@kevlns/ship-cli 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2879 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var VERSION = "0.1.0";
+var PACKAGE_NAME = "@kevlns/ship-cli";
+
+// src/core/suggest.ts
+var SUGGESTIONS = {
+  CLI_ARGUMENT_INVALID: {
+    suggestion: "check the command and arguments with ship-cli <command> --help"
+  },
+  PROCESS_START_FAILED: {
+    suggestion: "check that the executable exists and can run on this platform"
+  },
+  PROCESS_TIMEOUT: {
+    suggestion: "check connectivity and external-tool logs; retry after resolving the timeout"
+  },
+  WX_PROJECT_CONFIG_INVALID: {
+    suggestion: "fix project.config.json syntax, compileType=game and the configured AppID"
+  },
+  WX_CONTENT_UNREADABLE: {
+    suggestion: "make every packaged file readable and replace directory links with actual build content"
+  },
+  WX_WORKERS_INVALID: {
+    suggestion: "use a valid project-relative workers directory and avoid overlap with other subpackages"
+  },
+  WX_CI_VERSION_UNSUPPORTED: {
+    suggestion: "install the supported SDK: npm i -D miniprogram-ci@2.1.31"
+  },
+  CFG_CONFIG_NOT_FOUND: {
+    suggestion: "run `ship-cli config init` in the game repo (config is searched upward from cwd; use --project <dir> to point elsewhere)"
+  },
+  CFG_CONFIG_INVALID_JSON: {
+    suggestion: "fix the JSON syntax and validate against schemas/ship-config.schema.json; compare with the template via `ship-cli config init` in a scratch dir"
+  },
+  CFG_CONFIG_EXISTS: {
+    suggestion: "edit the existing ship.config.json instead, or pass --force to overwrite it deliberately"
+  },
+  CFG_CONFIG_PATH_CONFLICT: {
+    suggestion: "point steam.buildOutput and steam.contentRoot at separate directories \u2014 steamcmd writes chunk cache (.csm/.csd) into BuildOutput and must never upload it",
+    docs: "https://partner.steamgames.com/doc/sdk/uploading"
+  },
+  CFG_DEPOT_SOURCE_OUTSIDE_CONTENT_ROOT: {
+    suggestion: 'make each depot source a subdirectory of steam.contentRoot (use "." for the whole contentRoot)'
+  },
+  CFG_DEPOT_DUPLICATE_ID: {
+    suggestion: "give every depot a unique id; the convention is appId+1, appId+2, ... for base app depots",
+    docs: "https://partner.steamgames.com/doc/store/application/depots"
+  },
+  CFG_SCHEMA_INVALID: {
+    suggestion: "fix the listed fields against schemas/ship-config.schema.json (template: `ship-cli config init` in a scratch dir)"
+  },
+  PAT_ESCAPE: {
+    suggestion: "a configured path escaped its allowed base \u2014 remove absolute paths and '..' segments from path fields in ship.config.json"
+  },
+  STM_STEAMCMD_NOT_FOUND: {
+    suggestion: "download https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip into its own directory, then set SHIP_STEAMCMD or steam.steamcmdPath",
+    docs: "https://developer.valvesoftware.com/wiki/SteamCMD"
+  },
+  STM_NO_USERNAME: {
+    suggestion: "export SHIP_STEAM_USERNAME for the dedicated build account"
+  },
+  STM_SETLIVE_DEFAULT: {
+    suggestion: "Valve forbids auto set-live on default; push with --set-live <beta-branch> for testing, then set default live manually in App Admin -> Builds (`ship-cli steam open builds`)",
+    docs: "https://partner.steamgames.com/doc/store/application/branches"
+  },
+  STM_SETLIVE_EMPTY_BRANCH: {
+    suggestion: "pass a real branch name (e.g. beta) or omit --set-live entirely"
+  },
+  STM_CONFIG_VDF_INVALID: {
+    suggestion: "SHIP_STEAM_CONFIG_VDF must be base64 of a steamcmd config/config.vdf containing InstallConfigStore; re-export it right after one successful interactive login"
+  },
+  STM_CONFIG_VDF_CONFLICT: {
+    suggestion: "the steamcmd dir already holds a different config.vdf \u2014 remove it (or re-export a fresh one); note: logging in with a password again invalidates the old token",
+    docs: "https://partner.steamgames.com/doc/sdk/uploading"
+  },
+  STM_TOTP_INVALID: {
+    suggestion: "SHIP_STEAM_TOTP_SECRET must be the base64 shared secret of the build account's Steam Guard mobile authenticator"
+  },
+  STM_BUILD_FAILED: {
+    suggestion: "inspect the logged ERROR lines and the saved log; common causes: backend config not saved yet, build account lacks Edit App Metadata, or corrupted chunk cache (delete the depot's .csm/.csd under BuildOutput and retry)",
+    docs: "https://partner.steamgames.com/doc/sdk/uploading"
+  },
+  STM_BUILD_UNKNOWN_OUTCOME: {
+    suggestion: "steamcmd exited 0 without a success signature, so it is treated as failed (fail-closed); open the saved log and check whether a build actually appeared in App Admin -> Builds"
+  },
+  STM_LOGIN_GUARD_REQUIRED: {
+    suggestion: "first logins need a Steam Guard code: set SHIP_STEAM_TOTP / SHIP_STEAM_TOTP_SECRET, or log in once interactively and seed config.vdf via SHIP_STEAM_CONFIG_VDF",
+    docs: "https://partner.steamgames.com/doc/sdk/uploading"
+  },
+  STM_CONTENT_ROOT_MISSING: {
+    suggestion: "build the game player first, or fix steam.contentRoot in ship.config.json to point at the built output directory"
+  },
+  STM_EXECUTABLE_MISSING: {
+    suggestion: "fix steam.executable (relative to contentRoot) so `steam test` can find the main exe"
+  },
+  STM_APPID_FILE_MISMATCH: {
+    suggestion: "steam_appid.txt disagrees with steam.appId \u2014 fix one of them (`ship-cli steam test --write-appid` rewrites the file from config)"
+  },
+  WX_PROJECT_DIR_MISSING: {
+    suggestion: "wechat.projectPath must be the converted mini game directory (the one containing game.json); run the engine convertor or fix the path"
+  },
+  WX_GAME_JSON_MISSING: {
+    suggestion: "game.json must exist in wechat.projectPath \u2014 re-run the engine convertor or create it (deviceOrientation + subpackages)"
+  },
+  WX_GAME_JSON_INVALID: {
+    suggestion: "fix game.json: subpackages entries need exactly name + root (roots must be safe relative paths; no duplicates); openDataContext must be a string path",
+    docs: "https://developers.weixin.qq.com/minigame/dev/reference/configuration/app.html"
+  },
+  WX_GAME_ENTRY_MISSING: {
+    suggestion: "the main package needs game.js at the project root \u2014 engine convertor output normally provides it; do not hand-create an empty one without real bootstrap code"
+  },
+  WX_PROJECT_CONFIG_MISSING: {
+    suggestion: 'create a minimal project.config.json in the project dir, e.g. {"appid":"<appid>","compileType":"game","libVersion":"latest"} \u2014 the Unity convertor normally emits it (miniprogram-ci requires it)',
+    docs: "https://developers.weixin.qq.com/miniprogram/dev/devtools/projectconfig.html"
+  },
+  WX_SUBPACKAGE_ROOT_MISSING: {
+    suggestion: "create the subpackage directory with a game.js entry inside, or fix the root path in game.json \u2014 do not create an empty dir just to silence this check"
+  },
+  WX_SUBPACKAGE_ROOT_OUTSIDE: {
+    suggestion: "subpackage roots must stay inside the mini game project directory"
+  },
+  WX_SUBPACKAGE_NESTED: {
+    suggestion: "subpackage roots must not contain each other \u2014 keep them as sibling directories under the project root"
+  },
+  WX_SUBPACKAGE_OVERLAPS_OPEN_DATA: {
+    suggestion: "the openDataContext directory cannot be a subpackage or live inside one (official rule) \u2014 move it outside all subpackage roots",
+    docs: "https://developers.weixin.qq.com/minigame/dev/guide/base-ability/subPackage/useSubPackage.html"
+  },
+  WX_MAIN_OVER_LIMIT: {
+    suggestion: "move code/assets into subpackages (wx.loadSubpackage) or serve them from CDN \u2014 see the largest-files list for candidates; these are source estimates; configure compilation through wechat.setting and compare SDK package sizes",
+    docs: "https://developers.weixin.qq.com/minigame/dev/guide/base-ability/subPackage/useSubPackage.html"
+  },
+  WX_INDEPENDENT_OVER_LIMIT: {
+    suggestion: "independent subpackages are capped at 4M each \u2014 slim it down, or make it a normal subpackage if it does not need to start without the main package",
+    docs: "https://developers.weixin.qq.com/minigame/dev/guide/base-ability/independent-sub-packages.html"
+  },
+  WX_TOTAL_OVER_LIMIT: {
+    suggestion: "total package is capped at 30M \u2014 move engine assets to CDN (the Unity convertor's webgl/ output belongs on CDN, not in the package)",
+    docs: "https://developers.weixin.qq.com/minigame/dev/guide/base-ability/code-package.html"
+  },
+  WX_KEY_NOT_FOUND: {
+    suggestion: "download the code-upload key at MP backend -> \u7BA1\u7406 -> \u5F00\u53D1\u7BA1\u7406 -> \u5F00\u53D1\u8BBE\u7F6E -> \u5C0F\u7A0B\u5E8F\u4EE3\u7801\u4E0A\u4F20, then point SHIP_WX_PRIVATE_KEY (or wechat.privateKeyPath) at the file",
+    docs: "https://developers.weixin.qq.com/miniprogram/dev/devtools/ci.html"
+  },
+  WX_KEY_INVALID: {
+    suggestion: "the file must be the PEM private key downloaded from the MP backend (keys cannot be re-downloaded; reset if lost)"
+  },
+  WX_CI_NOT_INSTALLED: {
+    suggestion: "install it in the game project: npm i -D miniprogram-ci (ship-cli resolves it from the project's node_modules)",
+    docs: "https://developers.weixin.qq.com/miniprogram/dev/devtools/ci.html"
+  },
+  WX_UPLOAD_FAILED: {
+    suggestion: "read the miniprogram-ci error output above; common causes: IP whitelist not configured, key was reset, package rejected by the compiler"
+  },
+  WX_PREVIEW_FAILED: {
+    suggestion: "read the miniprogram-ci output and check wechat.bigPackageSizeSupport for preview-only size support"
+  },
+  WX_VALIDATION_FAILED: {
+    suggestion: "fix every WX_* item in the report above, then re-run `ship-cli wx validate`"
+  },
+  WX_VERSION_REQUIRED: {
+    suggestion: "pass --version <x.y.z>; it becomes the dev-version number shown in the MP backend"
+  }
+};
+function suggest(code) {
+  return SUGGESTIONS[code];
+}
+
+// src/core/errors.ts
+var CliError = class extends Error {
+  code;
+  exitCode;
+  details;
+  /** Remediation line, auto-filled from the suggestion registry when omitted. */
+  suggestion;
+  docs;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "CliError";
+    this.code = code;
+    this.exitCode = options?.exitCode ?? exitCodeFor(code);
+    this.details = options?.details;
+    const fix = suggest(code);
+    this.suggestion = options?.suggestion ?? fix.suggestion;
+    this.docs = options?.docs ?? fix.docs;
+  }
+};
+var VALIDATION_REJECT = /* @__PURE__ */ new Set([
+  "WX_VALIDATION_FAILED",
+  "WX_PROJECT_DIR_MISSING",
+  "WX_GAME_JSON_MISSING",
+  "WX_GAME_JSON_INVALID",
+  "WX_GAME_ENTRY_MISSING",
+  "WX_PROJECT_CONFIG_MISSING",
+  "WX_SUBPACKAGE_ROOT_MISSING",
+  "WX_SUBPACKAGE_ROOT_OUTSIDE",
+  "WX_SUBPACKAGE_NESTED",
+  "WX_SUBPACKAGE_OVERLAPS_OPEN_DATA",
+  "WX_MAIN_OVER_LIMIT",
+  "WX_INDEPENDENT_OVER_LIMIT",
+  "WX_TOTAL_OVER_LIMIT"
+]);
+var PREREQUISITE = /* @__PURE__ */ new Set([
+  "STM_STEAMCMD_NOT_FOUND",
+  "STM_NO_USERNAME",
+  "STM_SETLIVE_EMPTY_BRANCH",
+  "STM_CONFIG_VDF_INVALID",
+  "STM_CONFIG_VDF_CONFLICT",
+  "STM_TOTP_INVALID",
+  "STM_CONTENT_ROOT_MISSING",
+  "STM_EXECUTABLE_MISSING",
+  "WX_KEY_NOT_FOUND",
+  "WX_KEY_INVALID",
+  "WX_CI_NOT_INSTALLED",
+  "WX_CI_VERSION_UNSUPPORTED"
+]);
+var STEAM_RUN_FAILED = /* @__PURE__ */ new Set([
+  "STM_BUILD_FAILED",
+  "STM_BUILD_UNKNOWN_OUTCOME",
+  "STM_LOGIN_GUARD_REQUIRED"
+]);
+var WX_RUN_FAILED = /* @__PURE__ */ new Set([
+  "WX_UPLOAD_FAILED",
+  "WX_PREVIEW_FAILED"
+]);
+function exitCodeFor(code) {
+  if (STEAM_RUN_FAILED.has(code)) return 3;
+  if (WX_RUN_FAILED.has(code)) return 4;
+  if (VALIDATION_REJECT.has(code)) return 1;
+  if (PREREQUISITE.has(code)) return 2;
+  return 1;
+}
+
+// src/core/config.ts
+import path3 from "path";
+import fsp2 from "fs/promises";
+
+// src/core/schema.ts
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import Ajv from "ajv";
+var ajv = new Ajv({ allErrors: true, strict: false });
+function schemasDir() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path.resolve(here, "..", "schemas"), path.resolve(here, "..", "..", "schemas")];
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+var compiled = /* @__PURE__ */ new Map();
+function loadSchemaFile(schemaFile) {
+  const file = path.join(schemasDir(), schemaFile);
+  const raw = fs.readFileSync(file, "utf8");
+  return JSON.parse(raw);
+}
+function validateAgainstSchema(data, schemaFile) {
+  let validate = compiled.get(schemaFile);
