@bitmagic/cli 0.1.70-dev.1 → 0.1.70-dev.2

package/dist/package/collect-urls.js

@@ -0,0 +1,220 @@
+/**
+ * Every remote URL the packaged game may load, collected up front (§4b of
+ * docs/ios-export-design.md).
+ *
+ * Deliberately NOT a port of game/scripts/generate-asset-manifest.mjs's field list — that list
+ * demonstrably misses fields the engine loads (glb/gltf assets by id, lodVariants, splat
+ * configs, heightmaps, HUD images, three of the four animation packs). Instead the work-copy
+ * JSON is deep-walked for anything URL-shaped, with a small deny-list of fields that never load
+ * at runtime. An unknown future URL field is vendored by default: too much beats a network
+ * fetch on a device in airplane mode.
+ *
+ * The record pass (record-validate.ts) is the empirical net under all of this — anything the
+ * running game fetches that this module missed still gets vendored.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { pathToFileURL } from 'url';
+import { aliasSourceDir } from '../scaffold/aliases.js';
+/** Fields whose URLs are editor/publish provenance, never loaded by the running game. */
+const DENY_FIELDS = new Set([
+    'screenshotUrl',
+    'thumbnailUrl',
+    'thumbnailUrlOverride',
+    'faviconUrlOverride',
+    'sourceGlbUrl',
+    'sourceModelUrl',
+    'sourceVxlMasterUrl',
+    'sourceUrl',
+]);
+function isRemoteUrl(value) {
+    return /^https?:\/\/[^\s"']+$/.test(value);
+}
+/** Walk any JSON value, collecting remote-URL strings outside the deny-listed fields. */
+export function deepWalkUrls(value, out) {
+    if (typeof value === 'string') {
+        if (isRemoteUrl(value))
+            out.add(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            deepWalkUrls(item, out);
+        return;
+    }
+    if (typeof value === 'object' && value !== null) {
+        for (const [key, child] of Object.entries(value)) {
+            if (DENY_FIELDS.has(key))
+                continue;
+            deepWalkUrls(child, out);
+        }
+    }
+}
+/** The same compiled-code .glb scan the standalone lane runs, over the pro project's dist. */
+export function scanCompiledCodeUrls(compiledCode) {
+    const urls = new Set();
+    for (const match of compiledCode.match(/https?:\/\/[^"'`\s)\\]+\.glb\b/g) ?? []) {
+        urls.add(match);
+    }
+    return urls;
+}
+/** All compiled game JS under dist/src/work, concatenated — for reference scans. */
+export function readCompiledGameCode(root) {
+    const workDir = path.join(root, 'dist', aliasSourceDir('work'));
+    let combined = '';
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.name.endsWith('.js'))
+                combined += fs.readFileSync(full, 'utf-8');
+        }
+    };
+    walk(workDir);
+    return combined;
+}
+function isAnimationAssets(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return (typeof record.animationBaseUrl === 'string'
+        && typeof record.generatedAnimationBaseUrl === 'string'
+        && typeof record.characterUrls === 'object'
+        && Array.isArray(record.coreAnimations));
+}
+/**
+ * Import the vendored engine's compiled AnimationAssets — a pure data module with no imports,
+ * which is what makes this safe from plain node. Null (with the caller noting it) when the
+ * engine predates the module or the shape moved: the record pass still catches whatever the
+ * running game actually fetches.
+ */
+export async function loadAnimationAssets(root) {
+    const compiled = path.join(root, 'dist', 'engine', 'engine', 'AnimationAssets.js');
+    if (!fs.existsSync(compiled))
+        return null;
+    try {
+        const loaded = await import(pathToFileURL(compiled).href);
+        const assets = loaded.animationAssets;
+        return isAnimationAssets(assets) ? assets : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The built-in animation URLs this game can load. The ACTIVE library ships whole — its optional
+ * packs (melee/ranged/directional/posture) are loaded on demand by engine systems whose names
+ * game code never contains, so reference-scanning cannot bound them. The inactive library ships
+ * only clips the compiled game code names (`getBuiltinAnimationDef` resolves ids from either).
+ */
+export function collectAnimationUrls(assets, worldData, compiledCode) {
+    const urls = new Set();
+    const bases = new Set([
+        assets.animationBaseUrl,
