@playdrop/playdrop-cli 0.17.4 → 0.17.14

package/dist/apps/publishingRuntime.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startPublishingRuntime = startPublishingRuntime;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const appUrls_1 = require("../appUrls");
+const devGameServer_1 = require("../commands/devGameServer");
+const devServer_1 = require("../commands/devServer");
+const game_server_infra_1 = require("../commands/worker/game-server-infra");
+async function startPublishingRuntime(input) {
+    if (!Number.isSafeInteger(input.appId) || input.appId <= 0) {
+        throw new Error("publishing_game_server_app_missing: Publishing requires the registered game's exact app ID.");
+    }
+    if (!input.task.server || !input.task.version || !input.task.filePath || !input.apiBase?.trim()) {
+        throw new Error("publishing_game_server_context_missing: Game server validation requires the built game, exact version, and API address.");
+    }
+    const credential = await input.client.requestDevGameServerCredential(input.appId, { version: input.task.version });
+    let ownedServices = null;
+    let router = null;
+    let gameServer = null;
+    let mount = null;
+    let frozenDir = null;
+    let closed = false;
+    const close = async () => {
+        if (closed)
+            return;
+        closed = true;
+        const stopped = await Promise.allSettled([
+            mount ? mount.close() : (0, devServer_1.terminateChildProcessTree)(gameServer?.process ?? null),
+        ]);
+        // The mount unregisters over HTTP, so its router must still be running.
+        const routerStopped = await Promise.allSettled([(0, devServer_1.terminateChildProcessTree)(router)]);
+        // A Cloud task owns its lease beyond this publishing attempt. A direct
+        // publication owns only the temporary lease created here.
+        const cleaned = await Promise.allSettled([
+            ownedServices?.cleanup(),
+            frozenDir ? (0, promises_1.rm)(frozenDir, { recursive: true, force: true }) : undefined,
+        ]);
+        const failures = [...stopped, ...routerStopped, ...cleaned].filter((result) => result.status === "rejected");
+        if (failures.length) {
+            throw Object.assign(new Error("publishing_game_server_cleanup_failed: Could not clean up this publishing job's temporary resources."), {
+                errors: failures.map((result) => result.reason),
+            });
+        }
+    };
+    try {
+        let services = input.gameServerDev;
+        if (!services) {
+            const redisAdminUrl = process.env.PLAYDROP_WORKER_GAME_SERVER_REDIS_ADMIN_URL?.trim();
+            const mongoAdminUrl = process.env.PLAYDROP_DEV_MONGO_URL?.trim();
+            if (!redisAdminUrl || !mongoAdminUrl) {
+                throw new Error("publishing_game_server_services_missing: Start the local PlayDrop platform and provide its Redis administration and MongoDB settings. Cloud must pass this task's database settings to publishing.");
+            }
+            ownedServices = await (0, game_server_infra_1.provisionPublishingGameServerDevLease)({
+                sessionId: input.sessionId, environment: credential.environment, redisAdminUrl, mongoAdminUrl,
+            });
+            services = ownedServices;
+        }
+        if (!services.redisUrl.startsWith("redis://") || !services.mongoUrl.startsWith("mongodb://") || !services.redisNamespace) {
+            throw new Error("publishing_game_server_services_invalid: This publishing job has incomplete database or server settings.");
+        }
+        // Keep the task's database and ACL, but never match into a room belonging
+        // to its still-running development server or an earlier publishing check.
