@forgeax/game 0.3.7 → 0.3.8

package/assets/asset3d/schemas/result-1.0.0.json

@@ -1,361 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "forgeax.asset3d-search-result/1.0.0",
-  "title": "ForgeaX Asset3D Search Result",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schemaVersion",
-    "total",
-    "succeeded",
-    "failed",
-    "results"
-  ],
-  "properties": {
-    "schemaVersion": {
-      "const": "forgeax.asset3d-search-result/1.0.0"
-    },
-    "total": {
-      "type": "integer",
-      "minimum": 1,
-      "maximum": 16
-    },
-    "succeeded": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 16
-    },
-    "failed": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 16
-    },
-    "results": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 16,
-      "items": {
-        "oneOf": [
-          {
-            "$ref": "#/$defs/success"
-          },
-          {
-            "$ref": "#/$defs/packSuccess"
-          },
-          {
-            "$ref": "#/$defs/error"
-          }
-        ]
-      }
-    },
-    "receipt": {
-      "$ref": "receipt-1.0.0.json"
-    }
-  },
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "succeeded": {
-            "minimum": 1
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "receipt"
-        ]
-      }
-    }
-  ],
-  "$defs": {
-    "queryIndex": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 15
-    },
-    "safeId": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 128,
-      "pattern": "^[A-Za-z0-9._-]+$",
-      "not": {
-        "enum": [
-          ".",
-          ".."
-        ]
-      }
-    },
-    "sha256": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{64}$"
-    },
-    "relativePath": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 512,
-      "pattern": "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)[^\\u0000]+$"
-    },
-    "manifestEntry": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "path",
-        "role",
-        "bytes",
-        "sha256"
-      ],
-      "properties": {
-        "path": {
-          "$ref": "#/$defs/relativePath"
-        },
-        "role": {
-          "enum": [
-            "primary-model",
-            "animation",
-            "auxiliary-model",
-            "texture",
-            "metadata"
-          ]
-        },
-        "bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 134217728
-        },
-        "sha256": {
-          "$ref": "#/$defs/sha256"
-        }
-      }
-    },
-    "success": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "status",
-        "queryIndex",
-        "query",
-        "provider",
-        "providerAssetId",
-        "assetName",
-        "deliveredFormat",
-        "sha256",
-        "bytes",
-        "primaryModel",
-        "manifest",
-        "originSetDigest"
-      ],
-      "properties": {
-        "status": {
-          "const": "ok"
-        },
-        "queryIndex": {
-          "$ref": "#/$defs/queryIndex"
-        },
-        "query": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 200
-        },
-        "provider": {
-          "const": "ea-3d"
-        },
-        "providerAssetId": {
-          "$ref": "#/$defs/safeId"
-        },
-        "assetName": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 128
-        },
-        "deliveredFormat": {
-          "const": "glb"
-        },
-        "sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 268435456
-        },
-        "primaryModel": {
-          "$ref": "#/$defs/relativePath"
-        },
-        "manifest": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 1024,
-          "items": {
-            "$ref": "#/$defs/manifestEntry"