+        assets.generatedAnimationBaseUrl,
+        assets.animalBaseUrl,
+        assets.voxelAnimalBaseUrl,
+        assets.voxelFishBaseUrl,
+    ]);
+    // The rig loads for any humanoid: player (default present), NPCs, or multiplayer avatars —
+    // the same test the standalone collector applies.
+    const needsHumanoid = worldData.worldProfileData?.hasPlayerCharacter !== false
+        || compiledCode.includes('registerNpc')
+        || compiledCode.includes('MultiplayerSetup');
+    if (needsHumanoid) {
+        urls.add(assets.characterUrls.default);
+        urls.add(assets.characterUrls.defaultFallback);
+    }
+    const referenced = (clip) => compiledCode.includes(clip.motionId)
+        || (clip.file !== undefined && compiledCode.includes(clip.file));
+    // Each library flattened to clips carrying their own resolved URL, so the active/inactive rule
+    // below can be stated once instead of once per library.
+    const cdnLibrary = [
+        ...assets.coreAnimations.map((entry) => ({
+            ...entry,
+            url: entry.url ?? `${assets.animationBaseUrl}/${entry.file}`,
+        })),
+        ...assets.meleeWeaponAnimations,
+    ];
+    const generatedLibrary = [
+        assets.generatedAnimations,
+        assets.generatedMeleeWeaponAnimations,
+        assets.generatedRangedWeaponAnimations,
+        assets.generatedDirectionalAnimations,
+        assets.generatedPostureAnimations,
+    ].flatMap((pack) => pack.map((entry) => ({ ...entry, url: entry.url ?? `${assets.generatedAnimationBaseUrl}/${entry.file}` })));
+    const generatedActive = assets.activeLibrary === 'generated';
+    const active = generatedActive ? generatedLibrary : cdnLibrary;
+    const inactive = generatedActive ? cdnLibrary : generatedLibrary;
+    // The active library ships whole — but only to a game that animates a humanoid at all.
+    if (needsHumanoid) {
+        for (const clip of active)
+            urls.add(clip.url);
+    }
+    for (const clip of inactive) {
+        if (referenced(clip))
+            urls.add(clip.url);
+    }
+    // Skeleton rigs for skeleton-based animals in world data. Voxel animal/fish BODIES resolve
+    // through a registry inside the engine (species → file); those load at spawn during the
+    // record pass, which vendors them — the bases above are rewritten either way.
+    const declared = worldData.worldProfileData?.animals;
+    const animals = Array.isArray(declared) ? declared : [];
+    for (const animal of animals) {
+        if (typeof animal !== 'object' || animal === null)
+            continue;
+        const skeleton = animal.skeleton;
+        if (typeof skeleton === 'string') {
+            const file = assets.animalSkeletons[skeleton];
+            if (file !== undefined)
+                urls.add(`${assets.animalBaseUrl}/${file}`);
+        }
+    }
+    return { urls, bases };
+}
+function readWorkJson(root, file) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(root, aliasSourceDir('work'), file), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** The full §4b collection: deep walk + compiled-code scan + built-in animation surface. */
+export async function collectUrls(root) {
+    const urls = new Set();
+    const bases = new Set();
+    const notes = [];
+    const worldData = readWorkJson(root, 'world.json');
+    const gameData = readWorkJson(root, 'game.json');
+    deepWalkUrls(worldData, urls);
+    deepWalkUrls(gameData, urls);
+    const compiledCode = readCompiledGameCode(root);
+    if (compiledCode.length === 0) {
+        notes.push('No compiled game code under dist/ — code-referenced assets cannot be scanned.');
+    }
+    for (const url of scanCompiledCodeUrls(compiledCode))
+        urls.add(url);
+    const animationAssets = await loadAnimationAssets(root);
+    if (animationAssets === null) {
+        notes.push('The vendored engine\'s AnimationAssets could not be read — built-in animations will be '
+            + 'collected by the record pass instead.');
+    }
+    else {
+        const collected = collectAnimationUrls(animationAssets, (worldData ?? {}), compiledCode);
+        for (const url of collected.urls)
+            urls.add(url);
+        for (const base of collected.bases)
+            bases.add(base);
+    }
+    return { urls, bases, notes };
+}
+//# sourceMappingURL=collect-urls.js.map

