@mpgd/cli 0.54.0 → 0.54.1

package/dist/index.js

@@ -12,6 +12,7 @@ import { buildAssetPacks } from './asset-pack-build.js';
 import { verifyAssetPackDelivery } from './asset-pack-verify.js';
 import { buildAssetPackTarget } from './asset-pack-target.js';
 import { publishAssetPacks } from './asset-pack-publish.js';
+import { assertLegalProjectPath, publishLegalSiteFiles } from './legal-site-output.js';
 import { assertAssetPackTargetPolicy } from '@mpgd/target-config/asset-packs';
 import { materializeCapacitorShellStarter, planCapacitorShellStarter, } from './capacitor-shell-starter.js';
 import { doctorNativeDeployment, initializeDeployConfig, parseDeployTargets, planNativeDeployment, readNativeDeploymentPlan, writeNativeDeploymentPlan, } from './deploy-planning.js';
@@ -1818,7 +1819,10 @@ const targetCommand = defineI18n({
                     action: 'build',
                     target,
                     profile,
-                    env: createTargetCommandEnv(ctx.values, { nativeBuildTarget: target }),
+                    env: createTargetCommandEnv(ctx.values, {
+                        nativeBuildTarget: target,
+                        requireSourceRevision: true,
+                    }),
                     ...(variant === undefined ? {} : { variant }),
                 });
             },
@@ -2448,7 +2452,7 @@ const targetCommand = defineI18n({
             run: (ctx) => {
                 const aitVariant = readOptionalString(ctx.values['ait-variant']);
                 const iosVariant = readOptionalString(ctx.values['ios-variant']);
-                const env = createTargetCommandEnv(ctx.values);
+                const env = createTargetCommandEnv(ctx.values, { requireSourceRevision: true });
                 runTargetMatrix({
                     action: 'build',
                     targets: parseTargetList(readOptionalString(ctx.values.targets), env),
@@ -2774,9 +2778,13 @@ function resolveLegalCommandOptions(values) {
 function buildLegalSite(input) {
     const legalDir = path.resolve(process.cwd(), input.legalDir);
     const outDir = path.resolve(process.cwd(), input.outDir);
+    assertLegalProjectPath('legal-dir', legalDir);
+    assertLegalProjectPath('out-dir', outDir);
     const outputs = createLegalSiteOutputs(legalDir, outDir);
     if (input.check) {
+        assertLegalProjectPath('out-dir', outDir);
         const stale = outputs.filter((output) => {
+            assertLegalProjectPath('out-dir', output.file);
             if (!existsSync(output.file)) {
                 return true;
             }
@@ -2792,29 +2800,24 @@ function buildLegalSite(input) {
             outDir,
         };
     }
-    for (const output of outputs) {
-        mkdirSync(path.dirname(output.file), { recursive: true });
-        writeFileSync(output.file, output.content);
-    }
+    publishLegalSiteFiles(outDir, outputs);
     return {
         outDir,
     };
 }
 function createLegalSiteOutputs(legalDir, outDir) {
-    const relativeLegalDir = path.relative(process.cwd(), legalDir);
-    const relativeOutDir = path.relative(process.cwd(), outDir);
-    if (relativeLegalDir.startsWith('..') || path.isAbsolute(relativeLegalDir)) {
-        throw new Error(`legal-dir must be inside the project root: ${legalDir}`);
-    }
-    if (relativeOutDir.startsWith('..') || path.isAbsolute(relativeOutDir)) {
-        throw new Error(`out-dir must be inside the project root: ${outDir}`);
-    }
-    const sourceRoot = toTemplatePath(relativeLegalDir || '.');
+    assertLegalProjectPath('legal-dir', legalDir);
+    assertLegalProjectPath('out-dir', outDir);
+    const sourceRoot = toTemplatePath(path.relative(process.cwd(), legalDir) || '.');
     const outputs = legalPageSlugs.map((slug) => {
         const sourceFile = path.join(legalDir, `${slug}.html`);
+        // existsSync and readFileSync follow a page symlink. Check the file
+        // itself, not only the legal directory, immediately before reading it.
