@playdrop/playdrop-cli 0.16.16 → 0.17.1

package/dist/commands/worker/game-server-infra.js

@@ -0,0 +1,595 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKER_REDIS_RUNTIME_COMMANDS = exports.WORKER_MONGODB_VERSION = exports.WORKER_REDIS_VERSION = void 0;
+exports.resolveManagedWorkerGameServerPaths = resolveManagedWorkerGameServerPaths;
+exports.installManagedWorkerGameServerToolchains = installManagedWorkerGameServerToolchains;
+exports.writeManagedWorkerGameServerConfiguration = writeManagedWorkerGameServerConfiguration;
+exports.buildManagedWorkerGameServerLaunchAgents = buildManagedWorkerGameServerLaunchAgents;
+exports.syncManagedWorkerGameServerLaunchAgents = syncManagedWorkerGameServerLaunchAgents;
+exports.setupManagedWorkerGameServerInfrastructure = setupManagedWorkerGameServerInfrastructure;
+exports.probeManagedWorkerGameServerInfrastructure = probeManagedWorkerGameServerInfrastructure;
+exports.cleanupStaleWorkerGameServerDevResources = cleanupStaleWorkerGameServerDevResources;
+exports.provisionWorkerGameServerDevLease = provisionWorkerGameServerDevLease;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const mongodb_1 = require("mongodb");
+const ioredis_1 = require("ioredis");
+exports.WORKER_REDIS_VERSION = "7.4.5";
+exports.WORKER_MONGODB_VERSION = "8.0.26";
+const WORKER_REDIS_ARCHIVE_SHA256 = "00bb280528f5d7934bec8ab309b8125088c209131e10609cb1563b91365633bb";
+const WORKER_MONGODB_ARCHIVE_SHA256 = "49f93af3935632d8ca460584166e07fb7d00fb1c2173544851df453edfdb14a3";
+const WORKER_REDIS_ARCHIVE_URL = `https://download.redis.io/releases/redis-${exports.WORKER_REDIS_VERSION}.tar.gz`;
+const WORKER_MONGODB_ARCHIVE_URL = `https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${exports.WORKER_MONGODB_VERSION}.tgz`;
+const WORKER_REDIS_PORT = 6390;
+const WORKER_MONGODB_PORT = 27018;
+const WORKER_MONGODB_REPLICA_SET = "playdrop-worker-rs0";
+const WORKER_INFRA_SCHEMA_VERSION = 1;
+exports.WORKER_REDIS_RUNTIME_COMMANDS = [
+    "+auth",
+    "+select",
+    "+ping",
+    "+quit",
+    "+info",
+    "+client|setinfo",
+    "+client|setname",
+    "+publish",
+    "+subscribe",
+    "+unsubscribe",
+    "+pubsub",
+    "+get",
+    "+set",
+    "+setex",
+    "+expire",
+    "+del",
+    "+exists",
+    "+sadd",
+    "+smembers",
+    "+sismember",
+    "+srem",
+    "+scard",
+    "+sinter",
+    "+hset",
+    "+hincrby",
+    "+hget",
+    "+hgetall",
+    "+hdel",
+    "+hlen",
+    "+hexists",
+    "+incr",
+    "+decr",
+    "+llen",
+    "+rpush",
+    "+lpush",
+    "+rpop",
+    "+lpop",
+    "+brpop",
+    "+multi",
+    "+exec",
+];
+;
+;
+function requireAbsoluteWorkerHome(workerHomeDir) {
+    const normalized = workerHomeDir.trim();
+    if (!normalized || !node_path_1.default.isAbsolute(normalized))
+        throw new Error("worker_game_server_home_invalid");
+    return normalized;
+}
+function resolveManagedWorkerGameServerPaths(workerHomeDir) {
+    const workerHome = requireAbsoluteWorkerHome(workerHomeDir);
+    const root = node_path_1.default.join(workerHome, "game-server");
+    const toolchainsRoot = node_path_1.default.join(workerHome, "toolchains");
+    const redisRoot = node_path_1.default.join(toolchainsRoot, `redis-${exports.WORKER_REDIS_VERSION}`);
+    const mongoRoot = node_path_1.default.join(toolchainsRoot, `mongodb-macos-aarch64--${exports.WORKER_MONGODB_VERSION}`);
+    return {
+        root,
+        toolchainsRoot,
+        redisRoot,
+        redisBinary: node_path_1.default.join(redisRoot, "src", "redis-server"),
+        redisCliBinary: node_path_1.default.join(redisRoot, "src", "redis-cli"),
+        mongoRoot,
+        mongodBinary: node_path_1.default.join(mongoRoot, "bin", "mongod"),
+        credentialsPath: node_path_1.default.join(root, "credentials.json"),
+        redisConfigPath: node_path_1.default.join(root, "redis.conf"),
+        redisAclPath: node_path_1.default.join(root, "redis.acl"),
+        mongoConfigPath: node_path_1.default.join(root, "mongod.conf"),
