@mpgd/cli 0.34.0 → 0.36.0

package/dist/index.js

@@ -6,9 +6,12 @@ import completion from '@gunshi/plugin-completion';
 import i18n, { defineI18n } from '@gunshi/plugin-i18n';
 import resources from '@gunshi/resources';
 import { cli } from 'gunshi';
+import { assertPlatformVersionLedger } from '@mpgd/target-config';
 import { buildAssetPacks } from './asset-pack-build.js';
 import { verifyAssetPackDelivery } from './asset-pack-verify.js';
 import { materializeCapacitorShellStarter, planCapacitorShellStarter, } from './capacitor-shell-starter.js';
+import { doctorNativeDeployment, initializeDeployConfig, parseDeployTargets, planNativeDeployment, readNativeDeploymentPlan, writeNativeDeploymentPlan, } from './deploy-planning.js';
+import { initializeNativeDeployWorkflow } from './native-deploy-workflow.js';
 import { normalizeConfiguredBuildTargets, normalizeBuildTarget as normalizeConfiguredTargetName, supportedBuildTargets, } from './build-targets.js';
 import { escapeMarkdownInline as escapeEvidenceMarkdownInline, writeEvidenceReportFiles, } from './evidence-io.js';
 import { defaultGameAcceptanceCommandTimeoutMs, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, } from './game-acceptance.js';
@@ -17,11 +20,23 @@ import { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, verifyHost
 import { createMicrosoftStorePackageAcceptanceRuntime, runMicrosoftStorePackageAcceptance, } from './microsoft-store-package-acceptance.js';
 import { runMicrosoftStorePackageGeneration } from './microsoft-store-package-generation.js';
 import { defaultMpgdKitPath, initializeMicrosoftStoreStarter, listMicrosoftStoreInitializerTemplateFiles, prepareBaseGameTemplateFile, resolveMicrosoftStoreAdapterDependencyVersion, } from './microsoft-store-starter.js';
+import { applyKitUpgrade, planKitUpgrade } from './kit-upgrade.js';
 import { runMicrosoftStoreSubmissionPreflight } from './microsoft-store-submission.js';
 import { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, runOfflinePlaytestPackaging, } from './offline-playtest.js';
-import { targetConfigExtensionsFileEnv } from './target-config-env.js';
+import { targetConfigExtensionsFileEnv, targetConfigMatrixFileEnv } from './target-config-env.js';
+import { readStoreCredential, runNativeDeployment } from './native-deploy-run.js';
+import { submitRecordedNativeTarget } from './native-deploy-submission.js';
+import { readNativeReleaseStatus as readNativeReleaseStatusForCli } from './release-state.js';
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, } from './game-acceptance.js';
 export { applyCapacitorShellStarter, materializeCapacitorShellStarter, planCapacitorShellStarter, } from './capacitor-shell-starter.js';
+export { ReleaseProcessError, runReleaseProcess, } from './deploy-process.js';
+export { installPinnedReleaseDependencies, pinNativeDeploymentPlan, preparePinnedReleaseWorkspace, runPinnedNativeBuild, withPinnedReleaseWorkspace, } from './release-workspace.js';
+export { withAndroidUploadSigningSession, } from './android-signing-session.js';
+export { checkpointNativeSubmission, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, recordNativeReleaseBuild, reserveNativeRelease, } from './release-state.js';
+export { runNativeDeployment, readStoreCredential, } from './native-deploy-run.js';
+export { submitRecordedNativeTarget, } from './native-deploy-submission.js';
+export { PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+export { IosSubmissionUncertainError, submitVerifiedIosBuild, } from './testflight-submission.js';
 export { createBrowserGameplayE2EDriver, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, } from './gameplay-e2e.js';
 export { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, isSupportedHostedPwaProfile, verifyHostedPwaDeployment, } from './hosted-pwa-deployment.js';
@@ -135,7 +150,7 @@ export async function runMpgdCli(args) {
         // partial document. Every other command keeps the default rendering.
