@homie-rocks/studio 0.21.0 → 0.22.0

package/lib/asset-import.mjs

@@ -0,0 +1,136 @@
+/**
+ * A MODEL FILE INTO A GAME: the person's own (imported), or one a provider generated on their account (the models
+ * skill's image-to-3D). `homie-studio assets add <id> --file <model> --license <kind>`.
+ *
+ * The file is checked first (assets/safety.mjs, the import limits: a self-contained GLB, or a .glb/.gltf whose
+ * pictures sit beside it; no address anywhere in it; nothing over 64 MB, no buffer declaring more), then made
+ * phone-sized (lib/optimise.mjs: its tier's triangles and picture size, pivot at the bottom centre, scaled to its card's
+ * height), written to games/<id>/public/models/<asset>.glb, and recorded with its licence and every step that made it
+ * (lib/asset-manifest.mjs). The raw file is kept beside its art job in art/<slug>/raw/ (git-ignored; the studio's R2 by
+ * `media move` once it has storage): it is never shipped and never committed.
+ */
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, join, relative, resolve } from 'node:path';
+import { LIMITS, checkGlb } from '../assets/safety.mjs';
+import { ASSET_ID, KINDS, licenseInfo, readManifest, recordAsset } from './asset-manifest.mjs';
+import { readDecisions } from './decisions.mjs';
+import { budgetsFor } from './asset-check.mjs';
+
+const TIER_OF_KIND = { character: 'hero', creature: 'npc', prop: 'prop', kit: 'kit', environment: 'kit' };
+
+/** Refuse what must never come in, before anything reads it as a model: the safety rules at the import limits. */
+export function screenImport(path) {
+  if (!existsSync(path)) throw new Error(`no file at ${path}`);
+  const size = statSync(path).size;
+  if (size > LIMITS.import.bytes) throw new Error(`refused ${basename(path)}: ${Math.round(size / 1024 / 1024)} MB is over the ${LIMITS.import.bytes / 1024 / 1024} MB a model may be when it comes in`);
+  const bytes = readFileSync(path);
+  if (bytes.subarray(0, 4).toString('latin1') === 'glTF') {
+    const safe = checkGlb(bytes, LIMITS.import);
+    // A pack's .glb may name pictures that sit beside it ("Textures/colormap.png"): the optimiser reads those from the
+    // file's own folder. Anything with a scheme (http:, file:), an absolute path or ".." is an external URI: refused.
+    const sibling = (p) => { const m = /is loaded from an address \(([^)]*)\)/.exec(p); return Boolean(m) && !/^[a-z][a-z0-9+.-]*:|^\/|(^|[\\/])\.\.([\\/]|$)/i.test(m[1]); };
+    const hard = safe.problems.filter((p) => !sibling(p));
+    if (hard.length) throw new Error(`refused ${basename(path)}: ${hard.slice(0, 4).join('; ')}`);
+    return { bytes: size, glb: true };
+  }
+  if (/\.gltf$/i.test(path)) {
+    let json;
+    try { json = JSON.parse(bytes.toString('utf8')); } catch { throw new Error(`refused ${basename(path)}: not JSON`); }
+    for (const x of [...(json.buffers ?? []), ...(json.images ?? [])]) {
+      const u = String(x?.uri ?? '');
+      if (/^[a-z][a-z0-9+.-]*:/i.test(u) && !/^data:/i.test(u)) throw new Error(`refused ${basename(path)}: it loads ${u.slice(0, 60)} from an address (an external URI)`);
+      if (u.split(/[\\/]/).includes('..')) throw new Error(`refused ${basename(path)}: it reaches outside its folder (${u.slice(0, 60)})`);
+    }
+    for (const b of json.buffers ?? []) if (Number(b?.byteLength) > LIMITS.import.buffer) throw new Error(`refused ${basename(path)}: a buffer declares ${Math.round(Number(b.byteLength) / 1024 / 1024)} MB`);
+    return { bytes: size, glb: false };
+  }
+  if (/\.(fbx|obj|blend|dae|stl|usdz?)$/i.test(path)) throw new Error(`${basename(path)} is not glTF: export it as .glb (Blender: File > Export > glTF 2.0, binary), then add that`);
+  throw new Error(`refused ${basename(path)}: not a glTF file (.glb or .gltf)`);
+}
+
+/**
+ * Import one file. Options: as (asset id), kind, tier, card ("Items/Lantern"), height (m), triangles, texture (px),
+ * license (kind), attribution, owner, notes, route ('imported' or 'generated'), steps (the made.steps before optimising:
+ * the concept and mesh calls with their receipts and prices), slug (the art job's folder).
+ */
+export async function importModel(root, id, file, opts = {}) {
+  const gdir = join(root, 'games', id);
+  if (!existsSync(join(gdir, 'game.json')) && !existsSync(join(gdir, 'CODEX.md'))) throw new Error(`no game "${id}"`);
+  const path = resolve(root, file);
+  const route = opts.route === 'generated' ? 'generated' : 'imported';
+  const licKind = opts.license ?? (route === 'generated' ? 'generated' : null);
+  const info = licenseInfo(licKind);
+  if (!info) throw new Error('say whose it is and under what licence: --license own (the person made it), cc0, cc-by-4.0 (with --attribution), eula:<store>, market:<listing> or other (with --notes)');
+  if (info.attribution && !opts.attribution) throw new Error(`${info.label} needs credit: --attribution "<who made it, where it is from>"`);
+  screenImport(path);
+  const kind = KINDS.includes(opts.kind) ? opts.kind : 'prop';
+  const asId = String(opts.as ?? basename(path).replace(/\.(glb|gltf)$/i, '')).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48);
+  if (!ASSET_ID.test(asId)) throw new Error('give it an id: --as <lowercase-id>');
+  const tier = opts.tier ?? TIER_OF_KIND[kind] ?? 'prop';
+  const doc = readDecisions(root, id);
+  const budgets = budgetsFor(doc);
+  const b = budgets[tier] ?? budgets.prop;
+  // The raw file stays on this computer, beside its art job (git-ignored), unless it is there already.
