incanto 0.29.0 → 0.31.0

package/dist/{editor-switch-CAKlJMIY.js → teardown-ByzfDPyu.js}

@@ -69,6 +69,35 @@ function devServerLibrary(token) {
 	};
 }
 /**
+* Does the page's own dev server serve the project's scenes?
+*
+* `incantoScenes()` from `incanto/vite` (the plugin that already validates
+* scenes on save; `incanto-new` puts it in every scaffolded project) answers
+* `GET /api/scenes`. When it does, the
+* editor a game switches into is a PROJECT editor: it can list, open, create
+* and save every scene in the project, and play whichever one you loaded.
+* When it does not (a built game, someone else's server), the editor still
+* edits the scene the game is running, exactly as before.
+*/
+async function projectScenes() {
+	try {
+		const res = await fetch("/api/scenes");
+		if (!res.ok) return null;
+		const body = await res.json();
+		return Array.isArray(body) ? body : null;
+	} catch {
+		return null;
+	}
+}
+/** What to say when the dev server has no idea what scenes this project has. */
+const NO_SCENE_ROUTES = "this dev server does not serve the project's scenes yet. Add incantoScenes() to vite.config.ts and restart:\n\n  import { incantoScenes } from 'incanto/vite';\n  export default defineConfig({ plugins: [incantoScenes()] });\n\nIt also validates every scene you save, before the page reloads into a broken one.";
+async function readProjectScene(file) {
+	const res = await fetch(`/api/scene?file=${encodeURIComponent(file)}`);
+	if (res.ok) return await res.json();
+	const body = await res.json().catch(() => null);
+	throw new Error(body?.error ?? `could not open ${file}: HTTP ${res.status}`);
+}
+/**
 * The default opener: pull `incanto/editor` in on demand and mount it.
 *
 * It is a dynamic import so the editor — an IDE's worth of UI — never enters a
@@ -83,18 +112,44 @@ async function openBundledEditor(opts) {
 		throw new Error(`createGame3D editor: could not load 'incanto/editor'. If this app aliases incanto to the engine SOURCE (the examples and playground do), add an alias for 'incanto/editor' → packages/editor/src/main.ts — or pass editor: { open } and load it yourself. (${error instanceof Error ? error.message : String(error)})`);
 	}
 	let handle = null;
+	const project = await projectScenes();
+	const format = mod.formatSceneJson ?? ((json) => JSON.stringify(json, null, 2));
+	const writeProjectScene = async (file, json) => {
+		const res = await fetch(`/api/scene?file=${encodeURIComponent(file)}`, {
+			method: "PUT",
+			body: format(json)
+		});
+		if (!res.ok) throw new Error(`could not save ${file}: HTTP ${res.status} ${await res.text()}`);
+	};
 	handle = await mod.mountEditor({
 		...opts.camera ? { camera: opts.camera } : {},
 		api: {
 			meta: async () => ({
 				version: "live",
-				mode: "single",
+				mode: "project",
 				root: "",
 				input: null,
 				output: null
 			}),
-			loadScene: async () => opts.scene,
-			...opts.save ? { saveScene: async (json) => void opts.save?.(json) } : {},
+			loadScene: async (file) => file ? await readProjectScene(file) : opts.scene,
+			...opts.save || project ? { saveScene: async (json, file) => {
+				if (file) return writeProjectScene(file, json);
+				await opts.save?.(json);
+			} } : {},
+			scenes: async () => {
+				const found = await projectScenes();
+				if (!found) throw new Error(NO_SCENE_ROUTES);
+				return found;
+			},
+			createScene: async (path) => {
+				const res = await fetch("/api/scenes", {
+					method: "POST",
+					body: JSON.stringify({ path })
+				});
+				if (res.status === 404) throw new Error(NO_SCENE_ROUTES);
+				if (!res.ok) throw new Error(`could not create ${path}: ${await res.text()}`);
+				return await res.json();
+			},
 			...opts.library ? { library: opts.library } : {}
 		},
 		onPlay: (choice, working) => {
