@mpgd/cli 0.29.0 → 0.30.1

package/dist/hosted-pwa-deployment.js

@@ -375,6 +375,8 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
     const references = [...cssReferences];
     const metaRefreshContents = [];
     const embeddedDocuments = [];
+    const stylesheetHrefs = new Set();
+    const activeStylesheets = new Set();
     // Attributes only exist on start tags; scanning raw text would treat prose
     // like `Set href="..."` as a reference. Extract within element start tags,
     // with object data URLs and srcset candidates handled per tag.
@@ -385,18 +387,31 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
         const resourceNames = tagName === 'object'
             ? ['href', 'src', 'poster', 'data']
             : ['href', 'src', 'poster', 'xlink:href'];
-        // Tokenize real attribute name/value pairs first so quoted values of
-        // unrelated attributes (title='See href="..."') never leak references.
+        // Tokenize real attribute name/value pairs exactly once so every
+        // attribute-driven check (resource names, srcset, style, srcdoc, meta)
+        // shares one parse. Quoted values of unrelated attributes
+        // (title='See srcset="./missing.png"') can never leak references, and
+        // duplicate attributes keep their first occurrence like HTML parsing.
+        const seenAttributeNames = new Set();
+        const attributePairs = [];
+        for (const attribute of attributes.matchAll(/([A-Za-z_:][-A-Za-z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gu)) {
+            const name = (attribute[1] ?? '').toLowerCase();
+            if (seenAttributeNames.has(name)) {
+                continue;
+            }
+            seenAttributeNames.add(name);
+            attributePairs.push({ name, value: attribute[2] ?? attribute[3] ?? attribute[4] ?? '' });
+        }
+        // An iframe srcdoc overrides src even when its value is empty.
+        const attributesHasSrcdoc = tagName === 'iframe'
+            && attributePairs.some(({ name }) => name === 'srcdoc');
         let isMetaRefresh = false;
         let metaContent;
         let styleValue;
-        // Detect srcdoc before iterating resource attributes so an iframe src
-        // appearing before its srcdoc is already known to be overridden.
-        const attributesHasSrcdoc = tagName === 'iframe'
-            && /(?:^|\s)srcdoc\s*=\s*(?:"[^"]+"|'[^']+'|[^\s>]+)/iu.test(attributes);
-        for (const attribute of attributes.matchAll(/([A-Za-z_:][-A-Za-z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gu)) {
-            const name = (attribute[1] ?? '').toLowerCase();
-            const value = attribute[2] ?? attribute[3] ?? attribute[4] ?? '';
+        let srcsetValue;
+        let linkRel;
+        let linkHref;
+        for (const { name, value } of attributePairs) {
             if (tagName === 'meta' && name === 'http-equiv' && value.trim().toLowerCase() === 'refresh') {
                 isMetaRefresh = true;
             }
@@ -406,7 +421,16 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
             if (name === 'style') {
                 styleValue = value;
             }
-            if (!resourceNames.includes(name) && name !== 'srcset' && name !== 'srcdoc') {
+            if (name === 'srcset') {
+                srcsetValue = value;
+            }
+            if (tagName === 'link' && name === 'rel') {
+                linkRel = value.trim().toLowerCase();
+            }
+            if (tagName === 'link' && name === 'href') {
+                linkHref = value;
+            }
+            if (!resourceNames.includes(name) && name !== 'srcdoc') {
                 continue;
             }
             if (name === 'srcdoc' && value.length > 0) {
@@ -415,49 +439,30 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
                 embeddedDocuments.push(decodeHtmlReferences(value));
                 continue;
             }
-            if (name !== 'srcset' && value.length > 0) {
+            if (value.length > 0) {
                 if (tagName === 'iframe' && name === 'src' && attributesHasSrcdoc) {
                     continue;
                 }
                 references.push(value);
             }
         }
+        // Remember stylesheet links by their raw href so only files the browser
+        // actually applies as CSS join the stylesheet scan; a plain anchor to a
+        // .css file is just a downloadable reference. rel/href order-agnostic.
+        if (tagName === 'link' && linkHref !== undefined && isStylesheetRel(linkRel)) {
+            stylesheetHrefs.add(linkHref);
+        }
         if (isMetaRefresh && metaContent !== undefined) {
             metaRefreshContents.push(metaContent);
         }
         if (styleValue !== undefined) {
             collectInlineCssReferences(decodeHtmlReferences(styleValue), references);
         }
-        if (!/(?:^|\s)srcset\s*=/iu.test(attributes)) {
+        if (srcsetValue === undefined) {
             continue;
         }
-        const srcset = attributes.match(/(?:^|\s)srcset\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s>]+))/iu);
-        const rawCandidates = srcset?.[1] ?? srcset?.[2] ?? srcset?.[3] ?? '';
-        const candidates = decodeHtmlReferences(rawCandidates);
-        // WHATWG srcset tokenizing: whitespace-split tokens alternate between a
-        // candidate URL and its descriptors; a numeric single-token value like
-        // srcset="404" stays a URL, while densities after a URL are skipped.
