@mpgd/cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -120,8 +120,6 @@ const entryCommand = defineI18n({
         ko: 'mpgd-kit 스타터와 타깃 워크플로우를 관리합니다.',
     }),
     run: () => {
-        console.log('Use a sub-command: game, target, kit.');
-        console.log('Run "pnpm mpgd --help" for available commands.');
     },
 });
 const gameCommand = defineI18n({
@@ -420,12 +418,10 @@ const gameCommand = defineI18n({
                 }),
             ])),
             run: () => {
-                console.log('Use "mpgd game icons generate <game>", verify, or inspect.');
             },
         }),
     },
     run: () => {
-        console.log('Use "mpgd game create <directory>", "mpgd game accept <game>", or "mpgd game icons generate <game>".');
     },
 });
 const defaultLegalDir = 'legal';
@@ -553,12 +549,9 @@ function acceptGame(input) {
             MPGD_RELEASE_MANIFEST_FILE: releaseManifestFile,
         },
     });
-    console.log(`[mpgd:accept] JSON report: ${result.jsonFile}`);
-    console.log(`[mpgd:accept] Markdown report: ${result.markdownFile}`);
     if (result.report.status === 'failed') {
         throw new Error(`Game acceptance failed. Report: ${result.markdownFile}`);
     }
-    console.log('[mpgd:accept] passed');
 }
 function assertGameAcceptanceRoot(gameRoot) {
     const resolved = path.resolve(gameRoot);
@@ -642,7 +635,6 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: false,
                 });
-                console.log(`Built legal site: ${result.outDir}`);
             },
         }),
         check: defineI18n({
@@ -658,12 +650,10 @@ const legalCommand = defineI18n({
                     ...resolveLegalCommandOptions(ctx.values),
                     check: true,
                 });
-                console.log(`Legal site checked: ${result.outDir}`);
             },
         }),
     },
     run: () => {
-        console.log('Use "mpgd legal build" or "mpgd legal check".');
     },
 });
 const targetCommand = defineI18n({
@@ -872,7 +862,6 @@ const targetCommand = defineI18n({
         }),
     },
     run: () => {
-        console.log('Use "mpgd target build <target>" or "mpgd target smoke <target>".');
     },
 });
 const kitCommand = defineI18n({
@@ -891,17 +880,10 @@ const kitCommand = defineI18n({
                 ko: 'CLI, kit, template, target wrapper 상태를 출력합니다.',
             }),
             run: () => {
-                console.log(`cli package: ${packageRoot}`);
-                console.log(`mpgd-kit: ${detectedKitRoot ?? 'not detected'}`);
-                console.log(`cli template: ${existsSync(gameTemplateDir) ? 'ok' : 'missing'}`);
-                console.log(`mobile wrapper: ${kitFileStatus('apps/mobile-capacitor/package.json')}`);
-                console.log(`ait wrapper: ${kitFileStatus('apps/target-ait/package.json')}`);
-                console.log(`devvit wrapper: ${kitFileStatus('apps/target-devvit/package.json')}`);
             },
         }),
     },
     run: () => {
-        console.log('Use "mpgd kit doctor".');
     },
 });
 function commandResource(description, args = {}) {
@@ -1116,9 +1098,7 @@ function createGameApp(input) {
     });
     const files = collectTemplateFiles(gameTemplateDir);
     if (input.dryRun) {
-        console.log(`Would create ${path.relative(process.cwd(), appDir) || appDir}:`);
         for (const file of files) {
-            console.log(`- ${path.join(path.relative(process.cwd(), appDir), file.relativePath)}`);
         }
         return;
     }
@@ -1127,20 +1107,6 @@ function createGameApp(input) {
         mkdirSync(path.dirname(outputFile), { recursive: true });
         writeFileSync(outputFile, renderTemplate(file.content, context));
     }
-    console.log(`Created ${appDir}`);
-    console.log('Next steps:');
-    console.log(`  cd ${appDir}`);
-    console.log('  pnpm install -w');
-    console.log('  pnpm dev');
-    console.log('Target builds require an mpgd-kit checkout:');
-    console.log([
-        '  mpgd target build-all',
-        `--targets-file ${path.join(appDir, 'mpgd.targets.json')}`,
-        `--targets ${recommendedMatrixTargets}`,
-        '--profile staging',
-        '--ait-variant wrapper',
-        '--kit-path <path-to-mpgd-kit>',
-    ].join(' '));
 }
 function assertValidGameName(name) {
     if (!/^[a-z][a-z0-9-]*$/.test(name)) {
@@ -1492,7 +1458,6 @@ function runTargetCommand(input) {
     const args = input.action === 'build'
         ? ['build:target', target, profile]
         : ['smoke:target', target];
-    console.log(`[mpgd] ${input.action} ${target}`);
     runPnpm(args, env);
 }
 function runTargetMatrix(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Gunshi CLI for mpgd-kit starter generation and target workflow orchestration.",
   "license": "MIT",
   "repository": {
@@ -47,20 +47,20 @@
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
-    "@mpgd/adapter-ait": "0.4.1",
-    "@mpgd/adapter-devvit": "0.5.0",
-    "@mpgd/analytics": "0.3.4",
-    "@mpgd/adapter-browser": "0.4.1",
-    "@mpgd/adapter-capacitor": "0.4.1",
-    "@mpgd/bridge": "0.5.0",
-    "@mpgd/catalog": "0.3.4",
-    "@mpgd/game-services": "0.5.0",
-    "@mpgd/i18n": "0.5.0",
-    "@mpgd/platform": "0.5.0",
-    "@mpgd/phaser-assets": "0.4.0",
-    "@mpgd/target-config": "0.6.0"
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
+    "@mpgd/adapter-ait": "0.4.2",
+    "@mpgd/adapter-browser": "0.4.2",
+    "@mpgd/analytics": "0.3.5",
+    "@mpgd/adapter-capacitor": "0.4.2",
+    "@mpgd/adapter-devvit": "0.7.0",
+    "@mpgd/bridge": "0.6.0",
+    "@mpgd/catalog": "0.3.5",
+    "@mpgd/game-services": "0.7.0",
+    "@mpgd/phaser-assets": "0.4.1",
+    "@mpgd/i18n": "0.5.1",
+    "@mpgd/platform": "0.5.1",
+    "@mpgd/target-config": "0.6.1"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/templates/phaser-game/apps/target-cloudflare-pages/package.json

