@uzuhq/code-cli 0.5.6 → 0.5.8

package/dist/cli.js

@@ -1,326 +1,2521 @@
 #!/usr/bin/env node
-/**
- * @docs
- * - ゲーム仕様: docs/docs/uzu_code/games.md
- * - システム全体像: docs/docs/uzu_code/overview.md
- */
-import { Command, Option } from 'commander';
-import { execSync } from 'child_process';
-import { readFileSync, existsSync, unlinkSync, createWriteStream } from 'fs';
-import { dirname, resolve } from 'path';
-import { ZipArchive } from 'archiver';
-import { fileURLToPath, pathToFileURL } from 'url';
-import { uploadGameToR2, uploadLogicToR2 } from './r2-upload.js';
-import { registerRevision } from './rest-register.js';
-import { buildServerLogic } from './build-server-logic.js';
-import { create2dGame } from './create-2d-game.js';
-import { uploadIconsToCfImages } from './cf-images-upload.js';
-import { runDevCommand } from './dev.js';
-import { readInstalledSdkVersion } from './sdk-version.js';
-import { DEFAULT_ENV, authBaseURL, resolveEnv, studioHost } from './auth/env.js';
-import { runLoginFlow } from './auth/login-flow.js';
-import { saveCredentials, clearCredentials, credentialsPath } from './auth/config.js';
-import { getLoginIdToken, getValidIdToken } from './auth/token-cache.js';
-import { PUBLISH_TOKEN_ENV, createPublishToken, listPublishTokens, revokePublishToken, } from './auth/publish-token.js';
-// publish / login / logout 共通の env オプション。既定 dev・help には出さない (誤って本番へ publish しないため)。
-const envOption = () => new Option('--env <env>', '接続先環境 (dev | stg | prd)').default(DEFAULT_ENV).hideHelp();
-/** publish に使われている uzu-cli 自身のバージョン (dist/../package.json)。 */
-const readOwnCliVersion = () => {
-    const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
-    const version = JSON.parse(readFileSync(pkgPath, 'utf-8')).version;
-    if (!version) {
-        throw new Error('uzu-cli の package.json に version がありません。');
-    }
-    return version;
-};
-const OWN_CLI_VERSION = readOwnCliVersion();
-const program = new Command();
-program.name('uzu').description('UZU ゲーム開発 CLI').version(OWN_CLI_VERSION);
-program
-    .command('create-2d-game')
-    .description('2D エンジンを使ったゲームプロジェクトの雛形を作成')
-    .argument('<name>', 'プロジェクト名（ディレクトリ名）')
-    .action((name) => {
-    create2dGame(name);
-});
-program
-    .command('dev')
-    .description('scenario の dev server を起動し、 dev harness (iframe grid + HUD) と ' +
-    'in-memory GameRoom / SyncRoom / RelayRoom を提供する')
-    .action(async () => {
-    try {
-        await runDevCommand();
+
+// src/cli.ts
+import { Command, Option } from "commander";
+import { execSync } from "child_process";
+import { readFileSync as readFileSync6, existsSync as existsSync4, unlinkSync, createWriteStream } from "fs";
+import { dirname as dirname5, resolve as resolve5 } from "path";
+import { ZipArchive } from "archiver";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL2 } from "url";
+
+// src/r2-upload.ts
+import { readFileSync } from "fs";
+import { readdir } from "fs/promises";
+import mime from "mime-types";
+import { basename, join as join2, relative, sep } from "path";
+
+// src/auth/env.ts
+var UZU_ENVS = ["dev", "stg", "prd"];
+var DEFAULT_ENV = "dev";
+var ENV_HOSTS = {
+  prd: {
+    authHost: "auth.uzu-app.com",
+    graphHost: "prd.graph.backend.app.uzu.one",
+    studioHost: "studio.uzu-app.com"
+  },
+  stg: {
+    authHost: "stg.auth.uzu-app.com",
+    graphHost: "stg.graph.backend.app.uzu.one",
+    studioHost: "stg.studio.uzu-app.com"
+  },
+  dev: {
+    authHost: "dev.auth.uzu-app.com",
+    graphHost: "dev.graph.backend.app.uzu.one",
+    studioHost: "dev.studio.uzu-app.com"
+  }
+};
+var isUzuEnv = (v) => UZU_ENVS.includes(v);
+var resolveEnv = (raw) => {
+  if (raw === void 0 || raw === "") return DEFAULT_ENV;
+  if (!isUzuEnv(raw)) {
+    throw new Error(`\u4E0D\u6B63\u306A env: ${raw} (dev | stg | prd \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044)`);
+  }
+  return raw;
+};
+var authBaseURL = (env) => `https://${ENV_HOSTS[env].authHost}`;
+var graphBaseURL = (env) => `https://${ENV_HOSTS[env].graphHost}`;
+var studioHost = (env) => ENV_HOSTS[env].studioHost;
+
+// src/auth/config.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var CONFIG_DIR = join(homedir(), ".config", "uzu-cli");
+var CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
+var readRaw = async () => {
+  try {
+    const parsed = JSON.parse(await readFile(CREDENTIALS_FILE, "utf8"));
+    if (parsed !== null && typeof parsed === "object" && "envs" in parsed) {
+      return parsed;
     }
-    catch (err) {
-        console.error('[uzu dev]', err);
-        process.exit(1);
+  } catch {
+  }
+  return { envs: {} };
+};
+var write = async (creds) => {
+  await mkdir(CONFIG_DIR, { recursive: true });
+  await writeFile(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+};
+var getCredentials = async (env) => {
+  const creds = await readRaw();
+  return creds.envs[env] ?? null;
+};
+var saveCredentials = async (env, envCreds) => {
+  const creds = await readRaw();
+  creds.envs[env] = envCreds;
+  await write(creds);
+};
+var clearCredentials = async (env) => {
+  const creds = await readRaw();
+  if (creds.envs[env] === void 0) return false;
+  delete creds.envs[env];
+  await write(creds);
+  return true;
+};
+var credentialsPath = () => CREDENTIALS_FILE;
+
+// src/auth/publish-token.ts
+var PUBLISH_TOKEN_ENV = "UZU_PUBLISH_TOKEN";
+var REQUEST_TIMEOUT_MS = 15e3;
+var publishTokenFromEnv = () => {
+  const raw = process.env[PUBLISH_TOKEN_ENV];
+  if (raw === void 0) return null;
+  const token = raw.trim();
+  return token === "" ? null : token;
+};
+var parseApiError = (text, status) => {
+  try {
+    const j = JSON.parse(text);
+    if (j.error) {
+      return new Error(
+        j.error_description ? `uzu auth: ${j.error} (${j.error_description})` : `uzu auth: ${j.error}`
+      );
     }
+  } catch {
+  }
+  return new Error(`uzu auth: status ${status}`);
+};
+var request = async (baseUrl, path, idToken, init) => {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: init.method,
+    headers: {
+      authorization: `Bearer ${idToken}`,
+      ...init.body === void 0 ? {} : { "content-type": "application/json" }
+    },
+    body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+  const text = await res.text();
+  if (!res.ok) throw parseApiError(text, res.status);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error("uzu auth: invalid response");
+  }
+};
+var createPublishToken = (baseUrl, idToken, name) => request(baseUrl, "/api/publish-tokens", idToken, {
+  method: "POST",
+  body: { name }
 });
-program
-    .command('publish')
-    .description('ゲームをビルドして R2 にアップロード → 登録')
-    .option('--change-notes <msg>', 'リビジョンの変更メモ', '')
-    .addOption(envOption())
-    .action(async (options) => {
-    const env = resolveEnv(options.env);
-    const cwd = process.cwd();
-    const manifestPath = resolve(cwd, 'manifest.json');
-    if (!existsSync(manifestPath)) {
-        console.error('manifest.json が見つかりません。ゲームディレクトリで実行してください。');
-        process.exit(1);
+var listPublishTokens = async (baseUrl, idToken) => {
+  const { tokens } = await request(
+    baseUrl,
+    "/api/publish-tokens",
+    idToken,
+    { method: "GET" }
+  );
+  return tokens;
+};
+var revokePublishToken = async (baseUrl, idToken, id) => {
+  await request(baseUrl, `/api/publish-tokens/${encodeURIComponent(id)}`, idToken, {
+    method: "DELETE"
+  });
+};
+
+// src/auth/uzu-auth.ts
+var CLIENT_ID = "uzu-cli";
+var PUBLISH_TOKEN_TYPE = "urn:uzu:params:oauth:token-type:publish-token";
+var TOKEN_TIMEOUT_MS = 15e3;
+var buildLoginURL = (authBaseUrl, redirectUri, codeChallenge) => {
+  const q = new URLSearchParams({
+    redirect_uri: redirectUri,
+    client_id: CLIENT_ID,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256"
+  });
+  return `${authBaseUrl}/login?${q.toString()}`;
+};
+var parseOAuthTokenError = (text, status) => {
+  try {
+    const j = JSON.parse(text);
+    if (j.error) {
+      return new Error(
+        j.error_description ? `uzu auth: ${j.error} (${j.error_description})` : `uzu auth: ${j.error}`
+      );
     }
-    const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
-    if (typeof manifest !== 'object' || manifest === null) {
-        console.error('manifest.json が不正な形式です。');
-        process.exit(1);
+  } catch {
+  }
+  return new Error(`uzu auth: status ${status}`);
+};
+var requestToken = async (baseUrl, body) => {
+  const res = await fetch(`${baseUrl}/api/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS)
+  });
+  const text = await res.text();
+  if (!res.ok) throw parseOAuthTokenError(text, res.status);
+  let j;
+  try {
+    j = JSON.parse(text);
+  } catch {
+    throw new Error("uzu auth: invalid token response");
+  }
+  if (!j.access_token) throw new Error("uzu auth: missing access_token in response");
+  return {
+    accessToken: j.access_token,
+    refreshToken: j.refresh_token ?? "",
+    expiresIn: Number(j.expires_in) || 3600
+  };
+};
+var exchangeCodeForTokens = async (baseUrl, code, codeVerifier, redirectUri) => {
+  const tokens = await requestToken(baseUrl, {
+    grant_type: "authorization_code",
+    code,
+    code_verifier: codeVerifier,
+    redirect_uri: redirectUri,
+    client_id: CLIENT_ID
+  });
+  if (!tokens.refreshToken) throw new Error("uzu auth: missing refresh_token in response");
+  return tokens;
+};
+var refreshTokens = (baseUrl, refreshToken) => requestToken(baseUrl, { grant_type: "refresh_token", refresh_token: refreshToken });
+var exchangePublishToken = (baseUrl, publishToken) => requestToken(baseUrl, {
+  grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+  subject_token: publishToken,
+  subject_token_type: PUBLISH_TOKEN_TYPE
+});
+
+// src/auth/token-cache.ts
+var REFRESH_SKEW_MS = 5 * 60 * 1e3;
+var memoryCache = {};
+var mintFromCredentials = async (env) => {
+  const creds = await getCredentials(env);
+  if (!creds) return null;
+  const refreshed = await refreshTokens(authBaseURL(env), creds.refreshToken);
+  if (refreshed.refreshToken && refreshed.refreshToken !== creds.refreshToken) {
+    await saveCredentials(env, { ...creds, refreshToken: refreshed.refreshToken });
+  }
+  return { idToken: refreshed.accessToken, expiresIn: refreshed.expiresIn };
+};
+var getValidIdToken = async (env) => {
+  const now = Date.now();
+  const cached = memoryCache[env];
+  if (cached && cached.expiresAt - now > REFRESH_SKEW_MS) {
+    return cached.idToken;
+  }
+  const publishToken = publishTokenFromEnv();
+  if (publishToken !== null) {
+    const tokens = await exchangePublishToken(authBaseURL(env), publishToken);
+    memoryCache[env] = {
+      idToken: tokens.accessToken,
+      expiresAt: now + tokens.expiresIn * 1e3
+    };
+    return tokens.accessToken;
+  }
+  const minted = await mintFromCredentials(env);
+  if (minted === null) {
+    throw new Error(
+      `\u672A\u30ED\u30B0\u30A4\u30F3\u3067\u3059\u3002\`uzu login --env ${env}\` \u3092\u5B9F\u884C\u3059\u308B\u304B\u3001${PUBLISH_TOKEN_ENV} \u306B publish token \u3092\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044`
+    );
+  }
+  memoryCache[env] = { idToken: minted.idToken, expiresAt: now + minted.expiresIn * 1e3 };
+  return minted.idToken;
+};
+var getLoginIdToken = async (env) => {
+  const minted = await mintFromCredentials(env);
+  if (minted === null) {
+    throw new Error(`\u672A\u30ED\u30B0\u30A4\u30F3\u3067\u3059\u3002\`uzu login --env ${env}\` \u3092\u5148\u306B\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044`);
+  }
+  return minted.idToken;
+};
+
+// src/upload-session.ts
+var isUpload = (v) => typeof v === "object" && v !== null && "path" in v && typeof v.path === "string" && "url" in v && typeof v.url === "string" && "contentType" in v && typeof v.contentType === "string";
+var isImage = (v) => typeof v === "object" && v !== null && "uploadURL" in v && typeof v.uploadURL === "string";
+var parseUploadSession = (v) => {
+  if (typeof v === "object" && v !== null && "resourceId" in v && typeof v.resourceId === "string" && "revisionId" in v && typeof v.revisionId === "string" && "token" in v && typeof v.token === "string" && "uploads" in v && Array.isArray(v.uploads) && v.uploads.every(isUpload) && "images" in v && Array.isArray(v.images) && v.images.every(isImage) && "imageDeliveryBaseURL" in v && typeof v.imageDeliveryBaseURL === "string") {
