@forgeax/game 0.3.1 → 0.3.2

package/README.md

@@ -58,12 +58,14 @@ unknown non-empty directories fail closed.
 > `asset3d-search` to the project. Enable it only in an already initialized project:
 >
 > ```bash
-> npx -y @forgeax/game asset3d enable --base-url <aw-gateway-or-service-url>
+> npx -y @forgeax/game asset3d enable
 > ```
 >
-> The first enable prompts for the AW Sandbox Key with hidden input, validates it
-> through the packaged Provider, and stores it outside the project in a private
-> user credential file.
+> With no override, `enable` uses the documented AW production service. Pass
+> `--base-url <test-gateway-or-service-url>` only to select a test environment. The
+> first enable prompts for the AW Sandbox Key with hidden input, validates it through
+> the packaged Provider, and stores it outside the project in a private user
+> credential file.
 
 ## Agent completion contract
 
@@ -156,20 +158,22 @@ a live unverifiable PID fails closed as `preview_ownership_unverified`.
 ## Asset3D installation and transaction
 
 Asset3D is an opt-in, project-local MCP integration for AW HybridSearch. Run it only
-after `init`, while connected to the internal network, using the gateway or service
-URL supplied by the asset-platform administrator:
+after `init`, while connected to the internal network. The no-argument command uses
+the documented production service:
 
 ```bash
-npx -y @forgeax/game asset3d enable --base-url <aw-gateway-or-service-url>
+npx -y @forgeax/game asset3d enable
 forgeax-game asset3d doctor --json
 ```
 
-`--base-url` accepts either the gateway root or the full
-`trpc.oasismetric.omcontentserver.http` service root. It can instead be supplied by
-`FORGEAX_ASSET_LIBRARY_BASE_URL`. On first use, `enable` reads the key with hidden TTY
-input. Non-interactive automation must inject `FORGEAX_ASSET3D_AW_SANDBOX_KEY` from
-its secret store. The key is validated by the Provider against `HybridSearch` before
-the command reports success.
+The service selection precedence is explicit `--base-url`, then
+`FORGEAX_ASSET_LIBRARY_BASE_URL`, then the built-in production service. An override
+accepts either a gateway root or the full
+`trpc.oasismetric.omcontentserver.http` service root. On first use, `enable` reads the
+key with hidden TTY input. Non-interactive automation must inject
+`FORGEAX_ASSET3D_AW_SANDBOX_KEY` from its secret store. The key is validated by the
+Provider against the selected environment's `HybridSearch` before the command
+reports success.
 
 The validated key is stored in
 `~/.forgeax/credentials/asset3d-aw.json` as an owned, non-symlink `0600` file. Project
@@ -245,6 +249,8 @@ and evidence boundaries.
 > acceptance gates.
 
 See [docs/runtime.md](docs/runtime.md) for the exact artifact and lifecycle contract.
-For the current Asset3D authentication update and maintainer publish checklist, see
-[docs/release-0.3.1.md](docs/release-0.3.1.md). The original two-command onboarding
-contract remains documented in [docs/release-0.3.0.md](docs/release-0.3.0.md).
+For the current production-default environment contract and maintainer publish
+checklist, see [docs/release-0.3.2.md](docs/release-0.3.2.md). The authenticated AW
+Provider delivery is documented in [docs/release-0.3.1.md](docs/release-0.3.1.md),
+and the original two-command onboarding contract remains documented in
+[docs/release-0.3.0.md](docs/release-0.3.0.md).

package/dist/main.js

@@ -2946,7 +2946,7 @@ var RELEASE_IDENTITY_MIME = "application/vnd.forgeax.game-release-identity+json"
 var RELEASE_IDENTITY = Object.freeze({
   schema: RELEASE_IDENTITY_SCHEMA,
   gamePackage: "@forgeax/game",
-  gameVersion: "0.3.1",
+  gameVersion: "0.3.2",
   gameBin: "forgeax-game",
   engineSdkPackage: ENGINE_SDK_PACKAGE,
   engineSdkVersion: ENGINE_VERSION,
@@ -3355,7 +3355,7 @@ function launchSpec(mode) {
   }
   return {
     command: "npx",
-    args: ["-y", "-p", "@forgeax/game@0.3.1", "forgeax-game", "mcp"]
+    args: ["-y", "-p", "@forgeax/game@0.3.2", "forgeax-game", "mcp"]
   };
 }
 
@@ -5445,6 +5445,7 @@ import { existsSync as existsSync10 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 var AW_SERVICE_PATH = "/trpc.oasismetric.omcontentserver.http";
 var ACCESS_CHECK_SCHEMA = "forgeax.asset3d-access-check/1.0.0";
+var DEFAULT_AW_PRODUCTION_SERVICE_ROOT = "http://lb-pl74wsqg-5wi8ujmy1fq2746r.clb.usw-tencentclb.com:8008/trpc.oasismetric.omcontentserver.http";
 function normalizeAwServiceRoot(input) {
   let parsed;
   try {
@@ -5464,10 +5465,7 @@ function normalizeAwServiceRoot(input) {
   return parsed.toString().replace(/\/$/, "");
 }
 function resolveAwServiceRoot(explicit) {
-  const configured = explicit || process.env.FORGEAX_ASSET_LIBRARY_BASE_URL;
-  if (!configured) {
-    throw new Error("asset3d_base_url_required: pass --base-url <AW gateway/service URL> or set FORGEAX_ASSET_LIBRARY_BASE_URL");
-  }
+  const configured = explicit || process.env.FORGEAX_ASSET_LIBRARY_BASE_URL || DEFAULT_AW_PRODUCTION_SERVICE_ROOT;
   return normalizeAwServiceRoot(configured);
 }
 function checkAwProviderAccess(options) {

package/docs/asset3d.md

@@ -62,9 +62,11 @@ its authority must also appear in `--download-origin`.
 
