@mpgd/cli 0.64.0 → 0.66.0

package/dist/production-target-readiness.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { isIP } from 'node:net';
 import path from 'node:path';
+import { isHostedGameServicesPath } from '@mpgd/platform/routes';
 const wechatStagingAppId = 'wx0000000000000000';
 const ownerPathByTarget = {
     ait: 'wrapperApp',
@@ -48,7 +49,7 @@ export function assertProductionTargetReadiness(input) {
     }
     if (ownerPathKey === undefined) {
         if (requiresMonetizationAuthority || targetConfig.authoritativeGameServices !== false) {
-            assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target);
+            assertAuthoritativeGameServicesUrl(input.gameServicesUrl, input.target, targetConfig.kind === 'web' && requiresWebMonetizationAuthority);
         }
         return;
     }
@@ -167,11 +168,17 @@ function readCanonicalPathAllowingMissingTail(candidate, label) {
     }
     return path.join(readCanonicalPath(existingPath, label), ...missingSegments);
 }
-function assertAuthoritativeGameServicesUrl(value, target) {
+function assertAuthoritativeGameServicesUrl(value, target, allowSameOrigin = false) {
     if (value === undefined || value.length === 0) {
         throw new Error(`Production target ${target} requires VITE_MPGD_GAME_SERVICES_URL for an `
             + 'authoritative remote backend.');
     }
+    // Hosted web/PWA clients can reach an authoritative service through their
+    // own Pages/edge ingress. Never apply this allowance to third-party/native
+    // hosts, or accept paths that URL normalization can turn into another host.
+    if (allowSameOrigin && isHostedGameServicesPath(value)) {
+        return;
+    }
     let url;
     try {
         url = new URL(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -63,37 +63,37 @@
     "gunshi": "^0.35.1",
     "semver": "^7.8.5",
     "sharp": "0.35.5",
-    "typia": "13.0.2",
+    "typia": "15.2.1",
     "undici": "^7.29.1",
     "vite": "8.1.3",
     "yauzl": "3.4.0",
     "parse5": "7.3.0",
     "postcss": "8.5.28",
     "postcss-value-parser": "4.2.0",
-    "@mpgd/catalog": "0.13.0",
-    "@mpgd/platform": "0.32.0",
-    "@mpgd/target-config": "0.24.3",
-    "@mpgd/phaser-assets": "0.9.1"
+    "@mpgd/catalog": "0.14.1",
+    "@mpgd/phaser-assets": "0.9.1",
+    "@mpgd/platform": "0.34.0",
+    "@mpgd/target-config": "0.24.5"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@types/semver": "^7.8.0",
     "@types/yauzl": "3.4.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
-    "@mpgd/adapter-ait": "0.21.5",
-    "@mpgd/adapter-browser": "0.12.1",
-    "@mpgd/adapter-capacitor": "0.16.3",
-    "@mpgd/adapter-devvit": "0.14.7",
-    "@mpgd/adapter-verse8": "0.7.16",
-    "@mpgd/bridge": "0.16.4",
-    "@mpgd/analytics": "0.5.5",
-    "@mpgd/game-runtime": "0.8.9",
-    "@mpgd/capacitor-play-billing": "0.4.5",
-    "@mpgd/capacitor-storekit": "0.4.5",
-    "@mpgd/game-services": "0.30.5",
-    "@mpgd/i18n": "0.6.26",
-    "@mpgd/lite-shell": "0.1.0"
+    "@mpgd/adapter-ait": "0.21.7",
+    "@mpgd/adapter-capacitor": "0.18.0",
+    "@mpgd/adapter-browser": "0.12.3",
+    "@mpgd/adapter-devvit": "0.14.9",
+    "@mpgd/adapter-verse8": "0.7.18",
+    "@mpgd/bridge": "0.18.0",
+    "@mpgd/capacitor-play-billing": "0.6.0",
+    "@mpgd/analytics": "0.5.7",
+    "@mpgd/capacitor-storekit": "0.6.0",
+    "@mpgd/game-runtime": "0.9.0",
+    "@mpgd/game-services": "0.32.0",
+    "@mpgd/lite-shell": "0.1.0",
+    "@mpgd/i18n": "0.6.28"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/lite-overlay/README.md

@@ -16,6 +16,10 @@ pnpm accept
 Standalone games install the public `@mpgd/lite-shell` package. Add `--workspace --kit-path <mpgd-kit>` to generate a game linked to a local Kit checkout.
 The CLI supports the canvas renderer; DOM and SVG renderers are planned.
 