+  if (validate === void 0) {
+    validate = ajv.compile(loadSchemaFile(schemaFile));
+    compiled.set(schemaFile, validate);
+  }
+  const ok = validate(data);
+  if (ok) return [];
+  const issues = [];
+  for (const err of validate.errors ?? []) {
+    issues.push({ instancePath: err.instancePath || "/", message: err.message ?? "invalid" });
+  }
+  return issues;
+}
+function assertSchema(documentName, data, schemaFile) {
+  const issues = validateAgainstSchema(data, schemaFile);
+  if (issues.length > 0) {
+    throw new CliError("CFG_SCHEMA_INVALID", `${documentName} failed schema validation`, {
+      details: issues.map((issue) => `${issue.instancePath}: ${issue.message}`)
+    });
+  }
+}
+
+// src/core/fsx.ts
+import { spawn } from "child_process";
+import { randomBytes } from "crypto";
+import fs2 from "fs";
+import fsp from "fs/promises";
+import path2 from "path";
+async function pathExists(target) {
+  try {
+    await fsp.access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isDirectory(target) {
+  try {
+    return (await fsp.stat(target)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function isFile(target) {
+  try {
+    return (await fsp.stat(target)).isFile();
+  } catch {
+    return false;
+  }
+}
+function isInsidePath(base, target) {
+  const rel = path2.relative(path2.resolve(base), path2.resolve(target));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${path2.sep}`) && !path2.isAbsolute(rel);
+}
+function actualPath(target) {
+  let current = path2.resolve(target);
+  const tail = [];
+  for (; ; ) {
+    try {
+      return path2.join(fs2.realpathSync.native(current), ...tail);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      try {
+        if (fs2.lstatSync(current).isSymbolicLink())
+          throw new CliError(
+            "PAT_ESCAPE",
+            `dangling directory link: ${current}`
+          );
+      } catch (linkErr) {
+        if (linkErr.code !== "ENOENT") throw linkErr;
+      }
+      const parent = path2.dirname(current);
+      if (parent === current) throw err;
+      tail.unshift(path2.basename(current));
+      current = parent;
+    }
+  }
+}
+function assertRelativePath(segment) {
+  if (!segment || [...segment].some((char) => char.charCodeAt(0) < 32) || path2.posix.isAbsolute(segment) || path2.win32.isAbsolute(segment) || /^[A-Za-z]:/.test(segment) || segment.split(/[/\\]/).includes("..")) {
+    throw new CliError(
+      "PAT_ESCAPE",
+      `expected a safe relative path: ${segment}`
+    );
+  }
+}
+function safeJoin(base, segment) {
+  assertRelativePath(segment);
+  const resolved = path2.resolve(base, segment.replace(/[/\\]/g, path2.sep));
+  if (!isInsidePath(base, resolved) || !isInsidePath(actualPath(base), actualPath(resolved))) {
+    throw new CliError(
+      "PAT_ESCAPE",
+      `resolved path escapes the allowed base: ${resolved} (base: ${path2.resolve(base)})`
+    );
+  }
+  return resolved;
+}
+async function atomicWriteFile(target, data) {
+  try {
+    if ((await fsp.lstat(target)).isSymbolicLink())
+      throw new CliError(
+        "PAT_ESCAPE",
+        `refusing to replace a linked file: ${target}`
+      );
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  await fsp.mkdir(path2.dirname(target), { recursive: true });
+  const tmp = path2.join(
+    path2.dirname(target),
+    `.${path2.basename(target)}.${randomBytes(6).toString("hex")}.tmp`
+  );
+  await fsp.writeFile(tmp, data);
+  try {
+    await fsp.rename(tmp, target);
+  } catch (err) {
+    await fsp.rm(tmp, { force: true });
+    throw err;
+  }
+}
+function expandHome(input) {
+  if (input === "~") return homedir();
+  if (input.startsWith("~/") || input.startsWith("~\\")) {
+    return path2.join(homedir(), input.slice(2));
+  }
+  return input;
+}
+function homedir() {
+  return process.env.USERPROFILE ?? process.env.HOME ?? "";
+}
+async function openUrl(url) {
+  const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  await new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true,
+      windowsHide: true
+    });
+    child.on("error", reject);
+    child.on("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+// src/core/config.ts
+var CONFIG_FILE_NAME = "ship.config.json";
+var DEFAULT_WX_LIMITS = {
+  wxMainBytes: 4 * 1024 * 1024,
+  wxIndependentSubpackageBytes: 4 * 1024 * 1024,
+  wxTotalBytes: 30 * 1024 * 1024
+};
+var CONFIG_TEMPLATE = {
+  schemaVersion: 1,
+  name: "my-game",
+  steam: {
+    appId: 1e6,
+    contentRoot: "build/steam",
+    buildOutput: "build/steam-steamcmd-out",
+    executable: "MyGame.exe",
+    depots: [
+      {
+        id: 1000001,
+        source: ".",
+        exclusions: ["*.pdb", "*_BurstDebugInformation_*"]
+      }
+    ]
+  },
+  wechat: {
+    appid: "wx0000000000000000",
+    projectPath: "build/wx/minigame",
+    robot: 1
+  }
+};
+async function findConfigFile(startDir) {
+  let current = path3.resolve(startDir);
+  for (; ; ) {
+    const candidate = path3.join(current, CONFIG_FILE_NAME);
+    try {
+      const stat = await fsp2.stat(candidate);
+      if (stat.isFile()) return candidate;
+    } catch {
+    }
+    const parent = path3.dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
+async function loadConfig(startDir) {
+  const file = await findConfigFile(startDir);
+  if (file === void 0) {
+    throw new CliError(
+      "CFG_CONFIG_NOT_FOUND",
+      `no ${CONFIG_FILE_NAME} found in or above ${path3.resolve(startDir)}`
+    );
+  }
+  let raw;
+  try {
+    raw = await fsp2.readFile(file, "utf8");
+  } catch (err) {
+    throw new CliError(
+      "CFG_CONFIG_INVALID_JSON",
+      `cannot read ${file}: ${String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new CliError(
+      "CFG_CONFIG_INVALID_JSON",
+      `${file} is not valid JSON: ${String(err)}`
+    );
+  }
+  assertSchema(CONFIG_FILE_NAME, parsed, "ship-config.schema.json");
+  const doc = parsed;
+  const projectRoot = path3.dirname(file);
+  const config = { ...doc, projectRoot };
+  if (config.steam?.steamcmdPath !== void 0) config.steam.steamcmdPath = path3.resolve(projectRoot, expandHome(config.steam.steamcmdPath));
+  if (config.steam === void 0 && config.wechat === void 0) {
+    throw new CliError(
+      "CFG_SCHEMA_INVALID",
+      `${file}: at least one of "steam" or "wechat" must be configured`
+    );
+  }
+  if (config.steam !== void 0) validateSteamCrossFields(config.steam, file);
+  if (config.wechat !== void 0)
+    safeJoin(projectRoot, config.wechat.projectPath);
+  return config;
+}
+function validateSteamCrossFields(steam, file) {
+  const projectRoot = path3.dirname(file);
+  const contentRoot = safeJoin(projectRoot, steam.contentRoot);
+  const buildOutput = safeJoin(projectRoot, steam.buildOutput);
+  if (steam.executable !== void 0) safeJoin(contentRoot, steam.executable);
+  const ids = /* @__PURE__ */ new Set();
+  for (const depot of steam.depots) {
+    if (ids.has(depot.id)) {
+      throw new CliError(
+        "CFG_DEPOT_DUPLICATE_ID",
+        `${file}: duplicate depot id ${depot.id}`
+      );
+    }
+    ids.add(depot.id);
+    if (depot.source !== ".") {
+      const resolved = safeJoin(contentRoot, depot.source);
+      if (!isInsidePath(actualPath(contentRoot), actualPath(resolved))) {
+        throw new CliError(
+          "CFG_DEPOT_SOURCE_OUTSIDE_CONTENT_ROOT",
+          `${file}: depot ${depot.id} source "${depot.source}" resolves outside contentRoot`
+        );
+      }
+    }
+  }
+  const buildOutputAbs = actualPath(buildOutput);
+  const contentRootAbs = actualPath(contentRoot);
+  if (isInsidePath(contentRootAbs, buildOutputAbs)) {
+    throw new CliError(
+      "CFG_CONFIG_PATH_CONFLICT",
+      `${file}: buildOutput must not be inside contentRoot (steamcmd requirement; chunk cache would be uploaded)`
+    );
+  }
+  if (isInsidePath(buildOutputAbs, contentRootAbs)) {
+    throw new CliError(
+      "CFG_CONFIG_PATH_CONFLICT",
+      `${file}: contentRoot must not be inside buildOutput (BuildOutput holds logs/cache, not content)`
+    );
+  }
+}
+function resolveFromProject(config, relative) {
+  return safeJoin(config.projectRoot, relative);
+}
+async function writeConfigTemplate(target, force) {
+  const exists = await fsp2.stat(target).then(
+    () => true,
+    () => false
+  );
+  if (exists && !force) {
+    throw new CliError(
+      "CFG_CONFIG_EXISTS",
+      `${target} already exists (use --force to overwrite)`
+    );
+  }
+  await atomicWriteFile(
+    target,
+    `${JSON.stringify(CONFIG_TEMPLATE, null, 2)}
+`
+  );
+}
+
+// src/core/exec.ts
+import { execFile, spawn as spawn2 } from "child_process";
+import { StringDecoder } from "string_decoder";
+
+// src/core/redact.ts
+function redactSecrets(text, secrets) {
+  let out = text;
+  for (const secret of [...new Set(secrets)].sort(
+    (a, b) => (b?.length ?? 0) - (a?.length ?? 0)
+  )) {
+    if (secret !== void 0 && secret.length > 0) {
+      out = out.split(secret).join("***");
+    }
+  }
+  return out;
+}
+
+// src/core/exec.ts
+var RedactedStream = class {
+  constructor(secrets) {
+    this.secrets = secrets;
+  }
+  pending = "";
+  decoder = new StringDecoder("utf8");
+  push(chunk) {
+    this.pending += chunk ? this.decoder.write(chunk) : this.decoder.end();
+    let cut = chunk ? Math.max(
+      0,
+      this.pending.length - Math.max(0, ...this.secrets.map((s) => s.length - 1))
+    ) : this.pending.length;
+    for (const secret of this.secrets) {
+      for (let at = this.pending.indexOf(secret); at >= 0; at = this.pending.indexOf(secret, at + 1)) {
+        if (at < cut && at + secret.length > cut) cut = at;
+      }
+    }
+    const safe = redactSecrets(this.pending.slice(0, cut), this.secrets);
+    this.pending = this.pending.slice(cut);
+    return safe;
+  }
+};
+var runProcess = async function runProcess2(cmd, args, options = {}) {
+  const redact = options.redact ?? [];
+  return await new Promise((resolve, reject) => {
+    const child = spawn2(cmd, args, {
+      cwd: options.cwd,
+      env: options.env ? { ...process.env, ...options.env } : process.env,
+      windowsHide: true
+    });
+    let stdout = "";
+    let stderr = "";
+    let finished = false;
+    let timedOut = false;
+    const streams = {
+      stdout: new RedactedStream(redact.filter(Boolean)),
+      stderr: new RedactedStream(redact.filter(Boolean))
+    };
+    const lines = { stdout: "", stderr: "" };
+    const timer = options.timeoutMs !== void 0 ? setTimeout(() => {
+      timedOut = true;
+      if (process.platform === "win32" && child.pid)
+        execFile(
+          "taskkill",
+          ["/PID", String(child.pid), "/T", "/F"],
+          { windowsHide: true },
+          () => {
+          }
+        );
+      else child.kill("SIGKILL");
+    }, options.timeoutMs) : void 0;
+    const pump = (chunk, channel) => {
+      const safe = streams[channel].push(chunk);
+      if (channel === "stdout") stdout += safe;
+      else stderr += safe;
+      if (options.onLine) {
+        lines[channel] += safe;
+        const complete = lines[channel].split(/\r?\n/);
+        lines[channel] = complete.pop();
+        for (const line of complete) if (line) options.onLine(line, channel);
+        if (!chunk && lines[channel]) {
+          options.onLine(lines[channel], channel);
+          lines[channel] = "";
+        }
+      }
+    };
+    child.stdout.on("data", (chunk) => pump(chunk, "stdout"));
+    child.stderr.on("data", (chunk) => pump(chunk, "stderr"));
+    child.on("error", (err) => {
+      if (finished) return;
+      finished = true;
+      if (timer !== void 0) clearTimeout(timer);
+      reject(
+        new CliError(
+          "PROCESS_START_FAILED",
+          `cannot start ${cmd}: ${redactSecrets(err.message, redact)}`
+        )
+      );
+    });
+    child.on("close", (code) => {
+      if (finished) return;
+      finished = true;
+      if (timer !== void 0) clearTimeout(timer);
+      pump(void 0, "stdout");
+      pump(void 0, "stderr");
+      if (timedOut) {
+        reject(
+          new CliError(
+            "PROCESS_TIMEOUT",
+            `process exceeded ${options.timeoutMs}ms`,
+            { details: { stdout, stderr } }
+          )
+        );
+        return;
+      }
+      resolve({ code: code ?? -1, stdout, stderr });
+    });
+    child.stdin.end();
+  });
+};
+function lookupOnPath(executable) {
