@babylonjs-toolkit/server 0.0.0-stage → 9.35.1

package/lib/GameServerConfig.js

@@ -0,0 +1,1059 @@
+import { existsSync, readFileSync } from "node:fs";
+import { BlockList } from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { addNetworkEntry } from "./NetworkAddresses.js";
+import { DISCORD_CALLBACK_PATH, MAXIMUM_SESSION_DAYS, MINIMUM_SESSION_DAYS } from "./discord/DiscordSignInConstants.js";
+/** Thrown when the config is invalid; lists every problem. */
+export class GameServerConfigError extends Error {
+    /** Every problem, one readable sentence each. */
+    problems;
+    /**
+     * Creates the error.
+     * @param problems Every problem found.
+     */
+    constructor(problems) {
+        super("Babylon Game Server configuration problems:\n" + problems.map((problem) => "  - " + problem).join("\n"));
+        this.name = "GameServerConfigError";
+        this.problems = problems;
+    }
+}
+/** Prefix of every environment variable of the server. */
+const ENVIRONMENT_PREFIX = "GAME_SERVER_";
+/** Environment variable read for the port when GAME_SERVER_PORT is unset (platforms such as Heroku set it). */
+const PLATFORM_PORT_VARIABLE = "PORT";
+/** Base URL of the Colyseus Cloud API the console's Colyseus Cloud page reads (colyseus-cloud-console D6). */
+const DEFAULT_COLYSEUS_CLOUD_API_URL = "https://cloud-prod.colyseus.io/api/v1";
+/** Environment variable read for the Cloud API token when GAME_SERVER_ADMIN_COLYSEUS_CLOUD_API_TOKEN is unset (D6). */
+const COLYSEUS_CLOUD_TOKEN_VARIABLE = "COLYSEUS_CLOUD_TOKEN";
+/** Environment variables read for an option when its GAME_SERVER_ variable is unset, keyed by option path. */
+const FALLBACK_ENVIRONMENT_VARIABLES = new Map([
+    ["port", PLATFORM_PORT_VARIABLE],
+    ["admin.colyseusCloud.apiToken", COLYSEUS_CLOUD_TOKEN_VARIABLE]
+]);
+/** Environment variable that names the config file. */
+const CONFIG_FILE_VARIABLE = "GAME_SERVER_CONFIG";
+/** Flag that names the config file. */
+const CONFIG_FILE_FLAG = "config";
+/** Config files looked for in the working directory, in order. */
+const DEFAULT_CONFIG_FILE_NAMES = ["babylon-game-server.config.mjs", "babylon-game-server.config.js", "babylon-game-server.config.json"];
+/** Highest TCP/UDP port number. */
+const MAX_PORT = 65535;
+/** Prefix of a flag that turns a boolean option off. */
+const NEGATED_FLAG_PREFIX = "no-";
+/** What a secret shows in describeConfig. */
+const REDACTED_VALUE = "[redacted]";
+/** Text values a boolean option accepts as true. */
+const TRUE_WORDS = ["true", "1", "yes"];
+/** Text values a boolean option accepts as false. */
+const FALSE_WORDS = ["false", "0", "no"];
+/** Scene folder the legacy --dedicated flags load from when --scene-root is not given (the kit's dev server). */
+const LEGACY_SCENE_ROOT = "http://localhost:8877/scenes/";
+/** Legacy dedicated session flags (D19), handled apart from the option table. */
+const LEGACY_FLAGS = {
+    dedicated: "dedicated",
+    sceneRoot: "scene-root",
+    scene: "scene",
+    projectScript: "project-script",
+    players: "players"
+};
+/** Defaults of a dedicated scene's optional fields. */
+const DEDICATED_SCENE_DEFAULTS = {
+    projectScripts: [],
+    maxPlayers: 8,
+    onDemand: false,
+    idleSeconds: 60
+};
+/** The settings a server uses when nothing overrides them (D2: TLS, UDP and auth off). */
+export const DEFAULT_GAME_SERVER_CONFIG = {
+    port: 2567,
+    host: "0.0.0.0",
+    publicUrl: null,
+    publicAddress: null,
+    trustProxy: false,
+    logFormat: "auto",
+    logLevel: "info",
+    tls: { enabled: false, certFile: null, keyFile: null, certPem: null, keyPem: null, developmentCertificate: false },
+    udp: { enabled: false },
+    auth: {
+        enabled: false,
+        mode: "shared-secret",
+        sharedSecret: { tokens: [] },
+        jwt: { secret: null, jwksUrl: null, issuer: null, audience: null, algorithms: [] },
+        webhook: { url: null, timeoutMs: 5000 }
+    },
+    discordSignIn: { enabled: false, clientId: null, clientSecret: null, redirectUri: null, returnOrigins: [], sessionDays: 30 },
+    admin: {
+        token: null,
+        console: true,
+        dataDir: "./babylon-game-server-data",
+        sessionIdleMinutes: 30,
+        sessionMaxHours: 12,
+        allowedNetworks: [],
+        logBufferEntries: 10000,
+        metricsHistoryHours: 24,
+        grafanaUrl: null,
+        instanceLabel: null,
+        oidc: { enabled: false, issuer: null, clientId: null, clientSecret: null, label: "Single sign-on", roleClaim: "groups", roleMapping: [], allowLocalSignIn: true },
+        passkeys: { enabled: true, rpId: null },
+        colyseusCloud: { apiToken: null, application: null, apiUrl: DEFAULT_COLYSEUS_CLOUD_API_URL }
+    },
+    metrics: { enabled: true, requireAdminToken: false },
+    limits: {
+        allowedOrigins: [],
+        allowMissingOrigin: true,
+        joinRequestsPerMinutePerAddress: 120,
+        maxSessions: 1000,
+        maxPlayersPerSession: 255,
+        maxDedicatedSessions: 4,
+        maxMessageBytes: 65536,
+        maxMessagesPerSecond: 2000,
+        maxSessionNameLength: 128
+    },
+    redis: { url: null },
+    dedicated: { scenes: [], boot: [] },
+    leaderboards: { definitionsFile: null, signedInPlayersOnly: false },
+    drainSeconds: 30
+};
+/**
+ * Builds one option table row.
+ * @param optionPath Dotted path in GameServerConfig.
+ * @param environmentSuffix Environment variable without the GAME_SERVER_ prefix.
+ * @param flag CLI flag without dashes, or null.
+ * @param valueType How text values parse.
+ * @param description One sentence for docs and --help.
+ * @param extras Allowed enum values and the secret marker.
+ * @returns The row.