@@ -158,4 +213,28 @@ function poseFromRenderer(renderer, fallbackDistance = 8) {
 	};
 }
 //#endregion
-export { poseFromRenderer as i, devServerLibrary as n, openBundledEditor as r, crossFade as t };
+//#region src/core/teardown.ts
+function teardown(steps, onError = defaultReport) {
+	const failures = [];
+	for (const step of steps) {
+		if (!step) continue;
+		const [what, run] = step;
+		try {
+			run();
+		} catch (error) {
+			failures.push({
+				what,
+				error
+			});
+			try {
+				onError(what, error);
+			} catch {}
+		}
+	}
+	return { failures };
+}
+function defaultReport(what, error) {
+	console.error(`[incanto] teardown: ${what} failed (continuing)`, error);
+}
+//#endregion
+export { poseFromRenderer as a, openBundledEditor as i, crossFade as n, devServerLibrary as r, teardown as t };

package/dist/test.d.ts

@@ -1,6 +1,6 @@
+import { $ as LogEntry, X as Node, n as BehaviorCtor, v as Engine, w as Scene } from "./behavior-D_jMpFh8.js";
 import { c as JsonValue, i as SceneJson } from "./schema-CcoWb32N.js";
-import { $ as Node, T as LogEntry, n as BehaviorCtor, v as Engine, w as Scene } from "./behavior-BAc0erXF.js";
-import { t as LoadSceneOptions } from "./loader-B242FF6N.js";
+import { t as LoadSceneOptions } from "./loader-BYBrqTxP.js";
 import { i as auditScene, t as IncantoError } from "./errors-1dXlIwoR.js";
 
 //#region src/test/index.d.ts
@@ -74,11 +74,6 @@ interface ValidationResult {
   /** The hard load error, when ok is false — `details` is machine-readable. */
   error?: IncantoError;
 }
-/**
-* Run every hard load-time check headlessly. Unregistered behaviors are
-* stubbed by default (structure-only validation, no TypeScript needed) —
-* pass the real classes via `behaviors` to validate script props too.
-*/
 declare function validateScene(json: unknown, opts?: ValidateSceneOptions): ValidationResult;
 interface RunContext {
   engine: Engine;

package/dist/test.js

@@ -1,13 +1,13 @@
-import { _ as registerBehavior, n as loadScene } from "./loader-BZqOKfI2.js";
-import { u as Engine } from "./register-BTg0EM7s.js";
+import { n as loadScene, y as registerBehavior } from "./loader-BlaRQGaA.js";
+import { u as Engine } from "./register-Dzkd6-os.js";
 import { t as IncantoError } from "./errors-BpWbnbb_.js";
-import { t as auditScene } from "./audit-C6rMyict.js";
+import { t as auditScene } from "./audit-C4kmDK0o.js";
 import { n as jsonEquals, t as jsonClone } from "./json-BLk7H2Qa.js";
-import { i as getNodeSchema, s as mergeStaticProps } from "./registry-BVJ2HbCn.js";
-import { n as registerGameplayBehaviors } from "./gameplay-L05WgWd1.js";
-import { t as registerNodes2D } from "./register-DWcWq4QG.js";
-import { t as registerNodes3D } from "./register-C44aSduO.js";
-import { t as registerNodesNet } from "./register-MelqEdza.js";
+import { i as getNodeSchema, s as mergeStaticProps } from "./registry-CJdGpT2V.js";
+import { n as registerGameplayBehaviors } from "./gameplay-BftxM_It.js";
+import { t as registerNodes2D } from "./register-tkR_8tWg.js";
+import { n as registerNodes3D, t as resolveEnvironmentHdri } from "./environment-presets--DigHNg4.js";
+import { t as registerNodesNet } from "./register-CUY284Is.js";
 //#region src/test/index.ts
 /**
 * incanto/test — the browserless verification harness.
@@ -184,10 +184,28 @@ function defaultsFor(typeName) {
 * stubbed by default (structure-only validation, no TypeScript needed) —
 * pass the real classes via `behaviors` to validate script props too.
 */
+/**
+* `environment.preset` is resolved deep inside Renderer3D, which no headless
+* tool reaches — so a typo there passed `incanto-check` and hard-failed at boot.
+* It cannot live in the core loader (core must never import 3d), but it belongs
+* exactly here: the test entry already registers the 3D nodes.
