--- deliantra/server/lib/cf.pm	2006/07/16 17:15:39	1.19
+++ deliantra/server/lib/cf.pm	2007/01/04 20:29:46	1.135
@@ -1,138 +1,961 @@
 package cf;
 
+use utf8;
+use strict;
+
 use Symbol;
 use List::Util;
 use Storable;
+use Opcode;
+use Safe;
+use Safe::Hole;
+
+use Coro 3.3 ();
+use Coro::Event;
+use Coro::Timer;
+use Coro::Signal;
+use Coro::Semaphore;
+use Coro::AIO;
+
+use Digest::MD5;
+use Fcntl;
+use IO::AIO 2.31 ();
+use YAML::Syck ();
+use Time::HiRes;
+
+use Event; $Event::Eval = 1; # no idea why this is required, but it is
+
+# work around bug in YAML::Syck - bad news for perl6, will it be as broken wrt. unicode?
+$YAML::Syck::ImplicitUnicode = 1;
+
+$Coro::main->prio (2); # run main coroutine ("the server") with very high priority
+
+sub WF_AUTOCANCEL () { 1 } # automatically cancel this watcher on reload
+
+our %COMMAND      = ();
+our %COMMAND_TIME = ();
+our %EXTCMD       = ();
 
-use Event;
-$Event::Eval = 1; # no idea why this is required, but it is
+our @EVENT;
+our $LIBDIR = datadir . "/ext";
 
-use strict;
+our $TICK = MAX_TIME * 1e-6;
+our $TICK_WATCHER;
+our $NEXT_TICK;
+our $NOW;
+
+our %CFG;
+
+our $UPTIME; $UPTIME ||= time;
+our $RUNTIME;
+
+our %MAP; # all maps
+our $LINK_MAP; # the special {link} map
+our $RANDOM_MAPS = cf::localdir . "/random";
+our %EXT_CORO;
+
+binmode STDOUT;
+binmode STDERR;
+
+# read virtual server time, if available
+unless ($RUNTIME || !-e cf::localdir . "/runtime") {
+   open my $fh, "<", cf::localdir . "/runtime"
+      or die "unable to read runtime file: $!";
+   $RUNTIME = <$fh> + 0.;
+}
 
-our %COMMAND;
-our @EVENT;
-our %PROP_TYPE;
-our %PROP_IDX;
+mkdir cf::localdir;
+mkdir cf::localdir . "/" . cf::playerdir;
+mkdir cf::localdir . "/" . cf::tmpdir;
+mkdir cf::localdir . "/" . cf::uniquedir;
+mkdir $RANDOM_MAPS;
+
+# a special map that is always available
+our $LINK_MAP;
+our $EMERGENCY_POSITION;
 
-BEGIN {
-   @EVENT = map lc, @EVENT;
+#############################################################################
+
+=head2 GLOBAL VARIABLES
+
+=over 4
+
+=item $cf::UPTIME
+
+The timestamp of the server start (so not actually an uptime).
+
+=item $cf::RUNTIME
+
+The time this server has run, starts at 0 and is increased by $cf::TICK on
+every server tick.
+
+=item $cf::LIBDIR
+
+The perl library directory, where extensions and cf-specific modules can
+be found. It will be added to C<@INC> automatically.
+
+=item $cf::NOW
+
+The time of the last (current) server tick.
+
+=item $cf::TICK
+
+The interval between server ticks, in seconds.
+
+=item %cf::CFG
 
+Configuration for the server, loaded from C</etc/crossfire/config>, or
+from wherever your confdir points to.
+
+=back
+
+=cut
+
+BEGIN {
    *CORE::GLOBAL::warn = sub {
       my $msg = join "", @_;
+      utf8::encode $msg;
+
       $msg .= "\n"
          unless $msg =~ /\n$/;
 
-      print STDERR "cfperl: $msg";
       LOG llevError, "cfperl: $msg";
    };
 }
 
-my %ignore_set = (MAP_PROP_PATH => 1); # I hate the plug-in api. Deeply!
+@safe::cf::global::ISA         = @cf::global::ISA         = 'cf::attachable';
+@safe::cf::object::ISA         = @cf::object::ISA         = 'cf::attachable';
+@safe::cf::player::ISA         = @cf::player::ISA         = 'cf::attachable';
+@safe::cf::client::ISA         = @cf::client::ISA         = 'cf::attachable';
+@safe::cf::map::ISA            = @cf::map::ISA            = 'cf::attachable';
+@safe::cf::object::player::ISA = @cf::object::player::ISA = 'cf::object';
+
+# we bless all objects into (empty) derived classes to force a method lookup
+# within the Safe compartment.
+for my $pkg (qw(
+   cf::global cf::attachable
+   cf::object cf::object::player
+   cf::client cf::player
+   cf::arch cf::living
+   cf::map cf::party cf::region
+)) {
+   no strict 'refs';
+   @{"safe::$pkg\::wrap::ISA"} = @{"$pkg\::wrap::ISA"} = $pkg;
+}
 
-# generate property mutators
-sub prop_gen {
-   my ($prefix, $class) = @_;
+$Event::DIED = sub {
+   warn "error in event callback: @_";
+};
 
-   no strict 'refs';
+my %ext_pkg;
+my @exts;
+my @hook;
 
-   for my $prop (keys %PROP_TYPE) {
-      $prop =~ /^\Q$prefix\E_(.*$)/ or next;
-      my $sub = lc $1;
+=head2 UTILITY FUNCTIONS
 
-      my $type = $PROP_TYPE{$prop};
-      my $idx  = $PROP_IDX {$prop};
+=over 4
 
-      *{"$class\::get_$sub"} = *{"$class\::$sub"} = sub {
-         $_[0]->get_property ($type, $idx)
-      };
+=cut
+
+use JSON::Syck (); # TODO# replace by JSON::PC once working
+
+=item $ref = cf::from_json $json
+
+Converts a JSON string into the corresponding perl data structure.
+
+=cut
+
+sub from_json($) {
+   $JSON::Syck::ImplicitUnicode = 1; # work around JSON::Syck bugs
+   JSON::Syck::Load $_[0]
+}
 
-      *{"$class\::set_$sub"} = sub {
-         $_[0]->set_property ($type, $idx, $_[1]);
-      } unless $ignore_set{$prop};
+=item $json = cf::to_json $ref
+
+Converts a perl data structure into its JSON representation.
+
+=cut
+
+sub to_json($) {
+   $JSON::Syck::ImplicitUnicode = 0;  # work around JSON::Syck bugs
+   JSON::Syck::Dump $_[0]
+}
+
+=item cf::lock_wait $string
+
+Wait until the given lock is available. See cf::lock_acquire. 
+
+=item my $lock = cf::lock_acquire $string
+
+Wait until the given lock is available and then acquires it and returns
+a Coro::guard object. If the guard object gets destroyed (goes out of scope,
+for example when the coroutine gets canceled), the lock is automatically
+returned.
+
+Lock names should begin with a unique identifier (for example, cf::map::find
+uses map_find and cf::map::load uses map_load).
+
+=cut
+
+our %LOCK;
+
+sub lock_wait($) {
+   my ($key) = @_;
+
+   # wait for lock, if any
+   while ($LOCK{$key}) {
+      push @{ $LOCK{$key} }, $Coro::current;
+      Coro::schedule;
    }
 }
 
-# auto-generate most of the API
+sub lock_acquire($) {
+   my ($key) = @_;
 
-prop_gen OBJECT_PROP => "cf::object";
-# CFAPI_OBJECT_ANIMATION?
-prop_gen PLAYER_PROP => "cf::object::player";
+   # wait, to be sure we are not locked
+   lock_wait $key;
 
-prop_gen MAP_PROP    => "cf::map";
-prop_gen ARCH_PROP   => "cf::arch";
+   $LOCK{$key} = [];
 
-# guessed hierarchies
+   Coro::guard {
+      # wake up all waiters, to be on the safe side
+      $_->ready for @{ delete $LOCK{$key} };
+   }
+}
 
-@cf::object::player::ISA = 'cf::object';
-@cf::object::map::ISA    = 'cf::object';
+=item cf::async { BLOCK }
 
-$Event::DIED = sub {
-   warn "error in event callback: @_";
-};
+Like C<Coro::async>, but runs the given BLOCK in an eval and only logs the
+error instead of exiting the server in case of a problem.
 