+ttsc 0.34 compiles its type-transform plugins with Go 1.27 or later. It uses
+the Go it bundles unless `TTSC_GO_BINARY` names another one; if your mise or
+CI configuration pins Go for ttsc, pin 1.27 or later (the Kit uses 1.27.3).
+
 ## Ownership
 
 - `src/game/state.ts`: deterministic state.

package/templates/lite-overlay/apps/target-devvit/README.md

@@ -41,6 +41,16 @@ replace the `devvit.json` scheduler endpoint and should not use process-local
 memory when delivery must cross instances. The generated target exposes only
 the oRPC bridge route; the former JSON compatibility route is not generated.
 
+The bridge client (game `@mpgd/adapter-devvit`) and the bridge server
+(`src/server`) must ship in the same app build: they share one `@mpgd/bridge`
+and therefore one oRPC version. oRPC error bodies are not compatible across
+oRPC 2.0.0-beta.34 (`@mpgd/bridge` 0.16.4 and older used 2.0.0-beta.14), so a
+client and server from different kit releases would turn every oRPC error into a
+malformed-response failure. Bridge method errors and request-validation
+failures travel inside the bridge response envelope and are unaffected; only
+internal server errors and oRPC transport errors (413, undecodable bodies) use
+the oRPC error body.
+
 The default post entry uses `index.html` for a playable Canvas2D surface.
 Play full screen requests the `game` entrypoint, which loads the full game from
 the separate `game.html` document. Keep heavy imports behind the expanded entry

package/templates/notifications-overlay/common/src/platform/notificationBackend.ts

@@ -1,6 +1,7 @@
 import {
   isPublicGameServicesUrl,
   resolveGameServicesAuthorityMode,
+  resolveGameServicesBaseUrl,
   type GameServicesHeaderResolver,
 } from '@mpgd/game-services';
 import {
@@ -82,7 +83,10 @@ export function createStarterWorkerNotificationBackend(
   if (platform.target === 'reddit' || targetsWithoutWorkerBackend.has(platform.configTarget)) {
     return undefined;
   }
-  const baseUrl = input.baseUrl?.trim();
+  const baseUrl = resolveGameServicesBaseUrl(input.baseUrl, {
+    target: platform.target,
+    ...(globalThis.location?.origin === undefined ? {} : { pageOrigin: globalThis.location.origin }),
+  });
   const provider = platform.notificationsV2;
   if (baseUrl === undefined || baseUrl === '' || provider === undefined) {
     return undefined;