+ */
+function defineOption(optionPath, environmentSuffix, flag, valueType, description, extras = {}) {
+    const definition = { path: optionPath, environmentVariable: ENVIRONMENT_PREFIX + environmentSuffix, flag: flag, valueType: valueType, description: description, isSecret: extras.isSecret === true };
+    if (extras.allowedValues != null)
+        definition.allowedValues = extras.allowedValues;
+    return definition;
+}
+/** Every leaf option, once (D3). Flag parsing, env parsing, redaction and the docs all derive from it. */
+export const CONFIG_OPTIONS = [
+    defineOption("port", "PORT", "port", "number", "TCP (and UDP) port to listen on; 0 picks a free port. Falls back to PORT."),
+    defineOption("host", "HOST", "host", "string", "Address to bind."),
+    defineOption("publicUrl", "PUBLIC_URL", "public-url", "nullable-string", "Public ws:// or wss:// URL players use, shown in the banner."),
+    defineOption("publicAddress", "PUBLIC_ADDRESS", "public-address", "nullable-string", "host[:port] this instance advertises for seat reservations when scaled out with Redis."),
+    defineOption("trustProxy", "TRUST_PROXY", "trust-proxy", "boolean", "Trust x-forwarded-for / x-real-ip from a reverse proxy for the client address."),
+    defineOption("logFormat", "LOG_FORMAT", "log-format", "enum", "Log format: auto (JSON when NODE_ENV=production), json or text.", { allowedValues: ["auto", "json", "text"] }),
+    defineOption("logLevel", "LOG_LEVEL", "log-level", "enum", "Least severe level logged.", { allowedValues: ["error", "warn", "info", "debug"] }),
+    defineOption("tls.enabled", "TLS_ENABLED", "tls", "boolean", "Serve https:// and wss:// from the server itself."),
+    defineOption("tls.certFile", "TLS_CERT_FILE", "tls-cert-file", "nullable-string", "Path of the PEM certificate chain; reloaded when it changes."),
+    defineOption("tls.keyFile", "TLS_KEY_FILE", "tls-key-file", "nullable-string", "Path of the PEM private key; reloaded when it changes."),
+    defineOption("tls.certPem", "TLS_CERT_PEM", null, "nullable-string", "PEM certificate chain text, for container secrets.", { isSecret: true }),
+    defineOption("tls.keyPem", "TLS_KEY_PEM", null, "nullable-string", "PEM private key text, for container secrets.", { isSecret: true }),
+    defineOption("tls.developmentCertificate", "TLS_DEVELOPMENT_CERTIFICATE", "tls-dev-cert", "boolean", "Make a local development certificate with mkcert (refused when NODE_ENV=production)."),
+    defineOption("udp.enabled", "UDP_ENABLED", "udp", "boolean", "Also accept WebTransport over HTTP/3 (UDP) on the same port; needs TLS."),
+    defineOption("auth.enabled", "AUTH_ENABLED", "auth", "boolean", "Require a valid player token on every join."),
+    defineOption("auth.mode", "AUTH_MODE", "auth-mode", "enum", "How tokens are verified: shared-secret, jwt, webhook or custom.", { allowedValues: ["shared-secret", "jwt", "webhook", "custom"] }),
+    defineOption("auth.sharedSecret.tokens", "AUTH_SHARED_SECRET_TOKENS", null, "string-list", "Comma-separated tokens accepted in shared-secret mode.", { isSecret: true }),
+    defineOption("auth.jwt.secret", "AUTH_JWT_SECRET", null, "nullable-string", "HMAC secret (HS256/384/512) that signs player JWTs.", { isSecret: true }),
+    defineOption("auth.jwt.jwksUrl", "AUTH_JWT_JWKS_URL", null, "nullable-string", "JWKS URL of the identity provider that signs player JWTs."),
+    defineOption("auth.jwt.issuer", "AUTH_JWT_ISSUER", null, "nullable-string", "Required JWT issuer (iss), or none."),
+    defineOption("auth.jwt.audience", "AUTH_JWT_AUDIENCE", null, "nullable-string", "Required JWT audience (aud), or none."),
+    defineOption("auth.jwt.algorithms", "AUTH_JWT_ALGORITHMS", null, "string-list", "Comma-separated accepted JWT algorithms (empty: the key's defaults)."),
+    defineOption("auth.webhook.url", "AUTH_WEBHOOK_URL", null, "nullable-string", "URL that approves players in webhook mode."),
+    defineOption("auth.webhook.timeoutMs", "AUTH_WEBHOOK_TIMEOUT_MS", null, "number", "Milliseconds the auth webhook may take."),
+    defineOption("discordSignIn.enabled", "DISCORD_SIGN_IN_ENABLED", "discord-sign-in", "boolean", "Let players sign in with Discord (website OAuth2, scope identify)."),
+    defineOption("discordSignIn.clientId", "DISCORD_CLIENT_ID", null, "nullable-string", "The Discord application's client id."),
+    defineOption("discordSignIn.clientSecret", "DISCORD_CLIENT_SECRET", null, "nullable-string", "The Discord application's client secret.", { isSecret: true }),
+    defineOption("discordSignIn.redirectUri", "DISCORD_REDIRECT_URI", null, "nullable-string", "This server's Discord callback address, exactly as registered with Discord (…/game-server/discord/callback)."),
+    defineOption("discordSignIn.returnOrigins", "DISCORD_RETURN_ORIGINS", null, "string-list", "Comma-separated game origins a Discord sign-in may return to."),
+    defineOption("discordSignIn.sessionDays", "DISCORD_SESSION_DAYS", null, "number", "Days a player's Discord sign-in lasts before they sign in again."),
+    defineOption("admin.token", "ADMIN_TOKEN", "admin-token", "nullable-string", "Bearer token of the admin endpoints (unset: the admin API is off).", { isSecret: true }),
+    defineOption("admin.console", "ADMIN_CONSOLE", null, "boolean", "Serve the web admin console at /game-server/admin/ when an admin account exists or a setup is pending."),
+    defineOption("admin.dataDir", "ADMIN_DATA_DIR", "admin-data-dir", "string", "Folder of the admin data (accounts, bans, audit) when Redis is not configured."),
+    defineOption("admin.sessionIdleMinutes", "ADMIN_SESSION_IDLE_MINUTES", null, "number", "Console sign-out after this many idle minutes."),
+    defineOption("admin.sessionMaxHours", "ADMIN_SESSION_MAX_HOURS", null, "number", "Console sign-out after this many hours in all."),
+    defineOption("admin.allowedNetworks", "ADMIN_ALLOWED_NETWORKS", null, "string-list", "Comma-separated addresses or CIDR ranges that may reach the console and its API (empty: any)."),
+    defineOption("admin.logBufferEntries", "ADMIN_LOG_BUFFER_ENTRIES", null, "number", "Log entries each instance keeps for the console."),
+    defineOption("admin.metricsHistoryHours", "ADMIN_METRICS_HISTORY_HOURS", null, "number", "Hours of metrics history kept for the console charts."),
+    defineOption("admin.grafanaUrl", "ADMIN_GRAFANA_URL", null, "nullable-string", "An external Grafana dashboard URL the console links to."),
+    defineOption("admin.instanceLabel", "ADMIN_INSTANCE_LABEL", null, "nullable-string", "A region or label the console shows beside this instance."),
+    defineOption("admin.oidc.enabled", "ADMIN_OIDC_ENABLED", null, "boolean", "Offer OpenID Connect single sign-on on the console (needs issuer and clientId)."),
