@mpgd/cli 0.38.0 → 0.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -40,6 +40,8 @@
     "mpgd": "./dist/bin.js"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "3.1147.0",
+    "@smithy/node-http-handler": "4.12.1",
     "@googleapis/androidpublisher": "42.0.0",
     "@gunshi/plugin-completion": "^0.35.1",
     "@gunshi/plugin-i18n": "^0.35.1",
@@ -47,6 +49,7 @@
     "@xmldom/xmldom": "0.9.12",
     "acorn": "8.17.0",
     "entities": "^8.0.0",
+    "fflate": "0.8.3",
     "esbuild": "^0.28.1",
     "gunshi": "^0.35.1",
     "semver": "^7.8.5",
@@ -54,26 +57,28 @@
     "typia": "13.0.2",
     "undici": "^7.29.1",
     "vite": "8.1.3",
-    "@mpgd/catalog": "0.7.8",
-    "@mpgd/target-config": "0.18.0",
-    "@mpgd/phaser-assets": "0.7.0"
+    "yauzl": "3.4.0",
+    "@mpgd/catalog": "0.8.0",
+    "@mpgd/target-config": "0.20.0",
+    "@mpgd/phaser-assets": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@types/semver": "^7.8.0",
+    "@types/yauzl": "3.4.0",
     "ttsc": "0.30.4",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.13.1",
-    "@mpgd/adapter-browser": "0.8.0",
-    "@mpgd/adapter-capacitor": "0.7.1",
-    "@mpgd/adapter-devvit": "0.9.16",
-    "@mpgd/adapter-verse8": "0.4.1",
-    "@mpgd/analytics": "0.4.2",
-    "@mpgd/game-runtime": "0.4.0",
+    "@mpgd/adapter-ait": "0.13.2",
+    "@mpgd/adapter-browser": "0.9.0",
+    "@mpgd/adapter-capacitor": "0.7.3",
+    "@mpgd/adapter-devvit": "0.9.17",
+    "@mpgd/analytics": "0.4.3",
+    "@mpgd/adapter-verse8": "0.4.2",
+    "@mpgd/game-services": "0.19.0",
     "@mpgd/bridge": "0.11.0",
-    "@mpgd/game-services": "0.18.1",
-    "@mpgd/i18n": "0.6.7",
-    "@mpgd/platform": "0.16.0"
+    "@mpgd/game-runtime": "0.5.0",
+    "@mpgd/i18n": "0.6.8",
+    "@mpgd/platform": "0.17.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/phaser-game/agent/acceptance.md

@@ -76,3 +76,9 @@ the snapshot bounds for persistent controls.
   bootstrap monetization ports. A test memory store is not durable recovery.
 - Use the real adapter's SDK-driven conformance tests and a game-owned platform
   test environment; generic unit tests do not certify live ad delivery.
+
+## ONE play acceptance
+
+Build and smoke the configured ONE play target using the game-owned kit path. Validate server-issued reward/checkout binding, raw-byte signed SSV, purchase token API verification, ledger-before-consume/acknowledge, retries without duplicate grants, signed PNS orphan-purchase recovery and atomic cancellation fences. Missing finalization must keep PNS pending; a busy SDK must report native not-started before rejecting a new checkout. Permit five minutes of provider/server clock skew while rejecting timestamps outside the intent window.
+
+Use an authenticated server session rather than the SDK player pseudonym. Confirm ad IDs, real payments, lifecycle, HTTPS iframe hosting and PNS/SSV in ONE store with issued ONEconsole credentials. Generic fixture and artifact smoke do not certify real-app commerce.

package/templates/phaser-game/agent/brief.md

@@ -48,3 +48,7 @@ projection. Add SDKs only in target assembly or adapters. All rewarded views use
 the game-owned action coordinator and authoritative services, with an
 application-owned durable encrypted operation store. Keep recovery above scenes
 and reconcile existing operations on startup and resume without opening SDK UI.
+
+## ONE play server-owned monetization
+
+Specify issued placement/product IDs, the authenticated reward and checkout intent routes, durable SSV/intent/ledger stores, an encrypted client operation journal, and reconciliation plus atomic cancellation fencing. Keep monetization disabled until these ports are wired. Purchase/ad callbacks are evidence; backend grants precede consume/acknowledge. Separate confirmed checkout closure from financial completion. Plan real-app acceptance with ONEconsole credentials and hosting headers.

