fs.existsSync("database/certificates") || !fs.existsSync("database/certificates/cert.crt") || !fs.existsSync("database/certificates/cert.key")){
-	var generateSSLcert = require("./generateSSLcert.js");
-	
-	generateSSLcert({
-		certificatePath: "database/certificates",
-		doLogging: true,
-	});
-}

lib/objectOps.js

@@ -1,44 +0,0 @@
-/**
-Helper functions related to objects
-@module objectOps
-*/
-
-/**
-Deep clones an object, is actually just JSON.parse(JSON.stringify()) but looks cleaner.
-@param {object} obj to clone
-@returns {object}
-
-@example
-a = {"thingy":"with a value"};
-b = a;
-a == b; // true
-c = objectOps.deepclone(a);
-a == c; // false
-*/
-module.exports.deepclone = function(obj){
-	return JSON.parse(JSON.stringify(obj));
-}
-/**
-Checks if a string is valid JSON using try/catch. If passed an object it will always return true.
-@param {string} string to verify
-@returns {boolean}
-
-@example
-objectOps.isJSON("99 bottles of beer"); // false
-objectOps.isJSON("99"); // true
-objectOps.isJSON({"thingy":"that is an object"}); // true
-objectOps.isJSON(JSON.stringify({"thingy":"that is an object"})); // true
-*/
-module.exports.isJSON = function(string){
-	let stringIsJson = false;
-	let x
-	try {
-		x = JSON.parse(string);
-	} catch (e){
-		return false;
-	}
-	if(typeof x == "object" || typeof string == "object"){
-		stringIsJson = true;
-	}
-	return stringIsJson;
-}

lib/objectOps.spec.js

@@ -1,40 +0,0 @@
-var assert = require('assert');
-var objectOps = require('./objectOps');
-
-describe("objectOps.js", function(){
-	/*describe("objectOps.clone()", function(){
-		it("clones javascript objects", function(){
-			var object1 = {hello:"world", cat:{legs:4, name:"Kitty", colors:["brown", "yellow", "purple"]}};
-			var object2 = {};
-			object2 = objectOps.clone(object1);
-			
-			assert.equal(object2.cat.name, object1.cat.name)
-			assert.equal(object1.hello, object2.hello)
-		});	
-		it("does not deep clone objects", function(){
-			var obj1 = {hello:"world", cat:{legs:4, name:"Kitty", colors:["brown", "yellow", "purple"]}};
-			var obj2 = {};
-			obj2 = objectOps.clone(obj1);
-			
-			obj1.cat.colors = "black";
-			assert.equal(obj1.cat.colors, "black");
-			assert.notEqual(obj2.cat.colors[1], "yellow");
-		});
-	});*/
-	describe("objectOps.deepclone()", function(){
-		it("deep clones javascript objects", function(){
-			var obj1 = {hello:"world", cat:{legs:4, name:"Kitty", colors:["brown", "yellow", "purple"]}};
-			var obj2 = {};
-			obj2 = objectOps.deepclone(obj1);
-			
-			obj1.cat.colors = "black";
-			assert.equal(obj1.cat.colors, "black");
-			assert.equal(obj2.cat.colors[1], "yellow");
-		});
-		it("throws on non JSON parameters", function(){
-			assert.throws(function(){
-				let y = objectOps.deepclone(objectOps.deepclone);
-			});
-		});
-	});
-});

lib/stringUtils.js

@@ -1,14 +0,0 @@
-function hashCode(string){
-	if(typeof string !== "string") throw "ERROR stringUtils: Not a string";
-	var hash = 0;
-	if (string.length == 0) return hash;
-	for (let i = 0; i < string.length; i++) {
-		char = string.charCodeAt(i);
-		hash = ((hash << 5) - hash) + char;
-		hash = hash & hash; // Convert to 32bit integer
-	}
-	return hash;
-}
-module.exports = {
-	hashCode: hashCode,
-}

lib/stringUtils.spec.js

@@ -1,48 +0,0 @@
-const assert = require("assert");
-const stringUtils = require("./stringUtils");
-
-describe("stringUtils.js", function(){
-	describe("hashCode", function(){
-		it("Produces a 32bit signed int hash from a string", function(){
-			let x = stringUtils.hashCode("whatever");
-			let y = stringUtils.hashCode(" a much longer string to prove this works for long strings as well and also special characters &!¤(#)¤");
-			
-			assert(typeof x == "number", "hashCode should be returning a 32 bit signed int");
-			assert(x.toString() == "1934383586");
-			assert(y.toString() == "1648886132");
-		});
-		let permutations = 1000;
-		it("Rarely produces same hash for different strings ("+permutations+" hashes with collision check)", function(){
-			let keyHashPairs = [];
-			for(let i = 0; i < permutations; i++){
-				let string = Math.random().toString();
-				keyHashPairs.push({
-					key:string,
-					hash:stringUtils.hashCode(string),
-				});
-			}
-			
-			for(let i = 0; i < permutations; i++){
-				for(let o = 0; o < permutations; o++){
-					assert(i == o || keyHashPairs[o].key != keyHashPairs[i].key, "Woha, Math.random() generated 2 equal numbers???");
-					assert(i == o || keyHashPairs[o].hash != keyHashPairs[i].hash, "Hash collision, as long at it doesn't happen again its fine.");
-				}
-			}
-		});
-		it("Returns 0 for 0 length strings", function(){
-			let x = stringUtils.hashCode("");
-			assert.deepEqual(x, 0);
-		});
-		it("Throws when supplied with anything other than a string", function(){
-			assert.throws(function(){
-				stringUtils.hashCode([]);
-			}, "ERROR: Not a string")
-			assert.throws(function(){
-				stringUtils.hashCode({});
-			}, "ERROR: Not a string")
-			assert.throws(function(){
-				stringUtils.hashCode(0);
-			}, "ERROR: Not a string")
-		});
-	});
-});

lib/typedef.js

@@ -1,11 +0,0 @@
-/**
-An item with a count specified
-
-@typedef {object} itemStack
-@property {string} name The name of the item in the stack
-@property {(number|string)} count The amount of items in the stack
-
-@example
-itemStack = {name:"iron-plate", count:"12"}
-itemStack = {name:"copper-plate", count:972}
-*/

logo.svg

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg width="100%" height="100%" viewBox="0 0 154 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:1.41421;"><path d="M105.009,19.309l-3.12,0l-1.68,-1.68l0,-10.293l2.64,-2.64c2.029,0 7.281,0 9.996,0l1.68,1.68l0,6.2l-0.96,0.96l-7.596,-0.003l0,4.816l-0.96,0.953l0,0.007Zm6.876,0l-3.12,0l0,-3.944l0.96,-0.96l4.8,0l0,2.212l-2.64,2.692Zm-63.405,0l-9.917,0l-1.68,-1.68l0,-10.293l2.64,-2.64l3.118,0l0.002,9.827l2.718,0l0.002,-8.867l0.96,-0.96l3.117,0l1.68,1.68l0,10.293l-2.64,2.64Zm-15.652,0l-9.918,0l-1.68,-1.68l0,-10.293l2.64,-2.64l3.118,0l0.002,9.827l8.478,0.009l0,2.137l-2.64,2.64Zm-15.712,0l-9.996,0l-1.68,-1.68l0,-10.293l2.64,-2.64c2.029,0 7.281,0 9.996,0l1.68,1.68c0,1.028 0,2.147 0,2.147l-0.96,0.942l0,0.018l-7.596,0l0,5.04l8.556,0l0,2.146l-2.64,2.64Zm47.185,0l-9.997,0l-1.68,-1.68l0,-2.142l0.96,-0.96l7.597,-0.002l0,-0.993l-8.557,0l0,-6.196l1.68,-1.68l0,0l0.96,-0.96c2.029,0 7.282,0 9.997,0l1.68,1.68c0,1.028 0,2.147 0,2.147l-0.96,0.96l-7.597,0.002l0,0.957l8.557,0l0,6.227l-0.96,0.96l0,0l-1.68,1.68Zm12.444,0l-3.12,0l-1.68,-1.68l0,-6.216l0.96,-0.96l6.48,0l0,6.216l-2.64,2.64Zm19.325,0l-9.996,0l-1.68,-1.68l0,-10.293l2.64,-2.64c2.029,0 7.281,0 9.996,0l1.68,1.68c0,1.028 0,2.147 0,2.147l-1.086,0.96l-7.47,0l0,0.959l5.841,0l0,2.13l-0.96,0.96l-4.881,0l0,0.991l8.556,0l0,2.146l-2.64,2.64Zm20.065,-7.896l0.96,-0.96l6.481,0l0,5.953l-2.64,2.903l-3.121,0l-1.68,-1.943l0,-5.953Zm21.411,7.896l-2.872,0l0,-1.178c-1.382,-0.123 -2.749,-0.431 -4.028,-0.977l-0.056,-0.024l-1.307,0.804l-2.03,-1.25l1.277,-0.786c-0.81,-0.666 -1.487,-1.522 -1.761,-2.534l-1.749,0l0,-1.768l0.96,-0.96l1.141,0c0.332,-0.616 0.809,-1.156 1.35,-1.61l-1.198,-0.78l0.94,-0.93l2.03,-1.25l1.227,0.755c0.949,-0.424 2.033,-0.741 3.204,-0.922l0,-0.248l0.013,0l0.947,-0.96l2.872,0l0,1.116c1.505,0.156 2.889,0.535 4.059,1.079l1.332,-0.82l2.03,1.25l-1.12,1.059c0.701,0.671 1.181,1.437 1.377,2.261l1.976,0l0,1.768l-0.96,0.962l-0.002,-0.002l-1.327,0c-0.228,0.624 -0.547,1.236 -1.053,1.681l1.109,0.679l-0.968,0.978l-0.015,-0.004l-2.007,1.236l-1.411,-0.868c-0.958,0.432 -1.978,0.728 -3.02,0.908l0,0.375l-0.96,0.93l0,0.03Zm-15.17,-7.656l-6.001,0l0,5.624l1.55,1.792l2.901,0l1.55,-1.792l0,-5.624Zm-44.191,0l-6,0l0,5.877l1.54,1.539l2.921,0l1.539,-1.539l0,-5.877Zm35.14,3.952l-4.32,0l0,3.464l2.778,0l1.542,-1.59l0,-1.874Zm-96.308,-9.709l-9.798,0l-1.539,1.54l0,10.094l1.539,1.539l9.798,0l1.539,-1.539l0,-1.807l-8.556,0l0,-6.48l8.556,0l0,-1.807l-1.539,-1.54Zm8.771,0l-2.778,0l-1.54,1.54l0,10.094l1.54,1.539l9.719,0l1.539,-1.539l0,-1.799l-8.478,-0.008l-0.002,-9.827Zm15.653,0l-2.779,0l-1.539,1.54l0,10.094l1.539,1.539l9.719,0l1.539,-1.539l0,-10.094l-1.539,-1.54l-2.778,0l-0.003,9.827l-4.157,0l-0.002,-9.827Zm54.53,0l-9.798,0l-1.539,1.54l0,10.094l1.539,1.539l9.798,0l1.539,-1.539l0,-1.807l-8.556,0l0,-2.431l5.841,0l0,-1.65l-5.841,0l0,-2.399l8.556,0l0,-1.807l-1.539,-1.54Zm-31.77,0l-9.797,0l-0.82,0.82l-0.72,0.72l0,5.856l8.557,0l0,2.432l-8.557,0.003l0,1.803l1.54,1.539l9.797,0l1.54,-1.539l0,-5.888l-8.557,0l0,-2.396l8.557,-0.003l0,-1.807l-1.54,-1.54Zm47.585,0l-9.798,0l-1.539,1.54l0,10.094l1.539,1.539l2.781,0l0,-5.777l8.556,0.004l0,-5.86l-1.539,-1.54Zm28.324,7.453c0.327,-0.363 0.421,-0.95 0.212,-1.53c-0.459,-1.279 -2.339,-2.021 -4.278,-2.122c-0.058,0 -0.058,0 -0.115,0c-2.792,0.201 -3.386,1.31 -3.433,1.781c-0.151,1.505 1.994,2.74 4.45,2.74c1.269,0 2.7,-0.357 3.164,-0.869Zm-31.101,-1.707l0,-2.398l-4.24,0.002l0,2.396l4.24,0Zm-3.04,-2.157l0,0.957l2.8,0l0,-0.958l-2.8,0.001Zm-24.048,0.012l-13.471,0l0,-2.161l2.64,-2.64l10.111,0l1.68,1.68c0,1.034 0,2.161 0,2.161l-0.96,0.96Zm40.606,-0.048l-6.392,0l0,-2.113l2.64,-2.64l4.801,-0.005l0,3.798l-1.049,0.96Zm-42.386,-3.553l-9.912,0l-1.539,1.54l0,1.821l12.991,0l0,-1.821l-1.54,-1.54Zm37.774,0l-1.54,1.54l0,1.773l6.001,0l0,-3.318c-1.487,0.002 -2.974,0.003 -4.461,0.005Z" style="fill:#141414;"/><path d="M73.625,19.309l3.12,0l-3.12,0Zm47.201,-0.24l-2.901,0l-1.55,-1.792l0,-5.624l6.001,0l0,5.624l-1.55,1.792Zm-44.18,0l-2.921,0l-1.54,-1.539l0,-5.877l6,0l0,5.877l-1.539,1.539Zm60.66,0l-2.392,0l0,-1.157l-0.288,-0.026c-1.392,-0.131 -2.761,-0.465 -4.055,-1.026l-1.288,0.792l-1.572,-0.968l1.175,-0.724l0.005,-0.076l-0.25,-0.205c-0.598,-0.5 -1.12,-1.098 -1.438,-1.808c-0.159,-0.355 -0.249,-0.743 -0.25,-0.747l-1.693,0l0,-1.288l1.676,0l0.056,-0.226c0.27,-1.047 1.011,-1.878 1.84,-2.574l-0.005,-0.072l-1.116,-0.688l1.572,-0.968l1.208,0.743l0.228,-0.1c1.335,-0.574 2.76,-0.86 4.195,-0.988l0,-1.072l2.392,0l0,1.092l0.284,0.03c1.394,0.155 2.76,0.518 4.031,1.105l1.316,-0.81l1.572,0.968l-1.259,0.776l0.236,0.276c0.559,0.497 1.039,1.085 1.324,1.77c0.148,0.356 0.225,0.734 0.226,0.738l1.924,0l0,1.288l-1.941,0l-0.059,0.219c-0.367,1.3 -1.768,2.53 -1.768,2.53l1.317,0.811l-1.572,0.968l-1.394,-0.858lLine truncated

master.spec.js

@@ -1,184 +0,0 @@
-var app = require('./master.js'),
-  assert = require('assert'),
-  request = require('supertest');
-const validateHTML = require('html5-validator');
-var parallel = require('mocha.parallel');
-
-
-describe('Master server endpoint testing', function() {
-	describe('#GET /api/getFactorioLocale', function() { 
-		it('should get the basegame factorio locale', function(done) { 
-			request(app).get('/api/getFactorioLocale').end(function(err, res) {
-				assert.equal(res.statusCode, 200);
-				
-				let object = res.body;
-				
-				// test that it is actual factorio locale, copied from getFactorioLocale.spec.js
-				assert.equal(typeof object, "object");
-				assert.equal(object["entity-name"]["fish"], "Fish");
-				assert.equal(object["entity-name"]["small-lamp"], "Lamp");
-				Object.keys(object).forEach(key => {
-					// first level of the nested object is always an object
-					assert.equal(typeof object[key], "object");
-					
-					Object.keys(object[key]).forEach(key2 => {
-						// second level of the nested object is always a string, nearly always truthy
-						if(key2 != "so-long-and-thanks-for-all-the-fish"){
-							assert.ok(object[key][key2]);
-							assert.equal(typeof object[key][key2], "string");
-						}
-					});
-				});
-				done();
-			});
-		});
-	});
-	// describe("#GET /api/")
-	parallel("#GET static website data", function() {
-		this.timeout(6000);
-		it("sends some HTML when accessing /", function(done){
-			this.timeout(6000);
-			request(app).get("/").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				validateHTML(res.text).then(result => {
-					assert(result.messages.length === 1, "there are HTML errors on the page, please fix: "+JSON.stringify(result.messages));
-					done();
-				});
-			});
-		});
-		it("sends some HTML when accessing /nodes",function(done){
-			this.timeout(6000);
-			request(app).get("/nodes").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				validateHTML(res.text).then(result => {
-					assert(result.messages.length === 1, "there are HTML errors on the page, please fix: "+JSON.stringify(result.messages));
-					done();
-				});
-			});
-		});
-		it("sends some HTML when accessing /settings",function(done){
-			this.timeout(6000);
-			request(app).get("/settings").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				validateHTML(res.text).then(result => {
-					assert(result.messages.length === 1, "there are HTML errors on the page, please fix: "+JSON.stringify(result.messages));
-					done();
-				});
-			});
-		});
-		it("sends some HTML when accessing /nodeDetails",function(done){
-			this.timeout(6000);
-			request(app).get("/nodeDetails").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				validateHTML(res.text).then(result => {
-					assert(result.messages.length === 1, "there are HTML errors on the page, please fix: "+JSON.stringify(result.messages));
-					done();
-				});
-			});
-		});
-		it("sends some HTML when accessing /remoteMap",function(done){
-			this.timeout(6000);
-			request(app).get("/remoteMap").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				validateHTML(res.text).then(result => {
-					// there should be 1 error regarding complaining about me using ES6 modules before they are fully supported
-					assert(result.messages.length === 2, "there are HTML errors on the page, please fix: "+JSON.stringify(result.messages));
-					done();
-				});
-			});
-		});
-	});
-	let persistentMaster = request(app);
-	describe("#POST /api/place", function(){
-		it("adds an itemStack to the masters inventory", function(done){
-			persistentMaster.post("/api/place")
-			.send({
-				name:"steel-plate",
-				count:20,
-				instanceName:"unitTest"
-			})
-			.end(function(err,res){
-				assert(!err)
-				assert.equal(res.text, "success", "something went wrong with the request")
-				done();
-			});
-		});
-	});
-	describe("#GET /api/inventory", function(){
-		it("returns the masters current inventory", function(done){
-			persistentMaster.get("/api/inventory").end(function(err,res){
-				assert.equal(res.statusCode, 200);
-				let inventory = JSON.parse(res.text);
-				assert.equal(typeof inventory, "object", "Inventory should be an object");
-				assert(inventory.length >= 1, "There should be at least 1 entry in the inventory");
-				
-				let contains20SteelPlate = false;
-				inventory.forEach(itemStack => {
-					if(itemStack.name == "steel-plate" && itemStack.count >= 20) contains20SteelPlate = true;
-				});
-				assert(contains20SteelPlate, "Please ensure there are at least 20 steel plate in the inventory")
-				done();
-			});
-		});
-	});
-	parallel("#POST /api/remove", function(){
-		it("returns an itemStack of how many items were removed", function(done){
-			persistentMaster.post("/api/remove")
-			.send({
-				name:"steel-plate",
-				count:10
-			})
-			.end(function(err,res){
-				assert(!err);
-				assert.equal(res.body.count, 10, "Something is wrong with the response, maybe the format changed slightly or you didn't have enough steel?");
-				
-				done();
-			});
-		});
-		it("returns an empty itemStack if you try to request addItem or removeItem", function(done){
-			let casesRan = 0;
-			persistentMaster.post("/api/remove")
-			.send({
-				name:"addItem",
-				count:10
-			})
-			.end(function(err,res){
-				assert(!err);
-				assert.equal(res.text, '{"name":"addItem","count":0}', "When there are none of the item, you should get 0 back. addItem and removeItem should always return 0");
-				
-				isDone();
-			});
-			
-			persistentMaster.post("/api/remove")
-			.send({
-				name:"removeItem",
-				count:10
-			})
-			.end(function(err,res){
-				assert(!err);
-				assert.equal(res.text, '{"name":"removeItem","count":0}', "When there are none of the item, you should get 0 back. addItem and removeItem should always return 0");
-				
-				isDone();
-			});
-			
-			function isDone(){
-				if(++casesRan == 2) done();
-			}
-		});
-		it("returns an empty itemStack if you don't have any of the item you request", function(done){
-			persistentMaster.post("/api/remove")
-			.send({
-				name:"imaginaryItem",
-				count:999999
-			})
-			.end(function(err,res){
-				assert(!err);//{"name":"imaginaryItem","count":0}
-				assert.equal(res.body.name, "imaginaryItem", "Make sure body.name is the item we asked for");
-				assert.equal(res.body.count, 0, "Count should be 0 since we are asking for something that does not exist anywhere");
-				assert.equal(Object.keys(res.body).length, 2, "name and count should be the only keys on this object");
-				
-				done();
-			});
-		});
-	});
-});

node_modules/_app/factorioServer/index.js

@@ -1,168 +0,0 @@
-/**
-
-class factorioServer
-
-This class has the responsiblity of :
-
-* spawning a factorio server
-* Handling input via stdin or RCON
-
-
-*/
-
-const fs = require("fs");
-const child_process = require("child_process");
-const path = require("path");
-
-const mkdirp = require("mkdirp");
-const appRootPath = require("app-root-path");
-
-const fileOps = require("_app/fileOps");
-
-module.exports = class factorioServer {
-	constructor({
-		factorioDirectory = "factorio",
-		instanceDirectory = "instances/data",
-		instanceName = "Default server name",
-		factorioPort = Math.floor(Math.random() * 65535),
-		serversettings = {},
-		onProgress = function(type, a, b, c){
-			if(type == "progress") console.log("Progress: ",a," of ",b," unit: ",c);
-			if(type == "log") console.log(a);
-		},
-	} = {}){
-		this.factorioDirectory = factorioDirectory;
-		this.instanceDirectory = instanceDirectory;
-		this.instanceName = instanceName;
-		this.factorioPort = factorioPort;
-		this.serversettings = Object.assign({
-			"name": "Clusterio instance: " + this.instanceName,
-			"description": "Public factorio server running clusterio",
-			"tags": ["clusterio"],
-			"max_players": "20",
-			"visibility": "public",
-			"username": "",
-			"token": "",
-			"game_password": "",
-			"verify_user_identity": true,
-			"admins": ["Danielv123"],
-			"allow_commands": true,
-			"autosave_interval": 10,
-			"autosave_slots": 5,
-			"afk_autokick_interval": 0,
-			"auto_pause": false,
-		}, serversettings);
-		this.onProgress = (type, a, b, c) => {
-			if(typeof onProgress == "function") onProgress(type, a, b, c);
-		};
-	}
-	async initialize(){
-		if(!await this.isValidInstance()){
-			await this.createInstance();
-		}
-		return true;
-	}
-	async createInstance(path = this.instanceDirectory){
-		if(await this.isValidInstance(path)){
-			throw new Error("Instance already exists!");
-		}
-		
-		// create folders
-		let folders = [
-			"/script-output/",
-			"/saves/",
-			"/mods/",
-			"/instanceMods/",
-		];
-		mkdirp.sync(path);
-		folders.forEach(folder => mkdirp.sync(path + folder));
-		
-		// create files
-		let files = [
-			{name: "/script-output/output.txt", content: ""},
-			{name: "/script-output/orders.txt", content: ""},
-			{name: "/script-output/txbuffer.txt", content: ""},
-			{name: "/config.ini", content: "[path]\r\n\ read-data=__PATH__executable__/../../data\r\n\ write-data=__PATH__executable__/../../../" + this.instanceDirectory + "\r\n\ "},
-			{name: "/config.json", content: JSON.stringify({
-				factorioPort: this.factorioPort,
-				clientPassword: Math.random().toString(36).replace(/[^a-z]+/g, '').substr(0, 8),
-			}, null, 4)},
-			{name: "/server-settings.json", content: JSON.stringify(this.serversettings, null, 4)},
-		];
-		files.forEach(file => {
-			fs.writeFile(path + file.name, file.content, doneWritingHandler);
-			// console.log("Created: ",path+file.name);
-		});
-		
-		let filesToWrite = files.length;
-		function doneWritingHandler(){
-			if(!--filesToWrite){
-				return path;
-			}
-		}
-	}
-	async deleteInstance(path = this.instanceDirectory){
-		if(await this.isValidInstance(path)){
-			await fileOps.deleteFolderRecursive(path);
-			return true;
-		} else {
-			return false;
-		}
-	}
-	isValidInstance(path = this.instanceDirectory){
-		return new Promise((resolve, reject) => {
-			fs.stat(path, (err, stat) => {
-				if(err){
-					// console.log(err)
-					resolve(false);
-				} else {
-					// the instance folder exists, do some more checks
-					fs.readdir(path, (err, files) => {
-						if(files && Array.isArray(files)){
-							let foldersThatShouldBeThere = [
-								"script-output",
-								"saves",
-								"mods",
-								"instanceMods",
-							];
-							let instanceValidity = true;
-							foldersThatShouldBeThere.forEach(folder => {
-								if(!files.includes(folder)){
-									instanceValidity = false;
-								}
-							});
-							resolve(instanceValidity);
-						}
-					});
-				}
-			});
-		});
-	}
-	createMap(name = "map.zip"){
-		return new Promise((resolve, reject) => {
-			this.isValidInstance().then(isValid => {
-				if(!isValid){
-					return createInstance();
-				}
-			}).then(()=>{
-				this.onProgress("log", "Starting map creation");
-				// console.log(this.factorioDirectory + '/bin/x64/factorio')
-				let proc = child_process.spawn(
-					path.join(this.factorioDirectory, 'bin', 'x64', 'factorio'), [
-						'-c', path.join(this.instanceDirectory,'config.ini'),
-						'--create', path.join(this.instanceDirectory, 'saves',name),
-						'--server-settings', path.join(this.instanceDirectory, 'server-settings.json'),
-					],{
-						cwd:process.cwd(),
-					}
-				);
-				// console.log(proc.stdout.toString("utf8"));
-				proc.stdout.on("data", data => this.onProgress("log", data.toString("utf8")));
-				proc.on("close", code => {
-					this.onProgress("log", "Map created! "+code);
-					resolve();
-				});
-			});
-		});
-	}
-}

