@ttmg/cli 0.4.6-agent-beta.1 → 0.4.6-agent-beta.3

package/dist/index.js

@@ -21,6 +21,7 @@ var express = require('express');
 var cheerio = require('cheerio');
 var archiver = require('archiver');
 var FormData$1 = require('form-data');
+var https = require('https');
 var promises = require('timers/promises');
 var chokidar = require('chokidar');
 var WebSocket = require('ws');
@@ -34,10 +35,10 @@ var require$$0 = require('util');
 var require$$0$1 = require('events');
 var require$$0$2 = require('buffer');
 var require$$1$2 = require('stream');
-var https = require('https');
 var dns = require('dns');
 var boxen = require('boxen');
 var semver = require('semver');
+var path$1 = require('node:path');
 var glob = require('glob');
 var got = require('got');
 var ttmgPack = require('ttmg-pack');
@@ -45,7 +46,6 @@ var expressStaticGzip = require('express-static-gzip');
 var fileUpload = require('express-fileupload');
 var crypto$1 = require('node:crypto');
 var fs$1 = require('node:fs');
-var path$1 = require('node:path');
 var zlib = require('zlib');
 var promises$1 = require('fs/promises');
 var os$1 = require('node:os');
@@ -80,9 +80,9 @@ var http__namespace = /*#__PURE__*/_interopNamespaceDefault(http);
 var net__namespace = /*#__PURE__*/_interopNamespaceDefault(net);
 var require$$1__namespace = /*#__PURE__*/_interopNamespaceDefault(require$$1$1);
 var dns__namespace = /*#__PURE__*/_interopNamespaceDefault(dns);
+var path__namespace$1 = /*#__PURE__*/_interopNamespaceDefault(path$1);
 var glob__namespace = /*#__PURE__*/_interopNamespaceDefault(glob);
 var fs__namespace$1 = /*#__PURE__*/_interopNamespaceDefault(fs$1);
-var path__namespace$1 = /*#__PURE__*/_interopNamespaceDefault(path$1);
 
 async function openUrl(url) {
     const { launch } = await import('chrome-launcher');
@@ -6780,11 +6780,11 @@ function printApiResponseLog(title, result) {
         ['Return Value', result.data],
     ]);
 }
-async function request({ url, method, data, headers, params, logRequestBody = true, signal, }) {
+async function request({ url, method, data, headers, params, logRequestBody = true, logApiCalls = true, signal, }) {
     const config = getTTMGRC();
     const cookie = sanitizeCookieHeader(config?.cookie);
     const proxyConfig = getAxiosProxyConfig();
-    if (isVerboseEnabled()) {
+    if (isVerboseEnabled() && logApiCalls) {
         printApiRequestLog({
             url,
             method,
@@ -6811,7 +6811,7 @@ async function request({ url, method, data, headers, params, logRequestBody = tr
             },
             ...proxyConfig,
         });
-        if (isVerboseEnabled()) {
+        if (isVerboseEnabled() && logApiCalls) {
             printApiResponseLog('API Response', {
                 status: res?.status,
                 logid: res?.headers['x-tt-logid'],
@@ -6839,7 +6839,7 @@ async function request({ url, method, data, headers, params, logRequestBody = tr
                 NetworkCode: axiosError.code,
                 NetworkMessage: axiosError.message,
             };
-        if (isVerboseEnabled()) {
+        if (isVerboseEnabled() && logApiCalls) {
             printApiResponseLog('API Error', {
                 status: axiosError.response?.status,
                 logid: axiosError.response?.headers['x-tt-logid'],
@@ -7210,6 +7210,16 @@ const messages = {
     'en-US': {
         'cli.command.wasm.desc': 'Prepare or split Wasm into a separate output directory',
         'cli.command.wasm.prepare': 'Instrument original Wasm for function collection',
+        'cli.command.wasm.collect': 'Manage platform function collection using the local CLI login',
+        'cli.command.wasm.collect.start': 'Open or resume a collection window; preserve existing IDs unless --reset is set',
+        'cli.command.wasm.collect.export': 'Export collected IDs to an identity-matched collection.json file',
+        'cli.command.wasm.collect.clientKey': 'Client Key for the game being collected',
+        'cli.command.wasm.collect.md5': 'Original Wasm collection MD5 used by the instrumented game',
+        'cli.command.wasm.collect.timeout': 'Platform request deadline: 1–300 seconds',
+        'cli.command.wasm.collect.reset': 'Clear historical function IDs for this game and Wasm before collecting',
+        'cli.command.wasm.collect.output': 'New collection JSON file (never overwrite)',
+        'wasm.collect.succeeded': 'Wasm collection command completed.',
+        'wasm.collect.failed': 'Wasm collection command failed.',
         'cli.command.wasm.split': 'Split original Wasm using an identity-matched collection',
         'cli.command.wasm.input': 'Original .wasm or Brotli .wasm.br file',
         'cli.command.wasm.output': 'New output directory (never overwrite)',
@@ -7231,6 +7241,36 @@ const messages = {
         'cli.command.login.password': 'Developer account password (implicit mode)',
         'cli.command.logout.desc': 'Logout and clear local user data',
         'cli.command.auth.desc': 'Inspect local authentication state',
+        'cli.command.auth.open.desc': 'Open an existing Vibe task authorization page in the system browser',
+        'cli.command.upload.vibeWeb': 'Authorize in the browser, then upload to PPE (--vibe; no Mock or --no-open)',
+        'cli.command.game.desc': 'Inspect game metadata supported by the platform',
+        'cli.command.game.categories.desc': 'List game categories and subcategories with gameplay descriptions (offline, read-only)',
+        'cli.command.game.categories.category': 'Filter by an exact category value, e.g. Puzzle',
+        'cli.command.game.categories.unknown': 'Unknown category. Run ttmg game categories --format json for valid values.',
+        'cli.command.game.categories.invalidFormat': 'Use text, json, or ndjson output.',
+        'cli.command.upload.vibeCategory': 'Optional game category; provide with --subcategory (--vibe). Query ttmg game categories --format json',
+        'cli.command.upload.vibeSubcategory': 'Optional subcategory belonging to --category; omit both to keep Other/Other (--vibe)',
+        'cli.command.upload.vibeWebGuide': `
+Vibe web upload (real PPE trial):
+  ttmg upload --vibe --web --dir ./game --title "My game" --icon ./avatar.png --format ndjson
+  Use --package ./game.zip instead of --dir for an existing ZIP.
+  Collect only title and icon; the CLI fills other app_info fields with PPE trial defaults.
+  Skill may query ttmg game categories --format json and pass --category Puzzle --subcategory Physics together.
+  Omit both to keep Other/Other (or the legacy metadata-file classification). Invalid pairs fail before task creation.
+  prepared and terminal events expose the submitted classification and its source.
+  Keep this process running. At waiting_authorization, complete authorization in the system browser on the CLI computer.
+  pageUrl is the local binding/progress page. To reopen authorization, execute the returned authorizationOpenCommand.
+  The CLI polls and uploads avatar, app_info and package automatically after authorization. Do not start a second upload.
+  Real success: terminal=true, status=uploaded, uploaded=true, simulation=false. On failure, read errorCode and nextAction.
+  --web opens the browser for every output format. --mock is a separate simulation mode.
+  Upload completion is not review approval or production release. See bundled vibe-upload.md and ttmg capabilities --format json.
+`,
+        'cli.command.auth.open.pageUrl': 'Local pageUrl returned by the running Vibe upload command',
+        'cli.command.auth.open.requested': 'Browser open requested. Complete authorization there; the existing upload process continues polling.',
+        'cli.command.auth.open.invalidPage': 'Pass the local pageUrl from the running Vibe upload command, not the platform URL.',
+        'cli.command.auth.open.unavailable': 'Authorization page is unavailable, expired, or no longer waiting. Check the existing upload process; no new task was created.',
+        'cli.command.auth.open.invalidFormat': 'Use text, json, or ndjson output.',
+        'cli.command.auth.open.failed': 'Could not open the system browser. Retry this command on the CLI computer.',
         'cli.command.auth.status.desc': 'Return whether the local developer session is reusable',
         'cli.command.auth.status.format': 'Output format: text | json',
         'cli.command.auth.status.requireAuth': 'Exit non-zero when no reusable local session exists',
@@ -7258,7 +7298,8 @@ const messages = {
         'cli.command.dev.format': 'Session output format: text | json',
         'cli.command.dev.events': 'Lifecycle event stream: none | ndjson',
         'cli.command.dev.noOpen': 'Do not automatically open the IDE or scan page',
-        'cli.command.dev.evidenceDir': 'Session evidence output directory',
+        'cli.command.dev.evidenceDir': 'Session evidence output directory (outside the project or under its .ttmg directory)',
+        'dev.evidence.unsafeDirectory': 'Keep session evidence outside the game project or under its root .ttmg directory so it cannot enter game packages.',
         'dev.logs.recordModeRequired': '--record-logs requires --mode client-preview.',
         'dev.logs.archiveFailed': 'Local log recording stopped [DEV_LOG_ARCHIVE_WRITE_FAILED]. Live debugging is still available.',
         'cli.command.dev.recordLogs': 'Save redacted Runtime logs locally (client-preview only; bounded retention)',
@@ -7426,9 +7467,9 @@ const messages = {
         'cli.command.upload.servePreviewPage': 'Serve a temporary local preview page with test-account and preview QR codes',
         'cli.command.upload.noOpen': 'Do not open the local preview page in the default browser',
         'cli.command.upload.format': 'Output format: text | json | ndjson',
-        'cli.command.upload.vibe': 'Skill-guided binding and upload (schema v2; use --mock for the integration trial)',
