@mpgd/cli 0.28.1 → 0.30.0

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, type GameAcceptanceCommandResult, type GameAcceptanceCommandRunner, type GameAcceptanceReport, type GameAcceptanceStatus, type GameAcceptanceStep, type GameAcceptanceStepResult, type GameAcceptanceStepStatus, type RunGameAcceptanceInput, type RunGameAcceptanceResult, } from './game-acceptance.js';
 export { createBrowserGameplayE2EDriver, type BrowserGameplayE2EInspectInput, type BrowserGameplayE2EPage, type BrowserGameplayE2EScreenshotOptions, type BrowserGameplayE2EViewport, type CreateBrowserGameplayE2EDriverInput, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, type GameplayE2EAction, type GameplayE2EActionResult, type GameplayE2EDriver, type GameplayE2EHashLimits, type GameplayE2EInputAction, type GameplayE2EObservation, type GameplayE2EPauseResumeAction, type GameplayE2EPathEvidence, type GameplayE2EPlan, type GameplayE2EReport, type GameplayE2EResultStatus, type GameplayE2EState, type GameplayE2EStateResult, type GameplayE2EStatus, type RunGameplayE2EInput, type RunGameplayE2EResult, } from './gameplay-e2e.js';
+export { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, isSupportedHostedPwaProfile, verifyHostedPwaDeployment, type CloudflarePagesDeploymentProfile, type HostedPwaDeploymentHost, type HostedPwaDeploymentVerification, type VerifyHostedPwaDeploymentInput, } from './hosted-pwa-deployment.js';
 export { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, offlinePlaytestSchemaVersion, runOfflinePlaytestPackaging, type OfflinePlaytestEvidence, type RunOfflinePlaytestPackagingInput, type RunOfflinePlaytestPackagingResult, } from './offline-playtest.js';
 export { assertMicrosoftStorePwaCacheTransition, assertMicrosoftStorePwaPrecacheUrl, assertMicrosoftStorePwaReleaseEvidence, inspectMicrosoftStorePwaBrowserCacheTransition, microsoftStorePwaCacheSchema, readMicrosoftStorePwaBrowserReleaseEvidence, requestMicrosoftStorePwaBrowserUpdate, resolveMicrosoftStorePwaScopedCacheName, type AssertMicrosoftStorePwaCacheTransitionInput, type InspectMicrosoftStorePwaCacheTransitionInput, type MicrosoftStorePwaBrowserPage, type MicrosoftStorePwaCachedIndexObservation, type MicrosoftStorePwaCacheTransitionEvidence, type MicrosoftStorePwaCacheTransitionObservation, type MicrosoftStorePwaReleaseEvidence, } from './microsoft-store-pwa-e2e.js';
 export { createMicrosoftStorePackageAcceptanceRuntime, microsoftStorePackageAcceptanceSchemaVersion, parseMicrosoftStorePackageIdentity, parseWindowsAppCertificationResult, renderMicrosoftStorePackageAcceptanceMarkdown, runMicrosoftStorePackageAcceptance, type CreateMicrosoftStorePackageAcceptanceRuntimeInput, type MicrosoftStorePackageAcceptanceEvidence, type MicrosoftStorePackageAcceptanceRuntime, type MicrosoftStorePackageIdentity, type RunMicrosoftStorePackageAcceptanceInput, } from './microsoft-store-package-acceptance.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import completion from '@gunshi/plugin-completion';
@@ -7,8 +7,10 @@ import i18n, { defineI18n } from '@gunshi/plugin-i18n';
 import resources from '@gunshi/resources';
 import { cli } from 'gunshi';
 import { normalizeConfiguredBuildTargets, normalizeBuildTarget as normalizeConfiguredTargetName, supportedBuildTargets, } from './build-targets.js';
+import { escapeMarkdownInline as escapeEvidenceMarkdownInline, writeEvidenceReportFiles, } from './evidence-io.js';
 import { defaultGameAcceptanceCommandTimeoutMs, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, } from './game-acceptance.js';
 import { resolveGameplayE2EReportFile } from './gameplay-e2e.js';
+import { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, verifyHostedPwaDeployment, } from './hosted-pwa-deployment.js';
 import { createMicrosoftStorePackageAcceptanceRuntime, runMicrosoftStorePackageAcceptance, } from './microsoft-store-package-acceptance.js';
 import { runMicrosoftStorePackageGeneration } from './microsoft-store-package-generation.js';
 import { defaultMpgdKitPath, initializeMicrosoftStoreStarter, listMicrosoftStoreInitializerTemplateFiles, prepareBaseGameTemplateFile, resolveMicrosoftStoreAdapterDependencyVersion, } from './microsoft-store-starter.js';
