@driftengine/core 3.61.3 → 3.62.0

package/CHANGELOG.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "3.62.0",
+    "date": "2026-09-13",
+    "entries": [
+      {
+        "kind": "added",
+        "short": "An Android build can ask for the permissions it needs. Without this an APK could not open a socket at all, and there was no way for a game to say otherwise short of vendoring three directories.",
+        "text": "**The Android manifest template declares one activity and no permissions, and that default is right**: a permission is visible in a store listing, and a packager that granted the network to every game it ever built would be asking on behalf of games that never use it. The difficulty was that a consumer had no way to depart from it. The template is copied wholesale, none of the eight `-Pdrift*` properties Gradle takes reaches the manifest, there is no `manifestPlaceholders` and no source-set overlay, and `--resources` moves the desktop shell and the iOS spec along with the Gradle project — so changing one line of one manifest meant vendoring all three.\n\nSo an online game shipped an APK whose process is not permitted to open a socket. Every connection failed, the game reported that it could not connect, and the relay logged nothing at all because no packet left the phone: the same silence at both ends, indistinguishable from a wrong address. Measured on the built artifact, `aapt2 dump permissions` printed the package name and nothing else.\n\n```json\n\"android\": { \"permissions\": [\"INTERNET\"], \"cleartextTraffic\": false }\n```\n\n`\"INTERNET\"` and `\"android.permission.INTERNET\"` are both accepted; a name that would break out of the XML attribute it is written into is refused at parse time. The elements are written into the copied Gradle project before Gradle runs, which is where the icon is already written, so nothing in the engine's own tree is touched by a consumer's build. `doctor` prints what was asked for beside the signing mode, and says `none — the APK cannot open a socket` when nothing was.\n\n**`cleartextTraffic` is the second half, and it is the one only the engine could answer.** The game is served from `https://appassets.androidplatform.net`, which is a secure context, and a WebView defaults to `MIXED_CONTENT_NEVER_ALLOW` — stricter than a browser tab, where the same insecure WebSocket connects with a deprecation warning rather than being refused, measured on Chrome 151 against a LAN address. Setting it true writes `android:usesCleartextTraffic=\"true\"` **and** is what `MainActivity` reads back through `NetworkSecurityPolicy` to allow mixed content in the WebView. One switch drives both, so the platform and the renderer cannot disagree about it, and a network security config a consumer adds later is picked up without the Java learning about it. A relay on a LAN cannot hold a certificate, which is the case it exists for; a public relay should be `wss://` and this should stay false.\n\nVerified on real APKs with `aapt2`: unchanged, the dump is the package name alone; asking, it carries both permissions and the cleartext flag. Held by twenty-nine cases, and seven mutations each redden at least one."
+      }
+    ]
+  },
+  {
+    "version": "3.61.4",
+    "date": "2026-09-13",
+    "entries": [
+      {
+        "kind": "fixed",
+        "short": "The published packages carry a dist built from the source beside it. 3.61.3 went out with the fixed source and a dist built before the fix, so installing it delivered the bug.",
+        "text": "**`dist/` is gitignored, so a tarball carries whatever the publishing machine last built**, and nothing hooked the build to the publish or compared the two. 3.61.3 went to the registry with `src/render/backend/webgpu/insetPass.ts` carrying the inset depth fix and `dist/render/backend/webgpu/insetPass.js` carrying the bug it fixed. `main`, `types` and the default `exports` condition all resolve to `dist`, so an ordinary consumer installed the defect under a version number that claimed to have cured it, and only a consumer reading the `drift-source` condition got the fix.\n\nA published version is immutable, so the answer is this release rather than a correction of that one. **3.61.3 should not be used**: for the inset fix, take 3.61.4.\n\n**Invisible from inside the workspace, which is what it has in common with the missing files 3.61.2 fixed.** A path dependency resolves through a symlink into the tree, where `dist` is whatever the last local build left behind; only an install from the registry can show either defect, and by then it is published. That is the whole argument for gating both at the tarball.\n\nEvery package now carries a `prepack` that builds it, so the tarball is built the same way whoever publishes it invokes npm, and `packages.test.mjs` asserts every package declares one. `prepack` rather than `prepublishOnly` because npm runs it for `npm pack` too, so the tarball a gate inspects is the tarball a consumer installs. Held by staling a built `dist` on purpose and packing: the file inside the tarball comes out rebuilt."
+      }
+    ]
+  },
   {
     "version": "3.61.3",
     "date": "2026-09-13",

