@needle-tools/engine 5.1.0-canary.fbdfce3 → 5.1.0-experimental.03e8105

package/src/engine/engine_license.ts

@@ -3,23 +3,37 @@ import { ContextEvent, ContextRegistry } from "./engine_context_registry.js";
 import { onInitialized } from "./engine_lifecycle_api.js";
 import { isLocalNetwork } from "./engine_networking_utils.js";
 import { Context } from "./engine_setup.js";
+import { SSR } from "./engine_ssr.js";
 import type { IContext } from "./engine_types.js";
 import { getParam } from "./engine_utils.js";
-import { SSR } from "./engine_ssr.js";
 
-const debug = getParam("debuglicense");
+const debug = getParam("__debuglic__");
 
-const _licenseCheckResultChangedCallbacks: ((result: boolean) => void)[] = [];
+const dXgxU: ((result: boolean) => void)[] = [];
 
-// This is modified by a bundler (e.g. vite)
+// These are modified by a bundler (e.g. vite)
 // Do not edit manually
-let NEEDLE_ENGINE_LICENSE_TYPE: string = "basic";
-if (debug)
-    console.log("License Type: " + NEEDLE_ENGINE_LICENSE_TYPE)
+let _PQYikbj: string = "basic";
+// eslint-disable-next-line prefer-const -- value is replaced by the bundler at build time
+let _$QHon: string = "";
+if (debug) {
+    console.log("License Type: " + _PQYikbj);
+    if (_$QHon) {
+        console.log("License JWT: " + _$QHon);
+        try {
+            const payload = JSON.parse(atob(_$QHon.split(".")[1].replace(/-/g, '+').replace(/_/g, '/')));
+            console.log("License JWT payload:", payload);
+        }
+        catch { console.log("License JWT payload: (failed to decode)"); }
+    }
+    else {
+        console.log("License JWT: (none)");
+    }
+}
 
 /** @internal */
-export function hasProLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function UFadk() {
+    switch (_PQYikbj) {
         case "pro":
         case "enterprise":
             return true;
@@ -28,8 +42,8 @@ export function hasProLicense() {
 }
 
 /** @internal */
-export function hasIndieLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function __tFkl() {
+    switch (_PQYikbj) {
         case "indie":
             return true;
     }
@@ -37,8 +51,8 @@ export function hasIndieLicense() {
 }
 
 /** @internal */
-export function hasEduLicense() {
-    switch (NEEDLE_ENGINE_LICENSE_TYPE) {
+export function rxRjHuj() {
+    switch (_PQYikbj) {
         case "edu":
             return true;
     }
@@ -46,20 +60,20 @@ export function hasEduLicense() {
 }
 
 /** @internal */
-export function hasCommercialLicense() {
-    return hasProLicense() || hasIndieLicense() || hasEduLicense();
+export function _BGpnKD() {
+    return UFadk() || __tFkl() || rxRjHuj();
 }
 
 
 /** @internal */
-export function onLicenseCheckResultChanged(cb: (result: boolean) => void) {
-    if (hasProLicense() || hasIndieLicense() || hasEduLicense())
+export function __pLOnb(cb: (result: boolean) => void) {
+    if (UFadk() || __tFkl() || rxRjHuj())
         return cb(true);
-    _licenseCheckResultChangedCallbacks.push(cb);
+    dXgxU.push(cb);
 }
 
-function invokeLicenseCheckResultChanged(result: boolean) {
-    for (const cb of _licenseCheckResultChangedCallbacks) {
+function _csklVr(result: boolean) {
+    for (const cb of dXgxU) {
         try {
             cb(result);
         }
@@ -70,6 +84,127 @@ function invokeLicenseCheckResultChanged(result: boolean) {
 }
 
