@aqian0/dsh-unity 0.0.0-stage → 0.1.0

package/skills/build-live-game/references/remote-config.md

@@ -0,0 +1,96 @@
+# Remote Config Reference
+
+## Table of Contents
+
+- [Overview](#overview)
+- [How It Works](#how-it-works)
+- [FetchConfigsAsync API](#fetchconfigsasync-api)
+- [.rc File Format](#rc-file-format)
+- [Game Overrides](#game-overrides)
+- [Common Patterns](#common-patterns)
+- [Code Template -- Load JSON Config](#code-template--load-json-config)
+
+## Overview
+
+Server-side game configuration. Store game definitions (achievement lists, battle pass tiers, shop catalogs) as JSON entries updatable without a client build. Accessed via `RemoteConfigService.Instance`.
+
+- **Namespace:** `Unity.Services.RemoteConfig`
+- **Package:** `com.unity.remote-config`
+
+## How It Works
+
+- Configuration is stored as key-value entries in the Unity Dashboard or deployed via `.rc` files through the Deployment Window.
+- The client fetches all config at once using `FetchConfigsAsync`.
+- Values are strongly typed: `string`, `bool`, `int`, `float`, `long`, and `JSON`.
+
+## FetchConfigsAsync API
+
+```csharp
+struct UserAttributes {}
+struct AppAttributes {}
+var result = await RemoteConfigService.Instance.FetchConfigsAsync(
+    new UserAttributes(), new AppAttributes());
+// Access values:
+string val = result.config.GetString("key");
+int num = result.config.GetInt("key");
+bool flag = result.config.GetBool("key");
+// For JSON values:
+var token = result.config["key"]; // JToken
+var obj = token.ToObject<MyType>();
+```
+
+- `UserAttributes` and `AppAttributes` are empty structs unless you use Game Overrides (audience targeting).
+- Results are cached locally; subsequent calls return cached data unless you call with different attributes.
+
+## .rc File Format
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/remote-config.schema.json",
+  "entries": {
+    "my_string_key": "hello",
+    "my_int_key": 42,
+    "my_json_key": { "nested": true }
+  },
+  "types": {
+    "my_json_key": "JSON"
+  }
+}
+```
+
+- **Create via:** Right-click in Project window > Assets > Create > Services > Remote Config
+- **Deploy via:** the Deployment Window (Services > Deployment)
+- The `types` block is needed only for JSON entries; `string`, `int`, `bool`, `float`, and `long` are auto-detected.
+
+## Game Overrides
+
+Game Overrides (via `com.unity.services.tooling`) override Remote Config values for specific player segments. Remote Config itself does not provide A/B testing -- Game Overrides layer on top of it.
+
+- Game Overrides are defined as `.ugo` files.
+- Used for A/B testing and audience targeting.
+- Configured in the Unity Dashboard or deployed via `.ugo` files through the Deployment Window.
+- When active, `FetchConfigsAsync` returns the overridden values automatically.
+
+## Common Patterns
+
+- **Game definitions** (achievements, battle pass tiers) stored as JSON arrays under a single key.
+- **Feature flags** stored as booleans for toggling game features server-side.
+- **Version-specific config** with server-side updates -- change game balance without shipping a new client build.
+
+## Code Template -- Load JSON Config
+
+```csharp
+using Unity.Services.RemoteConfig;
+using Newtonsoft.Json.Linq;
+
+struct UserAttributes {}
+struct AppAttributes {}
+
+async Task<List<T>> LoadJsonConfigAsync<T>(string key)
+{
+    var result = await RemoteConfigService.Instance.FetchConfigsAsync(
+        new UserAttributes(), new AppAttributes());
+    var token = result.config[key];
+    return token.ToObject<List<T>>();
+}
+```

package/skills/build-live-game/references/services-overview.md

@@ -0,0 +1,76 @@
+# Core Services — Quick Reference
+
+## Authentication
+
+**Package:** `com.unity.services.authentication` (>= 3.6.1)
+
+Handles player identity; [How Authentication works](https://docs.unity.com/en-us/authentication/how-authentication-works.md) covers the sign-in methods. After sign-in `PlayerId` is available and the `SignedIn` event fires. `PlayerAccountService` (Unity browser sign-in) lives in a **separate assembly**: `Unity.Services.Authentication.PlayerAccounts`.