         renderHeader: async (ctx) => {
             const values = ctx.values;
-            if (ctx.name === 'verify-delivery' && values.json === true) {
+            if ((ctx.name === 'verify-delivery' || ctx.name === 'upgrade') && values.json === true) {
                 return '';
             }
             const title = ctx.env.description || ctx.env.name || '';
@@ -146,7 +161,7 @@ export async function runMpgdCli(args) {
         renderValidationErrors: async (ctx, error) => {
             const messages = error.errors.map((entry) => String(entry.message)).join('\n');
             const values = ctx.values;
-            if (ctx.name === 'verify-delivery' && values.json === true) {
+            if ((ctx.name === 'verify-delivery' || ctx.name === 'upgrade') && values.json === true) {
                 process.stderr.write(`${messages}\n`);
                 return '';
             }
@@ -155,6 +170,7 @@ export async function runMpgdCli(args) {
         subCommands: {
             assets: assetsCommand,
             game: gameCommand,
+            deploy: deployCommand,
             legal: legalCommand,
             target: targetCommand,
             kit: kitCommand,
@@ -207,10 +223,275 @@ const entryCommand = defineI18n({
         ko: 'mpgd-kit 스타터와 타깃 워크플로우를 관리합니다.',
     }),
     run: () => {
-        console.info('Use a sub-command: assets, game, legal, target, kit.');
+        console.info('Use a sub-command: assets, game, deploy, legal, target, kit.');
         console.info('Run "pnpm mpgd --help" for available commands.');
     },
 });
+const deployCommand = defineI18n({
+    name: 'deploy',
+    description: 'Configure and inspect game-owned native test deployments.',
+    resource: commandResource({
+        en: 'Configure and inspect game-owned native test deployments.',
+        ko: '게임 소유 네이티브 테스트 배포를 설정하고 점검합니다.',
+    }),
+    subCommands: {
+        init: defineI18n({
+            name: 'init',
+            description: 'Create game-owned deployment profile references.',
+            resource: commandResource({
+                en: 'Create game-owned deployment profile references.',
+                ko: '게임 소유 배포 프로필 참조를 생성합니다.',
+            }),
+            args: {
+                game: {
+                    type: 'string',
+                    required: false,
+                    description: 'Game project directory containing mpgd.targets.json.',
+                },
+            },
+            run: (ctx) => {
+                const game = readOptionalString(ctx.values.game) ?? '.';
+                console.info(`Created deployment config: ${initializeDeployConfig(game)}`);
+            },
+        }),
+        workflow: defineI18n({
+            name: 'workflow',
+            description: 'Scaffold game-owned native deployment CI.',
+            resource: commandResource({
+                en: 'Scaffold game-owned native deployment CI.',
+                ko: '게임 소유 네이티브 배포 CI를 생성합니다.',
+            }),
+            subCommands: {
+                init: defineI18n({
+                    name: 'init',
+                    description: 'Create a protected-branch native deployment workflow.',
+                    resource: commandResource({
+                        en: 'Create a protected-branch native deployment workflow.',
+                        ko: '보호 브랜치용 네이티브 배포 워크플로우를 생성합니다.',
+                    }),
+                    args: {
+                        game: { type: 'string', required: false, description: 'Game project directory.' },
+                        profile: { type: 'string', required: false, description: 'Deployment profile name.' },
+                        targets: { type: 'string', required: false, description: 'android,ios selection.' },
+                        'release-branch': {
+                            type: 'string', required: true,
+                            description: 'Protected branch allowed to dispatch signed deployments.',
+                        },
+                        'game-id': { type: 'string', required: false, description: 'Release ledger game ID.' },
+                        'approval-environment': {
+                            type: 'string', required: false,
+                            description: 'Protected GitHub Environment name.',
