@helix3/helix-cli 0.1.4-helix3.24

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hypersonic Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# @hypersoniclabs/helix-cli
+
+`helix` — the **HELIX creator CLI**: scaffold, validate, and publish Instant Worlds to the HELIX
+backend. It shares bundle validation with the server via `@hypersoniclabs/helix-manifest`, so "validate passed but
+publish failed" can't happen for contract reasons.
+
+## Install
+
+```bash
+npm install -g @hypersoniclabs/helix-cli
+```
+
+## Authentication
+
+`helix login` opens your browser to the website's `/cli-login` page; you sign in there and the CLI
+captures a **client token** via a one-shot loopback redirect. For CI/headless, pass a token directly:
+`helix login --token <token>` (mint one in the **Creator Hub** → *Settings → Client Tokens*).
+
+The token is stored in `~/.helix/credentials.json` (mode `600`). It's sent as
+`Authorization: Bearer <token>` on publish calls. `helix login` validates it against
+`GET /api/v1/users/me` before saving and reads the token's `exp` so the CLI knows when it lapses.
+
+> **The backend & website default to the build's environment:** the published `@hypersoniclabs/*`
+> CLI targets production (`api.helixgame.com` / `helixgame.com`); the staging `@helixdev/*` CLI targets
+> the staging backend (`helix-backend-staging.up.railway.app`) + staging website (`next.helixgame.com`).
+> Override per run with `--api-url`/`HELIX_API_URL` and `--web-url`/`HELIX_WEB_URL` (e.g. a local/dev backend).
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `helix login [--api-url <url>] [--web-url <url>] [--token <t>] [--no-browser]` | Sign in via the browser (`/cli-login`), or `--token` for CI/headless. Stores the client token. |
+| `helix logout` | Remove the stored token. |
+| `helix whoami` | Show current login status. |
+| `helix init <dir>` | Scaffold a minimal Three.js world (`helix.json` + `index.html` + `main.js`). |
+| `helix install [--update]` | Resolve a world's `systems`/`abilities` pins (a v0.2 **or v0.3** manifest) → materialize the modules, the `three` import map, and `helix.runtime.ts`. |
+| `helix validate [dir]` | Validate a bundle locally — the exact rules the server enforces. |
+| `helix publish [dir]` | Validate → resolve/create the world → upload files → finalize → print the play URL. |
+| `helix list` | List your worlds. |
+| `helix doctor [--project <dir>]` | Print the environment + whether the @helix toolchain (CLI/MCP/SDK/manifest) is current. |
+
+## Publish flow
+
+`helix publish` maps directly onto the backend's Instant World API:
+
+1. `checkBundle` validates `helix.json` + files via `@hypersoniclabs/helix-manifest`.
+2. `GET /api/v1/instant-worlds/me` → reuse the world with the manifest's slug, else
+   `POST /api/v1/instant-worlds`.
+3. `POST /api/v1/instant-worlds/:id/builds` → presigned upload tickets.
+4. Files PUT directly to storage (6 concurrent), content-type/length bound to each ticket.
+5. `POST /api/v1/instant-worlds/:id/builds/:buildId/finalize` → byte-exact verify, activate, publish.
+6. `GET /api/v1/instant-worlds/:slug` → the play URL.
+
+The programmatic surface (`publishWorld`, `checkBundle`, `whoAmI`, …) is exported from the package
+main, so an MCP server can drive the exact same code paths an agent would.