-my %ext_pkg;
-my @exts;
-my @hook;
-my %command;
-my %extcmd;
+=cut
+
+sub async(&) {
+   my ($cb) = @_;
+
+   Coro::async {
+      eval { $cb->() };
+      warn $@ if $@;
+   }
+}
+
+sub freeze_mainloop {
+   return unless $TICK_WATCHER->is_active;
+
+   my $guard = Coro::guard { $TICK_WATCHER->start };
+   $TICK_WATCHER->stop;
+   $guard
+}
+
+=item cf::sync_job { BLOCK }
+
+The design of crossfire+ requires that the main coro ($Coro::main) is
+always able to handle events or runnable, as crossfire+ is only partly
+reentrant. Thus "blocking" it by e.g. waiting for I/O is not acceptable.
+
+If it must be done, put the blocking parts into C<sync_job>. This will run
+the given BLOCK in another coroutine while waiting for the result. The
+server will be frozen during this time, so the block should either finish
+fast or be very important.
+
+=cut
+
+sub sync_job(&) {
+   my ($job) = @_;
+
+   if ($Coro::current == $Coro::main) {
+      # this is the main coro, too bad, we have to block
+      # till the operation succeeds, freezing the server :/
+      
+      # TODO: use suspend/resume instead
+      # (but this is cancel-safe)
+      my $freeze_guard = freeze_mainloop;
+
+      my $busy = 1;
+      my @res;
+
+      (Coro::async {
+         @res = eval { $job->() };
+         warn $@ if $@;
+         undef $busy;
+      })->prio (Coro::PRIO_MAX);
+
+      while ($busy) {
+         Coro::cede_notself;
+         Event::one_event unless Coro::nready;
+      }
+
+      wantarray ? @res : $res[0]
+   } else {
+      # we are in another coroutine, how wonderful, everything just works
+ 
+      $job->()
+   }
+}
+
+=item $coro = cf::coro { BLOCK }
+
+Creates and returns a new coro. This coro is automcatially being canceled
+when the extension calling this is being unloaded.
+
+=cut
+
+sub coro(&) {
+   my $cb = shift;
+
+   my $coro = &cf::async ($cb);
+
+   $coro->on_destroy (sub {
+      delete $EXT_CORO{$coro+0};
+   });
+   $EXT_CORO{$coro+0} = $coro;
 
-sub inject_event {
-   my $extension = shift;
-   my $event_code = shift;
+   $coro
+}
+
+sub write_runtime {
+   my $runtime = cf::localdir . "/runtime";
+
+   my $fh = aio_open "$runtime~", O_WRONLY | O_CREAT, 0644
+      or return;
+
+   my $value = $cf::RUNTIME + 1 + 10; # 10 is the runtime save interval, for a monotonic clock
+   (aio_write $fh, 0, (length $value), $value, 0) <= 0
+      and return;
+
+   aio_fsync $fh
+      and return;
 
-   my $cb = $hook[$event_code]{$extension}
+   close $fh
       or return;
 
-   &$cb
+   aio_rename "$runtime~", $runtime
+      and return;
+
+   1
+}
+
+=back
+
+=cut
+
+#############################################################################
+
+package cf::path;
+
+sub new {
+   my ($class, $path, $base) = @_;
+
+   $path = $path->as_string if ref $path;
+
+   my $self = bless { }, $class;
+
+   # {...        are special paths that are not touched
+   # ?xxx/...    are special absolute paths
+   # ?random/... random maps
+   # /!          non-realised random map exit
+   # /...        normal maps
+   # ~/...       per-player maps without a specific player (DO NOT USE)
+   # ~user/...   per-player map of a specific user
+
+   if ($path =~ /^{/) {
+      # fine as it is
+   } elsif ($path =~ s{^\?random/}{}) {
+      Coro::AIO::aio_load "$cf::RANDOM_MAPS/$path.meta", my $data;
+      $self->{random} = cf::from_json $data;
+   } else {
+      if ($path =~ s{^~([^/]+)?}{}) {
+         $self->{user_rel} = 1;
+
+         if (defined $1) {
+            $self->{user} = $1;
+         } elsif ($base =~ m{^~([^/]+)/}) {
+            $self->{user} = $1;
+         } else {
+            warn "cannot resolve user-relative path without user <$path,$base>\n";
+         }
+      } elsif ($path =~ /^\//) {
+         # already absolute
+      } else {
+         $base =~ s{[^/]+/?$}{};
+         return $class->new ("$base/$path");
+      }
+
+      for ($path) {
+         redo if s{/\.?/}{/};
+         redo if s{/[^/]+/\.\./}{/};
+      }
+   }
+
+   $self->{path} = $path;
+
+   $self
+}
+
+# the name / primary key / in-game path
+sub as_string {
+   my ($self) = @_;
+
+   $self->{user_rel} ? "~$self->{user}$self->{path}"
+   : $self->{random} ? "?random/$self->{path}"
+                     : $self->{path}
+}
+
+# the displayed name, this is a one way mapping
+sub visible_name {
+   my ($self) = @_;
+
+#   if (my $rmp = $self->{random}) {
+#      # todo: be more intelligent about this
+#      "?random/$rmp->{origin_map}+$rmp->{origin_x}+$rmp->{origin_y}/$rmp->{dungeon_level}"
+#   } else {
+      $self->as_string
+#   }
+}
+
+# escape the /'s in the path
+sub _escaped_path  {
+   # ∕ is U+2215
+   (my $path = $_[0]{path}) =~ s/\//∕/g;
+   $path
+}
+
+# the original (read-only) location
+sub load_path {
+   my ($self) = @_;
+
+   sprintf "%s/%s/%s", cf::datadir, cf::mapdir, $self->{path}
+}
+
+# the temporary/swap location
+sub save_path {
+   my ($self) = @_;
+
+   $self->{user_rel} ? sprintf "%s/%s/%s/%s", cf::localdir, cf::playerdir, $self->{user}, $self->_escaped_path
+   : $self->{random} ? sprintf "%s/%s", $RANDOM_MAPS, $self->{path}
+                     : sprintf "%s/%s/%s", cf::localdir, cf::tmpdir, $self->_escaped_path
+}
+
+# the unique path, might be eq to save_path
+sub uniq_path {
+   my ($self) = @_;
+
+   $self->{user_rel} || $self->{random}
+      ? undef
+      : sprintf "%s/%s/%s", cf::localdir, cf::uniquedir, $self->_escaped_path
+}
+
+# return random map parameters, or undef
+sub random_map_params {
+   my ($self) = @_;
+
+   $self->{random}
 }
 