+    return {
+      resourceId: v.resourceId,
+      revisionId: v.revisionId,
+      token: v.token,
+      uploads: v.uploads,
+      images: v.images,
+      imageDeliveryBaseURL: v.imageDeliveryBaseURL
+    };
+  }
+  throw new Error("\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u5FDC\u7B54\u304C\u60F3\u5B9A\u5916\u306E\u5F62\u5F0F\u3067\u3059");
+};
+var createUploadSession = async (params) => {
+  const idToken = await getValidIdToken(params.env);
+  const res = await fetch(`${graphBaseURL(params.env)}/uzu_code/upload_sessions`, {
+    method: "POST",
+    headers: {
+      authorization: `bearer ${idToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      ...params.token ? { token: params.token } : {},
+      files: params.files ?? [],
+      imageCount: params.imageCount ?? 0
+    })
+  });
+  if (!res.ok) {
+    const detail = (await res.text()).trim();
+    throw new Error(`\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30BB\u30C3\u30B7\u30E7\u30F3\u306E\u767A\u884C\u306B\u5931\u6557\u3057\u307E\u3057\u305F (HTTP ${res.status}): ${detail}`);
+  }
+  return parseUploadSession(await res.json());
+};
+var putToPresignedURL = async (upload, body) => {
+  const res = await fetch(upload.url, {
+    method: "PUT",
+    headers: { "content-type": upload.contentType },
+    body: typeof body === "string" ? body : new Blob([body])
+  });
+  if (!res.ok) {
+    const detail = (await res.text()).trim();
+    throw new Error(`\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F (${upload.path}, HTTP ${res.status}): ${detail}`);
+  }
+};
+
+// src/r2-upload.ts
+var getMimeType = (path) => mime.contentType(basename(path)) || "application/octet-stream";
+var UPLOAD_CONCURRENCY = 16;
+var listFilesRecursively = async (rootDir) => {
+  const entries = await readdir(rootDir, { withFileTypes: true, recursive: true });
+  return entries.filter((e) => e.isFile()).map((e) => join2(e.parentPath, e.name));
+};
+var runWithConcurrency = async (items, concurrency, worker) => {
+  let index = 0;
+  const runners = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+    while (true) {
+      const current = index++;
+      if (current >= items.length) return;
+      await worker(items[current]);
     }
-    if (!manifest.id || !manifest.playerCount || !manifest.output) {
-        console.error('manifest.json に id と playerCount と output が必要です。');
-        process.exit(1);
+  });
+  await Promise.all(runners);
+};
+var uploadGameToR2 = async (env, zipPath, outputDir) => {
+  const filePaths = await listFilesRecursively(outputDir);
+  const files = filePaths.map((absPath) => ({
+    absPath,
+    relPath: relative(outputDir, absPath).split(sep).join("/")
+  }));
+  const session = await createUploadSession({
+    env,
+    files: [
+      { path: "data.zip", contentType: "application/zip" },
+      ...files.map((f) => ({ path: `files/${f.relPath}`, contentType: getMimeType(f.relPath) }))
+    ]
+  });
+  const uploadByPath = new Map(session.uploads.map((u) => [u.path, u]));
+  const uploadFor = (path) => {
+    const upload = uploadByPath.get(path);
+    if (!upload) throw new Error(`\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9 URL \u304C\u767A\u884C\u3055\u308C\u3066\u3044\u307E\u305B\u3093: ${path}`);
+    return upload;
+  };
+  await putToPresignedURL(uploadFor("data.zip"), readFileSync(zipPath));
+  console.log(`Uploading ${files.length} files to R2 (concurrency=${UPLOAD_CONCURRENCY})...`);
+  let uploaded = 0;
+  await runWithConcurrency(files, UPLOAD_CONCURRENCY, async (f) => {
+    await putToPresignedURL(uploadFor(`files/${f.relPath}`), readFileSync(f.absPath));
+    uploaded++;
+    if (uploaded % 50 === 0 || uploaded === files.length) {
+      console.log(`  ${uploaded}/${files.length}`);
     }
-    const gameId = manifest.id;
-    const manifestCharacters = manifest.characters;
-    // characters バリデーション
-    if (manifestCharacters !== undefined) {
-        if (manifestCharacters.length === 0) {
-            console.error('characters が空の配列です。');
-            process.exit(1);
-        }
-        for (const c of manifestCharacters) {
-            if (!c.id || !c.name) {
-                console.error('characters の各要素に id と name が必要です。');
-                process.exit(1);
-            }
-        }
+  });
+  return { resourceId: session.resourceId, revisionId: session.revisionId, token: session.token };
+};
+var uploadLogicToR2 = async (env, token, logicJs) => {
+  const session = await createUploadSession({
+    env,
+    token,
+    files: [{ path: "logic.js", contentType: "application/javascript" }]
+  });
+  if (session.uploads.length !== 1) {
+    throw new Error("logic.js \u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9 URL \u304C\u767A\u884C\u3055\u308C\u3066\u3044\u307E\u305B\u3093");
+  }
+  await putToPresignedURL(session.uploads[0], logicJs);
+  console.log(`Uploaded logic.js to R2: ${session.revisionId}/logic.js`);
+};
+
+// src/rest-register.ts
+var buildCharacters = (params) => params.characters ? params.characters.map((char) => ({
+  id: char.id,
+  name: char.name,
+  description: char.description ?? "",
+  iconPath: char.icon ?? "",
+  ...char.furigana ? { furigana: char.furigana } : {}
+})) : Array.from({ length: params.playerCount }, (_, i) => ({
+  id: `player${i + 1}`,
+  name: `Player ${i + 1}`,
+  description: "",
+  iconPath: `https://ui-avatars.com/api/?name=Player+${i + 1}&background=random&size=128`
+}));
+var parseRegisterResponse = (body) => {
+  if (typeof body === "object" && body !== null && "scenarioRevisionId" in body && typeof body.scenarioRevisionId === "number") {
+    return body.scenarioRevisionId;
+  }
+  throw new Error("scenarioRevisionId \u3092\u542B\u307E\u306A\u3044\u5FDC\u7B54\u3092\u53D7\u3051\u53D6\u308A\u307E\u3057\u305F");
+};
+var registerRevision = async (params) => {
+  const idToken = await getValidIdToken(params.env);
+  const res = await fetch(`${graphBaseURL(params.env)}/uzu_code/scenario_revisions`, {
+    method: "POST",
+    headers: {
+      authorization: `bearer ${idToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      scenarioId: params.gameId,
+      configResourceId: params.resourceId,
+      uploadToken: params.uploadToken,
+      configSchemaVersion: "3.0.0",
+      changeNotes: params.changeNotes,
+      orientation: params.orientation,
+      characters: buildCharacters(params),
+      uzuCodeManifest: params.manifest,
+      uzuCodePublishMeta: params.publishMeta
+    })
+  });
+  if (!res.ok) {
+    const detail = (await res.text()).trim();
+    throw new Error(`revision \u306E\u767B\u9332\u306B\u5931\u6557\u3057\u307E\u3057\u305F (HTTP ${res.status}): ${detail}`);
+  }
+  return parseRegisterResponse(await res.json());
+};
+
+// src/build-server-logic.ts
+import { build } from "esbuild";
+var buildServerLogic = async (logicPath, outPath) => {
+  await build({
+    entryPoints: [logicPath],
+    outfile: outPath,
+    bundle: true,
+    format: "esm",
+    target: "es2022",
+    platform: "neutral",
+    // SDK の type-only import は tsc で消えるが安全のため external 指定。
+    // @uzupj/uzu-sdk は旧パッケージ名 (未移行 scenario 向けの両対応)
+    external: ["@uzuhq/code-sdk", "@uzupj/uzu-sdk"]
+  });
+  console.log(`Built server logic: ${logicPath} \u2192 ${outPath}`);
+};
+
+// src/create-2d-game.ts
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync, readdirSync, statSync } from "fs";
+import { resolve, dirname, join as join3 } from "path";
+import { fileURLToPath } from "url";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var copyDir = (src, dest, replacements) => {
+  mkdirSync(dest, { recursive: true });
+  for (const entry of readdirSync(src)) {
+    const srcPath = join3(src, entry);
+    const stat = statSync(srcPath);
+    if (stat.isDirectory()) {
+      copyDir(srcPath, join3(dest, entry), replacements);
+      continue;
     }
-    // playerCount: characters があればその長さ、なければ manifest.playerCount
-    const playerCount = manifestCharacters?.length ?? manifest.playerCount;
-    // ビルド・アップロード後に backend の 400 で落ちると手戻りが大きいので、ここで検証する
-    const rawOrientation = manifest.orientation ?? 'portrait';
-    if (rawOrientation !== 'portrait' && rawOrientation !== 'landscape') {
-        console.error(`manifest.json の orientation は portrait か landscape を指定してください (指定値: ${String(rawOrientation)})`);
-        process.exit(1);
+    if (entry.endsWith(".tpl")) {
+      let content = readFileSync2(srcPath, "utf-8");
+      for (const [key, value] of Object.entries(replacements)) {
+        content = content.replaceAll(`{{${key}}}`, value);
+      }
+      writeFileSync(join3(dest, entry.replace(/\.tpl$/, "")), content);
+    } else {
+      const content = readFileSync2(srcPath, "utf-8");
+      let output = content;
+      for (const [key, value] of Object.entries(replacements)) {
+        output = output.replaceAll(`{{${key}}}`, value);
+      }
+      writeFileSync(join3(dest, entry), output);
+    }
+  }
+};
+var toTitle = (name) => name.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+var create2dGame = (name) => {
+  const dest = resolve(process.cwd(), name);
+  const templateDir = resolve(__dirname, "..", "game-2d-template");
+  const title = toTitle(name);
+  const replacements = { name, title };
+  console.log(`Creating 2D game project: ${name}`);
+  copyDir(templateDir, dest, replacements);
+  console.log(`
+Done! Created ${name}/`);
+  console.log(`
+Next steps:`);
+  console.log(`  cd ${name}`);
+  console.log(`  npm install`);
+  console.log(`  npm run dev`);
+};
+
+// src/cf-images-upload.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { basename as basename2 } from "path";
+var parseUploadedImageId = (v) => {
+  if (typeof v === "object" && v !== null && "success" in v && v.success === true && "result" in v && typeof v.result === "object" && v.result !== null && "id" in v.result && typeof v.result.id === "string" && v.result.id !== "") {
+    return v.result.id;
+  }
+  throw new Error(`Cloudflare Images \u306E\u5FDC\u7B54\u304C\u60F3\u5B9A\u5916\u306E\u5F62\u5F0F\u3067\u3059: ${JSON.stringify(v)}`);
+};
+var uploadIconsToCfImages = async (env, token, filePaths) => {
+  if (filePaths.length === 0) return /* @__PURE__ */ new Map();
+  const session = await createUploadSession({ env, token, imageCount: filePaths.length });
+  if (session.images.length !== filePaths.length) {
+    throw new Error("\u30A2\u30A4\u30B3\u30F3\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9 URL \u306E\u767A\u884C\u6570\u304C\u4E00\u81F4\u3057\u307E\u305B\u3093");
+  }
+  const result = /* @__PURE__ */ new Map();
+  await Promise.all(
+    filePaths.map(async (filePath, i) => {
+      const image = session.images[i];
+      const formData = new FormData();
+      formData.append("file", new Blob([readFileSync3(filePath)]), basename2(filePath));
+      const res = await fetch(image.uploadURL, { method: "POST", body: formData });
+      if (!res.ok) {
+        const detail = (await res.text()).trim();
+        throw new Error(
+          `Cloudflare Images \u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u5931\u6557 (${filePath}, HTTP ${res.status}): ${detail}`
+        );
+      }
+      const imageId = parseUploadedImageId(await res.json());
+      result.set(filePath, `${session.imageDeliveryBaseURL}/${imageId}`);
+    })
+  );
+  return result;
+};
+
+// src/dev.ts
+import { spawn } from "child_process";
+import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { createInterface } from "readline";
+
+// src/dev-server/server.ts
+import {
+  Agent,
+  createServer,
+  request as httpRequest
+} from "http";
+import { connect as netConnect } from "net";
+import { hostname, networkInterfaces } from "os";
+import { WebSocketServer } from "ws";
+
+// src/dev-server/game-room.ts
+import { randomUUID } from "crypto";
+
+// ../engine-core/src/json-patch.ts
+function escapePointer(key) {
+  return key.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function unescapePointer(token) {
+  return token.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function compare(oldObj, newObj, basePath = "") {
+  if (oldObj === newObj) return [];
+  if (oldObj === null || newObj === null || typeof oldObj !== "object" || typeof newObj !== "object") {
