# Module (asset type) A module is a reusable, stateless (or globally-stateful) Luau library that other code pulls in with `require()`. Modules are the unit of factored-out logic in a world: helpers, math libraries, format parsers, registries, shared algorithms. ## When to use one - You have logic you want to share across multiple components, services, scenes, or tools. - You have a registry, lookup table, or shared cache that callers all read from / write to. - You want a stable API surface (`M.fn`) other code can depend on. If the logic is bound to one entity, use a `.component`. If you want a named UI of fields rather than functions, use a `.preset`. ## Where it lives - Source: `/zero/source/.../<name>.module/` - Identity: the source path with `/` written as `.` and each segment's type suffix dropped — `/zero/source/demo/beats.module` is `demo.beats`, and `/zero/source/kit.package/beats.module` is `kit.beats`, the container's name kept and its `.package` suffix gone. `asset.create` returns this string, `asset.resolve(...).identity` reads it back, and the `require` forms below write it as `<identity>`. - Folder shape: - `init.luau` (or `init.lua`) — module body. **Required.** Returns a table (conventionally named `M`). - `README.md` — instance-level documentation. **Required.** - `.metadata` — agent-editable tags + free-form fields. **Required.** ## How to create one ```luau asset.create("module", "<name>") -- Creates: /zero/source/<name>.module/ -- init.luau (canonical `local M = {} … return M`) -- README.md (instance README template) -- `folder` places it in a subfolder of /source, and that subfolder -- leads the identity: `{ folder = "lib" }` produces `lib.<name>`. -- `into` authors it inside a resolved container (a package, a toolbox), -- whose own identity leads the same way: asset.create("module", "<name>", { folder = "lib" }) asset.create("module", "<name>", { into = asset.resolve("myPkg.package") }) ``` ## How it operates 1. **Registration.** Writing `init.luau` into a `.module/` folder indexes the asset and registers the module path with the resolver. 2. **Loading.** The first `require("<identity>")` runs the file's body and caches the returned table. Subsequent requires from anywhere return the **same table** — this is the shared-state lever for "module-local" registries. The body runs in an environment of the module's own: a name it declares without `local` is readable by the module's own functions and by no other script, so an export reaches its callers through the returned table and nothing else. Requiring a component's folder runs its chunk the same way, once, and its `update`, `start` and `public` stay in that environment; a component runs on an entity through `entity(id).component.add(name)`. 3. **Hot reload.** Editing the file re-runs the module body and folds what it returns into the table already loaded, so that table keeps its identity: a caller that captured it with `require` reads the new source's functions and values through the reference it already holds, and a later `require` returns that same table. A key the new source drops goes away; a key something set at runtime stays. The body's own `local`s start again from their initial values, so state that must outlive an edit lives in `modules.state()` (`guides { path: "core/scripting-and-tasks" }`). 4. **Identity resolution.** A module is reached by its `<identity>`, and where the caller lives decides which spelling of it resolves. For a module in a **world**, from a caller in that same world — another module, a component, a scene entrypoint, or an `execute` chunk: - `require("<identity>")` — the identity on its own, resolved against the caller's own root. It carries every folder segment, so a module created with `{ folder = "demo" }` is `require("demo.beats")`. - `require("@root::<identity>")` — the same root-relative resolution, written out. - `require(".sibling")` — a module in the same folder, by its bare name; `..name` steps up one folder, `...name` two. Logs, stack traces and hot-reload notices name that same module `@local.source.<identity>` — its key under the world source root. The `<identity>` tail of that key is the form above, so a trace reading `@local.source.demo.beats` is `require("demo.beats")`. For a module in a **library** — content under `/zero/source/libs/@<lib>/` — `@<lib>::` addresses that library's root from anywhere: `require("@builtin::modules.transform")`. Mounting a world as a library moves its files under such a root and flips the caller root to `@<lib>::`, which is what keeps the root-relative forms above resolving across the move. ## Discovery - `asset.list("module")` — every registered module. - `asset.inspect("<name>")` — public functions, source path, this type README. - `ls /zero/source/<name>.module` lists the files the folder holds. ## Authoring conventions - Return a single `M` table from `init.luau`. Top-level statements with side effects run on first require — useful for one-time initialization, dangerous if they touch the engine before it's ready. - Write exported functions as `typed function`, not `function`: the argument types are enforced at the call and the checker knows the signature, so a caller's mistake is reported where they made it. - Annotate exported functions with `--!desc` / `--!arg` / `--!return` / `--!example` so the LSP, `tools.list`, and `asset.inspect` surface them. A function with no `--!desc` is reachable only by someone already reading this file. - Declare a VALUE with `Field.<kind>(default, mode, description)`, and a table whose members are reached through a metatable with `--!members <TypeName>` — the latter gives the surface its accepted member set, its type, and its documentation from one table. See `guides { path: "core/authoring" }` for all four rules and `modules/api/engine/entity.module/members.module` for a worked member table. - Keep module state in module-local upvalues or in `modules.state()`. A name the body declares without `local` lives in the module's environment, which every run of the module shares: a function the previous run left in place reads what the reload assigned. Module-locals start again from their initial values with each hot reload; the table `modules.state()` returns is the same table on both sides of every reload. - Prefer focused modules over kitchen-sink modules. If two halves of a module have no shared state, split them. ## Common pitfalls - **Cyclic requires.** A `require` chain that loops will return the partial table (the half built before the cycle was detected). Design for one-way dependencies. - **Engine-time side effects.** Don't `entity.spawn` at module top-level — the engine may not be ready. Expose an `M.init` and call it from a scene entrypoint. - **Hot-reload + module-local cache.** A module that caches expensive computation in upvalues loses that cache on reload — fine for dev, but be aware in performance work. - **`init.lua` vs `init.luau`.** Either works, `.luau` is canonical. - **Writing one while play runs.** A `/source` write made while play is running lands on the play shadow, and a guarded play-exit discards it unless it is kept. One `.module` write shadows `init.luau`, the `README.md` and the `.metadata` together. `vfs.write(path, bytes, { durable = true })` skips the shadow, and `vfs.promotePlayShadow` keeps what is already on it — the `core/vfs` guide has the model and what each route costs. ## Related types - `.component` — for entity-bound state + lifecycle hooks. - `.service` — generates content you don't have yet (a mesh, sound, texture, …) via a metered provider. - `.tool` — for a single agent-callable function with a YAML schema. - `.package` — to group several modules + components + scenes into one shippable folder. ## In the Inspector Exports: what the module exports (name, kind, signature), parsed from its source without running it, with **Check** (the LSP's diagnostics for its entry file) and **Open**.

# preview Render an asset's preview in the preview studio: an isolated camera, lit only by its own three-point rig, over a neutral backdrop, that nothing in the scene reaches. `ref:preview()` renders any asset by the recipe its type declares under `preview:` in its `type.yaml`, and these are the primitives it calls: they spawn temporary entities, frame an offscreen camera over them, render one frame, read it back as a PNG, and tear the entities down. ## Surface - `preview.fromEntities(makeFn, opts?) -> PreviewResult` — run `makeFn` to instantiate entities, frame a camera to their bounds, render one offscreen frame, and return the still PNG. - `preview.fromRecipe(ref, recipe, opts?) -> PreviewResult` — render `ref` by a declared recipe: `instantiate` stands it through its own `instantiate`, `surface` paints the material its type's `ref.previewMaterial` returns on the recipe's mesh, and `image` fits a file the asset holds to the frame on the studio backdrop without rendering anything. - `preview.backdrop() -> { r, g, b }` — the studio backdrop's colour in a finished preview, 0-255. `PreviewResult` is `{ available, imageBase64?, rendered?, width?, height?, bounds?, stats?, reason? }` — `imageBase64` is the rendered PNG when `available` is true, and `reason` explains why when it is false. `opts` is `{ size? = { width, height }, angle? = { yaw, pitch } }`. A preview pictures its whole subject, however many entities it composes. While the subject settles, its bounds are measured each frame by walking it in Luau for up to `opts.entityBudget` entities (default 2000); a subject composing more is measured by the capture framing alone, which reads each root's hierarchy bounds from the engine. ## Example local result = asset.resolve("gold", "material"):preview({ size = { width = 512, height = 512 } }) -- result.imageBase64 holds the rendered PNG (base64)

# world_vcs.derive The derive-hook registry. A hook is a computation that produces an output from the content a stage holds, so the output lands in the commit with the content it was computed from. - `register(hook)` / `unregister(name)` / `hooks()` manage the registered hooks, listed in name order; `allHooks()` lists them together with the hook each asset type exports. - `planFor(refs)` returns one `{ hook, ref }` per staged world asset an asset-scope hook's `matches` accepts. - `cache.get` / `cache.put` keep up to 64 results and 32 MiB by hook and fingerprint, least recently used out first. ```luau local derive = require("modules.world_vcs.derive") derive.register({ name = "thumbs", scope = "asset", output = "thumb.png", matches = function(ref) return ref.type == "texture" end, module = "@root::thumbs", fingerprint = "fingerprint", compute = "compute", }) ``` `world.derive(name, spec)` registers the same hook; `spec = nil` removes it. An asset type registers a hook by exporting `derive` from its `behavior.luau`: a hook without `name`, named `<type>.<output>`, matching refs of that type unless it states its own `matches`. `planFor` consults the behavior of each type among the staged refs, `hookNamed(name)` answers a registered hook or a type's export, and `allHooks()` reads every type's export beside the registered hooks, each from the `behavior.luau` its type holds at the call, so a type's output is left out of an asset's inputs (`snapshot.outputsExcluded`) and `zm derived retry` of its committed output finds its hook the way it does a registered one's. `derive.runner` reserves the planned outputs and computes them on workers; `derive.worker` holds the entries a worker runs (`fingerprint`, `compute`), each calling the entry of the hook's `module` that the hook names. A reservation whose stage leaves the output's inputs as the tree the commit lands on holds them settles `done` on the output that tree already holds, with nothing computed, when the working tree holds the same bytes at the output's path. The inputs are compared by `snapshot.inputLines`: the asset's files and the version of every asset they reference, where an asset the engine reads from a library it carries (`/zero/source/libs/`) is named by its guid alone, so a stage that only moves a library pin to another commit recomputes nothing.