+    defineOption("admin.oidc.issuer", "ADMIN_OIDC_ISSUER", null, "nullable-string", "OpenID Connect issuer URL (with a /.well-known/openid-configuration)."),
+    defineOption("admin.oidc.clientId", "ADMIN_OIDC_CLIENT_ID", null, "nullable-string", "The console's OpenID Connect client id."),
+    defineOption("admin.oidc.clientSecret", "ADMIN_OIDC_CLIENT_SECRET", null, "nullable-string", "The console's OpenID Connect client secret.", { isSecret: true }),
+    defineOption("admin.oidc.label", "ADMIN_OIDC_LABEL", null, "string", "Label of the single sign-on button."),
+    defineOption("admin.oidc.roleClaim", "ADMIN_OIDC_ROLE_CLAIM", null, "string", "ID token claim that carries the groups or roles mapped to console roles."),
+    defineOption("admin.oidc.roleMapping", "ADMIN_OIDC_ROLE_MAPPING", null, "string-list", "Comma-separated claim value=role pairs, e.g. admins=admin,support=moderator."),
+    defineOption("admin.oidc.allowLocalSignIn", "ADMIN_OIDC_ALLOW_LOCAL_SIGN_IN", null, "boolean", "Allow username and password sign-in besides single sign-on (the CLI always works)."),
+    defineOption("admin.passkeys.enabled", "ADMIN_PASSKEYS_ENABLED", null, "boolean", "Offer passkeys as a second factor and for password-less console sign-in."),
+    defineOption("admin.passkeys.rpId", "ADMIN_PASSKEYS_RP_ID", null, "nullable-string", "Passkey relying party id (unset: the console host)."),
+    defineOption("admin.colyseusCloud.apiToken", "ADMIN_COLYSEUS_CLOUD_API_TOKEN", null, "nullable-string", "Colyseus Cloud API token the console's Colyseus Cloud page reads with (read-only, team-wide). Falls back to COLYSEUS_CLOUD_TOKEN.", { isSecret: true }),
+    defineOption("admin.colyseusCloud.application", "ADMIN_COLYSEUS_CLOUD_APPLICATION", null, "nullable-string", "Slug of the Colyseus Cloud application the console shows, e.g. 1234-my-game (empty: the team's only application)."),
+    defineOption("admin.colyseusCloud.apiUrl", "ADMIN_COLYSEUS_CLOUD_API_URL", null, "string", "Base URL of the Colyseus Cloud API."),
+    defineOption("metrics.enabled", "METRICS_ENABLED", null, "boolean", "Serve Prometheus metrics on GET /metrics."),
+    defineOption("metrics.requireAdminToken", "METRICS_REQUIRE_ADMIN_TOKEN", null, "boolean", "Require the admin token on /metrics."),
+    defineOption("limits.allowedOrigins", "ALLOWED_ORIGINS", "allowed-origins", "string-list", "Comma-separated browser origins allowed to join (empty: any)."),
+    defineOption("limits.allowMissingOrigin", "ALLOW_MISSING_ORIGIN", null, "boolean", "Accept joins that send no Origin header (native clients)."),
+    defineOption("limits.joinRequestsPerMinutePerAddress", "JOIN_REQUESTS_PER_MINUTE", null, "number", "Join requests one client address may make per minute."),
+    defineOption("limits.maxSessions", "MAX_SESSIONS", null, "number", "Sessions one process hosts."),
+    defineOption("limits.maxPlayersPerSession", "MAX_PLAYERS_PER_SESSION", null, "number", "Players one session accepts; larger requests are clamped."),
+    defineOption("limits.maxDedicatedSessions", "MAX_DEDICATED_SESSIONS", null, "number", "Dedicated sessions one process runs."),
+    defineOption("limits.maxMessageBytes", "MAX_MESSAGE_BYTES", null, "number", "Largest WebSocket message in bytes."),
+    defineOption("limits.maxMessagesPerSecond", "MAX_MESSAGES_PER_SECOND", null, "number", "Messages one client may send per second before it is disconnected (a live change applies to new sessions)."),
+    defineOption("limits.maxSessionNameLength", "MAX_SESSION_NAME_LENGTH", null, "number", "Longest session name in characters."),
+    defineOption("redis.url", "REDIS_URL", "redis-url", "nullable-string", "redis:// URL shared by every instance when scaled out.", { isSecret: true }),
+    defineOption("leaderboards.definitionsFile", "LEADERBOARDS_DEFINITIONS_FILE", "leaderboards-definitions-file", "nullable-string", "JSON file of leaderboard boards to create on start when missing (relative to the working directory)."),
+    defineOption("leaderboards.signedInPlayersOnly", "LEADERBOARDS_SIGNED_IN_PLAYERS_ONLY", "leaderboards-signed-in-players-only", "boolean", "Only signed-in players (an auth identity with a user id) may submit leaderboard scores; anonymous entries are hidden on start."),
+    defineOption("drainSeconds", "DRAIN_SECONDS", "drain-seconds", "number", "Seconds running sessions may continue after SIGTERM.")
+];
+/** Set by Colyseus Cloud on every application process. */
+const COLYSEUS_CLOUD_VARIABLE = "COLYSEUS_CLOUD";
+/** Redis address Colyseus Cloud uses when it names none (the same address @colyseus/core falls back to). */
+const COLYSEUS_CLOUD_LOCAL_REDIS_URL = "redis://127.0.0.1:6379";
+/** Seconds running sessions may finish during a Colyseus Cloud deploy; a race fits inside it. */
+const COLYSEUS_CLOUD_DRAIN_SECONDS = 600;
+/** Admin data folder under the home folder, because a deploy can change the working folder. */
+const COLYSEUS_CLOUD_ADMIN_FOLDER = ".babylon-game-server-data";
+/**
+ * Tells whether this process runs on Colyseus Cloud.
+ * @param environment The process environment.
+ * @returns True on Colyseus Cloud.
+ */
+export function isColyseusCloud(environment) {
+    return environment[COLYSEUS_CLOUD_VARIABLE] !== undefined;
+}
+/**
+ * Loads the CLI config: defaults < platform < config file < environment < flags (D3), plus the legacy dedicated flags (D19).
+ * @param sources The arguments, environment and working directory.
+ * @returns The validated config.
+ * @throws GameServerConfigError listing every problem.
+ */
+export async function loadGameServerConfig(sources) {
+    return (await loadGameServerConfigWithSources(sources)).config;
+}
+/**
+ * Loads the CLI config like loadGameServerConfig and records where each option came from (game-server-admin-console
+ * D20): the last layer that set it, else "default".
+ * @param sources The arguments, environment and working directory.
+ * @returns The validated config and the source of every CONFIG_OPTIONS path.
+ * @throws GameServerConfigError listing every problem.
+ */
+export async function loadGameServerConfigWithSources(sources) {
+    const problems = [];
+    const parsedArguments = parseArguments(sources.argv, problems);
+    const configPath = findConfigFile(parsedArguments.configPath ?? nonEmpty(sources.environment[CONFIG_FILE_VARIABLE]), sources.workingDirectory, problems);
+    const fileLayer = (configPath != null) ? await readConfigFile(configPath, problems) : {};
+    const environmentLayer = parseEnvironment(sources.environment, problems);
+    const platformLayer = buildPlatformLayer(sources.environment, sources.processorCount ?? os.cpus().length, sources.homeDirectory ?? os.homedir());
+    const config = assembleConfig([platformLayer, fileLayer, environmentLayer, parsedArguments.overrides], problems);
+    // The legacy session is added to the file's scenes rather than replacing them, as a flag layer would.
