@mpgd/cli 0.6.0 → 0.8.0

package/dist/production-target-readiness.js

@@ -0,0 +1,207 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { isIP } from 'node:net';
+import path from 'node:path';
+const ownerPathByTarget = {
+    ait: 'wrapperApp',
+    android: 'shellApp',
+    ios: 'shellApp',
+};
+export function assertProductionTargetReadiness(input) {
+    if (typeof input.profile !== 'string'
+        || input.profile.length === 0
+        || input.profile.trim() !== input.profile) {
+        throw new Error('Target build profile must be a non-empty string without surrounding whitespace.');
+    }
+    if (input.profile !== 'production') {
+        return;
+    }
+    const ownerPathKey = ownerPathByTarget[input.target];
+    if (ownerPathKey === undefined) {
+        return;
+    }
+    const targetConfig = readTargets(input.targetsFile)[input.target];
+    if (!isRecord(targetConfig)) {
+        throw new Error(`Missing target configuration for ${input.target}.`);
+    }
+    const ownerPath = targetConfig[ownerPathKey];
+    const webDir = targetConfig.webDir;
+    if (typeof ownerPath !== 'string' || ownerPath.length === 0) {
+        throw new Error(`Production target ${input.target} is missing ${ownerPathKey}.`);
+    }
+    if (typeof webDir !== 'string' || webDir.length === 0) {
+        throw new Error(`Production target ${input.target} is missing webDir.`);
+    }
+    const resolvedOwnerPath = path.resolve(path.dirname(input.targetsFile), ownerPath);
+    const resolvedWebDir = path.resolve(path.dirname(input.targetsFile), webDir);
+    const canonicalGameRoot = readCanonicalPath(input.gameRoot, 'game root');
+    const canonicalOwnerPath = readCanonicalPath(resolvedOwnerPath, `${input.target} ${ownerPathKey}`);
+    if (!isDedicatedChildPath(canonicalGameRoot, canonicalOwnerPath)) {
+        throw new Error(`Production target ${input.target} must use a game-owned ${ownerPathKey} inside `
+            + `${canonicalGameRoot}; received ${canonicalOwnerPath}. `
+            + 'Use a non-production profile for kit reference wrapper/shell smoke builds.');
+    }
+    const canonicalWebDir = readCanonicalPathAllowingMissingTail(resolvedWebDir, `${input.target} webDir`);
+    if (!isDedicatedChildPath(canonicalOwnerPath, canonicalWebDir)) {
+        throw new Error(`Production target ${input.target} must keep webDir inside its game-owned `
+            + `${ownerPathKey} ${canonicalOwnerPath}; received ${canonicalWebDir}.`);
+    }
+    if (input.target === 'android' || input.target === 'ios') {
+        const canonicalPlatformDir = readCanonicalPathAllowingMissingTail(path.join(resolvedOwnerPath, input.target), `${input.target} native platform directory`);
+        if (!isDedicatedChildPath(canonicalOwnerPath, canonicalPlatformDir)) {
+            throw new Error(`Production target ${input.target} must keep its native platform directory inside `
+                + `${canonicalOwnerPath}; received ${canonicalPlatformDir}.`);
+        }
+    }
+    assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target);
+}
+function readTargets(targetsFile) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(targetsFile, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Failed to read prepared targets file ${targetsFile}: ${formatError(error)}`);
+    }
+    if (!isRecord(parsed) || !isRecord(parsed.targets)) {
+        throw new Error(`Prepared targets file ${targetsFile} must contain a targets object.`);
+    }
+    return parsed.targets;
+}
+// Equality is rejected: a wrapper or shell must be a dedicated child of the game root.
+function isDedicatedChildPath(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return relative.length > 0
+        && relative !== '..'
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+}
+function readCanonicalPath(candidate, label) {
+    try {
+        return realpathSync(candidate);
+    }
+    catch (error) {
+        throw new Error(`Production ${label} must exist: ${candidate} (${formatError(error)})`);
+    }
+}
+function readCanonicalPathAllowingMissingTail(candidate, label) {
+    let existingPath = candidate;
+    const missingSegments = [];
+    while (!existsSync(existingPath)) {
+        const parent = path.dirname(existingPath);
+        if (parent === existingPath) {
+            throw new Error(`Production ${label} has no existing ancestor: ${candidate}`);
+        }
+        missingSegments.unshift(path.basename(existingPath));
+        existingPath = parent;
+    }
+    return path.join(readCanonicalPath(existingPath, label), ...missingSegments);
+}
+function assertAuthoritativeGameServicesUrl(value, target) {
+    if (value === undefined || value.length === 0) {