+        'cli.command.upload.vibe': 'Binding and upload: collect only title and icon; CLI fills other fields with PPE trial defaults (schema v2)',
         'cli.command.upload.vibeTitle': 'Game title supplied by the Skill (--vibe)',
-        'cli.command.upload.vibeAppInfo': 'Local JSON with complete app metadata; validates platform title/icon requirements (--vibe)',
+        'cli.command.upload.vibeAppInfo': 'Legacy metadata file compatibility; not needed for current uploads and must not be requested from users',
         'cli.command.upload.vibeIcon': 'Local PNG/JPEG/WebP selected by the user (--vibe)',
         'cli.command.upload.vibePackage': 'Prepared ZIP instead of --dir (--vibe)',
         'cli.command.upload.vibeDryRun': 'Validate and package locally without authorization or upload (--vibe)',
@@ -7614,6 +7655,16 @@ const messages = {
     'zh-CN': {
         'cli.command.wasm.desc': '准备或分包 Wasm，产物写入独立目录',
         'cli.command.wasm.prepare': '对原始 Wasm 插桩，用于函数采集',
+        'cli.command.wasm.collect': '复用 CLI 本机登录态管理平台函数采集',
+        'cli.command.wasm.collect.start': '开启或恢复采集窗口；未指定 --reset 时保留已有函数 ID',
+        'cli.command.wasm.collect.export': '导出函数 ID，生成与原始 Wasm 匹配的 collection.json',
+        'cli.command.wasm.collect.clientKey': '采集游戏的 Client Key',
+        'cli.command.wasm.collect.md5': '插桩游戏上报使用的原始 Wasm 采集 MD5',
+        'cli.command.wasm.collect.timeout': '平台请求超时：1–300 秒',
+        'cli.command.wasm.collect.reset': '清空此游戏、此 Wasm 的历史函数 ID，再开始采集',
+        'cli.command.wasm.collect.output': '新的采集 JSON 文件（不覆盖已有文件）',
+        'wasm.collect.succeeded': 'Wasm 采集命令已完成。',
+        'wasm.collect.failed': 'Wasm 采集命令失败。',
         'cli.command.wasm.split': '使用与原始 Wasm 匹配的采集数据分包',
         'cli.command.wasm.input': '原始 .wasm 或 Brotli .wasm.br 文件',
         'cli.command.wasm.output': '新的输出目录（不覆盖已有内容）',
@@ -7635,6 +7686,36 @@ const messages = {
         'cli.command.login.password': '开发者账号密码（implicit 模式）',
         'cli.command.logout.desc': '退出登录并清除本地用户信息',
         'cli.command.auth.desc': '查看本地登录状态',
+        'cli.command.auth.open.desc': '在系统浏览器打开已有 Vibe 任务的授权页',
+        'cli.command.upload.vibeWeb': '网页授权就绪后自动上传到 PPE（--vibe；不能与 Mock 或 --no-open 同用）',
+        'cli.command.game.desc': '查询平台支持的游戏资料',
+        'cli.command.game.categories.desc': '查询游戏类型、子类型及玩法说明（离线、只读）',
+        'cli.command.game.categories.category': '按类型的精确值筛选，例如 Puzzle',
+        'cli.command.game.categories.unknown': '类型不存在。使用 ttmg game categories --format json 查询有效值。',
+        'cli.command.game.categories.invalidFormat': '输出格式请使用 text、json 或 ndjson。',
+        'cli.command.upload.vibeCategory': '可选游戏类型，须与 --subcategory 同传（--vibe）；用 ttmg game categories --format json 查询',
+        'cli.command.upload.vibeSubcategory': '所属类型的可选子类型；两者均不传保留 Other/Other（--vibe）',
+        'cli.command.upload.vibeWebGuide': `
+Vibe 网页上传（真实 PPE 试用）：
+  ttmg upload --vibe --web --dir ./game --title "游戏名称" --icon ./avatar.png --format ndjson
+  已有 ZIP 时，用 --package ./game.zip 替换 --dir。
+  只收集标题和头像；其他 app_info 字段由 CLI 使用 PPE 试用默认值补齐。
+  Skill 可先查 ttmg game categories --format json，再成对传入 --category Puzzle --subcategory Physics。
+  两者均不传保留 Other/Other（旧资料文件调用保留文件分类）；无效组合在创建任务前报错。
+  prepared 和终态事件返回最终 classification 及其来源。
+  保持原进程运行。在 waiting_authorization 阶段，在 CLI 所在电脑的系统浏览器完成授权。
+  pageUrl 是本机绑定／进度页；重新打开授权页时，执行返回的 authorizationOpenCommand。
+  CLI 负责轮询，授权后自动上传 avatar、app_info、package，不再启动第二次上传。
+  真实成功：terminal=true、status=uploaded、uploaded=true、simulation=false。失败时读取 errorCode 和 nextAction。
+  --web 在所有输出格式下都会打开浏览器；--mock 是独立的模拟模式。
+  上传完成不代表审核通过或正式上线。详见包内 vibe-upload.md 和 ttmg capabilities --format json。
+`,
+        'cli.command.auth.open.pageUrl': '正在运行的 Vibe 上传命令返回的本地 pageUrl',
+        'cli.command.auth.open.requested': '已请求浏览器打开授权页。请在页面完成授权，原上传进程继续轮询。',
+        'cli.command.auth.open.invalidPage': '请传入正在运行的 Vibe 上传命令返回的本地 pageUrl，不是平台授权链接。',
+        'cli.command.auth.open.unavailable': '授权页不可用、已过期或已不在等待授权。请查看原上传进程状态；未新建任务。',
+        'cli.command.auth.open.invalidFormat': '输出格式请使用 text、json 或 ndjson。',
+        'cli.command.auth.open.failed': '无法打开系统浏览器，请在 CLI 所在电脑重试此命令。',
         'cli.command.auth.status.desc': '返回本地开发者会话是否可复用',
         'cli.command.auth.status.format': '输出格式：text | json',
         'cli.command.auth.status.requireAuth': '没有可复用本地会话时以非零状态退出',
@@ -7662,7 +7743,8 @@ const messages = {
         'cli.command.dev.format': '会话输出格式：text | json',
         'cli.command.dev.events': '生命周期事件流：none | ndjson',
         'cli.command.dev.noOpen': '不自动打开 IDE 或扫码网页',
-        'cli.command.dev.evidenceDir': '会话证据输出目录',
+        'cli.command.dev.evidenceDir': '会话证据输出目录（工程外或工程根目录的 .ttmg 下）',
+        'dev.evidence.unsafeDirectory': '请将会话证据放在游戏工程外，或工程根目录的 .ttmg 下，避免日志、截图和构建输出进入游戏包。',
         'dev.logs.recordModeRequired': '--record-logs 仅支持 --mode client-preview。',
         'dev.logs.archiveFailed': '本地日志留存失败 [DEV_LOG_ARCHIVE_WRITE_FAILED]，已停止留存；实时调试仍可继续。',
         'cli.command.dev.recordLogs': '将脱敏后的 Runtime 日志保存在本地（仅 client-preview，有容量上限）',
@@ -7830,8 +7912,8 @@ const messages = {
         'cli.command.upload.servePreviewPage': '启动包含测试账号与预览二维码的临时本地页面',
         'cli.command.upload.noOpen': '不使用默认浏览器打开本地预览页面',
         'cli.command.upload.format': '输出格式：text | json | ndjson',
-        'cli.command.upload.vibe': 'Skill 引导绑定上传（schema v2；使用 --mock 联调试用）',
-        'cli.command.upload.vibeAppInfo': '完整应用信息 JSON 文件，同时检查平台名称和头像要求（--vibe）',
+        'cli.command.upload.vibe': '绑定上传：只收集标题和头像，CLI 自动补齐其他字段的 PPE 试用默认值（schema v2）',
+        'cli.command.upload.vibeAppInfo': '仅兼容旧资料文件；当前上传无需此参数，不应向用户索要',
         'cli.command.upload.vibeTitle': 'Skill 提供的游戏标题（--vibe）',
         'cli.command.upload.vibeIcon': '用户指定的本地 PNG/JPEG/WebP 图片（--vibe）',
         'cli.command.upload.vibePackage': '已准备的 ZIP，与 --dir 二选一（--vibe）',
@@ -8606,6 +8688,8 @@ const zipCwdToBuffer = (customIgnores = [], targetDir = process.cwd()) => {
         // 推到设备，体积虚胖外，host 在 fallback 路径下还可能错误命中未插桩 wasm。
         // 同时保留裸名 `TTMG_TEMP_DIR` 以兜底空目录场景。
         const defaultIgnores = [
+            '.ttmg',
+            '.ttmg/**',
             'node_modules/**',
             '.git/**',
             '.agents/**',
@@ -16288,7 +16372,7 @@ async function authStatus(options = {}) {
     return result;
 }
 
-var version = "0.4.6-agent-beta.1";
+var version = "0.4.6-agent-beta.3";
 var engines = {
 	node: ">=20.19.1 <21 || >=22"
 };
@@ -16297,6 +16381,722 @@ var pkg = {
 	engines: engines
 };
 
+// Skill-facing v2 contract. Backend credentials never cross this boundary.
+const VIBE_INPUT_REQUIREMENTS = {
+    requiredUserInputs: ['title', 'icon'],
+    codeSource: ['dir', 'package'],
+    additionalMetadataSource: 'cli-defaults',
+    defaultMetadataProfile: 'ppe-trial',
+    requestAdditionalMetadata: false,
+    optionalSkillInputs: ['category', 'subcategory'],
+    categoryQuery: 'ttmg game categories --format json',
+    categoryPairRequiredWhenProvided: true,
+    defaultCategory: { category: 'Other', subcategory: 'Other' },
+};
+class VibeError extends Error {
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+
+var catalogVersion = "sha256:f1d67b08cfbfb9396cba1ec246a84a4c1b6b2c9f077e236498c42e9c154b6900";
+var source = "bundled";
+var categories$1 = [
+	{
+		value: "Action",
+		subcategories: [
+			{
+				value: "Artillery Shooter",
+				description: "Turn based tactics game in which players aim and shoot other players"
+			},
+			{
+				value: "Asymmetric Battle",
+				description: "Game in which different players have different roles and capabilities as well as win condition (e.g. Identity 5)"
+			},
+			{
+				value: "Brawl",
+				description: "Multiplayer battle where player controls a character in team deathmatch battle without aiming a gun"
+			},
+			{
+				value: "Fighting",
+				description: "A game where the player controls a character to fight against other characters"
+			},
+			{
+				value: "MOBA",
+				description: "Multiplayer battle arena where the player controls a character on a team to destroy an enemy base"
+			},
+			{
+				value: "Music & Rhythm",
+				description: "Games that feature music as the primary gameplay driver"
+			},
+			{
+				value: "Open World",
+				description: "Action game in which players can explore the world and attempt objectives freely"
+			},
+			{
+				value: "Platformer",
+				description: "A game where players complete stages by avoiding obstacles and jumping between platforms"
+			},
+			{
+				value: "Royale Battle",
+				description: "Battle royale game (many players compete but with a single winner) that is action based and not a shooter"
+			},
+			{
+				value: "Run & Gun Platformer",
+				description: "Action games similar to side-scrolling platformers, but players are typically battling an onslaught of enemies appearing in front or behind them"
+			},
+			{
+				value: "Runner",
+				description: "A game where the player automatically progresses and must avoid obstacles to continue"
+			},
+			{
+				value: "Shark",
+				description: "Game in which the player eats other objects in the game to grow or stay alive"
+			},
+			{
+				value: "Shoot'em Up",
+				description: "A game where a lone unit (usually a spaceship) shoots projectiles against a large number of other enemies. Generally in a 2D movement space"
+			},
+			{
+				value: "Slicing (Slasher)",
+				description: "Game in which the main objective is to cut objects into pieces using a swiping motion"
+			},
+			{
+				value: "Stealth",
+				description: "Game where the player attempts to sneak around a game world and achieve objectives or escape"
+			},
+			{
+				value: "Adventure",
+				description: "Focuses on the actions themselves (shooting, twitch combat, etc.) or exploration of the world instead (finding non-gameplay collectables, solving puzzles, etc.) - Super Mario"
+			},
+			{
+				value: "Beat 'em up",
+				description: "Featuring hand-to-hand combat between the protagonist and an improbably large number of opponents."