package/templates/phaser-game/README.md

@@ -16,6 +16,10 @@ pnpm check
 pnpm build
 ```
 
+ttsc 0.34 compiles its type-transform plugins with Go 1.27 or later. It uses
+the Go it bundles unless `TTSC_GO_BINARY` names another one; if your mise or
+CI configuration pins Go for ttsc, pin 1.27 or later (the Kit uses 1.27.3).
+
 The starter keeps game code behind `PlatformGateway` and demonstrates:
 
 - target-aware adapter selection through `APP_TARGET`
@@ -515,8 +519,8 @@ session: Google Play's `obfuscatedAccountId` and StoreKit's `appAccountToken`
 are derived from that player's id (`src/platform/commerceAccountBinding.ts`),
 and the backend checks them before it grants. The native shell's local player
 (`android-local-player` / `ios-local-player`) is the same on every install, so
-it binds nothing: Play refuses with `ACCOUNT_BINDING_REQUIRED` and StoreKit
-throws an error naming the missing session.
+it binds nothing: both stores refuse the purchase before the sheet opens with
+a `failed` result whose code is `ACCOUNT_BINDING_REQUIRED`.
 
 Point the game at the kit's reference guest identity Worker
 (`apps/game-identity-worker` in mpgd-kit, deployed per
@@ -553,7 +557,32 @@ be claimed. The scenes' `player` and `identitySession` are the boot values
 for the whole run (the platform's player when the boot sign-in failed) and
 the server player from the next launch on: key game-owned save data by
 something that does not change, such as the platform storage itself, not by
-`player.playerId`. A native shell only reaches `https:` origins, so test on a
+`player.playerId`.
+
+The game services belong to one server player for the run
+(`src/platform/gameServices.ts`). A game that replaces the guest session with
+its own and lets the player switch accounts within a run gets them closed, not
+moved to the new account: from the moment the session names another player,
+nothing is verified, restored, or finished with the new player's credentials
+for the old player's purchases (a backend answers those as another account's
+purchase), no purchase is journaled under one player and bound to the
+other's store account, and purchases answer `failed` with the retryable
+diagnostic `GAME_SERVICES_PLAYER_CHANGED` before any store sheet opens.
+`main.ts` stops play at once (`onPlayerChanging`: an execution block and a
+"Switching player..." screen), and once the old services have stopped (an
+open store sheet first records its answer) it reloads the game
+(`restartForAnotherPlayer`), which boots again for the new player; replace the
+reload with your own restart if it does not suit the target. The old player's
+open purchases stay in the journal and recover when that player signs in
+again; store purchases bound to another player's account are left for that
+player instead of being verified with this one's session. Create the services
+only with the server session's player, never the native shell's local
+placeholder: services created for another player than the session's are
+closed at once (and say so in the console), and services for a second player cannot be
+created while the first player's are still open
+(`StarterCommercePinConflictError`).
+
+A native shell only reaches `https:` origins, so test on a
 device or emulator through an https tunnel to a local Worker. Account linking (Sign in with Apple or Google) is not
 part of the reference Worker yet.
 

package/templates/phaser-game/apps/target-ait/package.json

@@ -21,9 +21,9 @@
   },
   "devDependencies": {
     "@apps-in-toss/cli": "3.9.0",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3"
   }

package/templates/phaser-game/apps/target-cloudflare-pages/package.json

@@ -19,8 +19,8 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260707.1",
-    "@ttsc/unplugin": "0.32.1",
-    "ttsc": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3",
     "wrangler": "^4.107.0"

package/templates/phaser-game/apps/target-devvit/README.md

@@ -41,6 +41,16 @@ replace the `devvit.json` scheduler endpoint and should not use process-local
 memory when delivery must cross instances. The generated target exposes only
 the oRPC bridge route; the former JSON compatibility route is not generated.
 
+The bridge client (game `@mpgd/adapter-devvit`) and the bridge server