node_modules/_app/factorioServer/index.spec.js

@@ -1,114 +0,0 @@
-const assert = require("assert");
-const fs = require("fs");
-const path = require("path");
-
-const appRootPath = require("app-root-path");
-const parallel = require("mocha.parallel");
-const mkdirp = require("mkdirp");
-
-const factorioServer = require("./index.js");
-
-describe("class factorioServer/index.js", ()=>{
-	it("is a class (or at least a function)", ()=>{
-		assert.equal(typeof factorioServer, "function");
-	});
-	describe(".deleteInstance(instanceName)", ()=>{
-		it("deletes an instance, defaulting to the classes instanceDirectory", async () => {
-			let server = new factorioServer({
-				instanceDirectory: path.resolve(__dirname, "_testData_deleteInstance"),
-				instanceName: "Unit testing instance",
-			});
-			await server.initialize();
-			await server.deleteInstance();
-			assert.equal(await server.isValidInstance(), false);
-			return true;
-		});
-	});
-	describe(".isValidInstance(instanceName)", ()=>{
-		it("tells us whether an instance exists or not", async () => {
-			let server = new factorioServer({
-				instanceDirectory: path.join(__dirname, "_testData_isValidInstance"),
-				instanceName: "Unit testing instance",
-			});
-			await server.deleteInstance();
-			let status = await server.isValidInstance();
-			assert.equal(status, false);
-			let x = await server.initialize(); // creates our instance
-			let status2 = await server.isValidInstance();
-			assert.equal(status2, true);
-			
-			await server.deleteInstance(); // clean up folder
-			return true;
-		});
-		it("does not get tricked by an empty folder", async () => {
-			let server = new factorioServer({
-				instanceDirectory: path.join(__dirname, "_testData_isValidInstance_2"),
-				instanceName: "Unit testing instance",
-			});
-			assert.equal(await server.isValidInstance(), false);
-			
-			mkdirp.sync(path.join(__dirname, "_testData_isValidInstance_2")); // create empty folder simulating instance
-			assert.equal(await server.isValidInstance(), false);
-			
-			await server.initialize(); // create a proper instance
-			assert.equal(await server.isValidInstance(), true);
-			
-			await server.deleteInstance(); // delete the instance and ensure we see that it is in fact deleted
-			assert.equal(await server.isValidInstance(), false);
-			
-			return true;
-		}).timeout(5000);
-	});
-	describe(".initialize()", ()=>{
-		it("creates an instance", done => {
-			let server = new factorioServer({
-				instanceDirectory: path.resolve(__dirname, "_testData_initialize"),
-				instanceName: "Unit testing instance",
-			});
-			server.initialize().then(()=>{
-				return server.deleteInstance();
-			}).then(() => {
-				done();
-			}).catch(e => console.log(e));
-		});
-	});
-	describe(".createMap(mapName.zip)", ()=>{
-		it("creates a map file as instanceDirectory/saves/map.zip", async function(){
-			this.timeout(20000); // these test often takes a lot of time in the map creation step (4500 ms on i3 dev system)
-			let relativePath = __dirname.replace(appRootPath, "").substr(1);
-			let server = new factorioServer({
-				instanceDirectory: path.join(relativePath, "_testData_createMap"),
-				instanceName: "Unit testing instance",
-				onProgress: false,
-			});
-			await server.initialize();
-			let maps = fs.readdirSync(path.join(relativePath, "_testData_createMap", "saves"));
-			assert.equal(maps.length, 0);
-			await server.createMap();
-			let maps2 = fs.readdirSync(path.join(relativePath, "_testData_createMap", "saves"));
-			assert(maps2.includes("map.zip"));
-			
-			await server.deleteInstance();
-			return true;
-		});
-		it("supports custom filenames", async function(){
-			this.timeout(20000);
-			let relativePath = __dirname.replace(appRootPath, "").substr(1);
-			let server = new factorioServer({
-				instanceDirectory: path.join(relativePath, "_testData_createMap_2"),
-				instanceName: "Unit testing instance",
-				onProgress: false,
-			});
-			await server.initialize();
-			
-			let maps = fs.readdirSync(path.join(relativePath, "_testData_createMap_2", "saves"));
-			assert.equal(maps.length, 0);
-			await server.createMap("mapWithCustomName.zip");
-			let maps2 = fs.readdirSync(path.join(relativePath, "_testData_createMap_2", "saves"));
-			assert(maps2.includes("mapWithCustomName.zip"));
-			
-			await server.deleteInstance();
-			return true;
-		});
-	});
-});

node_modules/_app/fileOps/fileOps.js

@@ -1,120 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-
-// gets newest file in a directory
-// dir is directory
-// files is array of filenames
-// callback(err, filename string);
-var getNewestFile = function(dir, files, callback) {
-	if (!callback) throw new Error("Missing callback");
-	if (!files || (files && files.length === 0)) {
-		callback(new Error("No files"));
-		return;
-	}
-	// we are appending the file name to the directory, without the
-	// "/" we would get paths like /folderfile.txt instead of /folder/file.txt
-	if(dir[dir.length-1] != "/"){
-		dir += "/";
-	}
-	var newest = { file: files[0] };
-	var checked = 0;
-	fs.stat(dir + newest.file, function(err, stats) {
-		if(err) {
-			callback(err);
-		} else {
-			newest.mtime = stats.mtime;
-			for (var i = 0; i < files.length; i++) {
-				var file = files[i];
-				(function(file) {
-					fs.stat(file, function(err, stats) {
-						++checked;
-						if (stats.mtime.getTime() > newest.mtime.getTime()) {
-							newest = { file : file, mtime : stats.mtime };
-						}
-						if (checked == files.length) {
-							callback(undefined,newest);
-						}
-					});
-				})(dir + file);
-			}
-		}
-	});
-}
-
-// get names of all directories in directory
-var getDirectoriesSync = function(srcpath) {
-	return fs.readdirSync(srcpath).filter(function (file) {
-		return fs.statSync(path.join(srcpath, file)).isDirectory();
-	});
-}
-// get names of all files in a directory
-var getFileNamesSync = function(srcpath) {
-	return fs.readdirSync(srcpath).filter(function (file) {
-		return !fs.statSync(path.join(srcpath, file)).isDirectory();
-	});
-}
-// does what it says on the tin
-var deleteFolderRecursiveSync = function(path) {
-	if (fs.existsSync(path)) {
-		fs.readdirSync(path).forEach(function (file, index) {
-			var curPath = path + "/" + file;
-			if (fs.lstatSync(curPath).isDirectory()) { // recurse
-				deleteFolderRecursiveSync(curPath);
-			} else { // delete file
-				fs.unlinkSync(curPath);
-			}
-		});
-		fs.rmdirSync(path);
-		return true;
-	} else {
-		return false;
-	}
-};
-var deleteFolderRecursive = function(path){
-	return new Promise((resolve, reject) => {
-		fs.readdir(path, (err, files) => {
-			if(err){
-				reject(err);
-			} else {
-				let thingsToDelete = files.length;
-				files.forEach(file => {
-					let curPath = path + "/" + file;
-					fs.stat(curPath, (err, stat) => {
-						if(!err){
-							if(stat.isDirectory()){
-								// recurse
-								deleteFolderRecursive(curPath).then(() => {
-									whenFilesDeleted();
-								}).catch(e => console.log(e));
-							} else {
-								fs.unlink(curPath, () => {
-									// console.log("Deleted "+curPath);
-									whenFilesDeleted();
-								});
-							}
-						} else {
-							resolve(false);
-						}
-					});
-				});
-				whenFilesDeleted();
-				function whenFilesDeleted(){
-					if(!thingsToDelete--){// var-- instead of --var because we are calling the function once too much and need the delay
-						fs.rmdir(path, () => {
-							resolve();
-							// console.log("Deleted "+path);
-						});
-					}
-				}
-			}
-		});
-	});
-}
-
-module.exports = {
-	getNewestFile,
-	getDirectoriesSync,
-	deleteFolderRecursiveSync,
-	deleteFolderRecursive,
-	getFileNamesSync,
-}

node_modules/_app/fileOps/fileOps.spec.js

@@ -1,135 +0,0 @@
-const assert = require('assert');
-const fs = require('fs');
-const path = require('path');
-
-const fileOps = require('./fileOps');
-
-// create folders for testing
-function setupTestingEnv(){
-	if (!fs.existsSync(path.resolve(__dirname, "database"))){
-		fs.mkdirSync(path.resolve(__dirname, "database"));
-	}
-	if (!fs.existsSync(path.resolve(__dirname, "test"))){
-		fs.mkdirSync(path.resolve(__dirname, "test"));
-	}
-	if (!fs.existsSync(path.resolve(__dirname, "test/folder"))){
-		fs.mkdirSync(path.resolve(__dirname, "test/folder"));
-	}
-	if (!fs.existsSync(path.resolve(__dirname, "test/another folder"))){
-		fs.mkdirSync(path.resolve(__dirname, "test/another folder"));
-	}
-	if (!fs.existsSync(path.resolve(__dirname, "test/file.txt"))){
-		fs.writeFileSync(path.resolve(__dirname, "test/file.txt"), "contents");
-	}
-	if (!fs.existsSync(path.resolve(__dirname, "test/another file.txt"))){
-		fs.writeFileSync(path.resolve(__dirname, "test/another file.txt"), "more contents");
-	}
-	// we need this xfile to test a branch in fileOps.getNewestFile()s propagation
-	if (!fs.existsSync(path.resolve(__dirname, "test/xfile.txt"))){
-		fs.writeFileSync(path.resolve(__dirname, "test/xfile.txt"), "contents");
-	}
-}
-setupTestingEnv();
-setupTestingEnv(); // run twice to get branch coverage
-describe("fileOps.js", function(){
-	describe("fileOps.getDirectoriesSync()", function(){
-		it("gets an array of directory names from a path", function(){
-			let directories = fileOps.getDirectoriesSync(path.resolve(__dirname, "test"));
-			
-			// because there are no arrays for some reason
-			assert(typeof directories == "object");
-			
-			// they are sorted alphabetically because thats the way it is
-			assert(directories[0] == "another folder" && directories[1] == "folder");
-		});
-		it("does not return any filenames", function(){
-			let directories = fileOps.getDirectoriesSync(path.resolve(__dirname, "test"));
-			
-			// this is a function to return directories, not files. So yeah.
-			assert(!directories.includes("file.txt") && !directories.includes("another file.txt"));
-		});
-		it("throws when lacking first argument", function(){
-			assert.throws(function(){
-				let files = fileOps.getDirectoriesSync();
-			}, Error);
-		});
-	});
-	describe("fileOps.getFileNamesSync(path)", function(){
-		it("gets names of files in directory", function(){
-			let files = fileOps.getFileNamesSync(path.resolve(__dirname, "test"));
-			assert(files.length > 0);
-			assert(files.includes("file.txt") && files.includes("another file.txt"));
-		});
-		it("throws when lacking first argument", function(){
-			assert.throws(function(){
-				let files = fileOps.getFileNamesSync();
-			}, Error);
-		});
-	});
-	describe("fileOps.getNewestFile()", function(){
-		it("gets the newest file in a directory async", function(done){
-			fileOps.getNewestFile(path.resolve(__dirname, "test/"), fileOps.getFileNamesSync(path.resolve(__dirname, "test")), function(err, newest){
-				assert(newest && typeof newest.file == "string");
-				done();
-			});
-		});
-		it("throws if callback is missing", function(){
-			assert.throws(function(){
-				fileOps.getNewestFile("test", fileOps.getFileNamesSync(path.resolve(__dirname, "test")));
-			}, Error);
-		});
-		it("executes callback(err) if no files are provided", function(done){
-			fileOps.getNewestFile(path.resolve(__dirname, "test"), [], function(err, newest){
-				assert(err && typeof err == "object");
-				done();
-			});
-		});
-		it("executes callback(err) if launched without a directory", function(done){
-			fileOps.getNewestFile("", fileOps.getFileNamesSync(path.resolve(__dirname, "test")), function(err, newest){
-				assert(err);
-				done();
-			});
-		});
-		it("executes callback(err) when you do stupid shit", function(done){
-			fileOps.getNewestFile({thisWontWork: "but not crash either"}, {lolz:"yeah..."}, function(err, newest){
-				assert(err);
-				// ENOENT: no such file or directory, stat 'C:\**\factorioClusterio\lib\test\undefined'
-				done();
-			});
-		});
-	});
-	describe("fileOps.deleteFolderRecursiveSync(path)", function(){
-		it("deletes a folder and all files and folders in it", function(){
-			let x = fileOps.deleteFolderRecursiveSync(path.resolve(__dirname, "test"));
-			assert.throws(function(){
-				fs.statSync(path.resolve(__dirname, "test"));
-			}, Error);
-			assert(x);
-			// give it some extra time because its sometimes very slow
-		}).timeout(5000);
-		it("returns false if you give it an invalid path", function(){
-			let x = fileOps.deleteFolderRecursiveSync("This isn't a real path");
-			assert(!x);
-		});
-	});
-	describe("fileOps.deleteFolderRecursive(path)", function(){
-		it("deletes a folder and all files and folders in it, just like sync version", async function(){
-			setupTestingEnv();
-			assert(fs.statSync(path.resolve(__dirname, "test")));
-			let x = await fileOps.deleteFolderRecursive(path.resolve(__dirname, "test"));
-			assert.throws(function(){
-				fs.statSync(path.resolve(__dirname, "test"));
-			}, Error);
-			assert(x === undefined, "Promise version of this function does not have a return value upon success");
-			return true;
-		}).timeout(5000);
-		it("throws like a promise does if you give it an invalid path", async function(){
-			let x = await fileOps.deleteFolderRecursive("Look this path is fake!")
-			.catch(e => {
-				assert(e);
-				assert.equal(e.code, "ENOENT");
-				return true;
-			});
-		});
-	});
-});

node_modules/_app/fileOps/index.js

@@ -1,2 +0,0 @@
-const fileOps = require("./fileOps");
-module.exports = fileOps;

node_modules/_app/isFactorioCommand/index.js

@@ -1 +0,0 @@
-module.exports = require("./isFactorioCommand.js");

node_modules/_app/isFactorioCommand/isFactorioCommand.js

@@ -1,23 +0,0 @@
-const luamin = require("luamin");
-function isFactorioCommand(command){
-	if(typeof command != "string"){
-		return false;
-	} else if(!command.includes("/silent-command ") && !command.includes("/c ")){
-		return false;
-	} else if(command[0] != "/"){
-		return false;
-	} else {
-		// check that what follows /c is valid LUA
-		let x = command.replace("/silent-command ", "").replace("/c ","");
-		let y
-		try{
-			y = luamin.minify(x);
-		} catch (e) {
-			return false;
-		}
-		
-		// by this point it is surely a LUA command
-		return true;
-	}
-}
-module.exports = isFactorioCommand;

node_modules/_app/isFactorioCommand/isFactorioCommand.spec.js

@@ -1,18 +0,0 @@
-const isFactorioCommand = require("./isFactorioCommand");
-const assert = require("assert");
-
-describe("inventoryImports/isFactorioCommand.js()", function(){
-	it("Returns false if input is not a factorio command", function(){
-		assert(isFactorioCommand({}) == false, "This is not even a string so should return false");
-		assert(isFactorioCommand("Howdy boys!") == false, "This is not a command so should return false");
-		assert(isFactorioCommand("/c this ain't a command because its invalid LUA") == false, "This is not valid LUA so it should return false");
-		assert(isFactorioCommand("Trying to trick the system /c game.print('Hello world!')") == false, "this is still not a command");
-		
-	});
-	it("Returns true if it is a valid command", function(){
-		assert(isFactorioCommand("/c game.print('hello world')"), "This is a valid command, should output true not false")
-	});
-	it("Fails to understand that leading spaces are valid", function(){
-		assert(isFactorioCommand("  /c game.print('Hello world!')") == false, "This should be true but often returns false unintentionally. If you see this you probably fixed the bug so change this test, OK?")
-	});
-});

package.json

@@ -1,77 +1,66 @@
 {
-  "name": "clusterio",
-  "version": "1.7.0",
-  "description": "Interserver communication for factorio",
-  "repository": "https://github.com/Danielv123/factorioClusterio",
-  "main": "master.js",
-  "scripts": {
-    "test": "./node_modules/.bin/istanbul cover ./node_modules/mocha/bin/_mocha -- \"./{{,node_modules/_app/**/},!(node_modules)/**/}*.spec.js\" -R spec || echo .",
-    "start": "echo Run node client.js start [instance] to start slaves && node master.js",
-    "cover": "./node_modules/.bin/istanbul cover ./node_modules/mocha/bin/_mocha -- \"./{{,node_modules/_app/**/},!(node_modules)/**/}*.spec.js\" -R spec || echo . && codecov -t f7b38085-36eb-4d72-84e6-64721910171e",
-    "docs": "documentation build index.js --config documentation.yml -f html -o docs",
-    "livedocs": "documentation serve --watch *.js lib/** --config documentation.yml",
-    "install": "node lib/npmPostinstall.js"
-  },
-  "keywords": [
-    "factorio"
-  ],
-  "author": "Danielv123",
-  "license": "ISC",
-  "dependencies": {
-    "app-root-path": "^2.0.1",
-    "as-table": "^1.0.31",
-    "averaged-timeseries": "^1.4.0",
-    "base64url": "^3.0.0",
-    "bcrypt": "^2.0.1",
-    "bcrypt-promise": "^2.0.0",
-    "bcryptjs": "^2.4.3",
-    "body-parser": "^1.18.2",
-    "cache-require-paths": "^0.3.0",
-    "cli-interact": "^0.1.9",
-    "codecov": "^3.0.1",
-    "compression": "^1.7.2",
-    "deepmerge": "^1.5.2",
-    "ejs": "^2.5.7",
-    "express": "^4.16.2",
-    "express-fileupload": "0.0.6",
-    "follow-redirects": "^1.5.0",
-    "fs-extra": "^6.0.1",
-    "getmac": "^1.4.0",
-    "hash-files": "^1.1.1",
-    "html5-validator": "^1.0.7",
-    "ini": "^1.3.5",
-    "jsonwebtoken": "^8.2.1",
-    "leveldown": "^1.9.0",
-    "linvodb3": "^3.25.1",
-    "luamin": "^1.0.4",
-    "mkdirp": "^0.5.1",
-    "mkdirp-promise": "^5.0.1",
-    "moment": "^2.20.1",
-    "ncp": "^2.0.0",
-    "nedb": "^1.8.0",
-    "needle": "^1.1.0",
-    "node-factorio-api": "^0.3.1-alpha",
-    "node-forge": "^0.7.1",
-    "prom-client": "^10.2.3",
-    "rcon-client": "^3.0.2",
-    "request": "^2.83.0",
-    "right-pad": "^1.0.1",
-    "rmdir-sync": "^1.0.1",
-    "sanitizer": "^0.1.3",
-    "single-line-log": "^1.1.2",
-    "socket.io": "^2.0.4",
-    "socket.io-client": "^2.0.4",
-    "sync-request": "^4.0.1",
-    "underscore": "^1.8.3"
-  },
-  "devDependencies": {
-    "documentation": "^5.4.0",
-    "istanbul": "^0.4.5",
-    "mocha": "^3.5.3",
-    "mocha-sinon": "^2.0.0",
-    "mocha.parallel": "^0.15.5",
-    "nock": "^9.1.6",
-    "sinon": "^2.4.1",
-    "supertest": "^3.0.0"
-  }
+	"name": "root",
+	"private": true,
+	"files": [],
+	"packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
+	"type": "module",
+	"scripts": {
+		"build": "tsc --build",
+		"watch": "tsc --build --watch",
+		"build-mod": "pnpm run -r build-mod --output-dir ../../dist",
+		"test": "pnpm run build && NODE_EXTRA_CA_CERTS=$(pwd)/test/file/tls/cert.pem mocha --enable-source-maps --check-leaks -R spec --recursive test \"plugins/*/test/**\" --exclude \"test/manual/**\"",
+		"silent-test": "SILENT_TEST=y pnpm test",
+		"fast-test": "FAST_TEST=y pnpm test",
+		"no-external-test": "NO_EXTERNAL_TEST=y pnpm test",
+		"cover": "c8 pnpm test",
+		"fast-cover": "FAST_TEST=y c8 pnpm test",
+		"ci-cover": "c8 --reporter=lcovonly pnpm test",
+		"lint": "eslint packages plugins test",
+		"lint-fix": "eslint --fix packages plugins test",
+		"clean": "node ./clean.js",
+		"docs": "typedoc",
+		"bundle-dependencies": "bundle-dependencies"
+	},
+	"c8": {
+		"exclude": [
+			"test/**",
+			"plugins/*/test/**",
+			"temp/**"
+		]
+	},
+	"engines": {
+		"node": ">=22"
+	},
+	"workspaces": [
+		"packages/*",
+		"plugins/*",
+		"external_plugins/*",
+		"external_plugins/*/*"
+	],
+	"devDependencies": {
+		"@clusterio/controller": "workspace:^",
+		"@clusterio/ctl": "workspace:^",
+		"@clusterio/host": "workspace:^",
+		"@clusterio/lib": "workspace:^",
+		"@clusterio/web_ui": "workspace:^",
+		"@eslint/eslintrc": "^3.3.7",
+		"@eslint/js": "^10.0.1",
+		"@stylistic/eslint-plugin": "^5.10.0",
+		"@swc/core": "catalog:",
+		"@types/node": "catalog:",
+		"c8": "^12.0.0",
+		"@typescript-eslint/eslint-plugin": "^8.70.0",
+		"@typescript-eslint/parser": "^8.70.0",
+		"eslint": "^10.10.0",
+		"eslint-plugin-node": "^11.1.0",
+		"express": "catalog:",
+		"form-data": "^4.0.6",
+		"globals": "^17.12.0",
+		"jsonwebtoken": "catalog:",
+		"jszip": "catalog:",
+		"mocha": "^11.8.0",
+		"typedoc": "^0.28.20",
+		"typescript": "catalog:",
+		"yargs": "catalog:"
+	}
 }