package/dist/package/collect-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect-urls.js","sourceRoot":"","sources":["../../src/package/collect-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,yFAAyF;AACzF,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,eAAe;IACf,cAAc;IACd,sBAAsB;IACtB,oBAAoB;IACpB,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,WAAW;CACZ,CAAC,CAAC;AAeH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,GAAgB;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,iCAAiC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AA4CD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;WACxC,OAAO,MAAM,CAAC,yBAAyB,KAAK,QAAQ;WACpD,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;WACxC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACnF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,MAAM,GAAI,MAAwC,CAAC,eAAe,CAAC;QACzE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA2B,EAC3B,SAAyB,EACzB,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS;QAC5B,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,yBAAyB;QAChC,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,kBAAkB;QACzB,MAAM,CAAC,gBAAgB;KACxB,CAAC,CAAC;IAEH,2FAA2F;IAC3F,kDAAkD;IAClD,MAAM,aAAa,GACjB,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,KAAK,KAAK;WACrD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;WACpC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAiB,EAAW,EAAE,CAChD,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;WACjC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnE,+FAA+F;IAC/F,wDAAwD;IACxD,MAAM,UAAU,GAAkB;QAChC,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACvC,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,EAAE;SAC7D,CAAC,CAAC;QACH,GAAG,MAAM,CAAC,qBAAqB;KAChC,CAAC;IACF,MAAM,gBAAgB,GAAkB;QACtC,MAAM,CAAC,mBAAmB;QAC1B,MAAM,CAAC,8BAA8B;QACrC,MAAM,CAAC,+BAA+B;QACtC,MAAM,CAAC,8BAA8B;QACrC,MAAM,CAAC,0BAA0B;KAClC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjB,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,yBAAyB,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAC3G,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC;IAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAEjE,uFAAuF;IACvF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,2FAA2F;IAC3F,wFAAwF;IACxF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACrD,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,QAAQ,GAAI,MAAkC,CAAC,QAAQ,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjD,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE7B,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEpE,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,yFAAyF;cACrF,uCAAuC,CAC5C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,oBAAoB,CACpC,eAAe,EACf,CAAC,SAAS,IAAI,EAAE,CAAmB,EACnC,YAAY,CACb,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/package/local-server.d.ts

