@needle-tools/engine 5.1.0-canary.deec6e4 → 5.1.0-canary.e6680fa

package/src/engine/engine_license.ts

@@ -3,23 +3,37 @@ import { ContextEvent, ContextRegistry } from "./engine_context_registry.js";
 import { onInitialized } from "./engine_lifecycle_api.js";
 import { isLocalNetwork } from "./engine_networking_utils.js";
 import { Context } from "./engine_setup.js";
+import { SSR } from "./engine_ssr.js";
 import type { IContext } from "./engine_types.js";
 import { getParam } from "./engine_utils.js";
-import { SSR } from "./engine_ssr.js";
 
-const debug = getParam("debuglicense");
+const debug = getParam("__debuglic__");
+
+const $nNBkvau: ((result: boolean) => void)[] = [];
 
-const _licenseCheckResultChangedCallbacks: ((result: boolean) => void)[] = [];
+// DO NOT EDIT MANUALLY
+let _Ktp: string = "";
+// eslint-disable-next-line prefer-const
+let _HXKeIG: string = "";
 
-// This is modified by a bundler (e.g. vite)
-// Do not edit manually
-let NEEDLE_ENGINE_LICENSE_TYPE: string = "basic";
-if (debug)
-    console.log("License Type: " + NEEDLE_ENGINE_LICENSE_TYPE)
+if (debug) {
+    console.log("License Type: " + _Ktp);
+    if (_HXKeIG) {
+        console.log("License JWT: " + _HXKeIG);
+        try {
+            const payload = JSON.parse(atob(_HXKeIG.split(".")[1].replace(/-/g, '+').replace(/_/g, '/')));
+            console.log("License JWT payload:", payload);
+        }
+        catch { console.log("License JWT payload: (failed to decode)"); }
+    }
+    else {
+        console.log("License JWT: (none)");
+    }
+}
 
 /** @internal */
-export function hasProLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function $TXm() {
+    switch (_Ktp) {
         case "pro":
         case "enterprise":
             return true;
@@ -28,8 +42,8 @@ export function hasProLicense() {
 }
 
 /** @internal */
-export function hasIndieLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function __CYjiNy() {
+    switch (_Ktp) {
         case "indie":
             return true;
     }
@@ -37,8 +51,8 @@ export function hasIndieLicense() {
 }
 
 /** @internal */
-export function hasEduLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function _$qXuwVrGy() {
+    switch (_Ktp) {
         case "edu":
             return true;
     }
@@ -46,20 +60,20 @@ export function hasEduLicense() {
 }
 
 /** @internal */
-export function hasCommercialLicense() {
-    return hasProLicense() || hasIndieLicense() || hasEduLicense();
+export function __gGoBKfJa() {
+    return $TXm() || __CYjiNy() || _$qXuwVrGy();
 }
 
 
 /** @internal */
-export function onLicenseCheckResultChanged(cb: (result: boolean) => void) {
-    if (hasProLicense() || hasIndieLicense() || hasEduLicense())
+export function _MFjTEBcQ(cb: (result: boolean) => void) {
+    if ($TXm() || __CYjiNy() || _$qXuwVrGy())
         return cb(true);
-    _licenseCheckResultChangedCallbacks.push(cb);
+    $nNBkvau.push(cb);
 }
 
-function invokeLicenseCheckResultChanged(result: boolean) {
-    for (const cb of _licenseCheckResultChangedCallbacks) {
+function __AiHRn(result: boolean) {
+    for (const cb of $nNBkvau) {
         try {
             cb(result);
         }
@@ -70,6 +84,128 @@ function invokeLicenseCheckResultChanged(result: boolean) {
 }
 