@@ -18,6 +20,7 @@ import { targetConfigExtensionsFileEnv } from './target-config-env.js';
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, } from './game-acceptance.js';
 export { createBrowserGameplayE2EDriver, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, } from './gameplay-e2e.js';
+export { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, isSupportedHostedPwaProfile, verifyHostedPwaDeployment, } from './hosted-pwa-deployment.js';
 export { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, offlinePlaytestSchemaVersion, runOfflinePlaytestPackaging, } from './offline-playtest.js';
 export { assertMicrosoftStorePwaCacheTransition, assertMicrosoftStorePwaPrecacheUrl, assertMicrosoftStorePwaReleaseEvidence, inspectMicrosoftStorePwaBrowserCacheTransition, microsoftStorePwaCacheSchema, readMicrosoftStorePwaBrowserReleaseEvidence, requestMicrosoftStorePwaBrowserUpdate, resolveMicrosoftStorePwaScopedCacheName, } from './microsoft-store-pwa-e2e.js';
 export { createMicrosoftStorePackageAcceptanceRuntime, microsoftStorePackageAcceptanceSchemaVersion, parseMicrosoftStorePackageIdentity, parseWindowsAppCertificationResult, renderMicrosoftStorePackageAcceptanceMarkdown, runMicrosoftStorePackageAcceptance, } from './microsoft-store-package-acceptance.js';
@@ -140,6 +143,8 @@ const entryCommand = defineI18n({
         ko: 'mpgd-kit 스타터와 타깃 워크플로우를 관리합니다.',
     }),
     run: () => {
+        console.info('Use a sub-command: game, target, kit.');
+        console.info('Run "pnpm mpgd --help" for available commands.');
     },
 });
 const gameCommand = defineI18n({
@@ -475,6 +480,9 @@ const gameCommand = defineI18n({
                     outputDir,
                     maximumBytes,
                 });
+                console.info(`Offline playtest (test only): ${result.entryFile}`);
+                console.info(`Evidence: ${result.evidenceFile}`);
+                console.info('Not a release target, deployment artifact, PWA, or store-submission package.');
             },
         }),
         icons: defineI18n({
@@ -531,10 +539,12 @@ const gameCommand = defineI18n({
                 }),
             ])),
             run: () => {
+                console.info('Use "mpgd game icons generate <game>", verify, or inspect.');
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd game create <directory>", "mpgd game accept <game>", "mpgd game offline-playtest <game>", or "mpgd game icons generate <game>".');
     },
 });
 const defaultLegalDir = 'legal';
@@ -696,9 +706,12 @@ function acceptGame(input) {
             MPGD_GAMEPLAY_E2E_REPORT_FILE: gameplayE2EReportFile,
         },
     });
+    console.info(`[mpgd:accept] JSON report: ${result.jsonFile}`);
+    console.info(`[mpgd:accept] Markdown report: ${result.markdownFile}`);
     if (result.report.status === 'failed') {
         throw new Error(`Game acceptance failed. Report: ${result.markdownFile}`);
     }
+    console.info('[mpgd:accept] passed');
 }
 function assertGameAcceptanceRoot(gameRoot) {
     const resolved = path.resolve(gameRoot);
@@ -782,6 +795,7 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: false,
                 });
+                console.info(`Built legal site: ${result.outDir}`);
             },
         }),
         check: defineI18n({
@@ -797,10 +811,12 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: true,
                 });
+                console.info(`Legal site checked: ${result.outDir}`);
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd legal build" or "mpgd legal check".');
     },
 });
 const targetCommand = defineI18n({
@@ -870,9 +886,10 @@ const targetCommand = defineI18n({
                 const resolvedKitPath = configuredKitPath === undefined
                     ? detectedKitRoot
                     : assertKitRoot(path.resolve(configuredKitPath));
+                const canonicalGameRoot = existsSync(gameRoot) ? realpathSync(gameRoot) : gameRoot;
                 const defaultKitPath = resolvedKitPath === undefined
                     ? defaultMpgdKitPath
-                    : toTemplatePath(path.relative(gameRoot, resolvedKitPath) || '.');
+                    : toTemplatePath(path.relative(canonicalGameRoot, resolvedKitPath) || '.');