# assetType (asset type) An asset type says what a kind of asset is: the files an asset of the kind is made of, the code that gives it behaviour, the interface a person uses to work with it, and how it is found, pictured and checked. A `<typename>.assetType/` folder declares a type called `<typename>`, and every `<name>.<typename>/` folder is an asset of it. `assetType` is itself a type, so a type is an asset like any other: it is created, versioned, installed and contributed the same way. ## Making a type `asset.create("assetType", "<typename>")` scaffolds a type. The type registers the moment its folder is written, anywhere under `/zero/source/`, and from then on `<name>.<typename>/` folders are its assets. An asset of a type that is not registered yet is not an asset, so make the type first. A type folder is a root: `~.x` in any file inside it names the type's own `x`, wherever the type is installed. Keep the type's whole implementation inside its folder and reach it that way. What a type folder must hold is set by this type's own `type.yaml`, the same way every type's `type.yaml` sets what its assets hold. `asset.validate` on a type reports anything missing, and the scaffold produces a folder that passes. ## What sets your type's schema (`type.yaml`) `type.yaml` is the structural contract every asset of the type is checked against. The keys below are the ones the engine reads; a key not listed here is ignored. | Key | What it controls | |---|---| | `suffix` | The folder suffix of the type's assets. Defaults to `.<typename>`. | | `primary` | The file or files that are the asset's content: what the asset resolves to when it is used. | | `entry_files`, `primary_aliases` | Further files that load as the asset or share its identity. | | `is_container` | Whether the suffix stays in the identities of what the asset holds. | | `is_opaque_walker` | Whether a walk of the tree stops at the asset and registers only its primary. | | `plural_dir`, `classify_exts` | Loose files in a folder of this name, or with these extensions, are assets of the type. | | `is_text_default` | Whether the asset's files are text unless stated otherwise. | | `broadcasts_subassets` | Whether assets nested inside an asset of the type are found by their own short name. | | `root` | `true` makes every asset of the type a root, so `~.x` inside one names that asset's own `x`. | | `contract_ref: { field, category }` | A key of the primary file that names another asset the asset is built on. | | `files: { required, optional }` | The files an asset holds (below). | | `allow_unlisted` | `false` reports every file the type does not declare. | | `aliases_from: [{ file, key }]` | Further names an asset answers to, read from its own files. | | `settings:` | Typed per-asset settings (below). | | `inspector:` | The interface people use for the type and its assets (below). | | `preview:` | How an asset is pictured (below). | | `references:` | Names of other assets the type's files carry (below). | | `indexing:` | What search reads for each asset (below). | | `describe:` | How a missing description is generated (below). | ### The files an asset holds Each entry under `files.required` or `files.optional` is `{ path, kind: file | folder, one_of_group?, content? }`. `*` in a path matches within one segment. Entries that share a `one_of_group` are satisfied by any one of them. `content` lists checks on the file's bytes: | Check | Passes when | |---|---| | `non_empty` | the file has content | | `json_field { key, type?, non_empty?, accept? }` | the JSON holds the key (a dotted path) with that shape | | `yaml_field { key, type?, non_empty?, accept? }` | the same for YAML | | `described { keys?, headings?, message? }` | the file says what the asset is (see "Ask your assets to say what they are") | Each check takes a `message`, which is what the author is told when it fails. ### Settings `settings: { values, schema: { type | instance, export? } }` gives every asset typed settings. `values` names the file an asset's values live in; `schema.type` declares one schema for the whole type, and `schema.instance` names a file each asset declares its own in. `asset.create` writes the resolved values, and a write to the values file reaches `onChange` with what changed. ## The human side (`inspector.luau`) A type is used by people through its Inspector, and without one the type is usable only from code. The Inspector is the type's interface for a person: for a procedural graph it is the graph editor, for a kit it is the tracking view of what the kit holds and what is still missing. Writing it is part of writing the type. `inspector: { type, instance? }` in `type.yaml` names the files. `type` is the interface for the type itself and for its assets; `instance` names a file an asset may ship to add its own. Each returns: ```luau return { sections = { { id = "graph", title = "Graph", build = function(ctx) ... end } }, replace = { contents = { ... } }, -- replace a default section by id order = { "graph", "contents" }, -- section order } ``` `build(ctx)` receives the asset and builds the section. A section's `title`, and the text its rows carry, is a string or an `i18n.text` value read from a catalog (`i18n.text("inspectors.mesh.title")`), which follows the editor's language. `asset.create("assetType", ...)` scaffolds a working `inspector.luau` to start from. `asset.validate` on a type that names no inspector, or names one that does not load, reports it. ## Say what your type is for (`about.yaml`) Every type carries an `about.yaml` that says what the type is for, in three plain-language texts: ```yaml intent: "Sets the typeface of the text in your game: UI, labels, signs and 3D lettering." function: "A font, from a TTF, OTF or WOFF file, made available to all of Zero's text, including 3D text." usage: "You choose it by name for your UI or your text, and the text appears in that typeface." ``` - **`intent`** is what the type is for in someone's game, in the words a game maker uses. Up to 800 bytes. - **`function`** is how it works today: what an asset of it is made of and what the engine does with it. Up to 1500 bytes. - **`usage`** is what a person or an agent does with one. Up to 1200 bytes. Write about the type as a whole, not one asset of it, and say what it does now. Agents read these texts to learn when to reach for the type and how; people searching find the type by them. The scaffold starts each text with `[[describe]]` and a note on what to write; a text that still starts that way counts as not written. `services describe` can write them. They show up in `asset.inspect` as `detail.about`, in `assetTypeRef:getAbout()`, at the end of the type's `types/<typename>` guide, and at the top of the type's Inspector. ## Ask your assets to say what they are A type can require each asset to carry a description: a file, written by the author or generated, saying what the asset is and what it is for. Declare it with a `described` check: ```yaml files: required: - path: "README.md" kind: "file" content: - { check: "described", message: "Say what this widget is for and where it goes." } ``` A file that is missing, empty or still has a line starting with `[[describe]]` fails the check, and so does a YAML file whose named `keys` are missing or over their `max_bytes`, or a Markdown file missing a named heading. `asset.validate` names the asset, and a push that carries it is refused with `message`. `services describe` finds such assets and writes their descriptions. `describe:` steers what is generated: ```yaml describe: guidance: "Say what the widget shows, what input it reacts to, and where it fits in a UI." examples: - "<identity of an asset of this type whose description reads well>" ``` An example is an asset of your type whose description is a true, written one, never a placeholder and never the asset being described; with none, leave `examples` empty. A type whose assets the model cannot perceive (a sound, a motion) says so in `guidance`, and the description is drawn only from what the asset's own files state. Start the file unwritten in your `template/`: a heading and one line starting with `[[describe]]`, never example content, which every new asset would carry verbatim. A type whose assets say what they are through their own content (a mesh, a texture) declares no check. ## The type's code (`behavior.luau`) `behavior.luau` returns one table. These are the keys the engine reads from it; anything else on the table is the type's own. ### What the type's assets can do | Key | Shape | What the engine does with it | |---|---|---| | `ref` | `{ [name] = function(self, ...) }` | Every function becomes a method on every asset of the type: `ref:name(...)`. | | `modules` | `{ [name] = require(".x") }` | Code the type's assets reach with `asset.containing(__FILE__).modules.<name>`. | | `events` | an events schema | Events an asset fires. Readers subscribe through `ref.events.<name>:connect(...)`; the type fires them. | | `refShapes` | `{ [method] = function(self) -> (typeExpr, source?) }` | The result type of a `ref` method for one particular asset (below). | | `namePattern` | a Lua pattern | The names `asset.create` accepts for the type's assets. Default `^[A-Za-z][A-Za-z0-9_]*$`. | | `derive` | `{ output, module, compute, fingerprint, matches?, required?, timeout? }` | A file computed from the asset when it is committed; a `required` one holds the commit until it lands. | Some `ref` names mean the same for every type, and the engine calls them: - **`instantiate(self, target?, opts?) -> (root, idMap)`**: puts the asset in a scene. Defining it is what makes the type scene-instantiable. Its return is a contract (below). - **`inspect(self) -> detail`**: what `asset.inspect` reports for the asset beyond the common record (below). - **`preview(self, opts)`**: renders the asset's picture; it wins over the type's `preview:` recipe. - **`previewMaterial(self) -> { material }`**: the material a `surface` preview paints. - **`saveDefinition(self)`**: writes the asset's in-memory edits back to its files in edit mode. Some names are answered for every asset before the type is asked, so a `ref` entry of the same name is never reached: `getSource`, `getBytes`, `getText`, `exists`, `deps`, `canInstantiate`, `canPreview`, `preview` (which calls yours when you define one), `meta`, `runtime`, `events`, `typeRef`, `modules`, and the residency flags `has_backing_asset`, `has_runtime_changes`, `cpu_resident`, `gpu_resident`. ### When the engine calls the type | Hook | Signature | When it runs | |---|---|---| | `onCreate` | `(name, opts) -> { [path] = contents }` | On `asset.create`. Returns the files of the new asset, laid over the type's `template/`. Annotate `opts`: its type is the schema `asset.create` checks the caller's arguments against. A `""` key writes a single loose file. | | `onReplace` | `(dest, files) -> files` | On an `asset.create` over an asset already at `dest`, after `onCreate`, so what the author added can be carried into the replacement. | | `onRegister` | `(self)` | Once per asset, when it first registers: when the world loads, on a live `asset.create`, and when an asset arrives later (installed, pulled, synced). This is what makes an asset take effect the moment it is written. | | `onChange` | `(ref, change)` | On every write to a file inside an asset of the type. `change` is `{ path, asset, type, kind, origin }`, plus `settings` and `settingsChanged` for a write to the settings values file; `kind` is `edited` or `seeded`, `origin` is `local` or `remote`. Filter on `change.path`. Writes to one asset arrive in order, each after the hook for the one before has finished, and the hook may wait on what it reads. A write the hook makes inside its own asset arrives later like any other, so keep the hook convergent. | | `onDependencyChange` | `(ref, change)` | When a module the asset's code requires is re-run, or a name the asset carries starts resolving. `change.kind` is `dependency`. | | `onDelete` | `(ref)` | When an asset of the type leaves the world: deleted, or the world it is in is swapped away. | | `validate` | `(ref) -> { { code, message, severity?, path? } }` | On `asset.validate`, after the `type.yaml` checks, for the type's own rules. `severity` defaults to `error`. Runs on every push, so a type's rules hold at publish. A hook that fails reports `validate.hook_failed`. | ### Settings hooks | Hook | When it runs | |---|---| | `settingsDefaults(name, opts, asked) -> table` | Once per `asset.create`, for values the schema's defaults do not give. | | `settingsCorrections(values, name, opts) -> (corrections?, reasons?)