+        const publishingServices = {
+            ...services, redisNamespace: `${services.redisNamespace}upload-${(0, node_crypto_1.randomUUID)()}:`,
+        };
+        const [bundle, manifest] = await Promise.all([
+            (0, promises_1.readFile)(input.gameServerBuild.bundlePath), (0, promises_1.readFile)(input.gameServerBuild.manifestPath),
+        ]);
+        if ((0, node_crypto_1.createHash)("sha256").update(bundle).digest("hex") !== input.gameServerBuild.manifest.sha256 ||
+            JSON.stringify(JSON.parse(manifest.toString("utf8"))) !== JSON.stringify(input.gameServerBuild.manifest)) {
+            throw new Error("publishing_game_server_changed: The game server changed after upload preparation. Finish editing before publishing again.");
+        }
+        await (0, promises_1.mkdir)((0, node_path_1.join)(input.task.projectDir, ".playdrop"), { recursive: true });
+        frozenDir = await (0, promises_1.mkdtemp)((0, node_path_1.join)(input.task.projectDir, ".playdrop", "publishing-"));
+        const frozenBuild = {
+            ...input.gameServerBuild,
+            bundlePath: (0, node_path_1.join)(frozenDir, "bundle.mjs"), manifestPath: (0, node_path_1.join)(frozenDir, "manifest.json"),
+        };
+        await Promise.all([(0, promises_1.writeFile)(frozenBuild.bundlePath, bundle), (0, promises_1.writeFile)(frozenBuild.manifestPath, manifest)]);
+        const localDevPort = await (0, devGameServer_1.reserveLocalGameServerPort)();
+        router = await (0, devServer_1.startOwnedDevRouter)(localDevPort);
+        const appType = (0, appUrls_1.getAppTypeSlug)(input.task.type ?? "GAME");
+        const appPath = `/apps/dev/${encodeURIComponent(input.creatorUsername)}/${appType}/${encodeURIComponent(input.task.name)}`;
+        gameServer = await (0, devGameServer_1.startDevGameServer)({
+            task: input.task, credential, platformApiUrl: input.apiBase,
+            publicAddress: `127.0.0.1:${localDevPort}${appPath}/_playdrop/rooms`,
+            gameServerDev: publishingServices, gameServerBuild: frozenBuild,
+        });
+        if (!gameServer)
+            throw new Error("publishing_game_server_missing");
+        mount = await (0, devServer_1.startDevServer)({
+            creatorUsername: input.creatorUsername, appName: input.task.name, appType,
+            htmlPath: input.task.filePath, port: localDevPort,
+            projectInfo: { projectDir: input.task.projectDir, packageJsonPath: input.task.packageJsonPath ?? null },
+            roomsPort: gameServer.port, roomsProcess: gameServer.process,
+        });
+        console.log(`[upload] Game server ready for ${input.creatorUsername}/${input.task.name}, publishing check ${input.sessionId}.`);
+        return { localDevPort, close };
+    }
+    catch (error) {
+        try {
+            await close();
+        }
+        catch (cleanupError) {
+            console.error("[upload] Publishing runtime cleanup also failed:", cleanupError);
+        }
+        throw error;
+    }
+}

package/dist/apps/runtimeSyntax.d.ts

@@ -0,0 +1,7 @@
+type RuntimeFile = {
+    absolutePath: string;
+    relativePath: string;
+};
+/** Parse the exact runtime files after packaging, without evaluating game code. */
+export declare function validateRuntimeSyntax(files: RuntimeFile[]): Promise<void>;
+export {};

package/dist/apps/runtimeSyntax.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRuntimeSyntax = validateRuntimeSyntax;
+const esbuild_1 = require("esbuild");
+const node_fs_1 = require("node:fs");
+const node_vm_1 = require("node:vm");
+const parse5_1 = require("parse5");
+const JAVASCRIPT_TYPES = new Set([
+    "application/ecmascript",
+    "application/javascript",
+    "application/x-ecmascript",
+    "application/x-javascript",
+    "text/ecmascript",
+    "text/javascript",
+    "text/javascript1.0",
+    "text/javascript1.1",
+    "text/javascript1.2",
+    "text/javascript1.3",
+    "text/javascript1.4",