+
+- **Full reference:** [references/authentication.md](authentication.md)
+
+## Cloud Code
+
+**Package:** `com.unity.services.cloudcode` **`3.0.0`** for native `.ccmu` authoring (Unity 6000.5+); `>= 2.10.3` maintains legacy `.ccmr` modules. Before you author a `.ccmu`, bump a manifest that pins `2.10.x` to `3.0.0` or later.
+
+Runs server-side C# modules (.NET 8; .NET 10 on Unity 6.7+) for trusted operations. Check the project's Editor version, then **author new modules as `.ccmu` on Unity 6000.5+**: create the module inside the Unity project with **Create > Services > Cloud Code Module Script**. Unity compiles it with the project and generates its client bindings at compile time. `.ccmr` is legacy: on 6000.5+ maintain existing ones only; on an older Editor, author new modules as `.ccmr`.
+Call a `.ccmu` module from the client only through its generated bindings, never with `CallModuleEndpointAsync`. Use `CloudCodeService.Instance.CallModuleEndpointAsync` for legacy `.ccmr` modules only.
+Write new JavaScript scripts only when the user asks for them; maintain existing ones.
+
+- **Full reference:** [references/cloud-code-modules.md](cloud-code-modules.md)
+
+**CloudBehaviours** (experimental) generate a module's client bindings — RPCs, synchronized state, push
+events — from one C# class. Use them for shared match state, per-player secret state or a server-owned
+timer; otherwise use a plain Cloud Code module. Requires `com.unity.services.cloudcode` `3.1.0-exp.1`+
+and Unity 6000.5+. Check the installed package first: if CloudBehaviours are unavailable, use a plain
+stateful module (`[StateScope]`, see the modules reference) instead of stopping, unless the user asks for
+the experimental package.
+
+- **Full reference:** [references/cloud-code-cloudbehaviours.md](cloud-code-cloudbehaviours.md)
+
+## Cloud Save
+
+**Package:** `com.unity.services.cloudsave` (>= 3.4.0)
+
+Per-player key-value storage in three access classes (Default, Public, Protected), plus game-wide Custom data. Protected and Custom data can be written only by server code, so store anti-cheat and server-awarded state there. See [Player Data](https://docs.unity.com/en-us/cloud-save/concepts/player-data.md) and [Game Data](https://docs.unity.com/en-us/cloud-save/concepts/game-data.md) for the read and write rules of each class.
+
+- **Full reference:** [references/cloud-save.md](cloud-save.md)
+
+## Remote Config
+
+**Package:** `com.unity.services.remote-config` (>= 4.2.5)
+
+Server-side game configuration. Store game definitions (achievement lists, battle pass tiers, shop catalogs) as JSON entries updatable without a client build. Deployed via `.rc` files through the Deployment Window.
+
+For A/B testing and audience targeting, use Game Overrides (`.ugo`) via the Tooling package.
+
+- **Full reference:** [references/remote-config.md](remote-config.md)
+
+## Tooling
+
+**Package:** `com.unity.services.tooling` (>= 1.4.1)
+
+Editor-only package. Registers **Access Control** (`.ac`) and **Game Overrides** (`.ugo`) file types with the Deployment Window. Use Access Control to deny direct player writes to protected keys; Deny takes precedence over Allow.
+
+- **Full reference:** [references/tooling.md](tooling.md)
+
+## Deployment
+
+**Package:** `com.unity.services.deployment` (>= 1.7.2)
+
+Editor-only package providing the **Deployment Window** (Services > Deployment). Deploys cloud resources to a target environment:
+
+The Deployment Window deploys the cloud resource files: `.rc` (Remote Config), `.ac` (Access Control), `.ccmu` (in-project Cloud Code module, preferred), `.ccmr` (legacy module reference), `.lb` (Leaderboard) and `.ugo` (Game Overrides).
