@playdrop/playdrop-cli 0.17.4 → 0.17.14

package/dist/apps/upload.js

@@ -8,7 +8,10 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const http_1 = require("../http");
+const proceduralValidation_1 = require("../proceduralValidation");
+const game_source_git_1 = require("../commands/worker/game-source-git");
 const serverBuild_1 = require("./serverBuild");
+const publishingRuntime_1 = require("./publishingRuntime");
 const loadCheck_1 = require("./loadCheck");
 const EXTENSION_TO_MIME = {
     ".png": "image/png",
@@ -114,7 +117,8 @@ function createGenericFileFromPath(filePath) {
     const name = (0, node_path_1.basename)(filePath);
     return new File([content], name, { type: resolveMimeType(name) });
 }
-async function prepareOwnedAssetUpload(task) {
+async function prepareOwnedAssetUpload(task, client) {
+    await (0, proceduralValidation_1.assertProceduralAssetIsValid)(task, { client, primaryContentType: resolveMimeType(task.filePaths.primary ?? "") });
     const files = await Promise.all(Object.entries(task.filePaths).map(async ([role, filePath]) => {
         const file = createGenericFileFromPath(filePath);
         const buffer = await bufferFromFile(file);
@@ -174,15 +178,8 @@ function pushPreparedArtifact(task, currentTotal, file, maxBytes, code, label) {
     const bytes = ensurePreparedArtifactSize(file, maxBytes, code, label);
     return accumulateUploadBytes(task.name, currentTotal, bytes);
 }
-async function uploadSignedObject(client, creatorUsername, appName, sessionId, file) {
+async function uploadSignedObject(client, creatorUsername, appName, sessionId, file, descriptor) {
     for (let attempt = 0; attempt < 2; attempt += 1) {
-        const signed = await client.signAppUploadObjects(creatorUsername, appName, sessionId, {
-            objectIds: [file.id],
-        });
-        const descriptor = signed.uploads.find((entry) => entry.id === file.id);
-        if (!descriptor) {
-            throw new Error(`app_upload_signed_object_missing:${file.id}`);
-        }
         const response = await fetch(descriptor.url, {
             method: descriptor.method,
             headers: descriptor.headers,
@@ -192,6 +189,14 @@ async function uploadSignedObject(client, creatorUsername, appName, sessionId, f
             return;
         }
         if ((response.status === 401 || response.status === 403) && attempt === 0) {
+            const signed = await client.signAppUploadObjects(creatorUsername, appName, sessionId, {
+                objectIds: [file.id],
+            });
+            const refreshed = signed.uploads.find((entry) => entry.id === file.id);
+            // Signing omits objects whose stored bytes already match the manifest.
+            if (!refreshed)
+                return;
+            descriptor = refreshed;
             continue;
         }
         const detail = (await response.text()).trim();
@@ -199,21 +204,30 @@ async function uploadSignedObject(client, creatorUsername, appName, sessionId, f
     }
 }
 async function uploadSignedObjects(client, creatorUsername, appName, sessionId, files) {
-    let cursor = 0;
-    const workers = Array.from({ length: Math.min(8, files.length) }, async () => {
-        while (cursor < files.length) {
-            const index = cursor;
-            cursor += 1;
-            await uploadSignedObject(client, creatorUsername, appName, sessionId, files[index]);
-        }
-    });
-    await Promise.all(workers);
+    for (let offset = 0; offset < files.length; offset += 100) {
+        const batch = files.slice(offset, offset + 100);
+        const signed = await client.signAppUploadObjects(creatorUsername, appName, sessionId, {
+            objectIds: batch.map((file) => file.id),
+        });
+        const descriptors = new Map(signed.uploads.map((entry) => [entry.id, entry]));
+        let cursor = 0;
+        const workers = Array.from({ length: Math.min(8, batch.length) }, async () => {
+            while (cursor < batch.length) {
+                const file = batch[cursor++];
+                const descriptor = descriptors.get(file.id);
+                // A missing descriptor means the API verified this object is stored.
+                if (descriptor)
+                    await uploadSignedObject(client, creatorUsername, appName, sessionId, file, descriptor);
+            }
+        });
+        await Promise.all(workers);
+    }
 }
-async function prepareAppUploadFiles(task, artifacts) {
+async function prepareAppUploadFiles(task, artifacts, options = {}) {
     let totalUploadBytes = 0;
     const listing = task.listing;
     const sessionFiles = [];
-    const ownedAssets = await Promise.all(task.ownedAssets.map((ownedAsset) => prepareOwnedAssetUpload(ownedAsset)));
+    const ownedAssets = await Promise.all(task.ownedAssets.map((ownedAsset) => prepareOwnedAssetUpload(ownedAsset, options.client)));
     for (const ownedAsset of ownedAssets) {
         for (const file of ownedAsset.files) {
             totalUploadBytes = accumulateUploadBytes(task.name, totalUploadBytes, file.sizeBytes);
@@ -241,7 +255,7 @@ async function prepareAppUploadFiles(task, artifacts) {
             sessionFiles.push(await buildPreparedSessionFile("SOURCE", "source.zip", artifacts.sourceFile));
         }
     }
-    const gameServer = await (0, serverBuild_1.buildGameServer)(task);
+    const gameServer = await (0, serverBuild_1.buildGameServer)(task, options);
     if (gameServer) {
         const bundle = createFileFromPath(gameServer.bundlePath, "application/javascript", serverBuild_1.GAME_SERVER_BUNDLE_MAX_BYTES, "server_bundle_too_large", "invalid_server_bundle", "Game server bundle");
         const manifest = createFileFromPath(gameServer.manifestPath, "application/json", 16 * 1024, "server_manifest_too_large", "invalid_server_manifest", "Game server manifest");
@@ -289,7 +303,7 @@ async function prepareAppUploadFiles(task, artifacts) {