+    "text/javascript1.5",
+    "text/jscript",
+    "text/livescript",
+    "text/x-ecmascript",
+    "text/x-javascript",
+]);
+const LINE_BREAK = /\r\n|[\n\r\u2028\u2029]/;
+function syntaxError(source, reason, line, column) {
+    const fileLine = source.lineOffset + line;
+    const fileColumn = column === null ? null : column + (line === 1 ? source.columnOffset : 0);
+    const lineText = source.fileContent.split(LINE_BREAK)[fileLine - 1] ?? "";
+    const excerptStart = Math.max(0, (fileColumn ?? 0) - 70);
+    const excerptEnd = Math.min(lineText.length, excerptStart + 180);
+    const prefix = excerptStart > 0 ? "..." : "";
+    const excerpt = `${prefix}${lineText.slice(excerptStart, excerptEnd)}${excerptEnd < lineText.length ? "..." : ""}`;
+    const caret = fileColumn === null ? "" : `${" ".repeat(prefix.length + Math.max(0, fileColumn - excerptStart))}^`;
+    const location = `${source.file.absolutePath}:${fileLine}${fileColumn === null ? "" : `:${fileColumn + 1}`}`;
+    return new Error([
+        `app_bundle_syntax_invalid: ${location}: ${reason}`,
+        excerpt,
+        caret,
+        "The packaged JavaScript is invalid. Fix the final build output before upload; a successful compiler/build command is not sufficient.",
+    ]
+        .filter(Boolean)
+        .join("\n"));
+}
+async function validateScript(source) {
+    let classicError = null;
+    if (source.mode === "classic") {
+        try {
+            // Constructing Script only parses code, never executes it. Its native
+            // browser-style error avoids mislabeling corrupt HTML as unsupported JSX.
+            new node_vm_1.Script(source.code, { filename: source.file.relativePath });
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+            classicError = error;
+        }
+    }
+    try {
+        // esbuild uses .mjs to enforce module grammar, including strict mode and the
+        // rejection of legacy HTML comments. Transform output is discarded, never run.
+        await (0, esbuild_1.transform)(source.code, {
+            loader: "js",
+            sourcefile: `${source.file.relativePath}.${source.mode === "module" ? "mjs" : "js"}`,
+            target: "esnext",
+            logLevel: "silent",
+        });
+    }
+    catch (error) {
+        const diagnostic = error.errors?.[0];
+        if (!diagnostic)
+            throw error;
+        const location = diagnostic.location;
+        const column = location
+            ? Buffer.from(location.lineText).subarray(0, location.column).toString("utf8").length
+            : null;
+        throw syntaxError(source, classicError?.message ?? diagnostic.text, location?.line ?? 1, column);
+    }
+    if (classicError) {
+        // esbuild accepts module/CommonJS constructs forbidden in classic scripts.
+        // A successful transform cannot override the native classic parse failure.
+        const stackLines = classicError.stack?.split("\n") ?? [];
+        const line = Number(stackLines[0]?.match(/:(\d+)$/)?.[1] ?? 1);
+        const caret = stackLines[2]?.indexOf("^") ?? -1;
+        throw syntaxError(source, classicError.message, line, caret < 0 ? null : caret);
+    }
+}
+function scriptsIn(node) {
+    const scripts = [];
+    if ("tagName" in node && node.tagName === "script")
+        scripts.push(node);
+    if ("childNodes" in node) {
+        for (const child of node.childNodes)
+            scripts.push(...scriptsIn(child));
+    }
+    return scripts;
+}
+/** Parse the exact runtime files after packaging, without evaluating game code. */
+async function validateRuntimeSyntax(files) {
+    const filesByPath = new Map(files.map((file) => [file.relativePath, file]));
+    const validatedFiles = new Set();
+    const validateFile = async (file, mode) => {
+        const key = `${mode}:${file.relativePath}`;
+        if (validatedFiles.has(key))
+            return;
+        const code = (0, node_fs_1.readFileSync)(file.absolutePath, "utf8");