+    return [{ op: "replace", path: basePath || "/", value: newObj }];
+  }
+  if (Array.isArray(oldObj) || Array.isArray(newObj)) {
+    if (JSON.stringify(oldObj) === JSON.stringify(newObj)) return [];
+    return [{ op: "replace", path: basePath || "/", value: newObj }];
+  }
+  const ops = [];
+  const oldKeys = Object.keys(oldObj);
+  const newKeys = Object.keys(newObj);
+  for (const key of oldKeys) {
+    if (!(key in newObj)) {
+      ops.push({ op: "remove", path: `${basePath}/${escapePointer(key)}` });
+    }
+  }
+  for (const key of newKeys) {
+    const childPath = `${basePath}/${escapePointer(key)}`;
+    if (!(key in oldObj)) {
+      ops.push({ op: "add", path: childPath, value: newObj[key] });
+    } else {
+      const childOps = compare(oldObj[key], newObj[key], childPath);
+      ops.push(...childOps);
+    }
+  }
+  return ops;
+}
+function applyPatch(doc, ops) {
+  for (const op of ops) {
+    const tokens = op.path.split("/").slice(1).map(unescapePointer);
+    if (tokens.length === 0) return false;
+    if (op.op === "replace" || op.op === "add") {
+      let target = doc;
+      for (let i = 0; i < tokens.length - 1; i++) {
+        target = target?.[tokens[i]];
+        if (target === void 0 || target === null) return false;
+      }
+      const lastKey = tokens[tokens.length - 1];
+      target[lastKey] = op.value;
+    } else if (op.op === "remove") {
+      let target = doc;
+      for (let i = 0; i < tokens.length - 1; i++) {
+        target = target?.[tokens[i]];
+        if (target === void 0 || target === null) return false;
+      }
+      const lastKey = tokens[tokens.length - 1];
+      if (Array.isArray(target)) {
+        target.splice(Number(lastKey), 1);
+      } else {
+        delete target[lastKey];
+      }
+    }
+  }
+  return true;
+}
+
+// ../engine-core/src/random.ts
+var SeededRandomImpl = class _SeededRandomImpl {
+  _state;
+  constructor(seed) {
+    this._state = seed | 0;
+  }
+  get state() {
+    return this._state;
+  }
+  static fromState(state) {
+    const r = new _SeededRandomImpl(0);
+    r._state = state;
+    return r;
+  }
+  float() {
+    this._state |= 0;
+    this._state = this._state + 1831565813 | 0;
+    let t = Math.imul(this._state ^ this._state >>> 15, 1 | this._state);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  }
+  int(max) {
+    return Math.floor(this.float() * max);
+  }
+  pick(array) {
+    return array[this.int(array.length)];
+  }
+  shuffle(array) {
+    const a = [...array];
+    for (let i = a.length - 1; i > 0; i--) {
+      const j = this.int(i + 1);
+      [a[i], a[j]] = [a[j], a[i]];
     }
-    const orientation = rawOrientation;
-    const buildCommand = manifest.build;
-    const outputDir = manifest.output;
-    console.log(`Publishing game: ${gameId} (players: ${playerCount}, orientation: ${orientation})`);
-    // SDK バージョンも認証と同じくビルド前に実測する。登録直前に失敗すると
-    // ビルド・R2 アップロード・upload session の消費が全て無駄になるため。
-    let sdkVersion;
+    return a;
+  }
+};
+
+// ../engine-core/src/server-only.ts
+function isServerOnlyAction(handler) {
+  return typeof handler === "function" && "__serverOnly" in handler && handler.__serverOnly === true;
+}
+
+// ../engine-core/src/roster.ts
+function parseRoster(rosterParam) {
+  if (!rosterParam) return null;
+  let raw;
+  try {
+    raw = JSON.parse(rosterParam);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(raw)) return null;
+  return raw.filter((p) => (p.kind ?? "player") === "player").map((p) => ({
+    id: p.id,
+    nickname: p.name ?? "Guest",
+    iconUrl: p.iconUrl ?? "",
+    characterId: p.characterId
+  }));
+}
+
+// src/dev-server/admin-state-patch.ts
+var MERGE_PATCH_ARRAY_REJECT = "[applyJsonMergePatch] cannot merge a non-array patch into an array target";
+function applyJsonMergePatch(target, patch) {
+  if (patch === null || typeof patch !== "object" || Array.isArray(patch)) return;
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === void 0) continue;
+    if (value === null) {
+      target[key] = null;
+      continue;
+    }
+    if (Array.isArray(value)) {
+      target[key] = value;
+      continue;
+    }
+    if (typeof value === "object") {
+      const existing = target[key];
+      if (Array.isArray(existing)) {
+        throw new Error(MERGE_PATCH_ARRAY_REJECT);
+      }
+      if (existing === null || typeof existing !== "object") {
+        target[key] = value;
+        continue;
+      }
+      applyJsonMergePatch(existing, value);
+      continue;
+    }
+    target[key] = value;
+  }
+}
+function applyJsonPatch(target, ops) {
+  const ok = applyPatch(target, ops);
+  if (!ok) {
+    throw new Error("[applyJsonPatch] failed to apply one or more operations");
+  }
+}
+
+// src/dev-server/game-room.ts
+var GameRoom = class _GameRoom {
+  logic;
+  tickRate;
+  gameState = null;
+  stateInitialized = false;
+  random = null;
+  seed = 0;
+  tickCount = 0;
+  tickTimer = null;
+  tickPaused = false;
+  playerInputs = {};
+  /**
+   * roster。 配役を受け取る player 席のみで、 観測席 (GM 席・観戦席) は載らない。
+   * dev harness では manifest から組んだ roster を constructor で注入する
+   * (server 権威)。 その場合、 接続クエリの roster 申告は一切採用しないので、
+   * 旧世代 harness page の残タブが reconnect しても roster を汚染できない。
+   * 本番 DO は backend 由来の roster を全 client が同一申告するため接続時
+   * 登録で成立している — 権威が platform 側にある点は同じ。
+   */
+  players = [];
+  seq = 0;
+  prevBroadcastState = null;
+  static SNAPSHOT_INTERVAL = 20;
+  sockets = /* @__PURE__ */ new Set();
+  attachments = /* @__PURE__ */ new WeakMap();
+  snapshotSubscribers = /* @__PURE__ */ new Set();
+  eventSubscribers = /* @__PURE__ */ new Set();
+  constructor(logic, players) {
+    this.logic = logic;
+    this.tickRate = logic.tickRate ?? 0;
+    if (players && players.length > 0) {
+      this.players = players;
+      console.log(
+        `[GameRoom] \u{1F4CB} Roster (server-authoritative): ${players.map((p) => p.id).join(", ")}`
+      );
+    }
+  }
+  // ─── Broadcast ─────────────────────────────────────────
+  broadcastAll(msg) {
+    const data = JSON.stringify(msg);
+    for (const ws of this.sockets) {
+      try {
+        ws.send(data);
+      } catch {
+      }
+    }
+  }
+  sendTo(ws, msg) {
     try {
-        sdkVersion = readInstalledSdkVersion(cwd);
+      ws.send(JSON.stringify(msg));
+    } catch {
     }
-    catch (e) {
-        console.error(e instanceof Error ? e.message : String(e));
-        process.exit(1);
+  }
+  broadcastStateDelta(events, extra) {
+    this.seq++;
+    const serverTime = Date.now();
+    const fullType = extra.ack !== void 0 ? "__action_result" : "__tick";
+    const deltaType = extra.ack !== void 0 ? "__action_result_delta" : "__tick_delta";
+    const needFull = this.prevBroadcastState === null || this.seq % _GameRoom.SNAPSHOT_INTERVAL === 0;
+    if (needFull) {
+      this.broadcastAll({
+        type: fullType,
+        state: this.gameState,
+        events,
+        seq: this.seq,
+        serverTime,
+        ...extra
+      });
+    } else {
+      const patches = compare(this.prevBroadcastState, this.gameState);
+      const deltaPayload = JSON.stringify({
+        type: deltaType,
+        patches,
+        events,
+        seq: this.seq,
+        serverTime,
+        ...extra
+      });
+      const fullPayload = JSON.stringify({
+        type: fullType,
+        state: this.gameState,
+        events,
+        seq: this.seq,
+        serverTime,
+        ...extra
+      });
+      const data = deltaPayload.length < fullPayload.length ? deltaPayload : fullPayload;
+      for (const ws of this.sockets) {
+        try {
+          ws.send(data);
+        } catch {
+        }
+      }
     }
-    // 認証はビルド前に確認する。未ログインのまま重いビルド・アップロードまで進むと、
-    // 完了後に登録で失敗して成果物が無駄になるため、ここで先に落とす。
-    await getValidIdToken(env).catch((e) => {
-        console.error(e instanceof Error ? e.message : String(e));
-        process.exit(1);
+    this.prevBroadcastState = structuredClone(this.gameState);
+    this.notifySnapshotSubscribers();
+    if (events.length > 0) this.notifyEventSubscribers(events);
+  }
+  notifySnapshotSubscribers() {
+    this.snapshotSubscribers.forEach((cb) => {
+      try {
+        cb(this.gameState);
+      } catch (err) {
+        console.warn("[GameRoom] snapshot subscriber threw:", err);
+      }
     });
-    // 1. Build
-    if (buildCommand) {
-        console.log('Building...');
-        execSync(buildCommand, { stdio: 'inherit', cwd });
-    }
-    // 2. ZIP (archiver で OS 非依存に生成)
-    console.log('Creating ZIP...');
-    const absoluteOutputDir = resolve(cwd, outputDir);
-    const zipPath = resolve(cwd, '__zip__.zip');
-    await new Promise((res, reject) => {
-        const output = createWriteStream(zipPath);
-        const archive = new ZipArchive({ zlib: { level: 9 } });
-        output.on('close', () => res());
-        archive.on('error', (err) => reject(err));
-        archive.pipe(output);
-        archive.directory(absoluteOutputDir, false);
-        archive.finalize();
+  }
+  notifyEventSubscribers(events) {
+    const frozen = Object.freeze(events.slice());
+    this.eventSubscribers.forEach((cb) => {
+      try {
+        cb(frozen);
+      } catch (err) {
+        console.warn("[GameRoom] event subscriber threw:", err);
+      }
     });
-    console.log(`Created: ${zipPath}`);
-    // 3. R2 Upload (ZIP + 個別ファイル)
-    //    ZIP はモバイル `/__zip__` 経路用、個別ファイルは Web emulator 経路用。
-    //    Worker のメモリ上限 (128MB) を超えないよう、Worker 側で ZIP を展開せずに
-    //    R2 から直接個別ファイルを返す前提で publish 時に展開済みオブジェクトを並べる。
-    console.log('Uploading to R2...');
-    const { resourceId, revisionId, token } = await uploadGameToR2(env, zipPath, absoluteOutputDir);
-    console.log(`Uploaded to R2. revisionId: ${revisionId}, resourceId: ${resourceId}`);
-    // 4. ServerAction — serverActionLogicPath があれば logic.js ビルド + R2 保存
-    if (manifest.serverActionLogicPath) {
-        const logicEntryPoint = resolve(cwd, manifest.serverActionLogicPath);
-        const logicOutPath = resolve(cwd, '__logic__.js');
-        try {
-            console.log('Building server logic...');
-            await buildServerLogic(logicEntryPoint, logicOutPath);
-            // ビルド済み logic.js を動的 import し、default or named "logic" が存在するか検証
-            // Windows では絶対パスをそのまま渡すと ERR_UNSUPPORTED_ESM_URL_SCHEME になるため file:// URL に変換する
-            const logicModule = await import(pathToFileURL(logicOutPath).href);
-            const resolvedLogic = logicModule.default ?? logicModule.logic;
-            if (!resolvedLogic) {
-                console.error(`Error: ${manifest.serverActionLogicPath} must export a GameLogic object.\n` +
-                    `  Use either: export default logic\n` +
-                    `  Or:         export const logic: GameLogic<State> = { ... }`);
-                process.exit(1);
-            }
-            // ゲーム固有の logic.js のみを R2 に保存する。
-            // ランタイムテンプレ（GameRoom エンジン）は uzu-code play-server が所有し、JIT デプロイ時に
-            // この logic.js と合成される。これによりテンプレ修正が再 publish 無しで伝播する。
-            console.log('Uploading logic.js to R2...');
-            const logicJsContent = readFileSync(logicOutPath, 'utf-8');
-            await uploadLogicToR2(env, token, logicJsContent);
-        }
-        finally {
-            if (existsSync(logicOutPath))
-                unlinkSync(logicOutPath);
+  }
+  // ─── Game Lifecycle ────────────────────────────────────
+  /**
+   * 移行期: 手元のシナリオが `setup({ seats })` のままでも `uzu dev` を動かせるよう、
+   * 同じ配列を旧名でも渡す。 本番 (play-server) が publish 済み logic.js のために
+   * 同じことをしているのと揃えている。 `SetupArgs` に `seats` を宣言しないのは、
+   * 新規シナリオに旧名を選ばせないため。
+   */
+  setupArgs(random) {
+    return {
+      players: this.players,
+      seats: this.players,
+      ctx: { random, now: Date.now() }
+    };
+  }
+  maybeStartGame() {
+    if (this.gameState !== null) return;
+    if (this.players.length === 0) return;
+    this.seed = Date.now() & 4294967295;
+    this.random = new SeededRandomImpl(this.seed);
+    this.gameState = this.logic.setup(this.setupArgs(this.random));
+    this.stateInitialized = true;
+    this.tickCount = 0;
+    this.seq = 0;
+    this.prevBroadcastState = structuredClone(this.gameState);
+    console.log(`[GameRoom] \u2705 Game started with ${this.players.length} players`);