+                        },
+                    },
+                    run: (ctx) => {
+                        const targets = parseDeployTargets(readOptionalString(ctx.values.targets));
+                        const gameId = readOptionalString(ctx.values['game-id']);
+                        const approvalEnvironment = readOptionalString(ctx.values['approval-environment']);
+                        const file = initializeNativeDeployWorkflow({
+                            game: readOptionalString(ctx.values.game) ?? '.',
+                            profile: readOptionalString(ctx.values.profile) ?? 'beta',
+                            releaseBranch: readRequiredCliOption(ctx.values['release-branch'], '--release-branch'),
+                            ...(targets === undefined ? {} : { targets }),
+                            ...(gameId === undefined ? {} : { gameId }),
+                            ...(approvalEnvironment === undefined ? {} : { approvalEnvironment }),
+                        });
+                        console.info(`Created native deployment workflow: ${file}`);
+                    },
+                }),
+            },
+        }),
+        doctor: defineI18n({
+            name: 'doctor',
+            description: 'Check local native deployment configuration and toolchains.',
+            resource: commandResource({
+                en: 'Check local native deployment configuration and toolchains.',
+                ko: '로컬 네이티브 배포 설정과 도구 체인을 점검합니다.',
+            }),
+            args: {
+                game: {
+                    type: 'string',
+                    required: false,
+                    description: 'Game project directory.',
+                },
+                profile: {
+                    type: 'string',
+                    required: false,
+                    description: 'Deployment profile name; defaults to beta.',
+                },
+                targets: {
+                    type: 'string',
+                    required: false,
+                    description: 'Comma-separated android,ios target selection.',
+                },
+            },
+            run: (ctx) => {
+                const targets = parseDeployTargets(readOptionalString(ctx.values.targets));
+                const result = doctorNativeDeployment({
+                    game: readOptionalString(ctx.values.game) ?? '.',
+                    profile: readOptionalString(ctx.values.profile) ?? 'beta',
+                    ...(targets === undefined ? {} : { targets }),
+                });
+                for (const check of result.checks) {
+                    console.info(`${check.status}: ${check.name} — ${check.detail}`);
+                }
+                if (!result.healthy) {
+                    throw new Error('Native deployment doctor found missing requirements.');
+                }
+            },
+        }),
+        plan: defineI18n({
+            name: 'plan',
+            description: 'Write a read-only native deployment plan without reserving versions.',
+            resource: commandResource({
+                en: 'Write a read-only native deployment plan without reserving versions.',
+                ko: '버전 예약 없이 읽기 전용 네이티브 배포 계획을 작성합니다.',
+            }),
+            args: {
+                game: {
+                    type: 'string',
+                    required: false,
+                    description: 'Game project directory.',
+                },
+                profile: {
+                    type: 'string',
+                    required: false,
+                    description: 'Deployment profile name; defaults to beta.',
+                },
+                targets: {
+                    type: 'string',
+                    required: false,
+                    description: 'Comma-separated android,ios target selection.',
+                },
+                out: {
+                    type: 'string',
+                    required: true,
+                    description: 'New plan JSON path; existing files are not overwritten.',
+                },
+            },
+            run: (ctx) => {
+                const targets = parseDeployTargets(readOptionalString(ctx.values.targets));
