@mpgd/cli 0.56.0 → 0.58.0

package/templates/phaser-game/legal/privacy.html

@@ -48,30 +48,129 @@
         <a href="/privacy/" aria-current="page">Privacy</a>
         <a href="/support/">Support</a>
         <a href="/terms/">Terms</a>
+        <a href="/delete-account/">Delete account</a>
       </nav>
       <h1>__GAME_TITLE__ Privacy Policy</h1>
       <p>Last updated: __LEGAL_LAST_UPDATED__</p>
       <p>
-        __GAME_TITLE__ collects only the information needed to run the game,
-        keep player progress, operate platform features, and respond to support
-        requests.
+        This policy explains what __GAME_TITLE__ (the "game") and its operator,
+        [REPLACE: legal name of the developer or company] ("we"), collect, why,
+        how long we keep it, and how to have it deleted.
       </p>
+      <!--
+        Starting point, not legal advice. Before publishing, replace every
+        REPLACE marker in square brackets (mpgd legal build warns while any remain) and
+        delete what the game does not do or use.
+      -->
       <h2>Information We Process</h2>
+      <ul>
+        <li>
+          <strong>Player identifiers.</strong> A random guest player ID issued by
+          our game server, a random ID for this installation of the game, and,
+          when you sign in, the account ID of the sign-in provider. Store purchases are bound to a one-way hash of your signed-in player ID.
+        </li>
+        <li>
+          <strong>Game progress.</strong> Saves, settings, scores, and the
+          leaderboard entries you submit.
+        </li>
+        <li>
+          <strong>Purchases.</strong> The products you buy and the store's
+          transaction records (Google Play order IDs and a one-way hash of the
+          purchase token, which our server sends to Google to verify the
+          purchase; App Store transaction and original transaction IDs), kept in
+          our purchase ledger so a purchase is granted once and can be
+          restored. We never receive your payment card details.
+        </li>
+        <li>
+          <strong>Rewarded ads.</strong> Records of ads you chose to watch for a
+          reward, so the reward is granted once.
+        </li>
+        <li>
+          <strong>Notifications.</strong> If you allow notifications, a push
+          token for your device and your notification choices, including any
+          consent to advertising messages and when you gave it.
+        </li>
+        <li>
+          <strong>Technical data.</strong> App version, platform, coarse device
+          type, and error details needed to operate and fix the game.
+        </li>
+        <li><strong>Support.</strong> Messages you send us.</li>
+      </ul>
+      <h2>How We Use Information</h2>
       <p>
-        The game may process platform player identifiers, gameplay progress,
-        leaderboard scores, purchase or reward validation records, coarse
-        device/runtime information, and support messages you choose to send.
+        To run the game and its online features, keep your progress and
+        purchases, grant purchases and rewards exactly once, prevent fraud and
+        cheating, send the notifications you asked for, answer support requests,
+        and meet store and legal requirements. We do not sell your personal
+        information. [REPLACE: keep "We do not track you across other
+        companies' apps or websites." only if the game shows no personalized
+        ads and uses no other tracking; otherwise describe the tracking and how
+        to refuse it.]
       </p>
-      <h2>How We Use Information</h2>
+      <h2>Third-Party Services</h2>
+      <!-- Keep only the services the game uses. -->
+      <p>
+        These third-party services are involved in running the game; some act on
+        our behalf and some under their own privacy policies.
+      </p>
+      <ul>
+        <li>
+          Google Play Billing and the Google Play Developer API (Google) or Apple
+          StoreKit and the App Store Server API (Apple): purchases and their
+          verification.
+        </li>
+        <li>
+          Firebase Cloud Messaging (Google): delivering push notifications.
+        </li>
+        <li>
+          Google AdMob and the User Messaging Platform (Google): showing ads and
+          asking for consent where required. AdMob may use the device
+          advertising identifier where the platform and your choices allow it.
+        </li>
+        <li>
+          Cloudflare: hosting our game server, database, and these pages.
+        </li>
+        <li>[REPLACE: any other analytics, crash-reporting, or sign-in service.]</li>
+      </ul>
+      <h2>Retention</h2>
+      <p>
+        We keep account, progress, and notification data while your account is
+        active and delete it when you delete your account [REPLACE: and/or
+        after N months of inactivity]. We keep purchase records (product,
+        store order or transaction number, and date) for 5 years from the
+        purchase or its last refund, whichever is later, for payment and supply
+        record obligations
+        [REPLACE: the laws that apply to you, for example Korea's Act on
+        Consumer Protection in Electronic Commerce], also after the rest of
+        your data is deleted, stored separately and without your player ID. Server logs are kept for
+        [REPLACE: period].
+      </p>
+      <h2 id="delete-account">Deleting Your Account and Data</h2>
+      <p>
+        You can delete your account and the data linked to it in the game
+        ([REPLACE: menu path, for example the lobby's Delete account button])
+        or, without reinstalling the game, by following the steps on our
+        <a href="/delete-account/">account deletion page</a>. The deletion
+        page lists what is deleted and what we must keep (see Retention).
+      </p>
+      <h2>Your Choices</h2>
+      <p>
+        You can turn notifications off in the device settings [REPLACE: and in
+        the game's settings, if it has a notification settings screen], change
+        your ad privacy choices [REPLACE: from the game's privacy options, if it
+        shows ads with a consent form], and ask us for a copy or correction of
+        your data. [REPLACE: rights and contact points required where you
+        operate, for example GDPR, UK GDPR, CCPA, or Korea's PIPA.]
+      </p>
+      <h2>Children</h2>
       <p>
-        We use this information to provide gameplay features, prevent duplicate
-        grants, maintain leaderboards, troubleshoot issues, and satisfy platform
-        review or safety requirements.
+        [REPLACE: who the game is for. If it is directed at children, describe
+        the stricter handling the store programs require.]
       </p>
       <h2>Contact</h2>
       <p>
-        Replace this template before release with the game owner's support
-        contact and jurisdiction-specific privacy disclosures.
+        [REPLACE: support email or form, postal address, and data protection
+        contact if required.]
       </p>
     </main>
   </body>