                 const dryRun = ctx.values['dry-run'] === true;
                 const adapterDependencyVersion = resolveMicrosoftStoreAdapterDependencyVersion(requireMpgdDependencyVersion(resolveMpgdDependencyVersionReplacements({
                     workspace: false,
@@ -885,7 +902,9 @@ const targetCommand = defineI18n({
                     adapterDependencyVersion,
                     dryRun,
                 });
+                console.info(`${dryRun ? 'Would update' : 'Updated'} Microsoft Store starter workflow: ${result.changedFiles.length} file(s).`);
                 for (const file of result.changedFiles) {
+                    console.info(`- ${file}`);
                 }
             },
         }),
@@ -989,6 +1008,241 @@ const targetCommand = defineI18n({
                 });
             },
         }),
+        'verify-deployment': defineI18n({
+            name: 'verify-deployment',
+            description: 'Verify that a hosted deployment directory serves a verified PWA artifact unchanged.',
+            resource: commandResource({
+                en: 'Verify that a hosted deployment directory serves a verified PWA artifact unchanged.',
+                ko: '호스트 배포 디렉터리가 검증된 PWA 산출물을 변조 없이 서비스하는지 검증합니다.',
+            }, {
+                target: {
+                    en: 'Target that produced the source PWA artifact (microsoft-store).',
+                    ko: '원본 PWA 산출물을 생성한 타깃(microsoft-store).',
+                },
+                'deployment-root': {
+                    en: 'Host deployment directory to verify.',
+                    ko: '검증할 호스트 배포 디렉터리.',
+                },
+                'source-artifact-root': {
+                    en: 'Directory of the verified source PWA artifact.',
+                    ko: '검증된 원본 PWA 산출물 디렉터리.',
+                },
+                host: {
+                    en: `Hosting profile (${hostedPwaDeploymentHosts.join(', ')}).`,
+                    ko: `호스팅 프로필(${hostedPwaDeploymentHosts.join(', ')}).`,
+                },
+                profile: {
+                    en: `Host routing profile (${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                    ko: `호스트 라우팅 프로필(${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                },
+                'report-dir': {
+                    en: 'Directory for verification evidence files (defaults to the working directory).',
+                    ko: '검증 결과 파일을 기록할 디렉터리(기본값은 작업 디렉터리).',
+                },
+            }),
+            args: {
+                target: {
+                    type: 'positional',
+                    required: true,
+                    description: 'Target that produced the source PWA artifact (microsoft-store)',
+                },
+                'deployment-root': {
+                    type: 'string',
+                    required: true,
+                    description: 'Host deployment directory to verify.',
+                },
+                'source-artifact-root': {
+                    type: 'string',
+                    required: true,
+                    description: 'Directory of the verified source PWA artifact.',
+                },
+                host: {
+                    type: 'string',
+                    required: false,
+                    default: 'cloudflare-pages',
+                    description: `Hosting profile (${hostedPwaDeploymentHosts.join(', ')}).`,
+                },
+                profile: {
+                    type: 'string',
+                    required: false,
+                    default: 'api-only',
+                    description: `Host routing profile (${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                },
+                'report-dir': {
+                    type: 'string',
+                    required: false,
+                    description: 'Directory for verification evidence files (defaults to the working directory).',
+                },
+            },
+            run: (ctx) => {
+                const positionals = readLocalPositionals(ctx.positionals, [
+                    'target',
+                    'verify-deployment',