+                const plan = planNativeDeployment({
+                    game: readOptionalString(ctx.values.game) ?? '.',
+                    profile: readOptionalString(ctx.values.profile) ?? 'beta',
+                    ...(targets === undefined ? {} : { targets }),
+                });
+                const out = readRequiredCliOption(ctx.values.out, '--out');
+                writeNativeDeploymentPlan(out, plan);
+                console.info(`Wrote read-only deployment plan: ${path.resolve(out)}`);
+            },
+        }),
+        status: defineI18n({
+            name: 'status',
+            description: 'Read one game-owned native release and its store checkpoints.',
+            resource: commandResource({
+                en: 'Read one game-owned native release and its store checkpoints.',
+                ko: '게임 소유 네이티브 릴리스와 스토어 체크포인트를 조회합니다.',
+            }),
+            args: {
+                game: { type: 'string', required: false, description: 'Game project directory.' },
+                'game-id': { type: 'string', required: true, description: 'Explicit release ledger game ID.' },
+                release: { type: 'string', required: true, description: 'Explicit release ID.' },
+            },
+            run: async (ctx) => {
+                const status = await readNativeReleaseStatusForCli({
+                    gameRoot: path.resolve(readOptionalString(ctx.values.game) ?? '.'),
+                    gameId: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
+                    releaseKey: readRequiredCliOption(ctx.values.release, '--release'),
+                });
+                console.info(JSON.stringify(status, null, 2));
+            },
+        }),
+        submit: defineI18n({
+            name: 'submit',
+            description: 'Resume store submission of one already verified native build.',
+            resource: commandResource({
+                en: 'Resume store submission of one already verified native build.',
+                ko: '이미 검증한 네이티브 빌드의 스토어 제출을 재개합니다.',
+            }),
+            args: {
+                plan: { type: 'string', required: true, description: 'Saved deployment plan JSON.' },
+                game: { type: 'string', required: false, description: 'Current game directory if the plan moved.' },
+                'game-id': { type: 'string', required: true, description: 'Explicit release ledger game ID.' },
+                release: { type: 'string', required: true, description: 'Explicit release ID.' },
+                target: { type: 'string', required: true, description: 'android or ios.' },
+                approve: { type: 'boolean', required: false, description: 'Approve internal test submission.' },
+            },
+            run: async (ctx) => {
+                const game = readOptionalString(ctx.values.game);
+                const plan = readNativeDeploymentPlan(readRequiredCliOption(ctx.values.plan, '--plan'), game === undefined ? undefined : path.resolve(game));
+                const target = readRequiredCliOption(ctx.values.target, '--target');
+                if (target !== 'android' && target !== 'ios') {
+                    throw new Error('--target must be android or ios.');
+                }
+                const result = await submitRecordedNativeTarget({
+                    plan,
+                    gameId: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
+                    releaseKey: readRequiredCliOption(ctx.values.release, '--release'),
+                    credential: readStoreCredential(plan, target, process.env),
+                    approved: isDeployApproved(plan, ctx.values.approve === true),
+                });
+                console.info(JSON.stringify(result, null, 2));
+            },
+        }),
+        run: defineI18n({
+            name: 'run',
+            description: 'Reserve, build, verify and submit native internal-test releases.',
+            resource: commandResource({
+                en: 'Reserve, build, verify and submit native internal-test releases.',
+                ko: '네이티브 내부 테스트 릴리스를 예약·빌드·검증·제출합니다.',
+            }),
+            args: {
+                plan: { type: 'string', required: true, description: 'Saved deployment plan JSON.' },
