@hypersoniclabs/helix-cli 0.1.24-helix3.450 → 0.1.24-helix3.452

package/README.md

@@ -26,11 +26,11 @@ The token is stored in `~/.helix/credentials.json` (mode `600`). It's sent as
 `Authorization: Bearer <token>` on publish calls. `helix login` validates it against
 `GET /api/v1/users/me` before saving and reads the token's `exp` so the CLI knows when it lapses.
 
-> **The backend & website default to the build's environment:** the published `@hypersoniclabs/*`
-> CLI (built from `helix3`, see [docs/npm-publishing.md](docs/npm-publishing.md)) currently targets the
-> helix3 backend + website (`helix-backend-api-helix3.up.railway.app` / `new.helixgame.com`; HYPR-5040,
-> until the production cutover repoints it). The retired `@helix3/*` and `@helixdev/*` CLIs target helix3
-> and staging respectively.
+> **The backend & website default to production:** the published `@hypersoniclabs/*` CLI (built from `helix3`,
+> see [docs/npm-publishing.md](docs/npm-publishing.md)) targets `https://api.helixgame.com` and
+> `https://helixgame.com`. The former helix3 hosts (`helix-backend-api-helix3.up.railway.app`, `new.helixgame.com`)
+> are the same environment, so a login saved under them keeps working without logging in again. The retired
+> `@helix3/*` CLI resolves to production too; `@helixdev/*` targets staging.
 > Override per run with `--api-url`/`HELIX_API_URL` and `--web-url`/`HELIX_WEB_URL` (e.g. a local/dev backend).
 
 ## Commands

package/dist/config.d.ts

@@ -5,7 +5,7 @@ export type CliCredentials = {
     username: string;
 };
 export declare const CONFIG_DIR: string;
-type HelixEnvName = 'staging' | 'helix3' | 'production';
+type HelixEnvName = 'staging' | 'production';
 export declare function resolveEnvironment(scope: string, override?: {
     apiUrl?: string;
     webUrl?: string;