` | On every settings write. A correction to a field the writer named refuses the write, giving the reason. | | `settingsDerivedDefaults(values, explicit, changed)` | On a settings write, for fields derived from others. | | `normalizeSettings(values, stored?)` | On every read and write, to map an earlier spelling of a field to the current one. | | `settingsHealed(values, stored)` | On a read, to repair stored values. | | `settingsSchemaProblem(schema, ref) -> string?` | When an asset's own schema is read; a returned string refuses the schema. | `creationInputs` (`{ [opt] = true | selectorOpt }`) names `asset.create` options that are inputs to the type rather than settings. ### Reloading An edit to `behavior.luau` reaches existing assets with no restart. ## How an asset is pictured (`preview:`) | `kind` | The picture is | The type provides | |---|---|---| | `instantiate` | the asset placed in the preview studio through its `instantiate` | `ref.instantiate` | | `image` | a file the asset holds, fitted to the frame | `source: { files }`, the candidate files in order | | `surface` | the asset painted on a mesh | `mesh`, and `ref.previewMaterial` | | `custom` | whatever `ref.preview` returns | `ref.preview` | ```yaml preview: kind: surface mesh: sphere ``` `angle: [yaw, pitch]` turns the camera. The studio owns the light, the backdrop and the framing, so an asset pictures the same in every world. A type with no `preview:` that defines `instantiate` still answers `ref:preview()`. A picture is rendered when something asks to view it (the editor showing the asset, `ref:preview()`), when previews are generated on request (`assets.generatePreviews`), and when the asset is staged. An edit alone renders nothing. The picture records what it was made from, so a stale one is told from a current one. ## The names your type's assets hold (`references:`) Where your type's own format or API carries the name of another asset, declare it here: ```yaml references: keys: # a top-level key of the type's files that holds a name, or a table of them - { key: "shader", type: "shader" } args: # an argument of a call, counting from 1 - { call: "g:node", position: 2, type: "procNode" } fields: # a field of the options table a call takes - { call: "fx.beam", field: "material", type: "material" } ``` `type` is the category the name resolves in. `asset.declareReferenceKey`, `asset.declareReferenceArg` and `asset.declareReferenceField` declare the same from a script. ## What search reads (`indexing:`) `indexing:` is how assets are found. Search reaches an asset only through what its type's `indexing:` names, and adds nothing of its own. That includes you: an asset indexed badly is one you cannot find later, when you are making something else and need it. A type whose assets are never looked for says `indexing: none`. ```yaml indexing: data: # text, read from the asset's files - role: identity extractor: verbatim source: { file: "README.md" } - role: interface extractor: symbols source: { files: ["init.luau"] } - role: implementation extractor: verbatim source: { files: ["init.luau"] } content: # the picture - role: identity modality: image source: { file: "preview.png" } facets: # what a query filters and re-ranks by file: ".metadata" rigged: { type: bool, from: { components: { contains: SkinnedModel } } } roughness: { type: number, filter: range, from: { file: "mat.yaml", field: "floats.roughness" } } ``` **Roles.** Each `data` and `content` entry has a `role`, and a query matches in two slots: - **`identity`**: what an asset is. For anything you look at, the picture; for anything else, the text that says what it is. - **`capability`**: what it does and how it is made. `interface` (the signatures or shape a caller uses) and `implementation` (the body) both count as capability, and a type with code usually declares both. Ask what a person would recognise an asset of the type by, and what it does, and point each role at the file that says it. For text, that is the asset's description: the file your template starts with a `[[describe]]` block, which the author writes or `services describe` fills in (see "Ask your assets to say what they are"). **`data`.** `extractor: verbatim` embeds a file's text as it is; `symbols` embeds the declared signatures of code. `source` is `{ file }` or `{ files: [...] }`. Never index a file name (`source: { field: name }`): one or two words carry nothing to match. **`content`.** `modality: image` embeds the picture itself, so a text query matches what the asset looks like. A type whose assets are looked at makes the picture its identity. **`facets`.** What a query narrows and re-ranks the matches by. `file` is embedded whole, so keys nobody declared in it are still found. Each further key is computed for every asset and states a value for every one, including `false`: a file can imply "not rigged" but never say it, and a query separates rigged from unrigged only because the unrigged ones say `rigged: false`. A key is `{ type: bool | number | enum, filter?: range, from }`, where `from` is `{ file, field }` (a field of one of the asset's files, dotted for nesting), `{ metadata: key }`, or `{ components: { contains | any_outside } }` (what the asset's entities carry). ## What blocks a push A push checks every asset it carries against its type. These refuse it: - a required file that is missing, a `content` check that fails, a `described` file not written yet; - an error from the type's `validate`. Unlisted files and warnings do not. A `described` file blocks only a push that changes the asset. When a push is refused, the message names each asset and what it lacks. `world.publishBlockers()` and `zm status` read the same list without pushing. ## Typing a result from the asset (`refShapes`) A `ref` method whose result depends on the asset (one entry per child folder, per row of a config, per control a map declares) can only be annotated as `{ [string]: Thing }`, which accepts any key. `refShapes` states the result for each asset instead: a function returning a Luau type expression for that asset, and the module whose types the expression uses. Read the asset; never run it. ```lua -- inputMap.assetType/behavior.luau M.refShapes = { activate = function(self): (string, string) local names = {} for _, control in ipairs(M.ref.controls(self)) do table.insert(names, control.name .. ": Handle") end if #names == 0 then return "", "" end return "{ " .. table.concat(names, ", ") .. " }", "@builtin::modules.zinput.scheme" end, } ``` With it, `map.jump:onPressed(fn)` is checked and `map.noexisting` is reported. A per-asset type applies where the call site names which asset: a component field whose default names it, or an annotation `AssetRef<"inputMap", "<identity>">`. `asset.resolve(name, category)` carries only the category, and a name computed at runtime carries nothing, so calls on those keep the declared return. The type belongs to the call's result: index it there, or bind what you need from it there, and the names stay checked. `require("@builtin::assetTypes.assetType.shared.refShapes").published()` shows what was published: `categories` (each type's method surface) and `returns` (per-asset results by identity, then method). An identity missing from `returns` was never published. Results are recomputed when an asset is written; at most 64 assets of one type are read. ## Putting an asset in a scene (`ref.instantiate`) A caller writes one piece of code against every instantiable type, so what `instantiate` returns is fixed: ```lua local Instantiable = require("@builtin::assetTypes.assetType.shared.instantiable") M.ref = { instantiate = function(self, target, opts) local root = Instantiable.root(self, target, opts) -- compose the asset under `root`, now return Instantiable.result(self, root, idMap) end, } ``` **In.** `target` is the entity the asset lands under, or onto for a hierarchy type; with none, the type spawns a new root. `position`, `rotation` (three numbers in degrees, or a quaternion), `scale`, `name` and `temporary` mean the same for every type: `Instantiable.root` applies them to a root you make, `Instantiable.place` to one you adopt. Document any options of your own in the hook's `--!arg` docs. **Out.** `(root, idMap)`. `root` is the composed root, live when you return: build synchronously, never defer to a component's `awake`. `idMap` maps each original id to the spawned one, so a component that composes the asset again on every load can pass it back in and keep references into the composition. Every call goes through `Instantiable.result`, which refuses a root that is not live and turns a missing `idMap` into `{}`. ## Inspecting an asset (`ref.inspect`) `asset.inspect(ref)` builds a record every asset shares (`identity`, `name`, `guid`, `source`, `typeName`, `typeDefinitionPath`, `scope`, `origin`, `description`, `tags`), then calls `ref.inspect(self)` for the type's own `detail`: ```lua M.ref = { inspect = function(self) -- read the asset's own files, never runtime state: inspect works on an asset -- that has not been compiled, uploaded or registered return { --[[ what makes this asset what it is ]] } end, } ``` Without it, the record is the shared part alone, and an agent inspecting the asset learns nothing of what it is. A hook that raises leaves `detail` empty and sets `record.warning`. ## Discovery - `asset.list("assetType")`: every registered type. - `asset.inspect("<typename>")`: the type, its README and its `about.yaml` texts. - `asset.resolve("<typename>", "assetType")`: the type itself.