+			},
+			{
+				value: "Other Action",
+				description: "Other general action gameplay or games that feature arcade-style gameplay"
+			}
+		]
+	},
+	{
+		value: "Match",
+		subcategories: [
+			{
+				value: "Blast-Meta",
+				description: "Blast-style game with a heavy emphasis on an investable meta game system"
+			},
+			{
+				value: "Blast-Saga",
+				description: "Game where primary mechanic involves blasting/removing adjacent like items with saga based progression"
+			},
+			{
+				value: "Bubble Shooter",
+				description: "Game where bubbles are shot at different angles clearing groups of bubbles arranged on top of screen"
+			},
+			{
+				value: "Connect Tiles",
+				description: "Game in which two like tiles are linked via a pathway on a board and removed from the board"
+			},
+			{
+				value: "Line-Saga",
+				description: "Game where a line is created between like items to remove them from the board with saga based progression"
+			},
+			{
+				value: "M3-Meta",
+				description: "Match 3 swapping game with a focus on some form of building in its meta game"
+			},
+			{
+				value: "M3-Saga",
+				description: "Primary gameplay mechanism is matching 3 items on screen and swapping matched items"
+			},
+			{
+				value: "Merge-Saga",
+				description: "Game with focus on merging like items to create more powerful units or items and utilizing saga based progression"
+			},
+			{
+				value: "Other-Meta",
+				description: "Other match style game with a heavy emphasis on an investable meta game system"
+			},
+			{
+				value: "Other Match",
+				description: "Other kind of matching game"
+			}
+		]
+	},
+	{
+		value: "Puzzle",
+		subcategories: [
+			{
+				value: "Block Puzzle",
+				description: "Game in which players need to fit different shaped block pieces to fit onto a game board efficiently"
+			},
+			{
+				value: "Brain Puzzle",
+				description: "Knowledge or intelligence-based puzzle games"
+			},
+			{
+				value: "Brick-crusher",
+				description: "A bubble shooter game featuring many balls shot, high action, and real time (not turn based) gameplay"
+			},
+			{
+				value: "Detective",
+				description: "Game in which players must solve puzzles based on various clues and involves solving a narrative arc"
+			},
+			{
+				value: "Hidden Object",
+				description: "Games where the primary objective is identifying visual elements"
+			},
+			{
+				value: "Hybrid Puzzle",
+				description: "Puzzle game involving multiple types of puzzles instead of focusing on just one"
+			},
+			{
+				value: "Jigsaw",
+				description: "Jigsaw puzzle game"
+			},
+			{
+				value: "Klotski",
+				description: "A sliding block puzzle game"
+			},
+			{
+				value: "Maze",
+				description: "Game in which players must determine paths out of a maze"
+			},
+			{
+				value: "Minesweeper",
+				description: "Games similar to the classic Minesweeper game"
+			},
+			{
+				value: "Nonogram",
+				description: "Game in which cells in a grid are colored or left blank according to numbers on the side of a grid to reveal a hidden picture"
+			},
+			{
+				value: "Physics",
+				description: "Games that utilize a physics engine-based primary gameplay mechanism"
+			},
+			{
+				value: "Room Escape",
+				description: "Puzzles focused on progressing a player to escape from a room or building"
+			},
+			{
+				value: "Spot the Difference",
+				description: "Matching images and determining the difference between the images"
+			},
+			{
+				value: "Sudoku",
+				description: "Sudoku based game"
+			},
+			{
+				value: "Tile-Matching",
+				description: "Game in which tiles are matched to remove them from the game board (like Tetris)"
+			},
+			{
+				value: "Word",
+				description: "Word Games"
+			},
+			{
+				value: "Other Puzzle",
+				description: "Puzzle-based games that do not fall into the above categories"
+			}
+		]
+	},
+	{
+		value: "Racing",
+		subcategories: [
+			{
+				value: "Arcade Racing",
+				description: "Casual and fun racing arcade type of game"
+			},
+			{
+				value: "Competitive Racing",
+				description: "PVP Racing that can use a variety of control schemes"
+			},
+			{
+				value: "Simulation Racing",
+				description: "Simulated game of realistic racing"
+			}
+		]
+	},
+	{
+		value: "RPG",
+		subcategories: [
+			{
+				value: "Empire Simulation RPG",
+				description: "RPG game in which the player rules an empire or kingdom of some kind"
+			},
+			{
+				value: "Idle RPG",
+				description: "Squad based RPG that includes idle progression mechanics"
+			},
+			{
+				value: "Location RPG",
+				description: "Game where location plays a critical component in the core gameplay"
+			},
+			{
+				value: "MMORPG",
+				description: "Massively multiplayer online role-playing game typically featuring worlds or servers with hundreds or thousands of players online simultaneously"
+			},
+			{
+				value: "Open World RPG",
+				description: "RPG game where players traverse an open world relatively freely"
+			},
+			{
+				value: "Puzzle RPG",
+				description: "RPG games that utilize a puzzle system as the primary combat mechanism"
+			},
+			{
+				value: "Roguelike ARPG",
+				description: "ARPG with roguelike (sub-genre of role-playing games characterized by the exploration of randomly-generated dungeons and permanent death) gameplay elements (e.g. Hades)"
+			},
+			{
+				value: "Survival",
+				description: "RPG based game with a strong focus on crafting mechanics"
+			},
+			{
+				value: "Tactics",
+				description: "RPG game involving turn based movement of different characters on a tile-based map"
+			},
+			{
+				value: "Team Battle",
+				description: "RPG where you control multiple characters to advance the gameplay and story"
+			},
+			{
+				value: "Tower Defense RPG",
+				description: "Tower defense game with a strong emphasis on character collection and stateful upgrading"
+			},
+			{
+				value: "Other RPG",
+				description: "Other RPG Game"
+			}
+		]
+	},
+	{
+		value: "Shooting",
+		subcategories: [
+			{
+				value: "Battle Royale",
+				description: "Shooter game in which battle royale is the primary game mode"
+			},
+			{
+				value: "Cover-fire",
+				description: "Shooting game where the player takes cover and shoots out of cover"
+			},
+			{
+				value: "PvE Shooting",
+				description: "Shooter game in which players primarily battle against computer generated, player-vs-environment enemies"
+			},
+			{
+				value: "Sniper",
+				description: "Shooting game focused on small number of accurate shots through a scope"
+			},
+			{
+				value: "Team Deathmatch",
+				description: "Shooter game in which team deathmatch is the primary gameplay mode"
+			}
+		]
+	},
+	{
+		value: "Simulation",
+		subcategories: [
+			{
+				value: "Animal Avatar",
+				description: "Game in which players take the form and play as an animal in a virtual world"
+			},
+			{
+				value: "Avatar Life",
+				description: "Simulated life based on avatars in an alternate reality world"
+			},
+			{
+				value: "Build Breed",
+				description: "Games in which the player grows a city used to breed creatures for combat"
+			},
+			{
+				value: "Building",
+				description: "Games focused on building up a city with limited/no focus on combat"
+			},
+			{
+				value: "Creative Sandbox",
+				description: "Players have tools to create user generated levels or games shared with the overall game community"
+			},
+			{
+				value: "Dress Up & Lifestyle",
+				description: "Games built around dressing up avatars and simulated life-like experiences with emphasis on lifestyle"
+			},
+			{
+				value: "Driving",
+				description: "Games where the primary gameplay loop is centered around simulating driving or parking (non-competitive)."
+			},
+			{
+				value: "Farming",
+				description: "Farming-based simulation titles"
+			},
+			{
+				value: "Home Design",
+				description: "Games involving decorating homes"
+			},
+			{
+				value: "Idle",
+				description: "Games where game progression continues even when a player leaves the game session"
+			},
+			{
+				value: "Idol Training Sim",
+				description: "Game in which players train and level up Japanese style idols against different types of activities or professions"
+			},
+			{
+				value: "Life Simulator",
+				description: "Simulation of a virtual character from birth to death in which the player makes different life choices"
+			},
+			{
+				value: "Manager",
+				description: "Games simulating the management of a team or business"
+			},
+			{
+				value: "Pet",
+				description: "Games where the primary gameplay loop is centered around raising a pet (non-combat)"
+			},
+			{
+				value: "Time Management",
+				description: "Simulation games where players are challenged to complete tasks or quests within a specific (usually short) time frame"
+			},
+			{
+				value: "Weapon Simulator",
+				description: "Video game that focuses on simulating the experience of using various weapons. These games aim to provide players with a realistic or immersive representation of different types of firearms, melee weapons, or other tools used in combat"
+			},
+			{
+				value: "Other Sim",
+				description: "Other Sim/Management games"
+			}
+		]
+	},
+	{
+		value: "Sports",
+		subcategories: [
+			{
+				value: "Arcade Sports",
+				description: "Sports games where gameplay focuses on non-realistic simulation of gameplay"
+			},
+			{
+				value: "Simulation Sports",
+				description: "Sports games where the gameplay focuses on realistic simulation of gameplay"
+			},
+			{
+				value: "Team Manager",
+				description: "Sports games where the player focuses on manage a team"
+			},
+			{
+				value: "Other Sports",
+				description: "Other Sports Games"
+			}
+		]
+	},
+	{
+		value: "Strategy",
+		subcategories: [
+			{
+				value: "4X March-Battle",
+				description: "Games where player grows a city, builds an army that attacks through timed marches on a map"
+			},
+			{
+				value: "Auto Chess",
+				description: "Tactical strategy game with drafting and in which play is conducted PVP in multiple rounds"
+			},
+			{
+				value: "Build-Battle",
+				description: "Games focused on building troops that attack enemies and can be lost. City building is usually used to upgrade troops."
+			},
+			{
+				value: "CCG-Battle",
+				description: "Strategy game based on card decks typically associated with mana costs to play"
+			},
+			{
+				value: "Lane-Battle",
+				description: "Strategy game involving multiple lanes where units are sent down a specific lane to battle"
+			},
+			{
+				value: "Legion Battle",
+				description: "Game with a focus on building different types of army units and battling other players' armies"
+			},
+			{
+				value: "Summon-Battle",
+				description: "Games where units are summoned via some means (e.g., cards or mana) and then auto-battle"
+			},
+			{
+				value: "Tower Defense Strategy",
+				description: "Games where players establish defenses against NPC enemies that attack the player at regular intervals"
+			},
+			{
+				value: "RTS",
+				description: "Real-time Strategy is a strategy game that allow all users to play simultaneously instead of processing incrementally in turns"
+			},
+			{
+				value: "Other Strategy",
+				description: "Other strategy games"
+			}
+		]
+	},
+	{
+		value: "Party",
+		subcategories: [
+			{
+				value: "Guess Something",
+				description: "Social game in which players must guess what another player has in mind from different kinds of hints or drawings"
+			},
+			{
+				value: "Karaoke",
+				description: "A Karaoke game is a type of video or computer game that simulates the experience of karaoke singing"
+			},
+			{
+				value: "Dancing",
+				description: "Video game that involves gameplay elements centered around dance and rhythm. These games often require players to mimic dance moves or follow on-screen prompts in synchronization with music."
+			},
+			{
+				value: "Mafia/Betrayal",
+				description: "Mafia based game"
+			},
+			{
+				value: "Mini Games Collection",
+				description: "Multiplayer social game in which players can choose to play from a collection of multiple minigames"
+			},
+			{
+				value: "Party Royale",
+				description: "Party based battle royale game"
+			},
+			{
+				value: "Quiz",
+				description: "Game involving trivia or quizzes"
+			},
+			{
+				value: "Other Party",
+				description: "Other party game"
+			}
+		]
+	},
+	{
+		value: "Tabletop",
+		subcategories: [
+			{
+				value: "Board Game",
+				description: "Board game is a game that involves the movement of counters or other objects round a board."
+			},
+			{
+				value: "Card Games",
+				description: "[Non gambling] A card game is any game using playing cards as the primary device with which the game is played, be they traditional or game-specific"
+			},
+			{
+				value: "Chess",
+				description: "Chess is a board game for two players, called White and Black. It is sometimes called international chess or Western chess"
+			},
+			{
+				value: "Dice",
+				description: "Dice games are games that use or incorporate one or more dice as their sole or central component, usually as a random device"
+			},
+			{
+				value: "Ludo",
+				description: "Ludo is a strategy board game for two to four players, in which the players race their four tokens from start to finish according to the rolls of a single die"
+			},
+			{
+				value: "Othello",
+				description: "Game based on the classic Othello game"
+			},
+			{
+				value: "Solitaire",
+				description: "Solitaire games are card based games that can be played by a single player."
+			},
+			{
+				value: "Other Tabletop",
+				description: "Other tabletop game"
+			}
+		]
+	},
+	{
+		value: "Other",
+		subcategories: [
+			{
+				value: "Other",
+				description: "Game that doesn't fit in any of the other categories"
+			}
+		]
+	}
+];
+var catalog = {
+	catalogVersion: catalogVersion,
+	source: source,
+	categories: categories$1
+};
+
+const GAME_CATEGORY_CATALOG_VERSION = catalog.catalogVersion;
+const GAME_CATEGORIES = catalog.categories;
+function isGameCategoryPair(category, subcategory) {
+    return GAME_CATEGORIES.some(item => item.value === category &&
+        item.subcategories.some(child => child.value === subcategory));
+}
+function getGameCategories(options = {}) {
+    const errorCode = !['text', 'json', 'ndjson'].includes(options.format || 'text')
+        ? 'GAME_CATEGORIES_INVALID_FORMAT'
+        : options.category !== undefined && !GAME_CATEGORIES.some(item => item.value === options.category)
+            ? 'GAME_CATEGORY_UNKNOWN' : null;
+    const categories = errorCode ? [] : GAME_CATEGORIES.filter(item => options.category === undefined || item.value === options.category);
+    return {
+        schemaVersion: '1',
+        command: 'game categories',
+        operationId: `game_categories_${crypto.randomUUID()}`,
+        status: errorCode ? 'failed' : 'ready',
+        terminal: true,
+        platformWrite: false,
+        catalogVersion: GAME_CATEGORY_CATALOG_VERSION,
+        source: catalog.source,
+        descriptionLanguage: 'en',
+        categoryCount: categories.length,
+        subcategoryCount: categories.reduce((count, item) => count + item.subcategories.length, 0),
+        categories,
+        errorCode,
+        error: errorCode ? t(errorCode === 'GAME_CATEGORY_UNKNOWN'
+            ? 'cli.command.game.categories.unknown' : 'cli.command.game.categories.invalidFormat') : null,
+    };
+}
+function gameCategories(options) {
+    const result = getGameCategories(options);
+    if (options.format && options.format !== 'text')
+        console.log(JSON.stringify(result));
+    else if (result.error)
+        console.error(result.error);
+    else
+        for (const category of result.categories) {
+            console.log(category.value);
+            for (const item of category.subcategories)
+                console.log(`  ${item.value}: ${item.description}`);
+        }
+    if (result.errorCode)
+        process.exitCode = 1;
+}
+
+var categories = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    GAME_CATEGORIES: GAME_CATEGORIES,
+    GAME_CATEGORY_CATALOG_VERSION: GAME_CATEGORY_CATALOG_VERSION,
+    gameCategories: gameCategories,
+    getGameCategories: getGameCategories,
+    isGameCategoryPair: isGameCategoryPair
+});
+
+// Current PPE trial defaults: the owner-approved metadata used by the successful
+// real upload fixture on 2026-09-14, with owner-specified legal URLs updated on
+// 2026-09-15. This is not a production metadata profile.
+const VIBE_PPE_DEFAULT_APP_INFO = Object.freeze({
+    description: 'DevTool PPE integration test fixture. Not a production game.',
+    category: 'Other',
+    subcategory: 'Other',
+    terms_of_service: 'https://www.tiktok.com',
+    privacy_policy: 'https://www.tiktok.com',
+    copyright_confirmation: true,
+    contact_email: 'devtool-test@example.invalid',
+});
+// BFF IDL + Import Service ValidateAppInfo, feat-minis-import (2026-09-14).