         totalUploadBytes = pushPreparedFile(task.name, totalUploadBytes, prepared);
         sessionFiles.push(await buildPreparedSessionFile("LISTING", `listing/videos/landscape/${index}.mp4`, prepared.file));
     }
-    return { sessionFiles, ownedAssets };
+    return { sessionFiles, ownedAssets, gameServerBuild: gameServer };
 }
 async function uploadApp(client, task, artifacts, options) {
     // Version is required - no legacy fallback
@@ -310,7 +324,23 @@ async function uploadAppVersion(client, task, artifacts, options) {
     const achievements = task.achievements ?? [];
     const leaderboards = task.leaderboards ?? [];
     const listing = task.listing;
-    const { sessionFiles: preparedSessionFiles, ownedAssets: preparedOwnedAssets } = await prepareAppUploadFiles(task, artifacts);
+    // Preparation builds the server. Freeze its inputs first, then include the
+    // generated server files in the snapshot checked before source publication.
+    const inputFingerprint = options?.prepareGitTransition
+        ? await (0, game_source_git_1.fingerprintGameSourcePublication)(task.projectDir, false)
+        : null;
+    const assertPublicationUnchanged = async (expected, includeServerOutput = true) => {
+        if (expected !== null &&
+            await (0, game_source_git_1.fingerprintGameSourcePublication)(task.projectDir, includeServerOutput) !== expected) {
+            throw new Error("task_output_changed_during_upload: Source or build files changed after upload preparation started. " +
+                "The prepared upload does not match the project; finish edits and checks before retrying.");
+        }
+    };
+    const { sessionFiles: preparedSessionFiles, ownedAssets: preparedOwnedAssets, gameServerBuild } = await prepareAppUploadFiles(task, artifacts, { apiBase: options?.apiBase, client });
+    await assertPublicationUnchanged(inputFingerprint, false);
+    const publicationFingerprint = options?.prepareGitTransition
+        ? await (0, game_source_git_1.fingerprintGameSourcePublication)(task.projectDir)
+        : null;
     const preparedOwnedAssetFiles = preparedOwnedAssets.flatMap((ownedAsset) => ownedAsset.files.map((file) => ({
         id: file.objectId,
         role: "OWNED_ASSET",
@@ -424,13 +454,22 @@ async function uploadAppVersion(client, task, artifacts, options) {
         })),
     };
     let sessionId = null;
+    let publishingRuntime = null;
     try {
         const initialized = await client.initializeAppUpload(creatorUsername, task.name, initializeRequest);
         sessionId = initialized.session.id;
         if (initialized.status !== "finalized") {
             const missingIds = new Set(initialized.missingObjectIds);
             await uploadSignedObjects(client, creatorUsername, task.name, sessionId, preparedObjects.filter((file) => missingIds.has(file.id)));
-            if (task.hostingMode !== "EXTERNAL" && !task.externalUrl && options?.playtestSmokeCheckRequired) {
+            if (gameServerBuild) {
+                publishingRuntime = await (0, publishingRuntime_1.startPublishingRuntime)({
+                    client, task, creatorUsername, appId: initialized.session.appId, sessionId,
+                    apiBase: options?.apiBase, gameServerBuild, gameServerDev: options?.gameServerDev,
+                });
+            }
+            // These checks are part of publishing, not optional Cloud-only policy.
+            // A declared playtest tape always runs, regardless of who built the game.
+            if (task.hostingMode !== "EXTERNAL" && !task.externalUrl && task.playtestTapes) {
                 await (0, loadCheck_1.runUploadedHostedPlaytestSmokeCheck)({
                     client,
                     creatorUsername,
@@ -440,9 +479,10 @@ async function uploadAppVersion(client, task, artifacts, options) {
                     token: options?.token ?? null,
                     currentUser: options?.user ?? null,
                     captureSession: options?.captureSession,
+                    localDevPort: publishingRuntime?.localDevPort,
                 });
             }
-            else if (task.hostingMode !== "EXTERNAL" && !task.externalUrl && options?.runStagedUploadLoadCheck) {
+            else if (task.hostingMode !== "EXTERNAL" && !task.externalUrl) {
                 const loadCheck = await (0, loadCheck_1.runUploadedHostedLoadCheck)({
                     client,
                     creatorUsername,
@@ -452,6 +492,7 @@ async function uploadAppVersion(client, task, artifacts, options) {
                     token: options?.token ?? null,
                     currentUser: options?.user ?? null,
                     captureSession: options?.captureSession,
+                    localDevPort: publishingRuntime?.localDevPort,
                 });
                 if (loadCheck.status !== "PASSED") {
                     throw new Error((0, loadCheck_1.formatHostedLoadCheckFailure)(task.name, loadCheck, "staged"));
@@ -467,6 +508,7 @@ async function uploadAppVersion(client, task, artifacts, options) {
                     token: options?.token ?? null,
                     currentUser: options?.user ?? null,
                     captureSession: options?.captureSession,
+                    localDevPort: publishingRuntime?.localDevPort,
                     phase: "editor",
                     verifyEditorPhaseRoundTrip: true,
                 });
@@ -475,6 +517,7 @@ async function uploadAppVersion(client, task, artifacts, options) {
                 }
             }
         }
+        await assertPublicationUnchanged(publicationFingerprint);
         const gitTransition = !options?.prepareGitTransition
             ? undefined
             : await options.prepareGitTransition({
@@ -554,4 +597,7 @@ async function uploadAppVersion(client, task, artifacts, options) {
         }
         throw unknownError;
     }
+    finally {
+        await publishingRuntime?.close();
+    }
 }