@@ -0,0 +1,13 @@
+/** Extension → content type, shared by this server and the generated Swift handler. */
+export declare const MIME_TYPES: ReadonlyMap<string, string>;
+export declare const FALLBACK_MIME = "application/octet-stream";
+export declare function mimeTypeFor(filePath: string): string;
+export interface PayloadServer {
+    port: number;
+    origin: string;
+    close: () => Promise<void>;
+}
+/** Serve `dir` on an ephemeral localhost port. */
+export declare function startPayloadServer(dir: string, options?: {
+    mountPath?: string;
+}): Promise<PayloadServer>;

package/dist/package/local-server.js

@@ -0,0 +1,102 @@
+/**
+ * A minimal static server over the staged payload directory, for the record and offline
+ * validation passes. GET only, no caching, path-traversal guarded. The MIME table is exported
+ * because the Swift scheme handler (xcode-template.ts) is generated from the SAME table — the
+ * validation browser and the shipped app must answer identically or the validation proves
+ * nothing.
+ */
+import * as fs from 'fs';
+import * as http from 'http';
+import * as path from 'path';
+/** Extension → content type, shared by this server and the generated Swift handler. */
+export const MIME_TYPES = new Map([
+    ['html', 'text/html; charset=utf-8'],
+    ['js', 'text/javascript; charset=utf-8'],
+    ['mjs', 'text/javascript; charset=utf-8'],
+    ['css', 'text/css; charset=utf-8'],
+    ['json', 'application/json'],
+    ['wasm', 'application/wasm'],
+    ['glb', 'model/gltf-binary'],
+    ['gltf', 'model/gltf+json'],
+    ['png', 'image/png'],
+    ['webp', 'image/webp'],
+    ['jpg', 'image/jpeg'],
+    ['jpeg', 'image/jpeg'],
+    ['gif', 'image/gif'],
+    ['svg', 'image/svg+xml'],
+    ['ico', 'image/png'],
+    ['opus', 'audio/ogg'],
+    ['ogg', 'audio/ogg'],
+    ['mp3', 'audio/mpeg'],
+    ['wav', 'audio/wav'],
+    ['mp4', 'video/mp4'],
+    ['webm', 'video/webm'],
+    ['txt', 'text/plain; charset=utf-8'],
+]);
+export const FALLBACK_MIME = 'application/octet-stream';
+export function mimeTypeFor(filePath) {
+    const ext = filePath.split('?')[0].split('.').pop()?.toLowerCase() ?? '';
+    return MIME_TYPES.get(ext) ?? FALLBACK_MIME;
+}
+/** Serve `dir` on an ephemeral localhost port. */
+export function startPayloadServer(dir, options = {}) {
+    const rootDir = path.resolve(dir);
+    const server = http.createServer((req, res) => {
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            res.writeHead(405).end();
+            return;
+        }
+        let requestPath;
+        try {
+            requestPath = decodeURIComponent((req.url ?? '/').split('?')[0]);
+        }
+        catch {
+            res.writeHead(400).end();
+            return;
+        }
+        if (options.mountPath) {
+            if (!requestPath.startsWith(options.mountPath)) {
+                res.writeHead(404).end();
+                return;
+            }
+            requestPath = '/' + requestPath.slice(options.mountPath.length);
+        }
+        const resolved = path.resolve(rootDir, `.${requestPath}`);
+        if (resolved !== rootDir && !resolved.startsWith(rootDir + path.sep)) {
+            res.writeHead(403).end();
+            return;
+        }
+        let filePath = resolved;
+        try {
+            if (fs.statSync(filePath).isDirectory())
+                filePath = path.join(filePath, 'index.html');
+            const bytes = fs.readFileSync(filePath);
+            res
+                .writeHead(200, { 'Content-Type': mimeTypeFor(filePath), 'Cache-Control': 'no-store' })
+                .end(req.method === 'HEAD' ? undefined : bytes);
+        }
+        catch {
+            res.writeHead(404, { 'Content-Type': 'text/plain' }).end('not found');
+        }
+    });
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (address === null || typeof address === 'string') {
+                reject(new Error('The payload server did not report a port.'));
+                return;
+            }
+            resolve({
+                port: address.port,
+                origin: `http://127.0.0.1:${address.port}`,
+                close: () => new Promise((resolveClose) => {
+                    server.close(() => resolveClose());
+                    // Sockets Chrome keeps alive would otherwise hold close() open past the command.
+                    server.closeAllConnections();
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=local-server.js.map

package/dist/package/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/package/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAgC,IAAI,GAAG,CAAC;IAC7D,CAAC,MAAM,EAAE,0BAA0B,CAAC;IACpC,CAAC,IAAI,EAAE,gCAAgC,CAAC;IACxC,CAAC,KAAK,EAAE,gCAAgC,CAAC;IACzC,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAClC,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5B,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5B,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAC5B,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,KAAK,EAAE,YAAY,CAAC;IACrB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,KAAK,EAAE,eAAe,CAAC;IACxB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,KAAK,EAAE,YAAY,CAAC;IACrB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,KAAK,EAAE,2BAA2B,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAExD,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC;AAC9C,CAAC;AAQD,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAkC,EAAE;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YAAC,WAAW,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACzE,MAAM,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACrF,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,GAAG,QAAQ,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;gBAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;iBACtF,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,OAAO,CAAC;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;gBAC1C,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE;oBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;oBACnC,iFAAiF;oBACjF,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/package/transform.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The pure HTML surgery of §4d (docs/ios-export-design.md): given the pro-lane bundle, produce
+ * the payload page. Two deliberately redundant mechanisms:
+ *
+ *  - the `bm-bundled-assets` map (original URL → relative vendor path), which the engine's own
+ *    ASSET_MAP mechanism resolves through — every three.js loader plus the explicit
+ *    `ASSET_MAP.get` fetch sites;
+ *  - a literal rewrite of every vendored URL AND the animation base-URL constants, which fixes
+ *    the sites that bypass the map (raw fetch in PlacedObjectSystem/HeightmapSystem/physics2d/
+ *    splat loaders, and the StartScreen/SelectionSteps/AchievementToast DOM urls): the world
+ *    data is inlined in this HTML, so rewriting the literals fixes what those sites read.
+ *
+ * No DOM parser — the bundle is one multi-MB HTML string and the three edits are anchored on
+ * markers the scaffold's own template guarantees (`<head>`, `</head>`).
+ */
+export interface TransformOptions {
+    html: string;
+    distribution: 'ios' | 'poki';
+    /** Original absolute URL → document-relative vendor path (`vendor/<host>/<path>`). */
+    assetMap: ReadonlyMap<string, string>;
+    /** Base-URL constant → relative base (see vendor.ts vendorBasePathFor). */
+    baseRewrites: ReadonlyMap<string, string>;
+}
+export interface TransformResult {
+    html: string;
+    /** How many URL literals were rewritten, for the build's notes. */
+    rewrites: number;
+}
+export declare const BUNDLED_ASSETS_ID = "bm-bundled-assets";
+/**
+ * Rewrite every occurrence of the given URLs/bases in one pass. Longest key first, so an exact
+ * asset URL wins over a base that prefixes it — both rewrite into the same vendor layout, but
+ * the ordering keeps the replacement deterministic.
+ */
+export declare function rewriteUrlLiterals(html: string, replacements: ReadonlyMap<string, string>): {
+    html: string;
+    rewrites: number;
+};
+/** Serialize the asset map for the inline block. `<` is escaped so no URL can ever terminate
+ *  the script element early — standard inline-JSON hygiene, and still valid JSON. */
+export declare function renderAssetMapJson(assetMap: ReadonlyMap<string, string>): string;
+/**
+ * The full §4d transform. Throws when the bundle carries no `<head>`/`</head>` markers — that
+ * is not a page this lane understands, and silently skipping the injection would ship an app
+ * that fetches from the network.
+ */
+export declare function transformBundleHtml(options: TransformOptions): TransformResult;