-          }
-        },
-        "originSetDigest": {
-          "$ref": "#/$defs/sha256"
-        },
-        "downloaded_to": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 512,
-          "pattern": "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)[^\\u0000]+$"
-        }
-      }
-    },
-    "error": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "status",
-        "queryIndex",
-        "query",
-        "code",
-        "retryable",
-        "message"
-      ],
-      "properties": {
-        "status": {
-          "const": "error"
-        },
-        "queryIndex": {
-          "$ref": "#/$defs/queryIndex"
-        },
-        "query": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 200
-        },
-        "code": {
-          "enum": [
-            "asset_not_found",
-            "asset_identity_missing",
-            "search_timeout",
-            "search_upstream_error",
-            "download_timeout",
-            "download_origin_rejected",
-            "download_too_large",
-            "archive_rejected",
-            "conversion_failed",
-            "digest_failed",
-            "batch_timeout",
-            "internal_error"
-          ]
-        },
-        "retryable": {
-          "type": "boolean"
-        },
-        "message": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 256,
-          "pattern": "^[^\\u0000-\\u001f\\u007f]+$"
-        }
-      }
-    },
-    "packManifestEntry": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "path",
-        "role",
-        "bytes",
-        "sha256"
-      ],
-      "properties": {
-        "path": {
-          "$ref": "#/$defs/relativePath"
-        },
-        "role": {
-          "enum": [
-            "primary-pack",
-            "auxiliary-pack",
-            "animation",
-            "auxiliary-model",
-            "texture",
-            "metadata"
-          ]
-        },
-        "bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 134217728
-        },
-        "sha256": {
-          "$ref": "#/$defs/sha256"
-        }
-      }
-    },
-    "packSuccess": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "status",
-        "queryIndex",
-        "query",
-        "provider",
-        "providerAssetId",
-        "assetName",
-        "deliveredFormat",
-        "sha256",
-        "bytes",
-        "primaryPack",
-        "manifest",
-        "originSetDigest"
-      ],
-      "properties": {
-        "status": {
-          "const": "ok"
-        },
-        "queryIndex": {
-          "$ref": "#/$defs/queryIndex"
-        },
-        "query": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 200
-        },
-        "provider": {
-          "const": "ea-3d"
-        },
-        "providerAssetId": {
-          "$ref": "#/$defs/safeId"
-        },
-        "assetName": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 128
-        },
-        "deliveredFormat": {
-          "const": "pack"
-        },
-        "sha256": {
-          "$ref": "#/$defs/sha256"
-        },
-        "bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 268435456
-        },
-        "manifest": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 1024,
-          "items": {
-            "$ref": "#/$defs/packManifestEntry"
-          }
-        },
-        "originSetDigest": {
-          "$ref": "#/$defs/sha256"
-        },
-        "downloaded_to": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 512,
-          "pattern": "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)[^\\u0000]+$"
-        },
-        "primaryPack": {
-          "$ref": "#/$defs/relativePath"
-        }
-      }
-    }
-  }
-}