-        let holdingUrl = false;
-        for (const token of candidates.split(/\s+/u)) {
-            for (const piece of token.split(/(?<=\d[xw]),/u)) {
-                const trimmed = piece.replace(/^[,]+|[,]+$/gu, '');
-                if (trimmed.length === 0) {
-                    continue;
-                }
-                const isDescriptor = /^[\d.]+[wx]?$/u.test(trimmed);
-                if (holdingUrl && isDescriptor) {
-                    continue;
-                }
-                references.push(trimmed);
-                // A trailing comma on a URL token ends the candidate, so the next
-                // token starts fresh rather than being read as a descriptor.
-                const endedCandidate = /,$/u.test(piece);
-                holdingUrl = !isDescriptor && !endedCandidate;
-            }
-            if (/^[\d.]+[wx],?$/u.test(token)) {
-                holdingUrl = false;
-            }
-        }
+        // Shared WHATWG srcset tokenizer (also used by the legal-page pass).
+        pushSrcsetCandidates(decodeHtmlReferences(srcsetValue), references);
     }
     // Embedded srcdoc documents resolve their resources against this
     // deployment; scan them with the full tokenizer (resource attributes,
@@ -474,48 +479,6 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
             references.push(target[1] ?? target[2] ?? target[3] ?? '');
         }
     }
-    // Referenced local stylesheets carry their own url()/@import targets;
-    // resolve them relative to each stylesheet's directory.
-    const stylesheetReferences = [];
-    for (const reference of [...referenced]) {
-        if (!reference.endsWith('.css') || !deploymentPaths.has(reference)) {
-            continue;
-        }
-        const cssContent = readFileSync(join(deploymentRoot, reference), 'utf8');
-        const cssDir = reference.includes('/')
-            ? `./${reference.slice(0, reference.lastIndexOf('/'))}`
-            : '.';
-        for (const cssUrl of cssContent.matchAll(/url\(\s*(['"]?)([^'")]+)\1\s*\)/giu)) {
-            const raw = (cssUrl[2] ?? '').trim();
-            if (raw.length === 0 || raw.startsWith('data:') || raw.startsWith('#')) {
-                continue;
-            }
-            const scheme = /^([a-z][a-z0-9+.-]*):/iu.exec(raw);
-            if (scheme !== null && scheme[1] !== undefined && scheme[1].toLowerCase() !== 'https' && scheme[1].toLowerCase() !== 'http') {
-                continue;
-            }
-            const schemeText = scheme?.[1] ?? '';
-            let cssPath = scheme !== null ? raw.slice(schemeText.length + 1) : raw;
-            if (cssPath.startsWith('//')) {
-                continue;
-            }
-            cssPath = cssPath.split('?')[0]?.split('#')[0] ?? cssPath;
-            const cssTarget = cssPath.startsWith('/') ? cssPath.slice(1) : `${cssDir}/${cssPath}`;
-            const resolved = posix.normalize(cssTarget);
-            if (!resolved.startsWith('../')) {
-                stylesheetReferences.push(resolved);
-            }
-        }
-        for (const importMatch of cssContent.matchAll(/@import\s+(['"])([^'"]+)\1/giu)) {
-            const raw = (importMatch[2] ?? '').trim();
-            if (raw.length > 0 && !raw.startsWith('/') && !raw.startsWith('data:')) {
-                stylesheetReferences.push(posix.normalize(`${cssDir}/${raw.split('?')[0] ?? raw}`));
-            }
-        }
-    }
-    for (const stylesheetReference of stylesheetReferences) {
-        referenced.add(stylesheetReference);
-    }
     for (const rawReference of references) {
         const reference = decodeHtmlReferences(rawReference).trim();
         const schemeSeparated = /^([a-z][a-z0-9+.-]*):/iu.exec(reference);
@@ -542,9 +505,6 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
                 continue;
             }
         }
-        if (process.env.MPGD_DEBUG_SRCDOC === '1') {
-            console.error('DEBUG-REF', JSON.stringify(reference.slice(0, 60)), '->', JSON.stringify(effectiveReference.slice(0, 60)));
-        }
         const withoutQuery = effectiveReference.split(/[?#]/u)[0] ?? effectiveReference;
         if (withoutQuery.length === 0) {
             continue;
@@ -576,8 +536,84 @@ function verifyIndexReferences(deploymentRoot, deploymentFiles) {
         if (normalized === '.' || normalized.endsWith('/')) {
             normalized = `${normalized === '.' ? '' : normalized}index.html`;
         }
+        if (stylesheetHrefs.has(rawReference)) {
+            activeStylesheets.add(normalized);
+        }
         referenced.add(normalized);
     }
+    // Stylesheet links (and the @import chain they start) carry their own
+    // url()/@import targets, resolved relative to each stylesheet's directory.