# preview.derive The worker entries of the `<type>.preview` derive hooks that `preview` registers for every asset type with a preview recipe. - `fingerprint({ snapshot })` answers the digest of the snapshot's fingerprint lines, the value `preview.inputsFingerprint` states for the same content. - `compute` raises: a preview renders on the engine thread, through `preview.renderForReservation`, which the hook names as its `engineCompute`. ```luau local fingerprint = require("modules.preview.derive").fingerprint({ snapshot = snapshot }) ```

# world_vcs.derive.runner Turns staged assets into reservations and computes them on job-system workers. `world.add` and `world.add_all` call `reserveAndStart` once staging settles. - `reserveAndStart(stageName, stagedPaths)` plans the derive hooks that accept the assets holding the staged paths and reserves every planned output on the stage in one call before it returns, with a pending (empty) fingerprint. It then reads each reservation's `generation`, and after it the staged inputs, so it computes from that version of the inputs or a newer one; it fingerprints the assets on workers (every dispatch made before the first answer is awaited) and computes each output on a worker. Each output is written beside its asset, unless its reservation was reserved again meanwhile, and its reservation settled `done`, which stages the output into the reservation's stage in the same backend call; the settle carries the fingerprint of the inputs it was computed from, which a pending reservation records and a reservation that states another fingerprint refuses, and the generation it read: a settle at any other generation is refused (the inputs were staged again, and the computation of the newer ones answers for the output), and a settle at the current generation of a reservation already `done` changes nothing, so two engines computing the same version is harmless. A hook that raises, or runs past its `timeout`, settles `failed` with the reason and names no output. - A snapshot covers the whole asset: the files of the tree its stage's commit lands on, with the staged entries laid over them, and never the output the hook itself computes. That tree is the branch head with the caller's commits sealed before the stage laid over it, oldest first: a commit lands after the ones sealed before it and is rebased onto the head it finds. - Staging an asset again with the inputs the stage already holds for it (`snapshot.stagedInputs`: each staged file's address and the assets its reference table pins, a referenced folder asset whose files the stage holds by those files, so an output landing in it changes nothing) reserves nothing when this engine reserved its output for those inputs on that stage and is computing it or has settled it `done`: the reservation and its computation stay as they are. A staging that changes the inputs reserves the output again, and the run of the earlier keying is cancelled. - A run is cancelled when its output is reserved again or dropped. A cancelled run computes nothing it has not started: an engine-thread hook (`engineCompute`) is handed the run as its third argument, and one still waiting to start (a preview waiting for the stage it renders on) ends there. Nothing a cancelled run produces is written or settled. - The engine-thread work runs in units (preparing each asset, checking the reservation's generation, writing the output, settling it), each started only while the frame's shared slice (`modules.frame_budget`) has room, so a batch of any size runs across frames at the engine's frame rate. - `resume(stageName?)` dispatches again every `computing` reservation of the stage and of the caller's sealed stages that this engine is not computing, whichever engine or session reserved it. Each stage is read by its row id, entries and reservations together, and a reservation computes from the entries of its own stage laid over the tree that stage lands on, so a sealed commit's output is computed from what the commit holds. A reservation whose hook no engine has registered stays `computing`. - `status()` answers `{ computing, preparing, failed, statusReads }`; `failed` counts the failed settles the backend recorded, `statusReads` the whole-status reads the runner made (a reservation's generation is a read of its own row). - An output is written to its live path only when the snapshot it was computed from holds the live asset's files; a computation from other inputs (a sealed stage's, an older stage's) stores its bytes in the blob store by content address, settles `done` at that address, and leaves the live file alone. - A staged hook output (a `preview.png` swept in by `zm add .`) plans no reservation: only a change of the asset's inputs does. Neither does a staged file an install places where the world holds no row of its own: an installed asset is reserved only when the stage changes a file of it that is the world's own. - The snapshot of an asset that holds files of the world's own also holds the files an install places beside them (`snapshot.placedFiles`), read from the working tree: the commit carries them through the install's record, so an installed asset the world edited is computed whole. A file an install placed at the output's path is no live output of the world's: the computed bytes are written there, which makes the world's own file at that path, and a write that leaves the install's file in place settles `empty` when the bytes are the same and `failed` otherwise. - A settle refused because its reservation is gone drops the computation and tells no one: the staging area released the reservation once it no longer staged a change of the asset (the change was unstaged, the area emptied), or committed or closed. - A settle the backend refuses settles `failed` with the refusal as its reason, so the commit waiting on it is told why and a resume does not compute it again. A refusal for a fingerprint the reservation states for other inputs drops this computation, and a reservation whose failure is refused too posts a notice naming `zm derived retry`; a resume of this engine leaves either one alone until it is reserved again. A settle that raises before the backend answers leaves the reservation computing for a resume to compute again, three times in all; then this engine leaves it alone until it is reserved again and posts a notice naming `zm derived retry`, `zm derived provide` and `zm unseal`. - An asset that holds no input file of the world's own in the tree its commit lands on nor in the working tree has nothing to derive: the commit removes it, or every input file it holds is one an install places at a path the world holds no row of, which the install's record carries together with the outputs its publisher computed (an update of an install an earlier engine landed as one row per file leaves its assets so). Its reservation settles `empty`, so the commit waits on no output of it and lands none. `resume`, `retry` and `carry` settle such a reservation the same way, and `drop` of a required output of such an asset settles it `empty`. An asset whose working tree holds input files of the world's own that the commit does not settles `failed`, naming the `zm add` that stages them (after `zm unseal` for a sealed commit, since `zm add` stages into the staging area). A result is cached by hook name and fingerprint (`derive.cache`), so staging the same inputs again writes the cached bytes without computing. ```luau local runner = require("modules.world_vcs.derive.runner") runner.reserveAndStart("default", { "/zero/source/gold.material/mat.yaml" }) print(runner.status().computing) ```

# world_vcs.derive.snapshot A read-only view of an asset as a stage holds it, and the one fingerprint rule shared with `preview.inputsFingerprint`. - `of(assetPath, staged, opts?)` builds a `DeriveSnapshot` from staged entries shaped like the status `staged` rows, `{ path, staged_action?, staged_checksum, blob_sha256?, deps? }`, laid over `opts.base`, the files of the asset in the tree the stage's commit lands on (`{ path, checksum_sha256, blob_sha256?, refs_json? }`, the dependencies read from `refs_json`); a `delete` row removes a file, and `opts.exclude` names relative paths left out, such as the output a hook computes. An entry another entry lies beneath, staged or in the base, is a folder (a folder asset nested in the asset, such as a material's `textures/basecolor.texture`) and is left out: the asset holds the files beneath it (`foldersOf(paths)` names them). A base file with no blob address is read as text through its content address. `files` maps each file's path relative to the asset to its content address; `read(rel)` fetches the staged blob on first use, decodes it and keeps it on the snapshot, and answers nil for an absent file or an unreadable blob. - `opts.placed` (from `placedFiles`) names files of the asset an install places where the world holds no row of its own, each with its content address, VFS path and references: one joins `of` at a path no base or staged entry holds, is read from the working tree, and counts toward the version a pin of a folder asset nested in the asset states, so an installed asset the world edited fingerprints whole, the way the live asset does. - `placedFiles(path, isPlaced, opts?)` lists the live files of the asset that `isPlaced` says an install places. - `laidOver(base, stages)` lays the staged entries of each commit, oldest first, over the `base` rows and answers the tree in the base shape; a staged delete removes the path. - `live(path, opts?)` builds the same shape over the live files of the asset, with each file's dependencies from `asset.deps`. - `fingerprintLines(s)` returns the lines a fingerprint hashes: `f <relative path> <address>` per file in path order, each followed by `d <guid> <checksum>` per asset the file references. - `EXCLUDED` names the files that are never inputs: `preview.png`, `README.md` and `.metadata`. ```luau local snapshot = require("modules.world_vcs.derive.snapshot") local s = snapshot.live("/zero/source/a.material") print(__crypto.sha256_hex(table.concat(snapshot.fingerprintLines(s), "\n"))) ```

# world_vcs.derive.worker The entries `world_vcs.derive.runner` dispatches to job-system workers. Each runs in a worker VM, requires the module a hook names, and calls the hook's entry over data handed across as copies. - `fingerprint({ hook, snapshot })` answers the string the hook's `fingerprint` entry computes for the snapshot. - `compute({ hook, snapshot })` answers `{ bytes?, error? }` from the hook's `compute` entry. The snapshot's `read(rel)` answers the staged bytes the runner fetched for the file. ```luau local p = jobs.dispatch("modules.world_vcs.derive.worker", "fingerprint", { hook = hookData, snapshot = snapData }) local fingerprint = p:await() ```

# world_vcs Pure-Luau wrapper around the `__spacetime_vcs.*` FFI primitives. Composes the low-level stage / commit / push reducer chain into the headline `world.add` / `world.commit` / `world.push` / `world.diff` / etc. API. The prelude grafts these onto the engine's `world` namespace at boot via `M.installInto(world)` — callers use the grafted methods on `world.*`, they don't `require` this module directly. This module is the ONLY place where the public `world.