packages/controller/.npmignore

@@ -0,0 +1,2 @@
+webpack.config.js
+dist/browser

packages/controller/README.md

@@ -0,0 +1,145 @@
+# Clusterio Controller
+
+Communication hub for Clusterio clusters.
+The controller forwards data between Clusterio hosts connected to it and allows the cluster to be remotely managed through WebSocket connections to it either by using the included web interface or the Clusterio ctl command line utility.
+
+
+# Usage
+
+    npx clusteriocontroller <command>
+
+Common options:
+
+ * `--plugin-list <file>` JSON file to use for storing the list of plugins that are available to the controller.
+   Defaults to `plugin-list.json` and will be created if it does not exist.
+   See the `plugin` command for managing this list.
+
+ * `--config <file>` JSON file to use for storing configuration for the controller.
+   Defaults to `config-controller.json` and is required for operation.
+   See the `config` command for inspecting and modifying the configuration.
+
+ * `--create-config` If the config file is missing, create a new one and carry on instead of exiting with an error.
+   Alternative to the `config create` command.
+
+
+### `plugin <command>`
+
+Configure plugins available to be loaded by the controller.
+The available plugins will be loaded unless they have been disabled in the configuration, see the config command for disabling plugins.
+
+
+#### `plugin install <package>`
+
+Install a plugin from npm and add it to the plugin list.
+The package is passed to `npm install --save` so anything npm accepts works, including a version like `@clusterio/plugin-subspace_storage@2.0.0`.
+This command refuses to run outside the directory Clusterio was installed in, as the plugin has to end up in that directory's node_modules to be found.
+
+For example, installing the Subspace Storage plugin:
+
+    npx clusteriocontroller plugin install @clusterio/plugin-subspace_storage
+
+Since the `plugin-list.json` is shared between controller, host and ctl you usually only need to do this once per machine.
+
+
+#### `plugin add <path>`
+
+Add plugin either by require path or relative/absolute path to the plugin directory.
+A relative path must start with ./ or ../ (or .\ and ..\ on Windows) otherwise it will be assumed to be a require path for an installed package in node_modules.
+This is mainly useful for plugins under development, packages published on npm are better installed with `plugin install`.
+
+For example, adding a plugin checked out in the external_plugins directory:
+
+    npx clusteriocontroller plugin add ./external_plugins/my_plugin
+
+
+#### `plugin remove <name>`
+
+Remove a plugin by its name.
+This should be done before uninstalling the plugin, otherwise there will be an error when Clusterio tries to load the info from the plugin.
+Removing and unistalling a plugin is usually not neccessary as the functions provided by the plugin can be disabled in the config.
+
+For example, uninstalling the Subspace Storage plugin:
+
+    npx clusteriocontroller plugin remove subspace_storage
+    npm uninstall @clusterio/plugin-subspace_storage
+
+Since the `plugin-list.json` is shared between controller, host and ctl you usually only need to do this once per machine.
+
+
+#### `plugin list`
+
+Lists the plugins set up to be available by name followed by path.
+
+
+### `config`
+
+Manage the controller configuration offline.
+This should only be used when the controller is stopped, otherwise the config read might be out of date and config changes will be overwritten when the controller shuts down.
+
+
+#### `config create`
+
+Create a new config file with the default options inserted into if it doesn't already exist.
+
+See also the `--create-config` option.
+
+
+#### `config set <config-entry> [value]`
+
+Set a config entry to the given value.
+If value is not provided the entry is set to null.
+If the config entry is of type object the value must be a valid JSON serialization of an object.
+
+See docs/configuration.md in the main repositiory for the available configuration entries.
+
+
+#### `config show <config-entry>`
+
+Shows the value for a single config entry.
+
+
+#### `config list`
+
+Lists up all configuration entries with their currently configured values.
+
+
+### `bootstrap`
+
+Commands for setting up initial admin acount and access to the cluster.
+
+
+#### `bootstrap create-admin <name>`
+
+Creates a new user account with the given name if it does not already exist in the cluster and grant it full cluster admin permission.
+You should be using your own Factorio multiplayer username here.
+
+
+#### `bootstrap generate-user-token <name>`
+
+Generate an access token for logging in and possibly managing the cluster from the given user account.
+This can be used both in the web interface and as the `controller_token` to connect with clusterioctl.
+
+
+#### `bootstrap create-ctl-config <name>`
+
+Creates a clusterioctl config for the given user with url and token set up for connecting to the cluster.
+
+
+### `copy-static [target]`
+
+Copies the static web assets to the given target folder (which defaults to `./static/`).
+Useful in case you want to host the assets on a CDN or separate web server and want provide the files directly instead of fetching them from the controller.
+
+Note that mod pack exports will create additional static files that also have to be hosted, these are written to the `./static/` folder in the clusterio installation directory.
+
+See also the `controller.public_url` config option for setting where static assets are loaded from.
+
+
+### `run`
+
+Runs the controller.
+
+
+## See Also
+
+[The Clusterio repository](https://github.com/clusterio/clusterio) for instructions on how to set up a cluster.

packages/controller/controller.ts

@@ -0,0 +1,537 @@
+#!/usr/bin/env node
+
+/**
+ * Clusterio controller
+ *
+ * Facilitates communication between hosts and control of the cluster
+ * through WebSocet connections, and hosts a webserver for browser
+ * interfaces and Prometheus statistics export.  It is remotely controlled
+ * by {@link module:ctl/ctl}.
+ *
+ * @module controller/controller
+ * @author Danielv123, Hornwitser
+ * @example
+ * npx clusteriocontroller run
+ */
+
+import path from "path";
+import fs from "node:fs/promises";
+
+import crypto from "crypto";
+import yargs from "yargs";
+import util from "util";
+import winston from "winston";
+import DailyRotateFile from "winston-daily-rotate-file";
+
+import jwt from "jsonwebtoken";
+
+// homebrew modules
+import * as lib from "@clusterio/lib";
+import { ConsoleTransport, levels, logger } from "@clusterio/lib";
+
+import Controller from "./src/Controller.js";
+import UserManager from "./src/UserManager.js";
+import UserRecord from "./src/UserRecord.js";
+import packageConfig from "@clusterio/controller/package.json" with { type: "json" };
+
+// globals
+let controller: Controller;
+
+void new lib.Gauge(
+	"clusterio_controller_pending_requests",
+	"Count of pending link requests currently waiting in memory on the controller.",
+	{
+		callback: (gauge) => {
+			let count = 0;
+			if (controller) {
+				for (const host of controller.wsServer.hostConnections.values()) {
+					count += host.pendingRequestCount;
+				}
+				for (const control of controller.wsServer.controlConnections.values()) {
+					count += control.pendingRequestCount;
+				}
+			}
+			gauge.set(count);
+		},
+	}
+);
+
+void new lib.Gauge(
+	"clusterio_controller_host_mapping",
+	"Mapping of Host ID to name",
+	{
+		labels: ["host_id", "host_name"],
+		callback: function(gauge:lib.Gauge) {
+			gauge.clear();
+			if (!controller || !controller.hosts) {
+				return;
+			}
+			for (const host of controller.hosts.values()) {
+				gauge.labels({
+					host_id: String(host.id),
+					host_name: host.name,
+				}).set(1);
+			};
+		},
+	}
+);
+
+void new lib.Gauge(
+	"clusterio_controller_instance_mapping",
+	"Mapping of Instance ID to name and host",
+	{
+		labels: ["instance_id", "instance_name", "host_id"],
+		callback: function(gauge:lib.Gauge) {
+			gauge.clear();
+			if (!controller || !controller.instances) {
+				return;
+			}
+			for (const instance of controller.instances.values()) {
+				gauge.labels({
+					instance_id: String(instance.id),
+					instance_name: String(instance.config.get("instance.name")),
+					host_id: String(instance.config.get("instance.assigned_host")),
+				}).set(1);
+			}
+		},
+	}
+);
+
+void new lib.Gauge(
+	"clusterio_controller_websocket_active_connections",
+	"How many WebSocket connections are currently open to the controller",
+	{ callback: function(gauge:lib.Gauge) {
+		if (!controller) {
+			return;
+		}
+		gauge.set(controller.wsServer.activeConnectors.size);
+	}}
+);
+
+void new lib.Gauge(
+	"clusterio_controller_active_hosts",
+	"How many hosts are currently connected to the controller",
+	{ callback: function(gauge:lib.Gauge) {
+		if (!controller) {
+			return;
+		}
+		gauge.set(controller.wsServer.hostConnections.size);
+	}}
+);
+
+void new lib.Gauge(
+	"clusterio_controller_connected_clients_count",
+	"How many clients are currently connected to this controller",
+	{
+		labels: ["type"], callback: async function(gauge:lib.Gauge) {
+			if (!controller) {
+				return;
+			}
+			gauge.labels("host").set(controller.wsServer.hostConnections.size);
+			gauge.labels("control").set(controller.wsServer.controlConnections.size);
+		},
+	},
+);
+
+
+async function handleBootstrapCommand(
+	args: any,
+	controllerConfig: lib.ControllerConfig,
+	controllerConfigLock: lib.LockFile,
+): Promise<void> {
+	let subCommand = args._[1];
+
+	const databaseDirectory = controllerConfig.get("controller.database_directory");
+	await UserManager.attemptMigrateLegacyUsersFile(
+		path.join(databaseDirectory, "users.json"),
+		path.join(databaseDirectory, "roles.json"),
+	);
+
+	const roles = new lib.SubscribableDatastore(...await new lib.JsonIdDatastoreProvider(
+		path.join(databaseDirectory, "roles.json"),
+		lib.Role.fromJSON.bind(lib.Role),
+	).bootstrap());
+
+	const users = new lib.SubscribableDatastore(...await new lib.JsonIdDatastoreProvider(
+		path.join(databaseDirectory, "users.json"),
+		UserRecord.fromJSON.bind(UserRecord),
+	).bootstrap());
+
+	const userManager = new UserManager(users, roles, controllerConfig);
+
+	if (subCommand === "create-admin") {
+		await controllerConfigLock.acquire(); // Also needed to write to the database files
+
+		if (!args.name) {
+			logger.error("name cannot be blank");
+			process.exitCode = 1;
+			return;
+		}
+
+		const user = userManager.getOrCreateUser(args.name);
+		user.roleIds.add(lib.Role.DefaultAdminRoleId);
+		user.isAdmin = true;
+		user.saveRecord();
+
+		await userManager.records.save();
+		await controllerConfigLock.release();
+
+	} else if (subCommand === "generate-user-token") {
+		let user = userManager.getByName(args.name);
+		if (!user) {
+			logger.error(`No user named '${args.name}'`);
+			process.exitCode = 1;
+			return;
+		}
+		// eslint-disable-next-line no-console
+		console.log(userManager.signUserToken(user));
+
+	} else if (subCommand === "generate-host-token") {
+		// eslint-disable-next-line no-console
+		console.log(jwt.sign(
+			{ aud: "host", host: args.id },
+			// Auth secret is never null after startup
+			Buffer.from(controllerConfig.get("controller.auth_secret")!, "base64")
+		));
+
+	} else if (subCommand === "create-ctl-config") {
+		let admin = userManager.getByName(args.name);
+		if (!admin) {
+			logger.error(`No user named '${args.name}'`);
+			process.exitCode = 1;
+			return;
+		}
+		let ctlConfig = new lib.CtlConfig("control");
+
+		ctlConfig.set("ctl.controller_url", Controller.calculateControllerUrl(controllerConfig));
+		ctlConfig.set(
+			"ctl.controller_token",
+			userManager.signUserToken(admin),
+		);
+
+		let content = JSON.stringify(ctlConfig, null, "\t");
+		if (args.output === "-") {
+			// eslint-disable-next-line no-console
+			console.log(content);
+		} else {
+			logger.info(`Writing ${args.output}`);
+			await lib.safeOutputFile(args.output, content, { mode: 0o600 });
+		}
+	}
+}
+
+async function handleCopyStaticCommand(
+	args: any,
+	pluginInfos: lib.PluginNodeEnvInfo[],
+) {
+	await fs.cp(
+		path.join(import.meta.dirname, "..", "web", "static"),
+		args.target,
+		{
+			recursive: true,
+			mode: fs.constants.COPYFILE_FICLONE,
+		},
+	);
+	logger.info("Copied main web interface files");
+	for (const pluginInfo of pluginInfos) {
+		try {
+			await fs.cp(
+				pluginInfo.webStaticPath,
+				args.target,
+				{
+					recursive: true,
+					mode: fs.constants.COPYFILE_FICLONE,
+				},
+			);
+		} catch (err: any) {
+			if (err.code === "ENOENT") {
+				logger.info(`Skipped web interface files for ${pluginInfo.name}: ${err.message}`);
+			} else {
+				logger.error(`Unexpected error copying web interface files for ${pluginInfo.name}:\n${err.stack}`);
+				process.exitCode = 1;
+			}
+		}
+		logger.info(`Copied web interface files for ${pluginInfo.name}`);
+	}
+}
+
+export interface ControllerArgs {
+	[x: string]: unknown;
+	logLevel: string;
+	logDirectory: string;
+	pluginList: string;
+	devPlugin?: (string | number)[] | undefined;
+	dev?: boolean;
+	config: string;
+	_: (string | number)[];
+	$0: string;
+}
+
+interface InitializeParameters {
+	args: ControllerArgs;
+	shouldRun: boolean;
+	clusterLogger: winston.Logger;
+	pluginInfos: lib.PluginNodeEnvInfo[] | null;
+	controllerConfig: lib.ControllerConfig | null;
+}
+
+async function initialize(): Promise<InitializeParameters> {
+	// argument parsing
+	const args = await yargs(process.argv.slice(2))
+		.scriptName("controller")
+		.usage("$0 <command> [options]")
+		.option("log-level", {
+			nargs: 1,
+			describe: "Log level to print to stdout",
+			default: "info",
+			choices: ["none"].concat(Object.keys(levels)),
+			type: "string",
+		})
+		.option("log-directory", {
+			nargs: 1,
+			describe: "Directory to place logs in",
+			default: "logs",
+			type: "string",
+		})
+		.option("config", {
+			nargs: 1,
+			describe: "controller config file to use",
+			default: "config-controller.json",
+			type: "string",
+		})
+		.option("create-config", {
+			nargs: 0,
+			describe: "Create config file if it does not exist",
+			default: false,
+			type: "boolean",
+		})
+		.option("plugin-list", {
+			nargs: 1,
+			describe: "File containing list of plugins available with their install path",
+			default: "plugin-list.json",
+			type: "string",
+		})
+		.option("bypass-lock-file", { hidden: true, type: "boolean", nargs: 0, default: false })
+		.command("plugin", "Manage available plugins", lib.pluginCommand)
+		.command("config", "Manage Controller config", lib.configCommand)
+		.command("bootstrap", "Bootstrap access to cluster", yargs => {
+			yargs
+				.command("create-admin <name>", "Create a cluster admin", yargs => {
+					yargs.positional("name", { describe: "Name of the admin user", type: "string" });
+				})
+				.command("generate-user-token <name>", "Generate authentication token for the given user", yargs => {
+					yargs.positional("name", { describe: "Name of the user", type: "string" });
+				})
+				.command("generate-host-token <id>", "Generate authentication token for the given host", yargs => {
+					yargs.positional("id", { describe: "ID of the host", type: "number" });
+				})
+				.command("create-ctl-config <name>", "Create clusterioctl config for the given user", yargs => {
+					yargs.option("output", {
+						describe: "Path to output config (- for stdout)", type: "string",
+						nargs: 1, default: "config-ctl.json",
+					});
+				})
+				.demandCommand(1, "You need to specify a command to run");
+		})
+		.command("copy-static [target]", "Copy static Web UI files to a folder", yargs => {
+			yargs.positional("target", {
+				describe: "Target directory to copy files to",
+				type: "string",
+				default: "static",
+			});
+		})
+		.command("run", "Run controller", yargs => {
+			yargs.option("can-restart", {
+				type: "boolean", nargs: 0, default: false,
+				describe: "Indicate that a process monitor will restart the controller on failure",
+			});
+			yargs.option("recovery", {
+				type: "boolean", nargs: 0, default: false,
+				describe: "Start the controller in recovery mode with all plugins disabled and hosts disconnected",
+			});
+			yargs.option("check-user-count", { hidden: true, type: "boolean", nargs: 0, default: true });
+			yargs.option("dev", { hidden: true, type: "boolean", nargs: 0 });
+			yargs.option("dev-plugin", { hidden: true, type: "array" });
+		})
+		.demandCommand(1, "You need to specify a command to run")
+		.strict()
+		.parse()
+	;
+
+	// Combined log stream of the whole cluster.
+	const clusterLogger = winston.createLogger({
+		format: winston.format.json(),
+		level: "verbose",
+		levels,
+	});
+	clusterLogger.add(new DailyRotateFile({
+		format: winston.format.json(),
+		filename: "cluster-%DATE%.log",
+		utc: true,
+		dirname: path.join(args.logDirectory, "cluster"),
+	}));
+
+	// Log stream for the controller.
+	logger.add(new DailyRotateFile({
+		format: winston.format.json(),
+		filename: "controller-%DATE%.log",
+		utc: true,
+		dirname: path.join(args.logDirectory, "controller"),
+	}));
+	logger.add(new winston.transports.Stream({
+		stream: clusterLogger,
+	}));
+	if (args.logLevel !== "none") {
+		logger.add(new ConsoleTransport({
+			level: args.logLevel,
+			format: new lib.TerminalFormat(),
+		}));
+	}
+	lib.handleUnhandledErrors();
+
+	let command = args._[0];
+	let shouldRun = false;
+	if (command === "run") {
+		logger.info(`Starting Clusterio controller ${packageConfig.version}`);
+		if (args.recovery) {
+			logger.warn("Controller recovery mode enabled. Some features will be disabled.");
+		}
+		shouldRun = true;
+	}
+
+	logger.info(`Loading available plugins from ${args.pluginList}`);
+	let pluginList = await lib.loadPluginList(args.pluginList);
+
+	// If the command is plugin management we don't try to load plugins
+	if (command === "plugin") {
+		await lib.handlePluginCommand(args, pluginList, args.pluginList);
+		return {
+			args,
+			shouldRun,
+			clusterLogger,
+			pluginInfos: null,
+			controllerConfig: null,
+		};
+	}
+
+	logger.info("Loading Plugin info");
+	const pluginInfos = await lib.loadPluginInfos(pluginList);
+	lib.registerPluginMessages(pluginInfos);
+	lib.registerPluginPermissions(pluginInfos);
+	lib.addPluginConfigFields(pluginInfos);
+	if (!args.recovery) {
+		await lib.loadPluginMigrations(pluginInfos);
+	}
+
+	const [controllerConfig, controllerConfigLock] = await lib.loadConfigFromArgs(
+		args,
+		lib.ControllerConfig,
+		"controller",
+	);
+
+	controllerConfig.set("controller.version", packageConfig.version); // Allows tracking last loaded version
+
+	if (!controllerConfig.get("controller.auth_secret")) {
+		logger.info("Generating new controller authentication secret");
+		let asyncRandomBytes = util.promisify(crypto.randomBytes);
+		let bytes = await asyncRandomBytes(256);
+		controllerConfig.set("controller.auth_secret", bytes.toString("base64"));
+		await controllerConfig.save();
+	}
+
+	if (command === "config") {
+		await lib.handleConfigCommand(args, controllerConfig, controllerConfigLock);
+	} else if (command === "bootstrap") {
+		await handleBootstrapCommand(args, controllerConfig, controllerConfigLock);
+	} else if (command === "copy-static") {
+		await handleCopyStaticCommand(args, pluginInfos);
+	} else if (shouldRun) {
+		await controllerConfigLock.acquire(); // Hold the lock until process exit
+	}
+
+	return {
+		args,
+		clusterLogger,
+		pluginInfos,
+		controllerConfig,
+		shouldRun,
+	};
+}
+
+async function startup() {
+	// Set the process title, shows up as the title of the CMD window on windows
+	// and as the process name in ps/top on linux.
+	process.title = "clusteriocontroller";
+
+	let {
+		args,
+		shouldRun,
+		clusterLogger,
+		pluginInfos,
+		controllerConfig,
+	} = await initialize();
+	if (!shouldRun || !pluginInfos || !controllerConfig) {
+		return;
+	}
+
+	controller = new Controller(
+		clusterLogger,
+		pluginInfos,
+		controllerConfig,
+		Boolean(args.canRestart),
+		Boolean(args.recovery),
+		...await Controller.bootstrap(controllerConfig)
+	);
+
+	// Refuse to start if there are no users loaded
+	if (args.checkUserCount && controller.users.records.size === 0) {
+		logger.fatal(
+			"Cannot start controller, no users loaded.\n" +
+			"Try `npx clusteriocontroller bootstrap create-admin <username>`");
+		process.exit(1);
+	}
+
+	// Handle interrupts
+	process.on("SIGINT", lib.createShutdownGuard(logger, "interrupt", controller.stop.bind(controller)));
+	process.on("SIGTERM", lib.createShutdownGuard(logger, "termination", controller.stop.bind(controller)));
+	process.on("SIGHUP", () => {
+		logger.info("Terminal closed, shutting down");
+		controller.stop();
+	});
+
+	await controller.start(args);
+}
+
+export function bootstrap() {
+	startup().catch(err => {
+		if (err instanceof lib.StartupError || err.code === "InstallationError") {
+			logger.fatal(`
++-------------------------------+
+| Unable to to start controller |
++-------------------------------+
+${err.stack}`
+			);
+		} else if (err instanceof lib.PluginError) {
+			logger.fatal(`
+${err.pluginName} plugin threw an unexpected error
+during startup, please report it to the plugin author.
+------------------------------------------------------
+${err.original.stack}`
+			);
+		} else {
+			logger.fatal(`
++------------------------------------------------------------+
+| Unexpected error occured while starting controller, please |
+| report it to https://github.com/clusterio/clusterio/issues |
++------------------------------------------------------------+
+${err.stack}`
+			);
+		}
+
+		process.exitCode = 1;
+	});
+}
+
+if (import.meta.main) {
+	bootstrap();
+}

packages/controller/index.ts

@@ -0,0 +1,17 @@
+import { bootstrap } from "./controller.js";
+export { default as Controller } from "./src/Controller.js";
+export { default as ControllerRouter } from "./src/ControllerRouter.js";
+export { default as ControlConnection } from "./src/ControlConnection.js";
+export { default as HostConnection } from "./src/HostConnection.js";
+export { default as InstanceRecord } from "./src/InstanceRecord.js";
+export { default as InstanceManager } from "./src/InstanceManager.js";
+export { default as HostRecord } from "./src/HostRecord.js";
+export { BaseControllerPlugin, ControllerHooks, type ControllerPluginContext } from "./src/BaseControllerPlugin.js";
+export { default as UserManager } from "./src/UserManager.js";
+export { default as UserRecord } from "./src/UserRecord.js";
+export { default as User } from "./src/User.js";
+export { default as WsServer } from "./src/WsServer.js";
+
+if (import.meta.main) {
+	bootstrap();
+}