+  const slug = String(opts.slug ?? asId);
+  const rawDir = join(root, 'art', slug, 'raw');
+  let rawPath = path;
+  if (!path.startsWith(`${resolve(root, 'art')}/`)) {
+    mkdirSync(rawDir, { recursive: true });
+    rawPath = join(rawDir, basename(path));
+    if (resolve(rawPath) !== path) copyFileSync(path, rawPath);
+  }
+  const { optimiseModel, inspectModel } = await import('./optimise.mjs');
+  const out = join(gdir, 'public', 'models', `${asId}.glb`);
+  const r = await optimiseModel(path, { out, triangles: Number(opts.triangles ?? b.triangles), texture: Number(opts.texture ?? b.texturePx), height: opts.height ? Number(opts.height) : null, rigged: Boolean(opts.rigged), metal: doc?.decisions?.['style.render']?.value === 'pbr' });
+  if (!r.ok) throw new Error(`the optimised file is still refused: ${r.warnings.join('; ')}`);
+  const ins = await inspectModel(out);
+  const rel = relative(gdir, out).split('\\').join('/');
+  const steps = [...(Array.isArray(opts.steps) ? opts.steps : []), { what: 'optimise', tool: r.tool, ops: r.ops, from: { bytes: r.rawBytes, sha256: r.rawSha256 } }];
+  const entry = {
+    id: asId, kind, tier, card: opts.card ?? null, route,
+    ...(opts.height ? { heightM: Number(opts.height) } : {}),
+    files: [
+      { role: 'model', path: rel, bytes: r.bytes, sha256: r.sha256 },
+      ...(opts.concept ? [{ role: 'concept', path: relative(gdir, resolve(root, opts.concept)).split('\\').join('/'), public: false }] : []),
+      { role: 'raw', path: relative(gdir, rawPath).split('\\').join('/'), public: false, bytes: r.rawBytes, sha256: r.rawSha256 },
+    ],
+    made: { steps, ...(opts.under ? { under: opts.under } : {}) },
+    license: { kind: info.kind, spdx: info.spdx, owner: opts.owner ?? (route === 'generated' || licKind === 'own' ? 'studio' : null), attribution: opts.attribution ?? null, remix: info.remix, ...(route === 'generated' ? { terms: [{ who: 'fal', url: 'https://fal.ai/terms', read: '2026-10-02', label: 'Commercial use' }], notes: 'Made through fal on the studio\'s own account; fal\'s terms do not assign output ownership expressly (RIGHTS.md).' } : opts.notes ? { notes: opts.notes } : {}) },
+    measured: { tris: r.after.triangles, materials: r.after.materials, drawCalls: r.after.drawCalls, textures: r.after.textures.map((t) => ({ px: t.px, format: t.mimeType, gpuKB: Math.round(t.gpuBytes / 1024) })), bones: r.after.bones, clips: r.after.clips.length, heightM: r.after.heightM, box: r.after.box, glbKB: Math.round(r.bytes / 1024), flat: r.ops.some((o) => o.startsWith('palette')) && !r.after.textures.some((t) => t.slots?.includes('normalTexture')) },
+    review: { state: 'auto' },
+  };
+  const { entry: e, pinned } = recordAsset(root, id, entry);
+  return { ok: true, command: 'assets add', game: id, asset: e.id, route, file: rel, raw: relative(root, rawPath), before: { tris: r.before.triangles, kb: Math.round(r.rawBytes / 1024) }, after: { tris: r.after.triangles, kb: Math.round(r.bytes / 1024), heightM: r.after.heightM }, ops: r.ops, warnings: [...r.warnings, ...(ins.validator?.errors ? [`validator: ${ins.validator.messages[0]}`] : [])], pinned, license: info.label };
+}
+
+
+/**
+ * MADE AGAIN FROM ITS RAW FILE, FREE: `homie-studio assets redo <id> <asset>`. The kept raw file (art/<slug>/raw/) is
+ * checked against its recorded SHA-256 and optimised again under the game's budgets and render style now; the entry
+ * keeps its route, licence, receipts and concept. Only the free steps run again, so the decisions a paid step baked
+ * in (palette, shape, render) stay as they were recorded: an asset stale on those is still stale (a new concept and
+ * mesh fix it); one stale only on its budgets is not.
+ */
+export async function redoModel(root, id, assetId) {
+  const gdir = join(root, 'games', id);
+  const e = readManifest(root, id).assets.find((a) => a.id === assetId);
+  if (!e) throw new Error(`no asset "${assetId}" in games/${id}/assets/manifest.json`);
+  const raw = (e.files ?? []).find((f) => f.role === 'raw');
+  if (!raw) throw new Error(`${assetId} kept no raw file (${e.route === 'library' ? 'a library item: assets add it again' : 'add the file again'})`);
+  const rawPath = resolve(gdir, raw.path);
+  if (!rawPath.startsWith(`${resolve(root, 'art')}/`) || !existsSync(rawPath)) throw new Error(`the raw file ${raw.path} is not on this computer`);
+  const { createHash } = await import('node:crypto');
+  if (raw.sha256 && createHash('sha256').update(readFileSync(rawPath)).digest('hex') !== raw.sha256) throw new Error(`${raw.path} is not the file ${assetId} was made from (its SHA-256 differs)`);
+  const doc = readDecisions(root, id);
+  const under = { ...(e.made?.under ?? {}) };
+  for (const d of ['cast.tiers', 'style.render']) if (d in under && doc?.decisions?.[d]) under[d] = doc.decisions[d].rev;
+  const concept = (e.files ?? []).find((f) => f.role === 'concept');
+  const slug = relative(join(root, 'art'), rawPath).split(/[\\/]/)[0];
+  const r = await importModel(root, id, rawPath, {
+    as: e.id, kind: e.kind, tier: e.tier, card: e.card, height: e.heightM ?? null, route: e.route,
+    license: e.license?.kind, attribution: e.license?.attribution ?? undefined, owner: e.license?.owner ?? undefined, notes: e.license?.notes,
+    steps: (e.made?.steps ?? []).filter((s) => s.what !== 'optimise'), concept: concept ? relative(root, resolve(gdir, concept.path)) : undefined,
+    slug, rigged: Number(e.measured?.bones) > 0 || Number(e.measured?.clips) > 0, under,
+  });
+  return { ...r, command: 'assets redo' };
+}

package/lib/asset-manifest.mjs

@@ -0,0 +1,318 @@
+/**
+ * EVERY ASSET'S PROVENANCE AND LICENCE: games/<id>/assets/manifest.json, one entry per model,
+ * texture, sky or procedural part a game ships, with where it came from (procedural, library, generated, imported),
+ * each step that made it (endpoint, receipt, price), the decision revisions it was made under (lib/decisions.mjs),
+ * its licence and what a remix gets, its measurements and its review. An entry the game's code changes at runtime
+ * says so in `inGame` ({ heightM, repaint }: drawn at that height, repainted from style.json), so the lineup draws
+ * it as the game does. From it:
+ *
+ *   games/<id>/assets/RIGHTS.md   what each file is, where it came from, its licence and what that allows, in plain words
+ *   games/<id>/credits.json       a `parts[]` line per pack or attribution-required file (the landing's credits page)
+ *   licenceProblems()             what `publish` and `assets check` refuse: a file with no licence record, a licence
+ *                                 that forbids a public source or a web game, attribution that never reached credits
+ *   servedAssets()                /games/<id>/assets.json on the site: each redistributable file's address and SHA-256,
+ *                                 which `game remix` fetches
+ *
+ * Both files are text: they travel in the remix source; the codex/ folder (decisions, the board) does not.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { pinByUse, readDecisions, revisionsFor } from './decisions.mjs';
+import { GAME_ID } from './studio.mjs';
+
+export const MANIFEST_FILE = join('assets', 'manifest.json');
+export const RIGHTS_FILE = join('assets', 'RIGHTS.md');
+export const ROUTES = Object.freeze(['procedural', 'library', 'generated', 'imported', 'premium']);
+export const KINDS = Object.freeze(['prop', 'character', 'creature', 'kit', 'environment', 'texture', 'sky', 'clip']);
+export const ASSET_ID = /^[a-z0-9][a-z0-9-]{0,47}$/;
+
+/**
+ * Licence kinds: whether the file may sit in a public remix source and on Homie's mirror, whether
+ * credit is required, what a remix gets by default, and whether a browser game may serve the file at all.
