@helix3/helix-cli 0.1.13-helix3.140 → 0.1.13-helix3.142

package/README.md

@@ -59,6 +59,8 @@ The token is stored in `~/.helix/credentials.json` (mode `600`). It's sent as
 | `helix assets credits\|check-loaders` | Render asset credits from provenance and reject models requiring unsupported loaders. |
 | `helix character retarget-animation <clip.fbx\|clip.glb>` | Retarget a raw Mixamo/Meshy clip directly to `helix-humanoid@1`. FBX conversion is deterministic and runs inside the CLI; no hidden Blender/DCC pre-export is required. |
 | `helix world audit\|source-audit\|perf-gate\|prove-live` | Run the blocking world QA, performance, and deployed-build identity gates. |
+| `helix world scene-source inventory\|compile <helsinki\|bistro> <archive>` | Verify and safely inventory a known CC BY source archive, then compile deterministic local proxy/detail GLBs and an existing-schema Scene v2 package. |
+| `helix world scene-source publish <world-id> <package-dir> [--publish]` | Validate the Scene v2 package and print its multipart build receipt. Execution remains dry-run-only until backend private-pin entitlement lands; `--publish` currently fails closed, and access control never changes CC BY rights. |
 | `helix unreal init\|validate\|doctor\|package [project]` | Create and gate a shared-runtime or native-game publish manifest, check optional editor MCP, and assemble a local upload-shaped package. |
 | `helix unreal publish <candidate> --world <slug>` | Upload a **cooked** Unreal world to HELIX: verify the candidate, presign, upload every artifact, finalize, and promote it as the world's active build. |
 | `helix doctor [--project <dir>]` | Print the environment + whether the @helix toolchain (CLI/MCP/SDK/manifest) is current. |