+
+## Develop
+
+```bash
+npm install
+npm test       # jest
+npm run build  # tsc → dist/ (bin: dist/index.js)
+npm run lint
+```

package/dist/ability.d.ts

@@ -0,0 +1,73 @@
+export type ManifestIssue = {
+    path: string;
+    message: string;
+};
+export type ParsedSemver = {
+    major: number;
+    minor: number;
+    patch: number;
+    prerelease: string[];
+};
+export type AbilityValidator = {
+    validateAbilityManifest(value: unknown): ManifestIssue[];
+    /** Present on the real vendored artifact — enables the install-time system-pin check (gate 2). */
+    satisfiesSystemPin?(systemVersion: string, range: string): boolean;
+    /** Frozen semver primitives — the single source of `^`/`~` + prerelease ordering (reused by resolvePins). */
+    parseSemver?(version: string): ParsedSemver | null;
+    compareSemver?(a: ParsedSemver, b: ParsedSemver): number;
+    SYSTEM_IDENTITY?: {
+        id: string;
+        version: string;
+        skeleton: string;
+    };
+};
+export type InstalledIndexValidator = {
+    validateInstalledIndex(value: unknown): ManifestIssue[];
+    isResolvedEntry(entry: Record<string, unknown>): boolean;
+};
+export type AbilityManifestLike = {
+    id: string;
+    version: string;
+    title: string;
+    system: {
+        id: string;
+        version: string;
+        skeleton: string;
+    };
+    activation: {
+        mode: string;
+    };
+    entry: string;
+    configSchema: string;
+    clips?: {
+        name: string;
+        src: string;
+    }[];
+};
+export declare function loadVendoredValidator(): Promise<AbilityValidator>;
+export declare function loadInstalledIndexValidator(): Promise<InstalledIndexValidator>;
+export type AbilityBundleCheck = {
+    manifest: AbilityManifestLike | null;
+    errors: string[];
+};
+/** True when an ability's built entry has three.js bundled in rather than left external. */
+export declare function bundlesThree(entrySource: string): boolean;
+/** Validates an ability bundle directory: ability.json against the frozen contract + referenced files exist. */
+export declare function checkAbilityBundle(root: string, validator: AbilityValidator): AbilityBundleCheck;
+export declare const MODULES_DIR = "helix_modules";
+export declare const INSTALLED_INDEX = "installed.json";
+export type InstallResult = {
+    id: string;
+    version: string;
+    /** Bundle path relative to the index (== the ability id). */
+    path: string;
+    /** Total entries in installed.json after this install. */
+    installedCount: number;
+};
+/**
+ * `helix install <bundle> --first-party` (a.k.a. `--local`): the FIRST-PARTY whole-bundle copy —
+ * validates, copies the bundle (code AND clips) into `<worldDir>/helix_modules/<id>/`, and upserts a
+ * v1 local `installed.json` entry. Used by the engine devs to test co-located assets; consumer
+ * worlds use `helix install` (no path) which is code-only with assets streaming from the CDN.
+ */
+export declare function installLocalAbility(bundleDir: string, worldDir: string, validator: AbilityValidator, indexValidator: InstalledIndexValidator): InstallResult;

package/dist/ability.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSTALLED_INDEX = exports.MODULES_DIR = void 0;
+exports.loadVendoredValidator = loadVendoredValidator;
+exports.loadInstalledIndexValidator = loadInstalledIndexValidator;
+exports.bundlesThree = bundlesThree;
+exports.checkAbilityBundle = checkAbilityBundle;
+exports.installLocalAbility = installLocalAbility;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+// The vendor file is ESM; this package compiles to CommonJS, where tsc downlevels `import()` to
+// `require()` — which cannot load ESM. The Function indirection keeps the native dynamic import.
+const dynamicImport = new Function('specifier', 'return import(specifier)');
+async function loadVendoredValidator() {
+    const url = (0, node_url_1.pathToFileURL)((0, node_path_1.join)(__dirname, '..', 'vendor', 'ability-manifest.mjs')).href;
+    return (await dynamicImport(url));
+}
+async function loadInstalledIndexValidator() {
+    const url = (0, node_url_1.pathToFileURL)((0, node_path_1.join)(__dirname, '..', 'vendor', 'installed-index.mjs')).href;
+    return (await dynamicImport(url));
+}
+// three's bundled source carries its REVISION constant (`const REVISION = '172'`) and core class
+// declarations; an external bare import (`import ... from 'three'`) produces only property access
+// against the namespace (`THREE.Vector3`), never these definition forms. Either signal therefore
+// means three got inlined — which forks the instance and silently breaks instanceof across the host.