+*/
+function checkEnvironment(json) {
+	const env = json?.environment;
+	if (!env || typeof env !== "object") return;
+	if (env.preset === void 0) return;
+	if (typeof env.preset !== "string") throw new IncantoError("BAD_FORMAT", `Scene "environment.preset" must be a string, got ${JSON.stringify(env.preset)}.`);
+	try {
+		resolveEnvironmentHdri(env);
+	} catch (error) {
+		throw new IncantoError("BAD_FORMAT", error instanceof Error ? error.message : String(error));
+	}
+}
 function validateScene(json, opts = {}) {
 	registerAllNodes();
 	for (const [name, ctor] of Object.entries(opts.behaviors ?? {})) registerBehavior(name, ctor, { replace: true });
 	try {
+		checkEnvironment(json);
 		loadScene(json, {
 			resolveScene: opts.resolveScene,
 			stubMissingBehaviors: !opts.strictBehaviors
@@ -218,10 +236,10 @@ async function runScript(json, opts) {
 	engine.setScene(scene);
 	const physics = opts.physics ?? "auto";
 	if (physics === "2d" || physics === "auto" && scene.dimension === "2d") {
-		const { enablePhysics2D } = await import("./physics-2d-CCVTrKOd.js").then((n) => n.r);
+		const { enablePhysics2D } = await import("./physics-2d-D9wquBvK.js").then((n) => n.r);
 		await enablePhysics2D(engine);
 	} else if (physics === "3d" || physics === "auto" && scene.dimension === "3d") {
-		const { enablePhysics3D } = await import("./physics-3d-BZZLtwJu.js").then((n) => n.r);
+		const { enablePhysics3D } = await import("./physics-3d-CnPygVGo.js").then((n) => n.r);
 		await enablePhysics3D(engine);
 	}
 	const failures = [];
@@ -284,6 +302,12 @@ async function runScript(json, opts) {
 	}
 	const finalCapture = captureScene(scene);
 	const logs = [...engine.log.entries()];
+	const swallowed = engine.stats().errors;
+	if (swallowed > 0) failures.push({
+		atMs: opts.durationMs,
+		label: "engine",
+		message: `${swallowed} error(s) were swallowed to keep the loop alive — the logs above name the node, the behavior and the phase`
+	});
 	engine.dispose();
 	const ok = failures.length === 0;
 	return {
@@ -293,9 +317,14 @@ async function runScript(json, opts) {
 		logs,
 		finalCapture,
 		describe: () => {
+			const engineWarnings = logs.filter((l) => l.level === "warn" || l.level === "error");
+			const head = `run ${ok ? "OK" : "FAILED"} — ${opts.durationMs}ms simulated, ${failures.length} failure(s), ${logs.length} log(s)`;
+			const fails = failures.map((f) => `  ✗ at ${f.atMs}ms${f.label ? ` [${f.label}]` : ""}: ${f.message}`);
+			const noisy = engineWarnings.map((l) => `  ! ${l.level}: ${l.parts.map((p) => typeof p === "string" ? p : String(p)).join(" ")}`);
 			return [
-				`run ${ok ? "OK" : "FAILED"} — ${opts.durationMs}ms simulated, ${failures.length} failure(s), ${logs.length} log(s)`,
-				...failures.map((f) => `  ✗ at ${f.atMs}ms${f.label ? ` [${f.label}]` : ""}: ${f.message}`),
+				head,
+				...fails,
+				...noisy,
 				describeCapture(finalCapture)
 			].join("\n");
 		}
@@ -323,10 +352,10 @@ async function createPlaySession(json, opts = {}) {
 	engine.setScene(scene);
 	const physics = opts.physics ?? "auto";
 	if (physics === "2d" || physics === "auto" && scene.dimension === "2d") {
-		const { enablePhysics2D } = await import("./physics-2d-CCVTrKOd.js").then((n) => n.r);
+		const { enablePhysics2D } = await import("./physics-2d-D9wquBvK.js").then((n) => n.r);
 		await enablePhysics2D(engine);
 	} else if (physics === "3d" || physics === "auto" && scene.dimension === "3d") {
-		const { enablePhysics3D } = await import("./physics-3d-BZZLtwJu.js").then((n) => n.r);
+		const { enablePhysics3D } = await import("./physics-3d-CnPygVGo.js").then((n) => n.r);
 		await enablePhysics3D(engine);
 	}
 	const stepMs = 1e3 / (opts.fixedHz ?? 60);

package/dist/vite.d.ts

@@ -17,11 +17,97 @@ interface HotUpdateContext {
 interface IncantoScenesOptions {
   /** Hard-fail on unregistered behaviors too (default: structure-only). */
   strictBehaviors?: boolean;
+  /**
+  * Where scenes are found and written. Default: vite's `root` (your project).
