@bitmagic/cli 0.1.8 → 0.1.10

package/dist/project/package-manager.js

@@ -0,0 +1,48 @@
+/**
+ * Which package manager a scaffolded project is installed with, and the command lines that
+ * follow from it.
+ *
+ * Every command that tells a creator to install something prints a line meant to be run
+ * verbatim — by a person or by the agent driving this CLI. Naming the wrong manager is not
+ * cosmetic: running `npm install` in a pnpm project rewrites the tree under a different linker,
+ * and the very next `bitmagic build` fails on module resolution. That turns one clear instruction
+ * into a second, far more opaque failure — precisely the trap `bitmagic upgrade`'s dependency
+ * report and `projectBin`'s missing-binary error both exist to keep creators out of.
+ *
+ * Kept in `project/` rather than inside a command, because both `commands/upgrade.ts` and
+ * `project/context.ts` need it and a command module must not be imported from `project/`.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Decide from the project's lockfile. npm is the fallback: it is what the scaffold's own docs
+ * use and what ships with Node, so it is the right guess when there is no lockfile at all.
+ *
+ * Checked most-specific-first — a repo can carry both a `pnpm-lock.yaml` and a leftover
+ * `package-lock.json`, and pnpm is the one actually in use there.
+ */
+export function detectPackageManager(root) {
+    if (fs.existsSync(path.join(root, 'pnpm-lock.yaml')))
+        return 'pnpm';
+    if (fs.existsSync(path.join(root, 'yarn.lock')))
+        return 'yarn';
+    return 'npm';
+}
+/**
+ * The command that adds `specs` as (dev) dependencies. yarn's syntax differs from npm's and
+ * pnpm's (`yarn add --dev`, not `--save-dev`), which is why this is a function rather than a
+ * template string at each call site.
+ */
+export function addCommand(manager, dev, specs) {
+    const joined = specs.join(' ');
+    if (manager === 'yarn')
+        return `yarn add ${dev ? '--dev ' : ''}${joined}`;
+    if (manager === 'pnpm')
+        return `pnpm add ${dev ? '--save-dev ' : ''}${joined}`;
+    return `npm install ${dev ? '--save-dev ' : ''}${joined}`;
+}
+/** The command that installs everything already declared in package.json. */
+export function installAllCommand(manager) {
+    return `${manager} install`;
+}
+//# sourceMappingURL=package-manager.js.map

package/dist/project/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../../src/project/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAI7B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACpE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE,GAAY,EAAE,KAAe;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1E,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/E,OAAO,eAAe,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC"}

package/dist/publish/bundle.d.ts

@@ -27,5 +27,11 @@ export declare function readBuildManifest(root: string): BuildManifest | null;
  *
  * Exit code 1 on failure, matching the table in the spec: a build failure is the creator's own
  * code, and the compiler's output has already been printed.
+ *
+ * The pre-flight below runs BEFORE `tsc`, not after: a project scaffolded before
+ * `vite.publish.config.js` existed has no config for vite to load, and without this check the
+ * creator pays a full type-check and then reads a raw vite "config not found" that names no
+ * remedy. `bitmagic upgrade` is the remedy — it vendors the file without touching game code —
+ * so the error says so.
  */
 export declare function runBuild(root: string, engineVersion: string): BuildManifest;

package/dist/publish/bundle.js

@@ -41,8 +41,19 @@ export function readBuildManifest(root) {
  *
  * Exit code 1 on failure, matching the table in the spec: a build failure is the creator's own
  * code, and the compiler's output has already been printed.
+ *
+ * The pre-flight below runs BEFORE `tsc`, not after: a project scaffolded before
+ * `vite.publish.config.js` existed has no config for vite to load, and without this check the
+ * creator pays a full type-check and then reads a raw vite "config not found" that names no
+ * remedy. `bitmagic upgrade` is the remedy — it vendors the file without touching game code —
+ * so the error says so.
  */
 export function runBuild(root, engineVersion) {
+    if (!fs.existsSync(path.join(root, VITE_PUBLISH_CONFIG))) {
+        throw new CliError(`This project has no ${VITE_PUBLISH_CONFIG}, which \`bitmagic build\` needs to bundle it. ` +
+            'It was added to the scaffold after this project was created — run `bitmagic upgrade` to ' +
+            'vendor it (your game code is not touched), then build again.', 1);
+    }
     const tsc = projectBin(root, 'tsc');
     const compile = spawnSync(tsc, [], { cwd: root, stdio: 'inherit' });
     if (compile.error)

package/dist/publish/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/publish/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAiB5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAuB;IACtE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;WAChC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACjC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;WAC5B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,aAAqB;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAE/F,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE;QAC3G,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAkB;QAC9B,aAAa;QACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACrC,KAAK,EAAE,QAAQ,CAAC,UAAU;QAC1B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/publish/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAiB5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAuB;IACtE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;WAChC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACjC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;WAC5B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,aAAqB;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,mBAAmB,iDAAiD;YACzF,0FAA0F;YAC1F,8DAA8D,EAChE,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;IAE/F,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE;QAC3G,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAkB;QAC9B,aAAa;QACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACrC,KAAK,EAAE,QAAQ,CAAC,UAAU;QAC1B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3D,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/publish/client.d.ts