+    this.broadcastAll({
+      type: "__game_start",
+      state: this.gameState,
+      seed: this.seed,
+      seq: 0
+    });
+    if (this.tickRate > 0) this.startTickLoop();
+    this.notifySnapshotSubscribers();
+  }
+  startTickLoop() {
+    if (this.tickTimer) clearInterval(this.tickTimer);
+    this.tickTimer = setInterval(() => this.tick(), 1e3 / this.tickRate);
+  }
+  // 全クライアント切断で tickTimer は止まる (handleClose) が gameState は残るため、
+  // 再接続や reset で「動いているべきなのに止まっている」状態を復旧する。
+  ensureTickLoop() {
+    if (this.tickRate > 0 && this.gameState !== null && this.sockets.size > 0 && !this.tickPaused && !this.tickTimer) {
+      this.startTickLoop();
+    }
+  }
+  tick() {
+    if (this.tickPaused) return;
+    this.runOneTick();
+  }
+  runOneTick() {
+    if (!this.gameState || !this.random) return;
+    const events = [];
+    const emit = (name, data) => events.push({ name, data: data ?? {} });
+    const tickNow = Date.now();
+    try {
+      this.logic.update({
+        state: this.gameState,
+        ctx: {
+          random: this.random,
+          tick: this.tickCount,
+          now: tickNow,
+          emit,
+          playerInputs: this.playerInputs
         }
+      });
+    } catch (err) {
+      console.error(`[GameRoom] tick error at tick=${this.tickCount}:`, err);
+      this.tickCount++;
+      return;
+    }
+    this.tickCount++;
+    this.syncWakeup();
+    this.broadcastStateDelta(events, { tick: this.tickCount });
+  }
+  // ─── Connection ────────────────────────────────────────
+  handleConnection(ws, url) {
+    const playerId = url.searchParams.get("seatId");
+    if (!playerId) {
+      ws.close(1008, "Missing required query parameter: seatId");
+      return;
+    }
+    const nickname = url.searchParams.get("nickname") ?? "Guest";
+    const connectionId = randomUUID();
+    if (this.players.length === 0) {
+      const declared = parseRoster(
+        url.searchParams.get("players") ?? url.searchParams.get("seats")
+      );
+      if (declared && declared.length > 0) {
+        this.players = declared;
+        console.log(`[GameRoom] \u{1F4CB} Roster pinned: ${this.players.map((p) => p.id).join(", ")}`);
+      }
+    }
+    console.log(
+      `[GameRoom] \u{1F517} New connection: connectionId=${connectionId} playerId=${playerId} nickname=${nickname}`
+    );
+    this.sockets.add(ws);
+    this.attachments.set(ws, { connectionId, playerId, nickname });
+    ws.on("message", (raw) => {
+      void this.handleMessage(ws, raw.toString());
+    });
+    ws.on("close", () => this.handleClose(ws));
+    ws.on("error", () => this.handleClose(ws));
+    this.sendTo(ws, {
+      type: "__room_init",
+      myId: playerId
+    });
+    if (this.stateInitialized && this.gameState !== null) {
+      this.sendTo(ws, {
+        type: "__state",
+        state: this.gameState,
+        tick: this.tickCount,
+        seq: this.seq,
+        serverTime: Date.now()
+      });
+    }
+    this.maybeStartGame();
+    this.ensureTickLoop();
+  }
+  async handleMessage(ws, msg) {
+    if (msg === "__ping") {
+      try {
+        ws.send("__pong");
+      } catch {
+      }
+      return;
+    }
+    const attachment = this.attachments.get(ws);
+    if (!attachment) return;
+    const senderId = attachment.playerId;
+    let parsed;
+    try {
+      parsed = JSON.parse(msg);
+    } catch {
+      return;
     }
-    // 5. Resolve character icons (相対パス → Cloudflare Images アップロード)
-    let resolvedCharacters;
-    if (manifestCharacters) {
-        console.log('Resolving character icons...');
-        const isLocalIcon = (char) => !!char.icon && !char.icon.startsWith('http://') && !char.icon.startsWith('https://');
-        const localIconPaths = manifestCharacters.filter(isLocalIcon).map((char) => {
-            const iconAbsPath = resolve(cwd, char.icon);
-            if (!existsSync(iconAbsPath)) {
-                console.error(`アイコンファイルが見つかりません: ${char.icon}`);
-                process.exit(1);
-            }
-            return iconAbsPath;
+    const msgType = parsed.type;
+    console.log(`[GameRoom] \u2B05 recv from=${senderId} type=${msgType}`);
+    if (msgType === "__action") {
+      if (!this.gameState) {
+        this.sendTo(ws, {
+          type: "__action_error",
+          error: "Game not started",
+          seq: parsed.seq
         });
-        const iconURLs = await uploadIconsToCfImages(env, token, localIconPaths);
-        resolvedCharacters = manifestCharacters.map((char) => {
-            if (!isLocalIcon(char))
-                return char;
-            const cfImagesUrl = iconURLs.get(resolve(cwd, char.icon));
-            if (!cfImagesUrl) {
-                console.error(`アイコンのアップロード結果が見つかりません: ${char.icon}`);
-                process.exit(1);
-            }
-            console.log(`Uploaded icon: ${char.icon}`);
-            return { ...char, icon: cfImagesUrl };
+        return;
+      }
+      const actionName = parsed.action;
+      const payload = parsed.payload ?? {};
+      const seq = parsed.seq;
+      try {
+        await this.dispatchAction(actionName, payload, senderId, seq);
+      } catch (err) {
+        this.sendTo(ws, {
+          type: "__action_error",
+          error: `Action failed: ${err instanceof Error ? err.message : "unknown"}`,
+          seq
         });
+      }
+      return;
     }
-    // 6. Register revision
-    console.log('Registering revision...');
-    const revId = await registerRevision({
-        env,
-        gameId,
-        resourceId,
-        uploadToken: token,
-        changeNotes: options.changeNotes || '',
-        playerCount,
-        orientation,
-        characters: resolvedCharacters,
-        manifest,
-        publishMeta: { sdkVersion, cliVersion: OWN_CLI_VERSION },
-    });
-    console.log(`Registered revision: ${revId}`);
-    // 7. Cleanup
-    unlinkSync(zipPath);
-    const studioUrl = `https://${studioHost(env)}/ja/scenarios/global-id/${gameId}`;
-    console.log('\nDone!');
-    console.log(`UZU Studio: ${studioUrl}`);
-});
-program
-    .command('login')
-    .description('UZU にログインして publish 用の認証情報を保存')
-    .addOption(envOption())
-    .action(async (options) => {
-    const env = resolveEnv(options.env);
-    let result;
+    if (msgType === "__request_state") {
+      if (this.gameState !== null) {
+        this.sendTo(ws, {
+          type: "__state",
+          state: this.gameState,
+          tick: this.tickCount,
+          seq: this.seq,
+          serverTime: Date.now()
+        });
+      }
+      return;
+    }
+    if (msgType === "__input") {
+      const inputData = parsed.data;
+      if (inputData) this.playerInputs[senderId] = inputData;
+      return;
+    }
+  }
+  async dispatchAction(actionName, payload, senderId, ackSeq) {
+    const plain = this.logic.actions[actionName];
+    const legacyServerOnly = isServerOnlyAction(plain) ? plain : null;
+    const serverHandler = this.logic.serverActions?.[actionName] ?? legacyServerOnly;
+    if (!plain && !serverHandler) {
+      throw new Error(`Unknown action: ${actionName}`);
+    }
+    if (!this.gameState) {
+      throw new Error("Game not started");
+    }
+    const events = [];
+    const emit = (name, data) => events.push({ name, data: data ?? {} });
+    const serverEmit = emit;
+    const snapshot = structuredClone(this.gameState);
+    const now = Date.now();
     try {
-        result = await runLoginFlow(env, (url) => {
-            console.log('ブラウザで Google ログインを開きます。');
-            console.log('自動で開かない場合は次の URL を踏んでください:');
-            console.log(`  ${url}`);
+      if (plain && !legacyServerOnly) {
+        plain({
+          state: this.gameState,
+          payload: payload ?? {},
+          playerId: senderId,
+          ctx: { now, emit }
+        });
+      }
+      if (serverHandler) {
+        await serverHandler({
+          state: this.gameState,
+          payload: payload ?? {},
+          playerId: senderId,
+          ctx: {
+            tick: this.tickCount,
+            random: this.random ?? new SeededRandomImpl(this.seed),
+            now,
+            emit: serverEmit
+          }
         });
+      }
+    } catch (err) {
+      this.gameState = snapshot;
+      throw err;
     }
-    catch (e) {
-        console.error(`ログインに失敗しました: ${e.message}`);
-        process.exit(1);
+    this.syncWakeup();
+    this.broadcastStateDelta(events, { ack: ackSeq, from: senderId });
+  }
+  // ─── Deadlines (本番の Durable Object alarm 相当) ──────────
+  /** dev は setTimeout。本番は storage の alarm。意味論は同じ。 */
+  wakeupTimer = null;
+  wakeupAt = null;
+  /**
+   * 宣言された締切のうち最も早い時刻。締切が無ければ null。
+   * state から毎回導出するので保存しない。
+   */
+  nextDeadline() {
+    if (!this.gameState || !this.logic.deadlines) return null;
+    let earliest = null;
+    for (const [key, deadline] of Object.entries(this.logic.deadlines)) {
+      let at;
+      try {
+        at = deadline.at({ state: this.gameState });
+      } catch (err) {
+        console.error(`[Deadline] \u274C ${key}.at() \u3067\u4F8B\u5916`, err);
+        continue;
+      }
+      if (typeof at !== "number" || !Number.isFinite(at)) continue;
+      if (earliest === null || at < earliest) earliest = at;
+    }
+    return earliest;
+  }
+  /** 起床時刻を現在の state に合わせる。state を変えた後は必ず通す。 */
+  syncWakeup() {
+    const next = this.nextDeadline();
+    if (next === this.wakeupAt) return;
+    if (this.wakeupTimer) clearTimeout(this.wakeupTimer);
+    this.wakeupTimer = null;
+    this.wakeupAt = next;
+    if (next === null) return;
+    this.wakeupTimer = setTimeout(() => this.fireDue(), Math.max(0, next - Date.now()));
+    this.wakeupTimer.unref?.();
+  }
+  /**
+   * 過ぎた締切の handler を実行する。本番の alarm() と同じ意味論。
+   *
+   * handler の直前に at を評価し直す (先に走った handler が別の締切を消しうる)。
+   * 失敗は握って捨てる。ログには必ず残す。
+   */
+  fireDue() {
+    this.wakeupTimer = null;
+    this.wakeupAt = null;
+    if (!this.gameState || !this.logic.deadlines) return;
+    const now = Date.now();
+    const events = [];
+    const firedKeys = [];
+    for (const [key, deadline] of Object.entries(this.logic.deadlines)) {
+      const state = this.gameState;
+      if (!state) break;
+      const pending = [];
+      let snapshot = null;
+      try {
+        const at = deadline.at({ state });
+        if (typeof at !== "number" || !Number.isFinite(at) || at > now) continue;
+        snapshot = structuredClone(state);
+        deadline.handler({
+          state,
+          ctx: {
+            now,
+            random: this.random ?? new SeededRandomImpl(this.seed),
+            emit: (name, data) => pending.push({ name, data: data ?? {} })
+          }
+        });
+        events.push(...pending);
+        firedKeys.push(key);
+      } catch (err) {
+        if (snapshot !== null) this.gameState = snapshot;
+        console.error(`[Deadline] \u274C ${key} \u3067\u4F8B\u5916`, err);
+      }
+    }
+    this.syncWakeup();
+    if (firedKeys.length === 0) return;
+    console.log(`[Deadline] \u23F0 ${firedKeys.length} \u4EF6\u767A\u706B: ${firedKeys.join(", ")}`);
+    this.broadcastStateDelta(events, {});
+  }
+  handleClose(ws) {
+    const attachment = this.attachments.get(ws);
+    if (!attachment) return;
+    console.log(
+      `[GameRoom] \u274C Disconnected: connectionId=${attachment.connectionId} playerId=${attachment.playerId}`
+    );
+    this.sockets.delete(ws);
+    this.attachments.delete(ws);
+    delete this.playerInputs[attachment.playerId];
+    if (this.sockets.size === 0 && this.tickTimer) {
+      clearInterval(this.tickTimer);
+      this.tickTimer = null;
     }
-    await saveCredentials(env, {
-        uid: result.uid,
-        email: result.email,
-        refreshToken: result.refreshToken,
-        loggedInAt: new Date().toISOString(),
+  }
+  // ─── Admin API (parent frame __uzu_dev から使う) ──────────────────
+  admin() {
+    return {
+      getSnapshot: () => this.gameState,
+      getRawState: () => this.gameState,
+      setRawState: (next) => {
+        this.gameState = next;
+        this.broadcastStateDelta([], { tick: this.tickCount });
+      },
+      mergeRawState: (patch) => {
+        if (!this.gameState) return;
+        applyJsonMergePatch(this.gameState, patch);
+        this.broadcastStateDelta([], { tick: this.tickCount });
+      },