@@ -19,9 +19,9 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260707.1",
-    "@ttsc/unplugin": "0.16.9",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
+    "@ttsc/unplugin": "0.18.4",
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
     "vite": "^8.1.3",
     "wrangler": "^4.107.0"
   }

package/templates/phaser-game/apps/target-devvit/README.md

@@ -25,16 +25,30 @@ available and the CLI asks for a manual code. After that, use
 `pnpm devvit:playtest`, `pnpm devvit:upload`, and `pnpm devvit:publish` from the
 game root.
 
-The client bundle is copied into `dist/client` by the mpgd target build. The server bridge is
-compiled to `dist/server/index.cjs` and keeps Devvit SDK imports out of Phaser scenes.
-The game root pins `@mpgd/cli`, so these commands use the same CLI version as the generated
-starter's other `@mpgd/*` dependencies.
+The official `@devvit/start/vite` plugin builds the game client into
+`dist/client` and the CommonJS server bridge into `dist/server/index.cjs` in one
+pass. The mpgd target build wraps that unified build with release provenance and
+effective-target evidence while keeping Devvit SDK imports out of Phaser scenes.
+The game root pins `@mpgd/cli`, so these commands use the same CLI version as the
+generated starter's other `@mpgd/*` dependencies.
+
+The bridge endpoint at `/api/mpgd/rpc` uses the direct oRPC Node HTTP adapter
+from `@mpgd/bridge/orpc/node`; Express, Hono, and Fetch request conversion are
+not required. Devvit-owned menu, scheduler, trigger, and form callbacks remain
+thin `/internal/...` routes and delegate to shared service functions. oRPC
+Publisher helpers can broadcast results after a task completes, but they do not
+replace the `devvit.json` scheduler endpoint and should not use process-local
+memory when delivery must cross instances. The generated target exposes only
+the oRPC bridge route; the former JSON compatibility route is not generated.
 
 The default post entry uses `index.html` for a lightweight inline preview. Its
 Play button requests the `game` entrypoint, which loads the separate
 `game.html` Phaser document. Keep inline UI free of game runtime imports so the
 card remains lightweight before expansion.
 
+`devvit playtest` runs the official unified Vite build in watch mode, so a
+separate client/server watcher or staging prebuild is not required.
+
 ## Durable Post Operations
 
 Use `src/server/postOperationStore.ts` with `@mpgd/adapter-devvit/server` for a
@@ -59,3 +73,24 @@ first success, duplicate calls, interruption,
 response loss, lease expiry with concurrent reconciliation, malformed durable
 state, invalid launch metadata, and cross-scope key isolation before enabling a
 scheduled or user-triggered publication flow.
+
+## AI-assisted Devvit development
+
+Devvit provides an optional MCP server for targeted documentation search and
+deployed-app log inspection. See the official
+[Devvit AI Tools guide](https://developers.reddit.com/docs/guides/ai), then
+register it once in the developer's global Codex configuration:
+
+```sh
+codex mcp add devvit -- npx -y @devvit/mcp
+```
+
+Restart Codex or begin a new task after registering it. Use `devvit_search`
+before broad Devvit documentation exploration. Use the experimental
+`devvit_logs` tool for a deployed app and subreddit when diagnosing production
+or playtest behavior, and confirm its findings with local tests and
+`pnpm devvit:playtest`.
+
+The MCP server is an agent-side aid only. It is not required by the generated
+game build, must not be bundled into target artifacts, and does not replace
+Devvit CLI authentication or release verification.

package/templates/phaser-game/apps/target-devvit/devvit.json

@@ -41,7 +41,7 @@
     ]
   },
   "scripts": {
-    "dev": "pnpm dev:prepare && pnpm dev:watch",
+    "dev": "vite build --mode staging --watch",
     "build": "pnpm build"
   }
 }