package/assets/asset3d/vibegame-art-3d-asset-library-2.0.0.tgz.sha256

@@ -1 +0,0 @@
-4937fe00e2b919319c70c82db53ebe359b275ed662c026153ecb97f7601262b4  vibegame-art-3d-asset-library-2.0.0.tgz

package/docs/release-0.3.0.md

@@ -1,100 +0,0 @@
-# `@forgeax/game` 0.3.0 release guide
-
-## User-visible contract
-
-Version `0.3.0` makes the public onboarding flow exactly two commands:
-
-```bash
-npx -y @forgeax/game install --ide codex,cursor,claude
-cd /path/to/a-genuinely-empty-directory
-npx -y @forgeax/game init
-```
-
-Restart or reload an Agent host when the install command asks. `init` creates the
-Engine-owned standalone game in the current directory through the exact
-`@forgeax/engine-sdk@0.1.7` carrier, then installs the same Game Plugin Skill/routing
-contract for every selected host. Users do not run `forgeax new` separately.
-
-Standalone author source is `<game-root>/src`. `.forgeax/games/<slug>` belongs to the
-Studio-hosted project model and is not created by this package.
-
-## Agent authoring and Preview
-
-After `init`, ask the Agent to create a game and open Preview. A valid completion must
-include all of the following:
-
-- concrete `forge.json` id/name and a non-template package name;
-- one coherent README with controls and no Empty package-output residue;
-- a behavior test that imports and exercises a named game-specific state transition or
-  rule; renaming an Empty template test is insufficient;
-- UI mounted under Engine Host `uiRoot` or `#game-ui`; direct `document.body` mutation
-  is rejected because the released standalone Host provides `#game-ui`;
-- a successful `forgeax_run_current_game` response containing
-  `preview.status: ready`, the exact root, Engine release, build digest, Preview
-  instance ID, and the returned loopback URL.
-
-An MCP error, a bare HTTP 200, a PID, an old build, or a localhost URL discovered by
-shell probing is not Preview evidence. When another game owns the Preview port, stop
-that exact verified game first:
-
-```bash
-forgeax-game preview stop --target-dir /path/to/the-running-game
-```
-
-The internal 3D catalog is disabled by default and is not contacted by `install` or
-ordinary `init`. A user opts one initialized project in with:
-
-```bash
-npx -y @forgeax/game asset3d enable
-```
-
-The current `http://21.214.216.8:5180` catalog is network-gated and its body-free
-access probe requires no API Key. In particular, `ANTHROPIC_API_KEY` is unrelated and
-must not be supplied. If the service changes to `401`/`403` without publishing a
-supported authentication contract, enablement fails closed. If
-`asset3d-search/search_asset` is absent, the Agent must report
-`BLOCKED(asset-library-tools-missing)`. Procedural meshes and `forgeax_generate_3d`
-are not evidence that the reusable asset library is available.
-
-## Upgrade and compatibility
-
-- Node.js `>=22.13.0` is required.
-- Existing exact Engine games can rerun `forgeax-game init` to refresh project Skill,
-  routing, and authoring baseline without recreating gameplay source.
-- `install` and `init` are idempotent for already-current owned state.
-- Unknown non-empty directories fail before carrier execution or workspace mutation.
-- Engine-owned `forgeax-engine-*` Skills remain supplied by the selected Engine game;
-  this release changes only the Game Plugin-owned `forgeax-game` Skill and rule.
-
-## Release verification
-
-Before publishing, maintainers must run:
-
-```bash
-bun run typecheck
-bun test test/*.test.ts
-bun run build
-npm pack --json
-bun scripts/check-package-artifact.ts /absolute/path/to/forgeax-game-0.3.0.tgz
-```
-
-Then use the TGZ from a fresh consumer to verify:
-
-1. blank-directory `init`;
-2. identical Skill/rule projection for configured hosts;
-3. changed gameplay with stale template identity/tests fails closed;
-4. Engine build diagnostics before the terminal JSON frame are accepted;
-5. duplicate JSON or post-frame diagnostics fail closed;
-6. Preview failure is returned with MCP `isError: true`;
-7. a different game's occupied port is never reported as the new game's Preview;
-8. after stopping the old verified Preview, the new game returns its own exact
-   root/build/instance identity and loopback URL.
-
-Publishing and npm dist-tag changes remain separate maintainer actions after the MR
-and required checks are approved.
-
-> [!CAUTION]
-> Do not publish the npm dist-tag until every advertised host target has a Provider
-> release artifact at the exact URL pinned by the package and its SHA-256 has been
-> verified. The current source pins only `darwin-arm64`; other targets intentionally
-> fail with `asset3d_provider_target_unreleased`.