+      patchRawState: (ops) => {
+        if (!this.gameState) return;
+        applyJsonPatch(this.gameState, ops);
+        this.broadcastStateDelta([], { tick: this.tickCount });
+      },
+      sendAction: async ({ as, type, payload }) => {
+        await this.dispatchAction(type, payload, as);
+      },
+      getSeed: () => this.seed,
+      pauseTick: () => {
+        if (this.tickRate <= 0) return;
+        this.tickPaused = true;
+      },
+      resumeTick: () => {
+        if (this.tickRate <= 0) return;
+        this.tickPaused = false;
+      },
+      stepTick: (n = 1) => {
+        if (this.tickRate <= 0) return;
+        if (!Number.isInteger(n) || n < 0) {
+          throw new RangeError(`stepTick: n must be a non-negative integer (got ${n})`);
+        }
+        for (let i = 0; i < n; i++) this.runOneTick();
+      },
+      getCurrentTick: () => this.tickCount,
+      isTickPaused: () => this.tickPaused,
+      reset: (opts) => {
+        if (opts?.seed === "random") {
+          this.seed = Math.floor(Math.random() * 4294967295);
+        } else if (typeof opts?.seed === "number") {
+          this.seed = opts.seed;
+        }
+        this.random = new SeededRandomImpl(this.seed);
+        this.gameState = this.logic.setup(this.setupArgs(this.random));
+        this.tickCount = 0;
+        this.tickPaused = false;
+        this.seq = 0;
+        this.prevBroadcastState = structuredClone(this.gameState);
+        this.broadcastAll({
+          type: "__game_start",
+          state: this.gameState,
+          seed: this.seed,
+          seq: 0
+        });
+        this.notifySnapshotSubscribers();
+        this.ensureTickLoop();
+      },
+      subscribeSnapshot: (cb) => {
+        this.snapshotSubscribers.add(cb);
+        return () => {
+          this.snapshotSubscribers.delete(cb);
+        };
+      },
+      subscribeEvents: (cb) => {
+        this.eventSubscribers.add(cb);
+        return () => {
+          this.eventSubscribers.delete(cb);
+        };
+      }
+    };
+  }
+};
+
+// src/dev-server/sync-room.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var SERVER_TIME_SENTINEL = "__SERVER_TIME__";
+function resolveServerTime(ops, now) {
+  for (const op of ops) {
+    if (op.value === SERVER_TIME_SENTINEL) {
+      op.value = now;
+    }
+  }
+}
+var SyncRoom = class _SyncRoom {
+  cachedState = null;
+  stateInitialized = false;
+  seq = 0;
+  patchesSinceReconciliation = 0;
+  static RECONCILIATION_INTERVAL = 30;
+  sockets = /* @__PURE__ */ new Set();
+  attachments = /* @__PURE__ */ new WeakMap();
+  snapshotSubscribers = /* @__PURE__ */ new Set();
+  broadcastFullState() {
+    if (!this.stateInitialized || this.cachedState === null) return;
+    const stateMsg = JSON.stringify({
+      type: "__state",
+      state: this.cachedState,
+      seq: this.seq,
+      serverTime: Date.now()
     });
-    console.log(`\nログインしました: ${result.email} (env: ${env})`);
-    console.log(`保存先: ${credentialsPath()} (mode 0600)`);
-});
-program
-    .command('logout')
-    .description('保存済みの認証情報を削除')
-    .addOption(envOption())
-    .action(async (options) => {
-    const env = resolveEnv(options.env);
-    const removed = await clearCredentials(env);
-    if (removed) {
-        console.log(`ログアウトしました (env: ${env})`);
-    }
-    else {
-        console.log(`ログイン情報はありません (env: ${env})`);
+    for (const peer of this.sockets) {
+      try {
+        peer.send(stateMsg);
+      } catch {
+      }
     }
-});
-// CI / 自動化用の publish token 管理。認証は `uzu login` 済みの認証情報のみで、
-// UZU_PUBLISH_TOKEN では操作できない (漏れたトークンから新しい token を生やさせない)。
-const tokenCommand = program.command('token').description('CI 用 publish token の管理');
-const runTokenCommand = async (rawEnv, fn) => {
-    const env = resolveEnv(rawEnv);
+    this.notifySnapshotSubscribers();
+  }
+  notifySnapshotSubscribers() {
+    this.snapshotSubscribers.forEach((cb) => {
+      try {
+        cb(this.cachedState);
+      } catch (err) {
+        console.warn("[SyncRoom] snapshot subscriber threw:", err);
+      }
+    });
+  }
+  handleConnection(ws, url) {
+    const playerId = url.searchParams.get("playerId");
+    if (!playerId) {
+      ws.close(1008, "Missing required query parameter: playerId");
+      return;
+    }
+    const connectionId = randomUUID2();
+    console.log(`[SyncRoom] \u{1F517} New connection: connectionId=${connectionId} playerId=${playerId}`);
+    this.sockets.add(ws);
+    this.attachments.set(ws, { connectionId, playerId });
+    ws.on("message", (raw) => this.handleMessage(ws, raw.toString()));
+    ws.on("close", () => this.handleClose(ws));
+    ws.on("error", () => this.handleClose(ws));
+    ws.send(JSON.stringify({ type: "__room_init", myId: playerId }));
+    if (this.stateInitialized && this.cachedState !== null) {
+      ws.send(
+        JSON.stringify({
+          type: "__state",
+          state: this.cachedState,
+          seq: this.seq,
+          serverTime: Date.now()
+        })
+      );
+    }
+  }
+  handleMessage(ws, msg) {
+    if (msg === "__ping") {
+      try {
+        ws.send("__pong");
+      } catch {
+      }
+      return;
+    }
+    const attachment = this.attachments.get(ws);
+    if (!attachment) return;
+    const senderId = attachment.playerId;
+    let parsed;
     try {
-        const idToken = await getLoginIdToken(env);
-        await fn({ env, baseUrl: authBaseURL(env), idToken });
+      parsed = JSON.parse(msg);
+    } catch {
+      return;
     }
-    catch (e) {
-        console.error(e instanceof Error ? e.message : String(e));
-        process.exit(1);
+    const msgType = parsed.type;
+    console.log(`[SyncRoom] \u2B05 recv from=${senderId} type=${msgType}`);
+    if (msgType === "__init_state") {
+      if (this.stateInitialized) {
+        console.log(`[SyncRoom] __init_state skipped (already initialized)`);
+        return;
+      }
+      this.stateInitialized = true;
+      this.cachedState = parsed.state;
+      this.seq = 0;
+      this.patchesSinceReconciliation = 0;
+      console.log(`[SyncRoom] \u2705 State initialized`);
+      this.broadcastFullState();
+      return;
+    }
+    if (msgType === "__clear_state") {
+      this.cachedState = null;
+      this.stateInitialized = false;
+      this.seq = 0;
+      this.patchesSinceReconciliation = 0;
+      console.log(`[SyncRoom] \u{1F5D1} State cleared`);
+      const clearedMsg = JSON.stringify({ type: "__state_cleared" });
+      for (const peer of this.sockets) {
+        try {
+          peer.send(clearedMsg);
+        } catch {
+        }
+      }
+      this.notifySnapshotSubscribers();
+      return;
+    }
+    if (msgType === "__request_state") {
+      if (!this.stateInitialized || this.cachedState === null) return;
+      try {
+        ws.send(
+          JSON.stringify({
+            type: "__state",
+            state: this.cachedState,
+            seq: this.seq,
+            serverTime: Date.now()
+          })
+        );
+      } catch {
+      }
+      return;
+    }
+    if (msgType === "__patch") {
+      if (!this.stateInitialized || this.cachedState === null) return;
+      const ops = parsed.ops;
+      if (!ops || !Array.isArray(ops) || ops.length === 0) return;
+      const serverTime = Date.now();
+      resolveServerTime(ops, serverTime);
+      const workingCopy = structuredClone(this.cachedState);
+      const ok = applyPatch(workingCopy, ops);
+      if (!ok) {
+        try {
+          ws.send(JSON.stringify({ type: "__patch_failed", reason: "apply_error" }));
+          ws.send(
+            JSON.stringify({
+              type: "__state",
+              state: this.cachedState,
+              seq: this.seq,
+              serverTime: Date.now()
+            })
+          );
+        } catch {
+        }
+        return;
+      }
+      this.cachedState = workingCopy;
+      this.seq++;
+      const ackMsg = JSON.stringify({
+        type: "__patch_ack",
+        ops,
+        seq: this.seq,
+        serverTime,
+        senderId
+      });
+      for (const peer of this.sockets) {
+        try {
+          peer.send(ackMsg);
+        } catch {
+        }
+      }
+      this.notifySnapshotSubscribers();
+      this.patchesSinceReconciliation++;
+      if (this.patchesSinceReconciliation >= _SyncRoom.RECONCILIATION_INTERVAL) {
+        this.patchesSinceReconciliation = 0;
+        this.broadcastFullState();
+      }
+      return;
+    }
+    const outData = JSON.stringify({ ...parsed, __from: senderId });
+    if (parsed.__to && typeof parsed.__to === "string") {
+      for (const peer of this.sockets) {
+        const pa = this.attachments.get(peer);
+        if (pa && pa.playerId === parsed.__to) {
+          try {
+            peer.send(outData);
+          } catch {
+          }
+        }
+      }
+    } else {
+      for (const peer of this.sockets) {
+        if (peer === ws) continue;
+        try {
+          peer.send(outData);
+        } catch {
+        }
+      }
+    }
+  }
+  handleClose(ws) {
+    const attachment = this.attachments.get(ws);
+    if (attachment) {
+      console.log(
+        `[SyncRoom] \u274C Disconnected: connectionId=${attachment.connectionId} playerId=${attachment.playerId}`
+      );
+    }
+    this.sockets.delete(ws);
+    this.attachments.delete(ws);
+  }
+  // ─── Admin API (parent frame __uzu_dev から使う) ──────────────────
+  admin() {
+    return {
+      getSnapshot: () => this.cachedState,
+      getRawState: () => this.cachedState,
+      setRawState: (next) => {
+        this.cachedState = next;
+        this.stateInitialized = true;
+        this.broadcastFullState();
+      },
+      mergeRawState: (patch) => {
+        if (!this.cachedState) return;
+        applyJsonMergePatch(this.cachedState, patch);
+        this.broadcastFullState();
+      },
+      patchRawState: (ops) => {
+        if (!this.cachedState) return;
+        applyJsonPatch(this.cachedState, ops);
+        this.broadcastFullState();
+      },
+      subscribeSnapshot: (cb) => {
+        this.snapshotSubscribers.add(cb);
+        return () => {
+          this.snapshotSubscribers.delete(cb);
+        };
+      }
+    };
+  }
+};
+
+// src/dev-server/relay-room.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var RelayRoom = class {
+  sockets = /* @__PURE__ */ new Set();
+  attachments = /* @__PURE__ */ new WeakMap();
+  handleConnection(ws, url) {
+    const playerId = url.searchParams.get("playerId");
+    if (!playerId) {
+      ws.close(1008, "Missing required query parameter: playerId");
+      return;
+    }
+    const connectionId = randomUUID3();
+    console.log(`[RelayRoom] \u{1F517} New connection: connectionId=${connectionId} playerId=${playerId}`);
+    this.sockets.add(ws);
+    this.attachments.set(ws, { connectionId, playerId });
+    ws.on("message", (raw) => this.handleMessage(ws, raw.toString()));
+    ws.on("close", () => this.handleClose(ws));
+    ws.on("error", () => this.handleClose(ws));
+    ws.send(JSON.stringify({ type: "__room_init", myId: playerId }));
+  }
+  handleMessage(ws, msg) {
+    if (msg === "__ping") {
+      try {
+        ws.send("__pong");
+      } catch {
+      }
+      return;
+    }
+    const attachment = this.attachments.get(ws);
+    if (!attachment) return;
+    const senderId = attachment.playerId;
+    let parsed;
+    try {
+      parsed = JSON.parse(msg);
+    } catch {
+      return;
+    }
+    console.log(`[RelayRoom] \u2B05 recv from=${senderId}`, JSON.stringify(parsed));
+    const outData = JSON.stringify({ ...parsed, __from: senderId });
+    if (parsed.__to && typeof parsed.__to === "string") {
+      for (const peer of this.sockets) {
+        const pa = this.attachments.get(peer);
+        if (pa && pa.playerId === parsed.__to) {
+          try {
+            peer.send(outData);
+          } catch {
+          }
+        }
+      }
+    } else {
+      for (const peer of this.sockets) {
+        if (peer === ws) continue;
+        try {
+          peer.send(outData);
+        } catch {
+        }
+      }
+    }
+  }
+  handleClose(ws) {
+    const attachment = this.attachments.get(ws);
+    if (attachment) {
+      console.log(`[RelayRoom] \u274C Disconnected: connectionId=${attachment.connectionId}`);
     }
+    this.sockets.delete(ws);