@@ -0,0 +1,94 @@
+import type { Environment } from '../config/environments.js';
+export interface ApiDeps {
+    fetch: typeof globalThis.fetch;
+}
+/**
+ * One status→exit-code mapping for both publish calls.
+ *
+ * The distinction that matters is 4 vs 5: "your engine is too old" is self-serve
+ * (`bitmagic upgrade`), while a ban or an ownership mismatch is not. An agent that cannot
+ * tell them apart will either loop on upgrade or give up on a fixable problem.
+ */
+export declare function publishExitCode(status: number, body: {
+    code?: string;
+}): number;
+export interface BeginPublishRequest {
+    gameId: string;
+    visibility: 'public' | 'private';
+    name?: string;
+    description?: string;
+    engineVersion: string;
+    thumbnailUrl: string;
+}
+export interface BeginPublishResponse {
+    signedUrl: string;
+    key: string;
+    publishVersion: number;
+    metaBlock: string;
+    cacheControl: string;
+}
+export declare function beginPublish(environment: Environment, accessToken: string, body: BeginPublishRequest, deps: ApiDeps): Promise<BeginPublishResponse>;
+export interface CompletePublishRequest {
+    gameId: string;
+    key: string;
+    publishVersion: number;
+    visibility: 'public' | 'private';
+    name?: string;
+    description?: string;
+    thumbnailUrl: string;
+    bundleBytes: number;
+    sha256: string;
+    /**
+     * The audit trail the spec calls for: `engineVersion`, `fingerprint` and `sha256` recorded
+     * together for the publish that actually landed. All three are declarative — the server logs
+     * them, it does not verify them (there is no column for any of them today, and verifying the
+     * hash would mean reading bytes this design deliberately never reads).
+     *
+     * `engineVersion` is NOT a second floor gate. It cannot be: `begin` is the only step that
+     * mints the signed URL, so its floor check is already unavoidable, and a value re-declared
+     * here proves nothing about what the bundle was built with. It is sent so the log line that
+     * records a publish says which engine produced it — without it, the only record of a bundle's
+     * engine is a `begin` log entry that may belong to an abandoned attempt.
+     *
+     * `fingerprint` is the same hash `verify` recorded and `publish` gated on, so a support
+     * question about a published bundle can be tied back to the exact project state that produced
+     * it. Nothing else on the wire identifies the source.
+     */
+    engineVersion: string;
+    fingerprint: string;
+}
+export interface CompletePublishResponse {
+    url: string;
+    publishVersion: number;
+    visibility: 'public' | 'private';
+}
+export declare function completePublish(environment: Environment, accessToken: string, body: CompletePublishRequest, deps: ApiDeps): Promise<CompletePublishResponse>;
+/**
+ * `begin` always signs `text/html` for the entry HTML (cli-publish.ts's `getSignedUrl` call) but
+ * does not echo a `contentType` field back in its response — there is nothing to echo, so this
+ * fixed value is the one Content-Type that can ever be correct for the PUT.
+ */
+export declare const PUBLISH_BUNDLE_CONTENT_TYPE = "text/html";
+/** PUT the built (and meta-block-injected) bundle to the signed URL `begin` minted. */
+export declare function putBundle(signedUrl: string, html: string, cacheControl: string, deps: ApiDeps): Promise<void>;
+export interface ThumbnailUploadRequest {
+    gameId: string;
+    filename: string;
+    contentType: string;
+}
+/** `cli-uploads.ts`'s `generateUploadSignedUrl` response shape, the fields this lane uses. */
+export interface ThumbnailUploadUrl {
+    signedUrl: string;
+    publicUrl: string;
+    cacheControl: string;
+    contentEncoding?: string;
+}
+export declare function requestThumbnailUploadUrl(environment: Environment, accessToken: string, body: ThumbnailUploadRequest, deps: ApiDeps): Promise<ThumbnailUploadUrl>;
+/**
+ * PUT the thumbnail bytes to the signed URL `requestThumbnailUploadUrl` minted. `contentType` is
+ * the SAME value this lane requested (the server never echoes it back — see
+ * `PUBLISH_BUNDLE_CONTENT_TYPE`'s doc comment for why that is fine: the caller already knows it),
+ * while `cacheControl` and `contentEncoding` are read back from the signed-URL response, because
+ * the server — not this lane — decides both.
+ */
+export declare function putThumbnail(signed: ThumbnailUploadUrl, bytes: Uint8Array, contentType: string, deps: ApiDeps): Promise<void>;