 
+// #region JWT
+
+// ECDSA P-256 public key for verifying license JWTs (verification-only, safe to ship)
+/* eslint-disable no-secrets/no-secrets -- public key, not a secret */
+const __jOdcGEzl = {
+    kty: "EC",
+    crv: "P-256",
+    x: "A34nyKMjhQYVgzeE4tyLUYdx34TAKogDa7v7PRaO9Lg",
+    y: "JZI9IQavGCpGjEG_-pa0J-MHQYWJYINUM-MnvSu0TmE",
+} as const;
+/* eslint-enable no-secrets/no-secrets */
+
+/** Base64url decode (RFC 7515) */
+function base64urlDecode(str: string): Uint8Array {
+    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+
+/**
+ * Verify a JWT license token and return the `type` claim if valid.
+ * Returns null if the JWT is missing, malformed, or has an invalid signature.
+ */
+async function __sGba(jwt: string): Promise<string | null> {
+    if (!jwt) return null;
+    try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3) return null;
+
+        const [headerB64, payloadB64, signatureB64] = parts;
+
+        const key = await crypto.subtle.importKey(
+            "jwk",
+            __jOdcGEzl,
+            { name: "ECDSA", namedCurve: "P-256" },
+            false,
+            ["verify"]
+        );
+
+        const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = base64urlDecode(signatureB64);
+
+        const valid = await crypto.subtle.verify(
+            { name: "ECDSA", hash: "SHA-256" },
+            key,
+            signature.buffer as ArrayBuffer,
+            signingInput
+        );
+
+        if (!valid) {
+            if (debug) console.warn("JWT: signature verification failed");
+            return null;
+        }
+
+        const payloadStr = new TextDecoder().decode(base64urlDecode(payloadB64));
+        const payload = JSON.parse(payloadStr);
+
+        if (typeof payload.type !== "string" || payload.type.length === 0) {
+            if (debug) console.warn("JWT: missing or invalid 'type' claim");
+            return null;
+        }
+
+        // Optional: check expiration if present (future-proof — server doesn't set this yet)
+        if (typeof payload.exp === "number") {
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            if (nowSeconds > payload.exp) {
+                if (debug) console.warn("JWT: token has expired (exp=" + payload.exp + ", now=" + nowSeconds + ")");
+                return null;
+            }
+        }
+
+        // Optional: check audience/domain if present (future-proof — server doesn't set this yet)
+        if (payload.aud) {
+            const currentHost = typeof window !== "undefined" ? window.location.hostname : undefined;
+            if (currentHost) {
+                const allowed = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+                if (!allowed.some((a: string) => currentHost === a || currentHost.endsWith("." + a))) {
+                    if (debug) console.warn("JWT: domain '" + currentHost + "' not in allowed audience: " + allowed.join(", "));
+                    return null;
+                }
+            }
+        }
+
+        if (debug) console.log("JWT: verified license type: " + payload.type);
+        return payload.type;
+    }
+    catch (err) {
+        if (debug) console.error("JWT: verification error", err);
+        return null;
+    }
+}
+
+/** Verify the injected JWT and update the license type if valid.
+ * The engine ONLY trusts the JWT — the plain _Ktp string is ignored. */
+let _jwtVerificationPromise: Promise<void> | undefined = undefined;
+async function $IHlIUG(): Promise<void> {
+    // NOTE: do NOT add an `if (!_HXKeIG) return` guard here.
+    // esbuild (Vite dependency pre-bundling) would see the variable as constant ""
+    // and tree-shake the entire JWT verification code path.
+    const jwt = _HXKeIG;
+    // Clear after reading — this reassignment also prevents esbuild from
+    // constant-folding the variable (it now has multiple assignment sites).
+    _HXKeIG = "";
+    const verifiedType = await __sGba(jwt);
+    if (verifiedType) {
+        _Ktp = verifiedType;
+        if (debug) console.log("License type set from verified JWT: " + verifiedType);
+        __AiHRn(__gGoBKfJa());
+    }
+    else {
+        _Ktp = "basic";
+        if (debug && jwt) console.warn("JWT verification failed — license reset to basic");
+    }
+}
+
+// #endregion JWT License Verification
+
 
 // #region Telemetry
 export namespace Telemetry {
@@ -135,7 +271,7 @@ export namespace Telemetry {
 
         const attribute = domElement?.getAttribute("no-telemetry");
         if (attribute === "" || attribute === "true" || attribute === "1") {
-            if (NEEDLE_ENGINE_LICENSE_TYPE === "pro" || NEEDLE_ENGINE_LICENSE_TYPE === "enterprise") {
+            if (_Ktp === "pro" || _Ktp === "enterprise") {
                 if (debug) console.debug("Telemetry is disabled via no-telemetry attribute");
                 return false;
             }
@@ -242,22 +378,32 @@ export namespace Telemetry {
 }
 