+
+- **Full reference:** [references/deployment.md](deployment.md)
+
+## UGS CLI
+
+The UGS CLI ships as a Unity CLI plugin, run as `unity ugs <command>`, to deploy and fetch cloud resources outside the Editor. Install, auth/setup and which file types it deploys: [references/ugs-cli.md](ugs-cli.md). Plugin system: the **unity-cli** skill.
+
+## Services APIs
+
+**Package:** `com.unity.services.apis` (>= 1.1.1)
+
+Auto-generated REST clients for all UGS services, in four client types (`IGameClient`, `IAdminClient`, `IServerClient`, `ITrustedClient`). Use the high-level package SDKs by default; use Services APIs only for admin API access or when no package SDK covers the call.
+
+- **Full reference:** [references/apis.md](apis.md)

package/skills/build-live-game/references/tooling.md

@@ -0,0 +1,375 @@
+# Tooling Reference
+
+## Table of Contents
+
+- [Overview](#overview)
+- [Access Control](#access-control)
+  - [`.ac` File Format](#ac-file-format)
+  - [URN Pattern Format](#urn-pattern-format)
+  - [URN Reference by Service](#urn-reference-by-service)
+  - [Recommended Pattern: Deny-All-Then-Allow](#recommended-pattern-deny-all-then-allow)
+- [Game Overrides](#game-overrides)
+  - [`.ugo` File Format](#ugo-file-format)
+- [Editor API Models](#editor-api-models)
+
+Editor-only package. Registers **Access Control** (`.ac`) and **Game Overrides** (`.ugo`) file types with the Deployment Window (`com.unity.services.deployment`).
+
+- **Package:** `com.unity.services.tooling`
+- **Namespace:** `Unity.Services.Tooling.Editor.AccessControl.Authoring.Core.Model` / `Unity.Services.Tooling.Editor.GameOverrides.Authoring.Core.Model`
+
+---
+
+## Overview
+
+Tooling provides two cloud resource file types deployed through the Deployment Window:
+
+| File Type | Extension | Purpose |
+|---|---|---|
+| Access Control | `.ac` | Permit or deny player/service-account access to UGS services on a URN basis |
+| Game Overrides | `.ugo` | A/B testing and audience targeting by overriding Remote Config values for player segments |
+
+Both file types are created via right-click in the Project window → **Create > Unity Gaming Services** and deployed via **Services > Deployment**.
+
+---
+
+## Access Control
+
+Access Control policies permit or deny access to UGS services on a **URN basis**. Each statement targets a resource URN pattern and applies a `Read`, `Write`, or `*` action for a principal (`Player` or `ServiceAccount`). **Deny takes precedence over Allow.**
+
+| Concept | Description |
+|---|---|
+| **Effect** | `"Allow"` or `"Deny"` — Deny takes precedence over Allow |
+| **Action** | `"Read"`, `"Write"`, or `"*"` (both) |
+| **Principal** | `"Player"` (end user) or `"ServiceAccount"` (server/admin) |
+| **Resource** | URN pattern — `urn:ugs:<service>:/<path>` with `*` and `**` wildcards |
+
+Common use cases:
+- Deny direct player writes to Cloud Save (force writes through Cloud Code)
+- Restrict Cloud Code module/script invocation to specific endpoints
+- Deny player account deletion or identity unlinking
+
+### `.ac` File Format
+
+**Create via:** Right-click in Project window → **Create > Unity Gaming Services > Access Control**
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/project-access-policy.schema.json",
+  "statements": [
+    {
+      "Sid": "DenyPlayerCloudSaveWrites",
+      "Effect": "Deny",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**"
+    }
+  ]
+}
+```
+
+| Field | Type | Description |
+|---|---|---|
+| `Sid` | `string` | Unique statement ID within the file |
+| `Effect` | `string` | `"Allow"` or `"Deny"` — Deny wins over Allow |
+| `Action` | `string` or `string[]` | `"Read"`, `"Write"`, or `"*"` (both) |
+| `Principal` | `string` or `string[]` | `"Player"` (end user) or `"ServiceAccount"` (server/admin) |
+| `Resource` | `string` or `string[]` | URN pattern — `urn:ugs:<service>:/<path>` |
+
+### URN Pattern Format
+
+```
+urn:ugs:<service>:/<path>
+```
+
+- `*` matches a single path segment
