@hypersoniclabs/helix-cli 0.1.7 → 0.1.24-helix3.438

package/dist/publishDuplicateGuard.d.ts

@@ -0,0 +1,92 @@
+/**
+ * REFUSING TO PUBLISH A DUPLICATE ADD-ON A CREATOR ALREADY HAS LIVE.
+ *
+ * `helix item publish` has no memory: a lane that republishes from a stale local staging
+ * directory, or reruns a batch script against the wrong output, mints a brand-new item every
+ * time — same mesh, same title, same slot, different id — with nothing anywhere to notice. That
+ * is exactly the shape of the 15-item duplicate-publish incident this guard exists to make
+ * structurally impossible, not just documented against: a lane published new items from stale
+ * local staging directories without checking the live catalogue first.
+ *
+ * Two independent signals, either one enough to refuse:
+ *
+ *   1. TITLE + SLOT TYPE + BASE ITEM, same creator. The backend's own search endpoint filters by
+ *      `creatorId` and `slotType` directly (confirmed via its own 400 error listing supported params),
+ *      so this is one targeted query, not a full-catalogue scan. Title compares case-insensitively (so
+ *      "Sinth Ascetic Pants" catches "sinth ascetic pants") but not as a substring — a real revision
+ *      like "Sinth Ascetic Pants V2" is a different title and must NOT false-positive.
+ *
+ *      WHY BASE ITEM IS PART OF THE KEY. Title + slot alone is not an identity: a garment title is
+ *      only unique WITHIN a host. "Cargo Pants" legitimately exists for Base Male and for Base Female
+ *      at the same `character.bottom@1` slot, and a male/female pair is a normal thing to publish, not
+ *      a duplicate. Keying on title + slot made every legitimate cross-gender pair a false positive,
+ *      whose documented escape hatch was `--allow-duplicate` — and a lane that applied that flag across
+ *      a whole batch to get past the false positive ALSO punched through the true positive, which is
+ *      how a second Female Ninja Costume went live beside the first. The host the add-on fits is the
+ *      missing half of the identity: both sides' `fits.only.items` (an array of base item ids, e.g.
+ *      Base Male `b45e4a1e-…` / Base Female `bcafa7e1-…`), and a refusal requires the sets to OVERLAP.
+ *      Titles that match under disjoint host sets are different garments and must pass with no flag.
+ *
+ *      FAIL SAFE: if EITHER side's base ids are missing or empty, the base-item test cannot separate
+ *      the two and the pair is treated as a match. A gap in the catalogue data must weaken the guard to
+ *      its OLD title+slot behaviour, never below it — an unknown host is not a licence to publish.
+ *
+ *   2. CONTENT HASH, same creator. There is no live-catalogue field exposing a hosted asset's
+ *      content hash to compare against (checked: the search/detail responses carry `sizeBytes` and a
+ *      Continuum `manifestCid`, which hashes the sealed PACKAGE MANIFEST, not the raw mesh bytes) —
+ *      so an API-side hash comparison is not practically available without a new backend surface.
+ *      What IS available locally: this machine's own record of what it has already published. Every
+ *      successful add_on publish from THIS CLI records the mesh's sha256 under `~/.helix/`, beside
+ *      credentials.json — the same per-machine directory every agent lane on this host already
+ *      shares — so a republish of byte-identical content from a stale staging directory, even under
+ *      a different title, is still caught. This is a local record of history, not a live-catalogue
+ *      guarantee: it will not catch a duplicate uploaded from a machine that has never published it
+ *      before. The title+slot+base check above is the one that still holds in that case.
+ *
+ * `--allow-duplicate` is the explicit, auditable override for a creator who genuinely means to
+ * publish a second copy (an intentional variant, a deliberate re-release) — never a silent default.
+ */
+export interface PublishDuplicateGuardInput {
+    /** The title about to be published. */
+    title: string;
+    /** `fits.slotType` — always present by the time this runs; add_on payloads require it. */
+    slotType: string;
+    /** `fits.only.items` on the payload being published — the base host item ids this add-on fits.