package/dist/config.js

@@ -19,11 +19,10 @@ const browserLogin_1 = require("./browserLogin");
 // inventing its own.
 exports.CONFIG_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.helix');
 const CREDENTIALS_FILE = (0, node_path_1.join)(exports.CONFIG_DIR, 'credentials.json');
-// The npm scope this build was published under selects its default environment:
-// legacy lanes republished every @helix package under their scope (@helixdev = staging,
-// @helix3 = helix3); @hypersoniclabs is what helix3 publishes now (docs/npm-publishing.md). Read from our
-// own package.json `name` (dist/.. at runtime) — a lane tarball carries the rewritten
-// scope; file:-linked local dev reads @hypersoniclabs → production.
+// The npm scope this build was published under: @helixdev is the staging lane, everything
+// else (@hypersoniclabs, and the retired @helix3 scope) is production. Read from our own
+// package.json `name` (dist/.. at runtime) — a lane tarball carries the rewritten scope;
+// file:-linked local dev reads @hypersoniclabs → production.
 function ownScope() {
     try {
         const name = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '..', 'package.json'), 'utf8')).name;
@@ -34,32 +33,32 @@ function ownScope() {
     }
 }
 const ENVIRONMENTS = {
-    production: { apiUrl: 'https://api.helixgame.com', webUrl: 'https://helixgame.com' },
+    production: {
+        apiUrl: 'https://api.helixgame.com',
+        webUrl: 'https://helixgame.com',
+        aliasApiUrls: ['https://helix-backend-api-helix3.up.railway.app'],
+    },
     staging: { apiUrl: 'https://helix-backend-staging.up.railway.app', webUrl: 'https://next.helixgame.com' },
-    helix3: { apiUrl: 'https://helix-backend-api-helix3.up.railway.app', webUrl: 'https://new.helixgame.com' },
 };
-// TEMPORARY (HYPR-5040, 2026-08-07, Arash): the production-scoped build ALSO
-// defaults to the helix3 lane. helixgame.com serves a pre-2026-07-14 auth surface
-// (password-only /cli-login) that email-code/passwordless accounts cannot log into,
-// and the team's active lane is helix3 - so `helix login` from the @hypersoniclabs
-// package must land on new.helixgame.com to work at all. The production ENVIRONMENT
-// entry above stays intact and reachable via HELIX_API_URL=https://api.helixgame.com.
-// This mapping will be repointed to production (drop the '@hypersoniclabs' key and
-// restore the pinned spec) after the production backend release.
 const SCOPE_ENVS = {
     '@helixdev': 'staging',
-    '@helix3': 'helix3',
-    '@hypersoniclabs': 'helix3',
+    // Retired scope: old @helix3 installs resolve to the same production environment.
+    '@helix3': 'production',
 };
 // The scope each environment's toolchain is published under — what update hints and
-// install commands name. helix3 builds publish as @hypersoniclabs since 2026-10-07
-// (docs/npm-publishing.md); @helix3 is retired and only still MAPS to helix3 above so
-// an old @helix3 install keeps working.
+// install commands name. @hypersoniclabs is the only production package since 2026-10-07
+// (docs/npm-publishing.md).
 const ENV_SCOPES = {
     production: '@hypersoniclabs',
     staging: '@helixdev',
-    helix3: '@hypersoniclabs',
 };
+const normalizeOrigin = (url) => url.trim().replace(/\/+$/, '').toLowerCase();
+// The environment an API origin belongs to (canonical host or alias), or undefined for
+// anything else (localhost, a custom backend).
+function environmentOfApiUrl(url) {
+    const n = normalizeOrigin(url);
+    return Object.entries(ENVIRONMENTS).find(([, env]) => [env.apiUrl, ...(env.aliasApiUrls ?? [])].some((candidate) => normalizeOrigin(candidate) === n))?.[0];
+}
 // Pure resolver (testable without the ambient package.json / process.env): the npm scope
 // picks the environment; HELIX_API_URL/HELIX_WEB_URL override. The site is its OWN value —
 // only an API-only override derives it (api.-strip); otherwise the env default applies.
@@ -67,10 +66,7 @@ function resolveEnvironment(scope, override = {}) {
     // A local file-linked build still carries the production package name. When
     // its explicit API override exactly names a known lane, label and package
     // suggestions must follow that lane rather than falsely saying production.
-    const normalizedOverride = override.apiUrl?.replace(/\/+$/, '').toLowerCase();
-    const overrideEnv = normalizedOverride
-        ? Object.entries(ENVIRONMENTS).find(([, value]) => value.apiUrl.replace(/\/+$/, '').toLowerCase() === normalizedOverride)?.[0]
-        : undefined;