+- `**` matches zero or more path segments (including nested)
+- `/**/` is commonly used to skip environment/version segments in the URL
+
+### URN Reference by Service
+
+#### Authentication (`player-auth`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:player-auth:/*/authentication/anonymous**` | Anonymous sign-up |
+| `urn:ugs:player-auth:/*/authentication/external-token**` | External token sign-in (social, platform) |
+| `urn:ugs:player-auth:/*/authentication/session-token**` | Session token sign-in |
+| `urn:ugs:player-auth:/*/authentication/link/**` | Link external identity |
+| `urn:ugs:player-auth:/*/authentication/unlink/**` | Unlink external identity |
+| `urn:ugs:player-auth:/*/users**` | Player info (Read) / Delete player (Write) |
+| `urn:ugs:player-auth:/.well-known/**` | JWKS public keys |
+
+#### Cloud Save (`cloud-save`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:cloud-save:/**` | All Cloud Save (blanket) |
+| `urn:ugs:cloud-save:/**/players/*/keys**` | List player data keys |
+| `urn:ugs:cloud-save:/**/players/*/items**` | Read/write player data items (own data only) |
+| `urn:ugs:cloud-save:/**/players/*/item-batch**` | Batch write player data items |
+| `urn:ugs:cloud-save:/**/players/query**` | Query Default player data |
+| `urn:ugs:cloud-save:/**/players/*/public/keys**` | Read another player's public keys |
+| `urn:ugs:cloud-save:/**/players/*/public/items**` | Read another player's public items |
+| `urn:ugs:cloud-save:/**/players/public/query**` | Query Public player data |
+| `urn:ugs:cloud-save:/**/custom/*/items**` | Read game-wide (Custom) data items |
+
+#### Leaderboards (`leaderboards`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:leaderboards:/**/leaderboards/**` | All leaderboard operations |
+
+#### Cloud Code (`cloud-code`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:cloud-code:/**/modules/**` | Cloud Code module endpoints |
+| `urn:ugs:cloud-code:/**/scripts/**` | Cloud Code scripts (legacy JS) |
+| `urn:ugs:cloud-code:/**/subscriptions/tokens/**` | Subscription tokens |
+
+### Recommended Pattern: Deny-All-Then-Allow
+
+Start with a blanket deny, then explicitly allow only what the player needs. This ensures new services are locked down by default.
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/project-access-policy.schema.json",
+  "statements": [
+    {
+      "Sid": "Deny-all-ugs-access",
+      "Effect": "Deny",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:*:/**"
+    },
+    {
+      "Sid": "Allow-Anonymous-SignUp",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/anonymous**"
+    },
+    {
+      "Sid": "Allow-External-Token-SignIn",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/external-token**"
+    },
+    {
+      "Sid": "Allow-Session-Token-SignIn",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/session-token**"
+    },
+    {
+      "Sid": "Allow-Link-External-Id",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/link/**"
+    },
+    {
+      "Sid": "Allow-Get-PlayerInfo",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/users**"
+    },
+    {
+      "Sid": "Allow-Get-JWKS",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/.well-known/**"
+    },
+    {
+      "Sid": "Allow-Read-Leaderboards",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:leaderboards:/**/leaderboards/**"
+    },
+    {
+      "Sid": "Allow-Read-CloudSave-PlayerKeys",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/keys**"
+    },
+    {
+      "Sid": "Allow-CloudSave-PlayerItems",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/items**"
+    },
+    {
+      "Sid": "Allow-CloudSave-PlayerItemBatch",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/item-batch**"
+    },
+    {
+      "Sid": "Allow-Query-Default-PlayerData",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/query**"
+    },
+    {
+      "Sid": "Allow-Read-Public-PlayerKeys",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/public/keys**"