package/dist/package/transform.js

@@ -0,0 +1,62 @@
+/**
+ * The pure HTML surgery of §4d (docs/ios-export-design.md): given the pro-lane bundle, produce
+ * the payload page. Two deliberately redundant mechanisms:
+ *
+ *  - the `bm-bundled-assets` map (original URL → relative vendor path), which the engine's own
+ *    ASSET_MAP mechanism resolves through — every three.js loader plus the explicit
+ *    `ASSET_MAP.get` fetch sites;
+ *  - a literal rewrite of every vendored URL AND the animation base-URL constants, which fixes
+ *    the sites that bypass the map (raw fetch in PlacedObjectSystem/HeightmapSystem/physics2d/
+ *    splat loaders, and the StartScreen/SelectionSteps/AchievementToast DOM urls): the world
+ *    data is inlined in this HTML, so rewriting the literals fixes what those sites read.
+ *
+ * No DOM parser — the bundle is one multi-MB HTML string and the three edits are anchored on
+ * markers the scaffold's own template guarantees (`<head>`, `</head>`).
+ */
+export const BUNDLED_ASSETS_ID = 'bm-bundled-assets';
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Rewrite every occurrence of the given URLs/bases in one pass. Longest key first, so an exact
+ * asset URL wins over a base that prefixes it — both rewrite into the same vendor layout, but
+ * the ordering keeps the replacement deterministic.
+ */
+export function rewriteUrlLiterals(html, replacements) {
+    if (replacements.size === 0)
+        return { html, rewrites: 0 };
+    const keys = [...replacements.keys()].sort((a, b) => b.length - a.length);
+    const pattern = new RegExp(keys.map(escapeRegExp).join('|'), 'g');
+    let rewrites = 0;
+    const rewritten = html.replace(pattern, (match) => {
+        rewrites += 1;
+        // The alternation only matches keys of the map, so the lookup cannot miss.
+        return replacements.get(match) ?? match;
+    });
+    return { html: rewritten, rewrites };
+}
+/** Serialize the asset map for the inline block. `<` is escaped so no URL can ever terminate
+ *  the script element early — standard inline-JSON hygiene, and still valid JSON. */
+export function renderAssetMapJson(assetMap) {
+    return JSON.stringify(Object.fromEntries(assetMap)).replace(/</g, '\\u003c');
+}
+/**
+ * The full §4d transform. Throws when the bundle carries no `<head>`/`</head>` markers — that
+ * is not a page this lane understands, and silently skipping the injection would ship an app
+ * that fetches from the network.
+ */
+export function transformBundleHtml(options) {
+    const combined = new Map([...options.assetMap, ...options.baseRewrites]);
+    const { html: rewritten, rewrites } = rewriteUrlLiterals(options.html, combined);
+    if (!rewritten.includes('<head>') || !rewritten.includes('</head>')) {
+        throw new Error('The built bundle has no <head> section to inject the asset map into.');
+    }
+    const mapBlock = `<script type="application/json" id="${BUNDLED_ASSETS_ID}">`
+        + renderAssetMapJson(options.assetMap)
+        + '</script>';
+    const html = rewritten
+        .replace('<head>', `<head>\n    <meta name="bm:distribution" content="${options.distribution}">`)
+        .replace('</head>', `    ${mapBlock}\n</head>`);
+    return { html, rewrites };
+}
+//# sourceMappingURL=transform.js.map