+  * Nothing outside it is readable or writable, whatever a request asks for.
+  */
+  root?: string;
 }
 declare function incantoScenes(opts?: IncantoScenesOptions): {
   name: string;
   handleHotUpdate(ctx: HotUpdateContext): Promise<undefined | never[]>;
+  configureServer(server: SceneDevServer): void;
+};
+/**
+* `GET /api/scenes` → every `*.scene.json` under the project root
+* `POST /api/scenes` `{path}` → create a minimal scene there
+* `GET /api/scene?file=<rel>` → that scene's JSON
+* `PUT /api/scene?file=<rel>` → write it back (bytes verbatim)
+*
+* These are the routes `incanto-editor` serves, on YOUR dev server, so the
+* editor a game switches into is a project editor rather than a single-file
+* one: it can list, open, create and save any scene in the project, and play
+* whichever one you loaded.
+*
+* Everything is bounded to the root and to `*.scene.json`. A dev server is
+* still a server: `?file=../../.ssh/id_rsa` has to be a 400, not a read.
+*/
+interface SceneDevServer {
+  config?: {
+    root?: string;
+  };
+  middlewares: {
+    use(path: string, handler: (req: ApiReq, res: LibraryRes) => void): void;
+  };
+}
+interface ApiReq extends LibraryReq {
+  on(event: "data" | "end" | "error", cb: (chunk?: unknown) => void): void;
+}
+/**
+* One JSON file in the project, and whether it is a scene.
+*
+* A file browser that only shows `*.scene.json` cannot show you the scene you
+* saved as `level.json` — and, worse, gives no reason for its absence. So the
+* list is every `.json` under the project (a scene is JSON by definition, so
+* nothing else can be one), and `scene` says which of them actually are.
+*/
+interface ProjectFileEntry {
+  rel: string;
+  abs: string;
+  size: number;
+  modified: number;
+  /** Present only when the file IS a scene — read from the file, not the name. */
+  scene?: {
+    name: string;
+    dimension?: "2d" | "3d";
+    nodes: number;
+  };
+  /** Why it is not one, in a form a person can act on. */
+  notScene?: string;
+}
+/**
+* Is this JSON an incanto scene? The file itself answers.
+*
+* A scene declares what it is — `{"format": 1, "type": "scene", "name", "root"}`
+* — and those are exactly the four keys the loader demands before it will build
+* anything (`validateHeader`). So "is this a scene" is not a guess from the file
+* name; it is a fact readable from the first object in the file. That is what
+* lets the browser mark a row ✓ instead of hoping.
+*/
+declare function sceneFacts(json: unknown): {
+  ok: true;
+  name: string;
+  dimension?: "2d" | "3d";
+  nodes: number;
+} | {
+  ok: false;
+  why: string;
 };
+/** @internal Exported for tests. Root-bounded walk, deepest 6 levels. */
+declare function discoverScenes(root: string): ProjectFileEntry[];
+/**
+* @internal The one place a request's path becomes a file path.
+*
+* `.json` under the project, nothing else — the file browser offers every JSON
+* and the loader decides, but a dev server still must not be a way to read
+* `.env` or somebody's key file. Content is gated separately: a JSON that is
+* not a scene is never sent to the page, only the reason it is not one.
