@bitmagic/cli 0.1.55-dev.0 → 0.1.55-dev.2

package/dist/ios/record-validate.js

@@ -0,0 +1,98 @@
+/**
+ * §4e/f of docs/ios-export-design.md: boot the staged payload the way the app will run it —
+ * headless system Chrome as an iPhone, `?platform=mobile` — twice.
+ *
+ *  - `record`: remote requests are allowed through and every one on a non-denylisted host is
+ *    reported as a miss for the caller to vendor. This is the empirical net under the static
+ *    collector: whatever the running game actually fetches, however the URL was constructed.
+ *  - `offline`: every remote request is aborted. The run must still pass `classifyVerifyRun`
+ *    (the same "did the game render" verdict verify and the publish smoke check use) with zero
+ *    remote asset requests — that is the design's acceptance criterion for "no internet needed".
+ *
+ * Denylisted endpoints are the online-only features the engine already degrades without
+ * (game-server, play-auth, play sessions, fonts, analytics) — aborted in BOTH passes so the
+ * record run observes the same world the device will.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { browserLaunchPlan } from '../browser-gl.js';
+import { DEFAULT_START_INTERACTION, runHeadlessCheck } from '../verify/browser.js';
+import { classifyVerifyRun } from '../verify/classify.js';
+import { mobileContextOptions } from '../verify/device.js';
+import { startPayloadServer } from './local-server.js';
+/** Long enough for a forged level's worth of local loads; adaptive settle exits earlier. */
+export const PACKAGED_CHECK_SETTLE_MS = 25_000;
+/**
+ * Online-only endpoints the packaged game may talk to when a network exists, and must live
+ * without when one does not. Never vendored, aborted during both passes.
+ */
+export function isOnlineOnlyUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    const host = parsed.hostname;
+    return (host.includes('game-server')
+        || parsed.pathname.endsWith('/play-auth.html')
+        || host === 'fonts.googleapis.com'
+        || host === 'fonts.gstatic.com'
+        || host === 'esm.sh'
+        || host === 'esm.run'
+        || host.endsWith('.sentry.io')
+        || host.endsWith('google-analytics.com')
+        || host.endsWith('googletagmanager.com')
+        // Local dev services (api-server 3002, game-server 1666, agent 4111, lid relay 8765) —
+        // NOT the payload server, whose exact origin is allowed before this predicate runs.
+        || host === 'localhost'
+        || host === '127.0.0.1');
+}
+export async function runPackagedCheck(options) {
+    fs.mkdirSync(options.artifactDir, { recursive: true });
+    const consolePath = path.join(options.artifactDir, 'console.log');
+    const screenshotPath = path.join(options.artifactDir, 'screenshot.png');
+    const server = await startPayloadServer(options.payloadDir);
+    const misses = new Set();
+    const routes = async (context) => {
+        await context.route('**/*', (route) => {
+            const url = route.request().url();
+            if (url.startsWith(server.origin)) {
+                void route.continue();
+                return;
+            }
+            if (isOnlineOnlyUrl(url)) {
+                void route.abort('internetdisconnected');
+                return;
+            }
+            misses.add(url);
+            if (options.mode === 'record')
+                void route.continue();
+            else
+                void route.abort('internetdisconnected');
+        });
+    };
+    try {
+        const observations = await runHeadlessCheck({
+            url: `${server.origin}/index.html?platform=mobile&renderer=webgl`,
+            screenshotPath,
+            consolePath,
+            settleMs: options.settleMs ?? PACKAGED_CHECK_SETTLE_MS,
+            startInteraction: DEFAULT_START_INTERACTION,
+            launch: browserLaunchPlan(process.env, 'webgl'),
+            device: mobileContextOptions(options.orientation ?? 'portrait'),
+            routes,
+        });
+        return {
+            result: classifyVerifyRun(observations),
+            misses: [...misses],
+            consolePath,
+            screenshotPath,
+        };
+    }
+    finally {
+        await server.close();
+    }
+}
+//# sourceMappingURL=record-validate.js.map