 
-export function initLicense() {
+export function YftDqQmq() {
+
+    if(_Ktp === "") _Ktp = "basic";
+
+    // Start JWT verification — must be here (not top-level) to avoid tree-shaking
+    _jwtVerificationPromise = $IHlIUG();
+
     Telemetry.init();
     ContextRegistry.registerCallback(ContextEvent.ContextRegistered, evt => {
-        showLicenseInfo(evt.context);
-        handleForbidden(evt.context);
-        setTimeout(() => sendUsageMessageToAnalyticsBackend(evt.context), 2000);
+        $zlkki(evt.context);
+        __sRmQXZcI(evt.context);
+        setTimeout(() => __QwnVOJb(evt.context), 2000);
     });
 }
 
-export let runtimeLicenseCheckPromise: Promise<void> | undefined = undefined;
+export let $NzCTiAr: Promise<void> | undefined = undefined;
 let applicationIsForbidden = false;
 let applicationForbiddenText = "";
-async function checkLicense() {
+async function _eUjaC() {
     // Only perform the runtime license check once
-    if (runtimeLicenseCheckPromise) return runtimeLicenseCheckPromise;
-    if (NEEDLE_ENGINE_LICENSE_TYPE === "basic") {
+    if ($NzCTiAr) return $NzCTiAr;
+    // Wait for JWT verification to complete first (if running)
+    if (_jwtVerificationPromise) {
+        await _jwtVerificationPromise;
+    }
+    if (_Ktp === "basic") {
         try {
             const licenseUrl = "https://needle.tools/api/v1/needle-engine/check?location=" + encodeURIComponent(window.location.href) + "&version=" + VERSION + "&generator=" + encodeURIComponent(GENERATOR);
             const res = await fetch(licenseUrl, {
@@ -269,29 +415,29 @@ async function checkLicense() {
             if (res?.status === 200) {
                 applicationIsForbidden = false;
                 if (debug) console.log("License check succeeded");
-                NEEDLE_ENGINE_LICENSE_TYPE = "pro";
-                invokeLicenseCheckResultChanged(true);
+                _Ktp = "pro";
+                __AiHRn(true);
             }
             else if (res?.status === 403) {
-                invokeLicenseCheckResultChanged(false);
+                __AiHRn(false);
                 applicationIsForbidden = true;
                 applicationForbiddenText = await res.text();
             }
             else {
-                invokeLicenseCheckResultChanged(false);
+                __AiHRn(false);
                 if (debug) console.log("License check failed with status " + res?.status);
             }
         }
         catch (err) {
-            invokeLicenseCheckResultChanged(false);
+            __AiHRn(false);
             if (debug) console.error("License check failed", err);
         }
     }
-    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + NEEDLE_ENGINE_LICENSE_TYPE + "\"");
+    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + _Ktp + "\"");
 }
-runtimeLicenseCheckPromise = checkLicense();
+$NzCTiAr = _eUjaC();
 
-async function handleForbidden(ctx: IContext) {
+async function __sRmQXZcI(ctx: IContext) {
     function createForbiddenElement() {
         const div = document.createElement("div");
         div.className = "needle-forbidden";
@@ -356,40 +502,40 @@ async function handleForbidden(ctx: IContext) {
     }, 500)
 }
 
-async function showLicenseInfo(ctx: IContext) {
+async function $zlkki(ctx: IContext) {
     try {
-        if (!hasProLicense() && !hasIndieLicense()) {
-            return onNonCommercialVersionDetected(ctx);
+        if (!$TXm() && !__CYjiNy()) {
+            return _$ZUnMZ(ctx);
         }
     }
     catch (err) {
         if (debug) console.log("License check failed", err)
-        return onNonCommercialVersionDetected(ctx)
+        return _$ZUnMZ(ctx)
     }
-    if (debug) onNonCommercialVersionDetected(ctx)
+    if (debug) _$ZUnMZ(ctx)
 }
 