 
+// #region JWT License Verification
+
+// ECDSA P-256 public key for verifying license JWTs (verification-only, safe to ship)
+/* eslint-disable no-secrets/no-secrets -- public key, not a secret */
+const _$OYBbo = {
+    kty: "EC",
+    crv: "P-256",
+    x: "A34nyKMjhQYVgzeE4tyLUYdx34TAKogDa7v7PRaO9Lg",
+    y: "JZI9IQavGCpGjEG_-pa0J-MHQYWJYINUM-MnvSu0TmE",
+} as const;
+/* eslint-enable no-secrets/no-secrets */
+
+/** Base64url decode (RFC 7515) */
+function base64urlDecode(str: string): Uint8Array {
+    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - base64.length % 4) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+
+/**
+ * Verify a JWT license token and return the `type` claim if valid.
+ * Returns null if the JWT is missing, malformed, or has an invalid signature.
+ */
+async function GTeeZaHi(jwt: string): Promise<string | null> {
+    if (!jwt) return null;
+    try {
+        const parts = jwt.split(".");
+        if (parts.length !== 3) return null;
+
+        const [headerB64, payloadB64, signatureB64] = parts;
+
+        const key = await crypto.subtle.importKey(
+            "jwk",
+            _$OYBbo,
+            { name: "ECDSA", namedCurve: "P-256" },
+            false,
+            ["verify"]
+        );
+
+        const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = base64urlDecode(signatureB64);
+
+        const valid = await crypto.subtle.verify(
+            { name: "ECDSA", hash: "SHA-256" },
+            key,
+            signature.buffer as ArrayBuffer,
+            signingInput
+        );
+
+        if (!valid) {
+            if (debug) console.warn("JWT: signature verification failed");
+            return null;
+        }
+
+        const payloadStr = new TextDecoder().decode(base64urlDecode(payloadB64));
+        const payload = JSON.parse(payloadStr);
+
+        if (typeof payload.type !== "string" || payload.type.length === 0) {
+            if (debug) console.warn("JWT: missing or invalid 'type' claim");
+            return null;
+        }
+
+        // Optional: check expiration if present (future-proof — server doesn't set this yet)
+        if (typeof payload.exp === "number") {
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            if (nowSeconds > payload.exp) {
+                if (debug) console.warn("JWT: token has expired (exp=" + payload.exp + ", now=" + nowSeconds + ")");
+                return null;
+            }
+        }
+
+        // Optional: check audience/domain if present (future-proof — server doesn't set this yet)
+        if (payload.aud) {
+            const currentHost = typeof window !== "undefined" ? window.location.hostname : undefined;
+            if (currentHost) {
+                const allowed = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+                if (!allowed.some((a: string) => currentHost === a || currentHost.endsWith("." + a))) {
+                    if (debug) console.warn("JWT: domain '" + currentHost + "' not in allowed audience: " + allowed.join(", "));
+                    return null;
+                }
+            }
+        }
+
+        if (debug) console.log("JWT: verified license type: " + payload.type);
+        return payload.type;
+    }
+    catch (err) {
+        if (debug) console.error("JWT: verification error", err);
+        return null;
+    }
+}
+
+/** Verify the injected JWT and update the license type if valid.
+ * The engine ONLY trusts the JWT — the plain _PQYikbj string is ignored. */
+let _jwtVerificationPromise: Promise<void> | undefined = undefined;
+async function $sATIKYrT(): Promise<void> {
+    if (!_$QHon) {
+        // No JWT present: license stays "basic" regardless of what _PQYikbj says
+        _PQYikbj = "basic";
+        return;
+    }
+    const verifiedType = await GTeeZaHi(_$QHon);
+    if (verifiedType) {
+        _PQYikbj = verifiedType;
+        if (debug) console.log("License type set from verified JWT: " + verifiedType);
+        _csklVr(_BGpnKD());
+    }
+    else {
+        // JWT present but invalid: reset to basic
+        _PQYikbj = "basic";
+        if (debug) console.warn("JWT verification failed — license reset to basic");
+    }
+}
+
+// #endregion JWT License Verification
+
 
 // #region Telemetry
 export namespace Telemetry {
@@ -135,7 +270,7 @@ export namespace Telemetry {
 
         const attribute = domElement?.getAttribute("no-telemetry");
         if (attribute === "" || attribute === "true" || attribute === "1") {
-            if (NEEDLE_ENGINE_LICENSE_TYPE === "pro" || NEEDLE_ENGINE_LICENSE_TYPE === "enterprise") {
+            if (_PQYikbj === "pro" || _PQYikbj === "enterprise") {
                 if (debug) console.debug("Telemetry is disabled via no-telemetry attribute");
                 return false;
             }
@@ -242,22 +377,29 @@ export namespace Telemetry {
 }
 