package/templates/phaser-game/agent/game-manifest.json

@@ -10,6 +10,7 @@
     "microsoft-store",
     "verse8",
     "crazygames",
+    "oneplay",
     "android",
     "ios",
     "ait",
@@ -95,6 +96,26 @@
         "SDK earning and physical closure are separate from an authoritative backend ledger grant.",
         "Recover existing claims on startup and resume without reopening SDK UI."
       ]
+    },
+    {
+      "id": "commerce.checkout.verified-intent",
+      "owner": "src/platform/buildGateways/oneplay.ts",
+      "capabilities": [
+        "server-issued-checkout-intent",
+        "managed-purchase-verification",
+        "ledger-before-finalization",
+        "signed-notification-recovery",
+        "durable-cancellation-fence",
+        "native-checkout-presentation",
+        "server-issued-ad-request",
+        "signed-reward-ssv"
+      ],
+      "gotchas": [
+        "ONE play monetization stays unavailable without game-owned authenticated issuer routes and durable intent, receipt, ledger and encrypted client recovery stores.",
+        "SDK player IDs are platform asserted, not authenticated backend identities. Client ad or purchase callbacks never grant.",
+        "Require completed consume/acknowledge before accepting PNS; implement atomic cancellation fencing and authoritative revocation in the game ledger.",
+        "Keep uncertain native outcomes quarantined; SDK resume is not closure proof. Validate issued IDs, SSV, payments and hosting in the real ONE store app."
+      ]
     }
   ],
   "acceptance": [

package/templates/phaser-game/docs/MPGD_KIT_WORKFLOWS.md

@@ -153,3 +153,9 @@ Keep source revision, config, build/smoke results, gameplay evidence, target
 preflight, artifact hashes, and target acceptance reports together. A generic
 kit smoke test proves the reusable contract only; it does not replace
 game-owned production credentials, deployment, signing, or store evidence.
+
+### ONE play
+
+Use `@mpgd/adapter-browser/oneplay` through `PlatformGateway`. Build and smoke the `oneplay` target with the configured kit path. The adapter initializes the H5 SDK before gameplay; `completeLoading()` awaits host acknowledgement. Exit checkpoints must be synchronous through `storage.saveSync`. Use game-owned issued placement IDs and server verification before enabling ads or purchases. Check final HTTPS hosting headers for both ONE store domain families. See the [ONE play guide](https://github.com/imjlk/mpgd-kit/blob/main/docs/ONEPLAY.md) and [official SDK guide](https://onestore-dev.gitbook.io/dev/tools/web-sdk).
+
+Wire `rewardRequests` and `commerceServer` in `src/platform/buildGateways/oneplay.ts`. Server-only `@mpgd/game-services/oneplay-reward`, `oneplay-purchase-client`, `oneplay-purchase` and `oneplay-pns` provide signed SSV, authenticated checkout intents, API V7 verification, post-ledger consume/acknowledge and signed notification recovery. The game owns durable stores, routes, an encrypted client journal and atomic cancellation fencing. A completed PNS requires completed finalization. Missing ports keep capabilities unavailable; subscriptions are unsupported. See `commerce.checkout.verified-intent` in the game manifest and the ONE play acceptance notes before enabling policies.

package/templates/phaser-game/mpgd.targets.json

@@ -33,6 +33,17 @@
       "crazyGamesLaunch": "basic",
       "output": "artifacts/crazygames"
     },
+    "oneplay": {
+      "kind": "web",
+      "gameApp": ".",
+      "adapter": "oneplay",
+      "icon": {
+        "profile": "web-preview"
+      },
+      "installable": false,
+      "output": "artifacts/oneplay",
+      "authoritativeGameServices": false
+    },
     "android": {
       "kind": "capacitor-android",
       "gameApp": ".",

package/templates/phaser-game/src/main.ts

@@ -49,6 +49,7 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
     });
     const viewport = resolveTargetViewportSnapshot({
       ...measurement,
+      ...(platform.viewport === undefined ? {} : { safeAreaInsets: platform.viewport.getState().safeAreaInsets }),
       runtime: runtime.config.runtime,
       orientationPolicy,
     });
@@ -63,6 +64,7 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
     ]);
     locale = resolveTargetMpgdLocale({
       capabilities: runtime.capabilities,
+      ...(platform.gameSettings?.getLocale === undefined ? {} : { preferredLocales: [platform.gameSettings.getLocale()] }),
       fallbackLocale:
         runtime.effectiveConfig?.localization.fallbackLocale
         ?? runtime.config.localization.fallbackLocale,

