@babylonjs-toolkit/server 0.0.0-stage → 9.35.0

package/lib/discord/DiscordSignInRoutes.d.ts

@@ -0,0 +1,51 @@
+import { type Endpoint } from "colyseus";
+import type { GameServerStateValues } from "../GameServerState.js";
+import type { AdminClock } from "../admin/AdminClock.js";
+import type { AdminStore } from "../admin/AdminStore.js";
+import type { LeaderboardService } from "../leaderboards/LeaderboardService.js";
+import { type DiscordEndpoints } from "./DiscordOAuth.js";
+/** What the Discord routes read. */
+export interface DiscordSignInRouteContext {
+    /** The server state (config, discordSessions, limits). */
+    state: () => GameServerStateValues;
+    /** The admin store (challenges, handoffs). */
+    store: AdminStore;
+    /** The leaderboards (claims at the session exchange). */
+    leaderboards: LeaderboardService;
+    /** The clock. */
+    clock: AdminClock;
+    /** Discord's addresses. */
+    endpoints: DiscordEndpoints;
+}
+/** One verified Discord player of a network session (D17). */
+export interface DiscordSessionPlayerView {
+    /** The player id in the session. */
+    playerId: number;
+    /** discord:<id>. */
+    userId: string;
+    /** The verified display name. */
+    displayName: string;
+    /** The avatar hash, or null. */
+    avatar: string | null;
+}
+/** The answer of POST /game-server/discord/session. */
+export interface DiscordSessionResponse {
+    /** The session and its profile. */
+    session: {
+        token: string;
+        expiresAt: string;
+        userId: string;
+        discordId: string;
+        displayName: string;
+        avatarHash: string | null;
+    };
+    /** True when this browser's anonymous history was moved onto the Discord player. */
+    merged: boolean;
+}
+/**
+ * The Discord sign-in endpoints (discord-sign-in D13). Every route answers 404 { reason: "discordSignInOff" } while the
+ * state has no Discord sessions.
+ * @param context What the routes read.
+ * @returns The endpoints, keyed by name, for createRouter.
+ */
+export declare function createDiscordSignInRoutes(context: DiscordSignInRouteContext): Record<string, Endpoint>;

package/lib/discord/DiscordSignInRoutes.js

@@ -0,0 +1,359 @@
+// discord/DiscordSignInRoutes.ts — the Discord sign-in endpoints (discord-sign-in D13, D14, D17): start, Discord's
+// callback, the handoff-for-session exchange and the verified players of one network session.
+import { createHash } from "node:crypto";
+import { createEndpoint, matchMaker } from "colyseus";
+import { isOriginAllowed } from "../AbuseLimits.js";
+import { SESSION_ROOM_NAME } from "../DedicatedSession.js";
+import { getLogger } from "../GameServerLogger.js";
+import { jsonResponse } from "../ServerEndpoints.js";
+import { requestOf } from "../admin/AdminApiRouter.js";
+import { randomToken, sha256Hex } from "../admin/AdminCrypto.js";
+import { readJsonBody } from "../leaderboards/LeaderboardPublicApi.js";
+import { LeaderboardError } from "../leaderboards/LeaderboardError.js";
+import { DiscordApiError, exchangeDiscordCode, fetchDiscordProfile } from "./DiscordOAuth.js";
+import { CHALLENGE_ID_PREFIX, CHALLENGE_LIFETIME_MS, DISCORD_CALLBACK_PATH, DISCORD_COLLECTION, DISCORD_ISSUER, DISCORD_ROOM_CALL_TIMEOUT_MS, DISCORD_SCOPE, DISCORD_SESSION_PATH, DISCORD_SESSION_PLAYERS_PATH, DISCORD_START_PATH, HANDOFF_ID_PREFIX, HANDOFF_LIFETIME_MS, RANDOM_VALUE_BYTES, RETURN_COOKIE_MAX_AGE_SECONDS, RETURN_COOKIE_NAME, RETURN_COOKIE_PATH } from "./DiscordSignInConstants.js";
+/** HTTP statuses the routes answer with. */
+const HTTP_OK = 200;
+const HTTP_FOUND = 302;
+const HTTP_BAD_REQUEST = 400;
+const HTTP_UNAUTHORIZED = 401;
+const HTTP_FORBIDDEN = 403;
+const HTTP_NOT_FOUND = 404;
+/** The text page of a failed callback that has no return address to go back to. */
+const FAILED_SIGN_IN_TEXT = "Sign-in failed. Go back to the game and try again.";
+/** The authorization response's error for a player who pressed Cancel at Discord. */
+const ACCESS_DENIED_ERROR = "access_denied";
+/** The return query's names and the outcomes of signin=. */
+const SIGN_IN_QUERY_NAME = "signin";
+const CODE_QUERY_NAME = "code";
+const SIGN_IN_CANCELLED = "cancelled";
+const SIGN_IN_FAILED = "failed";
+const SIGN_IN_BUSY = "busy";
+/**
+ * The Discord sign-in endpoints (discord-sign-in D13). Every route answers 404 { reason: "discordSignInOff" } while the
+ * state has no Discord sessions.