+    this.attachments.delete(ws);
+  }
+};
+
+// src/dev-server/server.ts
+var CONTENT_TYPES = {
+  html: "text/html; charset=utf-8",
+  js: "application/javascript; charset=utf-8",
+  json: "application/json; charset=utf-8"
 };
-tokenCommand
-    .command('create')
-    .description('publish token を発行する (平文はこの 1 回しか表示されない)')
-    .option('--name <label>', 'トークンの用途がわかる表示名', '')
-    .addOption(envOption())
-    .action(async (options) => {
-    await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
-        const issued = await createPublishToken(baseUrl, idToken, options.name);
-        console.log(`publish token を発行しました (env: ${env})`);
-        console.log(`  id:   ${issued.id}`);
-        console.log(`  name: ${issued.name || '(なし)'}`);
-        console.log('');
-        console.log(`  ${issued.token}`);
-        console.log('');
-        console.log('この平文は再表示できません。CI では secret に登録し、');
-        console.log(`${PUBLISH_TOKEN_ENV} として渡してください。`);
+function startHarnessServer(opts) {
+  const gameRooms = /* @__PURE__ */ new Map();
+  const syncRooms = /* @__PURE__ */ new Map();
+  const relayRooms = /* @__PURE__ */ new Map();
+  const resolveAdmin = () => {
+    const preferredKey = `${opts.meta.revisionId}/${opts.meta.roomKey}`;
+    const gameRoom = gameRooms.get(preferredKey) ?? gameRooms.values().next().value;
+    if (gameRoom) return { kind: "game", game: gameRoom.admin() };
+    const syncRoom = syncRooms.values().next().value;
+    if (syncRoom) return { kind: "sync", sync: syncRoom.admin() };
+    return null;
+  };
+  const httpServer = createServer((req, res) => {
+    handleHttpRequest(req, res, opts);
+  });
+  const wss = new WebSocketServer({ noServer: true });
+  httpServer.on("upgrade", (req, socket, head) => {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    const pathname = url.pathname;
+    const gameMatch = pathname.match(/^\/ws\/games\/([^/]+)\/([^/]+)$/);
+    if (gameMatch) {
+      const revisionId = gameMatch[1];
+      const roomId = gameMatch[2];
+      wss.handleUpgrade(req, socket, head, (ws) => {
+        if (!opts.logic) {
+          ws.close(1008, "No server logic loaded (missing serverActionLogicPath in manifest)");
+          return;
+        }
+        const key = `${revisionId}/${roomId}`;
+        let room = gameRooms.get(key);
+        if (!room) {
+          room = new GameRoom(opts.logic, opts.meta.players);
+          gameRooms.set(key, room);
+        }
+        room.handleConnection(ws, url);
+      });
+      return;
+    }
+    const syncMatch = pathname.match(/^\/ws\/sync\/([^/]+)$/);
+    if (syncMatch) {
+      const roomId = syncMatch[1];
+      wss.handleUpgrade(req, socket, head, (ws) => {
+        let room = syncRooms.get(roomId);
+        if (!room) {
+          room = new SyncRoom();
+          syncRooms.set(roomId, room);
+        }
+        room.handleConnection(ws, url);
+      });
+      return;
+    }
+    const relayMatch = pathname.match(/^\/ws\/rooms\/([^/]+)$/);
+    if (relayMatch) {
+      const roomId = relayMatch[1];
+      wss.handleUpgrade(req, socket, head, (ws) => {
+        let room = relayRooms.get(roomId);
+        if (!room) {
+          room = new RelayRoom();
+          relayRooms.set(roomId, room);
+        }
+        room.handleConnection(ws, url);
+      });
+      return;
+    }
+    if (pathname === "/dev/admin") {
+      wss.handleUpgrade(req, socket, head, (ws) => {
+        handleAdminConnection(ws, resolveAdmin);
+      });
+      return;
+    }
+    proxyUpgradeToScenario(req, socket, head, opts.meta.scenarioUrl);
+  });
+  httpServer.listen(opts.port, opts.host ?? "127.0.0.1");
+  return {
+    stop: () => new Promise((resolve6) => {
+      for (const ws of wss.clients) {
+        try {
+          ws.close();
+        } catch {
+        }
+      }
+      wss.close(() => {
+        httpServer.close(() => resolve6());
+      });
+    })
+  };
+}
+function currentLanHosts() {
+  const hosts = [];
+  const name = hostname();
+  if (name)
+    hosts.push(
+      name.toLowerCase().endsWith(".local") ? name.toLowerCase() : `${name.toLowerCase()}.local`
+    );
+  for (const entries of Object.values(networkInterfaces())) {
+    for (const entry of entries ?? []) {
+      if (entry.family === "IPv4" && !entry.internal) hosts.push(entry.address);
+    }
+  }
+  return hosts;
+}
+function handleHttpRequest(req, res, opts) {
+  const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  const pathname = url.pathname;
+  const writeText = (body, contentType, status = 200) => {
+    res.writeHead(status, {
+      "content-type": contentType,
+      "cache-control": "no-store",
+      "access-control-allow-origin": "*"
     });
-});
-tokenCommand
-    .command('list')
-    .description('有効な publish token を一覧する')
-    .addOption(envOption())
-    .action(async (options) => {
-    await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
-        const tokens = await listPublishTokens(baseUrl, idToken);
-        if (tokens.length === 0) {
-            console.log(`publish token はありません (env: ${env})`);
-            return;
+    res.end(body);
+  };
+  const isScenarioIndex = (pathname === "/" || pathname === "/index.html") && url.searchParams.has("server");
+  if ((pathname === "/" || pathname === "/index.html") && !isScenarioIndex) {
+    writeText(opts.harness.html, CONTENT_TYPES.html);
+    return;
+  }
+  if (pathname === "/_uzu_harness.js") {
+    writeText(opts.harness.js, CONTENT_TYPES.js);
+    return;
+  }
+  if (pathname === "/_uzu_meta.json") {
+    writeText(JSON.stringify({ ...opts.meta, lanHosts: currentLanHosts() }), CONTENT_TYPES.json);
+    return;
+  }
+  if (pathname === "/health") {
+    writeText(JSON.stringify({ ok: true }), CONTENT_TYPES.json);
+    return;
+  }
+  proxyHttpToScenario(req, res, opts.meta.scenarioUrl);
+}
+function handleAdminConnection(ws, resolveAdmin) {
+  const unsubs = /* @__PURE__ */ new Map();
+  ws.on("message", async (raw) => {
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      return;
+    }
+    const type = msg.type;
+    const id = msg.id;
+    const admin = resolveAdmin();
+    if (!admin) {
+      ws.send(JSON.stringify({ type: "error", id, error: "no_active_room" }));
+      return;
+    }
+    if (type === "call") {
+      const method = msg.method;
+      const args = msg.args ?? [];
+      try {
+        const value = await invokeAdminMethod(admin, method, args);
+        if (value === void 0 && !adminHasMethod(admin, method)) {
+          ws.send(JSON.stringify({ type: "missing", id }));
+        } else {
+          ws.send(JSON.stringify({ type: "result", id, value }));
         }
-        for (const t of tokens) {
-            console.log(`${t.id}  ${t.name || '(なし)'}  created=${t.createdAt}  lastUsed=${t.lastUsedAt ?? '-'}`);
+      } catch (err) {
+        ws.send(
+          JSON.stringify({
+            type: "error",
+            id,
+            error: err instanceof Error ? err.message : String(err)
+          })
+        );
+      }
+      return;
+    }
+    if (type === "subscribe") {
+      const kind = msg.kind;
+      const unsub = subscribeAdmin(admin, kind, (value) => {
+        try {
+          ws.send(JSON.stringify({ type: "event", id, value }));
+        } catch {
         }
+      });
+      if (!unsub) {
+        ws.send(JSON.stringify({ type: "error", id, error: "subscription_not_supported" }));
+        return;
+      }
+      unsubs.set(id, unsub);
+      ws.send(JSON.stringify({ type: "result", id, value: null }));
+      return;
+    }
+    if (type === "unsubscribe") {
+      const unsub = unsubs.get(id);
+      if (unsub) {
+        unsub();
+        unsubs.delete(id);
+      }
+      return;
+    }
+  });
+  ws.on("close", () => {
+    unsubs.forEach((unsub) => unsub());
+    unsubs.clear();
+  });
+}
+function adminHasMethod(admin, method) {
+  if (admin.kind === "game" && admin.game) {
+    return typeof admin.game[method] === "function";
+  }
+  if (admin.kind === "sync" && admin.sync) {
+    return typeof admin.sync[method] === "function";
+  }
+  return false;
+}
+async function invokeAdminMethod(admin, method, args) {
+  const target = admin.kind === "game" ? admin.game : admin.sync;
+  if (!target) return void 0;
+  const fn = target[method];
+  if (typeof fn !== "function") return void 0;
+  return await fn.apply(target, args);
+}
+function subscribeAdmin(admin, kind, cb) {
+  if (kind === "snapshot") {
+    const target = admin.kind === "game" ? admin.game : admin.sync;
+    if (!target) return null;
+    return target.subscribeSnapshot(cb);
+  }
+  if (kind === "events") {
+    if (admin.kind !== "game" || !admin.game) return null;
+    return admin.game.subscribeEvents(cb);
+  }
+  return null;
+}
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function stripHopByHopHeaders(headers) {
+  const out = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (!HOP_BY_HOP_HEADERS.has(name.toLowerCase())) out[name] = value;
+  }
+  return out;
+}
+var scenarioProxyAgent = new Agent({ keepAlive: true, maxSockets: 32 });
+function proxyHttpToScenario(req, res, scenarioUrl) {
+  const target = new URL(scenarioUrl);
+  const proxyReq = httpRequest(
+    {
+      agent: scenarioProxyAgent,
+      hostname: target.hostname,
+      port: target.port,
+      path: req.url,
+      method: req.method,
+      headers: { ...stripHopByHopHeaders(req.headers), host: target.host },
+      timeout: 3e4
+    },
+    (proxyRes) => {
+      res.writeHead(proxyRes.statusCode ?? 502, stripHopByHopHeaders(proxyRes.headers));
+      proxyRes.pipe(res);
+    }
+  );
+  const fail = () => {
+    if (!res.headersSent) {
+      res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+    }
+    res.end("scenario dev server unreachable");
+  };
+  proxyReq.on("timeout", () => proxyReq.destroy(new Error("proxy timeout")));
+  proxyReq.on("error", fail);
+  res.on("close", () => proxyReq.destroy());
+  req.pipe(proxyReq);
+}
+function proxyUpgradeToScenario(req, socket, head, scenarioUrl) {
+  const target = new URL(scenarioUrl);
+  const proxySocket = netConnect(Number(target.port), target.hostname, () => {
+    const lines = [`${req.method} ${req.url} HTTP/1.1`];
+    for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      const name = req.rawHeaders[i];
+      const value = name.toLowerCase() === "host" ? target.host : req.rawHeaders[i + 1];
+      lines.push(`${name}: ${value}`);
+    }
+    proxySocket.write(lines.join("\r\n") + "\r\n\r\n");
+    if (head.length) proxySocket.write(head);
+    proxySocket.pipe(socket);
+    socket.pipe(proxySocket);
+  });
+  const destroyBoth = () => {
+    proxySocket.destroy();
+    socket.destroy();
+  };
+  proxySocket.on("error", destroyBoth);
+  socket.on("error", destroyBoth);
+  proxySocket.on("close", destroyBoth);
+  socket.on("close", destroyBoth);
+}
+
+// src/dev-server/load-logic.ts
+import { build as build2 } from "esbuild";
+import { existsSync, mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join4, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+function resolveSdkShimPath() {
+  const here = fileURLToPath2(import.meta.url);
+  const shim = here.endsWith(".ts") ? resolve2(dirname2(here), "sdk-server-shim.ts") : resolve2(dirname2(here), "dev-server", "sdk-server-shim.js");
+  if (!existsSync(shim)) {
+    throw new Error(`sdk-server-shim \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${shim}`);
+  }
+  return shim;
+}
+var uzuSdkServerStub = {
+  name: "uzu-sdk-server-stub",
+  setup(build3) {
+    const shimPath = resolveSdkShimPath();
+    build3.onResolve({ filter: /^(@uzuhq\/code-sdk|@uzupj\/uzu-sdk)$/ }, () => ({
+      path: shimPath
+    }));
+  }
+};
+async function loadLogicFromPath(logicPath) {
+  const absPath = resolve2(logicPath);
+  const tempDir = mkdtempSync(join4(tmpdir(), "uzu-dev-logic-"));
+  const outPath = join4(tempDir, "logic.mjs");
+  await build2({
+    entryPoints: [absPath],
+    outfile: outPath,
+    bundle: true,
+    format: "esm",
+    target: "es2022",
+    platform: "neutral",
+    plugins: [uzuSdkServerStub]
+  });
+  const mod = await import(pathToFileURL(outPath).href);
+  const logic = mod.default ?? mod.logic;
+  if (!logic) {
+    throw new Error(
+      `${logicPath} must export a GameLogic object.