+                ]);
+                const target = normalizeConfiguredTargetName(readRequiredPositional(positionals, 0, 'target'));
+                if (target !== 'microsoft-store') {
+                    throw new Error(`Hosted deployment verification is not available for target: ${target}`);
+                }
+                const deploymentRoot = readRequiredCliOption(ctx.values['deployment-root'], '--deployment-root');
+                const sourceArtifactRoot = readRequiredCliOption(ctx.values['source-artifact-root'], '--source-artifact-root');
+                const host = readOptionalString(ctx.values.host) ?? 'cloudflare-pages';
+                const profile = readOptionalString(ctx.values.profile) ?? 'api-only';
+                if (!hostedPwaDeploymentHosts.includes(host)) {
+                    throw new Error(`Unsupported hosted PWA deployment host: ${host} `
+                        + `(supported: ${hostedPwaDeploymentHosts.join(', ')}).`);
+                }
+                if (!cloudflarePagesDeploymentProfiles.includes(profile)) {
+                    throw new Error(`Unsupported ${host} deployment profile: ${profile} `
+                        + `(supported: ${cloudflarePagesDeploymentProfiles.join(', ')}).`);
+                }
+                const reportDir = path.resolve(readOptionalString(ctx.values['report-dir']) ?? process.cwd());
+                assertReportDirectoryOutsideVerifiedTrees(reportDir, sourceArtifactRoot, deploymentRoot);
+                assertReportFilesSafeToWrite(reportDir);
+                const verification = verifyHostedPwaDeployment({
+                    sourceArtifactRoot,
+                    deploymentRoot,
+                    host: host,
+                    profile: profile,
+                });
+                mkdirSync(reportDir, { recursive: true });
+                writeEvidenceReportFiles({
+                    jsonFile: path.join(reportDir, 'hosted-pwa-verification.json'),
+                    markdownFile: path.join(reportDir, 'hosted-pwa-verification.md'),
+                    report: verification,
+                    markdown: renderHostedPwaVerificationMarkdown(verification),
+                });
+                console.info(`Hosted PWA deployment verified: ${verification.verifiedGameFileCount} game `
+                    + `file(s) from revision ${verification.revision} under the `
+                    + `${verification.host}/${verification.profile} profile `
+                    + `(routes: ${verification.workerRoutes.include.join(', ')}).`);
+            },
+        }),
+        'preview-versions': defineI18n({
+            name: 'preview-versions',
+            description: 'Preview candidate platform version numbers for a release ledger without reserving them.',
+            resource: commandResource({
+                en: 'Preview candidate platform version numbers for a release ledger without reserving them.',
+                ko: '릴리스 원장에 대한 플랫폼 버전 번호 후보를 예약 없이 미리 확인합니다.',
+            }, {
+                'ledger-file': {
+                    en: 'Path to the platform version ledger JSON file (read-only).',
+                    ko: '플랫폼 버전 원장 JSON 파일 경로(읽기 전용).',
+                },
+                'plan-file': {
+                    en: 'Optional prepared release plan JSON to revalidate and extend.',
+                    ko: '재검증하고 확장할 선택적 준비된 릴리스 계획 JSON.',
+                },
+                'game-id': {
+                    en: 'Game identifier used in the release buildId.',
+                    ko: '릴리스 buildId에 사용할 게임 식별자.',
+                },
+                'game-version': {
+                    en: 'Final game SemVer for the release.',
+                    ko: '릴리스의 최종 게임 SemVer.',
+                },
+                'source-git-sha': {
+                    en: 'Full 40-character Git SHA of the game source.',
+                    ko: '게임 소스의 전체 40자 Git SHA.',
+                },
+                'kit-git-sha': {
+                    en: 'Full 40-character Git SHA of the mpgd-kit checkout.',
+                    ko: 'mpgd-kit 체크아웃의 전체 40자 Git SHA.',
+                },
+                'target-config-digest': {