+        await validateScript({ file, code, fileContent: code, mode, lineOffset: 0, columnOffset: 0 });
+        validatedFiles.add(key);
+    };
+    for (const file of files) {
+        if (!/\.html?$/i.test(file.relativePath))
+            continue;
+        const html = (0, node_fs_1.readFileSync)(file.absolutePath, "utf8");
+        const document = (0, parse5_1.parse)(html, { sourceCodeLocationInfo: true });
+        for (const script of scriptsIn(document)) {
+            const attrs = new Map(script.attrs.map((attr) => [attr.name, attr.value]));
+            const type = attrs.get("type")?.trim().toLowerCase() ?? "";
+            if (type && type !== "module" && !JAVASCRIPT_TYPES.has(type))
+                continue;
+            const mode = type === "module" ? "module" : "classic";
+            if (attrs.has("src")) {
+                const url = new URL(attrs.get("src"), `https://playdrop-bundle.invalid/${file.relativePath}`);
+                if (url.origin !== "https://playdrop-bundle.invalid")
+                    continue;
+                const referenced = filesByPath.get(decodeURIComponent(url.pathname.slice(1)));
+                if (referenced)
+                    await validateFile(referenced, mode);
+                continue;
+            }
+            const location = script.sourceCodeLocation;
+            if (!location?.startTag)
+                continue;
+            await validateScript({
+                file,
+                code: html.slice(location.startTag.endOffset, location.endTag?.startOffset ?? location.endOffset),
+                fileContent: html,
+                mode,
+                lineOffset: location.startTag.endLine - 1,
+                columnOffset: location.startTag.endCol - 1,
+            });
+        }
+    }
+    for (const file of files) {
+        if (!/\.(?:js|mjs|cjs)$/i.test(file.relativePath))
+            continue;
+        if (validatedFiles.has(`classic:${file.relativePath}`) || validatedFiles.has(`module:${file.relativePath}`))
+            continue;
+        // Unreferenced .js files may be imported modules or classic worker scripts.
+        // esbuild detects their syntax without inventing a script loading mode.
+        await validateFile(file, /\.mjs$/i.test(file.relativePath) ? "module" : "auto");
+    }
+}

package/dist/apps/serverBuild.d.ts

@@ -1,5 +1,6 @@
 import type { AppTask } from "../catalogue";
-export declare const GAME_SERVER_RUNTIME_VERSION: "colyseus-0.17-v1";
+import { GAME_SERVER_RUNTIME_VERSION, type ServerSdkOptions } from "./serverSdk";
+export { GAME_SERVER_RUNTIME_VERSION, verifyGameServerDependencies } from "./serverSdk";
 export declare const GAME_SERVER_BUNDLE_MAX_BYTES: number;
 export type GameServerManifest = {
     runtimeVersion: typeof GAME_SERVER_RUNTIME_VERSION;
@@ -12,6 +13,5 @@ export type GameServerBuild = {
     manifestPath: string;
     manifest: GameServerManifest;
 };
-export declare function verifyGameServerDependencies(task: AppTask): void;
-export declare function buildGameServer(task: AppTask): Promise<GameServerBuild | null>;
+export declare function buildGameServer(task: AppTask, options?: ServerSdkOptions): Promise<GameServerBuild | null>;
 export declare function formatServerBuildPath(task: AppTask, absolutePath: string): string;

package/dist/apps/serverBuild.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GAME_SERVER_BUNDLE_MAX_BYTES = exports.GAME_SERVER_RUNTIME_VERSION = void 0;
-exports.verifyGameServerDependencies = verifyGameServerDependencies;
+exports.GAME_SERVER_BUNDLE_MAX_BYTES = exports.verifyGameServerDependencies = exports.GAME_SERVER_RUNTIME_VERSION = void 0;
 exports.buildGameServer = buildGameServer;
 exports.formatServerBuildPath = formatServerBuildPath;
 const node_crypto_1 = require("node:crypto");
@@ -9,16 +8,11 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_url_1 = require("node:url");
 const esbuild_1 = require("esbuild");