+// Keep credentials, app_name and icon_uri out of this file: CLI owns those fields.
+const requiredStrings = [
+    'description', 'category', 'subcategory', 'terms_of_service', 'privacy_policy',
+];
+const optionalStrings = ['apple_team_id', 'contact_email', 'region', 'min_sdk_version'];
+function applyVibeCategory(options, appInfo) {
+    if (options.category === undefined && options.subcategory === undefined)
+        return appInfo;
+    if (options.category === undefined || options.subcategory === undefined)
+        throw new VibeError('VIBE_CATEGORY_PAIR_REQUIRED');
+    if (!isGameCategoryPair(options.category, options.subcategory))
+        throw new VibeError('VIBE_INVALID_CATEGORY');
+    return { ...(appInfo || VIBE_PPE_DEFAULT_APP_INFO), category: options.category, subcategory: options.subcategory };
+}
+function readVibeAppInfo(file) {
+    if (file === undefined)
+        return undefined;
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            throw new Error();
+        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        const allowed = new Set([...requiredStrings, ...optionalStrings, 'copyright_confirmation']);
+        if (Object.keys(value).some(key => !allowed.has(key)))
+            throw new Error();
+        // JSON can encode lone surrogates that Go rejects as invalid UTF-8 input.
+        for (const item of Object.values(value)) {
+            if (typeof item === 'string' && [...item].some(char => /^[\uD800-\uDFFF]$/.test(char)))
+                throw new Error();
+        }
+        for (const key of requiredStrings) {
+            if (typeof value[key] !== 'string' || !value[key].trim())
+                throw new Error();
+        }
+        for (const key of optionalStrings) {
+            if (value[key] !== undefined && (typeof value[key] !== 'string' || !value[key].trim()))
+                throw new Error();
+        }
+        // An explicit declaration is required; never infer consent or supply a default.
+        if (value.copyright_confirmation !== true)
+            throw new Error();
+        for (const key of ['terms_of_service', 'privacy_policy']) {
+            if (/\s/.test(value[key]))
+                throw new Error();
+            const url = new URL(value[key]);
+            if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password)
+                throw new Error();
+        }
+        if (value.contact_email !== undefined && !/^[^\s<>@]+@[^\s<>@]+$/.test(value.contact_email))
+            throw new Error();
+        return value;
+    }
+    catch {
+        // Do not expose paths, file contents or parser errors in structured output.
+        throw new VibeError('VIBE_INVALID_APP_INFO');
+    }
+}
+const VIBE_PLATFORM_ICON_LIMIT = 5 * 1024 * 1024;
+// Header preflight only. The BFF remains responsible for decoding the image.
+function validateVibeUploadInput(input) {
+    if ([...input.title].length > 30)
+        throw new VibeError('VIBE_TITLE_TOO_LONG');
+    const image = input.icon.bytes;
+    if (image.length > VIBE_PLATFORM_ICON_LIMIT)
+        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
+    let width = 0, height = 0;
+    if (image.length >= 33 && image.subarray(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex')) &&
+        image.readUInt32BE(8) === 13 && image.toString('ascii', 12, 16) === 'IHDR') {
+        width = image.readUInt32BE(16);
+        height = image.readUInt32BE(20);
+    }
+    else if (image[0] === 0xff && image[1] === 0xd8) {
+        let offset = 2;
+        while (offset + 4 <= image.length) {
+            if (image[offset++] !== 0xff)
+                break;
+            while (image[offset] === 0xff)
+                offset++;
+            const marker = image[offset++];
+            if (marker === 0xda || marker === 0xd9)
+                break;
+            if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7))
+                continue;
+            if (offset + 2 > image.length)
+                break;
+            const length = image.readUInt16BE(offset);
+            if (length < 2 || offset + length > image.length)
+                break;
+            // Go image/jpeg accepts baseline, extended sequential and progressive SOF.
+            if ([0xc0, 0xc1, 0xc2].includes(marker) && length >= 8) {
+                height = image.readUInt16BE(offset + 3);
+                width = image.readUInt16BE(offset + 5);
+                break;
+            }
+            offset += length;
+        }
+    }
+    if (width !== 1024 || height !== 1024)
+        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
+}
+
 function getCapabilities() {
     return {
         schemaVersion: '1',
@@ -16308,8 +17108,22 @@ function getCapabilities() {
             stdoutProtocolOnly: true,
         },
         commands: {
+            gameCategories: {
+                command: 'ttmg game categories --format json',
+                available: true,
+                schemaVersion: '1',
+                platformWrite: false,
+                source: 'bundled',
+                catalogVersion: GAME_CATEGORY_CATALOG_VERSION,
+                filterOption: '--category',
+                includesGameplayDescriptions: true,
+                requiresLogin: false,
+                networkRequired: false,
+            },
             vibeUpload: {
-                command: 'ttmg upload --vibe --mock --format ndjson',
+                command: 'ttmg upload --vibe --web --dir <gameDir> --title <title> --icon <iconPath> --format ndjson',
+                mockCommand: 'ttmg upload --vibe --mock --dir <gameDir> --title <title> --icon <iconPath> --format ndjson',
+                guide: 'vibe-upload.md',
                 option: '--vibe',
                 available: true,
                 platformWrite: true,
@@ -16331,19 +17145,55 @@ function getCapabilities() {
                     taskCreation: true,
                     statusPolling: true,
                     authorizationScheme: 'aweme://webview?url=<encoded landing_url>',
-                    uploadEnabled: false,
-                    uploadBlockedError: 'VIBE_REAL_UPLOAD_NOT_READY',
+                    uploadEnabled: true,
                 },
                 terminalSuccess: 'uploaded',
                 stages: ['precheck', 'packaging', 'prepared', 'creating_task', 'waiting_authorization', 'uploading', 'uploaded', 'failed', 'cancelled'],
                 uploadSteps: ['avatar', 'app_info', 'package'],
                 sourceProjectIdentity: '.ttmg/vibe-project.json',
                 metadataInputs: ['title', 'icon', 'dir|package'],
+                inputRequirements: VIBE_INPUT_REQUIREMENTS,
+                classification: {
+                    queryCommand: 'ttmg game categories --format json',
+                    options: ['--category', '--subcategory'],
+                    suppliedTogether: true,
+                    default: { category: 'Other', subcategory: 'Other' },
+                    invalidPair: 'reject-before-task-creation',
+                    legacyAppInfo: 'preserved-when-options-omitted; explicit-pair-overrides-category-fields',
+                    resultField: 'classification',
+                },
+                webAuthorization: { option: '--web', backend: 'ppe', defaultLane: 'ppe_op_vc', simulation: false, opensSystemBrowser: true, continuesPolling: true, formatIndependent: true, conflictsWith: ['--mock', '--mock-scenario', '--vibe-api', '--no-open'], mockBehaviorUnchanged: true, materialUploadEnabled: true },
+                skillWorkflow: {
+                    preferredFormat: 'ndjson',
+                    packageAlternative: '--package <zipPath> replaces --dir <gameDir>',
+                    keepUploadProcessRunning: true,
+                    pollingOwner: 'cli',
+                    uploadOwner: 'cli',
+                    waitingAuthorization: {
+                        status: 'waiting_authorization',
+                        userAction: 'complete authorization in the system browser on the CLI computer',
+                        pageUrlField: 'pageUrl',
+                        pageUrlPurpose: 'local binding and upload progress page',
+                        reopenCommandField: 'authorizationOpenCommand',
+                        browserOpenRequestedProvesAuthorization: false,
+                        createAnotherUploadTask: false,
+                    },
+                    realUploadSuccess: { terminal: true, status: 'uploaded', uploaded: true, simulation: false },
+                    failure: 'Read errorCode and nextAction; do not automatically create another task or reupload',
+                    completionMeaning: 'materials uploaded to PPE; review and production release are separate',
+                    sameHostRequired: true,
+                },
                 optionalMetadataFile: '--app-info',
                 appInfoFields: {
-                    required: ['description', 'category', 'subcategory', 'terms_of_service', 'privacy_policy', 'copyright_confirmation'],
-                    optional: ['apple_team_id', 'contact_email', 'region', 'min_sdk_version'],
+                    required: [],
+                    optional: [],
                     suppliedByCli: ['app_name', 'icon_uri'],
+                    defaultedByCli: Object.keys(VIBE_PPE_DEFAULT_APP_INFO),
+                    additionalMetadataSource: 'cli-defaults',
+                    defaultMetadataProfile: 'ppe-trial',
+                    requestFromUser: false,
+                    legacyFileOption: '--app-info',
+                    legacyFileOptionRecommended: false,
                 },
                 appInfoPreflight: {
                     titleMaxCharacters: 30,
@@ -16369,8 +17219,9 @@ function getCapabilities() {
                 httpContract: 'minis-import-task',
                 authorizationQr: true,
                 previewQr: false,
-                realAuthorizationVerified: false,
-                realUploadVerified: false,
+                realAuthorizationVerified: true,
+                realUploadVerified: true,
+                verificationScope: { backend: 'ppe', assets: 'test-fixtures', date: '2026-09-15', production: false },
                 autoUploadAfterAuthorization: true,
                 boundedPolling: true,
                 cancellation: true,
@@ -16380,6 +17231,18 @@ function getCapabilities() {
                 available: true,
                 platformWrite: false,
             },
+            vibeAuthOpen: {
+                command: 'ttmg auth open --page-url <pageUrl> --format json',
+                available: true,
+                schemaVersion: '1',
+                platformWrite: false,
+                requiresRunningUpload: true,
+                createsTask: false,
+                outputContainsLandingCredentials: false,
+                target: 'system-browser',
+                successStatus: 'open_requested',
+                provesAuthorization: false,
+            },
             loginImplicit: {
                 command: 'ttmg login --implicit',
                 available: true,
@@ -16427,6 +17290,20 @@ function getCapabilities() {
                 projectIntegration: false,
                 platformWrite: false,
             },
+            wasmCollect: {
+                available: true,
+                experimental: true,
+                authentication: 'local_cli_login',
+                credentialOutput: false,
+                nativeBindingRequired: false,
+                platformVerified: false,
+                outputFormats: ['text', 'json'],
+                start: { command: 'ttmg wasm collect start', platformWrite: true,
+                    resetDefault: false, resetOption: '--reset', automaticRetry: false },
+                export: { command: 'ttmg wasm collect export', platformWrite: false,
+                    collectionSchemaVersion: '1', originalInputRequired: true,
+                    outputPathField: 'collection.path', overwrite: false, strategy: 'union' },
+            },
             dev: {
                 command: 'ttmg dev --format json --no-open',
                 eventsCommand: 'ttmg dev --events ndjson --no-open',
@@ -16511,6 +17388,8 @@ function getCapabilities() {
                     verifiedOnDevice: false,
                 },
                 sessionLogs: {
+                    evidenceDirectoryLocations: ['outside-project', 'project-root-.ttmg'],
+                    unsafeEvidenceDirectoryError: 'DEV_EVIDENCE_DIRECTORY_UNSAFE',
                     sources: ['live', 'archive'],
                     defaultSource: 'live',
                     runtimeSessionOption: '--runtime-session',
@@ -17016,6 +17895,8 @@ function getDesktopPath() {
 const program = new commander.Command();
 const isPreviewPageServerWorker = process.argv[2] === '__preview-page-server';
 const isVibePageServerWorker = process.argv[2] === '__vibe-page-server';
+const wasmArgumentIndex = process.argv.indexOf('wasm', 2);
+const isWasmCollectCommand = wasmArgumentIndex >= 2 && process.argv[wasmArgumentIndex + 1] === 'collect';
 const withVerboseOption = (command) => command.option('--verbose', t('cli.option.verbose'));
 const structuredFormatIndex = process.argv.indexOf('--format');
 const inlineStructuredFormat = process.argv.find(arg => arg.startsWith('--format='));
@@ -17026,6 +17907,7 @@ const structuredFormat = inlineStructuredFormat
         : '';
 if (!isPreviewPageServerWorker &&
     !isVibePageServerWorker &&
+    !(isWasmCollectCommand && !structuredFormat) &&
     structuredFormat !== 'json' &&
     structuredFormat !== 'ndjson' &&
     !process.argv.includes('--implicit')) {
@@ -17054,6 +17936,21 @@ withVerboseOption(program.command('logout').description(t('cli.command.logout.de
     await logout();
 });
 const authCmd = program.command('auth').description(t('cli.command.auth.desc'));
+const gameCmd = program.command('game').description(t('cli.command.game.desc'));
+withVerboseOption(gameCmd.command('categories')
+    .description(t('cli.command.game.categories.desc'))
+    .option('--category <category>', t('cli.command.game.categories.category'))
+    .option('--format <format>', t('cli.command.capabilities.format'), 'text')).action(async (cmd) => {
+    const { gameCategories } = await Promise.resolve().then(function () { return categories; });
+    gameCategories(cmd);
+});
+withVerboseOption(authCmd.command('open')
+    .description(t('cli.command.auth.open.desc'))
+    .option('--page-url <url>', t('cli.command.auth.open.pageUrl'))
+    .option('--format <format>', t('cli.command.upload.format'), 'text')).action(async (cmd) => {
+    const { vibeAuthOpen } = await Promise.resolve().then(function () { return authOpen; });
+    await vibeAuthOpen(cmd);
+});
 withVerboseOption(authCmd
     .command('status')
     .description(t('cli.command.auth.status.desc'))
@@ -17080,10 +17977,13 @@ withVerboseOption(program
     .option('--serve-preview-page', t('cli.command.upload.servePreviewPage'))
     .option('--no-open', t('cli.command.upload.noOpen'))
     .option('--vibe', t('cli.command.upload.vibe'))
+    .option('--web', t('cli.command.upload.vibeWeb'))
     // Vibe v2 backend selection (including opt-in ppe-mock) stays outside the Skill workflow.
