Runic Portals

Runic Portals 1.1.0 adds permission-aware named portal networks for Valheim 0.221.12. Ordinary Standard Pair portals remain vanilla. A portal joins a Runic network only after an explicit edit.

The mod is independently installable. Its only runtime dependency is BepInExPack Valheim 5.4.2333; it does not require Runic Core, Persistence, Permissions, Transactions, or another shared Runic DLL.

Portal modes

• Standard Pair uses Valheim's normal tag pairing and teleport path.
• Public is the default and permits every player who passes the route and ward checks.
• Private permits only the portal's recorded Valheim player owner.
• Group permits current members of the group bound when the portal is edited. Membership comes from the authenticated server Group snapshot and fails closed while that snapshot is unavailable.

The recorded owner may edit any Runic portal they created, subject to native object ownership and the local ward. Public/private/Group travel policy is evaluated independently from ward evidence, so a ward or stale route is not reported as an owner or Group permission failure.

Arrival and departure are independent. A network endpoint may be both, arrive, or depart. Routing always stays inside the exact case-sensitive NetworkName.

Use

Aim at a portal to see its setup panel. Normal Use edits a Standard Pair tag. Alternate Place + Use opens the Runic editor. With Valheim's default keyboard bindings these are E and Left Shift + E.

Enter one of these one-line commands:

• network|public|NETWORK|NAME|both
• network|private|NETWORK|NAME|both
• network|group|NETWORK|NAME|both
• standard

The legacy public form network|NETWORK|NAME|both remains supported. Replace both with arrive or depart as needed. A connected Standard Pair must first be disconnected with a unique vanilla tag before conversion. Replacing existing Network metadata or restoring Standard mode requires the same command a second time within four seconds.

A Group command binds the player's currently active group; no group UUID is typed into the portal editor. Use normal chat commands such as /group create, /group list, /group use, /group invite, /group accept, and /group leave. /group displays the complete command syntax for member roles, removal, ownership transfer, rename, invitation cancellation, and deletion.

Walking into an authorized depart or both endpoint opens a map picker containing authorized, online arrive or both endpoints in the same NetworkName. The local player is held in place while the picker is open. Clicking a marker selects the destination and acknowledges a one-way route; Esc cancels. The final action rechecks the source, destination, permissions, wards, revisions, and Valheim's native teleportability rule before calling the local player's native teleport path.

The source portal and portal edits require definite local ward permission. A distant destination's zone is normally unloaded before teleport, so the absence of a local PrivateArea instance is not treated as a destination denial. If the destination ward is loaded and is known to deny the player, the route remains blocked. The same rule is used by the picker and world-wide directory, allowing ordinary long-distance Public, owner, and current-member Group routes to remain discoverable.

On Valheim's normal large map, unmodified P toggles a temporary world-wide portal directory. It includes Standard Pair portals and Runic endpoints visible to the current player. Temporary pins are never saved or shared.

Ownership and multiplayer

Portal metadata changes run only when Valheim says the local portal ZNetView is its current owner. Travel runs only for the locally owned player. Runic Portals never calls SetOwner or ClaimOwnership, and it does not add portal edit, directory, travel, or owner-command RPCs. If native ownership or current replicated evidence is unavailable, the action is rejected without creating a deferred operation.

Public, private, and Group checks are evaluated directly inside this DLL. Ward checks use the currently loaded native PrivateArea state at the action point. A known hostile destination ward fails closed; an unloaded remote zone is governed by its explicit portal policy rather than being mistaken for a permission denial. Route plans and map visibility are advisory; authority is reread immediately before a metadata change or teleport.

Remote /group commands and membership refreshes use the mod-owned RPC names RunicPortals.Groups.Request.v1 and RunicPortals.Groups.Response.v1. The server derives the actor from the current ZNetPeer, its exact owned character ZDO, the Player prefab, and the ZDO's positive s_playerID; payloads do not supply an authority identity. The channel is bounded to 32 pending requests, 128 thirty-second replay entries, 32 KiB envelopes, two attempts in a six-second request window, and short-lived in-memory snapshots. Timeouts and shutdown clear their own state and never lock inventory, tools, or unrelated gameplay.