+ * @param context What the routes read.
+ * @returns The endpoints, keyed by name, for createRouter.
+ */
+export function createDiscordSignInRoutes(context) {
+    return {
+        discordSignInStart: createEndpoint(DISCORD_START_PATH, { method: "GET", disableBody: true }, async (routerContext) => startSignIn(context, requestOf(routerContext))),
+        discordSignInCallback: createEndpoint(DISCORD_CALLBACK_PATH, { method: "GET", disableBody: true }, async (routerContext) => finishAtDiscordCallback(context, requestOf(routerContext))),
+        discordSignInSession: createEndpoint(DISCORD_SESSION_PATH, { method: "POST", disableBody: true }, async (routerContext) => exchangeHandoff(context, requestOf(routerContext))),
+        discordSignInSessionPlayers: createEndpoint(DISCORD_SESSION_PLAYERS_PATH, { method: "GET", disableBody: true }, async (routerContext) => readSessionPlayers(context, requestOf(routerContext)))
+    };
+}
+// ---- Route handlers ----------------------------------------------------------------------------------------------------
+/**
+ * GET start?returnTo=<url>: stores a challenge and sends the browser to Discord's consent page (prompt=none, so a
+ * player who already approved passes straight through), with the return cookie for refused-state answers.
+ * @param context What the routes read.
+ * @param request The Fetch request.
+ * @returns 302 to Discord, 400 returnNotAllowed, or 404 while sign-in is off.
+ */
+async function startSignIn(context, request) {
+    const state = context.state();
+    if (state.discordSessions == null)
+        return signInOffResponse();
+    const config = state.config.discordSignIn;
+    const returnTo = validReturnTo(new URL(request.url).searchParams.get("returnTo"), config.returnOrigins);
+    if (returnTo == null)
+        return jsonResponse(HTTP_BAD_REQUEST, { error: "returnTo is not an allowed game address", reason: "returnNotAllowed" });
+    await sweepExpired(context.store, context.clock);
+    const challengeState = randomToken(RANDOM_VALUE_BYTES);
+    const codeVerifier = randomToken(RANDOM_VALUE_BYTES);
+    const challenge = { kind: "challenge", codeVerifier: codeVerifier, returnTo: returnTo.href, expiresAt: new Date(context.clock.now() + CHALLENGE_LIFETIME_MS).toISOString() };
+    await context.store.putDocument(DISCORD_COLLECTION, CHALLENGE_ID_PREFIX + sha256Hex(challengeState), challenge, 0);
+    const authorizeUrl = new URL(context.endpoints.authorizeUrl);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", config.clientId ?? "");
+    authorizeUrl.searchParams.set("redirect_uri", config.redirectUri ?? "");
+    authorizeUrl.searchParams.set("scope", DISCORD_SCOPE);
+    authorizeUrl.searchParams.set("state", challengeState);
+    authorizeUrl.searchParams.set("code_challenge", createHash("sha256").update(codeVerifier).digest("base64url"));
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("prompt", "none");
+    return redirectResponse(authorizeUrl.href, returnCookie(returnTo.href, isSecureServer(state)));
+}
+/**
+ * GET callback?code&state&iss&error: Discord's redirect back. Consumes the challenge, checks Discord's issuer, trades
+ * the code, reads the user and hands the game a single-use code.
+ * @param context What the routes read.
+ * @param request The Fetch request.
+ * @returns 302 to the game's return address (code= or signin=), 400 text without a return address, or 404 while off.