packages/controller/package.json

@@ -0,0 +1,74 @@
+{
+	"name": "@clusterio/controller",
+	"version": "2.0.2",
+	"description": "Implementation of Clusterio controller",
+	"homepage": "https://github.com/clusterio/clusterio#readme",
+	"author": "Hornwitser <github@hornwitser.no>",
+	"license": "MIT",
+
+	"keywords": [
+		"clusterio",
+		"factorio"
+	],
+
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/clusterio/clusterio"
+	},
+	"bugs": {
+		"url": "https://github.com/clusterio/clusterio/issues"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+
+	"type": "module",
+	"main": "dist/node/index.js",
+	"scripts": {
+		"prepare": "tsc --build && webpack-cli --mode production",
+		"test": "echo \"Error: no test specified\" && exit 1"
+	},
+	"bin": {
+		"clusteriocontroller": "./dist/node/controller.js"
+	},
+	"engines": {
+		"node": ">=22"
+	},
+
+	"dependencies": {
+		"@clusterio/lib": "workspace:^",
+		"@sinclair/typebox": "catalog:",
+		"busboy": "^1.6.0",
+		"compression": "^1.8.2",
+		"express": "catalog:",
+		"finalhandler": "^2.1.1",
+		"jsonwebtoken": "catalog:",
+		"jszip": "catalog:",
+		"semver": "catalog:",
+		"winston": "catalog:",
+		"winston-daily-rotate-file": "catalog:",
+		"ws": "catalog:",
+		"yargs": "catalog:"
+	},
+	"devDependencies": {
+		"@clusterio/web_ui": "workspace:^",
+		"@swc/core": "catalog:",
+		"@types/busboy": "^1.5.4",
+		"@types/compression": "^1.8.1",
+		"@types/express": "catalog:",
+		"@types/finalhandler": "catalog:",
+		"@types/jsonwebtoken": "catalog:",
+		"@types/node": "catalog:",
+		"@types/semver": "catalog:",
+		"@types/ws": "catalog:",
+		"@types/yargs": "catalog:",
+		"react": "catalog:",
+		"react-dom": "catalog:",
+		"react-router-dom": "catalog:",
+		"typescript": "catalog:",
+		"webpack": "catalog:",
+		"webpack-cli": "catalog:",
+		"webpack-dev-middleware": "^6.1.3",
+		"webpack-merge": "catalog:"
+	}
+}

packages/controller/src/BaseConnection.ts

@@ -0,0 +1,121 @@
+import path from "path";
+import fs from "node:fs/promises";
+
+import type Controller from "./Controller.js";
+import type WsServerConnector from "./WsServerConnector.js";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+import * as routes from "./routes.js";
+
+
+/**
+ * Base class for controller connections
+ *
+ * @extends module:lib.Link
+ * @alias module:controller/src/BaseConnection
+ */
+export default class BaseConnection extends lib.Link {
+	declare "connector": WsServerConnector;
+
+	constructor(
+		connector: lib.WebSocketBaseConnector,
+		public _controller: Controller
+	) {
+		super(connector);
+		this.router = _controller.router;
+		for (let [Request, handler] of this._controller._registeredRequests) { this.handle(Request, handler); }
+		for (let [Request, handler] of this._controller._fallbackedRequests) { this.fallbackRequest(Request, handler); }
+		for (let [Event, handler] of this._controller._registeredEvents) { this.handle(Event, handler); }
+		for (let [Event, handler] of this._controller._snoopedEvents) { this.snoopEvent(Event, handler); }
+
+		this.handle(lib.ModPackGetRequest, this.handleModPackGetRequest.bind(this));
+		this.handle(lib.ModPackGetDefaultRequest, this.handleModPackGetDefaultRequest.bind(this));
+		this.handle(lib.ModDownloadRequest, this.handleModDownloadRequest.bind(this));
+		this.handle(lib.FactorioVersionsRequest, this.handleFactorioVersionsRequest.bind(this));
+		this.handle(lib.LatestReleasesRequest, this.handleLatestReleasesRequest.bind(this));
+
+		this.handle(lib.SubscriptionRequest, this.handleSubscriptionRequest.bind(this));
+		this.connector.on("close", () => {
+			this._controller.subscriptions.unsubscribeLink(this);
+		});
+	}
+
+	async disconnect(code: number, reason: string) {
+		try {
+			await this.connector.disconnect(code, reason);
+		} catch (err: any) {
+			if (!(err instanceof lib.SessionLost)) {
+				logger.error(`"Unexpected error preparing disconnect:\n${err.stack}`);
+			}
+		}
+	}
+
+	/**
+	 * True if the link is connected, not in the dropped state and not in
+	 * the process of disconnecting.
+	 */
+	get connected(): boolean {
+		return this.connector.connected;
+	}
+
+	async handleModPackGetRequest(request: lib.ModPackGetRequest): Promise<lib.ModPack> {
+		let { id } = request;
+		let modPack = this._controller.modPacks.get(id);
+		if (!modPack) {
+			throw new lib.RequestError(`Mod pack with ID ${id} does not exist`);
+		}
+		return modPack;
+	}
+
+	async handleModPackGetDefaultRequest(): Promise<lib.ModPack> {
+		let id = this._controller.config.get("controller.default_mod_pack_id");
+		if (id === null) {
+			throw new lib.RequestError("Default mod pack not set on controller");
+		}
+		let modPack = this._controller.modPacks.get(id);
+		if (!modPack) {
+			throw new lib.RequestError(`Default mod pack configured (${id}) does not exist`);
+		}
+		return modPack;
+	}
+
+	getMod(mod: { name: string, version: lib.SourceVersion, sha1?: string }) {
+		let filename = lib.ModInfo.filename(mod.name, mod.version);
+		let modInfo = this._controller.modStore.files.get(filename);
+		if (!modInfo) {
+			throw new lib.RequestError(`Mod ${filename} does not exist on controller`);
+		}
+		if (mod.sha1 && mod.sha1 !== modInfo.sha1) {
+			throw new lib.RequestError(`Mod ${filename} checksum does not match controller's checksum`);
+		}
+		return modInfo;
+	}
+
+	async handleModDownloadRequest(request: lib.ModDownloadRequest) {
+		let mod = this.getMod(request);
+		let modPath = path.join(this._controller.config.get("controller.mods_directory"), mod.filename);
+		// Open source file before creating the stream in case it throws.
+		let source = (await fs.open(modPath)).createReadStream();
+
+		let stream = await routes.createProxyStream(this._controller.app);
+		stream.filename = mod.filename;
+		stream.source = source;
+		stream.mime = "application/zip";
+		stream.size = String(mod.size);
+
+		return stream.id;
+	}
+
+	async handleSubscriptionRequest(request: lib.SubscriptionRequest, src: lib.Address, dst: lib.Address) {
+		return await this._controller.subscriptions.handleRequest(this, request, src, dst);
+	}
+
+	async handleFactorioVersionsRequest(request: lib.FactorioVersionsRequest) {
+		return await this._controller.factorioVersions.get(request.maxAgeMs);
+	}
+
+	async handleLatestReleasesRequest(request: lib.LatestReleasesRequest) {
+		return await this._controller.latestReleases.get(request.maxAgeMs);
+	}
+}

packages/controller/src/BaseControllerPlugin.ts

@@ -0,0 +1,361 @@
+import type Controller from "./Controller.js";
+import type InstanceRecord from "./InstanceRecord.js";
+import type ControlConnection from "./ControlConnection.js";
+import type HostConnection from "./HostConnection.js";
+import * as lib from "@clusterio/lib";
+
+export type ControllerPluginContext = lib.PluginLoadContext<{
+	controller: Controller;
+	metrics: any;
+}>;
+
+/**
+ * Collection of controller plugin hooks
+ */
+export class ControllerHooks extends lib.AsyncHookCollection {
+	constructor(logger: lib.Logger) {
+		super(logger);
+		this.save = this.newHook();
+		this.metrics = this.newHook();
+		this.shutdown = this.newHook();
+		this.instanceStatusChanged = this.newHook();
+		this.instanceConfigFieldChanged = this.newHook();
+		this.controllerConfigFieldChanged = this.newHook();
+		this.controlConnectionEvent = this.newHook();
+		this.hostConnectionEvent = this.newHook();
+		this.prepareHostDisconnect = this.newHook();
+		this.modPacksUpdated = this.newHook();
+		this.modsUpdated = this.newHook();
+		this.rolesUpdated = this.newHook();
+		this.playerEvent = this.newHook();
+	}
+
+	/**
+	 * Called when the controller saves data in memory to disk
+	 *
+	 * Invoked on the configured controller.autosave_interval by the
+	 * controller and intended to be used to flush any in memory data that
+	 * has changed to disk.
+	 *
+	 * This will also be called during graceful shutdown after {@link
+	 * BaseControllerPlugin.onShutdown} have been invoked and all links have
+	 * been disconnected.
+	 */
+	readonly save: lib.AsyncHook<[]>;
+
+	/**
+	 * Called when the status of an instance changes
+	 *
+	 * Invoked when the controller has changed the status of an instance
+	 * or received notice from a host that the status of an instance has
+	 * changed.  The possible statuses that can be notified about are:
+	 * - `unassigned:`: Instance is no longer asssigned to a host.
+	 * - `unknown`: Host assigned to instance is offline.
+	 * - `stopped`: Instance is no longer running or was just assigned to a
+	 *   host.
+	 * - `starting`: Instance is in the process of starting up.
+	 * - `running`: Instance startup completed and is now running.
+	 * - `stopping`: Instance is in the processing stopping.
+	 * - `creating_save`: Instance is in the process of creating a save.
+	 * - `exporting_data`: Instance is in the process of exporting item
+	 *   icons and locale data.
+	 * - `deleted`: Instance was deleted.
+	 *
+	 * On controller startup all known instances gets the status `unknown` if
+	 * they are assigned to a host, when the host then connects to the
+	 * controller and informs of the current status of its instances this hook
+	 * is invoked for all those instances.  You can detect this situation by
+	 * checking if prev equals `unknown`.  If the host disconnects the
+	 * instances will again get the `unknown` status.
+	 *
+	 * When instances are created on the controller they will notify of a status
+	 * change with prev set to null.  While the status of new instances is
+	 * in most cases `unassigned` it's possible for the created instance to
+	 * start with any state in some host connection corner cases.
+	 *
+	 * Note that it's possible for status change notification to get lost in
+	 * the case of network outages if reconnect fails to re-establish the
+	 * session between the controller and the host.
+	 *
+	 * @param instance -
+	 *     The instance that changed.
+	 * @param prev - the previous status of the instance.
+	 */
+	readonly instanceStatusChanged: lib.AsyncHook<[instance: InstanceRecord, prev: lib.InstanceStatus | undefined]>;
+
+	/**
+	 * Called when the value of a controller config field changed.
+	 *
+	 * Invoked after the value of the config field given by `field` has
+	 * changed on the controller.
+	 *
+	 * @param field - Name of the field that changed.
+	 * @param curr - The current value of the field.
+	 * @param prev - The previous value of the field.
+	 */
+	readonly controllerConfigFieldChanged: lib.AsyncHook<[field: string, curr: unknown, prev: unknown]>;
+
+	/**
+	 * Called when the value of an instance config field changed.
+	 *
+	 * Invoked after the value of the config field given by `field` has
+	 * changed on an instance.
+	 *
+	 * @param instance -
+	 *     The instance the config changed on.
+	 * @param field - Name of the field that changed.
+	 * @param curr - The current value of the field.
+	 * @param prev - The previous value of the field.
+	 */
+	// eslint-disable-next-line max-len
+	readonly instanceConfigFieldChanged: lib.AsyncHook<[instance: InstanceRecord, field: string, curr: unknown, prev: unknown]>;
+
+	/**
+	 * Called before collecting Prometheus metrics
+	 *
+	 * Invoked before the default metrics of prometheus is collected.  Note
+	 * that since this is done while replying to /metrics this should not
+	 * take a long time, otherwise the requst will time out.
+	 *
+	 * Although you can return the results of collecting your prometheus
+	 * collectors directly, all gauges in the default registry is already
+	 * automatically collected.  It's therefore recommended to only update
+	 * the Gauges/Counters/etc in onMetric and let Clusterio deal will
+	 * collecting the values.
+	 *
+	 * @returns an async iterator of prometheus metric results or undefined.
+	 */
+	readonly metrics: lib.AsyncHook<[], AsyncIterable<lib.CollectorResult> | void>;
+
+	/**
+	 * Called when the controller is shutting down
+	 */
+	readonly shutdown: lib.AsyncHook<[]>;
+
+	/**
+	 * Called when an event on a host connection happens
+	 *
+	 * The event param may be one of connect, drop, resume and close and has
+	 * the following meaning:
+	 *
+	 * ##### connect
+	 *
+	 * Invoked when a new connection to the host has been established.
+	 *
+	 * ##### drop
+	 *
+	 * Invoked when a connection loss is detected between the controller and a
+	 * host.  Plugins should respond to this event by throtteling messages
+	 * it is sending to the given host connection to an absolute minimum.
+	 *
+	 * Messages sent over a dropped host connection will get queued up in
+	 * memory on the controller and sent all in one go when the connection is
+	 * re-established again.
+	 *
+	 * ##### resume
+	 *
+	 * Invoked when a connection that had previously been dropped is
+	 * re-established
+	 *
+	 * ##### close
+	 *
+	 * Invoked when the connection to the host has been closed.
+	 *
+	 * @param connection -
+	 *     The connection the event occured on.
+	 * @param event - one of connect, drop, resume and close
+	 */
+	// eslint-disable-next-line max-len
+	readonly hostConnectionEvent: lib.AsyncHook<[connection: HostConnection, event: "connect" | "drop" | "resume" | "close"]>;
+
+	/**
+	 * Called when an avent on a control connection happens
+	 *
+	 * The event param may be one of connect, drop, resume and close and has
+	 * the following meaning:
+	 *
+	 * ##### connect
+	 *
+	 * Invoked when a new connection to the control has been established.
+	 *
+	 * ##### drop
+	 *
+	 * Invoked when a connection loss is detected between the controller and a
+	 * control.  Plugins should respond to this event by throtteling
+	 * messages it is sending to the given control connection to an absolute
+	 * minimum.
+	 *
+	 * Messages sent over a dropped control connection will get queued up in
+	 * memory on the controller and sent all in one go when the connection is
+	 * re-established again.
+	 *
+	 * ##### resume
+	 *
+	 * Invoked when a connection that had previously been dropped is
+	 * re-established.
+	 *
+	 * ##### close
+	 *
+	 * Invoked when the connection to the control has been closed.
+	 *
+	 * @param connection -
+	 *     The connection the event occured on.
+	 * @param event - one of connect, drop, resume, and close.
+	 */
+	// eslint-disable-next-line max-len
+	readonly controlConnectionEvent: lib.AsyncHook<[connection: ControlConnection, event: "connect" | "drop" | "resume" | "close"]>;
+
+	/**
+	 * Called when a host is preparing to disconnect from the controller
+	 *
+	 * Invoked when a host has requested the disconnection from the controller.
+	 * This typically happens when it is in the process of shutting down.
+	 *
+	 * Plugins must stop sending messages to the host in question after the
+	 * prepare disconnect has been handled.
+	 *
+	 * @param connection -
+	 *     The connection to the host preparing to disconnect.
+	 */
+	readonly prepareHostDisconnect: lib.AsyncHook<[connection: HostConnection]>;
+
+	/**
+	 * Called when one or more mod packs are updated
+	 *
+	 * Invoked when one or more mod pack have been added, updated or deleted
+	 * in the cluster.
+	 *
+	 * If a mod pack has been deleted its `.isDeleted` property will be
+	 * true.
+	 *
+	 * @param modPacks - Mod packs that updated.
+	 */
+	readonly modPacksUpdated: lib.AsyncHook<[modPacks: lib.ModPack[]]>;
+
+	/**
+	 * Called when one or more mod stored on the controller are updated
+	 *
+	 * Invoked when one or more mods have been added, updated or deleted
+	 * from the pool of shared mods stored on the cluster.
+	 *
+	 * If a mod has been deleted its `.isDeleted` property will be true.
+	 *
+	 * @param mods - Mods that updated.
+	 */
+	readonly modsUpdated: lib.AsyncHook<[mods: lib.ModInfo[]]>;
+
+	/**
+	 * Called when one or more roles stored on the controller are updated
+	 *
+	 * Invoked when one or more roles have been added, updated or deleted.
+	 *
+	 * If a role has been deleted its `.isDeleted` property will be true.
+	 *
+	 * @param roles - Roles that updated.
+	 */
+	readonly rolesUpdated: lib.AsyncHook<[roles: lib.Role[]]>;
+
+	/**
+	 * Called when a player joins or leaves an instance
+	 *
+	 * Invoked when a player either joins or leaves an instance in the
+	 * cluster.
+	 *
+	 * @param instance -
+	 *     The instance it occured on.
+	 * @param event - Information about the event.
+	 */
+	readonly playerEvent: lib.AsyncHook<[instance: InstanceRecord, event: lib.PlayerEvent]>;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
+export interface BaseControllerPlugin {
+	onSaveData?(): Promise<void>;
+	onMetrics?(): Promise<void | AsyncIterable<lib.CollectorResult>>;
+	onShutdown?(): Promise<void>;
+	onInstanceStatusChanged?(instance: InstanceRecord, prev?: lib.InstanceStatus): Promise<void>;
+	onControllerConfigFieldChanged?(field: string, curr: unknown, prev: unknown): Promise<void>;
+	onInstanceConfigFieldChanged?(instance: InstanceRecord, field: string, curr: unknown, prev: unknown): Promise<void>;
+	onHostConnectionEvent?(connection: HostConnection, event: "connect" | "drop" | "resume" | "close"): void;
+	onControlConnectionEvent?(connection: ControlConnection, event: "connect" | "drop" | "resume" | "close"): void;
+	onPrepareHostDisconnect?(connection: HostConnection): Promise<void>;
+	onModPacksUpdated?(modPacks: lib.ModPack[]): Promise<void>;
+	onModsUpdated?(mods: lib.ModInfo[]): Promise<void>;
+	onRolesUpdated?(roles: lib.Role[]): Promise<void>;
+	onPlayerEvent?(instance: InstanceRecord, event: lib.PlayerEvent): Promise<void>;
+}
+
+/**
+ * Base class for controller plugins
+ *
+ * Controller plugins are subclasses of this class which get instantiated by
+ * the controller on startup when the plugin is enabled in the config.
+ * To be discovered the class must be exported under the name `ControllerPlugin`
+ * in the module specified by the `controllerEntrypoint` in the plugin's
+ * `plugin` export.
+ */
+// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
+export class BaseControllerPlugin {
+	constructor(
+		public info: lib.PluginNodeEnvInfo,
+		public controller: Controller,
+		public metrics: any,
+		public logger: lib.Logger,
+	) {
+		const attach = <Args extends unknown[], Return>(
+			hook: lib.AsyncHook<Args, Return>,
+			fn?: lib.HookHandler<Args, Return>,
+		) => {
+			if (fn) {
+				hook.attach(info.name, fn.bind(this));
+			}
+		};
+
+		attach(controller.hooks.save, this.onSaveData);
+		attach(controller.hooks.instanceStatusChanged, this.onInstanceStatusChanged);
+		attach(controller.hooks.controllerConfigFieldChanged, this.onControllerConfigFieldChanged);
+		attach(controller.hooks.instanceConfigFieldChanged, this.onInstanceConfigFieldChanged);
+		attach(controller.hooks.metrics, this.onMetrics);
+		attach(controller.hooks.shutdown, this.onShutdown);
+		attach(controller.hooks.hostConnectionEvent, this.onHostConnectionEvent);
+		attach(controller.hooks.controlConnectionEvent, this.onControlConnectionEvent);
+		attach(controller.hooks.prepareHostDisconnect, this.onPrepareHostDisconnect);
+		attach(controller.hooks.modPacksUpdated, this.onModPacksUpdated);
+		attach(controller.hooks.modsUpdated, this.onModsUpdated);
+		attach(controller.hooks.rolesUpdated, this.onRolesUpdated);
+		attach(controller.hooks.playerEvent, this.onPlayerEvent);
+	}
+
+	static fromContext(context: ControllerPluginContext) {
+		return new this(context.plugin, context.controller, context.metrics, context.logger);
+	}
+
+	detachHooks() {
+		this.controller.hooks.detachAll(this.info.name);
+	}
+
+	/**
+	 * Called immediately after the class is instantiated
+	 */
+	async init() {}
+
+	/**
+	 * Broadcast event to all connected hosts
+	 *
+	 * Sends the given event to all hosts connected to the controller.
+	 * This does not include hosts that are in the process of closing the
+	 * connection, which typically happens when they are shutting down.
+	 *
+	 * @param event - Event to send
+	 */
+	broadcastEventToHosts<T>(event: lib.Event<T>) {
+		for (let hostConnection of this.controller.wsServer.hostConnections.values()) {
+			if (
+				!hostConnection.connector.closing
+				&& (!event.constructor.plugin || hostConnection.plugins.has(event.constructor.plugin))
+			) {
+				hostConnection.send(event);
+			}
+		}
+	}
+}

packages/controller/src/ControllerRouter.ts

@@ -0,0 +1,132 @@
+import type Controller from "./Controller.js";
+import type BaseConnection from "./BaseConnection.js";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+import HostConnection from "./HostConnection.js";
+import ControlConnection from "./ControlConnection.js";
+
+export default class ControllerRouter {
+	constructor(
+		public controller: Controller
+	) {}
+
+	/**
+	 * @param origin - Source link of the message.
+	 * @param message - Link the message originated from.
+	 * @param entry - message entry if message is a request or an event.
+	 * @param hasFallback - true if fallback handling is available.
+	 * @returns true if the message was handled
+	 */
+	forwardMessage(
+		origin: ControlConnection | HostConnection,
+		message: lib.MessageRoutable,
+		entry: lib.RequestEntry | lib.EventEntry | undefined,
+		hasFallback: boolean
+	): boolean {
+		if (!["request", "response", "responseError", "event"].includes(message.type)) {
+			throw new Error(`Message type ${message.type} can't be forwarded`);
+		}
+
+		let dst: lib.Address = message.dst;
+		let nextHop: ControlConnection | HostConnection | undefined;
+		let msg: string = "";
+		if (dst.type === lib.Address.broadcast) {
+			this.broadcastMessage(origin, message, entry as lib.EventEntry);
+			return true;
+		} else if (dst.type === lib.Address.host) {
+			nextHop = this.controller.wsServer.hostConnections.get(dst.id);
+			if (!nextHop) {
+				msg = `Host ${dst.id} is offline`;
+			}
+		} else if (dst.type === lib.Address.instance) {
+			let instance = this.controller.instances.get(dst.id);
+			if (!instance) {
+				msg = `Instance ${dst.id} does not exist`;
+			} else {
+				let assignedHost = instance.config.get("instance.assigned_host");
+				if (assignedHost === null) {
+					msg = `Instance ${dst.id} is not assigned a host`;
+				} else {
+					nextHop = this.controller.wsServer.hostConnections.get(assignedHost);
+					if (!nextHop) {
+						msg = `Assigned host for instance ${dst.id} is offline`;
+					}
+				}
+			}
+		} else if (dst.type === lib.Address.control) {
+			nextHop = this.controller.wsServer.controlConnections.get(dst.id);
+			if (!nextHop) {
+				msg = "Control connection does not exist";
+			}
+		} else if (dst.type === lib.Address.controller) {
+			msg = `Unexpected message forwarded to ${dst}`;
+		}
+
+		if (nextHop === origin) {
+			msg = `Message would return back to sender ${origin.connector.dst}.`;
+			nextHop = undefined;
+		}
+
+		if (message.type === "request") {
+			if (!nextHop) {
+				if (hasFallback) {
+					return false;
+				}
+				origin.connector.sendResponseError(
+					new lib.ResponseError(msg || "Unroutable destination"), message.src
+				);
+				return true;
+			}
+		}
+
+		if (nextHop) {
+			if (message.type === "request") {
+				nextHop.forwardRequest(message as lib.MessageRequest, origin);
+			} else {
+				nextHop.connector.forward(message);
+			}
+		} else {
+			this.warnUnrouted(message, msg);
+		}
+
+		return true;
+	}
+
+	broadcastMessage(
+		origin: lib.Link,
+		message: lib.MessageRoutable,
+		entry: lib.EventEntry,
+	) {
+		let dst = message.dst;
+		if (message.type !== "event") {
+			this.warnUnrouted(message, `Unexpected broadcast of ${message.type}`);
+			return;
+		}
+		const plugin = entry.Event.plugin;
+		if (dst.id === lib.Address.host || dst.id === lib.Address.instance) {
+			for (let hostConnection of this.controller.wsServer.hostConnections.values()) {
+				if (hostConnection !== origin && (!plugin || hostConnection.plugins.has(plugin))) {
+					hostConnection.connector.forward(message);
+				}
+			}
+		} else if (dst.id === lib.Address.control) {
+			for (let controlConnection of this.controller.wsServer.controlConnections.values()) {
+				if (controlConnection !== origin) {
+					controlConnection.connector.forward(message);
+				}
+			}
+		} else {
+			this.warnUnrouted(message, `Unexpected broacdast target ${dst.id}`);
+		}
+	}
+
+	warnUnrouted(
+		message: lib.MessageRoutable,
+		msg: string
+	) {
+		let dst = message.dst;
+		let baseMsg = `No destination for ${message.constructor.name} routed from ${message.src} to ${dst}`;
+		logger.warn(msg ? `${baseMsg}: ${msg}.` : `${baseMsg}.`);
+	}
+}