+        assertLegalProjectPath('legal-dir', sourceFile);
         if (!existsSync(sourceFile)) {
             throw new Error(`Missing legal page source: ${sourceFile}`);
         }
+        assertLegalProjectPath('legal-dir', sourceFile);
         return {
             file: path.join(outDir, slug, 'index.html'),
             content: normalizeLegalHtml(readFileSync(sourceFile, 'utf8'), sourceFile),
@@ -3347,7 +3350,11 @@ function createTargetCommandEnv(values, options = {}) {
     });
     const env = {
         ...process.env,
-        ...createGameOwnedReleaseEnv(gameRoot, process.env),
+        // Release provenance is recorded only by build commands. Smoke, doctor,
+        // icons, and submission preflight must still run on an exported game tree.
+        ...createGameOwnedReleaseEnv(gameRoot, process.env, {
+            requireSourceRevision: options.requireSourceRevision === true,
+        }),
         MPGD_PLATFORM_TARGETS_FILE: preparedTargetsFile,
         ...(targetConfigExtensionsFile === undefined
             ? {}
@@ -3450,10 +3457,9 @@ function resolveTargetConfigExtensionsFile(gameRoot, configuredFile) {
     const gameOwnedFile = path.join(gameRoot, 'mpgd.target-config.json');
     return existsSync(gameOwnedFile) ? gameOwnedFile : undefined;
 }
-function createGameOwnedReleaseEnv(gameRoot, baseEnv) {
+function createGameOwnedReleaseEnv(gameRoot, baseEnv, options) {
     const monetizationFiles = resolveGameOwnedMonetizationFiles(gameRoot, baseEnv);
-    const sourceGitSha = readOptionalString(baseEnv.MPGD_SOURCE_GIT_SHA)
-        ?? readSourceGitSha(gameRoot);
+    const sourceGitSha = resolveCommandSourceGitSha(gameRoot, baseEnv, options.requireSourceRevision);
     const appVersion = readOptionalString(baseEnv.APP_VERSION)
         ?? readGamePackageVersion(gameRoot);
     const notificationTopicsFile = readConfiguredPath(baseEnv.MPGD_NOTIFICATION_TOPICS_FILE);
@@ -3464,7 +3470,7 @@ function createGameOwnedReleaseEnv(gameRoot, baseEnv) {
         ...(notificationTopicsFile === undefined
             ? {}
             : { MPGD_NOTIFICATION_TOPICS_FILE: path.resolve(gameRoot, notificationTopicsFile) }),
-        MPGD_SOURCE_GIT_SHA: sourceGitSha,
+        ...(sourceGitSha === undefined ? {} : { MPGD_SOURCE_GIT_SHA: sourceGitSha }),
         ...(appVersion === undefined ? {} : { APP_VERSION: appVersion }),
     };
 }
@@ -3499,15 +3505,48 @@ function readConfiguredPath(value) {
     const normalized = value?.trim();
     return normalized === undefined || normalized.length === 0 ? undefined : normalized;
 }
+function resolveCommandSourceGitSha(gameRoot, baseEnv, requireSourceRevision) {
+    const configuredSourceGitSha = readOptionalString(baseEnv.MPGD_SOURCE_GIT_SHA);
+    if (requireSourceRevision) {
+        return configuredSourceGitSha === undefined
+            ? readSourceGitSha(gameRoot)
+            : requireSourceGitSha(configuredSourceGitSha);
+    }
+    if (configuredSourceGitSha !== undefined) {
+        return isSourceGitSha(configuredSourceGitSha) ? configuredSourceGitSha : undefined;
+    }
+    const detectedSourceGitSha = readGitHead(gameRoot);
+    return detectedSourceGitSha !== undefined && isSourceGitSha(detectedSourceGitSha)
+        ? detectedSourceGitSha
+        : undefined;
+}
 function readSourceGitSha(gameRoot) {
+    const head = readGitHead(gameRoot);
+    if (head === undefined) {
+        throw new Error(`Failed to resolve the game source Git revision for ${gameRoot}. `
+            + 'Set MPGD_SOURCE_GIT_SHA to its lowercase 40-character commit SHA.');
+    }
+    return requireSourceGitSha(head);
+}
+function readGitHead(gameRoot) {
     const result = spawnSync('git', ['-C', gameRoot, 'rev-parse', 'HEAD'], {
         encoding: 'utf8',
         stdio: ['ignore', 'pipe', 'ignore'],
     });
     if (result.error !== undefined || result.status !== 0) {
-        return 'uncommitted';
+        return undefined;
     }
-    return result.stdout.trim() || 'uncommitted';
+    const head = result.stdout.trim();
+    return head.length === 0 ? undefined : head;
+}
+function requireSourceGitSha(value) {
+    if (!isSourceGitSha(value)) {
+        throw new Error('MPGD_SOURCE_GIT_SHA must be a lowercase 40-character game source SHA.');
+    }
+    return value;
+}
+function isSourceGitSha(value) {
+    return /^[0-9a-f]{40}$/u.test(value);
 }
 function readGamePackageVersion(gameRoot) {
     const packageFile = path.join(gameRoot, 'package.json');

package/dist/kit-upgrade.js

@@ -1,6 +1,6 @@
 import { execFile as execFileCallback, spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { compare, intersects, minVersion, satisfies, valid, validRange } from 'semver';
@@ -154,6 +154,9 @@ export function applyKitUpgrade(plan, runLockfileUpdate = updatePnpmLockfile) {
         ...plan.manifestDigests,
         ...plan.lockfileDigests,
     })) {
+        // Re-check links before the digest read. readFileSync follows a symlink,
+        // so a same-bytes swap would otherwise look unchanged.