+                    en: '64-character SHA-256 digest of the game-owned target configuration.',
+                    ko: '게임 소유 타깃 설정의 64자 SHA-256 다이제스트.',
+                },
+                targets: {
+                    en: 'Comma-separated targets, optionally "name:hosted-content-only" for microsoft-store.',
+                    ko: '쉼표로 구분된 타깃. microsoft-store는 "name:hosted-content-only" 지정 가능.',
+                },
+                json: {
+                    en: 'Emit the candidate allocation as JSON.',
+                    ko: '후보 할당을 JSON으로 출력합니다.',
+                },
+                'kit-path': {
+                    en: 'Path to the mpgd-kit checkout.',
+                    ko: 'mpgd-kit 체크아웃 경로.',
+                },
+            }),
+            args: {
+                'ledger-file': {
+                    type: 'string',
+                    required: true,
+                    description: 'Path to the platform version ledger JSON file (read-only).',
+                },
+                'plan-file': {
+                    type: 'string',
+                    required: false,
+                    description: 'Optional prepared release plan JSON to revalidate and extend.',
+                },
+                'game-id': {
+                    type: 'string',
+                    required: true,
+                    description: 'Game identifier used in the release buildId.',
+                },
+                'game-version': {
+                    type: 'string',
+                    required: true,
+                    description: 'Final game SemVer for the release.',
+                },
+                'source-git-sha': {
+                    type: 'string',
+                    required: true,
+                    description: 'Full 40-character Git SHA of the game source.',
+                },
+                'kit-git-sha': {
+                    type: 'string',
+                    required: true,
+                    description: 'Full 40-character Git SHA of the mpgd-kit checkout.',
+                },
+                'target-config-digest': {
+                    type: 'string',
+                    required: true,
+                    description: '64-character SHA-256 digest of the game-owned target configuration.',
+                },
+                targets: {
+                    type: 'string',
+                    required: true,
+                    description: 'Comma-separated targets, optionally "name:hosted-content-only" for microsoft-store.',
+                },
+                json: {
+                    type: 'boolean',
+                    required: false,
+                    description: 'Emit the candidate allocation as JSON.',
+                },
+                'kit-path': {
+                    type: 'string',
+                    required: false,
+                    description: 'Path to the mpgd-kit checkout.',
+                },
+            },
+            run: (ctx) => {
+                const kitPath = resolveKitPathForTarget(ctx.values);
+                const planFile = readOptionalString(ctx.values['plan-file']);
+                const env = {
+                    ...process.env,
+                    MPGD_KIT_PATH: kitPath,
+                    MPGD_PREVIEW_LEDGER_FILE: path.resolve(readRequiredCliOption(ctx.values['ledger-file'], '--ledger-file')),
+                    MPGD_PREVIEW_GAME_ID: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
+                    MPGD_PREVIEW_GAME_VERSION: readRequiredCliOption(ctx.values['game-version'], '--game-version'),
+                    MPGD_PREVIEW_SOURCE_GIT_SHA: readRequiredCliOption(ctx.values['source-git-sha'], '--source-git-sha'),
+                    MPGD_PREVIEW_KIT_GIT_SHA: readRequiredCliOption(ctx.values['kit-git-sha'], '--kit-git-sha'),
+                    MPGD_PREVIEW_TARGET_CONFIG_DIGEST: readRequiredCliOption(ctx.values['target-config-digest'], '--target-config-digest'),
+                    MPGD_PREVIEW_TARGETS: readRequiredCliOption(ctx.values.targets, '--targets'),
+                    // Always define the optional toggles so ambient values from the
+                    // caller's environment cannot override absent flags.
