@mpgd/cli 0.53.0 → 0.54.1

package/dist/legal-site-output.js

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Legal-site paths are contained only after the nearest existing ancestor is
+ * canonicalized. A lexical `path.relative` check treats a symlinked `artifacts`
+ * directory as inside the project while later writes follow the link.
+ */
+export function assertLegalProjectPath(label, resolved) {
+    const lexicalRoot = process.cwd();
+    const lexical = path.relative(lexicalRoot, resolved);
+    if (lexical.startsWith('..') || path.isAbsolute(lexical)) {
+        throw new Error(`${label} must be inside the project root: ${resolved}`);
+    }
+    assertNoLegalSymlink(lexicalRoot, resolved, label);
+    const canonicalRoot = realpathSync(lexicalRoot);
+    const canonical = realpathBestEffort(resolved);
+    const canonicalRelative = path.relative(canonicalRoot, canonical);
+    if (canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative)) {
+        throw new Error(`${label} must be inside the project root: ${resolved}`);
+    }
+}
+/** Stage the site beside the destination, then publish with rename. */
+export function publishLegalSiteFiles(outDir, outputs) {
+    assertLegalProjectPath('out-dir', outDir);
+    // A temp dir on the project root is a different filesystem when out-dir is a
+    // mount or sits under a bind-mounted artifacts directory. Rename then fails
+    // with EXDEV. Stage on the destination filesystem instead.
+    const staging = path.join(legalStagingParent(outDir), `.mpgd-legal-${randomUUID()}`);
+    let publishedDirectory = false;
+    try {
+        for (const output of outputs) {
+            const relative = path.relative(outDir, output.file);
+            if (relative.startsWith('..') || path.isAbsolute(relative)) {
+                throw new Error(`Legal site output escapes the output directory: ${output.file}`);
+            }
+            const staged = path.join(staging, relative);
+            mkdirSync(path.dirname(staged), { recursive: true });
+            writeFileSync(staged, output.content, { flag: 'wx' });
+        }
+        assertLegalProjectPath('out-dir', outDir);
+        let existing;
+        try {
+            existing = lstatSync(outDir);
+        }
+        catch (error) {
+            if (!isErrno(error, 'ENOENT')) {
+                throw error;
+            }
+        }
+        if (existing?.isSymbolicLink() === true) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${outDir}`);
+        }
+        if (existing === undefined) {
+            ensureLegalDirectory(path.dirname(outDir));
+            assertLegalProjectPath('out-dir', outDir);
+            renameSync(staging, outDir);
+            publishedDirectory = true;
+            return;
+        }
+        if (!existing.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${outDir}`);
+        }
+        for (const output of outputs) {
+            assertNoLegalSymlink(process.cwd(), output.file, 'out-dir');
+            ensureLegalDirectory(path.dirname(output.file));
+            assertNoLegalSymlink(process.cwd(), output.file, 'out-dir');
+            renameSync(path.join(staging, path.relative(outDir, output.file)), output.file);
+        }
+    }
+    finally {
+        if (!publishedDirectory) {
+            rmSync(staging, { recursive: true, force: true });
+        }
+    }
+}
+/**
+ * Parent for the staging directory. An existing out-dir may itself be a mount,
+ * so stage inside it. A missing out-dir is created on its nearest existing
+ * ancestor, which is the filesystem the later rename must stay on.
+ */
+function legalStagingParent(outDir) {
+    const existing = lstatIfPresent(outDir);
+    if (existing !== undefined) {
+        if (existing.isSymbolicLink()) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${outDir}`);