 
-export function initLicense() {
+export function rFPJwMWf() {
+    // Start JWT verification — must be here (not top-level) to avoid tree-shaking
+    _jwtVerificationPromise = $sATIKYrT();
+
     Telemetry.init();
     ContextRegistry.registerCallback(ContextEvent.ContextRegistered, evt => {
-        showLicenseInfo(evt.context);
-        handleForbidden(evt.context);
-        setTimeout(() => sendUsageMessageToAnalyticsBackend(evt.context), 2000);
+        __loEAQjNJ(evt.context);
+        __msk(evt.context);
+        setTimeout(() => $tlH(evt.context), 2000);
     });
 }
 
-export let runtimeLicenseCheckPromise: Promise<void> | undefined = undefined;
+export let _$YsQVksF: Promise<void> | undefined = undefined;
 let applicationIsForbidden = false;
 let applicationForbiddenText = "";
-async function checkLicense() {
+async function _fYB() {
     // Only perform the runtime license check once
-    if (runtimeLicenseCheckPromise) return runtimeLicenseCheckPromise;
-    if (NEEDLE_ENGINE_LICENSE_TYPE === "basic") {
+    if (_$YsQVksF) return _$YsQVksF;
+    // Wait for JWT verification to complete first (if running)
+    if (_jwtVerificationPromise) {
+        await _jwtVerificationPromise;
+    }
+    if (_PQYikbj === "basic") {
         try {
             const licenseUrl = "https://needle.tools/api/v1/needle-engine/check?location=" + encodeURIComponent(window.location.href) + "&version=" + VERSION + "&generator=" + encodeURIComponent(GENERATOR);
             const res = await fetch(licenseUrl, {
@@ -269,29 +411,29 @@ async function checkLicense() {
             if (res?.status === 200) {
                 applicationIsForbidden = false;
                 if (debug) console.log("License check succeeded");
-                NEEDLE_ENGINE_LICENSE_TYPE = "pro";
-                invokeLicenseCheckResultChanged(true);
+                _PQYikbj = "pro";
+                _csklVr(true);
             }
             else if (res?.status === 403) {
-                invokeLicenseCheckResultChanged(false);
+                _csklVr(false);
                 applicationIsForbidden = true;
                 applicationForbiddenText = await res.text();
             }
             else {
-                invokeLicenseCheckResultChanged(false);
+                _csklVr(false);
                 if (debug) console.log("License check failed with status " + res?.status);
             }
         }
         catch (err) {
-            invokeLicenseCheckResultChanged(false);
+            _csklVr(false);
             if (debug) console.error("License check failed", err);
         }
     }
-    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + NEEDLE_ENGINE_LICENSE_TYPE + "\"");
+    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + _PQYikbj + "\"");
 }
-runtimeLicenseCheckPromise = checkLicense();
+_$YsQVksF = _fYB();
 
-async function handleForbidden(ctx: IContext) {
+async function __msk(ctx: IContext) {
     function createForbiddenElement() {
         const div = document.createElement("div");
         div.className = "needle-forbidden";
@@ -356,40 +498,40 @@ async function handleForbidden(ctx: IContext) {
     }, 500)
 }
 
-async function showLicenseInfo(ctx: IContext) {
+async function __loEAQjNJ(ctx: IContext) {
     try {
-        if (!hasProLicense() && !hasIndieLicense()) {
-            return onNonCommercialVersionDetected(ctx);
+        if (!UFadk() && !__tFkl()) {
+            return __pJSUSLs(ctx);
         }
     }
     catch (err) {
         if (debug) console.log("License check failed", err)
-        return onNonCommercialVersionDetected(ctx)
+        return __pJSUSLs(ctx)
     }
-    if (debug) onNonCommercialVersionDetected(ctx)
+    if (debug) __pJSUSLs(ctx)
 }
 