+                    MPGD_PREVIEW_PLAN_FILE: planFile === undefined ? '' : path.resolve(planFile),
+                    MPGD_PREVIEW_JSON: ctx.values.json === true ? '1' : '',
+                };
+                if (ctx.values.json !== true) {
+                    console.info('[mpgd] target preview-versions (read-only candidates, not reservations)');
+                }
+                // --silent keeps pnpm's script echo out of stdout so the JSON document
+                // is machine-readable apart from the framework banner.
+                runPnpm(['--silent', 'preview:platform-versions'], env);
+            },
+        }),
         'generate-package': defineI18n({
             name: 'generate-package',
             description: 'Generate a packaged target artifact with an external platform service.',
@@ -1108,6 +1362,7 @@ const targetCommand = defineI18n({
                     jsonFile: path.join(outputDir, 'package-generation.json'),
                     markdownFile: path.join(outputDir, 'package-generation.md'),
                 });
+                console.info(`Microsoft Store package ZIP downloaded to ${evidence.archive.file}; package inspection remains required.`);
             },
         }),
         preflight: defineI18n({
@@ -1186,6 +1441,7 @@ const targetCommand = defineI18n({
                     jsonFile: path.join(outputDir, 'submission-preflight.json'),
                     markdownFile: path.join(outputDir, 'submission-preflight.md'),
                 });
+                console.info(`Microsoft Store submission preflight passed: ${Object.keys(evidence.listing.locales).length} listing locale(s), ${evidence.warnings.length} warning(s).`);
             },
         }),
         'accept-package': defineI18n({
@@ -1300,6 +1556,7 @@ const targetCommand = defineI18n({
                     ...(appCertExecutable === undefined ? {} : { appCertExecutable }),
                     ...(makeAppxExecutable === undefined ? {} : { makeAppxExecutable }),
                 }));
+                console.info(`Microsoft Store package acceptance passed: ${evidence.packages.length} package(s).`);
             },
         }),
         'build-all': defineI18n({
@@ -1400,6 +1657,7 @@ const targetCommand = defineI18n({
         }),
     },
     run: () => {
+        console.info('Use "mpgd target init <target>", "mpgd target build <target>", "mpgd target smoke <target>", "mpgd target generate-package <target>", "mpgd target preflight <target>", or "mpgd target accept-package <target> --packages <paths>".');
     },
 });
 const kitCommand = defineI18n({
@@ -1418,10 +1676,17 @@ const kitCommand = defineI18n({
                 ko: 'CLI, kit, template, target wrapper 상태를 출력합니다.',
             }),
             run: () => {
+                console.info(`cli package: ${packageRoot}`);
+                console.info(`mpgd-kit: ${detectedKitRoot ?? 'not detected'}`);
+                console.info(`cli template: ${existsSync(gameTemplateDir) ? 'ok' : 'missing'}`);
+                console.info(`mobile wrapper: ${kitFileStatus('apps/mobile-capacitor/package.json')}`);
+                console.info(`ait wrapper: ${kitFileStatus('apps/target-ait/package.json')}`);
+                console.info(`devvit wrapper: ${kitFileStatus('apps/target-devvit/package.json')}`);
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd kit doctor".');
     },
 });
 function commandResource(description, args = {}) {
@@ -1650,10 +1915,12 @@ function createGameApp(input) {
             : [{ ...file, content: renderTemplate(prepared, context) }];
     });
     if (input.dryRun) {
+        console.info(`Would create ${path.relative(process.cwd(), appDir) || appDir}:`);
         const plannedFiles = input.microsoftStore
             ? [...files.map((file) => file.relativePath), ...listMicrosoftStoreInitializerTemplateFiles()]
             : files.map((file) => file.relativePath);
         for (const relativePath of [...new Set(plannedFiles)].sort()) {
+            console.info(`- ${path.join(path.relative(process.cwd(), appDir), relativePath)}`);
         }
         return;
     }
@@ -1688,6 +1955,20 @@ function createGameApp(input) {
         }
         throw error;
     }
+    console.info(`Created ${appDir}`);
+    console.info('Next steps:');