packages/controller/src/HostConnection.ts

@@ -0,0 +1,464 @@
+import type Controller from "./Controller.js";
+import type WsServerConnector from "./WsServerConnector.js";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+
+import BaseConnection from "./BaseConnection.js";
+import InstanceRecord from "./InstanceRecord.js";
+import HostRecord from "./HostRecord.js";
+
+
+// How long log message warnings are suppressed for after one is logged.
+const logMessageWarnIntervalMs = 5 * 60 * 1000;
+
+/**
+ * Represents the connection to a host
+ *
+ * @extends module:controller/src/BaseConnection
+ * @alias module:controller/src/HostConnection
+ */
+export default class HostConnection extends BaseConnection {
+	private info: HostRecord;
+	plugins: Map<string, string>;
+	// Shared by all log message warnings, a misbehaving host could log in a loop.
+	private _lastLogMessageWarnMs = Number.NEGATIVE_INFINITY;
+
+	constructor(
+		registerData: lib.RegisterHostData,
+		connector: WsServerConnector,
+		controller: Controller,
+		remoteAddress: string,
+	) {
+		super(connector, controller);
+
+		this.plugins = new Map(Object.entries(registerData.plugins));
+
+		const previousHostInfo = this._controller.hosts.get(registerData.id);
+		this.info = new HostRecord(
+			registerData.id,
+			previousHostInfo?.name ?? "",
+			registerData.version,
+			this.plugins,
+			true,
+			remoteAddress,
+			previousHostInfo?.publicAddress,
+			previousHostInfo?.tokenValidAfter,
+			0,
+			false,
+		);
+		this._controller.hosts.set(this.info);
+
+		this._checkPluginVersions();
+
+		for (let event of ["connect", "drop", "resume", "close"] as const) {
+			this.connector.on(event, () => this._controller.hooks.hostConnectionEvent.invoke(this, event));
+		}
+
+		this.connector.on("close", () => {
+			// Update status to unknown for instances on this host.
+			const instances: InstanceRecord[] = [];
+			for (let instance of this._controller.instances.valuesMutable()) {
+				if (instance.config.get("instance.assigned_host") !== this.id) {
+					continue;
+				}
+
+				instances.push(instance);
+				let prev = instance.status;
+				instance.status = "unknown";
+				this._controller.hooks.instanceStatusChanged.invoke(instance, prev);
+			}
+			this._controller.instances.records.setMany(instances);
+
+			this.info.connected = false;
+			this._controller.hosts.set(this.info);
+		});
+
+		this.handle(lib.GetFactorioCredentialsRequest, this.handleGetFactorioCredentialsRequest.bind(this));
+		this.handle(lib.HostInfoUpdateEvent, this.handleHostInfoUpdateEvent.bind(this));
+		this.handle(lib.InstanceStatusChangedEvent, this.handleInstanceStatusChangedEvent.bind(this));
+		this.handle(lib.InstancesUpdateRequest, this.handleInstancesUpdateRequest.bind(this));
+		this.handle(lib.InstanceSaveDetailsUpdatesEvent, this.handleInstanceSaveDetailsUpdatesEvent.bind(this));
+		this.handle(lib.LogMessageEvent, this.handleLogMessageEvent.bind(this));
+		this.handle(lib.InstancePlayerUpdateEvent, this.handleInstancePlayerUpdateEvent.bind(this));
+		this.snoopEvent(lib.InstanceAdminlistUpdateEvent, this.snoopInstanceAdminlistUpdateEvent.bind(this));
+		this.snoopEvent(lib.InstanceBanlistUpdateEvent, this.snoopInstanceBanlistUpdateEvent.bind(this));
+		this.snoopEvent(lib.InstanceWhitelistUpdateEvent, this.snoopInstanceWhitelistUpdateEvent.bind(this));
+	}
+
+	validateIngress(message: lib.MessageRoutable) {
+		let origin = this.connector.dst;
+		switch (message.src.type) {
+			case lib.Address.control:
+			case lib.Address.controller:
+				throw new lib.InvalidMessage(`Received message with invalid src ${message.src} from ${origin}`);
+
+			case lib.Address.host:
+				if (message.src.id !== origin.id) {
+					throw new lib.InvalidMessage(
+						`Received message with invalid src ${message.src} from ${origin}`
+					);
+				}
+				break;
+
+			case lib.Address.instance:
+				let instance = this._controller.instances.get(message.src.id);
+				if (!instance || instance.config.get("instance.assigned_host") !== this.id) {
+					throw new lib.InvalidMessage(
+						`Received message with invalid src ${message.src} from ${origin}`
+					);
+				}
+				break;
+
+			default:
+				throw new Error("Should be unreachable");
+		}
+	}
+
+	_checkPluginVersions() {
+		let pluginInfos = new Map(this._controller.pluginInfos.map(i => [i.name, i]));
+		for (let [name, version] of this.plugins) {
+			let info = pluginInfos.get(name);
+			if (!info) {
+				logger.warn(
+					`Host ${this.info.name} (${this.id}) has plugin ${name} ${version} which the ` +
+					"controller does not have",
+				);
+				continue;
+			}
+
+			if (info.version !== version) {
+				logger.warn(
+					`Host ${this.info.name} (${this.id}) has plugin ${name} ${version} which does not match ` +
+					`the version of this plugin on the controller (${info.version})`
+				);
+			}
+		}
+
+		for (let [name, info] of pluginInfos) {
+			if (!this.plugins.has(name)) {
+				logger.warn(`Host ${this.info.name} (${this.id}) is missing plugin ${name} ${info.version}`);
+			}
+		}
+	}
+
+	async prepareDisconnect() {
+		await this._controller.hooks.prepareHostDisconnect.invoke(this);
+		return await super.prepareDisconnect();
+	}
+
+	/**
+	 * ID of the host this connection is connected to
+	 *
+	 * @returns {number} host ID.
+	 */
+	get id() {
+		return this.info.id;
+	}
+
+	/**
+	 * Remote address of the host this connection is connected to
+	 *
+	 * @returns {string} host remote address.
+	 */
+	get remoteAddress() {
+		return this.info.remoteAddress;
+	}
+
+	async handleGetFactorioCredentialsRequest() {
+		if (this._controller.config.get("controller.share_factorio_credentials_with_hosts")) {
+			return {
+				username: this._controller.config.get("controller.factorio_username") ?? undefined,
+				token: this._controller.config.get("controller.factorio_token") ?? undefined,
+			};
+		}
+		return {};
+	}
+
+	async handleHostInfoUpdateEvent(event: lib.HostInfoUpdateEvent) {
+		this.info.name = event.update.name;
+		this.info.publicAddress = event.update.publicAddress;
+		this._controller.hosts.set(this.info);
+	}
+
+	async handleInstanceStatusChangedEvent(request: lib.InstanceStatusChangedEvent) {
+		let instance = this._controller.instances.getMutable(request.instanceId);
+
+		// It's possible to get updates from an instance that does not exist
+		// or is not assigned to the host it originated from if it was
+		// reassigned or deleted while the connection to the host it was
+		// originally on was down at the time.
+		if (!instance || instance.config.get("instance.assigned_host") !== this.id) {
+			logger.warn(`Got bogus update for instance id ${request.instanceId}`);
+			return;
+		}
+
+		// We may receive status changed where the status hasn't changed
+		// from our perspective if the connection was down at the time it
+		// changed.  Hosts also send status updates on assignInstance which
+		// for hacky reason is also used to push config changes and
+		// restablish status after a connection loss.
+		if (
+			instance.status === request.status
+			&& instance.gamePort === request.gamePort
+		) {
+			return;
+		}
+
+		let prev = instance.status;
+		instance.status = request.status;
+		// If the instance has transitioned to running then updated the started at time
+		if (request.status === "running" && prev === "starting") {
+			instance.startedAtMs = Date.now();
+		}
+
+		instance.gamePort = request.gamePort;
+		instance.factorioVersion = request.factorioVersion;
+		this._controller.instances.records.set(instance);
+		logger.verbose(`Instance ${instance.config.get("instance.name")} State: ${instance.status}`);
+		await this._controller.hooks.instanceStatusChanged.invoke(instance, prev);
+	}
+
+	async handleInstancesUpdateRequest(request: lib.InstancesUpdateRequest) {
+		// Push updated instance configs
+		for (let instance of this._controller.instances.values()) {
+			if (instance.config.get("instance.assigned_host") === this.id) {
+				await this.send(
+					new lib.InstanceAssignInternalRequest(instance.id, instance.config.toRemote("host"))
+				);
+			}
+		}
+
+		// Assign instances the host has but controller does not
+		const instanceUpdates: InstanceRecord[] = [];
+		for (let instanceData of request.instances) {
+			const instanceConfig = new lib.InstanceConfig("controller");
+			instanceConfig.update(instanceData.config, false, "host");
+
+			let controllerInstance = this._controller.instances.getMutable(instanceConfig.get("instance.id"));
+			if (controllerInstance) {
+				// Check if this instance is assigned somewhere else.
+				if (controllerInstance.config.get("instance.assigned_host") !== this.id) {
+					await this.send(
+						new lib.InstanceUnassignInternalRequest(instanceConfig.get("instance.id"))
+					);
+					continue;
+				}
+
+				// Already have this instance, update state instead
+				if (controllerInstance.status !== instanceData.status) {
+					let prev = controllerInstance.status;
+					controllerInstance.status = instanceData.status;
+					controllerInstance.gamePort = instanceData.gamePort;
+					controllerInstance.factorioVersion = instanceData.factorioVersion;
+					if (instanceData.status === "running" && prev === "starting") {
+						controllerInstance.startedAtMs = Date.now();
+					}
+					instanceUpdates.push(controllerInstance);
+					logger.verbose(`Instance ${instanceConfig.get("instance.name")} State: ${instanceData.status}`);
+					await this._controller.hooks.instanceStatusChanged.invoke(controllerInstance, prev);
+				}
+				continue;
+			}
+
+			instanceConfig.set("instance.assigned_host", this.id);
+			const newInstance = await this._controller.instances.createInstance(instanceConfig, true);
+			newInstance.factorioVersion = instanceData.factorioVersion;
+			newInstance.gamePort = instanceData.gamePort;
+			newInstance.status = instanceData.status;
+			instanceUpdates.push(newInstance);
+		}
+
+		// We suppress the changes made by createInstance so we must manually make them here
+		this._controller.instances.records.setMany(instanceUpdates);
+		await Promise.all(instanceUpdates.flatMap(newInstance => [
+			this._controller.hooks.instanceStatusChanged.invoke(newInstance, undefined),
+			this.send(
+				new lib.InstanceAssignInternalRequest(
+					newInstance.config.get("instance.id"), newInstance.config.toRemote("host")
+				)
+			),
+		]));
+
+		// Push lists to make sure they are in sync.
+		let adminlist: Set<string> = new Set();
+		let banlist: Map<string, string> = new Map();
+		let whitelist: Set<string> = new Set();
+
+		for (let user of this._controller.users.values()) {
+			if (user.isAdmin) {
+				adminlist.add(user.id);
+			}
+			if (user.isBanned) {
+				banlist.set(user.id, user.banReason);
+			}
+			if (user.isWhitelisted) {
+				whitelist.add(user.id);
+			}
+		}
+
+		await this.send(new lib.SyncUserListsEvent(adminlist, banlist, whitelist));
+	}
+
+	// A host may only report on instances assigned to it. Otherwise any host
+	// could speak for an instance on a different host. See
+	// handleInstanceStatusChangedEvent.
+	private _assignedInstance(instanceId: number) {
+		const instance = this._controller.instances.get(instanceId);
+		return instance?.config.get("instance.assigned_host") === this.id ? instance : undefined;
+	}
+
+	// Host connections live for days, so the suppression expires instead of
+	// latching for the life of the connection.
+	private _warnLogMessage(message: string) {
+		const now = Date.now();
+		if (now - this._lastLogMessageWarnMs < logMessageWarnIntervalMs) {
+			return;
+		}
+		this._lastLogMessageWarnMs = now;
+		logger.warn(message);
+	}
+
+	async handleInstanceSaveDetailsUpdatesEvent(event: lib.InstanceSaveDetailsUpdatesEvent) {
+		// Otherwise any host could inject save records for, or wipe the save
+		// list of, an instance on a different host.
+		if (event.instanceId !== undefined && !this._assignedInstance(event.instanceId)) {
+			logger.warn(`Got bogus save updates for instance id ${event.instanceId}`);
+			return;
+		}
+		if (event.updates.some(save => !this._assignedInstance(save.instanceId))) {
+			logger.warn(`Got bogus save updates from host id ${this.id}`);
+			return;
+		}
+
+		const updates: lib.SaveDetails[] = [];
+		const deletes: lib.SaveDetails[] = [];
+		for (const save of event.updates) {
+			const existingSave = this._controller.saves.get(save.id);
+			if (existingSave && save.equals(existingSave)) {
+				continue;
+			}
+			updates.push(save);
+		}
+		if (event.instanceId !== undefined) {
+			const updatedSaves = new Set(event.updates.map(s => s.id));
+			for (const save of this._controller.saves.values()) {
+				if (save.instanceId === event.instanceId && !updatedSaves.has(save.id)) {
+					deletes.push(save);
+				}
+			}
+		}
+		// Hosts eagerly send updates, which means we may get an update
+		// where nothing actually changed.
+		this._controller.saves.setMany(updates);
+		this._controller.saves.deleteMany(deletes);
+	}
+
+	async handleLogMessageEvent(event: lib.LogMessageEvent) {
+		// Fields beyond level and message survive schema validation, so the
+		// instance a log line claims to come from is whatever the host sent.
+		const info: typeof event.info & { instance_id?: number, instance_name?: string } = { ...event.info };
+		if (info.instance_id !== undefined) {
+			const instance = this._assignedInstance(info.instance_id);
+			if (!instance) {
+				// Demote to a host level line instead of dropping it. The host did
+				// log this, it just does not get to pin it on someone else's
+				// instance, and a host racing a reassignment still gets heard.
+				this._warnLogMessage(`Got bogus log message for instance id ${info.instance_id}`);
+				delete info.instance_id;
+				delete info.instance_name;
+			} else {
+				// The name the host sent may be stale or made up, ours is authoritative.
+				const name = instance.config.get("instance.name");
+				if (info.instance_name !== name) {
+					this._warnLogMessage(
+						`Got log message for instance id ${info.instance_id} named ` +
+						`${info.instance_name} which is named ${name} on the controller`
+					);
+					info.instance_name = name;
+				}
+			}
+		}
+
+		this._controller.clusterLogger.log({
+			...info,
+			host_id: this.id,
+			host_name: this.info.name,
+		});
+	}
+
+	async handleInstancePlayerUpdateEvent(event: lib.InstancePlayerUpdateEvent, src: lib.Address) {
+		let instanceId = src.id;
+		const user = this._controller.users.getOrCreateUser(event.name);
+
+		if (event.type === "join") {
+			user.notifyJoin(instanceId);
+		} else if (event.type === "leave") {
+			user.notifyLeave(instanceId);
+		}
+
+		user.instanceStats.set(instanceId, event.stats);
+
+		user.recalculatePlayerStats();
+		user.saveRecord();
+
+		let instance = this._controller.instances.get(instanceId)!;
+		await this._controller.hooks.playerEvent.invoke(instance, {
+			type: event.type,
+			name: event.name,
+			reason: event.reason,
+			stats: event.stats,
+		});
+	}
+
+	async snoopInstanceAdminlistUpdateEvent(event: lib.InstanceAdminlistUpdateEvent, src: lib.Address) {
+		if (src.type !== lib.Address.instance) {
+			return;
+		}
+
+		const user = this._controller.users.getOrCreateUser(event.name);
+		user.set("isAdmin", event.admin);
+
+		const instance = this._controller.instances.get(src.id)!;
+		await this._controller.hooks.playerEvent.invoke(instance, {
+			type: event.admin ? "promote" : "demote" as lib.PlayerEvent["type"],
+			name: event.name,
+			stats: user.instanceStats.get(src.id)!,
+		});
+	}
+
+	async snoopInstanceBanlistUpdateEvent(event: lib.InstanceBanlistUpdateEvent, src: lib.Address) {
+		if (src.type !== lib.Address.instance) {
+			return;
+		}
+
+		const user = this._controller.users.getOrCreateUser(event.name);
+		user.isBanned = event.banned;
+		user.banReason = event.reason;
+		user.saveRecord();
+
+		const instance = this._controller.instances.get(src.id)!;
+		await this._controller.hooks.playerEvent.invoke(instance, {
+			type: event.banned ? "ban" : "unban" as lib.PlayerEvent["type"],
+			name: event.name,
+			stats: user.instanceStats.get(src.id)!,
+			reason: event.reason,
+		});
+	}
+
+	async snoopInstanceWhitelistUpdateEvent(event: lib.InstanceWhitelistUpdateEvent, src: lib.Address) {
+		if (src.type !== lib.Address.instance) {
+			return;
+		}
+
+		const user = this._controller.users.getOrCreateUser(event.name);
+		user.set("isWhitelisted", event.whitelisted);
+
+		const instance = this._controller.instances.get(src.id)!;
+		await this._controller.hooks.playerEvent.invoke(instance, {
+			type: event.whitelisted ? "whitelisted" : "unwhitelisted" as lib.PlayerEvent["type"],
+			name: event.name,
+			stats: user.instanceStats.get(src.id)!,
+		});
+	}
+}

packages/controller/src/HostRecord.ts

@@ -0,0 +1,116 @@
+import { Type, Static } from "@sinclair/typebox";
+import { HostDetails } from "@clusterio/lib";
+
+/** Underlying data class for hosts on the controller */
+export default class HostRecord {
+	constructor(
+		/** Id of this host */
+		public id: number,
+		/** Name of this host */
+		public name: string,
+		/** Version this host last connected with */
+		public version: string,
+		/** Plugins this host last connected with */
+		public plugins: Map<string, string>,
+		/** True if this host is currently connected to controller */
+		public connected: boolean = false,
+		/** IP this host last connected from */
+		public remoteAddress: string = "",
+		/** Value of host.public_address configured for this host */
+		public publicAddress: string = "",
+		/** Unix timestamp in seconds host token must be issued after to be valid */
+		public tokenValidAfter: number = 0,
+		/** Millisecond Unix timestamp this entry was last updated at */
+		public updatedAtMs: number = 0,
+		/** True if this host has been deleted */
+		public isDeleted: boolean = false,
+	) { }
+
+	static jsonSchema = Type.Object({
+		"id": Type.Number(),
+		"name": Type.String(),
+		"version": Type.String(),
+		"plugins": Type.Record(Type.String(), Type.String()),
+		"connected": Type.Optional(Type.Boolean()),
+		"remote_address": Type.Optional(Type.String()),
+		"public_address": Type.Optional(Type.String()),
+		"token_valid_after": Type.Optional(Type.Number()),
+		"updated_at_ms": Type.Optional(Type.Number()),
+		"is_deleted": Type.Optional(Type.Boolean()),
+	});
+
+	static fromJSON(json: Static<typeof this.jsonSchema>) {
+		return new this(
+			json.id,
+			json.name,
+			json.version,
+			new Map(Object.entries(json.plugins)),
+			json.connected,
+			json.remote_address,
+			json.public_address,
+			json.token_valid_after,
+			json.updated_at_ms,
+			json.is_deleted,
+		);
+	}
+
+	toJSON() {
+		const json = {
+			id: this.id,
+			name: this.name,
+			version: this.version,
+			plugins: Object.fromEntries(this.plugins),
+		} as Static<typeof HostRecord.jsonSchema>;
+
+		if (this.connected !== false) {
+			json.connected = this.connected;
+		}
+		if (this.remoteAddress !== "") {
+			json.remote_address = this.remoteAddress;
+		}
+		if (this.publicAddress !== "") {
+			json.public_address = this.publicAddress;
+		}
+		if (this.tokenValidAfter !== 0) {
+			json.token_valid_after = this.tokenValidAfter;
+		}
+		if (this.updatedAtMs !== 0) {
+			json.updated_at_ms = this.updatedAtMs;
+		}
+		if (this.isDeleted !== false) {
+			json.is_deleted = this.isDeleted;
+		}
+
+		return json;
+	}
+
+
+	static fromHostDetails(details: HostDetails, plugins: Map<string, string>) {
+		return new HostRecord(
+			details.id,
+			details.name,
+			details.version,
+			plugins,
+			details.connected,
+			details.remoteAddress,
+			details.publicAddress,
+			details.tokenValidAfter,
+			details.updatedAtMs,
+			details.isDeleted,
+		);
+	}
+
+	toHostDetails() {
+		return new HostDetails(
+			this.version,
+			this.name,
+			this.id,
+			this.connected,
+			this.remoteAddress,
+			this.publicAddress,
+			this.tokenValidAfter,
+			this.updatedAtMs,
+			this.isDeleted,
+		);
+	}
+}