+    // Comments are stripped first, external URLs are skipped, root-relative
+    // targets resolve from the deployment root, percent-encoded segments
+    // decode, escaping targets are rejected, and chained imports follow with a
+    // visited set so circular imports cannot loop forever.
+    const visitedStylesheets = new Set();
+    const stylesheetQueue = [...activeStylesheets];
+    while (stylesheetQueue.length > 0) {
+        const stylesheet = stylesheetQueue.shift();
+        if (stylesheet === undefined || visitedStylesheets.has(stylesheet)) {
+            continue;
+        }
+        visitedStylesheets.add(stylesheet);
+        const { cssUrls, cssImports } = extractStylesheetTargets(readFileSync(join(deploymentRoot, stylesheet), 'utf8'));
+        const cssDir = stylesheet.includes('/')
+            ? `./${stylesheet.slice(0, stylesheet.lastIndexOf('/'))}`
+            : '.';
+        const resolvedUrls = [];
+        const resolvedImports = [];
+        const collectCssTarget = (rawTarget, sink) => {
+            const raw = decodeCssEscapes(rawTarget.trim());
+            if (raw.length === 0 || raw.startsWith('data:') || raw.startsWith('#')) {
+                return;
+            }
+            const scheme = /^([a-z][a-z0-9+.-]*):/iu.exec(raw);
+            if (scheme !== null
+                && scheme[1] !== undefined
+                && scheme[1].toLowerCase() !== 'https'
+                && scheme[1].toLowerCase() !== 'http') {
+                return;
+            }
+            const schemeText = scheme?.[1] ?? '';
+            let cssPath = scheme !== null ? raw.slice(schemeText.length + 1) : raw;
+            // Cross-scheme authority URLs (https://host/x, http:/host/x) are
+            // external; only same-scheme relative forms like https:./file.png
+            // resolve against the deployment.
+            if (scheme !== null && cssPath.startsWith('/')) {
+                return;
+            }
+            // Scheme-relative URLs without a scheme token (//host/x) are external.
+            if (scheme === null && cssPath.startsWith('//')) {
+                return;
+            }
+            cssPath = cssPath.split('?')[0]?.split('#')[0] ?? cssPath;
+            const cssTarget = cssPath.startsWith('/') ? cssPath.slice(1) : `${cssDir}/${cssPath}`;
+            const resolved = posix.normalize(cssTarget);
+            if (resolved.startsWith('../') || resolved === '..' || posix.isAbsolute(resolved)) {
+                throw new Error(`The stylesheet ${stylesheet} references a path outside the artifact root: ${raw}`);
+            }
+            sink.push(decodeReferenceSegments(resolved, `stylesheet ${stylesheet}`));
+        };
+        for (const cssUrl of cssUrls) {
+            collectCssTarget(cssUrl, resolvedUrls);
+        }
+        for (const cssImport of cssImports) {
+            collectCssTarget(cssImport, resolvedImports);
+        }
+        for (const resolvedUrl of resolvedUrls) {
+            referenced.add(resolvedUrl);
+        }
+        for (const resolvedImport of resolvedImports) {
+            referenced.add(resolvedImport);
+            // Imports are stylesheets by syntax whatever their URL looks like, and
+            // deduplication against earlier references must not suppress
+            // traversal: the browser still applies the imported file as CSS.
+            if (deploymentPaths.has(resolvedImport)
+                && !visitedStylesheets.has(resolvedImport)
+                && !stylesheetQueue.includes(resolvedImport)) {
+                stylesheetQueue.push(resolvedImport);
+            }
+        }
+    }
     for (const reference of [...referenced].sort()) {
         if (pagesControlArtifactNames.has(reference)) {
             throw new Error(`The deployment index.html references the Pages control file ${reference}; `
@@ -806,6 +842,147 @@ function collectEmbeddedDocumentReferences(document, references) {
     }
 }
 /** Tokenize srcset candidates into the reference list. */
+/** Whether a link rel token list applies the target as a stylesheet. */
+function isStylesheetRel(rel) {
+    return rel !== undefined && rel.split(/\s+/u).includes('stylesheet');
+}
+/**
+ * Extract live url() targets and @import targets from a stylesheet with a
+ * small string-aware tokenizer:
+ *
+ * - comments are skipped;
+ * - url()/@import text inside quoted strings is inert content, so a
+ *   `content: "url(./missing.png)"` rule never becomes a reference;
+ * - @import is honored only before the first top-level style block, because
+ *   CSS parsing makes later imports inert;
+ * - @import supports both quoted-string and url() forms.
