@zaisma/cli 0.12.0 → 0.14.0

package/README.md

@@ -4,13 +4,15 @@ Upload and publish browser games on [Zaisma](https://zaisma.com) from the comman
 
 Run it with `npx @zaisma/cli <command>`, or install it once with `npm install -g @zaisma/cli` and run `zaisma <command>`.
 
+Before anything else, `zaisma check ./build` lists anything in the game Zaisma would refuse or that won't work on Zaisma (threaded engine builds, `alert()`, forms, servers the game hasn't listed…), each with how to fix it. It needs no key and sends nothing.
+
 1. Make an API key at https://zaisma.com/account, under Game developers, and set it: `export ZAISMA_KEY=zsk_…`
 2. Make a game: `zaisma new "Sky Hopper"`
-3. Upload your build folder (the one with `index.html`): `zaisma upload ./build --game sky-hopper --patch-notes "First version"`. Only new or changed files are sent. Once the scan passes you get a private preview link.
+3. Upload your build folder (the one with `index.html`): `zaisma upload ./build --game sky-hopper --patch-notes "First version"`. Only new or changed files are sent. It runs the check first, and in what it sends (never in your folder) it downloads scripts, styles and fonts the game loads from other sites and unpacks pre-compressed builds (`.gz`, `.br`, `.unityweb`), then says what it changed. Once the scan passes you get a private preview link.
 4. Publish it: `zaisma publish sky-hopper <version_id>`, then show it to everyone: `zaisma visibility sky-hopper listed`
 
 `zaisma versions <slug>` lists versions and their preview links; `zaisma publish` with an older version rolls back, and `--scheduled-publish-at "2026-11-01T17:00+01:00"` publishes later (an ISO time with `Z` or an offset; `zaisma unschedule` cancels). Files over 95 MB are sent in parts automatically, up to 500 MB each.
 
-For scripts, CI and AI tools: every command takes `--json` and prints the API's answer as-is, or its `{ "error": { code, message, field, fix, retry_after_sec } }`. Commands refuse flags and choices they don't take instead of ignoring them, and the exit code says how it went: `0` done (for upload: passed), `1` failed, `2` a wrong command line (nothing was sent), `3` held for a person to look at, `4` rejected, `5` still scanning. `zaisma help --json` lists every command, flag and code.
+For scripts, CI and AI tools: every command takes `--json` and prints the API's answer as-is, or its `{ "error": { code, message, field, fix, retry_after_sec } }`. Commands refuse flags and choices they don't take instead of ignoring them, and the exit code says how it went: `0` done (for upload: passed), `1` failed, `2` a wrong command line (nothing was sent), `3` held for a person to look at, `4` rejected, `5` still scanning, `6` the check found something to fix. `zaisma help --json` lists every command, flag and code.
 
 Found a bug in Zaisma, or missing something? Search the developer forum first with `zaisma forum --search "too_big"`. `zaisma forum post --kind bug --title "…" --category mcp --text "…"` starts a public topic, and `zaisma forum message …` sends Zaisma a private one (logs, an unreleased game). `zaisma forum` lists your topics and messages, `zaisma forum <topic_id>` shows one with its replies, and `zaisma forum reply <topic_id> --text "…"` replies (`--reopen` if a fixed one is back). Posts say an AI wrote them unless you add `--by-me`. Everything here uses the [developer API](https://github.com/zaisma/zaisma/blob/main/docs/DEVELOPER-API.md#the-upload-command).

package/check.d.mts

@@ -0,0 +1,70 @@
+// Types for check.mjs, so the site imports the game check type-checked.
+
+export type CheckProblemCode =
+  | "no_index_html"
+  | "file_type_not_allowed"
+  | "precompressed_file"
+  | "hidden_file"
+  | "duplicate_path"
+  | "bad_path"
+  | "file_too_big"
+  | "game_too_big"
+  | "too_many_files"
+  | "outside_file"
+  | "outside_address"
+  | "address_not_allowed"
+  | "needs_threads"
+  | "browser_dialog"
+  | "form_submission"
+  | "file_download"
+  | "outside_link"
+  | "outside_frame"
+  | "blocked_feature";
+
+export type ProblemKind = "refused" | "broken";
+
+export interface CheckedFile {
+  path: string;
+  sizeBytes: number;
+  /** The file's text for the checked text files (CHECKED_TEXT_EXTENSIONS), null for the rest. */
+  contentText: string | null;
+}
+
+export interface CheckProblem {
+  code: CheckProblemCode;
+  problem_kind: ProblemKind;
+  is_fixed_by_upload_command: boolean;
+  message: string;
+  path: string | null;
+  quote: string | null;
+  fix: string;
+}
+
+export interface GameCheck {
+  file_count: number;
+  size_bytes: number;
+  problems: CheckProblem[];
+  omitted_problem_count: number;
+}
+
+export type ReferenceKind = "script" | "module" | "style" | "file" | "import_map";
+
+export interface OutsideReference {
+  url: string;
+  start: number;
+  end: number;
+  referenceKind: ReferenceKind;
+  quote: string;
+  importMapKey: string | null;
+}
+
+export const GAME_FILE_EXTENSIONS: string[];
+export const UPLOAD_LIMITS: { maximumGameSizeBytes: number; maximumFileSizeBytes: number; maximumFileCount: number; maximumPathCharacterCount: number };
+export const CHECKED_TEXT_EXTENSIONS: string[];
+export const PRECOMPRESSED_EXTENSIONS: string[];
+export const MAXIMUM_PROBLEM_COUNT: number;
+export const CHECK_PROBLEM_CODES: Record<CheckProblemCode, { problemKind: ProblemKind; isFixedByUploadCommand: boolean; meaning: string }>;
+export function extensionOf(path: string): string;
+export function isEngineOutput(path: string, lowercasePaths: Set<string>): boolean;
+export function findOutsideReferences(text: string, fileKind: "html" | "css" | "module", options?: { baseUrl?: string | null }): OutsideReference[];
+export function checkGameFiles(files: CheckedFile[], options?: { slug?: string | null; ownServerUrls?: readonly string[] | null }): GameCheck;

