@hypersoniclabs/helix-manifest 0.3.18 → 0.3.42

package/README.md

@@ -32,14 +32,15 @@ const manifest = result.manifest; // NormalizedHelixManifest — defaults applie
 - `validateManifest(data)` / `parseManifest(json)` — validate + normalize a world `helix.json` (v0.1–v0.3).
 - `validatePackageEnvelope(data)` / `parsePackageEnvelope(json)` — validate the `system | ability | asset-pack | interactable` envelope.
 - `validateInteractablePackageManifest(data)` / `validateInteractableServerFragment(data)` — validate a portable interactable manifest, run its authority fragment through the world grammar, and recompute its budget.
+- `validatePlatformRuntimeDelivery({ descriptor, manifestSystems, entryHtml })` — the shared CLI/server gate for system-bearing World builds. It accepts safe compatible `^`/`~` ranges or explicit exact pins, requires the built import map to match, and rejects legacy bundled delivery.
 - `validateSceneDocument(data, options?)` / `parseSceneDocument(json, options?)` — validate and normalize a portable HELIX Scene v2 document shared by Home and World profiles.
 - `validateSceneDocumentForPublication(data, options)` — the publication-safe gate whose type requires an Ed25519 implementation-signature verifier.
 - `normalizeSceneDocument(scene)` — return a detached, defaulted copy of an already validated Scene v2 document.
 - `canonicalSceneDocumentPayload(scene)` / `computeSceneDocumentIntegrity(scene)` / `verifySceneDocumentIntegrity(scene)` — RFC 8785 canonical payload and SHA-256 identity helpers; only the top-level self field is excluded.
-- Scene vocabulary: `HELIX_SCENE_FORMAT`, `HELIX_SCENE_VERSION`, `HELIX_SCENE_MEDIA_TYPE`, `HELIX_SCENE_CAPS`, behavior/runtime-extension/signing-key allow-lists, `sceneResourceMimeCompatible`, `sceneBundleUriMatchesResource`, `sceneProfileMemoryCommitmentMiB`, `behaviorImplementationSignaturePayload`, `HELIX_TO_UNREAL_ADAPTER`, and `helixPositionToUnrealCm(position)`.
+- Scene vocabulary: `HELIX_SCENE_FORMAT`, `HELIX_SCENE_VERSION`, `HELIX_SCENE_MEDIA_TYPE`, `HELIX_SCENE_CAPS`, `HELIX_SCENE_DEVICE_CAPABILITY`, behavior/runtime-extension/signing-key allow-lists, `isSceneContinuumItemDefinition`, `sceneResourceMimeCompatible`, `sceneBundleUriMatchesResource`, `sceneProfileMemoryCommitmentMiB`, `behaviorImplementationSignaturePayload`, `HELIX_TO_UNREAL_ADAPTER`, and `helixPositionToUnrealCm(position)`.
 - Bundle rules: `BUNDLE_MAX_FILES`, `BUNDLE_MAX_FILE_BYTES`, `BUNDLE_MAX_TOTAL_BYTES`, `BUNDLE_PATH_PATTERN`, `bundleContentType(path)`, `bundleLimitsForKind(kind)`, `classifyBundleFile(kind, path)`, `ASSET_EXTENSIONS`.
 - Vocabulary + federation maps: `BUNDLE_KINDS`, `MAIN_BACKEND_PACKAGE_TYPE`, `MAIN_BACKEND_CONTENT_RATING`, `PERMISSIONS_V01`, `PERMISSIONS_V03`, `PLATFORM_MAX_PLAYERS_PER_ROOM`, `MANIFEST_FILENAME`, `MANIFEST_VERSIONS`.
-- Types: `HelixManifest`, `NormalizedHelixManifest`, `HelixBundleKind`, `HelixContentRating`, `HelixPermission`, `HelixMultiplayerConfig`, `HelixPackageEnvelope`, `NormalizedPackageEnvelope`, `HelixSceneV2`, and the exported Scene v2 section types.
+- Types: `HelixManifest`, `NormalizedHelixManifest`, `HelixBundleKind`, `HelixContentRating`, `HelixPermission`, `HelixMultiplayerConfig`, `HelixPackageEnvelope`, `NormalizedPackageEnvelope`, `HelixScenePin`, `HelixSceneV2`, and the exported Scene v2 section types.
 
 ## HELIX Scene v2
 
@@ -50,10 +51,26 @@ physical lighting intent, surfaces, collision/navigation, streaming/LOD and
 registered declarative behavior. It never contains executable code or arbitrary
 remote URLs.
 
+Scene item definitions accept legacy exact Vault descriptors or exact Continuum
+Package Version pins. Optional `deviceLinks` connect stable item instances by
+named Package-owned ports and require the fail-closed `helix.scene-devices/1`
+capability.
+
 See [the creator contract](docs/helix-scene-v2.md) and the
 [dual-profile example](examples/minimal-home.scene-v2.json). The published JSON
 Schema is `schema/scene-v2.schema.json`.
 
+## Module bank references
+
+A module-v1 world names the interactables it hosts as
+`itx:<slug>@<version>#<sha256>` references. The digest is the package
+registry's published `checksumSha256` for that version — read, never computed.
+
+See [the module bank reference contract](docs/module-bank-reference.md).
+
+See [module Device action dispatch](docs/module-action-dispatch.md) for ordered,
+atomic `firstMatch` action cases and their empty-case semantics.
+
 ## Develop
 
 ```bash

package/dist/schema/manifest-v0.2.schema.json

@@ -73,7 +73,7 @@
             "type": "object",
             "additionalProperties": { "type": "string", "minLength": 1 },
             "propertyNames": { "pattern": "^[a-z0-9](?:[a-z0-9-]{1,48})[a-z0-9]$" },
-            "description": "Pinned system dependencies as slug -> semver range (e.g. { \"humanoid-character\": \"^0.1\" }). Resolved to exact active versions at build; the resolved code + asset-pack CDN bases are baked into the immutable build. The asset-pack is discovered via the system's own envelope, not pinned here."
+            "description": "Platform system dependencies as slug -> semver range (e.g. { \"humanoid-character\": \"^0.2\" }). Compatible ^/~ ranges resolve through the host runtime on fresh launch; exact versions remain immutable pins. The asset-pack is discovered via the system's own envelope, not pinned here."
         },
         "abilities": {
             "type": "object",