+ */
+async function finishAtDiscordCallback(context, request) {
+    const state = context.state();
+    if (state.discordSessions == null)
+        return signInOffResponse();
+    const config = state.config.discordSignIn;
+    const isSecure = isSecureServer(state);
+    const clearedCookie = clearedReturnCookie(isSecure);
+    const query = new URL(request.url).searchParams;
+    const challenge = await consumeRecord(context.store, context.clock, CHALLENGE_ID_PREFIX, query.get("state"), "challenge");
+    if (challenge == null) {
+        const cookieReturn = validReturnTo(decodedCookie(readCookie(request, RETURN_COOKIE_NAME)), config.returnOrigins);
+        if (cookieReturn == null)
+            return new Response(FAILED_SIGN_IN_TEXT, { status: HTTP_BAD_REQUEST, headers: { "content-type": "text/plain; charset=utf-8" } });
+        return redirectWithQuery(cookieReturn.href, SIGN_IN_QUERY_NAME, SIGN_IN_FAILED, clearedCookie);
+    }
+    const discordError = query.get("error");
+    if (discordError != null)
+        return redirectWithQuery(challenge.returnTo, SIGN_IN_QUERY_NAME, (discordError === ACCESS_DENIED_ERROR) ? SIGN_IN_CANCELLED : SIGN_IN_FAILED, clearedCookie);
+    const issuer = query.get("iss");
+    if (issuer != null && issuer !== DISCORD_ISSUER)
+        return redirectWithQuery(challenge.returnTo, SIGN_IN_QUERY_NAME, SIGN_IN_FAILED, clearedCookie);
+    const code = query.get("code");
+    if (code == null || code === "")
+        return redirectWithQuery(challenge.returnTo, SIGN_IN_QUERY_NAME, SIGN_IN_FAILED, clearedCookie);
+    let profile;
+    try {
+        const accessToken = await exchangeDiscordCode(context.endpoints, config, code, challenge.codeVerifier);
+        profile = await fetchDiscordProfile(context.endpoints, accessToken);
+    }
+    catch (error) {
+        if (!(error instanceof DiscordApiError))
+            throw error;
+        getLogger().warn("a Discord sign-in failed at Discord", { kind: error.kind, error: error.message });
+        return redirectWithQuery(challenge.returnTo, SIGN_IN_QUERY_NAME, (error.kind === "busy") ? SIGN_IN_BUSY : SIGN_IN_FAILED, clearedCookie);
+    }
+    const handoffCode = randomToken(RANDOM_VALUE_BYTES);
+    const handoff = { kind: "handoff", returnOrigin: new URL(challenge.returnTo).origin, profile: profile, expiresAt: new Date(context.clock.now() + HANDOFF_LIFETIME_MS).toISOString() };
+    await context.store.putDocument(DISCORD_COLLECTION, HANDOFF_ID_PREFIX + sha256Hex(handoffCode), handoff, 0);
+    return redirectWithQuery(challenge.returnTo, CODE_QUERY_NAME, handoffCode, clearedCookie);
+}
+/**
+ * POST session { code, playerKey? }: trades a handoff code for this server's session and gives the player their
+ * leaderboard player (merging the browser's anonymous history on a first sign-in, D16).
+ * @param context What the routes read.
+ * @param request The Fetch request.
+ * @returns 200 DiscordSessionResponse, 400 invalidRequest, 401 handoffInvalid, 403 originNotAllowed, or 404 while off.
+ */
+async function exchangeHandoff(context, request) {
+    const discordSessions = context.state().discordSessions;
+    if (discordSessions == null)
+        return signInOffResponse();
+    const body = await readBodyOrNull(request);
+    const code = body?.code;
+    if (body == null || typeof code !== "string" || code === "")
+        return jsonResponse(HTTP_BAD_REQUEST, { error: "the body needs a code", reason: "invalidRequest" });
+    const handoff = await consumeRecord(context.store, context.clock, HANDOFF_ID_PREFIX, code, "handoff");
+    if (handoff == null)
+        return jsonResponse(HTTP_UNAUTHORIZED, { error: "the sign-in code is not valid", reason: "handoffInvalid" });
+    if (request.headers.get("origin") !== handoff.returnOrigin)
+        return jsonResponse(HTTP_FORBIDDEN, { error: "origin not allowed", reason: "originNotAllowed" });
+    const grant = await discordSessions.issue(handoff.profile);
+    const playerKey = body.playerKey;
+    const anonymousPlayerKey = (typeof playerKey === "string" && playerKey !== "") ? playerKey : null;
+    const merged = await claimLeaderboardPlayer(context.leaderboards, grant, anonymousPlayerKey);
+    const response = {
+        session: { token: grant.token, expiresAt: grant.expiresAt, userId: grant.userId, discordId: grant.profile.discordId, displayName: grant.profile.displayName, avatarHash: grant.profile.avatarHash },
+        merged: merged
+    };
+    return jsonResponse(HTTP_OK, response);
+}
+/**
+ * GET session-players?sessionName=<name>: the verified Discord players of one network session (D17), asked of the
+ * session's room wherever it runs.