+(`src/server`) must ship in the same app build: they share one `@mpgd/bridge`
+and therefore one oRPC version. oRPC error bodies are not compatible across
+oRPC 2.0.0-beta.34 (`@mpgd/bridge` 0.16.4 and older used 2.0.0-beta.14), so a
+client and server from different kit releases would turn every oRPC error into a
+malformed-response failure. Bridge method errors and request-validation
+failures travel inside the bridge response envelope and are unaffected; only
+internal server errors and oRPC transport errors (413, undecodable bodies) use
+the oRPC error body.
+
 The default post entry uses `index.html` for a fixed, non-scrolling preview.
 Play full screen requests the `game` entrypoint, which loads Phaser from the
 separate `game.html` document. Keep preview UI free of game runtime imports so

package/templates/phaser-game/apps/target-devvit/package.json

@@ -27,10 +27,10 @@
   },
   "devDependencies": {
     "@devvit/start": "0.15.0",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
     "devvit": "0.15.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "7.3.6"
   }

package/templates/phaser-game/package.json

@@ -81,9 +81,9 @@
     "@ait-co/console-cli": "^0.1.49",
     "@cloudflare/workers-types": "^5.20260707.1",
     "@mpgd/cli": "__MPGD_DEPENDENCY_VERSION_CLI__",
-    "@ttsc/unplugin": "0.32.1",
+    "@ttsc/unplugin": "0.34.2",
     "@types/node": "^24.0.0",
-    "ttsc": "0.32.1",
+    "ttsc": "0.34.2",
     "typescript": "7.0.2",
     "vite": "8.1.3",
     "wrangler": "^4.107.0"

package/templates/phaser-game/src/i18n/messages.ts

@@ -28,6 +28,7 @@ export type GameMessageKey =
   | 'restoreNeedsSession'
   | 'restoreNeedsConnection'
   | 'restoreFailed'
+  | 'switchingPlayer'
   | 'deleteAccount'
   | 'deleteAccountConfirm'
   | 'deleteAccountPendingPurchase'
@@ -72,6 +73,7 @@ const messages = {
     restoreNeedsSession: 'Restoring purchases needs a game server session',
     restoreNeedsConnection: 'Could not reach the game server. Tap to try again.',
     restoreFailed: 'Could not restore purchases. Try again later.',
+    switchingPlayer: 'Switching player...',
     deleteAccount: 'Delete account',
     deleteAccountConfirm:
       'Delete your account? Your progress, scores, and notification settings are erased and you are signed out. '
@@ -120,6 +122,7 @@ const messages = {
     restoreNeedsSession: '구매를 복원하려면 게임 서버 세션이 필요합니다',
     restoreNeedsConnection: '게임 서버에 연결하지 못했습니다. 다시 시도하려면 누르세요.',
     restoreFailed: '구매를 복원하지 못했습니다. 나중에 다시 시도하세요.',
+    switchingPlayer: '플레이어를 전환하는 중...',
     deleteAccount: '계정 삭제',
     deleteAccountConfirm:
       '계정을 삭제할까요? 진행 상황, 점수, 알림 설정이 지워지고 로그아웃됩니다. '

package/templates/phaser-game/src/main.ts

@@ -27,6 +27,9 @@ import { setStarterServerSession } from './platform/serverSession';
 import { installPlatform } from './platform/installPlatform';
 import { installMicrosoftStorePwa } from './platform/microsoftStorePwa';
 
+/** Set by the first restart for another player (before bootstrap, which may call it). */
+let restartingForAnotherPlayer = false;
+
 await bootstrap();
 
 /** Install target services, analytics, and viewport state before starting the game. */
@@ -150,6 +153,17 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
           ...(options.monetization === undefined ? {} : { operationStore: options.monetization.operationStore }),
           analytics: analyticsSink,
           analyticsSessionId,
+          // The services are one player's for the run: another player signing in closes them
+          // (purchases fail closed, retryably). Play stops at once; the game boots again for
+          // that player once the old services have stopped.
+          onPlayerChanging: () => {
+            gameRuntime?.execution.acquireBlock({
+              reason: 'game-services:player-change',
+              channels: ['simulation', 'gameplay-input', 'audio'],
+            });
+            renderPlayerSwitch(locale);
+          },
+          onPlayerChanged: restartForAnotherPlayer,
         };
         // Configured but not signed in yet: the services wait for the server player, never
         // binding purchases or the journal to the platform's local placeholder.