+        }
+        if (!existing.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${outDir}`);
+        }
+        return outDir;
+    }
+    let current = path.dirname(outDir);
+    for (;;) {
+        const stat = lstatIfPresent(current);
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Refusing to write legal site output through a symbolic link: ${current}`);
+            }
+            if (!stat.isDirectory()) {
+                throw new Error(`Legal site output path is not a directory: ${current}`);
+            }
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            throw new Error(`out-dir must be inside the project root: ${outDir}`);
+        }
+        current = parent;
+    }
+}
+function lstatIfPresent(target) {
+    try {
+        return lstatSync(target);
+    }
+    catch (error) {
+        if (isErrno(error, 'ENOENT')) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+/** Resolve symlinks for the longest existing ancestor, keeping the remainder. */
+function realpathBestEffort(target) {
+    // lstat-based existence stops the walk at dangling symlinks, so realpath
+    // fails closed on them instead of lexically skipping the link.
+    const exists = (candidate) => {
+        try {
+            lstatSync(candidate);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    let existing = target;
+    while (!exists(existing)) {
+        const parent = path.dirname(existing);
+        if (parent === existing) {
+            return existing;
+        }
+        existing = parent;
+    }
+    let real;
+    try {
+        real = realpathSync(existing);
+    }
+    catch (error) {
+        throw new Error(`Legal site path resolves through a broken symbolic link: ${target}`, {
+            cause: error,
+        });
+    }
+    return existing === target ? real : path.resolve(real, path.relative(existing, target));
+}
+function assertNoLegalSymlink(root, target, label) {
+    const relative = path.relative(root, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`${label} must be inside the project root: ${target}`);
+    }
+    const verb = label === 'legal-dir' ? 'read legal sources' : 'write legal site output';
+    let current = root;
+    for (const part of relative.split(path.sep)) {
+        if (part === '' || part === '.') {
+            continue;
+        }
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (isErrno(error, 'ENOENT')) {
+                return;
+            }
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Refusing to ${verb} through a symbolic link: ${current}`);
+        }
+    }
+}
+function ensureLegalDirectory(directory) {
+    const root = process.cwd();
+    const relative = path.relative(root, directory);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`out-dir must be inside the project root: ${directory}`);
+    }
+    if (relative === '') {
+        return;
+    }
+    let current = root;
+    for (const part of relative.split(path.sep)) {
+        if (part === '' || part === '.') {
+            continue;
+        }
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (!isErrno(error, 'ENOENT')) {
+                throw error;
+            }
+            try {
+                mkdirSync(current);
+                continue;
+            }
+            catch (mkdirError) {
+                if (!isErrno(mkdirError, 'EEXIST')) {
+                    throw mkdirError;
+                }
+                stat = lstatSync(current);
+            }
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${current}`);
+        }
+        if (!stat.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${current}`);
+        }
+    }
+}
+function isErrno(error, code) {
+    return error !== null && typeof error === 'object' && 'code' in error && error.code === code;
+}