-sub inject_global_event {
+# this is somewhat ugly, but style maps do need special treatment
+sub is_style_map {
+   $_[0]{path} =~ m{^/styles/}
+}
+
+package cf;
+
+#############################################################################
+
+=head2 ATTACHABLE OBJECTS
+
+Many objects in crossfire are so-called attachable objects. That means you can
+attach callbacks/event handlers (a collection of which is called an "attachment")
+to it. All such attachable objects support the following methods.
+
+In the following description, CLASS can be any of C<global>, C<object>
+C<player>, C<client> or C<map> (i.e. the attachable objects in
+crossfire+).
+
+=over 4
+
+=item $attachable->attach ($attachment, key => $value...)
+
+=item $attachable->detach ($attachment)
+
+Attach/detach a pre-registered attachment to a specific object and give it
+the specified key/value pairs as arguments.
+
+Example, attach a minesweeper attachment to the given object, making it a
+10x10 minesweeper game:
+
+   $obj->attach (minesweeper => width => 10, height => 10);
+
+=item $bool = $attachable->attached ($name)
+
+Checks wether the named attachment is currently attached to the object.
+
+=item cf::CLASS->attach ...
+
+=item cf::CLASS->detach ...
+
+Define an anonymous attachment and attach it to all objects of the given
+CLASS. See the next function for an explanation of its arguments.
+
+You can attach to global events by using the C<cf::global> class.
+
+Example, log all player logins:
+
+   cf::player->attach (
+      on_login => sub {
+         my ($pl) = @_;
+         ...
+      },
+   );
+
+Example, attach to the jeweler skill:
+
+   cf::object->attach (
+      type         => cf::SKILL,
+      subtype      => cf::SK_JEWELER,
+      on_use_skill => sub {
+         my ($sk, $ob, $part, $dir, $msg) = @_;
+         ...
+      },
+   );
+
+=item cf::CLASS::attachment $name, ...
+
+Register an attachment by C<$name> through which attachable objects of the
+given CLASS can refer to this attachment.
+
+Some classes such as crossfire maps and objects can specify attachments
+that are attached at load/instantiate time, thus the need for a name.
+
+These calls expect any number of the following handler/hook descriptions:
+
+=over 4
+
+=item prio => $number
+
+Set the priority for all following handlers/hooks (unless overwritten
+by another C<prio> setting). Lower priority handlers get executed
+earlier. The default priority is C<0>, and many built-in handlers are
+registered at priority C<-1000>, so lower priorities should not be used
+unless you know what you are doing.
+
+=item type => $type
+
+(Only for C<< cf::object->attach >> calls), limits the attachment to the
+given type of objects only (the additional parameter C<subtype> can be
+used to further limit to the given subtype).
+
+=item on_I<event> => \&cb
+
+Call the given code reference whenever the named event happens (event is
+something like C<instantiate>, C<apply>, C<use_skill> and so on, and which
+handlers are recognised generally depends on the type of object these
+handlers attach to).
+
+See F<include/eventinc.h> for the full list of events supported, and their
+class.
+
+=item package => package::
+
+Look for sub functions of the name C<< on_I<event> >> in the given
+package and register them.  Only handlers for eevents supported by the
+object/class are recognised.
+
+=back
+
+Example, define an attachment called "sockpuppet" that calls the given
+event handler when a monster attacks:
+
+   cf::object::attachment sockpuppet =>
+      on_skill_attack => sub {
+         my ($self, $victim) = @_;
+         ...
+      }
+   }
+
+=item $attachable->valid
+
+Just because you have a perl object does not mean that the corresponding
+C-level object still exists. If you try to access an object that has no
+valid C counterpart anymore you get an exception at runtime. This method
+can be used to test for existence of the C object part without causing an
+exception.
+
+=cut
+
+# the following variables are defined in .xs and must not be re-created
+our @CB_GLOBAL     = (); # registry for all global events
+our @CB_ATTACHABLE = (); # registry for all attachables
+our @CB_OBJECT     = (); # all objects (should not be used except in emergency)
+our @CB_PLAYER     = ();
+our @CB_CLIENT     = ();
+our @CB_TYPE       = (); # registry for type (cf-object class) based events
+our @CB_MAP        = ();
+
+my %attachment;
+
+sub _attach_cb($$$$) {
+   my ($registry, $event, $prio, $cb) = @_;
+
+   use sort 'stable';
+
+   $cb = [$prio, $cb];
+
+   @{$registry->[$event]} = sort
+                           { $a->[0] cmp $b->[0] }
+                           @{$registry->[$event] || []}, $cb;
+}
+
+# hack
+my %attachable_klass = map +($_ => 1), KLASS_OBJECT, KLASS_CLIENT, KLASS_PLAYER, KLASS_MAP;
+
+# attach handles attaching event callbacks
+# the only thing the caller has to do is pass the correct
+# registry (== where the callback attaches to).
+sub _attach {
+   my ($registry, $klass, @arg) = @_;
+
+   my $object_type;
+   my $prio = 0;
+   my %cb_id = map +("on_" . lc $EVENT[$_][0], $_) , grep $EVENT[$_][1] == $klass, 0 .. $#EVENT;
+
+   #TODO: get rid of this hack
+   if ($attachable_klass{$klass}) {
+      %cb_id = (%cb_id, map +("on_" . lc $EVENT[$_][0], $_) , grep $EVENT[$_][1] == KLASS_ATTACHABLE, 0 .. $#EVENT);
+   }
+
+   while (@arg) {
+      my $type = shift @arg;
+
+      if ($type eq "prio") {
+         $prio = shift @arg;
+
+      } elsif ($type eq "type") {
+         $object_type = shift @arg;
+         $registry = $CB_TYPE[$object_type] ||= [];
+
+      } elsif ($type eq "subtype") {
+         defined $object_type or Carp::croak "subtype specified without type";
+         my $object_subtype = shift @arg;
+         $registry = $CB_TYPE[$object_type + $object_subtype * NUM_SUBTYPES] ||= [];
+
+      } elsif ($type eq "package") {
+         my $pkg = shift @arg;
+
+         while (my ($name, $id) = each %cb_id) {
+            if (my $cb = $pkg->can ($name)) {
+               _attach_cb $registry, $id, $prio, $cb;
+            }
+         }
+
+      } elsif (exists $cb_id{$type}) {
+         _attach_cb $registry, $cb_id{$type}, $prio, shift @arg;
+
+      } elsif (ref $type) {
+         warn "attaching objects not supported, ignoring.\n";
+
+      } else {
+         shift @arg;
+         warn "attach argument '$type' not supported, ignoring.\n";
+      }
+   }
+}
+
+sub _object_attach {
+   my ($obj, $name, %arg) = @_;
+
+   return if exists $obj->{_attachment}{$name};
+
+   if (my $attach = $attachment{$name}) {
+      my $registry = $obj->registry;
+
+      for (@$attach) {
+         my ($klass, @attach) = @$_;
+         _attach $registry, $klass, @attach;
+      }
+
+      $obj->{$name} = \%arg;
+   } else {
+      warn "object uses attachment '$name' that is not available, postponing.\n";
+   }
+
+   $obj->{_attachment}{$name} = undef;
+}
+
+sub cf::attachable::attach {
+   if (ref $_[0]) {
+      _object_attach @_;
+   } else {
+      _attach shift->_attach_registry, @_;
+   }
+};
+
+# all those should be optimised
+sub cf::attachable::detach {
+   my ($obj, $name) = @_;
+
+   if (ref $obj) {
+      delete $obj->{_attachment}{$name};
+      reattach ($obj);
+   } else {
+      Carp::croak "cannot, currently, detach class attachments";
+   }
+};
+
+sub cf::attachable::attached {
+   my ($obj, $name) = @_;
+
+   exists $obj->{_attachment}{$name}
+}
+
+for my $klass (qw(ATTACHABLE GLOBAL OBJECT PLAYER CLIENT MAP)) {
+   eval "#line " . __LINE__ . " 'cf.pm'
+      sub cf::\L$klass\E::_attach_registry {
+         (\\\@CB_$klass, KLASS_$klass)
+      }
+
+      sub cf::\L$klass\E::attachment {
+         my \$name = shift;
+
+         \$attachment{\$name} = [[KLASS_$klass, \@_]];
+      }
+   ";
+   die if $@;
+}
+
+our $override;
+our @invoke_results = (); # referenced from .xs code. TODO: play tricks with reify and mortals?
+
+sub override {
+   $override = 1;
+   @invoke_results = ();
+}
+
+sub do_invoke {
    my $event = shift;
+   my $callbacks = shift;
 
-   my $cb = $hook[$event]
-      or return;
+   @invoke_results = ();
+
+   local $override;
+
+   for (@$callbacks) {
+      eval { &{$_->[1]} };
 
-   List::Util::max map &$_, values %$cb
+      if ($@) {
+         warn "$@";
+         warn "... while processing $EVENT[$event][0](@_) event, skipping processing altogether.\n";
+         override;
+      }
+
+      return 1 if $override;
+   }
+
+   0
 }
 
-sub inject_command {
-   my ($name, $obj, $params) = @_;
+=item $bool = cf::global::invoke (EVENT_CLASS_XXX, ...)
+
+=item $bool = $attachable->invoke (EVENT_CLASS_XXX, ...)
 
-   for my $cmd (@{ $command{$name} }) {
-      $cmd->[1]->($obj, $params);
+Generate an object-specific event with the given arguments.
+
+This API is preliminary (most likely, the EVENT_CLASS_xxx prefix will be
+removed in future versions), and there is no public API to access override
+results (if you must, access C<@cf::invoke_results> directly).
+
+=back
+
+=cut
+
+#############################################################################
+# object support
+
+sub reattach {
+   # basically do the same as instantiate, without calling instantiate
+   my ($obj) = @_;
+
+   my $registry = $obj->registry;
+
+   @$registry = ();
+
+   delete $obj->{_attachment} unless scalar keys %{ $obj->{_attachment} || {} };
+
+   for my $name (keys %{ $obj->{_attachment} || {} }) {
+      if (my $attach = $attachment{$name}) {
+         for (@$attach) {
+            my ($klass, @attach) = @$_;
+            _attach $registry, $klass, @attach;
+         }
+      } else {
+         warn "object uses attachment '$name' that is not available, postponing.\n";
+      }
    }
+}
+
+cf::attachable->attach (
+   prio           => -1000000,
+   on_instantiate => sub {
+      my ($obj, $data) = @_;
+
+      $data = from_json $data;
+
+      for (@$data) {
+         my ($name, $args) = @$_;
 