 
 
-async function onNonCommercialVersionDetected(ctx: IContext) {
+async function _$ZUnMZ(ctx: IContext) {
 
     // if the engine loads faster than the license check, we need to capture the ready event here
     let isReady = false;
     ctx.domElement.addEventListener("ready", () => isReady = true);
 
-    await runtimeLicenseCheckPromise?.catch(() => { });
+    await $NzCTiAr?.catch(() => { });
 
 
-    if (hasProLicense() || hasIndieLicense()) return;
-    if (hasCommercialLicense() === false) logNonCommercialUse();
+    if ($TXm() || __CYjiNy()) return;
+    if (__gGoBKfJa() === false) $wrvl();
 
     // check if the engine is already ready (meaning has finished loading)
     if (isReady) {
-        insertNonCommercialUseHint(ctx);
+        $fObl(ctx);
     }
     else {
         ctx.domElement.addEventListener("ready", () => {
-            insertNonCommercialUseHint(ctx);
+            $fObl(ctx);
         });
     }
 }
@@ -397,7 +543,7 @@ async function onNonCommercialVersionDetected(ctx: IContext) {
 // const licenseElementIdentifier = "needle-license-element";
 // const licenseDuration = 10000;
 // const licenseDelay = 1200;
-function insertNonCommercialUseHint(ctx: IContext) {
+function $fObl(ctx: IContext) {
 
     const style = `
         position: relative;
@@ -410,7 +556,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
         padding: 10px;
         padding-left: 30px;
     `;
-    if (NEEDLE_ENGINE_LICENSE_TYPE === "edu") {
+    if (_Ktp === "edu") {
         if (navigator.webdriver) {
             console.log("This project is supported by Needle for Education – https://needle.tools");
         }
@@ -467,7 +613,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
         }
     }, 1000);
 
-    if (hasEduLicense()) {
+    if (_$qXuwVrGy()) {
         const removeDelay = 20_000;
         setTimeout(() => {
             clearInterval(interval);
@@ -476,7 +622,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
             const intervalInMinutes = 5;
             setTimeout(() => {
                 if (ctx.domElement.parentNode)
-                    insertNonCommercialUseHint(ctx);
+                    $fObl(ctx);
             }, 1000 * 60 * intervalInMinutes)
         }, removeDelay);
     }
@@ -487,7 +633,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
 const base64Logo = "data:image/webp;base64,UklGRrABAABXRUJQVlA4WAoAAAAQAAAAHwAAHwAAQUxQSKEAAAARN6CmbSM4WR7vdARON11EBDq3fLiNbVtVzpMCPlKAEzsx0Y/x+Ovuv4dn0EFE/ydAvz6YggXzgh5sVgXM/zOC/4sii7qgGvB5N7hmuQYwkvazWAu1JPW41FXSHq6pnaQWvqYH18Fc0j1hO/BFTtIeSBlJi5w6qIIO7IOrwhFsB2Yxukif0FTRLpXswHR8MxbslKe9VZsn/Ub5C7YFOpqSTABWUDgg6AAAAFAGAJ0BKiAAIAA+7VyoTqmkpCI3+qgBMB2JbACdMt69DwMIQBLhkTO6XwY00UEDK6cNIDnuNibPf0EgAP7Y1myuiQHLDsF/0h5unrGh6WAbv7aegg2ZMd3uRKfT/3SJztcaujYfTvMXspfCTmYcoO6a+vhC3ss4M8uM58t4siiu59I4aOl59e9Sr6xoxYlHf2v+NnBNpJYeJf8jABQAId/PXuBkLEFkiCucgSGEcfhvajql/j3reCGl0M5/9gQWy7ayNPs+wlvIxFnNfSlfuND4CZOCyxOHhRqOmHN4ULHo3tCSrUNvgAA=";
 
 let lastLogTime = 0;
-async function logNonCommercialUse(_logo?: string) {
+async function $wrvl(_logo?: string) {
     const now = Date.now();
     if (now - lastLogTime < 2000) return;
     lastLogTime = now;
@@ -520,7 +666,7 @@ async function logNonCommercialUse(_logo?: string) {
 }
 