package/check.mjs

@@ -0,0 +1,356 @@
+// The game check behind `zaisma check`, the MCP's check_game and POST /api/dev/check: what Zaisma would
+// refuse in a game, and what won't work inside its game frame, each with how to fix it. Plain JavaScript
+// with no imports, so the upload command runs it in Node and the site imports it as it is.
+// Docs: https://github.com/zaisma/zaisma/blob/main/docs/DEVELOPER-API.md#checking-a-game
+
+/** Every file type a game may contain: the extensions in CONTENT_TYPES (packages/core/src/mime.ts), in its order. */
+export const GAME_FILE_EXTENSIONS = [
+  "html", "htm", "js", "mjs", "css", "json", "map", "txt", "md", "xml", "csv", "wasm", "png", "jpg", "jpeg", "gif", "webp", "avif", "svg", "ico", "bmp",
+  "mp3", "ogg", "oga", "opus", "wav", "m4a", "aac", "flac", "mp4", "webm", "woff", "woff2", "ttf", "otf", "glb", "gltf", "obj", "mtl", "ktx2", "basis", "hdr",
+  "bin", "data", "dat", "pck", "atlas", "fnt", "tmx", "tsx", "tmj", "ldtk",
+];
+
+/** The upload limits the API refuses past (FILE_LIMITS in packages/core/src/uploads.ts, and a path's length in ZIP_LIMITS). */
+export const UPLOAD_LIMITS = { maximumGameSizeBytes: 2 * 1024 * 1024 * 1024, maximumFileSizeBytes: 500 * 1024 * 1024, maximumFileCount: 20_000, maximumPathCharacterCount: 200 };
+
+/** The files whose text the check reads; for every other file it needs only the path and size. */
+export const CHECKED_TEXT_EXTENSIONS = ["html", "htm", "js", "mjs", "css"];
+
+/** Files a pre-compressed build has, which the upload command unpacks. */
+export const PRECOMPRESSED_EXTENSIONS = ["gz", "br", "unityweb"];
+
+/** The most problems one answer lists; the rest are counted in omitted_problem_count. */
+export const MAXIMUM_PROBLEM_COUNT = 200;
+
+/**
+ * Every problem the check finds. refused: Zaisma refuses the upload as it is. broken: it uploads, but that
+ * part won't work on Zaisma. The file-list codes are the API's own error codes, with the same meanings.
+ */
+export const CHECK_PROBLEM_CODES = {
+  no_index_html: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "There's no index.html at the top." },
+  file_type_not_allowed: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "A file is of a type games can't have." },
+  precompressed_file: { problemKind: "refused", isFixedByUploadCommand: true, meaning: "A file is pre-compressed (.gz, .br or Unity's .unityweb); the upload command unpacks it." },
+  hidden_file: { problemKind: "refused", isFixedByUploadCommand: true, meaning: "A file or folder's name starts with a dot; the upload command leaves it out." },
+  duplicate_path: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "Two files share a path (paths don't depend on case)." },
+  bad_path: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "A path is absolute, has . or .. or an empty part in it, has control characters or is over 200 characters." },
+  file_too_big: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "A file is over 500 MB." },
+  game_too_big: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "The game is over 2 GB." },
+  too_many_files: { problemKind: "refused", isFixedByUploadCommand: false, meaning: "The game has more than 20,000 files." },
+  outside_file: { problemKind: "broken", isFixedByUploadCommand: true, meaning: "The page, a stylesheet or a module loads a file from another site; the upload command downloads it into the game." },
+  outside_address: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "The code connects to or loads from another site while it runs." },
+  address_not_allowed: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "The code connects to an address no game can use: plain ws:// or http://, localhost, or an IP address." },
+  needs_threads: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "The build needs threads (SharedArrayBuffer), which games on Zaisma don't have." },
+  browser_dialog: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "alert, confirm or prompt, which never show in the game's frame." },
+  form_submission: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "A form, which never submits in the game's frame." },
+  file_download: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "A file download, which the game's frame doesn't allow." },
+  outside_link: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "A link that opens another site or a new window, which the game's frame doesn't allow." },
+  outside_frame: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "A frame of another site, which games can't show." },
+  blocked_feature: { problemKind: "broken", isFixedByUploadCommand: false, meaning: "Camera, microphone, screen capture, location, payments, USB, serial, Bluetooth or HID, which games on Zaisma can't use." },
+};
+
+/** Hosts that appear in nearly every file and never load anything (the scan's own list, packages/core/src/scan/static.ts). */
+const IGNORED_HOSTS = new Set(["www.w3.org", "w3.org", "schemas.xmlsoap.org", "ns.adobe.com", "purl.org", "xmlns.com"]);
+/** Zaisma's own hosts: rooms are always allowed, and the game's own site is the game domain. */
+const isZaismaHost = (host) => host === "zaisma.com" || host.endsWith(".zaisma.com") || host === "zaismausercontent.com" || host.endsWith(".zaismausercontent.com");
+const isLocalHost = (host) => host === "localhost" || host.endsWith(".localhost") || /^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.startsWith("[");
+
+/** The extension of a path's last part, lowercase, without the dot; "" when it has none. */
+export const extensionOf = (path) => {
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  const dotIndex = name.lastIndexOf(".");
+  return dotIndex > 0 ? name.slice(dotIndex + 1).toLowerCase() : "";
+};
+
+/** A match's text for people and AIs to search for: on one line, up to 120 characters. */
+const quoteOf = (text) => {
+  const line = text.replace(/\s+/g, " ").trim();
+  return line.length > 120 ? `${line.slice(0, 117)}…` : line;
+};
+
+/** The line a match is on, for people and AIs to search for: up to 120 characters, around the match when the line is longer. */
+const lineAround = (text, index) => {
+  const lineStart = text.lastIndexOf("\n", index) + 1;
+  const lineEnd = text.indexOf("\n", index) === -1 ? text.length : text.indexOf("\n", index);
+  const windowStartIndex = Math.max(lineStart, Math.min(index - 40, lineEnd - 120));
+  return quoteOf(text.slice(windowStartIndex, Math.min(lineEnd, windowStartIndex + 120)));
+};
+
+/**
+ * Engine and library output: Unity's framework and loader, a .js beside a .wasm of the same name (Godot,
+ * Emscripten) and minified libraries. Their code mentions dialogs, cameras and the like without the game
+ * using them, so the behaviour checks skip them.
+ */
+export function isEngineOutput(path, lowercasePaths) {
+  const lowercasePath = path.toLowerCase();
+  if (/\.(framework|loader)\.js$/.test(lowercasePath) || /\.min\.m?js$/.test(lowercasePath)) return true;
+  return /\.m?js$/.test(lowercasePath) && lowercasePaths.has(lowercasePath.replace(/\.m?js$/, ".wasm"));
+}
+
+/** An attribute's value in a tag, with where the value starts and ends in the whole text. */
+function attributeOf(tag, tagStart, name) {
+  const match = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>"']+))`, "i").exec(tag);
+  if (!match) return null;
+  const attributeValue = match[1] ?? match[2] ?? match[3] ?? "";
+  const valueStartIndex = tagStart + match.index + match[0].length - attributeValue.length - (match[3] === undefined ? 1 : 0);
+  return { attributeValue, start: valueStartIndex, end: valueStartIndex + attributeValue.length };
+}
+
+/** An absolute http(s) URL for a reference, or null when it isn't one to download. */
+function resolveReference(raw, baseUrl, isModuleSpecifier) {
+  const given = raw.trim();
+  if (!given || /^(data|blob|javascript|about|mailto):/i.test(given) || given.startsWith("#") || /^(\.\/)?_zaisma\//.test(given)) return null;
+  const isAbsolute = /^(https?:)?\/\//i.test(given);
+  if (!isAbsolute && !baseUrl) return null;
+  // A bare module name ("three") is the import map's to resolve, not a file.
+  if (!isAbsolute && isModuleSpecifier && !/^(\.{1,2})?\//.test(given)) return null;
+  try {
+    const url = new URL(given.startsWith("//") ? `https:${given}` : given, baseUrl ?? undefined);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+
+const IMPORT_PATTERN = /(?:^|[^\w$.])(?:import|export)\s*(?:[\w$*{}\s,]*?\bfrom\s*)?(["'])([^"'\n]+?)\1/g;
+const DYNAMIC_IMPORT_PATTERN = /(?:^|[^\w$.])import\s*\(\s*(["'`])([^"'`\n]+?)\1\s*\)/g;
+const CSS_IMPORT_PATTERN = /@import\s+(?:url\(\s*)?(["']?)([^"')\s;]+)\1/gi;
+const CSS_URL_PATTERN = /url\(\s*(["']?)([^"')]+?)\1\s*\)/gi;
+
+/**
+ * Every outside file a text loads: where the URL stands in the text (start, end), what kind of reference it
+ * is and the URL it resolves to. fileKind is html, css or module. Without a baseUrl (the game's own files)
+ * only http(s) and // URLs count; with one (a file downloaded from baseUrl) relative ones count too.