+    const legacySession = parsedArguments.legacySession;
+    if (legacySession != null && Array.isArray(config.dedicated?.scenes) && Array.isArray(config.dedicated.boot)) {
+        config.dedicated.scenes.push(legacySession.scene);
+        config.dedicated.boot.push(legacySession.boot);
+    }
+    problems.push(...validateGameServerConfig(config, sources.environment));
+    if (problems.length > 0)
+        throw new GameServerConfigError(problems);
+    const layers = [
+        { source: "platform", layer: platformLayer },
+        { source: "file", layer: fileLayer },
+        { source: "environment", layer: environmentLayer },
+        { source: "flag", layer: parsedArguments.overrides }
+    ];
+    return { config: config, sources: recordConfigSources(layers) };
+}
+/**
+ * The defaults Colyseus Cloud needs: empty everywhere else, so no other host changes.
+ * @param environment The process environment.
+ * @param processorCount CPUs on this machine; more than one means Colyseus runs on Redis.
+ * @param homeDirectory The user's home folder.
+ * @returns The platform config layer.
+ */
+function buildPlatformLayer(environment, processorCount, homeDirectory) {
+    if (!isColyseusCloud(environment))
+        return {};
+    const layer = {
+        trustProxy: true,
+        drainSeconds: COLYSEUS_CLOUD_DRAIN_SECONDS,
+        admin: { dataDir: path.join(homeDirectory, COLYSEUS_CLOUD_ADMIN_FOLDER) }
+    };
+    const subdomain = nonEmpty(environment.SUBDOMAIN);
+    const serverName = nonEmpty(environment.SERVER_NAME);
+    if (subdomain != null && serverName != null)
+        layer.publicUrl = "wss://" + subdomain + "." + serverName;
+    const redisUrl = colyseusCloudRedisUrl(environment, processorCount);
+    if (redisUrl != null)
+        layer.redis = { url: redisUrl };
+    return layer;
+}
+/**
+ * The Redis address Colyseus Cloud matchmaking uses, under the rule @colyseus/core applies on its own.
+ * @param environment The process environment.
+ * @param processorCount CPUs on this machine.
+ * @returns REDIS_URI, else the local address on a machine of several CPUs, else null (one process, no Redis).
+ */
+function colyseusCloudRedisUrl(environment, processorCount) {
+    const namedUrl = nonEmpty(environment.REDIS_URI);
+    if (namedUrl != null)
+        return namedUrl;
+    return (processorCount > 1) ? COLYSEUS_CLOUD_LOCAL_REDIS_URL : null;
+}
+/**
+ * The source of every option: the last layer that set it, else "default".
+ * @param layers The layers in merge order.
+ * @returns The sources, keyed by dotted path.
+ */
+function recordConfigSources(layers) {
+    const sourceMap = {};
+    for (const definition of CONFIG_OPTIONS) {
+        sourceMap[definition.path] = "default";
+        for (const entry of layers)
+            if (readPath(entry.layer, definition.path) !== undefined)
+                sourceMap[definition.path] = entry.source;
+    }
+    return sourceMap;
+}
+/**
+ * Parses a value given for an option by its value type (the console's live overrides, game-server-admin-console
+ * D20): text parses as it would from an environment variable (so a string-list takes a comma-separated string), any
+ * other value is kept as it is for validateGameServerConfig to check.
+ * @param definition The option.
+ * @param value The value given.
+ * @returns The value, or null when text does not parse.
+ */
+export function parseOptionValue(definition, value) {
+    return (typeof value === "string") ? parseOptionText(definition, value) : { value: value };
+}
+/**
+ * The defaults deep-merged with overrides (objects merge, arrays and scalars replace), then validated.
+ * @param overrides The values to apply (a full config is fine).
+ * @param environment The environment validation checks (NODE_ENV); the process environment when omitted.
+ * @returns The validated config.
+ * @throws GameServerConfigError listing every problem.
+ */
+export function resolveGameServerConfig(overrides, environment) {
+    const problems = [];
+    const config = assembleConfig([overrides], problems);
+    problems.push(...validateGameServerConfig(config, environment));
+    if (problems.length > 0)
+        throw new GameServerConfigError(problems);
+    return config;
+}
+/**
+ * The problems of a config (empty when valid): wrong value types, out-of-range numbers and incomplete opt-ins (D2).
+ * @param config The config.
+ * @param environment The environment (NODE_ENV); the process environment when omitted.
+ * @returns One sentence per problem, each naming the option and its environment variable.
+ */
+export function validateGameServerConfig(config, environment = process.env) {
+    const typeProblems = CONFIG_OPTIONS.map((definition) => valueTypeProblem(definition, readPath(config, definition.path))).filter(isProblem);
+    if (typeProblems.length > 0)
+        return typeProblems;
+    return [
+        portProblem(config),
+        publicUrlProblem(config),
+        ...tlsProblems(config, environment),
+        udpProblem(config),
+        authProblem(config.auth),
+        ...limitProblems(config),
+        ...leaderboardProblems(config),
+        ...discordSignInProblems(config.discordSignIn),
+        ...adminProblems(config.admin),
+        ...dedicatedProblems(config.dedicated),
+        ...colyseusCloudProblems(config, environment)
+    ].filter(isProblem);
+}
+/**
+ * A copy safe to log: every isSecret option replaced by "[redacted]" (when set) or null (D4).
+ * @param config The config.
+ * @returns The redacted copy.
+ */
+export function describeConfig(config) {
+    const copy = JSON.parse(JSON.stringify(config));
+    for (const definition of CONFIG_OPTIONS) {
+        if (!definition.isSecret)
+            continue;
+        const value = readPath(copy, definition.path);
+        const isSet = Array.isArray(value) ? value.length > 0 : (value != null && value !== "");
+        writePath(copy, definition.path, isSet ? REDACTED_VALUE : null);
+    }
+    return copy;
+}
+/**
+ * The log format a config means here: "auto" is JSON under NODE_ENV=production, else text (D4).
+ * @param config The config.
+ * @param environment The environment (NODE_ENV); the process environment when omitted.
+ * @returns "json" or "text".
+ */
+export function effectiveLogFormat(config, environment = process.env) {
+    if (config.logFormat !== "auto")
+        return config.logFormat;
+    return isProductionEnvironment(environment) ? "json" : "text";
+}
+/**
+ * Whether NODE_ENV says production.
+ * @param environment The environment.
+ * @returns True when NODE_ENV is "production".
+ */
+export function isProductionEnvironment(environment) {
+    return environment.NODE_ENV === "production";
+}
+/**
+ * Merges layers over the defaults, reporting keys no option knows, and fills each dedicated scene's optional fields.
+ * @param layers The overrides, least important first.
+ * @param problems Receives unknown-key problems.
+ * @returns The merged config (a new object).
+ */
+function assembleConfig(layers, problems) {
+    let config = cloneConfig(DEFAULT_GAME_SERVER_CONFIG);
+    for (const layer of layers) {
+        problems.push(...unknownKeyProblems(layer, DEFAULT_GAME_SERVER_CONFIG, ""));
+        config = mergeConfig(config, layer);
+    }
+    const scenes = isPlainObject(config.dedicated) ? config.dedicated.scenes : undefined;
+    if (Array.isArray(scenes))
+        config.dedicated.scenes = scenes.map((scene) => Object.assign({}, DEDICATED_SCENE_DEFAULTS, scene));
+    return config;
+}
+/**
+ * A deep copy of a config, so merges never share arrays with the defaults.