package/dist/index.js

@@ -702,6 +702,7 @@ item
     .option('--ops <json|file>', 'add_on operation array (tune/hide/mount/patch); accepts inline JSON or a JSON file')
     .option('--host-kind <kind>', 'base host class with a published slot pack: vehicle or character')
     .option('--host-surface <json|file>', 'measured base surface ({ sockets, nodes, materialSlots, paths, skeleton }); inline JSON or file')
+    .option('--vehicle-package <json|file>', 'authored Universal Vehicle package, required for vehicles; inline JSON or file')
     .option('--slug <slug>', 'url slug (default: derived from the title)')
     .option('--description <text>', 'item description')
     .option('--thumbnail <file>', 'thumbnail image (png/jpg/webp); rendered from the mesh when omitted, required for an avatar')
@@ -733,6 +734,9 @@ item
         hostSurface: opts.hostSurface !== undefined
             ? (0, lib_1.parseJsonObjectOrFile)(opts.hostSurface, '--host-surface')
             : undefined,
+        vehiclePackage: opts.vehiclePackage !== undefined
+            ? (0, lib_1.parseJsonObjectOrFile)(opts.vehiclePackage, '--vehicle-package')
+            : undefined,
         slug: opts.slug,
         description: opts.description,
         collectibleSupply: opts.collectibleSupply !== undefined
@@ -1738,15 +1742,19 @@ assets
     .option('--description <text>', 'what this asset is')
     .option('--tags <a,b>', 'comma-separated tags')
     .option('--private', 'keep it out of Vault search — only you can reference it')
+    .option('--license <license>', 'asset license (use cc_by for CC BY source derivatives)')
     .option('--human', 'readable summary instead of JSON')
     .action(async (file, opts) => {
     const creds = requireAuth();
     try {
-        const { publishVaultAsset } = await Promise.resolve().then(() => __importStar(require('./vaultPublish')));
+        const { isVaultAssetLicense, publishVaultAsset } = await Promise.resolve().then(() => __importStar(require('./vaultPublish')));
         const path = (0, node_path_1.resolve)(file);
         if (!(0, node_fs_1.existsSync)(path))
             fail(`✖ no such file: ${file}`);
         const bytes = (0, node_fs_1.readFileSync)(path);
+        if (opts.license !== undefined && !isVaultAssetLicense(opts.license)) {
+            fail('✖ unknown Vault license; use helix_standard, cc0, cc_by, or all_rights_reserved');
+        }
         const result = await publishVaultAsset(lib_1.HelixApi.forCredentials(creds), {
             bytes,
             filename: (0, node_path_1.basename)(path),
@@ -1755,6 +1763,7 @@ assets
             ...(opts.description !== undefined && { description: opts.description }),
             ...(opts.tags !== undefined && { tags: opts.tags.split(',') }),
             ...(opts.private === true && { visibility: 'private' }),
+            ...(opts.license !== undefined && { license: opts.license }),
         });
         if (opts.human) {
             console.log(`✔ ${result.assetId} v${result.artifact.version}`);
@@ -3115,6 +3124,109 @@ world
         fail(err instanceof lib_1.ApiError ? err.render() : `✖ ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+const sceneSource = world
+    .command('scene-source')
+    .description('Inventory and compile rights-clean native Scene v2 source packages');
+sceneSource
+    .command('inventory')
+    .description('Hash and inventory one supported source archive without extracting it')
+    .argument('<source>', 'helsinki-672496d1 or bistro-interior')
+    .argument('<archive>', 'immutable original ZIP')
+    .action(async (source, archive) => {
+    try {
+        const { inventoryKnownSceneSource } = await Promise.resolve().then(() => __importStar(require('./sceneImport/compiler')));
+        if (source !== 'helsinki-672496d1' && source !== 'bistro-interior') {
+            fail('✖ source must be helsinki-672496d1 or bistro-interior');
+        }
+        console.log(JSON.stringify(await inventoryKnownSceneSource(source, (0, node_path_1.resolve)(archive)), null, 2));
+    }
+    catch (err) {
+        fail(`✖ ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
+sceneSource
+    .command('compile')
+    .description('Compile deterministic proxy/detail GLBs and an existing-schema Scene v2 package')
+    .argument('<source>', 'helsinki-672496d1 or bistro-interior')
+    .argument('<archive>', 'immutable original ZIP')
+    .requiredOption('-o, --output <dir>', 'empty/new output directory for generated artifacts')
+    .action(async (source, archive, opts) => {
+    try {
+        const { compileKnownSceneSource } = await Promise.resolve().then(() => __importStar(require('./sceneImport/compiler')));
+        if (source !== 'helsinki-672496d1' && source !== 'bistro-interior') {
+            fail('✖ source must be helsinki-672496d1 or bistro-interior');
+        }
+        const outputDir = (0, node_path_1.resolve)(opts.output);
+        const result = await compileKnownSceneSource({ source, archivePath: (0, node_path_1.resolve)(archive), outputDir });
+        const vaultPublication = result.resourcePaths.map((path) => ({
+            path,
+            license: 'cc_by',
+            visibility: 'private',
+            command: `helix assets publish ${JSON.stringify((0, node_path_1.join)(outputDir, path))} --license cc_by --private`,
+        }));
+        console.log(JSON.stringify({ ...result, scene: undefined, vaultPublication }, null, 2));
+    }
+    catch (err) {
+        fail(`✖ ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
+sceneSource
+    .command('publish')
+    .description('Validate and dry-run the native Scene v2 World-build multipart request')
+    .argument('<world-id>', 'owned World UUID')
+    .argument('<package-dir>', 'compiled Scene v2 package directory')
+    .option('--profile <id>', 'Scene profile', 'world')
+    .option('--content-rating <rating>', 'everyone, teen, or mature', 'everyone')
+    .option('--supports-mobile', 'declare mobile support', false)
+    .option('--requires-auth', 'require an authenticated player', false)
+    .option('--visibility <visibility>', 'private, unlisted, or public', 'private')
+    .option('--publish', 'upload the package and activate it as the World\'s build', false)
+    .action(async (worldId, packageDir, opts) => {
+    try {
+        if (!['everyone', 'teen', 'mature'].includes(opts.contentRating)) {
+            fail('✖ --content-rating must be everyone, teen, or mature');
+        }
+        if (!['private', 'unlisted', 'public'].includes(opts.visibility)) {
+            fail('✖ --visibility must be private, unlisted, or public');
+        }
+        const { loadSceneV2Package } = await Promise.resolve().then(() => __importStar(require('./sceneImport/packageReader')));
+        const { createSceneV2DryRunReceipt, publishSceneV2World } = await Promise.resolve().then(() => __importStar(require('./sceneImport/publish')));
+        const input = await loadSceneV2Package({
+            packageDir: (0, node_path_1.resolve)(packageDir),
+            worldId,
+            profileId: opts.profile,
+            contentRating: opts.contentRating,
+            supportsMobile: opts.supportsMobile,
+            requiresAuth: opts.requiresAuth,
+            visibility: opts.visibility,
+        });
+        if (!opts.publish) {
+            console.log(JSON.stringify(createSceneV2DryRunReceipt(input), null, 2));
+            return;
+        }
+        // `--visibility private` gates the WORLD ROW, not the bytes: published
+        // Scene resources are content-addressed objects on the public worlds
+        // bucket, so a private World is unlisted, not confidential. Say so
+        // rather than letting the flag name imply a guarantee the backend does
+        // not make yet.
+        const creds = requireAuth();
+        const receipt = await publishSceneV2World(lib_1.HelixApi.forCredentials(creds), input);
+        console.log(JSON.stringify({
+            schemaVersion: 'helix.scene-v2-world-build/1',
+            dryRun: false,
+            published: true,
+            apiUrl: creds.apiUrl,
+            worldId: input.worldId,
+            profileId: input.profileId,
+            visibility: input.visibility,
+            contentDelivery: 'public-content-addressed; --visibility gates World discovery only',
+            receipt,
+        }, null, 2));
+    }
+    catch (err) {
+        fail(err instanceof lib_1.ApiError ? err.render() : `✖ ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 addBundledAudit(world, {
     name: 'audit',
     description: 'Run the blocking composition, bundle-budget, loader, and provenance audit',