*` VCS API is defined. Future context-gating (only editor-scope VMs may invoke `world.commit`, components are denied, etc.) lives here as Luau-side checks. The Rust-side primitives stay one-to-one with module reducers and don't carry gating logic. ## Exports - `M.installInto(world: WorldNamespace)` — graft the entire VCS surface (`add`, `add_all`, `unstage`, `discard`, `commit`, `push`, `head`, `status`, `log`, `show`, `diff`, `affirm`, `trash`, `restore`, `stash`, `stashes`, `stashPop`, `stashDrop`, `reset`, `list`, `installLibrary`, `updateLibrary`, `installedLibraries`, `checkUpdates`, `reviewUpdate`, `update`, `uninstallLibrary`, `installAsset`, `uninstall`, `removeUnusedDeps`) onto the supplied namespace. After install, the following are callable on `world.*`: - `world.add(paths: string | { string })`: stage one path's manifest row, or each of a list of paths (asset-aware: expands to the asset family). A list stages every row its paths select once, so several files of one asset stage that asset's family once. Staging is advisory: a path another staging area holds is taken out of that area, whichever account opened it and whether or not its session is open, and named in the report's `released` (`stage`, `account`, `same_account`, `session`, `live`); a take from another account's area warns, naming that account, the area and its session. A staged path a caller of another account is writing now is named in `written` and warned about. The report is `{ staged, carried, released, written }`. - `world.add_all(opts?)`: stage every dirty manifest row, whoever wrote it, each with its asset family; conflicted rows stay out, and the call returns them. Staging is advisory: a path another staging area holds is taken from that area, whichever account opened it, and a row a caller of another account is writing is staged like any other. The calling account's own agents and engines never warn each other; a take from another account's area, and a staged path another account's open session is writing, warn once per area or caller. A second return value reports the call: `staged` (the paths it added), `held` (each conflicted path with its `reason`), `released` (each path taken from another staging area, with that area as `stage`, its row id as `stage_row_id`, its `account`, `same_account`, its `session` and whether that session is `live`) and `written` (each staged path a caller of another account is writing now, with `by` and `account`). Its cost follows the size of the dirty set: a fixed number of working-tree reads, and its stages and releases sent in batches. - `world.unstage(path: string)` — remove a path from the staging area. A path the calling area does not hold that another staging area does is taken out of that area, whichever account opened it; the call returns `{ released }`. - `world.stageVersion(rev, path)` — `git reset <rev> -- <path>`: the staging area's entry for the path becomes the revision's version, and a version the branch head holds (`HEAD` itself) unstages the path; the working tree stays. - `world.discard()` — drop the implicit stage without committing. - `world.commit(message: string) -> string` — open-or-resume stage, set message, materialise commit. Returns the new commit id (ULID). - `world.push(commitId: string?, opts: StageOpts?) -> (string?, string)` — push one or all unpushed commits to ZeroMind. `opts.stage` names the caller's own staging area. The pre-push content gate refuses over every asset the push publishes that falls short of its type's contract, whichever area staged it, and names beside each one the other area holding it, when one does. Returns the pushed ZM commit id and the verdict `"published"`, or the verdict `"already-published"` when the remote already carries what the call would have published — with the commit's existing ZM id for the single-commit form, and a nil id for the whole-stack form. - `world.head() -> string?` — current branch HEAD commit id, or nil. - `world.vcsStatus(opts?) -> StatusResult` — dirty + staged + untracked entries, and `ignored_summary`: the ignored rows counted by kind, one entry per scene autosave overlay (`kind = "overlay"`, `root` its `scene_dirty` folder) and per `.zmignore` / `.gitignore` line that matches rows (`kind = "rule"`, `file`, `rule`), each with its `count`. `{ ignored = true }` lists the ignored rows themselves in `ignored`, which is empty otherwise. A file whose bytes are the head's and whose reference table is not (a library pin moved, or an asset it references changed) is listed with `reason = "references moved"`, staged like any change, and committed with what moved it: a commit holding that change records each such file it does not stage at the bytes the branch head holds, with the pins that change moved advanced (a `staged` entry with `references_only = true`), so another caller's unstaged edit of the file stays out of the commit. `world.commit` refuses a commit holding a file whose table pins a version the commit leaves out (a changed asset or pin marker left unstaged), with a `dep.stale_references` entry per file. (Named `vcsStatus`, not `status`: `world.status()` is the runtime-snapshot accessor from `world_status.module`.) - `world.log(opts: LogOpts?) -> { CommitRow }` — `git log`: every commit reachable from `opts.rev` (default `HEAD`) through both parents, newest first; `opts.path` keeps the commits that touched one file. - `world.revParse(rev: string) -> string` — `git rev-parse`: the commit `HEAD`, a branch, `origin/<branch>`, a commit id or a unique prefix names, with `~N` / `^` / `^2` after it. - `world.show(...) -> any` — `git show`-style: commit metadata + diff, or path bytes via `<rev>:/path`. - `world.diff(...) -> any` — `git diff`-style: working / staged / revision-vs-revision, with `--stat` / `--name-only`. Working-tree files a `.zmignore` / `.gitignore` rule matches are left out unless `--ignored` is passed; staged files and paths named after `--` are diffed whatever rule matches them. - `world.diffUpstream(root: string) -> { UpdateFile }` — your changes to an installed asset against the version it was installed from. - `world.createBranch(name, fromCommit?)`, `world.branches()`, `world.remoteBranches()`, `world.deleteBranch(name, { force? })`, `world.renameBranch(old, new, { force? })` — `git branch` and its `-r`, `-d` / `-D`, `-m` / `-M`. A rename that fails part-way is undone, leaving the branches as they were. - `world.checkout(branch: string) -> string` — `git checkout <branch>`: the caller's uncommitted changes and staged entries come along, or the switch refuses with git's message, moving nothing. `world.checkoutSide(path, "ours" | "theirs")` takes one side of an unmerged path; `world.checkoutPaths(rev, paths, opts?)` writes and stages paths as a revision holds them, each as the asset the revision records (its guid, bytes and kind); a folder brings back every file the revision holds beneath it, and `{ stage = false }` leaves the staging area as it was. - `world.merge(source: string, opts: MergeOpts?) -> MergeResult` — `git merge` into the session's branch: a fast-forward when it can (`noFf` / `ffOnly`), else a merge commit; a local change on a path the merge rewrites refuses it. `world.mergeAbort()` takes back what a conflicted merge wrote. - `world.affirm(token: string)` — consume an affirmation token returned by a destructive op. - `world.trash() -> { TrashRow }` — list trash entries. - `world.restore(handle: any)` — restore a trash entry by row_id. - `world.trashEmpty() -> number` — delete the trash entries your own operations put there, for good, in one transaction; other callers' entries stay. - `world.stash(label: string?) -> StashPushResult` — `git stash push`: save the caller's dirty + staged state into a stash and take those paths back to their committed version. Binary and large content is saved by its stored blob, so applying the stash brings it back byte-identical. A path no commit holds keeps its working content in the tree, as git leaves an untracked file, and is listed under `kept`, with its reason in `reasons`. - `world.stashes() -> { StashRow }` — list every stash in the world. - `world.stashApply(ref?)` / `world.stashPop(ref?)` / `world.stashDrop(ref?)` — `git stash apply | pop | drop`, defaulting to the caller's newest stash; `ref` is a row id or `stash@{n}`. A drop snapshots the stash to trash. - `world.reset(target: string, opts: ResetOpts?) -> ResetResult` — `git reset --soft | --mixed | --hard` to any revision; the commits the head leaves behind become trash entries. `hard` takes the working tree to the target: every change of the caller's account, untracked files, uncommitted installs and a scene's autosave overlay included, goes to trash first, and a write this session owes the world that the world is not taking is given up (`world.dropOwedWrites`); another account's local changes stay and are listed in `kept`. - `world.list() -> { WorldEntry }` — every world the authenticated user has access to. - `world.installLibrary(opts: InstallLibraryOpts) -> InstallLibraryResult` — declarative cross-world dependency marker. - `world.updateLibrary(name: string, ref: string?) -> UpdateLibraryResult` — move an installed library (`@builtin` included) to the commit `ref` (default `main`) resolves to in the library's world: rewrites the marker, waits until the engine holds the library at that commit (an `@builtin` pin table is read, another library is mounted), and derives again the reference tables of the world's own sources that name it; a ref resolving to the commit already pinned changes nothing. A commit that does not hold an asset the world's own sources name is refused before the marker changes: the error names each such asset by the literal its sites wrote and its guid, with every source and line naming it (twenty listed, then a count), and the pin stays where it was. It refuses while play is running or in a runtime-profile session, and one move per library runs at a time. Returns `{ name, from, to, changed, rederived, broken, kept, conflicts }`; a pin already at that commit is left untouched (`changed = false`). The world's edits of the library's files stay at their paths through the move: `kept` lists the ones the new commit left as they were, `conflicts` the ones it changed or removed too, whose new version is for the author to merge in or take. - `world.checkUpdates() -> ({ UpdateReport }, { UpdateSkip })` — the units with an update available, read-only. A library is one unit: its marker's `requested_ref` (default `main`) resolves in the library's world to a commit other than the marker's `resolved_commit` (`{ kind = "library", library, from, to }`; apply with `world.updateLibrary(name)`). An installed asset is one unit per install root (its reference table marks it): its recorded version differs from the newest version of the asset at its origin, one lookup per root (`{ kind = "asset", root_path, root_guid, display_name, from, to }`; apply with `world.update(<root path>)` (`zeromind.update`), which installs the root's new closure with each dependency at the version the new root records and removes dependency versions no install records any more). A dependency is never compared or reported, assets from a library's world belong to that library's unit, and a pulled row no table marks as a root is not reported. The second value lists `{ name, reason }` for