+        mongoKeyFilePath: node_path_1.default.join(root, "mongodb-keyfile"),
+        redisDataPath: node_path_1.default.join(root, "redis"),
+        mongoDataPath: node_path_1.default.join(root, "mongodb"),
+        logsPath: node_path_1.default.join(root, "logs"),
+    };
+}
+function sha256(bytes) {
+    return (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex");
+}
+async function downloadVerifiedArchive(input) {
+    const response = await fetch(input.url, { signal: AbortSignal.timeout(5 * 60000) });
+    if (!response.ok)
+        throw new Error(`worker_game_server_toolchain_download_failed:${response.status}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const actual = sha256(bytes);
+    if (actual !== input.sha256) {
+        throw new Error(`worker_game_server_toolchain_hash_mismatch:expected=${input.sha256}:actual=${actual}`);
+    }
+    (0, node_fs_1.writeFileSync)(input.destination, bytes, { mode: 0o600 });
+}
+function readRedisVersion(binary) {
+    const result = (0, node_child_process_1.spawnSync)(binary, ["--version"], { encoding: "utf8" });
+    if (result.status !== 0)
+        return null;
+    return /\bv=([^\s]+)/u.exec(result.stdout)?.[1] ?? null;
+}
+function readMongoVersion(binary) {
+    const result = (0, node_child_process_1.spawnSync)(binary, ["--version"], { encoding: "utf8" });
+    if (result.status !== 0)
+        return null;
+    return /db version v([^\s]+)/u.exec(result.stdout)?.[1] ?? null;
+}
+async function installManagedWorkerGameServerToolchains(input) {
+    const platform = input.platform ?? process.platform;
+    const architecture = input.architecture ?? process.arch;
+    if (platform !== "darwin" || architecture !== "arm64") {
+        throw new Error("worker_game_server_toolchain_unsupported: managed game-server workers require Apple silicon macOS");
+    }
+    const paths = resolveManagedWorkerGameServerPaths(input.workerHomeDir);
+    (0, node_fs_1.mkdirSync)(paths.toolchainsRoot, { recursive: true, mode: 0o700 });
+    if (readRedisVersion(paths.redisBinary) !== exports.WORKER_REDIS_VERSION) {
+        const temporaryRoot = node_path_1.default.join((0, node_os_1.tmpdir)(), `playdrop-worker-redis-${process.pid}-${Date.now()}`);
+        const archive = `${temporaryRoot}.tar.gz`;
+        (0, node_fs_1.rmSync)(temporaryRoot, { recursive: true, force: true });
+        try {
+            await downloadVerifiedArchive({
+                url: WORKER_REDIS_ARCHIVE_URL,
+                sha256: WORKER_REDIS_ARCHIVE_SHA256,
+                destination: archive,
+            });
+            (0, node_fs_1.mkdirSync)(temporaryRoot, { recursive: true, mode: 0o700 });
+            (0, node_child_process_1.execFileSync)("/usr/bin/tar", ["-xzf", archive, "-C", temporaryRoot], { stdio: "inherit" });
+            const extracted = node_path_1.default.join(temporaryRoot, `redis-${exports.WORKER_REDIS_VERSION}`);
+            (0, node_child_process_1.execFileSync)("/usr/bin/make", ["-C", extracted, "-j4", "BUILD_TLS=no"], { stdio: "inherit" });
+            (0, node_fs_1.rmSync)(paths.redisRoot, { recursive: true, force: true });
+            (0, node_fs_1.renameSync)(extracted, paths.redisRoot);
+        }
+        finally {
+            (0, node_fs_1.rmSync)(archive, { force: true });
+            (0, node_fs_1.rmSync)(temporaryRoot, { recursive: true, force: true });
+        }
+    }
+    if (readMongoVersion(paths.mongodBinary) !== exports.WORKER_MONGODB_VERSION) {
+        const temporaryRoot = node_path_1.default.join((0, node_os_1.tmpdir)(), `playdrop-worker-mongodb-${process.pid}-${Date.now()}`);
+        const archive = `${temporaryRoot}.tgz`;
+        (0, node_fs_1.rmSync)(temporaryRoot, { recursive: true, force: true });
+        try {
+            await downloadVerifiedArchive({
+                url: WORKER_MONGODB_ARCHIVE_URL,
+                sha256: WORKER_MONGODB_ARCHIVE_SHA256,
+                destination: archive,
+            });