package/dist/apps/validate.d.ts

@@ -1,5 +1,6 @@
 import type { AppTask } from "../catalogue";
+import { type ServerSdkOptions } from "./serverSdk";
 export type AppValidationWarningMode = "source" | "bundle";
 export declare function collectAppValidationWarnings(task: AppTask, _mode?: AppValidationWarningMode): string[];
 export declare function runFormatScript(task: AppTask): Promise<boolean>;
-export declare function validateAppTask(task: AppTask): Promise<void>;
+export declare function validateAppTask(task: AppTask, options?: ServerSdkOptions): Promise<void>;

package/dist/apps/validate.js

@@ -8,6 +8,7 @@ const node_path_1 = require("node:path");
 const semver_1 = require("semver");
 const clientInfo_1 = require("../clientInfo");
 const build_1 = require("./build");
+const serverSdk_1 = require("./serverSdk");
 const projectValidateCache = new Map();
 const projectFormatCache = new Map();
 function ensureWithinProject(task) {
@@ -86,7 +87,7 @@ async function runFormatScript(task) {
     await projectFormatCache.get(task.projectDir);
     return true;
 }
-async function validateAppTask(task) {
+async function validateAppTask(task, options = {}) {
     if (!task.name) {
         throw new Error("[apps][validate] App entry is missing a name.");
     }
@@ -109,6 +110,7 @@ async function validateAppTask(task) {
         throw new Error(`[apps][validate] ${task.name} is missing a required "validate" script in package.json. Define a validate command (for example "validate": "npm run build").`);
     }
     ensureWithinProject(task);
+    await (0, serverSdk_1.ensureGameServerSdk)(task, options);
     if (!task.isTypescriptProject) {
         if (!(0, node_fs_1.existsSync)(task.filePath)) {
             throw new Error(`[apps][validate] Bundle not found for ${task.name}: ${task.relativeFile}. Run the app build locally before uploading.`);

package/dist/assetSpecs.js

@@ -30,6 +30,8 @@ const LOCAL_EXTENSION_TO_MIME = {
     ".gltf": "model/gltf+json",
     ".glb": "model/gltf-binary",
     ".json": "application/json",
+    ".js": "text/javascript",
+    ".mjs": "text/javascript",
     ".md": "text/markdown",
     ".txt": "text/plain",
 };