+        assertOwnedUpgradePath(upgradeWriteAnchor(plan, file), file);
         const current = readFileSync(file, 'utf8');
         if (digest(current) !== expected) {
             throw new Error('File changed after upgrade planning: ' + file);
@@ -176,9 +179,11 @@ export function applyKitUpgrade(plan, runLockfileUpdate = updatePnpmLockfile) {
                 section[update.packageName] = update.next;
                 parsed[update.section] = section;
             }
-            writeFileSync(manifest, stringifyLike(source, parsed));
+            writeUpgradeFile(plan, manifest, stringifyLike(source, parsed));
         }
         for (const root of plan.workspaceRoots) {
+            const lockfile = path.join(root, 'pnpm-lock.yaml');
+            assertOwnedUpgradePath(upgradeWriteAnchor(plan, lockfile), lockfile);
             runLockfileUpdate(root);
         }
     }
@@ -186,7 +191,7 @@ export function applyKitUpgrade(plan, runLockfileUpdate = updatePnpmLockfile) {
         const restoreFailures = [];
         for (const [file, original] of snapshots) {
             try {
-                writeFileSync(file, original);
+                writeUpgradeFile(plan, file, original);
             }
             catch (restoreError) {
                 restoreFailures.push(file + ': ' + formatError(restoreError));
@@ -473,6 +478,100 @@ function stringifyLike(original, value) {
     return JSON.stringify(value, null, indent).replaceAll('\n', newline)
         + (original.endsWith('\n') ? newline : '');
 }
+function upgradeWriteAnchor(plan, file) {
+    const resolved = path.resolve(file);
+    let anchor = plan.gameRoot;
+    while (!inside(anchor, resolved)) {
+        const parent = path.dirname(anchor);
+        if (parent === anchor) {
+            throw new Error('Refusing to write outside the planned upgrade directory: ' + file);
+        }
+        anchor = parent;
+    }
+    // In-game files used to return plan.gameRoot before this check. A game
+    // directory or parent swapped for a symlink after planning then skipped
+    // lstat/realpath, and assertOwnedUpgradePath only inspects children.
+    let anchorStat;
+    try {
+        anchorStat = lstatSync(anchor);
+    }
+    catch (error) {
+        throw new Error('Refusing to write through a symbolic link: ' + anchor, { cause: error });
+    }
+    if (anchorStat.isSymbolicLink()) {
+        throw new Error('Refusing to write through a symbolic link: ' + anchor);
+    }
+    const anchorReal = realpathSync(anchor);
+    // Compare with the game root captured at planning time. A fresh realpath of
+    // both sides would follow a parent swapped for a symlink and look consistent.