package/templates/phaser-game/legal/support.html

@@ -48,6 +48,7 @@
         <a href="/privacy/">Privacy</a>
         <a href="/support/" aria-current="page">Support</a>
         <a href="/terms/">Terms</a>
+        <a href="/delete-account/">Delete account</a>
       </nav>
       <h1>__GAME_TITLE__ Support</h1>
       <p>

package/templates/phaser-game/legal/terms.html

@@ -48,6 +48,7 @@
         <a href="/privacy/">Privacy</a>
         <a href="/support/">Support</a>
         <a href="/terms/" aria-current="page">Terms</a>
+        <a href="/delete-account/">Delete account</a>
       </nav>
       <h1>__GAME_TITLE__ Terms</h1>
       <p>Last updated: __LEGAL_LAST_UPDATED__</p>

package/templates/phaser-game/mpgd.game.json

@@ -8,6 +8,9 @@
   "ui": {
     "textSelection": "disabled"
   },
+  "native": {
+    "orientation": "landscape"
+  },
   "acceptance": {
     "gameplay": {
       "schemaVersion": 1,

package/templates/phaser-game/src/env.d.ts

@@ -19,6 +19,12 @@ interface ImportMetaEnv {
   readonly VITE_MPGD_GAME_SERVICES_URL?: string;
   readonly VITE_MPGD_GAME_SERVICES_TARGET?: string;
   readonly VITE_MPGD_GAME_SERVICES_TRANSPORT?: string;
+  /**
+   * The guest identity service (the kit's reference Worker,
+   * `apps/game-identity-worker`): an https URL, or http on a local
+   * development host. See `src/platform/guestIdentity.ts`.
+   */
+  readonly VITE_MPGD_IDENTITY_URL?: string;
   /**
    * Local development only: `<playerId>` or `<playerId>.<installationId>`
    * for an unauthenticated notifications session (see `serverSession.ts`).