package/dist/ios/record-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-validate.js","sourceRoot":"","sources":["../../src/ios/record-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAqB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;WACzB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;WAC3C,IAAI,KAAK,sBAAsB;WAC/B,IAAI,KAAK,mBAAmB;WAC5B,IAAI,KAAK,QAAQ;WACjB,IAAI,KAAK,SAAS;WAClB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC3B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;WACrC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,uFAAuF;QACvF,oFAAoF;WACjF,IAAI,KAAK,WAAW;WACpB,IAAI,KAAK,WAAW,CACxB,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA6B;IAClE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,MAAM,MAAM,GAAG,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAC9D,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;;gBAChD,KAAK,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC;YAC1C,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,4CAA4C;YACjE,cAAc;YACd,WAAW;YACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,wBAAwB;YACtD,gBAAgB,EAAE,yBAAyB;YAC3C,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC;YAC/C,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;YAC/D,MAAM;SACP,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,iBAAiB,CAAC,YAAY,CAAC;YACvC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;YACnB,WAAW;YACX,cAAc;SACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/ios/transform.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The pure HTML surgery of §4d (docs/ios-export-design.md): given the pro-lane bundle, produce
+ * the payload page. Two deliberately redundant mechanisms:
+ *
+ *  - the `bm-bundled-assets` map (original URL → relative vendor path), which the engine's own
+ *    ASSET_MAP mechanism resolves through — every three.js loader plus the explicit
+ *    `ASSET_MAP.get` fetch sites;
+ *  - a literal rewrite of every vendored URL AND the animation base-URL constants, which fixes
+ *    the sites that bypass the map (raw fetch in PlacedObjectSystem/HeightmapSystem/physics2d/
+ *    splat loaders, and the StartScreen/SelectionSteps/AchievementToast DOM urls): the world
+ *    data is inlined in this HTML, so rewriting the literals fixes what those sites read.
+ *
+ * No DOM parser — the bundle is one multi-MB HTML string and the three edits are anchored on
+ * markers the scaffold's own template guarantees (`<head>`, `</head>`).
+ */
+export interface TransformOptions {
+    html: string;
+    /** Original absolute URL → document-relative vendor path (`vendor/<host>/<path>`). */
+    assetMap: ReadonlyMap<string, string>;
+    /** Base-URL constant → relative base (see vendor.ts vendorBasePathFor). */
+    baseRewrites: ReadonlyMap<string, string>;
+}
+export interface TransformResult {
+    html: string;
+    /** How many URL literals were rewritten, for the build's notes. */
+    rewrites: number;
+}
+export declare const DISTRIBUTION_META = "<meta name=\"bm:distribution\" content=\"ios\">";
+export declare const BUNDLED_ASSETS_ID = "bm-bundled-assets";
+/**
+ * Rewrite every occurrence of the given URLs/bases in one pass. Longest key first, so an exact
+ * asset URL wins over a base that prefixes it — both rewrite into the same vendor layout, but
+ * the ordering keeps the replacement deterministic.
+ */
+export declare function rewriteUrlLiterals(html: string, replacements: ReadonlyMap<string, string>): {
+    html: string;
+    rewrites: number;
+};
+/** Serialize the asset map for the inline block. `<` is escaped so no URL can ever terminate
+ *  the script element early — standard inline-JSON hygiene, and still valid JSON. */
+export declare function renderAssetMapJson(assetMap: ReadonlyMap<string, string>): string;
+/**
+ * The full §4d transform. Throws when the bundle carries no `<head>`/`</head>` markers — that
+ * is not a page this lane understands, and silently skipping the injection would ship an app
+ * that fetches from the network.
+ */
+export declare function transformBundleHtml(options: TransformOptions): TransformResult;