+ * @param config The config.
+ * @returns The copy.
+ */
+function cloneConfig(config) {
+    return structuredClone(config);
+}
+/**
+ * Whether a value is a plain object (not an array, null or a class instance).
+ * @param value The value.
+ * @returns True for object literals and JSON objects.
+ */
+function isPlainObject(value) {
+    if (value == null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+/**
+ * Copies overrides onto a base config: objects merge key by key, arrays and scalars replace.
+ * @param base The config to start from (not modified).
+ * @param overrides The values to apply.
+ * @returns A new config.
+ */
+function mergeConfig(base, overrides) {
+    const merged = Object.assign({}, base);
+    for (const [key, overrideValue] of Object.entries(overrides)) {
+        if (overrideValue === undefined)
+            continue;
+        const baseValue = merged[key];
+        const mergesDeeper = isPlainObject(baseValue) && isPlainObject(overrideValue);
+        merged[key] = mergesDeeper ? mergeConfig(baseValue, overrideValue) : overrideValue;
+    }
+    return merged;
+}
+/**
+ * Problems for keys of an override object that the config does not have (typos in config files and API calls).
+ * Arrays (dedicated scenes and boot entries) are checked by validation, not here.
+ * @param layer The overrides.
+ * @param reference The matching part of the defaults.
+ * @param prefix The dotted path of the layer.
+ * @returns One problem per unknown key.
+ */
+function unknownKeyProblems(layer, reference, prefix) {
+    if (!isPlainObject(layer) || !isPlainObject(reference))
+        return [];
+    return Object.keys(layer).flatMap((key) => {
+        const keyPath = prefix + key;
+        if (!(key in reference))
+            return ["unknown option " + keyPath];
+        return unknownKeyProblems(layer[key], reference[key], keyPath + ".");
+    });
+}
+/**
+ * Reads the command line: option table flags, --config and the legacy dedicated flags (D19). The subcommand must
+ * already be removed.
+ * @param argv The arguments.
+ * @param problems Receives parse problems.
+ * @returns The parsed arguments.
+ */
+function parseArguments(argv, problems) {
+    const overrides = {};
+    const legacyValues = new Map();
+    const legacyFlagNames = Object.values(LEGACY_FLAGS);
+    let configPath = null;
+    for (let i = 0; i < argv.length; i++) {
+        const argument = argv[i];
+        if (!argument.startsWith("--")) {
+            problems.push("unexpected argument " + argument);
+            continue;
+        }
+        const equalsIndex = argument.indexOf("=");
+        const flag = (equalsIndex < 0) ? argument.slice(2) : argument.slice(2, equalsIndex);
+        const inlineValue = (equalsIndex < 0) ? null : argument.slice(equalsIndex + 1);
+        const definition = findFlagDefinition(flag);
+        if (definition != null && definition.valueType === "boolean") {
+            i += readBooleanFlag(definition, flag, inlineValue, argv[i + 1], overrides, problems);
+            continue;
+        }
+        const isKnown = definition != null || flag === CONFIG_FILE_FLAG || legacyFlagNames.includes(flag);
+        if (!isKnown) {
+            problems.push("unknown option --" + flag);
+            continue;
+        }
+        const followingValue = argv[i + 1];
+        const hasFollowingValue = inlineValue == null && followingValue != null && !followingValue.startsWith("--");
+        const value = inlineValue ?? (hasFollowingValue ? followingValue : null);
+        if (hasFollowingValue)
+            i++;
+        if (value == null) {
+            problems.push("--" + flag + " needs a value");
+            continue;
+        }
+        if (definition != null)
+            setParsedValue(overrides, definition, value, "--" + flag, problems);
+        else if (flag === CONFIG_FILE_FLAG)
+            configPath = value;
+        else
+            legacyValues.set(flag, (legacyValues.get(flag) ?? []).concat([value]));
+    }
+    return { overrides: overrides, configPath: configPath, legacySession: readLegacySession(legacyValues, problems) };
+}
+/**
+ * The option a flag (or its --no- form) sets.
+ * @param flag The flag without dashes or value.
+ * @returns The option, or undefined.
+ */
+function findFlagDefinition(flag) {
+    const direct = CONFIG_OPTIONS.find((definition) => definition.flag === flag);
+    if (direct != null || !flag.startsWith(NEGATED_FLAG_PREFIX))
+        return direct;
+    const positiveFlag = flag.slice(NEGATED_FLAG_PREFIX.length);
+    return CONFIG_OPTIONS.find((definition) => definition.flag === positiveFlag && definition.valueType === "boolean");
+}
+/**
+ * Sets a boolean flag: `--flag` is true, `--no-flag` false, `--flag=<value>` or `--flag <true|false|1|0|yes|no>` that value.
+ * @param definition The boolean option.
+ * @param flag The flag as written, without dashes.
+ * @param inlineValue The text after "=", or null.
+ * @param followingArgument The next argument, which is consumed when it is a boolean word.
+ * @param overrides Receives the value.
+ * @param problems Receives a bad value.
+ * @returns How many following arguments were consumed (0 or 1).
+ */
+function readBooleanFlag(definition, flag, inlineValue, followingArgument, overrides, problems) {
+    const isNegated = flag !== definition.flag;
+    if (isNegated) {
+        if (inlineValue != null)
+            problems.push("--" + flag + " takes no value");
+        else
+            writePath(overrides, definition.path, false);
+        return 0;
+    }
+    if (inlineValue != null) {
+        setParsedValue(overrides, definition, inlineValue, "--" + flag, problems);
+        return 0;
+    }
+    const followingIsBoolean = followingArgument != null && parseBoolean(followingArgument) != null;
+    writePath(overrides, definition.path, followingIsBoolean ? parseBoolean(followingArgument) : true);
+    return followingIsBoolean ? 1 : 0;
+}
+/**
+ * Turns the legacy dedicated flags into one scene named after the session plus its boot entry (D19).
+ * @param legacyValues The values of each legacy flag, in order.
+ * @param problems Receives a missing --scene or a bad --players.
+ * @returns The session, or null without --dedicated.
+ */
+function readLegacySession(legacyValues, problems) {
+    const lastValue = (flag) => {
+        const values = legacyValues.get(flag);
+        return (values != null && values.length > 0) ? values[values.length - 1] : null;
+    };
+    const sessionName = lastValue(LEGACY_FLAGS.dedicated);
+    if (sessionName == null) {
+        const strayFlags = Array.from(legacyValues.keys());
+        if (strayFlags.length > 0)
+            problems.push("--" + strayFlags.join(", --") + " only apply with --dedicated <sessionName>");
+        return null;
+    }
+    const sceneFile = lastValue(LEGACY_FLAGS.scene);
+    if (sceneFile == null)
+        problems.push("--dedicated needs --scene <file> (the exported scene the clients load)");
+    const playersText = lastValue(LEGACY_FLAGS.players);
+    const maxPlayers = (playersText != null) ? Number(playersText) : DEDICATED_SCENE_DEFAULTS.maxPlayers;
+    if (playersText != null && !Number.isInteger(maxPlayers))
+        problems.push("--players needs a whole number, got \"" + playersText + "\"");
+    if (sceneFile == null)
+        return null;
+    const scene = {
+        name: sessionName,
+        sceneRoot: lastValue(LEGACY_FLAGS.sceneRoot) ?? LEGACY_SCENE_ROOT,
+        sceneFile: sceneFile,
+        projectScripts: legacyValues.get(LEGACY_FLAGS.projectScript) ?? [],
+        maxPlayers: maxPlayers,
+        onDemand: false,
+        idleSeconds: DEDICATED_SCENE_DEFAULTS.idleSeconds
+    };
+    return { scene: scene, boot: { sessionName: sessionName, sceneName: sessionName } };
+}
+/**
+ * Reads every option's environment variable (empty counts as unset); an option's fallback variable (PORT,
+ * COLYSEUS_CLOUD_TOKEN) stands in when its GAME_SERVER_ variable is unset.