+    },
+    {
+      "Sid": "Allow-Read-Public-PlayerItems",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/public/items**"
+    },
+    {
+      "Sid": "Allow-Query-Public-PlayerData",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/public/query**"
+    },
+    {
+      "Sid": "Allow-Read-GameData",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/custom/*/items**"
+    },
+    {
+      "Sid": "Allow-CloudCode-Modules",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/modules/**"
+    },
+    {
+      "Sid": "Allow-CloudCode-Scripts",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/scripts/**"
+    },
+    {
+      "Sid": "Allow-Subscription-Tokens",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/subscriptions/tokens/**"
+    }
+  ]
+}
+```
+
+This policy:
+- **Denies** all UGS access by default
+- **Allows** authentication (anonymous, external, session token sign-in; link external ID; read player info)
+- **Denies** identity unlinking and player deletion (inherited from blanket deny)
+- **Allows** leaderboard reads
+- **Allows** Cloud Save player data reads/writes for own data (Default items), public data reads, game-wide data reads
+- **Denies** Cloud Save blanket writes (Protected data only writable via Cloud Code)
+- **Allows** Cloud Code module, script, and subscription token access
+
+---
+
+## Game Overrides
+
+Game Overrides are the A/B testing and audience targeting mechanism for UGS. They override **Remote Config** values for specific player segments (audiences). Remote Config itself does not provide A/B testing — Game Overrides layer on top of it.
+
+Use cases:
+- A/B test different XP multipliers for player segments
+- Roll out features gradually to targeted audiences
+- Run time-limited promotions with different reward values
+
+### `.ugo` File Format
+
+**Create via:** Right-click in Project window → **Create > Unity Gaming Services > Game Override**
+
+```json
+{
+  "GameOverrides": [
+    {
+      "id": "double-xp-weekend",
+      "name": "Double XP Weekend",
+      "enabled": true,
+      "audiences": ["high_engagement_players"],
+      "overrides": [
+        {
+          "key": "xp_multiplier",
+          "value": 2.0
+        }
+      ]
+    }
+  ]
+}
+```
+
+| Field | Type | Description |
+|---|---|---|
+| `id` | `string` | Unique override ID |
+| `name` | `string` | Human-readable name |
+| `enabled` | `bool` | Whether this override is active |
+| `audiences` | `string[]` | Segment IDs from Unity Segmentation |
+| `overrides[].key` | `string` | Remote Config key to override |
+| `overrides[].value` | `any` | Replacement value |
+
+---
+
+## Editor API Models
+
+### Access Control
+
+```csharp
+namespace Unity.Services.Tooling.Editor.AccessControl.Authoring.Core.Model
+{
+    interface IProjectAccessFile
+    {
+        string Path { get; }
+        string Name { get; }
+        List<IAccessControlStatement> Statements { get; }
+    }
+
+    interface IAccessControlStatement
+    {
+        string Sid { get; }          // Statement ID — unique within the file
+        string Effect { get; }       // "Allow" or "Deny" — Deny takes precedence
+        List<string> Action { get; } // "Read", "Write", or "*" (both)
+        List<string> Principal { get; } // "Player" or "ServiceAccount"
+        List<string> Resource { get; }  // URN pattern(s) the rule applies to
+    }
+}
+```
+
+### Game Overrides
+
+```csharp
+namespace Unity.Services.Tooling.Editor.GameOverrides.Authoring.Core.Model
+{
+    interface IGameOverride
+    {
+        string Id { get; }
+        string Name { get; }
+        bool Enabled { get; }
+        List<string> Audiences { get; }
+        List<OverrideConfig> Overrides { get; }
+    }
+
+    class GameOverridesConfigFile
+    {
+        public List<IGameOverride> GameOverrides { get; }
+    }
+}
+```
+
+Both file types are discovered automatically by the Deployment Window when `com.unity.services.deployment` is installed.