+ */
+export const LICENSES = Object.freeze({
+  cc0: { label: 'CC0 1.0 (public domain)', spdx: 'CC0-1.0', url: 'https://creativecommons.org/publicdomain/zero/1.0/', redistribute: true, attribution: false, remix: 'include', web: true },
+  'cc-by-4.0': { label: 'CC BY 4.0', spdx: 'CC-BY-4.0', url: 'https://creativecommons.org/licenses/by/4.0/', redistribute: true, attribution: true, remix: 'include', web: true },
+  'cc-by-3.0': { label: 'CC BY 3.0', spdx: 'CC-BY-3.0', url: 'https://creativecommons.org/licenses/by/3.0/', redistribute: true, attribution: true, remix: 'include', web: true },
+  own: { label: 'The studio\'s own work', spdx: null, url: null, redistribute: true, attribution: false, remix: 'include', web: true },
+  generated: { label: 'Generated on the studio\'s own account', spdx: null, url: null, redistribute: true, attribution: false, remix: 'include', web: true },
+  qal: { label: 'Quaternius Asset License', spdx: null, url: 'https://quaternius.com/license.html', redistribute: false, attribution: false, remix: 'reference', web: true },
+  mixamo: { label: 'Mixamo (Adobe)', spdx: null, url: 'https://helpx.adobe.com/creative-cloud/faq/mixamo-faq.html', redistribute: false, attribution: false, remix: 'none', web: true },
+  other: { label: 'Other (see notes)', spdx: null, url: null, redistribute: false, attribution: false, remix: 'none', web: true },
+});
+/** `eula:<name>` and `market:<listing>` are commercial licences: never in a public source; TurboSquid never on the web. */
+export function licenseInfo(kind) {
+  const k = String(kind ?? '');
+  if (LICENSES[k]) return { kind: k, ...LICENSES[k] };
+  if (/^eula:[a-z0-9-]{1,40}$/.test(k)) return { kind: k, label: `Commercial licence (${k.slice(5)})`, spdx: null, url: null, redistribute: false, attribution: false, remix: 'none', web: k !== 'eula:turbosquid' };
+  if (/^market:[a-z0-9:._-]{1,80}$/.test(k)) return { kind: k, label: `Bought (${k.slice(7)})`, spdx: null, url: null, redistribute: false, attribution: false, remix: 'none', web: true };
+  return null;
+}
+
+/** The decisions each kind of asset is made under (its `made.under`). */
+const UNDER = {
+  prop: ['style.render', 'style.palette', 'style.shape', 'style.materials', 'style.light', 'cast.scale'],
+  character: ['style.render', 'style.palette', 'style.shape', 'style.materials', 'style.light', 'style.proportions', 'cast.scale', 'rig.skeleton'],
+  kit: ['style.render', 'style.palette', 'style.materials', 'cast.scale'],
+  texture: ['style.render', 'style.palette', 'style.materials'],
+  sky: ['style.light', 'style.palette'],
+  clip: ['anim.style', 'rig.skeleton'],
+};
+UNDER.creature = UNDER.character;
+UNDER.environment = UNDER.kit;
+export function underFor(kind, route) {
+  return [...(UNDER[kind] ?? UNDER.prop), ...(route === 'library' ? ['cast.family'] : []), ...(route === 'generated' ? ['derived.prompt'] : [])];
+}
+
+const fileOf = (root, id) => join(root, 'games', id, MANIFEST_FILE);
+const now = () => new Date().toISOString();
+const clean = (s, n = 300) => (typeof s === 'string' ? s.replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, n) : null);
+
+export function readManifest(root, id) {
+  if (!GAME_ID.test(String(id ?? ''))) throw new Error(`"${id}" is not a game id`);
+  const file = fileOf(root, id);
+  if (!existsSync(file)) return { v: 1, assets: [] };
+  const m = JSON.parse(readFileSync(file, 'utf8'));
+  if (m?.v !== 1 || !Array.isArray(m.assets)) throw new Error(`games/${id}/${MANIFEST_FILE} is not an asset manifest (v 1)`);
+  return m;
+}
+
+export function writeManifest(root, id, manifest) {
+  const file = fileOf(root, id);
+  mkdirSync(dirname(file), { recursive: true });
+  manifest.assets.sort((a, b) => a.id.localeCompare(b.id));
+  writeFileSync(`${file}.tmp`, `${JSON.stringify(manifest, null, 2)}\n`);
+  renameSync(`${file}.tmp`, file);
+  return manifest;
+}
+
+/** One entry's shape, checked: { ok, problems }. */
+export function checkEntry(e) {
+  const problems = [];
+  if (!ASSET_ID.test(String(e?.id ?? ''))) problems.push('an id: lowercase letters, digits and hyphens');
+  if (!KINDS.includes(e?.kind)) problems.push(`a kind: ${KINDS.join(', ')}`);
+  if (!ROUTES.includes(e?.route)) problems.push(`a route: ${ROUTES.join(', ')}`);
+  if (!e?.license || !licenseInfo(e.license.kind)) problems.push('a licence record (license.kind: cc0, cc-by-4.0, own, generated, …)');
+  else if (licenseInfo(e.license.kind).attribution && !clean(e.license.attribution)) problems.push(`${e.license.kind} requires an attribution line (license.attribution)`);
+  if (e?.route !== 'procedural' && !(e?.files ?? []).some((f) => f.role === 'model' || f.role === 'texture' || f.role === 'sky' || f.role === 'clip')) problems.push('a shipped file (files[].role model, texture, sky or clip)');
+  return { ok: problems.length === 0, problems };
+}
+
+/**
+ * Record (or replace) one asset. Fills `made.under` with the current decision revisions for its kind and route,
+ * pins the auto decisions it was made under (pinned by use), then writes the manifest, RIGHTS.md and credits.json.