+                game: { type: 'string', required: false, description: 'Current game directory if the plan moved.' },
+                'game-id': { type: 'string', required: true, description: 'Explicit release ledger game ID.' },
+                'game-version': { type: 'string', required: true, description: 'Game SemVer version.' },
+                release: { type: 'string', required: true, description: 'Explicit release ID.' },
+                'initial-ledger': {
+                    type: 'string', required: false,
+                    description: 'Initial version ledger JSON; only for the first release.',
+                },
+                approve: { type: 'boolean', required: false, description: 'Approve internal test submission.' },
+            },
+            run: async (ctx) => {
+                const game = readOptionalString(ctx.values.game);
+                const plan = readNativeDeploymentPlan(readRequiredCliOption(ctx.values.plan, '--plan'), game === undefined ? undefined : path.resolve(game));
+                const infoFile = path.join(packageRoot, 'dist/native-build-info.json');
+                const info = readJsonForCli(infoFile, 'native builder metadata');
+                assertJsonObject(info, 'native builder package metadata');
+                if (info.packageVersion !== cliVersion || typeof info.kitGitSha !== 'string'
+                    || !/^[0-9a-f]{40}$/u.test(info.kitGitSha) || info.kitDirty !== false) {
+                    throw new Error('Installed CLI has no clean, matching native Kit build identity.');
+                }
+                const initialLedgerFile = readOptionalString(ctx.values['initial-ledger']);
+                const recordedBuildMarker = process.env.MPGD_RECORDED_BUILD_MARKER;
+                if (recordedBuildMarker !== undefined
+                    && (process.env.RUNNER_TEMP === undefined
+                        || !path.isAbsolute(process.env.RUNNER_TEMP)
+                        || !path.isAbsolute(recordedBuildMarker)
+                        || path.dirname(recordedBuildMarker) !== path.resolve(process.env.RUNNER_TEMP))) {
+                    throw new Error('The recorded-build marker must be directly inside RUNNER_TEMP.');
+                }
+                const status = await runNativeDeployment({
+                    plan,
+                    gameId: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
+                    gameVersion: readRequiredCliOption(ctx.values['game-version'], '--game-version'),
+                    releaseKey: readRequiredCliOption(ctx.values.release, '--release'),
+                    kit: { packageVersion: cliVersion, gitSha: info.kitGitSha },
+                    ...(initialLedgerFile === undefined ? {} : {
+                        initialLedger: assertPlatformVersionLedger(readJsonForCli(path.resolve(initialLedgerFile), 'initial version ledger')),
+                    }),
+                    approved: isDeployApproved(plan, ctx.values.approve === true),
+                    ...(recordedBuildMarker === undefined ? {} : {
+                        onBuildRecorded: (target) => {
+                            writeFileSync(recordedBuildMarker, target, { flag: 'wx', mode: 0o600 });
+                        },
+                    }),
+                });
+                console.info(JSON.stringify(status, null, 2));
+            },
+        }),
+    },
+});
 const gameCommand = defineI18n({
     name: 'game',
     description: 'Create standalone Phaser game starters.',
@@ -1339,7 +1620,7 @@ const targetCommand = defineI18n({
                     action: 'build',
                     target,
                     profile,
-                    env: createTargetCommandEnv(ctx.values),
+                    env: createTargetCommandEnv(ctx.values, { nativeBuildTarget: target }),
                     ...(variant === undefined ? {} : { variant }),
                 });
             },
@@ -2042,6 +2323,79 @@ const kitCommand = defineI18n({
         ko: '현재 mpgd-kit 체크아웃을 점검합니다.',
     }),
     subCommands: {
+        upgrade: defineI18n({
+            name: 'upgrade',
+            description: 'Plan or apply the latest published Kit package versions for a game.',
