@mpgd/cli 0.47.0 → 0.49.0

package/templates/lite-overlay/apps/target-devvit/README.md

@@ -0,0 +1,134 @@
+# __GAME_TITLE__ Devvit Target
+
+This directory is the Reddit Devvit app root for `__GAME_NAME__`.
+
+`devvit.json` belongs to the generated game, not to the mpgd-kit checkout. That keeps the
+Reddit app name, menu entry, upload history, and playtest state owned by this game.
+Its `name` is generated as a Devvit-safe slug; edit it before `pnpm devvit:init`
+if you want a different Reddit app name.
+
+## First Playtest
+
+```sh
+pnpm install -w
+pnpm devvit:login
+pnpm devvit:whoami
+pnpm devvit:init
+pnpm build:devvit
+pnpm devvit:playtest
+```
+
+`devvit:init` performs the first App Directory upload/link step with Devvit's
+logged-in account. It may open a browser for authorization. Use
+`pnpm devvit:init:copy-paste` from the game root if the browser flow is not
+available and the CLI asks for a manual code. After that, use
+`pnpm devvit:playtest`, `pnpm devvit:upload`, and `pnpm devvit:publish` from the
+game root.
+
+The official `@devvit/start/vite` plugin builds the game client into
+`dist/client` and the CommonJS server bridge into `dist/server/index.cjs` in one
+pass. The mpgd target build wraps that unified build with release provenance and
+effective-target evidence while keeping Devvit SDK imports behind the platform gateway.
+The game root pins `@mpgd/cli`, so these commands use the same CLI version as the
+generated starter's other `@mpgd/*` dependencies.
+
+The bridge endpoint at `/api/mpgd/rpc` uses the direct oRPC Node HTTP adapter
+from `@mpgd/bridge/orpc/node`; Express, Hono, and Fetch request conversion are
+not required. Devvit-owned menu, scheduler, trigger, and form callbacks remain
+thin `/internal/...` routes and delegate to shared service functions. oRPC
+Publisher helpers can broadcast results after a task completes, but they do not
+replace the `devvit.json` scheduler endpoint and should not use process-local
+memory when delivery must cross instances. The generated target exposes only
+the oRPC bridge route; the former JSON compatibility route is not generated.
+
+The default post entry uses `index.html` for a playable Canvas2D surface.
+Play full screen requests the `game` entrypoint, which loads the full game from
+the separate `game.html` document. Keep heavy imports behind the expanded entry
+and preserve native feed scrolling in the inline surface.
+
+Games that intentionally support inline gameplay can opt in through
+`startDevvitWebView`; the generated default uses `startDevvitPreviewWebView`.
+An opt-in inline surface must remain tap/click based and preserve Reddit-native
+gestures across its complete gameplay flow.
+
+The bridge method handlers live in `src/server/bridge.ts`; `src/server/index.ts`
+only wires the Devvit `context`, `reddit`, and `redis` clients into them. Cloud
+saves are bound to the authenticated Reddit user from the request context and
+stored under `<game-name>:save:<user>:<key>`. Each value is capped at
+`maxStorageValueBytes` and each user may hold at most `maxStorageKeysPerPlayer`
+distinct keys, tracked in the `<game-name>:save-keys:<user>` hash and enforced
+inside a WATCH/MULTI/EXEC transaction so concurrent saves cannot overshoot the
+cap; saves past it fail with `DEVVIT_STORAGE_KEY_LIMIT`. Saves do not expire by
+default; set `storageEntryTtlSeconds` to let idle saves age out. Keep
+`bridge.ts` aligned with the kit's `apps/target-devvit/src/server/bridge.ts`
+when upgrading so generated games inherit storage protections.
+
+The generated bridge does not advertise or accept a generic platform
+leaderboard. Devvit ranking should be owned by a server completion handler that
+validates the game-specific attempt, records it through the verified leaderboard