     .option('--title <title>', t('cli.command.upload.vibeTitle'))
     .option('--icon <path>', t('cli.command.upload.vibeIcon'))
-    .option('--app-info <path>', t('cli.command.upload.vibeAppInfo'))
+    .option('--category <category>', t('cli.command.upload.vibeCategory'))
+    .option('--subcategory <subcategory>', t('cli.command.upload.vibeSubcategory'))
+    .addOption(new commander.Option('--app-info <path>', t('cli.command.upload.vibeAppInfo')).hideHelp())
     .option('--package <path>', t('cli.command.upload.vibePackage'))
     .option('--dry-run', t('cli.command.upload.vibeDryRun'))
     .option('--mock', t('cli.command.upload.vibeMock'))
@@ -17092,7 +17992,8 @@ withVerboseOption(program
     .option('--vibe-authorize-url <url>', t('cli.command.upload.vibeAuthorizeUrl'))
     .option('--poll-interval <seconds>', t('cli.command.upload.vibePollInterval'))
     .option('--timeout <seconds>', t('cli.command.upload.vibeTimeout'))
-    .option('--format <format>', t('cli.command.upload.format'), 'text')).action(async (cmd) => {
+    .option('--format <format>', t('cli.command.upload.format'), 'text')
+    .addHelpText('after', t('cli.command.upload.vibeWebGuide'))).action(async (cmd) => {
     if (cmd.vibe) {
         const { vibeUpload } = await Promise.resolve().then(function () { return index$1; });
         await vibeUpload(cmd);
@@ -17102,6 +18003,9 @@ withVerboseOption(program
         cmd.title,
         cmd.icon,
         cmd.appInfo,
+        cmd.category,
+        cmd.subcategory,
+        cmd.web,
         cmd.package,
         cmd.dryRun,
         cmd.mock,
@@ -17443,6 +18347,25 @@ devSessionCmd
     });
 });
 const wasmCmd = program.command('wasm').description(t('cli.command.wasm.desc'));
+const collectCmd = wasmCmd.command('collect').description(t('cli.command.wasm.collect'));
+for (const operation of ['start', 'export']) {
+    const command = collectCmd.command(operation)
+        .description(t(operation === 'start' ? 'cli.command.wasm.collect.start' : 'cli.command.wasm.collect.export'))
+        .allowExcessArguments(false)
+        .option('--client-key <key>', t('cli.command.wasm.collect.clientKey'))
+        .option('--wasm-md5 <md5>', t('cli.command.wasm.collect.md5'))
+        .option('--timeout <seconds>', t('cli.command.wasm.collect.timeout'), '30')
+        .option('--format <format>', t('cli.command.wasm.format'), 'json');
+    if (operation === 'start')
+        command.option('--reset', t('cli.command.wasm.collect.reset'));
+    else
+        command.option('--input <path>', t('cli.command.wasm.input'))
+            .option('--output <path>', t('cli.command.wasm.collect.output'));
+    command.action(async (options) => {
+        const Native = await Promise.resolve().then(function () { return index; });
+        await Native.wasmCollectCommand(operation, options);
+    });
+}
 for (const operation of ['prepare', 'split']) {
     const command = wasmCmd.command(operation)
         .description(t(operation === 'prepare' ? 'cli.command.wasm.prepare' : 'cli.command.wasm.split'))
@@ -17532,14 +18455,118 @@ else {
     program.parse(process.argv);
 }
 
-class VibeError extends Error {
-    constructor(code) {
-        super(code);
-        this.code = code;
+// Only the backend-owned authorization page can be a browser redirect target.
+// Never return its import_token to Skill stdout or put it in a CLI argument.
+function browserLandingUrl(value) {
+    if (typeof value !== 'string' || value.length > 16384 || /[\r\n]/.test(value))
+        return;
+    try {
+        const url = new URL(value);
+        if (url.origin !== 'https://developers.tiktok.com' || url.username || url.password || url.hash ||
+            url.pathname !== '/portal_h5/minis_import' ||
+            url.searchParams.getAll('task_id').length !== 1 ||
+            url.searchParams.getAll('import_token').length !== 1 ||
+            !/^\d{1,19}$/.test(url.searchParams.get('task_id') || '') ||
+            !url.searchParams.get('import_token'))
+            return;
+        return url.href;
+    }
+    catch {
+        return;
+    }
+}
+function authorizationOpenUrl(pageUrl) {
+    try {
+        if (typeof pageUrl !== 'string')
+            throw new Error();
+        const url = new URL(pageUrl);
+        if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || !url.port ||
+            url.username || url.password || url.search || url.hash ||
+            !/^\/[a-f0-9]{48}$/.test(url.pathname))
+            throw new Error();
+        return `${url.origin}${url.pathname}/authorize`;
+    }
+    catch {
+        throw new VibeError('VIBE_INVALID_PAGE_URL');
+    }
+}
+function checkAuthorizationPage(url) {
+    return new Promise((resolve, reject) => {
+        // HEAD never follows the redirect or requests the platform. The browser GET
+        // rechecks readiness, covering state changes between the probe and opening.
+        const req = http.request(url, { method: 'HEAD' }, res => {
+            res.resume();
+            if (res.statusCode === 204 && res.headers['x-ttmg-authorization'] === 'ready')
+                resolve();
+            else
+                reject(new VibeError('VIBE_AUTH_PAGE_UNAVAILABLE'));
+        });
+        const timer = setTimeout(() => req.destroy(new Error('timeout')), 5000);
+        req.once('close', () => clearTimeout(timer));
+        req.once('error', () => reject(new VibeError('VIBE_AUTH_PAGE_UNAVAILABLE')));
+        req.end();
+    });
+}
+async function openVibeBrowser(url) {
+    const child = await (await import('open')).default(url);
+    return new Promise((resolve, reject) => {
+        child.once('error', reject);
+        if (child.pid)
+            resolve(child);
+        else
+            child.once('spawn', () => resolve(child));
+    });
+}
+async function executeVibeAuthOpen(options, deps = { open: openVibeBrowser }) {
+    const result = {
+        schemaVersion: '1', command: 'auth open', operationId: `auth_open_${crypto.randomUUID()}`,
+        status: 'failed', platformWrite: false, browserOpenRequested: false,
+        errorCode: null, error: null,
+    };
+    try {
+        if (!['text', 'json', 'ndjson'].includes(options.format || 'text'))
+            throw new VibeError('VIBE_INVALID_FORMAT');
+        const url = authorizationOpenUrl(options.pageUrl);
+        await checkAuthorizationPage(url);
+        try {
+            await deps.open(url);
+        }
+        catch {
+            throw new VibeError('VIBE_BROWSER_OPEN_FAILED');
+        }
+        result.status = 'open_requested';
+        result.browserOpenRequested = true;
+    }
+    catch (error) {
+        result.errorCode = error instanceof VibeError ? error.code : 'VIBE_BROWSER_OPEN_FAILED';
+        const key = result.errorCode === 'VIBE_INVALID_PAGE_URL' ? 'invalidPage'
+            : result.errorCode === 'VIBE_AUTH_PAGE_UNAVAILABLE' ? 'unavailable'
+                : result.errorCode === 'VIBE_INVALID_FORMAT' ? 'invalidFormat' : 'failed';
+        result.error = t(`cli.command.auth.open.${key}`);
     }
+    return result;
+}
+async function vibeAuthOpen(options) {
+    const result = await executeVibeAuthOpen(options);
+    if (options.format === 'json' || options.format === 'ndjson')
+        console.log(JSON.stringify(result));
+    else
+        console.log(result.error || t('cli.command.auth.open.requested'));
+    if (result.errorCode)
+        process.exitCode = 1;
+    return result;
 }
 
-// BFF IDL: feat-minis-import. PPE task creation/polling only; no production adapter.
+var authOpen = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    authorizationOpenUrl: authorizationOpenUrl,
+    browserLandingUrl: browserLandingUrl,
+    executeVibeAuthOpen: executeVibeAuthOpen,
+    openVibeBrowser: openVibeBrowser,
+    vibeAuthOpen: vibeAuthOpen
+});
+
+// BFF IDL: feat-minis-import. PPE import flow; no production adapter.
 const prefix = '/bff/app_info/minis_import/';
 const MINIS_IMPORT_PATHS = {
     create: `${prefix}create_minis_import_task_for_agent/`,
@@ -17659,7 +18686,7 @@ function createBackend(mode, transport) {
                 path: MINIS_IMPORT_PATHS.info,
                 data: {
                     ...credentials(task),
-                    app_info: { ...appInfo, app_name: title, icon_uri: iconUri },
+                    app_info: { ...(appInfo || VIBE_PPE_DEFAULT_APP_INFO), app_name: title, icon_uri: iconUri },
                 },
                 signal,
             });
@@ -17707,15 +18734,9 @@ function createPpeBackend(lane, adapter) {
         'x-use-ppe': '1',
         'x-tt-env': lane,
     }, adapter);
-    const uploadUnavailable = async () => {
-        throw new VibeError('VIBE_REAL_UPLOAD_NOT_READY');
-    };
     return {
         ...backend,
-        uploadAvailable: false,
-        uploadIcon: uploadUnavailable,
-        submitInfo: uploadUnavailable,
-        uploadPackage: uploadUnavailable,
+        uploadAvailable: true,
     };
 }
 /** Opt-in integration demo: only creation and polling can reach PPE. */
@@ -17739,6 +18760,7 @@ function createPpeMockBackend(lane, adapter, scenario = 'success') {
     return {
         mode: 'ppe-mock',
         uploadAvailable: true,
+        dispose: () => real.dispose?.(),
         async createTask(input, signal) {
             if (realTask)
                 throw new VibeError('VIBE_TASK_NOT_ACCEPTING_INPUT');
@@ -17770,14 +18792,20 @@ function createPpeMockBackend(lane, adapter, scenario = 'success') {
     };
 }
 function createHttpBackend(mode, baseURL, environmentHeaders = {}, adapter) {
+    // Own the agents so an early multipart response cannot leave upload sockets
+    // keeping the CLI alive after its terminal result. Never destroy global agents.
+    const httpAgent = new http.Agent();
+    const httpsAgent = new https.Agent();
     const client = axios.create({
         baseURL,
         timeout: 30000,
         maxRedirects: 0,
         proxy: false,
         adapter,
+        httpAgent,
+        httpsAgent,
     });
-    return createBackend(mode, async (request) => {
+    const backend = createBackend(mode, async (request) => {
         try {
             let body;
             let headers = {};
@@ -17816,6 +18844,13 @@ function createHttpBackend(mode, baseURL, environmentHeaders = {}, adapter) {
                 : 'VIBE_BACKEND_REQUEST_FAILED');
         }
     });
+    return {
+        ...backend,
+        dispose() {
+            httpAgent.destroy();
+            httpsAgent.destroy();
+        },
+    };
 }
 const MOCK_SCENARIOS = [
     'success',
@@ -18127,101 +19162,6 @@ async function checkCommand(options = {}) {
     return report;
 }
 
-// BFF IDL + Import Service ValidateAppInfo, feat-minis-import (2026-09-14).