+        throw new Error(`Production target ${target} requires VITE_MPGD_GAME_SERVICES_URL for an `
+            + 'authoritative remote backend.');
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`Production target ${target} has an invalid game-services URL.`);
+    }
+    if (url.protocol !== 'https:'
+        || url.username.length > 0
+        || url.password.length > 0
+        || isNonPublicServiceHostname(url.hostname)) {
+        throw new Error(`Production target ${target} requires a public HTTPS game-services URL `
+            + 'without embedded credentials.');
+    }
+}
+function isNonPublicServiceHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/u, '');
+    if (normalized === 'localhost'
+        || normalized.endsWith('.localhost')
+        || normalized.endsWith('.local')) {
+        return true;
+    }
+    const ipVersion = isIP(normalized);
+    if (ipVersion === 4) {
+        return isNonPublicIpv4(normalized);
+    }
+    if (ipVersion === 6) {
+        return isNonPublicIpv6(normalized);
+    }
+    return false;
+}
+function isNonPublicIpv4(address) {
+    const [first = 0, second = 0, third = 0] = address.split('.').map(Number);
+    return first === 0
+        || first === 10
+        || first === 127
+        || (first === 100 && second >= 64 && second <= 127)
+        || (first === 169 && second === 254)
+        || (first === 172 && second >= 16 && second <= 31)
+        || (first === 192 && second === 0 && third === 0)
+        || (first === 192 && second === 0 && third === 2)
+        || (first === 192 && second === 168)
+        || (first === 198 && (second === 18 || second === 19))
+        || (first === 198 && second === 51 && third === 100)
+        || (first === 203 && second === 0 && third === 113)
+        || first >= 224;
+}
+function isNonPublicIpv6(address) {
+    const words = expandIpv6(address);
+    if (words === undefined) {
+        return true;
+    }
+    if (words.slice(0, 7).every((word) => word === 0)) {
+        return true;
+    }
+    if (words.slice(0, 5).every((word) => word === 0) && words[5] === 0xffff) {
+        return isNonPublicIpv4(`${(words[6] ?? 0) >> 8}.${(words[6] ?? 0) & 0xff}.`
+            + `${(words[7] ?? 0) >> 8}.${(words[7] ?? 0) & 0xff}`);
+    }
+    if (words.slice(0, 6).every((word) => word === 0)) {
+        return isNonPublicIpv4(`${(words[6] ?? 0) >> 8}.${(words[6] ?? 0) & 0xff}.`
+            + `${(words[7] ?? 0) >> 8}.${(words[7] ?? 0) & 0xff}`);
+    }
+    const first = words[0] ?? 0;
+    return (first & 0xfe00) === 0xfc00
+        || (first & 0xffc0) === 0xfe80
+        || (first & 0xff00) === 0xff00
+        || (first === 0x2001 && words[1] === 0x0db8);
+}
+function expandIpv6(address) {
+    const sections = address.split('::');
+    if (sections.length > 2) {
+        return undefined;
+    }
+    const head = ipv6Words(sections[0] ?? '');
+    const tail = ipv6Words(sections[1] ?? '');
+    if (head === undefined || tail === undefined) {
+        return undefined;
+    }
+    const omitted = 8 - head.length - tail.length;
+    if ((sections.length === 1 && omitted !== 0) || (sections.length === 2 && omitted < 1)) {
+        return undefined;
+    }
+    return [...head, ...Array.from({ length: omitted }, () => 0), ...tail];
+}
+function ipv6Words(section) {
+    if (section.length === 0) {
+        return [];
+    }
+    const words = [];
+    for (const segment of section.split(':')) {
+        if (!/^[0-9a-f]{1,4}$/u.test(segment)) {
+            return undefined;
+        }
+        words.push(Number.parseInt(segment, 16));
+    }
+    return words;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function formatError(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -47,20 +47,20 @@
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
-    "@mpgd/adapter-browser": "0.4.0",
-    "@mpgd/adapter-devvit": "0.4.0",
-    "@mpgd/adapter-capacitor": "0.4.0",
-    "@mpgd/analytics": "0.3.3",
-    "@mpgd/adapter-ait": "0.4.0",
-    "@mpgd/bridge": "0.5.0",
-    "@mpgd/catalog": "0.3.3",
-    "@mpgd/i18n": "0.4.1",
-    "@mpgd/game-services": "0.4.0",
-    "@mpgd/phaser-assets": "0.4.0",
-    "@mpgd/platform": "0.4.0",
-    "@mpgd/target-config": "0.5.0"
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
+    "@mpgd/adapter-ait": "0.4.2",
+    "@mpgd/adapter-browser": "0.4.2",
+    "@mpgd/adapter-capacitor": "0.4.2",
+    "@mpgd/adapter-devvit": "0.6.0",
+    "@mpgd/analytics": "0.3.5",
+    "@mpgd/bridge": "0.6.0",
+    "@mpgd/game-services": "0.6.0",
+    "@mpgd/catalog": "0.3.5",
+    "@mpgd/i18n": "0.5.1",
+    "@mpgd/phaser-assets": "0.4.1",
+    "@mpgd/platform": "0.5.1",
+    "@mpgd/target-config": "0.6.1"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/phaser-game/README.md