-exports.GAME_SERVER_RUNTIME_VERSION = "colyseus-0.17-v1";
+const serverSdk_1 = require("./serverSdk");
+var serverSdk_2 = require("./serverSdk");
+Object.defineProperty(exports, "GAME_SERVER_RUNTIME_VERSION", { enumerable: true, get: function () { return serverSdk_2.GAME_SERVER_RUNTIME_VERSION; } });
+Object.defineProperty(exports, "verifyGameServerDependencies", { enumerable: true, get: function () { return serverSdk_2.verifyGameServerDependencies; } });
 exports.GAME_SERVER_BUNDLE_MAX_BYTES = 2 * 1024 * 1024;
-const REQUIRED_PACKAGE_VERSIONS = Object.freeze({
-    colyseus: "0.17.10",
-    "@colyseus/core": "0.17.50",
-    "@colyseus/schema": "4.0.30",
-    mongodb: "7.5.0",
-    "@playdrop/server": "0.1.0",
-    typescript: "5.9.3",
-});
 const CREATOR_IMPORTS = new Set([
     "colyseus",
     "@colyseus/core",
@@ -26,35 +20,6 @@ const CREATOR_IMPORTS = new Set([
     "mongodb",
     "@playdrop/server",
 ]);
-function resolveInstalledPackageVersion(projectPackageJsonPath, packageName) {
-    let current = (0, node_path_1.dirname)(projectPackageJsonPath);
-    while (true) {
-        const packageJsonPath = (0, node_path_1.join)(current, "node_modules", ...packageName.split("/"), "package.json");
-        if ((0, node_fs_1.existsSync)(packageJsonPath)) {
-            const manifest = JSON.parse((0, node_fs_1.readFileSync)(packageJsonPath, "utf8"));
-            if (manifest.name === packageName && typeof manifest.version === "string") {
-                return manifest.version;
-            }
-        }
-        const parent = (0, node_path_1.dirname)(current);
-        if (parent === current)
-            break;
-        current = parent;
-    }
-    throw new Error(`server_dependency_missing:${packageName}`);
-}
-function verifyGameServerDependencies(task) {
-    if (!task.server)
-        return;
-    if (!task.packageJsonPath)
-        throw new Error("server_package_json_required");
-    for (const [packageName, expected] of Object.entries(REQUIRED_PACKAGE_VERSIONS)) {
-        const actual = resolveInstalledPackageVersion(task.packageJsonPath, packageName);
-        if (actual !== expected) {
-            throw new Error(`server_dependency_version_mismatch:${packageName}:expected=${expected}:actual=${actual}`);
-        }
-    }
-}
 function allowedImportsPlugin(projectDir) {
     const normalizedProjectDir = `${(0, node_fs_1.realpathSync)(projectDir)}${node_path_1.sep}`;
     return {
@@ -111,10 +76,10 @@ async function validateRoomExports(task, bundlePath) {
             throw new Error(`server_room_invalid:${roomName}`);
     }
 }
-async function buildGameServer(task) {
+async function buildGameServer(task, options = {}) {
     if (!task.server)
         return null;
-    verifyGameServerDependencies(task);
+    await (0, serverSdk_1.ensureGameServerSdk)(task, options);
     const outputDir = (0, node_path_1.join)(task.projectDir, ".playdrop", "server");
     const bundlePath = (0, node_path_1.join)(outputDir, "bundle.mjs");
     const manifestPath = (0, node_path_1.join)(outputDir, "manifest.json");
@@ -142,7 +107,7 @@ async function buildGameServer(task) {
     await validateRoomExports(task, bundlePath);
     const sha256 = (0, node_crypto_1.createHash)("sha256").update((0, node_fs_1.readFileSync)(bundlePath)).digest("hex");
     const manifest = {
-        runtimeVersion: exports.GAME_SERVER_RUNTIME_VERSION,
+        runtimeVersion: serverSdk_1.GAME_SERVER_RUNTIME_VERSION,
         rooms: [...task.server.rooms],
         size,
         sha256,

package/dist/apps/serverSdk.d.ts

@@ -0,0 +1,23 @@
+import type { AppTask } from "../catalogue";
+import { type EnvironmentConfig } from "../environment";
+export declare const GAME_SERVER_RUNTIME_VERSION: "colyseus-0.17-v1";
+export type ServerSdkRelease = {
+    version: string;
+    build: number;
+    runtimeVersion: typeof GAME_SERVER_RUNTIME_VERSION;
+    package: string;
+    sha256: string;
+    dependencies: Record<string, string>;
+};
+export type ServerSdkOptions = {