+ * Returns { entry, pinned }.
+ */
+export function recordAsset(root, id, entry) {
+  const manifest = readManifest(root, id);
+  const e = JSON.parse(JSON.stringify(entry));
+  e.license = { remix: licenseInfo(e.license?.kind)?.remix ?? 'none', ...e.license };
+  const check = checkEntry(e);
+  if (!check.ok) throw new Error(`asset ${e.id ?? '?'} needs ${check.problems.join('; ')}`);
+  const doc = readDecisions(root, id);
+  const under = underFor(e.kind, e.route);
+  e.made = { ...(e.made ?? {}), under: { ...revisionsFor(doc, under), ...(e.made?.under ?? {}) } };
+  e.recordedAt = now();
+  const at = manifest.assets.findIndex((a) => a.id === e.id);
+  if (at >= 0) manifest.assets[at] = e; else manifest.assets.push(e);
+  writeManifest(root, id, manifest);
+  const pinned = pinByUse(root, id, under.filter((d) => d !== 'derived.prompt'), e.id);
+  writeRights(root, id, manifest);
+  syncCredits(root, id, manifest);
+  return { entry: e, pinned };
+}
+
+/**
+ * `assets remove`: the record goes, and so does the copy the game ships (its files under public/) when it is still
+ * byte for byte what the record put there and no other asset names it. A raw file in art/ stays, and so does a
+ * shipped file someone changed since. Returns { removed, deleted: [paths], kept: [paths] }.
+ */
+export function removeAsset(root, id, assetId) {
+  const manifest = readManifest(root, id);
+  const gone = manifest.assets.find((a) => a.id === assetId);
+  if (!gone) return { removed: false, deleted: [], kept: [] };
+  manifest.assets = manifest.assets.filter((a) => a.id !== assetId);
+  writeManifest(root, id, manifest);
+  writeRights(root, id, manifest);
+  syncCredits(root, id, manifest);
+  const gdir = join(root, 'games', id);
+  const named = new Set(manifest.assets.flatMap((a) => (a.files ?? []).map((f) => f.path)));
+  const deleted = []; const kept = [];
+  for (const f of gone.files ?? []) {
+    const path = String(f.path ?? '');
+    if (!/^public\//.test(path) || path.split('/').includes('..') || named.has(path)) continue;
+    const abs = join(gdir, path);
+    if (!existsSync(abs)) continue;
+    if (f.sha256 && createHash('sha256').update(readFileSync(abs)).digest('hex') === f.sha256) { rmSync(abs); deleted.push(path); } else kept.push(path);
+  }
+  return { removed: true, deleted, kept };
+}
+
+/* ------------------------------------------------------------------ the licence check (publish, assets check) */
+
+/**
+ * What stops a public game, per asset: [{ asset, level: 'refuse' | 'warn', problem, fix }]. `public`: the game's
+ * source is shared (game.json share.source is not false) and it is listed. A file a game ships under games/<id>/public
+ * with no manifest entry at all is refused too: every shipped model needs a record.
+ */
+export function licenceProblems(root, id, manifest = readManifest(root, id), { public: pub = true } = {}) {
+  const out = [];
+  for (const a of manifest.assets) {
+    const info = licenseInfo(a.license?.kind);
+    if (!info) { out.push({ asset: a.id, level: 'refuse', problem: 'no licence record', fix: `record its licence: homie-studio assets add ${id} --file … --license <cc0|cc-by-4.0|own|…>` }); continue; }
+    if (!info.web) out.push({ asset: a.id, level: 'refuse', problem: `${info.label} does not allow a three.js web game to serve the file`, fix: 'replace it (a library match, or generate one)' });
+    if (info.attribution && !clean(a.license.attribution)) out.push({ asset: a.id, level: 'refuse', problem: `${info.label} requires credit, and there is no attribution line`, fix: 'add license.attribution (who made it, where it is from)' });
+    if (pub && !info.redistribute && a.license.remix === 'include') out.push({ asset: a.id, level: 'refuse', problem: `${info.label} forbids handing the file to remixers, but its remix is "include"`, fix: `set license.remix to "${info.remix}" (remixers get ${info.remix === 'reference' ? 'it from its origin' : 'a placeholder'})` });
+    else if (pub && !info.redistribute) out.push({ asset: a.id, level: 'warn', problem: `${info.label}: a public game serves the file to players but never to remixers (${a.license.remix}); keep the studio's repository private while it holds the raw file`, fix: null });
+  }
+  for (const f of unrecordedModels(root, id, manifest)) out.push({ asset: f, level: 'refuse', problem: 'a shipped model with no record in assets/manifest.json', fix: `homie-studio assets add ${id} --file ${f} --license <kind>` });
+  return out;
+}
+
+/** Model files a game ships (.glb, .gltf, .fbx, .obj, .vrm under games/<id>/) that no manifest entry names. */
+export function unrecordedModels(root, id, manifest = readManifest(root, id)) {
+  const dir = join(root, 'games', id);
+  const named = new Set(manifest.assets.flatMap((a) => (a.files ?? []).map((f) => f.path)));
+  const out = [];
+  const walk = (rel, depth) => {
+    if (depth > 6) return;
+    let entries = [];
+    try { entries = readdirSyncSafe(join(dir, rel)); } catch { return; }
+    for (const e of entries) {
+      if (e.name.startsWith('.') || ['node_modules', 'codex', 'dist', 'raw'].includes(e.name)) continue;
+      const p = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) walk(p, depth + 1);
+      else if (/\.(glb|gltf|fbx|obj|vrm)$/i.test(e.name) && !named.has(p)) out.push(p);
+    }
+  };
+  walk('', 0);
+  return out;
+}
+const readdirSyncSafe = (p) => readdirSync(p, { withFileTypes: true });
+
+/* ------------------------------------------------------------------ RIGHTS.md */
+
+/**
+ * What the providers' own terms say, with the date they were read (the models skill's references/RIGHTS.md keeps the
+ * same text and says to read the live pages again before commercial publishing).
