@ttmg/cli 0.4.6-vibe-beta.11 → 0.4.6-vibe-beta.13

package/README.md

@@ -9,8 +9,21 @@ Vibe real web authorization and upload: use `--web` with the title, local icon a
 
 #### Installation 安装
 
-For Agent, Monetization and Vibe Coding workflows, install the published beta:
-Agent、商业化和 Vibe Coding 流程请安装已发布的 beta 版本：
+For Vibe Web authorization and upload, install the `vibe-beta` release:
+Vibe 网页授权上传安装 `vibe-beta` 版本：
+
+```bash
+npm install -g @ttmg/cli@vibe-beta
+ttmg --version
+ttmg capabilities --format json
+ttmg upload --help
+```
+
+The package includes [vibe-upload.md](vibe-upload.md). Keep the Web upload process running during authorization and read NDJSON until a terminal event. The `beta` and `vibe-beta` tags point to different published versions.
+安装包包含 [vibe-upload.md](vibe-upload.md)。授权期间保持原 Web 上传进程运行，持续读取 NDJSON，直到收到终态。`beta` 与 `vibe-beta` 指向不同发布版本。
+
+For Agent and Monetization workflows, the published beta is:
+Agent、商业化流程的已发布 beta 为：
 
 ```bash
 npm install -g @ttmg/cli@0.4.6-agent-beta.2
@@ -55,14 +68,10 @@ Keep the upload process running; this command creates no task and reports only
 Skill 如需手动打开网页授权，读取上传进程 `waiting_authorization` 事件的 `pageUrl`，
 执行 `ttmg auth open --page-url <pageUrl> --format json`。保持原上传进程运行；
 新命令在 CLI 所在电脑打开系统浏览器，不新建任务，`open_requested` 不代表授权成功。
-该功能需使用包含新命令的本地构建；已发布旧版不会因此自动增加命令。
+`--web` 已自动打开授权页；上述辅助命令只用于重新打开同一任务的授权页。
 
-The experimental `upload --vibe` local prototype does not require platform login.
-Use `ttmg upload --vibe --mock` for the integration trial. No environment setup:
-task creation/polling use the built-in PPE lane; authorization and uploads are
-simulated. See [Vibe binding/upload](vibe-upload.md) for schema-v2 results.
-实验性 `upload --vibe --mock` 不要求平台登录或环境配置。CLI 内置 PPE 创建／查询任务，
-模拟授权和上传；本次结束于模拟上传完成，不含预览和发布。详见 [Vibe 绑定上传](vibe-upload.md)。
+`ttmg upload --vibe --web` uses real browser authorization and uploads to PPE without a prior platform login or environment setup. `--mock` is a separate demo: task creation/polling are real, but authorization and material uploads are simulated. See [Vibe binding/upload](vibe-upload.md) for schema-v2 results.
+`ttmg upload --vibe --web` 无需预先平台登录或配置环境，使用真实浏览器授权并上传到 PPE。`--mock` 是独立演示：真实创建／查询任务，模拟授权和素材上传。详见 [Vibe 绑定上传](vibe-upload.md)。
 
 `--mock` 现在会真实创建 PPE 任务，不再表示全程离线；真实请求失败仍报错。
 上线时由 CLI 发布版本去掉 PPE 路由，Skill 无需承担环境切换。
@@ -72,8 +81,8 @@ still fail. Production routing is a future CLI release change, not Skill configu
 当前上传只需要标题、头像和游戏目录或代码包，其他应用资料由 CLI 使用既有 PPE 试用默认值补齐。Skill 读取 `inputRequirements`，不向用户索要额外资料；本地预检使用 `--dry-run`。
 Current uploads need only the title, icon and game directory or ZIP. The CLI fills other metadata with existing PPE trial defaults. Read `inputRequirements` and do not request extra fields. Use `--dry-run` for local preparation.
 
-For the existing authenticated platform workflow, log in first; this does not apply to the local Vibe prototype above.
-原有需要平台鉴权的流程仍先登录；上述 Vibe 本地原型不需要此步骤。
+For the existing authenticated platform workflow, log in first; Vibe Web upload uses its own browser authorization.
+原有需要平台鉴权的流程仍先登录；Vibe Web 上传使用本次任务的浏览器授权。
 