-   -1
+         $obj->attach ($name, %{$args || {} });
+      }
+   },
+   on_reattach => \&reattach,
+   on_clone => sub {
+      my ($src, $dst) = @_;
+
+      @{$dst->registry} = @{$src->registry};
+
+      %$dst = %$src;
+
+      %{$dst->{_attachment}} = %{$src->{_attachment}}
+         if exists $src->{_attachment};
+   },
+);
+
+sub object_freezer_save {
+   my ($filename, $rdata, $objs) = @_;
+
+   sync_job {
+      if (length $$rdata) {
+         warn sprintf "saving %s (%d,%d)\n",
+            $filename, length $$rdata, scalar @$objs;
+
+         if (my $fh = aio_open "$filename~", O_WRONLY | O_CREAT, 0600) {
+            chmod SAVE_MODE, $fh;
+            aio_write $fh, 0, (length $$rdata), $$rdata, 0;
+            aio_fsync $fh;
+            close $fh;
+
+            if (@$objs) {
+               if (my $fh = aio_open "$filename.pst~", O_WRONLY | O_CREAT, 0600) {
+                  chmod SAVE_MODE, $fh;
+                  my $data = Storable::nfreeze { version => 1, objs => $objs };
+                  aio_write $fh, 0, (length $data), $data, 0;
+                  aio_fsync $fh;
+                  close $fh;
+                  aio_rename "$filename.pst~", "$filename.pst";
+               }
+            } else {
+               aio_unlink "$filename.pst";
+            }
+
+            aio_rename "$filename~", $filename;
+         } else {
+            warn "FATAL: $filename~: $!\n";
+         }
+      } else {
+         aio_unlink $filename;
+         aio_unlink "$filename.pst";
+      }
+   }
 }
 
+sub object_freezer_as_string {
+   my ($rdata, $objs) = @_;
+
+   use Data::Dumper;
+
+   $$rdata . Dumper $objs
+}
+
+sub object_thawer_load {
+   my ($filename) = @_;
+
+   my ($data, $av);
+
+   (aio_load $filename, $data) >= 0
+      or return;
+
+   unless (aio_stat "$filename.pst") {
+      (aio_load "$filename.pst", $av) >= 0
+         or return;
+      $av = eval { (Storable::thaw $av)->{objs} };
+   }
+
+   warn sprintf "loading %s (%d)\n",
+      $filename, length $data, scalar @{$av || []};#d#
+   return ($data, $av);
+}
+
+#############################################################################
+# command handling &c
+
+=item cf::register_command $name => \&callback($ob,$args);
+
+Register a callback for execution when the client sends the user command
+$name.
+
+=cut
+
 sub register_command {
-   my ($name, $time, $cb) = @_;
+   my ($name, $cb) = @_;
 
    my $caller = caller;
    #warn "registering command '$name/$time' to '$caller'";
 
-   push @{ $command{$name} }, [$time, $cb, $caller];
-   $COMMAND{"$name\000"} = List::Util::max map $_->[0], @{ $command{$name} };
+   push @{ $COMMAND{$name} }, [$caller, $cb];
 }
 
+=item cf::register_extcmd $name => \&callback($pl,$packet);
+
+Register a callbackf ro execution when the client sends an extcmd packet.
+
+If the callback returns something, it is sent back as if reply was being
+called.
+
+=cut
+
 sub register_extcmd {
    my ($name, $cb) = @_;
 
    my $caller = caller;
    #warn "registering extcmd '$name' to '$caller'";
 
-   $extcmd{$name} = [$cb, $caller];
+   $EXTCMD{$name} = [$cb, $caller];
 }
 
+cf::player->attach (
+   on_command => sub {
+      my ($pl, $name, $params) = @_;
+
+      my $cb = $COMMAND{$name}
+         or return;
+
+      for my $cmd (@$cb) {
+         $cmd->[1]->($pl->ob, $params);
+      }
+
+      cf::override;
+   },
+   on_extcmd => sub {
+      my ($pl, $buf) = @_;
+
+      my $msg = eval { from_json $buf };
+
+      if (ref $msg) {
+         if (my $cb = $EXTCMD{$msg->{msgtype}}) {
+            if (my %reply = $cb->[0]->($pl, $msg)) {
+               $pl->ext_reply ($msg->{msgid}, %reply);
+            }
+         }
+      } else {
+         warn "player " . ($pl->ob->name) . " sent unparseable ext message: <$buf>\n";
+      }
+
+      cf::override;
+   },
+);
+
 sub register {
    my ($base, $pkg) = @_;
 
-   for my $idx (0 .. $#EVENT) {
-      if (my $ref = $pkg->can ("on_$EVENT[$idx]")) {
-         #warn "registering $EVENT[$idx] hook to '$pkg'\n";
-         $hook[$idx]{$base} = $ref;
-      }
-   }
+   #TODO
 }
 
 sub load_extension {
@@ -142,7 +965,7 @@
    my $base = $1;
    my $pkg = $1;
    $pkg =~ s/[^[:word:]]/_/g;
-   $pkg = "cf::ext::$pkg";
+   $pkg = "ext::$pkg";
 
    warn "loading '$path' into '$pkg'\n";
 
@@ -156,13 +979,14 @@
       . "\n};\n1";
 
    eval $source
-      or die "$path: $@";
+      or die $@ ? "$path: $@\n"
+                : "extension disabled.\n";
 
    push @exts, $pkg;
    $ext_pkg{$base} = $pkg;
 
 #   no strict 'refs';
-#   @{"$pkg\::ISA"} = cf::ext::;
+#   @{"$pkg\::ISA"} = ext::;
 
    register $base, $pkg;
 }
@@ -173,34 +997,38 @@
    warn "removing extension $pkg\n";
 
    # remove hooks
-   for my $idx (0 .. $#EVENT) {
-      delete $hook[$idx]{$pkg};
-   }
+   #TODO
+#   for my $idx (0 .. $#PLUGIN_EVENT) {
+#      delete $hook[$idx]{$pkg};
+#   }
 
    # remove commands
-   for my $name (keys %command) {
-      my @cb = grep $_->[2] ne $pkg, @{ $command{$name} };
+   for my $name (keys %COMMAND) {
+      my @cb = grep $_->[0] ne $pkg, @{ $COMMAND{$name} };
 
       if (@cb) {
-         $command{$name} = \@cb;
-         $COMMAND{"$name\000"} = List::Util::max map $_->[0], @cb;
+         $COMMAND{$name} = \@cb;
       } else {
-         delete $command{$name};
-         delete $COMMAND{"$name\000"};
+         delete $COMMAND{$name};
       }
    }
 
    # remove extcmds
-   for my $name (grep $extcmd{$_}[1] eq $pkg, keys %extcmd) {
-      delete $extcmd{$name};
+   for my $name (grep $EXTCMD{$_}[1] eq $pkg, keys %EXTCMD) {
+      delete $EXTCMD{$name};
+   }
+
+   if (my $cb = $pkg->can ("unload")) {
+      eval {
+         $cb->($pkg);
+         1
+      } or warn "$pkg unloaded, but with errors: $@";
    }
 
    Symbol::delete_package $pkg;
 }
 
 sub load_extensions {
-   my $LIBDIR = maps_directory "perl";
-
    for my $ext (<$LIBDIR/*.ext>) {
       next unless -r $ext;
       eval {
@@ -210,144 +1038,1177 @@
    }
 }
 
-register_command "perl-reload", 0, sub {
-   my ($who, $arg) = @_;
+#############################################################################
+# load/save/clean perl data associated with a map
 
-   if ($who->flag (FLAG_WIZ)) {
-      $who->message ("reloading...");
+*cf::mapsupport::on_clean = sub {
+   my ($map) = @_;
 
-      warn "reloading...\n";
-      eval {
-         unload_extension $_ for @exts;
-         delete $INC{"cf.pm"};
+   my $path = $map->tmpname;
+   defined $path or return;
 
-         # don't, removes xs symbols, too
-         #Symbol::delete_package $pkg;
+   unlink "$path.pst";
+};
 
-         require cf;
-      };
-      warn $@ if $@;
-      $who->message ($@) if $@;
-      warn "reloaded\n";
+cf::map->attach (prio => -10000, package => cf::mapsupport::);
 
-      $who->message ("reloaded");
-   } else {
-      $who->message ("Intruder Alert!");
-   }
-};
+#############################################################################
+# load/save perl data associated with player->ob objects
+
+sub all_objects(@) {
+   @_, map all_objects ($_->inv), @_
+}
+
+# TODO: compatibility cruft, remove when no longer needed
+cf::player->attach (
+   on_load => sub {
+      my ($pl, $path) = @_;
+
+      for my $o (all_objects $pl->ob) {
+         if (my $value = $o->get_ob_key_value ("_perl_data")) {
+            $o->set_ob_key_value ("_perl_data");
+
+            %$o = %{ Storable::thaw pack "H*", $value };
+         }
+      }
+   },
+);
 
 #############################################################################
-# extcmd framework, basically convert ext <id> <pkg> arg1 args
-# into pkg::->on_extcmd_arg1 (...) while shortcutting a few
 
-sub on_extcmd {
-   my ($pl, $buf) = @_;
+=head2 CORE EXTENSIONS
+
+Functions and methods that extend core crossfire objects.
+
+=head3 cf::player
+
+=over 4
+
+=item cf::player::exists $login
+
+Returns true when the given account exists.
 