+     * Empty/undefined is possible (an add-on may declare its host by tag or not at all yet); the
+     * fail-safe in `baseItemSetsOverlap` treats that as "cannot separate", see the file header. */
+    baseItemIds: readonly string[];
+    /** sha256 of the mesh bytes about to be uploaded. Undefined for a meshless (clip-set) add-on. */
+    contentHash: string | undefined;
+    /** The authenticated creator's id (JWT `sub`), scoping both checks to "this creator's own items". */
+    creatorId: string;
+    apiUrl: string;
+}
+export interface PublishDuplicateMatch {
+    reason: 'content-hash' | 'title-slot';
+    itemId: string;
+    title: string;
+}
+interface CatalogueApi {
+    request<T>(method: string, path: string, body?: unknown): Promise<T>;
+}
+interface HashCacheEntry {
+    itemId: string;
+    title: string;
+    slotType: string;
+    creatorId: string;
+    publishedAt: string;
+}
+/** Records a successful add_on publish's content hash for future duplicate detection. Best-effort:
+ * a write failure (read-only home, disk full) must never fail the publish that already succeeded. */
+export declare function recordPublishedContentHash(contentHash: string, entry: HashCacheEntry): void;
+/** sha256 of the mesh bytes about to be uploaded — the same identity a republish of the exact same
+ * file, from any staging directory or filename, will always reproduce. */
+export declare function contentHashOf(meshBytes: Buffer): string;
+/**
+ * Checks both signals and returns the first match, or null when neither fires. Does not throw —
+ * the caller decides how to surface a match. This is retained for read-only
+ * duplicate inspection of existing catalogue content.
+ */
+export declare function findDuplicatePublish(api: CatalogueApi, input: PublishDuplicateGuardInput): Promise<PublishDuplicateMatch | null>;
+export declare function renderDuplicateMatchError(match: PublishDuplicateMatch, title: string, slotType: string): string;
+export {};

package/dist/publishDuplicateGuard.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordPublishedContentHash = recordPublishedContentHash;
+exports.contentHashOf = contentHashOf;
+exports.findDuplicatePublish = findDuplicatePublish;
+exports.renderDuplicateMatchError = renderDuplicateMatchError;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const config_1 = require("./config");
+const CATALOGUE_PAGE_LIMIT = 50;
+/** `fits.only.items` as string ids, or [] when the shape is anything else — never throws, because a
+ * catalogue row with an unexpected `fits` shape must degrade to the fail-safe, not break the run. */
+function baseItemIdsOf(rowFits) {
+    if (typeof rowFits !== 'object' || rowFits === null)
+        return [];
+    const only = rowFits.only;
+    if (typeof only !== 'object' || only === null)
+        return [];
+    const items = only.items;
+    if (!Array.isArray(items))
+        return [];
+    return items
+        .filter((item) => typeof item === 'string')
+        .map((item) => item.trim().toLowerCase())
+        .filter((item) => item !== '');
+}
+/** The identity half the guard is missing without a host. Two add-ons are the same garment only when
+ * the base hosts they fit OVERLAP — a male pair and a female pair of "Cargo Pants" are different
+ * garments, not a duplicate. Empty on either side means the host cannot be established at all, and an
+ * unknown host must refuse rather than pass: that is the guard's pre-base-item behaviour, and a gap in
+ * the data is not evidence the two are different. */
+function baseItemSetsOverlap(inputBaseItemIds, existingBaseItemIds) {
+    const input = inputBaseItemIds.map((id) => id.trim().toLowerCase()).filter((id) => id !== '');
+    if (input.length === 0 || existingBaseItemIds.length === 0)
+        return true;
+    return existingBaseItemIds.some((id) => input.includes(id));