package/dist/commandContext.js

@@ -186,13 +186,15 @@ async function loadWorkspaceAwareConfig(command, options) {
     let workspaceAuth = null;
     const workspacePath = options.workspacePath ?? (process.env.PLAYDROP_WORKER_CONTEXT === "1" ? process.cwd() : undefined);
     try {
-        workspaceAuth = workspacePath ? (0, workspaceAuth_1.findWorkspaceAuthConfig)(workspacePath) : null;
-        if (!workspaceAuth && workspacePath && process.env.PLAYDROP_WORKER_CONTEXT === "1") {
-            workspaceAuth = (0, workspaceAuth_1.findWorkerTaskWorkspaceAuthConfig)(workspacePath);
-        }
+        workspaceAuth = workspacePath && process.env.PLAYDROP_WORKER_CONTEXT === "1"
+            ? (0, workspaceAuth_1.findWorkerTaskWorkspaceAuthConfig)(workspacePath)
+            : workspacePath ? (0, workspaceAuth_1.findWorkspaceAuthConfig)(workspacePath) : null;
     }
     catch (error) {
         if (error instanceof workspaceAuth_1.WorkspaceAuthConfigError) {
+            if (process.env.PLAYDROP_WORKER_CONTEXT === "1") {
+                throw new Error(`worker_task_context_invalid:${error.filePath}: expected the assigned protocolVersion 2 task document with task credentials and metadata.playdrop.creatorUsername`);
+            }
             (0, messages_1.printErrorWithHelp)(`Invalid .playdrop.json at ${error.filePath}.`, ["The file must be valid JSON.", 'It must include a non-empty "ownerUsername" string.'], { command });
             process.exitCode = 1;
             return null;
@@ -421,12 +423,28 @@ async function withEnvironment(command, actionLabel, callback, options = {}) {
     await callback(ctx);
 }
 async function withPublicEnvironment(command, callback, options = {}) {
+    if (process.env.PLAYDROP_WORKER_CONTEXT === "1") {
+        const resolved = await resolveAuthenticatedEnvironment(command, "Cloud content access", {
+            workspacePath: process.cwd(),
+            env: options.env,
+        });
+        if (!resolved)
+            return;
+        const task = resolved.workspaceAuth?.config;
+        if (!task?.taskToken || !task.taskId || !task.taskAttempt) {
+            throw new Error("worker_task_context_missing: run this command inside the assigned Cloud task workspace");
+        }
+        if (task.env !== resolved.envConfig.name) {
+            throw new Error(`worker_task_environment_mismatch: this task uses ${task.env}`);
+        }
+        // Task credentials are checked by the server and cannot be refreshed through account login.
+        await callback(buildContext(resolved.cfg, resolved.envConfig, resolved.account, resolved.workspaceAuth));
+        return;
+    }
     const cfg = (0, config_1.loadConfig)();
-    const currentAccount = (0, config_1.getCurrentAccountSession)(cfg);
-    const requestedEnv = options.env?.trim();
-    const account = requestedEnv && currentAccount
-        ? (0, config_1.findAccountSession)(currentAccount.username, requestedEnv, cfg)
-        : currentAccount;
+    const currentAccount = (0, config_1.getCurrentAccountSession)(cfg) ?? buildLegacyAccountSession(cfg);
+    const requestedEnv = normalizeRequestedEnv(options.env);
+    const account = resolveRequestedCurrentAccount(cfg, currentAccount, requestedEnv);
     const envConfig = resolveConfiguredEnvironment(requestedEnv ?? account?.env ?? cfg.env, command, {
         requireAuth: false,
         allowDefaultPublicEnv: true,
@@ -434,5 +452,11 @@ async function withPublicEnvironment(command, callback, options = {}) {
     if (!envConfig) {
         return;
     }
-    await callback(buildContext(cfg, envConfig, account));
+    if (currentAccount && !account) {
+        (0, messages_1.printErrorWithHelp)(`${currentAccount.username || "This CLI session"} is not logged in on ${requestedEnv}.`, [`Run "playdrop auth login --env ${requestedEnv}" to authenticate in that environment.`], { command });
+        process.exitCode = 1;
+        return;
+    }
+    const refreshedAccount = account ? await refreshStoredAccountSession({ account, envConfig }) : null;
+    await callback(buildContext(refreshedAccount ? (0, config_1.loadConfig)() : cfg, envConfig, refreshedAccount));
 }