+ */
+export const PROVIDER_TERMS = Object.freeze([
+  { who: 'fal (generated images and models)', url: 'https://fal.ai/terms', read: '2026-10-02', says: 'You own what you upload; fal\'s terms give no express assignment of the output to you, and say output may not be unique and is not promised to be non-infringing. The models used here carry fal\'s "Commercial use" label.' },
+  { who: 'Tripo (image to 3D through fal)', url: 'https://developers.tripo3d.ai/en/terms', read: '2026-10-02', says: 'Calls through fal are paid calls. Tripo\'s developer terms (last updated 2025-07-11): "you may use Outputs for lawful commercial or non-commercial purposes". Its free plan\'s outputs are public under CC BY 4.0 (a free plan is not used here).' },
+  { who: 'Kenney', url: 'https://kenney.nl/support', read: '2026-10-02', says: 'Public domain (CC0): use in any project, commercial or not; credit is not required (kindly given anyway).' },
+  { who: 'KayKit', url: 'https://kaylousberg.itch.io/', read: '2026-10-02', says: 'CC0 1.0: free for personal and commercial use, no attribution required.' },
+  { who: 'Poly Haven', url: 'https://polyhaven.com/license', read: '2026-10-02', says: 'CC0: use for any purpose, redistribute, even in a product you sell; no credit needed for downloaded files.' },
+  { who: 'ambientCG', url: 'https://docs.ambientcg.com/license/', read: '2026-10-02', says: 'CC0 1.0: the raw files may be included in a project such as a video game.' },
+]);
+
+const REMIX_WORDS = { include: 'a remix gets this file (fetched from this studio\'s site, checked by SHA-256)', reference: 'a remix fetches it from its origin, never from this studio', none: 'a remix gets a grey placeholder of the same size and needs its own licence' };
+const ROUTE_WORDS = { procedural: 'made by the game\'s own code', library: 'from the Homie starter library', generated: 'generated on the studio\'s own account', imported: 'brought in by the studio', premium: 'bought' };
+/** A remix's file was made by the original studio, not this one: say whose. */
+const whoseAccount = (a) => (a.from?.remixOf?.studio ? `${a.from.remixOf.studio}'s` : 'the original studio\'s');
+function routeWords(a) {
+  if (!a.from?.remixOf) return ROUTE_WORDS[a.route] ?? a.route;
+  if (a.route === 'generated') return `generated on ${whoseAccount(a)} own account`;
+  if (a.route === 'imported') return `brought in by ${a.from.remixOf.studio ?? 'the original studio'}`;
+  return ROUTE_WORDS[a.route] ?? a.route;
+}
+
+/** RIGHTS.md for one game, in plain words. */
+export function rightsMarkdown(root, id, manifest = readManifest(root, id)) {
+  let game = {};
+  try { game = JSON.parse(readFileSync(join(root, 'games', id, 'game.json'), 'utf8')); } catch { game = {}; }
+  const lines = [
+    `# Rights: ${game.name ?? id}`,
+    '',
+    `Every file this game ships, where it came from, its licence and what that allows. Written by \`homie-studio assets rights ${id}\` from \`assets/manifest.json\`; do not edit it by hand.`,
+    '',
+    '## What the providers\' terms say',
+    '',
+    'Read on the dates shown. Terms change: read the live page again before publishing anything commercial.',
+    '',
+    ...PROVIDER_TERMS.filter((t) => manifest.assets.some((a) => termsApply(t, a))).map((t) => `- **${t.who}** (${t.url}, read ${t.read}): ${t.says}`),
+    ...(manifest.assets.some((a) => a.route === 'generated') ? ['- **Copyright in AI-made files** may be thin: "remix with credit" may not bind a remixer for files no person authored. This file never claims more than the terms above.'] : []),
+    '',
+    '## Files',
+    '',
+  ];
+  if (!manifest.assets.length) lines.push('None yet: everything on screen is drawn by the game\'s own code.');
+  for (const a of manifest.assets) {
+    const info = licenseInfo(a.license?.kind);
+    const files = (a.files ?? []).filter((f) => f.public !== false).map((f) => `\`${f.path}\``).join(', ');
+    lines.push(`### ${a.id}`, '', `- **What:** ${a.kind}${a.card ? ` (${a.card})` : ''}${files ? `: ${files}` : ''}`,
+      `- **From:** ${routeWords(a)}${a.from?.pack ? `: ${a.from.packLabel ?? a.from.pack}${a.from.item ? `, ${String(a.from.item).split('/').pop()}` : ''}` : ''}${a.from?.packUrl ?? a.from?.origin ? ` (${a.from.packUrl ?? a.from.origin})` : ''}${a.from?.remixOf ? `; carried from ${a.from.remixOf.game ?? 'the original'}${a.from.remixOf.studio ? ` by ${a.from.remixOf.studio}` : ''}` : ''}${a.made?.steps?.length ? `; ${a.made.steps.map((s) => s.endpoint ? `${s.what} with ${s.endpoint}${Number(s.usd) ? ` (US$${Number(s.usd).toFixed(3)})` : ''}` : `${s.what}${s.tool ? ` (${s.tool})` : ''}`).join(', ')}` : ''}`,
+      `- **Licence:** ${info ? (a.from?.remixOf && info.kind === 'generated' ? `Generated on ${whoseAccount(a)} own account` : info.label) : 'NONE RECORDED: this file cannot be published'}${info?.url ? ` (${info.url})` : ''}${a.license?.owner ? `; owner: ${a.license.owner}` : ''}`,
+      ...(a.license?.attribution ? [`- **Credit:** ${a.license.attribution}`] : []),
+      `- **A remix:** ${REMIX_WORDS[a.license?.remix] ?? REMIX_WORDS.none}`,
+      ...(a.license?.notes ? [`- **Notes:** ${a.license.notes}`] : []),
+      '');
+  }
+  return `${lines.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd()}\n`;
+}
+function termsApply(t, a) {
+  const w = t.who.toLowerCase();
+  if (w.startsWith('fal')) return a.route === 'generated';
+  if (w.startsWith('tripo')) return (a.made?.steps ?? []).some((s) => /tripo/i.test(String(s.endpoint ?? '')));
+  return String(a.from?.pack ?? a.from?.library ?? a.license?.attribution ?? '').toLowerCase().includes(w.split(' ')[0]) || String(a.from?.origin ?? '').toLowerCase().includes(w.split(' ')[0].replace(/\s+/g, ''));
+}
+
+export function writeRights(root, id, manifest = readManifest(root, id)) {
+  const file = join(root, 'games', id, RIGHTS_FILE);
+  mkdirSync(dirname(file), { recursive: true });
+  const text = rightsMarkdown(root, id, manifest);
+  if (!existsSync(file) || readFileSync(file, 'utf8') !== text) writeFileSync(file, text);
+  return relative(root, file);
+}
+
+/* ------------------------------------------------------------------ credits.json */
+
+/**
+ * credits.json `parts[]` (the landing's credits page): one line per library pack used (CC0 needs none; it is kind),
+ * and one per attribution-required file. Lines this function wrote carry `"asset": true`; every other part stays.