package/docs/release-0.3.1.md

@@ -1,107 +0,0 @@
-# `@forgeax/game` 0.3.1 release guide
-
-Version `0.3.1` keeps the two-command ForgeaX onboarding contract from `0.3.0` and
-replaces the Asset3D default route with the documented AW `HybridSearch` contract.
-Asset3D remains optional and disabled until a user explicitly enables it.
-
-## User contract
-
-The ordinary setup flow is unchanged:
-
-```bash
-npx -y @forgeax/game install --ide codex,cursor,claude
-cd /path/to/a-genuinely-empty-directory
-npx -y @forgeax/game init
-```
-
-Inside an initialized project, enable AW Asset3D separately:
-
-```bash
-npx -y @forgeax/game asset3d enable --base-url <aw-gateway-or-service-url>
-npx -y @forgeax/game asset3d doctor --json
-```
-
-`--base-url` can be replaced by `FORGEAX_ASSET_LIBRARY_BASE_URL`. The first
-interactive enable asks for the AW Sandbox Key with hidden input. CI or another
-non-interactive host must inject `FORGEAX_ASSET3D_AW_SANDBOX_KEY` from its own secret
-store.
-
-> [!IMPORTANT]
-> Do not place the key on the command line, in `.forgeax/mcp.json`, in a repository
-> `.env`, or in a release artifact. `ANTHROPIC_API_KEY` is unrelated and is never
-> accepted as an Asset3D credential.
-
-## What changed
-
-| Area | `0.3.0` | `0.3.1` |
-|:--|:--|:--|
-| Search adapter | Explicit internal directory catalog | AW `HybridSearch` through the packaged Provider |
-| Authentication | Network gate, reported `authentication=none` | Required `X-Sandbox-Key`, validated before success |
-| Service address | Compiled catalog origin | Explicit `--base-url` or environment configuration |
-| Credential storage | None | User-level versioned JSON, directory `0700`, file `0600` |
-| Project MCP config | Catalog origin and download origins | AW service URL, credential-file path, exact download origins |
-| Failure behavior | Failed when an unknown auth contract appeared | Invalid key/network/address fails closed; new credential is rolled back |
-| Provider delivery | Private external release URL | Digest-pinned archive embedded in the npm package |
-
-The Provider accepts either an AW gateway root or the complete
-`trpc.oasismetric.omcontentserver.http` service root and appends `HybridSearch`
-exactly once. Its request includes `depot_name`, `asset_type=1`, text content type,
-the query, `similarity_score`, and page size. Short-lived signed `res_url` values stay
-inside the Provider; the access check exposes only their canonical origins for the
-download sandbox.
-
-## Security and artifact gates
-
-Before publishing, the exact npm tarball and Provider archive must pass all of these
-checks:
-
-- [ ] TypeScript typecheck, full Game Plugin test suite, and build.
-- [ ] Provider AW/catalog/security tests and Python compile check.
-- [ ] Two independently built Provider archives are byte-identical.
-- [ ] Provider verifier provisions the archive under its exact SHA-256 cache key.
-- [ ] Real AW access check succeeds without printing the key or a signed URL.
-- [ ] Real search/download and Engine import/readback succeed in a fresh project.
-- [ ] Package artifact gate accepts only the declared files and immutable digests.
-- [ ] Secret scan covers source diff, npm tarball, its embedded workflow TGZ and
-  Provider archive, manifests, and file names.
-- [ ] Registry-downloaded npm tarball is byte-identical to the audited candidate.
-
-> [!WARNING]
-> A successful search or download is not Preview acceptance. Release evidence must
-> report Provider access, download, Engine import/readback, and visible Play as
-> separate gates. AW responses do not establish license or commercial-use clearance;
-> those remain asset-release requirements.
-
-## Provider inclusion
-
-The pinned Darwin arm64 Provider identity for this release is:
-
-```text
-provider commit: c181c48fbffc933a7ce9a0836f7878ca5e6d77e1
-archive sha256: c8d2afd7ba68ae4b3540c927a2ff7133a82ea90975d09cab1d10b003fbbdeed3
-```
-
-The exact archive is embedded beneath `assets/asset3d/provider/` in the npm tarball.
-`asset3d enable` verifies this SHA-256 before provisioning and does not fetch Provider
-code from GitHub, Gongfeng, or another repository. This makes cache-empty enablement
-depend only on npm installation, local Python 3.11/3.12, the explicitly configured AW
-service, and a valid user-supplied AW key.
-
-The repository intentionally does not track the generated 17.2 MB Provider binary.
-Release packaging injects the already audited archive through
-`FORGEAX_ASSET3D_PROVIDER_BUNDLE`; the package artifact gate rejects any tarball that
-omits it or contains different bytes.
-
-## Maintainer commands
-
-```bash
-bun run typecheck
-bun test test/*.test.ts
-FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> bun run build
-FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> \
-  npm pack --ignore-scripts --json --pack-destination <audited-directory>
-bun scripts/check-package-artifact.ts <audited-directory>/forgeax-game-0.3.1.tgz
-```
-
-Publishing, npm registry readback, and any merge request are separate irreversible or
-remote-state steps. Record the exact Git heads and artifact digests at each boundary.