package/templates/phaser-game/apps/target-devvit/package.json

@@ -9,12 +9,7 @@
     "init": "pnpm run prepare:icon:production && devvit upload --config devvit.json",
     "init:copy-paste": "pnpm run prepare:icon:production && devvit upload --copy-paste --config devvit.json",
     "dev": "pnpm run prepare:icon && devvit playtest --config devvit.json",
-    "dev:prepare": "pnpm --dir ../.. build:devvit:staging",
-    "dev:client": "APP_TARGET=reddit APP_VERSION=0.0.0-dev BUILD_ID=devvit-watch pnpm --dir ../.. exec vite build --mode staging --watch --outDir apps/target-devvit/dist/client",
-    "dev:server": "vite build --config vite.server.config.ts --watch",
-    "dev:watch": "concurrently --kill-others --success first \"pnpm run dev:client\" \"pnpm run dev:server\"",
     "build": "pnpm --dir ../.. build:devvit",
-    "build:server": "vite build --config vite.server.config.ts",
     "whoami": "devvit whoami",
     "upload": "pnpm run prepare:icon:production && devvit upload --config devvit.json",
     "publish": "pnpm run prepare:icon:production && devvit publish --config devvit.json",
@@ -24,20 +19,17 @@
     "fix": "ttsc fix"
   },
   "dependencies": {
-    "@devvit/web": "0.13.6",
+    "@devvit/web": "0.13.8",
     "@mpgd/adapter-devvit": "__MPGD_DEPENDENCY_VERSION_ADAPTER_DEVVIT__",
-    "@mpgd/bridge": "__MPGD_DEPENDENCY_VERSION_BRIDGE__",
-    "express": "^5.2.1",
-    "helmet": "^8.1.0"
+    "@mpgd/bridge": "__MPGD_DEPENDENCY_VERSION_BRIDGE__"
   },
   "devDependencies": {
-    "@ttsc/unplugin": "0.16.9",
-    "@types/express": "^5.0.6",
+    "@devvit/start": "0.13.8",
+    "@ttsc/unplugin": "0.18.4",
     "@types/node": "^24.0.0",
-    "concurrently": "10.0.3",
-    "devvit": "0.13.6",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
+    "devvit": "0.13.8",
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
     "vite": "^8.1.3"
   }
 }

package/templates/phaser-game/apps/target-devvit/src/client/game.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#0f172a" />
+    <title>__GAME_TITLE__</title>
+  </head>
+  <body>
+    <div id="game"></div>
+    <script type="module" src="./game.ts"></script>
+  </body>
+</html>

package/templates/phaser-game/apps/target-devvit/src/client/game.ts

@@ -0,0 +1,3 @@
+await import('../../../../src/gameEntry');
+
+export {};

package/templates/phaser-game/apps/target-devvit/src/client/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#0f172a" />
+    <title>__GAME_TITLE__</title>
+  </head>
+  <body>
+    <div id="game"></div>
+    <script type="module" src="./preview.ts"></script>
+  </body>
+</html>

package/templates/phaser-game/apps/target-devvit/src/client/preview.ts

@@ -0,0 +1,3 @@
+await import('../../../../src/entry');
+
+export {};

package/templates/phaser-game/apps/target-devvit/src/server/index.ts

@@ -1,23 +1,22 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
 import { createServer, context, getServerPort, reddit, redis } from '@devvit/web/server';
 import type { UiResponse } from '@devvit/web/shared';
 import {
-  assertBridgeRequest,
   createBridgeError,
   type BridgeRequest,
   type BridgeResponse,
 } from '@mpgd/bridge';
 import {
-  createBridgeRpcFetchHandler,
   createBridgeRpcRouter,
   defaultBridgeRpcEndpoint,
 } from '@mpgd/bridge/orpc';
-import express, { type Request as ExpressRequest, type Response as ExpressResponse } from 'express';
-import helmet from 'helmet';
+import { createBridgeRpcNodeHandler } from '@mpgd/bridge/orpc/node';
 
-const app = express();
 const redisKeyComponentPattern = /^[A-Za-z0-9:_-]{1,128}$/;
 const maxStorageKeyLength = 128;
 const maxEncodedStorageKeyLength = 384;
+const maxRequestBodySize = 1_048_576;
 const leaderboardUpdateMaxAttempts = 3;
 const leaderboardBackoffBaseMs = 25;
 const leaderboardLockTtlMs = 2_000;
@@ -25,51 +24,53 @@ const leaderboardLockTtlSeconds = Math.ceil(leaderboardLockTtlMs / 1_000);
 const leaderboardLockRetryBudgetMs = leaderboardLockTtlSeconds * 1_000;
 const gameName = '__GAME_NAME__';
 const gameTitle = __GAME_TITLE_TS_LITERAL__;
-const expressManagedResponseHeaders = new Set([
-  'connection',
-  'content-encoding',
-  'content-length',
-  'transfer-encoding',
-]);
-
-app.disable('x-powered-by');
-app.use(helmet());
-
-const bridgeRpcFetchHandler = createBridgeRpcFetchHandler(
+const bridgeRpcHandler = createBridgeRpcNodeHandler(
   createBridgeRpcRouter(handleBridgeRequest),
+  {
+    maxBodySize: maxRequestBodySize,
+    prefix: defaultBridgeRpcEndpoint,
+  },
 );
 
