@liveroom-tech/react-immersive 4.0.1 → 4.0.3

package/README.md

@@ -982,6 +982,24 @@ ending in `.glb`, `.gltf`, `.obj`, `.fbx`, or `.usdz` are detected automatically
 
 License key for the library. Required.
 
+### `licenseValidationUrl`
+
+Optional. Points license validation at a different endpoint, for first-party or
+self-hosted consoles that proxy validation through their own origin instead of
+calling `react-immersive.liveroom.dev` cross-origin.
+
+This is not a way to self-approve a license. When this prop is set, a successful
+response is only accepted if it carries an `offlineGrant` signed by the React
+Immersive license service, verified against the ECDSA public key pinned in this
+package — and the resulting `environment` and `tier` are read from that signed
+grant, not from the surrounding JSON body. An endpoint that returns
+`{"valid": true}` without a valid grant is treated as a broken license server:
+the SDK falls back to a previously verified grant if one is cached, and
+otherwise fails closed.
+
+In practice the endpoint must be a deployment of the official validation route
+configured with `LICENSE_GRANT_PRIVATE_KEY`.
+
 ### `objectBindings`
 
 A map keyed by the model node name. Each key should match a mesh name from the GLB/GLTF file.

package/dist/index.d.mts

@@ -180,7 +180,13 @@ type ModelViewerProps = {
     /** Explicit format for extensionless or signed model URLs. */
     modelFormat?: ModelFormat;
     licenseKey: string;
-    /** Trusted validation endpoint override for first-party/self-hosted consoles. */
+    /**
+     * Alternate licence validation endpoint, for first-party/self-hosted consoles
+     * that proxy validation through their own origin. The response must carry a
+     * signed grant issued by the React Immersive licence service; the entitlement
+     * is read from that grant, so this cannot be pointed at an arbitrary server
+     * to approve a licence.
+     */
     licenseValidationUrl?: string;
     objectBindings: Record<string, ObjectBinding>;
     selectedObject?: ObjectBinding | null;
@@ -283,7 +289,13 @@ type BindingBuilderProjectChangeOrigin = "local" | "remote";
 
 type BindingBuilderProps = {
     licenseKey: string;
-    /** Trusted validation endpoint override for first-party/self-hosted consoles. */
+    /**
+     * Alternate licence validation endpoint, for first-party/self-hosted consoles
+     * that proxy validation through their own origin. The response must carry a
+     * signed grant issued by the React Immersive licence service; the entitlement
+     * is read from that grant, so this cannot be pointed at an arbitrary server
+     * to approve a licence.
+     */
     licenseValidationUrl?: string;
     /** Directory containing the DRACO decoder files, or false. */
     dracoDecoderPath?: string | false;

package/dist/index.d.ts

@@ -180,7 +180,13 @@ type ModelViewerProps = {
     /** Explicit format for extensionless or signed model URLs. */
     modelFormat?: ModelFormat;
     licenseKey: string;
-    /** Trusted validation endpoint override for first-party/self-hosted consoles. */
+    /**
+     * Alternate licence validation endpoint, for first-party/self-hosted consoles
+     * that proxy validation through their own origin. The response must carry a
+     * signed grant issued by the React Immersive licence service; the entitlement
+     * is read from that grant, so this cannot be pointed at an arbitrary server
+     * to approve a licence.
+     */
     licenseValidationUrl?: string;
     objectBindings: Record<string, ObjectBinding>;
     selectedObject?: ObjectBinding | null;
@@ -283,7 +289,13 @@ type BindingBuilderProjectChangeOrigin = "local" | "remote";
 
 type BindingBuilderProps = {
     licenseKey: string;
-    /** Trusted validation endpoint override for first-party/self-hosted consoles. */
+    /**
+     * Alternate licence validation endpoint, for first-party/self-hosted consoles
+     * that proxy validation through their own origin. The response must carry a
+     * signed grant issued by the React Immersive licence service; the entitlement
+     * is read from that grant, so this cannot be pointed at an arbitrary server
+     * to approve a licence.
+     */
     licenseValidationUrl?: string;
     /** Directory containing the DRACO decoder files, or false. */
     dracoDecoderPath?: string | false;