+    apiBase?: string;
+    environment?: EnvironmentConfig;
+};
+export declare function resolveServerSdkEnvironment(task: AppTask, apiBase?: string): EnvironmentConfig;
+export declare function parseServerSdkRelease(value: unknown, expected: {
+    version: string;
+    build: number;
+}): ServerSdkRelease;
+export declare function resolveActiveServerSdk(environment: EnvironmentConfig): Promise<ServerSdkRelease>;
+export declare function verifyGameServerDependencies(task: AppTask, release: ServerSdkRelease): void;
+export declare function ensureGameServerSdk(task: AppTask, options?: ServerSdkOptions): Promise<ServerSdkRelease | null>;

package/dist/apps/serverSdk.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GAME_SERVER_RUNTIME_VERSION = void 0;
+exports.resolveServerSdkEnvironment = resolveServerSdkEnvironment;
+exports.parseServerSdkRelease = parseServerSdkRelease;
+exports.resolveActiveServerSdk = resolveActiveServerSdk;
+exports.verifyGameServerDependencies = verifyGameServerDependencies;
+exports.ensureGameServerSdk = ensureGameServerSdk;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const config_1 = require("../config");
+const environment_1 = require("../environment");
+const workspaceAuth_1 = require("../workspaceAuth");
+const npmProcess_1 = require("../commands/npmProcess");
+exports.GAME_SERVER_RUNTIME_VERSION = "colyseus-0.17-v1";
+const PACKAGE_NAMES = ["@colyseus/core", "@colyseus/schema", "@playdrop/server", "colyseus", "mongodb", "typescript"];
+const VERSION = /^\d+\.\d+\.\d+$/u;
+const MAX_ARCHIVE_BYTES = 20 * 1024 * 1024;
+function resolveServerSdkEnvironment(task, apiBase) {
+    const workspace = (0, workspaceAuth_1.findWorkerTaskWorkspaceAuthConfig)(task.projectDir) ?? (0, workspaceAuth_1.findWorkspaceAuthConfig)(task.projectDir);
+    const preferred = (0, environment_1.resolveEnvironmentConfig)(workspace?.config.env ?? (0, config_1.loadConfig)().env ?? "prod");
+    if (!preferred)
+        throw new Error("server_sdk_environment_invalid");
+    if (!apiBase || preferred.apiBase === apiBase.replace(/\/$/u, ""))
+        return preferred;
+    for (const name of ["dev", "local", "prod", "preview", "blue", "green"]) {
+        const candidate = (0, environment_1.resolveEnvironmentConfig)(name);
+        if (candidate.apiBase === apiBase.replace(/\/$/u, ""))
+            return candidate;
+    }
+    throw new Error(`server_sdk_environment_unknown:${apiBase}`);
+}
+async function fetchJson(url) {
+    const response = await fetch(url, { cache: "no-store", signal: AbortSignal.timeout(15000) });
+    if (!response.ok)
+        throw new Error(`server_sdk_unavailable:${response.status}:${url}`);
+    return response.json();
+}
+function parseServerSdkRelease(value, expected) {
+    const metadata = value;
+    if (!metadata || metadata.version !== expected.version || metadata.build !== expected.build ||
+        metadata.runtimeVersion !== exports.GAME_SERVER_RUNTIME_VERSION ||
+        metadata.package !== `playdrop-server-${expected.version}.tgz` ||
+        typeof metadata.sha256 !== "string" || !/^[a-f0-9]{64}$/u.test(metadata.sha256) ||
+        !metadata.dependencies || Object.keys(metadata.dependencies).sort().join(",") !== PACKAGE_NAMES.join(",") ||
+        Object.values(metadata.dependencies).some((version) => typeof version !== "string" || !VERSION.test(version)) ||
+        metadata.dependencies["@playdrop/server"] !== expected.version) {
+        throw new Error(`server_sdk_release_mismatch:${expected.version}:${expected.build}`);
+    }
+    return metadata;
+}
+async function resolveActiveServerSdk(environment) {
+    if (!environment.roomsBase || !environment.cdnBase) {
+        throw new Error(`server_sdk_environment_unavailable:${environment.name}:game-server endpoint is not configured`);
+    }
+    // The deployed rooms runtime is authoritative. Client latest.json can be ahead
+    // or behind it while a release is being promoted.