+  Use either: export default logic
+  Or:         export const logic: GameLogic<State> = { ... }`
+    );
+  }
+  return {
+    logic,
+    dispose: () => {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  };
+}
+
+// src/harness/page.ts
+function harnessHtml() {
+  return `<!DOCTYPE html>
+<html lang="ja">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<meta name="apple-mobile-web-app-capable" content="yes" />
+<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+<meta name="apple-mobile-web-app-title" content="UZU dev" />
+<title>UZU dev harness</title>
+<style>
+  html, body { margin: 0; padding: 0; width: 100%; height: 100%; background: #1a1a2e; overflow: hidden; }
+</style>
+</head>
+<body>
+<script src="/_uzu_harness.js"></script>
+</body>
+</html>
+`;
+}
+async function buildHarnessClientJs(entryFile) {
+  const esbuild = await import("esbuild");
+  const result = await esbuild.build({
+    entryPoints: [entryFile],
+    bundle: true,
+    format: "iife",
+    target: "es2022",
+    platform: "browser",
+    write: false,
+    minify: false
+  });
+  const out = result.outputFiles?.[0];
+  if (!out) {
+    throw new Error("esbuild produced no output for harness client bundle");
+  }
+  return out.text;
+}
+
+// src/dev.ts
+var DEFAULT_DEV_COMMAND = "pnpm run dev";
+var DEFAULT_READY_PATTERN = "Local:\\s+(https?://[^\\s]+)";
+var DEFAULT_MIN_IFRAME_SHORT_EDGE = 360;
+async function runDevCommand() {
+  const cwd = process.cwd();
+  const manifestPath = resolve3(cwd, "manifest.json");
+  if (!existsSync2(manifestPath)) {
+    console.error("manifest.json \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002 scenario \u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3067\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    process.exit(1);
+  }
+  const manifest = JSON.parse(readFileSync4(manifestPath, "utf-8"));
+  const playerCount = manifest.characters?.length ?? manifest.playerCount ?? 2;
+  const orientation = manifest.orientation ?? "portrait";
+  const devCommand = manifest.dev?.command ?? DEFAULT_DEV_COMMAND;
+  const readyPattern = new RegExp(manifest.dev?.readyPattern ?? DEFAULT_READY_PATTERN);
+  let loaded = null;
+  if (manifest.serverActionLogicPath) {
+    console.log(`[uzu dev] Building server logic from ${manifest.serverActionLogicPath}...`);
+    const logicPath = resolve3(cwd, manifest.serverActionLogicPath);
+    loaded = await loadLogicFromPath(logicPath);
+    console.log("[uzu dev] Server logic ready");
+  }
+  const thisDir = dirname3(fileURLToPath3(import.meta.url));
+  const clientEntryJs = resolve3(thisDir, "harness", "client-entry.js");
+  const clientEntryTs = resolve3(thisDir, "harness", "client-entry.ts");
+  const clientEntry = existsSync2(clientEntryJs) ? clientEntryJs : existsSync2(clientEntryTs) ? clientEntryTs : null;
+  if (!clientEntry) {
+    console.error(`harness client entry \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${clientEntryJs}`);
+    process.exit(1);
+  }
+  console.log("[uzu dev] Bundling harness client...");
+  const harnessJs = await buildHarnessClientJs(clientEntry);
+  console.log(`[uzu dev] Harness client ready (${harnessJs.length} bytes)`);
+  console.log(`[uzu dev] Spawning: ${devCommand}`);
+  const child = spawn(devCommand, {
+    cwd,
+    shell: true,
+    env: { ...process.env, FORCE_COLOR: "1" },
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const scenarioUrl = await watchForReady(child, readyPattern);
+  console.log(`[uzu dev] Scenario ready at ${scenarioUrl}`);
+  const roomKey = "devroom";
+  const harnessPort = await findFreePort();
+  const lanHosts = currentLanHosts();
+  const players = Array.from({ length: playerCount }, (_, i) => ({
+    id: `dev_${i}`,
+    nickname: manifest.characters?.[i]?.name ?? `Player ${i + 1}`,
+    iconUrl: manifest.characters?.[i]?.icon ?? "",
+    characterId: manifest.characters?.[i]?.id
+  }));
+  const admin = manifest.admin ?? false;
+  const spectator = manifest.spectator ?? false;
+  const meta = {
+    scenarioUrl,
+    playerCount,
+    orientation,
+    players,
+    admin,
+    spectator,
+    roomKey,
+    serverBaseUrl: `ws://localhost:${harnessPort}`,
+    revisionId: "dev",
+    devMinIframeShortEdge: DEFAULT_MIN_IFRAME_SHORT_EDGE
+  };
+  const server = startHarnessServer({
+    port: harnessPort,
+    // 同一 LAN の実機 (スマホ等) から harness / 単一プレイヤー画面を開けるよう
+    // 全 interface で listen する。 GameRoom は in-memory の dev 専用 state のみ。
+    host: HARNESS_HOST,
+    logic: loaded?.logic ?? null,
+    harness: { html: harnessHtml(), js: harnessJs },
+    meta
+  });
+  const harnessUrl = `http://localhost:${harnessPort}/`;
+  console.log("");
+  console.log(`  \u{1F3AE}  UZU dev harness: ${harnessUrl}`);
+  console.log(`      scenario: ${scenarioUrl}`);
+  console.log(`      players: ${playerCount}  orientation: ${orientation}  roomKey: ${roomKey}`);
+  const observerIds = [...spectator ? ["spec_0"] : [], ...admin ? ["admin_0"] : []];
+  if (observerIds.length > 0) {
+    console.log(`      observer seats (roster \u5916): ${observerIds.join(", ")}`);
+  }
+  if (lanHosts.length) {
+    console.log("");
+    console.log(`  \u{1F4F1}  \u540C\u4E00 Wi-Fi \u306E\u5B9F\u6A5F\u304B\u3089 (LAN \u306B\u516C\u958B\u3055\u308C\u3066\u3044\u307E\u3059):`);
+    for (const host of lanHosts) {
+      console.log(`      http://${host}:${harnessPort}/            (5\u4EBA\u30B0\u30EA\u30C3\u30C9)`);
+      console.log(
+        `      http://${host}:${harnessPort}/?player=0   (Player 1 \u5358\u4F53, ?player=0..${playerCount - 1})`
+      );
+    }
+    console.log(`      \u203B scenario \u3078\u306E\u901A\u4FE1\u306F harness \u304C proxy \u3059\u308B\u305F\u3081 vite \u5074\u306E\u8A2D\u5B9A\u306F\u4E0D\u8981\u3067\u3059`);
+  }
+  console.log("");
+  const cleanup = async () => {
+    console.log("\n[uzu dev] Shutting down...");
+    try {
+      await server.stop();
+    } catch {
+    }
+    if (child.pid && !child.killed) {
+      child.kill("SIGTERM");
+    }
+    if (loaded) loaded.dispose();
+  };
+  process.on("SIGINT", () => {
+    void cleanup().then(() => process.exit(0));
+  });
+  process.on("SIGTERM", () => {
+    void cleanup().then(() => process.exit(0));
+  });
+  child.on("exit", (code) => {
+    console.log(`[uzu dev] scenario dev server exited (code=${code})`);
+    void cleanup().then(() => process.exit(code ?? 0));
+  });
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+}
+function watchForReady(child, pattern) {
+  return new Promise((resolve6, reject) => {
+    const timeout = setTimeout(() => {
+      reject(new Error("Timed out waiting for scenario dev server to become ready (30s)"));
+    }, 3e4);
+    let resolved = false;
+    const onLine = (line) => {
+      process.stdout.write(line + "\n");
+      if (resolved) return;
+      const clean = stripAnsi(line);
+      const m = pattern.exec(clean);
+      if (!m) return;
+      const captured = m[1];
+      if (!captured) return;
+      const url = /^https?:\/\//i.test(captured) ? captured : `http://localhost:${captured}`;
+      resolved = true;
+      clearTimeout(timeout);
+      resolve6(url.replace(/\/$/, ""));
+    };
+    if (child.stdout) {
+      const rl = createInterface({ input: child.stdout });
+      rl.on("line", onLine);
+    }
+    if (child.stderr) {
+      const rl = createInterface({ input: child.stderr });
+      rl.on("line", onLine);
+    }
+    child.on("error", (err) => {
+      clearTimeout(timeout);
+      reject(err);
+    });
+    child.on("exit", (code) => {
+      if (!resolved) {
+        clearTimeout(timeout);
+        reject(new Error(`scenario dev server exited before ready (code=${code})`));
+      }
+    });
+  });
+}
+var DEFAULT_HARNESS_PORT = 10001;
+var MAX_HARNESS_PORT_ATTEMPTS = 100;
+var HARNESS_HOST = "0.0.0.0";
+async function findFreePort() {
+  const net = await import("net");
+  const tryPort = (port) => new Promise((resolve6) => {
+    const server = net.createServer();
+    server.unref();
+    server.once("error", () => resolve6(null));
+    server.listen(port, HARNESS_HOST, () => {
+      const address = server.address();
+      const assigned = typeof address === "object" && address !== null ? address.port : port;
+      server.close(() => resolve6(assigned));
+    });
+  });
+  for (let i = 0; i < MAX_HARNESS_PORT_ATTEMPTS; i++) {
+    const candidate = DEFAULT_HARNESS_PORT + i;
+    const ok2 = await tryPort(candidate);
+    if (ok2 != null) return ok2;
+  }
+  const ok = await tryPort(0);
+  if (ok != null) return ok;
+  throw new Error("could not determine free port");
+}
+
+// src/sdk-version.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, resolve as resolve4 } from "path";
+var SDK_PACKAGE_PATHS = [
+  ["@uzuhq", "code-sdk"],
+  ["@uzupj", "uzu-sdk"]
+];
+var readInstalledSdkVersion = (cwd) => {
+  const pkgPath = findSdkPackageJson(cwd);
+  if (!pkgPath) {
+    throw new Error(
+      "@uzuhq/code-sdk \u304C node_modules \u306B\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002\u4F9D\u5B58\u3092 install \u3057\u3066\u304B\u3089 publish \u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+    );
+  }
+  const version = JSON.parse(readFileSync5(pkgPath, "utf-8")).version;
+  if (!version) {
+    throw new Error(`${pkgPath} \u306B version \u304C\u3042\u308A\u307E\u305B\u3093\u3002`);
+  }
+  return version;
+};
+var findSdkPackageJson = (cwd) => {
+  let dir = resolve4(cwd);
+  for (; ; ) {
+    const found = SDK_PACKAGE_PATHS.map(
+      (segments) => resolve4(dir, "node_modules", ...segments, "package.json")
+    ).find(existsSync3);
+    if (found) {
+      return found;
+    }
+    const parent = dirname4(dir);
+    if (parent === dir) {
+      return void 0;
+    }
+    dir = parent;
+  }
+};
+
+// src/auth/browser.ts
+import { spawn as spawn2 } from "node:child_process";
+var openBrowser = (url) => {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", '""', url] : [url];
+  try {
+    const child = spawn2(cmd, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    child.on("error", () => {
+    });
+  } catch {
+  }
+};
+
+// src/auth/jwt.ts
+var parseIdTokenClaims = (idToken) => {
+  const parts = idToken.split(".");
+  const payloadSegment = parts[1];
+  if (parts.length !== 3 || payloadSegment === void 0) {
+    throw new Error("id token is not a well-formed JWT");
+  }
+  let claims;
+  try {
+    claims = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("id token payload is not valid JSON");
+  }
+  const uid = claims.user_id || claims.sub || "";
+  if (!uid) throw new Error("id token has no user_id or sub claim");
+  return { uid, email: claims.email ?? "" };
+};
+
+// src/auth/loopback.ts
+import { createServer as createServer2 } from "node:http";
+var SUCCESS_HTML = `<!doctype html><meta charset="utf-8"><title>uzu: Login successful</title>
+<body style="font-family:system-ui;max-width:480px;margin:80px auto;text-align:center;">
+<h2>Login successful</h2>
+<p>\u3053\u306E\u30BF\u30D6\u3092\u9589\u3058\u3066\u30BF\u30FC\u30DF\u30CA\u30EB\u306B\u623B\u3063\u3066\u304F\u3060\u3055\u3044\u3002</p>
+</body>`;
+var failureHtml = (msg) => {
+  const escaped = msg.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+  return `<!doctype html><meta charset="utf-8"><title>uzu: Login failed</title>
+<body style="font-family:system-ui;max-width:480px;margin:80px auto;text-align:center;">
+<h2>Login failed</h2>
+<p>${escaped}</p>
+</body>`;
+};
+var startLoopbackServer = async () => {
+  let resolve6 = null;
+  let reject = null;
+  let delivered = false;
+  let pending = null;
+  const server = createServer2((req, res) => {
+    if (!req.url?.startsWith("/callback")) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    if (delivered) {
+      res.writeHead(410, { "Content-Type": "text/plain" });
+      res.end("already handled");
+      return;
+    }
+    delivered = true;
+    const url = new URL(req.url, "http://127.0.0.1");
+    const err = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    if (err) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(failureHtml(`auth server returned error: ${err}`));
+      const e = new Error(`auth server returned error: ${err}`);
+      if (reject) reject(e);
+      else pending = { err: e };
+      return;
+    }
+    if (!code) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(failureHtml("missing authorization code"));
+      const e = new Error("authorization code missing in callback");
+      if (reject) reject(e);
+      else pending = { err: e };
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(SUCCESS_HTML);
+    if (resolve6) resolve6(code);
+    else pending = { code };
+  });
+  await new Promise((res, rej) => {
+    server.once("error", rej);
+    server.listen(0, "127.0.0.1", () => res());
+  });
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  return {
+    port,
+    redirectUri,
+    waitForCode: (timeoutMs) => new Promise((res, rej) => {
+      if (pending) {
+        if ("code" in pending) res(pending.code);
+        else rej(pending.err);
+        return;
+      }
+      const t = setTimeout(
+        () => rej(new Error(`login timed out after ${timeoutMs}ms`)),
+        timeoutMs
+      );
+      resolve6 = (code) => {
+        clearTimeout(t);
+        res(code);
+      };
+      reject = (err) => {
+        clearTimeout(t);
+        rej(err);
+      };
+    }),
+    close: () => server.close()
+  };
+};
+