package/templates/phaser-game/src/platform/buildGateways/oneplay.ts

@@ -0,0 +1,32 @@
+import {
+  createOnePlayPlatformGateway,
+  type OnePlayGatewayOptions,
+} from '@mpgd/adapter-browser/oneplay';
+import {
+  resolveAdPlacementPlatformId,
+  resolveProductPlatformId,
+  type AdPlacements,
+  type ProductCatalog,
+} from '@mpgd/catalog';
+import adPlacementsJson from '@mpgd/catalog/placements.json';
+import productCatalogJson from '@mpgd/catalog/catalog.json';
+import type { PlatformGateway } from '@mpgd/platform';
+import type { RuntimeConfig } from '../runtimeDetector';
+
+export async function createBuildGateway(runtime: RuntimeConfig, ports: Pick<OnePlayGatewayOptions, 'rewardRequests' | 'commerceServer'> = {}): Promise<PlatformGateway> {
+  const placementIds = Object.fromEntries(
+    (adPlacementsJson as AdPlacements).placements.flatMap((placement) => {
+      const platformId = resolveAdPlacementPlatformId(placement, runtime.configTarget);
+      return placement.type !== 'banner' && platformId !== undefined
+        ? [[placement.id, { format: placement.type, platformId }]]
+        : [];
+    }),
+  );
+  const products = (productCatalogJson as ProductCatalog).products.flatMap((product) => {
+    const platformId = resolveProductPlatformId(product, runtime.configTarget);
+    return product.type !== 'subscription' && platformId !== undefined
+      ? [{ id: product.id, platformId, type: product.type }]
+      : [];
+  });
+  return createOnePlayPlatformGateway({ ...ports, placementIds, products });
+}

package/templates/phaser-game/src/platform/runtimeDetector.ts

@@ -8,6 +8,7 @@ const validTargets = new Set<string>([
   'reddit',
   'verse8',
   'crazygames',
+  'oneplay',
   'telegram',
   'tauri',
   'wechat',

package/templates/phaser-game/src/runtime/createGame.ts

@@ -28,15 +28,15 @@ export function createStarterGame(input: {
     },
     scene: [BootScene, LobbyScene, PlayScene],
     callbacks: {
-      postBoot(game: Phaser.Game) {
+      preBoot(game: Phaser.Game) {
         game.registry.set(starterContextKey, input.context);
+      },
+      postBoot(game: Phaser.Game) {
         ownGameAudio(game, input.context);
       },
     },
   });
 
-  game.registry.set(starterContextKey, input.context);
-
   return game;
 }
 

package/templates/phaser-game/src/scenes/BootScene.ts

@@ -12,11 +12,17 @@ export class BootScene extends Phaser.Scene {
   }
 
   preload(): void {
+    const context = this.registry.get(starterContextKey) as StarterContext;
+    this.load.on('progress', (progress: number) =>
+      context.gameRuntime.setLoadingProgress(progress * 100),
+    );
     loadPhaserAssets(this, starterAssets);
   }
 
   create(): void {
     const context = this.registry.get(starterContextKey) as StarterContext;
-    this.scene.start(context.launchIntent.entry === 'free-play' ? 'PlayScene' : 'LobbyScene');
+    void context.gameRuntime.completeLoading().then(() => {
+      this.scene.start(context.launchIntent.entry === 'free-play' ? 'PlayScene' : 'LobbyScene');
+    }).catch((error: unknown) => { console.error('[game-loading]', error); });
   }
 }

package/templates/phaser-game/src/scenes/PlayScene.ts

@@ -29,6 +29,22 @@ export class PlayScene extends Phaser.Scene {
 
   create(): void {
     this.context = this.registry.get(starterContextKey) as StarterContext;
+    // A host exit callback cannot await a server upload. Keep this local checkpoint synchronous.
+    const checkpoint = () => {
+      try {
+        this.context.platform.storage.saveSync?.({
+          key: 'starter-run',
+          value: this.state,
+        });
+      } catch (error) {
+        console.error('[checkpoint]', error);
+      }
+    };
+    const unsubscribeExit = this.context.platform.lifecycle.onExit?.(checkpoint);
+    this.events.once('shutdown', () => {
+      checkpoint();
+      unsubscribeExit?.();
+    });
     bindPhaserGameScene({
       controller: this.context.gameRuntime.execution,
       gameplayScope: this.context.gameRuntime.createGameplayScope(),

package/templates/phaser-game/vite.runtime-target-config.ts

@@ -21,6 +21,7 @@ const runtimeKinds = valueSet({
   'devvit-web': true,
   'verse8-web': true,
   'crazygames-web': true,
+  'oneplay-web': true,
   'wechat-minigame': true,
   'tiktok-minigame': true,
 } satisfies Record<TargetRuntimeKind, true>);
@@ -34,6 +35,7 @@ const releaseProfiles = valueSet({
   devvit: true,
   verse8: true,
   crazygames: true,
+  oneplay: true,
   'wechat-minigame': true,
   'tiktok-minigame': true,
 } satisfies Record<ReleaseProfile, true>);

package/templates/phaser-game/vite.shared.ts

@@ -152,6 +152,8 @@ export function resolveBuildGatewayModule(input: {
       return input.debug && input.buildId === devvitSandboxBuildId
         ? 'src/platform/buildGateways/redditSandbox.ts'
         : 'src/platform/buildGateways/reddit.ts';
+    case 'oneplay':
+      return 'src/platform/buildGateways/oneplay.ts';
     case 'crazygames':
       return 'src/platform/buildGateways/crazygames.ts';
     case 'verse8':