package/dist/native-build-info.json

@@ -1,5 +1,5 @@
 {
-  "kitGitSha": "78bcaad6a3e53131be44f749c27b9377a2fd96dc",
+  "kitGitSha": "ed8837541cc3c5737c21638a596ba2dc121112da",
   "kitDirty": false,
-  "packageVersion": "0.53.0"
+  "packageVersion": "0.54.1"
 }

package/dist/native-build-target.js

@@ -6899,6 +6899,72 @@ var timestampPattern = new RegExp("^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})
 var fcmAddressKinds = Object.freeze(["fcm-token"]);
 var fcmReservedDataKeys = Object.freeze(["topic", "route"]);
 var tokenRefreshMarginMs = 5 * 60 * 1e3;
+var sha256K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
 
 // node_modules/.cache/mpgd-native-build/packages/game-services/src/notifications/registry.js
 var notificationHistoryRetentionDays = 30;
@@ -9436,9 +9502,21 @@ var assertReleaseManifestStructure = /* @__PURE__ */ (() => {
   };
 })();
 var fullGitShaPattern = /^[0-9a-f]{40}$/u;
+var sha256DigestPattern = /^[0-9a-f]{64}$/u;
 function assertReleaseManifest(input) {
   const manifest = assertReleaseManifestStructure(input);
+  if (!fullGitShaPattern.test(manifest.gitSha)) {
+    throw new TypeError("Release manifest gitSha must be a lowercase 40-character SHA.");
+  }
+  if (!fullGitShaPattern.test(manifest.kitGitSha)) {
+    throw new TypeError("Release manifest kitGitSha must be a lowercase 40-character SHA.");
+  }
   for (const [target2, entry] of Object.entries(manifest.targets)) {
+    assertSha256Digest(entry.effectiveConfig.digest, `Release manifest ${target2} effectiveConfig.digest`);
+    assertSha256Digest(entry.iconManifest.digest, `Release manifest ${target2} iconManifest.digest`);
+    assertSha256Digest(entry.iconManifest.sourceSha256, `Release manifest ${target2} iconManifest.sourceSha256`);
+    assertSha256Digest(entry.iconManifest.sharedConfigSha256, `Release manifest ${target2} iconManifest.sharedConfigSha256`);
+    assertSha256Digest(entry.iconManifest.renderConfigSha256, `Release manifest ${target2} iconManifest.renderConfigSha256`);
     const delivery = entry.nativeDelivery;
     if (delivery === void 0) {
       continue;
@@ -9453,9 +9531,6 @@ function assertReleaseManifest(input) {
       throw new TypeError(`Release manifest production native delivery is unsigned: ${target2}.`);
     }
   }
-  if (!fullGitShaPattern.test(manifest.kitGitSha)) {
-    throw new TypeError("Release manifest kitGitSha must be a lowercase 40-character SHA.");
-  }
   if (manifest.releaseIdentity !== void 0) {
     const releaseIdentity = createMpgdReleaseIdentity({
       gameVersion: manifest.releaseIdentity.gameVersion,
@@ -9477,6 +9552,11 @@ function assertReleaseManifest(input) {
   }
   return manifest;
 }
+function assertSha256Digest(value, label) {
+  if (!sha256DigestPattern.test(value)) {
+    throw new TypeError(`${label} must be a lowercase 64-character SHA-256 digest.`);
+  }
+}
 