+provider from `@mpgd/adapter-devvit/server`, and exposes only an authenticated
+game-scoped snapshot route. Do not enable `nativeLeaderboard` or trust a raw
+client score submission for that flow. Keep `remoteLeaderboard` disabled too;
+the verified completion route is not the generic `PlatformGateway` leaderboard.
+
+`devvit playtest` runs the official unified Vite build in watch mode, so a
+separate client/server watcher or staging prebuild is not required.
+
+## Durable Post Operations
+
+Use `src/server/postOperationStore.ts` with `@mpgd/adapter-devvit/server` for a
+server action or scheduler that may receive the same custom-post operation more
+than once. Use `{ appScope, subredditId }` as the scope, a stable `operationType`
+in the definition, and an `operationId` for each logical publication slot. Validate
+the public payload and launch parameters, then inject the Redis-backed store into
+`createDevvitPostOperationCoordinator`.
+
+The contract is duplicate-safe and ambiguity-safe, not exactly-once. It persists
+the attempt before invoking Reddit. If Reddit accepts the post but its response is
+lost, or the process stops before the receipt is saved, repeating `execute` returns
+`reconciliation-required` and never blindly calls the submit function again. An
+explicit recovery endpoint or scheduler calls `reconcile`, which requires an exact
+match of the full canonical envelope. A missing match from a bounded listing
+remains unresolved rather than restoring submit permission.
+
+The generated Redis wrapper implements `DevvitIndexedDurableOperationStore`.
+Use `listPending()` with a small limit and its scope-bound continuation cursor to
+discover prepared, attempted, and terminal work without scanning Redis keys.
+Listing is read-only; prepared work still requires an explicit `execute` decision,
+attempted work must use `reconcile`, and terminal ambiguity remains fail-closed.
+
+Keep operation definitions and `@devvit/web/server` imports inside this target
+app. The canonical `{ mpgd, launch, payload }` envelope is public and untrusted;
+keep private content and authoritative records in server-side storage. Exercise
+first success, duplicate calls, interruption,
+response loss, lease expiry with concurrent reconciliation, malformed durable
+state, invalid launch metadata, and cross-scope key isolation before enabling a
+scheduled or user-triggered publication flow.
+
+## AI-assisted Devvit development
+
+Devvit provides an optional MCP server for targeted documentation search and
+deployed-app log inspection. See the official
+[Devvit AI Tools guide](https://developers.reddit.com/docs/guides/ai), then
+register it once in the developer's global Codex configuration:
+
+```sh
+codex mcp add devvit -- mise --no-config exec node@22 -- npx -y @devvit/mcp@0.0.27
+```
+
+The server needs Node 22: `@devvit/mcp` 0.0.27 depends on `better-sqlite3`
+11.9.1, which ships prebuilt binaries for Node 22 but not 24 and does not
+build on 26. `--no-config` keeps mise from passing your mise-managed
+environment to the server. Without mise, register `npx -y @devvit/mcp@0.0.27`
+only if the MCP client's `PATH` resolves `npx` from Node 22. Running
+`codex mcp add devvit` again replaces an older registration.
+
+Restart Codex or begin a new task after registering it. Use `devvit_search`
+before broad Devvit documentation exploration. Use the experimental
+`devvit_logs` tool for a deployed app and subreddit when diagnosing production
+or playtest behavior, and confirm its findings with local tests and
+`pnpm devvit:playtest`.
+
+The MCP server is an agent-side aid only. It is not required by the generated
+game build, must not be bundled into target artifacts, and does not replace
+Devvit CLI authentication or release verification.

