@helix3/helix-cli 0.1.13-helix3.76 → 0.1.13-helix3.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helix3/helix-cli",
-  "version": "0.1.13-helix3.76",
+  "version": "0.1.13-helix3.78",
   "description": "helix — the HELIX creator CLI: scaffold, validate, and publish Instant Worlds",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",

package/vendor/audits/source-audit.mjs

@@ -37,6 +37,7 @@ const has = (n) => argv.includes(`--${n}`);
 const SRC = arg('src', 'src');
 const DIST = arg('dist', 'dist');
 const MANIFEST = arg('manifest', 'public/helix.json');
+const CONTROLS = arg('controls', 'public/helix.controls.json');
 const CONSOLE_LOG = arg('console');
 const PERF_JSON = arg('perf');
 const GENRE = arg('genre', 'none');
@@ -408,11 +409,11 @@ if (required === undefined) {
   );
 }
 
-// ── 6. mobile — supportsMobile is a claim about controls that must exist ────────────
-// humanoid-character carries a `touch` widget hint on every standard action, but its own source
-// marks the touch HUD "pre-HUD v1" — NOTHING renders those hints. A world that declares
-// supportsMobile and wires no virtual input ships a phone build where the player can look but
-// cannot move or jump, and the catalog repeats the claim.
+// ── 6. mobile — supportsMobile is a claim backed by a durable controls contract ─────
+// The contract file is copied into dist by ordinary Vite builds and the platform default exposes
+// the same version marker on its generated DOM. That is a much stronger seam than guessing from a
+// setVirtual* source regex, while still allowing an equivalent custom controller. Static validation
+// cannot prove touch effects, so G6/G7 must still exercise the built world at a phone viewport.
 let manifest = null;
 if (existsSync(MANIFEST)) {
   try { manifest = JSON.parse(readFileSync(MANIFEST, 'utf8')); }
@@ -420,19 +421,37 @@ if (existsSync(MANIFEST)) {
 } else {
   warn('manifest.absent', `${MANIFEST} not found — the supportsMobile / touch-control gate measured NOTHING`);
 }
-const virtualInput = /\.setVirtualVec2\s*\(|\.setVirtualButton\s*\(/.test(allText);
+let controls = null;
+if (existsSync(CONTROLS)) {
+  try { controls = JSON.parse(readFileSync(CONTROLS, 'utf8')); }
+  catch (err) { fail('mobile.controls-unparseable', `${CONTROLS}: ${err.message}`); }
+}
+const requiredMobileCapabilities = ['move', 'look', 'zoom', 'jump'];
+function validControlsContract(value) {
+  return value?.version === 1 &&
+    (value.provider === '@helix/humanoid-character' || value.provider === 'custom') &&
+    Array.isArray(value.capabilities) &&
+    requiredMobileCapabilities.every((capability) => value.capabilities.includes(capability));
+}
 if (manifest) {
   if (manifest.supportsMobile === true) {
-    if (!virtualInput) {
+    if (!validControlsContract(controls)) {
       fail(
         'mobile.no-touch-controls',
-        `${MANIFEST} declares supportsMobile: true but the source never calls input.setVirtualVec2 / input.setVirtualButton. The platform renders NO touch HUD from the action \`touch\` hints (pre-HUD v1), so a phone player can look but cannot move or jump. Implement on-screen controls against the virtual-input API and verify them at a phone viewport, or set supportsMobile: false.`,
+        `${MANIFEST} declares supportsMobile: true but ${CONTROLS} does not declare the v1 move/look/zoom/jump contract. Mount createMobileControls(input, { surface }) or provide an equivalent custom controller, ship the contract file, and verify it at a phone viewport.`,
       );
     } else {
-      info('mobile.touch-controls', 'supportsMobile: true and virtual input (setVirtualVec2/setVirtualButton) is wired — G6/G7 must still prove it drives the character at a phone viewport');
+      const builtContract = join(DIST, basename(CONTROLS));
+      if (!existsSync(builtContract)) {
+        fail('mobile.controls-not-shipped', `${CONTROLS} is valid but ${builtContract} is absent — the published bundle cannot prove which touch system it carries`);
+      } else if (controls.provider === '@helix/humanoid-character' && !/\bcreateMobileControls\s*\(/.test(allText)) {
+        fail('mobile.default-not-mounted', `${CONTROLS} claims the platform provider but source never mounts createMobileControls(input, { surface }). Use provider: "custom" only for a real equivalent implementation.`);
+      } else {
+        info('mobile.controls-contract', `supportsMobile: true · ${controls.provider} · ${controls.capabilities.join('/')} · contract shipped in ${builtContract}. G6/G7 must still prove touch effects at phone viewports.`);
+      }
     }
   } else {
-    info('mobile.declared', `supportsMobile: ${manifest.supportsMobile ?? '(unset)'}${virtualInput ? ' — touch controls ARE wired; declare true once you have verified them on a phone viewport' : ''}`);
+    info('mobile.declared', `supportsMobile: ${manifest.supportsMobile ?? '(unset)'}${validControlsContract(controls) ? ' — a valid touch contract is present; declare true once phone QA passes' : ''}`);
   }
 }