 ```
 ttmg login

package/dist/index.js

@@ -7233,6 +7233,18 @@ const messages = {
         'cli.command.auth.desc': 'Inspect local authentication state',
         'cli.command.auth.open.desc': 'Open an existing Vibe task authorization page in the system browser',
         'cli.command.upload.vibeWeb': 'Authorize in the browser, then upload to PPE (--vibe; no Mock or --no-open)',
+        'cli.command.upload.vibeWebGuide': `
+Vibe web upload (real PPE trial):
+  ttmg upload --vibe --web --dir ./game --title "My game" --icon ./avatar.png --format ndjson
+  Use --package ./game.zip instead of --dir for an existing ZIP.
+  Collect only title and icon; the CLI fills other app_info fields with PPE trial defaults.
+  Keep this process running. At waiting_authorization, complete authorization in the system browser on the CLI computer.
+  pageUrl is the local binding/progress page. To reopen authorization, execute the returned authorizationOpenCommand.
+  The CLI polls and uploads avatar, app_info and package automatically after authorization. Do not start a second upload.
+  Real success: terminal=true, status=uploaded, uploaded=true, simulation=false. On failure, read errorCode and nextAction.
+  --web opens the browser for every output format. --mock is a separate simulation mode.
+  Upload completion is not review approval or production release. See bundled vibe-upload.md and ttmg capabilities --format json.
+`,
         'cli.command.auth.open.pageUrl': 'Local pageUrl returned by the running Vibe upload command',
         'cli.command.auth.open.requested': 'Browser open requested. Complete authorization there; the existing upload process continues polling.',
         'cli.command.auth.open.invalidPage': 'Pass the local pageUrl from the running Vibe upload command, not the platform URL.',
@@ -7646,6 +7658,18 @@ const messages = {
         'cli.command.auth.desc': '查看本地登录状态',
         'cli.command.auth.open.desc': '在系统浏览器打开已有 Vibe 任务的授权页',
         'cli.command.upload.vibeWeb': '网页授权就绪后自动上传到 PPE（--vibe；不能与 Mock 或 --no-open 同用）',
+        'cli.command.upload.vibeWebGuide': `
+Vibe 网页上传（真实 PPE 试用）：
+  ttmg upload --vibe --web --dir ./game --title "游戏名称" --icon ./avatar.png --format ndjson
+  已有 ZIP 时，用 --package ./game.zip 替换 --dir。
+  只收集标题和头像；其他 app_info 字段由 CLI 使用 PPE 试用默认值补齐。
+  保持原进程运行。在 waiting_authorization 阶段，在 CLI 所在电脑的系统浏览器完成授权。
+  pageUrl 是本机绑定／进度页；重新打开授权页时，执行返回的 authorizationOpenCommand。
+  CLI 负责轮询，授权后自动上传 avatar、app_info、package，不再启动第二次上传。
+  真实成功：terminal=true、status=uploaded、uploaded=true、simulation=false。失败时读取 errorCode 和 nextAction。
+  --web 在所有输出格式下都会打开浏览器；--mock 是独立的模拟模式。
+  上传完成不代表审核通过或正式上线。详见包内 vibe-upload.md 和 ttmg capabilities --format json。
+`,
         'cli.command.auth.open.pageUrl': '正在运行的 Vibe 上传命令返回的本地 pageUrl',
         'cli.command.auth.open.requested': '已请求浏览器打开授权页。请在页面完成授权，原上传进程继续轮询。',
         'cli.command.auth.open.invalidPage': '请传入正在运行的 Vibe 上传命令返回的本地 pageUrl，不是平台授权链接。',
@@ -16308,7 +16332,7 @@ async function authStatus(options = {}) {
     return result;
 }
 
-var version = "0.4.6-vibe-beta.11";
+var version = "0.4.6-vibe-beta.13";
 var engines = {
 	node: ">=20.19.1 <21 || >=22"
 };
@@ -16332,6 +16356,113 @@ class VibeError extends Error {
     }
 }
 