+ * referenceKind: script (a classic script tag), module, style, file or import_map (importMapKey is set; a
+ * key ending in / is a prefix).
+ */
+export function findOutsideReferences(text, fileKind, { baseUrl = null } = {}) {
+  const references = [];
+  const add = (raw, start, referenceKind, quote, isModuleSpecifier = false, importMapKey = null) => {
+    const url = resolveReference(raw, baseUrl, isModuleSpecifier);
+    if (url) references.push({ url, start, end: start + raw.length, referenceKind, quote: quoteOf(quote), importMapKey });
+  };
+  const findCss = (css, offset) => {
+    const importSpans = [];
+    for (const match of css.matchAll(CSS_IMPORT_PATTERN)) {
+      importSpans.push([match.index, match.index + match[0].length]);
+      add(match[2], offset + match.index + match[0].lastIndexOf(match[2]), "style", match[0]);
+    }
+    for (const match of css.matchAll(CSS_URL_PATTERN)) {
+      if (importSpans.some(([start, end]) => match.index >= start && match.index < end)) continue;
+      add(match[2], offset + match.index + match[0].indexOf(match[2], 4), "file", match[0]);
+    }
+  };
+  const findModule = (code, offset) => {
+    for (const pattern of [IMPORT_PATTERN, DYNAMIC_IMPORT_PATTERN]) {
+      for (const match of code.matchAll(pattern)) add(match[2], offset + match.index + match[0].lastIndexOf(match[1] + match[2]) + 1, "module", match[0], true);
+    }
+  };
+  if (fileKind === "css") findCss(text, 0);
+  if (fileKind === "module") findModule(text, 0);
+  if (fileKind !== "html") return references.sort((first, second) => first.start - second.start);
+
+  for (const match of text.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi)) {
+    const openingTag = `<script${match[1]}>`;
+    const type = (attributeOf(openingTag, match.index, "type")?.attributeValue ?? "").toLowerCase();
+    const source = attributeOf(openingTag, match.index, "src");
+    const contentStart = match.index + openingTag.length;
+    if (source) add(source.attributeValue, source.start, type === "module" ? "module" : "script", openingTag);
+    else if (type === "importmap") {
+      let importMap;
+      try {
+        importMap = JSON.parse(match[2]);
+      } catch {
+        continue;
+      }
+      let searchFromIndex = 0;
+      const entries = [...Object.entries(importMap?.imports ?? {}), ...Object.values(importMap?.scopes ?? {}).flatMap((scope) => Object.entries(scope ?? {}))];
+      for (const [key, mappedUrl] of entries) {
+        if (typeof mappedUrl !== "string") continue;
+        const written = JSON.stringify(mappedUrl);
+        const foundIndex = match[2].indexOf(written, searchFromIndex);
+        if (foundIndex === -1) continue;
+        searchFromIndex = foundIndex + written.length;
+        add(mappedUrl, contentStart + foundIndex + 1, "import_map", `"${key}": ${written}`, false, key);
+      }
+    } else if (type === "module") findModule(match[2], contentStart);
+  }
+  for (const match of text.matchAll(/<link\b[^>]*>/gi)) {
+    const relations = (attributeOf(match[0], match.index, "rel")?.attributeValue ?? "").toLowerCase().split(/\s+/);
+    const link = attributeOf(match[0], match.index, "href");
+    if (!link) continue;
+    if (relations.includes("stylesheet")) add(link.attributeValue, link.start, "style", match[0]);
+    else if (relations.includes("modulepreload")) add(link.attributeValue, link.start, "module", match[0]);
+    else if (relations.includes("preload") && (attributeOf(match[0], match.index, "as")?.attributeValue ?? "").toLowerCase() === "script") add(link.attributeValue, link.start, "script", match[0]);
+    else if (relations.some((relation) => ["icon", "apple-touch-icon", "preload"].includes(relation))) add(link.attributeValue, link.start, "file", match[0]);
+  }
+  for (const match of text.matchAll(/<(?:img|audio|video|source)\b[^>]*>/gi)) {
+    const media = attributeOf(match[0], match.index, "src");
+    if (media) add(media.attributeValue, media.start, "file", match[0]);
+  }
+  for (const match of text.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)) findCss(match[1], match.index + match[0].indexOf(">") + 1);
+  for (const match of text.matchAll(/\sstyle\s*=\s*(?:"([^"]*)"|'([^']*)')/gi)) {
+    const css = match[1] ?? match[2];
+    findCss(css, match.index + match[0].indexOf(css, match[0].indexOf("=")));
+  }
+  return references.sort((first, second) => first.start - second.start);
+}
+
+/** Addresses code connects to or loads from while it runs: any ws(s):// text, and http(s) URLs given straight to the calls that load. */
+const ADDRESS_PATTERNS = [
+  /(["'`])(wss?:\/\/[^"'`\s]+)\1/g,
+  /\b(?:fetch|WebSocket|EventSource|importScripts|Worker|Audio|io)\s*\(\s*(["'`])((?:https?|wss?):\/\/[^"'`\s]+)\1/g,
+  /\.open\s*\(\s*["'`][A-Za-z]+["'`]\s*,\s*(["'`])(https?:\/\/[^"'`\s]+)\1/g,
+  /\.src\s*=\s*(["'`])(https?:\/\/[^"'`\s]+)\1/g,
+];
+
+function findAddresses(text) {
+  const addresses = [];
+  for (const pattern of ADDRESS_PATTERNS) {
+    for (const match of text.matchAll(pattern)) {
+      let url;
+      try {
+        url = new URL(match[2]);
+      } catch {
+        continue;
+      }
+      if (url.hostname.includes("$")) continue;
+      addresses.push({ index: match.index, protocol: url.protocol.slice(0, -1), host: url.hostname.toLowerCase(), quote: lineAround(text, match.index) });
+    }
+  }
+  return addresses.sort((first, second) => first.index - second.index);
+}
+
+const FEATURES = [
+  { pattern: /\bgetUserMedia\b/, name: "the camera or microphone (getUserMedia)" },
+  { pattern: /\bgetDisplayMedia\b/, name: "screen capture (getDisplayMedia)" },
+  { pattern: /\bnavigator\.geolocation\b/, name: "location (navigator.geolocation)" },
+  { pattern: /\bnew\s+PaymentRequest\b/, name: "payments (PaymentRequest)" },
+  { pattern: /\bnavigator\.usb\b/, name: "USB (navigator.usb)" },
+  { pattern: /\bnavigator\.serial\b/, name: "serial ports (navigator.serial)" },
+  { pattern: /\bnavigator\.bluetooth\b/, name: "Bluetooth (navigator.bluetooth)" },
+  { pattern: /\bnavigator\.hid\b/, name: "HID devices (navigator.hid)" },
+];
+const DIALOG_PATTERN = /(?<![\w$.])(?<!function\s+)(?:window\.)?(alert|confirm|prompt)\s*\(/;
+const THREADS_PATTERNS = [/\bGODOT_THREADS_ENABLED\s*=\s*true\b/, /\bENVIRONMENT_IS_PTHREAD\b/, /coi-serviceworker/i];
+
+/**
+ * Checks a game's files: [{ path, sizeBytes, contentText }], contentText a string for the checked text files
+ * (CHECKED_TEXT_EXTENSIONS) and null for the rest. slug names the game in the fixes; ownServerUrls are its
+ * own servers, which the code may connect to (null when they aren't known). Answers the API's answer, snake_case: { file_count,
+ * size_bytes, problems, omitted_problem_count }, each problem { code, problem_kind,
+ * is_fixed_by_upload_command, message, path, quote, fix }.
+ */
+export function checkGameFiles(files, { slug = null, ownServerUrls = null } = {}) {
+  const game = slug ?? "<slug>";
+  const ownHosts = new Set((ownServerUrls ?? []).map((ownServerUrl) => { try { return new URL(ownServerUrl).hostname.toLowerCase(); } catch { return ""; } }));
+  const problems = [];
+  const seen = new Set();
+  let omittedProblemCount = 0;
+  const add = (code, { message, path = null, quote = null, fix, sameAs = "" }) => {
+    const key = `${code}\n${path}\n${sameAs}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (problems.length >= MAXIMUM_PROBLEM_COUNT) {
+      omittedProblemCount++;
+      return;
+    }
+    const { problemKind, isFixedByUploadCommand } = CHECK_PROBLEM_CODES[code];
+    problems.push({ code, problem_kind: problemKind, is_fixed_by_upload_command: isFixedByUploadCommand, message, path, quote, fix });
+  };
+
+  const lowercasePaths = new Set(files.map((file) => file.path.toLowerCase()));
+  const pathsSeen = new Set();
+  let sizeBytes = 0;
+  for (const file of files) {
+    sizeBytes += file.sizeBytes;
+    const { path } = file;
+    // eslint-disable-next-line no-control-regex
+    if (path.startsWith("/") || /^[a-z]:/i.test(path) || /[\u0000-\u001f\u007f]/.test(path) || path.replace(/\\/g, "/").split("/").some((part) => part === "" || part === "." || part === "..") || path.length > UPLOAD_LIMITS.maximumPathCharacterCount) {
+      add("bad_path", { message: `${JSON.stringify(path.slice(0, 80))} isn't a path a game can have.`, path: path.slice(0, 200), fix: "Give paths relative to the game's folder, like index.html or assets/hero.png: no leading /, no . or .. parts, up to 200 characters. Rename or move the file." });
+      continue;
+    }
+    const parts = path.split("/");
+    const hiddenIndex = parts.findIndex((part) => part.startsWith("."));
+    if (hiddenIndex !== -1) {
+      const hiddenPath = parts.slice(0, hiddenIndex + 1).join("/");
+      add("hidden_file", { message: `${hiddenPath} is hidden: its name starts with a dot.`, path: hiddenPath, sameAs: hiddenPath, fix: "zaisma upload leaves hidden files out. With upload_files or the API, leave it out of the files." });
+      continue;
+    }
+    const extension = extensionOf(path);