+const THREE_REVISION = /\bREVISION\s*=\s*['"]\d+['"]/;
+const THREE_CORE_CLASS = /\bclass\s+(Object3D|BufferGeometry|Matrix4|Vector3|Quaternion|Euler|PerspectiveCamera|WebGLRenderer|Material)\b/g;
+/** True when an ability's built entry has three.js bundled in rather than left external. */
+function bundlesThree(entrySource) {
+    if (THREE_REVISION.test(entrySource))
+        return true;
+    const classes = new Set(entrySource.match(THREE_CORE_CLASS) ?? []);
+    return classes.size >= 2;
+}
+/** Validates an ability bundle directory: ability.json against the frozen contract + referenced files exist. */
+function checkAbilityBundle(root, validator) {
+    const manifestPath = (0, node_path_1.join)(root, 'ability.json');
+    if (!(0, node_fs_1.existsSync)(manifestPath)) {
+        const hint = (0, node_fs_1.existsSync)((0, node_path_1.join)(root, 'helix.json'))
+            ? 'this looks like a WORLD bundle (helix.json) — use `helix validate`'
+            : 'is this the built bundle directory (dist/)?';
+        return { manifest: null, errors: [`no ability.json at the bundle root — ${hint}`] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse((0, node_fs_1.readFileSync)(manifestPath, 'utf8'));
+    }
+    catch (err) {
+        return { manifest: null, errors: [`ability.json is not valid JSON: ${err instanceof Error ? err.message : err}`] };
+    }
+    const issues = validator.validateAbilityManifest(parsed);
+    if (issues.length) {
+        return { manifest: null, errors: issues.map((i) => `ability.json ${i.path === '' ? '(root)' : i.path}: ${i.message}`) };
+    }
+    const manifest = parsed;
+    const errors = [];
+    // System-pin check against the vendored validator's own system identity (gate 2: refused at
+    // install, not just at load) — the artifact banner records which system version it came from.
+    const system = validator.SYSTEM_IDENTITY;
+    if (system !== undefined && validator.satisfiesSystemPin !== undefined) {
+        if (manifest.system.id !== system.id) {
+            errors.push(`system.id '${manifest.system.id}' does not match the running system '${system.id}'`);
+        }
+        else if (!validator.satisfiesSystemPin(system.version, manifest.system.version)) {
+            errors.push(`system.version '${manifest.system.version}' is not satisfied by the system version ${system.version}`);
+        }
+        else if (manifest.system.skeleton !== system.skeleton) {
+            errors.push(`system.skeleton '${manifest.system.skeleton}' does not match the running skeleton standard '${system.skeleton}'`);
+        }
+    }
+    const referenced = [manifest.entry, manifest.configSchema, ...(manifest.clips ?? []).map((c) => c.src)];
+    for (const rel of referenced) {
+        if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(root, rel)))
+            errors.push(`referenced file missing from the bundle: ${rel}`);
+    }
+    // Single-instance invariant: the world supplies the one shared three; the entry must import it,
+    // not ship its own copy. Build the ability with `--external three`.
+    const entryPath = (0, node_path_1.join)(root, manifest.entry);
+    if ((0, node_fs_1.existsSync)(entryPath) && bundlesThree((0, node_fs_1.readFileSync)(entryPath, 'utf8'))) {
+        errors.push(`${manifest.entry} inlines three.js — rebuild the ability with \`--external three\` so the world supplies the single shared instance`);
+    }
+    return { manifest: errors.length ? null : manifest, errors };
+}
+exports.MODULES_DIR = 'helix_modules';
+exports.INSTALLED_INDEX = 'installed.json';
+/**
+ * `helix install <bundle> --first-party` (a.k.a. `--local`): the FIRST-PARTY whole-bundle copy —
+ * validates, copies the bundle (code AND clips) into `<worldDir>/helix_modules/<id>/`, and upserts a
+ * v1 local `installed.json` entry. Used by the engine devs to test co-located assets; consumer
+ * worlds use `helix install` (no path) which is code-only with assets streaming from the CDN.