-app.use(defaultBridgeRpcEndpoint, express.raw({ type: '*/*', limit: '1mb' }), async (
-  request: ExpressRequest,
-  response: ExpressResponse,
-): Promise<void> => {
-  try {
-    const fetchResponse = await bridgeRpcFetchHandler(expressRequestToFetchRequest(request));
-    await sendFetchResponse(response, fetchResponse);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : 'Devvit oRPC request failed.';
-    console.error(`devvit oRPC internal error: ${message}`, error);
-    response.status(500).json(
-      createBridgeError(
-        requestIdFromBody(request.body),
-        'DEVVIT_BRIDGE_INTERNAL_ERROR',
-        'Devvit bridge request failed.',
-        true,
-      ),
-    );
+async function handleHttpRequest(
+  request: IncomingMessage,
+  response: ServerResponse,
+): Promise<void> {
+  setResponseSecurityHeaders(response);
+
+  if (request.method === 'POST' && requestPathname(request) === '/internal/menu/create-post') {
+    try {
+      await drainRequestBody(request, maxRequestBodySize);
+    } catch (error) {
+      if (!(error instanceof RequestBodyTooLargeError)) {
+        throw error;
+      }
+
+      discardOversizedRequestBody(request, response);
+      sendJson(response, 413, {
+        error: 'REQUEST_BODY_TOO_LARGE',
+      });
+      return;
+    }
+
+    await handleCreatePostMenu(response);
+    return;
   }
-});
 
-app.use(express.json({ limit: '1mb' }));
+  if (await bridgeRpcHandler(request, response)) {
+    return;
+  }
+
+  sendJson(response, 404, {
+    error: 'NOT_FOUND',
+  });
+}
 
-app.post('/internal/menu/create-post', async (
-  _request: ExpressRequest,
-  response: ExpressResponse,
-): Promise<void> => {
+async function handleCreatePostMenu(response: ServerResponse): Promise<void> {
   const subredditName = currentSubredditName();
 
   if (subredditName === undefined) {
-    response.status(200).json({
+    sendJson(response, 200, {
       showToast: {
         text: 'Could not resolve the target subreddit for this menu action.',
         appearance: 'neutral',
@@ -92,7 +93,7 @@ app.post('/internal/menu/create-post', async (
       },
     });
 
-    response.status(200).json({
+    sendJson(response, 200, {
       showToast: {
         text: `Created ${gameTitle} post ${post.id}.`,
         appearance: 'success',
@@ -100,53 +101,30 @@ app.post('/internal/menu/create-post', async (
     } satisfies UiResponse);
   } catch (error) {
     console.error(`devvit custom post creation failed: ${errorMessage(error)}`, error);
-    response.status(200).json({
+    sendJson(response, 200, {
       showToast: {
         text: `Could not create the ${gameTitle} post.`,
         appearance: 'neutral',
       },
     } satisfies UiResponse);
   }
-});
+}
 
-app.post('/api/mpgd/bridge', async (
-  request: ExpressRequest,
-  response: ExpressResponse,
-): Promise<void> => {
-  let bridgeRequest: BridgeRequest;
+const server = createServer((request, response) => {
+  void handleHttpRequest(request, response).catch((error: unknown) => {
+    console.error(`devvit server request failed: ${errorMessage(error)}`, error);
 
-  try {
-    bridgeRequest = assertBridgeRequest(request.body);
-  } catch (error) {
-    response.status(400).json(
-      createBridgeError(
-        requestIdFromBody(request.body),
-        'INVALID_BRIDGE_REQUEST',
-        error instanceof Error ? error.message : 'Invalid bridge request.',
-      ),
-    );
-    return;
-  }
+    if (response.headersSent) {
+      response.end();
+      return;
+    }
 
-  try {
-    const bridgeResponse = await handleBridgeRequest(bridgeRequest);
-    response.status(200).json(bridgeResponse);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : 'Devvit bridge request failed.';
-    console.error(`devvit bridge internal error: ${message}`, error);
-
-    response.status(500).json(
-      createBridgeError(
-        bridgeRequest.id,
-        'DEVVIT_BRIDGE_INTERNAL_ERROR',
-        'Devvit bridge request failed.',
-        true,
-      ),
-    );
-  }
+    sendJson(response, 500, {
+      error: 'DEVVIT_SERVER_INTERNAL_ERROR',
+    });
+  });
 });
 
-const server = createServer(app);
 const port = getServerPort();
 
 server.on('error', (error) => {
@@ -387,15 +365,6 @@ async function saveStorage(input: BridgeRequest): Promise<BridgeResponse> {
   });
 }
 
-function requestIdFromBody(input: unknown): string {
-  if (typeof input !== 'object' || input === null) {
-    return 'unknown';
-  }
-
-  const candidate = input as { readonly id?: unknown };
-  return typeof candidate.id === 'string' ? candidate.id : 'unknown';
-}
-
 function ok(input: BridgeRequest, data: unknown): BridgeResponse {
   return {
     id: input.id,
@@ -641,61 +610,76 @@ function optionalObjectPayload(payload: unknown): Record<string, unknown> {
   return payload as Record<string, unknown>;
 }
 
-function expressRequestToFetchRequest(request: ExpressRequest): Request {
-  const headers = new Headers();
+function requestPathname(request: IncomingMessage): string {
+  return new URL(request.url ?? '/', 'http://localhost').pathname;
+}
+
+class RequestBodyTooLargeError extends Error {}
 
-  for (const [key, value] of Object.entries(request.headers)) {
-    if (typeof value === 'string') {
-      headers.set(key, value);
-    } else if (Array.isArray(value)) {
-      headers.set(key, value.join(', '));
-    }
-  }
+async function* readRequestBodyChunks(
+  request: IncomingMessage,
+  maxBodySize: number,
+): AsyncGenerator<Buffer, void, undefined> {
+  assertContentLengthWithinLimit(request, maxBodySize);
 
-  const init: RequestInit = {
-    method: request.method,
-    headers,
-  };
+  let bodySize = 0;
 
-  if (request.method !== 'GET' && request.method !== 'HEAD') {
-    init.body = requestBodyToBodyInit(request.body);
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bodySize += buffer.byteLength;
 