 ## Installation ownership
 
-`asset3d enable` requires an AW gateway or full service URL through `--base-url` or
-`FORGEAX_ASSET_LIBRARY_BASE_URL`. No private-network endpoint is compiled into the
-package. The first interactive run asks for the AW Sandbox Key with terminal echo
+`asset3d enable` uses the documented AW production service when no override is
+present. Service selection precedence is explicit `--base-url`, then
+`FORGEAX_ASSET_LIBRARY_BASE_URL`, then the built-in production service. Therefore a
+test environment is contacted only when the caller supplies its gateway or service
+URL. The first interactive run asks for the AW Sandbox Key with terminal echo
 disabled. Automation can supply `FORGEAX_ASSET3D_AW_SANDBOX_KEY` from a secret store;
 command-line key arguments are deliberately unsupported.
 

package/docs/release-0.3.2.md

@@ -0,0 +1,90 @@
+# `@forgeax/game` 0.3.2 release guide
+
+Version `0.3.2` keeps Asset3D opt-in while making the documented AW production
+service the default selected by `asset3d enable`. Test and pre-release environments
+remain explicit overrides.
+
+## User contract
+
+The ordinary setup flow is unchanged:
+
+```bash
+npx -y @forgeax/game install --ide codex,cursor,claude
+cd /path/to/a-genuinely-empty-directory
+npx -y @forgeax/game init
+```
+
+Inside an initialized project, enable production Asset3D without passing an address:
+
+```bash
+npx -y @forgeax/game asset3d enable
+npx -y @forgeax/game asset3d doctor --json
+```
+
+> [!IMPORTANT]
+> Asset3D remains disabled until the user runs `asset3d enable`. A no-argument enable
+> selects production; it does not make `install` or `init` contact AW.
+
+To select a non-production environment, pass its gateway or complete service URL:
+
+```bash
+npx -y @forgeax/game asset3d enable \
+  --base-url <test-gateway-or-service-url>
+```
+
+## Environment selection
+
+| Priority | Input | Selected environment |
+|--:|:--|:--|
+| 1 | `--base-url` | Explicit caller-selected service, normally test or pre-release |
+| 2 | `FORGEAX_ASSET_LIBRARY_BASE_URL` | Automation or deployment override |
+| 3 | No override | Documented AW production service |
+
+The built-in production root is:
+
+```text
+http://lb-pl74wsqg-5wi8ujmy1fq2746r.clb.usw-tencentclb.com:8008/trpc.oasismetric.omcontentserver.http
+```
+
+Every selection is normalized so `HybridSearch` is appended exactly once. The
+selected endpoint is validated by the packaged Provider before project configuration
+is published.
+
+## Authentication and safety
+
+The first enable reads an AW Sandbox Key with hidden terminal input. Automation may
+inject `FORGEAX_ASSET3D_AW_SANDBOX_KEY` from a secret store. The plugin never accepts
+`ANTHROPIC_API_KEY` or another model credential as an Asset3D key.
+
+The key remains in the private user credential file. Project MCP configuration
+contains only the selected service URL and the credential-file path. Failed access
+validation or installation rolls back a newly written credential and leaves the
+project disabled.
+
+## Release gates
+
+- [ ] Default resolution selects the exact documented production root.
+- [ ] Explicit CLI URL overrides the environment and production default.
+- [ ] Environment URL overrides the production default when CLI input is absent.
+- [ ] Real production access check succeeds with a valid AW Sandbox Key.
+- [ ] Real production `search_asset` downloads a valid GLB.
+- [ ] Game Plugin transaction validates and commits the asset through Engine.
+- [ ] `doctor` reports the production Provider live in a fresh installed project.
+- [ ] Exact npm tarball and embedded Provider pass the package and secret gates.
+- [ ] Registry-downloaded tarball matches the audited candidate.
+
+> [!WARNING]
+> Provider access and Engine import do not prove visible Play acceptance. If a game
+> consumes the imported asset, verify that game separately in its owned Preview and
+> report the Play result as a distinct gate.
+
+## Maintainer commands
+
+```bash
+bun run typecheck
+bun test test/*.test.ts
+FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> bun run build
+FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> \
+  npm pack --ignore-scripts --json --pack-destination <audited-directory>
+bun scripts/check-package-artifact.ts <audited-directory>/forgeax-game-0.3.2.tgz
+```

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "bun@1.3.14",
   "name": "@forgeax/game",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": false,
   "type": "module",
   "description": "@forgeax/game — an MCP/CLI connector for exact released ForgeaX Engine games and Engine-owned Preview.",
@@ -23,6 +23,7 @@
     "docs/asset3d.md",
     "docs/release-0.3.0.md",
     "docs/release-0.3.1.md",
+    "docs/release-0.3.2.md",
     "README.md"
   ],
   "scripts": {