+ */
+function extractStylesheetTargets(css) {
+    const cssUrls = [];
+    const cssImports = [];
+    let index = 0;
+    let sawTopLevelBlock = false;
+    const skipString = () => {
+        const quote = css[index] ?? '';
+        index += 1;
+        while (index < css.length) {
+            const inner = css[index] ?? '';
+            index += 1;
+            if (inner === '\\') {
+                index += 1;
+                continue;
+            }
+            if (inner === quote) {
+                return;
+            }
+        }
+    };
+    while (index < css.length) {
+        const char = css[index] ?? '';
+        if (char === '"' || char === "'") {
+            skipString();
+            continue;
+        }
+        if (char === '/' && (css[index + 1] ?? '') === '*') {
+            const end = css.indexOf('*/', index + 2);
+            index = end === -1 ? css.length : end + 2;
+            continue;
+        }
+        if (char === '{') {
+            sawTopLevelBlock = true;
+            index += 1;
+            continue;
+        }
+        const rest = css.slice(index);
+        const urlMatch = /^url\(/iu.exec(rest);
+        if (urlMatch !== null) {
+            index += urlMatch[0].length;
+            let quote = '';
+            let argument = '';
+            while (index < css.length) {
+                const inner = css[index] ?? '';
+                if (quote === '' && (inner === '"' || inner === "'")) {
+                    quote = inner;
+                    index += 1;
+                    continue;
+                }
+                if (quote !== '' && inner === quote) {
+                    quote = '';
+                    index += 1;
+                    continue;
+                }
+                if (quote !== '' && inner === '\\') {
+                    argument += inner + (css[index + 1] ?? '');
+                    index += 2;
+                    continue;
+                }
+                if (quote === '' && inner === ')') {
+                    index += 1;
+                    break;
+                }
+                argument += inner;
+                index += 1;
+            }
+            cssUrls.push(argument.trim());
+            continue;
+        }
+        const importMatch = !sawTopLevelBlock ? /^@import\b/iu.exec(rest) : null;
+        if (importMatch !== null) {
+            index += importMatch[0].length;
+            let captured = '';
+            while (index < css.length) {
+                const inner = css[index] ?? '';
+                if (inner === ';') {
+                    index += 1;
+                    break;
+                }
+                captured += inner;
+                index += 1;
+            }
+            const trimmed = captured.trim();
+            const quotedForm = /^(['"])([\s\S]*)\1$/u.exec(trimmed);
+            if (quotedForm !== null) {
+                cssImports.push((quotedForm[2] ?? '').trim());
+            }
+            else {
+                const urlForm = /^url\(\s*(['"]?)([^'")]*)\1\s*\)$/iu.exec(trimmed);
+                if (urlForm !== null) {
+                    cssImports.push((urlForm[2] ?? '').trim());
+                }
+            }
+            continue;
+        }
+        index += 1;
+    }
+    return { cssUrls, cssImports };
+}
+/** Decode CSS string escapes (backslash-character and hex forms) like browsers do. */
+function decodeCssEscapes(value) {
+    if (!value.includes('\\')) {
+        return value;
+    }
+    return value.replace(/\\(?:([0-9a-fA-F]{1,6})\s?|(.))/gu, (_match, hex, plain) => {
+        if (hex === undefined) {
+            return plain ?? '';
+        }
+        const codePoint = Number.parseInt(hex, 16);
+        return codePoint > 1114111 || Number.isNaN(codePoint)
+            ? '\uFFFD'
+            : String.fromCodePoint(codePoint);
+    });
+}
+/** Percent-decode each path segment, mirroring the HTML reference handling. */
+function decodeReferenceSegments(path, label) {
+    try {
+        return path
+            .split('/')
+            .map((segment) => decodeURIComponent(segment))
+            .join('/');
+    }
+    catch {
+        throw new Error(`${label} references a malformed percent-encoded URL: ${path}`);
+    }
+}
 function pushSrcsetCandidates(candidates, references) {
     let holdingUrl = false;
     for (const token of candidates.split(/\s+/u)) {

package/dist/index.js

@@ -143,6 +143,8 @@ const entryCommand = defineI18n({
         ko: 'mpgd-kit 스타터와 타깃 워크플로우를 관리합니다.',
     }),
     run: () => {
+        console.info('Use a sub-command: game, target, kit.');
+        console.info('Run "pnpm mpgd --help" for available commands.');
     },
 });
 const gameCommand = defineI18n({
@@ -478,6 +480,9 @@ const gameCommand = defineI18n({
                     outputDir,
                     maximumBytes,
                 });
+                console.info(`Offline playtest (test only): ${result.entryFile}`);
+                console.info(`Evidence: ${result.evidenceFile}`);