+}
+/** Every live add_on this creator owns in `slotType` — paginated, since one creator can plausibly
+ * clear 50 items in a single slot over a long-running catalogue (the male/female wearables pilot
+ * alone published dozens per slot). Carries each row's base host ids, because title+slot is not an
+ * identity on its own: see the file header. */
+async function creatorAddOnsInSlot(api, creatorId, slotType) {
+    const rows = [];
+    for (let page = 1;; page++) {
+        const params = new URLSearchParams({
+            kind: 'add_on',
+            creatorId,
+            slotType,
+            status: 'published',
+            limit: String(CATALOGUE_PAGE_LIMIT),
+            page: String(page),
+        });
+        const response = await api.request('GET', `/api/v1/universal-items?${params.toString()}`);
+        const items = response.items ?? [];
+        for (const row of items) {
+            if (typeof row.id === 'string' && typeof row.title === 'string') {
+                rows.push({ id: row.id, title: row.title, baseItemIds: baseItemIdsOf(row.fits) });
+            }
+        }
+        const total = typeof response.totalItems === 'number' ? response.totalItems : rows.length;
+        if (rows.length >= total || items.length === 0)
+            break;
+    }
+    return rows;
+}
+// --- local publish-history cache (content-hash signal) --------------------------------------
+const HASH_CACHE_FILE = (0, node_path_1.join)(config_1.CONFIG_DIR, 'publish-content-hashes.json');
+function loadHashCache() {
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(HASH_CACHE_FILE, 'utf8'));
+        return typeof parsed === 'object' && parsed !== null ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Records a successful add_on publish's content hash for future duplicate detection. Best-effort:
+ * a write failure (read-only home, disk full) must never fail the publish that already succeeded. */
+function recordPublishedContentHash(contentHash, entry) {
+    try {
+        const cache = loadHashCache();
+        cache[contentHash] = entry;
+        (0, node_fs_1.mkdirSync)(config_1.CONFIG_DIR, { recursive: true });
+        (0, node_fs_1.writeFileSync)(HASH_CACHE_FILE, JSON.stringify(cache, null, 2), { mode: 0o600 });
+    }
+    catch {
+        // Best-effort local cache — see doc comment above.
+    }
+}
+/** sha256 of the mesh bytes about to be uploaded — the same identity a republish of the exact same
+ * file, from any staging directory or filename, will always reproduce. */
+function contentHashOf(meshBytes) {
+    return (0, node_crypto_1.createHash)('sha256').update(meshBytes).digest('hex');
+}
+/**
+ * Checks both signals and returns the first match, or null when neither fires. Does not throw —
+ * the caller decides how to surface a match. This is retained for read-only
+ * duplicate inspection of existing catalogue content.
+ */
+async function findDuplicatePublish(api, input) {
+    if (input.contentHash !== undefined) {
+        const cache = loadHashCache();
+        const cached = cache[input.contentHash];
+        if (cached !== undefined && cached.creatorId === input.creatorId) {
+            return { reason: 'content-hash', itemId: cached.itemId, title: cached.title };
+        }
+    }
+    const existing = await creatorAddOnsInSlot(api, input.creatorId, input.slotType);
+    const normalizedTitle = input.title.trim().toLowerCase();
+    // A title match only refuses when the base host also overlaps. A title-match under a DISJOINT host
+    // set is the legitimate cross-gender pair (or any same-slot, different-base garment) and must pass
+    // silently, with no flag. When neither side names a usable host, baseItemSetsOverlap declines to
+    // separate them and refuses — today's behaviour, preserved.