 
 
-async function onNonCommercialVersionDetected(ctx: IContext) {
+async function __pJSUSLs(ctx: IContext) {
 
     // if the engine loads faster than the license check, we need to capture the ready event here
     let isReady = false;
     ctx.domElement.addEventListener("ready", () => isReady = true);
 
-    await runtimeLicenseCheckPromise?.catch(() => { });
+    await _$YsQVksF?.catch(() => { });
 
 
-    if (hasProLicense() || hasIndieLicense()) return;
-    if (hasCommercialLicense() === false) logNonCommercialUse();
+    if (UFadk() || __tFkl()) return;
+    if (_BGpnKD() === false) _ArTbiTUU();
 
     // check if the engine is already ready (meaning has finished loading)
     if (isReady) {
-        insertNonCommercialUseHint(ctx);
+        _$gRXdD(ctx);
     }
     else {
         ctx.domElement.addEventListener("ready", () => {
-            insertNonCommercialUseHint(ctx);
+            _$gRXdD(ctx);
         });
     }
 }
@@ -397,7 +539,7 @@ async function onNonCommercialVersionDetected(ctx: IContext) {
 // const licenseElementIdentifier = "needle-license-element";
 // const licenseDuration = 10000;
 // const licenseDelay = 1200;
-function insertNonCommercialUseHint(ctx: IContext) {
+function _$gRXdD(ctx: IContext) {
 
     const style = `
         position: relative;
@@ -410,7 +552,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
         padding: 10px;
         padding-left: 30px;
     `;
-    if (NEEDLE_ENGINE_LICENSE_TYPE === "edu") {
+    if (_PQYikbj === "edu") {
         if (navigator.webdriver) {
             console.log("This project is supported by Needle for Education – https://needle.tools");
         }
@@ -467,7 +609,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
         }
     }, 1000);
 
-    if (hasEduLicense()) {
+    if (rxRjHuj()) {
         const removeDelay = 20_000;
         setTimeout(() => {
             clearInterval(interval);
@@ -476,7 +618,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
             const intervalInMinutes = 5;
             setTimeout(() => {
                 if (ctx.domElement.parentNode)
-                    insertNonCommercialUseHint(ctx);
+                    _$gRXdD(ctx);
             }, 1000 * 60 * intervalInMinutes)
         }, removeDelay);
     }
@@ -487,7 +629,7 @@ function insertNonCommercialUseHint(ctx: IContext) {
 const base64Logo = "data:image/webp;base64,UklGRrABAABXRUJQVlA4WAoAAAAQAAAAHwAAHwAAQUxQSKEAAAARN6CmbSM4WR7vdARON11EBDq3fLiNbVtVzpMCPlKAEzsx0Y/x+Ovuv4dn0EFE/ydAvz6YggXzgh5sVgXM/zOC/4sii7qgGvB5N7hmuQYwkvazWAu1JPW41FXSHq6pnaQWvqYH18Fc0j1hO/BFTtIeSBlJi5w6qIIO7IOrwhFsB2Yxukif0FTRLpXswHR8MxbslKe9VZsn/Ub5C7YFOpqSTABWUDgg6AAAAFAGAJ0BKiAAIAA+7VyoTqmkpCI3+qgBMB2JbACdMt69DwMIQBLhkTO6XwY00UEDK6cNIDnuNibPf0EgAP7Y1myuiQHLDsF/0h5unrGh6WAbv7aegg2ZMd3uRKfT/3SJztcaujYfTvMXspfCTmYcoO6a+vhC3ss4M8uM58t4siiu59I4aOl59e9Sr6xoxYlHf2v+NnBNpJYeJf8jABQAId/PXuBkLEFkiCucgSGEcfhvajql/j3reCGl0M5/9gQWy7ayNPs+wlvIxFnNfSlfuND4CZOCyxOHhRqOmHN4ULHo3tCSrUNvgAA=";
 
 let lastLogTime = 0;
-async function logNonCommercialUse(_logo?: string) {
+async function _ArTbiTUU(_logo?: string) {
     const now = Date.now();
     if (now - lastLogTime < 2000) return;
     lastLogTime = now;
@@ -520,7 +662,7 @@ async function logNonCommercialUse(_logo?: string) {
 }
 