+    if (PRECOMPRESSED_EXTENSIONS.includes(extension)) {
+      const unpackedPath = path.slice(0, -extension.length - 1);
+      add("precompressed_file", { message: `${path} is pre-compressed.`, path, fix: `zaisma upload unpacks it into ${unpackedPath} and points the game at it; Zaisma compresses files for players itself. With upload_files or the API, turn off compression in the engine's build settings (Unity: Publishing Settings, Compression Format: Disabled) and build again.` });
+    } else if (!GAME_FILE_EXTENSIONS.includes(extension)) {
+      add("file_type_not_allowed", { message: `${path}: .${extension || "(no extension)"} files aren't allowed in games.`, path, fix: `Leave it out of the game's folder. Games can have: ${GAME_FILE_EXTENSIONS.join(", ")}.` });
+    }
+    if (file.sizeBytes > UPLOAD_LIMITS.maximumFileSizeBytes) add("file_too_big", { message: `${path} is over 500 MB.`, path, fix: "Split it into smaller files, or ask Zaisma (message_zaisma, kind gap) if the game needs bigger ones." });
+    const lowercasePath = path.toLowerCase();
+    if (pathsSeen.has(lowercasePath)) add("duplicate_path", { message: `Two files share the path ${path} (paths don't depend on case).`, path, fix: "Give each file its own path." });
+    pathsSeen.add(lowercasePath);
+  }
+  if (!pathsSeen.has("index.html")) {
+    const nested = [...pathsSeen].filter((path) => path.endsWith("/index.html")).sort((first, second) => first.split("/").length - second.split("/").length || first.localeCompare(second))[0];
+    const folder = nested ? files.find((file) => file.path.toLowerCase() === nested).path.slice(0, -"/index.html".length) : null;
+    add("no_index_html", { message: "There's no index.html at the top of the game.", fix: folder ? `Upload the ${folder} folder instead: index.html has to be at the top of the folder you upload.` : "Add the game's start page as index.html at the top of the folder." });
+  }
+  if (files.length > UPLOAD_LIMITS.maximumFileCount) add("too_many_files", { message: `The game has ${files.length} files; the limit is 20,000.`, fix: "Leave out files the game doesn't load, or pack small ones together (like sprites into an atlas)." });
+  if (sizeBytes > UPLOAD_LIMITS.maximumGameSizeBytes) add("game_too_big", { message: `The game is ${(sizeBytes / 1024 ** 3).toFixed(1)} GB; the limit is 2 GB.`, fix: "Leave out files the game doesn't load, or ask Zaisma (message_zaisma, kind gap) for more." });
+
+  const threadsFix = "Export without threads: in Godot 4.3 or newer, turn Thread Support off in the Web export preset (Godot 4.0 to 4.2 always use threads, so update); in Unity, leave Native C/C++ Multithreading off in Player Settings, the default. Games on Zaisma can't have SharedArrayBuffer.";
+  let hasThreadsProblem = false;
+  const addThreads = (message, quote, path) => {
+    if (!hasThreadsProblem) add("needs_threads", { message, quote, path, fix: threadsFix });
+    hasThreadsProblem = true;
+  };
+  for (const file of files) {
+    const { path, contentText: text } = file;
+    if (typeof text !== "string") {
+      if (/coi-serviceworker/i.test(path)) addThreads(`${path} is there to turn on threads (SharedArrayBuffer), which games on Zaisma don't have.`, null, path);
+      continue;
+    }
+    const extension = extensionOf(path);
+    const fileKind = extension === "css" ? "css" : extension === "js" || extension === "mjs" ? "module" : "html";
+
+    for (const reference of findOutsideReferences(text, fileKind)) {
+      add("outside_file", { message: `${path} loads ${reference.url} from another site, which games on Zaisma can't do.`, path, quote: reference.quote, sameAs: reference.url, fix: `zaisma upload downloads it into the game and points ${path} at it. With upload_files or the API, download it into the game's files yourself and load it by its path.` });
+    }
+    if (fileKind === "css") continue;
+
+    for (const address of findAddresses(text)) {
+      const { host, protocol } = address;
+      if (IGNORED_HOSTS.has(host) || isZaismaHost(host)) continue;
+      const isSocket = protocol === "ws" || protocol === "wss";
+      if (isLocalHost(host)) {
+        add("address_not_allowed", { message: `${path} connects to ${host}, and players' browsers can't connect to localhost or an IP address from a game on Zaisma.`, path, quote: address.quote, sameAs: host, fix: `Run the server at a host name with wss:// (or https://) and list it as one of the game's own servers: zaisma own-servers ${game} wss://play.example.com (the command sets the whole list, so name any it already has too), or update_game with own_server_urls. Or use Zaisma rooms.` });
+      } else if (protocol === "ws" || protocol === "http") {
+        add("address_not_allowed", { message: `${path} connects to ${protocol}://${host}, a plain address the game page's browser blocks.`, path, quote: address.quote, sameAs: host, fix: `Use ${isSocket ? "wss" : "https"}://${host}: games run on https, and own servers take only wss:// and https:// addresses. Then list it: zaisma own-servers ${game} ${isSocket ? "wss" : "https"}://${host} (the command sets the whole list, so name any it already has too).` });
+      } else if (!ownHosts.has(host)) {
+        add("outside_address", {
+          message: `${path} connects to or loads from ${host} while it runs${ownServerUrls ? ", and it isn't one of the game's own servers" : ", which works only if it's one of the game's own servers"}.`,
+          path,
+          quote: address.quote,
+          sameAs: host,
+          fix: `If ${host} is the game's own server, list it so players' browsers may connect: zaisma own-servers ${game} ${isSocket ? "wss" : "https"}://${host} (the command sets the whole list, so name any it already has too), or update_game with own_server_urls; it works at once. If it's a file, put it in the game's files and load it by its path.`,
+        });
+      }
+    }
+
+    const threadsMatch = THREADS_PATTERNS.map((pattern) => pattern.exec(text)).find(Boolean);
+    if (threadsMatch) addThreads(`${path} is from a build that needs threads (SharedArrayBuffer), which games on Zaisma don't have, so it won't start.`, lineAround(text, threadsMatch.index), path);
+
+    if (isEngineOutput(path, lowercasePaths)) continue;
+    const found = (pattern) => pattern.exec(text);
+    let match;
+    if ((match = found(DIALOG_PATTERN))) add("browser_dialog", { message: `${path} uses ${match[1]}(), which never shows in the game's frame on Zaisma.`, path, quote: lineAround(text, match.index), fix: "Show the message in the game itself, like on the canvas or in an element over it." });
+    if (fileKind === "html" && (match = found(/<form\b[^>]*>/i))) add("form_submission", { message: `${path} has a form, which never submits in the game's frame on Zaisma.`, path, quote: lineAround(text, match.index), fix: "Handle the button's click (or the Enter key) in script instead of submitting the form." });
+    if ((match = (fileKind === "html" && found(/<a\b[^>]*\sdownload\b[^>]*>/i)) || found(/\.download\s*=(?!=)/))) add("file_download", { message: `${path} downloads a file, which the game's frame on Zaisma doesn't allow.`, path, quote: lineAround(text, match.index), fix: "Keep it in the game (its browser saves, which Zaisma's cloud saves mirror), or copy it to the clipboard." });
+    if ((match = (fileKind === "html" && (found(/<a\b[^>]*\shref\s*=\s*["']?(?:https?:)?\/\/[^>]*>/i) || found(/<a\b[^>]*\starget\s*=\s*["']?_blank[^>]*>/i))) || found(/\bwindow\.open\s*\(/))) {
+      add("outside_link", { message: `${path} opens another site or a new window, which the game's frame on Zaisma doesn't allow.`, path, quote: lineAround(text, match.index), fix: `Register the link and open it by name: zaisma links set ${game} <link_name> <url> (or update_game with links), then Zaisma.links.open("<link_name>") in the game.` });
+    }
+    if (fileKind === "html" && (match = found(/<iframe\b[^>]*\ssrc\s*=\s*["']?(?:https?:)?\/\/[^>]*>/i))) add("outside_frame", { message: `${path} shows another site in a frame, which games on Zaisma can't do.`, path, quote: lineAround(text, match.index), fix: "Frames show only the game's own pages: put what it shows in the game's files, or register a link to it (zaisma links set)." });
+    for (const feature of FEATURES) {
+      if ((match = found(feature.pattern))) add("blocked_feature", { message: `${path} uses ${feature.name}, which games on Zaisma can't use.`, path, quote: lineAround(text, match.index), sameAs: feature.name, fix: "Leave it out, or make the game work without it when the browser says no." });
+    }
+  }
+  return { file_count: files.length, size_bytes: sizeBytes, problems, omitted_problem_count: omittedProblemCount };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaisma/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Upload and publish browser games on Zaisma from the command line.",
   "license": "MIT",
   "homepage": "https://zaisma.com",
@@ -25,6 +25,8 @@
   },
   "files": [
     "zaisma.mjs",
+    "check.mjs",
+    "check.d.mts",
     "README.md",
     "LICENSE"
   ],