+  const isWin = process.platform === "win32";
+  const name = isWin && !/\.(exe|cmd|bat)$/i.test(executable) ? `${executable}.exe` : executable;
+  return new Promise((resolve) => {
+    execFile(
+      isWin ? "where" : "which",
+      [name],
+      { windowsHide: true },
+      (err, stdout) => {
+        if (err || !stdout) {
+          resolve(void 0);
+          return;
+        }
+        const first = stdout.toString().split(/\r?\n/).find((line) => line.trim().length > 0);
+        resolve(first?.trim() || void 0);
+      }
+    );
+  });
+}
+
+// src/steam/vdf.ts
+function escapeVdfString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\t/g, "\\t");
+}
+function quoteVdf(value) {
+  return `"${escapeVdfString(value)}"`;
+}
+function vdfPath(value) {
+  return value.replace(/\\/g, "/");
+}
+function renderAppBuildVdf(input) {
+  const lines = [];
+  lines.push('"AppBuild"');
+  lines.push("{");
+  lines.push(`	"AppID" "${input.appId}"`);
+  lines.push(`	"Desc" ${quoteVdf(input.desc)}`);
+  lines.push(`	"ContentRoot" ${quoteVdf(vdfPath(input.contentRoot) + "/")}`);
+  lines.push(`	"BuildOutput" ${quoteVdf(vdfPath(input.buildOutput) + "/")}`);
+  lines.push(`	"SetLive" ${quoteVdf(input.setLive)}`);
+  lines.push(`	"Preview" "${input.preview ? "1" : "0"}"`);
+  lines.push(`	"Local" ""`);
+  lines.push("");
+  lines.push('	"Depots"');
+  lines.push("	{");
+  for (const depot of input.depots) {
+    lines.push(`		"${depot.id}" ${quoteVdf(depot.vdf)}`);
+  }
+  lines.push("	}");
+  lines.push("}");
+  return `${lines.join("\n")}
+`;
+}
+function renderDepotBuildVdf(input) {
+  const localPath = input.source === "." ? "*" : `${vdfPath(input.source)}/*`;
+  const lines = [];
+  lines.push('"DepotBuild"');
+  lines.push("{");
+  lines.push(`	"DepotID" "${input.depotId}"`);
+  lines.push("");
+  lines.push('	"FileMapping"');
+  lines.push("	{");
+  lines.push(`		"LocalPath" ${quoteVdf(localPath)}`);
+  lines.push(`		"DepotPath" "."`);
+  lines.push(`		"Recursive" "true"`);
+  lines.push("	}");
+  for (const exclusion of input.exclusions) {
+    lines.push(`	"FileExclusion" ${quoteVdf(exclusion)}`);
+  }
+  lines.push("}");
+  return `${lines.join("\n")}
+`;
+}
+function appBuildVdfName(appId) {
+  return `app_build_${appId}.vdf`;
+}
+function depotBuildVdfName(depotId) {
+  return `depot_build_${depotId}.vdf`;
+}
+
+// src/steam/totp.ts
+import { createHmac } from "crypto";
+var ALPHABET = "23456789BCDFGHJKMNPQRTVWXY";
+function generateSteamTotp(secretBase64, timeSeconds) {
+  let key;
+  try {
+    key = Buffer.from(secretBase64, "base64");
+  } catch {
+    throw new CliError("STM_TOTP_INVALID", "STEAM shared secret is not valid base64");
+  }
+  if (key.length === 0) {
+    throw new CliError("STM_TOTP_INVALID", "STEAM shared secret decodes to zero bytes");
+  }
+  const timeSlice = Math.floor(timeSeconds / 30);
+  const message = Buffer.alloc(8);
+  message.writeBigUInt64BE(BigInt(timeSlice));
+  const digest = createHmac("sha1", key).update(message).digest();
+  const offset = digest[digest.length - 1] & 15;
+  const code = digest.readUInt32BE(offset) & 2147483647;
+  let out = "";
+  let remaining = code;
+  for (let i = 0; i < 5; i += 1) {
+    out += ALPHABET[remaining % ALPHABET.length];
+    remaining = Math.floor(remaining / ALPHABET.length);
+  }
+  return out;
+}
+
+// src/steam/logparse.ts
+var ERROR_PATTERNS = [
+  {
+    re: /\bERROR[!:]|\bFailed\b/i,
+    hint: "steamcmd reported a failure; inspect the build log"
+  },
+  {
+    re: /Login Failure|Account Login Denied|Invalid Password/i,
+    hint: "login rejected: check STEAM credentials; first-time logins need a Steam Guard code (SHIP_STEAM_TOTP / SHIP_STEAM_CONFIG_VDF)"
+  },
+  {
+    re: /Invalid content configuration/i,
+    hint: "app/depot configuration not saved on the partner backend, or build account lacks Edit App Metadata"
+  },
+  {
+    re: /Failed to get application info for app \d+/i,
+    hint: "app config not yet live on the backend or wrong build account; also check the AppID"
+  },
+  {
+    re: /Timed out waiting for AppInfo update/i,
+    hint: "steamcmd timed out waiting for app info; usually transient, retry"
+  },
+  {
+    re: /set_steam_guard_code/i,
+    hint: "steamcmd is asking for a Steam Guard code; provide SHIP_STEAM_TOTP or seed config.vdf via SHIP_STEAM_CONFIG_VDF"
+  }
+];
+var FINISHED_RE = /Successfully finished\s+(?:AppID\s+)?(?:build\s+)?(\d+)\s+build(?:\s*\(BuildID\s+(\d+)\))?/i;
+function analyzeSteamcmdOutput(stdout, stderr, exitCode, expected) {
+  const combined = `${stdout}
+${stderr}`;
+  const errors = [];
+  const hints = [];
+  for (const line of combined.split(/\r?\n/)) {
+    for (const pattern of ERROR_PATTERNS) {
+      if (pattern.re.test(line)) {
+        if (!errors.includes(line.trim())) errors.push(line.trim());
+        if (!hints.includes(pattern.hint)) hints.push(pattern.hint);
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { status: "failed", errors, hints };
+  }
+  if (exitCode !== 0) {
+    return {
+      status: "failed",
+      errors: [`steamcmd exited with code ${exitCode}`],
+      hints
+    };
+  }
+  const finished = FINISHED_RE.exec(combined);
+  if (finished && (!expected || Number(finished[1]) === expected.appId) && (expected?.preview || finished[2])) {
+    return { status: "success", buildId: finished[2], errors, hints };
+  }
+  return {
+    status: "unknown",
+    errors: ["steamcmd exited 0 without a matching completed app-build record"],
+    hints: [
+      "inspect the full log; run with Preview first to validate the pipeline"
+    ]
+  };
+}
+
+// src/steam/steamcmd.ts
+import fsp3 from "fs/promises";
+import path4 from "path";
+
+// src/core/logger.ts
+function createLogger() {
+  return {
+    json: false,
+    info(message) {
+      process.stderr.write(`${message}
+`);
+    },
+    warn(message) {
+      process.stderr.write(`warning: ${message}
+`);
+    },
+    error(message) {
+      process.stderr.write(`error: ${message}
+`);
+    },
+    result(payload) {
+      if (this.json && payload !== null && typeof payload === "object" && !Array.isArray(payload)) {
+        payload = { ok: true, ...payload };
+      }
+      if (typeof payload === "string") {
+        process.stdout.write(`${payload}
+`);
+      } else {
+        process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+      }
+    }
+  };
+}
+var log = createLogger();
+
+// src/steam/steamcmd.ts
+function pick(env, suffix) {
+  const prefixed = env[`SHIP_STEAM_${suffix}`];
+  if (prefixed !== void 0 && prefixed !== "") return prefixed;
+  return void 0;
+}
+function resolveSteamCredentials(env) {
+  return {
+    username: pick(env, "USERNAME"),
+    password: pick(env, "PASSWORD"),
+    totp: pick(env, "TOTP"),
+    totpSecret: pick(env, "TOTP_SECRET"),
+    configVdf: pick(env, "CONFIG_VDF")
+  };
+}
+function describeCredentialMode(creds) {
+  if (creds.password !== void 0 && (creds.totp !== void 0 || creds.totpSecret !== void 0)) {
+    return "password + TOTP";
+  }
+  if (creds.password !== void 0) {
+    return "password only (first login may require a Steam Guard code)";
+  }
+  return "passwordless (requires a valid config.vdf next to steamcmd)";
+}
+function buildLoginArgs(creds, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (creds.username === void 0 || creds.username === "") {
+    throw new CliError(
+      "STM_NO_USERNAME",
+      "Steam build account username missing: set SHIP_STEAM_USERNAME"
+    );
+  }
+  if (creds.password === void 0 || creds.password === "") {
+    return ["+login", creds.username];
+  }
+  const code = creds.totp ?? (creds.totpSecret !== void 0 ? generateSteamTotp(creds.totpSecret, nowSeconds) : void 0);
+  if (code !== void 0) {
+    return ["+login", creds.username, creds.password, code];
+  }
+  return ["+login", creds.username, creds.password];
+}
+var COMMON_STEAMCMD_DIRS = ["~/steamcmd", "C:/steamcmd", "D:/steamcmd"];
+async function findSteamcmd(env, configPath) {
+  const candidates = [];
+  const fromEnv = env.SHIP_STEAMCMD;
+  const explicit = fromEnv || configPath;
+  if (explicit)
+    return await isFile(expandHome(explicit)) ? path4.resolve(expandHome(explicit)) : void 0;
+  const onPath = await lookupOnPath("steamcmd");
+  if (onPath) return onPath;
+  for (const dir of COMMON_STEAMCMD_DIRS) {
+    if (process.platform !== "win32") candidates.push(path4.join(expandHome(dir), "steamcmd.sh"));
+    candidates.push(
+      path4.join(
+        expandHome(dir),
+        process.platform === "win32" ? "steamcmd.exe" : "steamcmd"
+      )
+    );
+  }
+  for (const candidate of candidates) {
+    const expanded = expandHome(candidate);
+    if (await isFile(expanded)) return path4.resolve(expanded);
+  }
+  return void 0;
+}
+async function seedConfigVdf(steamcmdExe, base64Payload) {
+  let decoded;
+  try {
+    decoded = Buffer.from(base64Payload, "base64").toString("utf8");
+  } catch {
+    throw new CliError(
+      "STM_CONFIG_VDF_INVALID",
+      "SHIP_STEAM_CONFIG_VDF is not valid base64"
+    );
+  }
+  if (!decoded.includes("InstallConfigStore")) {
+    throw new CliError(
+      "STM_CONFIG_VDF_INVALID",
+      "SHIP_STEAM_CONFIG_VDF payload does not look like a steamcmd config.vdf (missing InstallConfigStore)"
+    );
+  }
+  const target = path4.join(
+    path4.dirname(path4.resolve(steamcmdExe)),
+    "config",
+    "config.vdf"
+  );
+  if (await pathExists(target)) {
+    const existing = await fsp3.readFile(target, "utf8");
+    if (existing === decoded) return target;
+    throw new CliError(
+      "STM_CONFIG_VDF_CONFLICT",
+      `${target} already exists and differs from SHIP_STEAM_CONFIG_VDF; remove it (or re-export a fresh config.vdf) before seeding. Remember: logging in with a password again invalidates the old token.`
+    );
+  }
+  await atomicWriteFile(target, decoded);
+  return target;
+}
+async function runSteamcmdBuild(input, secrets) {
+  const args = [
+    ...input.loginArgs,
+    "+run_app_build",
+    input.appBuildVdf,
+    "+quit"
+  ];
+  const run = input.run ?? runProcess;
+  const logsDir = path4.join(input.buildOutputDir, "logs");
+  await fsp3.mkdir(logsDir, { recursive: true });
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const logPath = path4.join(logsDir, `steamcmd-${stamp}.log`);
+  const effectiveSecrets = [...secrets, ...input.loginArgs.slice(2)];
+  let result;
+  try {
+    result = await run(input.steamcmdExe, args, {
+      env: input.env,
+      redact: effectiveSecrets,
+      timeoutMs: 60 * 60 * 1e3,
+      onLine: (line) => {
+        if (!log.json) log.info(line);
+      }
+    });
+  } catch (err) {
+    const error = err;
+    await atomicWriteFile(
+      logPath,
+      redactSecrets(
+        JSON.stringify({ message: error.message, details: error.details }),
+        effectiveSecrets
+      )
+    );
+    throw new CliError(
+      "STM_BUILD_FAILED",
+      redactSecrets(error.message, effectiveSecrets),
+      { details: { logPath } }
+    );
+  }
+  const combined = redactSecrets(
+    `${result.stdout}
+${result.stderr}`,
+    effectiveSecrets
+  );
+  await atomicWriteFile(
+    logPath,
+    combined.endsWith("\n") ? combined : `${combined}
+`
+  );
+  return { exitCode: result.code, logPath, combinedOutput: combined };
+}
+function steamBuildsUrl(appId) {
+  return `https://partner.steamgames.com/apps/builds/${appId}`;
+}
+
+// src/wx/gamejson.ts
+function gameRelativePath(value) {
+  if (value.startsWith("//") || value.includes("\\") || /^[A-Za-z]:/.test(value) || [...value].some((char) => char.charCodeAt(0) < 32))
+    throw new Error("unsafe game path");
+  const normalized = value.replace(/^\//, "").replace(/\/$/, "");
+  if (!normalized || normalized.split("/").some((part) => part === ".." || part === "." || part === ""))
+    throw new Error("unsafe game path");
+  return normalized;
+}
+function parseGameJson(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    return { ok: false, error: `game.json is not valid JSON: ${String(err)}` };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { ok: false, error: "game.json must be a JSON object" };
+  }
+  const obj = parsed;
+  if (obj.subpackages !== void 0 && obj.subPackages !== void 0)
+    return { ok: false, error: "use one subpackages spelling, not both" };
+  const rawSubs = obj.subpackages ?? obj.subPackages;