+    const status = await fetchJson(`${environment.roomsBase}/status`);
+    if (typeof status?.status !== "string" || status.runtimeVersion !== exports.GAME_SERVER_RUNTIME_VERSION ||
+        typeof status.sdk?.version !== "string" || !VERSION.test(status.sdk.version) ||
+        !Number.isInteger(status.sdk.build) || status.sdk.build < 1) {
+        throw new Error(`server_sdk_runtime_metadata_missing:${environment.roomsBase}`);
+    }
+    if (status.status !== "ok") {
+        throw new Error(`server_sdk_runtime_unhealthy:${environment.roomsBase}:status=${status.status}` +
+            `,redis=${status.redis?.status ?? "unknown"},mongodb=${status.mongodb?.status ?? "unknown"}` +
+            `,unhealthyAppVersions=${status.colyseus?.unhealthyAppVersions ?? "unknown"}`);
+    }
+    if (environment.name === "prod" && (status.slot !== status.activeSlot || status.acceptingNewRooms !== true)) {
+        throw new Error("server_sdk_runtime_not_active");
+    }
+    const metadata = await fetchJson(`${environment.cdnBase}/sdk/playdrop-server-${status.sdk.version}.json`);
+    return parseServerSdkRelease(metadata, status.sdk);
+}
+function verifyGameServerDependencies(task, release) {
+    if (!task.packageJsonPath)
+        throw new Error("server_package_json_required");
+    for (const [name, expected] of Object.entries(release.dependencies)) {
+        const path = (0, node_path_1.join)(task.projectDir, "node_modules", ...name.split("/"), "package.json");
+        if (!(0, node_fs_1.existsSync)(path))
+            throw new Error(`server_dependency_missing:${name}`);
+        const installed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+        if (installed.name !== name || installed.version !== expected) {
+            throw new Error(`server_dependency_version_mismatch:${name}:expected=${expected}:actual=${installed.version}`);
+        }
+    }
+}
+async function installServerSdk(task, release, cdnBase) {
+    if (!task.packageJsonPath)
+        throw new Error("server_package_json_required: add package.json beside catalogue.json");
+    const archiveRelativePath = `vendor/playdrop/${release.package}`;
+    const archivePath = (0, node_path_1.join)(task.projectDir, archiveRelativePath);
+    const packageJson = JSON.parse((0, node_fs_1.readFileSync)(task.packageJsonPath, "utf8"));
+    const sdkDependency = packageJson.dependencies?.["@playdrop/server"] ?? packageJson.devDependencies?.["@playdrop/server"];
+    const archiveMatches = (0, node_fs_1.existsSync)(archivePath) &&
+        (0, node_crypto_1.createHash)("sha256").update((0, node_fs_1.readFileSync)(archivePath)).digest("hex") === release.sha256;
+    if (archiveMatches && sdkDependency === `file:${archiveRelativePath}` && (0, node_fs_1.existsSync)((0, node_path_1.join)(task.projectDir, "package-lock.json"))) {
+        try {
+            verifyGameServerDependencies(task, release);
+            return;
+        }
+        catch {
+            // The selected SDK is unchanged, but npm ci or a fresh checkout can leave
+            // dependencies missing. Install that same selected release below.