@@ -32,6 +32,7 @@ pnpm exec mpgd target build-all \
   --targets-file ./mpgd.targets.json \
   --kit-path ../mpgd-kit \
   --targets web,microsoft-store,ait,reddit \
+  --profile staging \
   --ait-variant wrapper
 pnpm exec mpgd target smoke-all \
   --targets-file ./mpgd.targets.json \
@@ -51,6 +52,7 @@ pnpm --dir ../mpgd-kit mpgd target build-all \
   --targets-file "$PWD/mpgd.targets.json" \
   --kit-path ../mpgd-kit \
   --targets web,microsoft-store,ait,reddit \
+  --profile staging \
   --ait-variant wrapper
 ```
 
@@ -58,10 +60,37 @@ pnpm --dir ../mpgd-kit mpgd target build-all \
 into `.mpgd.targets.generated.json` before calling the kit's existing target
 build and smoke scripts.
 
+The starter's Apps in Toss and Capacitor entries intentionally point at kit
+reference wrappers, so their reusable validation builds use the `staging`
+profile. Before an AIT, Android, or iOS production build, copy or create the
+wrapper/shell under this game directory, update `mpgd.targets.json`, and set
+`VITE_MPGD_GAME_SERVICES_URL` to a public HTTPS endpoint without embedded
+credentials. Production preflight resolves real paths, rejects wrappers or
+shells outside the game root (including symbolic-link escapes), and blocks
+localhost plus literal private or reserved IP addresses.
+
 `mpgd target doctor` verifies that release manifest artifact paths stay under
 this game directory, even when a build used the kit reference Apps in Toss or
 Capacitor wrappers.
 
+## Acceptance Handoff
+
+Run the reusable acceptance workflow before handing the game off:
+
+```sh
+pnpm accept
+```
+
+The command runs `check`, an optional `test` script, `build`, the kit's ttsc
+graph preflight, an optional game-owned `playtest` script, and the configured
+target build/smoke matrix. Results are written as JSON and Markdown under
+`artifacts/acceptance`. Add a non-interactive `playtest` package script when the
+game has an automated browser scenario; interactive platform playtests remain
+separate operator workflows.
+Each command has a 30-minute timeout by default. Pass `--timeout-ms` to the
+underlying `mpgd game accept` command when a target matrix needs a different
+per-step limit.
+
 ## Assets
 
 Static assets live under `src/assets` and are declared in
@@ -116,6 +145,24 @@ soft rotate prompt on mismatch. The generated PWA manifest also declares
 that manifest value aligned with the runtime policy if you make a portrait-first
 game.
 
+## App Icons
+
+`mpgd.game.json` owns one canonical PNG or SVG app icon source. Target profiles
+derive each platform's required sizes, safe zones, alpha policy, and native or
+wrapper staging files.
+
+```sh
+pnpm icons:generate
+pnpm icons:verify
+pnpm icons:inspect
+```
+
+Use each target's optional `icon` object in `mpgd.targets.json` for a profile,
+background, source, or variant override. The release evidence still records the
+shared canonical source separately from an override render source. Before an
+Apps in Toss production package build, upload the generated 600x600 icon in the
+console and configure the returned HTTPS URL as `ait.icon.externalUrl`.
+
 ## Reddit Devvit
 
 This starter owns its Devvit app root in `apps/target-devvit`. That directory
@@ -126,10 +173,17 @@ The generated `devvit.json` app name is a Devvit-safe slug derived from the game
 directory name; edit it before `devvit:init` if you need a different Reddit app
 name.
 
+The default post entry builds a lightweight inline preview without importing
+Phaser. Its Play button requests the separate `game` entrypoint, whose
+`game.html` document starts the Phaser bundle directly. Keep these physical
+entries separate when customizing the preview so Reddit cards do not pay the
+game runtime cost before expansion.
+
 First-time Devvit setup:
 