+// Current PPE trial defaults: the owner-approved metadata used by the successful
+// real upload fixture on 2026-09-14, with owner-specified legal URLs updated on
+// 2026-09-15. This is not a production metadata profile.
+const VIBE_PPE_DEFAULT_APP_INFO = Object.freeze({
+    description: 'DevTool PPE integration test fixture. Not a production game.',
+    category: 'Other',
+    subcategory: 'Other',
+    terms_of_service: 'https://www.tiktok.com',
+    privacy_policy: 'https://www.tiktok.com',
+    copyright_confirmation: true,
+    contact_email: 'devtool-test@example.invalid',
+});
+// BFF IDL + Import Service ValidateAppInfo, feat-minis-import (2026-09-14).
+// Keep credentials, app_name and icon_uri out of this file: CLI owns those fields.
+const requiredStrings = [
+    'description', 'category', 'subcategory', 'terms_of_service', 'privacy_policy',
+];
+const optionalStrings = ['apple_team_id', 'contact_email', 'region', 'min_sdk_version'];
+function readVibeAppInfo(file) {
+    if (file === undefined)
+        return undefined;
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            throw new Error();
+        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        const allowed = new Set([...requiredStrings, ...optionalStrings, 'copyright_confirmation']);
+        if (Object.keys(value).some(key => !allowed.has(key)))
+            throw new Error();
+        // JSON can encode lone surrogates that Go rejects as invalid UTF-8 input.
+        for (const item of Object.values(value)) {
+            if (typeof item === 'string' && [...item].some(char => /^[\uD800-\uDFFF]$/.test(char)))
+                throw new Error();
+        }
+        for (const key of requiredStrings) {
+            if (typeof value[key] !== 'string' || !value[key].trim())
+                throw new Error();
+        }
+        for (const key of optionalStrings) {
+            if (value[key] !== undefined && (typeof value[key] !== 'string' || !value[key].trim()))
+                throw new Error();
+        }
+        // An explicit declaration is required; never infer consent or supply a default.
+        if (value.copyright_confirmation !== true)
+            throw new Error();
+        for (const key of ['terms_of_service', 'privacy_policy']) {
+            if (/\s/.test(value[key]))
+                throw new Error();
+            const url = new URL(value[key]);
+            if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password)
+                throw new Error();
+        }
+        if (value.contact_email !== undefined && !/^[^\s<>@]+@[^\s<>@]+$/.test(value.contact_email))
+            throw new Error();
+        return value;
+    }
+    catch {
+        // Do not expose paths, file contents or parser errors in structured output.
+        throw new VibeError('VIBE_INVALID_APP_INFO');
+    }
+}
+const VIBE_PLATFORM_ICON_LIMIT = 5 * 1024 * 1024;
+// Header preflight only. The BFF remains responsible for decoding the image.
+function validateVibeUploadInput(input) {
+    if ([...input.title].length > 30)
+        throw new VibeError('VIBE_TITLE_TOO_LONG');
+    const image = input.icon.bytes;
+    if (image.length > VIBE_PLATFORM_ICON_LIMIT)
+        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
+    let width = 0, height = 0;
+    if (image.length >= 33 && image.subarray(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex')) &&
+        image.readUInt32BE(8) === 13 && image.toString('ascii', 12, 16) === 'IHDR') {
+        width = image.readUInt32BE(16);
+        height = image.readUInt32BE(20);
+    }
+    else if (image[0] === 0xff && image[1] === 0xd8) {
+        let offset = 2;
+        while (offset + 4 <= image.length) {
+            if (image[offset++] !== 0xff)
+                break;
+            while (image[offset] === 0xff)
+                offset++;
+            const marker = image[offset++];
+            if (marker === 0xda || marker === 0xd9)
+                break;
+            if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7))
+                continue;
+            if (offset + 2 > image.length)
+                break;
+            const length = image.readUInt16BE(offset);
+            if (length < 2 || offset + length > image.length)
+                break;
+            // Go image/jpeg accepts baseline, extended sequential and progressive SOF.
+            if ([0xc0, 0xc1, 0xc2].includes(marker) && length >= 8) {
+                height = image.readUInt16BE(offset + 3);
+                width = image.readUInt16BE(offset + 5);