package/dist/package/transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.js","sourceRoot":"","sources":["../../src/package/transform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,YAAyC;IAEzC,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAChD,QAAQ,IAAI,CAAC,CAAC;QACd,2EAA2E;QAC3E,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,QAAqC;IACtE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GACZ,uCAAuC,iBAAiB,IAAI;UAC1D,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;UACpC,WAAW,CAAC;IAEhB,MAAM,IAAI,GAAG,SAAS;SACnB,OAAO,CAAC,QAAQ,EAAE,qDAAqD,OAAO,CAAC,YAAY,IAAI,CAAC;SAChG,OAAO,CAAC,SAAS,EAAE,OAAO,QAAQ,WAAW,CAAC,CAAC;IAElD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/package/vendor.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The document-relative path a URL is vendored at, or null for a URL this lane cannot mirror
+ * (unparseable, or a path that escapes the tree). The query string is dropped — asset URLs do
+ * not carry meaningful queries, and a `?` cannot survive as a same-file request path anyway.
+ */
+export declare function vendorPathFor(url: string): string | null;
+/** Where a BASE url's rewrite points: the same mapping, minus the appended 'index'. */
+export declare function vendorBasePathFor(baseUrl: string): string | null;
+export interface VendorFailure {
+    url: string;
+    error: string;
+}
+export interface VendorResult {
+    /** URL → document-relative vendor path, for every URL that is now on disk. */
+    entries: Map<string, string>;
+    failures: VendorFailure[];
+    /** How many came from the cache rather than the network. */
+    cacheHits: number;
+}
+export interface VendorOptions {
+    urls: Iterable<string>;
+    cacheDir: string;
+    payloadDir: string;
+    fetchImpl?: typeof globalThis.fetch;
+    log?: (message: string) => void;
+    concurrency?: number;
+    /** Target-specific layout; iOS retains its historical host/path layout. */
+    pathForUrl?: (url: string) => string | null;
+    /** Mutable resources must be fetched again rather than trusting a URL-only cache. */
+    reuseCache?: boolean;
+}
+/** Download (or copy from cache) every URL into the payload's vendor tree. */
+export declare function vendorUrls(options: VendorOptions): Promise<VendorResult>;