package/zaisma.mjs

@@ -3,9 +3,13 @@
 // Docs: https://github.com/zaisma/zaisma/blob/main/docs/DEVELOPER-API.md#the-upload-command
 
 import { createHash } from "node:crypto";
-import { createReadStream, readFileSync } from "node:fs";
-import { open, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { extname, join, relative, sep } from "node:path";
+import { createReadStream, createWriteStream, readFileSync } from "node:fs";
+import { mkdir, mkdtemp, open, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, extname, join, posix, relative, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { createBrotliDecompress, createGunzip } from "node:zlib";
+import { CHECKED_TEXT_EXTENSIONS, GAME_FILE_EXTENSIONS, PRECOMPRESSED_EXTENSIONS, checkGameFiles, extensionOf, findOutsideReferences } from "./check.mjs";
 
 const API = (process.env.ZAISMA_API || "https://zaisma.com").replace(/\/+$/, "");
 const KEY = process.env.ZAISMA_KEY || "";
@@ -19,6 +23,14 @@ const SCAN_CHECK_INTERVAL_MS = Number(process.env.ZAISMA_SCAN_CHECK_INTERVAL_MS)
 const SCAN_CHECK_COUNT = 200;
 /** The most SQL database import sends at once (a single bigger statement goes on its own; the API takes up to 5 MB). ZAISMA_DUMP_PART_SIZE_BYTES is for tests. */
 const DUMP_PART_SIZE_BYTES = Number(process.env.ZAISMA_DUMP_PART_SIZE_BYTES) || 4 * 1024 * 1024;
+/** What upload downloads into a game from outside sites: at most this many files, each up to this size, each within this time. */
+const MAXIMUM_OUTSIDE_FILE_COUNT = 500;
+const MAXIMUM_OUTSIDE_FILE_SIZE_BYTES = 100 * 1024 * 1024;
+const DOWNLOAD_TIMEOUT_SEC = 30;
+/** Sent with those downloads, so font services answer with the woff2 fonts every browser games run in takes. */
+const DOWNLOAD_USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36";
+/** Where upload puts the files it downloads, by site and path. */
+const OUTSIDE_FOLDER = "zaisma-outside";
 /** Files database export and import read and write as SQLite databases; any other name is SQL text. */
 const SQLITE_EXTENSIONS = [".sqlite", ".sqlite3", ".db"];
 
@@ -36,6 +48,7 @@ const EXIT_CODES = {
   held: { exitCode: 3, meaning: "upload: the version is held for a person at Zaisma to look at, usually within a day." },
   rejected: { exitCode: 4, meaning: "upload: the version was rejected. Its review_reason and findings say why and how to fix it." },
   still_scanning: { exitCode: 5, meaning: "upload: the version was still being scanned after 10 minutes. Check it later with zaisma versions <slug>." },
+  problems_found: { exitCode: 6, meaning: "check: something in the game won't work on Zaisma as it is, and the upload command doesn't fix it. The problems say what and how to fix it." },
 };
 
 /** The errors only the command itself answers with; every other code is the API's (ERROR_CODES in packages/core/src/errors.ts). */
@@ -46,12 +59,15 @@ const COMMAND_ERROR_CODES = {
   repeated_field: "A flag was given twice.",
   missing_value: "A flag that takes a value was given none.",
   takes_no_value: "A flag that takes no value was given one.",
-  not_a_folder: "The folder to upload isn't a folder.",
+  not_a_folder: "The folder to check or upload isn't a folder.",
   not_a_file: "The file given (of statements, a dump to import, or a save) can't be read.",
   file_exists: "database export won't write over a file that's already there.",
   needs_newer_node: "Reading or writing a .sqlite file needs Node 22.13 or newer.",
   not_a_database: "The .sqlite file to import isn't a SQLite database.",
   unknown_link: "links remove: the game has no link by that name.",
+  outside_file_unreachable: "upload: a file the game loads from an outside site couldn't be downloaded, so nothing was sent.",
+  too_many_outside_files: "upload: the game loads more than 500 files from outside sites, so nothing was sent.",
+  unpack_failed: "upload: a pre-compressed file couldn't be unpacked, so nothing was sent.",
   server_unreachable: "Zaisma couldn't be reached: no connection, or a wrong ZAISMA_API.",
   unexpected_answer: "Zaisma answered without JSON, like a page from a network in between.",
 };
@@ -68,8 +84,13 @@ const KIND_ABOUT = "bug (something doesn't work), gap (a limit or missing piece
 const COMMANDS = {
   games: { about: "List your games", arguments: [], flags: {} },
   new: { about: "Make a game (it starts as a draft)", arguments: [{ name: "title", isRest: true }], flags: { slug: { hasValue: true, placeholder: "<slug>", about: "Its link name, as in zaisma.com/g/<slug>; made from the title if left out" } } },
+  check: {
+    about: "Check a game's folder for anything Zaisma refuses or that won't work on Zaisma, with how to fix each, before anything is sent; needs no key",
+    arguments: [{ name: "folder" }],
+    flags: { game: { hasValue: true, placeholder: "<slug>", about: "The game it's for, so the fixes name it (and, with ZAISMA_KEY set, so its own servers count)" } },
+  },
   upload: {
-    about: "Upload a version; only changed files are sent",
+    about: "Upload a version; only changed files are sent. It runs the check first, and downloads files the game loads from outside sites and unpacks pre-compressed builds in what it sends, never in the folder",
     arguments: [{ name: "folder" }],
     flags: {
       game: { hasValue: true, isRequired: true, placeholder: "<slug>", about: "The game to upload to" },
@@ -159,6 +180,12 @@ const COMMANDS = {
     arguments: [{ name: "slug" }, { name: "file", isOptional: true }],
     flags: {},
   },
+  "database restore": {
+    about: "Put a game's database back as it was at a moment in the last 30 days (an ISO time, like 2026-10-18T14:05:00Z), live; undo it with database undo-restore",
+    arguments: [{ name: "slug" }, { name: "restore_to_at" }],
+    flags: {},
+  },
+  "database undo-restore": { about: "Undo a restore of a game's database: back to just before it, live", arguments: [{ name: "slug" }, { name: "database_restore_id" }], flags: {} },
   saves: {
     about: "The players with a cloud save in a game, by player ID, 100 a page",
     arguments: [{ name: "slug" }],
@@ -182,7 +209,7 @@ const COMMANDS = {
   help: { about: "This help; with --json, every command, flag, exit code and error code", arguments: [], flags: {} },
 };
 /** Commands with a second word, like zaisma forum post. */
-const SUBCOMMANDS = { links: ["set", "remove"], forum: ["post", "message", "reply"], database: ["query", "batch", "export", "import"], saves: ["get", "change", "replace", "reset", "copies", "copy", "restore"], secrets: ["set", "delete"] };
+const SUBCOMMANDS = { links: ["set", "remove"], forum: ["post", "message", "reply"], database: ["query", "batch", "export", "import", "restore", "undo-restore"], saves: ["get", "change", "replace", "reset", "copies", "copy", "restore"], secrets: ["set", "delete"] };
 /** Flags every command takes. */
 const GLOBAL_FLAGS = {
   json: { hasValue: false, about: "Print the API's answer as JSON, as-is (on failure its { error }), and nothing else" },
@@ -372,15 +399,16 @@ async function api(method, path, body) {
   return answer;
 }
 