-   my ($type) = $buf =~ s/^(\S+) // ? $1 : "";
+=cut
 
-   $extcmd{$type}[0]->($pl, $buf)
-      if $extcmd{$type};
+sub cf::player::exists($) {
+   cf::player::find $_[0]
+      or -f sprintf "%s/%s/%s/%s.pl", cf::localdir, cf::playerdir, ($_[0]) x 2;
 }
 
-#############################################################################
-# load/save/clean perl data associated with a map
+=item $player->ext_reply ($msgid, $msgtype, %msg)
 
-*on_mapclean = sub {
-   my ($map) = @_;
+Sends an ext reply to the player.
 
-   my $path = $map->tmpname;
-   defined $path or return;
+=cut
 
-   unlink "$path.cfperl";
-};
+sub cf::player::ext_reply($$$%) {
+   my ($self, $id, %msg) = @_;
 
-*on_mapin =
-*on_mapload = sub {
-   my ($map) = @_;
+   $msg{msgid} = $id;
 
-   my $path = $map->tmpname;
-   $path = $map->path unless defined $path;
+   $self->send ("ext " . to_json \%msg);
+}
 
-   open my $fh, "<:raw", "$path.cfperl"
-      or return; # no perl data
+=back
 
-   my $data = Storable::thaw do { local $/; <$fh> };
 
-   $data->{version} <= 1
-      or return; # too new
+=head3 cf::map
 
-   $map->_set_obs ($data->{obs});
-};
+=over 4
+
+=cut
+
+package cf::map;
+
+use Fcntl;
+use Coro::AIO;
+
+our $MAX_RESET     = 3600;
+our $DEFAULT_RESET = 3000;
+
+sub generate_random_map {
+   my ($path, $rmp) = @_;
+
+   # mit "rum" bekleckern, nicht
+   cf::map::_create_random_map
+      $path,
+      $rmp->{wallstyle}, $rmp->{wall_name}, $rmp->{floorstyle}, $rmp->{monsterstyle},
+      $rmp->{treasurestyle}, $rmp->{layoutstyle}, $rmp->{doorstyle}, $rmp->{decorstyle},
+      $rmp->{origin_map}, $rmp->{final_map}, $rmp->{exitstyle}, $rmp->{this_map},
+      $rmp->{exit_on_final_map},
+      $rmp->{xsize}, $rmp->{ysize},
+      $rmp->{expand2x}, $rmp->{layoutoptions1}, $rmp->{layoutoptions2}, $rmp->{layoutoptions3},
+      $rmp->{symmetry}, $rmp->{difficulty}, $rmp->{difficulty_given}, $rmp->{difficulty_increase},
+      $rmp->{dungeon_level}, $rmp->{dungeon_depth}, $rmp->{decoroptions}, $rmp->{orientation},
+      $rmp->{origin_y}, $rmp->{origin_x}, $rmp->{random_seed}, $rmp->{total_map_hp},
+      $rmp->{map_layout_style}, $rmp->{treasureoptions}, $rmp->{symmetry_used},
+      (cf::region::find $rmp->{region})
+}
+
+# and all this just because we cannot iterate over
+# all maps in C++...
+sub change_all_map_light {
+   my ($change) = @_;
+
+   $_->change_map_light ($change)
+      for grep $_->outdoor, values %cf::MAP;
+}
 
-*on_mapout = sub {
+sub try_load_header($) {
+   my ($path) = @_;
+
+   utf8::encode $path;
+   aio_open $path, O_RDONLY, 0
+      or return;
+
+   my $map = cf::map::new
+      or return;
+
+   # for better error messages only, will be overwritten
+   $map->path ($path);
+
+   $map->load_header ($path)
+     or return;
+
+   $map->{load_path} = $path;
+
+   $map
+}
+
+sub find;
+sub find {
+   my ($path, $origin) = @_;
+
+   #warn "find<$path,$origin>\n";#d#
+
+   $path = new cf::path $path, $origin && $origin->path;
+   my $key = $path->as_string;
+
+   cf::lock_wait "map_find:$key";
+
+   $cf::MAP{$key} || do {
+      my $guard = cf::lock_acquire "map_find:$key";
+
+      # do it the slow way
+      my $map = try_load_header $path->save_path;
+
+      Coro::cede;
+
+      if ($map) {
+         $map->last_access ((delete $map->{last_access})
+                            || $cf::RUNTIME); #d#
+         # safety
+         $map->{instantiate_time} = $cf::RUNTIME
+            if $map->{instantiate_time} > $cf::RUNTIME;
+      } else {
+         if (my $rmp = $path->random_map_params) {
+            $map = generate_random_map $key, $rmp;
+         } else {
+            $map = try_load_header $path->load_path;
+         }
+
+         $map or return;
+
+         $map->{load_original} = 1;
+         $map->{instantiate_time} = $cf::RUNTIME;
+         $map->last_access ($cf::RUNTIME);
+         $map->instantiate;
+
+         # per-player maps become, after loading, normal maps
+         $map->per_player (0) if $path->{user_rel};
+      }
+
+      $map->path ($key);
+      $map->{path} = $path;
+      $map->{last_save} = $cf::RUNTIME;
+
+      Coro::cede;
+
+      if ($map->should_reset) {
+         $map->reset;
+         undef $guard;
+         $map = find $path
+            or return;
+      }
+
+      $cf::MAP{$key} = $map
+   }
+}
+
+sub load {
+   my ($self) = @_;
+
+   my $path = $self->{path};
+   my $guard = cf::lock_acquire "map_load:" . $path->as_string;
+
+   return if $self->in_memory != cf::MAP_SWAPPED;
+
+   $self->in_memory (cf::MAP_LOADING);
+
+   $self->alloc;
+   $self->load_objects ($self->{load_path}, 1)
+      or return;
+
+   $self->set_object_flag (cf::FLAG_OBJ_ORIGINAL, 1)
+      if delete $self->{load_original};
+
+   if (my $uniq = $path->uniq_path) {
+      utf8::encode $uniq;
+      if (aio_open $uniq, O_RDONLY, 0) {
+         $self->clear_unique_items;
+         $self->load_objects ($uniq, 0);
+      }
+   }
+
+   Coro::cede;
+
+   # now do the right thing for maps
+   $self->link_multipart_objects;
+
+   if ($self->{path}->is_style_map) {
+      $self->{deny_save}  = 1;
+      $self->{deny_reset} = 1;
+   } else {
+      $self->fix_auto_apply;
+      $self->decay_objects;
+      $self->update_buttons;
+      $self->set_darkness_map;
+      $self->difficulty ($self->estimate_difficulty)
+         unless $self->difficulty;
+      $self->activate;
+   }
+
+   Coro::cede;
+
+   $self->in_memory (cf::MAP_IN_MEMORY);
+}
+
+sub find_sync {
+   my ($path, $origin) = @_;
+
+   cf::sync_job { cf::map::find $path, $origin }
+}
+
+sub do_load_sync {
    my ($map) = @_;
 
-   my $path = $map->tmpname;
-   $path = $map->path unless defined $path;
+   cf::sync_job { $map->load };
+}
 
-   my $obs = $map->_get_obs;
+sub save {
+   my ($self) = @_;
 
-   if (defined $obs) {
-      open my $fh, ">:raw", "$path.cfperl"
-         or die "$path.cfperl: $!";
+   $self->{last_save} = $cf::RUNTIME;
 
-      stat $path;
+   return unless $self->dirty;
 
-      print $fh Storable::nfreeze {
-         size    => (stat _)[7],
-         time    => (stat _)[9],
-         version => 1,
-         obs     => $obs,
-      };
+   my $save = $self->{path}->save_path; utf8::encode $save;
+   my $uniq = $self->{path}->uniq_path; utf8::encode $uniq;
+
+   $self->{load_path} = $save;
+
+   return if $self->{deny_save};
 