+    if (!inside(anchorReal, plan.gameRoot)
+        && path.resolve(anchorReal) !== path.resolve(plan.gameRoot)) {
+        throw new Error('Refusing to write through a symbolic link: ' + anchor);
+    }
+    return anchor;
+}
+function assertOwnedUpgradePath(anchor, file) {
+    const resolved = path.resolve(file);
+    if (!inside(anchor, resolved)) {
+        throw new Error('Refusing to write outside the planned upgrade directory: ' + file);
+    }
+    const relative = path.relative(anchor, resolved);
+    const parts = relative.split(path.sep).filter((part) => part !== '' && part !== '.');
+    let current = anchor;
+    for (let index = 0; index < parts.length; index += 1) {
+        const part = parts[index];
+        if (part === undefined) {
+            continue;
+        }
+        current = path.join(current, part);
+        const isFinal = index === parts.length - 1;
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (isErrno(error, 'ENOENT') && isFinal) {
+                return;
+            }
+            throw new Error('Upgrade file disappeared before write: ' + file, { cause: error });
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error('Refusing to write through a symbolic link: ' + current);
+        }
+    }
+    if (!inside(realpathSync(anchor), realpathSync(resolved))) {
+        throw new Error('Refusing to write through a symbolic link: ' + file);
+    }
+}
+function writeUpgradeFile(plan, file, source) {
+    const anchor = upgradeWriteAnchor(plan, file);
+    assertOwnedUpgradePath(anchor, file);
+    const temporary = `${file}.mpgd-${randomUUID()}.tmp`;
+    try {
+        let mode = 0o644;
+        try {
+            const stat = lstatSync(file);
+            if (stat.isSymbolicLink()) {
+                throw new Error('Refusing to write through a symbolic link: ' + file);
+            }
+            mode = stat.mode & 0o777;
+        }
+        catch (error) {
+            if (!isErrno(error, 'ENOENT')) {
+                throw error;
+            }
+        }
+        writeFileSync(temporary, source, { flag: 'wx', mode });
+        assertOwnedUpgradePath(anchor, file);
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function isErrno(error, code) {
+    return error !== null && typeof error === 'object' && 'code' in error && error.code === code;
+}
 function inside(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (!relative.startsWith('..' + path.sep) && relative !== '..'

package/dist/legal-site-output.d.ts

@@ -0,0 +1,12 @@
+export interface LegalSiteFile {
+  readonly file: string;
+  readonly content: string;
+}
+/**
+* Legal-site paths are contained only after the nearest existing ancestor is
+* canonicalized. A lexical `path.relative` check treats a symlinked `artifacts`
+* directory as inside the project while later writes follow the link.
+*/
+export declare function assertLegalProjectPath(label: string, resolved: string): void;
+/** Stage the site beside the destination, then publish with rename. */
+export declare function publishLegalSiteFiles(outDir: string, outputs: readonly LegalSiteFile[]): void;

package/dist/legal-site-output.js

@@ -0,0 +1,226 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Legal-site paths are contained only after the nearest existing ancestor is
+ * canonicalized. A lexical `path.relative` check treats a symlinked `artifacts`
+ * directory as inside the project while later writes follow the link.
+ */
+export function assertLegalProjectPath(label, resolved) {
+    const lexicalRoot = process.cwd();
+    const lexical = path.relative(lexicalRoot, resolved);
+    if (lexical.startsWith('..') || path.isAbsolute(lexical)) {
+        throw new Error(`${label} must be inside the project root: ${resolved}`);
+    }
+    assertNoLegalSymlink(lexicalRoot, resolved, label);
+    const canonicalRoot = realpathSync(lexicalRoot);
+    const canonical = realpathBestEffort(resolved);
+    const canonicalRelative = path.relative(canonicalRoot, canonical);
+    if (canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative)) {
+        throw new Error(`${label} must be inside the project root: ${resolved}`);
+    }
+}
+/** Stage the site beside the destination, then publish with rename. */
+export function publishLegalSiteFiles(outDir, outputs) {
+    assertLegalProjectPath('out-dir', outDir);
+    // A temp dir on the project root is a different filesystem when out-dir is a
+    // mount or sits under a bind-mounted artifacts directory. Rename then fails
+    // with EXDEV. Stage on the destination filesystem instead.
+    const staging = path.join(legalStagingParent(outDir), `.mpgd-legal-${randomUUID()}`);
+    let publishedDirectory = false;
+    try {
+        for (const output of outputs) {
+            const relative = path.relative(outDir, output.file);
+            if (relative.startsWith('..') || path.isAbsolute(relative)) {
+                throw new Error(`Legal site output escapes the output directory: ${output.file}`);
+            }
+            const staged = path.join(staging, relative);
+            mkdirSync(path.dirname(staged), { recursive: true });
+            writeFileSync(staged, output.content, { flag: 'wx' });
+        }
+        assertLegalProjectPath('out-dir', outDir);
+        let existing;
+        try {
+            existing = lstatSync(outDir);
+        }
+        catch (error) {
+            if (!isErrno(error, 'ENOENT')) {
+                throw error;
+            }
+        }
+        if (existing?.isSymbolicLink() === true) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${outDir}`);
+        }
+        if (existing === undefined) {
+            ensureLegalDirectory(path.dirname(outDir));
+            assertLegalProjectPath('out-dir', outDir);
+            renameSync(staging, outDir);
+            publishedDirectory = true;
+            return;
+        }
+        if (!existing.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${outDir}`);
+        }
+        for (const output of outputs) {
+            assertNoLegalSymlink(process.cwd(), output.file, 'out-dir');
+            ensureLegalDirectory(path.dirname(output.file));
+            assertNoLegalSymlink(process.cwd(), output.file, 'out-dir');
+            renameSync(path.join(staging, path.relative(outDir, output.file)), output.file);
+        }
+    }
+    finally {
+        if (!publishedDirectory) {
+            rmSync(staging, { recursive: true, force: true });
+        }
+    }
+}
+/**
+ * Parent for the staging directory. An existing out-dir may itself be a mount,
+ * so stage inside it. A missing out-dir is created on its nearest existing
+ * ancestor, which is the filesystem the later rename must stay on.