+ */
+function installLocalAbility(bundleDir, worldDir, validator, indexValidator) {
+    const check = checkAbilityBundle(bundleDir, validator);
+    if (check.errors.length || check.manifest === null) {
+        throw new Error(`bundle refused:\n${check.errors.map((e) => `  - ${e}`).join('\n')}`);
+    }
+    const { id, version } = check.manifest;
+    const modulesDir = (0, node_path_1.join)(worldDir, exports.MODULES_DIR);
+    const indexPath = (0, node_path_1.join)(modulesDir, exports.INSTALLED_INDEX);
+    let index = [];
+    if ((0, node_fs_1.existsSync)(indexPath)) {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(indexPath, 'utf8'));
+        const issues = indexValidator.validateInstalledIndex(parsed);
+        if (issues.length) {
+            throw new Error(`existing ${exports.INSTALLED_INDEX} is invalid (delete it to regenerate):\n${issues.map((i) => `  ${i.path}: ${i.message}`).join('\n')}`);
+        }
+        index = parsed;
+    }
+    const target = (0, node_path_1.join)(modulesDir, id);
+    (0, node_fs_1.rmSync)(target, { recursive: true, force: true });
+    (0, node_fs_1.mkdirSync)(target, { recursive: true });
+    (0, node_fs_1.cpSync)(bundleDir, target, { recursive: true });
+    index = index.filter((entry) => entry.id !== id);
+    index.push({ id, version, path: id });
+    index.sort((a, b) => a.id.localeCompare(b.id));
+    (0, node_fs_1.writeFileSync)(indexPath, `${JSON.stringify(index, null, 2)}\n`);
+    return { id, version, path: id, installedCount: index.length };
+}
+//# sourceMappingURL=ability.js.map

package/dist/ability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.js","sourceRoot":"","sources":["../src/ability.ts"],"names":[],"mappings":";;;AA+CA,sDAGC;AAED,kEAGC;AAeD,oCAIC;AAGD,gDAkDC;AAoBD,kDA8BC;AAjLD,qCAA6F;AAC7F,yCAAiC;AACjC,uCAAyC;AAyCzC,gGAAgG;AAChG,iGAAiG;AACjG,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAA4C,CAAC;AAEhH,KAAK,UAAU,qBAAqB;IACzC,MAAM,GAAG,GAAG,IAAA,wBAAa,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAqB,CAAC;AACxD,CAAC;AAEM,KAAK,UAAU,2BAA2B;IAC/C,MAAM,GAAG,GAAG,IAAA,wBAAa,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAA4B,CAAC;AAC/D,CAAC;AAOD,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,qGAAqG;AACrG,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,gBAAgB,GAAG,kHAAkH,CAAC;AAE5I,4FAA4F;AAC5F,SAAgB,YAAY,CAAC,WAAmB;IAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,gHAAgH;AAChH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,SAA2B;IAC1E,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC/C,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,6CAA6C,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,wCAAwC,IAAI,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IACrH,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IAED,MAAM,QAAQ,GAAG,MAA6B,CAAC;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,4FAA4F;IAC5F,8FAA8F;IAC9F,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,MAAM,CAAC,EAAE,wCAAwC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACpG,CAAC;aAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,MAAM,CAAC,OAAO,4CAA4C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACtH,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,MAAM,CAAC,QAAQ,mDAAmD,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QACjI,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,gGAAgG;IAChG,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,IAAI,YAAY,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,oHAAoH,CAAC,CAAC;IACrJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC/D,CAAC;AAEY,QAAA,WAAW,GAAG,eAAe,CAAC;AAC9B,QAAA,eAAe,GAAG,gBAAgB,CAAC;AAWhD;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,SAAiB,EAAE,QAAgB,EAAE,SAA2B,EAAE,cAAuC;IAC3I,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAEvC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,mBAAW,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,uBAAe,CAAC,CAAC;IACpD,IAAI,KAAK,GAAoD,EAAE,CAAC;IAChE,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAY,CAAC;QACtE,MAAM,MAAM,GAAG,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,YAAY,uBAAe,2CAA2C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,KAAK,GAAG,MAAsB,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAA,mBAAS,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,IAAA,gBAAM,EAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAA,uBAAa,EAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAEhE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC"}

package/dist/api.d.ts

@@ -0,0 +1,24 @@
+import { CliCredentials } from './config';
+type NestErrorBody = {
+    statusCode?: number;
+    message?: string | string[];
+    error?: string;
+};
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly body: NestErrorBody;
+    constructor(status: number, body: NestErrorBody);
+    private static messages;
+    render(): string;
+}
+export declare class HelixApi {
+    private readonly baseUrl;
+    private token;
+    constructor(baseUrl: string, token?: string | null);
+    setToken(token: string): void;
+    request<T>(method: string, path: string, body?: unknown): Promise<T>;
+    requestItem<T>(method: string, path: string, body?: unknown): Promise<T>;
+    static forCredentials(creds: CliCredentials): HelixApi;
+}
+export declare function uploadToTicket(url: string, body: Buffer, contentType: string, cacheControl?: string): Promise<void>;
+export {};

package/dist/api.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HelixApi = exports.ApiError = void 0;
+exports.uploadToTicket = uploadToTicket;
+class ApiError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(ApiError.messages(body).join('; ') || `HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+    }
+    static messages(body) {
+        if (Array.isArray(body.message))
+            return body.message;
+        if (typeof body.message === 'string')
+            return [body.message];
+        return [];
+    }
+    // Rendered for terminal humans.