package/dist/ios/transform.js

@@ -0,0 +1,67 @@
+/**
+ * The pure HTML surgery of §4d (docs/ios-export-design.md): given the pro-lane bundle, produce
+ * the payload page. Two deliberately redundant mechanisms:
+ *
+ *  - the `bm-bundled-assets` map (original URL → relative vendor path), which the engine's own
+ *    ASSET_MAP mechanism resolves through — every three.js loader plus the explicit
+ *    `ASSET_MAP.get` fetch sites;
+ *  - a literal rewrite of every vendored URL AND the animation base-URL constants, which fixes
+ *    the sites that bypass the map (raw fetch in PlacedObjectSystem/HeightmapSystem/physics2d/
+ *    splat loaders, and the StartScreen/SelectionSteps/AchievementToast DOM urls): the world
+ *    data is inlined in this HTML, so rewriting the literals fixes what those sites read.
+ *
+ * No DOM parser — the bundle is one multi-MB HTML string and the three edits are anchored on
+ * markers the scaffold's own template guarantees (`<head>`, `</head>`).
+ */
+export const DISTRIBUTION_META = '<meta name="bm:distribution" content="ios">';
+export const BUNDLED_ASSETS_ID = 'bm-bundled-assets';
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Rewrite every occurrence of the given URLs/bases in one pass. Longest key first, so an exact
+ * asset URL wins over a base that prefixes it — both rewrite into the same vendor layout, but
+ * the ordering keeps the replacement deterministic.
+ */
+export function rewriteUrlLiterals(html, replacements) {
+    if (replacements.size === 0)
+        return { html, rewrites: 0 };
+    const keys = [...replacements.keys()].sort((a, b) => b.length - a.length);
+    const pattern = new RegExp(keys.map(escapeRegExp).join('|'), 'g');
+    let rewrites = 0;
+    const rewritten = html.replace(pattern, (match) => {
+        rewrites += 1;
+        // The alternation only matches keys of the map, so the lookup cannot miss.
+        return replacements.get(match) ?? match;
+    });
+    return { html: rewritten, rewrites };
+}
+/** Serialize the asset map for the inline block. `<` is escaped so no URL can ever terminate
+ *  the script element early — standard inline-JSON hygiene, and still valid JSON. */
+export function renderAssetMapJson(assetMap) {
+    return JSON.stringify(Object.fromEntries(assetMap)).replace(/</g, '\\u003c');
+}
+/**
+ * The full §4d transform. Throws when the bundle carries no `<head>`/`</head>` markers — that
+ * is not a page this lane understands, and silently skipping the injection would ship an app
+ * that fetches from the network.
+ */
+export function transformBundleHtml(options) {
+    const combined = new Map();
+    for (const [url, rel] of options.assetMap)
+        combined.set(url, rel);
+    for (const [base, rel] of options.baseRewrites)
+        combined.set(base, rel);
+    const { html: rewritten, rewrites } = rewriteUrlLiterals(options.html, combined);
+    if (!rewritten.includes('<head>') || !rewritten.includes('</head>')) {
+        throw new Error('The built bundle has no <head> section to inject the asset map into.');
+    }
+    const mapBlock = `<script type="application/json" id="${BUNDLED_ASSETS_ID}">`
+        + renderAssetMapJson(options.assetMap)
+        + '</script>';
+    const html = rewritten
+        .replace('<head>', `<head>\n    ${DISTRIBUTION_META}`)
+        .replace('</head>', `    ${mapBlock}\n</head>`);
+    return { html, rewrites };
+}
+//# sourceMappingURL=transform.js.map

package/dist/ios/transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.js","sourceRoot":"","sources":["../../src/ios/transform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,MAAM,CAAC,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,YAAyC;IAEzC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAChD,QAAQ,IAAI,CAAC,CAAC;QACd,2EAA2E;QAC3E,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,QAAqC;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY;QAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAExE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GACZ,uCAAuC,iBAAiB,IAAI;UAC1D,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;UACpC,WAAW,CAAC;IAEhB,MAAM,IAAI,GAAG,SAAS;SACnB,OAAO,CAAC,QAAQ,EAAE,eAAe,iBAAiB,EAAE,CAAC;SACrD,OAAO,CAAC,SAAS,EAAE,OAAO,QAAQ,WAAW,CAAC,CAAC;IAElD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/ios/vendor.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The document-relative path a URL is vendored at, or null for a URL this lane cannot mirror
+ * (unparseable, or a path that escapes the tree). The query string is dropped — asset URLs do
+ * not carry meaningful queries, and a `?` cannot survive as a same-file request path anyway.
+ */
+export declare function vendorPathFor(url: string): string | null;
+/** Where a BASE url's rewrite points: the same mapping, minus the appended 'index'. */
+export declare function vendorBasePathFor(baseUrl: string): string | null;
+export interface VendorFailure {
+    url: string;
+    error: string;
+}
+export interface VendorResult {
+    /** URL → document-relative vendor path, for every URL that is now on disk. */
+    entries: Map<string, string>;
+    failures: VendorFailure[];
+    /** How many came from the cache rather than the network. */
+    cacheHits: number;
+}
+export interface VendorOptions {
+    urls: Iterable<string>;
+    cacheDir: string;
+    payloadDir: string;
+    fetchImpl?: typeof globalThis.fetch;
+    log?: (message: string) => void;
+    concurrency?: number;
+}
+/** Download (or copy from cache) every URL into the payload's vendor tree. */
+export declare function vendorUrls(options: VendorOptions): Promise<VendorResult>;