 // node_modules/.cache/mpgd-native-build/tools/target/release-manifest-lock.js
 import { randomUUID } from "node:crypto";
@@ -9575,7 +9655,7 @@ function canRecoverLock(lockFile) {
 // node_modules/.cache/mpgd-native-build/tools/target/generate-release-manifest.js
 var __typia_transform__accessExpressionAsString6 = _accessExpressionAsString_110._accessExpressionAsString;
 var assertProductCatalog = /* @__PURE__ */ (() => {
-  const _ae0 = '({ readonly type: "currency"; readonly currency: string & MinLength<1>; readonly amount: number; } | { readonly type: "entitlement"; readonly entitlement: string; } | { readonly type: "resource"; readonly resource: string & MinLength<1>; readonly amount: number & ExclusiveMinimum<0> & Maximum<1.7976931348623157e+308>; })';
+  const _ae0 = '({ readonly type: "currency"; readonly currency: string & MinLength<1>; readonly amount: PositiveLedgerAmount; } | { readonly type: "entitlement"; readonly entitlement: string; } | { readonly type: "resource"; readonly resource: string & MinLength<1>; readonly amount: number & ExclusiveMinimum<0> & Maximum<1.7976931348623157e+308>; })';
   const _ao0 = (input, _path, _exceptionable = true) => ("string" === typeof input.version || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".version",
@@ -9673,10 +9753,25 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
     path: _path + ".currency",
     expected: "(string & MinLength<1>)",
     value: input.currency
-  }, _errorFactory)) && ("number" === typeof input.amount || _assertGuard_19._assertGuard(_exceptionable, {
+  }, _errorFactory)) && ("number" === typeof input.amount && (1 <= input.amount || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".amount",
-    expected: "number",
+    expected: "number & Minimum<1>",
+    value: input.amount
+  }, _errorFactory)) && (input.amount <= 9007199254740991 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & Maximum<9007199254740991>",
+    value: input.amount
+  }, _errorFactory)) && (input.amount % 1 === 0 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & MultipleOf<1>",
+    value: input.amount
+  }, _errorFactory)) || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "(number & Minimum<1> & Maximum<9007199254740991> & MultipleOf<1>)",
     value: input.amount
   }, _errorFactory));
   const _ao3 = (input, _path, _exceptionable = true) => ("entitlement" === input.type || _assertGuard_19._assertGuard(_exceptionable, {
@@ -9749,7 +9844,7 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
   })();
   const _io0 = (input) => "string" === typeof input.version && (void 0 === input.currencies || Array.isArray(input.currencies) && (1 <= input.currencies.length && input.currencies.every((elem) => "string" === typeof elem && 1 <= elem.length))) && (Array.isArray(input.products) && input.products.every((elem) => "object" === typeof elem && null !== elem && _io1(elem)));
   const _io1 = (input) => "string" === typeof input.id && ("consumable" === input.type || "non_consumable" === input.type || "subscription" === input.type) && ("object" === typeof input.grant && null !== input.grant && _iu0(input.grant)) && ("object" === typeof input.platformProductIds && null !== input.platformProductIds && false === Array.isArray(input.platformProductIds) && _io5(input.platformProductIds));
-  const _io2 = (input) => "currency" === input.type && ("string" === typeof input.currency && 1 <= input.currency.length) && "number" === typeof input.amount;
+  const _io2 = (input) => "currency" === input.type && ("string" === typeof input.currency && 1 <= input.currency.length) && ("number" === typeof input.amount && (1 <= input.amount && input.amount <= 9007199254740991 && input.amount % 1 === 0));
   const _io3 = (input) => "entitlement" === input.type && "string" === typeof input.entitlement;
   const _io4 = (input) => "resource" === input.type && ("string" === typeof input.resource && 1 <= input.resource.length) && ("number" === typeof input.amount && (0 < input.amount && input.amount <= 17976931348623157e292));
   const _io5 = (input) => Object.keys(input).every((key) => {
@@ -9789,16 +9884,31 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
   };
 })();
 var assertAdPlacements = /* @__PURE__ */ (() => {
-  const _ip0 = (input) => "number" === typeof input["amount"];
+  const _ip0 = (input) => "number" === typeof input["amount"] && (1 <= input["amount"] && input["amount"] <= 9007199254740991 && input["amount"] % 1 === 0);