+            resource: commandResource({
+                base: {
+                    en: 'Plan or apply the latest published Kit package versions for a game.',
+                    ko: '게임에 배포된 최신 Kit 패키지 버전 적용을 계획하거나 실행합니다.',
+                },
+                args: {
+                    game: {
+                        en: 'Game directory containing package.json and optional mpgd.targets.json.',
+                        ko: 'package.json과 선택적 mpgd.targets.json이 있는 게임 디렉터리.',
+                    },
+                    'targets-file': {
+                        en: 'Optional game-owned target configuration file.',
+                        ko: '선택적 게임 소유 타깃 구성 파일.',
+                    },
+                    apply: {
+                        en: 'Write the planned manifests and pnpm lockfiles.',
+                        ko: '계획된 의존성 선언과 pnpm 락파일을 갱신합니다.',
+                    },
+                    json: {
+                        en: 'Write one machine-readable JSON document to stdout.',
+                        ko: '표준 출력에 기계 판독용 JSON 문서 하나를 출력합니다.',
+                    },
+                },
+            }),
+            args: {
+                game: { type: 'string', required: false, default: '.', description: 'Game directory.' },
+                'targets-file': { type: 'string', required: false, description: 'Target config file.' },
+                apply: { type: 'boolean', required: false, description: 'Apply the upgrade plan.' },
+                json: { type: 'boolean', required: false, description: 'Print JSON.' },
+            },
+            run: async (ctx) => {
+                const game = readOptionalString(ctx.values.game) ?? '.';
+                const plan = await planKitUpgrade(game, undefined, readOptionalString(ctx.values['targets-file']));
+                const result = ctx.values.apply === true && plan.blockers.length === 0
+                    ? applyKitUpgrade(plan)
+                    : undefined;
+                if (ctx.values.json === true) {
+                    process.stdout.write(JSON.stringify({ plan, result: result ?? null }, null, 2) + '\n');
+                }
+                else {
+                    console.info('Kit upgrade plan for ' + plan.gameRoot);
+                    for (const update of plan.updates) {
+                        console.info('  ' + path.relative(plan.gameRoot, update.manifest)
+                            + ': ' + update.packageName + ' ' + update.current + ' -> ' + update.next);
+                    }
+                    if (plan.updates.length === 0) {
+                        console.info('  Already current for published npm latest tags.');
+                    }
+                    for (const note of plan.notes) {
+                        console.info('Note: ' + note);
+                    }
+                    for (const advisory of plan.targetAdvisories) {
+                        console.info('Target advisory [' + advisory.target + ']: ' + advisory.message);
+                    }
+                    for (const blocker of plan.blockers) {
+                        console.error('Blocked: ' + blocker);
+                    }
+                    if (result !== undefined) {
+                        console.info('Updated ' + result.manifests.length + ' manifest(s) and '
+                            + result.lockfiles.length + ' lockfile(s). Run target checks before release.');
+                    }
+                    else if (plan.updates.length > 0 && plan.blockers.length === 0) {
+                        console.info('Run again with --apply to update manifests and pnpm lockfiles.');
+                    }
+                }
+                if (plan.blockers.length > 0) {
+                    process.exitCode = 1;
+                }
+            },
+        }),
         doctor: defineI18n({
             name: 'doctor',
             description: 'Print CLI, kit, template, and target-wrapper status.',
@@ -2060,7 +2414,7 @@ const kitCommand = defineI18n({
         }),
     },
     run: () => {
-        console.info('Use "mpgd kit doctor".');
+        console.info('Use "mpgd kit doctor" or "mpgd kit upgrade --game <directory> [--apply]".');
     },
 });
 function commandResource(description, args = {}) {