+    console.info(`  cd ${appDir}`);
+    console.info('  pnpm install -w');
+    console.info('  pnpm dev');
+    console.info('Target builds require an mpgd-kit checkout:');
+    console.info([
+        '  mpgd target build-all',
+        `--targets-file ${path.join(appDir, 'mpgd.targets.json')}`,
+        `--targets ${context.recommendedMatrixTargets}`,
+        '--profile staging',
+        '--ait-variant wrapper',
+        '--kit-path <path-to-mpgd-kit>',
+    ].join(' '));
 }
 function assertValidGameName(name) {
     if (!/^[a-z][a-z0-9-]*$/.test(name)) {
@@ -2067,6 +2348,7 @@ function runTargetCommand(input) {
     const args = input.action === 'build'
         ? ['build:target', target, profile]
         : ['smoke:target', target];
+    console.info(`[mpgd] ${input.action} ${target}`);
     runPnpm(args, env);
 }
 function runTargetMatrix(input) {
@@ -2258,6 +2540,109 @@ function readLocalPositionals(positionals, commandPath) {
     }
     return positionals.slice(commandPath.length);
 }
+/** Reject existing evidence destinations that are links into verified trees. */
+function assertReportFilesSafeToWrite(reportDir) {
+    for (const name of ['hosted-pwa-verification.json', 'hosted-pwa-verification.md']) {
+        const destination = path.join(reportDir, name);
+        let stat;
+        try {
+            stat = lstatSync(destination);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`The report destination ${destination} is a symbolic link; refusing to follow `
+                + 'it because the report write must stay outside the verified trees.');
+        }
+        if (!stat.isFile()) {
+            throw new Error(`The report destination ${destination} is not a regular file; refusing to `
+                + 'write evidence through sockets, FIFOs, devices, or directories.');
+        }
+        if (stat.nlink > 1) {
+            throw new Error(`The report destination ${destination} has ${String(stat.nlink)} hard links; `
+                + 'refusing to write through a shared inode into the verified trees.');
+        }
+    }
+}
+function assertReportDirectoryOutsideVerifiedTrees(reportDir, sourceArtifactRoot, deploymentRoot) {
+    const canonicalReportDir = realpathThroughExistingAncestor(reportDir);
+    for (const [label, root] of [
+        ['source artifact', sourceArtifactRoot],
+        ['deployment', deploymentRoot],
+    ]) {
+        const resolvedRoot = realpathThroughExistingAncestor(root);
+        const distance = path.relative(resolvedRoot, canonicalReportDir);
+        if (distance === '' || (!distance.startsWith('..') && !path.isAbsolute(distance))) {
+            throw new Error(`The --report-dir must stay outside the verified ${label} directory; `
+                + `${reportDir} is inside ${resolvedRoot}, and writing evidence there would `
+                + 'mutate a read-only verification input.');
+        }
+    }
+}
+/** Canonicalize a possibly missing path through its nearest existing ancestor. */
+function realpathThroughExistingAncestor(candidate) {
+    let absolute = path.resolve(candidate);
+    while (true) {
+        try {
+            return realpathSync(absolute);
+        }
+        catch {
+            const parent = path.dirname(absolute);
+            if (parent === absolute) {
+                return absolute;
+            }
+            absolute = parent;
+        }
+    }
+}
+/** Markdown-escape a verification value, normalizing CR line endings first. */
+function escapeVerificationMarkdown(value) {
+    return escapeEvidenceMarkdownInline(value.replaceAll('\r\n', ' ').replaceAll('\r', ' '));
+}
+function renderHostedPwaVerificationMarkdown(verification) {
+    return [
+        '# Hosted PWA Deployment Verification',
+        '',
+        `- Host: ${escapeVerificationMarkdown(verification.host)} (${escapeVerificationMarkdown(verification.profile)} profile)`,
+        `- Source artifact: ${escapeVerificationMarkdown(verification.sourceArtifactRoot)}`,
+        `- Deployment: ${escapeVerificationMarkdown(verification.deploymentRoot)}`,
+        '- Release: '
+            + `${escapeVerificationMarkdown(verification.appVersion)} (build `
+            + `${escapeVerificationMarkdown(verification.buildId)}, revision `