package/docs/release-0.3.2.md

@@ -1,90 +0,0 @@
-# `@forgeax/game` 0.3.2 release guide
-
-Version `0.3.2` keeps Asset3D opt-in while making the documented AW production
-service the default selected by `asset3d enable`. Test and pre-release environments
-remain explicit overrides.
-
-## User contract
-
-The ordinary setup flow is unchanged:
-
-```bash
-npx -y @forgeax/game install --ide codex,cursor,claude
-cd /path/to/a-genuinely-empty-directory
-npx -y @forgeax/game init
-```
-
-Inside an initialized project, enable production Asset3D without passing an address:
-
-```bash
-npx -y @forgeax/game asset3d enable
-npx -y @forgeax/game asset3d doctor --json
-```
-
-> [!IMPORTANT]
-> Asset3D remains disabled until the user runs `asset3d enable`. A no-argument enable
-> selects production; it does not make `install` or `init` contact AW.
-
-To select a non-production environment, pass its gateway or complete service URL:
-
-```bash
-npx -y @forgeax/game asset3d enable \
-  --base-url <test-gateway-or-service-url>
-```
-
-## Environment selection
-
-| Priority | Input | Selected environment |
-|--:|:--|:--|
-| 1 | `--base-url` | Explicit caller-selected service, normally test or pre-release |
-| 2 | `FORGEAX_ASSET_LIBRARY_BASE_URL` | Automation or deployment override |
-| 3 | No override | Documented AW production service |
-
-The built-in production root is:
-
-```text
-http://lb-pl74wsqg-5wi8ujmy1fq2746r.clb.usw-tencentclb.com:8008/trpc.oasismetric.omcontentserver.http
-```
-
-Every selection is normalized so `HybridSearch` is appended exactly once. The
-selected endpoint is validated by the packaged Provider before project configuration
-is published.
-
-## Authentication and safety
-
-The first enable reads an AW Sandbox Key with hidden terminal input. Automation may
-inject `FORGEAX_ASSET3D_AW_SANDBOX_KEY` from a secret store. The plugin never accepts
-`ANTHROPIC_API_KEY` or another model credential as an Asset3D key.
-
-The key remains in the private user credential file. Project MCP configuration
-contains only the selected service URL and the credential-file path. Failed access
-validation or installation rolls back a newly written credential and leaves the
-project disabled.
-
-## Release gates
-
-- [ ] Default resolution selects the exact documented production root.
-- [ ] Explicit CLI URL overrides the environment and production default.
-- [ ] Environment URL overrides the production default when CLI input is absent.
-- [ ] Real production access check succeeds with a valid AW Sandbox Key.
-- [ ] Real production `search_asset` downloads a valid GLB.
-- [ ] Game Plugin transaction validates and commits the asset through Engine.
-- [ ] `doctor` reports the production Provider live in a fresh installed project.
-- [ ] Exact npm tarball and embedded Provider pass the package and secret gates.
-- [ ] Registry-downloaded tarball matches the audited candidate.
-
-> [!WARNING]
-> Provider access and Engine import do not prove visible Play acceptance. If a game
-> consumes the imported asset, verify that game separately in its owned Preview and
-> report the Play result as a distinct gate.
-
-## Maintainer commands
-
-```bash
-bun run typecheck
-bun test test/*.test.ts
-FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> bun run build
-FORGEAX_ASSET3D_PROVIDER_BUNDLE=<audited-provider-archive> \
-  npm pack --ignore-scripts --json --pack-destination <audited-directory>
-bun scripts/check-package-artifact.ts <audited-directory>/forgeax-game-0.3.2.tgz
-```