+ * @param environment The environment.
+ * @param problems Receives values that do not parse.
+ * @returns The environment layer.
+ */
+function parseEnvironment(environment, problems) {
+    const layer = {};
+    for (const definition of CONFIG_OPTIONS) {
+        const fallbackVariable = FALLBACK_ENVIRONMENT_VARIABLES.get(definition.path);
+        const usesFallback = fallbackVariable != null && nonEmpty(environment[definition.environmentVariable]) == null;
+        const variableName = (usesFallback && fallbackVariable != null) ? fallbackVariable : definition.environmentVariable;
+        const text = nonEmpty(environment[variableName]);
+        if (text != null)
+            setParsedValue(layer, definition, text, variableName, problems);
+    }
+    return layer;
+}
+/**
+ * Parses an option's text and writes it into a layer, or reports why it does not parse.
+ * @param layer Receives the value.
+ * @param definition The option.
+ * @param text The text.
+ * @param sourceName The flag or variable it came from, for the problem.
+ * @param problems Receives a bad value.
+ */
+function setParsedValue(layer, definition, text, sourceName, problems) {
+    const parsed = parseOptionText(definition, text);
+    if (parsed == null) {
+        problems.push(definition.path + " (" + sourceName + ") must be " + describeValueType(definition) + ", got \"" + text + "\"");
+        return;
+    }
+    writePath(layer, definition.path, parsed.value);
+}
+/**
+ * Parses an option's text by its value type.
+ * @param definition The option.
+ * @param text The text.
+ * @returns The value, or null when the text does not parse.
+ */
+function parseOptionText(definition, text) {
+    switch (definition.valueType) {
+        case "number": {
+            const value = Number(text);
+            return (text.trim() !== "" && Number.isFinite(value)) ? { value: value } : null;
+        }
+        case "boolean": {
+            const value = parseBoolean(text);
+            return (value != null) ? { value: value } : null;
+        }
+        case "string-list":
+            return { value: text.split(",").map((item) => item.trim()).filter((item) => item !== "") };
+        case "enum":
+            return (definition.allowedValues ?? []).includes(text) ? { value: text } : null;
+        case "nullable-string":
+            return { value: (text === "") ? null : text };
+        default:
+            return { value: text };
+    }
+}
+/**
+ * Parses a boolean word, case-insensitive.
+ * @param text true/false/1/0/yes/no.
+ * @returns The value, or null for any other text.
+ */
+function parseBoolean(text) {
+    const word = text.trim().toLowerCase();
+    if (TRUE_WORDS.includes(word))
+        return true;
+    if (FALSE_WORDS.includes(word))
+        return false;
+    return null;
+}
+/**
+ * What values an option accepts, for problems.
+ * @param definition The option.
+ * @returns A short phrase, e.g. "a number".
+ */
+function describeValueType(definition) {
+    switch (definition.valueType) {
+        case "number": return "a number";
+        case "boolean": return "true or false";
+        case "string-list": return "a comma-separated list";
+        case "enum": return "one of " + (definition.allowedValues ?? []).join(", ");
+        case "nullable-string": return "text or unset";
+        default: return "text";
+    }
+}
+/**
+ * The config file to read: the named one (which must exist), else the first default file in the working directory.
+ * @param namedPath The --config or GAME_SERVER_CONFIG path, or null.
+ * @param workingDirectory The folder relative paths resolve against.
+ * @param problems Receives a named file that does not exist.
+ * @returns The absolute path, or null when there is none.
+ */
+function findConfigFile(namedPath, workingDirectory, problems) {
+    if (namedPath != null) {
+        const absolutePath = path.resolve(workingDirectory, namedPath);
+        if (existsSync(absolutePath))
+            return absolutePath;
+        problems.push("the config file " + absolutePath + " does not exist (--config / " + CONFIG_FILE_VARIABLE + ")");
+        return null;
+    }
+    const defaultPaths = DEFAULT_CONFIG_FILE_NAMES.map((fileName) => path.join(workingDirectory, fileName));
+    return defaultPaths.find((candidate) => existsSync(candidate)) ?? null;
+}
+/**
+ * Reads a config file: JSON, or a module whose default export is an object or a function (async allowed) returning one.
+ * @param filePath The absolute path.
+ * @param problems Receives load errors and non-object contents.
+ * @returns The file layer ({} on a problem).
+ */
+async function readConfigFile(filePath, problems) {
+    try {
+        const contents = filePath.endsWith(".json") ? JSON.parse(readFileSync(filePath, "utf8")) : await readConfigModule(filePath);
+        if (isPlainObject(contents))
+            return contents;
+        problems.push("the config file " + filePath + " must contain an object");
+    }
+    catch (error) {
+        const detail = (error instanceof Error) ? error.message : String(error);
+        problems.push("the config file " + filePath + " could not be read: " + detail);
+    }
+    return {};
+}
+/**
+ * Imports a .mjs/.js config file and resolves its default export (calling it when it is a function).
+ * @param filePath The absolute path.
+ * @returns The exported config.
+ */
+async function readConfigModule(filePath) {
+    const configModule = await import(pathToFileURL(filePath).href);
+    const exported = configModule.default;
+    return (typeof exported === "function") ? await exported() : exported;
+}
+/**
+ * Reads a dotted path of an object.
+ * @param target The object.
+ * @param dottedPath E.g. "tls.certFile".
+ * @returns The value, or undefined when a step is missing.
+ */
+export function readPath(target, dottedPath) {
+    let current = target;
+    for (const key of dottedPath.split(".")) {
+        if (!isPlainObject(current))
+            return undefined;
+        current = current[key];
+    }
+    return current;
+}
+/**
+ * Writes a dotted path of an object, creating the objects on the way.
+ * @param target The object.
+ * @param dottedPath E.g. "tls.certFile".
+ * @param value The value.
+ */
+export function writePath(target, dottedPath, value) {
+    const keys = dottedPath.split(".");
+    let current = target;
+    for (const key of keys.slice(0, -1)) {
+        if (!isPlainObject(current[key]))
+            current[key] = {};
+        current = current[key];
+    }
+    current[keys[keys.length - 1]] = value;
+}
+/**
+ * Text, or null when it is unset or empty.
+ * @param text The text.
+ * @returns The text, or null.
+ */
+function nonEmpty(text) {
+    return (text == null || text === "") ? null : text;
+}
+/**
+ * Narrows a problem list entry.