package/dist/publish/client.js

@@ -0,0 +1,150 @@
+/**
+ * The HTTP client for `bitmagic publish`: the two authorizing calls to api-server
+ * (`publish/begin`, `publish/complete`), the thumbnail's signed-upload lane
+ * (`uploads/signed-url`, the same route `forge/upload-proxy.ts` bridges for the browser), and the
+ * two raw PUTs against the signed GCS URLs those calls mint.
+ *
+ * `publishExitCode` is the one status→exit-code mapping every call above shares, so `publish.ts`
+ * never has to duplicate the 401/403/409 distinctions per call site.
+ */
+import { CliError } from '../errors.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringField(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+async function readJsonBody(response) {
+    try {
+        const parsed = await response.json();
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * One status→exit-code mapping for both publish calls.
+ *
+ * The distinction that matters is 4 vs 5: "your engine is too old" is self-serve
+ * (`bitmagic upgrade`), while a ban or an ownership mismatch is not. An agent that cannot
+ * tell them apart will either loop on upgrade or give up on a fixable problem.
+ */
+export function publishExitCode(status, body) {
+    if (status === 401)
+        return 2;
+    if (status === 403)
+        return 5;
+    if (status === 409 && body.code === 'engine-below-floor')
+        return 4;
+    return 6;
+}
+/**
+ * POST `path` as JSON with a bearer token, and map a non-2xx response through `publishExitCode`.
+ * Shared by every authenticated JSON call this module makes — begin, complete, and the thumbnail
+ * signed-URL mint — so the three cannot drift on how a failure is reported.
+ */
+async function postJson(url, accessToken, body, deps) {
+    let response;
+    try {
+        response = await deps.fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        // A transport failure and an error status send people to very different places.
+        throw new CliError(`Cannot reach api-server at ${url}.`, 6);
+    }
+    // A 2xx response MUST parse as a JSON object — this is the one branch that feeds its result
+    // straight back to the caller as `T` with no further validation (`beginPublish`'s `signedUrl`,
+    // `completePublish`'s `url`, ...). Falling back to `{}` here the way the error branch below
+    // does would silently turn a malformed 200 into every field of `T` being `undefined` — e.g. a
+    // PUT sent to the literal string `"undefined"` — instead of a clear failure at the point the
+    // bad response actually arrived.
+    if (response.ok) {
+        let parsed;
+        try {
+            parsed = await response.json();
+        }
+        catch {
+            throw new CliError(`api-server returned a ${response.status} from ${url} with a body that is not valid JSON.`, 6);
+        }
+        if (!isRecord(parsed)) {
+            throw new CliError(`api-server returned an unexpected response shape from ${url}.`, 6);
+        }
+        return parsed;
+    }
+    // The error path can tolerate an unparsable/absent body — the fallback is just a generic
+    // message, not a value silently flowing on to become someone else's `undefined`.
+    const parsedError = await readJsonBody(response);
+    const code = stringField(parsedError.code);
+    const message = stringField(parsedError.error) ?? `api-server returned HTTP ${response.status} for ${url}.`;
+    throw new CliError(message, publishExitCode(response.status, { code }));
+}
+/**
+ * Raw PUT of already-prepared bytes to a GCS V4 signed URL.
+ *
+ * `headers` must match exactly what the URL's signature bound (Cache-Control, and — for the
+ * thumbnail lane — Content-Encoding when the server chose to gzip). A mismatch is a 403 from GCS,
+ * not a stale-cache symptom; see cli-publish.ts's and cli-uploads.ts's own doc comments for why.
+ */
+async function putSignedUrl(url, body, headers, deps) {
+    let response;
+    try {
+        // `@types/node`'s ambient `Uint8Array` (generic over `ArrayBufferLike` since TS 5.7) does not
+        // structurally match this project's `BodyInit` (this tsconfig's `"DOM"` lib pulls in lib.dom's
+        // own copy, which `@types/node`'s conditional global-augmentation defers to whenever DOM
+        // globals are present — see node_modules/@types/node/web-globals/fetch.d.ts). Deriving the
+        // body type from `Parameters<typeof fetch>[1]` instead of naming `BodyInit` was tried and hits
+        // the identical mismatch, because it resolves to the same lib.dom type in THIS project. Both a
+        // `string` and a `Uint8Array` are valid `fetch` bodies at runtime regardless.
+        response = await deps.fetch(url, { method: 'PUT', headers, body: body });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new CliError(`Could not upload to storage: ${message}`, 6);
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new CliError(`Upload to storage failed: HTTP ${response.status}${text ? ` — ${text.slice(0, 200)}` : ''}`, 6);
+    }
+}
+export async function beginPublish(environment, accessToken, body, deps) {
+    return postJson(`${environment.apiUrl}/api/cli/v1/publish/begin`, accessToken, body, deps);
+}
+export async function completePublish(environment, accessToken, body, deps) {
+    return postJson(`${environment.apiUrl}/api/cli/v1/publish/complete`, accessToken, body, deps);
+}
+/**
+ * `begin` always signs `text/html` for the entry HTML (cli-publish.ts's `getSignedUrl` call) but
+ * does not echo a `contentType` field back in its response — there is nothing to echo, so this
+ * fixed value is the one Content-Type that can ever be correct for the PUT.
+ */
+export const PUBLISH_BUNDLE_CONTENT_TYPE = 'text/html';
+/** PUT the built (and meta-block-injected) bundle to the signed URL `begin` minted. */
+export async function putBundle(signedUrl, html, cacheControl, deps) {
+    await putSignedUrl(signedUrl, html, { 'Content-Type': PUBLISH_BUNDLE_CONTENT_TYPE, 'Cache-Control': cacheControl }, deps);
+}
+export async function requestThumbnailUploadUrl(environment, accessToken, body, deps) {
+    return postJson(`${environment.apiUrl}/api/cli/v1/uploads/signed-url`, accessToken, body, deps);
+}
+/**
+ * PUT the thumbnail bytes to the signed URL `requestThumbnailUploadUrl` minted. `contentType` is
+ * the SAME value this lane requested (the server never echoes it back — see
+ * `PUBLISH_BUNDLE_CONTENT_TYPE`'s doc comment for why that is fine: the caller already knows it),
+ * while `cacheControl` and `contentEncoding` are read back from the signed-URL response, because
+ * the server — not this lane — decides both.
+ */
+export async function putThumbnail(signed, bytes, contentType, deps) {
+    const headers = { 'Content-Type': contentType, 'Cache-Control': signed.cacheControl };
+    if (signed.contentEncoding)
+        headers['Content-Encoding'] = signed.contentEncoding;
+    await putSignedUrl(signed.signedUrl, bytes, headers, deps);
+}
+//# sourceMappingURL=client.js.map