 ```sh
 pnpm install -w
+pnpm icons:generate:devvit:production
 pnpm devvit:login
 pnpm devvit:whoami
 pnpm devvit:init
@@ -218,7 +272,14 @@ submission.
 - Microsoft Store is a game-owned PWA target that reuses the browser adapter and
   writes to `artifacts/microsoft-store` with `manifest.webmanifest` for
   PWABuilder packaging. Replace the starter icon and manifest metadata before
-  Store submission.
+  Store submission. Production builds also emit `pwa-release.json` and an
+  atomic offline `service-worker.js`; its deterministic revision covers every
+  precached artifact plus the game and kit Git provenance. Updates intentionally
+  wait while any old app window remains open. Listen for
+  `mpgd:pwa-update-ready` to tell players to close every window and reopen the
+  app; do not force activation with `skipWaiting()`. Keep the web manifest `id`
+  game-specific because the cache namespace uses it to isolate apps sharing an
+  origin.
 - Reddit Devvit is game-owned in `apps/target-devvit`.
 - Apps in Toss currently uses the kit reference wrapper at
   `${MPGD_KIT_PATH}/apps/target-ait` for smoke packaging. Before a real Toss
@@ -242,3 +303,12 @@ VITE_MPGD_GAME_SERVICES_TRANSPORT=http
 
 Use `VITE_MPGD_GAME_SERVICES_TRANSPORT=orpc` with a `/rpc` URL to test the oRPC
 client path.
+
+The generated starter uses `createGameServicesRuntime` for backend selection
+and treats only the exact Vite `production` profile as production authority.
+Production fails closed when the URL is absent or is not public HTTPS without
+credentials: Game Services reports `missing_authoritative_backend` or
+`invalid_authoritative_backend` and does not create a client. Process-local
+backends require both a non-production authority mode and an explicit
+`allowLocalBackend` opt-in, so they cannot manufacture successful production
+purchase, rewarded-ad, or leaderboard ledger results.

package/templates/phaser-game/agent/acceptance.md

@@ -3,22 +3,28 @@
 Run these checks before handing off a generated game starter:
 
 ```sh
-pnpm check
-pnpm build
-pnpm --dir ../mpgd-kit mpgd target build-all --targets-file "$PWD/mpgd.targets.json" --targets web,microsoft-store,ait,reddit --ait-variant wrapper
-pnpm --dir ../mpgd-kit mpgd target smoke-all --targets-file "$PWD/mpgd.targets.json" --targets web,microsoft-store,ait,reddit
-pnpm --dir ../mpgd-kit mpgd target doctor --targets-file "$PWD/mpgd.targets.json" --targets web,microsoft-store,ait,reddit
+pnpm icons:generate
+pnpm icons:verify
+pnpm accept
 ```
 