+/** The game's files, without junk; hidden ones (a name starting with a dot) are listed apart, since they're never uploaded. */
 async function walk(root) {
   const files = [];
-  const skipped = new Set();
+  const hiddenPaths = [];
   async function visit(dir) {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
       if (JUNK.has(entry.name)) continue;
       const full = join(dir, entry.name);
       if (entry.name.startsWith(".")) {
-        skipped.add(relative(root, full));
+        hiddenPaths.push(relative(root, full).split(sep).join("/"));
         continue;
       }
       if (entry.isDirectory()) await visit(full);
@@ -388,8 +416,250 @@ async function walk(root) {
     }
   }
   await visit(root);
-  if (skipped.size) say(`Skipping hidden files: ${[...skipped].slice(0, 5).join(", ")}${skipped.size > 5 ? "…" : ""}`);
-  return files;
+  return { files, hiddenPaths };
+}
+
+/** A game's folder for the check and the upload: each file's path, where it is, its size and, for the checked text files, its text. */
+async function readGameFolder(folder) {
+  if (!(await stat(folder).catch(() => null))?.isDirectory()) refuse("not_a_folder", { message: `${folder} isn't a folder.`, field: "folder", fix: "Give the folder with the game's index.html at the top, like ./build." });
+  const { files: fullPaths, hiddenPaths } = await walk(folder);
+  const files = [];
+  for (const full of fullPaths) {
+    const path = relative(folder, full).split(sep).join("/");
+    files.push({ path, full, sizeBytes: (await stat(full)).size, contentText: CHECKED_TEXT_EXTENSIONS.includes(extensionOf(path)) ? await readFile(full, "utf8") : null });
+  }
+  return { files, hiddenPaths };
+}
+
+/**
+ * The check on a folder's files (hidden ones included, so it can say they're left out). With the game named
+ * and a key set, a game that connects to outside addresses is checked against its own servers too; with no
+ * key, nothing is sent.
+ */
+async function checkGame({ files, hiddenPaths }, slug) {
+  const checked = [...files, ...hiddenPaths.map((path) => ({ path, sizeBytes: 0, contentText: null }))];
+  const answer = checkGameFiles(checked, { slug });
+  if (!slug || !KEY || !answer.problems.some((problem) => problem.code === "outside_address")) return answer;
+  const { game } = await api("GET", `/games/${slug}`);
+  return checkGameFiles(checked, { slug, ownServerUrls: game.own_server_urls });
+}
+
+const PROBLEM_GROUPS = [
+  { heading: "Zaisma refuses the upload until these are fixed:", isIn: (problem) => problem.problem_kind === "refused" && !problem.is_fixed_by_upload_command },
+  { heading: "These won't work on Zaisma:", isIn: (problem) => problem.problem_kind === "broken" && !problem.is_fixed_by_upload_command },
+  { heading: "zaisma upload fixes these itself:", isIn: (problem) => problem.is_fixed_by_upload_command },
+];
+
+/** The check's problems for people, in groups, each with its code and fix. */
+function printProblems(problems, groups = PROBLEM_GROUPS) {
+  for (const group of groups) {
+    const inGroup = problems.filter(group.isIn);
+    if (!inGroup.length) continue;
+    say(group.heading);
+    for (const problem of inGroup) {
+      // What the upload fixes needs only saying; the rest needs where it is and what to do.
+      if (problem.is_fixed_by_upload_command) say(`  - ${problem.message} [${problem.code}]`);
+      else say(`  - ${problem.message} [${problem.code}]${problem.quote ? `\n    Where: ${problem.quote}` : ""}\n    Fix: ${problem.fix}`);
+    }
+  }
+}
+
+/** zaisma check: the problems, or the answer with --json. Ends with problems_found when one isn't fixed by the upload command. */
+async function checkFolder({ folder }, flags) {
+  const answer = await checkGame(await readGameFolder(folder), flags.game ?? null);
+  const hasProblems = answer.problems.some((problem) => !problem.is_fixed_by_upload_command);
+  if (isJson) printJson(answer);
+  else {
+    printProblems(answer.problems);
+    if (answer.omitted_problem_count) console.log(`…and ${answer.omitted_problem_count} more.`);
+    console.log(
+      hasProblems
+        ? "Fix what's above, then check again."
+        : `Ready to upload: ${answer.file_count} files, ${readableSize(answer.size_bytes)}. Upload with: zaisma upload ${folder} --game ${flags.game ?? "<slug>"}`,
+    );
+  }
+  return hasProblems ? EXIT_CODES.problems_found : EXIT_CODES.done;
+}
+
+const sha256Of = (text) => createHash("sha256").update(text).digest("hex");
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** A path's file kind for findOutsideReferences, or null when its text isn't read. */
+const fileKindOf = (path) => ({ html: "html", htm: "html", css: "css", js: "module", mjs: "module" })[extensionOf(path)] ?? null;
+/** One file's place to another's, as a page or a module writes it: ./ or ../ first. */
+const relativePath = (fromPath, toPath) => {
+  const path = posix.relative(posix.dirname(fromPath), toPath);
+  return path.startsWith("../") ? path : `./${path}`;
+};
+const TYPE_EXTENSIONS = { "text/css": "css", "text/javascript": "js", "application/javascript": "js", "application/json": "json", "application/wasm": "wasm", "font/woff2": "woff2", "font/woff": "woff", "font/ttf": "ttf", "font/otf": "otf", "image/png": "png", "image/jpeg": "jpg", "image/gif": "gif", "image/webp": "webp", "image/avif": "avif", "image/svg+xml": "svg", "audio/mpeg": "mp3", "audio/ogg": "ogg", "audio/wav": "wav" };
+
+/** Unpacks a gzip (it starts 1f 8b) or brotli file. */
+async function unpack(source, target) {
+  const handle = await open(source);
+  const start = new Uint8Array(2);
+  await handle.read(start, 0, 2, 0);
+  await handle.close();
+  await pipeline(createReadStream(source), start[0] === 0x1f && start[1] === 0x8b ? createGunzip() : createBrotliDecompress(), createWriteStream(target));
+}
+
+/**
+ * Fixes two blockers in what's uploaded, never in the folder: unpacks pre-compressed files, and downloads
+ * what the page, its stylesheets and its modules load from outside sites into zaisma-outside/<site>/<path>,
+ * pointing the game at them. Works in a temporary folder (temporaryFolder, for the caller to remove) and
+ * answers the files to upload and what changed, for people.
+ */
+async function fixUpload(givenFiles) {
+  const temporaryFolder = await mkdtemp(join(tmpdir(), "zaisma-upload-"));
+  const filesByPath = new Map(givenFiles.map((file) => [file.path, { ...file }]));
+  const changes = [];
+  const writeTemporary = async (path, bytes) => {
+    const full = join(temporaryFolder, ...path.split("/"));
+    await mkdir(dirname(full), { recursive: true });
+    await writeFile(full, bytes);
+    return full;
+  };
+
+  // Unpack, then put the unpacked names wherever the game names the packed ones.
+  const renames = [];
+  for (const file of [...filesByPath.values()]) {
+    const extension = extensionOf(file.path);
+    if (!PRECOMPRESSED_EXTENSIONS.includes(extension)) continue;
+    const unpackedPath = file.path.slice(0, -extension.length - 1);
+    filesByPath.delete(file.path);
+    renames.push([posix.basename(file.path), posix.basename(unpackedPath)]);
+    if (filesByPath.has(unpackedPath)) {
+      changes.push(`Left out ${file.path}: ${unpackedPath} is there already`);
+      continue;
+    }
+    const full = join(temporaryFolder, ...unpackedPath.split("/"));
+    await mkdir(dirname(full), { recursive: true });
+    try {
+      await unpack(file.full, full);
+    } catch {
+      refuse("unpack_failed", { message: `${file.path} couldn't be unpacked as gzip or brotli.`, field: "folder", fix: "Turn off compression in the engine's build settings (Unity: Publishing Settings, Compression Format: Disabled) and build again." }, EXIT_CODES.failed);
+    }
+    filesByPath.set(unpackedPath, { path: unpackedPath, full, sizeBytes: (await stat(full)).size, contentText: fileKindOf(unpackedPath) ? await readFile(full, "utf8") : null });
+    changes.push(`Unpacked ${file.path} into ${unpackedPath}`);
+  }
+  const texts = new Map([...filesByPath.values()].filter((file) => file.contentText !== null).map((file) => [file.path, file.contentText]));
+  const editedPaths = new Set();
+  if (renames.length) {
+    for (const file of filesByPath.values()) if (extensionOf(file.path) === "json") texts.set(file.path, await readFile(file.full, "utf8"));
+    for (const [path, text] of texts) {
+      let changed = text;
+      for (const [packedName, unpackedName] of renames) changed = changed.replace(new RegExp(`(?<![\\w.-])${escapeRegExp(packedName)}(?![\\w.-])`, "g"), unpackedName);
+      if (changed !== text) {
+        texts.set(path, changed);
+        editedPaths.add(path);
+      }
+    }
+  }
+
+  // Download what the game loads from outside sites, and what those files load, each once.
+  const takenPaths = new Set([...filesByPath.keys()].map((path) => path.toLowerCase()));
+  const pathsByUrl = new Map();
+  const downloads = [];
+  let freeSlotCount = 4;
+  const waiting = [];
+  const takeSlot = () => (freeSlotCount > 0 ? (freeSlotCount--, Promise.resolve()) : new Promise((resolve) => waiting.push(resolve)));
+  const freeSlot = () => (waiting.length ? waiting.shift()() : freeSlotCount++);
+  const unreachable = (url, why) => refuse("outside_file_unreachable", { message: `${url} couldn't be downloaded: ${why}.`, field: url, fix: "Check the address, or download it into the game's folder yourself and point the game at it by its path." }, EXIT_CODES.failed);
+
+  /** Where a downloaded file goes; null when its extension has to come from what the site answers. */
+  const outsidePath = (url, extension) => {
+    const parsed = new URL(url);
+    const site = parsed.host.replace(/[^A-Za-z0-9.-]/g, "_");
+    const parts = parsed.pathname.split("/").filter(Boolean).map((part) => {
+      let name = part;
+      try {
+        name = decodeURIComponent(part);
+      } catch {}
+      return name.replace(/[^A-Za-z0-9._@+~-]/g, "_").replace(/^\./, "_");
+    });
+    if (!parts.length) parts.push("index");
+    const last = parts[parts.length - 1];
+    const urlExtension = extensionOf(last);
+    const isAllowed = GAME_FILE_EXTENSIONS.includes(urlExtension);
+    // A module may keep .mjs where a script would be .js.
+    const finalExtension = isAllowed && (extension === null || urlExtension === extension || (extension === "js" && urlExtension === "mjs")) ? urlExtension : extension;
+    if (!finalExtension) return null;
+    if (parsed.search || !isAllowed || urlExtension !== finalExtension) parts[parts.length - 1] = `${isAllowed ? last.slice(0, -urlExtension.length - 1) : last}-${sha256Of(url).slice(0, 8)}.${finalExtension}`;
+    let path = [OUTSIDE_FOLDER, site, ...parts].join("/");
+    if (path.length > 200 || takenPaths.has(path.toLowerCase())) path = `${OUTSIDE_FOLDER}/${site}/${sha256Of(url).slice(0, 16)}.${finalExtension}`;
+    takenPaths.add(path.toLowerCase());
+    return path;
+  };
+  const codeExtension = { script: "js", module: "js", import_map: "js", style: "css", file: null };
+
+  /** The downloaded file's path for a URL, downloading it (and what it loads) once. */
+  const pull = (url, referenceKind) => {
+    if (pathsByUrl.has(url)) return pathsByUrl.get(url);
+    if (pathsByUrl.size >= MAXIMUM_OUTSIDE_FILE_COUNT) refuse("too_many_outside_files", { message: `The game loads more than ${MAXIMUM_OUTSIDE_FILE_COUNT} files from outside sites.`, field: "folder", fix: "Put its libraries in the game's folder (npm install and a bundler, or download them) and load them by their paths." }, EXIT_CODES.failed);
+    const knownPath = outsidePath(url, codeExtension[referenceKind] ?? null);
+    const download = (async () => {
+      await takeSlot();
+      let response;
+      let bytes;
+      try {
+        response = await fetch(url, { headers: { "user-agent": DOWNLOAD_USER_AGENT }, redirect: "follow", signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_SEC * 1000) });
+        if (!response.ok) unreachable(url, `the site answered ${response.status}`);
+        if (Number(response.headers.get("content-length") ?? 0) > MAXIMUM_OUTSIDE_FILE_SIZE_BYTES) unreachable(url, "it's over 100 MB");
+        bytes = new Uint8Array(await response.arrayBuffer());
+      } catch (error) {
+        if (error instanceof CommandError) throw error;
+        unreachable(url, error.cause?.message ?? error.message);
+      } finally {
+        freeSlot();
+      }
+      if (bytes.length > MAXIMUM_OUTSIDE_FILE_SIZE_BYTES) unreachable(url, "it's over 100 MB");
+      const path = knownPath ?? outsidePath(url, TYPE_EXTENSIONS[(response.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase()] ?? "bin");
+      if (referenceKind === "module" || referenceKind === "import_map" || referenceKind === "style") {
+        const text = new TextDecoder().decode(bytes);
+        const rewritten = await rewriteReferences(path, text, findOutsideReferences(text, referenceKind === "style" ? "css" : "module", { baseUrl: response.url || url }));
+        if (rewritten !== text) bytes = new TextEncoder().encode(rewritten);
+      }
+      filesByPath.set(path, { path, full: await writeTemporary(path, bytes), sizeBytes: bytes.length, contentText: null });
+      changes.push(`Downloaded ${url} into ${path}`);
+      return path;
+    })();
+    download.catch(() => {});
+    downloads.push(download);
+    const path = knownPath ? Promise.resolve(knownPath) : download;
+    pathsByUrl.set(url, path);
+    return path;
+  };
+
+  /** A text with each reference pointing at its downloaded file instead (an import map's prefix at its folder). */
+  async function rewriteReferences(fromPath, text, references) {
+    let rewritten = text;
+    for (const reference of [...references].reverse()) {
+      let toPath;
+      if (reference.referenceKind === "import_map" && reference.importMapKey?.endsWith("/")) {
+        const prefixUrl = reference.url.endsWith("/") ? reference.url : `${reference.url}/`;
+        // Each import under the prefix in the game's own code, like "three/addons/controls/OrbitControls.js" (not the import map's own key).
+        const pattern = new RegExp(`(["'])${escapeRegExp(reference.importMapKey)}([^"'\\n]+)\\1`, "g");
+        for (const ownText of texts.values()) for (const match of ownText.matchAll(pattern)) await pull(prefixUrl + match[2], "module");
+        const parsed = new URL(prefixUrl);
+        toPath = [OUTSIDE_FOLDER, parsed.host.replace(/[^A-Za-z0-9.-]/g, "_"), ...parsed.pathname.split("/").filter(Boolean)].join("/") + "/";
+      } else toPath = await pull(reference.url, reference.referenceKind);
+      rewritten = rewritten.slice(0, reference.start) + relativePath(fromPath, toPath) + (toPath.endsWith("/") ? "/" : "") + rewritten.slice(reference.end);
+    }
+    return rewritten;
+  }
+
+  for (const [path, text] of texts) {
+    const fileKind = fileKindOf(path);
+    const references = fileKind ? findOutsideReferences(text, fileKind) : [];
+    if (!references.length) continue;
+    texts.set(path, await rewriteReferences(path, text, references));
+    editedPaths.add(path);
+  }
+  for (let i = 0; i < downloads.length; i++) await downloads[i];
+  for (const path of editedPaths) {
+    const bytes = new TextEncoder().encode(texts.get(path));
+    filesByPath.set(path, { ...filesByPath.get(path), full: await writeTemporary(path, bytes), sizeBytes: bytes.length });
+    changes.push(`Pointed ${path} at them`);
+  }
+  return { files: [...filesByPath.values()], changes, temporaryFolder };
 }
 