   const _ae0 = '(AdPlacementEntryBase & { readonly type: "banner" | "interstitial"; readonly reward?: never; } | AdPlacementEntryBase & { readonly type: "rewarded"; readonly reward?: AdReward; })';
-  const _ae1 = '(undefined | { readonly type: "continue"; readonly amount: number; } | { readonly type: "currency"; readonly amount: number; readonly currency: string & MinLength<1>; })';
-  const _ap0 = (input, _path, _exceptionable = true) => "number" === typeof input["amount"] || _assertGuard_19._assertGuard(_exceptionable, {
+  const _ae1 = '(undefined | { readonly type: "continue"; readonly amount: PositiveLedgerAmount; } | { readonly type: "currency"; readonly amount: PositiveLedgerAmount; readonly currency: string & MinLength<1>; })';
+  const _ap0 = (input, _path, _exceptionable = true) => "number" === typeof input["amount"] && (1 <= input["amount"] || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".amount",
-    expected: "number",
+    expected: "number & Minimum<1>",
+    value: input["amount"]
+  }, _errorFactory)) && (input["amount"] <= 9007199254740991 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & Maximum<9007199254740991>",
+    value: input["amount"]
+  }, _errorFactory)) && (input["amount"] % 1 === 0 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & MultipleOf<1>",
+    value: input["amount"]
+  }, _errorFactory)) || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "(number & Minimum<1> & Maximum<9007199254740991> & MultipleOf<1>)",
     value: input["amount"]
   }, _errorFactory);
-  const _ae2 = '({ readonly type: "continue"; readonly amount: number; } | { readonly type: "currency"; readonly amount: number; readonly currency: string & MinLength<1>; })';
+  const _ae2 = '({ readonly type: "continue"; readonly amount: PositiveLedgerAmount; } | { readonly type: "currency"; readonly amount: PositiveLedgerAmount; readonly currency: string & MinLength<1>; })';
   const _ao0 = (input, _path, _exceptionable = true) => ("string" === typeof input.version || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".version",
@@ -10307,9 +10417,47 @@ function readSdkMajor(envValue, metadataValue) {
 function getSourceGitSha(kitGitSha) {
   const configuredGitSha = readOptionalString2(process.env.MPGD_SOURCE_GIT_SHA);
   if (configuredGitSha !== void 0) {
-    return configuredGitSha;
+    return requireFullGitSha(configuredGitSha, "MPGD_SOURCE_GIT_SHA");
   }
-  return kitGitSha;
+  if (isInRepoKitBuild()) {
+    return inRepoKitSourceGitSha(kitGitSha);
+  }
+  throw new Error("MPGD_SOURCE_GIT_SHA is required for a downstream game build and must be a lowercase 40-character SHA. Refusing to record the kit revision as the game revision.");
+}
+function inRepoKitSourceGitSha(kitGitSha) {
+  return requireFullGitSha(kitGitSha, "in-repo kit source Git SHA");
+}
+function isInRepoKitBuild() {
+  if (process.env.MPGD_NATIVE_PACKAGED_BUILD === "1") {
+    return false;
+  }
+  const targetsFile = readOptionalString2(process.env.MPGD_PLATFORM_TARGETS_FILE);
+  if (targetsFile === void 0) {
+    return true;
+  }
+  return isInsideDirectory(resolveKitRoot(), targetsFile);
+}
+function isInsideDirectory(root, candidate) {
+  let resolvedRoot;
+  try {
+    resolvedRoot = realpathSync6(root);
+  } catch {
+    return false;
+  }
+  const resolvedCandidate = resolve12(candidate);
+  let comparable = resolvedCandidate;
+  try {
+    comparable = realpathSync6(resolvedCandidate);
+  } catch {
+  }
+  const rel = relative9(resolvedRoot, comparable);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute8(rel);
+}
+function requireFullGitSha(value, label) {
+  if (!/^[0-9a-f]{40}$/u.test(value)) {
+    throw new Error(`${label} must be a lowercase 40-character SHA.`);
+  }
+  return value;
 }
 function resolveKitGitSha() {
   if (process.env.MPGD_NATIVE_PACKAGED_BUILD === "1") {
@@ -14739,6 +14887,7 @@ var notificationsCapacitorGateways = Object.freeze({
 var notificationsCapacitorGatewayModules = Object.freeze([
   "src/platform/capacitorNotifications.ts",
   "src/platform/notifications.ts",
+  "src/platform/notificationBackend.ts",
   "src/platform/notificationSettings.ts",
   "src/platform/notificationOpens.ts"
 ]);
@@ -14749,6 +14898,9 @@ var notificationsCapacitorSupportFiles = Object.freeze([
   "tools/validate-notifications.ts",
   "docs/NOTIFICATIONS.md"
 ]);
+var notificationsCapacitorTemplateSupportFiles = Object.freeze([
+  "src/platform/serverSession.ts"
+]);
 