 
-async function sendUsageMessageToAnalyticsBackend(context: IContext) {
+async function __QwnVOJb(context: IContext) {
     // We can't send beacons from cross-origin isolated pages
     if (window.crossOriginIsolated) return;
 
@@ -535,7 +681,7 @@ async function sendUsageMessageToAnalyticsBackend(context: IContext) {
 
             // current url without query parameters
             const currentUrl = window.location.href.split("?")[0];
-            const license = NEEDLE_ENGINE_LICENSE_TYPE;
+            const license = _Ktp;
 
             const beaconData = {
                 license,

package/src/engine/engine_mainloop_utils.ts

@@ -344,8 +344,11 @@ function updateIsActiveInHierarchyRecursiveRuntime(go: Object3D, activeInHierarc
         if (allowEventCall) {
             const components = go.userData?.components;
             if (components) {
-                for (let ci = components.length - 1, cl = -1; ci > cl; ci--) {
-                    const comp = components[ci];
+                // We need to iterate on components in the original order right now to work-around UI related initialization bugs where RectTransform must be initialized before e.g. Graphic components. https://linear.app/needle/issue/NE-6986
+                // In the future we can reverse iterate this once the UI system has been replaced (that being said it's probably expected that component enable in the order in which they're added to an object)
+                const componentsCopy = [...components];
+                for (let ci = 0; ci < componentsCopy.length; ci++) {
+                    const comp = componentsCopy[ci];
                     if (activeInHierarchy) {
                         if (comp?.enabled) {
                             try { comp.__internalAwake(); }
@@ -357,8 +360,8 @@ function updateIsActiveInHierarchyRecursiveRuntime(go: Object3D, activeInHierarc
                     }
                     else if(comp) {
                         if (comp["__didAwake"] && comp.enabled) {
-                            comp["__didEnable"] = false;
-                            comp.onDisable();
+                            // autoCleanup uses __internalDisable; isRemovingFromScene=true preserves __isEnabled
+                            comp.__internalDisable(true);
                         }
                     }
                 }

package/src/engine/engine_networking.transport.websocket.ts

@@ -0,0 +1,45 @@
+import type { INetworkTransport } from './engine_networking_types.js';
+
+/** Default transport that wraps the `websocket-ts` library */
+export class WebsocketTransport implements INetworkTransport {
+    private _url: string;
+    private _ws: import('websocket-ts').Websocket | undefined;
+
+    onOpen: (() => void) | null = null;
+    onClose: (() => void) | null = null;
+    onError: ((err: any) => void) | null = null;
+    onMessage: ((data: string | Blob) => void) | null = null;
+
+    get url() { return this._ws?.url ?? this._url; }
+
+    constructor(url: string) {
+        this._url = url;
+    }
+
+    async start() {
+        const pkg = await import('websocket-ts');
+        // @ts-ignore
+        const WebsocketBuilder = pkg.default?.WebsocketBuilder ?? pkg.WebsocketBuilder;
+        const ExponentialBackoff = pkg.default?.ExponentialBackoff ?? pkg.ExponentialBackoff;
+        const ws = new WebsocketBuilder(this._url)
+            .withMaxRetries(10)
+            .withBackoff(new ExponentialBackoff(2000, 4))
+            .onOpen(() => { this._ws = ws; this.onOpen?.(); })
+            .onClose(() => { this.onClose?.(); })
+            .onError(() => { this.onError?.(new Error("Websocket connection failed")); })
+            .onRetry(() => { console.log("Retry connecting to networking websocket"); })
+            .build();
+        ws.addEventListener(pkg.WebsocketEvent.message, (_, msg) => {
+            this.onMessage?.(msg.data);
+        });
+    }
+
+    send(data: string | Uint8Array) {
+        this._ws?.send(data);
+    }
+
+    close() {
+        this._ws?.close();
+        this._ws = undefined;
+    }
+}