+ */
+export function syncCredits(root, id, manifest = readManifest(root, id)) {
+  const file = join(root, 'games', id, 'credits.json');
+  let credits = {};
+  try { credits = JSON.parse(readFileSync(file, 'utf8')); } catch { credits = {}; }
+  const keep = (Array.isArray(credits.parts) ? credits.parts : []).filter((p) => p?.asset !== true);
+  const parts = [];
+  const packs = new Map();
+  for (const a of manifest.assets) {
+    const info = licenseInfo(a.license?.kind);
+    if (!info) continue;
+    if (info.attribution) parts.push({ what: `${a.card ?? a.id} (${a.kind})`, author: clean(a.license.attribution, 120), url: a.from?.origin ?? null, licence: info.spdx ?? info.label, licenceUrl: info.url, asset: true });
+    else if (a.route === 'library' && a.from?.pack) {
+      const key = a.from.pack;
+      if (!packs.has(key)) packs.set(key, { what: `${a.from.packLabel ?? a.from.pack} (${a.kind === 'texture' ? 'textures' : 'models'})`, author: a.from.author ?? null, url: a.from.packUrl ?? a.from.origin ?? null, licence: info.spdx ?? info.label, licenceUrl: info.url, note: 'Copied from the Homie starter library', asset: true });
+    }
+  }
+  const next = [...keep, ...packs.values(), ...parts].slice(0, 40);
+  if (!next.length && !existsSync(file)) return null;
+  const out = { ...credits, parts: next };
+  const text = `${JSON.stringify(out, null, 2)}\n`;
+  if (!existsSync(file) || readFileSync(file, 'utf8') !== text) writeFileSync(file, text);
+  return relative(root, file);
+}
+
+/* ------------------------------------------------------------------ the site's assets.json (remix carry-over) */
+
+/**
+ * /games/<id>/assets.json on the built site: each asset's licence and remix rule, and for `include` files their
+ * served address (relative to /games/<id>/) and SHA-256, so `game remix` can fetch them. Only files under the
+ * game's public/ folder are served; a file's address there is its path without "public/".
+ */
+export function servedAssets(root, id, out, manifest = readManifest(root, id)) {
+  const assets = [];
+  for (const a of manifest.assets) {
+    const info = licenseInfo(a.license?.kind);
+    const remix = info ? (info.redistribute ? a.license.remix ?? info.remix : info.remix === 'include' ? 'none' : info.remix) : 'none';
+    const files = (a.files ?? []).filter((f) => f.public !== false && /^public\//.test(String(f.path ?? ''))).map((f) => {
+      const served = f.path.replace(/^public\//, '');
+      const abs = join(out, served);
+      return existsSync(abs) ? { role: f.role, path: f.path, url: served, bytes: statSync(abs).size, sha256: f.sha256 ?? null } : null;
+    }).filter(Boolean);
+    assets.push({ id: a.id, kind: a.kind, route: a.route, card: a.card ?? null, license: { kind: a.license?.kind ?? null, spdx: info?.spdx ?? null, attribution: a.license?.attribution ?? null, remix }, from: a.from ? { library: a.from.library ?? null, pack: a.from.pack ?? null, item: a.from.item ?? null, origin: a.from.origin ?? null, sha256: a.from.sha256 ?? null } : null, size: a.measured?.box?.size ?? null, files: remix === 'include' ? files : files.map(({ url, ...f }) => ({ ...f, url: null })) });
+  }
+  return { v: 1, kind: 'homie-game-assets', game: id, assets };
+}

package/lib/build.mjs

@@ -5,6 +5,8 @@
  *   site/dist/games/<id>/index.html        the game's page (the Worker adds HOMIE_NET)
  *   site/dist/games/<id>/assets/main.js    its bundle (esbuild; @homie-rocks/studio/netplay inlined)
  *   site/dist/games/<id>/...               everything in games/<id>/public/
+ *   site/dist/games/<id>/assets.json       its assets' licences and, for those a remix may carry, their address and SHA-256
+ *                                          (games/<id>/assets/manifest.json; lib/asset-manifest.mjs servedAssets)
  *   site/dist/games/<id>/agents.json       the AI guides' vocabulary (games/<id>/agents.json, checked; NETPLAY.md
  *                                          section 18): the only goals and lines an AI in its rooms has
  *   site/dist/games.json                   { studio, games[], songs[], videos[], posts[], site } from studio.json,
@@ -35,6 +37,7 @@ import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statS
 import { createRequire } from 'node:module';
 import { join, relative } from 'node:path';
 import { buildCodexPages } from './codex.mjs';
+import { servedAssets } from './asset-manifest.mjs';
 import { buildMedia } from './media.mjs';
 import { buildSiteFiles, landingOf, readPosts, readTheme } from './site.mjs';
 import { PACKAGE_ROOT, listGames, readStudio } from './studio.mjs';
@@ -46,7 +49,7 @@ import { vocabularyOf } from '../worker/brain.mjs';
 
 const SOURCE_SKIP = new Set(['node_modules', 'dist', '.git', '.wrangler', '.port']);
 /** Never copied into a static game's served folder. */
-const STATIC_SKIP = new Set(['node_modules', '.git', '.wrangler', '.port', '.DS_Store', 'game.json', 'PORT.md', 'CODEX.md', 'lab.json']);
+const STATIC_SKIP = new Set(['node_modules', '.git', '.wrangler', '.port', '.DS_Store', 'game.json', 'PORT.md', 'CODEX.md', 'lab.json', 'codex']);
 const LOADERS = { '.png': 'file', '.jpg': 'file', '.jpeg': 'file', '.gif': 'file', '.webp': 'file', '.mp3': 'file', '.ogg': 'file', '.wav': 'file', '.m4a': 'file', '.glb': 'file', '.gltf': 'file', '.bin': 'file', '.hdr': 'file', '.svg': 'file', '.json': 'json', '.woff2': 'file', '.ttf': 'file' };
 
 /** The port toolkit as one classic script (window.HomiePort), for static games. Built once per build. */
@@ -79,12 +82,25 @@ const TEXT = /\.(ts|tsx|js|mjs|jsx|json|html|css|md|txt|svg|glsl|wgsl|frag|vert)
  * it (`credit`: the studio and the game; the live site adds the page, worker/index.mjs) and its licence (game.json
  * "license", worker/license.mjs).