 // node_modules/.cache/mpgd-native-build/packages/cli/src/native-shell-identity.js
 function assertAndroidSettingsAppProject(source) {

package/dist/notifications-starter.d.ts

@@ -58,6 +58,12 @@ export declare const notificationsCapacitorGatewayModules: readonly string[];
 * catalog files they read, the validator, and the game's notifications doc.
 */
 export declare const notificationsCapacitorSupportFiles: readonly string[];
+/**
+* Files of the base game template the notifications modules import, which a
+* game created by an earlier CLI release may not have: written from the
+* template when missing, kept when the game has one.
+*/
+export declare const notificationsCapacitorTemplateSupportFiles: readonly string[];
 /** Whether a Capacitor gateway already registers a notifications provider. */
 export declare function capacitorGatewayRegistersNotifications(source: string): boolean;
 /**

package/dist/notifications-starter.js

@@ -460,6 +460,7 @@ export const notificationsCapacitorGateways = Object.freeze({
 export const notificationsCapacitorGatewayModules = Object.freeze([
     'src/platform/capacitorNotifications.ts',
     'src/platform/notifications.ts',
+    'src/platform/notificationBackend.ts',
     'src/platform/notificationSettings.ts',
     'src/platform/notificationOpens.ts',
 ]);
@@ -475,6 +476,14 @@ export const notificationsCapacitorSupportFiles = Object.freeze([
     'tools/validate-notifications.ts',
     'docs/NOTIFICATIONS.md',
 ]);
+/**
+ * Files of the base game template the notifications modules import, which a
+ * game created by an earlier CLI release may not have: written from the
+ * template when missing, kept when the game has one.
+ */
+export const notificationsCapacitorTemplateSupportFiles = Object.freeze([
+    'src/platform/serverSession.ts',
+]);
 /** Whether a Capacitor gateway already registers a notifications provider. */
 export function capacitorGatewayRegistersNotifications(source) {
     // One pass over strings and comments: neither registers anything, and a

package/dist/offline-playtest.js

@@ -3125,7 +3125,7 @@ function assembleOfflineHtml(html, bundledEntry, entryAttributes) {
         || output.indexOf(offlineEntryPlaceholder) !== output.lastIndexOf(offlineEntryPlaceholder)) {
         throw new Error('Offline playtest could not preserve the module entry position.');
     }
-    output = output.replace(offlineEntryPlaceholder, inlineScript);
+    output = output.replace(offlineEntryPlaceholder, () => inlineScript);
     if (findActiveHtmlStartTag(output, 'body') !== undefined) {
         return `${output.trim()}\n`;
     }

package/dist/tooling-migration.js

@@ -399,7 +399,7 @@ function migrateKnownRunner(source, template) {
         if (defaults.length !== 1) {
             return undefined;
         }
-        const rendered = template.replace("'__DEFAULT_KIT_PATH__'", JSON.stringify(defaults[0]));
+        const rendered = template.replace("'__DEFAULT_KIT_PATH__'", () => JSON.stringify(defaults[0]));
         const canonical = (value) => JSON.stringify(value, (key, item) => ['start', 'end', 'raw'].includes(key) ? undefined : item);
         return canonical(ast) === canonical(parse(rendered, { ecmaVersion: 'latest', sourceType: 'module' }))
             ? rendered

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -70,10 +70,10 @@
     "parse5": "7.3.0",
     "postcss": "8.5.28",
     "postcss-value-parser": "4.2.0",
-    "@mpgd/catalog": "0.10.4",
-    "@mpgd/platform": "0.26.0",
-    "@mpgd/target-config": "0.23.4",
-    "@mpgd/phaser-assets": "0.9.1"
+    "@mpgd/catalog": "0.10.6",
+    "@mpgd/platform": "0.27.1",
+    "@mpgd/phaser-assets": "0.9.1",
+    "@mpgd/target-config": "0.23.6"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
@@ -81,18 +81,18 @@
     "@types/yauzl": "3.4.0",
     "ttsc": "0.32.1",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.20.0",
-    "@mpgd/adapter-browser": "0.11.4",
-    "@mpgd/adapter-capacitor": "0.12.0",
-    "@mpgd/adapter-devvit": "0.13.2",
-    "@mpgd/adapter-verse8": "0.7.4",
-    "@mpgd/analytics": "0.4.13",
-    "@mpgd/bridge": "0.14.1",
-    "@mpgd/capacitor-storekit": "0.3.4",
-    "@mpgd/game-services": "0.26.0",
-    "@mpgd/capacitor-play-billing": "0.3.4",
-    "@mpgd/i18n": "0.6.18",
-    "@mpgd/game-runtime": "0.7.4",
+    "@mpgd/adapter-browser": "0.11.6",
+    "@mpgd/adapter-capacitor": "0.12.2",
+    "@mpgd/adapter-ait": "0.20.2",
+    "@mpgd/adapter-verse8": "0.7.6",
+    "@mpgd/bridge": "0.14.3",
+    "@mpgd/analytics": "0.4.15",
+    "@mpgd/adapter-devvit": "0.13.4",
+    "@mpgd/capacitor-play-billing": "0.3.6",
+    "@mpgd/capacitor-storekit": "0.3.6",
+    "@mpgd/game-runtime": "0.7.6",
+    "@mpgd/game-services": "0.27.1",
+    "@mpgd/i18n": "0.6.20",
     "@mpgd/lite-shell": "0.1.0"
   },
   "main": "./dist/index.js",