-// Keep credentials, app_name and icon_uri out of this file: CLI owns those fields.
-const requiredStrings = [
-    'description', 'category', 'subcategory', 'terms_of_service', 'privacy_policy',
-];
-const optionalStrings = ['apple_team_id', 'contact_email', 'region', 'min_sdk_version'];
-function readVibeAppInfo(file) {
-    if (file === undefined)
-        return undefined;
-    try {
-        const stat = fs.statSync(file);
-        if (!stat.isFile() || stat.size > 64 * 1024)
-            throw new Error();
-        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            throw new Error();
-        const allowed = new Set([...requiredStrings, ...optionalStrings, 'copyright_confirmation']);
-        if (Object.keys(value).some(key => !allowed.has(key)))
-            throw new Error();
-        // JSON can encode lone surrogates that Go rejects as invalid UTF-8 input.
-        for (const item of Object.values(value)) {
-            if (typeof item === 'string' && [...item].some(char => /^[\uD800-\uDFFF]$/.test(char)))
-                throw new Error();
-        }
-        for (const key of requiredStrings) {
-            if (typeof value[key] !== 'string' || !value[key].trim())
-                throw new Error();
-        }
-        for (const key of optionalStrings) {
-            if (value[key] !== undefined && (typeof value[key] !== 'string' || !value[key].trim()))
-                throw new Error();
-        }
-        // An explicit declaration is required; never infer consent or supply a default.
-        if (value.copyright_confirmation !== true)
-            throw new Error();
-        for (const key of ['terms_of_service', 'privacy_policy']) {
-            if (/\s/.test(value[key]))
-                throw new Error();
-            const url = new URL(value[key]);
-            if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password)
-                throw new Error();
-        }
-        if (value.contact_email !== undefined && !/^[^\s<>@]+@[^\s<>@]+$/.test(value.contact_email))
-            throw new Error();
-        return value;
-    }
-    catch {
-        // Do not expose paths, file contents or parser errors in structured output.
-        throw new VibeError('VIBE_INVALID_APP_INFO');
-    }
-}
-const VIBE_PLATFORM_ICON_LIMIT = 5 * 1024 * 1024;
-// Header preflight only. The BFF remains responsible for decoding the image.
-function validateVibeUploadInput(input) {
-    if ([...input.title].length > 30)
-        throw new VibeError('VIBE_TITLE_TOO_LONG');
-    const image = input.icon.bytes;
-    if (image.length > VIBE_PLATFORM_ICON_LIMIT)
-        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
-    let width = 0, height = 0;
-    if (image.length >= 33 && image.subarray(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex')) &&
-        image.readUInt32BE(8) === 13 && image.toString('ascii', 12, 16) === 'IHDR') {
-        width = image.readUInt32BE(16);
-        height = image.readUInt32BE(20);
-    }
-    else if (image[0] === 0xff && image[1] === 0xd8) {
-        let offset = 2;
-        while (offset + 4 <= image.length) {
-            if (image[offset++] !== 0xff)
-                break;
-            while (image[offset] === 0xff)
-                offset++;
-            const marker = image[offset++];
-            if (marker === 0xda || marker === 0xd9)
-                break;
-            if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7))
-                continue;
-            if (offset + 2 > image.length)
-                break;
-            const length = image.readUInt16BE(offset);
-            if (length < 2 || offset + length > image.length)
-                break;
-            // Go image/jpeg accepts baseline, extended sequential and progressive SOF.
-            if ([0xc0, 0xc1, 0xc2].includes(marker) && length >= 8) {
-                height = image.readUInt16BE(offset + 3);
-                width = image.readUInt16BE(offset + 5);
-                break;
-            }
-            offset += length;
-        }
-    }
-    if (width !== 1024 || height !== 1024)
-        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
-}
-
 // Prototype resource guards, not agreed platform validation rules.
 const VIBE_ICON_LIMIT = 10 * 1024 * 1024;
 const VIBE_ZIP_LIMIT = 100 * 1024 * 1024;
@@ -18242,7 +19182,7 @@ async function prepareVibeInput(options, onPackaging, signal, deps = { check: ex
     const title = options.title?.trim();
     if (!title)
         throw new VibeError('VIBE_TITLE_REQUIRED');
-    const appInfo = readVibeAppInfo(options.appInfo);
+    const appInfo = applyVibeCategory(options, readVibeAppInfo(options.appInfo));
     if (options.package && options.dir)
         throw new VibeError('VIBE_INPUT_CONFLICT');
     const image = readFile(options.icon, VIBE_ICON_LIMIT, 'VIBE_INVALID_ICON');
@@ -18285,7 +19225,7 @@ async function prepareVibeInput(options, onPackaging, signal, deps = { check: ex
         },
         code: { bytes: code, name: 'game.zip', contentType: 'application/zip' },
     };
-    if (appInfo)
+    if (options.appInfo !== undefined)
         validateVibeUploadInput(input);
     return input;
 }
@@ -18369,6 +19309,14 @@ async function renderVibePage(input) {
             mockNote: input.hybrid ? 'Real task creation / polling · Mock authorization / upload · Real task status unchanged' : 'Mock only · no scan needed, nothing is uploaded',
             footer: 'Temporary page · closes after 15 minutes',
         };
+    if (input.web) {
+        copy.steps[0] = zh ? '网页授权' : 'Web authorization';
+        copy.bindingAction = zh ? '在浏览器完成授权绑定' : 'Authorize in your browser';
+        copy.bindingSubtitle = input.simulation
+            ? (zh ? '本次为模拟运行，无需完成网页授权，稍后继续模拟上传。' : 'Mock run: browser approval is not required; simulated upload continues shortly.')
+            : (zh ? '请在已打开的 TikTok 页面确认授权，当前命令会继续查询绑定状态。' : 'Confirm authorization on the opened TikTok page. The command continues polling.');
+        copy.bindingStatus = input.simulation ? (zh ? '模拟等待授权' : 'Simulating authorization') : (zh ? '等待网页授权' : 'Waiting for browser authorization');
+    }
     const step = phase === 'binding' ? 0 : phase === 'uploading' ? 1 : 2;
     // Only embed the chosen raster image; never fetch a URL or expose its local path.
     const icon = input.iconDataUrl &&
@@ -18392,7 +19340,7 @@ async function renderVibePage(input) {
             : phase === 'failed'
                 ? escape(input.message)
                 : copy.completeSubtitle;
-    const qr = phase === 'binding' && input.qrUrl
+    const qr = phase === 'binding' && !input.web && input.qrUrl
         ? await QRCode.toDataURL(input.qrUrl, {
             width: 384,
             margin: 4,
@@ -18411,11 +19359,13 @@ async function renderVibePage(input) {
             : phase === 'failed'
                 ? copy.failedTitle
                 : copy.accepted;
-    const content = qr
-        ? `<div class="qr-area"><div class="qr-frame"><img width="192" height="192" alt="${purpose}" src="${qr}"></div></div>`
-        : phase === 'uploading'
-            ? `<div class="upload-area"><div class="upload-symbol"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-hidden="true"><path d="M12 16V4m-4 4 4-4 4 4M5 15v5h14v-5" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg></div>${progress !== undefined ? `<div class="percentage">${progress}<span>%</span></div><div class="progress-wrap"><progress aria-label="${copy.uploadLabel}" max="100" value="${progress}"></progress><p class="transfer-label">${copy.uploadLabel}</p></div>` : '<span class="spinner" aria-hidden="true"></span>'}</div>`
-            : `<div class="upload-area"><div class="pending-symbol">${phase === 'failed' ? '!' : checkIcon}</div></div>`;
+    const content = phase === 'binding' && input.web
+        ? '<div class="upload-area"><span class="spinner" aria-hidden="true"></span></div>'
+        : qr
+            ? `<div class="qr-area"><div class="qr-frame"><img width="192" height="192" alt="${purpose}" src="${qr}"></div></div>`
+            : phase === 'uploading'
+                ? `<div class="upload-area"><div class="upload-symbol"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" aria-hidden="true"><path d="M12 16V4m-4 4 4-4 4 4M5 15v5h14v-5" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg></div>${progress !== undefined ? `<div class="percentage">${progress}<span>%</span></div><div class="progress-wrap"><progress aria-label="${copy.uploadLabel}" max="100" value="${progress}"></progress><p class="transfer-label">${copy.uploadLabel}</p></div>` : '<span class="spinner" aria-hidden="true"></span>'}</div>`
+                : `<div class="upload-area"><div class="pending-symbol">${phase === 'failed' ? '!' : checkIcon}</div></div>`;
     return `<!doctype html><html lang="${zh ? 'zh-CN' : 'en'}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="refresh" content="2"><title>${escape(title)} · ${escape(input.title)}</title><style>${vibePageStyles}</style></head>
 <body><main class="shell" data-phase="${phase}"><header class="brand"><span class="brand-mark" aria-hidden="true"><svg width="16" height="16" viewBox="0 0 20 20" fill="none"><path d="m7 5-4 5 4 5m6-10 4 5-4 5" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/></svg></span><span class="brand-name">TikTok Minis</span><span class="brand-tool">DevTool</span>${input.simulation ? `<span class="mock-badge">${copy.mock}</span>` : ''}</header>
 <section class="card" aria-labelledby="page-title">${phase === 'failed' ? '' : `<ol class="steps" aria-label="${zh ? '上传步骤' : 'Upload steps'}">${copy.steps.map((label, i) => `<li class="step ${i < step ? 'done' : i === step ? 'active' : ''}"${i === step ? ' aria-current="step"' : ''}><span class="step-number">${i < step ? checkIcon : i + 1}</span>${label}</li>`).join('')}</ol>`}
@@ -18427,9 +19377,27 @@ async function renderVibePage(input) {
 async function createVibePageServer() {
     const route = `/${crypto.randomBytes(24).toString('hex')}`;
     let html = 'Starting…';
+    let landingUrl;
     const server = http.createServer((req, res) => {
         const address = server.address();
         const host = address && typeof address !== 'string' ? `127.0.0.1:${address.port}` : '';
+        if (req.url === `${route}/authorize` && req.headers.host === host &&
+            ['GET', 'HEAD'].includes(req.method || '') &&
+            (!req.headers.origin || req.headers.origin === `http://${host}`) &&
+            req.headers['sec-fetch-site'] !== 'cross-site') {
+            const headers = { 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' };
+            if (!landingUrl) {
+                res.writeHead(410, { ...headers, 'Content-Type': 'text/plain; charset=utf-8' });
+                res.end('Authorization is no longer available. Return to the upload process.');
+            }
+            else if (req.method === 'HEAD') {
+                res.writeHead(204, { ...headers, 'X-TTMG-Authorization': 'ready' }).end();
+            }
+            else {
+                res.writeHead(302, { ...headers, Location: landingUrl }).end();
+            }
+            return;
+        }
         if (req.method !== 'GET' ||
             req.url !== route ||
             req.headers.host !== host) {
@@ -18452,8 +19420,9 @@ async function createVibePageServer() {
     const address = server.address();
     return {
         url: `http://127.0.0.1:${address.port}${route}`,
-        update: (value) => {
+        update: (value, authorization) => {
             html = value;
+            landingUrl = browserLandingUrl(authorization);
         },
         close: () => server.close(),
     };
@@ -18475,7 +19444,7 @@ async function runVibePageWorker() {
         if (message?.type === 'render' &&
             typeof message.html === 'string' &&
             message.html.length < VIBE_PAGE_HTML_LIMIT) {
-            server.update(message.html);
+            server.update(message.html, message.browserLandingUrl);
             process.send?.({ type: 'rendered', id: message.id });
         }
         if (message?.type === 'close') {
@@ -18523,7 +19492,8 @@ async function startVibePage() {
                 const html = await renderVibePage(input);
                 const current = ++id;
                 const ack = receive(m => m?.type === 'rendered' && m.id === current);
-                child.send({ type: 'render', id: current, html }, error => {
+                const landingUrl = input.phase === 'binding' ? browserLandingUrl(input.browserLandingUrl) : undefined;
+                child.send({ type: 'render', id: current, html, browserLandingUrl: landingUrl }, error => {
                     if (error)
                         child.emit('error', error);
                 });
@@ -18640,7 +19610,7 @@ const defaults = {
     startPage: startVibePage,
     sleep: abortableDelay,
     projectId: getVibeProjectId,
-    open: async (url) => (await import('open')).default(url),
+    open: openVibeBrowser,
 };
 async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}, externalSignal) {
     const deps = { ...defaults, ...dependencies };
@@ -18652,6 +19622,7 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
     let timeout;
     let timedOut = false;
     let page;
+    let backend = deps.backend;
     let detached = false;
     let progressUpdates = Promise.resolve();
     let ppeLane;
@@ -18661,6 +19632,7 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
         schemaVersion: '2',
         command: 'upload',
         mode: 'vibe',
+        inputRequirements: VIBE_INPUT_REQUIREMENTS,
         operationId: `vibe_${crypto.randomUUID()}`,
         ts: Date.now(),
         status: 'precheck',
@@ -18694,7 +19666,17 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
         // --mock is the stable trial entry: working steps use the built-in PPE lane,
         // blocked steps remain simulated. No environment setup is required.
