bump pinned sdk-js ver

[The64thRealm]

No description provided.

[claude]

Claude finished @The64thRealm's task in 1m 8s —— View job

---

Code Review — PR #52

• Gather context (diff, CLAUDE.md, bump script, consumers)
• Review the change
• Post findings

No blocking issues. The change is a clean one-line pin bump: src/dev/sdk-js-version 1.3.38 → 1.3.43.

What I checked

• File format — bytes are exactly 1.3.43\n: one bare semver, single trailing newline. This satisfies both unit tests in src/dev/server.rs:679-701 (the_pinned_sdk_version_file_holds_one_bare_semver, the_inject_url_never_carries_the_version_files_trailing_newline), since inject_url() at src/dev/server.rs:31-37 .trim()s before interpolating into the jsdelivr URL.
• Pin discipline — still an exact version, not @latest, per the CLAUDE.md rule that an SDK release must not change wavedash dev behaviour underfoot. ✅
• Consumers — SDK_JS_VERSION is only read in src/dev/server.rs:26; no other file hardcodes the version, so nothing else needed updating in this repo.

Notes (non-blocking)

1. This won't reach users until a CLI release is cut. The pin is include_str!'d into the binary, and .github/workflows/auto-tag.yml only tags on a Cargo.toml path change. Cargo.toml:3 is still 0.1.92, so installed binaries keep injecting 1.3.38 after this merges. If the bump is meant to ship, pair it with a Cargo.toml version bump (either here or in a follow-up).

2. Cross-repo parity is unverified from here. CLAUDE.md says to keep this in step with the @wvdsh/sdk-js version prod play bundles use (play/package.json), which lives outside this repo — worth a manual confirmation that prod is also on 1.3.43.

3. Unverified locally: I couldn't run npm view @wvdsh/sdk-js@1.3.43 (network/tool not permitted in this sandbox) to confirm publication, nor doppler run -- cargo test (command needs approval). If the bump came from ./scripts/bump-sdk-js.sh, publication was already validated by the script's npm view check, and CI covers the tests.

4. Manual smoke test — per the script's own closing advice, confirm a game boots with wavedash dev against 1.3.43 before relying on it; a patch bump in inject.global.js is the one thing static checks here can't catch.
   · branch bump-pinned-sdk-js-ver

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.