+    const overrideEnv = override.apiUrl ? environmentOfApiUrl(override.apiUrl) : undefined;
     const env = overrideEnv ?? SCOPE_ENVS[scope] ?? 'production';
     const resolvedScope = overrideEnv ? ENV_SCOPES[overrideEnv] : scope;
     const preset = ENVIRONMENTS[env];
@@ -88,23 +84,23 @@ const RESOLVED = resolveEnvironment(ownScope(), {
 /** The website that belongs to an API origin, when it is one of ours (visual QA renders on the site that serves the
  *  API the item lives on, not on this build's default site). */
 function webUrlForApi(apiUrl) {
-    const n = normalizeApiUrlForEnv(apiUrl);
-    for (const env of Object.values(ENVIRONMENTS))
-        if (normalizeApiUrlForEnv(env.apiUrl) === n)
-            return env.webUrl;
-    return null;
+    const env = environmentOfApiUrl(apiUrl);
+    return env ? ENVIRONMENTS[env].webUrl : null;
 }
-const normalizeApiUrlForEnv = (url) => url.trim().replace(/\/+$/, '').toLowerCase();
 exports.HELIX_SCOPE = RESOLVED.scope;
 exports.HELIX_ENV = RESOLVED.env;
 exports.DEFAULT_API_URL = RESOLVED.apiUrl;
 exports.DEFAULT_WEB_URL = RESOLVED.webUrl;
 // One credentials file (~/.helix/credentials.json) serves every installed lane, so a login minted
 // against another environment silently redirects publishes there. Compare normalized: trailing
-// slashes and case are not meaningful differences in an origin.
-const normalizeApiUrl = (url) => url.trim().replace(/\/+$/, '').toLowerCase();
+// slashes and case are not meaningful differences in an origin, and a host and its alias (the
+// Railway URL and api.helixgame.com) are the same environment — a login stored under either one
+// is valid for both, so the cutover needs no re-login.
 function apiUrlMatchesEnv(credsApiUrl, defaultApiUrl) {
-    return normalizeApiUrl(credsApiUrl) === normalizeApiUrl(defaultApiUrl);
+    if (normalizeOrigin(credsApiUrl) === normalizeOrigin(defaultApiUrl))
+        return true;
+    const credsEnv = environmentOfApiUrl(credsApiUrl);
+    return credsEnv !== undefined && credsEnv === environmentOfApiUrl(defaultApiUrl);
 }
 // The standard cross-environment warning, or null when the stored login targets this build's
 // environment. `env` defaults to this build's resolved environment; tests inject it explicitly.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAoEA,gDAsBC;AAUD,oCAIC;AAaD,4CAEC;AAID,0DAeC;AAED,0CAUC;AAED,0CAYC;AAED,4CAMC;AAqBD,0CAGC;AAKD,gCAGC;AA5MD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAAiC;AACjC,iDAA8C;AAU9C,iGAAiG;AACjG,6FAA6F;AAC7F,qBAAqB;AACR,QAAA,UAAU,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,IAAA,gBAAI,EAAC,kBAAU,EAAE,kBAAkB,CAAC,CAAC;AAE9D,gFAAgF;AAChF,wFAAwF;AACxF,0GAA0G;AAC1G,sFAAsF;AACtF,oEAAoE;AACpE,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC,IAAI,CAAC;QACjH,OAAO,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAMD,MAAM,YAAY,GAA6D;IAC7E,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,uBAAuB,EAAE;IACpF,OAAO,EAAE,EAAE,MAAM,EAAE,8CAA8C,EAAE,MAAM,EAAE,4BAA4B,EAAE;IACzG,MAAM,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE,MAAM,EAAE,2BAA2B,EAAE;CAC3G,CAAC;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,oFAAoF;AACpF,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,mFAAmF;AACnF,iEAAiE;AACjE,MAAM,UAAU,GAAiC;IAC/C,WAAW,EAAE,SAAS;IACtB,SAAS,EAAE,QAAQ;IACnB,iBAAiB,EAAE,QAAQ;CAC5B,CAAC;AACF,oFAAoF;AACpF,mFAAmF;AACnF,sFAAsF;AACtF,wCAAwC;AACxC,MAAM,UAAU,GAAiC;IAC/C,UAAU,EAAE,iBAAiB;IAC7B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,yFAAyF;AACzF,2FAA2F;AAC3F,wFAAwF;AACxF,SAAgB,kBAAkB,CAChC,KAAa,EACb,WAAiD,EAAE;IAEnD,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,kBAAkB;QACpC,CAAC,CAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CACZ,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,kBAAkB,CACxE,EAAE,CAAC,CAAC,CAA8B;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAiB,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC;IAC3E,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM;QACf,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,2BAAY,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,yFAAyF;AACzF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE;IAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AACH;gEACgE;AAChE,SAAgB,YAAY,CAAC,MAAc;IACzC,MAAM,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAC9G,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAEvF,QAAA,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC7B,QAAA,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;AACzB,QAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;AAClC,QAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;AAE/C