@@ -216,6 +230,34 @@ async function bootstrap(options: { readonly monetization?: StarterMonetizationP
   }
 }
 
+/**
+ * Another player signed in to the server session within the run (a game's own
+ * account switch; the reference guest never changes player). The game
+ * services already closed for the boot player; the scenes, the action
+ * coordinator, and the notifications still hold it, so the game boots again
+ * and builds them all for the new player. Replace the reload with your own
+ * restart (back to the title, then `bootstrap()`) if a reload does not suit
+ * the target.
+ */
+function restartForAnotherPlayer(): void {
+  if (!restartingForAnotherPlayer) {
+    restartingForAnotherPlayer = true;
+    globalThis.location?.reload();
+  }
+}
+
+/** Cover the game while it restarts for another player (taps never reach it meanwhile). */
+function renderPlayerSwitch(locale: Locale): void {
+  if (document.querySelector('.player-switch') !== null) {
+    return;
+  }
+  const overlay = document.createElement('div');
+  overlay.className = 'player-switch';
+  overlay.setAttribute('role', 'status');
+  overlay.textContent = t(locale, 'switchingPlayer');
+  document.body.append(overlay);
+}
+
 /** Resolve a verified platform session or fall back to a local guest. */
 async function resolveIdentitySession(
   platform: PlatformGateway,

package/templates/phaser-game/src/platform/buildGateways/capacitorAndroid.ts

@@ -51,6 +51,11 @@ function createStoreProviders(
   return [
     createCapacitorPlayBillingServiceProvider({
       products,
+      // Sales switch (none by default): to refuse NEW purchases without
+      // touching recovery, add `purchaseGate: async () => ({ allowed })`,
+      // `allowed` read from the game's own server flag. A refusal answers
+      // ITEM_UNAVAILABLE / PURCHASES_PAUSED before the store opens; paid
+      // purchases keep reconciling. See the adapter-capacitor README.
       // The backend's resolveObfuscatedAccountId must derive the same value; see commerceAccountBinding.ts.
       accountBinding: async () => {
         const gateway = resolveGateway();

package/templates/phaser-game/src/platform/buildGateways/capacitorIos.ts

@@ -48,6 +48,11 @@ function createStoreProviders(
   return [
     createCapacitorStoreKitServiceProvider({
       products,
+      // Sales switch (none by default): to refuse NEW purchases without
+      // touching recovery, add `purchaseGate: async () => ({ allowed })`,
+      // `allowed` read from the game's own server flag. A refusal answers
+      // ITEM_UNAVAILABLE / PURCHASES_PAUSED before the store opens; paid
+      // purchases keep reconciling. See the adapter-capacitor README.
       // The backend's resolveAppAccountToken must derive the same value; see commerceAccountBinding.ts.
       getAppAccountToken: async () => {
         const gateway = resolveGateway();

package/templates/phaser-game/src/platform/commerceAccountBinding.ts

@@ -30,6 +30,37 @@ export function setStarterCommerceServerPlayer(source: (() => string | undefined
   serverPlayer = source;
 }
 
+/** The open pins: one per game services instance, all for the same player. */
+const pins = new Set<{ readonly playerId: string }>();
+
+/** Another player's game services are still open; dispose them before creating these. */
+export class StarterCommercePinConflictError extends Error {
+  constructor() {
+    super("Another player's game services are still open; dispose them before creating these.");
+    this.name = 'StarterCommercePinConflictError';
+  }
+}
+
+/**
+ * Pins purchases to the player a game services instance was created for
+ * (`createStarterGameServices` does, and releases it once those services
+ * were disposed): while the session names anyone else, a purchase binds
+ * nothing and is refused before any store sheet, so no purchase is
+ * journaled under one player and bound to another's store account. Returns
+ * the release (idempotent). Throws `StarterCommercePinConflictError` while
+ * an earlier instance for another player is still open.
+ */
+export function pinStarterCommercePlayer(playerId: string): () => void {
+  if ([...pins].some((pin) => pin.playerId !== playerId)) {
+    throw new StarterCommercePinConflictError();
+  }
+  const pin = { playerId };