package/dist/commands/build.js

@@ -5,6 +5,7 @@ const taskSelection_1 = require("../taskSelection");
 const taskUtils_1 = require("../taskUtils");
 const uploadLog_1 = require("../uploadLog");
 const apps_1 = require("../apps");
+const serverBuild_1 = require("../apps/serverBuild");
 async function build(pathOrName) {
     const selection = (0, taskSelection_1.selectTasks)(pathOrName);
     if (selection.errors.length > 0) {
@@ -26,7 +27,8 @@ async function build(pathOrName) {
             if (task.kind === "app") {
                 await (0, apps_1.validateAppTask)(task);
                 const artifacts = await (0, apps_1.buildApp)(task);
-                detail = `bundleHash=${artifacts.bundleHash}`;
+                const server = await (0, serverBuild_1.buildGameServer)(task);
+                detail = `bundleHash=${artifacts.bundleHash}${server ? ` serverHash=${server.manifest.sha256}` : ""}`;
             }
             else {
                 throw new Error(`project build does not support ${task.kind} "${entityId}".`);

package/dist/commands/create.js

@@ -17,7 +17,7 @@ const node_process_1 = require("node:process");
 const promises_1 = __importDefault(require("node:readline/promises"));
 const catalogue_1 = require("../catalogue");
 const catalogue_utils_1 = require("../catalogue-utils");
-const clientInfo_1 = require("../clientInfo");
+const apiClient_1 = require("../apiClient");
 const commandContext_1 = require("../commandContext");
 const http_1 = require("../http");
 const listingPreflight_1 = require("../listingPreflight");
@@ -30,26 +30,45 @@ const taskCaptureSession_1 = require("./taskCaptureSession");
 const CATALOGUE_FILENAME = "catalogue.json";
 const LEGACY_CATALOGUE_VERSION_KEY = ["schema", "Version"].join("");
 const ALLOWED_CATALOGUE_TOP_LEVEL_KEYS = new Set(["apps", "assetSpecs", "assets", "assetPacks"]);
-function buildArchiveDownloadHeaders(url, apiBase, token) {
-    const targetUrl = new URL(url, apiBase);
-    const apiOrigin = new URL(apiBase).origin;
+function buildArchiveDownloadHeaders(url, ctx) {
+    const targetUrl = new URL(url, ctx.envConfig.apiBase);
+    const apiOrigin = new URL(ctx.envConfig.apiBase).origin;
     if (targetUrl.origin !== apiOrigin) {
         return undefined;
     }
-    const headers = new Headers((0, clientInfo_1.createClientHeaders)());
-    if (token.trim().length > 0) {
-        headers.set("authorization", `Bearer ${token}`);
+    const workspaceAuth = ctx.workspaceAuth?.config;
+    const headers = new Headers((0, apiClient_1.createCliClientHeaders)({
+        onBehalfCreatorUsername: workspaceAuth?.ownerUsername,
+        agentTaskToken: workspaceAuth?.taskToken,
+        agentTaskId: workspaceAuth?.taskId,
+        agentTaskAttempt: workspaceAuth?.taskAttempt,
+    }));
+    if (ctx.token.trim().length > 0) {
+        headers.set("authorization", `Bearer ${ctx.token}`);
     }
     return headers;
 }
-async function downloadArchive(url, apiBase, token) {
-    const headers = buildArchiveDownloadHeaders(url, apiBase, token);
-    const response = await fetch(url, headers ? { headers } : undefined);
-    if (!response.ok) {
-        throw new Error(`Failed to download project archive (${response.status})`);
-    }
-    const buffer = await response.arrayBuffer();
-    return new Uint8Array(buffer);
+async function downloadArchive(url, ctx) {
+    let downloadUrl = url;
+    for (let redirects = 0; redirects <= 20; redirects += 1) {
+        const headers = buildArchiveDownloadHeaders(downloadUrl, ctx);
+        // Recompute headers on each hop: Fetch forwards custom task headers across origins.
+        const response = await fetch(downloadUrl, { redirect: "manual", ...(headers ? { headers } : {}) });
+        if ([301, 302, 303, 307, 308].includes(response.status)) {
+            const location = response.headers.get("location");
+            await response.body?.cancel();
+            if (!location)
+                throw new Error("Project archive redirect is missing its location.");
+            downloadUrl = new URL(location, downloadUrl).toString();
+            continue;
+        }
+        if (!response.ok) {
+            throw new Error(`Failed to download project archive (${response.status})`);
+        }
+        const buffer = await response.arrayBuffer();
+        return new Uint8Array(buffer);
+    }
+    throw new Error("Too many project archive redirects.");
 }
 function resolveArchiveDownloadUrl(url, apiBase) {
     return new URL(url, apiBase).toString();
@@ -1043,7 +1062,7 @@ async function create(name, options = {}) {
             }
         }
         try {
-            const archiveBuffer = await downloadArchive(resolveArchiveDownloadUrl(scaffold.archiveUrl, ctx.envConfig.apiBase), ctx.envConfig.apiBase, ctx.token);
+            const archiveBuffer = await downloadArchive(resolveArchiveDownloadUrl(scaffold.archiveUrl, ctx.envConfig.apiBase), ctx);
             const extraction = extractProjectArchive(archiveBuffer, projectDir);
             writeCreatedProjectWorkspaceAuth(projectDir, ctx);
             const extractedCatalogue = (0, node_path_1.resolve)(projectDir, CATALOGUE_FILENAME);