,kGAAkG;AAClG,+FAA+F;AAC/F,gEAAgE;AAChE,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE9F,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,aAAqB;IACzE,OAAO,eAAe,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,aAAa,CAAC,CAAC;AACzE,CAAC;AAED,6FAA6F;AAC7F,gGAAgG;AAChG,SAAgB,uBAAuB,CACrC,WAAmB,EACnB,MAAiE;IAC/D,aAAa,EAAE,uBAAe;IAC9B,OAAO,EAAE,iBAAS;IAClB,KAAK,EAAE,mBAAW;CACnB;IAED,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,CACL,4BAA4B,WAAW,cAAc,GAAG,CAAC,OAAO,WAAW,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,aAAa,KAAK;QACvH,iEAAiE;QACjE,iBAAiB,GAAG,CAAC,KAAK,6BAA6B;QACvD,iDAAiD,WAAW,wCAAwC,CACrG,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,KAAqB;IACnD,IAAA,mBAAS,EAAC,kBAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAA,uBAAa,EAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED,SAAgB,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,IAAA,sBAAY,EAAC,gBAAgB,EAAE,MAAM,CAAC,CACrB,CAAC;QACpB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,+FAA+F;AAC/F,+FAA+F;AAC/F,oFAAoF;AACpF,uCAAuC;AACvC,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,4FAA4F;AAC5F,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,mFAAmF;AACnF,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA6EA,gDAgBC;AAUD,oCAGC;AAYD,4CAIC;AAID,0DAeC;AAED,0CAUC;AAED,0CAYC;AAED,4CAMC;AAqBD,0CAGC;AAKD,gCAGC;AA/MD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAAiC;AACjC,iDAA8C;AAU9C,iGAAiG;AACjG,6FAA6F;AAC7F,qBAAqB;AACR,QAAA,UAAU,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,IAAA,gBAAI,EAAC,kBAAU,EAAE,kBAAkB,CAAC,CAAC;AAE9D,0FAA0F;AAC1F,yFAAyF;AACzF,yFAAyF;AACzF,6DAA6D;AAC7D,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC,IAAI,CAAC;QACjH,OAAO,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAYD,MAAM,YAAY,GAA2C;IAC3D,UAAU,EAAE;QACV,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE,uBAAuB;QAC/B,YAAY,EAAE,CAAC,iDAAiD,CAAC;KAClE;IACD,OAAO,EAAE,EAAE,MAAM,EAAE,8CAA8C,EAAE,MAAM,EAAE,4BAA4B,EAAE;CAC1G,CAAC;AACF,MAAM,UAAU,GAAiC;IAC/C,WAAW,EAAE,SAAS;IACtB,kFAAkF;IAClF,SAAS,EAAE,YAAY;CACxB,CAAC;AACF,oFAAoF;AACpF,yFAAyF;AACzF,4BAA4B;AAC5B,MAAM,UAAU,GAAiC;IAC/C,UAAU,EAAE,iBAAiB;IAC7B,OAAO,EAAE,WAAW;CACrB,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE9F,uFAAuF;AACvF,+CAA+C;AAC/C,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,CAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAC3F,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAChG,EAAE,CAAC,CAAC,CAAC,CAAC;AACT,CAAC;AAED,yFAAyF;AACzF,2FAA2F;AAC3F,wFAAwF;AACxF,SAAgB,kBAAkB,CAChC,KAAa,EACb,WAAiD,EAAE;IAEnD,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,GAAG,GAAiB,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC;IAC3E,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM;QACf,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,2BAAY,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,yFAAyF;AACzF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE;IAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AACH;gEACgE;AAChE,SAAgB,YAAY,CAAC,MAAc;IACzC,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAEY,QAAA,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;AAC7B,QAAA,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;AACzB,QAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;AAClC,QAAA,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;AAE/C,kGAAkG;AAClG,+FAA+F;AAC/F,8FAA8F;AAC9F,gGAAgG;AAChG,uDAAuD;AACvD,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,aAAqB;IACzE,IAAI,eAAe,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,mBAAmB,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC;AAED,6FAA6F;AAC7F,gGAAgG;AAChG,SAAgB,uBAAuB,CACrC,WAAmB,EACnB,MAAiE;IAC/D,aAAa,EAAE,uBAAe;IAC9B,OAAO,EAAE,iBAAS;IAClB,KAAK,EAAE,mBAAW;CACnB;IAED,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,CACL,4BAA4B,WAAW,cAAc,GAAG,CAAC,OAAO,WAAW,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,aAAa,KAAK;QACvH,iEAAiE;QACjE,iBAAiB,GAAG,CAAC,KAAK,6BAA6B;QACvD,iDAAiD,WAAW,wCAAwC,CACrG,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,KAAqB;IACnD,IAAA,mBAAS,EAAC,kBAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAA,uBAAa,EAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED,SAAgB,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,IAAA,sBAAY,EAAC,gBAAgB,EAAE,MAAM,CAAC,CACrB,CAAC;QACpB,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,+FAA+F;AAC/F,+FAA+F;AAC/F,oFAAoF;AACpF,uCAAuC;AACvC,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,4FAA4F;AAC5F,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,mFAAmF;AACnF,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC"}