package/dist/package/vendor.js

@@ -0,0 +1,114 @@
+/**
+ * Mirror remote assets into the payload's `vendor/` tree.
+ *
+ * The layout preserves `<host>/<pathname>` so that rewriting a BASE url in the bundle (see
+ * transform.ts) makes runtime-constructed `${base}/${file}` URLs land on the mirrored file —
+ * exact-URL map entries alone could never cover those.
+ *
+ * Downloads are cached under `.bitmagic/ios/cache` keyed by URL hash: generated-asset URLs are
+ * immutable in practice (uuid/content-addressed paths), and a rebuild should not re-download a
+ * hundred GLBs. Bytes are stored post-Content-Encoding (node fetch inflates); the engine's
+ * gzip-sniffing loaders accept raw bytes unchanged (fetchVwld.ts).
+ */
+import { createHash } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * The document-relative path a URL is vendored at, or null for a URL this lane cannot mirror
+ * (unparseable, or a path that escapes the tree). The query string is dropped — asset URLs do
+ * not carry meaningful queries, and a `?` cannot survive as a same-file request path anyway.
+ */
+export function vendorPathFor(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    let pathname = parsed.pathname;
+    if (pathname.endsWith('/') || pathname === '')
+        pathname += 'index';
+    const segments = [];
+    for (const rawSegment of pathname.split('/')) {
+        if (rawSegment === '')
+            continue;
+        let segment;
+        try {
+            segment = decodeURIComponent(rawSegment);
+        }
+        catch {
+            segment = rawSegment;
+        }
+        if (segment === '.' || segment === '..' || /[\\/]/.test(segment)
+            || [...segment].some((char) => char.charCodeAt(0) < 32))
+            return null;
+        segments.push(segment);
+    }
+    if (segments.length === 0)
+        return null;
+    return ['vendor', parsed.host, ...segments].join('/');
+}
+/** Where a BASE url's rewrite points: the same mapping, minus the appended 'index'. */
+export function vendorBasePathFor(baseUrl) {
+    const mapped = vendorPathFor(baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`);
+    if (mapped === null)
+        return null;
+    return mapped.replace(/\/index$/, '');
+}
+function cacheFileFor(cacheDir, url) {
+    return path.join(cacheDir, createHash('sha256').update(url).digest('hex'));
+}
+/** Download (or copy from cache) every URL into the payload's vendor tree. */
+export async function vendorUrls(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const log = options.log ?? (() => { });
+    const entries = new Map();
+    const failures = [];
+    let cacheHits = 0;
+    fs.mkdirSync(options.cacheDir, { recursive: true });
+    const queue = [...new Set(options.urls)];
+    const worker = async () => {
+        for (;;) {
+            const url = queue.shift();
+            if (url === undefined)
+                return;
+            const relPath = (options.pathForUrl ?? vendorPathFor)(url);
+            if (relPath === null) {
+                failures.push({ url, error: 'not a vendorable URL' });
+                continue;
+            }
+            const cacheFile = cacheFileFor(options.cacheDir, url);
+            try {
+                if (options.reuseCache !== false && fs.existsSync(cacheFile)) {
+                    cacheHits += 1;
+                }
+                else {
+                    const response = await fetchImpl(url, { signal: AbortSignal.timeout(60_000) });
+                    if (!response.ok)
+                        throw new Error(`HTTP ${response.status}`);
+                    const bytes = Buffer.from(await response.arrayBuffer());
+                    // Write-then-rename so a crashed download never leaves a truncated cache entry that
+                    // every later build would trust.
+                    const tmp = `${cacheFile}.tmp-${process.pid}`;
+                    fs.writeFileSync(tmp, bytes);
+                    fs.renameSync(tmp, cacheFile);
+                    log(`  fetched ${url} (${bytes.byteLength} bytes)`);
+                }
+                const target = path.join(options.payloadDir, ...relPath.split('/'));
+                fs.mkdirSync(path.dirname(target), { recursive: true });
+                fs.copyFileSync(cacheFile, target);
+                entries.set(url, relPath);
+            }
+            catch (error) {
+                failures.push({ url, error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    };
+    const width = Math.max(1, Math.min(options.concurrency ?? 6, queue.length));
+    await Promise.all(Array.from({ length: width }, worker));
+    return { entries, failures, cacheHits };
+}
+//# sourceMappingURL=vendor.js.map

package/dist/package/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../src/package/vendor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7E,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,EAAE;QAAE,QAAQ,IAAI,OAAO,CAAC;IAEnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,UAAU,KAAK,EAAE;YAAE,SAAS;QAChC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,UAAU,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;eAC3D,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AA4BD,SAAS,YAAY,CAAC,QAAgB,EAAE,GAAW;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO;YAC9B,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7D,SAAS,IAAI,CAAC,CAAC;gBACjB,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;oBACxD,oFAAoF;oBACpF,iCAAiC;oBACjC,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC9C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC7B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC9B,GAAG,CAAC,aAAa,GAAG,KAAK,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC"}

package/dist/poki/assets.d.ts

@@ -0,0 +1,20 @@
+/** Only static resources may be downloaded by discovery; never vendor API responses. */
+export declare function isStaticAsset(url: string): boolean;
+export declare function scanAssetUrls(text: string): string[];
+/** HTML resource attributes, excluding dormant URL strings in bundled engine code. */
+export declare function scanHtmlAssets(html: string): string[];
+/** Preserve sibling layout, but never merge distinct query resources or unsafe decoded paths. */
+export declare function pokiAssetPath(url: string): string | null;
+/** References inside a sidecar, retained with their original spelling for rewriting. */
+export declare function sidecarReferences(text: string, url: string): Map<string, string>;
+/** Rewrite resource references only; short names must not replace arbitrary CSS or GLTF text. */
+export declare function rewriteSidecar(text: string, url: string, replacements: ReadonlyMap<string, string>): string;
+export interface PackageAssetsOptions {
+    urls: Iterable<string>;
+    payloadDir: string;
+    cacheDir: string;
+    fetch: typeof globalThis.fetch;
+    log: (message: string) => void;
+}
+/** Walk GLTF/CSS dependencies as well as direct URLs; a missing declared asset is an error. */
+export declare function packageAssets(options: PackageAssetsOptions): Promise<Map<string, string>>;