+  pins.add(pin);
+  return () => {
+    pins.delete(pin);
+  };
+}
+
 /**
  * The player id a purchase is bound to: the server session's player when
  * the game set one (`setStarterCommerceServerPlayer`), else an
@@ -37,10 +68,20 @@ export function setStarterCommerceServerPlayer(source: (() => string | undefined
  * platform-anonymous session (the native shell's `android-local-player` /
  * `ios-local-player`) or a locally asserted id would give every install the
  * same binding, so it binds nothing; the backend binds the purchase to the
- * player its ingress authentication resolved anyway.
+ * player its ingress authentication resolved anyway. While game services
+ * are pinned to a player (`pinStarterCommercePlayer`), any other player
+ * binds nothing too.
  */
 export async function resolveStarterCommercePlayerId(
   gateway: Pick<PlatformGateway, 'identity'>,
+): Promise<string | undefined> {
+  const playerId = await resolveSessionPlayerId(gateway);
+  // Another player than the services' (an account switch): bind nothing.
+  return [...pins].some((pin) => pin.playerId !== playerId) ? undefined : playerId;
+}
+
+async function resolveSessionPlayerId(
+  gateway: Pick<PlatformGateway, 'identity'>,
 ): Promise<string | undefined> {
   if (serverPlayer !== undefined) {
     const playerId = serverPlayer()?.trim();
@@ -89,6 +130,45 @@ export async function resolveStoreKitAppAccountToken(
   return toUuid(await digestPlayerId(playerId));
 }
 
+/**
+ * The store account binding the native providers above give `playerId`'s
+ * purchases on `target` (`android`: Google Play's obfuscated account id,
+ * `ios`: StoreKit's app account token), derived from the player id alone;
+ * `undefined` on other targets. The game services runtime compares store
+ * purchases with it (`commerceAccountBinding`) so another player's purchase
+ * is never verified for this one.
+ */
+export async function resolveStarterStoreAccountBindingFor(
+  target: string,
+  playerId: string,
+): Promise<StorePurchaseAccountBinding | undefined> {
+  const kind = starterStoreAccountBindingKind(target);
+  if (kind === undefined) {
+    return undefined;
+  }
+  const digest = await digestPlayerId(playerId);
+  return kind === 'obfuscated-account-id'
+    ? { kind, value: toHex(digest) }
+    : { kind, value: toUuid(digest) };
+}
+
+/**
+ * The kind of store account binding this module derives for `target`'s
+ * purchases, or `undefined` where it binds none (every target but the
+ * native stores: Microsoft Store purchases, for one, carry their own
+ * claimed scope). Pass `commerceAccountBinding` only where this answers a
+ * kind: a runtime given a binding source that never answers would leave every
+ * bound purchase alone.
+ */
+export function starterStoreAccountBindingKind(
+  target: string,
+): 'obfuscated-account-id' | 'app-account-token' | undefined {
+  if (target === 'android') {
+    return 'obfuscated-account-id';
+  }
+  return target === 'ios' ? 'app-account-token' : undefined;
+}
+
 async function digestPlayerId(playerId: string): Promise<Uint8Array> {
   const bytes = new TextEncoder().encode(`${starterAccountBindingDigestPrefix}${playerId}`);
   return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));

package/templates/phaser-game/src/platform/deleteAccount.ts

@@ -1,7 +1,9 @@
 import {
   AccountDeletionError,
   GuestSessionCoordinatorError,
+  isCommercePurchaseOperationRecord,
   isMonetizationOperationRecoverable,
+  isParkedForAnotherAccount,
   type AccountDeletionClient,
   type MonetizationOperationRecord,
 } from '@mpgd/game-services';
@@ -272,7 +274,10 @@ export function createStarterAccountDeletion(input: {
           return false;
         }
         return Object.values(records as Record<string, MonetizationOperationRecord>).some(
-          (record) => record.kind !== 'rewarded-ad' && isMonetizationOperationRecoverable(record),
+          (record) => record.kind !== 'rewarded-ad'
+            && isMonetizationOperationRecoverable(record)
+            // Parked as another account's purchase: nothing of this player is in progress.
+            && !(isCommercePurchaseOperationRecord(record) && isParkedForAnotherAccount(record)),
         );
       } catch {
         return false;