package/dist/earlyAccessNotice.d.ts

@@ -0,0 +1,9 @@
+/** The notice line for a command path such as ["vehicle", "validate"], or null when there is none. */
+export declare function earlyAccessNoticeFor(commandPath: readonly string[]): string | null;
+/** Print the notice for this command at most once per process. Never throws. */
+export declare function printEarlyAccessNotice(commandPath: readonly string[], env?: NodeJS.ProcessEnv): void;
+/** The names from the root command's direct child down to the executing command. */
+export declare function commandPathOf(command: {
+    name(): string;
+    parent: unknown;
+}): string[];

package/dist/earlyAccessNotice.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.earlyAccessNoticeFor = earlyAccessNoticeFor;
+exports.printEarlyAccessNotice = printEarlyAccessNotice;
+exports.commandPathOf = commandPathOf;
+// The "Early access" notice for creation commands whose kind is not yet stable.
+//
+// The kind -> stability map and the disclaimer wording live in @hypersoniclabs/helix-manifest
+// (creation-stability) so the MCP, this CLI and the website agree. This file only decides which
+// command is which kind and prints the line once per run.
+//
+// It goes to STDERR, always: `--json` output on stdout stays one parseable document. Set
+// HELIX_NO_EARLY_ACCESS_NOTICE=1 to silence it (scripts, and wrappers that already tell the user).
+const helix_manifest_1 = require("@hypersoniclabs/helix-manifest");
+/** Command path -> creation kind. Longest prefix wins; a path with no match prints nothing. */
+const COMMAND_KINDS = [
+    ['vehicle addon', 'vehicle-addon'],
+    ['vehicle', 'vehicle'],
+    ['device', 'device'],
+    ['pack', 'locomotion-pack'],
+    // Interactive item definitions are weapons and emotes today; neither kind is stable yet.
+    ['item-def', 'Weapon and emote'],
+];
+/** The notice line for a command path such as ["vehicle", "validate"], or null when there is none. */
+function earlyAccessNoticeFor(commandPath) {
+    const joined = commandPath.join(' ');
+    let best = null;
+    for (const entry of COMMAND_KINDS) {
+        const [prefix] = entry;
+        if ((joined === prefix || joined.startsWith(`${prefix} `)) && (!best || prefix.length > best[0].length))
+            best = entry;
+    }
+    if (!best)
+        return null;
+    return (0, helix_manifest_1.isEarlyAccessCreationKind)(best[1]) ? (0, helix_manifest_1.earlyAccessDisclaimer)(best[1]) : null;
+}
+let printed = false;
+/** Print the notice for this command at most once per process. Never throws. */
+function printEarlyAccessNotice(commandPath, env = process.env) {
+    if (printed || env.HELIX_NO_EARLY_ACCESS_NOTICE === '1')
+        return;
+    const notice = earlyAccessNoticeFor(commandPath);
+    if (!notice)
+        return;
+    printed = true;
+    try {
+        process.stderr.write(`${notice}\n`);
+    }
+    catch {
+        /* a closed stderr must never fail the command */
+    }
+}
+/** The names from the root command's direct child down to the executing command. */
+function commandPathOf(command) {
+    const names = [];
+    let current = command;
+    while (current && current.parent) {
+        names.unshift(current.name());
+        current = current.parent;
+    }
+    return names;
+}
+//# sourceMappingURL=earlyAccessNotice.js.map