package/templates/phaser-game/src/i18n/messages.ts

@@ -16,7 +16,32 @@ export type GameMessageKey =
   | 'rewardPending'
   | 'rewardUnavailable'
   | 'analytics'
-  | 'bootError';
+  | 'bootError'
+  | 'restorePurchases'
+  | 'restoreWorking'
+  | 'restoreDone'
+  | 'restoreToDevice'
+  | 'restoreHolderLimit'
+  | 'restoreNothing'
+  | 'restoreIncomplete'
+  | 'restorePartial'
+  | 'restoreNeedsSession'
+  | 'restoreNeedsConnection'
+  | 'restoreFailed'
+  | 'deleteAccount'
+  | 'deleteAccountConfirm'
+  | 'deleteAccountPendingPurchase'
+  | 'deleteAccountConfirmButton'
+  | 'deleteAccountCancel'
+  | 'deleteAccountClose'
+  | 'deleteAccountWorking'
+  | 'deleteAccountDone'
+  | 'deleteAccountDoneLocalFailed'
+  | 'deleteAccountSessionEnded'
+  | 'deleteAccountNeedsSession'
+  | 'deleteAccountUnavailable'
+  | 'deleteAccountFailed'
+  | 'deleteAccountRejected';
 
 const messages = {
   en: {
@@ -36,6 +61,36 @@ const messages = {
     rewardUnavailable: 'Rewarded ads unavailable on this target',
     analytics: 'Analytics events: {count}',
     bootError: 'Failed to start game',
+    restorePurchases: 'Restore purchases',
+    restoreWorking: 'Restoring purchases...',
+    restoreDone: 'Purchases restored ({count} confirmed)',
+    restoreToDevice: 'Restored to this device ({count} confirmed)',
+    restoreHolderLimit: 'This purchase is already in use on the maximum number of devices',
+    restoreNothing: 'No new purchases to restore',
+    restoreIncomplete: 'Some purchases are not confirmed yet. Try again later.',
+    restorePartial: 'Purchases restored ({count}); others are not confirmed yet. Try again later.',
+    restoreNeedsSession: 'Restoring purchases needs a game server session',
+    restoreNeedsConnection: 'Could not reach the game server. Tap to try again.',
+    restoreFailed: 'Could not restore purchases. Try again later.',
+    deleteAccount: 'Delete account',
+    deleteAccountConfirm:
+      'Delete your account? Your progress, scores, and notification settings are erased and you are signed out. '
+      + 'Purchases are not refunded; ask the store you bought from for a refund. Items you bought once (such as Remove ads) can be restored to a new account with Restore purchases while the store account still owns them. '
+      + 'Purchase records are kept for 5 years from the purchase or its last refund, for payment and supply record obligations, without your player ID.',
+    deleteAccountPendingPurchase:
+      'A purchase is still being processed. Deleting now loses it: Google Play refunds it, but for an App Store purchase ask Apple for the refund.',
+    deleteAccountConfirmButton: 'Delete permanently',
+    deleteAccountCancel: 'Cancel',