package/templates/lite-overlay/docs/MPGD_KIT_WORKFLOWS.md

@@ -0,0 +1,37 @@
+# mpgd-kit Lite Workflows
+
+Start with `agent/game-manifest.json`; enabled targets are build paths and future targets are design directions.
+
+| Concern | Owner |
+| --- | --- |
+| Deterministic rules and state | `src/game` |
+| Canvas2D rendering and input | `src/lite` through `@mpgd/lite-shell` |
+| Renderer mounting and teardown | `src/runtime/createGame.ts` |
+| Platform services | `src/platform` through `PlatformGateway` |
+| Target build configuration | `mpgd.targets.json` and `@mpgd/target-config` |
+| Runtime, recovery, and audio ownership | bootstrap and `@mpgd/game-runtime` |
+| Acceptance | `agent/acceptance.md` and `pnpm accept` |
+
+Use the generated icon and localization commands. Load browser images and fonts directly or through lite-shell font helpers; this template has no Phaser asset manifest.
+Keep deterministic state independent of Canvas2D, DOM, network, and SDKs.
+Reserve safe-area geometry once through CSS or viewport content bounds.
+Never call SDKs from renderer code or grant purchases/rewards from client callbacks.
+
+## Platform integration
+
+Choose the owning adapter in `src/platform/buildGateways`. Configure target features and service availability rather than bypassing them in game code.
+Keep commerce verification and grants in the backend ledger; use authenticated sessions and durable encrypted recovery journals.
+Construct one game runtime above renderer lifetimes, preserve native presentation ownership, and reconcile existing operations without reopening checkout.
+Use generated target build/smoke and effective-config checks before changing a release contract.
+
+## Devvit
+
+`apps/target-devvit` owns Reddit SDK and deployment files. The lite inline entry is playable and the expanded entry uses the same Canvas2D game.
+Preserve native feed gestures. Keep optional heavy engines behind declared dynamic imports; static imports, HTML preloads, and CSS imports count toward first-load budget.
+Use configured Devvit documentation/MCP for SDK or publish-flow changes and run real playtest for platform acceptance.
+
+## Target handoff
+
+Run focused checks, `pnpm check`, `pnpm build`, and `pnpm accept`. Preserve generated evidence.
+Use official target tooling and configured skills for native signing, Apps in Toss, ONE play, and Verse8 acceptance.
+Keep credentials, signing material, and personal MCP configuration out of source control.

package/templates/lite-overlay/src/lite/tapGame.ts

@@ -0,0 +1,77 @@
+import {
+  createCanvasRenderer,
+  createLiteShell,
+  type CanvasSurface,
+  type LiteShell,
+} from '@mpgd/lite-shell';
+
+import { createStarterRunState, stepStarterRunState, type StarterRunState } from '../game/state';
+
+export interface TapGameOptions {
+  readonly mount: HTMLElement;
+  readonly title: string;
+  readonly onHit?: (hits: number) => void;
+}
+
+/**
+ * Renderer-agnostic starter gameplay: tap the orbiting target. State lives in
+ * `src/game/state.ts`; this file only draws and routes taps. Swap
+ * `createCanvasRenderer` for another `LiteRenderer` (dom/svg) when one exists.
+ */
+export function createTapGame(options: TapGameOptions): LiteShell<CanvasSurface> {
+  let run: StarterRunState = createStarterRunState();
+  let hits = 0;
+  let pulse = 0;
+  const target = (width: number, height: number) => {
+    const angle = run.phase * Math.PI * 2;
+    const radius = Math.min(width, height) * 0.28;
+    return {
+      x: width / 2 + Math.cos(angle) * radius,
+      y: height / 2 + Math.sin(angle) * radius,
+      r: 22,
+    };
+  };
+
+  const shell = createLiteShell<CanvasSurface>({
+    mount: options.mount,
+    renderer: createCanvasRenderer(),
+    frame({ context, size }, deltaMs) {
+      run = stepStarterRunState(run, deltaMs);
+      pulse = Math.max(0, pulse - deltaMs / 300);
+      const { width, height } = size;
+      context.fillStyle = '#07111f';
+      context.fillRect(0, 0, width, height);
+      const dot = target(width, height);
+      context.beginPath();
+      context.arc(dot.x, dot.y, dot.r * (1 + pulse * 0.4), 0, Math.PI * 2);
+      context.fillStyle = pulse > 0 ? '#5eead4' : '#38bdf8';
+      context.fill();
+      context.fillStyle = '#ffffff';
+      context.font = '600 16px system-ui, sans-serif';
+      context.textAlign = 'center';
+      context.fillText(`${options.title} · ${hits}`, width / 2, 28);
+      // Keep animating only while the document is visible; the loop sleeps otherwise.
+      return document.visibilityState === 'visible';
+    },
+    onTap({ x, y }) {
+      const dot = target(shell.size.width, shell.size.height);
+      if (Math.hypot(x - dot.x, y - dot.y) <= dot.r * 1.6) {
+        hits += 1;
+        pulse = 1;
+        options.onHit?.(hits);
+      }
+    },
+  });
+  const onVisibilityChange = (): void => shell.invalidate();
+  document.addEventListener('visibilitychange', onVisibilityChange);
+  return {
+    ...shell,
+    get size() {
+      return shell.size;
+    },
+    dispose() {
+      document.removeEventListener('visibilitychange', onVisibilityChange);
+      shell.dispose();
+    },
+  };
+}