packages/controller/src/HttpCloser.ts

@@ -0,0 +1,111 @@
+import type { Socket } from "net";
+
+import http from "http";
+import https from "https";
+
+/**
+ * Gracefully close a Node.js HTTP(S) server
+ *
+ * Helper class to properly close down a Node.js HTTP(S) server.  This is
+ * necessary due to connections being able to linger around forever with the
+ * keep-alive logic in HTTP.
+ *
+ * @example
+ * // during server initialization
+ * const server = http.createServer();
+ * const serverCloser = new HttpCloser(server);
+ *
+ * // in the shutdown logic
+ * await serverCloser.close();
+ *
+ * @alias module:controller/src/HttpCloser
+ */
+export default class HttpCloser {
+	private _server: http.Server | https.Server;
+	private _sockets: Set<Socket>;
+	private _responses: Set<http.ServerResponse>;
+
+	/**
+	 * Create HttpCloser attached to a server.
+	 * @param server - Node.js HTTP(S) server to attach to.
+	 */
+	constructor(server: http.Server | https.Server) {
+		this._server = server;
+		this._sockets = new Set();
+		this._responses = new Set();
+
+		if (this._server instanceof https.Server) {
+			this._server.on("secureConnection", this._addSocket.bind(this));
+		} else if (this._server instanceof http.Server) {
+			this._server.on("connection", this._addSocket.bind(this));
+		} else {
+			throw Error("server must be an instance of either http.Server or https.Server.");
+		}
+		this._server.on("request", this._addRequest.bind(this));
+	}
+
+	_addSocket(socket:Socket) {
+		this._sockets.add(socket);
+		socket.once("close", () => {
+			this._sockets.delete(socket);
+		});
+	}
+
+	_addRequest(request: http.IncomingMessage, response: http.ServerResponse) {
+		this._responses.add(response);
+		response.once("close", () => this._responses.delete(response));
+		response.once("finish", () => this._responses.delete(response));
+	}
+
+	/**
+	 * Gracefully close down the attached HTTP(S) server.
+	 *
+	 * Closes open connections that do not have a request in flight, signals
+	 * connections to pending requests should close, and initiates the
+	 * close operation on the attached server.
+	 *
+	 * If there's requests in progress that still haven't been completed
+	 * after the timeout value passed they will be aborted.
+	 *
+	 * @param timeoutMs -
+	 *     Time in ms to wait for connections to close.
+	 */
+	async close(timeoutMs: number = 5000): Promise<void> {
+		let activeSockets = new Set();
+		for (let response of this._responses) {
+			if (!response.headersSent) {
+				response.setHeader("Connection", "close");
+			} else {
+				let socket = response.socket!;
+				response.once("finish", () => {
+					socket.end();
+				});
+			}
+			activeSockets.add(response.socket);
+		}
+		for (let socket of this._sockets) {
+			if (!activeSockets.has(socket)) {
+				socket.end();
+			}
+		}
+
+		return new Promise((resolve, reject) => {
+			let timer = setTimeout(() => {
+				for (let socket of this._sockets) {
+					// Ideally a RST would be sent here to indicate the the
+					// transfer failed, but we can't reliably send that from
+					// Node.js, see nodejs/node#27428.
+					socket.destroy();
+				}
+			}, timeoutMs);
+			this._server.close(err => {
+				clearTimeout(timer);
+				if (err) {
+					reject(err);
+				} else {
+					resolve();
+				}
+			});
+		});
+	}
+};

packages/controller/src/InstanceManager.ts

@@ -0,0 +1,270 @@
+import * as lib from "@clusterio/lib";
+
+import type Controller from "./Controller.js";
+import type HostConnection from "./HostConnection.js";
+import InstanceRecord from "./InstanceRecord.js";
+
+export default class InstanceManager {
+	private static readonly DefaultFactorioSettings = {
+		tags: ["clusterio"],
+		max_players: 0,
+		visibility: { public: true, lan: true },
+		game_password: "",
+		require_user_verification: true,
+		max_upload_in_kilobytes_per_second: 0,
+		max_upload_slots: 5,
+		ignore_player_limit_for_returning_players: false,
+		allow_commands: "admins-only",
+		autosave_interval: 10,
+		autosave_slots: 5,
+		afk_autokick_interval: 0,
+		auto_pause: false,
+		only_admins_can_pause_the_game: true,
+		autosave_only_on_server: true,
+		non_blocking_saving: false,
+	} as const;
+
+	constructor(
+		public readonly records: lib.SubscribableDatastore<InstanceRecord>,
+		private readonly _controller: Controller,
+	) {
+		for (const instance of records.values()) {
+			this.addInstanceHooks(instance);
+		}
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Basic Accessors                                                           */
+	/* ------------------------------------------------------------------------- */
+
+	has(id: InstanceRecord["id"]): boolean {
+		return this.records.has(id);
+	}
+
+	getMutable(id: InstanceRecord["id"]): InstanceRecord | undefined {
+		return this.records.get(id);
+	}
+
+	get(id: InstanceRecord["id"]): Readonly<InstanceRecord> | undefined {
+		return this.getMutable(id);
+	}
+
+	valuesMutable(): IterableIterator<InstanceRecord> {
+		return this.records.values();
+	}
+
+	values(): IterableIterator<Readonly<InstanceRecord>> {
+		return this.valuesMutable();
+	}
+
+	/**
+	 * Get instance by ID for a request.
+	 *
+	 * Convenience wrapper around {@link getMutable} that throws
+	 * if the instance does not exist.
+	 *
+	 * @param instanceId - ID of instance to get.
+	 * @returns The instance record.
+	 * @throws {module:lib.RequestError} if the instance does not exist.
+	 */
+	getForRequest(instanceId: number): InstanceRecord {
+		const instance = this.records.get(instanceId);
+		if (!instance) {
+			throw new lib.RequestError(`Instance with ID ${instanceId} does not exist`);
+		}
+		return instance;
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Internal Helpers                                                          */
+	/* ------------------------------------------------------------------------- */
+
+	private async _notifyStatusChanged(
+		instance: InstanceRecord,
+		prev?: lib.InstanceStatus,
+	): Promise<void> {
+		await this._controller.hooks.instanceStatusChanged.invoke(instance, prev);
+	}
+
+	private async _notifyConfigFieldChanged(
+		instance: InstanceRecord,
+		field: string,
+		curr: unknown,
+		prev: unknown,
+	): Promise<void> {
+		await this._controller.hooks.instanceConfigFieldChanged.invoke(instance, field, curr, prev);
+	}
+
+	/**
+	 * Attach change listeners to an instance record.
+	 *
+	 * Hooks into configuration field changes and ensures the datastore
+	 * is updated and plugins are notified when a config field changes.
+	 *
+	 * @param instance - The instance record to attach hooks to.
+	 * @internal
+	 */
+	addInstanceHooks(instance: InstanceRecord): void {
+		instance.config.on("fieldChanged", (field: string, curr: unknown, prev: unknown) => {
+			this.records.set(instance);
+			this._notifyConfigFieldChanged(instance, field, curr, prev);
+		});
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Lifecycle                                                                 */
+	/* ------------------------------------------------------------------------- */
+
+	/**
+	 * Create a new instance.
+	 *
+	 * @example
+	 * const config = new lib.InstanceConfig("controller", { "instance.name": "My instance" });
+	 * const instance = await controller.instances.createInstance(config);
+	 *
+	 * @param instanceConfig - Config to base the newly created instance on.
+	 * @param _suppressChanges - When true, side effects are suppressed, caller takes ownership.
+	 * @returns The created instance record.
+	 * @throws {module:lib.RequestError} if an instance with the same ID already exists.
+	 */
+	async createInstance(
+		instanceConfig: lib.InstanceConfig,
+		_suppressChanges?: boolean,
+	): Promise<InstanceRecord> {
+		const instanceId = instanceConfig.get("instance.id");
+		if (this.records.has(instanceId)) {
+			throw new lib.RequestError(`Instance with ID ${instanceId} already exists`);
+		}
+
+		const controllerName = this._controller.config.get("controller.name");
+		instanceConfig.set("factorio.settings", {
+			name: `${controllerName} - ${instanceConfig.get("instance.name")}`,
+			description: `Clusterio instance for ${controllerName}`,
+			...InstanceManager.DefaultFactorioSettings,
+			...instanceConfig.get("factorio.settings"),
+		});
+
+		const instance = new InstanceRecord(instanceConfig, "unassigned");
+		this.addInstanceHooks(instance);
+
+		if (!_suppressChanges) {
+			this.records.set(instance);
+			await this._notifyStatusChanged(instance);
+		}
+
+		return instance;
+	}
+
+	/**
+	 * Change the assigned host of an instance.
+	 *
+	 * Unassigns the instance from the currently assigned host (if connected)
+	 * and assigns it to the provided host.
+	 *
+	 * This is the only supported way of modifying the
+	 * `instance.assigned_host` configuration entry.
+	 *
+	 * Note:
+	 * - This does NOT transfer any files or saves between hosts.
+	 * - If the instance is already assigned to the specified host, no action is taken.
+	 *
+	 * @param instanceId - ID of instance to assign.
+	 * @param hostId - ID of host to assign the instance to. If undefined,
+	 * the instance will be unassigned.
+	 *
+	 * @throws {module:lib.RequestError} if the instance does not exist.
+	 * @throws {module:lib.RequestError} if the target host is not connected.
+	 */
+	async assignInstance(
+		instanceId: number,
+		hostId: number | null,
+	): Promise<void> {
+		const instance = this.getForRequest(instanceId);
+		const hostConnections = this._controller.wsServer.hostConnections;
+
+		const currentAssignedHost = instance.config.get("instance.assigned_host");
+		if (currentAssignedHost === hostId) {
+			return;
+		}
+
+		let newHostConnection: HostConnection | undefined;
+		if (hostId !== null) {
+			newHostConnection = hostConnections.get(hostId);
+			if (!newHostConnection) {
+				throw new lib.RequestError("Target host is not connected to the controller");
+			}
+		}
+
+		if (currentAssignedHost !== null) {
+			const oldHostConnection = hostConnections.get(currentAssignedHost);
+			if (oldHostConnection && !oldHostConnection.connector.closing) {
+				await oldHostConnection.send(
+					new lib.InstanceUnassignInternalRequest(instanceId),
+				);
+			}
+		}
+
+		this._controller.clearSavesOfInstance(instanceId);
+		instance.config.set("instance.assigned_host", hostId);
+
+		if (newHostConnection) {
+			try {
+				await newHostConnection.send(
+					new lib.InstanceAssignInternalRequest(instanceId, instance.config.toRemote("host")),
+				);
+			} catch (err) {
+				// Leave unassigned so the assign can be retried
+				instance.config.set("instance.assigned_host", null);
+				instance.status = "unassigned";
+				this.records.set(instance);
+				throw err;
+			}
+		} else {
+			instance.status = "unassigned";
+		}
+
+		this.records.set(instance);
+	}
+
+	/**
+	 * Unassign an instance from its current host.
+	 *
+	 * Convenience wrapper around {@link assignInstance} that removes
+	 * the assigned host.
+	 *
+	 * @param instanceId - ID of instance to unassign.
+	 */
+	async unassignInstance(instanceId: number): Promise<void> {
+		return this.assignInstance(instanceId, null);
+	}
+
+	/**
+	 * Delete an instance permanently.
+	 *
+	 * Sends a delete request to the assigned host (if any),
+	 * removes the instance from the datastore,
+	 * clears associated saves and user statistics.
+	 *
+	 * @param instanceId - ID of instance to delete.
+	 *
+	 * @throws {module:lib.RequestError} if the instance does not exist.
+	 */
+	async deleteInstance(instanceId: number): Promise<void> {
+		const instance = this.getForRequest(instanceId);
+		const hostId = instance.config.get("instance.assigned_host");
+
+		if (hostId !== null) {
+			await this._controller.sendTo(
+				{ hostId },
+				new lib.InstanceDeleteInternalRequest(instanceId),
+			);
+		}
+
+		const prevStatus = instance.status;
+		this.records.delete(instance);
+		this._controller.clearSavesOfInstance(instanceId);
+		this._controller.users.clearStatsOfInstance(instanceId);
+
+		await this._notifyStatusChanged(instance, prevStatus);
+	}
+}

packages/controller/src/InstanceRecord.ts

@@ -0,0 +1,99 @@
+import * as lib from "@clusterio/lib";
+import { Static, Type } from "@sinclair/typebox";
+
+/** Underlying data class for instances on the controller */
+export default class InstanceRecord {
+	constructor(
+		public config: lib.InstanceConfig,
+		public status: lib.InstanceStatus,
+		public gamePort?: number,
+		public factorioVersion?: lib.TargetVersion,
+		public startedAtMs = 0,
+		public updatedAtMs = 0,
+	) {
+		this.config = config;
+		this.status = status;
+	}
+
+	get id(): number {
+		return this.config.get("instance.id");
+	}
+
+	get isDeleted() {
+		return this.status === "deleted";
+	}
+
+	set isDeleted(value: boolean) {
+		if (value === false) {
+			throw new Error("Setting isDeleted to false is not supported, use status instead.");
+		}
+		this.status = "deleted";
+	}
+
+	static jsonSchema = Type.Object({
+		"config": lib.InstanceConfig.jsonSchema,
+		"status": lib.InstanceStatus,
+		"gamePort": Type.Optional(Type.Number()),
+		"startedAtMs": Type.Optional(Type.Number()),
+		"updatedAtMs": Type.Optional(Type.Number()),
+		"factorioVersion": Type.Optional(lib.TargetVersionSchema),
+	});
+
+	static fromJSON(json: Static<typeof this.jsonSchema>) {
+		return new this(
+			lib.InstanceConfig.fromJSON(json.config, "controller"),
+			json.status,
+			json.gamePort,
+			json.factorioVersion,
+			json.startedAtMs,
+			json.updatedAtMs,
+		);
+	}
+
+	toJSON(): Static<typeof InstanceRecord.jsonSchema> {
+		const json: any = {
+			config: this.config.toJSON(),
+			status: this.status,
+		};
+
+		if (this.gamePort !== undefined) {
+			json.gamePort = this.gamePort;
+		}
+		if (this.factorioVersion !== undefined) {
+			json.factorioVersion = this.factorioVersion;
+		}
+		if (this.startedAtMs !== 0) {
+			json.startedAtMs = this.startedAtMs;
+		}
+		if (this.updatedAtMs !== 0) {
+			json.updatedAtMs = this.updatedAtMs;
+		}
+
+		return json;
+	}
+
+	toInstanceDetails() {
+		return new lib.InstanceDetails(
+			this.config.get("instance.name"),
+			this.id,
+			this.config.get("instance.assigned_host") ?? undefined,
+			this.gamePort,
+			this.status,
+			this.factorioVersion,
+			this.startedAtMs,
+			this.updatedAtMs,
+			this.config.get("instance.exclude_from_start_all"),
+		);
+	}
+
+	static fromInstanceDetails(details: lib.InstanceDetails, config: lib.InstanceConfig) {
+		return new InstanceRecord(
+			config,
+			details.status,
+			details.gamePort,
+			details.factorioVersion,
+			details.startedAtMs,
+			details.updatedAtMs,
+		);
+	}
+}

packages/controller/src/User.ts

@@ -0,0 +1,146 @@
+
+import {
+	IUser, Role, SubscribableDatastore,
+	PermissionError, PermissionName, permissions,
+} from "@clusterio/lib";
+
+import UserRecord from "./UserRecord.js";
+import { Static } from "@sinclair/typebox";
+
+/**
+ * Represents a user as viewed from the controller.
+ *
+ * All methods are safe to use when readonly.
+ * Only use mutable when needing to change multiple values.
+ */
+export default class User extends UserRecord implements IUser {
+	constructor(
+		private _controllerUsers: SubscribableDatastore<UserRecord>,
+		private _controllerRoles: SubscribableDatastore<Role>,
+		...args: ConstructorParameters<typeof UserRecord>
+	) {
+		super(...args);
+	}
+
+	static fromJSON(
+		json: Static<typeof this.jsonSchema>,
+		_controllerUsers: SubscribableDatastore<UserRecord>,
+		_controllerRoles: SubscribableDatastore<Role>,
+	) {
+		return this.fromUserRecord(
+			UserRecord.fromJSON(json),
+			_controllerUsers,
+			_controllerRoles,
+		);
+	}
+
+	static fromUserRecord(
+		userRecord: UserRecord,
+		_controllerUsers: SubscribableDatastore<UserRecord>,
+		_controllerRoles: SubscribableDatastore<Role>,
+	): User {
+		return new this(
+			_controllerUsers,
+			_controllerRoles,
+			userRecord.tokenValidAfter,
+			userRecord.name,
+			userRecord.roleIds,
+			userRecord.instances,
+			userRecord.isAdmin,
+			userRecord.isBanned,
+			userRecord.isWhitelisted,
+			userRecord.banReason,
+			userRecord.updatedAtMs,
+			userRecord.isDeleted,
+			userRecord.instanceStats,
+		);
+	}
+
+	/** Roles this user has */
+	get roles(): ReadonlySet<Readonly<Role>> {
+		return new Set([...this.roleIds].map(
+			id => this._controllerRoles.get(id)
+		).filter(
+			(r): r is Role => Boolean(r)
+		));
+	}
+
+	/** Save the underlying user record */
+	saveRecord() {
+		this._controllerUsers.set(this);
+	}
+
+	/** Set a property on the underlying record, then save it. */
+	set<K extends keyof this>(key: K, value: this[K]) {
+		this[key] = value;
+		this.saveRecord();
+	}
+
+	/**
+	 * Invalidate current tokens for the user
+	 *
+	 * Sets the tokenValidAfter property to the current time, which causes
+	 * all currently issued tokens for the user to become invalid.
+	 */
+	invalidateToken() {
+		this.tokenValidAfter = Math.floor(Date.now() / 1000);
+		this.saveRecord();
+	}
+
+	/** Add a role to this user */
+	addRole(roleId: number) {
+		const role = this._controllerRoles.get(roleId);
+		if (!role) {
+			throw new Error(`role ${roleId} does not exist`);
+		}
+		this.roleIds.add(roleId);
+		this.saveRecord();
+	}
+
+	/** Remove a role from user */
+	removeRole(roleId: number) {
+		if (!this.roleIds.delete(roleId)) {
+			return false;
+		}
+		this.saveRecord();
+		return true;
+	}
+
+	/** Set a user as being online on a specific instance */
+	notifyJoin(instanceId: number) {
+		this.instances.add(instanceId);
+		this.saveRecord();
+	}
+
+	/** Set a user as being offline on a specific instance */
+	notifyLeave(instanceId: number) {
+		this.instances.delete(instanceId);
+		this.saveRecord();
+	}
+
+	/** Clear the stats of a player on a specific instance */
+	clearInstanceStats(instanceId: number) {
+		this.instances.delete(instanceId);
+		this.instanceStats.delete(instanceId);
+		this.recalculatePlayerStats();
+		this.saveRecord();
+	}
+
+	checkPermission(permission: PermissionName) {
+		if (!permissions.has(permission)) {
+			throw new Error(`permission ${permission} does not exist`);
+		}
+
+		for (const roleId of this.roleIds) {
+			const role = this._controllerRoles.get(roleId);
+			if (!role) {
+				continue;
+			}
+			if (role.permissions.has("core.admin") || role.permissions.has(permission)) {
+				return;
+			}
+		}
+
+		throw new PermissionError("Permission denied");
+	}
+}

packages/controller/src/UserManager.ts

@@ -0,0 +1,167 @@
+import fs from "node:fs/promises";
+import jwt from "jsonwebtoken";
+
+import * as lib from "@clusterio/lib";
+
+import User from "./User.js";
+import UserRecord from "./UserRecord.js";
+
+/**
+ * Access layer for users on the controller.
+ *
+ * In performance critical paths the raw records can be accessed directly.
+ * Otherwise this class will wrap data in a view class with a set and save method.
+ *
+ * @alias module:controller/src/UserManager
+ */
+export default class UserManager {
+	constructor(
+		public records: lib.SubscribableDatastore<UserRecord>,
+		private _controllerRoles: lib.SubscribableDatastore<lib.Role>,
+		private _controllerConfig: lib.ControllerConfig,
+	) {
+	}
+
+	/**
+	 * Prior to 2.0.0-alpha.22 users and roles were stored in a single file.
+	 * This migration separates them so they can be loaded by datastore.
+	 *
+	 * @param usersFilePath The src and dst file path for the users json file
+	 * @param rolesFilePath The dst for the roles json file
+	 */
+	static async attemptMigrateLegacyUsersFile(usersFilePath: string, rolesFilePath: string) {
+		try {
+			const combinedJson = JSON.parse(await fs.readFile(usersFilePath, { encoding: "utf8" }));
+			if (!("roles" in combinedJson)) {
+				return; // Files are already split, no action required
+			}
+			if (!("users" in combinedJson)) {
+				throw new Error("Legacy users json does not contain users property");
+			}
+
+			// We intentionally write the roles first because if it fails then the old user file will still contain them
+			await lib.safeOutputFile(rolesFilePath, JSON.stringify(combinedJson.roles));
+			await lib.safeOutputFile(usersFilePath, JSON.stringify(combinedJson.users));
+		} catch (err: any) {
+			if (err.code !== "ENOENT") {
+				throw err;
+			}
+		}
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Basic Accessors                                                           */
+	/* ------------------------------------------------------------------------- */
+
+	has(id: UserRecord["id"]) {
+		return this.records.has(id);
+	}
+
+	getMutable(id: UserRecord["id"]) {
+		const userRecord = this.records.getMutable(id);
+		if (!userRecord) {
+			return undefined;
+		}
+
+		return User.fromUserRecord(
+			userRecord,
+			this.records,
+			this._controllerRoles,
+		);
+	}
+
+	get(id: UserRecord["id"]): Readonly<User> | undefined {
+		return this.getMutable(id);
+	}
+
+	hasName(name: UserRecord["name"]) {
+		return this.has(name.toLowerCase());
+	}
+
+	getByNameMutable(name: UserRecord["name"]) {
+		return this.getMutable(name.toLowerCase());
+	}
+
+	getByName(name: UserRecord["name"]) {
+		return this.get(name.toLowerCase());
+	}
+
+	* valuesMutable(): IterableIterator<User> {
+		const roles = this._controllerRoles;
+		const users = this.records;
+
+		for (const record of users.values()) {
+			yield User.fromUserRecord(record, users, roles);
+		}
+	}
+
+	values(): IterableIterator<Readonly<User>> {
+		return this.valuesMutable();
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Lifecycle                                                                 */
+	/* ------------------------------------------------------------------------- */
+
+	/**
+	 * Creates a new user and add it to the user database.
+	 * @param name - Name of the user to create.
+	 * @returns The created user.
+	 */
+	createUser(name: string): User {
+		if (this.getByName(name)) {
+			throw new Error(`User '${name}' already exists`);
+		}
+
+		let roles = new Set<number>();
+		let defaultRoleId = this._controllerConfig.get("controller.default_role_id");
+		if (defaultRoleId !== null && this._controllerRoles.has(defaultRoleId)) {
+			roles.add(defaultRoleId);
+		}
+
+		// Reject tokens issued before the user existed, e.g. for a previous user by the same name
+		const tokenValidAfter = Math.floor(Date.now() / 1000);
+		const user = new User(this.records, this._controllerRoles, tokenValidAfter, name, roles);
+		this.records.set(user);
+		return user;
+	}
+
+	/** Get or create a user with a given name. */
+	getOrCreateUser(name: string): User {
+		return this.getByNameMutable(name) ?? this.createUser(name);
+	}
+
+	/**
+	 * Deletes an existing user
+	 *
+	 * @param user - user to delete
+	 */
+	deleteUser(user: UserRecord) {
+		return this.records.delete(user);
+	}
+
+	/* ------------------------------------------------------------------------- */
+	/* Helpers                                                                   */
+	/* ------------------------------------------------------------------------- */
+
+	/**
+	 * Sign access token for the given user
+	 *
+	 * @param user - user to sign token for
+	 * @returns JWT access token for the user.
+	 */
+	signUserToken(user: UserRecord): string {
+		return jwt.sign(
+			{ aud: "user", user: user.id },
+			// auth secret is never null after startup
+			Buffer.from(this._controllerConfig.get("controller.auth_secret")!, "base64")
+		);
+	}
+
+	/** Clear all player stats for specific instance */
+	clearStatsOfInstance(instanceId: number) {
+		for (const user of this.values()) {
+			user.clearInstanceStats(instanceId);
+		}
+	}
+}