package/dist/earlyAccessNotice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"earlyAccessNotice.js","sourceRoot":"","sources":["../src/earlyAccessNotice.ts"],"names":[],"mappings":";;AAqBA,oDASC;AAKD,wDAUC;AAGD,sCAQC;AAxDD,gFAAgF;AAChF,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,0DAA0D;AAC1D,EAAE;AACF,yFAAyF;AACzF,mGAAmG;AACnG,mEAAkG;AAElG,+FAA+F;AAC/F,MAAM,aAAa,GAA2D;IAC5E,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,yFAAyF;IACzF,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF,sGAAsG;AACtG,SAAgB,oBAAoB,CAAC,WAA8B;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,GAAqC,IAAI,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACxH,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAA,0CAAyB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,sCAAqB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,gFAAgF;AAChF,SAAgB,sBAAsB,CAAC,WAA8B,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzG,IAAI,OAAO,IAAI,GAAG,CAAC,4BAA4B,KAAK,GAAG;QAAE,OAAO;IAChE,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAgB,aAAa,CAAC,OAA4C;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAA+C,OAAO,CAAC;IAClE,OAAO,OAAO,IAAK,OAA+B,CAAC,MAAM,EAAE,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO,GAAI,OAAkE,CAAC,MAAM,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.js

@@ -74,6 +74,7 @@ const browserLogin_1 = require("./browserLogin");
 const unreal_1 = require("./unreal");
 const unrealPublish_1 = require("./unrealPublish");
 const device_1 = require("./device");
+const earlyAccessNotice_1 = require("./earlyAccessNotice");
 const types_1 = require("./bridge/types");
 const cliAuthority_1 = require("./continuum/cliAuthority");
 const adminPackagePinCommand_1 = require("./continuum/adminPackagePinCommand");
@@ -85,6 +86,10 @@ program
     .name('helix')
     .description('HELIX creator CLI — scaffold, validate, and publish Instant Worlds')
     .version((0, lib_1.cliVersion)());
+// Early-access kinds (device, vehicle, add-on, ...) say so once per run, on stderr, before the work starts.
+program.hook('preAction', (_thisCommand, actionCommand) => {
+    (0, earlyAccessNotice_1.printEarlyAccessNotice)((0, earlyAccessNotice_1.commandPathOf)(actionCommand));
+});
 function fail(message) {
     // Synchronous: stderr is an ASYNC pipe on macOS, so console.error + process.exit cut a long refusal at ~512 bytes
     // whenever the output was piped — exactly how an agent or CI reads it — losing the next command it names.
@@ -937,7 +942,7 @@ vehicleCommand
         let report;
         if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(target)) {
             const creds = (0, config_1.loadCredentials)();
-            const apiUrl = creds?.apiUrl ?? process.env.HELIX_API_URL ?? 'https://helix-backend-api-helix3.up.railway.app';
+            const apiUrl = creds?.apiUrl ?? config_1.DEFAULT_API_URL;
             const res = await fetch(`${apiUrl.replace(/\/$/, '')}/api/v1/universal-items/${target}`, { headers: { accept: 'application/json' } });
             if (!res.ok)
                 throw new Error(`item ${target}: HTTP ${res.status}`);
@@ -1209,7 +1214,8 @@ program
         }
         // Interactive: open the browser, let the website mint + hand back a token.
         // An explicit --api-url derives its own site; otherwise use the env website default.
-        const webUrl = opts.webUrl ?? (opts.apiUrl === config_1.DEFAULT_API_URL ? config_1.DEFAULT_WEB_URL : (0, browserLogin_1.deriveWebUrl)(opts.apiUrl));
+        const webUrl = opts.webUrl ??
+            (opts.apiUrl === config_1.DEFAULT_API_URL ? config_1.DEFAULT_WEB_URL : ((0, config_1.webUrlForApi)(opts.apiUrl) ?? (0, browserLogin_1.deriveWebUrl)(opts.apiUrl)));
         console.log(`Opening your browser to sign in (${webUrl}) …`);
         const { token } = await (0, browserLogin_1.browserLogin)({
             webUrl,