+    const titleMatch = existing.find((row) => row.title.trim().toLowerCase() === normalizedTitle
+        && baseItemSetsOverlap(input.baseItemIds, row.baseItemIds));
+    if (titleMatch)
+        return { reason: 'title-slot', itemId: titleMatch.id, title: titleMatch.title };
+    return null;
+}
+function renderDuplicateMatchError(match, title, slotType) {
+    const because = match.reason === 'content-hash'
+        ? 'this exact mesh (by content hash) was already published from this machine'
+        : `you already have a live add-on with this exact title in slot "${slotType}" that fits the same base item`;
+    return (`Refusing to publish "${title}" — ${because}: existing item "${match.title}" (${match.itemId}). ` +
+        'If this is a genuine new item, pass --allow-duplicate.');
+}
+//# sourceMappingURL=publishDuplicateGuard.js.map

package/dist/publishDuplicateGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishDuplicateGuard.js","sourceRoot":"","sources":["../src/publishDuplicateGuard.ts"],"names":[],"mappings":";;AAwLA,gEASC;AAID,sCAEC;AAOD,oDA0BC;AAED,8DAQC;AAlPD,6CAAyC;AACzC,qCAAiE;AACjE,yCAAiC;AACjC,qCAAsC;AAqFtC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAWhC;qGACqG;AACrG,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACxC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;qDAIqD;AACrD,SAAS,mBAAmB,CAAC,gBAAmC,EAAE,mBAAsC;IACtG,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;+CAG+C;AAC/C,KAAK,UAAU,mBAAmB,CAChC,GAAiB,EACjB,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,MAAM,CAAC,oBAAoB,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAChC,KAAK,EACL,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAC/C,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1F,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAE/F,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,mBAAU,EAAE,6BAA6B,CAAC,CAAC;AAYxE,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,MAAM,CAAC,CAAY,CAAC;QAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;qGACqG;AACrG,SAAgB,0BAA0B,CAAC,WAAmB,EAAE,KAAqB;IACnF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;QAC3B,IAAA,mBAAS,EAAC,mBAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAA,uBAAa,EAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,SAAgB,aAAa,CAAC,SAAiB;IAC7C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,GAAiB,EACjB,KAAiC;IAEjC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACjE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,mGAAmG;IACnG,mGAAmG;IACnG,iGAAiG;IACjG,4DAA4D;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAC9B,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,eAAe;WAC/C,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAC7D,CAAC;IACF,IAAI,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAEhG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,yBAAyB,CAAC,KAA4B,EAAE,KAAa,EAAE,QAAgB;IACrG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,cAAc;QAC7C,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,iEAAiE,QAAQ,gCAAgC,CAAC;IAC9G,OAAO,CACL,wBAAwB,KAAK,OAAO,OAAO,oBAAoB,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,KAAK;QACjG,wDAAwD,CACzD,CAAC;AACJ,CAAC"}

package/dist/realizability.d.ts

@@ -0,0 +1,36 @@
+export declare const TICK_NODE_CEILING = 100000;
+type JsonObject = Record<string, unknown>;
+export type ModuleDeclaration = JsonObject & {
+    id?: unknown;
+    bank?: unknown;
+};
+export type PublishedBank = {
+    checksum: string;
+};
+export type RealizabilityDeps = {
+    resolveBank(ref: string): Promise<PublishedBank>;
+    /**
+     * `playerCap` is the number of players a room of the modules' program can hold, which is what
+     * every per-player budget term is charged at: 24 for a standard default block, a room type's own
+     * seats for a type, and up to 64 for a `capacityClass: "large"` program.
+     */
+    validateBudgets(modules: ModuleDeclaration[], ceiling: number, playerCap: number): string[];
+};
+export type RealizabilityFailure = {
+    moduleId: string;
+    bankRef: string;
+    reason: string;
+};
+type ParsedBankRef = {
+    ref: string;
+    namespace: string | null;
+    slug: string;
+    version: string;
+    checksum: string;
+};
+export declare function parseBankRef(value: unknown): ParsedBankRef | null;
+export declare function checksumOf(value: unknown): string | null;
+export declare function registryRealizabilityDeps(apiUrl: string): RealizabilityDeps;
+export declare function checkRealizability(manifest: unknown, deps: RealizabilityDeps): Promise<RealizabilityFailure[]>;
+export declare function renderRealizabilityRefusal(failures: RealizabilityFailure[]): string;
+export {};

package/dist/realizability.js

@@ -0,0 +1,269 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TICK_NODE_CEILING = void 0;
+exports.parseBankRef = parseBankRef;
+exports.checksumOf = checksumOf;
+exports.registryRealizabilityDeps = registryRealizabilityDeps;
+exports.checkRealizability = checkRealizability;
+exports.renderRealizabilityRefusal = renderRealizabilityRefusal;
+const manifestContract = __importStar(require("@hypersoniclabs/helix-manifest"));
+const api_1 = require("./api");
+exports.TICK_NODE_CEILING = 100_000;
+// A real fleet reference is `itx:darts@0.1.8#6c754337…`: a NAMESPACED slug and a BARE 64-character
+// hex digest. The previous pattern required a literal `sha256:` prefix and allowed only [a-z0-9-]
+// in the slug, so it rejected every reference actually in use — on both counts at once — while
+// accepting the invented shape used in this file's own tests. A `sha256:` prefix is now tolerated
+// on input and never required, and digests are normalised to bare lowercase hex on BOTH sides
+// before they are compared, so the prefix can never decide a mismatch.