+    deleteAccountClose: 'Close',
+    deleteAccountWorking: 'Deleting your account...',
+    deleteAccountDone: 'Your account was deleted and you are signed out.',
+    deleteAccountDoneLocalFailed:
+      'Your account was deleted, but this device could not forget its sign-in. Clear the app data or reinstall the app.',
+    deleteAccountSessionEnded: 'Your session has ended: your account deletion most likely completed.',
+    deleteAccountNeedsSession: 'Sign in to delete your account.',
+    deleteAccountUnavailable: 'Account deletion is not available here. Use the deletion page linked from the privacy policy.',
+    deleteAccountFailed: 'Could not delete your account. Try again.',
+    deleteAccountRejected: 'Could not delete your account. Contact support.',
   },
   ko: {
     title: '__GAME_TITLE__',
@@ -54,6 +109,36 @@ const messages = {
     rewardUnavailable: '이 타깃에서는 리워드 광고를 사용할 수 없음',
     analytics: '애널리틱스 이벤트: {count}',
     bootError: '게임 시작 실패',
+    restorePurchases: '구매 복원',
+    restoreWorking: '구매 복원 중...',
+    restoreDone: '구매 복원 완료 ({count}건 확인)',
+    restoreToDevice: '이 기기로 구매를 복원했습니다 ({count}건 확인)',
+    restoreHolderLimit: '이 구매는 이미 허용된 최대 기기 수에서 사용 중입니다',
+    restoreNothing: '새로 복원할 구매가 없습니다',
+    restoreIncomplete: '아직 확인되지 않은 구매가 있습니다. 나중에 다시 시도하세요.',
+    restorePartial: '{count}건 복원, 아직 확인되지 않은 구매가 있습니다. 나중에 다시 시도하세요.',
+    restoreNeedsSession: '구매를 복원하려면 게임 서버 세션이 필요합니다',
+    restoreNeedsConnection: '게임 서버에 연결하지 못했습니다. 다시 시도하려면 누르세요.',
+    restoreFailed: '구매를 복원하지 못했습니다. 나중에 다시 시도하세요.',
+    deleteAccount: '계정 삭제',
+    deleteAccountConfirm:
+      '계정을 삭제할까요? 진행 상황, 점수, 알림 설정이 지워지고 로그아웃됩니다. '
+      + '구매는 환불되지 않습니다. 환불은 구매한 스토어에 요청하세요. 한 번 구매한 항목(광고 제거 등)은 스토어 계정이 계속 보유하고 있으면 구매 복원으로 새 계정에서 다시 받을 수 있습니다. '
+      + '구매 기록은 거래기록 보존 의무에 따라 구매 또는 마지막 환불 시점부터 5년 동안 플레이어 ID 없이 보관됩니다.',
+    deleteAccountPendingPurchase:
+      '아직 처리 중인 구매가 있습니다. 지금 삭제하면 이 구매는 지급되지 않습니다. Google Play는 자동으로 환불하지만, App Store 구매는 Apple에 환불을 요청해야 합니다.',
+    deleteAccountConfirmButton: '영구 삭제',
+    deleteAccountCancel: '취소',
+    deleteAccountClose: '닫기',
+    deleteAccountWorking: '계정을 삭제하는 중...',
+    deleteAccountDone: '계정이 삭제되었고 로그아웃되었습니다.',
+    deleteAccountDoneLocalFailed:
+      '계정은 삭제되었지만 이 기기의 로그인 정보를 지우지 못했습니다. 앱 데이터를 지우거나 앱을 다시 설치하세요.',
+    deleteAccountSessionEnded: '세션이 종료되었습니다. 계정 삭제가 완료되었을 가능성이 높습니다.',
+    deleteAccountNeedsSession: '계정을 삭제하려면 로그인하세요.',
+    deleteAccountUnavailable: '여기서는 계정을 삭제할 수 없습니다. 개인정보처리방침에 연결된 삭제 페이지를 이용하세요.',
+    deleteAccountFailed: '계정을 삭제하지 못했습니다. 다시 시도하세요.',
+    deleteAccountRejected: '계정을 삭제하지 못했습니다. 고객 지원에 문의하세요.',
   },
 } satisfies Record<Locale, Record<GameMessageKey, string>>;
 