packages/controller/src/UserRecord.ts

@@ -0,0 +1,102 @@
+import { UserDetails } from "@clusterio/lib";
+import { Type, Static } from "@sinclair/typebox";
+
+/** Underlying data class for users on the controller */
+export default class UserRecord extends UserDetails {
+	constructor(
+		/** Unix time in seconds the user token must be issued after to be valid.  */
+		public tokenValidAfter = 0,
+		...args: ConstructorParameters<typeof UserDetails>
+	) {
+		super(...args);
+	}
+
+	static jsonSchema = Type.Object({
+		token_valid_after: Type.Optional(Type.Number()),
+		...UserDetails.jsonSchema.properties,
+	});
+
+	// _a and _b are a ts workaround for allowing User to have extra arguments
+	static fromJSON(json: Static<typeof this.jsonSchema>, _a?: any, _b?: any) {
+		return this.fromUserDetails(
+			UserDetails.fromJSON(json),
+			json.token_valid_after,
+		);
+	}
+
+	toJSON() {
+		const json = super.toJSON() as Static<typeof UserRecord.jsonSchema>;
+
+		if (this.tokenValidAfter > 0) {
+			json.token_valid_after = this.tokenValidAfter;
+		}
+
+		return json;
+	}
+
+	static fromUserDetails(
+		userDetails: UserDetails,
+		tokenValidAfter = 0,
+	) {
+		return new this(
+			tokenValidAfter,
+			userDetails.name,
+			userDetails.roleIds,
+			userDetails.instances,
+			userDetails.isAdmin,
+			userDetails.isBanned,
+			userDetails.isWhitelisted,
+			userDetails.banReason,
+			userDetails.updatedAtMs,
+			userDetails.isDeleted,
+			userDetails.instanceStats,
+		);
+	}
+
+	toUserDetails() {
+		return new UserDetails(
+			this.name,
+			this.roleIds,
+			this.instances,
+			this.isAdmin,
+			this.isBanned,
+			this.isWhitelisted,
+			this.banReason,
+			this.updatedAtMs,
+			this.isDeleted,
+			this.instanceStats,
+		);
+	}
+
+	/**
+	 * Merge another user into this one, must have matching ids, user is not deleted
+	 * @param otherUser - User who's details are merged from
+	*/
+	merge(otherUser: UserDetails) {
+		if (this.id !== otherUser.id) {
+			throw new Error("Cannot merge users with different ids");
+		}
+
+		// Merge properties
+		this.roleIds = new Set([...this.roleIds, ...otherUser.roleIds]);
+		this.instances = new Set([...this.instances, ...otherUser.instances]);
+		this.isAdmin = this.isAdmin && otherUser.isAdmin; // More secure to use && rather ||
+		this.isBanned = this.isBanned || otherUser.isBanned;
+		this.isWhitelisted = this.isWhitelisted || otherUser.isWhitelisted;
+		this.banReason = this.updatedAtMs > otherUser.updatedAtMs ? this.banReason : otherUser.banReason;
+		this.updatedAtMs = Date.now();
+
+		// Merge instance stats
+		const thisInstanceStats = this.instanceStats;
+		for (const [instanceId, instanceStats] of otherUser.instanceStats.entries()) {
+			if (thisInstanceStats.has(instanceId)) {
+				thisInstanceStats.get(instanceId)!.merge(instanceStats);
+			} else {
+				thisInstanceStats.set(instanceId, instanceStats);
+			}
+		}
+
+		// Player stats must be recalculated after modifying instance stats
+		this.recalculatePlayerStats();
+	}
+}

packages/controller/src/WsServer.ts

@@ -0,0 +1,393 @@
+import type { IncomingMessage } from "http";
+import type { Duplex } from "stream";
+import type Controller from "./Controller.js";
+
+import jwt from "jsonwebtoken";
+import WebSocket, { WebSocketServer } from "ws";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+
+import ControlConnection from "./ControlConnection.js";
+import HostConnection from "./HostConnection.js";
+import WsServerConnector from "./WsServerConnector.js";
+
+import packageConfig from "@clusterio/controller/package.json" with { type: "json" };
+
+const wsMessageCounter = new lib.Counter(
+	"clusterio_controller_websocket_message_total",
+	"How many messages have been received over WebSocket on the controller",
+	{ labels: ["direction"] }
+);
+
+const wsConnectionsCounter = new lib.Counter(
+	"clusterio_controller_websocket_connections_total",
+	"How many WebSocket connections have been initiated on the controller"
+);
+
+const wsRejectedConnectionsCounter = new lib.Counter(
+	"clusterio_controller_websocket_rejected_connections_total",
+	"How many WebSocket connections have been rejected during the handshake on the controller"
+);
+
+/**
+ * WebSocket server
+ * @alias module:controller/src/WsServer
+ */
+export default class WsServer {
+	controller: Controller;
+	stopAcceptingNewSessions: boolean = false;
+	controlConnections: Map<number, ControlConnection> = new Map();
+	hostConnections: Map<number, HostConnection> = new Map();
+	activeConnectors: Map<number, WsServerConnector> = new Map();
+	pendingSockets: Set<WebSocket> = new Set();
+	// Unique string for the session token audience
+	sessionAud: string = `session-${Date.now()}`;
+	nextSessionId: number = 1;
+	nextControlId: number = 1;
+	wss: WebSocketServer;
+
+	constructor(controller: Controller) {
+		this.controller = controller;
+
+		this.wss = new WebSocketServer({
+			noServer: true,
+			path: "/api/socket",
+		});
+		this.wss.on("connection",
+			(socket: lib.WebSocketClusterio, req: IncomingMessage) => this.handleConnection(socket, req),
+		);
+	}
+
+	remoteAddr(req: IncomingMessage) {
+		const remote = req.socket.remoteAddress ?? "";
+		if (
+			remote && req.headers["x-forwarded-for"]
+			&& (
+				(req.socket.remoteFamily === "IPv4" && this.controller.trustedProxies.check(remote, "ipv4"))
+				|| (req.socket.remoteFamily === "IPv6" && this.controller.trustedProxies.check(remote, "ipv6"))
+			)
+		) {
+			return (req.headers["x-forwarded-for"] as string).split(",").slice(-1)[0].trim();
+		}
+		return remote;
+	}
+
+	async stop(): Promise<void> {
+		this.stopAcceptingNewSessions = true;
+
+		let disconnectTasks = [];
+		for (let controlConnection of this.controlConnections.values()) {
+			disconnectTasks.push(controlConnection.disconnect(lib.ConnectionClosed.GoingAway, "Server Quit"));
+		}
+
+		for (let hostConnection of this.hostConnections.values()) {
+			disconnectTasks.push(hostConnection.disconnect(lib.ConnectionClosed.GoingAway, "Server Quit"));
+		}
+
+		logger.info(`WsServer | Waiting for ${disconnectTasks.length} connectors to close`);
+		for (let task of disconnectTasks) {
+			try {
+				await task;
+			} catch (err: any) {
+				if (!(err instanceof lib.SessionLost)) {
+					logger.warn(`Unexpected error disconnecting connector:\n${err.stack}`);
+				}
+			}
+		}
+
+		for (let socket of this.pendingSockets) {
+			socket.close(lib.ConnectionClosed.GoingAway, "Server Quit");
+		}
+	}
+
+	handleUpgrade(
+		req: IncomingMessage,
+		socket: Duplex,
+		head: Buffer
+	) {
+		// For reasons that defy common sense, the connection event has
+		// to be emitted explictly when using noServer.
+		this.wss.handleUpgrade(req, socket, head, (ws) => {
+			this.wss.emit("connection", ws, req);
+		});
+	}
+
+	handleConnection(socket: lib.WebSocketClusterio, req: IncomingMessage) {
+		logger.verbose(`WsServer | new connection from ${this.remoteAddr(req)}`);
+
+		// ws emits errors like invalid frames on the socket, and an error with
+		// no listener crashes the controller. The connector adds its own
+		// listener, but only once the handshake has completed.
+		socket.on("error", (err: Error) => {
+			logger.verbose(`WsServer | error on connection from ${this.remoteAddr(req)}: ${err.message}`);
+		});
+
+		// Track statistics
+		wsConnectionsCounter.inc();
+		socket.on("message", (message: WebSocket.RawData) => {
+			wsMessageCounter.labels("in").inc();
+			if (!socket.clusterio_ignore_dump) {
+				this.controller.debugEvents.emit("message", { direction: "in", content: message.toString("utf8") });
+			}
+		});
+		let originalSend = socket.send;
+		socket.send = (...args: [string, any]) => {
+			wsMessageCounter.labels("out").inc();
+			if (typeof args[0] === "string" && !socket.clusterio_ignore_dump) {
+				this.controller.debugEvents.emit("message", { direction: "out", content: args[0] });
+			}
+			return originalSend.call(socket, ...args);
+		};
+
+		// Start connection handshake.
+		let loadedPlugins: {[key:string]: string} = {};
+		for (const plugin of this.controller.loadedPlugins) {
+			loadedPlugins[plugin.name] = plugin.version;
+		}
+
+		socket.send(JSON.stringify(new lib.MessageHello(new lib.HelloData(packageConfig.version, loadedPlugins))));
+		this.attachHandler(socket, req);
+	}
+
+	attachHandler(
+		socket: WebSocket,
+		req: IncomingMessage
+	) {
+		this.pendingSockets.add(socket);
+
+		let timeoutId = setTimeout(() => {
+			logger.verbose(`WsServer | closing ${this.remoteAddr(req)} after timing out on handshake`);
+			wsRejectedConnectionsCounter.inc();
+			socket.terminate();
+			this.pendingSockets.delete(socket);
+		}, 30*1000);
+
+		socket.once("message", (message: string) => {
+			clearTimeout(timeoutId);
+			this.pendingSockets.delete(socket);
+			this.handleHandshake(
+				message, socket, req
+			).catch(err => {
+				logger.error(`
++------------------------------------------------------------+
+| Unexpected error occured in WebSocket handshake, please    |
+| report it to https://github.com/clusterio/clusterio/issues |
++------------------------------------------------------------+
+${err.stack}`
+				);
+				wsRejectedConnectionsCounter.inc();
+				socket.close(lib.ConnectionClosed.InternalError, "Unexpected error");
+			});
+		});
+	}
+
+	async handleHandshake(rawMessage: string, socket: WebSocket, req: IncomingMessage) {
+		let message;
+		try {
+			const json = JSON.parse(rawMessage);
+			lib.Message.validate(json);
+			message = lib.Message.fromJSON(json);
+		} catch (err: any) {
+			logger.verbose(`WsServer | closing ${this.remoteAddr(req)} after receiving invalid message`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.ProtocolError, `Invalid message: ${err.message}`);
+			return;
+		}
+
+		if (message.type === "resume") {
+			this.resumeSession((message as lib.MessageResume).data, socket, req);
+			return;
+		}
+
+		if (message.type !== "registerHost" && message.type !== "registerControl") {
+			logger.verbose(`WsServer | closing ${this.remoteAddr(req)} after receiving invalid handshake`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.ProtocolError, "Bad handshake");
+			return;
+		}
+
+		if (this.stopAcceptingNewSessions) {
+			logger.verbose(`WsServer | closing ${this.remoteAddr(req)}, server is shutting down`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.GoingAway, "Shutting down");
+			return;
+		}
+
+		if (message.type === "registerHost") {
+			await this.registerHost((message as lib.MessageRegisterHost).data, socket, req);
+			return;
+		}
+
+		if (message.type === "registerControl") {
+			await this.registerControl((message as lib.MessageRegisterControl).data, socket, req);
+			return;
+		}
+
+		throw new Error("This should be unreachable");
+	}
+
+	createSession(dst: lib.Address): [ WsServerConnector, string ] {
+		let sessionId = this.nextSessionId;
+		this.nextSessionId += 1;
+		let sessionToken = jwt.sign({ aud: this.sessionAud, sid: sessionId }, this.controller.authSecret);
+		let sessionTimeout = this.controller.config.get("controller.session_timeout");
+		let heartbeatInterval = this.controller.config.get("controller.heartbeat_interval");
+		let maxSendBufferSize = this.controller.config.get("controller.max_send_buffer_size") * 1024 * 1024;
+		let connector = new WsServerConnector(dst, sessionId, sessionTimeout, heartbeatInterval, maxSendBufferSize);
+		this.activeConnectors.set(sessionId, connector);
+		connector.on("close", () => {
+			this.activeConnectors.delete(sessionId);
+		});
+
+		return [connector, sessionToken];
+	}
+
+	async registerHost(data: lib.RegisterHostData, socket: WebSocket, req: IncomingMessage) {
+		if (this.controller.recoveryMode) {
+			logger.warn(`Recovery | rejected host connection attempt for ${this.remoteAddr(req)}`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.RecoveryMode, "Connection Refused: Controller in recovery mode");
+			return;
+		}
+
+		try {
+			// migrate: allow pre-rename tokens issued to hosts before alpha-14
+			const tokenPayload = jwt.verify(data.token, this.controller.authSecret, { audience: ["host", "slave"] });
+			if (typeof tokenPayload === "string") {
+				throw new Error("unexpected JsonWebToken type");
+			}
+
+			// migrate: allow pre-rename tokens issued to hosts before alpha-14
+			if ((tokenPayload.host !== undefined ? tokenPayload.host : tokenPayload.slave) !== data.id) {
+				throw new Error("missmatched host id");
+			}
+
+			let host = this.controller.hosts.get(data.id);
+			if (!tokenPayload.iat || tokenPayload.iat < (host?.tokenValidAfter ?? 0)) {
+				throw new Error("invalid token");
+			}
+		} catch (err: any) {
+			logger.verbose(`WsServer | authentication failed for ${this.remoteAddr(req)}`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.Unauthorized, `Authentication failed: ${err.message}`);
+			return;
+		}
+
+		let connection = this.hostConnections.get(data.id);
+		if (connection) {
+			if (connection.remoteAddress !== this.remoteAddr(req)) {
+				logger.verbose(
+					`WsServer | disallowed duplicate connection from ${this.remoteAddr(req)} for host ${data.id}`
+				);
+				wsRejectedConnectionsCounter.inc();
+				socket.close(lib.ConnectionClosed.PolicyViolation, "Host already connected from another address");
+				return;
+			}
+			logger.verbose(
+				`WsServer | disconnecting duplicate connection from host ${data.id}`
+			);
+			await connection.disconnect(
+				lib.ConnectionClosed.PolicyViolation, "Newer connection for host from same address"
+			);
+		}
+
+		logger.info(
+			`WsServer | registered host ${data.id} using version ${data.version}`
+		);
+		if (data.version !== packageConfig.version) {
+			logger.warn(
+				`Host ${data.id} connected using version ${data.version} which does not match the ` +
+				`version of the controller is currently running (${packageConfig.version}). ` +
+				"It may not work as expected."
+			);
+		}
+
+		let [connector, sessionToken] = this.createSession(new lib.Address(lib.Address.host, data.id));
+
+		// Handle close before HostConnection does. This avoids a host
+		// connection event happening between the connection breaking and
+		// it being removed from the host connections list.
+		connector.on("close", () => {
+			if (this.hostConnections.get(data.id) === connection) {
+				this.hostConnections.delete(data.id);
+			} else {
+				logger.warn("Unlisted HostConnection closed");
+			}
+		});
+
+		connection = new HostConnection(data, connector, this.controller, this.remoteAddr(req));
+		this.hostConnections.set(data.id, connection);
+		let src = new lib.Address(lib.Address.host, data.id);
+		connector.ready(socket, src, sessionToken, undefined);
+	}
+
+	async registerControl(data: lib.RegisterControlData, socket: WebSocket, req: IncomingMessage) {
+		let user;
+		try {
+			const tokenPayload = jwt.verify(data.token, this.controller.authSecret, { audience: "user" });
+			if (typeof tokenPayload === "string") {
+				throw new Error("unexpected JsonWebToken type");
+			}
+
+			user = this.controller.users.getByNameMutable(tokenPayload.user);
+			if (!user) {
+				throw new Error("invalid user");
+			}
+			if ((tokenPayload.iat || 0) < user.tokenValidAfter) {
+				throw new Error("invalid token");
+			}
+			user.checkPermission("core.control.connect");
+
+		} catch (err: any) {
+			logger.verbose(`WsServer | authentication failed for ${this.remoteAddr(req)}`);
+			wsRejectedConnectionsCounter.inc();
+			socket.close(lib.ConnectionClosed.Unauthorized, `Authentication failed: ${err.message}`);
+			return;
+		}
+
+		let id = this.nextControlId;
+		this.nextControlId += 1;
+		let [connector, sessionToken] = this.createSession(new lib.Address(lib.Address.control, id));
+
+		logger.verbose(`WsServer | registered control ${id} from ${this.remoteAddr(req)}`);
+		connector.on("close", () => {
+			this.controlConnections.delete(id);
+		});
+		let connection = new ControlConnection(data, connector, this.controller, user, id);
+		this.controlConnections.set(id, connection);
+		let account = new lib.AccountDetails(
+			user.name,
+			[...user.roles].map(r => ({
+				name: r.name,
+				id: r.id,
+				permissions: [...r.permissions],
+			}))
+		);
+
+		let src = new lib.Address(lib.Address.control, id);
+		connector.ready(socket, src, sessionToken, account);
+	}
+
+	resumeSession(data: lib.ResumeData, socket: WebSocket, req: IncomingMessage) {
+		let connector;
+		try {
+			const payload = jwt.verify(data.sessionToken, this.controller.authSecret, { audience: this.sessionAud });
+			if (typeof payload === "string") {
+				throw new Error("unexpected JsonWebToken type");
+			}
+
+			connector = this.activeConnectors.get(payload.sid);
+			if (!connector) {
+				throw new Error();
+			}
+
+		} catch (err) {
+			socket.send(JSON.stringify(new lib.MessageInvalidate()));
+			this.attachHandler(socket, req);
+			return;
+		}
+
+		connector.continue(socket, data.lastSeq as number);
+	}
+}

packages/controller/src/WsServerConnector.ts

@@ -0,0 +1,230 @@
+import { type WebSocket } from "ws";
+
+import events from "events";
+import assert from "assert/strict";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+
+
+/**
+ * Connector for controller connections
+ *
+ * @extends module:lib.WebSocketBaseConnector
+ * @alias module:controller/src/WsServerConnector
+ */
+export default class WsServerConnector extends lib.WebSocketBaseConnector {
+	_timeoutId: ReturnType<typeof setTimeout> | null = null;
+
+	constructor(
+		dst: lib.Address,
+		private _sessionId: number,
+		private _sessionTimeout: number,
+		public _heartbeatInterval: number,
+		maxSendBufferSize = 0,
+	) {
+		super(new lib.Address(lib.Address.controller, 0), dst);
+		this.maxSendBufferSize = maxSendBufferSize;
+
+		// The following states are used in the server connector
+		// closed: Connection is closed
+		// connected: Connection is online
+		// resuming: Waiting for client to resume.
+	}
+
+	_reset() {
+		if (this._timeoutId) {
+			clearTimeout(this._timeoutId);
+			this._timeoutId = null;
+		}
+		super._reset();
+	}
+
+	/**
+	 * Send ready over the socket
+	 *
+	 * Sends the ready message over the socket to initiate the session.
+	 *
+	 * @param socket - WebSocket connection to client.
+	 * @param src - Source address for this link.
+	 * @param sessionToken - the session token to send to the client.
+	 * @param account - account data to provide to control connection
+	 */
+	ready(
+		socket: WebSocket,
+		src: lib.Address,
+		sessionToken: string,
+		account: lib.AccountDetails | undefined
+	) {
+		this._socket = socket;
+		this._sendInternal(new lib.MessageReady(
+			new lib.ReadyData(
+				src,
+				sessionToken,
+				this._sessionTimeout,
+				this._heartbeatInterval,
+				account,
+			),
+		));
+
+		this._state = "connected";
+		this._attachSocketHandlers();
+		this.emit("connect", { src: this.src });
+	}
+
+	/**
+	 * Continue connection with the given socket
+	 *
+	 * Terminates the current socket and contiunes the session over the
+	 * socket given from the message sequence given.
+	 *
+	 * @param socket - New socket to continue on.
+	 * @param lastSeq - The last message the client received.
+	 */
+	continue(
+		socket: WebSocket,
+		lastSeq: number
+	) {
+
+		// It's possible the previous connection hasn't closed yet due to a
+		// stale connection.  Terminate it if so.
+		if (this._state === "connected" && this._socket !== null) {
+			this._socket.terminate();
+			this._socket.once("close", () => this.continue(socket, lastSeq));
+			return;
+		}
+
+		this._socket = socket;
+
+		if (this._timeoutId) {
+			clearTimeout(this._timeoutId);
+			this._timeoutId = null;
+		}
+
+		this._sendInternal(new lib.MessageContinue(
+			new lib.ContinueData(this._sessionTimeout, this._heartbeatInterval, this._lastReceivedSeq)
+		));
+
+		this._state = "connected";
+		this._attachSocketHandlers();
+		this._dropSendBufferSeq(lastSeq);
+		logger.verbose(
+			`Connector | resuming session with ${this.dst}, resending ${this._sendBuffer.length} buffered messages`
+		);
+		for (let message of this._sendBuffer) {
+			this._socket.send(message.text);
+		}
+		this.emit("resume");
+	}
+
+	_timedOut() {
+		logger.verbose(`Connector | Connection to ${this.dst} timed out`);
+		this._close();
+	}
+
+	_attachSocketHandlers() {
+		if (this._socket === null) {
+			throw new Error("this._socket is null");
+		}
+
+		this.startHeartbeat();
+
+		this._socket.on("close", (code: number, reason: string) => {
+			logger.verbose(`Connector | Close (code: ${code}, reason: ${reason})`);
+			this.stopHeartbeat();
+			this._socket = null;
+
+			if (this._closing) {
+				this._close();
+
+			} else {
+				this._state = "resuming";
+				this.emit("drop");
+				this._timeoutId = setTimeout(() => { this._timedOut(); }, this._sessionTimeout * 1000);
+			}
+		});
+
+		this._socket.on("open", () => {
+			logger.verbose("Connector | Open");
+		});
+		this._socket.on("ping", (data: string) => {
+			logger.verbose(`Connector | Ping (data: ${data}`);
+		});
+		this._socket.on("pong", (data: string) => {
+			logger.verbose(`Connector | Pong (data: ${data}`);
+		});
+
+		// Handle messages
+		this._socket.on("message", (data: string) => {
+			let message = this._parseMessage(data);
+			if (!message) {
+				return;
+			}
+			if (this._state === "connected") {
+				this._processMessage(message);
+
+			} else {
+				throw new Error(`Received message in unexpected state ${this._state}`);
+			}
+		});
+	}
+
+	/**
+	 * Close the connection with the given reason.
+	 *
+	 * Sends a close frame and disconnects the connector.
+	 *
+	 * @param code - WebSocket close code.
+	 * @param reason - WebSocket close reason.
+	 */
+	async close(
+		code: number,
+		reason: string
+	): Promise<void> {
+		if (this._state === "closed") {
+			return;
+		}
+
+		if (this._state === "resuming") {
+			this._close();
+			return;
+		}
+
+		this._closing = true;
+		if (this._socket !== null) {
+			this._socket.close(code, reason);
+		}
+		await events.once(this, "close");
+	}
+
+	/**
+	 * Forcefully close the connection immediately
+	 *
+	 * This should only be used if there's a security implication from
+	 * letting the connection carry on with a normal close proceedure.
+	 */
+	terminate() {
+		this.setClosing();
+
+		if (this._socket) {
+			this._socket.terminate();
+		}
+	}
+
+	/**
+	 * Notify the connection is expected to close
+	 *
+	 * Sets the internal flag to signal not to wait for the client to
+	 * reconnect and resume the connection if the client closes it.  This
+	 * will close the connection if it's currently waiting for the client to
+	 * resume it.
+	 */
+	setClosing() {
+		if (this._state === "resuming") {
+			this._close();
+			return;
+		}
+
+		this._closing = true;
+	}
+}