-    if (!headers.has('content-type') && !(request.body instanceof Uint8Array)) {
-      headers.set('content-type', 'application/json');
+    if (bodySize > maxBodySize) {
+      throw new RequestBodyTooLargeError();
     }
+
+    yield buffer;
   }
+}
 
-  return new Request(expressRequestUrl(request), init);
+async function drainRequestBody(
+  request: IncomingMessage,
+  maxBodySize: number,
+): Promise<void> {
+  for await (const _chunk of readRequestBodyChunks(request, maxBodySize)) {
+    // Drain the bounded request stream without retaining its contents.
+  }
 }
 
-function requestBodyToBodyInit(input: unknown): BodyInit {
-  if (input instanceof Uint8Array) {
-    const body = new Uint8Array(input.byteLength);
-    body.set(input);
+function assertContentLengthWithinLimit(
+  request: IncomingMessage,
+  maxBodySize: number,
+): void {
+  const contentLength = request.headers['content-length'];
 
-    return body.buffer as ArrayBuffer;
+  if (
+    contentLength !== undefined
+    && Number.isFinite(Number(contentLength))
+    && Number(contentLength) > maxBodySize
+  ) {
+    throw new RequestBodyTooLargeError();
   }
-
-  return JSON.stringify(input ?? null);
 }
 
-function expressRequestUrl(request: ExpressRequest): string {
-  const host = request.get('host') ?? 'localhost';
-  const protocol = request.protocol || 'https';
-
-  return `${protocol}://${host}${request.originalUrl}`;
+function discardOversizedRequestBody(
+  request: IncomingMessage,
+  response: ServerResponse,
+): void {
+  response.setHeader('connection', 'close');
+  request.resume();
 }
 
-async function sendFetchResponse(
-  response: ExpressResponse,
-  fetchResponse: Response,
-): Promise<void> {
-  fetchResponse.headers.forEach((value: string, key: string) => {
-    if (!expressManagedResponseHeaders.has(key.toLowerCase())) {
-      response.setHeader(key, value);
-    }
-  });
+function setResponseSecurityHeaders(response: ServerResponse): void {
+  response.setHeader('cache-control', 'no-store');
+  response.setHeader('content-security-policy', "default-src 'none'; frame-ancestors 'none'");
+  response.setHeader('referrer-policy', 'no-referrer');
+  response.setHeader('x-content-type-options', 'nosniff');
+  response.setHeader('x-frame-options', 'DENY');
+}
 
-  response.status(fetchResponse.status);
-  response.send(await fetchResponse.text());
+function sendJson(response: ServerResponse, status: number, body: unknown): void {
+  const payload = JSON.stringify(body);
+  response.statusCode = status;
+  response.setHeader('content-length', Buffer.byteLength(payload));
+  response.setHeader('content-type', 'application/json; charset=utf-8');
+  response.end(payload);
 }

package/templates/phaser-game/apps/target-devvit/tsconfig.json

@@ -2,8 +2,13 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "allowSyntheticDefaultImports": true,
-    "types": ["node"],
+    "types": ["node", "vite/client"],
     "noEmit": true
   },
-  "include": ["src/**/*.ts", "vite.server.config.ts"]
+  "include": [
+    "src/**/*.ts",
+    "vite.config.ts",
+    "../../src/**/*.ts",
+    "../../vite.shared.ts"
+  ]
 }

package/templates/phaser-game/apps/target-devvit/vite.config.ts

@@ -0,0 +1,41 @@
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { devvit } from '@devvit/start/vite';
+import { defineConfig } from 'vite';
+
+import { createGameViteSharedConfig } from '../../vite.shared';
+
+const wrapperRoot = fileURLToPath(new URL('.', import.meta.url));
+const gameRoot = resolve(wrapperRoot, '../..');
+
+export default defineConfig(({ mode }) => {
+  const shared = createGameViteSharedConfig({
+    appTarget: 'reddit',
+    configTarget: 'reddit',
+    gameRoot,
+    mode,
+    platformTargetsFile: resolve(gameRoot, 'mpgd.targets.json'),
+    project: resolve(wrapperRoot, 'tsconfig.json'),
+  });
+
+  return {
+    ...shared,
+    publicDir: resolve(gameRoot, 'public'),
+    plugins: [
+      ...(shared.plugins ?? []),
+      devvit({
+        client: {
+          build: {
+            sourcemap: mode !== 'production',
+          },
+        },
+        server: {
+          build: {
+            sourcemap: mode !== 'production',
+          },
+        },
+      }),
+    ],
+  };
+});

package/templates/phaser-game/package.json

@@ -73,10 +73,10 @@
     "@ait-co/console-cli": "^0.1.45",
     "@cloudflare/workers-types": "^5.20260707.1",
     "@mpgd/cli": "__MPGD_DEPENDENCY_VERSION_CLI__",
-    "@ttsc/unplugin": "0.16.9",
+    "@ttsc/unplugin": "0.18.4",
     "@types/node": "^24.0.0",
-    "ttsc": "0.16.9",
-    "typescript": "7.0.1-rc",
+    "ttsc": "0.18.4",
+    "typescript": "7.0.2",
     "vite": "^8.1.3",
     "wrangler": "^4.107.0"
   }

package/templates/phaser-game/vite.config.ts

@@ -1,53 +1,27 @@
-import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
-import ttsc from '@ttsc/unplugin/vite';
 import { defineConfig } from 'vite';
 