package/templates/phaser-game/src/main.ts

@@ -17,7 +17,13 @@ import { t } from './i18n/messages';
 import { createClientId } from './runtime/id';
 import { createStarterGame } from './runtime/createGame';
 import { detectRuntime } from './platform/runtimeDetector';
-import { createStarterGameServices, type StarterMonetizationPorts } from './platform/gameServices';
+import {
+  createStarterGameServices,
+  createStarterSessionGatedGameServices,
+  type StarterMonetizationPorts,
+} from './platform/gameServices';
+import { createStarterGuestSignIn } from './platform/guestIdentity';
+import { setStarterServerSession } from './platform/serverSession';
 import { installPlatform } from './platform/installPlatform';
 import { installMicrosoftStorePwa } from './platform/microsoftStorePwa';
 
@@ -28,6 +34,7 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
   let gameRuntime: GamePlatformRuntime | undefined;
   let locale: Locale = 'en';
   let disposeMicrosoftStorePwa: (() => void) | undefined;
+  let disposeGuestSignIn: (() => void) | undefined;
 
   try {
     if (__APP_TARGET__ === 'ait') {
@@ -53,15 +60,45 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
       runtime: runtime.config.runtime,
       orientationPolicy,
     });
-    const player =
+    const platformPlayer =
       (await platform.identity.getPlayer()) ?? {
         playerId: 'local-player',
         displayName: 'Local Player',
       };
-    const [identitySession, launchIntent] = await Promise.all([
-      resolveIdentitySession(platform, player.playerId),
+    // The server-issued guest (VITE_MPGD_IDENTITY_URL): tried at boot, and when that fails,
+    // again in the background and before any purchase or restore (`guestIdentity.ts`).
+    const guestSignIn = createStarterGuestSignIn({
+      identityUrl: import.meta.env.VITE_MPGD_IDENTITY_URL,
+      credentials: platform.secureCredentials,
+    });
+    disposeGuestSignIn = () => guestSignIn.dispose();
+    const [bootSignIn, platformSession, launchIntent] = await Promise.all([
+      guestSignIn.ensure(),
+      resolveIdentitySession(platform, platformPlayer.playerId),
       resolveLaunchIntent(platform),
     ]);
+    // A background retry may have won while the other boot reads were pending.
+    const guestIdentity = guestSignIn.current() ?? bootSignIn;
+    // Before the game services read the session: at once, or when a later attempt succeeds
+    // (notifications then come up on their next open; the session-gated services read it).
+    if (guestIdentity !== undefined) {
+      setStarterServerSession(guestIdentity.serverSession);
+    } else {
+      guestSignIn.onSignedIn((later) => setStarterServerSession(later.serverSession));
+    }
+    // Signed in at boot, the server player replaces the platform's (on the native shell a local
+    // placeholder) everywhere. Signed in later, the scenes keep this run's boot player (see
+    // README, "Guest identity"); only the purchase and notification services use the server player.
+    const player = guestIdentity !== undefined
+      ? { ...platformPlayer, playerId: guestIdentity.playerId }
+      : platformPlayer;
+    const identitySession: IdentitySession = guestIdentity !== undefined
+      ? {
+          identityLevel: guestIdentity.identityLevel,
+          playerId: guestIdentity.playerId,
+          trustLevel: 'server-verified',
+        }
+      : platformSession;
     locale = resolveTargetMpgdLocale({
       capabilities: runtime.capabilities,
       ...(platform.gameSettings?.getLocale === undefined ? {} : { preferredLocales: [platform.gameSettings.getLocale()] }),
@@ -76,10 +113,16 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
       sessionId: analyticsSessionId,
       sink: analyticsSink,
     });
+    const sessionGated = guestIdentity === undefined && guestSignIn.configured;
     const ownedRuntime = createGamePlatformRuntime({
       gateway: platform,
       initialLifecycleState: document.visibilityState === 'hidden' ? 'inactive' : 'active',
       canShow: (placement) => {
+        // A run that booted before its sign-in shows no rewarded ad: the runtime's late
+        // reward evidence recovery is bound at boot, which had no recovery client.
+        if (placement.format === 'rewarded' && sessionGated) {
+          return false;
+        }
         const enabled = placement.format === 'rewarded'
           ? runtime.config.features.rewardedAds
           : runtime.config.features.interstitialAds;
@@ -100,15 +143,32 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
       onObserverError: (error) => {
         console.error('[game-runtime]', error);
       },
-      createServices: (gateway) =>
-        createStarterGameServices({
+      createServices: (gateway) => {
+        const servicesInput = {
           gateway,
-          playerId: identitySession.playerId ?? player.playerId,
           configTarget: runtime.configTarget,
           ...(options.monetization === undefined ? {} : { operationStore: options.monetization.operationStore }),
           analytics: analyticsSink,
           analyticsSessionId,
-        }),
+        };
+        // Configured but not signed in yet: the services wait for the server player, never
+        // binding purchases or the journal to the platform's local placeholder.
+        return sessionGated
+          ? createStarterSessionGatedGameServices({
+              ...servicesInput,
+              signIn: guestSignIn,
+              // The startup recovery the boot ran without a player, with the action coordinator's.
+              onActivated: () => {
+                void gameRuntime?.reconcile().catch((error: unknown) => {
+                  console.error('[game-services] recovery after sign-in failed', error);
+                });
+              },
+            })
+          : createStarterGameServices({
+              ...servicesInput,
+              playerId: identitySession.playerId ?? player.playerId,
+            });
+      },
     });
     gameRuntime = ownedRuntime;
     const gameServices = ownedRuntime.services;
@@ -149,6 +209,7 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
     });
   } catch (error) {
     gameRuntime?.dispose();
+    disposeGuestSignIn?.();
     disposeMicrosoftStorePwa?.();
     renderBootstrapError(error, locale);
     console.error('[bootstrap]', error);