packages/controller/src/metrics.ts

@@ -0,0 +1,13 @@
+import * as lib from "@clusterio/lib";
+import util from "util";
+
+export const endpointHitCounter = new lib.Counter(
+	"clusterio_controller_http_endpoint_hits_total",
+	"How many requests a particular HTTP endpoint has gotten",
+	{ labels: ["route"], register: false }
+);
+
+endpointHitCounter.labels = util.deprecate(
+	endpointHitCounter.labels,
+	"incrementing endpointHitCounter is no longer needed and has no effect"
+);

packages/controller/src/routes.ts

@@ -0,0 +1,732 @@
+import type { Application, Request, Response } from "express";
+import Controller from "./Controller.js";
+
+import busboy from "busboy";
+import crypto from "crypto";
+import events from "events";
+import fs from "node:fs/promises";
+import JSZip from "jszip";
+import jwt from "jsonwebtoken";
+import path from "path";
+import nodeStream from "stream";
+import util from "util";
+
+import * as lib from "@clusterio/lib";
+import { logger } from "@clusterio/lib";
+
+const finished = util.promisify(nodeStream.finished);
+
+declare global {
+	// eslint-disable-next-line @typescript-eslint/no-namespace
+	namespace Express {
+		export interface Locals {
+			controller: Controller,
+			mainBundle: string,
+			staticRoot: string | null,
+			devPlugins: Map<string, number>,
+			streams: Map<string, ProxyStream>,
+			pendingMetrics?: Promise<string>,
+		}
+	}
+}
+
+// Merges samples from sourceResult to destinationResult
+function mergeSamples(destinationResult: lib.CollectorResultSerialized, sourceResult: lib.CollectorResultSerialized) {
+	let receivedSamples = new Map(sourceResult.samples);
+	for (let [suffix, suffixSamples] of destinationResult.samples) {
+		if (receivedSamples.has(suffix)) {
+			suffixSamples.push(...receivedSamples.get(suffix) as any[]);
+			receivedSamples.delete(suffix);
+		}
+	}
+
+	for (let entry of receivedSamples) {
+		destinationResult.samples.push(entry);
+	}
+}
+
+// Collect metrics from the controller, its plugins and all connected hosts
+async function gatherMetrics(controller: Controller) {
+	let results: lib.CollectorResult[] = [];
+	let pluginResults = await controller.hooks.metrics.collect();
+	for (let metricIterator of pluginResults) {
+		for await (let metric of metricIterator) {
+			results.push(metric);
+		}
+	}
+
+	let requests: Promise<InstanceType<typeof lib.HostMetricsRequest["Response"]> | null>[] = [];
+	let timeoutMs = controller.config.get("controller.metrics_timeout") * 1000;
+	for (let [hostId, hostConnection] of controller.wsServer.hostConnections) {
+		if (!hostConnection.connected) {
+			continue;
+		}
+		requests.push(lib.timeout(
+			hostConnection.send(new lib.HostMetricsRequest()).catch((err: any) => {
+				if (!(err instanceof lib.SessionLost)) {
+					logger.error(`Unexpected error gathering metrics from host:\n${err.stack}`);
+				}
+				return null;
+			}),
+			timeoutMs, null
+		));
+	}
+
+	for await (let result of lib.defaultRegistry.collect()) {
+		results.push(result);
+	}
+
+	let resultMap: Map<string, lib.CollectorResultSerialized> = new Map();
+	for (let response of await Promise.all(requests)) {
+		if (!response) {
+			// TODO: Log timeout occured?
+			continue;
+		}
+
+		for (let result of response.results) {
+			if (!resultMap.has(result.metric.name)) {
+				resultMap.set(result.metric.name, result);
+
+			} else {
+				// Merge metrics received by multiple hosts
+				mergeSamples(resultMap.get(result.metric.name)!, result);
+			}
+		}
+	}
+
+	for (let result of resultMap.values()) {
+		results.push(lib.deserializeResult(result));
+	}
+
+	return await lib.exposition(results);
+}
+
+// Prometheus polling endpoint
+async function getMetrics(req: Request, res: Response) {
+	try {
+		res.locals.user.checkPermission("core.controller.metrics");
+	} catch (err: any) {
+		res.status(403).json({ request_errors: [err.message] });
+		return;
+	}
+
+	// Concurrent scrapes share one gather so hosts see at most one
+	// metrics request at a time regardless of how many clients poll.
+	const locals = req.app.locals;
+	if (!locals.pendingMetrics) {
+		locals.pendingMetrics = gatherMetrics(locals.controller).finally(() => {
+			locals.pendingMetrics = undefined;
+		});
+	}
+	const text = await locals.pendingMetrics;
+	res.set("Content-Type", lib.expositionContentType);
+	res.send(text);
+}
+
+
+/**
+ * Removes the static/ prefix webpack adds to bundle paths so they can be
+ * resolved relative to staticRoot.
+ */
+export function stripStaticPrefix(bundlePath: string) {
+	return bundlePath.replace(/^static\//, "");
+}
+
+function getPlugins(req: Request, res: Response) {
+	let plugins: lib.PluginWebApi[] = [];
+	for (let pluginInfo of req.app.locals.controller.pluginInfos) {
+		let name = pluginInfo.name;
+		const loaded = req.app.locals.controller.loadedPlugins.has(pluginInfo);
+		const enabled = loaded && req.app.locals.controller.config.get(`${pluginInfo.name}.load_plugin`);
+		// Note: Cast through unknown is needed because load_plugin is
+		// defined at runtime and no other fields in the controller config
+		// currently have the boolean type.
+		let web: { main:any, error:string|undefined } = { main: undefined, error: undefined};
+		let devPlugins = req.app.locals.devPlugins;
+		if (devPlugins && devPlugins.has(name)) {
+			let stats = res.locals.webpack.devMiddleware.stats.stats[devPlugins.get(name)!];
+			web.main = stats.toJson().assetsByChunkName[name][0];
+		} else if (pluginInfo.manifest) {
+			web.main = pluginInfo.manifest[`${pluginInfo.name}.js`];
+			if (!web.main) {
+				web.error = `Missing ${pluginInfo.name}.js entry in manifest.json`;
+			}
+		} else if (lib.pluginNeedsWebBuild(pluginInfo)) {
+			web.error = "Missing dist/web/manifest.json";
+		}
+		if (web.main === "remoteEntry.js") {
+			web.error = "Incompatible old remoteEntry.js entrypoint.";
+		}
+		if (web.main) {
+			web.main = stripStaticPrefix(web.main);
+		}
+		plugins.push({ name, version: pluginInfo.version, enabled, loaded, web, npmPackage: pluginInfo.npmPackage });
+	}
+	res.send(plugins);
+}
+
+function getClusterName(req: Request, res: Response) {
+	const controller: Controller = req.app.locals.controller;
+	const clusterName = controller.config.get("controller.name");
+	res.json({ name: clusterName });
+}
+
+// Reads the access token from X-Access-Token or Authorization: Bearer
+function getAccessToken(req: Request) {
+	const token = req.header("x-access-token");
+	if (token) {
+		return token;
+	}
+	const authorization = req.header("authorization");
+	if (authorization && /^Bearer /i.test(authorization)) {
+		return authorization.slice("Bearer ".length).trim();
+	}
+	return undefined;
+}
+
+function validateHostToken(req: Request, res: Response, next: any) {
+	let token = getAccessToken(req);
+	if (!token) {
+		res.sendStatus(401);
+		return;
+	}
+
+	try {
+		const tokenPayload = jwt.verify(token, req.app.locals.controller.authSecret, { audience: "host" });
+		if (typeof tokenPayload === "string") {
+			throw new Error("unexpected JsonWebToken type");
+		}
+		let host = req.app.locals.controller.hosts.get(tokenPayload.host);
+		if (!host) {
+			throw new Error("invalid host");
+		}
+		if (!tokenPayload.iat || tokenPayload.iat < (host.tokenValidAfter ?? 0)) {
+			throw new Error("invalid token");
+		}
+	} catch (err) {
+		res.sendStatus(401);
+		return;
+	}
+
+	next();
+}
+
+function validateUserToken(req: Request, res: Response, next: any) {
+	let token = getAccessToken(req);
+	if (!token) {
+		res.sendStatus(401);
+		return;
+	}
+
+	try {
+		const tokenPayload = jwt.verify(token, req.app.locals.controller.authSecret, { audience: "user" });
+		if (typeof tokenPayload === "string") {
+			throw new Error("unexpected JsonWebToken type");
+		}
+		let user = req.app.locals.controller.users.getByName(tokenPayload.user);
+		if (!user) {
+			throw new Error("invalid user");
+		}
+		if (!tokenPayload.iat || tokenPayload.iat < user.tokenValidAfter) {
+			throw new Error("invalid token");
+		}
+		res.locals.user = user;
+
+	} catch (err) {
+		res.sendStatus(401);
+		return;
+	}
+
+	next();
+}
+
+// Handle an uploaded export package.
+async function uploadExport(req: Request, res: Response) {
+	if (req.get("Content-Type") !== "application/zip") {
+		res.sendStatus(415);
+		return;
+	}
+
+	if (typeof req.query.mod_pack_id !== "string") {
+		res.sendStatus(400);
+		return;
+	}
+	let modPackId = Number.parseInt(req.query.mod_pack_id, 10);
+	if (!Number.isInteger(modPackId)) {
+		res.sendStatus(400);
+		return;
+	}
+	let modPack = res.app.locals.controller.modPacks.getMutable(modPackId);
+	if (!modPack) {
+		res.sendStatus(400);
+		return;
+	}
+
+	let data = [];
+	for await (let chunk of req) {
+		data.push(chunk);
+	}
+	let buffer: Buffer | null = Buffer.concat(data);
+	let zip = await JSZip.loadAsync(buffer);
+	buffer = null;
+
+	// This is hardcoded to prevent path expansion attacks
+	let exportFiles = [
+		"export/settings.json",
+		"export/prototypes.json",
+		"export/locale.json",
+		"export/defines.json",
+		"export/spritesheet.png",
+		"export/metadata.json",
+	];
+
+	let assets: any = {};
+	let settingPrototypes: lib.ExportSettings = {};
+	for (let filePath of exportFiles) {
+		let file = zip.file(filePath);
+		if (!file) {
+			continue;
+		}
+
+		if (filePath === "export/settings.json") {
+			settingPrototypes = JSON.parse(await file.async("text"));
+		}
+
+		let { name, ext } = path.posix.parse(filePath);
+		let hash = await lib.hashStream(file.nodeStream());
+		assets[name] = `${name}.${hash}${ext}`;
+		await lib.safeOutputFile(path.join("static", `${name}.${hash}${ext}`), await file.async("nodebuffer"));
+	}
+
+	modPack.exportManifest = new lib.ExportManifest(assets, new Date().toISOString());
+	modPack.fillDefaultSettings(settingPrototypes, logger);
+	res.app.locals.controller.modPacks.set(modPack);
+
+	res.sendStatus(200);
+}
+
+type ProxyStreamEvents = {
+	"error": [ err: any ],
+	"close": [],
+	"timeout": [],
+	"source": [],
+}
+
+export interface ProxyStream {
+	id: string;
+	source: nodeStream.Readable | null;
+	flowing: boolean;
+	size?: string;
+	mime?: string;
+	filename: string | null;
+	events: events.EventEmitter<ProxyStreamEvents>;
+	timeout: ReturnType<typeof setTimeout>;
+}
+
+export async function createProxyStream(app: Application): Promise<ProxyStream> {
+	let asyncRandomBytes = util.promisify(crypto.randomBytes);
+	let id = (await asyncRandomBytes(8)).toString("hex");
+	let stream: ProxyStream = {
+		id,
+		source: null,
+		flowing: false,
+		size: undefined,
+		mime: undefined,
+		filename: null,
+		events: new events.EventEmitter(),
+		timeout: setTimeout(() => {
+			stream.events.emit("timeout");
+		}, app.locals.controller.config.get("controller.proxy_stream_timeout") * 1000),
+	};
+	stream.events.on("close", () => {
+		clearTimeout(stream.timeout);
+		app.locals.streams.delete(id);
+	});
+	stream.events.on("timeout", () => {
+		stream.events.emit("close");
+	});
+	app.locals.streams.set(id, stream);
+	return stream;
+}
+
+async function putStream(req: Request<{ id: string }>, res: Response) {
+	const stream = req.app.locals.streams.get(req.params.id);
+	if (!stream || stream.source) {
+		res.sendStatus(404);
+		return;
+	}
+	stream.source = req;
+	stream.mime = req.get("Content-Type");
+	stream.size = req.get("Content-Length");
+
+	stream.events.emit("source");
+	stream.events.on("close", () => {
+		if (!stream.flowing) {
+			req.resume();
+			res.sendStatus(500);
+		} else {
+			res.sendStatus(200);
+		}
+	});
+}
+
+function startStream(res: Response, stream: ProxyStream) {
+	res.append("Content-Type", stream.mime);
+	if (stream.size) {
+		res.append("Content-Length", stream.size);
+	}
+	if (stream.filename) {
+		res.append("Content-Disposition", `attachment; filename="${stream.filename}"`);
+	} else {
+		res.append("Content-Disposition", "attachment");
+	}
+	stream.source!.pipe(res);
+	stream.flowing = true;
+	res.on("close", () => {
+		stream.events.emit("close");
+	});
+	clearTimeout(stream.timeout);
+}
+
+async function getStream(req: Request<{ id: string }>, res: Response) {
+	const stream = req.app.locals.streams.get(req.params.id);
+	if (!stream || stream.flowing) {
+		res.sendStatus(404);
+		return;
+	}
+
+	if (stream.source) {
+		startStream(res, stream);
+	} else {
+		stream.events.on("source", () => startStream(res, stream));
+		stream.events.on("timeout", () => {
+			res.sendStatus(500);
+		});
+	}
+}
+
+
+const zipMimes = [
+	"application/zip",
+	"application/x-zip-compressed",
+];
+
+const contentTypeRegExp = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+\/[!#$%&'*+\-.^_`|~0-9A-Za-z]+)/;
+
+async function uploadSave(req: Request, res: Response) {
+	try {
+		res.locals.user.checkPermission("core.instance.save.upload");
+	} catch (err: any) {
+		res.status(403).json({ request_errors: [err.message] });
+		return;
+	}
+
+	let contentType = req.get("Content-Type") || "";
+	let match = contentTypeRegExp.exec(contentType);
+	if (!match) {
+		res.status(415).json({ request_errors: ["invalid Content-Type"] });
+		return;
+	}
+	let contentMime = match[1].toLowerCase();
+
+	let tasks = [];
+	let errors: string[] = [];
+	let requestErrors = [];
+	let saves: string[] = [];
+
+	async function handleFile(instanceId:number, stream: nodeStream.Readable, filename: string, streamMime: string) {
+		let proxyStream = await createProxyStream(req.app);
+		proxyStream.source = stream;
+		proxyStream.mime = streamMime;
+		let timeout = new Promise<never>((_, reject) => {
+			proxyStream.events.on("timeout", () => {
+				stream.resume();
+				reject(new Error("Timed out establishing stream to host"));
+			});
+		});
+
+		try {
+			let storedName: string = await Promise.race([
+				req.app.locals.controller.sendToHostByInstanceId(
+					new lib.InstancePullSaveRequest(
+						instanceId,
+						proxyStream.id,
+						filename,
+					)
+				),
+				timeout,
+			]);
+			saves.push(storedName);
+
+		} catch (err: any) {
+			proxyStream.events.emit("close");
+			logger.error(`Error uploading save: ${err.message}`);
+			errors.push(err.message);
+			stream.resume();
+		}
+	}
+
+	if (contentMime === "multipart/form-data") {
+		await new Promise(resolve => {
+			let instanceId: number | undefined;
+			function fileHandler(
+				name: string,
+				stream: nodeStream.Readable,
+				{ filename, mimeType }: { filename: string, mimeType: string }
+			) {
+				if (instanceId === undefined) {
+					requestErrors.push("instance_id must come before files uploaded");
+				}
+				if (!zipMimes.includes(mimeType)) {
+					requestErrors.push("invalid file Content-Type");
+				}
+				if (!filename.endsWith(".zip")) {
+					requestErrors.push("filename must end with .zip");
+				}
+				if (errors.length || requestErrors.length) {
+					stream.resume();
+					return;
+				}
+				tasks.push(handleFile(instanceId as number, stream, filename, mimeType));
+			}
+			let parser = busboy({ headers: req.headers });
+			parser.on("file", fileHandler);
+			parser.on("field", (name, value, info) => {
+				if (name === "instance_id") {
+					instanceId = Number.parseInt(value, 10);
+					if (Number.isNaN(instanceId)) {
+						requestErrors.push("invalid instance_id");
+					}
+				}
+			});
+			parser.on("close", resolve);
+			parser.on("error", (err: any) => {
+				logger.error(`Error parsing multipart request in upload-save:\n${err.stack}`);
+				errors.push(err.message);
+			});
+			req.pipe(parser);
+		});
+
+	} else if (zipMimes.includes(contentMime)) {
+		let filename = req.query.filename;
+		if (typeof filename !== "string") {
+			requestErrors.push("Missing or invalid filename parameter");
+		} else if (!filename.endsWith(".zip")) {
+			requestErrors.push("filename must end with .zip");
+		}
+		let instanceId = Number.parseInt(String(req.query.instance_id), 10);
+		if (Number.isNaN(instanceId)) {
+			requestErrors.push("Missing or invalid instance_id parameter");
+		}
+
+		if (errors.length || requestErrors.length) {
+			req.resume();
+		} else {
+			tasks.push(handleFile(instanceId, req, filename as string, contentMime));
+		}
+
+	} else {
+		res.status(415).json({ request_errors: ["invalid Content-Type"] });
+		return;
+	}
+
+	await Promise.all(tasks);
+
+	if (errors.length) {
+		res.status(500);
+		res.json({ errors, request_errors: requestErrors });
+		return;
+	}
+	if (requestErrors.length) {
+		res.status(400);
+		res.json({ request_errors: requestErrors });
+		return;
+	}
+
+	res.json({ saves });
+}
+
+function checkModName(name: string) {
+	try {
+		lib.checkFilename(name);
+	} catch (err: any) {
+		throw new lib.RequestError(`Mod name ${err.message}`);
+	}
+}
+
+async function uploadMod(req: Request, res: Response) {
+	try {
+		res.locals.user.checkPermission("core.mod.upload");
+	} catch (err: any) {
+		res.status(403).json({ request_errors: [err.message] });
+		return;
+	}
+
+	let contentType = req.get("Content-Type")!;
+	let match = contentTypeRegExp.exec(contentType);
+	if (!match) {
+		res.status(415).json({ request_errors: ["invalid Content-Type"] });
+		return;
+	}
+	let contentMime = match[1].toLowerCase();
+
+	let tasks = [];
+	let errors: string[] = [];
+	let requestErrors = [];
+	let mods: any[] = [];
+
+	async function handleFile(stream: nodeStream.Readable, filename: string) {
+		try {
+			checkModName(filename);
+
+		} catch (err: any) {
+			logger.error(`Error uploading mod: ${err.message}`);
+			errors.push(err.message);
+			stream.resume();
+			return;
+		}
+
+		const modsDirectory = req.app.locals.controller.config.get("controller.mods_directory");
+		const filePath = path.join(modsDirectory, filename);
+		const [tempFilePath, writeStream] = await lib.createTempWriteStream(filePath);
+
+		try {
+			stream.pipe(writeStream);
+			await finished(writeStream);
+
+			const modInfo = await lib.ModInfo.fromModFile(tempFilePath);
+			checkModName(modInfo.filename);
+			await fs.rename(tempFilePath, path.join(modsDirectory, modInfo.filename));
+			req.app.locals.controller.modStore.addMod(modInfo);
+			mods.push(modInfo.toJSON());
+
+		} catch (err: any) {
+			logger.error(`Error uploading mod: ${err.message}`);
+			errors.push(err.message);
+			stream.resume();
+
+			// Attempt to clean up.
+			writeStream.destroy();
+
+			try {
+				await fs.unlink(tempFilePath);
+			} catch (unlinkErr: any) {
+				if (unlinkErr.code !== "ENOENT") {
+					logger.error(`Error removing ${tempFilePath}: ${unlinkErr.message}`);
+				}
+			}
+		}
+	}
+
+	if (contentMime === "multipart/form-data") {
+		await new Promise(resolve => {
+			function fileHandler(
+				name: string,
+				stream: nodeStream.Readable,
+				{ filename, mimeType }: { filename: string, mimeType: string }
+			) {
+				if (!zipMimes.includes(mimeType)) {
+					requestErrors.push("invalid file Content-Type");
+				}
+				if (!filename.endsWith(".zip")) {
+					requestErrors.push("filename must end with .zip");
+				}
+				if (errors.length || requestErrors.length) {
+					stream.resume();
+					return;
+				}
+				tasks.push(handleFile(stream, filename));
+			}
+
+			let parser = busboy({ headers: req.headers });
+			parser.on("file", fileHandler);
+			parser.on("close", resolve);
+			parser.on("error", (err: any) => {
+				logger.error(`Error parsing multipart request in upload-mod:\n${err.stack}`);
+				errors.push(err.message);
+			});
+			req.pipe(parser);
+		});
+
+	} else if (zipMimes.includes(contentMime)) {
+		let filename = req.query.filename;
+		if (typeof filename !== "string") {
+			requestErrors.push("Missing or invalid filename parameter");
+		} else if (!filename.endsWith(".zip")) {
+			requestErrors.push("filename must end with .zip");
+		}
+
+		if (errors.length || requestErrors.length) {
+			req.resume();
+		} else {
+			tasks.push(handleFile(req, filename as string));
+		}
+
+	} else {
+		res.status(415).json({ request_errors: ["invalid Content-Type"] });
+		return;
+	}
+
+	await Promise.all(tasks);
+
+	if (errors.length) {
+		res.status(500);
+		res.json({ errors, request_errors: requestErrors });
+		return;
+	}
+	if (requestErrors.length) {
+		res.status(400);
+		res.json({ request_errors: requestErrors });
+		return;
+	}
+
+	res.json({ mods });
+}
+
+
+export function addRouteHandlers(app: Application) {
+	app.get("/metrics",
+		validateUserToken,
+		(req:Request, res:Response, next:any) => getMetrics(req, res).catch(next)
+	);
+	app.get("/api/plugins", getPlugins);
+	app.get("/api/cluster-name", getClusterName);
+	app.put("/api/upload-export",
+		validateHostToken,
+		(req:Request, res:Response, next:any) => uploadExport(req, res).catch(next)
+	);
+	app.put("/api/stream/:id",
+		(req:Request<{ id: string }>, res:Response, next:any) => putStream(req, res).catch(next)
+	);
+	app.get("/api/stream/:id",
+		(req:Request<{ id: string }>, res:Response, next:any) => getStream(req, res).catch(next)
+	);
+	app.post("/api/upload-save",
+		validateUserToken,
+		(req:Request, res:Response, next:any) => uploadSave(req, res).catch(next)
+	);
+	app.post("/api/upload-mod",
+		validateUserToken,
+		(req:Request, res:Response, next:any) => uploadMod(req, res).catch(next)
+	);
+}
+
+// Routes used in the web interface and served by the controller
+export const webRoutes = [
+	"/",
+	"/controller",
+	"/hosts",
+	"/hosts/:id/view",
+	"/instances",
+	"/instances/:id/view",
+	"/mods",
+	"/mods/mod-packs/:id/view",
+	"/mods/mod-packs/:id/icon-reference",
+	"/users",
+	"/users/:id/view",
+	"/roles",
+	"/roles/:id/view",
+	"/plugins",
+	"/plugins/:name/view",
+	"/error",
+];