+*/
+declare function resolveSceneFile(root: string, rel: unknown): string | null;
+/** @internal Exported for tests — `GET`/`POST /api/scenes`. */
+declare function serveSceneList(req: ApiReq, res: LibraryRes, root: string): Promise<void>;
+/** @internal Exported for tests — `GET`/`PUT /api/scene?file=`. */
+declare function serveSceneFile(req: ApiReq, res: LibraryRes, root: string): Promise<void>;
 interface DevServer {
   middlewares: {
     use(path: string, handler: (req: LibraryReq, res: LibraryRes) => void): void;
@@ -75,4 +161,4 @@ declare function incantoLibrary(opts?: IncantoLibraryOptions): {
 /** @internal Exported for tests — the whole request/response behaviour. */
 declare function serveLibrary(req: LibraryReq, res: LibraryRes, opts?: IncantoLibraryOptions, doFetch?: typeof fetch): Promise<void>;
 //#endregion
-export { IncantoLibraryOptions, IncantoScenesOptions, incantoLibrary, incantoScenes, serveLibrary };
+export { IncantoLibraryOptions, IncantoScenesOptions, ProjectFileEntry, discoverScenes, incantoLibrary, incantoScenes, resolveSceneFile, sceneFacts, serveLibrary, serveSceneFile, serveSceneList };

package/dist/vite.js

@@ -1,6 +1,6 @@
 import { validateScene } from "./test.js";
-import { readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, normalize, relative, resolve, sep } from "node:path";
 //#region src/vite/index.ts
 /**
 * incanto/vite — dev-server integration: validate every `*.scene.json` edit
@@ -24,6 +24,20 @@ import { dirname, resolve } from "node:path";
 function incantoScenes(opts = {}) {
 	return {
 		name: "incanto-scenes",
+		/**
+		* The project's scenes, over HTTP, so the editor opened from a running
+		* game can browse and load them the same way the standalone
+		* `incanto-editor` does. Dev-only by construction (`configureServer`).
+		*/
+		configureServer(server) {
+			const root = opts.root ?? server.config?.root ?? process.cwd();
+			server.middlewares.use("/api/scenes", (req, res) => {
+				serveSceneList(req, res, root);
+			});
+			server.middlewares.use("/api/scene", (req, res) => {
+				serveSceneFile(req, res, root);
+			});
+		},
 		async handleHotUpdate(ctx) {
 			if (!ctx.file.endsWith(".scene.json")) return void 0;
 			let json;
@@ -58,6 +72,251 @@ function report(ctx, message) {
 		}
 	});
 }
+const SKIP_DIRS = new Set([
+	"node_modules",
+	"dist",
+	"build",
+	"out",
+	".git",
+	"coverage",
+	".vite",
+	".next"
+]);
+/**
+* Is this JSON an incanto scene? The file itself answers.
+*
+* A scene declares what it is — `{"format": 1, "type": "scene", "name", "root"}`
+* — and those are exactly the four keys the loader demands before it will build
+* anything (`validateHeader`). So "is this a scene" is not a guess from the file
+* name; it is a fact readable from the first object in the file. That is what
+* lets the browser mark a row ✓ instead of hoping.
+*/
+function sceneFacts(json) {
+	if (json === null || typeof json !== "object" || Array.isArray(json)) return {
+		ok: false,
+		why: "the file is JSON, but not a JSON object"
+	};
+	const j = json;
+	if (j.type !== "scene") return {
+		ok: false,
+		why: `"type" must be "scene"${j.type === void 0 ? ", and this file has no \"type\"" : `, not ${JSON.stringify(j.type)}`}`
+	};
+	if (j.format !== 1) return {
+		ok: false,
+		why: `"format" must be 1, not ${JSON.stringify(j.format)}`
+	};
+	if (typeof j.root !== "object" || j.root === null) return {
+		ok: false,
+		why: "\"root\" must be a node object"
+	};
+	return {
+		ok: true,
+		name: typeof j.name === "string" ? j.name : "",
+		...j.dimension === "2d" || j.dimension === "3d" ? { dimension: j.dimension } : {},
+		nodes: countNodes(j.root)
+	};
+}
+function countNodes(node) {
+	const children = node.children;
+	if (!Array.isArray(children)) return 1;
+	let n = 1;
+	for (const child of children) n += countNodes(child);
+	return n;
+}
+/** Reading a 300 MB "json" to label a row is not worth it — say so instead. */
+const SNIFF_LIMIT = 16e6;
+function inspect(abs, size) {
+	if (size > SNIFF_LIMIT) return { notScene: "too large to check without opening it" };
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(abs, "utf-8"));
+	} catch (error) {
+		return { notScene: `not valid JSON: ${message(error)}` };
+	}
+	const facts = sceneFacts(parsed);
+	return facts.ok ? { scene: {
+		name: facts.name,
+		...facts.dimension ? { dimension: facts.dimension } : {},
+		nodes: facts.nodes
+	} } : { notScene: facts.why };
+}
+/** @internal Exported for tests. Root-bounded walk, deepest 6 levels. */
+function discoverScenes(root) {
+	const found = [];
+	const walk = (dir, depth) => {
+		if (depth > 6) return;
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) if (entry.isDirectory()) {
+			if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) walk(join(dir, entry.name), depth + 1);
+		} else if (entry.name.endsWith(".json")) {
+			const abs = join(dir, entry.name);
+			let size = 0;
+			let modified = 0;
+			try {
+				const stat = statSync(abs);
+				size = stat.size;
+				modified = stat.mtimeMs;
+			} catch {}
+			found.push({
+				rel: relative(root, abs).split(sep).join("/"),
+				abs,
+				size,
+				modified,
+				...inspect(abs, size)
+			});
+		}
+	};
+	walk(root, 0);
+	return found.sort((a, b) => a.rel.localeCompare(b.rel));
+}
+/**
+* @internal The one place a request's path becomes a file path.