Persistent compatibility

Portal world data keeps the existing runic.portals.* ZDO keys, schema-1 compatibility reads, and schema-2 record format. Removing the DLL does not delete that metadata; Valheim simply ignores it.

Group membership and active selection keep the prior catalog codecs and world-scoped location under BepInEx/config/RunicPermissions/groups. These are genuine feature data. They are written synchronously with bounded files and atomic replacement; there is no gameplay transaction journal, durable command ledger execution, quarantine, account binding, join-time recovery, or global lock.

Runic Portals also exposes RunicPortals.Api.GroupIntegrationApi.TryIsMember so another gameplay mod may query local membership through optional reflection. No mod is required to consume it.

Bounds and defaults

• Editor: 256 characters; network IDs and names: 64 characters each.
• Indexed portal ZDOs: 4096; graph endpoints: 2048.
• MaximumNetworkEndpoints: 1024 by default, clamped to 16-2048.
• CyclePageSize: 32 by default, clamped to 1-128.
• Return and selection caches: 256 identities each, memory only.
• Return route lifetime: 15 minutes; one-way acknowledgement: 10 seconds.
• Index refresh: 2 seconds; edit range: 5 metres.

Malformed, stale, unknown-schema, disabled, destroyed, offline, or unauthorized endpoints are excluded. Standard Pair discovery remains Standard-to-Standard and never routes through a Runic network.

Changelog

1.1.0 - 2026-08-31

• Added an optional, reflection-only Runic Sentinel security bridge without making Sentinel a required dependency. Rejected malformed, identity-unbound, or replay-conflicting portal requests can now contribute trusted evidence to Sentinel's bounded automatic-enforcement policy.
• Kept ordinary portal permission denials out of cheat escalation: being outside a ward, group, or network permission is a normal authorization failure and is never treated as proof of cheating.

1.0.0 - 2026-08-29

• Fixed the first network-portal entry on a dedicated client reporting that no destinations were available until the player had traveled through a vanilla portal. The authenticated client now asks the server to force-send only the matching portal records it may discover and arrive at, then waits briefly for the complete authorized network before drawing the picker map.

• Kept the first-use directory request bounded, retry-limited, source-revision checked, peer-character authenticated, network-scoped, and filtered by portal and ward permissions.

• Fixed dedicated-client long-distance Runic routes being denied whenever the destination zone was unloaded and therefore had no local PrivateArea evidence.

• Separated Public/private/Group policy authorization, source ward authorization, destination ward authorization, and route-revision evidence so failures report the correct reason.

• Public remains the default travel policy; Private remains recorded-owner-only; Group travel uses the current authenticated server membership snapshot and fails closed when it is unavailable.

• Kept source/edit wards strict and kept known hostile loaded destination wards denied, while an unloaded remote destination is no longer rejected solely because its ward state is unknown.

• Applied the same remote-destination rule to the picker, world-wide directory, and final commit.

• Made Runic Portals independently installable with BepInEx as its only runtime dependency.

• Removed the Core registry, capability negotiation, protocol admission, account binding, portal transport, durable edit intents, mutation WAL, recovery, quarantine, and source-protection leases.

• Moved portal edits and travel to Valheim's native local portal/player ownership paths without claiming or transferring ownership.

• Kept Standard Pair routing separate from public, private, and Group named networks.

• Kept permission-filtered map directories, walk-in destination selection, direction rules, one-way acknowledgement, return routes, setup UI, and bounded diagnostics.

• Compiled the limited group domain code needed by this mod into RunicPortals.dll; no shared Runic runtime assembly is produced.

• Added one bounded, namespaced Group request/response channel. The server authenticates its actor from the current peer's owned Player character ZDO and keeps request/replay state only in memory.

• Preserved existing portal ZDO keys and record schemas plus the prior world-scoped group catalog and active-selection file formats and locations.

• Added an optional reflection-friendly Group membership API for other gameplay mods.

• Replaced the obsolete durability and remote-owner harness with 19 focused format, routing, ownership, RPC-authentication, and architecture tests.