package/templates/lite-overlay/src/platform/devvitEntrypoint.ts

@@ -0,0 +1,116 @@
+import { requestDevvitExpandedMode, startDevvitPreviewWebView } from '@mpgd/adapter-devvit/web';
+
+import { createTapGame } from '../lite/tapGame';
+
+const expandedRequestRecoveryMs = 8_000;
+
+await startDevvitPreviewWebView({
+  async mountInlinePreview() {
+    await import('./devvitInlineMode.css');
+    renderInlineLaunchScreen();
+  },
+  async loadExpandedGame() {
+    await import('../main');
+  },
+  onModeUnavailable(error) {
+    if (!(error instanceof ReferenceError)) {
+      console.warn('[devvit] web view mode unavailable; loading expanded gameplay.', error);
+    }
+  },
+});
+
+function renderInlineLaunchScreen(): void {
+  const launchScreen = document.createElement('main');
+  launchScreen.className = 'devvit-launch-screen';
+
+  const eyebrow = document.createElement('p');
+  eyebrow.className = 'devvit-launch-screen__eyebrow';
+  eyebrow.textContent = 'Play in feed';
+
+  const title = document.createElement('h1');
+  title.textContent = '__GAME_TITLE__';
+
+  const description = document.createElement('p');
+  description.className = 'devvit-launch-screen__description';
+  description.textContent = 'Tap to play here, or open the full game.';
+
+  // Lite template: the inline surface is playable. It uses the same lite shell
+  // as the expanded game, never loads Phaser, and keeps feed scrolling (taps only).
+  const stage = document.createElement('div');
+  stage.className = 'devvit-launch-screen__stage';
+  stage.style.width = 'min(100%, 22rem)';
+  stage.style.height = '9rem';
+
+  const actions = document.createElement('div');
+  actions.className = 'devvit-launch-screen__actions';
+
+  const expandButton = document.createElement('button');
+  expandButton.className = 'devvit-launch-screen__button';
+  expandButton.type = 'button';
+  expandButton.textContent = 'Play full screen';
+
+  const status = document.createElement('p');
+  status.className = 'devvit-launch-screen__status';
+  status.setAttribute('aria-live', 'polite');
+  status.setAttribute('role', 'status');
+
+  let nextRequestId = 0;
+  let activeRequestId: number | undefined;
+  let recoveryTimeout: ReturnType<typeof globalThis.setTimeout> | undefined;
+  const recover = (requestId: number, message: string) => {
+    if (activeRequestId !== requestId) {
+      return;
+    }
+
+    activeRequestId = undefined;
+    if (recoveryTimeout !== undefined) {
+      globalThis.clearTimeout(recoveryTimeout);
+      recoveryTimeout = undefined;
+    }
+
+    expandButton.disabled = false;
+    status.textContent = message;
+  };
+  expandButton.addEventListener('click', (event) => {
+    const requestId = ++nextRequestId;
+
+    activeRequestId = requestId;
+    expandButton.disabled = true;
+    status.textContent = 'Opening full screen…';
+    recoveryTimeout = globalThis.setTimeout(() => {
+      recover(requestId, 'Full screen did not open. Try again.');
+    }, expandedRequestRecoveryMs);
+
+    void requestDevvitExpandedMode(event, 'game')
+      .catch((error: unknown) => {
+        console.error('[devvit] expanded mode request failed.', error);
+        recover(requestId, 'Full screen is unavailable. Try again.');
+      });
+  });
+  const recoverAfterReturn = () => {
+    if (activeRequestId !== undefined) {
+      recover(activeRequestId, '');
+    }
+  };
+  globalThis.addEventListener('focus', recoverAfterReturn);
+  globalThis.addEventListener('pageshow', recoverAfterReturn);
+
+  actions.append(expandButton);
+  launchScreen.append(eyebrow, title, description, stage, actions, status);
+  const body = requireDocumentBody();
+
+  body.classList.add('devvit-inline-mode-host');
+  delete body.dataset.mpgdPreserveBrowserTouchGestures;
+  body.replaceChildren(launchScreen);
+  createTapGame({ mount: stage, title: '__GAME_TITLE__' });
+}
+
+function requireDocumentBody(): HTMLElement {
+  const body = document.body;
+
+  if (body === null) {
+    throw new Error('Devvit inline mode requires a document body.');
+  }
+
+  return body;
+}