+ * @param context What the routes read.
+ * @param request The Fetch request.
+ * @returns 200 { players }, 400 invalidRequest, 403 originNotAllowed, or 404 while off.
+ */
+async function readSessionPlayers(context, request) {
+    const state = context.state();
+    if (state.discordSessions == null)
+        return signInOffResponse();
+    const sessionName = new URL(request.url).searchParams.get("sessionName");
+    if (sessionName == null || sessionName === "")
+        return jsonResponse(HTTP_BAD_REQUEST, { error: "sessionName is required", reason: "invalidRequest" });
+    if (!isOriginAllowed(request.headers.get("origin"), state.config.limits))
+        return jsonResponse(HTTP_FORBIDDEN, { error: "origin not allowed", reason: "originNotAllowed" });
+    const rooms = await matchMaker.query({ name: SESSION_ROOM_NAME, sessionName: sessionName });
+    if (rooms.length === 0)
+        return jsonResponse(HTTP_OK, { players: [] });
+    try {
+        const players = await matchMaker.remoteRoomCall(rooms[0].roomId, "discordPlayers", [], DISCORD_ROOM_CALL_TIMEOUT_MS);
+        return jsonResponse(HTTP_OK, { players: players });
+    }
+    catch (error) {
+        getLogger().warn("the verified players of a session could not be read", { sessionName: sessionName, error: String(error) });
+        return jsonResponse(HTTP_OK, { players: [] });
+    }
+}
+// ---- Helpers -----------------------------------------------------------------------------------------------------------
+/**
+ * The answer of every route while Discord sign-in is off.
+ * @returns 404 discordSignInOff.
+ */
+function signInOffResponse() {
+    return jsonResponse(HTTP_NOT_FOUND, { error: "Discord sign-in is off on this server", reason: "discordSignInOff" });
+}
+/**
+ * Whether the server's own callback is https (the return cookie is then Secure).
+ * @param state The server state.
+ * @returns True when the redirect address starts with https:.
+ */
+function isSecureServer(state) {
+    return (state.config.discordSignIn.redirectUri ?? "").startsWith("https:");
+}
+/**
+ * A return address the routes may redirect to (D13: no open redirect).
+ * @param text The requested address, or null.
+ * @param returnOrigins The configured game origins.
+ * @returns The parsed URL when it is absolute http(s), its origin is listed, and it has no query, fragment or user info;
+ *     else null.
+ */
+function validReturnTo(text, returnOrigins) {
+    if (text == null || text === "")
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(text);
+    }
+    catch {
+        return null;
+    }
+    const isHttp = parsed.protocol === "http:" || parsed.protocol === "https:";
+    const isBare = parsed.search === "" && parsed.hash === "" && parsed.username === "" && parsed.password === "";
+    return (isHttp && isBare && returnOrigins.includes(parsed.origin)) ? parsed : null;
+}
+/**
+ * Takes a single-use record (D14): read, delete, and only a successful delete counts; the record must be live.
+ * @param store The admin store.
+ * @param clock The clock.
+ * @param idPrefix CHALLENGE_ID_PREFIX or HANDOFF_ID_PREFIX.
+ * @param secret The state or code the browser carried, or null.
+ * @param kind The record kind the id must hold.
+ * @returns The record, or null when missing, already taken, of another kind or expired.
+ */
+async function consumeRecord(store, clock, idPrefix, secret, kind) {
+    if (secret == null || secret === "")
+        return null;
+    const documentId = idPrefix + sha256Hex(secret);
+    const stored = await store.getDocument(DISCORD_COLLECTION, documentId);
+    if (stored == null || !(await store.deleteDocument(DISCORD_COLLECTION, documentId)))
+        return null;
+    const isLive = stored.value.kind === kind && Date.parse(stored.value.expiresAt) > clock.now();
+    return isLive ? stored.value : null;
+}
+/**
+ * Deletes every challenge and handoff whose expiry has passed (run at each start; the session key has no expiry).
+ * @param store The admin store.
+ * @param clock The clock.