the units whose origin could not be reached. Opening a world in an editor raises one notice with the same list. `world.pullAsset` aimed at a dependency of an install answers `<path> is a dependency of the install <name> (<root path>); update the root`. - `world.reviewUpdate(unit: string, opts: ReviewUpdateOpts?) -> UpdateReview` — what updating one unit changes, writing nothing: `from` (what the world holds) and `to` (what the origin holds at `opts.ref`, default the ref `world.checkUpdates` compares it with), then `commits`, the commits of the origin world in between, newest first, each `{ id, message, author, date }` (`more` is true past 200), then the files; `modified` names up front each file holding an edit of the world's own that the update touches, with `merges` or `conflicts`, and `by`, the session that wrote the uncommitted change: a file is edited when it is not an installed file holding the bytes it installed (an install nobody edited is never in `modified`, committed or not). An installed asset (its root path; a path inside the install stands for the root) lists the commits that change the install back to the one that moved the root from the installed version, and `files`: each file the update adds, changes or removes, `{ path, change, diff, hunks, local_edit }`, `local_edit` being `none`, `merges` or `conflicts` for a file the world edited since it was installed. A library (`@<name>`, the `@` optional) lists its commits from the pin to the new commit and counts the library files that change and the world's files whose references move with the pin; `moving` (the world's files whose references move) is always present; `opts.files = true` adds `files`, the list behind the counts; the moving files are read from the engine's reverse reference index. `opts.commits = false` reads no commits and `opts.files = false` leaves an install's `files` and diffs out, so `{ commits = false, files = false }` is the check before an update: `modified` and the counts alone. A file listed in status only because its reference table moved (`references moved`, `install recorded`) holds no change of its own and is never in `modified`. An install's commit list stops at the commit whose parent holds the root at the version the install recorded, read from the root's closure at that commit, the root alone (`zeromind.world` op `closure`, `maxDepth = 0`), or at the commit that adds the root's path; when a version cannot be read the list stops there, `more` is true and `commits_error` says why. The origin's log, commits and diffs are read through the trusted ZeroMind bridge (`zeromind.world` ops `commits`, `commit`, `diff`). - `world.pull(branch: string?, opts: PullOpts?) -> PullResult` — `git pull`: fetch `origin/<branch>` (default the session branch) and merge it into the session branch: a fast-forward when the session branch is strictly behind, else a two-parent merge commit with markers on conflict; nothing when the session branch already holds the fetched commit, read before anything moves so a tree with uncommitted changes is not refused for it: for the session branch's own upstream the fetch's `behind` count answers that, for another branch the session branch's history does. `opts.ffOnly` refuses anything but a fast-forward, `opts.noFf` always makes a merge commit. - `world.update(units: (string | { string })?, opts: UpdateOpts?) -> UpdateResult` — apply updates: no `units` updates every unit `world.checkUpdates` lists, a name or a list of names (library names and install root paths, mixed) updates those, to `opts.ref` when given. A library moves its pin (`world.updateLibrary`), an installed asset pulls its new closure (`world.pullAsset`), one unit at a time; a unit that fails is reported in its entry with the reason and the rest still run. An install's pull refuses while a row it writes is conflicted (a row under its root, or the row a closure entry lands in), and runs over conflicts in every other row. Nothing is staged, committed or pushed: the updated files wait in `world.status()`. Returns `{ results, to_commit, skipped, warnings, note }`: one `{ unit, kind, from, to, ok, error?, merged?, conflicted?, added?, pruned?, moving? }` per unit, every path the updates changed or moved, the units the check could not read, one `{ unit, path, outcome = "merged" | "conflicted" }` per file holding uncommitted changes that an update touched, and a note that nothing was committed. - `world.uninstallLibrary(name: string) -> string` — delete the library marker file. - `world.uninstall(path: string, opts: { dryRun: boolean? }?) -> UninstallReport` — remove the install at `path` with the dependencies under `/zero/source/deps/` it placed or used that nothing else uses; a dependency something else uses stays (`kept`, with its users), and a file this world changed stays as a file of the world (`kept_modified`). Commits nothing. Lives in `dependencies.module`. - `world.removeUnusedDeps(opts: { dryRun: boolean?, only: (string | { string })? }?) -> RemoveUnusedReport` — list (`dryRun`) or remove the dependencies under `/zero/source/deps/` nothing in the world uses, by the engine's reverse index of reference tables and the install records. Commits nothing. `dependencies.module` also posts the notice naming them whenever the set changes; the notice writes nothing to the world. - `world.installedLibraries() -> { LibraryMarker }` — the libraries this world has installed, one row per marker under `/zero/source/libs`, sorted by name: `{ name, world_guid, requested_ref?, resolved_commit }`. - `world.installAsset(opts: InstallAssetOpts) -> InstallAssetResult` — imperative content pull from another world. - `world.assetInstallable(opts: AssetInstallableOpts) -> AssetInstallableReport` — whether one published asset resolves a closure of its own, as a verdict. - `world.installedAssets() -> { InstalledAsset }` — every asset this world carries from ZeroMind, keyed by the published guid it was pulled from. Types: - `WorldNamespace = { [string]: any }` — target table for `installInto`. - `LogOpts = { limit: number? }` - `CommitRow = { commit_id: string, parent_commit_id: string?, hivemind_pushed: boolean?, message: string?, created_at: number? }` - `StatusEntry = { path: string, dirtied_by: string?, dirtied_by_caller: string?, writer: string?, dirty_since_micros: number?, staged_action: string? }`: `dirtied_by` is the identity the row was written under, which every session of one account shares; `dirtied_by_caller` is the caller key of the call that wrote it (`client:<session>` / `actor:<sub>`, and `client:<session>@<engine seat>` for an agent an engine hosts in its dock, whose session id every engine repeats; a row keyed by a bare `client:ide-slot-<n>`, written before those keys named the seat, resolves to no agent); `writer` is what the row is to the calling caller (see `StatusResult`). - `StatusResult = { dirty: { StatusEntry }, staged: { StatusEntry }, untracked: { StatusEntry }, local_identity: string?, local_caller: string? }`: `local_identity` is this connection's identity and `local_caller` the calling caller's own key. `writer` is `"you"`, `"other"` (a caller whose session is open), `"ended"` (a caller whose session has ended) or `"unattributed"`; `dirtied_by_account` is the account a row's writer acts for and `same_account` whether that is the calling caller's; `local_account` is the calling connection's account. `claimed_by_other_stages` lists `{ path, stage_name, stage_row_id, owner_identity, owner_account, same_account, live, session, staged_action }` for each path another staging area holds; a staging call that stages one of them takes it out of that area. `writer_accounts_refusal` is set when the world's backend module predates the record of writers' accounts. - `ShowResult = { commit: any, parent: string?, entries: { any }, diff: any? }` - `DiffFile = { path: string?, action: string?, is_text: boolean?, added: number?, removed: number?, hunks: { any }? }` - `TrashRow = { row_id: number, op_kind: string?, path: string?, destroyed_by: string?, days_left: number? }` - `StashRow = { row_id: number, branch: string?, label: string?, author_hex: string?, created_at_micros: number?, dirty_count: number?, staged_count: number? }` - `StashSnapshot = { dirty: { any }, staged: { any } }` - `WorldEntry = { guid: string?, name: string?, title: string?, visibility: string?, role: string? }` - `InstallLibraryOpts = { world: string, commit: string?, as: string?, ref: string? }` - `InstallLibraryResult = { name: string, path: string, world_guid: string, version: string }` - `InstallAssetOpts = { guid: string, at: string?, ref: string? }` - `InstallAssetDep = { path: string, guid: string, version: string? }` - `InstallAssetResult = { assets_written: number, blobs_downloaded: number, root_guid: string, root_path: string?, root_version: string?, deps: { InstallAssetDep }, pending: { string } }`: `blobs_downloaded` counts the blobs the install fetched, and `pending` lists written paths that did not read back before the install's wait for them stalled ## Usage ```luau -- The prelude installs the wrapper at boot: require("@builtin::modules.world_vcs").installInto(world) -- After install, callers use the grafted methods on `world.*`: world.add("/source/foo.luau") world.add_all() local commitId = world.commit("feat: ship widget") local zmId, verdict = world.push() local s = world.vcsStatus() for _, e in ipairs(s.dirty) do print(e.path) end local commits = world.log({ limit = 20 }) local r = world.show("--stat", commits[1].commit_id) ``` ## Parts The module is a folder of parts, each a module of its own that `init.luau` requires: - `world_vcs.vcsWire`: the `__spacetime_vcs.*` promise wire and the readers of its answers. - `world_vcs.history`: commit trees, ancestry, revisions and the diff reads. - `world_vcs.ignore`: the `.zmignore` / `.gitignore` rules. - `world_vcs.sceneEdits`: a scene's live edits and the gate publication calls run on them. - `world_vcs.ulid`: commit ids. - `world_vcs.worldReady`: waiting for a swapped world's content to land. - `world_vcs.statusRead`, `world_vcs.derive`, `world_vcs.derivedGate`, `world_vcs.finalize`, `world_vcs.dependencies`: derived outputs, sealed commits and dependency upkeep. ## Notes - One implicit "default" stage per (world, branch, user). `world.add` / `world.add_all` / `world.unstage` open-or-resume that stage idempotently. `world.commit` auto-closes on success. `world.discard` drops it without committing. - `world.add` is asset-aware: staging a path inside a composite asset (`.scene`, `.component`, `.bundle`, etc.) expands to the full asset family so the resulting commit's tree-hash stays consistent. - Commit ids are caller-allocated ULIDs generated client-side (Crockford base32, 48 bits ms timestamp + 80 bits randomness via `math.random()`). Not a cryptographic primitive — sufficient for client-side collision avoidance. - All `__spacetime_vcs.*` calls go through the same promise-await pipeline; `ERR:...` payloads are unwrapped into Luau errors. - `world.stashDrop`, `world.reset` and `world.deleteBranch` run through the destructive-affirm token mechanism, minted and affirmed in the same call. - `world.diff` and `world.show` mirror their git CLI counterparts' argument grammar, including `--stat`, `--name-only`, `--staged`, `--`, and `commit:/path`.