package/dist/commands/dev.js

@@ -19,6 +19,7 @@ const devServer_1 = require("./devServer");
 const tweakStaleness_1 = require("../tweakStaleness");
 const devShared_1 = require("./devShared");
 const devGameServer_1 = require("./devGameServer");
+const taskCaptureSession_1 = require("./taskCaptureSession");
 function formatDevRuntimeAssetManifestFailure(error) {
     const rawMessage = error instanceof Error ? error.message : String(error ?? "unknown_error");
     if (rawMessage.startsWith("dev_runtime_asset_ref_invalid:")) {
@@ -265,6 +266,15 @@ async function dev(targetArg, appOption, devOptions = {}) {
                 throw error;
             }
         }
+        let captureSession;
+        try {
+            captureSession = (0, taskCaptureSession_1.resolveTaskCaptureSession)(workspaceAuth, registeredApp);
+        }
+        catch (error) {
+            (0, messages_1.printErrorWithHelp)(error instanceof Error ? error.message : "Worker capture session is invalid.", ["Run this command from the active worker task workspace."], { command: "project dev" });
+            process.exitCode = 1;
+            return;
+        }
         const projectInfo = (0, devShared_1.findProjectInfo)(filePath);
         const devScriptAvailable = Boolean(projectInfo.projectDir && projectInfo.packageJson && typeof projectInfo.packageJson.scripts?.dev === "string");
         const taskLookup = (0, catalogue_1.findAppTaskByFile)(filePath);
@@ -407,6 +417,7 @@ async function dev(targetArg, appOption, devOptions = {}) {
                 appType: appTypeSlug,
                 appName,
                 localDevPort: devRouterPort === devServer_1.DEV_ROUTER_PORT ? null : devRouterPort,
+                captureSession,
             }), devAuthSelection);
             console.log("\nTest your app at:");
             console.log(`  ${iframeUrl}`);

package/dist/commands/devGameServer.d.ts

@@ -7,10 +7,18 @@ export interface DevGameServerHandle {
     port: number;
     build: GameServerBuild;
 }
+export type GameServerDevServices = {
+    redisUrl: string;
+    mongoUrl: string;
+    redisNamespace: string;
+};
 export declare function isValidDevRedisNamespace(namespace: string): boolean;
+export declare function reserveLocalGameServerPort(): Promise<number>;
 export declare function startDevGameServer(input: {
     task: AppTask;
     credential: DevGameServerCredentialResponse;
     platformApiUrl: string;
     publicAddress: string;
+    gameServerDev?: GameServerDevServices;
+    gameServerBuild?: GameServerBuild;
 }): Promise<DevGameServerHandle | null>;