         // Explicit command-line selection wins; real failures never fall back to mock.
-        if (!options.mock && !options.vibeApi && process.env.TTMG_VIBE_BACKEND) {
+        if (options.web) {
+            if (options.mock || options.mockScenario || options.vibeApi || options.open === false)
+                throw new VibeError('VIBE_WEB_OPTION_CONFLICT');
+            ppeSelected = true;
+            ppeLane = process.env.TTMG_VIBE_PPE || 'ppe_op_vc';
+            if (!/^ppe_[a-zA-Z0-9_-]{1,64}$/.test(ppeLane))
+                throw new VibeError('VIBE_INVALID_PPE_ENV');
+            if (deps.backend && deps.backend.mode !== 'ppe')
+                throw new VibeError('VIBE_WEB_OPTION_CONFLICT');
+        }
+        else if (!options.mock && !options.vibeApi && process.env.TTMG_VIBE_BACKEND) {
             const configured = process.env.TTMG_VIBE_BACKEND;
             if (configured === 'mock')
                 options = { ...options, mock: true };
@@ -18731,7 +19713,6 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
             timedOut = true;
             controller.abort();
         }, timeoutMs);
-        let backend = deps.backend;
         if (!options.dryRun && !backend) {
             if (options.mock)
                 backend = deps.createTrialBackend(options.mockScenario);
@@ -18756,6 +19737,12 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
             terminal: !!options.dryRun,
             nextAction: options.dryRun ? 'none' : 'wait',
             title: input.title,
+            classification: {
+                category: (input.appInfo || VIBE_PPE_DEFAULT_APP_INFO).category,
+                subcategory: (input.appInfo || VIBE_PPE_DEFAULT_APP_INFO).subcategory,
+                source: options.category !== undefined ? 'arguments' : input.appInfo ? 'app-info' : 'defaults',
+                catalogVersion: GAME_CATEGORY_CATALOG_VERSION,
+            },
             iconSizeBytes: input.icon.bytes.length,
             packageSizeBytes: input.code.bytes.length,
             packageSha256: crypto.createHash('sha256')
@@ -18769,6 +19756,7 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
             iconDataUrl: `data:${input.icon.contentType};base64,${input.icon.bytes.toString('base64')}`,
             uploadAvailable: backend.uploadAvailable !== false,
             hybrid: backend.mode === 'ppe-mock',
+            web: !!options.web,
         };
         const sourceProjectId = deps.projectId(options);
         emit('creating_task', { platformWrite: backend.mode === 'ppe' || backend.mode === 'ppe-mock' });
@@ -18780,6 +19768,8 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
         }, controller.signal);
         ensureActive();
         const authorizationUrl = createAuthorizationScheme(task.landingUrl);
+        if (options.web && !browserLandingUrl(task.landingUrl))
+            throw new VibeError('VIBE_INVALID_RESPONSE');
         const pollMs = seconds(options.pollInterval, task.pollIntervalSeconds);
         result = {
             ...result,
@@ -18788,32 +19778,55 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
         };
         page = await deps.startPage();
         ensureActive();
-        const bindingMessage = backend.mode === 'ppe-mock'
+        const bindingMessage = options.web
             ? (getCurrentLanguage() === 'zh-CN'
-                ? '真实 PPE 任务和授权二维码；查询三次后模拟授权、上传，无需完成手机授权。'
-                : 'Real PPE task and authorization QR. After three polls, authorization and upload are simulated; phone authorization is not required.')
-            : backend.uploadAvailable === false
-                ? (getCurrentLanguage() === 'zh-CN' ? '请扫码完成真实 PPE 授权；上传尚未开放。' : 'Scan to authorize in PPE. Upload is not enabled yet.')
-                : text('waiting_authorization', result.simulation);
+                ? '请在浏览器完成真实授权，当前命令会继续查询绑定状态。'
+                : 'Complete real authorization in the browser; this command keeps polling the binding status.')
+            : backend.mode === 'ppe-mock'
+                ? (getCurrentLanguage() === 'zh-CN'
+                    ? '真实 PPE 任务和授权二维码；查询三次后模拟授权、上传，无需完成手机授权。'
+                    : 'Real PPE task and authorization QR. After three polls, authorization and upload are simulated; phone authorization is not required.')
+                : backend.uploadAvailable === false
+                    ? (getCurrentLanguage() === 'zh-CN' ? '请扫码完成真实 PPE 授权；上传尚未开放。' : 'Scan to authorize in PPE. Upload is not enabled yet.')
+                    : text('waiting_authorization', result.simulation);
         await page.update({
             ...pageGame,
             language: getCurrentLanguage(),
             phase: 'binding',
             simulation: result.simulation,
             message: bindingMessage,
-            qrUrl: authorizationUrl,
+            qrUrl: options.web ? undefined : authorizationUrl,
+            browserLandingUrl: task.landingUrl,
             purpose: 'authorization_binding',
         });
         ensureActive();
+        let browserOpenRequested = false;
+        let browserOpenErrorCode;
+        if (options.web) {
+            try {
+                await deps.open(authorizationOpenUrl(page.url));
+                browserOpenRequested = true;
+            }
+            catch {
+                // Preserve the task and polling; the returned helper retries this same page.
+                browserOpenErrorCode = 'VIBE_BROWSER_OPEN_FAILED';
+            }
+        }
         emit('waiting_authorization', {
-            message: bindingMessage,
+            message: browserOpenErrorCode
+                ? (getCurrentLanguage() === 'zh-CN' ? '浏览器未能打开，请使用 authorizationOpenCommand 重试；当前任务仍在等待授权。' : 'Browser opening failed. Retry authorizationOpenCommand; this task is still waiting for authorization.')
+                : bindingMessage,
             pageUrl: page.url,
-            qrPurpose: 'authorization_binding',
-            nextAction: result.simulation ? 'wait' : 'scan_qr',
+            authorizationMode: options.web ? 'web' : 'qr',
+            ...(options.web ? { browserOpenRequested, browserOpenErrorCode } : {}),
+            authorizationOpenCommand: browserLandingUrl(task.landingUrl)
+                ? `ttmg auth open --page-url ${page.url} --format json` : undefined,
+            qrPurpose: options.web ? undefined : 'authorization_binding',
+            nextAction: result.simulation ? 'wait' : options.web ? 'open_browser' : 'scan_qr',
             readyForInput: false,
         });
         // Opening a browser is presentation only and never gates token polling.
-        if ((options.format || 'text') === 'text' && options.open !== false)
+        if (!options.web && (options.format || 'text') === 'text' && options.open !== false)
             void deps.open(page.url).catch(() => { });
         while (true) {
             ensureActive();
@@ -18921,6 +19934,9 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
                 ? 'cancelled'
                 : 'failed';
         const messages = {
+            VIBE_CATEGORY_PAIR_REQUIRED: ['--category 和 --subcategory 必须同时提供；均不传时保留默认分类。使用 ttmg game categories --format json 查询。', 'Provide --category and --subcategory together, or omit both to keep the default. Query ttmg game categories --format json.'],
+            VIBE_INVALID_CATEGORY: ['类型或子类型无效，或两者不匹配。使用 ttmg game categories --format json 查询有效组合。', 'Invalid category/subcategory pair. Query valid values with ttmg game categories --format json.'],
+            VIBE_WEB_OPTION_CONFLICT: ['--web 使用真实网页授权，不能与 --mock、--mock-scenario、--vibe-api 或 --no-open 同时使用。', '--web uses real browser authorization and cannot be combined with --mock, --mock-scenario, --vibe-api or --no-open.'],
             VIBE_AUTH_DENIED: [
                 '已取消授权，本次未上传。',
                 'Authorization cancelled. No upload was performed.',
@@ -18937,8 +19953,8 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
             VIBE_TITLE_REQUIRED: ['请提供游戏名称。', 'Provide a game title.'],
             VIBE_TITLE_TOO_LONG: ['游戏名称不能超过 30 个字符。', 'The game title must not exceed 30 characters.'],
             VIBE_INVALID_APP_INFO: [
-                '请检查 --app-info JSON：需要简介、分类、子分类、有效的条款及隐私链接、明确的版权确认；不要填写任务凭据、名称或头像 URI。',
-                'Check --app-info JSON: description, category, subcategory, valid terms/privacy URLs and explicit copyright confirmation are required. Do not include credentials, app_name or icon_uri.',
+                '旧 --app-info 文件无效。当前上传只需标题和头像，CLI 自动补齐其他字段的 PPE 试用默认值；移除 --app-info 后重试，不要向用户索要额外资料。',
+                'Invalid legacy --app-info file. Current uploads need only title and icon; CLI fills other fields with PPE trial defaults. Remove --app-info and retry without requesting extra fields from the user.',
             ],
             VIBE_PLATFORM_ICON_INVALID: [
                 '平台头像要求 PNG/JPEG、1024×1024，且不超过 5 MiB，请重新选择本地图片。',
@@ -19043,6 +20059,7 @@ async function executeVibeUpload(options, onEvent = () => { }, dependencies = {}
     finally {
         clearTimeout(timeout);
         externalSignal?.removeEventListener('abort', cancel);
+        backend?.dispose?.();
         if (page && !detached)
             page.close();
     }
@@ -19913,7 +20930,12 @@ async function watch(options = {}) {
         /**
          * 忽略 wasmcode/cache 目录
          */
-        ignored: /(^|[\/\\])(\.git|\.ttmg|node_modules|__TTMG_TEMP__)/,
+        ignored: file => {
+            if (/(^|[\/\\])(\.git|node_modules|__TTMG_TEMP__)/.test(file))
+                return true;
+            const relative = path$1.relative(process.cwd(), file);
+            return relative === '.ttmg' || relative.startsWith(`.ttmg${path$1.sep}`);
+        },
         ignoreInitial: true, // 忽略初始添加事件
         persistent: true,
         awaitWriteFinish: {
@@ -27737,7 +28759,7 @@ function requireOperationId(value) {
 async function snapshotProject(source, signal) {
     const directory = await fsp.mkdtemp(path$1.join(os$1.tmpdir(), 'ttmg-iteration-'));
     const hash = crypto$1.createHash('sha256');
-    const ignored = new Set(['.git', '.ttmg', 'node_modules', '__TTMG_TEMP__']);
+    const ignored = new Set(['.git', 'node_modules', '__TTMG_TEMP__']);
     const dispose = () => fs$1.rmSync(directory, { recursive: true, force: true });
     try {
         async function copy(relative) {
@@ -27746,7 +28768,7 @@ async function snapshotProject(source, signal) {
             });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
                 signal?.throwIfAborted();
-                if (ignored.has(entry.name))
+                if (ignored.has(entry.name) || (!relative && entry.name === '.ttmg'))
                     continue;
                 const name = path$1.join(relative, entry.name);
                 if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile()))
@@ -28047,6 +29069,24 @@ class PreviewWorkflow {
     }
 }
 
+function physicalPath(directory) {
+    const absolute = path$1.resolve(directory);
+    if (fs$1.existsSync(absolute))
+        return fs$1.realpathSync(absolute);
+    const parent = path$1.dirname(absolute);
+    if (parent === absolute)
+        return absolute;
+    return path$1.join(physicalPath(parent), path$1.basename(absolute));
+}
+// Packaging reserves only the project-root .ttmg directory. Never silently put
+// session output into an ordinary game asset directory (including via symlinks).