+                break;
+            }
+            offset += length;
+        }
+    }
+    if (width !== 1024 || height !== 1024)
+        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
+}
+
 function getCapabilities() {
     return {
         schemaVersion: '1',
@@ -16344,7 +16475,9 @@ function getCapabilities() {
         },
         commands: {
             vibeUpload: {
-                command: 'ttmg upload --vibe --mock --format ndjson',
+                command: 'ttmg upload --vibe --web --dir <gameDir> --title <title> --icon <iconPath> --format ndjson',
+                mockCommand: 'ttmg upload --vibe --mock --dir <gameDir> --title <title> --icon <iconPath> --format ndjson',
+                guide: 'vibe-upload.md',
                 option: '--vibe',
                 available: true,
                 platformWrite: true,
@@ -16375,11 +16508,32 @@ function getCapabilities() {
                 metadataInputs: ['title', 'icon', 'dir|package'],
                 inputRequirements: VIBE_INPUT_REQUIREMENTS,
                 webAuthorization: { option: '--web', backend: 'ppe', defaultLane: 'ppe_op_vc', simulation: false, opensSystemBrowser: true, continuesPolling: true, formatIndependent: true, conflictsWith: ['--mock', '--mock-scenario', '--vibe-api', '--no-open'], mockBehaviorUnchanged: true, materialUploadEnabled: true },
+                skillWorkflow: {
+                    preferredFormat: 'ndjson',
+                    packageAlternative: '--package <zipPath> replaces --dir <gameDir>',
+                    keepUploadProcessRunning: true,
+                    pollingOwner: 'cli',
+                    uploadOwner: 'cli',
+                    waitingAuthorization: {
+                        status: 'waiting_authorization',
+                        userAction: 'complete authorization in the system browser on the CLI computer',
+                        pageUrlField: 'pageUrl',
+                        pageUrlPurpose: 'local binding and upload progress page',
+                        reopenCommandField: 'authorizationOpenCommand',
+                        browserOpenRequestedProvesAuthorization: false,
+                        createAnotherUploadTask: false,
+                    },
+                    realUploadSuccess: { terminal: true, status: 'uploaded', uploaded: true, simulation: false },
+                    failure: 'Read errorCode and nextAction; do not automatically create another task or reupload',
+                    completionMeaning: 'materials uploaded to PPE; review and production release are separate',
+                    sameHostRequired: true,
+                },
                 optionalMetadataFile: '--app-info',
                 appInfoFields: {
                     required: [],
                     optional: [],
                     suppliedByCli: ['app_name', 'icon_uri'],
+                    defaultedByCli: Object.keys(VIBE_PPE_DEFAULT_APP_INFO),
                     additionalMetadataSource: 'cli-defaults',
                     defaultMetadataProfile: 'ppe-trial',
                     requestFromUser: false,
@@ -16410,8 +16564,9 @@ function getCapabilities() {
                 httpContract: 'minis-import-task',
                 authorizationQr: true,
                 previewQr: false,
-                realAuthorizationVerified: false,
-                realUploadVerified: false,
+                realAuthorizationVerified: true,
+                realUploadVerified: true,
+                verificationScope: { backend: 'ppe', assets: 'test-fixtures', date: '2026-09-15', production: false },
                 autoUploadAfterAuthorization: true,
                 boundedPolling: true,
                 cancellation: true,
@@ -17155,7 +17310,8 @@ withVerboseOption(program
     .option('--vibe-authorize-url <url>', t('cli.command.upload.vibeAuthorizeUrl'))
     .option('--poll-interval <seconds>', t('cli.command.upload.vibePollInterval'))
     .option('--timeout <seconds>', t('cli.command.upload.vibeTimeout'))
-    .option('--format <format>', t('cli.command.upload.format'), 'text')).action(async (cmd) => {
+    .option('--format <format>', t('cli.command.upload.format'), 'text')
+    .addHelpText('after', t('cli.command.upload.vibeWebGuide'))).action(async (cmd) => {
     if (cmd.vibe) {
         const { vibeUpload } = await Promise.resolve().then(function () { return index$1; });
         await vibeUpload(cmd);
@@ -17707,112 +17863,6 @@ var authOpen = /*#__PURE__*/Object.freeze({
     vibeAuthOpen: vibeAuthOpen
 });
 