-interface RuntimePlatformTargetMetadata {
-  readonly kind: string;
-  readonly adapter: string;
-  readonly integrations?: Record<string, unknown>;
-}
+import { createGameViteSharedConfig } from './vite.shared';
+
+export { resolveBuildGatewayModule } from './vite.shared';
+
+const gameRoot = process.cwd();
 
 export default defineConfig(({ mode }) => {
-  const isProduction = mode === 'production';
-  const platformTarget = readRuntimePlatformTarget();
   const appTarget = process.env.APP_TARGET ?? 'browser';
   const isDevvitBuild = appTarget === 'reddit';
-  const buildGatewayModule = resolveBuildGatewayModule({
-    target: appTarget,
-    debug: !isProduction,
-    buildId: process.env.BUILD_ID ?? 'local',
-  });
 
   return {
-    base: './',
-    plugins: [
-      ttsc({
-        project: 'tsconfig.json',
-        plugins: false,
-      }),
-    ],
-    resolve: {
-      alias: {
-        ...createCatalogAliases(),
-        '#mpgd-platform-gateway': resolve(buildGatewayModule),
-      },
-    },
-    define: {
-      __APP_TARGET__: JSON.stringify(appTarget),
-      __MPGD_CONFIG_TARGET__: JSON.stringify(process.env.MPGD_CONFIG_TARGET ?? ''),
-      __MPGD_PLATFORM_TARGET__:
-        platformTarget === undefined ? 'undefined' : JSON.stringify(platformTarget),
-      __APP_VERSION__: JSON.stringify(process.env.APP_VERSION ?? '0.0.0-dev'),
-      __BUILD_ID__: JSON.stringify(process.env.BUILD_ID ?? 'local'),
-      __SOURCE_GIT_SHA__: JSON.stringify(process.env.MPGD_SOURCE_GIT_SHA ?? 'uncommitted'),
-      __DEBUG_BUILD__: JSON.stringify(!isProduction),
-    },
+    ...createGameViteSharedConfig({
+      appTarget,
+      gameRoot,
+      mode,
+      project: resolve(gameRoot, 'tsconfig.json'),
+    }),
     build: {
       target: 'es2022',
-      sourcemap: !isProduction,
+      sourcemap: mode !== 'production',
       outDir: 'dist',
       assetsDir: 'assets',
       emptyOutDir: true,
@@ -55,8 +29,8 @@ export default defineConfig(({ mode }) => {
         ...(isDevvitBuild
           ? {
               input: {
-                preview: resolve('index.html'),
-                game: resolve('game.html'),
+                preview: resolve(gameRoot, 'index.html'),
+                game: resolve(gameRoot, 'game.html'),
               },
             }
           : {}),
@@ -69,128 +43,3 @@ export default defineConfig(({ mode }) => {
     },
   };
 });
-
-export function resolveBuildGatewayModule(input: {
-  readonly target: string;
-  readonly debug: boolean;
-  readonly buildId: string;
-}): string {
-  switch (input.target) {
-    case 'android':
-      return 'src/platform/buildGateways/capacitorAndroid.ts';
-    case 'ios':
-      return 'src/platform/buildGateways/capacitorIos.ts';
-    case 'ait':
-      return input.debug
-        ? 'src/platform/buildGateways/aitSandbox.ts'
-        : 'src/platform/buildGateways/ait.ts';
-    case 'reddit':
-      return input.debug && input.buildId === 'devvit-sandbox'
-        ? 'src/platform/buildGateways/redditSandbox.ts'
-        : 'src/platform/buildGateways/reddit.ts';
-    default:
-      return 'src/platform/buildGateways/browser.ts';
-  }
-}
-
-function createCatalogAliases(): Record<string, string> {
-  const productCatalogFile = readConfiguredPath(process.env.MPGD_PRODUCT_CATALOG_FILE);
-  const adPlacementsFile = readConfiguredPath(process.env.MPGD_AD_PLACEMENTS_FILE);
-
-  if ((productCatalogFile === undefined) !== (adPlacementsFile === undefined)) {
-    throw new Error(
-      'MPGD_PRODUCT_CATALOG_FILE and MPGD_AD_PLACEMENTS_FILE must be configured together.',
-    );
-  }
-
-  if (productCatalogFile === undefined || adPlacementsFile === undefined) {
-    return {};
-  }
-
-  return {
-    '@mpgd/catalog/catalog.json': resolveCatalogPath(productCatalogFile, adPlacementsFile),
-    '@mpgd/catalog/placements.json': resolveCatalogPath(adPlacementsFile, productCatalogFile),
-  };
-}
-
-function readConfiguredPath(value: string | undefined): string | undefined {
-  const normalized = value?.trim();
-  return normalized === undefined || normalized.length === 0 ? undefined : normalized;
-}
-
-function readRuntimePlatformTarget(): RuntimePlatformTargetMetadata | undefined {
-  const targetsFile = readConfiguredPath(process.env.MPGD_PLATFORM_TARGETS_FILE);
-  const configTarget = readConfiguredPath(process.env.MPGD_CONFIG_TARGET);
-
-  if (targetsFile === undefined || configTarget === undefined) {
-    return undefined;
-  }
-
-  const resolvedTargetsFile = resolve(targetsFile);
-  let parsed: unknown;
-
-  try {
-    parsed = JSON.parse(readFileSync(resolvedTargetsFile, 'utf8'));
-  } catch (error) {
-    throw new Error(
-      `Failed to read or parse MPGD_PLATFORM_TARGETS_FILE at ${resolvedTargetsFile}: ${formatError(error)}`,
-    );
-  }
-
-  if (!isRecord(parsed) || !isRecord(parsed.targets)) {
-    throw new Error('MPGD_PLATFORM_TARGETS_FILE must contain a targets object.');
-  }
-
-  const target = parsed.targets[configTarget];
-
-  if (!isRecord(target)) {
-    throw new Error(`Missing platform target metadata for ${configTarget}.`);
-  }
-
-  if (typeof target.kind !== 'string' || typeof target.adapter !== 'string') {
-    throw new Error(`Platform target ${configTarget} must define kind and adapter.`);
-  }
-
-  if (target.integrations !== undefined && !isRecord(target.integrations)) {
-    throw new Error(`Platform target ${configTarget} integrations must be an object.`);
-  }
-
-  return {
-    kind: target.kind,
-    adapter: target.adapter,
-    ...(target.integrations === undefined ? {} : { integrations: target.integrations }),
-  };
-}
-
-function isRecord(input: unknown): input is Record<string, unknown> {
-  return typeof input === 'object' && input !== null && !Array.isArray(input);
-}
-
-function formatError(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function resolveCatalogPath(path: string, pairedPath: string): string {
-  return resolve(resolveCatalogBaseDir(path, pairedPath), path);
-}
-
-function resolveCatalogBaseDir(path: string, pairedPath: string): string {
-  const fallbackBaseDir = process.cwd();
-  const candidates = [
-    fallbackBaseDir,
-    readConfiguredPath(process.env.INIT_CWD),
-    readConfiguredPath(process.env.PWD),
-  ];
-
-  for (const candidate of candidates) {
-    if (
-      candidate !== undefined
-      && existsSync(resolve(candidate, path))
-      && existsSync(resolve(candidate, pairedPath))
-    ) {
-      return candidate;
-    }
-  }
-
-  return fallbackBaseDir;
-}