+        }
+    }
+    if (!archiveMatches) {
+        const url = `${cdnBase}/sdk/${release.package}`;
+        const response = await fetch(url, { signal: AbortSignal.timeout(30000) });
+        if (!response.ok)
+            throw new Error(`server_sdk_unavailable:${response.status}:${url}`);
+        const archive = Buffer.from(await response.arrayBuffer());
+        if (archive.length > MAX_ARCHIVE_BYTES)
+            throw new Error("server_sdk_archive_too_large");
+        if ((0, node_crypto_1.createHash)("sha256").update(archive).digest("hex") !== release.sha256) {
+            throw new Error(`server_sdk_integrity_mismatch:${release.package}`);
+        }
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(task.projectDir, "vendor", "playdrop"), { recursive: true });
+        (0, node_fs_1.writeFileSync)(archivePath, archive);
+    }
+    const dependencies = Object.entries(release.dependencies)
+        .filter(([name]) => name !== "@playdrop/server")
+        .map(([name, version]) => `${name}@${version}`);
+    const invocation = (0, npmProcess_1.resolveNpmInvocation)([
+        "install", "--ignore-scripts", "--no-audit", "--no-fund", "--save-exact", `./${archiveRelativePath}`, ...dependencies,
+    ]);
+    console.log(`[server-sdk] Installing platform SDK ${release.version} (build ${release.build})`);
+    await new Promise((resolveInstall, rejectInstall) => {
+        const child = (0, node_child_process_1.spawn)(invocation.command, invocation.args, { cwd: task.projectDir, stdio: "inherit" });
+        child.once("error", rejectInstall);
+        child.once("close", (code) => code === 0 ? resolveInstall() :
+            rejectInstall(new Error(`server_sdk_install_failed:${code}: ${release.version}`)));
+    });
+    verifyGameServerDependencies(task, release);
+}
+// One selection per command and environment. Rebuilding a running dev game must
+// not silently change its SDK after a platform release.
+const preparations = new Map();
+async function ensureGameServerSdk(task, options = {}) {
+    if (!task.server)
+        return null;
+    const environment = options.environment ?? resolveServerSdkEnvironment(task, options.apiBase);
+    const key = JSON.stringify([(0, node_path_1.resolve)(task.projectDir), environment.roomsBase, environment.cdnBase]);
+    let preparation = preparations.get(key);
+    if (!preparation) {
+        preparation = (async () => {
+            const release = await resolveActiveServerSdk(environment);
+            await installServerSdk(task, release, environment.cdnBase);
+            return release;
+        })();
+        preparations.set(key, preparation);
+        preparation.catch(() => preparations.delete(key));
+    }
+    return preparation;
+}

package/dist/apps/upload.d.ts

@@ -3,6 +3,8 @@ import type { AgentTaskPlaytestProof, FinalizeAppUploadRequest, UserResponse } f
 import type { AppTask } from "../catalogue";
 import type { TaskCaptureSession } from "../appUrls";
 import type { AppBuildArtifacts } from "./build";
+import { type GameServerBuild } from "./serverBuild";
+import type { GameServerDevServices } from "../commands/devGameServer";
 export type AppUploadResult = {
     fileUnchanged?: boolean;
     metadataUnchanged?: boolean;
@@ -13,16 +15,16 @@ export type AppUploadResult = {
     versionNodeId?: string;
 };
 export type AppUploadOptions = {
+    apiBase?: string;
     skipReview?: boolean;
     clearTags?: boolean;
     creatorUsername?: string;
     token?: string | null;
     user?: UserResponse | null;
-    runStagedUploadLoadCheck?: boolean;
+    gameServerDev?: GameServerDevServices;
     loadCheckTimeoutMs?: number;
     agentTaskId?: number;
     playtestProof?: AgentTaskPlaytestProof;
-    playtestSmokeCheckRequired?: boolean;
     captureSession?: TaskCaptureSession | null;
     prepareGitTransition?: (input: {
         appId: number;
@@ -70,7 +72,11 @@ type PreparedOwnedAssetUpload = {
 type PreparedAppUploadFiles = {
     sessionFiles: PreparedSessionFile[];
     ownedAssets: PreparedOwnedAssetUpload[];
+    gameServerBuild: GameServerBuild | null;
 };
-export declare function prepareAppUploadFiles(task: AppTask, artifacts: AppBuildArtifacts | null): Promise<PreparedAppUploadFiles>;
+export declare function prepareAppUploadFiles(task: AppTask, artifacts: AppBuildArtifacts | null, options?: {
+    apiBase?: string;
+    client?: ApiClient;
+}): Promise<PreparedAppUploadFiles>;
 export declare function uploadApp(client: ApiClient, task: AppTask, artifacts: AppBuildArtifacts | null, options?: AppUploadOptions): Promise<AppUploadResult>;
 export {};