+    render() {
+        const heading = this.body.error ?? 'Error';
+        const lines = [`✖ ${heading} (${this.status})`];
+        for (const msg of ApiError.messages(this.body))
+            lines.push(`  - ${msg}`);
+        return lines.join('\n');
+    }
+}
+exports.ApiError = ApiError;
+class HelixApi {
+    baseUrl;
+    token;
+    constructor(baseUrl, token = null) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+    }
+    setToken(token) {
+        this.token = token;
+    }
+    async request(method, path, body) {
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            method,
+            headers: {
+                'content-type': 'application/json',
+                ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const problem = (await res.json().catch(() => ({})));
+            throw new ApiError(res.status, problem);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+    // Convenience for endpoints that return a SingleResponseDto ({ item: T }).
+    async requestItem(method, path, body) {
+        const envelope = await this.request(method, path, body);
+        return envelope.item;
+    }
+    static forCredentials(creds) {
+        return new HelixApi(creds.apiUrl, creds.token);
+    }
+}
+exports.HelixApi = HelixApi;
+// Uploads a file body to a presigned URL. Content-Type (and, for package
+// uploads, Cache-Control) are part of the signature, so the client must echo
+// them exactly or R2 rejects the PUT with a signature mismatch.
+async function uploadToTicket(url, body, contentType, cacheControl) {
+    const res = await fetch(url, {
+        method: 'PUT',
+        body: new Uint8Array(body),
+        headers: {
+            'content-type': contentType,
+            ...(cacheControl ? { 'cache-control': cacheControl } : {}),
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`upload failed (${res.status}): ${await res.text().catch(() => '')}`);
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":";;;AA4EA,wCAmBC;AAnFD,MAAa,QAAS,SAAQ,KAAK;IAEtB;IACA;IAFX,YACW,MAAc,EACd,IAAmB;QAE5B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,EAAE,CAAC,CAAC;QAHrD,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAe;IAG9B,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,IAAmB;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACrD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gCAAgC;IAChC,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,KAAK,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AArBD,4BAqBC;AAED,MAAa,QAAQ;IAEA;IACT;IAFV,YACmB,OAAe,EACxB,QAAuB,IAAI;QADlB,YAAO,GAAP,OAAO,CAAQ;QACxB,UAAK,GAAL,KAAK,CAAsB;IAClC,CAAC;IAEJ,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAkB,CAAC;YACtE,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,WAAW,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkB,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,KAAqB;QACzC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;CACF;AApCD,4BAoCC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,gEAAgE;AACzD,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,IAAY,EACZ,WAAmB,EACnB,YAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/browserLogin.d.ts

@@ -0,0 +1,22 @@
+export type BrowserLoginResult = {
+    token: string;
+};
+/** A human-readable default token nickname, e.g. "HELIX CLI (my-laptop)". */
+export declare function defaultClientTokenName(): string;
+/**
+ * Derive the website URL from the API URL: `https://api.helixgame.com` →
+ * `https://helixgame.com`. For local dev (e.g. backend on localhost) the host
+ * isn't an `api.` subdomain of the site, so pass `--web-url` explicitly.
+ */
+export declare function deriveWebUrl(apiUrl: string): string;
+/**
+ * Run the loopback login flow. Resolves with the captured client token, or
+ * rejects on timeout / state mismatch / a site-reported error.