-// Current PPE trial defaults: the owner-approved metadata used by the successful
-// real upload fixture on 2026-09-14. This is not a production metadata profile.
-const VIBE_PPE_DEFAULT_APP_INFO = Object.freeze({
-    description: 'DevTool PPE integration test fixture. Not a production game.',
-    category: 'Other',
-    subcategory: 'Other',
-    terms_of_service: 'https://example.invalid/devtool-ppe-test/terms',
-    privacy_policy: 'https://example.invalid/devtool-ppe-test/privacy',
-    copyright_confirmation: true,
-    contact_email: 'devtool-test@example.invalid',
-});
-// BFF IDL + Import Service ValidateAppInfo, feat-minis-import (2026-09-14).
-// Keep credentials, app_name and icon_uri out of this file: CLI owns those fields.
-const requiredStrings = [
-    'description', 'category', 'subcategory', 'terms_of_service', 'privacy_policy',
-];
-const optionalStrings = ['apple_team_id', 'contact_email', 'region', 'min_sdk_version'];
-function readVibeAppInfo(file) {
-    if (file === undefined)
-        return undefined;
-    try {
-        const stat = fs.statSync(file);
-        if (!stat.isFile() || stat.size > 64 * 1024)
-            throw new Error();
-        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            throw new Error();
-        const allowed = new Set([...requiredStrings, ...optionalStrings, 'copyright_confirmation']);
-        if (Object.keys(value).some(key => !allowed.has(key)))
-            throw new Error();
-        // JSON can encode lone surrogates that Go rejects as invalid UTF-8 input.
-        for (const item of Object.values(value)) {
-            if (typeof item === 'string' && [...item].some(char => /^[\uD800-\uDFFF]$/.test(char)))
-                throw new Error();
-        }
-        for (const key of requiredStrings) {
-            if (typeof value[key] !== 'string' || !value[key].trim())
-                throw new Error();
-        }
-        for (const key of optionalStrings) {
-            if (value[key] !== undefined && (typeof value[key] !== 'string' || !value[key].trim()))
-                throw new Error();
-        }
-        // An explicit declaration is required; never infer consent or supply a default.
-        if (value.copyright_confirmation !== true)
-            throw new Error();
-        for (const key of ['terms_of_service', 'privacy_policy']) {
-            if (/\s/.test(value[key]))
-                throw new Error();
-            const url = new URL(value[key]);
-            if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password)
-                throw new Error();
-        }
-        if (value.contact_email !== undefined && !/^[^\s<>@]+@[^\s<>@]+$/.test(value.contact_email))
-            throw new Error();
-        return value;
-    }
-    catch {
-        // Do not expose paths, file contents or parser errors in structured output.
-        throw new VibeError('VIBE_INVALID_APP_INFO');
-    }
-}
-const VIBE_PLATFORM_ICON_LIMIT = 5 * 1024 * 1024;
-// Header preflight only. The BFF remains responsible for decoding the image.
-function validateVibeUploadInput(input) {
-    if ([...input.title].length > 30)
-        throw new VibeError('VIBE_TITLE_TOO_LONG');
-    const image = input.icon.bytes;
-    if (image.length > VIBE_PLATFORM_ICON_LIMIT)
-        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
-    let width = 0, height = 0;
-    if (image.length >= 33 && image.subarray(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex')) &&
-        image.readUInt32BE(8) === 13 && image.toString('ascii', 12, 16) === 'IHDR') {
-        width = image.readUInt32BE(16);
-        height = image.readUInt32BE(20);
-    }
-    else if (image[0] === 0xff && image[1] === 0xd8) {
-        let offset = 2;
-        while (offset + 4 <= image.length) {
-            if (image[offset++] !== 0xff)
-                break;
-            while (image[offset] === 0xff)
-                offset++;
-            const marker = image[offset++];
-            if (marker === 0xda || marker === 0xd9)
-                break;
-            if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7))
-                continue;
-            if (offset + 2 > image.length)
-                break;
-            const length = image.readUInt16BE(offset);
-            if (length < 2 || offset + length > image.length)
-                break;
-            // Go image/jpeg accepts baseline, extended sequential and progressive SOF.
-            if ([0xc0, 0xc1, 0xc2].includes(marker) && length >= 8) {
-                height = image.readUInt16BE(offset + 3);
-                width = image.readUInt16BE(offset + 5);
-                break;
-            }
-            offset += length;
-        }
-    }
-    if (width !== 1024 || height !== 1024)
-        throw new VibeError('VIBE_PLATFORM_ICON_INVALID');
-}
-
 // BFF IDL: feat-minis-import. PPE import flow; no production adapter.
 const prefix = '/bff/app_info/minis_import/';
 const MINIS_IMPORT_PATHS = {