+*
+* `.json` under the project, nothing else — the file browser offers every JSON
+* and the loader decides, but a dev server still must not be a way to read
+* `.env` or somebody's key file. Content is gated separately: a JSON that is
+* not a scene is never sent to the page, only the reason it is not one.
+*/
+function resolveSceneFile(root, rel) {
+	if (typeof rel !== "string" || !rel.endsWith(".json")) return null;
+	const abs = normalize(resolve(root, rel));
+	return abs.startsWith(root.endsWith(sep) ? root : root + sep) ? abs : null;
+}
+/**
+* Same-origin assertion for state-changing requests.
+*
+* A dev server is reachable from any page the developer happens to have open:
+* `fetch('http://localhost:5173/api/scenes', {method:'POST', ...})` from
+* evil.example needs no CORS permission to be SENT — only to be read — so
+* without this a visited page can write `*.scene.json` files into the repo.
+* Browsers attach `Origin` to every POST/PUT (including cross-site form posts,
+* the one path that used to omit it), so requiring it to match the host we were
+* addressed as costs a real editor nothing. A request with no `Origin` at all is
+* not a browser, and a non-browser client has no CSRF exposure to exploit —
+* same rule the `incanto-editor` server uses.
+*/
+function originAllowed(req) {
+	const raw = req.headers.origin;
+	const origin = Array.isArray(raw) ? raw[0] : raw;
+	if (!origin) return true;
+	const rawHost = req.headers.host;
+	try {
+		return new URL(origin).host === (Array.isArray(rawHost) ? rawHost[0] : rawHost ?? "");
+	} catch {
+		return false;
+	}
+}
+function json(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("content-type", "application/json; charset=utf-8");
+	res.end(typeof body === "string" ? body : JSON.stringify(body));
+}
+function readBody(req) {
+	return new Promise((done, fail) => {
+		let raw = "";
+		req.on("data", (chunk) => {
+			raw += String(chunk);
+			if (raw.length > 64e6) fail(/* @__PURE__ */ new Error("scene too large"));
+		});
+		req.on("end", () => done(raw));
+		req.on("error", () => fail(/* @__PURE__ */ new Error("request failed")));
+	});
+}
+/** @internal Exported for tests — `GET`/`POST /api/scenes`. */
+async function serveSceneList(req, res, root) {
+	const base = normalize(resolve(root));
+	if (req.method === void 0 || req.method === "GET") return json(res, 200, discoverScenes(base));
+	if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+	if (!originAllowed(req)) return json(res, 403, { error: "cross-origin write refused" });
+	let body;
+	try {
+		body = JSON.parse(await readBody(req));
+	} catch (error) {
+		return json(res, 400, { error: `bad request body: ${message(error)}` });
+	}
+	const wanted = typeof body.path === "string" && body.path && !body.path.endsWith(".json") ? `${body.path}.scene.json` : body.path;
+	const abs = resolveSceneFile(base, wanted);
+	if (!abs) return json(res, 400, { error: "path must be a .json file inside the project" });
+	if (existsSync(abs)) return json(res, 409, { error: `already exists: ${String(wanted)}` });
+	const name = basename(abs).replace(/\.scene\.json$|\.json$/, "") || "Scene";
+	try {
+		mkdirSync(dirname(abs), { recursive: true });
+		writeFileSync(abs, `${JSON.stringify({
+			format: 1,
+			type: "scene",
+			dimension: "3d",
+			name,
+			root: {
+				name,
+				type: "Node3D"
+			}
+		}, null, 2)}\n`);
+	} catch (error) {
+		return json(res, 400, { error: message(error) });
+	}
+	return json(res, 201, {
+		rel: relative(base, abs).split(sep).join("/"),