package/templates/notifications-overlay/common/docs/NOTIFICATIONS.md

@@ -57,13 +57,42 @@ left for you.
 
 Consent records (reminders, 광고성 정보 수신동의, night consent), endpoint
 registration, server reminders, and consent notices go through the game
-backend. The kit does not ship that runtime's backend client yet, so
-`createStarterNotificationBackend` in `src/platform/notifications.ts` returns
-`undefined` and the settings screen asks only for the OS or host permission
-(and withdraws a Devvit opt-in the game rendered). Once your backend serves
-the notification routes, return its `NotificationRuntime` there with
-`listConsent`, which reads the signed-in player's consent records (the
-game-services Worker's `GET /consent`). The settings screen shows each
+backend. `createStarterNotificationBackend` in
+`src/platform/notifications.ts` builds the notifications runtime
+(`@mpgd/platform/notifications-runtime`) over the game-services Worker's
+notification routes (`@mpgd/game-services/notifications/client`) when the
+game has both:
+
+- a game-services URL, `VITE_MPGD_GAME_SERVICES_URL`, the one the commerce
+  client uses (a public https URL in production); and
+- a server-backed session, which the game sets with
+  `setStarterServerSession` in `src/platform/serverSession.ts` at the top of
+  `src/main.ts`, before `bootstrap()`: the signed-in `{ playerId, sessionId }`
+  (`undefined` until the player signs in), a sign-in subscription, and the
+  session's `Authorization` header. The commerce client then sends the same
+  header. `sessionId` must be the stable session-family id: the `sessionId` your
+  identity service answers to the Worker's `authenticateNotificationSession`
+  for this session's header, the same across token refreshes (see the kit's
+  `docs/CLOUDFLARE_WORKER_DEPLOY.md`, "Sessions"). Do not pass a per-token
+  or rotating id: a `GuestSessionCoordinator` view's `sessionId` may rotate
+  on refresh, so it is not that id.
+
+Without either, it returns `undefined` and the settings screen asks only
+for the OS or host permission (and withdraws a Devvit opt-in the game
+rendered). With them, the runtime registers the device for the signed-in
+player, keeps its registration state in the platform storage, and
+`listConsent` reads the player's consent records (the Worker's
+`GET /consent`). The runtime also loads the Worker's registry entry for
+its target (`GET /providers`) and turns notifications into a configuration
+error when the provider disagrees with it; a Worker it cannot reach is
+logged and the runtime runs without that check.
+
+Reddit never gets this backend, even with a URL and a session: a Reddit
+game's notifications backend is its Devvit server, which keeps the opt-in,
+the records, and the sends, and the Worker serves no `reddit` target. The
+Worker serves the Android, iOS, and Apps in Toss providers.
+
+The settings screen shows each
 switch from the latest record, read every time it opens and after every
 change, so a choice made on another device shows. A tap reads the records
 again and writes only what changes. It keeps nothing on the device, and