package/dist/publish/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/publish/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAYxC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAuB;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAuB;IACrE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,WAAmB,EACnB,IAAa,EACb,IAAa;IAEb,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,MAAM,IAAI,QAAQ,CAAC,8BAA8B,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,4FAA4F;IAC5F,+FAA+F;IAC/F,4FAA4F;IAC5F,8FAA8F;IAC9F,6FAA6F;IAC7F,iCAAiC;IACjC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,yBAAyB,QAAQ,CAAC,MAAM,SAAS,GAAG,sCAAsC,EAC1F,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,QAAQ,CAAC,yDAAyD,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,yFAAyF;IACzF,iFAAiF;IACjF,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,4BAA4B,QAAQ,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;IAC5G,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,IAAyB,EACzB,OAA+B,EAC/B,IAAa;IAEb,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,8FAA8F;QAC9F,+FAA+F;QAC/F,yFAAyF;QACzF,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,8EAA8E;QAC9E,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAA2B,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,gCAAgC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,QAAQ,CAChB,kCAAkC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5F,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AA8BD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAwB,EACxB,WAAmB,EACnB,IAAyB,EACzB,IAAa;IAEb,OAAO,QAAQ,CACb,GAAG,WAAW,CAAC,MAAM,2BAA2B,EAChD,WAAW,EACX,IAAI,EACJ,IAAI,CACL,CAAC;AACJ,CAAC;AA4CD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAwB,EACxB,WAAmB,EACnB,IAA4B,EAC5B,IAAa;IAEb,OAAO,QAAQ,CACb,GAAG,WAAW,CAAC,MAAM,8BAA8B,EACnD,WAAW,EACX,IAAI,EACJ,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,IAAY,EACZ,YAAoB,EACpB,IAAa;IAEb,MAAM,YAAY,CAChB,SAAS,EACT,IAAI,EACJ,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,YAAY,EAAE,EAC9E,IAAI,CACL,CAAC;AACJ,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAwB,EACxB,WAAmB,EACnB,IAA4B,EAC5B,IAAa;IAEb,OAAO,QAAQ,CACb,GAAG,WAAW,CAAC,MAAM,gCAAgC,EACrD,WAAW,EACX,IAAI,EACJ,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,KAAiB,EACjB,WAAmB,EACnB,IAAa;IAEb,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9G,IAAI,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;IACjF,MAAM,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/publish/fingerprint.js