+ */
+function legalStagingParent(outDir) {
+    const existing = lstatIfPresent(outDir);
+    if (existing !== undefined) {
+        if (existing.isSymbolicLink()) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${outDir}`);
+        }
+        if (!existing.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${outDir}`);
+        }
+        return outDir;
+    }
+    let current = path.dirname(outDir);
+    for (;;) {
+        const stat = lstatIfPresent(current);
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Refusing to write legal site output through a symbolic link: ${current}`);
+            }
+            if (!stat.isDirectory()) {
+                throw new Error(`Legal site output path is not a directory: ${current}`);
+            }
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            throw new Error(`out-dir must be inside the project root: ${outDir}`);
+        }
+        current = parent;
+    }
+}
+function lstatIfPresent(target) {
+    try {
+        return lstatSync(target);
+    }
+    catch (error) {
+        if (isErrno(error, 'ENOENT')) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+/** Resolve symlinks for the longest existing ancestor, keeping the remainder. */
+function realpathBestEffort(target) {
+    // lstat-based existence stops the walk at dangling symlinks, so realpath
+    // fails closed on them instead of lexically skipping the link.
+    const exists = (candidate) => {
+        try {
+            lstatSync(candidate);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    let existing = target;
+    while (!exists(existing)) {
+        const parent = path.dirname(existing);
+        if (parent === existing) {
+            return existing;
+        }
+        existing = parent;
+    }
+    let real;
+    try {
+        real = realpathSync(existing);
+    }
+    catch (error) {
+        throw new Error(`Legal site path resolves through a broken symbolic link: ${target}`, {
+            cause: error,
+        });
+    }
+    return existing === target ? real : path.resolve(real, path.relative(existing, target));
+}
+function assertNoLegalSymlink(root, target, label) {
+    const relative = path.relative(root, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`${label} must be inside the project root: ${target}`);
+    }
+    const verb = label === 'legal-dir' ? 'read legal sources' : 'write legal site output';
+    let current = root;
+    for (const part of relative.split(path.sep)) {
+        if (part === '' || part === '.') {
+            continue;
+        }
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (isErrno(error, 'ENOENT')) {
+                return;
+            }
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Refusing to ${verb} through a symbolic link: ${current}`);
+        }
+    }
+}
+function ensureLegalDirectory(directory) {
+    const root = process.cwd();
+    const relative = path.relative(root, directory);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`out-dir must be inside the project root: ${directory}`);
+    }
+    if (relative === '') {
+        return;
+    }
+    let current = root;
+    for (const part of relative.split(path.sep)) {
+        if (part === '' || part === '.') {
+            continue;
+        }
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (!isErrno(error, 'ENOENT')) {
+                throw error;
+            }
+            try {
+                mkdirSync(current);
+                continue;
+            }
+            catch (mkdirError) {
+                if (!isErrno(mkdirError, 'EEXIST')) {
+                    throw mkdirError;
+                }
+                stat = lstatSync(current);
+            }
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Refusing to write legal site output through a symbolic link: ${current}`);
+        }
+        if (!stat.isDirectory()) {
+            throw new Error(`Legal site output path is not a directory: ${current}`);
+        }
+    }
+}
+function isErrno(error, code) {
+    return error !== null && typeof error === 'object' && 'code' in error && error.code === code;