+            (0, node_fs_1.mkdirSync)(temporaryRoot, { recursive: true, mode: 0o700 });
+            (0, node_child_process_1.execFileSync)("/usr/bin/tar", ["-xzf", archive, "-C", temporaryRoot], { stdio: "inherit" });
+            const extracted = node_path_1.default.join(temporaryRoot, `mongodb-macos-aarch64--${exports.WORKER_MONGODB_VERSION}`);
+            (0, node_fs_1.rmSync)(paths.mongoRoot, { recursive: true, force: true });
+            (0, node_fs_1.renameSync)(extracted, paths.mongoRoot);
+        }
+        finally {
+            (0, node_fs_1.rmSync)(archive, { force: true });
+            (0, node_fs_1.rmSync)(temporaryRoot, { recursive: true, force: true });
+        }
+    }
+    if (readRedisVersion(paths.redisBinary) !== exports.WORKER_REDIS_VERSION) {
+        throw new Error(`worker_game_server_redis_version_mismatch:expected=${exports.WORKER_REDIS_VERSION}`);
+    }
+    if (readMongoVersion(paths.mongodBinary) !== exports.WORKER_MONGODB_VERSION) {
+        throw new Error(`worker_game_server_mongodb_version_mismatch:expected=${exports.WORKER_MONGODB_VERSION}`);
+    }
+    return paths;
+}
+function loadOrCreateCredentials(paths) {
+    if ((0, node_fs_1.existsSync)(paths.credentialsPath)) {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(paths.credentialsPath, "utf8"));
+        if (parsed.schemaVersion !== WORKER_INFRA_SCHEMA_VERSION ||
+            typeof parsed.redisAdminPassword !== "string" ||
+            parsed.redisAdminPassword.length < 32 ||
+            typeof parsed.mongoAdminPassword !== "string" ||
+            parsed.mongoAdminPassword.length < 32) {
+            throw new Error("worker_game_server_credentials_invalid");
+        }
+        return parsed;
+    }
+    const credentials = {
+        schemaVersion: WORKER_INFRA_SCHEMA_VERSION,
+        redisAdminPassword: (0, node_crypto_1.randomBytes)(32).toString("base64url"),
+        mongoAdminPassword: (0, node_crypto_1.randomBytes)(32).toString("base64url"),
+    };
+    (0, node_fs_1.writeFileSync)(paths.credentialsPath, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+    return credentials;
+}
+function writeManagedWorkerGameServerConfiguration(input) {
+    const paths = resolveManagedWorkerGameServerPaths(input.workerHomeDir);
+    for (const directory of [paths.root, paths.redisDataPath, paths.mongoDataPath, paths.logsPath]) {
+        (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+        (0, node_fs_1.chmodSync)(directory, 0o700);
+    }
+    if (!(0, node_fs_1.existsSync)(paths.mongoKeyFilePath)) {
+        (0, node_fs_1.writeFileSync)(paths.mongoKeyFilePath, `${(0, node_crypto_1.randomBytes)(48).toString("base64")}\n`, { mode: 0o600 });
+    }
+    (0, node_fs_1.chmodSync)(paths.mongoKeyFilePath, 0o600);
+    const credentials = loadOrCreateCredentials(paths);
+    (0, node_fs_1.writeFileSync)(paths.redisAclPath, [
+        "user default off",
+        `user worker-admin on >${credentials.redisAdminPassword} ~* &* +@all`,
+        "",
+    ].join("\n"), { mode: 0o600 });
+    (0, node_fs_1.writeFileSync)(paths.redisConfigPath, [
+        "bind 127.0.0.1",
+        "protected-mode yes",
+        `port ${WORKER_REDIS_PORT}`,
+        `dir ${paths.redisDataPath}`,
+        `aclfile ${paths.redisAclPath}`,
+        'save ""',
+        "appendonly no",
+        "maxmemory 256mb",
+        "maxmemory-policy noeviction",
+        `logfile ${node_path_1.default.join(paths.logsPath, "redis.log")}`,
+        "",
+    ].join("\n"));
+    (0, node_fs_1.writeFileSync)(paths.mongoConfigPath, [
+        "storage:",
+        `  dbPath: ${paths.mongoDataPath}`,
+        "  wiredTiger:",
+        "    engineConfig:",
+        "      cacheSizeGB: 0.25",
+        "net:",
+        "  bindIp: 127.0.0.1",
+        `  port: ${WORKER_MONGODB_PORT}`,
+        "replication:",
+        `  replSetName: ${WORKER_MONGODB_REPLICA_SET}`,
+        "security:",
+        "  authorization: enabled",
+        `  keyFile: ${paths.mongoKeyFilePath}`,
+        "systemLog:",
