Apps & the manifest

What a Helix Phone app is, the manifest that describes it, app IDs, content ratings, and the full set of built-in apps.

A Helix Phone app is a web bundle (HTML/CSS/JS) described by a manifest. The manifest is the contract between your app and the phone: it declares the app's identity, where its code lives, which permissions it needs, and any in-app purchases.

The manifest

type PhoneAppManifest = {
  appId: PhoneManifestAppId;          // unique id (built-in slug, or "vendor.app")
  name: string;                        // display name
  version?: string;                    // semver, e.g. "0.1.0"
  subtitle: string;                    // short tagline on the store card
  icon: string;                        // icon token (e.g. "solar:gallery-bold")
  accent: string;                      // brand hex, e.g. "#ff4f9a"
  entry?: string;                      // where the app loads from (see below)
  allowedOrigins?: string[];           // sandbox origin allow-list (e.g. ["self"])
  permissions: PhonePermissionScope[]; // scopes the app may request
  contentRating: "Everyone" | "13+" | "16+" | "18+";
  iap?: PhoneIapProduct[];             // optional in-app purchase catalog
};

A real third-party manifest (the bundled sandbox demo):

{
  appId: "studio.example",
  name: "Studio Example",
  version: "0.1.0",
  subtitle: "Sandbox demo app",
  icon: "solar:code-square-bold",
  accent: "#f2f2f2",
  entry: "/phone-apps/studio-example/index.html",
  allowedOrigins: ["self"],
  permissions: [
    "account.basic", "storage.app", "media.pick", "camera.capture",
    "wallet.read", "presence.world", "payments", "notifications.push",
    "messages.send_with_consent", "voice.calls", "social.discovery",
    "social.connections.read",
  ],
  contentRating: "16+",
  iap: [
    { sku: "demo_boost_1",   name: "Demo Boost",      priceLix: 150, type: "consumable" },
    { sku: "demo_theme_pack", name: "Demo Theme Pack", priceLix: 500, type: "non_consumable" },
  ],
}

App IDs

Built-in apps use a bare slug: helixgram, messages, camera, …
Third-party apps use a namespaced vendor.app form (e.g. studio.example, acme.notes). The dot-separated shape keeps third-party IDs from ever colliding with first-party slugs.

`entry` and the sandbox

entry tells the phone where to load the app:

Value	Meaning
`helix://apps/<id>`	A built-in app rendered by the phone shell itself (native React view).
`/phone-apps/<id>/index.html`	A bundle served by Helix.
an `https://…` URL	A bundle hosted by the developer (must be listed in `allowedOrigins`).

Third-party apps load inside a sandboxed iframe and talk to the phone through the bridge. allowedOrigins: ["self"] restricts the bundle to its own origin.

Content rating

contentRating is one of Everyone / 13+ / 16+ / 18+. It's declared per app and surfaced in the store so players (and the platform's age gates) know what to expect.

Built-in apps

The phone ships with these first-party apps, always installed:

App ID	Name	What it does
`helixgram`	Helixgram	Photo & video feed (Instagram-style)
`h`	H	Public square / short posts (Twitter-style)
`messages`	Messages	Universal DMs across worlds
`phone`	Phone	Calls & the dialer
`contacts`	Contacts	Friends, backed by the Helix social graph
`wallet`	Wallet	LIX & Coins balances and history
`album`	Album	Captured photos & videos
`camera`	Camera	Capture from the current world
`settings`	Settings	Phone preferences, permissions, appearance
`calculator`	Calculator	Quick math
`weather`	Weather	Forecast
`browser`	Browser	In-phone web
`notes`	Notes	Jot things down
`app-store`	App Store	Discover & install apps

Built-in apps are special only in two ways: they can render as native shell views (helix://), and they're granted their declared permissions by default. Otherwise they call the same Phone SDK third-party apps use — so the SDK reference applies to both.

Helixgram & H are also SDK surfaces

Because the social feeds are first-party, the SDK exposes them directly as phone.helixgram and phone.h — any app with social.discovery can read and post to them.

Install state

A player's relationship to an app is an install record: installed or uninstalled. Built-in apps are pre-installed and can't be uninstalled. Third-party apps are installed from the app store and can be removed (which also revokes their permissions and clears their notifications).