+}

package/dist/native-build-info.json

@@ -1,5 +1,5 @@
 {
-  "kitGitSha": "95ea69d3e9755256b27a3b0ea230812a632ed03b",
+  "kitGitSha": "ed8837541cc3c5737c21638a596ba2dc121112da",
   "kitDirty": false,
-  "packageVersion": "0.54.0"
+  "packageVersion": "0.54.1"
 }

package/dist/native-build-target.js

@@ -9502,9 +9502,21 @@ var assertReleaseManifestStructure = /* @__PURE__ */ (() => {
   };
 })();
 var fullGitShaPattern = /^[0-9a-f]{40}$/u;
+var sha256DigestPattern = /^[0-9a-f]{64}$/u;
 function assertReleaseManifest(input) {
   const manifest = assertReleaseManifestStructure(input);
+  if (!fullGitShaPattern.test(manifest.gitSha)) {
+    throw new TypeError("Release manifest gitSha must be a lowercase 40-character SHA.");
+  }
+  if (!fullGitShaPattern.test(manifest.kitGitSha)) {
+    throw new TypeError("Release manifest kitGitSha must be a lowercase 40-character SHA.");
+  }
   for (const [target2, entry] of Object.entries(manifest.targets)) {
+    assertSha256Digest(entry.effectiveConfig.digest, `Release manifest ${target2} effectiveConfig.digest`);
+    assertSha256Digest(entry.iconManifest.digest, `Release manifest ${target2} iconManifest.digest`);
+    assertSha256Digest(entry.iconManifest.sourceSha256, `Release manifest ${target2} iconManifest.sourceSha256`);
+    assertSha256Digest(entry.iconManifest.sharedConfigSha256, `Release manifest ${target2} iconManifest.sharedConfigSha256`);
+    assertSha256Digest(entry.iconManifest.renderConfigSha256, `Release manifest ${target2} iconManifest.renderConfigSha256`);
     const delivery = entry.nativeDelivery;
     if (delivery === void 0) {
       continue;
@@ -9519,9 +9531,6 @@ function assertReleaseManifest(input) {
       throw new TypeError(`Release manifest production native delivery is unsigned: ${target2}.`);
     }
   }
-  if (!fullGitShaPattern.test(manifest.kitGitSha)) {
-    throw new TypeError("Release manifest kitGitSha must be a lowercase 40-character SHA.");
-  }
   if (manifest.releaseIdentity !== void 0) {
     const releaseIdentity = createMpgdReleaseIdentity({
       gameVersion: manifest.releaseIdentity.gameVersion,
@@ -9543,6 +9552,11 @@ function assertReleaseManifest(input) {
   }
   return manifest;
 }
+function assertSha256Digest(value, label) {
+  if (!sha256DigestPattern.test(value)) {
+    throw new TypeError(`${label} must be a lowercase 64-character SHA-256 digest.`);
+  }
+}
 
 // node_modules/.cache/mpgd-native-build/tools/target/release-manifest-lock.js
 import { randomUUID } from "node:crypto";
@@ -9641,7 +9655,7 @@ function canRecoverLock(lockFile) {
 // node_modules/.cache/mpgd-native-build/tools/target/generate-release-manifest.js
 var __typia_transform__accessExpressionAsString6 = _accessExpressionAsString_110._accessExpressionAsString;
 var assertProductCatalog = /* @__PURE__ */ (() => {
-  const _ae0 = '({ readonly type: "currency"; readonly currency: string & MinLength<1>; readonly amount: number; } | { readonly type: "entitlement"; readonly entitlement: string; } | { readonly type: "resource"; readonly resource: string & MinLength<1>; readonly amount: number & ExclusiveMinimum<0> & Maximum<1.7976931348623157e+308>; })';
+  const _ae0 = '({ readonly type: "currency"; readonly currency: string & MinLength<1>; readonly amount: PositiveLedgerAmount; } | { readonly type: "entitlement"; readonly entitlement: string; } | { readonly type: "resource"; readonly resource: string & MinLength<1>; readonly amount: number & ExclusiveMinimum<0> & Maximum<1.7976931348623157e+308>; })';
   const _ao0 = (input, _path, _exceptionable = true) => ("string" === typeof input.version || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".version",
@@ -9739,10 +9753,25 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
     path: _path + ".currency",
     expected: "(string & MinLength<1>)",
     value: input.currency
-  }, _errorFactory)) && ("number" === typeof input.amount || _assertGuard_19._assertGuard(_exceptionable, {
+  }, _errorFactory)) && ("number" === typeof input.amount && (1 <= input.amount || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".amount",