# luau_introspect (module) Parses Luau/asset source TEXT into structured declarations. Pure string/pattern parsing (`string.find` / `string.match` / `string.gmatch`) over the literal source — no compiling, no VM spawn, no runtime state, no engine FFI. Given source text, it extracts what is written in the file. This is the shared parser every per-assetType `M.ref.inspect` hook uses to turn a component/module/tool's own source into the structured record `asset.inspect` returns. ## Exports - `docstrings(src) -> DocMap` — scans `--!desc` / `--!arg` / `--!return` / `--!example` comment runs and binds each run to the name of the declaration on the next non-comment line (the identifier after `function`, `public:`, `local function`, or `M.`). - `publicFields(src) -> { FieldEntry }` — parses `public = { name = Field.<kind>(default, mode), ... }` table-literal entries and module-scope `public.<name> = Field.<kind>(...)` assignments. - `events(src) -> { EventEntry }` — parses `events = { name = Event(payloadSchema?, syncMode?), ... }` table-literal entries. - `methods(src) -> { MethodEntry }` — parses `function public:<name>(...)` / `typed function public:<name>(...)` declarations (params + optional return type). - `lifecycleHooks(src, catalog) -> { string }` — top-level `function <name>(` declarations whose name is in the caller-supplied `catalog` array. - `moduleExports(src) -> { ExportEntry }` — parses `M.<name> = function` assignments, `function M.<name>(...)` declarations, and a trailing `return { foo = foo, ... }` export table. - `forSource(src, computeFn) -> any` — memoises `computeFn(src)` keyed on `src` itself in a module-local table. The same source text returns the cached result without re-running `computeFn`; different source text recomputes. Keyed on the source content (not an asset checksum) because composite/container assets (component folders, scene folders, etc.) all hash to the empty-string checksum — a checksum-keyed cache collapses every such asset's detail onto whichever one was inspected first. ## Usage ```luau local Introspect = require("modules.luau_introspect") local src = self:getInitScript() local detail = Introspect.forSource(src, function(s) return { fields = Introspect.publicFields(s), events = Introspect.events(s), methods = Introspect.methods(s), hooks = Introspect.lifecycleHooks(s, lifecycleCatalog), } end) ``` ## Notes - Every function is a pure string→table transform: same source text in, same structured table out, every time. No reads of live component state, no entity/world queries. - Structural scanning runs over a comment- and string-aware **mask** of the source (a same-length copy where comment bodies and string-literal contents are blanked to spaces, delimiters and newlines preserved). Pattern matches and brace/paren balancing run on the mask — so a brace, `Field.`, `Event(`, or a whole entry that appears inside a comment or a string literal never registers — while captured values are sliced from the original source at the same (aligned) indices. This makes the parser robust to apostrophes in comments, commented-out entries, string defaults containing `}` / `Field.` / `Event(`, and `[[ ]]` long strings. - `default` / `category` are raw trimmed source-text slices (with any trailing comment stripped), not evaluated values. - For a **ref constructor** (`Field.assetRef` / `dataRef` / `resource` / `componentRef`) the FIRST positional argument is the category / contract / componentType selector, captured under `category`; the SECOND argument is captured under `default`. - For every **other** Field kind the first argument is the `default` and `category` is nil. - A trailing `Sync` / `NoSync` identifier is captured as `sync`, tolerating a trailing comma or a trailing comment after the last argument. - Field/Event entries whose key is a computed or indirect expression (`[expr] = Field.number(...)`) are omitted — only literal identifier keys are recognised. - `methods` captures a `...` variadic parameter (as `name = "..."`), with its `: <type>` annotation when present. - A `--!desc` written above a field/event declaration (`<name> = Field.<kind>(...)` / `<name> = Event(...)`) or a `public.<name> =` assignment binds to that name in `docstrings`, and is folded into the corresponding `publicFields` / `events` entry's `desc`. - `lifecycleHooks` never hardcodes the lifecycle-callback catalog; the caller passes the list of names to match against. - `forSource`'s memo is bounded (oldest-key eviction) so a long session touching many distinct asset versions can't grow it without limit.

# assetType.shared.ref Builds the metatable every `AssetRef` (the `{ __ref, type, name, guid, identity, path }` envelope returned by `asset.resolve` / `asset.ref`) carries. Replaces the per-call C metatable that used to live in `crates/zero_scripting/src/ffi/bindings/asset.rs::attach_asset_ref_metatable`. ## Public API ```lua local assetRef = require("@builtin::assetTypes.assetType.shared.ref") -- Called by the Rust factory (push_asset_ref_handle) via -- _G.__build_asset_ref_proxy after the envelope fields are set. assetRef.build(envelope) -- attaches AssetRefMT, returns the table ``` The module exposes no invalidation surface — discovery is registry-driven and hot-reload is transparent (see "Discovery and hot-reload" below). ## Method dispatch order `ref.foo` is resolved in this order: 1. **Default methods** — `getSource` / `getBytes` / `getText` / `exists` / `inspect` and the lazy `meta` property. Per-type definitions cannot override these (engine contract from gh#1889). 2. **Per-type `ref` table** — discovered through `asset.resolve(<typename>, "assetType")` + `require(<identity>.behavior)`. The lookup resolves to whichever `<typename>.assetType/` folder is currently registered for the typename (built-in, user, or library-vendored) and pulls its `ref` methods. 3. **Nil** — unknown key, same shape as the original C metatable. ## Adding methods for a new asset type Drop a `behavior.luau` into the type folder: ``` src/lua/lib/assetTypes/<typename>.assetType/ ├── type.yaml -- structural spec (existing) ├── behavior.luau -- ref + global behaviour (new) └── template/ -- placeholder body (existing) ``` `behavior.luau` returns: ```lua return { ref = { --!desc Per-instance method on every `<typename>` AssetRef. myMethod = function(self, ...) ... end, }, global = { -- Reserved for the asset.<typename>.* surface — not consumed -- yet; included so the contract from gh#1889 lands cleanly. }, } ``` Within `ref` methods, `self` is the AssetRef envelope: `self.path`, `self.identity`, `self.guid`, `self.type`, `self.name` are available. Engine-required fields (`guid`, `path`, `identity`, `type`) must not be redefined. ## Discovery and hot-reload Type discovery uses the asset registry, so it doesn't matter where a `<typename>.assetType/` folder lives — engine built-ins under `@builtin::assetTypes.<X>`, user types dropped under `/zero/source/<X>.assetType/`, or types vendored inside an imported library all resolve identically. The dispatcher walks `asset.resolve(<typename>, "assetType")` → canonical identity → `require <identity>.behavior` on every miss; the asset registry is the cache for the resolve half and Luau's `_LOADED` is the cache for the require half. Hot-reload is transparent. When a `<typename>.assetType/behavior.luau` is rewritten through VFS, the engine's `invalidate_require_cache_for_state` re-runs the module and mutates the cached `_LOADED[<identity>.behavior]` table in place. Dispatch reads `mod.ref` on every access (rather than caching a sub-pointer), so existing AssetRefs see the new methods on the very next access — no Rust-side hook into this module is needed, and no invalidation API is exposed for callers to call. The same registry-driven path also handles type **registration** correctness: dropping a new `<typename>.assetType/behavior.luau` updates the asset registry, the next `asset.resolve(<typename>, "assetType")` returns the new ref, and AssetRefs of that type immediately gain the new methods. ## Why Luau, not Rust The asset surface needed per-category behaviour (`material:getProperties()`, `bundle:instantiate(entityId)`, `tool:run(args)`) and the old shape couldn't grow without an FFI change per method. Owning the proxy in Luau means: - Type-specific methods ship as content (the `<typename>.assetType/` folder), not engine code. - Adding a new asset type drops in a new folder; no Rust rebuild. - Methods can call any other Luau global (`vfs`, `asset`, `Material`, `entity`, etc.) directly, instead of going through narrow FFI primitives. ## Consumers - `crates/zero_scripting/src/ffi/bindings/asset.rs::attach_asset_ref_metatable` — the Rust factory that pushes envelopes invokes `_G.__build_asset_ref_proxy` once per push. - Every Luau call site of `asset.resolve` / `asset.ref` / `entity(id).component.X.material` / any binding declared `AssetRef<...>` — they all receive envelopes built through this module.