+  if (rawSubs !== void 0 && !Array.isArray(rawSubs)) {
+    return { ok: false, error: "game.json subpackages must be an array" };
+  }
+  const subpackages = [];
+  for (const [index, raw] of (rawSubs ?? []).entries()) {
+    if (typeof raw !== "object" || raw === null) {
+      return {
+        ok: false,
+        error: `game.json subpackages[${index}] must be an object`
+      };
+    }
+    const entry = raw;
+    if (typeof entry.name !== "string" || entry.name.length === 0) {
+      return {
+        ok: false,
+        error: `game.json subpackages[${index}].name must be a non-empty string`
+      };
+    }
+    if (typeof entry.root !== "string" || entry.root.length === 0) {
+      return {
+        ok: false,
+        error: `game.json subpackages[${index}].root must be a non-empty string`
+      };
+    }
+    let root;
+    try {
+      root = gameRelativePath(entry.root);
+    } catch {
+      return {
+        ok: false,
+        error: `game.json subpackages[${index}].root must be a safe relative path (got "${entry.root}")`
+      };
+    }
+    if (entry.independent !== void 0 && typeof entry.independent !== "boolean")
+      return {
+        ok: false,
+        error: `subpackages[${index}].independent must be boolean`
+      };
+    if (subpackages.some((existing) => existing.name === entry.name)) {
+      return {
+        ok: false,
+        error: `game.json subpackages: duplicate name "${entry.name}"`
+      };
+    }
+    subpackages.push({
+      name: entry.name,
+      root,
+      independent: entry.independent === true
+    });
+  }
+  let openDataContext;
+  if (obj.openDataContext !== void 0) {
+    if (typeof obj.openDataContext !== "string" || obj.openDataContext.length === 0) {
+      return {
+        ok: false,
+        error: "game.json openDataContext must be a non-empty string"
+      };
+    }
+    try {
+      openDataContext = gameRelativePath(obj.openDataContext);
+    } catch {
+      return {
+        ok: false,
+        error: "game.json openDataContext must be a safe relative path"
+      };
+    }
+  }
+  let workers;
+  if (obj.workers !== void 0) {
+    try {
+      if (typeof obj.workers === "string")
+        workers = gameRelativePath(obj.workers);
+      else if (obj.workers && typeof obj.workers === "object" && !Array.isArray(obj.workers)) {
+        const worker = obj.workers;
+        if (typeof worker.path !== "string" || worker.isSubpackage !== void 0 && typeof worker.isSubpackage !== "boolean")
+          throw Error();
+        workers = {
+          path: gameRelativePath(worker.path),
+          isSubpackage: worker.isSubpackage === true
+        };
+      } else throw Error();
+    } catch {
+      return {
+        ok: false,
+        error: "workers must specify a safe directory path and optional boolean isSubpackage"
+      };
+    }
+  }
+  return {
+    ok: true,
+    gameJson: {
+      deviceOrientation: typeof obj.deviceOrientation === "string" ? obj.deviceOrientation : void 0,
+      openDataContext,
+      workers,
+      subpackages
+    }
+  };
+}
+
+// src/wx/validate.ts
+import fsp4 from "fs/promises";
+import path5 from "path";
+
+// src/wx/files.ts
+import { minimatch } from "minimatch";
+function fileSelector(projectConfig, ignores = ["node_modules/**/*"]) {
+  const options = projectConfig.packOptions;
+  if (options !== void 0 && (!options || typeof options !== "object" || Array.isArray(options)))
+    throw new CliError(
+      "WX_PROJECT_CONFIG_INVALID",
+      "packOptions must be an object"
+    );
+  const pack = options ?? {};
+  function rules(value) {
+    if (value === void 0) return [];
+    if (!Array.isArray(value))
+      throw new CliError(
+        "WX_PROJECT_CONFIG_INVALID",
+        "packOptions rules must be arrays"
+      );
+    return value.map((rule) => {
+      if (!rule || typeof rule !== "object" || typeof rule.value !== "string" || !["file", "folder", "suffix", "prefix", "regexp", "glob"].includes(
+        rule.type
+      ))
+        throw new CliError(
+          "WX_PROJECT_CONFIG_INVALID",
+          "invalid packOptions rule"
+        );
+      if (rule.type === "regexp")
+        try {
+          new RegExp(rule.value);
+        } catch {
+          throw new CliError(
+            "WX_PROJECT_CONFIG_INVALID",
+            "invalid packOptions regular expression"
+          );
+        }
+      return { type: rule.type, value: rule.value };
+    });
+  }
+  const include = rules(pack.include), ignore = rules(pack.ignore);
+  const matches = (file, rule) => {
+    const value = rule.value.replace(/\\/g, "/").replace(/^\//, "").replace(/\/$/, "");
+    switch (rule.type) {
+      case "file":
+        return file === value;
+      case "folder":
+        return file.startsWith(value + "/");
+      case "suffix":
+        return file.endsWith(value);
+      case "prefix":
+        return file.startsWith(value);
+      case "regexp":
+        return new RegExp(rule.value).test(file);
+      default:
+        return minimatch(file, rule.value, { dot: true });
+    }
+  };
+  return (file) => !ignores.some((pattern) => minimatch(file, pattern, { dot: true })) && (include.some((rule) => matches(file, rule)) || !ignore.some((rule) => matches(file, rule)));
+}
+
+// src/wx/validate.ts
+var WARN_RATIO = 0.9;
+var ANALYSIS_TOP_N = 10;
+function problem(code, subject, message, override) {
+  const fix = suggest(code);
+  return {
+    code,
+    subject,
+    message,
+    suggestion: override?.suggestion ?? fix.suggestion,
+    ...fix.docs !== void 0 ? { docs: fix.docs } : {}
+  };
+}
+async function validateWechatProject(wechat, projectRoot, limitsOverride) {
+  const limits = {
+    main: limitsOverride?.wxMainBytes ?? DEFAULT_WX_LIMITS.wxMainBytes,
+    independent: limitsOverride?.wxIndependentSubpackageBytes ?? DEFAULT_WX_LIMITS.wxIndependentSubpackageBytes,
+    total: limitsOverride?.wxTotalBytes ?? DEFAULT_WX_LIMITS.wxTotalBytes
+  };
+  const projectPath = safeJoin(projectRoot, wechat.projectPath);
+  const errors = [];
+  const warnings = [];
+  const analysis = [];
+  const emptyReport = (code, message) => ({
+    measurement: "filtered-source-estimate",
+    ok: false,
+    projectPath,
+    appid: wechat.appid,
+    limits,
+    main: { files: 0, bytes: 0 },
+    subpackages: [],
+    total: { files: 0, bytes: 0 },
+    openDataContext: null,
+    errors: [problem(code, "project", message)],
+    warnings,
+    analysis
+  });
+  if (!await isDirectory(projectPath)) {
+    return emptyReport(
+      "WX_PROJECT_DIR_MISSING",
+      `projectPath does not exist or is not a directory: ${projectPath}`
+    );
+  }
+  const gameJsonPath = path5.join(projectPath, "game.json");
+  let gameJsonText;
+  try {
+    gameJsonText = await fsp4.readFile(gameJsonPath, "utf8");
+  } catch {
+    return emptyReport(
+      "WX_GAME_JSON_MISSING",
+      `game.json not found at ${gameJsonPath}`
+    );
+  }
+  const parsed = parseGameJson(gameJsonText);
+  if (!parsed.ok || parsed.gameJson === void 0) {
+    return emptyReport(
+      "WX_GAME_JSON_INVALID",
+      parsed.error ?? "game.json is invalid"
+    );
+  }
+  const gameJson = parsed.gameJson;
+  if (!await isFile(path5.join(projectPath, "game.js"))) {
+    errors.push(
+      problem(
+        "WX_GAME_ENTRY_MISSING",
+        "main package",
+        "main package entry game.js is missing"
+      )
+    );
+  }
+  let projectConfig = {};
+  if (!await isFile(path5.join(projectPath, "project.config.json"))) {
+    errors.push(
+      problem(
+        "WX_PROJECT_CONFIG_MISSING",
+        "project",
+        "project.config.json is missing (miniprogram-ci needs it; the Unity convertor normally emits it)"
+      )
+    );
+  } else {
+    try {
+      projectConfig = JSON.parse(
+        await fsp4.readFile(
+          path5.join(projectPath, "project.config.json"),
+          "utf8"
+        )
+      );
+      if (!projectConfig || typeof projectConfig !== "object" || Array.isArray(projectConfig) || projectConfig.appid !== wechat.appid || projectConfig.compileType !== "game")
+        throw Error(
+          "project.config.json must be an object with matching appid and compileType=game"
+        );
+    } catch (err) {
+      errors.push(
+        problem(
+          "WX_PROJECT_CONFIG_INVALID",
+          "project.config.json",
+          String(err)
+        )
+      );
+    }
+  }
+  let include;
+  try {
+    include = fileSelector(projectConfig, wechat.ignores);
+  } catch (err) {
+    return emptyReport("WX_PROJECT_CONFIG_INVALID", String(err));
+  }
+  for (const required of ["game.js", "game.json"])
+    if (!include(required))
+      errors.push(
+        problem(
+          "WX_GAME_ENTRY_MISSING",
+          required,
+          `${required} is excluded from the package`
+        )
+      );
+  const resolvedSubs = [];
+  for (const entry of gameJson.subpackages) {
+    const abs = safeJoin(projectPath, entry.root);
+    if (!isInsidePath(projectPath, abs)) {
+      errors.push(
+        problem(
+          "WX_SUBPACKAGE_ROOT_OUTSIDE",
+          `subpackage "${entry.name}"`,
+          `root escapes projectPath: ${entry.root}`
+        )
+      );
+      continue;
+    }
+    const isJsFile = /\.js$/i.test(entry.root);
+    const exists = isJsFile ? await isFile(abs) : await isDirectory(abs);
+    if (!exists) {
+      errors.push(
+        problem(
+          "WX_SUBPACKAGE_ROOT_MISSING",
+          `subpackage "${entry.name}"`,
+          `root does not exist: ${entry.root}`
+        )
+      );
+    } else if (isJsFile && !include(entry.root) || !isJsFile && (!await isFile(path5.join(abs, "game.js")) || !include(`${entry.root}/game.js`))) {
+      errors.push(
+        problem(
+          "WX_GAME_ENTRY_MISSING",
+          entry.root,
+          `subpackage "${entry.name}" has no game.js at its root`
+        )
+      );
+    }
+    resolvedSubs.push({ entry, abs, isJsFile, exists });
+  }
+  for (let i = 0; i < resolvedSubs.length; i += 1) {
+    for (let j = i + 1; j < resolvedSubs.length; j += 1) {
+      const a = resolvedSubs[i];
+      const b = resolvedSubs[j];
+      if (isInsidePath(a.abs, b.abs) || isInsidePath(b.abs, a.abs)) {
+        errors.push(
+          problem(
+            "WX_SUBPACKAGE_NESTED",
+            `subpackages "${a.entry.name}" + "${b.entry.name}"`,
+            "subpackage roots must not nest or overlap"
+          )
+        );
+      }
+    }
+  }
+  let openDataContext = null;
+  if (gameJson.openDataContext !== void 0) {
+    const oddAbs = safeJoin(projectPath, gameJson.openDataContext);
+    if (!isInsidePath(projectPath, oddAbs)) {
+      errors.push(
+        problem(
+          "WX_SUBPACKAGE_ROOT_OUTSIDE",
+          "openDataContext",
+          `openDataContext escapes projectPath: ${gameJson.openDataContext}`
+        )
+      );
+    } else {
+      if (!await isDirectory(oddAbs)) {
+        errors.push(
+          problem(
+            "WX_GAME_ENTRY_MISSING",
+            "openDataContext",
+            `directory does not exist: ${gameJson.openDataContext}`
+          )
+        );
+      }
+      if (!await isFile(path5.join(oddAbs, "index.js")))
+        errors.push(
+          problem(
+            "WX_GAME_ENTRY_MISSING",
+            "openDataContext",
+            "index.js is missing"
+          )
+        );
+      for (const sub of resolvedSubs) {
+        if (isInsidePath(sub.abs, oddAbs) || isInsidePath(oddAbs, sub.abs)) {
+          errors.push(
+            problem(
+              "WX_SUBPACKAGE_OVERLAPS_OPEN_DATA",
+              `openDataContext vs subpackage "${sub.entry.name}"`,
+              "openDataContext must not overlap any subpackage"
+            )
+          );
+        }
+      }
+      if (await isDirectory(oddAbs)) {
+        const measured = await walkTree(oddAbs, {
+          relBase: projectPath,
+          include,
+          ignores: wechat.ignores
+        });
+        openDataContext = {
+          dir: gameJson.openDataContext,
+          files: measured.files,
+          bytes: measured.bytes
+        };
+      }
+    }
+  }
+  if (gameJson.workers) {
+    const worker = typeof gameJson.workers === "string" ? { path: gameJson.workers, isSubpackage: false } : gameJson.workers;
+    const abs = safeJoin(projectPath, worker.path);
+    if (!await isDirectory(abs))
+      errors.push(
