Local package catalog
The separate developer repository tool now supports a signed remote index,
exact dependency versions, isolated installation snapshots and offline rollback.
See REPOSITORY_RU.md. The native client Repository dialog now offers explicit
online/cached browsing, exact-version installation, offline rollback and opening
the verified snapshot. Local scripts returns to the original local catalog.
Installed sources are read-only; installation never launches them.
./bin/EasyUniversal.exe packages ./examples
./bin/EasyUniversal.exe inspect ./examples/demopackages scans immediate child directories only, sorts them by folder path,
and returns metadata plus per-entry errors. A broken package does not suppress
other entries. Duplicate package IDs mark all matching entries invalid,
including two versions of the same ID. Keep one active version; archive the
older folder through Remove script before loading the newer one. The catalogue
reports an explicit versions index with folder, author version, fingerprint
and active flag. The GUI shows each version beside its package name.
The scan root cannot be a detected reparse point; enumeration is capped at
256 filesystem entries, including ordinary files. Subdirectories without a
manifest are shown as invalid entries rather than silently omitted.
inspect validates the manifest, entrypoint and declared resource files and
computes source/resource SHA-256 hashes. fingerprint hashes a canonical JSON
object containing the hash of the raw manifest, entrypoint hash and sorted
resource records. Manifest formatting changes therefore change the fingerprint.
Resources use their existing 8 KiB text-resource limit; entrypoint: 128 KiB.
Optional modules contains up to 8 additional .as sections (128 KiB each,
256 KiB combined). Inspection records each module's path/size/hash; these
records participate in the fingerprint. Optional adapter metadata declares
game/source/capabilities; it is author-supplied, not compatibility certification.
RC12 includes http_origins in inspection metadata; validated exact origins
participate in the existing raw-manifest fingerprint. Inspection does not fetch
URLs or grant network access. See HTTP_RU.md.
Neither command creates an AngelScript engine, compiles the script, calls global
initializers/callbacks, writes configuration nor grants permissions. valid:true
means package structure and accessible file sizes passed, not that the script
will compile/run or is safe. Metadata is author-controlled. Hashes are content
identifiers, not signatures; signature_verified:false is explicit.
This is the backend used by the local graphical client (see CLIENT.md), not an
installer, persistent approval registry or daemon. No autostart occurs. run/stream/preview still take an explicit folder; duplicate-ID catalog status does not
block someone manually launching that folder. Concurrent file modification and
path-substitution races remain outside the trusted-package prototype's scope.