package/templates/phaser-game/vite.shared.ts

@@ -0,0 +1,212 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import ttsc from '@ttsc/unplugin/vite';
+import type { UserConfig } from 'vite';
+
+interface RuntimePlatformTargetMetadata {
+  readonly kind: string;
+  readonly adapter: string;
+  readonly integrations?: Record<string, unknown>;
+}
+
+const devvitSandboxBuildId = 'devvit-sandbox';
+
+export interface CreateGameViteSharedConfigInput {
+  readonly appTarget?: string;
+  readonly configTarget?: string;
+  readonly gameRoot: string;
+  readonly mode: string;
+  readonly platformTargetsFile?: string;
+  readonly project: string;
+  readonly productCatalogFile?: string;
+  readonly adPlacementsFile?: string;
+}
+
+export function createGameViteSharedConfig(
+  input: CreateGameViteSharedConfigInput,
+): UserConfig {
+  const isProduction = input.mode === 'production';
+  const appTarget = input.appTarget ?? process.env.APP_TARGET ?? 'browser';
+  const configTarget = input.configTarget ?? process.env.MPGD_CONFIG_TARGET ?? '';
+  const platformTarget = readRuntimePlatformTarget(
+    input.platformTargetsFile ?? process.env.MPGD_PLATFORM_TARGETS_FILE,
+    configTarget,
+  );
+  const buildGatewayModule = resolveBuildGatewayModule({
+    target: appTarget,
+    debug: !isProduction,
+    buildId: process.env.BUILD_ID ?? 'local',
+  });
+
+  return {
+    base: './',
+    plugins: [
+      ttsc({
+        project: input.project,
+        plugins: false,
+      }),
+    ],
+    resolve: {
+      alias: {
+        ...createCatalogAliases({
+          gameRoot: input.gameRoot,
+          productCatalogFile: input.productCatalogFile,
+          adPlacementsFile: input.adPlacementsFile,
+        }),
+        '#mpgd-platform-gateway': resolve(input.gameRoot, buildGatewayModule),
+      },
+    },
+    define: {
+      __APP_TARGET__: JSON.stringify(appTarget),
+      __MPGD_CONFIG_TARGET__: JSON.stringify(configTarget),
+      __MPGD_PLATFORM_TARGET__:
+        platformTarget === undefined ? 'undefined' : JSON.stringify(platformTarget),
+      __APP_VERSION__: JSON.stringify(process.env.APP_VERSION ?? '0.0.0-dev'),
+      __BUILD_ID__: JSON.stringify(process.env.BUILD_ID ?? 'local'),
+      __SOURCE_GIT_SHA__: JSON.stringify(process.env.MPGD_SOURCE_GIT_SHA ?? 'uncommitted'),
+      __DEBUG_BUILD__: JSON.stringify(!isProduction),
+    },
+  };
+}
+
+export function resolveBuildGatewayModule(input: {
+  readonly target: string;
+  readonly debug: boolean;
+  readonly buildId: string;
+}): string {
+  switch (input.target) {
+    case 'android':
+      return 'src/platform/buildGateways/capacitorAndroid.ts';
+    case 'ios':
+      return 'src/platform/buildGateways/capacitorIos.ts';
+    case 'ait':
+      return input.debug
+        ? 'src/platform/buildGateways/aitSandbox.ts'
+        : 'src/platform/buildGateways/ait.ts';
+    case 'reddit':
+      return input.debug && input.buildId === devvitSandboxBuildId
+        ? 'src/platform/buildGateways/redditSandbox.ts'
+        : 'src/platform/buildGateways/reddit.ts';
+    default:
+      return 'src/platform/buildGateways/browser.ts';
+  }
+}
+
+function createCatalogAliases(input: {
+  readonly gameRoot: string;
+  readonly productCatalogFile: string | undefined;
+  readonly adPlacementsFile: string | undefined;
+}): Record<string, string> {
+  const productCatalogFile = readConfiguredPath(
+    input.productCatalogFile ?? process.env.MPGD_PRODUCT_CATALOG_FILE,
+  );
+  const adPlacementsFile = readConfiguredPath(
+    input.adPlacementsFile ?? process.env.MPGD_AD_PLACEMENTS_FILE,
+  );
+
+  if ((productCatalogFile === undefined) !== (adPlacementsFile === undefined)) {
+    throw new Error(
+      'productCatalogFile and adPlacementsFile '
+      + '(MPGD_PRODUCT_CATALOG_FILE / MPGD_AD_PLACEMENTS_FILE) must be configured together.',
+    );
+  }