+`pnpm accept` runs the configured game check, optional test and playtest scripts,
+game build, kit TypeScript graph preflight, and the reusable target build/smoke
+matrix. It writes `artifacts/acceptance/acceptance-report.json` and
+`acceptance-report.md` for handoff. Missing optional `test` or `playtest` scripts
+are recorded as skipped; check and build remain required.
+
 For Apps in Toss changes, use the apps-in-toss MCP before implementation and
 keep SDK calls inside adapters or target wrappers.
 Resolve identity and launch intents during bootstrap, treat inbound share data as
 untrusted, and keep notification delivery on the server.
 
-For Reddit Devvit changes, keep Devvit SDK calls inside the target wrapper and
+For Reddit Devvit changes, keep Devvit SDK calls inside the adapter or target wrapper and
 continue to expose game-facing behavior through `PlatformGateway`. The Devvit
 app root is game-owned in `apps/target-devvit`; run `pnpm devvit:init` once
 after login before upload or playtest.
+Verify the default post entry renders only the lightweight inline preview and
+the `game` entry opens the separate expanded Phaser document.
 
 For Microsoft Store changes, keep the first pass as a PWA/web target that uses
 the browser adapter. Add a dedicated Store commerce adapter only when wiring

package/templates/phaser-game/agent/brief.md

@@ -18,7 +18,9 @@ Useful commands:
 pnpm dev
 pnpm check
 pnpm build
-pnpm exec mpgd target build-all --targets-file ./mpgd.targets.json --kit-path ../mpgd-kit --targets web,microsoft-store,ait,reddit --ait-variant wrapper
+pnpm icons:generate
+pnpm icons:verify
+pnpm exec mpgd target build-all --targets-file ./mpgd.targets.json --kit-path ../mpgd-kit --targets web,microsoft-store,ait,reddit --profile staging --ait-variant wrapper
 pnpm devvit:login
 pnpm devvit:init
 pnpm devvit:playtest

package/templates/phaser-game/agent/game-manifest.json

@@ -37,6 +37,10 @@
       "id": "platform.devvit.app-root",
       "owner": "apps/target-devvit"
     },
+    {
+      "id": "platform.devvit.surface-split",
+      "owner": "src/platform/devvitEntrypoint.ts"
+    },
     {
       "id": "services.backend.game-services",
       "owner": "src/platform/gameServices.ts"
@@ -51,6 +55,9 @@
     }
   ],
   "acceptance": [
+    "pnpm accept",
+    "pnpm icons:generate",
+    "pnpm icons:verify",
     "pnpm check",
     "pnpm build"
   ]

package/templates/phaser-game/apps/target-cloudflare-pages/package.json

@@ -19,9 +19,9 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260707.1",
-    "@ttsc/unplugin": "0.16.9",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
+    "@ttsc/unplugin": "0.18.4",
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
     "vite": "^8.1.3",
     "wrangler": "^4.107.0"
   }

package/templates/phaser-game/apps/target-devvit/README.md

@@ -25,7 +25,73 @@ available and the CLI asks for a manual code. After that, use
 `pnpm devvit:playtest`, `pnpm devvit:upload`, and `pnpm devvit:publish` from the
 game root.
 