+            + `${escapeVerificationMarkdown(verification.revision)})`,
+        `- Verified game files: ${verification.verifiedGameFileCount}`,
+        `- Recognized host files: ${verification.hostFileCount}`,
+        `- Worker routes (include): ${escapeVerificationMarkdown(verification.workerRoutes.include.join(', '))}`,
+        '',
+        '## Verified',
+        '',
+        '- Every source artifact file is present in the deployment with an identical sha256 digest.',
+        '- The source artifact release evidence revision recomputes from its own files.',
+        '- All local index.html references resolve inside the deployment.',
+        '- The `_routes.json` worker routing matches the reviewed profile exactly.',
+        '- Cache-Control policies are explicit for every asset URL: immutable',
+        '  (content-hashed pipelines) or revalidation (stable names) both satisfy',
+        '  the contract; missing or conflicting policies fail. The service worker',
+        '  and stable-name icons use no-store; the index, manifest, release',
+        '  evidence, and legal pages use revalidation.',
+        '- No redirect moves the PWA entry point or PWA-critical files.',
+        '',
+        '## Not verified',
+        '',
+        '- The Pages worker runtime behavior; exercise it with the host preview',
+        '  (for example `wrangler pages dev`) before deploying.',
+        '- CDN or account-level cache settings outside the deployment directory.',
+        '',
+    ].join('\n');
+}
+function readRequiredCliOption(value, label) {
+    const read = readOptionalString(value);
+    if (read === undefined) {
+        throw new Error(`${label} is required.`);
+    }
+    return read;
+}
 function readOptionalString(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }

package/dist/microsoft-store-package-acceptance.js

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { closeSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { closeSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { escapeMarkdownInline, escapeMarkdownTable, formatError, relativeOrAbsolute, } from './evidence-io.js';
@@ -85,10 +85,10 @@ export function runMicrosoftStorePackageAcceptance(input, runtime = createMicros
         ...packageFiles.map((file) => ({ file, label: 'Microsoft Store package' })),
     ]);
     for (const reportFile of reportFiles) {
-        rmSync(reportFile, { force: true });
+        removeEvidenceFile(reportFile);
     }
-    rmSync(jsonFile, { force: true });
-    rmSync(markdownFile, { force: true });
+    removeEvidenceFile(jsonFile);
+    removeEvidenceFile(markdownFile);
     const tempRoot = mkdtempSync(path.join(tmpdir(), 'mpgd-microsoft-store-package-'));
     try {
         const packages = packageFiles.map((packageFile, index) => {
@@ -136,10 +136,10 @@ export function runMicrosoftStorePackageAcceptance(input, runtime = createMicros
             writeFileSync(markdownFile, renderMicrosoftStorePackageAcceptanceMarkdown(evidence));
         }
         catch (error) {
-            rmSync(jsonFile, { force: true });
-            rmSync(markdownFile, { force: true });
+            removeEvidenceFile(jsonFile);
+            removeEvidenceFile(markdownFile);
             for (const reportFile of reportFiles) {
-                rmSync(reportFile, { force: true });
+                removeEvidenceFile(reportFile);
             }
             throw error;
         }
@@ -170,7 +170,7 @@ function runOptionalWindowsAppCertification(input) {
     if (reportFile === undefined) {
         throw new Error('Windows App Certification Kit report path was not prepared.');
     }
-    rmSync(reportFile, { force: true });
+    removeEvidenceFile(reportFile);
     input.runtime.runCommand(appCertExecutable, ['reset']);
     input.runtime.runCommand(appCertExecutable, [
         'test',
@@ -714,6 +714,17 @@ function sameFile(left, right) {
         return false;
     }
 }
+/** Remove only the file or link, never traverse a replacement directory link. */
+function removeEvidenceFile(file) {
+    try {
+        unlinkSync(file);
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            throw error;
+        }
+    }
+}
 function isMissingFileError(error) {
     if (typeof error !== 'object' || error === null) {
         return false;