+        problem(
+          "WX_WORKERS_INVALID",
+          worker.path,
+          "workers directory is missing"
+        )
+      );
+    if (worker.isSubpackage) {
+      if (resolvedSubs.some(
+        (sub) => isInsidePath(sub.abs, abs) || isInsidePath(abs, sub.abs)
+      ) || gameJson.openDataContext && (isInsidePath(abs, safeJoin(projectPath, gameJson.openDataContext)) || isInsidePath(safeJoin(projectPath, gameJson.openDataContext), abs)))
+        errors.push(
+          problem(
+            "WX_WORKERS_INVALID",
+            worker.path,
+            "worker package overlaps another package or open data context"
+          )
+        );
+      else
+        resolvedSubs.push({
+          entry: { name: "__WORKERS__", root: worker.path, independent: false },
+          abs,
+          isJsFile: false,
+          exists: await isDirectory(abs)
+        });
+    }
+  }
+  const subRoots = resolvedSubs.map((s) => s.abs);
+  const mainWalk = await walkTree(projectPath, {
+    skip: (abs) => subRoots.some((root) => isInsidePath(root, abs)),
+    relBase: projectPath,
+    include,
+    ignores: wechat.ignores
+  });
+  const main2 = {
+    files: mainWalk.files,
+    bytes: mainWalk.bytes,
+    limitBytes: limits.main
+  };
+  const subpackages = [];
+  const subWalks = /* @__PURE__ */ new Map();
+  for (const sub of resolvedSubs) {
+    if (!sub.exists) {
+      subpackages.push({
+        name: sub.entry.name,
+        root: sub.entry.root,
+        independent: sub.entry.independent,
+        rootExists: false,
+        files: 0,
+        bytes: 0
+      });
+      continue;
+    }
+    const walked = sub.isJsFile ? {
+      files: 1,
+      bytes: (await fsp4.stat(sub.abs)).size,
+      entries: [
+        {
+          path: toPosix(path5.relative(projectPath, sub.abs)),
+          bytes: (await fsp4.stat(sub.abs)).size
+        }
+      ]
+    } : await walkTree(sub.abs, {
+      relBase: projectPath,
+      include,
+      ignores: wechat.ignores
+    });
+    subWalks.set(sub.entry.name, walked);
+    subpackages.push({
+      name: sub.entry.name,
+      root: sub.entry.root,
+      independent: sub.entry.independent,
+      rootExists: true,
+      files: walked.files,
+      bytes: walked.bytes,
+      ...sub.entry.independent ? { limitBytes: limits.independent } : {}
+    });
+  }
+  const totalBytes = main2.bytes + subpackages.reduce((sum, s) => sum + s.bytes, 0);
+  const totalFiles = main2.files + subpackages.reduce((sum, s) => sum + s.files, 0);
+  const total = {
+    files: totalFiles,
+    bytes: totalBytes,
+    limitBytes: limits.total
+  };
+  if (main2.bytes > limits.main) {
+    errors.push(
+      problem(
+        "WX_MAIN_OVER_LIMIT",
+        "main package",
+        `main package is ${formatBytes(main2.bytes)} but the limit is ${formatBytes(limits.main)}`
+      )
+    );
+  } else if (main2.bytes >= limits.main * WARN_RATIO) {
+    warnings.push(
+      `main package is at ${Math.round(main2.bytes / limits.main * 100)}% of the limit`
+    );
+  }
+  for (const sub of subpackages) {
+    if (sub.independent && sub.bytes > limits.independent) {
+      errors.push(
+        problem(
+          "WX_INDEPENDENT_OVER_LIMIT",
+          `subpackage "${sub.name}" (independent)`,
+          `size is ${formatBytes(sub.bytes)} but the limit is ${formatBytes(limits.independent)}`
+        )
+      );
+    }
+  }
+  if (totalBytes > limits.total) {
+    errors.push(
+      problem(
+        "WX_TOTAL_OVER_LIMIT",
+        "total package",
+        `total size is ${formatBytes(totalBytes)} but the limit is ${formatBytes(limits.total)}`
+      )
+    );
+  } else if (totalBytes >= limits.total * WARN_RATIO) {
+    warnings.push(
+      `total package size is at ${Math.round(totalBytes / limits.total * 100)}% of the limit`
+    );
+  }
+  if (main2.bytes >= limits.main * WARN_RATIO) {
+    analysis.push({
+      package: "main",
+      files: topEntries(mainWalk.entries, ANALYSIS_TOP_N)
+    });
+  }
+  for (const sub of subpackages) {
+    const overIndependent = sub.independent && sub.bytes >= limits.independent * WARN_RATIO;
+    if (overIndependent) {
+      const walked = subWalks.get(sub.name);
+      if (walked !== void 0)
+        analysis.push({
+          package: `subpackage "${sub.name}"`,
+          files: topEntries(walked.entries, ANALYSIS_TOP_N)
+        });
+    }
+  }
+  if (totalBytes >= limits.total * WARN_RATIO) {
+    const largest = [...subpackages].sort((a, b) => b.bytes - a.bytes)[0];
+    if (largest !== void 0 && !analysis.some(
+      (entry) => entry.package === `subpackage "${largest.name}"`
+    )) {
+      const walked = subWalks.get(largest.name);
+      if (walked !== void 0)
+        analysis.push({
+          package: `subpackage "${largest.name}" (largest)`,
+          files: topEntries(walked.entries, ANALYSIS_TOP_N)
+        });
+    }
+  }
+  return {
+    measurement: "filtered-source-estimate",
+    ok: errors.length === 0,
+    projectPath,
+    appid: wechat.appid,
+    limits,
+    main: main2,
+    subpackages,
+    total,
+    openDataContext,
+    errors,
+    warnings,
+    analysis
+  };
+}
+async function walkTree(root, opts = {}) {
+  const relBase = opts.relBase ?? root;
+  let files = 0;
+  let bytes = 0;
+  const entries = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === void 0) break;
+    let dirents;
+    try {
+      dirents = await fsp4.readdir(current, { withFileTypes: true });
+    } catch {
+      throw new CliError(
+        "WX_CONTENT_UNREADABLE",
+        `cannot read directory: ${current}`
+      );
+    }
+    for (const entry of dirents) {
+      const full = path5.join(current, entry.name);
+      if (opts.skip !== void 0 && opts.skip(full)) continue;
+      const relative = toPosix(path5.relative(relBase, full));
+      if ((entry.isDirectory() || entry.isSymbolicLink()) && (opts.ignores ?? ["node_modules/**/*"]).some((pattern) => {
+        if (!pattern.endsWith("/**/*")) return false;
+        const prefix = pattern.slice(0, -5);
+        return ![...prefix].some((char) => "?*[{}".includes(char)) && (relative === prefix || relative.startsWith(`${prefix}/`));
+      }))
+        continue;
+      if (entry.isSymbolicLink())
+        throw new CliError(
+          "WX_CONTENT_UNREADABLE",
+          `packaged content contains a link: ${full}`
+        );
+      if (entry.isDirectory()) {
+        stack.push(full);
+      } else if (entry.isFile()) {
+        if (opts.include && !opts.include(toPosix(path5.relative(relBase, full))))
+          continue;
+        let size = 0;
+        try {
+          size = (await fsp4.stat(full)).size;
+        } catch {
+          throw new CliError(
+            "WX_CONTENT_UNREADABLE",
+            `cannot measure file: ${full}`
+          );
+        }
+        files += 1;
+        bytes += size;
+        entries.push({
+          path: toPosix(path5.relative(relBase, full)),
+          bytes: size
+        });
+      }
+    }
+  }
+  return { files, bytes, entries };
+}
+function topEntries(entries, count) {
+  return [...entries].sort((a, b) => b.bytes - a.bytes).slice(0, count);
+}
+function toPosix(input) {
+  return input.replace(/\\/g, "/");
+}
+function formatBytes(bytes) {
+  const mib = bytes / (1024 * 1024);
+  if (mib >= 1) return `${mib.toFixed(2)}M`;
+  return `${(bytes / 1024).toFixed(1)}K`;
+}
+
+// src/wx/cicli.ts
+import { createRequire } from "module";
+import path6 from "path";
+import fsp5 from "fs/promises";
+import { createPrivateKey } from "crypto";
+async function resolveMiniprogramCi(candidateRoots) {
+  for (const root of candidateRoots) {
+    const req = createRequire(path6.join(path6.resolve(root), "noop.js"));
+    let pkgJsonPath;
+    try {
+      pkgJsonPath = req.resolve("miniprogram-ci/package.json");
+    } catch {
+      continue;
+    }
+    try {
+      const pkg = JSON.parse(await fsp5.readFile(pkgJsonPath, "utf8"));
+      if (pkg.name === "miniprogram-ci") {
+        const version = pkg.version?.match(/^(\d+)\.(\d+)\.(\d+)$/);
+        if (!version || Number(version[1]) !== 2 || Number(version[2]) < 1 || Number(version[2]) === 1 && Number(version[3]) < 31)
+          throw new CliError(
+            "WX_CI_VERSION_UNSUPPORTED",
+            `supported miniprogram-ci range is >=2.1.31 <3; found ${pkg.version}`
+          );
+        return path6.dirname(pkgJsonPath);
+      }
+    } catch (err) {
+      if (err instanceof CliError) throw err;
+      continue;
+    }
+  }
+  throw new CliError(
+    "WX_CI_NOT_INSTALLED",
+    "miniprogram-ci is not resolvable; install it in the game project (npm i -D miniprogram-ci) or any parent directory"
+  );
+}
+async function resolvePrivateKey(env, configPath, projectRoot) {
+  const fromEnv = env.SHIP_WX_PRIVATE_KEY;
+  const raw = fromEnv ?? configPath;
+  if (raw === void 0 || raw === "") {
+    throw new CliError(
+      "WX_KEY_NOT_FOUND",
+      "WeChat upload key not configured: set SHIP_WX_PRIVATE_KEY or wechat.privateKeyPath in ship.config.json. Download the key from MP backend: \u7BA1\u7406 -> \u5F00\u53D1\u7BA1\u7406 -> \u5F00\u53D1\u8BBE\u7F6E -> \u5C0F\u7A0B\u5E8F\u4EE3\u7801\u4E0A\u4F20"
+    );
+  }
+  const expanded = expandHome(raw);
+  const resolved = path6.resolve(projectRoot, expanded);
+  if (!await isFile(resolved)) {
+    throw new CliError(
+      "WX_KEY_NOT_FOUND",
+      `WeChat upload key file not found: ${resolved}`
+    );
+  }
+  try {
+    createPrivateKey(await fsp5.readFile(resolved));
+  } catch {
+    throw new CliError(
+      "WX_KEY_INVALID",
+      `WeChat upload key does not look like a PEM private key: ${resolved}`
+    );
+  }
+  return resolved;
+}
+function js(value) {
+  return JSON.stringify(value);
+}
+function buildDriverScript(input) {
+  const lines = [
+    `"use strict";`,
+    `const ci = require(${js(input.pkgDir)});`,
+    `function done(label, payload) { process.stdout.write(label + JSON.stringify(payload) + "\\n"); }`,
+    `(async () => {`,
+    `  const project = new ci.Project({`,
+    `    appid: ${js(input.appid)},`,
+    `    type: "miniGame",`,
+    `    projectPath: ${js(input.projectPath)},`,
+    `    privateKeyPath: ${js(input.privateKeyPath)},`,
+    `    ignores: ${js(input.ignores ?? ["node_modules/**/*"])}`,
+    `  });`,
+    `  const onProgressUpdate = (task) => { try { process.stderr.write("[ci] " + (typeof task === "string" ? task : JSON.stringify(task)) + "\\n"); } catch {} };`
+  ];
+  if (input.mode === "upload") {
+    if (input.version === void 0 || input.version === "") {
+      throw new CliError(
+        "WX_VERSION_REQUIRED",
+        "upload requires --version (becomes the dev-version number, e.g. 1.0.0)"
+      );
+    }
+    lines.push(
+      `  const result = await ci.upload({ project, version: ${js(input.version)}, desc: ${js(input.desc ?? "")}, robot: ${input.robot ?? 1}, setting: ${js({ useProjectConfig: true, ...input.setting })}, onProgressUpdate });`,
+      `  done("SHIP_RESULT_JSON:", { completed: true, mode: "upload", appid: ${js(input.appid)}, result });`
+    );
+  } else {
+    const dest = input.qrcodeOutputDest ?? "wx-preview-qr.png";
+    lines.push(
+      `  const result = await ci.preview({ project, desc: ${js(input.desc ?? "")}, robot: ${input.robot ?? 1}, setting: ${js({ useProjectConfig: true, ...input.setting })}, bigPackageSizeSupport: ${js(input.bigPackageSizeSupport ?? false)}, qrcodeFormat: "image", qrcodeOutputDest: ${js(path6.resolve(dest))}, onProgressUpdate });`,
+      `  done("SHIP_RESULT_JSON:", { completed: true, mode: "preview", appid: ${js(input.appid)}, result });`
+    );
+  }
+  lines.push(
+    `})().catch((err) => { done("SHIP_ERROR_JSON:", { message: String((err && err.message) || err) }); process.exit(1); });`
+  );
+  return lines.join("\n");
+}
+var RESULT_MARK = "SHIP_RESULT_JSON:";
+var ERROR_MARK = "SHIP_ERROR_JSON:";
+async function runWxCi(input) {
+  const script = buildDriverScript(input);
+  const run = input.run ?? runProcess;
+  const privateKey = await fsp5.readFile(input.privateKeyPath, "utf8");
+  const secrets = [
+    privateKey,
+    ...privateKey.split(/\r?\n/).filter((line) => line && !line.startsWith("-----"))
+  ];
+  let result;
+  try {
+    result = await run(process.execPath, ["-e", script], {
+      cwd: input.projectPath,
+      timeoutMs: input.timeoutMs ?? 15 * 60 * 1e3,