+                console.info('Not a release target, deployment artifact, PWA, or store-submission package.');
             },
         }),
         icons: defineI18n({
@@ -534,10 +539,12 @@ const gameCommand = defineI18n({
                 }),
             ])),
             run: () => {
+                console.info('Use "mpgd game icons generate <game>", verify, or inspect.');
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd game create <directory>", "mpgd game accept <game>", "mpgd game offline-playtest <game>", or "mpgd game icons generate <game>".');
     },
 });
 const defaultLegalDir = 'legal';
@@ -699,9 +706,12 @@ function acceptGame(input) {
             MPGD_GAMEPLAY_E2E_REPORT_FILE: gameplayE2EReportFile,
         },
     });
+    console.info(`[mpgd:accept] JSON report: ${result.jsonFile}`);
+    console.info(`[mpgd:accept] Markdown report: ${result.markdownFile}`);
     if (result.report.status === 'failed') {
         throw new Error(`Game acceptance failed. Report: ${result.markdownFile}`);
     }
+    console.info('[mpgd:accept] passed');
 }
 function assertGameAcceptanceRoot(gameRoot) {
     const resolved = path.resolve(gameRoot);
@@ -785,6 +795,7 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: false,
                 });
+                console.info(`Built legal site: ${result.outDir}`);
             },
         }),
         check: defineI18n({
@@ -800,10 +811,12 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: true,
                 });
+                console.info(`Legal site checked: ${result.outDir}`);
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd legal build" or "mpgd legal check".');
     },
 });
 const targetCommand = defineI18n({
@@ -873,9 +886,10 @@ const targetCommand = defineI18n({
                 const resolvedKitPath = configuredKitPath === undefined
                     ? detectedKitRoot
                     : assertKitRoot(path.resolve(configuredKitPath));
+                const canonicalGameRoot = existsSync(gameRoot) ? realpathSync(gameRoot) : gameRoot;
                 const defaultKitPath = resolvedKitPath === undefined
                     ? defaultMpgdKitPath
-                    : toTemplatePath(path.relative(gameRoot, resolvedKitPath) || '.');
+                    : toTemplatePath(path.relative(canonicalGameRoot, resolvedKitPath) || '.');
                 const dryRun = ctx.values['dry-run'] === true;
                 const adapterDependencyVersion = resolveMicrosoftStoreAdapterDependencyVersion(requireMpgdDependencyVersion(resolveMpgdDependencyVersionReplacements({
                     workspace: false,
@@ -888,7 +902,9 @@ const targetCommand = defineI18n({
                     adapterDependencyVersion,
                     dryRun,
                 });
+                console.info(`${dryRun ? 'Would update' : 'Updated'} Microsoft Store starter workflow: ${result.changedFiles.length} file(s).`);
                 for (const file of result.changedFiles) {
+                    console.info(`- ${file}`);
                 }
             },
         }),
@@ -1095,6 +1111,136 @@ const targetCommand = defineI18n({
                     report: verification,
                     markdown: renderHostedPwaVerificationMarkdown(verification),
                 });
+                console.info(`Hosted PWA deployment verified: ${verification.verifiedGameFileCount} game `
+                    + `file(s) from revision ${verification.revision} under the `
+                    + `${verification.host}/${verification.profile} profile `
+                    + `(routes: ${verification.workerRoutes.include.join(', ')}).`);
+            },
+        }),
+        'preview-versions': defineI18n({
+            name: 'preview-versions',
+            description: 'Preview candidate platform version numbers for a release ledger without reserving them.',
+            resource: commandResource({
+                en: 'Preview candidate platform version numbers for a release ledger without reserving them.',
+                ko: '릴리스 원장에 대한 플랫폼 버전 번호 후보를 예약 없이 미리 확인합니다.',
+            }, {
+                'ledger-file': {
+                    en: 'Path to the platform version ledger JSON file (read-only).',
+                    ko: '플랫폼 버전 원장 JSON 파일 경로(읽기 전용).',
+                },
+                'plan-file': {
+                    en: 'Optional prepared release plan JSON to revalidate and extend.',
+                    ko: '재검증하고 확장할 선택적 준비된 릴리스 계획 JSON.',
+                },
+                'game-id': {
+                    en: 'Game identifier used in the release buildId.',
+                    ko: '릴리스 buildId에 사용할 게임 식별자.',
+                },
+                'game-version': {
+                    en: 'Final game SemVer for the release.',
+                    ko: '릴리스의 최종 게임 SemVer.',
+                },
+                'source-git-sha': {
+                    en: 'Full 40-character Git SHA of the game source.',
+                    ko: '게임 소스의 전체 40자 Git SHA.',