+// Groups: 1 = optional namespace, 2 = registry slug, 3 = version, 4 = digest.
+//
+// The NAMESPACE IS CAPTURED SEPARATELY AND IS NOT PART OF THE SLUG. `itx:` is added by
+// `interactableBank` when a bank reference is formatted; the registry itself is keyed on the bare
+// id, which is what `resolveVerifiedBundle` queries with (`reference.id`) and what comes back as
+// `bundle.slug`. Folding the namespace into the slug makes this gate request
+// `/instant-packages/itx%3Adarts/…`, get a 404, and refuse a package that is in fact published.
+//
+// The VERSION MUST START WITH A DIGIT. The registry serves `/versions/latest` (see assets.ts), so
+// an unconstrained version group lets `itx:darts@latest#<digest>` through: it would resolve, its
+// digest could match today, and the gate would approve a FLOATING reference as if it were an
+// immutable pin. A leading digit is exactly what separates a version from an alias (`latest`,
+// `next`, `stable`) without inventing a semver grammar that might reject a legal version.
+const BANK_REF = /^(?:([a-z0-9]+):)?([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)@(\d[^\s#]*)#(?:sha256:)?([a-f0-9]{64})$/i;
+function normalizeDigest(value) {
+    return value.trim().replace(/^sha256:/i, '').toLowerCase();
+}
+function parseBankRef(value) {
+    if (typeof value === 'string') {
+        const match = BANK_REF.exec(value);
+        return match ? { ref: value, namespace: match[1] ?? null, slug: match[2], version: match[3], checksum: normalizeDigest(match[4]) } : null;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const bank = value;
+    const slug = typeof bank.slug === 'string' ? bank.slug : typeof bank.package === 'string' ? bank.package : null;
+    const version = typeof bank.version === 'string' ? bank.version : null;
+    const checksum = typeof bank.checksum === 'string' ? bank.checksum : null;
+    if (!slug || !version || !checksum)
+        return null;
+    const ref = `${slug}@${version}#${checksum}`;
+    const match = BANK_REF.exec(ref);
+    return match ? { ref, namespace: match[1] ?? null, slug: match[2], version: match[3], checksum: normalizeDigest(match[4]) } : null;
+}
+function moduleName(module, index) {
+    return typeof module.id === 'string' && module.id ? module.id : `modules[${index}]`;
+}
+function asModule(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+// Decision #352 settled that the digest in a bank ref IS the registry's published `checksumSha256`,
+// read by name and never recomputed. The previous version guessed across `checksum`, `integrity`
+// and `sha256` — none of which is the published field. Guessing is strictly worse than failing
+// here: if a near-miss field happens to exist, the gate passes on a digest nobody ever agreed on,
+// which is the exact failure this gate exists to prevent.
+// A module with no `bank` key is INLINE: its rules are in the manifest (helix-manifest refuses a
+// module that has both, and refuses a bank ref inside a room type). A `bank` that is present but
+// unreadable is still a malformed ref, never an inline module.
+const INLINE = '<inline>';
+function isInline(module) {
+    return module.bank === undefined || module.bank === null;
+}
+function checksumOf(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const item = value;
+    const published = item.checksumSha256;
+    if (typeof published === 'string' && published.trim())
+        return normalizeDigest(published);
+    return checksumOf(item.manifest);
+}
+// Registry-backed implementation for the temporary resolver seam. When the runtime resolver is
+// exposed by the backend, replace only this function; the gate and its diagnostics stay unchanged.