+ * @param problem A problem, or null.
+ * @returns True for a problem.
+ */
+function isProblem(problem) {
+    return problem != null;
+}
+/**
+ * How an option is named in problems: its path and its environment variable.
+ * @param optionPath The dotted path.
+ * @returns E.g. "udp.enabled (GAME_SERVER_UDP_ENABLED)".
+ */
+function optionLabel(optionPath) {
+    const definition = CONFIG_OPTIONS.find((candidate) => candidate.path === optionPath);
+    return (definition != null) ? optionPath + " (" + definition.environmentVariable + ")" : optionPath;
+}
+/**
+ * Whether a value has an option's type (files and API callers may pass anything).
+ * @param definition The option.
+ * @param value The value.
+ * @returns A problem, or null.
+ */
+function valueTypeProblem(definition, value) {
+    const isValid = hasValueType(definition, value);
+    return isValid ? null : optionLabel(definition.path) + " must be " + describeValueType(definition) + ", got " + JSON.stringify(value);
+}
+/**
+ * Whether a value has an option's type.
+ * @param definition The option.
+ * @param value The value.
+ * @returns True when it fits.
+ */
+function hasValueType(definition, value) {
+    switch (definition.valueType) {
+        case "number": return typeof value === "number" && Number.isFinite(value);
+        case "boolean": return typeof value === "boolean";
+        case "string-list": return Array.isArray(value) && value.every((item) => typeof item === "string");
+        case "enum": return typeof value === "string" && (definition.allowedValues ?? []).includes(value);
+        case "nullable-string": return value === null || typeof value === "string";
+        default: return typeof value === "string";
+    }
+}
+/**
+ * @param config The config.
+ * @returns A problem when the port is not a whole number from 0 to 65535, else null.
+ */
+function portProblem(config) {
+    const isValid = Number.isInteger(config.port) && config.port >= 0 && config.port <= MAX_PORT;
+    return isValid ? null : optionLabel("port") + " must be a whole number from 0 to " + MAX_PORT + ", got " + config.port;
+}
+/**
+ * @param config The config.
+ * @returns A problem when the public URL is not a ws:// or wss:// URL, else null.
+ */
+function publicUrlProblem(config) {
+    if (config.publicUrl == null || /^wss?:\/\/./.test(config.publicUrl))
+        return null;
+    return optionLabel("publicUrl") + " must be a ws:// or wss:// URL, got \"" + config.publicUrl + "\"";
+}
+/**
+ * @param config The config.
+ * @param environment The environment (NODE_ENV).
+ * @returns Problems of an enabled TLS with no certificate source, and of a development certificate in production.
+ */
+function tlsProblems(config, environment) {
+    const tls = config.tls;
+    const problems = [];
+    const hasFilePair = tls.certFile != null && tls.keyFile != null;
+    const hasPemPair = tls.certPem != null && tls.keyPem != null;
+    if (tls.enabled && !hasFilePair && !hasPemPair && !tls.developmentCertificate) {
+        problems.push(optionLabel("tls.enabled") + " needs a certificate: set " + optionLabel("tls.certFile") + " and " + optionLabel("tls.keyFile") + ", or " + optionLabel("tls.certPem") + " and " + optionLabel("tls.keyPem") + ", or " + optionLabel("tls.developmentCertificate"));
+    }
+    if (tls.developmentCertificate && isProductionEnvironment(environment)) {
+        problems.push(optionLabel("tls.developmentCertificate") + " is refused when NODE_ENV=production: use a real certificate");
+    }
+    return problems;
+}
+/**
+ * The settings that break routing behind Colyseus Cloud's NGINX, which a Cloud deploy must not turn on.
+ * @param config The config.
+ * @param environment The environment.
+ * @returns One problem per such setting; none on any other host.
+ */
+function colyseusCloudProblems(config, environment) {
+    if (!isColyseusCloud(environment))
+        return [];
+    const problems = [];
+    if (config.tls.enabled)
+        problems.push("Colyseus Cloud serves TLS itself; turn off GAME_SERVER_TLS_ENABLED");
+    if (config.udp.enabled)
+        problems.push("UDP does not reach the server on Colyseus Cloud; turn off GAME_SERVER_UDP_ENABLED");
+    if (config.publicAddress != null)
+        problems.push("Colyseus Cloud sets the public address; unset GAME_SERVER_PUBLIC_ADDRESS");
+    return problems;
+}
+/**
+ * @param config The config.
+ * @returns A problem when UDP is enabled without TLS (WebTransport runs over HTTP/3, which needs TLS), else null.
+ */
+function udpProblem(config) {
+    if (!config.udp.enabled || config.tls.enabled)
+        return null;
+    return optionLabel("udp.enabled") + " needs " + optionLabel("tls.enabled") + ": WebTransport runs over HTTP/3, which always uses TLS";
+}
+/**
+ * @param auth The auth settings.
+ * @returns A problem when auth is enabled but its mode lacks what it needs, else null.
+ */
+function authProblem(auth) {
+    if (!auth.enabled)
+        return null;
+    if (auth.mode === "shared-secret" && auth.sharedSecret.tokens.length === 0) {
+        return optionLabel("auth.mode") + " shared-secret needs at least one token in " + optionLabel("auth.sharedSecret.tokens");
+    }
+    if (auth.mode === "jwt" && auth.jwt.secret == null && auth.jwt.jwksUrl == null) {
+        return optionLabel("auth.mode") + " jwt needs " + optionLabel("auth.jwt.secret") + " or " + optionLabel("auth.jwt.jwksUrl");
+    }
+    if (auth.mode === "webhook" && auth.webhook.url == null) {
+        return optionLabel("auth.mode") + " webhook needs " + optionLabel("auth.webhook.url");
+    }
+    return null;
+}
+/**
+ * @param config The config.
+ * @returns A problem per limit, timeout or drain time that is out of range.
+ */
+function limitProblems(config) {
+    const positivePaths = CONFIG_OPTIONS
+        .filter((definition) => definition.path.startsWith("limits.") && definition.valueType === "number")
+        .map((definition) => definition.path)
+        .concat(["auth.webhook.timeoutMs"]);
+    const problems = positivePaths
+        .filter((optionPath) => readPath(config, optionPath) <= 0)
+        .map((optionPath) => optionLabel(optionPath) + " must be more than 0, got " + String(readPath(config, optionPath)));
+    if (config.drainSeconds < 0)
+        problems.push(optionLabel("drainSeconds") + " must be 0 or more, got " + config.drainSeconds);
+    return problems;
+}
+/**
+ * The problems of the leaderboard options (game-server-leaderboards D11).
+ * @param config The config.
+ * @returns A problem when the definitions file is an empty path.
+ */
+function leaderboardProblems(config) {
+    return (config.leaderboards.definitionsFile === "") ? ["leaderboards.definitionsFile must not be empty"] : [];
+}
+/** The admin options that must be more than 0. */
+const POSITIVE_ADMIN_OPTION_PATHS = ["admin.sessionIdleMinutes", "admin.sessionMaxHours", "admin.logBufferEntries", "admin.metricsHistoryHours"];
+/** An http:// or https:// URL (admin.colyseusCloud.apiUrl). */
+const HTTP_URL_PATTERN = /^https?:\/\//;
+/**
+ * The problems of the admin options (game-server-admin-console DR §4): positive durations and sizes, network
+ * entries that parse as addresses or CIDR ranges, and an http(s) Colyseus Cloud API URL.