+                },
+                'kit-git-sha': {
+                    en: 'Full 40-character Git SHA of the mpgd-kit checkout.',
+                    ko: 'mpgd-kit 체크아웃의 전체 40자 Git SHA.',
+                },
+                'target-config-digest': {
+                    en: '64-character SHA-256 digest of the game-owned target configuration.',
+                    ko: '게임 소유 타깃 설정의 64자 SHA-256 다이제스트.',
+                },
+                targets: {
+                    en: 'Comma-separated targets, optionally "name:hosted-content-only" for microsoft-store.',
+                    ko: '쉼표로 구분된 타깃. microsoft-store는 "name:hosted-content-only" 지정 가능.',
+                },
+                json: {
+                    en: 'Emit the candidate allocation as JSON.',
+                    ko: '후보 할당을 JSON으로 출력합니다.',
+                },
+                'kit-path': {
+                    en: 'Path to the mpgd-kit checkout.',
+                    ko: 'mpgd-kit 체크아웃 경로.',
+                },
+            }),
+            args: {
+                'ledger-file': {
+                    type: 'string',
+                    required: true,
+                    description: 'Path to the platform version ledger JSON file (read-only).',
+                },
+                'plan-file': {
+                    type: 'string',
+                    required: false,
+                    description: 'Optional prepared release plan JSON to revalidate and extend.',
+                },
+                'game-id': {
+                    type: 'string',
+                    required: true,
+                    description: 'Game identifier used in the release buildId.',
+                },
+                'game-version': {
+                    type: 'string',
+                    required: true,
+                    description: 'Final game SemVer for the release.',
+                },
+                'source-git-sha': {
+                    type: 'string',
+                    required: true,
+                    description: 'Full 40-character Git SHA of the game source.',
+                },
+                'kit-git-sha': {
+                    type: 'string',
+                    required: true,
+                    description: 'Full 40-character Git SHA of the mpgd-kit checkout.',
+                },
+                'target-config-digest': {
+                    type: 'string',
+                    required: true,
+                    description: '64-character SHA-256 digest of the game-owned target configuration.',
+                },
+                targets: {
+                    type: 'string',
+                    required: true,
+                    description: 'Comma-separated targets, optionally "name:hosted-content-only" for microsoft-store.',
+                },
+                json: {
+                    type: 'boolean',
+                    required: false,
+                    description: 'Emit the candidate allocation as JSON.',
+                },
+                'kit-path': {
+                    type: 'string',
+                    required: false,
+                    description: 'Path to the mpgd-kit checkout.',
+                },
+            },
+            run: (ctx) => {
+                const kitPath = resolveKitPathForTarget(ctx.values);
+                const planFile = readOptionalString(ctx.values['plan-file']);
+                const env = {
+                    ...process.env,
+                    MPGD_KIT_PATH: kitPath,
+                    MPGD_PREVIEW_LEDGER_FILE: path.resolve(readRequiredCliOption(ctx.values['ledger-file'], '--ledger-file')),
+                    MPGD_PREVIEW_GAME_ID: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
+                    MPGD_PREVIEW_GAME_VERSION: readRequiredCliOption(ctx.values['game-version'], '--game-version'),
+                    MPGD_PREVIEW_SOURCE_GIT_SHA: readRequiredCliOption(ctx.values['source-git-sha'], '--source-git-sha'),
+                    MPGD_PREVIEW_KIT_GIT_SHA: readRequiredCliOption(ctx.values['kit-git-sha'], '--kit-git-sha'),
+                    MPGD_PREVIEW_TARGET_CONFIG_DIGEST: readRequiredCliOption(ctx.values['target-config-digest'], '--target-config-digest'),
+                    MPGD_PREVIEW_TARGETS: readRequiredCliOption(ctx.values.targets, '--targets'),
+                    // Always define the optional toggles so ambient values from the
+                    // caller's environment cannot override absent flags.
+                    MPGD_PREVIEW_PLAN_FILE: planFile === undefined ? '' : path.resolve(planFile),
+                    MPGD_PREVIEW_JSON: ctx.values.json === true ? '1' : '',
+                };
+                if (ctx.values.json !== true) {
+                    console.info('[mpgd] target preview-versions (read-only candidates, not reservations)');
+                }
+                // --silent keeps pnpm's script echo out of stdout so the JSON document
+                // is machine-readable apart from the framework banner.