-      chmod SAVE_MODE, "$path.cfperl"; # very racy, but cf-compatible *g*
+   local $self->{last_access} = $self->last_access;#d#
+
+   if ($uniq) {
+      $self->save_objects ($save, cf::IO_HEADER | cf::IO_OBJECTS);
+      $self->save_objects ($uniq, cf::IO_UNIQUES);
    } else {
-      unlink "$path.cfperl";
+      $self->save_objects ($save, cf::IO_HEADER | cf::IO_OBJECTS | cf::IO_UNIQUES);
    }
-};
+}
+
+sub swap_out {
+   my ($self) = @_;
+
+   # save first because save cedes
+   $self->save;
+
+   return if $self->players;
+   return if $self->in_memory != cf::MAP_IN_MEMORY;
+   return if $self->{deny_save};
+
+   $self->clear;
+   $self->in_memory (cf::MAP_SWAPPED);
+}
+
+sub reset_at {
+   my ($self) = @_;
+
+   # TODO: safety, remove and allow resettable per-player maps
+   return 1e99 if $self->{path}{user_rel};
+   return 1e99 if $self->{deny_reset};
+
+   my $time = $self->fixed_resettime ? $self->{instantiate_time} : $self->last_access;
+   my $to = List::Util::min $MAX_RESET, $self->reset_timeout || $DEFAULT_RESET;
+
+   $time + $to
+}
+
+sub should_reset {
+   my ($self) = @_;
+
+   $self->reset_at <= $cf::RUNTIME
+}
+
+sub unlink_save {
+   my ($self) = @_;
+
+   utf8::encode (my $save = $self->{path}->save_path);
+   aioreq_pri 3; IO::AIO::aio_unlink $save;
+   aioreq_pri 3; IO::AIO::aio_unlink "$save.pst";
+}
+
+sub rename {
+   my ($self, $new_path) = @_;
+
+   $self->unlink_save;
+
+   delete $cf::MAP{$self->path};
+   $self->{path} = new cf::path $new_path;
+   $self->path ($self->{path}->as_string);
+   $cf::MAP{$self->path} = $self;
+
+   $self->save;
+}
+
+sub reset {
+   my ($self) = @_;
+
+   return if $self->players;
+   return if $self->{path}{user_rel};#d#
+
+   warn "resetting map ", $self->path;#d#
+
+   delete $cf::MAP{$self->path};
+
+   $_->clear_links_to ($self) for values %cf::MAP;
+
+   $self->unlink_save;
+   $self->destroy;
+}
+
+my $nuke_counter = "aaaa";
+
+sub nuke {
+   my ($self) = @_;
+
+   $self->{deny_save} = 1;
+   $self->reset_timeout (1);
+   $self->rename ("{nuke}/" . ($nuke_counter++));
+   $self->reset; # polite request, might not happen
+}
+
+sub customise_for {
+   my ($map, $ob) = @_;
+
+   if ($map->per_player) {
+      return cf::map::find "~" . $ob->name . "/" . $map->{path}{path};
+   }
+
+   $map
+}
+
+sub emergency_save {
+   my $freeze_guard = cf::freeze_mainloop;
+
+   warn "enter emergency map save\n";
+
+   cf::sync_job {
+      warn "begin emergency map save\n";
+      $_->save for values %cf::MAP;
+   };
+
+   warn "end emergency map save\n";
+}
+
+package cf;
+
+=back
+
+
+=head3 cf::object::player
+
+=over 4
+
+=item $player_object->reply ($npc, $msg[, $flags])
+
+Sends a message to the player, as if the npc C<$npc> replied. C<$npc>
+can be C<undef>. Does the right thing when the player is currently in a
+dialogue with the given NPC character.
+
+=cut
+
+# rough implementation of a future "reply" method that works
+# with dialog boxes.
+#TODO: the first argument must go, split into a $npc->reply_to ( method
+sub cf::object::player::reply($$$;$) {
+   my ($self, $npc, $msg, $flags) = @_;
+
+   $flags = cf::NDI_BROWN | cf::NDI_UNIQUE unless @_ >= 4;
+
+   if ($self->{record_replies}) {
+      push @{ $self->{record_replies} }, [$npc, $msg, $flags];
+   } else {
+      $msg = $npc->name . " says: $msg" if $npc;
+      $self->message ($msg, $flags);
+   }
+}
+
+=item $player_object->may ("access")
+
+Returns wether the given player is authorized to access resource "access"
+(e.g. "command_wizcast").
+
+=cut
+
+sub cf::object::player::may {
+   my ($self, $access) = @_;
+
+   $self->flag (cf::FLAG_WIZ) || 
+      (ref $cf::CFG{"may_$access"}
+         ? scalar grep $self->name eq $_, @{$cf::CFG{"may_$access"}}
+         : $cf::CFG{"may_$access"})
+}
+
+=item $player_object->enter_link
+
+Freezes the player and moves him/her to a special map (C<{link}>).
+
+The player should be reaosnably safe there for short amounts of time. You
+I<MUST> call C<leave_link> as soon as possible, though.
+
+=item $player_object->leave_link ($map, $x, $y)
+
+Moves the player out of the specila link map onto the given map. If the
+map is not valid (or omitted), the player will be moved back to the
+location he/she was before the call to C<enter_link>, or, if that fails,
+to the emergency map position.
+
+Might block.
+
+=cut
+
+sub cf::object::player::enter_link {
+   my ($self) = @_;
+
+   $self->deactivate_recursive;
+
+   return if $self->map == $LINK_MAP;
+
+   $self->{_link_pos} ||= [$self->map->{path}, $self->x, $self->y]
+      if $self->map;
+
+   $self->enter_map ($LINK_MAP, 20, 20);
+}
+
+sub cf::object::player::leave_link {
+   my ($self, $map, $x, $y) = @_;
+
+   my $link_pos = delete $self->{_link_pos};
+
+   unless ($map) {
+      # restore original map position
+      ($map, $x, $y) = @{ $link_pos || [] };
+      $map = cf::map::find $map;
+
+      unless ($map) {
+         ($map, $x, $y) = @$EMERGENCY_POSITION;
+         $map = cf::map::find $map
+            or die "FATAL: cannot load emergency map\n";
+      }
+   }
+
+   ($x, $y) = (-1, -1)
+      unless (defined $x) && (defined $y);
+
+   # use -1 or undef as default coordinates, not 0, 0
+   ($x, $y) = ($map->enter_x, $map->enter_y)
+      if $x <=0 && $y <= 0;
+
+   $map->load;
+
+   $self->activate_recursive;
+   $self->enter_map ($map, $x, $y);
+}
+
+cf::player->attach (
+   on_logout => sub {
+      my ($pl) = @_;
+
+      # abort map switching before logout
+      if ($pl->ob->{_link_pos}) {
+         cf::sync_job {
+            $pl->ob->leave_link
+         };
+      }
+   },
+   on_login => sub {
+      my ($pl) = @_;
+
+      # try to abort aborted map switching on player login :)
+      # should happen only on crashes
+      if ($pl->ob->{_link_pos}) {
+         $pl->ob->enter_link;
+         cf::async {
+            # we need this sleep as the login has a concurrent enter_exit running
+            # and this sleep increases chances of the player not ending up in scorn
+            Coro::Timer::sleep 1;
+            $pl->ob->leave_link;
+         };
+      }
+   },
+);
+
+=item $player_object->goto_map ($path, $x, $y)
+
+=cut
+
+sub cf::object::player::goto_map {
+   my ($self, $path, $x, $y) = @_;
+
+   $self->enter_link;
+
+   (cf::async {
+      $path = new cf::path $path;
+
+      my $map = cf::map::find $path->as_string;
+      $map = $map->customise_for ($self) if $map;
+
+#      warn "entering ", $map->path, " at ($x, $y)\n"
+#         if $map;
+
+      $map or $self->message ("The exit is closed", cf::NDI_UNIQUE | cf::NDI_RED);
+
+      $self->leave_link ($map, $x, $y);
+   })->prio (1);
+}
+
+=item $player_object->enter_exit ($exit_object)
+
+=cut
+
+sub parse_random_map_params {
+   my ($spec) = @_;
+
+   my $rmp = { # defaults
+      xsize => 10,
+      ysize => 10,
+   };
+
+   for (split /\n/, $spec) {
+      my ($k, $v) = split /\s+/, $_, 2;
+
+      $rmp->{lc $k} = $v if (length $k) && (length $v);
+   }
+
+   $rmp
+}
+
+sub prepare_random_map {
+   my ($exit) = @_;
+
+   # all this does is basically replace the /! path by
+   # a new random map path (?random/...) with a seed
+   # that depends on the exit object
+
+   my $rmp = parse_random_map_params $exit->msg;
+
+   if ($exit->map) {
+      $rmp->{region}     = $exit->map->region_name;
+      $rmp->{origin_map} = $exit->map->path;
+      $rmp->{origin_x}   = $exit->x;
+      $rmp->{origin_y}   = $exit->y;
+   }
+
+   $rmp->{random_seed} ||= $exit->random_seed;
+
+   my $data = cf::to_json $rmp;
+   my $md5 = Digest::MD5::md5_hex $data;
+
+   if (my $fh = aio_open "$cf::RANDOM_MAPS/$md5.meta", O_WRONLY | O_CREAT, 0666) {
+      aio_write $fh, 0, (length $data), $data, 0;
+
+      $exit->slaying ("?random/$md5");
+      $exit->msg (undef);
+   }
+}
+
+sub cf::object::player::enter_exit {
+   my ($self, $exit) = @_;
+
+   return unless $self->type == cf::PLAYER;
+
+   $self->enter_link;
+
+   (cf::async {
+      $self->deactivate_recursive; # just to be sure
+      unless (eval {
+         prepare_random_map $exit
+            if $exit->slaying eq "/!";
+
+         my $path = new cf::path $exit->slaying, $exit->map && $exit->map->path;
+         $self->goto_map ($path, $exit->stats->hp, $exit->stats->sp);
+
+         1;
+      }) {
+         $self->message ("Something went wrong deep within the crossfire server. "
+                     . "I'll try to bring you back to the map you were before. "
+                     . "Please report this to the dungeon master",
+                       cf::NDI_UNIQUE | cf::NDI_RED);
+
+         warn "ERROR in enter_exit: $@";
+         $self->leave_link;
+      }
+   })->prio (1);
+}
+
+=head3 cf::client
+
+=over 4
+
+=item $client->send_drawinfo ($text, $flags)
+
+Sends a drawinfo packet to the client. Circumvents output buffering so
+should not be used under normal circumstances.
+
+=cut
+
+sub cf::client::send_drawinfo {
+   my ($self, $text, $flags) = @_;
+
+   utf8::encode $text;
+   $self->send_packet (sprintf "drawinfo %d %s", $flags, $text);
+}
+
+
+=item $success = $client->query ($flags, "text", \&cb)
+
+Queues a query to the client, calling the given callback with
+the reply text on a reply. flags can be C<cf::CS_QUERY_YESNO>,
+C<cf::CS_QUERY_SINGLECHAR> or C<cf::CS_QUERY_HIDEINPUT> or C<0>.
+
+Queries can fail, so check the return code. Or don't, as queries will become
+reliable at some point in the future.
+
+=cut
+
+sub cf::client::query {
+   my ($self, $flags, $text, $cb) = @_;
+
+   return unless $self->state == ST_PLAYING
+              || $self->state == ST_SETUP
+              || $self->state == ST_CUSTOM;
+
+   $self->state (ST_CUSTOM);
+
+   utf8::encode $text;
+   push @{ $self->{query_queue} }, [(sprintf "query %d %s", $flags, $text), $cb];
+
+   $self->send_packet ($self->{query_queue}[0][0])
+      if @{ $self->{query_queue} } == 1;
+}
+
+cf::client->attach (
+   on_reply => sub {
+      my ($ns, $msg) = @_;
+
+      # this weird shuffling is so that direct followup queries
+      # get handled first
+      my $queue = delete $ns->{query_queue}
+         or return; # be conservative, not sure how that can happen, but we saw a crash here
+
+      (shift @$queue)->[1]->($msg);
+
+      push @{ $ns->{query_queue} }, @$queue;
+
+      if (@{ $ns->{query_queue} } == @$queue) {
+         if (@$queue) {
+            $ns->send_packet ($ns->{query_queue}[0][0]);
+         } else {
+            $ns->state (ST_PLAYING) if $ns->state == ST_CUSTOM;
+         }
+      }
+   },
+);
+
+=item $client->coro (\&cb)
+
+Create a new coroutine, running the specified callback. The coroutine will
+be automatically cancelled when the client gets destroyed (e.g. on logout,
+or loss of connection).
+
+=cut
+
+sub cf::client::coro {
+   my ($self, $cb) = @_;
+
+   my $coro = &cf::async ($cb);
+
+   $coro->on_destroy (sub {
+      delete $self->{_coro}{$coro+0};
+   });
+
+   $self->{_coro}{$coro+0} = $coro;
+
+   $coro
+}
+
+cf::client->attach (
+   on_destroy => sub {
+      my ($ns) = @_;
+
+      $_->cancel for values %{ (delete $ns->{_coro}) || {} };
+   },
+);
+
+=back
+
+
+=head2 SAFE SCRIPTING
+
+Functions that provide a safe environment to compile and execute
+snippets of perl code without them endangering the safety of the server
+itself. Looping constructs, I/O operators and other built-in functionality
+is not available in the safe scripting environment, and the number of
+functions and methods that can be called is greatly reduced.
+
+=cut
+
+our $safe = new Safe "safe";
+our $safe_hole = new Safe::Hole;
+
+$SIG{FPE} = 'IGNORE';
+
+$safe->permit_only (Opcode::opset qw(:base_core :base_mem :base_orig :base_math sort time));
+
+# here we export the classes and methods available to script code
+
+=pod
+
+The following fucntions and emthods are available within a safe environment:
+
+  cf::object contr pay_amount pay_player map
+  cf::object::player player
+  cf::player peaceful
+  cf::map trigger
+
+=cut
+
+for (
+   ["cf::object"         => qw(contr pay_amount pay_player map)],
+   ["cf::object::player" => qw(player)],
+   ["cf::player"         => qw(peaceful)],
+   ["cf::map"            => qw(trigger)],
+) {
+   no strict 'refs';
+   my ($pkg, @funs) = @$_;
+   *{"safe::$pkg\::$_"} = $safe_hole->wrap (\&{"$pkg\::$_"})
+      for @funs;
+}
+
+=over 4
+
+=item @retval = safe_eval $code, [var => value, ...]
+
+Compiled and executes the given perl code snippet. additional var/value
+pairs result in temporary local (my) scalar variables of the given name
+that are available in the code snippet. Example:
+
+   my $five = safe_eval '$first + $second', first => 1, second => 4;
+
+=cut
+
+sub safe_eval($;@) {
+   my ($code, %vars) = @_;
+
+   my $qcode = $code;
+   $qcode =~ s/"/‟/g; # not allowed in #line filenames
+   $qcode =~ s/\n/\\n/g;
+
+   local $_;
+   local @safe::cf::_safe_eval_args = values %vars;
+
+   my $eval =
+      "do {\n"
+      . "my (" . (join ",", map "\$$_", keys %vars) . ") = \@cf::_safe_eval_args;\n"
+      . "#line 0 \"{$qcode}\"\n"
+      . $code
+      . "\n}"
+   ;
+
+   sub_generation_inc;
+   my @res = wantarray ? $safe->reval ($eval) : scalar $safe->reval ($eval);
+   sub_generation_inc;
+
+   if ($@) {
+      warn "$@";
+      warn "while executing safe code '$code'\n";
+      warn "with arguments " . (join " ", %vars) . "\n";
+   }
+
+   wantarray ? @res : $res[0]
+}
+
+=item cf::register_script_function $function => $cb
+
+Register a function that can be called from within map/npc scripts. The
+function should be reasonably secure and should be put into a package name
+like the extension.
+
+Example: register a function that gets called whenever a map script calls
+C<rent::overview>, as used by the C<rent> extension.
+
+   cf::register_script_function "rent::overview" => sub {
+     ...
+   };
+
+=cut
+
+sub register_script_function {
+   my ($fun, $cb) = @_;
+
+   no strict 'refs';
+   *{"safe::$fun"} = $safe_hole->wrap ($cb);
+}
+
+=back
+
+=cut
 