package/templates/lite-overlay/src/platform/devvitInlineMode.css

@@ -0,0 +1,146 @@
+html,
+body {
+  width: 100%;
+  height: 100%;
+  margin: 0;
+  overflow: hidden;
+  overscroll-behavior: auto;
+  touch-action: pan-y;
+}
+
+body.devvit-inline-mode-host {
+  background: #0f172a;
+}
+
+.devvit-launch-screen,
+.devvit-launch-screen * {
+  box-sizing: border-box;
+}
+
+.devvit-launch-screen {
+  position: fixed;
+  inset: 0;
+  width: 100%;
+  height: 100dvh;
+  overflow: hidden;
+  display: grid;
+  place-content: safe center;
+  justify-items: center;
+  gap: 0.75rem;
+  --inline-padding-block: clamp(1.25rem, 5vw, 3rem);
+  --inline-padding-inline: clamp(1.25rem, 5vw, 3rem);
+  padding-block:
+    calc(var(--inline-padding-block) + env(safe-area-inset-top, 0px))
+    calc(var(--inline-padding-block) + env(safe-area-inset-bottom, 0px));
+  padding-inline:
+    calc(var(--inline-padding-inline) + env(safe-area-inset-left, 0px))
+    calc(var(--inline-padding-inline) + env(safe-area-inset-right, 0px));
+  background:
+    radial-gradient(circle at 85% 15%, rgb(56 189 248 / 0.2), transparent 38%),
+    linear-gradient(145deg, #0f172a, #172554);
+  color: #f8fafc;
+  font-family: Inter, ui-sans-serif, system-ui, sans-serif;
+  text-align: center;
+  touch-action: pan-y;
+}
+
+.devvit-launch-screen__eyebrow,
+.devvit-launch-screen__description,
+.devvit-launch-screen__status,
+.devvit-launch-screen h1 {
+  margin: 0;
+}
+
+.devvit-launch-screen__eyebrow {
+  color: #7dd3fc;
+  font-size: 0.75rem;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
+
+.devvit-launch-screen h1 {
+  display: -webkit-box;
+  max-width: 18ch;
+  max-height: 1.9em;
+  overflow: hidden;
+  font-size: clamp(2rem, 9vw, 4.5rem);
+  line-height: 0.95;
+  overflow-wrap: anywhere;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 2;
+  line-clamp: 2;
+}
+
+.devvit-launch-screen__description {
+  max-width: 36rem;
+  color: #cbd5e1;
+  line-height: 1.5;
+}
+
+.devvit-launch-screen__actions {
+  width: min(100%, 22rem);
+  display: grid;
+  margin-top: 0.5rem;
+}
+
+.devvit-launch-screen__button {
+  min-height: 2.75rem;
+  padding: 0.65rem 1.25rem;
+  border: 1px solid transparent;
+  border-radius: 999px;
+  color: #082f49;
+  background: #7dd3fc;
+  font: inherit;
+  font-weight: 800;
+  cursor: pointer;
+}
+
+.devvit-launch-screen__button:disabled {
+  cursor: wait;
+  opacity: 0.65;
+}
+
+.devvit-launch-screen__button:focus-visible {
+  outline: 3px solid #f8fafc;
+  outline-offset: 3px;
+}
+
+.devvit-launch-screen__status {
+  min-height: 1.5em;
+  color: #fda4af;
+  font-size: 0.875rem;
+}
+
+@media (hover: hover) {
+  .devvit-launch-screen__button:not(:disabled):hover {
+    filter: brightness(1.1);
+  }
+}
+
+@media (max-width: 420px) {
+  .devvit-launch-screen__actions,
+  .devvit-launch-screen__button {
+    width: 100%;
+  }
+}
+
+@media (max-height: 440px) {
+  .devvit-launch-screen {
+    gap: 0.45rem;
+    --inline-padding-block: 0.5rem;
+  }
+
+  .devvit-launch-screen h1 {
+    font-size: clamp(1.75rem, 8vw, 2.5rem);
+  }
+
+  .devvit-launch-screen__description {
+    font-size: 0.875rem;
+    line-height: 1.3;
+  }
+
+  .devvit-launch-screen__actions {
+    margin-top: 0.2rem;
+  }
+}