+                runPnpm(['--silent', 'preview:platform-versions'], env);
             },
         }),
         'generate-package': defineI18n({
@@ -1216,6 +1362,7 @@ const targetCommand = defineI18n({
                     jsonFile: path.join(outputDir, 'package-generation.json'),
                     markdownFile: path.join(outputDir, 'package-generation.md'),
                 });
+                console.info(`Microsoft Store package ZIP downloaded to ${evidence.archive.file}; package inspection remains required.`);
             },
         }),
         preflight: defineI18n({
@@ -1294,6 +1441,7 @@ const targetCommand = defineI18n({
                     jsonFile: path.join(outputDir, 'submission-preflight.json'),
                     markdownFile: path.join(outputDir, 'submission-preflight.md'),
                 });
+                console.info(`Microsoft Store submission preflight passed: ${Object.keys(evidence.listing.locales).length} listing locale(s), ${evidence.warnings.length} warning(s).`);
             },
         }),
         'accept-package': defineI18n({
@@ -1408,6 +1556,7 @@ const targetCommand = defineI18n({
                     ...(appCertExecutable === undefined ? {} : { appCertExecutable }),
                     ...(makeAppxExecutable === undefined ? {} : { makeAppxExecutable }),
                 }));
+                console.info(`Microsoft Store package acceptance passed: ${evidence.packages.length} package(s).`);
             },
         }),
         'build-all': defineI18n({
@@ -1508,6 +1657,7 @@ const targetCommand = defineI18n({
         }),
     },
     run: () => {
+        console.info('Use "mpgd target init <target>", "mpgd target build <target>", "mpgd target smoke <target>", "mpgd target generate-package <target>", "mpgd target preflight <target>", or "mpgd target accept-package <target> --packages <paths>".');
     },
 });
 const kitCommand = defineI18n({
@@ -1526,10 +1676,17 @@ const kitCommand = defineI18n({
                 ko: 'CLI, kit, template, target wrapper 상태를 출력합니다.',
             }),
             run: () => {
+                console.info(`cli package: ${packageRoot}`);
+                console.info(`mpgd-kit: ${detectedKitRoot ?? 'not detected'}`);
+                console.info(`cli template: ${existsSync(gameTemplateDir) ? 'ok' : 'missing'}`);
+                console.info(`mobile wrapper: ${kitFileStatus('apps/mobile-capacitor/package.json')}`);
+                console.info(`ait wrapper: ${kitFileStatus('apps/target-ait/package.json')}`);
+                console.info(`devvit wrapper: ${kitFileStatus('apps/target-devvit/package.json')}`);
             },
         }),
     },
     run: () => {
+        console.info('Use "mpgd kit doctor".');
     },
 });
 function commandResource(description, args = {}) {
@@ -1758,10 +1915,12 @@ function createGameApp(input) {
             : [{ ...file, content: renderTemplate(prepared, context) }];
     });
     if (input.dryRun) {
+        console.info(`Would create ${path.relative(process.cwd(), appDir) || appDir}:`);
         const plannedFiles = input.microsoftStore
             ? [...files.map((file) => file.relativePath), ...listMicrosoftStoreInitializerTemplateFiles()]
             : files.map((file) => file.relativePath);
         for (const relativePath of [...new Set(plannedFiles)].sort()) {
+            console.info(`- ${path.join(path.relative(process.cwd(), appDir), relativePath)}`);
         }
         return;
     }
@@ -1796,6 +1955,20 @@ function createGameApp(input) {
         }
         throw error;
     }
+    console.info(`Created ${appDir}`);
+    console.info('Next steps:');
+    console.info(`  cd ${appDir}`);
+    console.info('  pnpm install -w');
+    console.info('  pnpm dev');
+    console.info('Target builds require an mpgd-kit checkout:');
+    console.info([
+        '  mpgd target build-all',
+        `--targets-file ${path.join(appDir, 'mpgd.targets.json')}`,
+        `--targets ${context.recommendedMatrixTargets}`,
+        '--profile staging',
+        '--ait-variant wrapper',
+        '--kit-path <path-to-mpgd-kit>',
+    ].join(' '));
 }
 function assertValidGameName(name) {
     if (!/^[a-z][a-z0-9-]*$/.test(name)) {
@@ -2175,6 +2348,7 @@ function runTargetCommand(input) {
     const args = input.action === 'build'
         ? ['build:target', target, profile]
         : ['smoke:target', target];
+    console.info(`[mpgd] ${input.action} ${target}`);
     runPnpm(args, env);
 }
 function runTargetMatrix(input) {

package/dist/microsoft-store-package-acceptance.js

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { closeSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { closeSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { escapeMarkdownInline, escapeMarkdownTable, formatError, relativeOrAbsolute, } from './evidence-io.js';
@@ -85,10 +85,10 @@ export function runMicrosoftStorePackageAcceptance(input, runtime = createMicros
         ...packageFiles.map((file) => ({ file, label: 'Microsoft Store package' })),
     ]);
     for (const reportFile of reportFiles) {
-        rmSync(reportFile, { force: true });
+        removeEvidenceFile(reportFile);
     }
-    rmSync(jsonFile, { force: true });
-    rmSync(markdownFile, { force: true });
+    removeEvidenceFile(jsonFile);
+    removeEvidenceFile(markdownFile);
     const tempRoot = mkdtempSync(path.join(tmpdir(), 'mpgd-microsoft-store-package-'));
     try {
         const packages = packageFiles.map((packageFile, index) => {
@@ -136,10 +136,10 @@ export function runMicrosoftStorePackageAcceptance(input, runtime = createMicros
             writeFileSync(markdownFile, renderMicrosoftStorePackageAcceptanceMarkdown(evidence));
         }
         catch (error) {
-            rmSync(jsonFile, { force: true });
-            rmSync(markdownFile, { force: true });
+            removeEvidenceFile(jsonFile);
+            removeEvidenceFile(markdownFile);
             for (const reportFile of reportFiles) {
-                rmSync(reportFile, { force: true });
+                removeEvidenceFile(reportFile);
             }
             throw error;
         }
@@ -170,7 +170,7 @@ function runOptionalWindowsAppCertification(input) {
     if (reportFile === undefined) {
         throw new Error('Windows App Certification Kit report path was not prepared.');
     }
-    rmSync(reportFile, { force: true });
+    removeEvidenceFile(reportFile);
     input.runtime.runCommand(appCertExecutable, ['reset']);
     input.runtime.runCommand(appCertExecutable, [
         'test',
@@ -714,6 +714,17 @@ function sameFile(left, right) {
         return false;
     }
 }
+/** Remove only the file or link, never traverse a replacement directory link. */
+function removeEvidenceFile(file) {
+    try {
+        unlinkSync(file);
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            throw error;
+        }
+    }
+}
 function isMissingFileError(error) {
     if (typeof error !== 'object' || error === null) {
         return false;

package/dist/offline-playtest.js

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { decodeHTMLAttribute } from 'entities';
-import { build } from 'esbuild';
+import { build, transform } from 'esbuild';
 export const defaultOfflinePlaytestArtifactDir = 'artifacts/web-preview';
 export const defaultOfflinePlaytestOutputDir = 'artifacts/offline-playtest';
 export const defaultOfflinePlaytestMaximumBytes = 25 * 1024 * 1024;
@@ -530,7 +530,11 @@ async function bundleEntry(entryFile, context) {
         platform: 'browser',
         target: 'es2022',
         keepNames: true,
-        minify: true,
+        minifyWhitespace: true,
+        minifySyntax: true,
+        // Random deferred markers must not influence esbuild's short identifier choices.