@@ -4,10 +4,28 @@ import * as path from 'path';
 /**
  * Directories whose contents never change what the bundle contains: our own artifacts
  * (`.bitmagic/`, `dist/`), the dependency tree (`node_modules/` — pinned by the lockfile the
- * scaffold writes), and vite's cache. Including any of them would make the fingerprint change
- * on every build, which would make the staleness gate reject every publish.
+ * scaffold writes), vite's cache, and git's object store. Including any of them would make the
+ * fingerprint change on something other than an edit, which would make the staleness gate reject
+ * a publish of an unchanged project.
+ *
+ * `.git` is the one that bit in practice. Hashing it means an EMPTY `git commit` — no source
+ * change at all — flips the fingerprint, because the commit writes new objects, a new ref value
+ * and a new reflog entry. That turns the ordinary `bitmagic verify` → `git commit` →
+ * `bitmagic publish` sequence into exit 3 ("The project has changed since it was last verified"),
+ * and `bitmagic upgrade` actively pushes creators into git by refusing a dirty tree. The
+ * scaffolded AGENTS.md's "do not edit any tracked file between verifying and publishing" cannot
+ * prevent it either: committing is not editing. It also made every publish rebuild, since the
+ * build manifest's own recorded fingerprint could never still match by the time publish ran.
+ *
+ * `.DS_Store` is excluded for the same reason at file granularity: on macOS, Finder writes it
+ * merely for opening the project folder, and no build tool ever reads it — so it is another way
+ * to flip the fingerprint without editing anything. It is the only excluded FILE; the list is
+ * deliberately not a general ignore mechanism, because a false "fresh" ships an unverified
+ * bundle while a false "stale" only costs one `bitmagic verify`.
  */
-const EXCLUDED_DIRS = new Set(['.bitmagic', 'node_modules', 'dist', '.vite-cache']);
+const EXCLUDED_DIRS = new Set(['.bitmagic', 'node_modules', 'dist', '.vite-cache', '.git']);
+/** See EXCLUDED_DIRS: tool-written files that can never change what the bundle contains. */
+const EXCLUDED_FILES = new Set(['.DS_Store']);
 /**
  * A relative path as the fingerprint hashes it: always forward-slashed.
  *
@@ -27,6 +45,8 @@ function walk(dir, root, out) {
             walk(path.join(dir, entry.name), root, out);
         }
         else if (entry.isFile()) {
+            if (EXCLUDED_FILES.has(entry.name))
+                continue;
             const relPath = path.relative(root, path.join(dir, entry.name));
             out.push(toPosixPath(relPath));
         }

package/dist/publish/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/publish/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG;IACtE,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAa;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,EAAE,CAAC;IAEb,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/publish/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5F,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG;IACtE,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,GAAa;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,EAAE,CAAC;IAEb,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/publish/meta-block.d.ts

@@ -0,0 +1,26 @@
+import type { VerifyRunRecord } from '../verify/result.js';
+/**
+ * Put the server-issued block immediately after `<head>`, matching where the web lane puts its
+ * own meta tags — and close enough to the start of the file that the server's 64KB range read
+ * always covers it.
+ *
+ * String insertion, not DOM parsing: this HTML carries the whole inlined engine.
+ */
+export declare function injectMetaBlock(html: string, block: string): string;
+export type VerifyGate = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * May this project be published?
+ *
+ * Three distinct answers, deliberately: "never verified", "verified then edited", and "verified
+ * and broken" have three different fixes, and collapsing them into "run verify" is how an agent
+ * ends up looping verify against a game that is genuinely broken.
+ *
+ * `force` overrides the VERDICT and STALENESS, not the existence of a record: the thumbnail comes
+ * from the verify screenshot, so with no verify there is nothing to publish a thumbnail from.
+ */
+export declare function checkVerifyGate(record: VerifyRunRecord | null, fingerprint: string, force: boolean): VerifyGate;