 function sha256(file) {
@@ -426,14 +696,33 @@ const showProgress = (text) => isJson || process.stdout.write(`\r  ${text}   `);
 /** Uploads a version and waits for its scan. With --json, prints the last version answer as-is; the exit code says how the scan went. */
 async function upload({ folder }, flags) {
   const slug = flags.game;
-  if (!(await stat(folder).catch(() => null))?.isDirectory()) refuse("not_a_folder", { message: `${folder} isn't a folder.`, field: "folder", fix: "Give the folder with the game's index.html at the top, like ./build." });
+  const gameFolder = await readGameFolder(folder);
+  const { problems } = await checkGame(gameFolder, slug);
+  const refused = problems.find((problem) => problem.problem_kind === "refused" && !problem.is_fixed_by_upload_command);
+  if (refused) {
+    printProblems(problems, PROBLEM_GROUPS.slice(0, 2));
+    throw new CommandError({ code: refused.code, message: refused.message, field: "folder", fix: refused.fix, retry_after_sec: null }, EXIT_CODES.failed.exitCode);
+  }
+  printProblems(problems, PROBLEM_GROUPS.slice(1, 2));
+  if (gameFolder.hiddenPaths.length) say(`Leaving out hidden files: ${gameFolder.hiddenPaths.slice(0, 5).join(", ")}${gameFolder.hiddenPaths.length > 5 ? "…" : ""}`);
 