-    expected: "number",
+    expected: "number & Minimum<1>",
+    value: input.amount
+  }, _errorFactory)) && (input.amount <= 9007199254740991 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & Maximum<9007199254740991>",
+    value: input.amount
+  }, _errorFactory)) && (input.amount % 1 === 0 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & MultipleOf<1>",
+    value: input.amount
+  }, _errorFactory)) || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "(number & Minimum<1> & Maximum<9007199254740991> & MultipleOf<1>)",
     value: input.amount
   }, _errorFactory));
   const _ao3 = (input, _path, _exceptionable = true) => ("entitlement" === input.type || _assertGuard_19._assertGuard(_exceptionable, {
@@ -9815,7 +9844,7 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
   })();
   const _io0 = (input) => "string" === typeof input.version && (void 0 === input.currencies || Array.isArray(input.currencies) && (1 <= input.currencies.length && input.currencies.every((elem) => "string" === typeof elem && 1 <= elem.length))) && (Array.isArray(input.products) && input.products.every((elem) => "object" === typeof elem && null !== elem && _io1(elem)));
   const _io1 = (input) => "string" === typeof input.id && ("consumable" === input.type || "non_consumable" === input.type || "subscription" === input.type) && ("object" === typeof input.grant && null !== input.grant && _iu0(input.grant)) && ("object" === typeof input.platformProductIds && null !== input.platformProductIds && false === Array.isArray(input.platformProductIds) && _io5(input.platformProductIds));
-  const _io2 = (input) => "currency" === input.type && ("string" === typeof input.currency && 1 <= input.currency.length) && "number" === typeof input.amount;
+  const _io2 = (input) => "currency" === input.type && ("string" === typeof input.currency && 1 <= input.currency.length) && ("number" === typeof input.amount && (1 <= input.amount && input.amount <= 9007199254740991 && input.amount % 1 === 0));
   const _io3 = (input) => "entitlement" === input.type && "string" === typeof input.entitlement;
   const _io4 = (input) => "resource" === input.type && ("string" === typeof input.resource && 1 <= input.resource.length) && ("number" === typeof input.amount && (0 < input.amount && input.amount <= 17976931348623157e292));
   const _io5 = (input) => Object.keys(input).every((key) => {
@@ -9855,16 +9884,31 @@ var assertProductCatalog = /* @__PURE__ */ (() => {
   };
 })();
 var assertAdPlacements = /* @__PURE__ */ (() => {
-  const _ip0 = (input) => "number" === typeof input["amount"];
+  const _ip0 = (input) => "number" === typeof input["amount"] && (1 <= input["amount"] && input["amount"] <= 9007199254740991 && input["amount"] % 1 === 0);
   const _ae0 = '(AdPlacementEntryBase & { readonly type: "banner" | "interstitial"; readonly reward?: never; } | AdPlacementEntryBase & { readonly type: "rewarded"; readonly reward?: AdReward; })';
-  const _ae1 = '(undefined | { readonly type: "continue"; readonly amount: number; } | { readonly type: "currency"; readonly amount: number; readonly currency: string & MinLength<1>; })';
-  const _ap0 = (input, _path, _exceptionable = true) => "number" === typeof input["amount"] || _assertGuard_19._assertGuard(_exceptionable, {
+  const _ae1 = '(undefined | { readonly type: "continue"; readonly amount: PositiveLedgerAmount; } | { readonly type: "currency"; readonly amount: PositiveLedgerAmount; readonly currency: string & MinLength<1>; })';
+  const _ap0 = (input, _path, _exceptionable = true) => "number" === typeof input["amount"] && (1 <= input["amount"] || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".amount",
-    expected: "number",
+    expected: "number & Minimum<1>",
+    value: input["amount"]
+  }, _errorFactory)) && (input["amount"] <= 9007199254740991 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & Maximum<9007199254740991>",
+    value: input["amount"]
+  }, _errorFactory)) && (input["amount"] % 1 === 0 || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "number & MultipleOf<1>",
+    value: input["amount"]