+ */
+async function sweepExpired(store, clock) {
+    const documents = await store.listDocuments(DISCORD_COLLECTION);
+    const now = clock.now();
+    for (const document of documents) {
+        const expiresAt = document.value.expiresAt;
+        if (typeof expiresAt === "string" && Date.parse(expiresAt) <= now)
+            await store.deleteDocument(DISCORD_COLLECTION, document.id);
+    }
+}
+/**
+ * The return cookie set at start (D13).
+ * @param returnTo The validated return address.
+ * @param isSecure True to add Secure.
+ * @returns The Set-Cookie value.
+ */
+function returnCookie(returnTo, isSecure) {
+    return RETURN_COOKIE_NAME + "=" + encodeURIComponent(returnTo) + "; Path=" + RETURN_COOKIE_PATH + "; Max-Age=" + RETURN_COOKIE_MAX_AGE_SECONDS + "; HttpOnly; SameSite=Lax" + (isSecure ? "; Secure" : "");
+}
+/**
+ * The Set-Cookie value that clears the return cookie.
+ * @param isSecure True to add Secure.
+ * @returns The Set-Cookie value.
+ */
+function clearedReturnCookie(isSecure) {
+    return RETURN_COOKIE_NAME + "=; Path=" + RETURN_COOKIE_PATH + "; Max-Age=0; HttpOnly; SameSite=Lax" + (isSecure ? "; Secure" : "");
+}
+/**
+ * One cookie of a request.
+ * @param request The Fetch request.
+ * @param name The cookie name.
+ * @returns Its raw value, or null when the request does not carry it.
+ */
+function readCookie(request, name) {
+    const header = request.headers.get("cookie");
+    if (header == null)
+        return null;
+    for (const part of header.split(";")) {
+        const separatorIndex = part.indexOf("=");
+        if (separatorIndex < 0)
+            continue;
+        if (part.slice(0, separatorIndex).trim() === name)
+            return part.slice(separatorIndex + 1).trim();
+    }
+    return null;
+}
+/**
+ * A cookie value decoded from encodeURIComponent.
+ * @param value The raw value, or null.
+ * @returns The decoded text, or null when absent or malformed.
+ */
+function decodedCookie(value) {
+    if (value == null)
+        return null;
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A 302 to the game's return address with one query value, clearing the return cookie.
+ * @param returnTo The validated return address.
+ * @param name "code" or "signin".
+ * @param value The value.
+ * @param cookie The Set-Cookie value.
+ * @returns The redirect.
+ */
+function redirectWithQuery(returnTo, name, value, cookie) {
+    const location = new URL(returnTo);
+    location.searchParams.set(name, value);
+    return redirectResponse(location.href, cookie);
+}
+/**
+ * A 302 with a cookie.
+ * @param location The address.
+ * @param cookie The Set-Cookie value.
+ * @returns The redirect.
+ */
+function redirectResponse(location, cookie) {
+    return new Response(null, { status: HTTP_FOUND, headers: { location: location, "set-cookie": cookie } });
+}
+/**
+ * Reads the exchange body.
+ * @param request The Fetch request.
+ * @returns The JSON object, or null when it is too large, not JSON or not an object.
+ */
+async function readBodyOrNull(request) {
+    try {
+        return await readJsonBody(request);
+    }
+    catch (error) {
+        if (error instanceof LeaderboardError)
+            return null;
+        throw error;
+    }
+}
+/**
+ * Gives the signed-in user their leaderboard player; a refused claim is logged and the sign-in still succeeds.
+ * @param leaderboards The leaderboard service.
+ * @param grant The issued session.
+ * @param anonymousPlayerKey The browser's anonymous key, or null.
+ * @returns True when the anonymous history was merged.
+ */
+async function claimLeaderboardPlayer(leaderboards, grant, anonymousPlayerKey) {
+    try {
+        const claim = await leaderboards.claimUserPlayer({ userId: grant.userId, displayName: grant.profile.displayName, avatar: grant.profile.avatarHash, anonymousPlayerKey: anonymousPlayerKey });
+        return claim.merged;
+    }
+    catch (error) {
+        if (!(error instanceof LeaderboardError))
+            throw error;
+        getLogger().warn("the leaderboard claim of a Discord sign-in failed", { userId: grant.userId, reason: error.reason });
+        return false;
+    }
+}

package/lib/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The public API of the Babylon Game Server package (`@babylonjs-toolkit/server`).