-The client bundle is copied into `dist/client` by the mpgd target build. The server bridge is
-compiled to `dist/server/index.cjs` and keeps Devvit SDK imports out of Phaser scenes.
-The game root pins `@mpgd/cli`, so these commands use the same CLI version as the generated
-starter's other `@mpgd/*` dependencies.
+The official `@devvit/start/vite` plugin builds the game client into
+`dist/client` and the CommonJS server bridge into `dist/server/index.cjs` in one
+pass. The mpgd target build wraps that unified build with release provenance and
+effective-target evidence while keeping Devvit SDK imports out of Phaser scenes.
+The game root pins `@mpgd/cli`, so these commands use the same CLI version as the
+generated starter's other `@mpgd/*` dependencies.
+
+The bridge endpoint at `/api/mpgd/rpc` uses the direct oRPC Node HTTP adapter
+from `@mpgd/bridge/orpc/node`; Express, Hono, and Fetch request conversion are
+not required. Devvit-owned menu, scheduler, trigger, and form callbacks remain
+thin `/internal/...` routes and delegate to shared service functions. oRPC
+Publisher helpers can broadcast results after a task completes, but they do not
+replace the `devvit.json` scheduler endpoint and should not use process-local
+memory when delivery must cross instances. A thin `/api/mpgd/bridge` JSON route
+remains available for callers that explicitly configure the adapter's legacy
+`endpoint` option; new traffic uses oRPC by default.
+
+The default post entry uses `index.html` for a lightweight inline preview. Its
+Play button requests the `game` entrypoint, which loads the separate
+`game.html` Phaser document. Keep inline UI free of game runtime imports so the
+card remains lightweight before expansion.
+
+`devvit playtest` runs the official unified Vite build in watch mode, so a
+separate client/server watcher or staging prebuild is not required.
+
+## Durable Post Operations
+
+Use `src/server/postOperationStore.ts` with `@mpgd/adapter-devvit/server` for a
+server action or scheduler that may receive the same custom-post operation more
+than once. Use `{ appScope, subredditId }` as the scope, a stable `operationType`
+in the definition, and an `operationId` for each logical publication slot. Validate
+the public payload and launch parameters, then inject the Redis-backed store into
+`createDevvitPostOperationCoordinator`.
+
+The contract is duplicate-safe and ambiguity-safe, not exactly-once. It persists
+the attempt before invoking Reddit. If Reddit accepts the post but its response is
+lost, or the process stops before the receipt is saved, repeating `execute` returns
+`reconciliation-required` and never blindly calls the submit function again. An
+explicit recovery endpoint or scheduler calls `reconcile`, which requires an exact
+match of the full canonical envelope. A missing match from a bounded listing
+remains unresolved rather than restoring submit permission.
+
+Keep operation definitions and `@devvit/web/server` imports inside this target
+app. The canonical `{ mpgd, launch, payload }` envelope is public and untrusted;
+keep private content and authoritative records in server-side storage. Exercise
+first success, duplicate calls, interruption,
+response loss, lease expiry with concurrent reconciliation, malformed durable
+state, invalid launch metadata, and cross-scope key isolation before enabling a
+scheduled or user-triggered publication flow.
+
+## AI-assisted Devvit development
+
+Devvit provides an optional MCP server for targeted documentation search and
+deployed-app log inspection. See the official
+[Devvit AI Tools guide](https://developers.reddit.com/docs/guides/ai), then
+register it once in the developer's global Codex configuration:
+
+```sh
+codex mcp add devvit -- npx -y @devvit/mcp
+```
+
+Restart Codex or begin a new task after registering it. Use `devvit_search`
+before broad Devvit documentation exploration. Use the experimental
+`devvit_logs` tool for a deployed app and subreddit when diagnosing production
+or playtest behavior, and confirm its findings with local tests and
+`pnpm devvit:playtest`.
+
+The MCP server is an agent-side aid only. It is not required by the generated
+game build, must not be bundled into target artifacts, and does not replace
+Devvit CLI authentication or release verification.

package/templates/phaser-game/apps/target-devvit/devvit.json

@@ -1,12 +1,19 @@
 {
   "$schema": "https://developers.reddit.com/schema/config-file.v1.json",
   "name": "__DEVVIT_APP_NAME__",
+  "marketingAssets": {
+    "icon": "generated/marketing-icon.png"
+  },
   "post": {
     "dir": "dist/client",
     "entrypoints": {
       "default": {
         "entry": "index.html",
         "height": "tall"
+      },
+      "game": {
+        "entry": "game.html",
+        "height": "tall"
       }
     }
   },
@@ -34,7 +41,7 @@
     ]
   },
   "scripts": {
-    "dev": "pnpm dev:prepare && pnpm dev:watch",
+    "dev": "vite build --mode staging --watch",
     "build": "pnpm build"
   }
 }