+      redact: secrets,
+      onLine: (line) => {
+        if (!log.json && !line.startsWith(RESULT_MARK) && !line.startsWith(ERROR_MARK))
+          log.info(line);
+      }
+    });
+  } catch (err) {
+    const error = err;
+    throw new CliError(
+      input.mode === "upload" ? "WX_UPLOAD_FAILED" : "WX_PREVIEW_FAILED",
+      redactSecrets(error.message, secrets),
+      { details: error.details }
+    );
+  }
+  const stdout = redactSecrets(result.stdout, secrets);
+  const markers = stdout.split(/\r?\n/).filter(
+    (line) => line.startsWith(RESULT_MARK) || line.startsWith(ERROR_MARK)
+  );
+  const markerLine = markers.length === 1 ? markers[0] : void 0;
+  let parsed;
+  let errorMessage;
+  if (markerLine !== void 0) {
+    try {
+      parsed = JSON.parse(
+        markerLine.slice(markerLine.indexOf(":") + 1)
+      );
+      if (markerLine.startsWith(ERROR_MARK)) {
+        errorMessage = parsed !== null && typeof parsed === "object" ? String(
+          parsed.message ?? "miniprogram-ci failed"
+        ) : "miniprogram-ci returned an invalid error record";
+      }
+      if (markerLine.startsWith(RESULT_MARK)) {
+        const payload = parsed;
+        if (!payload || payload.completed !== true || payload.mode !== input.mode || payload.appid !== input.appid || !payload.result || typeof payload.result !== "object" || Array.isArray(payload.result))
+          errorMessage = "miniprogram-ci completion protocol is invalid";
+        else parsed = payload.result;
+      }
+    } catch {
+      errorMessage = "miniprogram-ci returned an invalid JSON completion record";
+    }
+  } else errorMessage = "miniprogram-ci returned no unique completion record";
+  if (input.mode === "preview" && result.code === 0 && !errorMessage) {
+    const file = path6.resolve(input.qrcodeOutputDest ?? "wx-preview-qr.png");
+    const bytes = await fsp5.readFile(file).catch(() => void 0);
+    if (!bytes || bytes.length < 8 || !bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])))
+      errorMessage = "preview completed without a valid PNG QR image";
+  }
+  return {
+    exitCode: result.code,
+    result: parsed,
+    errorMessage,
+    output: stdout + redactSecrets(result.stderr, secrets)
+  };
+}
+
+// src/cli.ts
+import path11 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { Command, CommanderError } from "commander";
+
+// src/commands/doctor.ts
+import path7 from "path";
+async function runDoctor(startDir) {
+  const checks = [];
+  const report = {
+    node: process.version,
+    platform: process.platform,
+    config: { found: false },
+    checks
+  };
+  const configFile = await findConfigFile(startDir);
+  report.config = configFile === void 0 ? { found: false } : { found: true, path: configFile };
+  const config = configFile === void 0 ? void 0 : await safeLoad(startDir);
+  if (configFile === void 0) {
+    checks.push({
+      name: "config",
+      status: "fail",
+      detail: `no ${CONFIG_FILE_NAME} in or above ${startDir} (config init creates one)`
+    });
+  } else if (config === void 0) {
+    checks.push({
+      name: "config",
+      status: "fail",
+      detail: `${configFile} failed to load; run: ship-cli config validate`
+    });
+  } else {
+    checks.push({ name: "config", status: "ok", detail: configFile });
+  }
+  if (config?.steam !== void 0) {
+    const steamExe = await findSteamcmd(process.env, config.steam.steamcmdPath);
+    report.steam = {
+      configured: true,
+      steamcmd: steamExe === void 0 ? { found: false } : { found: true, path: steamExe }
+    };
+    if (steamExe === void 0) {
+      checks.push({
+        name: "steam:steamcmd",
+        status: "fail",
+        detail: "steamcmd not found; install from https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip and set SHIP_STEAMCMD or steam.steamcmdPath"
+      });
+    } else {
+      checks.push({ name: "steam:steamcmd", status: "ok", detail: steamExe });
+    }
+    const creds = resolveSteamCredentials(process.env);
+    const mode = describeCredentialMode(creds);
+    report.steam.credentials = {
+      mode,
+      username: creds.username !== void 0,
+      configVdfSeeded: creds.configVdf !== void 0
+    };
+    if (creds.username === void 0) {
+      checks.push({
+        name: "steam:credentials",
+        status: "fail",
+        detail: "SHIP_STEAM_USERNAME unset; steam push will not run"
+      });
+    } else if (!creds.password && !creds.configVdf && (!steamExe || !await isFile(
+      path7.join(path7.dirname(steamExe), "config", "config.vdf")
+    ))) {
+      checks.push({
+        name: "steam:credentials",
+        status: "fail",
+        detail: "passwordless login requires an existing config/config.vdf or SHIP_STEAM_CONFIG_VDF"
+      });
+    } else {
+      checks.push({ name: "steam:credentials", status: "ok", detail: mode });
+    }
+    const contentRoot = path7.resolve(
+      config.projectRoot,
+      config.steam.contentRoot
+    );
+    if (!await isDirectory(contentRoot)) {
+      checks.push({
+        name: "steam:contentRoot",
+        status: "fail",
+        detail: `contentRoot does not exist yet: ${contentRoot}`
+      });
+    } else {
+      checks.push({
+        name: "steam:contentRoot",
+        status: "ok",
+        detail: contentRoot
+      });
+    }
+  }
+  if (config?.wechat !== void 0) {
+    const projectPath = path7.resolve(
+      config.projectRoot,
+      config.wechat.projectPath
+    );
+    const exists = await isDirectory(projectPath);
+    report.wechat = {
+      configured: true,
+      projectDir: { exists, path: projectPath }
+    };
+    checks.push({
+      name: "wx:project",
+      status: exists ? "ok" : "fail",
+      detail: exists ? projectPath : `wechat projectPath does not exist yet: ${projectPath}`
+    });
+    try {
+      const key = await resolvePrivateKey(
+        process.env,
+        config.wechat.privateKeyPath,
+        config.projectRoot
+      );
+      if (isInsidePath(actualPath(projectPath), actualPath(key))) throw new CliError("WX_KEY_INVALID", "upload private key must be outside packaged game content");
+      report.wechat.privateKey = { found: true, path: key };
+      checks.push({ name: "wx:key", status: "ok", detail: key });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      report.wechat.privateKey = { found: false, error: message };
+      checks.push({ name: "wx:key", status: "fail", detail: message });
+    }
+    try {
+      const ciDir = await resolveMiniprogramCi([
+        projectPath,
+        config.projectRoot
+      ]);
+      report.wechat.miniprogramCi = { found: true, dir: ciDir };
+      checks.push({ name: "wx:miniprogram-ci", status: "ok", detail: ciDir });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      report.wechat.miniprogramCi = { found: false };
+      checks.push({
+        name: "wx:miniprogram-ci",
+        status: "fail",
+        detail: message
+      });
+    }
+  }
+  return report;
+}
+async function safeLoad(startDir) {
+  try {
+    return await loadConfig(startDir);
+  } catch {
+    return void 0;
+  }
+}
+function printDoctor(report, json) {
+  if (json) {
+    log.result({
+      ...report,
+      ok: !report.checks.some((check) => check.status === "fail")
+    });
+    return;
+  }
+  log.info(`ship-cli doctor`);
+  log.info(`  node ${report.node}  platform ${report.platform}`);
+  for (const check of report.checks) {
+    const icon = check.status === "ok" ? "[ok]" : check.status === "warn" ? "[!!]" : "[XX]";
+    log.info(`  ${icon} ${check.name}: ${check.detail}`);
+  }
+}
+
+// src/commands/config.ts
+import path8 from "path";
+async function runConfigInit(startDir, force, json) {
+  const target = path8.join(path8.resolve(startDir), CONFIG_FILE_NAME);
+  await writeConfigTemplate(target, force);
+  if (json) {
+    log.result({ written: target, force });
+  } else {
+    log.info(`wrote ${target}`);
+    log.info("edit appId/appid/paths, then run: ship-cli config validate");
+  }
+}
+async function runConfigValidate(startDir, json) {
+  const config = await loadConfig(startDir);
+  if (json) {
+    log.result({
+      ok: true,
+      projectRoot: config.projectRoot,
+      steam: config.steam === void 0 ? null : { appId: config.steam.appId, depots: config.steam.depots.length },
+      wechat: config.wechat === void 0 ? null : { appid: config.wechat.appid, robot: config.wechat.robot ?? 1 }
+    });
+  } else {
+    log.info(`${path8.join(config.projectRoot, CONFIG_FILE_NAME)} OK`);
+    if (config.steam !== void 0) {
+      log.info(`  steam: appId=${config.steam.appId}, depots=${config.steam.depots.map((d) => d.id).join(",")}`);
+    }
+    if (config.wechat !== void 0) {
+      log.info(`  wechat: appid=${config.wechat.appid}, robot=${config.wechat.robot ?? 1}`);
+    }
+  }
+}
+async function runConfigShow(startDir, json) {
+  const config = await loadConfig(startDir);
+  const { projectRoot, ...rest } = config;
+  if (json) {
+    log.result({ projectRoot, ...rest });
+  } else {
+    log.result(`${JSON.stringify({ projectRoot, ...rest }, null, 2)}`);
+  }
+}
+
+// src/commands/steam.ts
+import fsp6 from "fs/promises";
+import path9 from "path";
+function requireSteam(config) {
+  if (config.steam === void 0) {
+    throw new CliError(
+      "CFG_SCHEMA_INVALID",
+      "ship.config.json has no steam section"
+    );
+  }
+  return config.steam;
+}
+function normalizeBranch(branch) {
+  if (branch === void 0) return "";
+  const trimmed = branch.trim();
+  if (trimmed === "") {
+    throw new CliError(
+      "STM_SETLIVE_EMPTY_BRANCH",
+      "--set-live must be a non-empty branch name when provided"
+    );
+  }
+  if (trimmed.toLowerCase() === "default") {
+    throw new CliError(
+      "STM_SETLIVE_DEFAULT",
+      `Steam forbids setting the default branch live automatically; set it manually in App Admin -> Builds (requires phone-verified build account for released apps)`
+    );
+  }
+  return trimmed;
+}
+async function prepareSteamVdfs(config, opts) {
+  const steam = requireSteam(config);
+  const setLive = normalizeBranch(opts.setLive);
+  const contentRoot = resolveFromProject(config, steam.contentRoot);
+  const buildOutput = resolveFromProject(config, steam.buildOutput);
+  const vdfDir = path9.join(buildOutput, "vdf");
+  const depotNames = steam.depots.map((depot) => ({
+    id: depot.id,
+    vdf: depotBuildVdfName(depot.id)
+  }));
+  const appBuild = renderAppBuildVdf({
+    appId: steam.appId,
+    desc: opts.desc,
+    contentRoot,
+    buildOutput,
+    setLive,
+    preview: opts.preview,
+    depots: depotNames
+  });
+  const appBuildPath = path9.join(vdfDir, appBuildVdfName(steam.appId));
+  await atomicWriteFile(appBuildPath, appBuild);
+  const depotPaths = [];
+  for (const depot of steam.depots) {
+    const content = renderDepotBuildVdf({
+      depotId: depot.id,
+      source: depot.source,
+      exclusions: depot.exclusions ?? []
+    });
+    const depotPath = path9.join(vdfDir, depotBuildVdfName(depot.id));
+    await atomicWriteFile(depotPath, content);
+    depotPaths.push({ id: depot.id, path: depotPath });
+  }
+  return {
+    vdfDir,
+    appBuildPath,
+    depotPaths,
+    contentRoot,
+    buildOutput,
+    setLive,
+    preview: opts.preview
+  };
+}
+async function runSteamVdf(startDir, opts) {
+  const config = await loadConfig(startDir);
+  const prepared = await prepareSteamVdfs(config, opts);
+  if (opts.json) {
+    log.result({
+      appBuild: prepared.appBuildPath,
+      depots: prepared.depotPaths,
+      setLive: prepared.setLive,
+      preview: prepared.preview
+    });
+    return;
+  }
+  log.info(`wrote ${prepared.appBuildPath}`);
+  for (const depot of prepared.depotPaths) {
+    log.info(`wrote ${depot.path} (depot ${depot.id})`);
+  }
+  log.info(
+    `preview=${prepared.preview ? "1 (dry-run, uploads nothing)" : "0 (real build)"}  setLive="${prepared.setLive}"`
+  );
+}
+async function runSteamBuild(startDir, opts) {
+  const config = await loadConfig(startDir);
+  const steam = requireSteam(config);
+  const creds = resolveSteamCredentials(process.env);
+  const loginArgs = buildLoginArgs(creds);
+  const steamcmdExe = await findSteamcmd(process.env, steam.steamcmdPath);
+  if (steamcmdExe === void 0) {
+    throw new CliError(
+      "STM_STEAMCMD_NOT_FOUND",