  */
+/** From games/<id>/style.json: the light colour as paper, the dark as text, and the accent; null without one. */
+function uiOf(g) {
+  let pal = null;
+  try { pal = JSON.parse(readFileSync(join(g.dir, 'style.json'), 'utf8'))?.palette ?? null; } catch { pal = null; }
+  const hex = (v) => (/^#[0-9a-f]{6}$/i.test(String(v ?? '')) ? String(v).toLowerCase() : null);
+  const ink = hex(pal?.ink); const bg = hex(pal?.bg);
+  if (!ink || !bg) return null;
+  const lum = (h) => (0.2126 * parseInt(h.slice(1, 3), 16) + 0.7152 * parseInt(h.slice(3, 5), 16) + 0.0722 * parseInt(h.slice(5, 7), 16)) / 255;
+  const light = lum(ink) >= lum(bg);
+  return { paper: light ? ink : bg, text: light ? bg : ink, ...(hex(pal?.accent) ? { hot: hex(pal.accent) } : {}) };
+}
+
 export function sourceOf(dir, id, { studio = null, game = null, license } = {}) {
   const files = {};
   let total = 0;
   const walk = (rel) => {
     for (const entry of readdirSync(join(dir, rel), { withFileTypes: true })) {
-      if (entry.name.startsWith('.') || SOURCE_SKIP.has(entry.name) || (!rel && entry.name === 'CODEX.md')) continue;
+      // The codex (CODEX.md, and codex/: the art-direction decisions and the style board) is the owner's, never shared.
+      if (entry.name.startsWith('.') || SOURCE_SKIP.has(entry.name) || (!rel && (entry.name === 'CODEX.md' || entry.name === 'codex'))) continue;
       const path = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) walk(path);
       else if (TEXT.test(entry.name)) {
@@ -298,6 +314,9 @@ export async function build(root, { only = null, log = () => {}, deploy = proces
     vocabFor(g, out);
     // The game's own source, for other studios to remix (game.json "share": { "source": false } keeps it private).
     if (g.share?.source !== false) writeFileSync(join(out, 'source.json'), `${JSON.stringify(sourceOf(g.dir, g.id, { studio: studio.name ?? null, game: g.name ?? g.id, license: g.license }))}\n`);
+    // Its assets' licences, and the address and SHA-256 of each one a remix may carry (`game remix` fetches them).
+    if (g.share?.source !== false && existsSync(join(g.dir, 'assets', 'manifest.json'))) writeFileSync(join(out, 'assets.json'), `${JSON.stringify(servedAssets(root, g.id, out))}\n`);
+    else rmSync(join(out, 'assets.json'), { force: true });
     const main = join(out, 'assets', 'main.js');
     const bytes = existsSync(main) ? statSync(main).size : dirBytes(out);
     const seats = seatsFor(g, netplayOf(g, out));
@@ -321,8 +340,12 @@ export async function build(root, { only = null, log = () => {}, deploy = proces
     const net = netplayOf(g, join(dist, 'games', g.id));
     const { min, max } = seatsFor(g, net);
     const seeds = serverSeeds(g, log);
+    // The game's own palette (style.json, its art direction): the play page's buttons wear its paper and ink, so the
+    // page's pills and the game's own HUD are one UI.
+    const ui = uiOf(g);
     return {
       id: g.id, name: g.name ?? g.id, blurb: g.blurb ?? '', players: { min, max },
+      ...(ui ? { ui } : {}),
       roundSeconds: g.roundSeconds ?? net.roundSeconds ?? null, movement: net.movement ?? null, cover: g.cover ?? null,
       ...(g.screen ? { screen: g.screen } : {}),
       // game.json "saves": true — player accounts and cloud saves (saves/SAVES.md): the play shell answers the game's

package/lib/codex.mjs

@@ -42,6 +42,7 @@ import { latestFeedFor, summarize } from './feed-summary.mjs';
 import { escapeHtml as esc, renderMarkdown } from './markdown.mjs';
 import { readTheme } from './site.mjs';
 import { GAME_ID, listGames, readStudio } from './studio.mjs';
+import { decisionRows, readDecisions } from './decisions.mjs';
 
 export const CODEX_FILE = 'CODEX.md';
 export const CODEX_DIR = join('.studio', 'codex');
@@ -314,6 +315,9 @@ function sectionHtml(section, emb, ctx) {
   }
   const questions = section.key === 'questions';
   let body = blocks(intro, emb, { dated: section.key === 'latest' });
+  // The Art direction tab is the style bible: the decisions (games/<id>/codex/decisions.json) drawn after the prose.
+  const decided = section.key === 'art' && ctx.decisions ? decisionsHtml(ctx.decisions, emb) : '';
+  if (decided) body += decided;
   if (questions) body = body.replace(/^<(ul|ol)>/, '<ol class="questions">').replace(/<\/(ul|ol)>$/, '</ol>');
   const empty = !body && !cards.length;
   return `<section class="tab" id="${esc(section.id)}" data-key="${esc(section.key ?? '')}">
@@ -324,6 +328,29 @@ ${cards.length ? `<div class="cards">${cards.map((c) => card(c.title, c.lines, e
 </section>`;
 }
 
+/* ------------------------------------------------------------------ the art direction decisions */
+
+const STATE_WORD = { auto: 'Auto', steered: 'Steered', pinned: 'Pinned by use', locked: 'Locked' };
+
+/**
+ * The decisions as the style bible: the board's directions (the engine's swatches, a painted mood image only as a
+ * labelled target), the golden images, then one table per phase: decision, value (with the palette's colours), why, its
+ * state and who set it. Pictures come from codex/board/ inside the game's folder, embedded like any codex picture.