+        "  destination: file",
+        `  path: ${node_path_1.default.join(paths.logsPath, "mongod.log")}`,
+        "  logAppend: true",
+        "",
+    ].join("\n"));
+    return {
+        redisAdminUrl: `redis://worker-admin:${credentials.redisAdminPassword}@127.0.0.1:${WORKER_REDIS_PORT}`,
+        mongoAdminUrl: `mongodb://worker-admin:${credentials.mongoAdminPassword}@127.0.0.1:${WORKER_MONGODB_PORT}/admin` +
+            `?replicaSet=${WORKER_MONGODB_REPLICA_SET}&directConnection=true&authSource=admin`,
+        redisVersion: exports.WORKER_REDIS_VERSION,
+        mongoVersion: exports.WORKER_MONGODB_VERSION,
+        paths,
+    };
+}
+function buildManagedWorkerGameServerLaunchAgents(input) {
+    const paths = resolveManagedWorkerGameServerPaths(input.workerHomeDir);
+    const launchAgentsRoot = node_path_1.default.join(node_path_1.default.dirname(requireAbsoluteWorkerHome(input.workerHomeDir)), "Library", "LaunchAgents");
+    const definitions = [
+        {
+            label: "ai.playdrop.worker.redis",
+            args: [paths.redisBinary, paths.redisConfigPath],
+            stdout: node_path_1.default.join(paths.logsPath, "redis-launch.out.log"),
+            stderr: node_path_1.default.join(paths.logsPath, "redis-launch.err.log"),
+        },
+        {
+            label: "ai.playdrop.worker.mongodb",
+            args: [paths.mongodBinary, "--config", paths.mongoConfigPath],
+            stdout: node_path_1.default.join(paths.logsPath, "mongodb-launch.out.log"),
+            stderr: node_path_1.default.join(paths.logsPath, "mongodb-launch.err.log"),
+        },
+    ];
+    return definitions.map((definition) => ({
+        label: definition.label,
+        plistPath: node_path_1.default.join(launchAgentsRoot, `${definition.label}.plist`),
+        contents: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${definition.label}</string>
+  <key>ProgramArguments</key>
+  <array>${definition.args.map((argument) => `\n    <string>${argument.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</string>`).join("")}\n  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>ProcessType</key><string>Background</string>
+  <key>StandardOutPath</key><string>${definition.stdout}</string>
+  <key>StandardErrorPath</key><string>${definition.stderr}</string>
+</dict>
+</plist>
+`,
+    }));
+}
+function syncManagedWorkerGameServerLaunchAgents(definitions, deps = { spawn: node_child_process_1.spawnSync }) {
+    const domain = `gui/${process.getuid?.() ?? -1}`;
+    for (const definition of definitions) {
+        (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(definition.plistPath), { recursive: true, mode: 0o700 });
+        const current = (0, node_fs_1.existsSync)(definition.plistPath) ? (0, node_fs_1.readFileSync)(definition.plistPath, "utf8") : null;
+        const changed = current !== definition.contents;
+        if (changed) {
+            (0, node_fs_1.writeFileSync)(definition.plistPath, definition.contents, { mode: 0o600 });
+        }
+        const status = deps.spawn("/bin/launchctl", ["print", `${domain}/${definition.label}`], { stdio: "ignore" });
+        const loaded = status.status === 0;
+        if (loaded && changed) {
+            const result = deps.spawn("/bin/launchctl", ["bootout", `${domain}/${definition.label}`], { encoding: "utf8" });
+            if (result.status !== 0) {
+                throw new Error(`worker_game_server_launchagent_reload_failed:${definition.label}:${String(result.stderr).trim()}`);
+            }
+        }
+        if (!loaded || changed) {
+            const result = deps.spawn("/bin/launchctl", ["bootstrap", domain, definition.plistPath], { encoding: "utf8" });
+            if (result.status !== 0) {
+                throw new Error(`worker_game_server_launchagent_failed:${definition.label}:${String(result.stderr).trim()}`);
+            }
+        }
+    }
+}
+async function waitForRedis(url) {
+    const deadline = Date.now() + 30000;