+		abs,
+		size: 0,
+		modified: 0
+	});
+}
+/** @internal Exported for tests — `GET`/`PUT /api/scene?file=`. */
+async function serveSceneFile(req, res, root) {
+	const base = normalize(resolve(root));
+	const file = new URL(req.url ?? "/", "http://localhost").searchParams.get("file");
+	const abs = resolveSceneFile(base, file);
+	if (!abs) return json(res, 400, { error: "?file= must be a .json file inside the project" });
+	if (req.method === void 0 || req.method === "GET") {
+		let text;
+		let parsed;
+		try {
+			text = readFileSync(abs, "utf-8");
+			parsed = JSON.parse(text);
+		} catch (error) {
+			return json(res, 422, { error: `${file}: ${message(error)}` });
+		}
+		const facts = sceneFacts(parsed);
+		if (!facts.ok) return json(res, 422, {
+			error: `${file} is not an incanto scene — ${facts.why}.`,
+			notScene: true
+		});
+		return json(res, 200, text);
+	}
+	if (req.method !== "PUT") return json(res, 405, { error: "method not allowed" });
+	if (!originAllowed(req)) return json(res, 403, { error: "cross-origin write refused" });
+	let raw;
+	try {
+		raw = await readBody(req);
+	} catch (error) {
+		return json(res, 400, { error: message(error) });
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		return json(res, 422, { error: `not JSON — the file was NOT written: ${message(error)}` });
+	}
+	const shape = sceneFacts(parsed);
+	if (!shape.ok) return json(res, 422, { error: `not an incanto scene — ${shape.why}. The file was NOT written.` });
+	try {
+		writeFileSync(abs, raw.endsWith("\n") ? raw : `${raw}\n`);
+	} catch (error) {
+		return json(res, 400, { error: message(error) });
+	}
+	return json(res, 200, {
+		ok: true,
+		output: abs
+	});
+}
+function message(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 /**
 * Serve the agent8 asset catalog at `/api/library` on the dev server.
 *
@@ -146,4 +405,4 @@ function libraryItem(row) {
 	};
 }
 //#endregion
-export { incantoLibrary, incantoScenes, serveLibrary };
+export { discoverScenes, incantoLibrary, incantoScenes, resolveSceneFile, sceneFacts, serveLibrary, serveSceneFile, serveSceneList };

package/editor/assets/{agent8-DEVkEa3d.js → agent8-o27_Y1xN.js}

@@ -1 +1 @@
-import{n as e}from"./index-Bx4UtWYY.js";async function t(t){return new n((await e(()=>import(`./GameServer-C56iOUgF.js`),[],import.meta.url)).GameServer,t)}var n=class{raw;active=new Map;reconnecting=!1;disposed=!1;constructor(e,t){this.raw=new e({...t})}get account(){return this.raw.account}get connected(){return this.raw.connected}connect(){return this.raw.connected?Promise.resolve(!0):(this.disposed=!1,this.rawConnect())}rawConnect(){return this.raw.connect({onDisconnect:()=>void this.reconnect()})}disconnect(){this.disposed=!0;for(let e of this.active.values())e.off();return this.active.clear(),this.raw.disconnect()}remoteFunction(e,t,n){return this.raw.remoteFunction(e,t,n)}track(e){let t=Symbol(`sub`),n={make:e,off:e()};return this.active.set(t,n),()=>{n.off(),this.active.delete(t)}}async reconnect(){if(!this.disposed&&!this.reconnecting){this.reconnecting=!0;try{await this.rawConnect();for(let e of this.active.values())e.off(),e.off=e.make()}finally{this.reconnecting=!1}}}subscribeRoomState(e,t){return this.track(()=>this.raw.subscribeRoomState(e,t))}subscribeRoomMyState(e,t){return this.track(()=>this.raw.subscribeRoomMyState(e,t))}subscribeRoomAllUserStates(e,t){return this.track(()=>this.raw.subscribeRoomAllUserStates(e,e=>{let n={};for(let t of e??[]){if(!t||typeof t.account!=`string`||t.