@@ -2573,10 +2927,11 @@ function toJavaScriptStringLiteral(value) {
 function toTemplatePath(value) {
     return value.split(path.sep).join('/');
 }
-function createTargetCommandEnv(values) {
+function createTargetCommandEnv(values, options = {}) {
     const targetsFile = path.resolve(readOptionalString(values['targets-file']) ?? 'mpgd.targets.json');
     const gameRoot = path.dirname(targetsFile);
-    const kitPath = resolveKitPathForTarget(values);
+    const standaloneNative = resolveStandaloneNativeBuild(targetsFile, options.nativeBuildTarget, values);
+    const kitPath = standaloneNative === undefined ? resolveKitPathForTarget(values) : gameRoot;
     const resolvedTargetsFile = readOptionalString(values['resolved-targets-file']);
     const targetConfigExtensionsFile = resolveTargetConfigExtensionsFile(gameRoot, readOptionalString(values['target-config-extensions-file']));
     const preparedTargetsFile = preparePlatformTargetsFile({
@@ -2586,15 +2941,101 @@ function createTargetCommandEnv(values) {
             ? {}
             : { outputFile: path.resolve(resolvedTargetsFile) }),
     });
-    return {
+    const env = {
         ...process.env,
         ...createGameOwnedReleaseEnv(gameRoot, process.env),
-        MPGD_KIT_PATH: kitPath,
         MPGD_PLATFORM_TARGETS_FILE: preparedTargetsFile,
         ...(targetConfigExtensionsFile === undefined
             ? {}
             : { [targetConfigExtensionsFileEnv]: targetConfigExtensionsFile }),
     };
+    if (standaloneNative === undefined) {
+        env.MPGD_KIT_PATH = kitPath;
+        delete env.MPGD_NATIVE_PACKAGED_BUILD;
+        delete env.MPGD_PACKAGED_KIT_GIT_SHA;
+    }
+    else {
+        delete env.MPGD_KIT_PATH;
+        env.MPGD_NATIVE_PACKAGED_BUILD = '1';
+        env.MPGD_PACKAGED_KIT_GIT_SHA = standaloneNative.kitGitSha;
+        env.MPGD_SKIP_BUILD_TARGET_PREFLIGHT = '1';
+        env[targetConfigMatrixFileEnv] = standaloneNative.targetMatrixFile;
+    }
+    return env;
+}
+function resolveStandaloneNativeBuild(targetsFile, requestedTarget, values) {
+    if ((requestedTarget !== 'android' && requestedTarget !== 'ios')
+        || readOptionalString(values['kit-path']) !== undefined
+        || readOptionalString(process.env.MPGD_KIT_PATH) !== undefined) {
+        return undefined;
+    }
+    const raw = readJsonForCli(targetsFile);
+    assertJsonObject(raw, `targets file ${targetsFile}`);
+    assertJsonObject(raw.targets, `targets in ${targetsFile}`);
+    const selected = raw.targets[requestedTarget];
+    const expectedKind = requestedTarget === 'android' ? 'capacitor-android' : 'capacitor-ios';
+    if (typeof selected !== 'object' || selected === null || Array.isArray(selected)
+        || selected.kind !== expectedKind) {
+        return undefined;
+    }
+    if (JSON.stringify(selected).includes('${MPGD_KIT_PATH}')) {
+        if (detectedKitRoot !== undefined) {
+            return undefined;
+        }
+        throw new Error(`Native target ${requestedTarget} still references the Kit checkout. Run mpgd target init capacitor to create a game-owned shell.`);
+    }
+    const gameRoot = path.dirname(targetsFile);
+    const gameRootReal = realpathSync(gameRoot);
+    for (const field of ['shellApp', 'webDir']) {
+        const configuredPath = selected[field];
+        if (typeof configuredPath !== 'string') {
+            return undefined;
+        }
+        const candidate = path.resolve(gameRoot, configuredPath
+            .replaceAll('${MPGD_GAME_ROOT}', gameRoot)
+            .replaceAll('${MPGD_GAME_APP_ROOT}', gameRoot));
+        let existingAncestor = candidate;
+        while (!existsSync(existingAncestor)) {
+            const parent = path.dirname(existingAncestor);
+            if (parent === existingAncestor) {
+                throw new Error(`Cannot resolve native target ${requestedTarget} ${field}: ${configuredPath}`);
+            }
+            existingAncestor = parent;
+        }
+        const canonicalCandidate = path.resolve(realpathSync(existingAncestor), path.relative(existingAncestor, candidate));
+        const relativeToGame = path.relative(gameRootReal, canonicalCandidate);
+        if (relativeToGame === '' || relativeToGame === '..'