+ * @param admin The admin config.
+ * @returns One sentence per problem.
+ */
+function adminProblems(admin) {
+    const problems = POSITIVE_ADMIN_OPTION_PATHS
+        .filter((optionPath) => readPath({ admin: admin }, optionPath) <= 0)
+        .map((optionPath) => optionLabel(optionPath) + " must be more than 0, got " + String(readPath({ admin: admin }, optionPath)));
+    const probeList = new BlockList();
+    for (const entry of admin.allowedNetworks) {
+        if (!addNetworkEntry(probeList, entry))
+            problems.push(optionLabel("admin.allowedNetworks") + " must list addresses or CIDR ranges, got " + JSON.stringify(entry));
+    }
+    if (!HTTP_URL_PATTERN.test(admin.colyseusCloud.apiUrl))
+        problems.push(optionLabel("admin.colyseusCloud.apiUrl") + " must be an http:// or https:// URL, got " + JSON.stringify(admin.colyseusCloud.apiUrl));
+    return problems.concat(openIdProblems(admin.oidc));
+}
+/** A role mapping entry: "claim value=role" (DR §4). */
+const ROLE_MAPPING_PATTERN = /^[^=]+=(owner|admin|operator|moderator|developer|viewer)$/;
+/**
+ * The problems of the OpenID Connect options (DR §4): enabled needs issuer and clientId, and each role mapping entry
+ * must be "value=role".
+ * @param oidc The OpenID Connect settings.
+ * @returns One sentence per problem.
+ */
+function openIdProblems(oidc) {
+    const problems = [];
+    if (oidc.enabled && (oidc.issuer == null || oidc.issuer === ""))
+        problems.push(optionLabel("admin.oidc.issuer") + " is required when admin.oidc.enabled is true");
+    if (oidc.enabled && (oidc.clientId == null || oidc.clientId === ""))
+        problems.push(optionLabel("admin.oidc.clientId") + " is required when admin.oidc.enabled is true");
+    for (const entry of oidc.roleMapping) {
+        if (!ROLE_MAPPING_PATTERN.test(entry))
+            problems.push(optionLabel("admin.oidc.roleMapping") + " entries must be value=role with a console role, got " + JSON.stringify(entry));
+    }
+    return problems;
+}
+/**
+ * The problems of the Discord sign-in section (discord-sign-in D12); none while it is off.
+ * @param discord The section.
+ * @returns One message per problem.
+ */
+function discordSignInProblems(discord) {
+    if (!discord.enabled)
+        return [];
+    const problems = [];
+    if (discord.clientId == null || discord.clientId === "")
+        problems.push(optionLabel("discordSignIn.clientId") + " is required when discordSignIn.enabled is true");
+    if (discord.clientSecret == null || discord.clientSecret === "")
+        problems.push(optionLabel("discordSignIn.clientSecret") + " is required when discordSignIn.enabled is true");
+    if (!isDiscordCallbackUri(discord.redirectUri))
+        problems.push(optionLabel("discordSignIn.redirectUri") + " must be an http(s) address ending in " + DISCORD_CALLBACK_PATH);
+    if (discord.returnOrigins.length === 0)
+        problems.push(optionLabel("discordSignIn.returnOrigins") + " needs at least one game origin");
+    for (const origin of discord.returnOrigins) {
+        if (!isPlainOrigin(origin))
+            problems.push(optionLabel("discordSignIn.returnOrigins") + " entry " + JSON.stringify(origin) + " is not an origin (scheme://host[:port])");
+    }
+    if (!Number.isInteger(discord.sessionDays) || discord.sessionDays < MINIMUM_SESSION_DAYS || discord.sessionDays > MAXIMUM_SESSION_DAYS)
+        problems.push(optionLabel("discordSignIn.sessionDays") + " must be a whole number from 1 to 365");
+    return problems;
+}
+/**
+ * Whether a text is an http(s) URL whose path is the Discord callback path.
+ * @param uri The configured redirect address.
+ * @returns True when it can be registered with Discord as this server's callback.
+ */
+function isDiscordCallbackUri(uri) {
+    if (uri == null)
+        return false;
+    try {
+        const parsed = new URL(uri);
+        return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.pathname === DISCORD_CALLBACK_PATH && parsed.search === "" && parsed.hash === "";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a text is a bare origin: http(s), a host, an optional port, and nothing else.
+ * @param origin The text.
+ * @returns True for "https://game.example.com" or "http://localhost:6178".
+ */
+export function isPlainOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.origin === origin;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * @param dedicated The dedicated session settings.
+ * @returns Problems of malformed scenes, duplicate scene names and boot entries naming unknown scenes.
+ */
+function dedicatedProblems(dedicated) {
+    const hasLists = isPlainObject(dedicated) && Array.isArray(dedicated.scenes) && Array.isArray(dedicated.boot);
+    if (!hasLists)
+        return ["dedicated.scenes and dedicated.boot must be lists"];
+    const malformedEntries = !dedicated.scenes.every(isPlainObject) || !dedicated.boot.every(isPlainObject);
+    if (malformedEntries)
+        return ["every dedicated.scenes and dedicated.boot entry must be an object"];
+    const problems = dedicated.scenes.flatMap((scene, index) => sceneProblems(scene, index));
+    const sceneNames = dedicated.scenes.map((scene) => scene.name);
+    const duplicateNames = sceneNames.filter((name, index) => sceneNames.indexOf(name) !== index);
+    for (const name of new Set(duplicateNames))
+        problems.push("dedicated.scenes has more than one scene named \"" + name + "\"");
+    for (const boot of dedicated.boot) {
+        if (!sceneNames.includes(boot.sceneName))
+            problems.push("dedicated.boot session \"" + boot.sessionName + "\" names the unknown scene \"" + boot.sceneName + "\"");
+    }
+    return problems;
+}
+/**
+ * @param scene One dedicated scene.
+ * @param index Its position in dedicated.scenes.
+ * @returns Problems of missing or out-of-range fields.
+ */
+function sceneProblems(scene, index) {
+    const label = "dedicated.scenes[" + index + "]";
+    const problems = [];
+    for (const field of ["name", "sceneRoot", "sceneFile"]) {
+        if (typeof scene[field] !== "string" || scene[field] === "")
+            problems.push(label + "." + field + " must be non-empty text");
+    }
+    if (!Array.isArray(scene.projectScripts) || !scene.projectScripts.every((script) => typeof script === "string"))
+        problems.push(label + ".projectScripts must be a list of URLs");
+    if (!Number.isInteger(scene.maxPlayers) || scene.maxPlayers <= 0)
+        problems.push(label + ".maxPlayers must be a whole number more than 0, got " + String(scene.maxPlayers));
+    if (typeof scene.onDemand !== "boolean")
+        problems.push(label + ".onDemand must be true or false");
+    if (typeof scene.idleSeconds !== "number" || scene.idleSeconds < 0)
+        problems.push(label + ".idleSeconds must be 0 or more, got " + String(scene.idleSeconds));
+    return problems;
+}