__leaved)continue;let{account:e,__updated:r,__leaved:i,...a}=t;n[e]=a}t(n)}))}subscribeRoomCollection(e,t,n){return this.track(()=>this.raw.subscribeRoomCollection(e,t,({items:e})=>{let t={};for(let n of e??[])n&&typeof n.__id==`string`&&(t[n.__id]=n);n(t)}))}onRoomMessage(e,t,n){return this.track(()=>this.raw.onRoomMessage(e,t,n))}onRoomUserJoin(e,t){return this.track(()=>this.raw.onRoomUserJoin(e,t))}onRoomUserLeave(e,t){return this.track(()=>this.raw.onRoomUserLeave(e,t))}subscribeGlobalState(e){return this.track(()=>this.raw.subscribeGlobalState(e))}subscribeGlobalMyState(e){return this.track(()=>this.raw.subscribeGlobalMyState(e))}subscribeGlobalUserState(e,t){return this.track(()=>this.raw.subscribeGlobalUserState(e,t))}subscribeGlobalCollection(e,t){return this.track(()=>this.raw.subscribeGlobalCollection(e,({items:e})=>{let n={};for(let t of e??[])t&&typeof t.__id==`string`&&(n[t.__id]=t);t(n)}))}subscribeAsset(e,t){return this.track(()=>this.raw.subscribeAsset(e,t))}onGlobalMessage(e,t){return this.track(()=>this.raw.onGlobalMessage(e,t))}};export{t as createAgent8Server};
+import{n as e}from"./index-C9fb5QcT.js";async function t(t){return new n((await e(()=>import(`./GameServer-C56iOUgF.js`),[],import.meta.url)).GameServer,t)}var n=class{raw;active=new Map;reconnecting=!1;disposed=!1;constructor(e,t){this.raw=new e({...t})}get account(){return this.raw.account}get connected(){return this.raw.connected}connect(){return this.raw.connected?Promise.resolve(!0):(this.disposed=!1,this.rawConnect())}rawConnect(){return this.raw.connect({onDisconnect:()=>void this.reconnect()})}disconnect(){this.disposed=!0;for(let e of this.active.values())e.off();return this.active.clear(),this.raw.disconnect()}remoteFunction(e,t,n){return this.raw.remoteFunction(e,t,n)}track(e){let t=Symbol(`sub`),n={make:e,off:e()};return this.active.set(t,n),()=>{n.off(),this.active.delete(t)}}async reconnect(){if(!this.disposed&&!this.reconnecting){this.reconnecting=!0;try{await this.rawConnect();for(let e of this.active.values())e.off(),e.off=e.make()}finally{this.reconnecting=!1}}}subscribeRoomState(e,t){return this.track(()=>this.raw.subscribeRoomState(e,t))}subscribeRoomMyState(e,t){return this.track(()=>this.raw.subscribeRoomMyState(e,t))}subscribeRoomAllUserStates(e,t){return this.track(()=>this.raw.subscribeRoomAllUserStates(e,e=>{let n={};for(let t of e??[]){if(!t||typeof t.account!=`string`||t.__leaved)continue;let{account:e,__updated:r,__leaved:i,...a}=t;n[e]=a}t(n)}))}subscribeRoomCollection(e,t,n){return this.track(()=>this.raw.subscribeRoomCollection(e,t,({items:e})=>{let t={};for(let n of e??[])n&&typeof n.__id==`string`&&(t[n.__id]=n);n(t)}))}onRoomMessage(e,t,n){return this.track(()=>this.raw.onRoomMessage(e,t,n))}onRoomUserJoin(e,t){return this.track(()=>this.raw.onRoomUserJoin(e,t))}onRoomUserLeave(e,t){return this.track(()=>this.raw.onRoomUserLeave(e,t))}subscribeGlobalState(e){return this.track(()=>this.raw.subscribeGlobalState(e))}subscribeGlobalMyState(e){return this.track(()=>this.raw.subscribeGlobalMyState(e))}subscribeGlobalUserState(e,t){return this.track(()=>this.raw.subscribeGlobalUserState(e,t))}subscribeGlobalCollection(e,t){return this.track(()=>this.raw.subscribeGlobalCollection(e,({items:e})=>{let n={};for(let t of e??[])t&&typeof t.__id==`string`&&(n[t.__id]=t);t(n)}))}subscribeAsset(e,t){return this.track(()=>this.raw.subscribeAsset(e,t))}onGlobalMessage(e,t){return this.track(()=>this.raw.onGlobalMessage(e,t))}};export{t as createAgent8Server};