package/templates/lite-overlay/src/runtime/createGame.ts

@@ -0,0 +1,57 @@
+import { bindGameAudio } from '@mpgd/game-runtime/audio';
+import type { CanvasSurface, LiteShell } from '@mpgd/lite-shell';
+
+import { createTapGame } from '../lite/tapGame';
+import type { StarterContext } from './gameContext';
+
+/** Lite template: no Phaser. Mount a renderer-agnostic lite shell into the game element. */
+export function createStarterGame(input: {
+  readonly mountId: string;
+  readonly preserveBrowserTouchGestures?: boolean;
+  readonly context: StarterContext;
+}): LiteShell<CanvasSurface> {
+  const mount = document.getElementById(input.mountId);
+  if (mount === null) {
+    throw new Error(`Missing game mount #${input.mountId}.`);
+  }
+  mount.style.width = '100%';
+  mount.style.height = '100%';
+  let muted = false;
+  const audio = bindGameAudio({
+    execution: input.context.gameRuntime.execution,
+    sink: {
+      getMuted: () => muted,
+      setMuted: (next) => {
+        muted = next;
+      },
+    },
+    onError: (error) => {
+      console.error('[game-audio]', error);
+    },
+  });
+  const shell = createTapGame({ mount, title: '__GAME_TITLE__' });
+  let disposed = false;
+  const dispose = (): void => {
+    if (disposed) {
+      return;
+    }
+    disposed = true;
+    globalThis.removeEventListener('pagehide', onPageHide);
+    audio.dispose();
+    input.context.gameRuntime.dispose();
+    shell.dispose();
+  };
+  const onPageHide = (event: PageTransitionEvent): void => {
+    if (!event.persisted) {
+      dispose();
+    }
+  };
+  globalThis.addEventListener('pagehide', onPageHide);
+  return {
+    ...shell,
+    get size() {
+      return shell.size;
+    },
+    dispose,
+  };
+}

package/templates/phaser-game/AGENTS.md

@@ -27,6 +27,11 @@ This repository is a standalone Phaser game generated with `@mpgd/create-game`.
 
 ## Tooling and checks
 
+- Author game code, tests, and development tools in TypeScript (`.ts`). Include every tool in
+  `tsconfig.tools.json` and run it with `ttsx --project tsconfig.tools.json`.
+- Use `.mjs`, `.cjs`, or authored `.js` only when a concrete consumer cannot run TypeScript
+  (for example a browser fixture or a JavaScript-only config loader). Document that constraint
+  beside the file. Convenience or avoiding type errors is not an exception.
 - Use `ttsx`, not `tsx`, for TypeScript scripts.
 - Use `ttsc` and `@ttsc/lint`; do not add ESLint or Prettier for TypeScript.
 - Run focused checks, then `pnpm check` and `pnpm build`.