package/dist/commands/devGameServer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isValidDevRedisNamespace = isValidDevRedisNamespace;
+exports.reserveLocalGameServerPort = reserveLocalGameServerPort;
 exports.startDevGameServer = startDevGameServer;
 const node_child_process_1 = require("node:child_process");
 const node_module_1 = require("node:module");
@@ -11,7 +12,7 @@ const serverBuild_1 = require("../apps/serverBuild");
 const EXPECTED_REDIS_VERSION = "7.4.5";
 const EXPECTED_MONGODB_VERSION = "8.0.26";
 function isValidDevRedisNamespace(namespace) {
-    return /^colyseus:[a-z0-9_.-]+:[a-z0-9_.-]+:$/u.test(namespace);
+    return /^colyseus:[a-z0-9_.-]+:[a-z0-9_.-]+:(?:upload-[a-zA-Z0-9-]{1,100}:)?$/u.test(namespace);
 }
 function requireServiceUrl(name) {
     const value = process.env[name]?.trim() ?? "";
@@ -126,7 +127,7 @@ async function provisionScopedMongoUrl(mongoUrl, appId) {
         await mongo.close().catch(() => undefined);
     }
 }
-async function reserveLocalPort() {
+async function reserveLocalGameServerPort() {
     const server = (0, node_net_1.createServer)();
     await new Promise((resolveListen, rejectListen) => {
         server.once("error", rejectListen);
@@ -184,25 +185,27 @@ async function waitForReady(child, timeoutMs = 10000) {
 async function startDevGameServer(input) {
     if (!input.task.server)
         return null;
-    const redisUrl = requireServiceUrl("PLAYDROP_DEV_REDIS_URL");
-    const baseMongoUrl = requireServiceUrl("PLAYDROP_DEV_MONGO_URL");
+    const redisUrl = input.gameServerDev ? input.gameServerDev.redisUrl : requireServiceUrl("PLAYDROP_DEV_REDIS_URL");
+    const baseMongoUrl = input.gameServerDev ? input.gameServerDev.mongoUrl : requireServiceUrl("PLAYDROP_DEV_MONGO_URL");
     const workerScoped = process.env.PLAYDROP_WORKER_CONTEXT === "1";
-    const redisNamespace = process.env.PLAYDROP_DEV_REDIS_NAMESPACE?.trim() ||
-        `colyseus:${input.credential.environment}:${input.credential.deploymentId}:`;
+    const redisNamespace = input.gameServerDev
+        ? input.gameServerDev.redisNamespace
+        : process.env.PLAYDROP_DEV_REDIS_NAMESPACE?.trim() ||
+            `colyseus:${input.credential.environment}:${input.credential.deploymentId}:`;
     if (!isValidDevRedisNamespace(redisNamespace)) {
         throw new Error("playdrop_dev_redis_namespace_invalid");
     }
-    const scopedMongoUrl = workerScoped
+    const scopedMongoUrl = input.gameServerDev || workerScoped
         ? baseMongoUrl
         : await provisionScopedMongoUrl(baseMongoUrl, input.credential.appId);
     await Promise.all([
         verifyRedis(redisUrl, redisNamespace),
         verifyScopedMongoUrl(scopedMongoUrl),
     ]);
-    const build = await (0, serverBuild_1.buildGameServer)(input.task);
+    const build = input.gameServerBuild ?? await (0, serverBuild_1.buildGameServer)(input.task, { apiBase: input.platformApiUrl });
     if (!build)
         throw new Error("server_build_missing");
-    const port = await reserveLocalPort();
+    const port = await reserveLocalGameServerPort();
     const runtimeEntry = resolveDevRuntimeEntry(input.task);
     const child = (0, node_child_process_1.spawn)(process.execPath, ["--max-old-space-size=192", runtimeEntry], {
         cwd: input.task.projectDir,

package/dist/commands/devServer.d.ts

@@ -37,6 +37,7 @@ export declare function buildLocalDevAppUrl(input: {
 }): string;
 export declare function terminateChildProcessTree(child: ChildProcess | null, timeoutMs?: number): Promise<void>;
 export declare function ensureDevRouterRunning(port?: number): Promise<void>;
+export declare function startOwnedDevRouter(port: number): Promise<ChildProcess>;
 export declare function resolveDevRouterWorkingDirectory(cliEntrypoint: string): string;
 export declare function updateMountedDevRuntimeAssetManifest(input: {
     creatorUsername: string;