+            || relativeToGame.startsWith(`..${path.sep}`)
+            || path.isAbsolute(relativeToGame)) {
+            if (detectedKitRoot !== undefined) {
+                return undefined;
+            }
+            throw new Error(`Native target ${requestedTarget} ${field} must stay inside its game project. Run mpgd target init capacitor to create a game-owned shell.`);
+        }
+    }
+    const script = path.join(packageRoot, 'dist/native-build-target.js');
+    const infoFile = path.join(packageRoot, 'dist/native-build-info.json');
+    if (!existsSync(script) || !existsSync(infoFile)) {
+        if (detectedKitRoot !== undefined) {
+            return undefined;
+        }
+        throw new Error('The installed @mpgd/cli package is missing its native builder artifacts.');
+    }
+    const info = readJsonForCli(infoFile);
+    assertJsonObject(info, 'native builder package metadata');
+    if (info.packageVersion !== cliVersion
+        || typeof info.kitGitSha !== 'string'
+        || !/^[0-9a-f]{40}$/u.test(info.kitGitSha)
+        || typeof info.kitDirty !== 'boolean') {
+        throw new Error('The installed native builder metadata does not match @mpgd/cli.');
+    }
+    if (info.kitDirty) {
+        throw new Error('The installed native builder was packaged from a dirty Kit worktree and cannot provide reliable kitGitSha provenance.');
+    }
+    return {
+        kitGitSha: info.kitGitSha,
+        targetMatrixFile: fileURLToPath(import.meta.resolve('@mpgd/target-config/targets.json')),
+    };
 }
 function resolveTargetConfigExtensionsFile(gameRoot, configuredFile) {
     const inheritedFile = readConfiguredPath(process.env[targetConfigExtensionsFileEnv]);
@@ -2684,19 +3125,19 @@ function preparePlatformTargetsFile(input) {
     writeFileSync(outputFile, `${JSON.stringify(rendered, null, 2)}\n`);
     return outputFile;
 }
-function readJsonForCli(file) {
+function readJsonForCli(file, label = 'targets file') {
     let raw;
     try {
         raw = readFileSync(file, 'utf8');
     }
     catch (error) {
-        throw new Error(`Failed to read targets file ${file}: ${formatError(error)}`);
+        throw new Error(`Failed to read ${label} ${file}: ${formatError(error)}`);
     }
     try {
         return JSON.parse(raw);
     }
     catch (error) {
-        throw new Error(`Failed to parse targets file ${file}: ${formatError(error)}`);
+        throw new Error(`Failed to parse ${label} ${file}: ${formatError(error)}`);
     }
 }
 function formatError(error) {
@@ -2728,12 +3169,38 @@ function runTargetCommand(input) {
     const target = normalizeBuildTarget(input.target, input.env);
     const env = withTargetVariantEnv(target, input.variant, input.env);
     const profile = input.profile ?? 'production';
+    if (input.action === 'build' && env.MPGD_NATIVE_PACKAGED_BUILD === '1') {
+        if (target !== 'android' && target !== 'ios') {
+            throw new Error(`Packaged native builder cannot build target ${target}.`);
+        }
+        console.info(`[mpgd] build ${target} from installed CLI`);
+        runPackagedNativeBuild(target, profile, env);
+        return;
+    }
     const args = input.action === 'build'
         ? ['build:target', target, profile]
         : ['smoke:target', target];
     console.info(`[mpgd] ${input.action} ${target}`);
     runPnpm(args, env);
 }
+function runPackagedNativeBuild(target, profile, env) {
+    const targetsFile = env.MPGD_PLATFORM_TARGETS_FILE;
+    if (targetsFile === undefined) {
+        throw new Error('Packaged native build is missing its target config file.');
+    }
+    const script = path.join(packageRoot, 'dist/native-build-target.js');
+    const result = spawnSync(process.execPath, [script, target, profile], {
+        cwd: path.dirname(targetsFile),
+        env,
+        stdio: 'inherit',
+    });
+    if (result.error !== undefined) {
+        throw result.error;
+    }
+    if (result.status !== 0) {
+        throw new Error(`Packaged ${target} build failed with exit code ${result.status}.`);
+    }
+}
 function runTargetMatrix(input) {
     for (const target of input.targets) {
         const variant = variantForTarget(target, input);
@@ -3019,6 +3486,9 @@ function renderHostedPwaVerificationMarkdown(verification) {
         '',
     ].join('\n');
 }
+function isDeployApproved(plan, approveFlag) {
+    return plan.approval === 'preapproved-internal-test' || approveFlag;
+}
 function readRequiredCliOption(value, label) {
     const read = readOptionalString(value);
     if (read === undefined) {