+  }, _errorFactory)) || _assertGuard_19._assertGuard(_exceptionable, {
+    method: "typia.createAssert",
+    path: _path + ".amount",
+    expected: "(number & Minimum<1> & Maximum<9007199254740991> & MultipleOf<1>)",
     value: input["amount"]
   }, _errorFactory);
-  const _ae2 = '({ readonly type: "continue"; readonly amount: number; } | { readonly type: "currency"; readonly amount: number; readonly currency: string & MinLength<1>; })';
+  const _ae2 = '({ readonly type: "continue"; readonly amount: PositiveLedgerAmount; } | { readonly type: "currency"; readonly amount: PositiveLedgerAmount; readonly currency: string & MinLength<1>; })';
   const _ao0 = (input, _path, _exceptionable = true) => ("string" === typeof input.version || _assertGuard_19._assertGuard(_exceptionable, {
     method: "typia.createAssert",
     path: _path + ".version",
@@ -10373,9 +10417,47 @@ function readSdkMajor(envValue, metadataValue) {
 function getSourceGitSha(kitGitSha) {
   const configuredGitSha = readOptionalString2(process.env.MPGD_SOURCE_GIT_SHA);
   if (configuredGitSha !== void 0) {
-    return configuredGitSha;
+    return requireFullGitSha(configuredGitSha, "MPGD_SOURCE_GIT_SHA");
   }
-  return kitGitSha;
+  if (isInRepoKitBuild()) {
+    return inRepoKitSourceGitSha(kitGitSha);
+  }
+  throw new Error("MPGD_SOURCE_GIT_SHA is required for a downstream game build and must be a lowercase 40-character SHA. Refusing to record the kit revision as the game revision.");
+}
+function inRepoKitSourceGitSha(kitGitSha) {
+  return requireFullGitSha(kitGitSha, "in-repo kit source Git SHA");
+}
+function isInRepoKitBuild() {
+  if (process.env.MPGD_NATIVE_PACKAGED_BUILD === "1") {
+    return false;
+  }
+  const targetsFile = readOptionalString2(process.env.MPGD_PLATFORM_TARGETS_FILE);
+  if (targetsFile === void 0) {
+    return true;
+  }
+  return isInsideDirectory(resolveKitRoot(), targetsFile);
+}
+function isInsideDirectory(root, candidate) {
+  let resolvedRoot;
+  try {
+    resolvedRoot = realpathSync6(root);
+  } catch {
+    return false;
+  }
+  const resolvedCandidate = resolve12(candidate);
+  let comparable = resolvedCandidate;
+  try {
+    comparable = realpathSync6(resolvedCandidate);
+  } catch {
+  }
+  const rel = relative9(resolvedRoot, comparable);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute8(rel);
+}
+function requireFullGitSha(value, label) {
+  if (!/^[0-9a-f]{40}$/u.test(value)) {
+    throw new Error(`${label} must be a lowercase 40-character SHA.`);
+  }
+  return value;
 }
 function resolveKitGitSha() {
   if (process.env.MPGD_NATIVE_PACKAGED_BUILD === "1") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -70,10 +70,10 @@
     "parse5": "7.3.0",
     "postcss": "8.5.28",
     "postcss-value-parser": "4.2.0",
-    "@mpgd/catalog": "0.10.5",
-    "@mpgd/platform": "0.27.0",
+    "@mpgd/catalog": "0.10.6",
+    "@mpgd/platform": "0.27.1",
     "@mpgd/phaser-assets": "0.9.1",
-    "@mpgd/target-config": "0.23.5"
+    "@mpgd/target-config": "0.23.6"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
@@ -81,18 +81,18 @@
     "@types/yauzl": "3.4.0",
     "ttsc": "0.32.1",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.20.1",
-    "@mpgd/adapter-browser": "0.11.5",
-    "@mpgd/adapter-devvit": "0.13.3",
-    "@mpgd/adapter-verse8": "0.7.5",
-    "@mpgd/bridge": "0.14.2",
-    "@mpgd/adapter-capacitor": "0.12.1",
-    "@mpgd/analytics": "0.4.14",
-    "@mpgd/capacitor-play-billing": "0.3.5",
-    "@mpgd/capacitor-storekit": "0.3.5",
-    "@mpgd/game-services": "0.27.0",
-    "@mpgd/i18n": "0.6.19",
-    "@mpgd/game-runtime": "0.7.5",
+    "@mpgd/adapter-browser": "0.11.6",
+    "@mpgd/adapter-capacitor": "0.12.2",
+    "@mpgd/adapter-ait": "0.20.2",
+    "@mpgd/adapter-verse8": "0.7.6",
+    "@mpgd/bridge": "0.14.3",
+    "@mpgd/analytics": "0.4.15",
+    "@mpgd/adapter-devvit": "0.13.4",
+    "@mpgd/capacitor-play-billing": "0.3.6",
+    "@mpgd/capacitor-storekit": "0.3.6",
+    "@mpgd/game-runtime": "0.7.6",
+    "@mpgd/game-services": "0.27.1",
+    "@mpgd/i18n": "0.6.20",
     "@mpgd/lite-shell": "0.1.0"
   },
   "main": "./dist/index.js",