+        // Keep their collision resistance; rename identifiers after resolving the markers.
+        minifyIdentifiers: false,
         metafile: true,
         sourcemap: false,
         legalComments: 'none',
@@ -542,7 +546,18 @@ async function bundleEntry(entryFile, context) {
         throw new Error('The offline playtest bundler did not produce JavaScript.');
     }
     recordRetainedBundledAssets(result.metafile, context);
-    const script = resolveDeferredJavaScriptAssets(scriptOutput.text, deferredAssets, context);
+    const resolvedScript = resolveDeferredJavaScriptAssets(scriptOutput.text, deferredAssets, context);
+    const { code: script } = await transform(resolvedScript, {
+        loader: 'js',
+        format: 'esm',
+        target: 'es2022',
+        keepNames: true,
+        minifyIdentifiers: true,
+        minifyWhitespace: true,
+        minifySyntax: false,
+        legalComments: 'none',
+        sourcemap: false,
+    });
     const stylesheetOutput = result.outputFiles.find((file) => file.path.endsWith('.css'));
     assertNoEntryImportMetaUrl(script);
     assertSupportedBundledRuntime(script);
@@ -1271,7 +1286,8 @@ function parseStaticElementConstructor(initializer, rawInitializer, allowAnyCrea
     if (constructor?.[2] === undefined) {
         const initializerCodePositions = createCodePositionMap(rawInitializer, true);
         const normalizedInitializer = maskNonCode(rawInitializer, initializerCodePositions).trim();
-        const createdElement = /^(?:(globalThis|self|window)\s*\.\s*)?document\s*\.\s*createElement\s*\(\s*\)\s*$/u.exec(normalizedInitializer);
+        // The code mask retains the opening quote of a literal so token boundaries survive.
+        const createdElement = /^(?:(globalThis|self|window)\s*\.\s*)?document\s*\.\s*createElement\s*\(\s*["'`]\s*\)\s*$/u.exec(normalizedInitializer);
         let openingParenthesis = -1;
         for (let index = 0; index < rawInitializer.length; index += 1) {
             if (rawInitializer[index] === '(' && initializerCodePositions[index] === 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.29.0",
+  "version": "0.30.1",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -52,19 +52,19 @@
     "@types/node": "^24.0.0",
     "ttsc": "0.18.4",
     "typescript": "7.0.2",
-    "@mpgd/adapter-browser": "0.7.3",
-    "@mpgd/adapter-ait": "0.12.1",
     "@mpgd/adapter-capacitor": "0.4.10",
-    "@mpgd/adapter-devvit": "0.9.6",
-    "@mpgd/adapter-verse8": "0.3.4",
+    "@mpgd/adapter-ait": "0.12.1",
+    "@mpgd/adapter-browser": "0.7.3",
+    "@mpgd/adapter-devvit": "0.9.8",
+    "@mpgd/adapter-verse8": "0.3.6",
     "@mpgd/analytics": "0.3.12",
-    "@mpgd/bridge": "0.9.0",
     "@mpgd/catalog": "0.7.2",
-    "@mpgd/i18n": "0.6.1",
-    "@mpgd/game-services": "0.14.0",
-    "@mpgd/phaser-assets": "0.4.1",
+    "@mpgd/game-services": "0.15.1",
+    "@mpgd/bridge": "0.9.0",
     "@mpgd/platform": "0.12.0",
-    "@mpgd/target-config": "0.14.1"
+    "@mpgd/target-config": "0.15.0",
+    "@mpgd/phaser-assets": "0.4.1",
+    "@mpgd/i18n": "0.6.1"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",