package/templates/phaser-game/src/platform/commerceAccountBinding.ts

@@ -8,23 +8,44 @@ import type { StorePurchaseAccountBinding } from '@mpgd/platform/commerce';
  * (`resolveObfuscatedAccountId` of the Play verifier,
  * `resolveAppAccountToken` of the App Store verifier), which is how the
  * backend ties a store purchase to the player before it grants. This module
- * derives both from a SHA-256 digest of the authenticated player id; a game
- * with its own account scheme replaces these two functions and the backend
+ * derives both from a SHA-256 digest of the server player id (the reference
+ * identity Worker, apps/game-identity-worker, derives the same); a game with
+ * its own account scheme replaces these two functions and the backend
  * resolvers together. Nothing here grants anything.
  */
 export const starterAccountBindingDigestPrefix = 'mpgd-commerce-account:';
 
+/** The game's server player source; see `setStarterCommerceServerPlayer`. */
+let serverPlayer: (() => string | undefined) | undefined;
+
+/**
+ * Binds store purchases to the player of the game's server session (the
+ * identity service's player, a server-issued guest included) instead of the
+ * platform session. A generated game's `guestIdentity.ts` sets it when
+ * `VITE_MPGD_IDENTITY_URL` is configured; `undefined` restores the platform
+ * session. While it is set, no server player (not signed in yet, or the
+ * sign-in failed) binds nothing: the platform's local player never stands in.
+ */
+export function setStarterCommerceServerPlayer(source: (() => string | undefined) | undefined): void {
+  serverPlayer = source;
+}
+
 /**
- * The authenticated player id a purchase is bound to. Only an
- * `authenticated` session whose trust is not `local` binds: a guest, a
- * platform-anonymous session (the native shell's default
- * `android-local-player` / `ios-local-player`), or a locally asserted id
- * would give every install the same binding, and the backend binds the
- * purchase to its own authenticated player id anyway.
+ * The player id a purchase is bound to: the server session's player when
+ * the game set one (`setStarterCommerceServerPlayer`), else an
+ * `authenticated` platform session whose trust is not `local`. A
+ * platform-anonymous session (the native shell's `android-local-player` /
+ * `ios-local-player`) or a locally asserted id would give every install the
+ * same binding, so it binds nothing; the backend binds the purchase to the
+ * player its ingress authentication resolved anyway.
  */
 export async function resolveStarterCommercePlayerId(
   gateway: Pick<PlatformGateway, 'identity'>,
 ): Promise<string | undefined> {
+  if (serverPlayer !== undefined) {
+    const playerId = serverPlayer()?.trim();
+    return playerId === undefined || playerId.length === 0 ? undefined : playerId;
+  }
   let session: IdentitySession | undefined;
   try {
     session = await gateway.identity.getSession?.();
@@ -38,7 +59,11 @@ export async function resolveStarterCommercePlayerId(
   return playerId === undefined || playerId.length === 0 ? undefined : playerId;
 }
 
-/** Google Play `obfuscatedAccountId`: 64 hex characters, within Play's 64-character limit. */
+/**
+ * Google Play `obfuscatedAccountId`: 64 hex characters, within Play's
+ * 64-character limit. `undefined` without a player, which the Play
+ * provider refuses with `ACCOUNT_BINDING_REQUIRED`.
+ */
 export async function resolvePlayBillingAccountBinding(
   gateway: Pick<PlatformGateway, 'identity'>,
 ): Promise<StorePurchaseAccountBinding | undefined> {
@@ -55,7 +80,11 @@ export async function resolveStoreKitAppAccountToken(
 ): Promise<string> {
   const playerId = await resolveStarterCommercePlayerId(gateway);
   if (playerId === undefined) {
-    throw new Error('A StoreKit purchase requires an authenticated player session.');
+    throw new Error(
+      'A StoreKit purchase is bound to the player of a server session, and there is none: '
+        + 'sign in to an identity service first (a generated game: VITE_MPGD_IDENTITY_URL and '
+        + "src/platform/guestIdentity.ts). The native shell's local player cannot bind a purchase.",
+    );
   }
   return toUuid(await digestPlayerId(playerId));
 }