+ */
+export declare function browserLogin(opts: {
+    webUrl: string;
+    name: string;
+    openBrowser?: boolean;
+    timeoutMs?: number;
+    onUrl?: (url: string) => void;
+}): Promise<BrowserLoginResult>;

package/dist/browserLogin.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultClientTokenName = defaultClientTokenName;
+exports.deriveWebUrl = deriveWebUrl;
+exports.browserLogin = browserLogin;
+// Browser-based login (OAuth-style loopback flow), mirroring how the HELIX
+// desktop launcher authenticates via the website. Instead of pasting a token,
+// `helix login` opens the browser to the HELIX website's /cli-login page; once
+// the user is signed in there, the site mints a client token and redirects the
+// browser to a one-shot loopback server this process runs on 127.0.0.1, which
+// captures the token. A random `state` ties the redirect to this process.
+//
+// Headless/CI keeps using `helix login --token <client-token>` (no browser).
+const node_http_1 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_os_1 = require("node:os");
+const page = (title, body) => `<!doctype html><html lang="en"><head><meta charset="utf-8">` +
+    `<meta name="viewport" content="width=device-width,initial-scale=1">` +
+    `<title>${title}</title><style>` +
+    `body{font-family:system-ui,-apple-system,Segoe UI,sans-serif;background:#0a0a0a;color:#ededed;` +
+    `display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}` +
+    `.card{max-width:420px;text-align:center;padding:40px;border:1px solid #222;border-radius:12px;background:#111}` +
+    `h1{font-size:20px;text-transform:uppercase;letter-spacing:.04em;margin:0 0 12px}` +
+    `p{color:#9a9a9a;font-size:14px;line-height:1.6;margin:0}` +
+    `</style></head><body><div class="card"><h1>${title}</h1><p>${body}</p></div></body></html>`;
+const SUCCESS_HTML = page('Signed in to HELIX', "You're logged in to the HELIX CLI. You can close this tab and return to your terminal.");
+const errorHtml = (msg) => page('Sign-in failed', msg);
+/** A human-readable default token nickname, e.g. "HELIX CLI (my-laptop)". */
+function defaultClientTokenName() {
+    let host = 'cli';
+    try {
+        host = (0, node_os_1.hostname)() || 'cli';
+    }
+    catch {
+        // hostname() can throw on some sandboxes — fall back to a generic name.
+    }
+    return `HELIX CLI (${host})`;
+}
+/**
+ * Derive the website URL from the API URL: `https://api.helixgame.com` →
+ * `https://helixgame.com`. For local dev (e.g. backend on localhost) the host
+ * isn't an `api.` subdomain of the site, so pass `--web-url` explicitly.
+ */
+function deriveWebUrl(apiUrl) {
+    try {
+        const u = new URL(apiUrl);
+        if (u.hostname.startsWith('api.'))
+            u.hostname = u.hostname.slice('api.'.length);
+        return u.origin;
+    }
+    catch {
+        return apiUrl.replace(/\/$/, '');
+    }
+}
+function openInBrowser(url) {
+    try {
+        if (process.platform === 'win32') {
+            // NOT `cmd /c start` — cmd treats `&` (and `(`/`)`) in the URL's query
+            // string as command separators and truncates it. rundll32 hands the full
+            // URL to the shell's protocol handler with no cmd re-parsing.
+            (0, node_child_process_1.spawn)('rundll32', ['url.dll,FileProtocolHandler', url], {
+                stdio: 'ignore',
+                detached: true,
+            }).unref();
+        }
+        else if (process.platform === 'darwin') {
+            (0, node_child_process_1.spawn)('open', [url], { stdio: 'ignore', detached: true }).unref();
+        }
+        else {
+            (0, node_child_process_1.spawn)('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+        }
+    }
+    catch {
+        // Best-effort — the caller also prints the URL for manual copy.
+    }
+}
+/**
+ * Run the loopback login flow. Resolves with the captured client token, or
+ * rejects on timeout / state mismatch / a site-reported error.