package/dist/render/backend/webgpu/insetPass.js

@@ -1,3 +1,4 @@
+import { DEPTH_CLEAR } from '../../depthConvention.js';
 import { DEPTH_FORMAT } from './flatPass.js';
 import { shaderModule } from './shaderModules.js';
 /**
@@ -9,7 +10,10 @@ import { shaderModule } from './shaderModules.js';
  * depth that way would silently un-occlude everything a scene draws *after* `endInset`.
  *
  * So the rect is drawn rather than cleared: one quad at the far plane, depth always written,
- * colour written or masked off depending on whether the caller asked for a colour.
+ * colour written or masked off depending on whether the caller asked for a colour. **Which end of
+ * the buffer "the far plane" is comes from `depthConvention.ts`** and not from this file: depth is
+ * reversed here, and a quad that names the conventional end clears the inset to the *near* plane
+ * and makes it undrawable. See the note at the return.
  *
  * **Its own shader, and it is allowed to be.** This is not generated from GLSL and has no
  * WebGL2 counterpart to stay honest against — the counterpart is `gl.clear`. The mip blit in
@@ -41,8 +45,24 @@ fn vertexMain(@builtin(vertex_index) index: u32) -> @builtin(position) vec4<f32>
     vec2<f32>(0.0, 0.0), vec2<f32>(1.0, 1.0), vec2<f32>(0.0, 1.0),
   );
   let ndc = corner[index] * 2.0 - vec2<f32>(1.0, 1.0);
-  // z = 1: the far plane, which is what a depth clear writes.
-  return vec4<f32>(ndc, 1.0, 1.0);
+  /*
+   * **The far plane, interpolated from the convention rather than written down.**
+   *
+   * This said \`1.0\`, under a comment calling it "the far plane, which is what a depth clear
+   * writes". That is true of a conventional depth buffer and this engine reverses depth, where
+   * 1.0 is the *near* plane and the compare is \`greater\`. The quad is drawn with
+   * \`depthCompare: 'always'\` and depth writes on, so it stamped the nearest possible value
+   * across the whole inset and every mesh drawn between \`beginInset\` and \`endInset\` failed
+   * the test against it: the box came out holding its clear colour and nothing else, on WebGPU
+   * only, with nothing logged. Reported from a game as two empty boxes on two menu screens, both
+   * of them the places it draws an inset.
+   *
+   * It is the mistake \`glslFarDepth\` exists because the sky made — a full-screen triangle at
+   * \`z = w\`, the far plane conventionally and the near plane once reversed. \`DEPTH_CLEAR\` is
+   * the same number by definition: what a depth attachment is cleared to, which is what a quad
+   * standing in for a depth clear must write.
+   */
+  return vec4<f32>(ndc, ${DEPTH_CLEAR}.0, 1.0);
 }
 
 @fragment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@driftengine/core",
-  "version": "3.61.3",
+  "version": "3.62.0",
   "description": "DriftEngine reusable browser 3D runtime",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,8 +29,8 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@driftengine/drft": "3.61.3",
-    "@driftengine/physics": "3.61.3",
+    "@driftengine/drft": "3.62.0",
+    "@driftengine/physics": "3.62.0",
     "gl-matrix": "^3.4.3"
   },
   "author": "Drift Technologies",
@@ -58,5 +58,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "prepack": "node ../../scripts/build.mjs @driftengine/core"
   }
 }