 #############################################################################
-# load/save perl data associated with player->ob objects
 
-*on_player_load = sub {
-   my ($ob, $path) = @_;
+=head2 EXTENSION DATABASE SUPPORT
+
+Crossfire maintains a very simple database for extension use. It can
+currently store anything that can be serialised using Storable, which
+excludes objects.
+
+The parameter C<$family> should best start with the name of the extension
+using it, it should be unique.
+
+=over 4
+
+=item $hashref = cf::db_get $family
+
+Return a hashref for use by the extension C<$family>, which can be
+modified. After modifications, you have to call C<cf::db_dirty> or
+C<cf::db_sync>.
+
+=item $value = cf::db_get $family => $key
+
+Returns a single value from the database
+
+=item cf::db_put $family => $hashref
+
+Stores the given family hashref into the database. Updates are delayed, if
+you want the data to be synced to disk immediately, use C<cf::db_sync>.
+
+=item cf::db_put $family => $key => $value
+
+Stores the given C<$value> in the family hash. Updates are delayed, if you
+want the data to be synced to disk immediately, use C<cf::db_sync>.
+
+=item cf::db_dirty
+
+Marks the database as dirty, to be updated at a later time.
+
+=item cf::db_sync
+
+Immediately write the database to disk I<if it is dirty>.
+
+=cut
 
-   if (open my $fh, "<:raw", "$path.cfperl") {
+our $DB;
 
-      #d##TODO#remove
+{
+   my $path = cf::localdir . "/database.pst";
 