package/templates/phaser-game/apps/target-devvit/package.json

@@ -4,37 +4,32 @@
   "version": "0.0.0",
   "type": "module",
   "scripts": {
-    "init": "devvit upload --config devvit.json",
-    "init:copy-paste": "devvit upload --copy-paste --config devvit.json",
-    "dev": "devvit playtest --config devvit.json",
-    "dev:prepare": "pnpm --dir ../.. build:devvit:staging",
-    "dev:client": "APP_TARGET=reddit APP_VERSION=0.0.0-dev BUILD_ID=devvit-watch pnpm --dir ../.. exec vite build --mode staging --watch --outDir apps/target-devvit/dist/client",
-    "dev:server": "vite build --config vite.server.config.ts --watch",
-    "dev:watch": "concurrently --kill-others --success first \"pnpm run dev:client\" \"pnpm run dev:server\"",
+    "prepare:icon": "pnpm --dir ../.. icons:generate:devvit",
+    "prepare:icon:production": "pnpm --dir ../.. icons:generate:devvit:production",
+    "init": "pnpm run prepare:icon:production && devvit upload --config devvit.json",
+    "init:copy-paste": "pnpm run prepare:icon:production && devvit upload --copy-paste --config devvit.json",
+    "dev": "pnpm run prepare:icon && devvit playtest --config devvit.json",
     "build": "pnpm --dir ../.. build:devvit",
-    "build:server": "vite build --config vite.server.config.ts",
     "whoami": "devvit whoami",
-    "upload": "devvit upload --config devvit.json",
-    "publish": "devvit publish --config devvit.json",
+    "upload": "pnpm run prepare:icon:production && devvit upload --config devvit.json",
+    "publish": "pnpm run prepare:icon:production && devvit publish --config devvit.json",
     "check": "ttsc --noEmit -p tsconfig.json",
     "lint": "ttsc --noEmit -p tsconfig.json",
     "format": "ttsc format",
     "fix": "ttsc fix"
   },
   "dependencies": {
-    "@devvit/web": "0.13.6",
-    "@mpgd/bridge": "__MPGD_DEPENDENCY_VERSION_BRIDGE__",
-    "express": "^5.2.1",
-    "helmet": "^8.1.0"
+    "@devvit/web": "0.13.7",
+    "@mpgd/adapter-devvit": "__MPGD_DEPENDENCY_VERSION_ADAPTER_DEVVIT__",
+    "@mpgd/bridge": "__MPGD_DEPENDENCY_VERSION_BRIDGE__"
   },
   "devDependencies": {
-    "@ttsc/unplugin": "0.16.9",
-    "@types/express": "^5.0.6",
+    "@devvit/start": "0.13.7",
+    "@ttsc/unplugin": "0.18.4",
     "@types/node": "^24.0.0",
-    "concurrently": "10.0.3",
-    "devvit": "0.13.6",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
+    "devvit": "0.13.7",
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
     "vite": "^8.1.3"
   }
 }

package/templates/phaser-game/apps/target-devvit/src/client/game.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#0f172a" />
+    <title>__GAME_TITLE__</title>
+  </head>
+  <body>
+    <div id="game"></div>
+    <script type="module" src="./game.ts"></script>
+  </body>
+</html>

package/templates/phaser-game/apps/target-devvit/src/client/game.ts

@@ -0,0 +1,3 @@
+await import('../../../../src/gameEntry');
+
+export {};

package/templates/phaser-game/apps/target-devvit/src/client/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#0f172a" />
+    <title>__GAME_TITLE__</title>
+  </head>
+  <body>
+    <div id="game"></div>
+    <script type="module" src="./preview.ts"></script>
+  </body>
+</html>

package/templates/phaser-game/apps/target-devvit/src/client/preview.ts

@@ -0,0 +1,3 @@
+await import('../../../../src/entry');
+
+export {};