+ */
+function browserLogin(opts) {
+    const state = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000;
+    return new Promise((resolve, reject) => {
+        let timer;
+        const server = (0, node_http_1.createServer)((req, res) => {
+            const reqUrl = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (reqUrl.pathname !== '/callback') {
+                res.statusCode = 404;
+                res.end('Not found');
+                return;
+            }
+            const settle = (status, html) => {
+                res.statusCode = status;
+                res.setHeader('content-type', 'text/html; charset=utf-8');
+                res.end(html);
+                clearTimeout(timer);
+                server.close();
+            };
+            const error = reqUrl.searchParams.get('error');
+            const token = reqUrl.searchParams.get('token');
+            const gotState = reqUrl.searchParams.get('state');
+            if (error) {
+                settle(400, errorHtml(`The website reported an error: ${error}.`));
+                reject(new Error(`login failed: ${error}`));
+                return;
+            }
+            if (!gotState || gotState !== state) {
+                settle(400, errorHtml('State mismatch — the response did not match this login attempt. Aborted.'));
+                reject(new Error('state mismatch (possible CSRF) — aborted'));
+                return;
+            }
+            if (!token) {
+                settle(400, errorHtml('No token was returned by the website.'));
+                reject(new Error('no token in callback'));
+                return;
+            }
+            settle(200, SUCCESS_HTML);
+            resolve({ token });
+        });
+        timer = setTimeout(() => {
+            server.close();
+            reject(new Error('timed out waiting for the browser login (5 minutes)'));
+        }, timeoutMs);
+        server.on('error', (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+        // Bind loopback-only on an ephemeral port, then build the URL with the port.
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            if (!port) {
+                clearTimeout(timer);
+                server.close();
+                reject(new Error('could not bind a loopback port for login'));
+                return;
+            }
+            const loginUrl = `${opts.webUrl.replace(/\/$/, '')}/cli-login` +
+                `?port=${port}&state=${state}&name=${encodeURIComponent(opts.name)}`;
+            opts.onUrl?.(loginUrl);
+            if (opts.openBrowser !== false)
+                openInBrowser(loginUrl);
+        });
+    });
+}
+//# sourceMappingURL=browserLogin.js.map

package/dist/browserLogin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserLogin.js","sourceRoot":"","sources":["../src/browserLogin.ts"],"names":[],"mappings":";;AAiCA,wDAQC;AAOD,oCAQC;AA0BD,oCA8EC;AAhKD,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,yCAAyC;AACzC,6CAA0C;AAC1C,2DAA2C;AAC3C,qCAAmC;AAInC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CACnD,6DAA6D;IAC7D,qEAAqE;IACrE,UAAU,KAAK,iBAAiB;IAChC,gGAAgG;IAChG,mFAAmF;IACnF,gHAAgH;IAChH,kFAAkF;IAClF,0DAA0D;IAC1D,8CAA8C,KAAK,WAAW,IAAI,0BAA0B,CAAC;AAE/F,MAAM,YAAY,GAAG,IAAI,CACvB,oBAAoB,EACpB,wFAAwF,CACzF,CAAC;AACF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAEvE,6EAA6E;AAC7E,SAAgB,sBAAsB;IACpC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,kBAAQ,GAAE,IAAI,KAAK,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IACD,OAAO,cAAc,IAAI,GAAG,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,uEAAuE;YACvE,yEAAyE;YACzE,8DAA8D;YAC9D,IAAA,0BAAK,EAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE;gBACtD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAA,0BAAK,EAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,IAAA,0BAAK,EAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,IAM5B;IACC,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,IAAI,KAAoC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;gBAC9C,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,kCAAkC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACnE,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,0EAA0E,CAAC,CAAC,CAAC;gBACnG,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAChE,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC1B,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;QAC3E,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACZ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY;gBAC7C,SAAS,IAAI,UAAU,KAAK,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK;gBAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/bundle.d.ts

@@ -0,0 +1,15 @@
+import { NormalizedHelixManifest } from '@hypersoniclabs/helix-manifest';
+export type BundleFile = {
+    path: string;
+    size: number;
+    absolutePath: string;
+    content?: Buffer;
+};
+export type BundleCheck = {
+    manifest: NormalizedHelixManifest | null;
+    files: BundleFile[];
+    errors: string[];
+};
+export declare function checkBundle(root: string): BundleCheck;
+export declare const MULTIPLAYER_CONFIG_FILENAME = "multiplayer.json";
+export declare function multiplayerConfigBundleFile(root: string, manifest: NormalizedHelixManifest): BundleFile | null;