# yaml.module YAML decode + encode for authored engine content. Pure Luau, no engine dependencies — a general parsing library, not data-system plumbing. ```luau local Yaml = require("@builtin::modules.yaml") local doc = Yaml.decode(vfs.read(path)) vfs.write(path, Yaml.encode(doc)) ``` ## Supported subset - Block mappings (`key: value`) and block sequences (`- item`), nested to any depth. - Compact sequence-of-mapping entries (`- path: x` / ` kind: y`). - Flow collections — `{ a: 1, b: 2 }` and `[1, 2, 3]` — single line. - Plain scalars with type inference: `~` / `null` → nil, `true` / `false` → boolean, numeric literals → number, everything else → string. - Single- and double-quoted strings (`''` escapes a literal quote inside a single-quoted string; `\n` `\t` `\r` `\\` `\"` inside a double-quoted one). A quote opens a quoted scalar where a scalar begins — after `key:`, after a `- ` entry marker, or inside a flow collection — so a plain scalar carries an apostrophe as data (`note: the world's rules`). Quoted keys are read in flow mappings. - `#` comments — honored outside quotes, so a `#` inside a quoted string is kept as data. - Literal (`|`) and folded (`>`) block scalars, with a chomping indicator (`-` strips the final newline, `+` keeps every trailing blank line, none keeps one newline) and an indentation indicator (`1`-`9`: the content's indent past the parent's), in either order (`|-`, `>+`, `|2`, `>1-`). A block scalar's content is literal text: quotes (balanced or not), `#`, `key: value` and `---` inside it are data. - An optional leading `---` document marker. ## Loud-error contract Constructs outside the subset above raise instead of misparsing: anchors/aliases (`&`, `*`), tags (`!`), directives (`%`), multi-document streams (a second `---`), a block-scalar header it cannot read (`|x`, `|-+`, `|0`), tab indentation, and inconsistent indentation (both block structure and block-scalar bodies). Every error carries the offending line number (`yaml: line N: ...`), so a bad config points straight at the line to fix. Tab indentation is rejected everywhere — including block-scalar body lines whose leading whitespace contains a tab. A tab after the first non-space character of a line is content and passes through. ## API - `Yaml.decode(text: string): any` — decode a YAML document into a Luau value (table, scalar, or nil for an empty document). Raises on malformed input or an unsupported construct. - `Yaml.decodeWithComments(text: string): (any, boolean)` — decode as `decode` does, and report whether the text carries a comment by the decoder's own rule: a `#` at a line's start or after whitespace, outside a quoted scalar and outside a block scalar. Re-encoding the value drops such comments, so an editor that writes a document back reads this first. - `Yaml.encode(value: table): string` — encode a Luau table as YAML (block style, two-space indent, alphabetically sorted keys). Raises on values YAML can't represent (functions, userdata, non-string mapping keys). A top-level empty table encodes to an empty document, which decodes back to `nil` (the YAML empty-document ambiguity).

# json JSON encode/decode library for Luau. Encodes Lua values to JSON strings and decodes JSON strings back to Lua values. Used for communication with the Rust side of the engine, the VFS read/write bridge, and any wire-format that needs JSON. Pure Luau, no engine dependencies. Compact and pretty-printed encoders, plus a hand-rolled decoder that streams the input by position so it works under WASM as well as native. ## Exports - `Json.encode(value: any, indent?: string, currentIndent?: string) -> string` — compact encode. Functions / unknown types and NaN/Inf encode as `null`. - `Json.encodePretty(value: any, indentStr?: string) -> string` — pretty-printed encode with sorted object keys (diff-friendly). - `Json.encodeArgs(...: any) -> string` — encode varargs as a JSON array. - `Json.decode(str: string) -> any` — decode a JSON string. Returns the decoded value, or `nil` + error message on failure. ## Usage ```luau local Json = require("@builtin::modules.json") local widget = { type = "button", text = "Click Me" } local compact = Json.encode(widget) -- '{"text":"Click Me","type":"button"}' local pretty = Json.encodePretty(widget, " ") local decoded = Json.decode(compact) local v, err = Json.decode("oops") -- v = nil, err = error message ``` ## Notes - Object keys are sorted alphabetically in both encoders for consistent output across runs. - Numeric keys on objects are stringified at encode time (JSON has no numeric keys). Pure-integer key sets get detected as arrays via `isArray` and encoded with brackets. - NaN, +Inf, -Inf encode as `null` — JSON has no representation. Round trips through `decode` recover `null` (Lua `nil`), so they don't preserve. - Unicode `\uXXXX` escapes decode to UTF-8 by hand to stay WASM-safe. Only the BMP is covered; supplementary planes via surrogate pairs are not. - Functions encode as `null`. - Decode is character-streamed — no regex, no `string.match` patterns on the whole input — so the line-and-column information needs to be reconstructed from the position offset.

# assetType runtime The machinery that reads a `<typename>.assetType/behavior.luau` and turns its declarations into live behaviour. A `behavior.luau` is a table of declarations — `ref` methods, `modules` shared code, an `events` schema, a `namePattern`, `refShapes`, and the `onCreate` / `onRegister` / `onChange` / `onDelete` / `validate` / `settingsDefaults` / `settingsCorrections` hooks. None of it runs itself. This is the code that runs it, and it lives here because reading a type's declarations is the **assetType type's own behaviour** — the same way `material.assetType` owns what a `.material` does. ## Sub-modules | Module | Reads | Responsibility | |---|---|---| | `ref.module` | `ref`, `modules` | Builds every `AssetRef` envelope, attaches the shared metatable, and dispatches per-type methods and shared modules onto it. Also owns edit-mode write-behind persistence. | | `create.module` | `onCreate`, `namePattern`, `validate` | Backs `asset.create`: resolves the type, checks the name against its pattern, runs `onCreate` (or clones `template/`), and writes the instance. `validate.module` beside it checks a creation `opts` table against the type's `createSchema`. Before running `onCreate`, resolves the type's settings chain (below) and hands the result to the hook as `opts.settings`. | | `settings.module` | `settings`, `settingsDefaults`, `settingsCorrections` | A type's declared settings schema and where its values live (`type.yaml`'s `settings:` block). `Settings.resolveForCreate` layers the schema's own defaults, the type's own `settingsDefaults(name, opts, asked)` hook (a DEFAULT the schema can't express — a name-derived convention, a fact read off a payload the caller handed it, a value following a field `asked` shows a higher layer naming; any later layer overrides it), the Preset Manager, an importer's settings, the caller's `settings` table, then the type's own `settingsCorrections(values, name, opts)` hook (a CROSS-FIELD CONSTRAINT the schema can't express, applied last over the fully merged values). A correction over a default/preset/importer value lands silently; a correction that would override what the caller's own `settings` table explicitly asked for refuses the creation instead, naming the field and why. Neither hook is ever handed a table to mutate; each returns what it wants changed (`settingsCorrections` may also return a `{ [field]: reason }` table for that refusal message). `Settings.cloneValues` deep-copies a values table — `create.module` hands `onCreate` a copy, never the table it stamps. `Settings.valuesOf` / `writeValues` read and write an asset's own values file. | | `typeYaml.module` | `type.yaml` | The folder a type lives in and its parsed `type.yaml`, decoded once per content version of the file. `settings.module` and `inspector.module` read their blocks through it. `about` / `aboutAt` read a type's `about.yaml` (`intent`, `function`, `usage`), leaving out any key that is empty or still starts with `[[describe]]`; `aboutRows` and `aboutMarkdown` lay the texts out for the Inspector and the `types/<name>` guide. | | `inspector.module` | `type.yaml`'s `inspector:` block | Which inspector a type declares for its assets (`inspector: { type: ... }` or `{ instance: ... }`), and the declaration that file returns — the sections it adds, the generic ones it replaces, and their order — or the problem that kept it from loading. | | `onRegister.module` | `onRegister` | Fires an instance's once-only registration hook — on arrival, on world load, and for `@builtin` library instances. | | `changeDispatch.module` | `onChange`, `onDelete`, `refShapes` | Routes a VFS source write or a folder delete to the enclosing typed asset's type hooks. | | `refShapes.module` | `refShapes`, `ref` | Publishes what every `AssetRef<category>` answers to, so a member read on an asset-typed value is checked against that category's real surface. | | `events.module` | `events` | The per-asset event runtime behind `ref.events`. | | `instantiable.module` | `ref.instantiate` | The instantiation contract an asset type opts into: `root` stands the root entity, `place` applies the base placement opts to one the type adopted, and `result` shapes the `(root, idMap)` every `instantiate` returns. Also registers the `sceneInstantiable` field-constraint validator. | | `declaration.module` | `type.yaml` | The type's decoded declaration, read once and held until a write inside an `.assetType` folder; what every question about a type as a whole reads. | | `previewRecipe.module` | `type.yaml` `preview:` | How an instance's `preview.png` is produced: which of the four recipes (`instantiate`, `image`, `surface`, `custom`) the type declares, and what that recipe needs. | ## Reaching it ```luau local rt = require("@builtin::assetTypes.assetType.shared") rt.ref.loadTypeBehavior("material") ``` Fields resolve lazily. The prelude requires the sub-modules directly, in dependency order (`ref`, then `changeDispatch`, `onRegister.install()`, `refShapes.install()`) — a table that required all six on load would take that ordering away from it.