+function registryRealizabilityDeps(apiUrl) {
+    const api = new api_1.HelixApi(apiUrl);
+    return {
+        async resolveBank(ref) {
+            const parsed = parseBankRef(ref);
+            if (!parsed)
+                throw new Error('malformed bank ref');
+            try {
+                const item = await api.requestItem('GET', `/api/v1/instant-packages/${encodeURIComponent(parsed.slug)}/versions/${encodeURIComponent(parsed.version)}`);
+                const checksum = checksumOf(item);
+                if (!checksum)
+                    throw new Error('published package does not expose checksumSha256');
+                return { checksum };
+            }
+            catch (err) {
+                if (err instanceof api_1.ApiError && err.status === 404)
+                    throw new Error('bank is not published');
+                throw err;
+            }
+        },
+        validateBudgets(modules, ceiling, playerCap) {
+            const contract = manifestContract;
+            const validator = contract.validateModuleBudgets ?? contract.validateMultiplayerBudgets;
+            if (typeof validator !== 'function') {
+                throw new Error('installed helix-manifest does not provide multiplayer budget validation');
+            }
+            // A helix-manifest from before large rooms takes two arguments and ignores the third.
+            const result = validator(modules, ceiling, playerCap);
+            if (Array.isArray(result))
+                return result.map(String);
+            if (result && typeof result === 'object' && Array.isArray(result.errors)) {
+                return result.errors.map(String);
+            }
+            return result === true || result === undefined ? [] : [String(result)];
+        },
+    };
+}
+// The seat caps the room server clamps a room to. Read from the installed helix-manifest so the gate
+// charges what the validator charges; the literals cover a manifest package that predates the
+// exports, and are the values those constants have.
+function seatCap(name, fallback) {
+    const value = manifestContract[name];
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function declaredMaxPlayers(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
+}
+// The room server never seats fewer than this (helix-colyseus-server tuning, MIN_MAX_CLIENTS), so a
+// program that declares maxPlayers 1 still runs in a room of two.
+const MIN_ROOM_SEATS = 2;
+// Every program of the world that carries modules, with the number of players its room can hold.
+// The default block is a standard room of 24 whatever the world's maxPlayers says, unless it
+// declares `capacityClass: "large"`, which is a room of the declared maxPlayers up to 64. A room
+// type is a room of its own: its own maxPlayers, clamped to 24, or to 64 when the type is large.
+// These are helix-manifest's own numbers (`programPlayerCap`), raised to the server's floor of 2.
+// Room-type modules are inline (helix-manifest refuses a bank ref there), so for a room type this
+// is a budget check; a bank ref that reaches here anyway is resolved like any other.
+function modulePrograms(manifest, multiplayer) {
+    const standard = seatCap('PLATFORM_MAX_PLAYERS_PER_ROOM', 24);
+    const large = seatCap('PLATFORM_MAX_PLAYERS_PER_LARGE_ROOM', 64);
+    const programs = [];
+    if (Array.isArray(multiplayer.modules)) {
+        programs.push({
+            label: '',
+            modules: multiplayer.modules,
+            playerCap: multiplayer.capacityClass === 'large'
+                ? Math.max(MIN_ROOM_SEATS, Math.min(declaredMaxPlayers(manifest.maxPlayers, standard), large))
+                : standard,
+        });
+    }
+    const roomTypes = multiplayer.roomTypes;
+    if (roomTypes && typeof roomTypes === 'object' && !Array.isArray(roomTypes)) {
+        for (const [name, raw] of Object.entries(roomTypes)) {
+            if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+                continue;
+            const type = raw;
+            if (!Array.isArray(type.modules))
+                continue;
+            // Absent, a room type's maxPlayers is 10 (helix-manifest, HelixRoomType).
+            const declared = declaredMaxPlayers(type.maxPlayers, 10);
+            programs.push({
+                label: `roomTypes.${name}: `,
+                modules: type.modules,
+                playerCap: Math.max(MIN_ROOM_SEATS, Math.min(declared, type.capacityClass === 'large' ? large : standard)),
+            });
+        }
+    }
+    return programs;
+}
+async function checkRealizability(manifest, deps) {
+    if (!manifest || typeof manifest !== 'object')
+        return [];
+    const multiplayer = manifest.multiplayer;
+    if (!multiplayer || typeof multiplayer !== 'object' || Array.isArray(multiplayer))
+        return [];
+    // flat-v0 and pre-module multiplayer are deliberately unchanged: no program with modules, no work.