package/templates/phaser-game/README.md

@@ -459,9 +459,11 @@ HTTPS game-services backend that verifies purchase or reward evidence.
   Verse8-signed accounts from self-signed guest accounts. Ads are available
   only when placement mappings are present. VXShop stays capability-disabled
   until the gateway receives the literal `purchaseEventAuthority:
-  'agent8-server'`, catalog product mappings, and an authenticated Agent8
-  entitlement reader. The client purchase result is always `pending`; grants
-  belong only in the reserved Agent8 `$onItemPurchased` event. Do not use
+  'agent8-server'`, catalog product mappings, and `purchases`, an
+  authenticated Agent8 source (`listPurchases`) for the purchases the server
+  recorded. The client purchase result is always `launched`; grants belong
+  only in the reserved Agent8 `$onItemPurchased` event, which the backend
+  ledger looks up when the reconciler verifies the purchase. Do not use
   `VXShop.onClose`, client metadata, or a client-created transaction ID as
   purchase evidence. Keep `@agent8/gameserver-node` in the separate Agent8
   server project and use `@mpgd/adapter-verse8/agent8` there for the locked,

package/templates/phaser-game/apps/target-ait/package.json

@@ -16,14 +16,14 @@
     "fix": "ttsc fix"
   },
   "dependencies": {
-    "@apps-in-toss/web-framework": "3.5.0",
+    "@apps-in-toss/web-framework": "3.6.0",
     "@mpgd/adapter-ait": "__MPGD_DEPENDENCY_VERSION_ADAPTER_AIT__"
   },
   "devDependencies": {
-    "@apps-in-toss/cli": "3.5.0",
-    "@ttsc/unplugin": "0.30.4",
+    "@apps-in-toss/cli": "3.6.0",
+    "@ttsc/unplugin": "0.32.1",
     "@types/node": "^24.0.0",
-    "ttsc": "0.30.4",
+    "ttsc": "0.32.1",
     "typescript": "7.0.2",
     "vite": "8.1.3"
   }

package/templates/phaser-game/apps/target-ait/src/main.ts

@@ -26,14 +26,14 @@ if (app !== null) {
  * The IAP products come from the catalog (`platformProductIds.ait`) at build
  * time, so the wrapper and the game agree on every SKU. The host bridge still
  * sells nothing until the game supplies its server hooks (`prepareIap`,
- * `verifyIapProductGrant`, `readIapEntitlements`, see the mpgd-kit
- * APPS_IN_TOSS_PRODUCTION_EVIDENCE guide): without them every purchase and
- * every `commerce.v2.*` method fails closed, and the grant callback only ever
- * confirms through the game backend.
+ * `verifyIapProductGrant`, see the mpgd-kit APPS_IN_TOSS_PRODUCTION_EVIDENCE
+ * guide): without them every purchase and every `commerce.v2.*` method fails
+ * closed, and the grant callback only ever confirms through the game backend.
+ * Ownership is read from the backend ledger, not from the wrapper.
  */
 function iapBridgeOptions(): Pick<
   InstallAitHostBridgeOptions,
-  'iapProducts' | 'prepareIap' | 'verifyIapProductGrant' | 'readIapEntitlements'
+  'iapProducts' | 'prepareIap' | 'verifyIapProductGrant'
 > {
   return runtimeConfig.iapProducts.length === 0 ? {} : { iapProducts: runtimeConfig.iapProducts };
 }

package/templates/phaser-game/apps/target-cloudflare-pages/package.json

@@ -19,8 +19,8 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260707.1",
-    "@ttsc/unplugin": "0.30.4",
-    "ttsc": "0.30.4",
+    "@ttsc/unplugin": "0.32.1",
+    "ttsc": "0.32.1",
     "typescript": "7.0.2",
     "vite": "8.1.3",
     "wrangler": "^4.107.0"

package/templates/phaser-game/apps/target-devvit/package.json

@@ -26,10 +26,10 @@
   },
   "devDependencies": {
     "@devvit/start": "0.14.1",
-    "@ttsc/unplugin": "0.30.4",
+    "@ttsc/unplugin": "0.32.1",
     "@types/node": "^24.0.0",
     "devvit": "0.14.1",
-    "ttsc": "0.30.4",
+    "ttsc": "0.32.1",
     "typescript": "7.0.2",
     "vite": "7.3.6"
   }