package/skills/build-live-game/references/ugs-cli.md

@@ -0,0 +1,86 @@
+# UGS CLI Reference
+
+## Table of Contents
+
+- [Overview](#overview)
+- [Install and Update](#install-and-update)
+- [If the Unity CLI Itself Is Missing](#if-the-unity-cli-itself-is-missing)
+- [Auth and Project Setup](#auth-and-project-setup)
+- [Running Commands](#running-commands)
+- [Headless Deploy by File Type](#headless-deploy-by-file-type)
+- [Credentials and Environment](#credentials-and-environment)
+
+## Overview
+
+The [Unity Gaming Services CLI](https://github.com/Unity-Technologies/unity-gaming-services-cli/) manages UGS resources outside the Unity Editor: deploy and fetch cloud resource files, manage triggers and schedules, and reach admin functionality across all UGS services. Every command in this reference is invoked as `unity ugs <command>` — there is no standalone `ugs` form.
+
+## Install and Update
+
+**It ships as a Unity CLI plugin**, so install and update it through the Unity CLI rather than downloading it separately. Before running any `unity ugs` command, confirm the plugin is installed and install it if it's missing:
+
+```bash
+unity plugin list            # every component, its state, and where it resolved from — check ugs is "resolved"
+unity plugin install ugs     # install the managed copy, if missing
+unity plugin upgrade ugs     # re-install when the pinned build changes
+```
+
+If `unity plugin list` shows `ugs` resolved from `path` rather than `managed`, a UGS CLI already on PATH is used instead of the plugin, and may be an older version without the features above (e.g. Hub sign-in needs 2.0.0+). Check `unity ugs --version`; remove the other install or upgrade it.
+
+For the plugin system itself (what a managed tool is, `unity plugin remove` / `changelog`), see the **unity-cli** skill.
+
+## If the Unity CLI Itself Is Missing
+
+If `unity` is not on PATH at all, `unity plugin install ugs` can't run. Don't stop at a raw "command not found" — tell the user to install the Unity CLI first, following the **unity-cli** skill's own install instructions (its own `--help`/docs are the source of truth for the current install command).
+
+## Auth and Project Setup
+
+Before any `unity ugs` command that talks to the backend, the CLI needs credentials and a target project/environment:
+
+```bash
+unity ugs config set project-id <project-id>
+unity ugs config set environment-name <environment-name>
+```
+
+**Developer sign-in — Unity Hub (requires UGS CLI 2.0.0+):** with Unity Hub running and signed in, either run `unity ugs login` with its Hub option (see `unity ugs login --help`) to persist Hub auth, or set `UGS_CLI_USE_HUB_AUTH=true` (also accepts `1`/`yes`/`y`/`t`) to use it for one invocation without logging in — it takes priority over any saved `unity ugs login` and the service-account env vars below for that call. Hub sign-in reads the currently-running Hub's session over its local IPC socket (`/tmp/Unity-hubIPCService.sock` on macOS/Linux, a named pipe on Windows), not a file or keychain, so Hub has to actually be running and signed in on the machine the CLI runs on. The CLI prints bare `ugs` in its messages; run the equivalent as `unity ugs logout` then `unity ugs login`. Hub sign-in failures:
+
+| Error string | Cause | Fix |
+| :-- | :-- | :-- |
+| ``Unity Hub is not running. Start Hub or run `ugs logout` then `ugs login` to switch to service account authentication.`` | Hub is not running on this machine | Start Hub and sign in, or switch to a service account |
+| ``Unity Hub user is not signed in. Sign in through Unity Hub or run `ugs logout` then `ugs login` to switch to service account authentication.`` | Hub is running but nobody is signed in | Sign in through Hub, or switch to a service account |
+
+Run `unity ugs --version` first — v1.9.0 predates Hub auth; `unity plugin upgrade ugs` if it reports lower than 2.0.0. Note `unity ugs status` does **not** reflect `UGS_CLI_USE_HUB_AUTH` — it only detects a persisted Hub login, so it can still report "no credentials" while a command using the env var succeeds.
+
+**Service account — CI / headless:**
+
+```bash
+unity ugs login --service-key-id <id> --secret-key-stdin   # prompts for the secret key on stdin
+# or set UGS_CLI_SERVICE_KEY_ID / UGS_CLI_SERVICE_SECRET_KEY instead of logging in
+```
+
+`unity ugs status` reports whether a service account is currently stored. Run `unity ugs login --help` / `unity ugs config --help` to confirm flags against the installed CLI version before relying on this from memory.