package/dist/publish/meta-block.js

@@ -0,0 +1,48 @@
+import { CliError } from '../errors.js';
+const HEAD_OPEN = '<head>';
+/**
+ * Put the server-issued block immediately after `<head>`, matching where the web lane puts its
+ * own meta tags — and close enough to the start of the file that the server's 64KB range read
+ * always covers it.
+ *
+ * String insertion, not DOM parsing: this HTML carries the whole inlined engine.
+ */
+export function injectMetaBlock(html, block) {
+    if (html.includes('<!--bitmagic:meta:v1-->')) {
+        throw new CliError('This bundle already carries a meta block. Run `bitmagic build` again.', 6);
+    }
+    const at = html.indexOf(HEAD_OPEN);
+    if (at === -1) {
+        throw new CliError('The built bundle has no <head> to inject into.', 1);
+    }
+    const cut = at + HEAD_OPEN.length;
+    return html.slice(0, cut) + block + html.slice(cut);
+}
+/**
+ * May this project be published?
+ *
+ * Three distinct answers, deliberately: "never verified", "verified then edited", and "verified
+ * and broken" have three different fixes, and collapsing them into "run verify" is how an agent
+ * ends up looping verify against a game that is genuinely broken.
+ *
+ * `force` overrides the VERDICT and STALENESS, not the existence of a record: the thumbnail comes
+ * from the verify screenshot, so with no verify there is nothing to publish a thumbnail from.
+ */
+export function checkVerifyGate(record, fingerprint, force) {
+    if (record === null) {
+        return { ok: false, message: 'This game has not been verified. Run `bitmagic verify` first.' };
+    }
+    if (force)
+        return { ok: true };
+    if (record.fingerprint !== fingerprint) {
+        return { ok: false, message: 'The project has changed since it was last verified. Run `bitmagic verify` again.' };
+    }
+    if (!record.ok) {
+        return {
+            ok: false,
+            message: `The last verify failed:\n${record.failures.map((f) => `  ✗ ${f}`).join('\n')}\nFix these, or publish with --force.`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=meta-block.js.map

package/dist/publish/meta-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-block.js","sourceRoot":"","sources":["../../src/publish/meta-block.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,QAAQ,CAAC,uEAAuE,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,gDAAgD,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAID;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B,EAC9B,WAAmB,EACnB,KAAc;IAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kFAAkF,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,4BAA4B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC;SAC9H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/scaffold/project-files.js

@@ -252,6 +252,19 @@ import { viteSingleFile } from 'vite-plugin-singlefile';
 // since Rollup then just treats the unmatched id as an unresolved bare specifier and fails the
 // build. Verified against a real \`vite build\` before trusting the plain-string form.
 export default defineConfig({
+  // The engine serves world.json/game.json two different ways, and this flag is how it chooses.
+  // \`utils/worldDataLoader.ts\` reads \`typeof __BUNDLED__ !== 'undefined' && __BUNDLED__\`: true
+  // means "the data is inlined in this bundle, import it", false means "fetch it as separate
+  // files". A single-file published bundle has no separate files to fetch, so omitting this
+  // define does not degrade gracefully — the game boots, then dies at runtime with 404s on
+  // src/work/world.json and "world.json not found (neither bundle nor fetch available)".
+  //
+  // The typeof guard is why nothing catches it at build time: the identifier is genuinely
+  // undeclared when /dist is served raw in live-edit mode, so the engine cannot just read it.
+  // That makes a missing define invisible until a published game is opened in a browser.
+  //
+  // Deliberately NOT set in the dev config — live-edit serving must take the fetch path.
+  define: { __BUNDLED__: true },
   resolve: {
     alias: {
 ${entries}
@@ -326,6 +339,54 @@ compile that dies on load — a missing asset, a bad \`world.json\` value, a nul
 \`bitmagic verify\` after a change you cannot eyeball: it loads the game in a headless browser and
 fails with what actually broke, leaving a console log and a screenshot in \`.bitmagic/verify/\`.
 