+ */
+function decisionsHtml(doc, emb) {
+  const phases = decisionRows(doc);
+  if (!phases.length) return '';
+  const swatch = (c) => `<span class="sw" style="background:${esc(c)}" title="${esc(c)}"></span>`;
+  const board = (doc.board?.directions ?? []).map((d) => {
+    const pic = d.swatch ? emb.image(d.swatch) : null;
+    const mood = d.mood?.path ? emb.image(d.mood.path) : null;
+    return `<figure class="dir${doc.board.chosen === d.id ? ' chosen' : ''}">${pic ? `<img src="${pic}" alt="Direction ${esc(d.id.toUpperCase())}, drawn by the game engine">` : ''}${mood ? `<img src="${mood}" alt="A painted mood image for direction ${esc(d.id.toUpperCase())} (a target)">` : ''}<figcaption><b>${esc(d.id.toUpperCase())}</b> ${esc(d.label)}${doc.board.chosen === d.id ? ' · chosen' : ''}${mood ? ' · the painting is a target, not what the game draws' : ''}</figcaption></figure>`;
+  }).join('');
+  const golden = (doc.golden ?? []).map((g) => { const pic = emb.image(g.path); return pic ? `<img src="${pic}" alt="Golden image">` : ''; }).join('');
+  const tables = phases.map((p) => `<h3 class="phase">${esc(p.label)}</h3><div class="scroll"><table class="decisions"><thead><tr><th>Decision</th><th>Value</th><th>Why</th><th>State</th></tr></thead><tbody>${p.rows.map((r) => `<tr class="${esc(r.state)}"><td>${esc(r.name)}</td><td>${r.colours ? `<span class="sws">${r.colours.map(swatch).join('')}</span> ` : ''}${esc(r.label)}${r.steer.length ? ` <em>(“${esc(r.steer.at(-1))}”)</em>` : ''}</td><td>${esc(r.why ?? '')}</td><td><span class="st ${esc(r.state)}">${esc(STATE_WORD[r.state] ?? r.state)}</span>${r.by === 'person' ? ' <small>the person</small>' : ''}${r.at ? ` <small>${esc(String(r.at).slice(0, 10))}</small>` : ''}</td></tr>`).join('')}</tbody></table></div>`).join('');
+  return `<div class="decided"><p class="eyebrow">The decisions</p><p class="sub">Every look decision with its why. Auto: picked from the plan; steered: nudged by the person; pinned: an asset is built on it; locked: frozen by the person. Your AI changes a locked one only after you say so, and shows what would need remaking first.</p>${board ? `<div class="board">${board}</div>` : ''}${golden ? `<p class="eyebrow">Golden images</p><div class="gallery golden">${golden}</div>` : ''}${tables}${doc.derived?.prompt?.text ? `<details class="prompt"><summary>The style prompt every generated picture starts from</summary><p>${esc(doc.derived.prompt.text)}</p></details>` : ''}</div>`;
+}
+
 /* ------------------------------------------------------------------ the build status tab */
 
 const STATE_MARK = { done: '✓', pass: '✓', skipped: '–', skip: '–', running: '◌', failed: '✗', fail: '✗', stopped: '■', pending: '' };
@@ -432,6 +459,13 @@ code{font-family:var(--mono);font-size:.92em}pre{overflow-x:auto;background:var(
 .try{margin:16px 0;padding:14px 16px;border:1px solid var(--gold);border-radius:14px;background:color-mix(in srgb,var(--gold) 8%,transparent)}.try .eyebrow{color:var(--gold)}.try p{margin:0}
 .panel h3{margin-bottom:6px}.status .panel{margin-top:14px}
 footer{max-width:1080px;margin:0 auto;padding:18px 16px 40px;color:var(--dim);font-size:13px;border-top:1px solid var(--line)}
+.decided{margin-top:22px}.decided h3.phase{margin:22px 0 4px;font:600 13px/1.4 var(--mono);letter-spacing:.1em;text-transform:uppercase;color:var(--accent2)}
+table.decisions td:first-child{white-space:nowrap;font-weight:600}table.decisions td:nth-child(3){color:var(--dim);font-size:14px}
+.sws{display:inline-flex;gap:3px;vertical-align:middle}.sw{display:inline-block;width:16px;height:16px;border-radius:4px;border:1px solid var(--line)}
+.st{display:inline-block;padding:1px 8px;border-radius:999px;font:600 12px/1.6 var(--mono);border:1px solid var(--line);color:var(--dim)}
+.st.locked{color:var(--gold);border-color:var(--gold)}.st.pinned{color:var(--accent2);border-color:color-mix(in srgb,var(--accent2) 60%,transparent)}.st.steered{color:var(--ink)}
+.board{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,300px),1fr));gap:12px;margin:12px 0}.board figure{margin:0}.board figure.chosen img:first-child{outline:3px solid var(--accent);outline-offset:-3px}.board img+img{margin-top:6px}
+details.prompt{margin:16px 0;color:var(--dim);font-size:14px}details.prompt summary{cursor:pointer;color:var(--accent2)}
 @media (max-width:560px){.card .art{width:72px;height:72px}ol.timeline li{grid-template-columns:1fr;gap:2px}}`;
 }
 
@@ -502,10 +536,17 @@ export function renderCodex(root, id, { mode = 'file', feed, now = new Date() }
   let studio = {};
   try { studio = readStudio(root); } catch { studio = {}; }
   const emb = new Embedder(root, game.dir);
+  let decisions = null;
+  try { decisions = readDecisions(root, id); } catch { decisions = null; }
+  // A palette or fonts the person steered or locked, or an asset pinned, is the game's look: the codex wears it too.
+  const pal = decisions?.decisions?.['style.palette'];
+  const ui = decisions?.decisions?.['style.ui'];
+  if (pal && pal.state !== 'auto') meta.palette = { ...(meta.palette ?? {}), ...Object.fromEntries(['bg', 'ink', 'accent', 'accent2', 'danger', 'good', 'gold'].filter((k) => pal.value?.[k]).map((k) => [k, pal.value[k]])) };
+  if (ui && ui.state !== 'auto' && ui.value?.display) meta.fonts = { ...(meta.fonts ?? {}), display: ui.value.display, body: ui.value.body ?? meta.fonts?.body };
   const look = lookOf(root, game, meta, emb);
   const title = parsed.title ?? game.name ?? id;
   const eyebrow = typeof meta.eyebrow === 'string' && meta.eyebrow.trim() ? meta.eyebrow.trim() : `${studio.name ?? 'Studio'} · ${title}`;
-  const ctx = { eyebrow: String(eyebrow).slice(0, 80), pixel: meta.pixel === true, try: typeof meta.try === 'string' ? meta.try.slice(0, 300) : '', mode };
+  const ctx = { eyebrow: String(eyebrow).slice(0, 80), pixel: meta.pixel === true, try: typeof meta.try === 'string' ? meta.try.slice(0, 300) : '', mode, decisions };
   const s = summarize(feed === undefined ? latestFeedFor(root, id) : feed);
   const sections = parsed.sections.filter((x) => x.body.join('\n').trim() || x.key);
   const tabs = sections.map((x) => `<a href="#${esc(x.id)}">${esc(x.title)}</a>`);
@@ -519,6 +560,7 @@ export function renderCodex(root, id, { mode = 'file', feed, now = new Date() }
   const start = s?.state === 'running' ? 'build-status' : (sections[0]?.id ?? 'build-status');
   const tagline = typeof meta.tagline === 'string' ? meta.tagline : '';
   const gaps = codexGaps(parsed);
+  if (decisions) gaps.missing = gaps.missing.filter((x) => x !== 'Art direction');
   const html = `<!doctype html>
 <html lang="en">
 <head>