+
+## Running Commands
+
+Invoke it as `unity ugs <command>`:
+
+```bash
+unity ugs login                                      # or UGS_CLI_SERVICE_KEY_ID / UGS_CLI_SERVICE_SECRET_KEY
+unity ugs deploy . --dry-run
+unity ugs fetch . -s remote-config -e production
+```
+
+## Headless Deploy by File Type
+
+`unity ugs deploy` picks files up by extension and silently skips the rest. A skipped file does not show up in the result at all, so a dry run that lists nothing means nothing was recognised.
+
+| Resource | Headless path |
+|---|---|
+| `.ccmu` (native C# module) | **Not the UGS CLI** — `unity ugs deploy` skips `.ccmu`. The Editor compiles the module and deploys it: the Deployment Window, or headlessly the `Deploy.cs` template in `references/deployment.md`. |
+| `.ccmr` (legacy module) | `unity ugs deploy` skips the `.ccmr` itself — pass the `.sln` it points at: `unity ugs deploy Module~/Module.sln`. The CLI runs `dotnet publish` (needs a .NET SDK on PATH). The Deployment Window deploys the `.ccmr` directly. |
+| `.ccm` (packaged module) | `unity ugs deploy <file>.ccm` |
+| `.rc`, `.ac`, `.lb`, `.js`, `.tr`, `.sched` | `unity ugs deploy <paths>` and `unity ugs fetch <path>`, or the Deployment Window. `--dry-run` first; `--reconcile` deletes remote content not in the deploy. `unity ugs tr new-file <name>` / `unity ugs sched new-file <name>` generate a default trigger / schedule config. |
+| `.ugo` (Game Overrides) | **Not the UGS CLI** — `unity ugs deploy` skips `.ugo`. Deploy through the Deployment Window, or headlessly the `Deploy.cs` template in `references/deployment.md`. |
+
+## Credentials and Environment
+
+`unity ugs deploy`/`fetch` authenticate using whichever CLI credential is active — a service account (`unity ugs login` or its env vars) or, from 2.0.0+, Unity Hub sign-in (see [Auth and Project Setup](#auth-and-project-setup)) — never as the signed-in Editor user, and take the environment as an argument (`-e <name>`). An Editor deploy uses the Editor's own credentials and the project's *active* environment — except that while the local Cloud Code server runs, a Cloud Code module deploy goes to that server instead. Stop the local server before deploying a module remotely.

package/skills/craft-game-floors/SECURITY.md

@@ -0,0 +1,23 @@
+# Security notes: craft-game-floors
+
+This skill has the agent run C# inside the user's open Unity Editor (applying the craft floors:
+materials, lighting, UI, audio, captures) and, for the live floor, wire Unity Gaming Services
+calls in the user's own project. Automated skill scanners flag these as powerful capabilities.
+They are intentional, and limited by the safeguards below.
+
+## Accepted risks
+
+| Risk | Capability | Why it is accepted |
+|---|---|---|
+| `SEC_POWER_CAP` | Runs C# in the user's open Editor | It only reaches the Editor the user already has open, on their own machine, as that user, behind the Pipeline capability gate. No code fetched from a remote source is run — the agent runs C# written from this skill's own references, which also require a restore point before project changes. |
+| `SEC_CLOUD` | Wires Cloud Save / Leaderboards / Remote Config client calls (the live floor) | Only against the project's own cloud id, only when a live identity probe succeeds, and declining any floor is one word. Provisioning that needs credentials or the Editor UI is named as a human step, never automated. |
+
+## Mitigations
+
+- **Restore point first.** The skill requires a rollback point (a clean commit, or one it creates)
+  before changing the project.
+- **Floors are declinable.** Every floor reverses on a word; declines are recorded, not argued.
+- **Only the user's own Editor and project.** Everything runs on this machine as this user.
+- **No remote code.** All executed C# comes from this skill's references.
+- **Mechanics route to their owners.** Mixer routing, UI construction, backend integration, and
+  import settings go to their dedicated skills rather than being improvised here.