+    const programs = modulePrograms(manifest, multiplayer);
+    if (!programs.length)
+        return [];
+    const failures = [];
+    const resolved = new Map();
+    await Promise.all(programs.flatMap((program) => program.modules.map(async (raw, index) => {
+        const module = asModule(raw);
+        const id = program.label + moduleName(module, index);
+        // An inline module carries its program in the manifest, so there is no bank for the server to
+        // resolve. Only its budget is checked, below.
+        if (isInline(module))
+            return;
+        const bank = parseBankRef(module.bank);
+        const shown = typeof module.bank === 'string' ? module.bank : JSON.stringify(module.bank);
+        if (!bank) {
+            failures.push({ moduleId: id, bankRef: shown ?? '<missing>', reason: 'malformed bank ref (expected [namespace:]slug@version#<64 hex characters>, with an exact version rather than a moving alias such as latest)' });
+            return;
+        }
+        try {
+            const published = await (resolved.get(bank.ref) ?? (() => {
+                const request = deps.resolveBank(bank.ref);
+                resolved.set(bank.ref, request);
+                return request;
+            })());
+            if (normalizeDigest(published.checksum) !== bank.checksum) {
+                failures.push({ moduleId: id, bankRef: bank.ref, reason: `checksum mismatch (manifest ${bank.checksum}, published ${published.checksum})` });
+            }
+        }
+        catch (err) {
+            failures.push({ moduleId: id, bankRef: bank.ref, reason: err instanceof Error ? err.message : String(err) });
+        }
+    })));
+    // Budgets are a property of one program in one room, so each program is checked on its own, at
+    // the number of players its room can hold.
+    for (const program of programs) {
+        const modules = program.modules;
+        const moduleId = modules.map((module, index) => program.label + moduleName(asModule(module), index)).join(', ');
+        const bankRef = modules.map((module) => (isInline(asModule(module)) ? INLINE : parseBankRef(asModule(module).bank)?.ref ?? '<malformed>')).join(', ');
+        try {
+            for (const reason of deps.validateBudgets(modules, exports.TICK_NODE_CEILING, program.playerCap)) {
+                failures.push({ moduleId, bankRef, reason });
+            }
+        }
+        catch (err) {
+            failures.push({ moduleId, bankRef, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return failures;
+}
+function renderRealizabilityRefusal(failures) {
+    return [
+        'Refusing to publish: the server cannot realize this multiplayer world.',
+        ...failures.map((f) => (f.bankRef.split(', ').every((ref) => ref === INLINE)
+            ? `  - module "${f.moduleId}" (inline): ${f.reason}`
+            : `  - module "${f.moduleId}", bank "${f.bankRef}": ${f.reason}`)),
+        'Publish the referenced bank (or correct its version/checksum and module budgets), then retry.',
+        'To bypass this safety gate intentionally, pass --skip-realizability-check.',
+    ].join('\n');
+}
+//# sourceMappingURL=realizability.js.map

package/dist/realizability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realizability.js","sourceRoot":"","sources":["../src/realizability.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,oCAcC;AAuBD,gCAMC;AAID,8DAkCC;AA+DD,gDAsDC;AAED,gEASC;AAzQD,iFAAmE;AACnE,+BAA2C;AAE9B,QAAA,iBAAiB,GAAG,OAAO,CAAC;AA4BzC,mGAAmG;AACnG,kGAAkG;AAClG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,uEAAuE;AACvE,8EAA8E;AAC9E,EAAE;AACF,uFAAuF;AACvF,kGAAkG;AAClG,iGAAiG;AACjG,6EAA6E;AAC7E,gGAAgG;AAChG,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,0FAA0F;AAC1F,MAAM,QAAQ,GAAG,8FAA8F,CAAC;AAEhH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAmB,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrI,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB,EAAE,KAAa;IAC1D,OAAO,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC;AACtF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,kGAAkG;AAClG,0DAA0D;AAC1D,iGAAiG;AACjG,iGAAiG;AACjG,+DAA+D;AAC/D,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,SAAS,QAAQ,CAAC,MAAyB;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;AAC3D,CAAC;AAED,SAAgB,UAAU,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,KAAmB,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE;QAAE,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;IACzF,