 
-async function sendUsageMessageToAnalyticsBackend(context: IContext) {
+async function $tlH(context: IContext) {
     // We can't send beacons from cross-origin isolated pages
     if (window.crossOriginIsolated) return;
 
@@ -535,7 +677,7 @@ async function sendUsageMessageToAnalyticsBackend(context: IContext) {
 
             // current url without query parameters
             const currentUrl = window.location.href.split("?")[0];
-            const license = NEEDLE_ENGINE_LICENSE_TYPE;
+            const license = _PQYikbj;
 
             const beaconData = {
                 license,

package/src/engine/engine_mainloop_utils.ts

@@ -344,8 +344,11 @@ function updateIsActiveInHierarchyRecursiveRuntime(go: Object3D, activeInHierarc
         if (allowEventCall) {
             const components = go.userData?.components;
             if (components) {
-                for (let ci = components.length - 1, cl = -1; ci > cl; ci--) {
-                    const comp = components[ci];
+                // We need to iterate on components in the original order right now to work-around UI related initialization bugs where RectTransform must be initialized before e.g. Graphic components. https://linear.app/needle/issue/NE-6986
+                // In the future we can reverse iterate this once the UI system has been replaced (that being said it's probably expected that component enable in the order in which they're added to an object)
+                const componentsCopy = [...components];
+                for (let ci = 0; ci < componentsCopy.length; ci++) {
+                    const comp = componentsCopy[ci];
                     if (activeInHierarchy) {
                         if (comp?.enabled) {
                             try { comp.__internalAwake(); }
@@ -357,8 +360,8 @@ function updateIsActiveInHierarchyRecursiveRuntime(go: Object3D, activeInHierarc
                     }
                     else if(comp) {
                         if (comp["__didAwake"] && comp.enabled) {
-                            comp["__didEnable"] = false;
-                            comp.onDisable();
+                            // autoCleanup uses __internalDisable; isRemovingFromScene=true preserves __isEnabled
+                            comp.__internalDisable(true);
                         }
                     }
                 }

package/src/engine/engine_networking.transport.websocket.ts

@@ -0,0 +1,45 @@
+import type { INetworkTransport } from './engine_networking_types.js';
+
+/** Default transport that wraps the `websocket-ts` library */
+export class WebsocketTransport implements INetworkTransport {
+    private _url: string;
+    private _ws: import('websocket-ts').Websocket | undefined;
+
+    onOpen: (() => void) | null = null;
+    onClose: (() => void) | null = null;
+    onError: ((err: any) => void) | null = null;
+    onMessage: ((data: string | Blob) => void) | null = null;
+
+    get url() { return this._ws?.url ?? this._url; }
+
+    constructor(url: string) {
+        this._url = url;
+    }
+
+    async start() {
+        const pkg = await import('websocket-ts');
+        // @ts-ignore
+        const WebsocketBuilder = pkg.default?.WebsocketBuilder ?? pkg.WebsocketBuilder;
+        const ExponentialBackoff = pkg.default?.ExponentialBackoff ?? pkg.ExponentialBackoff;
+        const ws = new WebsocketBuilder(this._url)
+            .withMaxRetries(10)
+            .withBackoff(new ExponentialBackoff(2000, 4))
+            .onOpen(() => { this._ws = ws; this.onOpen?.(); })
+            .onClose(() => { this.onClose?.(); })
+            .onError(() => { this.onError?.(new Error("Websocket connection failed")); })
+            .onRetry(() => { console.log("Retry connecting to networking websocket"); })
+            .build();
+        ws.addEventListener(pkg.WebsocketEvent.message, (_, msg) => {
+            this.onMessage?.(msg.data);
+        });
+    }
+
+    send(data: string | Uint8Array) {
+        this._ws?.send(data);
+    }
+
+    close() {
+        this._ws?.close();
+        this._ws = undefined;
+    }
+}