package/dist/ios/vendor.js

@@ -0,0 +1,113 @@
+/**
+ * Mirror remote assets into the payload's `vendor/` tree.
+ *
+ * The layout preserves `<host>/<pathname>` so that rewriting a BASE url in the bundle (see
+ * transform.ts) makes runtime-constructed `${base}/${file}` URLs land on the mirrored file —
+ * exact-URL map entries alone could never cover those.
+ *
+ * Downloads are cached under `.bitmagic/ios/cache` keyed by URL hash: generated-asset URLs are
+ * immutable in practice (uuid/content-addressed paths), and a rebuild should not re-download a
+ * hundred GLBs. Bytes are stored post-Content-Encoding (node fetch inflates); the engine's
+ * gzip-sniffing loaders accept raw bytes unchanged (fetchVwld.ts).
+ */
+import { createHash } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * The document-relative path a URL is vendored at, or null for a URL this lane cannot mirror
+ * (unparseable, or a path that escapes the tree). The query string is dropped — asset URLs do
+ * not carry meaningful queries, and a `?` cannot survive as a same-file request path anyway.
+ */
+export function vendorPathFor(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    let pathname = parsed.pathname;
+    if (pathname.endsWith('/') || pathname === '')
+        pathname += 'index';
+    const segments = [];
+    for (const rawSegment of pathname.split('/')) {
+        if (rawSegment === '')
+            continue;
+        let segment;
+        try {
+            segment = decodeURIComponent(rawSegment);
+        }
+        catch {
+            segment = rawSegment;
+        }
+        if (segment === '.' || segment === '..')
+            return null;
+        segments.push(segment);
+    }
+    if (segments.length === 0)
+        return null;
+    return ['vendor', parsed.host, ...segments].join('/');
+}
+/** Where a BASE url's rewrite points: the same mapping, minus the appended 'index'. */
+export function vendorBasePathFor(baseUrl) {
+    const mapped = vendorPathFor(baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`);
+    if (mapped === null)
+        return null;
+    return mapped.replace(/\/index$/, '');
+}
+function cacheFileFor(cacheDir, url) {
+    return path.join(cacheDir, createHash('sha256').update(url).digest('hex'));
+}
+/** Download (or copy from cache) every URL into the payload's vendor tree. */
+export async function vendorUrls(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const log = options.log ?? (() => { });
+    const entries = new Map();
+    const failures = [];
+    let cacheHits = 0;
+    fs.mkdirSync(options.cacheDir, { recursive: true });
+    const queue = [...new Set(options.urls)];
+    const worker = async () => {
+        for (;;) {
+            const url = queue.shift();
+            if (url === undefined)
+                return;
+            const relPath = vendorPathFor(url);
+            if (relPath === null) {
+                failures.push({ url, error: 'not a vendorable URL' });
+                continue;
+            }
+            const cacheFile = cacheFileFor(options.cacheDir, url);
+            try {
+                if (fs.existsSync(cacheFile)) {
+                    cacheHits += 1;
+                }
+                else {
+                    const response = await fetchImpl(url);
+                    if (!response.ok)
+                        throw new Error(`HTTP ${response.status}`);
+                    const bytes = Buffer.from(await response.arrayBuffer());
+                    // Write-then-rename so a crashed download never leaves a truncated cache entry that
+                    // every later build would trust.
+                    const tmp = `${cacheFile}.tmp-${process.pid}`;
+                    fs.writeFileSync(tmp, bytes);
+                    fs.renameSync(tmp, cacheFile);
+                    log(`  fetched ${url} (${bytes.byteLength} bytes)`);
+                }
+                const target = path.join(options.payloadDir, ...relPath.split('/'));
+                fs.mkdirSync(path.dirname(target), { recursive: true });
+                fs.copyFileSync(cacheFile, target);
+                entries.set(url, relPath);
+            }
+            catch (error) {
+                failures.push({ url, error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    };
+    const width = Math.max(1, Math.min(options.concurrency ?? 6, queue.length));
+    await Promise.all(Array.from({ length: width }, worker));
+    return { entries, failures, cacheHits };
+}
+//# sourceMappingURL=vendor.js.map

package/dist/ios/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../src/ios/vendor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,EAAE;QAAE,QAAQ,IAAI,OAAO,CAAC;IAEnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,UAAU,KAAK,EAAE;YAAE,SAAS;QAChC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,UAAU,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAwBD,SAAS,YAAY,CAAC,QAAgB,EAAE,GAAW;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO;YAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,SAAS,IAAI,CAAC,CAAC;gBACjB,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;oBACxD,oFAAoF;oBACpF,iCAAiC;oBACjC,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC9C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC7B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC9B,GAAG,CAAC,aAAa,GAAG,KAAK,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC"}

package/dist/ios/xcode-template.d.ts

@@ -0,0 +1,11 @@
+import type { IosAppConfig } from './app-config.js';
+export declare const TARGET_NAME = "Game";
+export declare const PAYLOAD_DIR_NAME = "GamePayload";
+export declare const URL_SCHEME = "bmapp";
+/** The Info.plist orientation array for the project's declaration (§6). */
+export declare function orientationValues(orientation: 'portrait' | 'landscape' | undefined): string[];
+/**
+ * Write the whole project (everything except the payload contents and the icon PNG, which have
+ * their own producers). Existing files are overwritten — the project is CLI-owned.
+ */
+export declare function stampXcodeProject(projectDir: string, config: IosAppConfig): void;