+ */
+export { createGameServer, type GameServer, type GameServerOptions, type GameServerUrls } from "./GameServer.js";
+export { type GameServerHooks, type GameServerMetricsSink, type PlayerEvent, type SessionEvent } from "./GameServerState.js";
+export { AuthRefusal, type AuthIdentity, type AuthRequest, type TokenVerifier } from "./Authentication.js";
+export { UNKNOWN_CLIENT_ADDRESS, type JoinGateResult, type JoinKind } from "./JoinGate.js";
+export { GameServerMetrics } from "./GameServerMetrics.js";
+export { buildServerInfo, jsonResponse, type AdminSessionSummary, type GameServerInfo, type GameServerRouteContext, type GameServerTransports, type WebTransportEndpointInfo } from "./ServerEndpoints.js";
+export { reloadTlsNow, TLS_RELOAD_POLL_MS, type TlsMaterial } from "./TlsCertificates.js";
+export { DedicatedSession, type DedicatedSessionOptions } from "./DedicatedSession.js";
+export { DedicatedSceneRegistry, type ResolvedDedicatedScene } from "./DedicatedSceneRegistry.js";
+export { allowScriptUrlPrefixes, isUrlAllowed } from "./HeadlessRuntime.js";
+export { GameServerLogger, getLogger, setLogger, type LogFields, type LogLineFormat } from "./GameServerLogger.js";
+/** Builds extra HTTP endpoints for `GameServerOptions.routes` (re-exported from Colyseus, D15). */
+export { createEndpoint } from "colyseus";
+export { CONFIG_OPTIONS, DEFAULT_GAME_SERVER_CONFIG, GameServerConfigError, loadGameServerConfig, resolveGameServerConfig, type AdminConfig, type AuthConfig, type AuthMode, type ConfigOptionDefinition, type DedicatedBootSession, type DedicatedConfig, type DedicatedSceneConfig, type DeepPartial, type DiscordSignInConfig, type GameServerConfig, type GameServerConfigSources, type GameServerLogLevel, type LimitsConfig, type MetricsConfig, type RedisConfig, type TlsConfig, type UdpConfig } from "./GameServerConfig.js";
+export { DiscordSessions, type DiscordProfile, type DiscordSessionGrant } from "./discord/DiscordSessions.js";
+export type { DiscordTestingOptions } from "./discord/DiscordOAuth.js";
+export type { DiscordSessionPlayerView, DiscordSessionResponse } from "./discord/DiscordSignInRoutes.js";
+/** Developer extensions of the admin console: custom actions, panels and admin event hooks (game-server-admin-console D25). */
+export { type AdminActionContext, type AdminActionDefinition, type AdminEventHooks, type AdminExtensions, type AdminPanelDefinition } from "./admin/AdminExtensionsHost.js";
+export { type AdminActionField, type AdminActionResult, type AdminActionTarget, type AdminPanelContent, type AdminPermission, type AdminRole } from "./admin/AdminApiTypes.js";
+export { ADMIN_PERMISSIONS, ROLE_PERMISSIONS } from "./admin/AdminPermissions.js";

package/lib/index.js

@@ -0,0 +1,18 @@
+/**
+ * The public API of the Babylon Game Server package (`@babylonjs-toolkit/server`).
+ */
+export { createGameServer } from "./GameServer.js";
+export { AuthRefusal } from "./Authentication.js";
+export { UNKNOWN_CLIENT_ADDRESS } from "./JoinGate.js";
+export { GameServerMetrics } from "./GameServerMetrics.js";
+export { buildServerInfo, jsonResponse } from "./ServerEndpoints.js";
+export { reloadTlsNow, TLS_RELOAD_POLL_MS } from "./TlsCertificates.js";
+export { DedicatedSession } from "./DedicatedSession.js";
+export { DedicatedSceneRegistry } from "./DedicatedSceneRegistry.js";
+export { allowScriptUrlPrefixes, isUrlAllowed } from "./HeadlessRuntime.js";
+export { GameServerLogger, getLogger, setLogger } from "./GameServerLogger.js";
+/** Builds extra HTTP endpoints for `GameServerOptions.routes` (re-exported from Colyseus, D15). */
+export { createEndpoint } from "colyseus";
+export { CONFIG_OPTIONS, DEFAULT_GAME_SERVER_CONFIG, GameServerConfigError, loadGameServerConfig, resolveGameServerConfig } from "./GameServerConfig.js";
+export { DiscordSessions } from "./discord/DiscordSessions.js";
+export { ADMIN_PERMISSIONS, ROLE_PERMISSIONS } from "./admin/AdminPermissions.js";