+    while (Date.now() < deadline) {
+        const redis = new ioredis_1.Redis(url, { lazyConnect: true, connectTimeout: 500, maxRetriesPerRequest: 1 });
+        redis.on("error", () => undefined);
+        try {
+            await redis.connect();
+            const info = await redis.info("server");
+            const version = /^redis_version:([^\r\n]+)/mu.exec(info)?.[1]?.trim() ?? "unknown";
+            if (version !== exports.WORKER_REDIS_VERSION) {
+                throw new Error(`worker_game_server_redis_version_mismatch:expected=${exports.WORKER_REDIS_VERSION}:actual=${version}`);
+            }
+            await redis.quit();
+            return;
+        }
+        catch (error) {
+            await redis.disconnect();
+            if (error instanceof Error && error.message.startsWith("worker_game_server_redis_version_mismatch"))
+                throw error;
+            await new Promise((resolveWait) => setTimeout(resolveWait, 250));
+        }
+    }
+    throw new Error("worker_game_server_redis_start_timeout");
+}
+async function waitForMongoAndInitialize(url) {
+    const parsed = new URL(url);
+    const password = decodeURIComponent(parsed.password);
+    const directUrl = `mongodb://127.0.0.1:${WORKER_MONGODB_PORT}/admin?directConnection=true`;
+    const deadline = Date.now() + 30000;
+    let control = null;
+    let authenticated = false;
+    while (Date.now() < deadline && !control) {
+        for (const candidate of [{ url, authenticated: true }, { url: directUrl, authenticated: false }]) {
+            const client = new mongodb_1.MongoClient(candidate.url, { serverSelectionTimeoutMS: 500, maxPoolSize: 1 });
+            try {
+                await client.connect();
+                await client.db("admin").command({ ping: 1 });
+                control = client;
+                authenticated = candidate.authenticated;
+                break;
+            }
+            catch {
+                await client.close().catch(() => undefined);
+            }
+        }
+        if (!control)
+            await new Promise((resolveWait) => setTimeout(resolveWait, 250));
+    }
+    if (!control)
+        throw new Error("worker_game_server_mongodb_start_timeout");
+    try {
+        const admin = control.db("admin");
+        const buildInfo = (await admin.command({ buildInfo: 1 }));
+        if (buildInfo.version !== exports.WORKER_MONGODB_VERSION) {
+            throw new Error(`worker_game_server_mongodb_version_mismatch:expected=${exports.WORKER_MONGODB_VERSION}:actual=${String(buildInfo.version)}`);
+        }
+        try {
+            await admin.command({ replSetGetStatus: 1 });
+        }
+        catch (error) {
+            if (error && typeof error === "object" && "code" in error && error.code === 94) {
+                await admin.command({
+                    replSetInitiate: {
+                        _id: WORKER_MONGODB_REPLICA_SET,
+                        members: [{ _id: 0, host: `127.0.0.1:${WORKER_MONGODB_PORT}` }],
+                    },
+                });
+            }
+            else {
+                throw error;
+            }
+        }
+        for (let attempt = 0; attempt < 120; attempt += 1) {
+            const hello = (await admin.command({ hello: 1 }));
+            if (hello.isWritablePrimary === true)
+                break;
+            if (attempt === 119)
+                throw new Error("worker_game_server_mongodb_primary_timeout");
+            await new Promise((resolveWait) => setTimeout(resolveWait, 250));
+        }
+        if (!authenticated) {
+            await admin.command({
+                createUser: "worker-admin",
+                pwd: password,
+                roles: [{ role: "root", db: "admin" }],
+            });
+        }
+    }
+    finally {
+        await control.close();
+    }
+    const verified = new mongodb_1.MongoClient(url, { serverSelectionTimeoutMS: 1000, maxPoolSize: 1 });
+    try {
+        await verified.connect();