package/dist/commands/devServer.js

@@ -8,6 +8,7 @@ exports.parseMountConflictError = parseMountConflictError;
 exports.buildLocalDevAppUrl = buildLocalDevAppUrl;
 exports.terminateChildProcessTree = terminateChildProcessTree;
 exports.ensureDevRouterRunning = ensureDevRouterRunning;
+exports.startOwnedDevRouter = startOwnedDevRouter;
 exports.resolveDevRouterWorkingDirectory = resolveDevRouterWorkingDirectory;
 exports.updateMountedDevRuntimeAssetManifest = updateMountedDevRuntimeAssetManifest;
 exports.startDevServer = startDevServer;
@@ -25,7 +26,11 @@ exports.DEV_ROUTER_PORT = 8888;
 const DEV_ROUTER_HOST = "127.0.0.1";
 const CONTROL_PREFIX = "/_playdrop";
 const DEV_ROUTER_PROTOCOL_VERSION = 4;
-const APPROVED_PLAYDROP_WEB_ORIGINS = new Set(["https://playdrop.ai", "https://www.playdrop.ai"]);
+const APPROVED_PLAYDROP_ROUTER_ORIGINS = new Set([
+    "https://playdrop.ai",
+    "https://www.playdrop.ai",
+    "https://assets.playdrop.ai",
+]);
 const CONTENT_TYPE_BY_EXTENSION = {
     ".html": "text/html; charset=utf-8",
     ".js": "application/javascript; charset=utf-8",
@@ -58,7 +63,7 @@ function resolveApprovedDevRouterOrigin(originHeader) {
     catch {
         return null;
     }
-    if (APPROVED_PLAYDROP_WEB_ORIGINS.has(parsedOrigin.origin)) {
+    if (APPROVED_PLAYDROP_ROUTER_ORIGINS.has(parsedOrigin.origin)) {
         return parsedOrigin.origin;
     }
     const isLocalWebOrigin = (parsedOrigin.protocol === "http:" || parsedOrigin.protocol === "https:") &&
@@ -267,6 +272,10 @@ function proxyRoomsRequest(req, res, target) {
     }, (upstream) => {
         res.statusCode = upstream.statusCode ?? 502;
         for (const [name, value] of Object.entries(upstream.headers)) {
+            // The loopback router owns its exact origin policy, including credentialed
+            // Colyseus requests. An upstream wildcard must not replace that policy.
+            if (name.startsWith("access-control-") || name === "vary")
+                continue;
             if (value !== undefined)
                 res.setHeader(name, value);
         }
@@ -524,6 +533,13 @@ async function ensureDevRouterRunning(port = exports.DEV_ROUTER_PORT) {
         }
         throw new Error(`dev_router_incompatible:port_${port}`);
     }
+    await startOwnedDevRouter(port);
+}
+// Publication checks retain this handle and stop only their own router.
+// Ordinary project dev intentionally keeps its shared router running.
+async function startOwnedDevRouter(port) {
+    if (await fetchRouterHealth(port))
+        throw new Error(`publishing_dev_router_port_in_use:${port}`);
     const cliEntrypoint = getCliEntrypointPath();
     const childEnv = { ...process.env };
     delete childEnv.PLAYDROP_WORKER_CONTEXT;
@@ -541,10 +557,11 @@ async function ensureDevRouterRunning(port = exports.DEV_ROUTER_PORT) {
     while (Date.now() < deadline) {
         const health = await fetchRouterHealth(port, 250);
         if (health && isCompatibleRouterHealth(health)) {
-            return;
+            return child;
         }
         await new Promise((resolveTimeout) => setTimeout(resolveTimeout, 150));
     }
+    await terminateChildProcessTree(child);
     throw new Error("dev_router_start_failed");
 }
 function resolveDevRouterWorkingDirectory(cliEntrypoint) {
@@ -703,6 +720,7 @@ function createDevRouterServer(initialPort = exports.DEV_ROUTER_PORT) {
         const allowedOrigin = resolveApprovedDevRouterOrigin(typeof req.headers.origin === "string" ? req.headers.origin : undefined);
         if (allowedOrigin) {
             res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
+            res.setHeader("Access-Control-Allow-Credentials", "true");
         }
         res.setHeader("Vary", "Origin");
         res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");

package/dist/commands/source.d.ts

@@ -1,4 +1,6 @@
-type SourceKind = "asset" | "pack";
+import { type GameSourceLockEntry } from "@playdrop/game-source-git";
+import { type WorkerReadGameSourceFilesResponse } from "@playdrop/types";
+type SourceKind = "app" | "asset" | "pack";
 type ExactSourceRef = {
     kind: SourceKind;
     creator: string;
@@ -8,11 +10,17 @@ type ExactSourceRef = {
 export declare function parseExactSourceRef(raw: string, expectedKind: SourceKind): ExactSourceRef;
 export declare function prepareDestination(path: string): string;
 export declare function extractArchive(bytes: Uint8Array, destination: string): number;
-export declare function showExactContentDetail(kind: SourceKind, rawRef: string, options?: {
+export declare function extractGitSource(bytes: Uint8Array, destination: string, options: {
+    version: string;
+    commitSha: string;
+    workerHomeDir: string;
+    readFiles: (files: GameSourceLockEntry[]) => Promise<WorkerReadGameSourceFilesResponse>;
+}): Promise<number>;
+export declare function showExactContentDetail(kind: Exclude<SourceKind, "app">, rawRef: string, options?: {
     env?: string;
     json?: boolean;
 }): Promise<void>;
-export declare function downloadContentSource(kind: SourceKind, rawRef: string, directory: string | undefined, options?: {
+export declare function downloadContentSource(kind: SourceKind, rawRef: string, directory?: string, options?: {
     env?: string;
     json?: boolean;
 }): Promise<void>;