+## Publishing
+
+\`\`\`
+bitmagic build      # bundle into .bitmagic/build/index.html + .bitmagic/build/manifest.json
+bitmagic publish    # verify-gate, build if needed, and ship to bitmagic.ai
+\`\`\`
+
+Follow this order; \`publish\` enforces it and refuses otherwise:
+
+1. Run \`bitmagic verify\` and get it passing. It writes \`.bitmagic/verify/result.json\`,
+   \`.bitmagic/verify/screenshot.png\` (becomes the publish thumbnail) and
+   \`.bitmagic/verify/console.log\`.
+2. Do not edit any tracked file between verifying and publishing. Staleness is decided by a
+   content fingerprint of every tracked file, not a clock — one edit after verifying invalidates
+   it immediately, and an untouched project stays fresh no matter how long it has been. There is
+   no way to check freshness except running \`bitmagic verify\` again. Git operations are safe:
+   \`.git/\` is excluded from the fingerprint, so committing (or branching, or stashing) between
+   verifying and publishing changes nothing. So are \`node_modules/\`, \`dist/\`, \`.bitmagic/\`
+   and \`.vite-cache/\`.
+3. Run \`bitmagic publish\`. It rebuilds automatically if the project changed since the last
+   build, so a manual \`bitmagic build\` first is optional.
+
+**A bare \`bitmagic publish\` does not make the game public.** Every publish uploads and
+registers the game, but \`visibility\` defaults to \`private\` — reachable by URL, not listed on
+bitmagic.ai. Pass \`--visibility public\` explicitly, on that call, to list it; omit it on a later
+publish and the game goes back to private — its \`/play/\` page stops serving too, so a public
+game you re-publish bare disappears from bitmagic.ai entirely until the next
+\`--visibility public\`.
+
+\`--force\` overrides a **stale or failed** verify verdict, never a **missing** one — the
+thumbnail comes from the verify screenshot, so \`bitmagic verify\` must have produced one at least
+once before \`--force\` has anything to publish from.
+
+\`--name\`/\`--description\` apply to that one publish call only; they are never written back to
+\`src/work/game.json\` (doing so by hand would change the fingerprint and invalidate the verify
+you just checked).
+
+If \`bitmagic publish\` exits non-zero, branch on the exit code rather than parsing the message:
+
+| Code | Meaning | Fix |
+|---|---|---|
+| 1 | Build failed | Run \`bitmagic check\` to see the error, fix it. If the message says \`vite.publish.config.js\` is missing, this project predates it — run \`bitmagic upgrade\` |
+| 2 | Not logged in | \`bitmagic login\` |
+| 3 | Verify missing, stale, or failed | \`bitmagic verify\` (then publish again, or add \`--force\` for a stale/failed record) |
+| 4 | Engine below the publish floor | \`bitmagic upgrade\` |
+| 5 | Not this game's owner, or the account/game is banned | Not self-serve — stop and report it |
+| 6 | Upload or finalize failed | Usually transient (network/storage). Retry once; if it fails identically, stop and report it — this code also covers permanent failures such as an unknown game or a rejected request |
+
 ## Generating assets
 
 You can create game content from here — no web editor needed:

package/dist/scaffold/project-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-files.js","sourceRoot":"","sources":["../../src/scaffold/project-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,2BAA2B,EAAE,SAAS;IACtC,2BAA2B,EAAE,SAAS;IACtC,kBAAkB,EAAE,QAAQ;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,kCAAkC,EAAE,QAAQ;IAC5C,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,aAAa,EAAE,UAAU;IACzB,cAAc,EAAE,UAAU;IAC1B,8FAA8F;IAC9F,cAAc,EAAE,QAAQ;IACxB,4FAA4F;IAC5F,mFAAmF;IACnF,eAAe,EAAE,SAAS;IAC1B,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,QAAQ;IACd,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG;IACjB,uBAAuB;IACvB,oCAAoC,aAAa,WAAW;IAC5D,kDAAkD,aAAa,2CAA2C;IAC1G,8CAA8C,aAAa,uCAAuC;IAClG,gDAAgD,aAAa,wCAAwC;CACtG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,oGAAoG;AACpG,MAAM,WAAW,GAA2B;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,4FAA4F;IAC5F,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,wBAAwB,aAAa,SAAS;IAC9D,WAAW,EAAE,wBAAwB,aAAa,MAAM;IACxD,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,eAAe,EAAE,yBAAyB,aAAa,UAAU;IACjE,qBAAqB,EAAE,yBAAyB,aAAa,gBAAgB;IAC7E,QAAQ,EAAE,wBAAwB,aAAa,GAAG;IAClD,2BAA2B,EAAE,iDAAiD;IAC9E,2BAA2B,EAAE,iDAAiD;IAC9E,OAAO,EAAE,+BAA+B;IACxC,kCAAkC,EAAE,uDAAuD;IAC3F,kBAAkB,EAAE,uCAAuC;IAC3D,MAAM,EAAE,6BAA6B;CACtC,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC;QAChB,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,MAAM;SACZ;QACD,YAAY,EAAE,YAAY;QAC1B,eAAe,EAAE,gBAAgB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC;QAChB,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;YACtB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,aAAa,EAAE;YACtB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,KAAK;YACjC,oBAAoB,EAAE,IAAI;YAC1B,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,OAAO;YACxB,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,4BAA4B,EAAE,IAAI;YAClC,gCAAgC,EAAE,IAAI;YACtC,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,IAAI;YACf,wFAAwF;YACxF,yFAAyF;YACzF,wFAAwF;YACxF,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,gFAAgF;YAChF,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,CAAC,cAAc,EAAE,qBAAqB,EAAE,wCAAwC,CAAC;SAC7F;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;QACpC,uFAAuF;QACvF,uFAAuF;QACvF,oFAAoF;QACpF,wFAAwF;QACxF,wDAAwD;QACxD,OAAO,EAAE;YACP,cAAc;YACd,MAAM;YACN,qBAAqB;YACrB,0BAA0B;YAC1B,kBAAkB;YAClB,uBAAuB;YACvB,oBAAoB;SACrB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrE,0FAA0F;IAC1F,0FAA0F;IAC1F,wFAAwF;IACxF,2FAA2F;IAC3F,mDAAmD;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;;iCAG5B,gBAAgB;;;CAGhD,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,MAAM,GAAG,CAAC;SACrD,IAAI,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;EAWP,OAAO;;;;;;;CAOR,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;;;;;EAeP,OAAO;;;;;;;;;;;;;;CAcR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiHR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;CAIR,CAAC;AACF,CAAC"}
+{"version":3,"file":"project-files.js","sourceRoot":"","sources":["../../src/scaffold/project-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,2BAA2B,EAAE,SAAS;IACtC,2BAA2B,EAAE,SAAS;IACtC,kBAAkB,EAAE,QAAQ;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,kCAAkC,EAAE,QAAQ;IAC5C,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,aAAa,EAAE,UAAU;IACzB,cAAc,EAAE,UAAU;IAC1B,8FAA8F;IAC9F,cAAc,EAAE,QAAQ;IACxB,4FAA4F;IAC5F,mFAAmF;IACnF,eAAe,EAAE,SAAS;IAC1B,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,QAAQ;IACd,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG;IACjB,uBAAuB;IACvB,oCAAoC,aAAa,WAAW;IAC5D,kDAAkD,aAAa,2CAA2C;IAC1G,8CAA8C,aAAa,uCAAuC;IAClG,gDAAgD,aAAa,wCAAwC;CACtG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,oGAAoG;AACpG,MAAM,WAAW,GAA2B;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,4FAA4F;IAC5F,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,wBAAwB,aAAa,SAAS;IAC9D,WAAW,EAAE,wBAAwB,aAAa,MAAM;IACxD,2FAA2F;IAC3F,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,eAAe,EAAE,yBAAyB,aAAa,UAAU;IACjE,qBAAqB,EAAE,yBAAyB,aAAa,gBAAgB;IAC7E,QAAQ,EAAE,wBAAwB,aAAa,GAAG;IAClD,2BAA2B,EAAE,iDAAiD;IAC9E,2BAA2B,EAAE,iDAAiD;IAC9E,OAAO,EAAE,+BAA+B;IACxC,kCAAkC,EAAE,uDAAuD;IAC3F,kBAAkB,EAAE,uCAAuC;IAC3D,MAAM,EAAE,6BAA6B;CACtC,CAAC;AAEF,sFAAsF;AACtF,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC;QAChB,IAAI;QACJ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,MAAM;SACZ;QACD,YAAY,EAAE,YAAY;QAC1B,eAAe,EAAE,gBAAgB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC;QAChB,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;YACtB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,aAAa,EAAE;YACtB,gBAAgB,EAAE,SAAS;YAC3B,MAAM,EAAE,IAAI;YACZ,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,KAAK;YACjC,oBAAoB,EAAE,IAAI;YAC1B,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,OAAO;YACxB,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,IAAI;YACrB,4BAA4B,EAAE,IAAI;YAClC,gCAAgC,EAAE,IAAI;YACtC,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,IAAI;YACf,wFAAwF;YACxF,yFAAyF;YACzF,wFAAwF;YACxF,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,gFAAgF;YAChF,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,SAAS,EAAE,CAAC,cAAc,EAAE,qBAAqB,EAAE,wCAAwC,CAAC;SAC7F;QACD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;QACpC,uFAAuF;QACvF,uFAAuF;QACvF,oFAAoF;QACpF,wFAAwF;QACxF,wDAAwD;QACxD,OAAO,EAAE;YACP,cAAc;YACd,MAAM;YACN,qBAAqB;YACrB,0BAA0B;YAC1B,kBAAkB;YAClB,uBAAuB;YACvB,oBAAoB;SACrB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrE,0FAA0F;IAC1F,0FAA0F;IAC1F,wFAAwF;IACxF,2FAA2F;IAC3F,mDAAmD;IACnD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;;iCAG5B,gBAAgB;;;CAGhD,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,MAAM,GAAG,CAAC;SACrD,IAAI,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;EAWP,OAAO;;;;;;;CAOR,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BP,OAAO;;;;;;;;;;;;;;CAcR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;CAIR,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitmagic/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Build Bitmagic games from your own agent tool",
   "type": "module",
   "bin": {
@@ -19,8 +19,8 @@
     "citty": "^0.2.2",
     "playwright-core": "^1.59.1",
     "tar": "^7.4.3",
-    "@bitmagic/world-forger": "0.1.3",
-    "@bitmagic/asset-core": "0.1.0"
+    "@bitmagic/asset-core": "0.1.0",
+    "@bitmagic/world-forger": "0.1.3"
   },
   "devDependencies": {
     "@eslint/js": "^9.38.0",