+
+  if (productCatalogFile === undefined || adPlacementsFile === undefined) {
+    return {};
+  }
+
+  const catalogBaseDir = resolveCatalogBaseDir(
+    productCatalogFile,
+    adPlacementsFile,
+    input.gameRoot,
+  );
+
+  return {
+    '@mpgd/catalog/catalog.json': resolve(catalogBaseDir, productCatalogFile),
+    '@mpgd/catalog/placements.json': resolve(catalogBaseDir, adPlacementsFile),
+  };
+}
+
+function readConfiguredPath(value: string | undefined): string | undefined {
+  const normalized = value?.trim();
+  return normalized === undefined || normalized.length === 0 ? undefined : normalized;
+}
+
+function readRuntimePlatformTarget(
+  targetsFileInput: string | undefined,
+  configTarget: string,
+): RuntimePlatformTargetMetadata | undefined {
+  const targetsFile = readConfiguredPath(targetsFileInput);
+
+  if (targetsFile === undefined || configTarget.length === 0) {
+    return undefined;
+  }
+
+  const resolvedTargetsFile = resolve(targetsFile);
+  let parsed: unknown;
+
+  try {
+    parsed = JSON.parse(readFileSync(resolvedTargetsFile, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `Failed to read or parse MPGD_PLATFORM_TARGETS_FILE at ${resolvedTargetsFile}: ${formatError(error)}`,
+    );
+  }
+
+  if (!isRecord(parsed) || !isRecord(parsed.targets)) {
+    throw new Error('MPGD_PLATFORM_TARGETS_FILE must contain a targets object.');
+  }
+
+  const target = parsed.targets[configTarget];
+
+  if (!isRecord(target)) {
+    throw new Error(`Missing platform target metadata for ${configTarget}.`);
+  }
+
+  if (typeof target.kind !== 'string' || typeof target.adapter !== 'string') {
+    throw new Error(`Platform target ${configTarget} must define kind and adapter.`);
+  }
+
+  if (target.integrations !== undefined && !isRecord(target.integrations)) {
+    throw new Error(`Platform target ${configTarget} integrations must be an object.`);
+  }
+
+  return {
+    kind: target.kind,
+    adapter: target.adapter,
+    ...(target.integrations === undefined ? {} : { integrations: target.integrations }),
+  };
+}
+
+function isRecord(input: unknown): input is Record<string, unknown> {
+  return typeof input === 'object' && input !== null && !Array.isArray(input);
+}
+
+function formatError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function resolveCatalogBaseDir(path: string, pairedPath: string, gameRoot: string): string {
+  const candidates = [
+    gameRoot,
+    process.cwd(),
+    readConfiguredPath(process.env.INIT_CWD),
+    readConfiguredPath(process.env.PWD),
+  ];
+
+  for (const candidate of candidates) {
+    if (
+      candidate !== undefined
+      && existsSync(resolve(candidate, path))
+      && existsSync(resolve(candidate, pairedPath))
+    ) {
+      return candidate;
+    }
+  }
+
+  throw new Error(
+    `Could not locate catalog files (${path}, ${pairedPath}) in any expected directory; `
+      + `checked: ${candidates.filter((candidate) => candidate !== undefined).join(', ')}.`,
+  );
+}

package/templates/phaser-game/apps/target-devvit/vite.server.config.ts

@@ -1,37 +0,0 @@
-import { builtinModules } from 'node:module';
-
-import ttsc from '@ttsc/unplugin/vite';
-import { defineConfig } from 'vite';
-
-const externalBuiltins = [
-  ...builtinModules,
-  ...builtinModules.map((moduleName) => `node:${moduleName}`),
-];
-
-export default defineConfig({
-  plugins: [
-    ttsc({
-      project: 'tsconfig.json',
-      plugins: false,
-    }),
-  ],
-  ssr: {
-    noExternal: true,
-  },
-  build: {
-    ssr: 'src/server/index.ts',
-    outDir: 'dist/server',
-    target: 'node22',
-    minify: 'esbuild',
-    sourcemap: false,
-    emptyOutDir: true,
-    rollupOptions: {
-      external: externalBuiltins,
-      output: {
-        format: 'cjs',
-        entryFileNames: 'index.cjs',
-        codeSplitting: false,
-      },
-    },
-  },
-});