+function isSafeEvidenceDirectory(project, directory) {
+    const relative = path$1.relative(physicalPath(project), physicalPath(directory));
+    return path$1.isAbsolute(relative) || relative === '..' ||
+        relative.startsWith(`..${path$1.sep}`) || relative === '.ttmg' ||
+        relative.startsWith(`.ttmg${path$1.sep}`);
+}
+
 function normalizeMode(mode) {
     const value = (mode || 'default').toLowerCase();
     if (value !== 'default' && value !== 'client-preview') {
@@ -28116,6 +29156,17 @@ async function dev(options = {}) {
     }
     const humanPreview = mode === 'client-preview' && !structured;
     const managed = structured || humanPreview;
+    if (managed && !isSafeEvidenceDirectory(process.cwd(), options.evidenceDir || path$1.join('.ttmg', 'sessions'))) {
+        const failed = { schemaVersion: '1', command: 'dev', status: 'failed',
+            sessionId: null, platformWrite: false, errorCode: 'DEV_EVIDENCE_DIRECTORY_UNSAFE',
+            error: t('dev.evidence.unsafeDirectory') };
+        if (structured)
+            console.log(JSON.stringify(failed));
+        else
+            console.error(failed.error);
+        process.exitCode = 1;
+        return failed;
+    }
     const humanOutput = humanPreview ? new HumanPreviewOutput() : null;
     const scanPage = mode === 'client-preview' ? new ClientPreviewScanPage() : null;
     const timeoutMs = normalizeTimeout(options.timeout);
@@ -29993,6 +31044,8 @@ async function startBackgroundPreview(options) {
         const clientKey = options.clientKey?.trim();
         if (!clientKey)
             throw workflowError('DEV_ITERATION_INVALID_OPTIONS', 'Pass --client-key when starting a background preview.');
+        if (!isSafeEvidenceDirectory(process.cwd(), path$1.dirname(lock)))
+            throw workflowError('DEV_EVIDENCE_DIRECTORY_UNSAFE', 'The project .ttmg directory must not resolve to a game asset directory.');
         fs$1.mkdirSync(path$1.dirname(lock), { recursive: true });
         try {
             fs$1.mkdirSync(lock, { mode: 0o700 });
@@ -30198,12 +31251,17 @@ async function snapshotWasm(input, output) {
             callback(bytes > 512 * 1024 * 1024 ? fail('WASM_INPUT_INVALID', 'Expanded Wasm exceeds 512 MiB.') : null, chunk);
         } });
     const source = fs$1.createReadStream(input);
+    const fileMd5 = crypto$1.createHash('md5');
+    const identity = new node_stream.Transform({ transform(chunk, _encoding, callback) {
+            fileMd5.update(chunk);
+            callback(null, chunk);
+        } });
     const target = fs$1.createWriteStream(output, { flags: 'wx', mode: 0o600 });
     try {
         if (input.endsWith('.br'))
-            await promises$2.pipeline(source, zlib$1.createBrotliDecompress(), bound, target);
+            await promises$2.pipeline(source, identity, zlib$1.createBrotliDecompress(), bound, target);
         else
-            await promises$2.pipeline(source, bound, target);
+            await promises$2.pipeline(source, identity, bound, target);
     }
     catch (error) {
         throw fail(error.code === 'WASM_INPUT_INVALID' ? error.code : 'WASM_INPUT_INVALID', 'Could not read the original Wasm input.');
@@ -30220,7 +31278,11 @@ async function snapshotWasm(input, output) {
         throw fail('WASM_INPUT_INVALID', 'Expected a WebAssembly version 1 binary.');
     if (!WebAssembly.validate(await fsp.readFile(output)))
         throw fail('WASM_INPUT_INVALID', 'Original Wasm is invalid or unsupported by this Node.js WebAssembly engine.');
-    return { bytes, wasmSha256: await digest(output) };
+    const rawMd5 = crypto$1.createHash('md5');
+    for await (const chunk of fs$1.createReadStream(output))
+        rawMd5.update(chunk);
+    return { bytes, wasmSha256: await digest(output), wasmMd5: fileMd5.digest('hex'),
+        uncompressedWasmMd5: rawMd5.digest('hex') };
 }
 async function executeWasm(operation, options, dependencies = {}) {
     const base = { schemaVersion: '1', command: `wasm.${operation}`, operationId: `wasm_${crypto$1.randomUUID()}`,
@@ -30328,6 +31390,149 @@ async function wasmCommand(operation, options) {
     process.exitCode = result.status === 'failed' ? 1 : 0;
 }
 
+class CollectError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+const invalid = (code, message) => { throw new CollectError(code, message); };
+async function executeWasmCollect(operation, options, overrides = {}) {
+    const deps = { authenticated: () => Boolean(getCurrentUser()?.cookie), request, ...overrides };
+    const base = { schemaVersion: '1', command: `wasm.collect.${operation}`,
+        operationId: `wasm_collect_${crypto$1.randomUUID()}`, platformWrite: operation === 'start',
+        platformWriteAttempted: false, sourceModified: false };
+    let temporary;
+    let staging;
+    let timer;
+    try {
+        const timeout = Number(options.timeout ?? 30);
+        if (!['start', 'export'].includes(operation) || !['json', 'text'].includes(options.format || 'json') ||
+            !/^[A-Za-z0-9_-]{1,128}$/.test(options.clientKey || '') || !/^[a-fA-F0-9]{32}$/.test(options.wasmMd5 || '') ||
+            !Number.isInteger(timeout) || timeout < 1 || timeout > 300 ||
+            (options.reset !== undefined && typeof options.reset !== 'boolean') ||
+            (operation === 'export' && (!options.input || !options.output || options.reset !== undefined)) ||
+            (operation === 'start' && (options.input || options.output))) {
+            invalid('WASM_COLLECT_INVALID_OPTIONS', 'Provide client-key and wasm-md5; export also requires original input and a new output file. Timeout: 1–300 seconds.');
+        }
+        const clientKey = options.clientKey;
+        const wasmMd5 = options.wasmMd5.toLowerCase();
+        const output = options.output ? path$1.resolve(options.output) : undefined;
+        let source;
+        if (operation === 'export') {
+            // lstat detects dangling links as well as existing files. Never overwrite.
+            if (await fsp.lstat(output).catch((e) => { if (e.code !== 'ENOENT')
+                throw e; return null; }))
+                invalid('WASM_OUTPUT_EXISTS', 'Collection output already exists; choose a new file.');
+            temporary = await fsp.mkdtemp(path$1.join(os$1.tmpdir(), 'ttmg-collect-'));
+            try {
+                source = await snapshotWasm(path$1.resolve(options.input), path$1.join(temporary, 'original.wasm'));
+            }
+            catch {
+                return invalid('WASM_INPUT_INVALID', 'Expected a valid original Wasm or Brotli Wasm file.');
+            }
+            if (wasmMd5 !== source.wasmMd5 && wasmMd5 !== source.uncompressedWasmMd5)
+                invalid('WASM_COLLECTION_MISMATCH', 'Collection MD5 does not match this original Wasm (file bytes or uncompressed bytes).');
+        }
+        if (!deps.authenticated())
+            invalid('WASM_AUTH_REQUIRED', 'Run ttmg login on this machine before collecting or exporting.');
+        const controller = new AbortController();
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new CollectError('WASM_COLLECT_TIMEOUT', 'Platform request timed out. A start may have reached the server; retry without --reset to preserve collection.'));
+            }, timeout * 1000);
+        });
+        base.platformWriteAttempted = operation === 'start';
+        const response = await Promise.race([deps.request({
+                url: `${WASM_COLLECT_BASE_URL}/${operation === 'start' ? 'start' : 'export'}`,
+                method: operation === 'start' ? 'POST' : 'GET',
+                ...(operation === 'start'
+                    ? { data: { app_id: clientKey, wasm_md5: wasmMd5, reset: options.reset ?? false } }
+                    : { params: { app_id: clientKey, wasm_md5: wasmMd5, strategy: 'union' } }),
+                signal: controller.signal,
+                logRequestBody: false, logApiCalls: false,
+            }), deadline]);
+        clearTimeout(timer);
+        const code = response.error?.code ?? response.error?.StatusCode ?? response.data?.code;
+        const httpStatus = response.ctx?.httpStatusCode;
+        // Upstream bodies/errors are deliberately never included in output: they
+        // can contain credentials or gateway HTML, even with verbose enabled.
+        if ([401, -401].includes(Number(code)) || httpStatus === 401 ||
+            (Number(code) === -1 && /login|log.?in|登录|未登|auth/i.test(String(response.error?.message ?? response.error?.StatusMessage ?? response.data?.message ?? ''))))
+            invalid('WASM_AUTH_REQUIRED', 'Platform login expired. Run ttmg login and retry.');
+        if ([403, -403].includes(Number(code)) || httpStatus === 403)
+            invalid('WASM_COLLECT_FORBIDDEN', 'This account cannot access collection for this game.');
+        if (response.error || response.data?.code !== 0 || (httpStatus && (httpStatus < 200 || httpStatus >= 300)))
+            invalid('WASM_COLLECT_API_FAILED', 'Platform collection request failed; no collection file was written.');
+        if (operation === 'start') {
+            if (response.data.collect_state !== 'open')
+                invalid('WASM_COLLECT_INVALID_RESPONSE', 'Platform did not confirm an open collection window.');
+            return { ...base, status: 'succeeded', clientKey, wasmMd5, reset: options.reset ?? false,
+                collectState: 'open', nextAction: 'run_instrumented_game_and_collect', errorCode: null, error: null };
+        }
+        if (Array.isArray(response.data.func_ids) && response.data.func_ids.length === 0)
+            invalid('WASM_COLLECTION_EMPTY', 'No function IDs collected. Run the instrumented game and export again.');
+        let ids;
+        try {
+            ids = parseCollection({ schemaVersion: '1', wasmSha256: source.wasmSha256,
+                funcIds: response.data.func_ids, bootFuncIds: response.data.boot_func_ids }, source.wasmSha256);
+        }
+        catch {
+            return invalid('WASM_COLLECTION_INVALID', 'Platform returned invalid function IDs; no collection file was written.');
+        }
+        const collection = { schemaVersion: '1', wasmSha256: source.wasmSha256, ...ids,
+            clientKey, wasmMd5, strategy: 'union', exportedAt: new Date().toISOString() };
+        const bytes = Buffer.from(JSON.stringify(collection, null, 2) + '\n');
+        if (bytes.length > 32 * 1024 * 1024)
+            invalid('WASM_COLLECTION_INVALID', 'Collection JSON exceeds 32 MiB.');
+        await fsp.mkdir(path$1.dirname(output), { recursive: true });
+        staging = path$1.join(path$1.dirname(output), `.ttmg-collection-${crypto$1.randomUUID()}.tmp`);
+        await fsp.writeFile(staging, bytes, { flag: 'wx', mode: 0o600 });
+        // Publish a complete file atomically, with exclusive no-clobber semantics.
+        try {
+            await fsp.link(staging, output);
+        }
+        catch (e) {
+            if (e.code === 'EEXIST')
+                invalid('WASM_OUTPUT_EXISTS', 'Collection output already exists; choose a new file.');
+            throw e;
+        }
+        return { ...base, status: 'succeeded', clientKey, wasmMd5,
+            collection: { path: output, schemaVersion: '1', wasmSha256: source.wasmSha256,
+                funcCount: ids.funcIds.length, bootFuncCount: ids.bootFuncIds.length,
+                bytes: bytes.length, sha256: crypto$1.createHash('sha256').update(bytes).digest('hex') },
+            nextAction: 'split_with_collection', errorCode: null, error: null };
+    }
+    catch (error) {
+        const known = error instanceof CollectError;
+        return { ...base, status: 'failed', errorCode: known ? error.code : 'WASM_COLLECT_FAILED',
+            error: known ? error.message : 'Collection operation failed; check the original Wasm, output directory and connection.',
+            nextAction: known && error.code === 'WASM_AUTH_REQUIRED' ? 'login' : 'fix_and_retry' };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        if (staging)
+            await fsp.unlink(staging).catch(() => { });
+        if (temporary)
+            await fsp.rm(temporary, { recursive: true, force: true });
+    }
+}
+async function wasmCollectCommand(operation, options) {
+    const result = await executeWasmCollect(operation, options);
+    if ((options.format || 'json') === 'json')
+        console.log(JSON.stringify(result));
+    else {
+        console.log(t(result.status === 'failed' ? 'wasm.collect.failed' : 'wasm.collect.succeeded'));
+        if (result.error)
+            console.error(result.error);
+        if ('collection' in result)
+            console.log(result.collection.path);
+    }
+    process.exitCode = result.status === 'failed' ? 1 : 0;
+}
+
 const problem = (code, message) => Object.assign(new Error(message), { code });
 const MAX_BYTES = 64 * 1024 * 1024;
 // Export one finite Runtime interval. Sequence numbers are global, so gaps in
@@ -30531,6 +31736,7 @@ var index = /*#__PURE__*/Object.freeze({
     devSessionStopCommand: devSessionStopCommand,
     devWorkflowCommand: devWorkflowCommand,
     doctor: doctor,
+    wasmCollectCommand: wasmCollectCommand,
     wasmCommand: wasmCommand
 });
 //# sourceMappingURL=index.js.map