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,+FAA+F;AAC/F,mGAAmG;AACnG,SAAgB,yBAAyB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,cAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,GAAG;YACnB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAChC,KAAK,EACL,4BAA4B,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAC7G,CAAC;gBACF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACnF,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,cAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC5F,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;YACzC,MAAM,QAAQ,GAAG,gBAA8B,CAAC;YAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,0BAA0B,CAAC;YACxF,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YACD,sFAAsF;YACtF,MAAM,MAAM,GAAI,SAA2F,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACzI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,MAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,OAAS,MAAqB,CAAC,MAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,8FAA8F;AAC9F,oDAAoD;AACpD,SAAS,OAAO,CAAC,IAA6E,EAAE,QAAgB;IAC9G,MAAM,KAAK,GAAI,gBAA+B,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9F,CAAC;AASD,SAAS,kBAAkB,CAAC,KAAc,EAAE,QAAgB;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1G,CAAC;AAED,oGAAoG;AACpG,kEAAkE;AAClE,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,iGAAiG;AACjG,6FAA6F;AAC7F,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,kGAAkG;AAClG,qFAAqF;AACrF,SAAS,cAAc,CAAC,QAAoB,EAAE,WAAuB;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,SAAS,EAAE,WAAW,CAAC,aAAa,KAAK,OAAO;gBAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC9F,CAAC,CAAC,QAAQ;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACxC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAuB,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpE,MAAM,IAAI,GAAG,GAAiB,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,QAAiB,EACjB,IAAuB;IAEvB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,WAAW,GAAI,QAAuB,CAAC,WAAW,CAAC;IACzD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7F,mGAAmG;IACnG,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAsB,EAAE,WAAyB,CAAC,CAAC;IACnF,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC3D,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,8FAA8F;QAC9F,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,EAAE,6IAA6I,EAAE,CAAC,CAAC;YACtN,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC,CAAC;YACN,IAAI,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,+BAA+B,IAAI,CAAC,QAAQ,eAAe,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YAC/I,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC,CAAC,CAAC,CAAC,CAAC;IAEL,+FAA+F;IAC/F,2CAA2C;IAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAA8B,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtJ,IAAI,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,yBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,0BAA0B,CAAC,QAAgC;IACzE,OAAO;QACL,wEAAwE;QACxE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;YAC1E,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,MAAM,EAAE;YACpD,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,+FAA+F;QAC/F,4EAA4E;KAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/resolve.d.ts

@@ -13,6 +13,7 @@ export type VersionDetail = {
             range: string;
         };
         three?: string;
+        rapier?: string;
     } & Record<string, unknown>;
     codeBaseUrl: string;
     assetBaseUrl: string | null;
@@ -48,10 +49,15 @@ export type ResolvedPackage = {
     };
     /** Systems only: the full three.js version from the envelope — helix install wires the import map to runtime/three/<three>/. */
     three?: string;
+    /** Systems only: the full Rapier version from the envelope — helix install wires the import map to runtime/rapier/<rapier>/rapier.es.js. */
+    rapier?: string;
 };
 export type ResolvedPins = {
     systems: ResolvedPackage[];
     abilities: ResolvedPackage[];
 };
 export declare function normalizePinRange(range: string): string;
-export declare function resolvePins(apiUrl: string, pins: WorldPins, deps?: ResolveDeps): Promise<ResolvedPins>;
+/** Invocation-local asset constraints; the system envelope remains authoritative. */
+export declare function validateAssetPackConstraints(constraints: PinMap): void;
+export declare function defaultDeps(apiUrl: string): Promise<ResolveDeps>;
+export declare function resolvePins(apiUrl: string, pins: WorldPins, deps?: ResolveDeps, assetPacks?: PinMap): Promise<ResolvedPins>;