+      "steamcmd not found; download https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip, then set SHIP_STEAMCMD or steam.steamcmdPath"
+    );
+  }
+  const prepared = await prepareSteamVdfs(config, opts);
+  if (!await isDirectory(prepared.contentRoot)) {
+    throw new CliError(
+      "STM_CONTENT_ROOT_MISSING",
+      `contentRoot does not exist: ${prepared.contentRoot}`
+    );
+  }
+  await inspectSteamContent(prepared.contentRoot);
+  if (creds.configVdf !== void 0) {
+    await seedConfigVdf(steamcmdExe, creds.configVdf);
+  }
+  await fsp6.mkdir(path9.join(prepared.buildOutput, "logs"), { recursive: true });
+  const mode = opts.preview ? "preview (no upload)" : "build";
+  if (!opts.json) {
+    log.info(`steamcmd: ${steamcmdExe}`);
+    log.info(
+      `mode: ${mode}  app ${steam.appId}  setLive "${prepared.setLive || "(none)"}"`
+    );
+    log.info(`content: ${prepared.contentRoot}`);
+  }
+  const secrets = [creds.password, creds.totp, creds.totpSecret].filter(
+    (s) => s !== void 0
+  );
+  const run = await runSteamcmdBuild(
+    {
+      steamcmdExe,
+      loginArgs,
+      appBuildVdf: prepared.appBuildPath,
+      buildOutputDir: prepared.buildOutput
+    },
+    secrets
+  );
+  const outcome = analyzeSteamcmdOutput(run.combinedOutput, "", run.exitCode, {
+    appId: steam.appId,
+    preview: opts.preview
+  });
+  if (outcome.status !== "success") {
+    const code = outcome.status === "failed" ? "STM_BUILD_FAILED" : "STM_BUILD_UNKNOWN_OUTCOME";
+    throw new CliError(
+      code,
+      `steamcmd ${mode} did not succeed (exit ${run.exitCode})`,
+      {
+        exitCode: 3,
+        details: {
+          errors: outcome.errors,
+          hints: outcome.hints,
+          logPath: run.logPath
+        }
+      }
+    );
+  }
+  if (opts.json) {
+    log.result({
+      ok: true,
+      mode,
+      appId: steam.appId,
+      buildId: outcome.buildId ?? null,
+      setLive: prepared.setLive || null,
+      logPath: run.logPath,
+      vdfDir: prepared.vdfDir
+    });
+    return;
+  }
+  log.info(
+    `success${outcome.buildId !== void 0 ? ` (build ${outcome.buildId})` : ""}`
+  );
+  log.info(`full log: ${run.logPath}`);
+  if (prepared.setLive !== "") {
+    log.info(
+      `build is live on branch "${prepared.setLive}"; test with: steam://run/${steam.appId}`
+    );
+  } else {
+    log.info(
+      `next: set the build live on a branch in App Admin -> Builds: ${steamBuildsUrl(steam.appId)}`
+    );
+  }
+}
+async function runSteamTest(startDir, opts) {
+  const config = await loadConfig(startDir);
+  const steam = requireSteam(config);
+  const contentRoot = resolveFromProject(config, steam.contentRoot);
+  const appidFile = path9.join(contentRoot, "steam_appid.txt");
+  if (!await isDirectory(contentRoot)) {
+    throw new CliError(
+      "STM_CONTENT_ROOT_MISSING",
+      `contentRoot does not exist: ${contentRoot}`
+    );
+  }
+  let appidState = "missing";
+  if (await isFile(appidFile)) {
+    appidState = "present";
+    const content = (await fsp6.readFile(appidFile, "utf8")).trim();
+    if (content !== String(steam.appId)) {
+      throw new CliError(
+        "STM_APPID_FILE_MISMATCH",
+        `steam_appid.txt contains "${content}" but config appId is ${steam.appId}`
+      );
+    }
+  } else if (opts.writeAppid) {
+    await atomicWriteFile(appidFile, `${steam.appId}
+`);
+    appidState = "written";
+  }
+  const libraries = await inspectSteamContent(contentRoot);
+  const apiDllFound = libraries.length > 0;
+  const executable = steam.executable === void 0 ? void 0 : safeJoin(contentRoot, steam.executable);
+  const executableOk = executable === void 0 ? null : await isFile(executable);
+  const summary = {
+    ok: appidState !== "missing" && apiDllFound && executableOk !== false,
+    contentRoot,
+    steamAppidTxt: appidState,
+    steamApiDllFound: apiDllFound,
+    steamApiLibraries: libraries,
+    executable: executable === null || executable === void 0 ? null : { path: executable, exists: executableOk === true },
+    runUrl: `steam://run/${steam.appId}`,
+    buildsUrl: steamBuildsUrl(steam.appId)
+  };
+  if (!summary.ok)
+    throw new CliError(
+      executableOk === false ? "STM_EXECUTABLE_MISSING" : "STM_CONTENT_ROOT_MISSING",
+      "local Steam prerequisites are incomplete (AppID file, Steam API library or configured executable)",
+      { details: summary }
+    );
+  if (opts.json) {
+    log.result(summary);
+    return;
+  }
+  log.info(`content root: ${contentRoot}`);
+  log.info(`steam_appid.txt: ${appidState}`);
+  if (apiDllFound) {
+    log.info("steam_api64.dll: found");
+  } else {
+    log.warn("steam_api64.dll: NOT found");
+    log.warn(
+      "  fix: copy steam_api64.dll from the Steamworks SDK redistributables next to the exe (required to run outside the Steam client)"
+    );
+  }
+  if (executable !== void 0) {
+    if (executableOk) {
+      log.info(`executable: ${executable}`);
+    } else {
+      log.warn(`executable: ${executable} (missing)`);
+      log.warn(
+        "  fix: point steam.executable at the built exe (relative to contentRoot)"
+      );
+    }
+  }
+  log.info(
+    `run locally from the build dir (needs a logged-in Steam client) or via ${summary.runUrl}`
+  );
+  log.info(`manage builds: ${summary.buildsUrl}`);
+  if (appidState === "missing") {
+    log.warn(
+      "steam_appid.txt missing; rerun with --write-appid to create it for local runs outside the Steam client"
+    );
+  }
+}
+async function inspectSteamContent(root) {
+  const libraries = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === void 0) break;
+    const entries = await fsp6.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isSymbolicLink())
+        throw new CliError(
+          "PAT_ESCAPE",
+          `Steam content must contain actual files, not links: ${path9.join(current, entry.name)}`
+        );
+      if (entry.isFile() && /^(?:steam_api(?:64)?\.dll|libsteam_api\.(?:so|dylib))$/i.test(
+        entry.name
+      ))
+        libraries.push(path9.join(current, entry.name));
+      if (entry.isDirectory()) stack.push(path9.join(current, entry.name));
+    }
+  }
+  return libraries;
+}
+async function runSteamOpen(startDir, target) {
+  const config = await loadConfig(startDir);
+  const steam = requireSteam(config);
+  if (target === "builds") {
+    await openUrl(steamBuildsUrl(steam.appId));
+    return;
+  }
+  throw new CliError(
+    "CFG_SCHEMA_INVALID",
+    `unknown steam open target "${target}" (supported: builds)`
+  );
+}
+function registerSteamCommand(program) {
+  const steam = program.command("steam").description("Steam packaging and upload via steamcmd / SteamPipe");
+  steam.command("vdf").description(
+    "generate app_build + depot_build VDFs (inspect or hand-run them yourself)"
+  ).option(
+    "--desc <text>",
+    "build description recorded on the Builds page",
+    "ship-cli build"
+  ).option(
+    "--set-live <branch>",
+    "branch to auto set live after upload (NOT allowed: default)"
+  ).option(
+    "--preview",
+    "write Preview=1 (dry-run VDF, uploads nothing)",
+    false
+  ).option("--json", "print JSON result").action(
+    async (options) => {
+      await runSteamVdf(process.cwd(), options);
+    }
+  );
+  const build = (cmd, preview) => {
+    cmd.option(
+      "--desc <text>",
+      "build description recorded on the Builds page",
+      "ship-cli build"
+    ).option("--json", "print JSON result");
+    if (!preview) {
+      cmd.option(
+        "--set-live <branch>",
+        "branch to auto set live after upload (NOT allowed: default)"
+      );
+    }
+    return cmd;
+  };
+  build(
+    steam.command("preview").description(
+      "run steamcmd with Preview=1: full pipeline, uploads NOTHING, produces logs + manifest"
+    ),
+    true
+  ).action(async (options) => {
+    await runSteamBuild(process.cwd(), {
+      ...options,
+      preview: true,
+      setLive: void 0
+    });
+  });
+  build(
+    steam.command("push").description(
+      "upload a real build via steamcmd (optionally set live on a NON-default branch)"
+    ),
+    false
+  ).action(
+    async (options) => {
+      await runSteamBuild(process.cwd(), { ...options, preview: false });
+    }
+  );
+  steam.command("test").description(
+    "local smoke checks on the built content (steam_appid.txt, steam_api dll, run URLs)"
+  ).option(
+    "--write-appid",
+    "create steam_appid.txt in contentRoot when missing",
+    false
+  ).option("--json", "print JSON result").action(async (options) => {
+    await runSteamTest(process.cwd(), options);
+  });
+  steam.command("open <target>").description("open a Steamworks partner page (builds)").action(async (target) => {
+    await runSteamOpen(process.cwd(), target);
+  });
+}
+
+// src/commands/wx.ts
+import path10 from "path";
+import fsp7 from "fs/promises";
+import { randomUUID } from "crypto";
+function parseRobot(value) {
+  if (!/^(?:[1-9]|[12][0-9]|30)$/.test(value))
+    throw new CliError(
+      "CLI_ARGUMENT_INVALID",
+      "--robot must be an integer from 1 to 30"
+    );
+  return Number(value);
+}
+function requireWechat(config) {
+  if (config.wechat === void 0) {
+    throw new CliError(
+      "CFG_SCHEMA_INVALID",
+      "ship.config.json has no wechat section"
+    );
+  }
+  return config.wechat;
+}
+function renderWxReport(report) {
+  log.info(
+    "sizes are filtered source estimates; miniprogram-ci compilation determines actual package sizes"
+  );
+  log.info(`project: ${report.projectPath} (appid ${report.appid})`);
+  const mainExceeded = report.main.bytes > report.limits.main;
+  log.info(
+    `main: ${formatBytes(report.main.bytes)} / ${formatBytes(report.limits.main)} (${report.main.files} files)${mainExceeded ? "  EXCEEDED" : ""}`
+  );
+  for (const sub of report.subpackages) {
+    const limit = sub.limitBytes !== void 0 ? ` / ${formatBytes(sub.limitBytes)}` : "";
+    const exceeded = sub.limitBytes !== void 0 && sub.bytes > sub.limitBytes;
+    log.info(
+      `subpackage "${sub.name}"${sub.independent ? " (independent)" : ""}: ${formatBytes(sub.bytes)}${limit} (${sub.files} files)${exceeded ? "  EXCEEDED" : ""}`
+    );
+  }
+  if (report.openDataContext !== null) {
+    log.info(
+      `openDataContext "${report.openDataContext.dir}": ${formatBytes(report.openDataContext.bytes)} (counts toward main)`
+    );
+  }
+  const totalExceeded = report.total.bytes > report.limits.total;
+  log.info(
+    `total: ${formatBytes(report.total.bytes)} / ${formatBytes(report.limits.total)}${totalExceeded ? "  EXCEEDED" : ""}`
+  );
+  if (report.analysis.length > 0) {
+    for (const item of report.analysis) {
+      log.info(`largest files in ${item.package} (top ${item.files.length}):`);
+      for (const file of item.files) {
+        log.info(`  ${formatBytes(file.bytes).padStart(8)}  ${file.path}`);
+      }
+    }
+  }
+  if (report.errors.length > 0) {
+    log.error(`errors (${report.errors.length}):`);
+    report.errors.forEach((error, index) => {
+      log.error(`  [E${index + 1}] ${error.code} \u2014 ${error.subject}`);
+      log.error(`       ${error.message}`);
+      log.error(`       fix: ${error.suggestion}`);
+      if (error.docs !== void 0) log.error(`       docs: ${error.docs}`);
+    });
+  }
+  if (report.warnings.length > 0) {
+    log.warn(`warnings (${report.warnings.length}):`);
+    for (const warning of report.warnings) log.warn(`  - ${warning}`);
+  }
+}
+async function runWxValidate(startDir, json) {
+  const config = await loadConfig(startDir);
+  const wechat = requireWechat(config);
+  const report = await validateWechatProject(
+    wechat,
+    config.projectRoot,
+    config.limits
+  );
+  if (!json) {
+    renderWxReport(report);
+  }
+  if (!report.ok) {
+    throw new CliError(
+      "WX_VALIDATION_FAILED",
+      `${report.errors.length} validation error(s)${json ? "" : " \u2014 see report above"}`,
+      {
+        details: json ? report : void 0
+      }
+    );
+  }
+  if (json) {
+    log.result(report);
+  }
+}
+async function runWxPreview(startDir, opts) {
+  const config = await loadConfig(startDir);
+  const wechat = requireWechat(config);
+  if (opts.version !== void 0 && opts.version !== "") {
+    throw new CliError(
+      "CFG_SCHEMA_INVALID",
+      "wx preview does not take --version (uploads create versions; previews do not)"
+    );
+  }