+// src/auth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+var base64url = (buf) => buf.toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+var generateCodeVerifier = () => base64url(randomBytes(32));
+var computeCodeChallenge = (verifier) => base64url(createHash("sha256").update(verifier).digest());
+
+// src/auth/login-flow.ts
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var runLoginFlow = async (env, onURL) => {
+  const verifier = generateCodeVerifier();
+  const challenge = computeCodeChallenge(verifier);
+  const server = await startLoopbackServer();
+  try {
+    const baseUrl = authBaseURL(env);
+    const loginUrl = buildLoginURL(baseUrl, server.redirectUri, challenge);
+    onURL?.(loginUrl);
+    openBrowser(loginUrl);
+    const code = await server.waitForCode(LOGIN_TIMEOUT_MS);
+    const tokens = await exchangeCodeForTokens(baseUrl, code, verifier, server.redirectUri);
+    const { uid, email } = parseIdTokenClaims(tokens.accessToken);
+    return {
+      email,
+      uid,
+      refreshToken: tokens.refreshToken,
+      idToken: tokens.accessToken,
+      expiresIn: tokens.expiresIn
+    };
+  } finally {
+    server.close();
+  }
+};
+
+// src/cli.ts
+var envOption = () => new Option("--env <env>", "\u63A5\u7D9A\u5148\u74B0\u5883 (dev | stg | prd)").default(DEFAULT_ENV).hideHelp();
+var readOwnCliVersion = () => {
+  const pkgPath = resolve5(dirname5(fileURLToPath4(import.meta.url)), "..", "package.json");
+  const version = JSON.parse(readFileSync6(pkgPath, "utf-8")).version;
+  if (!version) {
+    throw new Error("uzu-cli \u306E package.json \u306B version \u304C\u3042\u308A\u307E\u305B\u3093\u3002");
+  }
+  return version;
+};
+var OWN_CLI_VERSION = readOwnCliVersion();
+var program = new Command();
+program.name("uzu").description("UZU \u30B2\u30FC\u30E0\u958B\u767A CLI").version(OWN_CLI_VERSION);
+program.command("create-2d-game").description("2D \u30A8\u30F3\u30B8\u30F3\u3092\u4F7F\u3063\u305F\u30B2\u30FC\u30E0\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u96DB\u5F62\u3092\u4F5C\u6210").argument("<name>", "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u540D\uFF08\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u540D\uFF09").action((name) => {
+  create2dGame(name);
+});
+program.command("dev").description(
+  "scenario \u306E dev server \u3092\u8D77\u52D5\u3057\u3001 dev harness (iframe grid + HUD) \u3068 in-memory GameRoom / SyncRoom / RelayRoom \u3092\u63D0\u4F9B\u3059\u308B"
+).action(async () => {
+  try {
+    await runDevCommand();
+  } catch (err) {
+    console.error("[uzu dev]", err);
+    process.exit(1);
+  }
+});
+program.command("publish").description("\u30B2\u30FC\u30E0\u3092\u30D3\u30EB\u30C9\u3057\u3066 R2 \u306B\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9 \u2192 \u767B\u9332").option("--change-notes <msg>", "\u30EA\u30D3\u30B8\u30E7\u30F3\u306E\u5909\u66F4\u30E1\u30E2", "").addOption(envOption()).action(async (options) => {
+  const env = resolveEnv(options.env);
+  const cwd = process.cwd();
+  const manifestPath = resolve5(cwd, "manifest.json");
+  if (!existsSync4(manifestPath)) {
+    console.error("manifest.json \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002\u30B2\u30FC\u30E0\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3067\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002");
+    process.exit(1);
+  }
+  const manifest = JSON.parse(readFileSync6(manifestPath, "utf-8"));
+  if (typeof manifest !== "object" || manifest === null) {
+    console.error("manifest.json \u304C\u4E0D\u6B63\u306A\u5F62\u5F0F\u3067\u3059\u3002");
+    process.exit(1);
+  }
+  if (!manifest.id || !manifest.playerCount || !manifest.output) {
+    console.error("manifest.json \u306B id \u3068 playerCount \u3068 output \u304C\u5FC5\u8981\u3067\u3059\u3002");
+    process.exit(1);
+  }
+  const gameId = manifest.id;
+  const manifestCharacters = manifest.characters;
+  if (manifestCharacters !== void 0) {
+    if (manifestCharacters.length === 0) {
+      console.error("characters \u304C\u7A7A\u306E\u914D\u5217\u3067\u3059\u3002");
+      process.exit(1);
+    }
+    for (const c of manifestCharacters) {
+      if (!c.id || !c.name) {
+        console.error("characters \u306E\u5404\u8981\u7D20\u306B id \u3068 name \u304C\u5FC5\u8981\u3067\u3059\u3002");
+        process.exit(1);
+      }
+    }
+  }
+  const playerCount = manifestCharacters?.length ?? manifest.playerCount;
+  const rawOrientation = manifest.orientation ?? "portrait";
+  if (rawOrientation !== "portrait" && rawOrientation !== "landscape") {
+    console.error(
+      `manifest.json \u306E orientation \u306F portrait \u304B landscape \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044 (\u6307\u5B9A\u5024: ${String(rawOrientation)})`
+    );
+    process.exit(1);
+  }
+  const orientation = rawOrientation;
+  const buildCommand = manifest.build;
+  const outputDir = manifest.output;
+  console.log(
+    `Publishing game: ${gameId} (players: ${playerCount}, orientation: ${orientation})`
+  );
+  let sdkVersion;
+  try {
+    sdkVersion = readInstalledSdkVersion(cwd);
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+  await getValidIdToken(env).catch((e) => {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  });
+  if (buildCommand) {
+    console.log("Building...");
+    execSync(buildCommand, { stdio: "inherit", cwd });
+  }
+  console.log("Creating ZIP...");
+  const absoluteOutputDir = resolve5(cwd, outputDir);
+  const zipPath = resolve5(cwd, "__zip__.zip");
+  await new Promise((res, reject) => {
+    const output = createWriteStream(zipPath);
+    const archive = new ZipArchive({ zlib: { level: 9 } });
+    output.on("close", () => res());
+    archive.on("error", (err) => reject(err));
+    archive.pipe(output);
+    archive.directory(absoluteOutputDir, false);
+    archive.finalize();
+  });
+  console.log(`Created: ${zipPath}`);
+  console.log("Uploading to R2...");
+  const { resourceId, revisionId, token } = await uploadGameToR2(env, zipPath, absoluteOutputDir);
+  console.log(`Uploaded to R2. revisionId: ${revisionId}, resourceId: ${resourceId}`);
+  if (manifest.serverActionLogicPath) {
+    const logicEntryPoint = resolve5(cwd, manifest.serverActionLogicPath);
+    const logicOutPath = resolve5(cwd, "__logic__.js");
+    try {
+      console.log("Building server logic...");
+      await buildServerLogic(logicEntryPoint, logicOutPath);
+      const logicModule = await import(pathToFileURL2(logicOutPath).href);
+      const resolvedLogic = logicModule.default ?? logicModule.logic;
+      if (!resolvedLogic) {
+        console.error(
+          `Error: ${manifest.serverActionLogicPath} must export a GameLogic object.
+  Use either: export default logic
+  Or:         export const logic: GameLogic<State> = { ... }`
+        );
+        process.exit(1);
+      }
+      console.log("Uploading logic.js to R2...");
+      const logicJsContent = readFileSync6(logicOutPath, "utf-8");
+      await uploadLogicToR2(env, token, logicJsContent);
+    } finally {
+      if (existsSync4(logicOutPath)) unlinkSync(logicOutPath);
+    }
+  }
+  let resolvedCharacters;
+  if (manifestCharacters) {
+    console.log("Resolving character icons...");
+    const isLocalIcon = (char) => !!char.icon && !char.icon.startsWith("http://") && !char.icon.startsWith("https://");
+    const localIconPaths = manifestCharacters.filter(isLocalIcon).map((char) => {
+      const iconAbsPath = resolve5(cwd, char.icon);
+      if (!existsSync4(iconAbsPath)) {
+        console.error(`\u30A2\u30A4\u30B3\u30F3\u30D5\u30A1\u30A4\u30EB\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${char.icon}`);
+        process.exit(1);
+      }
+      return iconAbsPath;
+    });
+    const iconURLs = await uploadIconsToCfImages(env, token, localIconPaths);
+    resolvedCharacters = manifestCharacters.map((char) => {
+      if (!isLocalIcon(char)) return char;
+      const cfImagesUrl = iconURLs.get(resolve5(cwd, char.icon));
+      if (!cfImagesUrl) {
+        console.error(`\u30A2\u30A4\u30B3\u30F3\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u7D50\u679C\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093: ${char.icon}`);
+        process.exit(1);
+      }
+      console.log(`Uploaded icon: ${char.icon}`);
+      return { ...char, icon: cfImagesUrl };
     });
+  }
+  console.log("Registering revision...");
+  const revId = await registerRevision({
+    env,
+    gameId,
+    resourceId,
+    uploadToken: token,
+    changeNotes: options.changeNotes || "",
+    playerCount,
+    orientation,
+    characters: resolvedCharacters,
+    manifest,
+    publishMeta: { sdkVersion, cliVersion: OWN_CLI_VERSION }
+  });
+  console.log(`Registered revision: ${revId}`);
+  unlinkSync(zipPath);
+  const studioUrl = `https://${studioHost(env)}/ja/scenarios/global-id/${gameId}`;
+  console.log("\nDone!");
+  console.log(`UZU Studio: ${studioUrl}`);
 });
-tokenCommand
-    .command('revoke')
-    .description('publish token を失効させる')
-    .argument('<id>', '失効させる token の id (uzu token list で確認)')
-    .addOption(envOption())
-    .action(async (id, options) => {
-    await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
-        await revokePublishToken(baseUrl, idToken, id);
-        console.log(`失効しました: ${id} (env: ${env})`);
+program.command("login").description("UZU \u306B\u30ED\u30B0\u30A4\u30F3\u3057\u3066 publish \u7528\u306E\u8A8D\u8A3C\u60C5\u5831\u3092\u4FDD\u5B58").addOption(envOption()).action(async (options) => {
+  const env = resolveEnv(options.env);
+  let result;
+  try {
+    result = await runLoginFlow(env, (url) => {
+      console.log("\u30D6\u30E9\u30A6\u30B6\u3067 Google \u30ED\u30B0\u30A4\u30F3\u3092\u958B\u304D\u307E\u3059\u3002");
+      console.log("\u81EA\u52D5\u3067\u958B\u304B\u306A\u3044\u5834\u5408\u306F\u6B21\u306E URL \u3092\u8E0F\u3093\u3067\u304F\u3060\u3055\u3044:");
+      console.log(`  ${url}`);
     });
+  } catch (e) {
+    console.error(`\u30ED\u30B0\u30A4\u30F3\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${e.message}`);
+    process.exit(1);
+  }
+  await saveCredentials(env, {
+    uid: result.uid,
+    email: result.email,
+    refreshToken: result.refreshToken,
+    loggedInAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  console.log(`
+\u30ED\u30B0\u30A4\u30F3\u3057\u307E\u3057\u305F: ${result.email} (env: ${env})`);
+  console.log(`\u4FDD\u5B58\u5148: ${credentialsPath()} (mode 0600)`);
+});
+program.command("logout").description("\u4FDD\u5B58\u6E08\u307F\u306E\u8A8D\u8A3C\u60C5\u5831\u3092\u524A\u9664").addOption(envOption()).action(async (options) => {
+  const env = resolveEnv(options.env);
+  const removed = await clearCredentials(env);
+  if (removed) {
+    console.log(`\u30ED\u30B0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F (env: ${env})`);
+  } else {
+    console.log(`\u30ED\u30B0\u30A4\u30F3\u60C5\u5831\u306F\u3042\u308A\u307E\u305B\u3093 (env: ${env})`);
+  }
+});
+var tokenCommand = program.command("token").description("CI \u7528 publish token \u306E\u7BA1\u7406");
+var runTokenCommand = async (rawEnv, fn) => {
+  const env = resolveEnv(rawEnv);
+  try {
+    const idToken = await getLoginIdToken(env);
+    await fn({ env, baseUrl: authBaseURL(env), idToken });
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+};
+tokenCommand.command("create").description("publish token \u3092\u767A\u884C\u3059\u308B (\u5E73\u6587\u306F\u3053\u306E 1 \u56DE\u3057\u304B\u8868\u793A\u3055\u308C\u306A\u3044)").option("--name <label>", "\u30C8\u30FC\u30AF\u30F3\u306E\u7528\u9014\u304C\u308F\u304B\u308B\u8868\u793A\u540D", "").addOption(envOption()).action(async (options) => {
+  await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
+    const issued = await createPublishToken(baseUrl, idToken, options.name);
+    console.log(`publish token \u3092\u767A\u884C\u3057\u307E\u3057\u305F (env: ${env})`);
+    console.log(`  id:   ${issued.id}`);
+    console.log(`  name: ${issued.name || "(\u306A\u3057)"}`);
+    console.log("");
+    console.log(`  ${issued.token}`);
+    console.log("");
+    console.log("\u3053\u306E\u5E73\u6587\u306F\u518D\u8868\u793A\u3067\u304D\u307E\u305B\u3093\u3002CI \u3067\u306F secret \u306B\u767B\u9332\u3057\u3001");
+    console.log(`${PUBLISH_TOKEN_ENV} \u3068\u3057\u3066\u6E21\u3057\u3066\u304F\u3060\u3055\u3044\u3002`);
+  });
+});
+tokenCommand.command("list").description("\u6709\u52B9\u306A publish token \u3092\u4E00\u89A7\u3059\u308B").addOption(envOption()).action(async (options) => {
+  await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
+    const tokens = await listPublishTokens(baseUrl, idToken);
+    if (tokens.length === 0) {
+      console.log(`publish token \u306F\u3042\u308A\u307E\u305B\u3093 (env: ${env})`);
+      return;
+    }
+    for (const t of tokens) {
+      console.log(
+        `${t.id}  ${t.name || "(\u306A\u3057)"}  created=${t.createdAt}  lastUsed=${t.lastUsedAt ?? "-"}`
+      );
+    }
+  });
+});
+tokenCommand.command("revoke").description("publish token \u3092\u5931\u52B9\u3055\u305B\u308B").argument("<id>", "\u5931\u52B9\u3055\u305B\u308B token \u306E id (uzu token list \u3067\u78BA\u8A8D)").addOption(envOption()).action(async (id, options) => {
+  await runTokenCommand(options.env, async ({ env, baseUrl, idToken }) => {
+    await revokePublishToken(baseUrl, idToken, id);
+    console.log(`\u5931\u52B9\u3057\u307E\u3057\u305F: ${id} (env: ${env})`);
+  });
 });
 program.parse();