-  const paths = await walk(folder);
-  say(`Checking ${paths.length} files…`);
-  const files = [];
-  for (const full of paths) {
-    files.push({ path: relative(folder, full).split(sep).join("/"), sha256: await sha256(full), size_bytes: (await stat(full)).size, full });
+  const fixed = await fixUpload(gameFolder.files);
+  try {
+    if (fixed.changes.length) {
+      say("Changed in this upload only (your folder stays as it is):");
+      for (const change of fixed.changes) say(`  ${change}`);
+    }
+    return await sendVersion(slug, fixed.files, flags);
+  } finally {
+    await rm(fixed.temporaryFolder, { recursive: true, force: true });
   }
+}
+
+/** Sends the files Zaisma doesn't have yet, makes the version and waits for its scan. */
+async function sendVersion(slug, fixedFiles, flags) {
+  say(`Checking ${fixedFiles.length} files…`);
+  const files = [];
+  for (const file of fixedFiles) files.push({ path: file.path, sha256: await sha256(file.full), size_bytes: file.sizeBytes, full: file.full });
   const list = files.map(({ full: _, ...file }) => file);
   const plan = await api("POST", `/games/${slug}/uploads`, { files: list });
   const todo = files.filter((file, i) => plan.missing_file_hashes.includes(file.sha256) && files.findIndex((other) => other.sha256 === file.sha256) === i);
@@ -608,10 +897,22 @@ async function readInput() {
   return Buffer.concat(chunks).toString("utf8").trim();
 }
 
-/** A game's own database (GET and POST /games/<slug>/database…), as the MCP's get_database, query_database, batch_database, export_database and import_database. */
+/** A game's own database (GET and POST /games/<slug>/database…), as the MCP's get_database, query_database, batch_database, export_database, import_database, restore_database and undo_database_restore. */
 async function database(command, values, flags) {
   if (command === "database export") return exportDatabase(values);
   if (command === "database import") return importDatabase(values);
+  if (command === "database restore" || command === "database undo-restore") {
+    const isUndo = command === "database undo-restore";
+    const answer = isUndo
+      ? await api("POST", `/games/${values.slug}/database/restores/${encodeURIComponent(values.database_restore_id)}/undo`)
+      : await api("POST", `/games/${values.slug}/database/restores`, { restore_to_at: values.restore_to_at });
+    if (isJson) return printJson(answer);
+    const restore = answer.database_restore;
+    console.log(isUndo ? `Undid restore ${values.database_restore_id}: ${values.slug}'s database is back to ${restore.restore_to_at}.` : `Restored ${values.slug}'s database to ${restore.restore_to_at}.`);
+    if (answer.erased_again_player_count) console.log(`Erased ${answer.erased_again_player_count} player${answer.erased_again_player_count === 1 ? "" : "s"} again who had been erased since.`);
+    console.log(`Undo it until ${restore.undo_expires_at}: zaisma database undo-restore ${values.slug} ${restore.id}`);
+    return;
+  }
   if (command === "database") {
     const answer = await api("GET", `/games/${values.slug}/database`);
     if (isJson) return printJson(answer);
@@ -625,6 +926,10 @@ async function database(command, values, flags) {
         `${use.written_row_count.toLocaleString("en-US")} written (${percent(use.written_row_count, use.free_written_row_count)} of ${use.free_written_row_count.toLocaleString("en-US")}), ` +
         `${(use.storage_size_bytes / 1024 / 1024).toFixed(1)} MB stored (${percent(use.storage_size_bytes, use.free_storage_size_bytes)} of ${use.free_storage_size_bytes / 1024 / 1024} MB). Resets ${use.reset_date}.`,
     );
+    if (answer.restores.length) {
+      console.log("\nRestores (newest first; undo with zaisma database undo-restore <slug> <id>):");
+      for (const restore of answer.restores.slice(0, 5)) console.log(`${restore.id}  ${restore.restored_at}  ${restore.undoes_database_restore_id ? `undid ${restore.undoes_database_restore_id}` : `back to ${restore.restore_to_at}`}`);
+    }
     return;
   }
   if (command === "database query") {
@@ -1080,6 +1385,7 @@ async function run({ command, values, flags, globalFlags, rest }) {
     console.log(`Made ${answer.game.page_url} (a draft). Upload it with: zaisma upload <folder> --game ${answer.game.slug}`);
     return EXIT_CODES.done;
   }
+  if (command === "check") return checkFolder(values, flags);
   if (command === "upload") return upload(values, flags);
   if (command === "versions") {
     const answer = await api("GET", `/games/${values.slug}`);