+        const hello = (await verified.db("admin").command({ hello: 1 }));
+        if (hello.setName !== WORKER_MONGODB_REPLICA_SET || hello.isWritablePrimary !== true) {
+            throw new Error("worker_game_server_mongodb_primary_timeout");
+        }
+    }
+    finally {
+        await verified.close();
+    }
+}
+async function setupManagedWorkerGameServerInfrastructure(input) {
+    await installManagedWorkerGameServerToolchains(input);
+    const infrastructure = writeManagedWorkerGameServerConfiguration(input);
+    if (input.startLaunchAgents !== false) {
+        syncManagedWorkerGameServerLaunchAgents(buildManagedWorkerGameServerLaunchAgents(input));
+        await Promise.all([
+            waitForRedis(infrastructure.redisAdminUrl),
+            waitForMongoAndInitialize(infrastructure.mongoAdminUrl),
+        ]);
+    }
+    return infrastructure;
+}
+async function probeManagedWorkerGameServerInfrastructure(input) {
+    await Promise.all([waitForRedis(input.redisAdminUrl), waitForMongoAndInitialize(input.mongoAdminUrl)]);
+}
+function buildScopedUrl(baseUrl, username, password) {
+    const scoped = new URL(baseUrl);
+    scoped.username = username;
+    scoped.password = password;
+    return scoped.toString();
+}
+function normalizeTaskScope(taskId, attempt) {
+    if (!Number.isInteger(taskId) || taskId <= 0 || !Number.isInteger(attempt) || attempt <= 0) {
+        throw new Error("worker_game_server_dev_scope_invalid");
+    }
+    return `task-${taskId}-attempt-${attempt}`;
+}
+async function deleteRedisKeys(redis, pattern) {
+    let cursor = "0";
+    let deleted = 0;
+    do {
+        const [nextCursor, keys] = await redis.scan(cursor, "MATCH", pattern, "COUNT", 200);
+        cursor = nextCursor;
+        if (keys.length > 0) {
+            deleted += await redis.unlink(...keys);
+        }
+    } while (cursor !== "0");
+    return deleted;
+}
+async function removeRedisLease(input) {
+    await deleteRedisKeys(input.redis, `${input.namespace}*`);
+    await input.redis.call("ACL", "DELUSER", input.username);
+    await input.redis.call("ACL", "SAVE");
+}
+async function cleanupStaleWorkerGameServerDevResources(input) {
+    const redis = new ioredis_1.Redis(input.redisAdminUrl, { lazyConnect: true, connectTimeout: 2000, maxRetriesPerRequest: 1 });
+    redis.on("error", () => undefined);
+    const mongo = new mongodb_1.MongoClient(input.mongoAdminUrl, { serverSelectionTimeoutMS: 2000, maxPoolSize: 1 });
+    try {
+        await Promise.all([redis.connect(), mongo.connect()]);
+        const rawUsers = await redis.call("ACL", "USERS");
+        const users = Array.isArray(rawUsers)
+            ? rawUsers.map(String).filter((value) => /^playdrop-task-[1-9]\d*-attempt-[1-9]\d*$/u.test(value))
+            : [];
+        let redisKeys = 0;
+        for (const username of users) {
+            const scope = username.slice("playdrop-".length);
+            redisKeys += await deleteRedisKeys(redis, `colyseus:*:dev-${scope}:*`);
+            await redis.call("ACL", "DELUSER", username);
+        }
+        if (users.length > 0)
+            await redis.call("ACL", "SAVE");
+        const databases = (await mongo.db("admin").admin().listDatabases({ nameOnly: true })).databases
+            .map(({ name }) => name)
+            .filter((name) => /^dev_task_[1-9]\d*_attempt_[1-9]\d*$/u.test(name));
+        for (const database of databases)
+            await mongo.db(database).dropDatabase();
+        return { redisUsers: users.length, redisKeys, mongoDatabases: databases.length };
+    }
+    finally {
+        await Promise.allSettled([redis.quit(), mongo.close()]);
+    }
+}
+async function provisionWorkerGameServerDevLease(input) {
+    const scope = normalizeTaskScope(input.taskId, input.attempt);
+    const environment = input.environment.trim().toLowerCase().replace(/[^a-z0-9_-]/gu, "-");
+    if (!environment)
+        throw new Error("worker_game_server_dev_environment_invalid");