-      my $data = Storable::thaw do { local $/; <$fh> };
+   sub db_load() {
+      $DB = stat $path ? Storable::retrieve $path : { };
+   }
+
+   my $pid;
+
+   sub db_save() {
+      waitpid $pid, 0 if $pid;
+      if (0 == ($pid = fork)) {
+         $DB->{_meta}{version} = 1;
+         Storable::nstore $DB, "$path~";
+         rename "$path~", $path;
+         cf::_exit 0 if defined $pid;
+      }
+   }
+
+   my $dirty;
 
-      $data->{version} <= 1
-         or return; # too new
+   sub db_sync() {
+      db_save if $dirty;
+      undef $dirty;
+   }
+
+   my $idle = Event->idle (min => $TICK * 2.8, max => 10, repeat => 0, data => WF_AUTOCANCEL, cb => sub {
+      db_sync;
+   });
+
+   sub db_dirty() {
+      $dirty = 1;
+      $idle->start;
+   }
+
+   sub db_get($;$) {
+      @_ >= 2
+         ? $DB->{$_[0]}{$_[1]}
+         : ($DB->{$_[0]} ||= { })
+   }
+
+   sub db_put($$;$) {
+      if (@_ >= 3) {
+         $DB->{$_[0]}{$_[1]} = $_[2];
+      } else {
+         $DB->{$_[0]} = $_[1];
+      }
+      db_dirty;
+   }
+
+   cf::global->attach (
+      prio       => 10000,
+      on_cleanup => sub {
+         db_sync;
+      },
+   );
+}
+
+#############################################################################
+# the server's main()
+
+sub cfg_load {
+   open my $fh, "<:utf8", cf::confdir . "/config"
+      or return;
 
-      %$ob = %{$data->{ob}};
+   local $/;
+   *CFG = YAML::Syck::Load <$fh>;
+
+   $EMERGENCY_POSITION = $CFG{emergency_position} || ["/world/world_105_115", 5, 37];
+
+   if (exists $CFG{mlockall}) {
+      eval {
+         $CFG{mlockall} ? &mlockall : &munlockall
+            and die "WARNING: m(un)lockall failed: $!\n";
+      };
+      warn $@ if $@;
+   }
+}
+
+sub main {
+   # we must not ever block the main coroutine
+   local $Coro::idle = sub {
+      Carp::cluck "FATAL: Coro::idle was called, major BUG, use cf::sync_job!\n";#d#
+      (Coro::unblock_sub {
+         Event::one_event;
+      })->();
+   };
+
+   cfg_load;
+   db_load;
+   load_extensions;
+   Event::loop;
+}
+
+#############################################################################
+# initialisation
+
+sub reload() {
+   # can/must only be called in main
+   if ($Coro::current != $Coro::main) {
+      warn "can only reload from main coroutine\n";
       return;
    }
 
-   for my $o ($ob, $ob->inv) {
-      if (my $value = $o->get_ob_key_value ("_perl_data")) {
-         $o->set_ob_key_value ("_perl_data");
+   warn "reloading...";
+
+   my $guard = freeze_mainloop;
+   cf::emergency_save;
+
+   eval {
+      # if anything goes wrong in here, we should simply crash as we already saved
 
-         %$o = %{ Storable::thaw pack "H*", $value };
+      # cancel all watchers
+      for (Event::all_watchers) {
+         $_->cancel if $_->data & WF_AUTOCANCEL;
       }
+
+      # cancel all extension coros
+      $_->cancel for values %EXT_CORO;
+      %EXT_CORO = ();
+
+      # unload all extensions
+      for (@exts) {
+         warn "unloading <$_>";
+         unload_extension $_;
+      }
+
+      # unload all modules loaded from $LIBDIR
+      while (my ($k, $v) = each %INC) {
+         next unless $v =~ /^\Q$LIBDIR\E\/.*\.pm$/;
+
+         warn "removing <$k>";
+         delete $INC{$k};
+
+         $k =~ s/\.pm$//;
+         $k =~ s/\//::/g;
+
+         if (my $cb = $k->can ("unload_module")) {
+            $cb->();
+         }
+
+         Symbol::delete_package $k;
+      }
+
+      # sync database to disk
+      cf::db_sync;
+      IO::AIO::flush;
+
+      # get rid of safe::, as good as possible
+      Symbol::delete_package "safe::$_"
+         for qw(cf::attachable cf::object cf::object::player cf::client cf::player cf::map cf::party cf::region);
+
+      # remove register_script_function callbacks
+      # TODO
+      
+      # unload cf.pm "a bit"
+      delete $INC{"cf.pm"};
+
+      # don't, removes xs symbols, too,
+      # and global variables created in xs
+      #Symbol::delete_package __PACKAGE__;
+
+      # reload cf.pm
+      warn "reloading cf.pm";
+      require cf;
+      cf::_connect_to_perl; # nominally unnecessary, but cannot hurt
+
+      # load config and database again
+      cf::cfg_load;
+      cf::db_load;
+
+      # load extensions
+      warn "load extensions";
+      cf::load_extensions;
+
+      # reattach attachments to objects
+      warn "reattach";
+      _global_reattach;
+   };
+
+   if ($@) {
+      warn $@;
+      warn "error while reloading, exiting.";
+      exit 1;
    }
+
+   warn "reloaded successfully";
 };
 
-*on_player_save = sub {
-   my ($ob, $path) = @_;
+#############################################################################
 
-   $_->set_ob_key_value (_perl_data => unpack "H*", Storable::nfreeze $_)
-      for grep %$_, $ob, $ob->inv;
+unless ($LINK_MAP) {
+   $LINK_MAP = cf::map::new;
 
-   unlink "$path.cfperl";#d##TODO#remove
-};
+   $LINK_MAP->width  (41);
+   $LINK_MAP->height (41);
+   $LINK_MAP->alloc;
+   $LINK_MAP->path ("{link}");
+   $LINK_MAP->{path} = bless { path => "{link}" }, "cf::path";
+   $LINK_MAP->in_memory (MAP_IN_MEMORY);
+
+   # dirty hack because... archetypes are not yet loaded
+   Event->timer (
+      after => 2,
+      cb    => sub {
+         $_[0]->w->cancel;
+
+         # provide some exits "home"
+         my $exit = cf::object::new "exit";
+
+         $exit->slaying   ($EMERGENCY_POSITION->[0]);
+         $exit->stats->hp ($EMERGENCY_POSITION->[1]);
+         $exit->stats->sp ($EMERGENCY_POSITION->[2]);
+
+         $LINK_MAP->insert ($exit->clone, 19, 19);
+         $LINK_MAP->insert ($exit->clone, 19, 20);
+         $LINK_MAP->insert ($exit->clone, 19, 21);
+         $LINK_MAP->insert ($exit->clone, 20, 19);
+         $LINK_MAP->insert ($exit->clone, 20, 21);
+         $LINK_MAP->insert ($exit->clone, 21, 19);
+         $LINK_MAP->insert ($exit->clone, 21, 20);
+         $LINK_MAP->insert ($exit->clone, 21, 21);
+
+         $exit->destroy;
+      });
+
+   $LINK_MAP->{deny_save}  = 1;
+   $LINK_MAP->{deny_reset} = 1;
+
+   $cf::MAP{$LINK_MAP->path} = $LINK_MAP;
+}
 
 register "<global>", __PACKAGE__;
 
-unshift @INC, maps_directory "perl";
+register_command "reload" => sub {
+   my ($who, $arg) = @_;
+
+   if ($who->flag (FLAG_WIZ)) {
+      $who->message ("start of reload.");
+      reload;
+      $who->message ("end of reload.");
+   }
+};
+
+unshift @INC, $LIBDIR;
+
+$TICK_WATCHER = Event->timer (
+   reentrant => 0,
+   prio      => 0,
+   at        => $NEXT_TICK || $TICK,
+   data      => WF_AUTOCANCEL,
+   cb        => sub {
+      cf::server_tick; # one server iteration
+      $RUNTIME   += $TICK;
+      $NEXT_TICK += $TICK;
+
+      # if we are delayed by four ticks or more, skip them all
+      $NEXT_TICK = Event::time if Event::time >= $NEXT_TICK + $TICK * 4;
+
+      $TICK_WATCHER->at ($NEXT_TICK);
+      $TICK_WATCHER->start;
+   },
+);
+
+IO::AIO::max_poll_time $TICK * 0.2;
+
+Event->io (
+   fd   => IO::AIO::poll_fileno,
+   poll => 'r',
+   prio => 5,
+   data => WF_AUTOCANCEL,
+   cb   => \&IO::AIO::poll_cb,
+);
+
+Event->timer (
+   data     => WF_AUTOCANCEL,
+   after    => 0,
+   interval => 10,
+   cb       => sub {
+      (Coro::unblock_sub {
+         write_runtime
+            or warn "ERROR: unable to write runtime file: $!";
+      })->();
+   },
+);
 
-load_extensions;
+END { cf::emergency_save }
 
 1