+  const validation = await validateWechatProject(
+    wechat,
+    config.projectRoot,
+    config.limits
+  );
+  const structural = validation.errors.filter(
+    (error) => ![
+      "WX_MAIN_OVER_LIMIT",
+      "WX_INDEPENDENT_OVER_LIMIT",
+      "WX_TOTAL_OVER_LIMIT"
+    ].includes(error.code)
+  );
+  if (structural.length)
+    throw new CliError(
+      "WX_VALIDATION_FAILED",
+      "preview blocked by invalid game structure",
+      { details: validation }
+    );
+  await executeWxCi(config, wechat, { mode: "preview", opts });
+}
+async function runWxPush(startDir, opts) {
+  if (!opts.version?.trim())
+    throw new CliError(
+      "WX_VERSION_REQUIRED",
+      "upload requires a non-empty --version"
+    );
+  const config = await loadConfig(startDir);
+  const wechat = requireWechat(config);
+  const validation = await validateWechatProject(
+    wechat,
+    config.projectRoot,
+    config.limits
+  );
+  if (!validation.ok) {
+    if (!opts.json) {
+      log.error("refusing to upload \u2014 validation failed:");
+      renderWxReport(validation);
+    }
+    throw new CliError(
+      "WX_VALIDATION_FAILED",
+      "upload blocked until wx validate passes",
+      {
+        details: opts.json ? validation : void 0
+      }
+    );
+  }
+  await executeWxCi(config, wechat, { mode: "upload", opts });
+}
+async function executeWxCi(config, wechat, input) {
+  const projectPath = resolveFromProject(config, wechat.projectPath);
+  const robot = input.opts.robot ?? wechat.robot ?? 1;
+  if (!Number.isInteger(robot) || robot < 1 || robot > 30) {
+    throw new CliError(
+      "CFG_SCHEMA_INVALID",
+      `robot must be an integer in 1..30 (got ${robot})`
+    );
+  }
+  const pkgDir = await resolveMiniprogramCi([projectPath, config.projectRoot]);
+  const privateKeyPath = await resolvePrivateKey(
+    process.env,
+    wechat.privateKeyPath,
+    config.projectRoot
+  );
+  if (isInsidePath(actualPath(projectPath), actualPath(privateKeyPath)))
+    throw new CliError(
+      "WX_KEY_INVALID",
+      "upload private key must be outside packaged game content"
+    );
+  const qrOut = input.mode === "preview" ? input.opts.qrOut ? path10.resolve(config.projectRoot, input.opts.qrOut) : resolveFromProject(
+    config,
+    `build/ship-preview/${randomUUID()}/qr.png`
+  ) : void 0;
+  if (qrOut) {
+    if (isInsidePath(actualPath(projectPath), actualPath(qrOut)))
+      throw new CliError(
+        "PAT_ESCAPE",
+        "QR output must be outside packaged game content"
+      );
+    try {
+      await fsp7.lstat(qrOut);
+      throw new CliError(
+        "PAT_ESCAPE",
+        `QR output already exists; choose another --qr-out: ${qrOut}`
+      );
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+    await fsp7.mkdir(path10.dirname(qrOut), { recursive: true });
+  }
+  if (!input.opts.json) {
+    log.info(`miniprogram-ci: ${pkgDir}`);
+    log.info(`project: ${projectPath}  appid ${wechat.appid}  robot ${robot}`);
+    log.info(
+      input.mode === "upload" ? `upload dev-version ${input.opts.version ?? ""} (creates a new \u5F00\u53D1\u7248; select it as \u4F53\u9A8C\u7248 in the MP backend)` : `preview (QR code for phone testing)`
+    );
+  }
+  const result = await runWxCi({
+    mode: input.mode,
+    pkgDir,
+    appid: wechat.appid,
+    projectPath,
+    privateKeyPath,
+    version: input.opts.version,
+    desc: input.opts.desc,
+    robot,
+    qrcodeOutputDest: qrOut,
+    ignores: wechat.ignores,
+    setting: wechat.setting,
+    bigPackageSizeSupport: wechat.bigPackageSizeSupport,
+    timeoutMs: wechat.timeoutMs
+  });
+  if (result.exitCode !== 0 || result.errorMessage !== void 0) {
+    throw new CliError(
+      input.mode === "upload" ? "WX_UPLOAD_FAILED" : "WX_PREVIEW_FAILED",
+      result.errorMessage ?? `miniprogram-ci exited with code ${result.exitCode}`,
+      { exitCode: 4, details: { output: result.output.slice(-4e3) } }
+    );
+  }
+  if (input.opts.json) {
+    log.result({
+      ok: true,
+      mode: input.mode,
+      appid: wechat.appid,
+      robot,
+      version: input.opts.version ?? null,
+      qrOut: qrOut ?? null,
+      result: result.result ?? null
+    });
+    return;
+  }
+  log.info("done");
+  if (qrOut) log.info(`QR image: ${qrOut}`);
+  if (input.mode === "upload") {
+    log.info(
+      "next (human steps): MP \u540E\u53F0 -> \u7248\u672C\u7BA1\u7406 -> \u5F00\u53D1\u7248\u672C -> \u9009\u4E3A\u4F53\u9A8C\u7248 / \u63D0\u4EA4\u5BA1\u6838\u3002\u5BA1\u6838\u901A\u8FC7\u540E\u624D\u80FD\u5168\u91CF\u53D1\u5E03\u6216\u7070\u5EA6\u3002"
+    );
+  }
+}
+async function runWxOpen(_startDir, target) {
+  if (target === "mp") {
+    await openUrl("https://mp.weixin.qq.com/");
+    return;
+  }
+  throw new CliError(
+    "CFG_SCHEMA_INVALID",
+    `unknown wx open target "${target}" (supported: mp)`
+  );
+}
+function registerWxCommand(program) {
+  const wx = program.command("wx").description(
+    "WeChat mini game packaging checks, preview QR and dev-version upload"
+  );
+  wx.command("validate").description(
+    "offline structural + package-size validation (main 4M / independent subpackage 4M / total 30M)"
+  ).option("--json", "print JSON report").action(async (options) => {
+    await runWxValidate(process.cwd(), options.json === true);
+  });
+  wx.command("preview").description(
+    "generate a phone-test QR code via miniprogram-ci (no version created)"
+  ).option(
+    "--qr-out <file>",
+    "new PNG QR image outside packaged content (relative to project)"
+  ).option("--desc <text>", "note shown in the dev-version list").option("--robot <n>", "miniprogram-ci robot slot 1-30", parseRobot).option("--json", "print JSON result").action(
+    async (options) => {
+      await runWxPreview(process.cwd(), {
+        version: "",
+        desc: options.desc,
+        robot: options.robot,
+        qrOut: options.qrOut,
+        json: options.json === true
+      });
+    }
+  );
+  wx.command("push").description(
+    "upload a new dev version via miniprogram-ci (validate first; NEVER submits for review)"
+  ).requiredOption("--version <text>", "dev-version number, e.g. 1.0.0").option("--desc <text>", "upload note / changelog shown in the backend").option("--robot <n>", "miniprogram-ci robot slot 1-30", parseRobot).option("--json", "print JSON result").action(
+    async (options) => {
+      await runWxPush(process.cwd(), {
+        version: options.version,
+        desc: options.desc,
+        robot: options.robot,
+        json: options.json === true
+      });
+    }
+  );
+  wx.command("open <target>").description("open the WeChat MP backend (mp)").action(async (target) => {
+    await runWxOpen(process.cwd(), target);
+  });
+}
+
+// src/cli.ts
+function extractProjectArg(argv) {
+  const out = [];
+  let project;
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (token === "--project") {
+      const value = argv[i + 1];
+      if (value === void 0 || value.startsWith("--") || project !== void 0) {
+        throw new CliError(
+          "CLI_ARGUMENT_INVALID",
+          "--project requires one directory argument"
+        );
+      }
+      project = value;
+      i += 1;
+      continue;
+    }
+    if (token.startsWith("--project=")) {
+      if (!token.slice("--project=".length) || project !== void 0)
+        throw new CliError(
+          "CLI_ARGUMENT_INVALID",
+          "--project must appear once with a non-empty directory"
+        );
+      project = token.slice("--project=".length);
+      continue;
+    }
+    out.push(token);
+  }
+  return { argv: out, project };
+}
+function normalizeLeadingJson(argv) {
+  const rest = [...argv];
+  let sawJson = false;
+  while (rest[0] === "--json") {
+    sawJson = true;
+    rest.shift();
+  }
+  return sawJson ? [...rest, "--json"] : rest;
+}
+function buildProgram() {
+  const program = new Command();
+  program.name("ship-cli").enablePositionalOptions().exitOverride().configureOutput({
+    writeErr: (message) => {
+      if (!log.json) process.stderr.write(message);
+    }
+  }).option(
+    "--project <dir>",
+    "project directory (also accepted after subcommands)"
+  ).version(VERSION).description(
+    "Cross-platform game shipping CLI: package, validate and push builds (Steam, WeChat mini games). Never publishes to players on its own."
+  );
+  program.command("doctor").description(
+    "environment + config + credential preflight (offline, no network calls)"
+  ).option("--json", "print JSON report").action(async (options) => {
+    const report = await runDoctor(process.cwd());
+    printDoctor(report, options.json === true);
+  });
+  const config = program.command("config").description("ship.config.json management");
+  config.command("init").description(
+    "write a ship.config.json template (refuses to overwrite without --force)"
+  ).option("--force", "overwrite an existing file", false).option("--json", "print JSON result").action(async (options) => {
+    await runConfigInit(process.cwd(), options.force, options.json === true);
+  });
+  config.command("validate").description("load + schema + cross-field validation").option("--json", "print JSON result").action(async (options) => {
+    await runConfigValidate(process.cwd(), options.json === true);
+  });
+  config.command("show").description("print the normalized config").option("--json", "print JSON result").action(async (options) => {
+    await runConfigShow(process.cwd(), options.json === true);
+  });
+  registerSteamCommand(program);
+  registerWxCommand(program);
+  return program;
+}
+async function main(argv) {
+  log.json = argv.includes("--json");
+  const originalCwd = process.cwd();
+  try {
+    const { argv: withoutProject, project } = extractProjectArg(argv);
+    if (project !== void 0) {
+      const resolved = path11.resolve(project);
+      const fs3 = await import("fs/promises");
+      const stat = await fs3.stat(resolved).catch(() => void 0);
+      if (stat === void 0 || !stat.isDirectory()) {
+        throw new CliError(
+          "CFG_CONFIG_NOT_FOUND",
+          `--project is not a directory: ${resolved}`
+        );
+      }
+      process.chdir(resolved);
+    }
+    const program = buildProgram();
+    await program.parseAsync(normalizeLeadingJson(withoutProject), {
+      from: "user"
+    });
+    return 0;
+  } catch (err) {
+    if (err instanceof CommanderError && err.exitCode === 0) return 0;
+    throw err;
+  } finally {
+    process.chdir(originalCwd);
+  }
+}
+function cliErrorExit(err) {
+  if (log.json) {
+    const error = err instanceof CliError ? err : new CliError(
+      "CLI_ARGUMENT_INVALID",
+      err instanceof Error ? err.message : String(err)
+    );
+    log.result({
+      ok: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        details: error.details,
+        fix: error.suggestion,
+        docs: error.docs
+      }
+    });
+    return error.exitCode;
+  }
+  if (err instanceof CliError) {
+    log.error(`${err.code}: ${err.message}`);
+    if (err.suggestion !== void 0) log.error(`fix: ${err.suggestion}`);
+    if (err.docs !== void 0) log.error(`docs: ${err.docs}`);
+    if (err.details !== void 0) {
+      log.error(JSON.stringify(err.details, null, 2));
+    }
+    return err.exitCode || exitCodeFor(err.code);
+  }
+  log.error(err instanceof Error ? `${err.stack ?? err.message}` : String(err));
+  return 1;
+}
+var invokedDirect = process.argv[1] !== void 0 && fileURLToPath2(import.meta.url) === path11.resolve(process.argv[1]);
+if (invokedDirect) {
+  try {
+    process.exitCode = await main(process.argv.slice(2));
+  } catch (err) {
+    process.exitCode = cliErrorExit(err);
+  }
+}
+export {
+  CONFIG_FILE_NAME,
+  CliError,
+  DEFAULT_WX_LIMITS,
+  PACKAGE_NAME,
+  SUGGESTIONS,
+  VERSION,
+  analyzeSteamcmdOutput,
+  appBuildVdfName,
+  buildDriverScript,
+  buildLoginArgs,
+  buildProgram,
+  cliErrorExit,
+  depotBuildVdfName,
+  describeCredentialMode,
+  escapeVdfString,
+  findConfigFile,
+  findSteamcmd,
+  formatBytes,
+  generateSteamTotp,
+  loadConfig,
+  lookupOnPath,
+  main,
+  parseGameJson,
+  quoteVdf,
+  renderAppBuildVdf,
+  renderDepotBuildVdf,
+  resolveMiniprogramCi,
+  resolvePrivateKey,
+  resolveSteamCredentials,
+  runProcess,
+  runWxCi,
+  seedConfigVdf,
+  steamBuildsUrl,
+  suggest,
+  validateAgainstSchema,
+  validateWechatProject
+};