+    const redisNamespace = `colyseus:${environment}:dev-${scope}:`;
+    const redisUsername = `playdrop-${scope}`;
+    const redisPassword = (0, node_crypto_1.randomBytes)(24).toString("base64url");
+    const mongoDatabase = `dev_${scope.replace(/-/gu, "_")}`;
+    const mongoUsername = `playdrop-${scope}`;
+    const mongoPassword = (0, node_crypto_1.randomBytes)(24).toString("base64url");
+    const redisAdmin = new ioredis_1.Redis(input.redisAdminUrl, { lazyConnect: true, connectTimeout: 2000, maxRetriesPerRequest: 1 });
+    redisAdmin.on("error", () => undefined);
+    const mongoAdmin = new mongodb_1.MongoClient(input.mongoAdminUrl, { serverSelectionTimeoutMS: 2000, maxPoolSize: 1 });
+    let redisUserCreated = false;
+    let mongoUserCreated = false;
+    try {
+        await Promise.all([redisAdmin.connect(), mongoAdmin.connect()]);
+        try {
+            await redisAdmin.call("ACL", "SETUSER", redisUsername, "reset", "on", `>${redisPassword}`, "resetkeys", "resetchannels", `~${redisNamespace}*`, `&${redisNamespace}*`, ...exports.WORKER_REDIS_RUNTIME_COMMANDS);
+            redisUserCreated = true;
+            await redisAdmin.call("ACL", "SAVE");
+        }
+        catch (error) {
+            if (input.requireRedisAcl !== false)
+                throw error;
+        }
+        const database = mongoAdmin.db(mongoDatabase);
+        const existing = (await database.command({ usersInfo: mongoUsername }));
+        if (Array.isArray(existing.users) && existing.users.length > 0) {
+            await database.command({
+                updateUser: mongoUsername,
+                pwd: mongoPassword,
+                roles: [{ role: "readWrite", db: mongoDatabase }],
+            });
+        }
+        else {
+            await database.command({
+                createUser: mongoUsername,
+                pwd: mongoPassword,
+                roles: [{ role: "readWrite", db: mongoDatabase }],
+            });
+        }
+        mongoUserCreated = true;
+        const redisUrl = redisUserCreated
+            ? buildScopedUrl(input.redisAdminUrl, redisUsername, redisPassword)
+            : input.redisAdminUrl;
+        const mongoUrlValue = new URL(input.mongoAdminUrl);
+        mongoUrlValue.username = mongoUsername;
+        mongoUrlValue.password = mongoPassword;
+        mongoUrlValue.pathname = `/${mongoDatabase}`;
+        mongoUrlValue.searchParams.set("authSource", mongoDatabase);
+        mongoUrlValue.searchParams.set("maxPoolSize", "5");
+        return {
+            scope,
+            redisNamespace,
+            redisUrl,
+            mongoUrl: mongoUrlValue.toString(),
+            async cleanup() {
+                await Promise.allSettled([
+                    redisUserCreated
+                        ? removeRedisLease({ redis: redisAdmin, username: redisUsername, namespace: redisNamespace })
+                        : Promise.resolve(),
+                    mongoUserCreated
+                        ? mongoAdmin
+                            .db(mongoDatabase)
+                            .command({ dropUser: mongoUsername })
+                            .catch(() => undefined)
+                            .then(() => mongoAdmin.db(mongoDatabase).dropDatabase())
+                        : Promise.resolve(),
+                ]);
+                await Promise.allSettled([redisAdmin.quit(), mongoAdmin.close()]);
+            },
+        };
+    }
+    catch (error) {
+        if (redisUserCreated) {
+            await removeRedisLease({ redis: redisAdmin, username: redisUsername, namespace: redisNamespace })
+                .catch(() => undefined);
+        }
+        if (mongoUserCreated) {
+            await mongoAdmin.db(mongoDatabase).command({ dropUser: mongoUsername }).catch(() => undefined);
+            await mongoAdmin.db(mongoDatabase).dropDatabase().catch(() => undefined);
+        }
+        await Promise.allSettled([redisAdmin.quit(), mongoAdmin.close()]);
+        throw error;
+    }
+}